diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 31fd088d324..189428c47fe 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -56,17 +56,15 @@ CI enforces this for `src/preload/` and `src/shared/` — see `docs/preload-type
 
 ## Pull Requests
 
-Each pull request should:
+Each pull request should follow [`.github/pull_request_template.md`](./pull_request_template.md). In particular:
 
-- explain the user-visible change
-- stay focused on a single topic when possible
-- include screenshots or screen recordings for new UI or behavior changes
+- open with an ELI5 of the change (plain language paragraph; the PR title is the one-liner)
+- explain what changed and why, and stay focused on a single topic when possible
+- for any UI or interaction change, attach **before and after** screenshots (or short videos); if there is no visual change, say `No visual change` and why
 - include high-quality tests when behavior changes or bug fixes warrant them
 - include a brief code review summary from your AI coding agent that explicitly checks cross-platform compatibility, SSH/remote/local compatibility, supported agent and integration compatibility, performance risk, UI quality when applicable, and basic security risk
 - mention any platform-specific, remote/SSH-specific, agent-specific, integration-specific, or git-provider-specific behavior and testing notes
-- **Include your X (Twitter) handle!** We love giving shoutouts to our contributors when we merge features on [@orca_build](https://x.com/orca_build).
-
-If there is no visual change, say that explicitly in the PR description.
+- **Include your X (Twitter) handle** in the PR template Author section — we shout out contributors when we merge features on [@orca_build](https://x.com/orca_build).
 
 ## Release Process
 
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index b69e2dcc233..d620ad7c92c 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,29 +1,51 @@
-## Summary
+## ELI5
 
-Describe the user-visible change.
+<!-- Simple high-level explanation -->
 
-## Screenshots
+## What Changed
 
-- Add screenshots or a screen recording for any new or changed UI behavior.
-- If there is no visual change, say `No visual change`.
+<!-- Describe the change clearly and keep scope tight. -->
+
+## Why
+
+<!-- What problem does this solve, and why is this approach right? -->
+
+## Linked Issue
+
+<!-- Link the issue this PR addresses, there should ALWAYS be one -->
+
+Fixes #
+
+## Visual Proof
+<!-- REQUIRED for UI / behavior changes. Please attach a BEFORE and AFTER that can easily tabbed/switched. Use videos for when appropriate over screenshots -->
+<!-- If there is truly no visual or interaction change, write exactly: `N/A` and briefly say why. -->
+<!-- For attachments NEVER add directly to the PR files (do not commit to files), use `gh image` extension or drag + drop (works for any attachment) -->
 
 ## Testing
 
-- [ ] `pnpm lint`
-- [ ] `pnpm typecheck`
-- [ ] `pnpm test`
-- [ ] `pnpm build`
-- [ ] Added or updated high-quality tests that would catch regressions, or explained why tests were not needed
+<!-- How did you verify this? Steps a reviewer can follow. Which platforms did you actually test (macOS / Linux / Windows / SSH)? -->
 
-## AI Review Report
+- [ ] I manually tested these changes locally
+- [ ] Automated tests added/updated, or explained why not below
 
-Summarize the code review you ran with your AI coding agent. Include the main risks it checked, what it flagged, and what you changed or verified as a result.
-Confirm that the review explicitly checked cross-platform compatibility for macOS, Linux, and Windows, including shortcuts, labels, paths, shell behavior, and any Electron-specific platform differences touched by this PR.
 
-## Security Audit
+## AI Disclosure
+<!-- For all external contributors only: Which AI model if anyone was used, please state the details -->
 
-Provide a basic security audit summary from your AI coding agent. Call out any input handling, command execution, path handling, auth, secrets, dependency, or IPC risks that were reviewed, plus any follow-up needed.
+## Review
 
-## Notes
+Ensure no issues in: Security, Cross-platoform support (Linux, Windows, Mac), Remote SSH, Mobile, general backwards compatibility, performance
 
-Call out any platform-specific behavior, risks, or follow-up work.
+## Checklist
+
+- [ ] This PR is small and focused
+- [ ] I explained what changed and why (including ELI5)
+- [ ] Before/after screenshots or videos attached for UI changes, or `N/A` with reason
+- [ ] Self-reviewed for correctness, security, and performance
+- [ ] Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
+- [ ] `pnpm lint`, `pnpm typecheck`, `pnpm test`, and `pnpm build` pass (or CI will cover; local preferred)
+
+## Author
+
+- X / Twitter: @your_handle
+  <!-- Optional but appreciated -->
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 05a73229d69..3c9678a5a8d 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -176,6 +176,12 @@ jobs:
   shell_contracts:
     name: shell contracts
     runs-on: ubuntu-latest
+    env:
+      # Why: the suites below gate their live fish tests on the binary, which is
+      # right on a developer machine and wrong here — this job is a required check
+      # and its fish lane is the only end-to-end guard for #9993, so a skip would
+      # report green with nothing exercised. Turns those skips into failures.
+      ORCA_REQUIRE_FISH: '1'
 
     steps:
       - name: Checkout
@@ -186,8 +192,46 @@ jobs:
       # Why fish: shell-ready.test.ts gates its live fish test on the binary being
       # present, so without this the fish barrier is only covered by config-shape
       # assertions and never actually exercised.
+      # Why release-4: DECSET 2031 arming lives in the fish 4.0 Rust tty_handoff, and
+      # fish-color-scheme-child-stdin.node-pty.test.ts (#9993) needs it. Noble ships
+      # 3.7, so the PPA is what makes that lane real.
       - name: Install zsh and fish
-        run: sudo apt-get update && sudo apt-get install -y zsh fish
+        run: |
+          # Why the update/PPA/fish steps are tolerant: a repo the runner image already
+          # ships can lack a Release file for this suite, and a failed add-apt-repository
+          # still leaves its list entry behind — either makes `apt-get update` exit
+          # non-zero and would red this required check over something unrelated to the
+          # PR. Every fish outcome is judged by the version gate below instead, so only
+          # the zsh install (which has no such gate) stays fatal here.
+          sudo apt-get update || true
+          # Why retry only here: adding the PPA is the network-flaky step, and the
+          # version gate below is fatal, so a transient Launchpad blip would
+          # otherwise red a required check on PRs unrelated to shells.
+          for attempt in 1 2 3; do
+            sudo add-apt-repository -y ppa:fish-shell/release-4 && break
+            echo "add-apt-repository attempt ${attempt} failed; retrying" >&2
+            sudo add-apt-repository -y -r ppa:fish-shell/release-4 || true
+            sleep 5
+          done
+          sudo apt-get update || true
+          # Why both shells on one line: pr-workflow-parallelism.test.mjs parses only the
+          # first install command in this step to prove the lane really installs them.
+          sudo apt-get install -y zsh fish
+
+      # Separate from the install so the failure names the contract, not an apt error.
+      # ORCA_REQUIRE_FISH re-checks this at test time; this step just fails in seconds
+      # instead of after a full dependency install.
+      - name: Require fish 4+
+        run: |
+          version="$(fish --version 2>/dev/null || true)"
+          major="${version##*version }"
+          major="${major%%.*}"
+          case "$major" in '' | *[!0-9]*) major=0 ;; esac
+          echo "${version:-<fish not installed>}"
+          if [ "$major" -lt 4 ]; then
+            echo "::error::shell contracts needs fish 4+ (DECSET 2031 arming, #9993) but got '${version:-none}'. Fix the ppa:fish-shell/release-4 install rather than letting the fish lane skip." >&2
+            exit 1
+          fi
 
       - uses: ./.github/actions/install-node-dependencies
         with:
@@ -195,12 +239,14 @@ jobs:
 
       - name: Test real shell contracts
         run: |
-          pnpm exec vitest run --config config/vitest.config.ts \
+          pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
+            src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts \
             src/main/daemon/shell-ready.test.ts \
             src/main/daemon/node-pty-fd-leak.test.ts \
             src/main/providers/local-pty-shell-ready.test.ts \
             src/main/providers/__tests__/shell-ready-framework-example.test.ts \
             src/main/pty/omp-shell-wrapper.node-pty.test.ts \
+            src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts \
             src/shared/posix-command-path-lookup.test.ts
 
   test:
@@ -230,11 +276,13 @@ jobs:
       - name: Test shard
         run: |
           pnpm exec vitest run --config config/vitest.config.ts \
+            --exclude=src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts \
             --exclude=src/main/daemon/shell-ready.test.ts \
             --exclude=src/main/daemon/node-pty-fd-leak.test.ts \
             --exclude=src/main/providers/local-pty-shell-ready.test.ts \
             --exclude=src/main/providers/__tests__/shell-ready-framework-example.test.ts \
             --exclude=src/main/pty/omp-shell-wrapper.node-pty.test.ts \
+            --exclude=src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts \
             --exclude=src/shared/posix-command-path-lookup.test.ts \
             --exclude=tests/e2e/cross-version-wire/** \
             --shard=${{ matrix.shard }}/${{ matrix.shard_total }}
@@ -378,6 +426,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Test Windows PowerShell CLI boundary
+        run: pnpm exec vitest run --config config/vitest.config.ts src/main/cli/wsl-cli-powershell-boundary.test.ts
+
       - name: Build package inputs
         run: pnpm run build:release
 
diff --git a/.github/workflows/release-policy.yml b/.github/workflows/release-policy.yml
new file mode 100644
index 00000000000..8014145939b
--- /dev/null
+++ b/.github/workflows/release-policy.yml
@@ -0,0 +1,98 @@
+name: Release Policy
+
+on:
+  release:
+    types:
+      - published
+      - edited
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-policy
+  cancel-in-progress: false
+
+jobs:
+  enforce:
+    if: github.repository == 'stablyai/orca'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Enforce release policy
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const release = context.payload.release;
+            const tag = release.tag_name;
+            const author = release.author?.login;
+            const number = "(?:0|[1-9][0-9]*)";
+            const version = `${number}\\.${number}\\.${number}`;
+            const stableTag = new RegExp(`^v${version}$`);
+            const prereleaseTag = new RegExp(
+              `^(?:v${version}-rc\\.${number}(?:\\.[0-9A-Za-z]+)?|mobile(?:-android)?-v${version})$`,
+            );
+            const expectedPrerelease = prereleaseTag.test(tag);
+            const allowed = author === "github-actions[bot]" &&
+              (stableTag.test(tag) || expectedPrerelease);
+            const { owner, repo } = context.repo;
+
+            async function restoreLatestStable() {
+              const releases = await github.paginate(github.rest.repos.listReleases, {
+                owner,
+                repo,
+                per_page: 100,
+              });
+              const stable = releases
+                .filter((candidate) =>
+                  !candidate.draft &&
+                  !candidate.prerelease &&
+                  candidate.author?.login === "github-actions[bot]" &&
+                  stableTag.test(candidate.tag_name),
+                )
+                .sort((left, right) => {
+                  const a = left.tag_name.slice(1).split(".").map(Number);
+                  const b = right.tag_name.slice(1).split(".").map(Number);
+                  return a.reduce((result, part, index) => result || part - b[index], 0);
+                })
+                .at(-1);
+              if (stable) {
+                await github.rest.repos.updateRelease({
+                  owner,
+                  repo,
+                  release_id: stable.id,
+                  make_latest: "true",
+                });
+              }
+            }
+
+            if (allowed) {
+              if (release.prerelease !== expectedPrerelease) {
+                await github.rest.repos.updateRelease({
+                  owner,
+                  repo,
+                  release_id: release.id,
+                  prerelease: expectedPrerelease,
+                  make_latest: expectedPrerelease ? "false" : "legacy",
+                });
+              }
+              await restoreLatestStable();
+              return;
+            }
+
+            await github.rest.repos.updateRelease({
+              owner,
+              repo,
+              release_id: release.id,
+              draft: true,
+              prerelease: true,
+              make_latest: "false",
+            });
+            await restoreLatestStable();
+            await github.rest.repos.deleteRelease({ owner, repo, release_id: release.id });
+            try {
+              await github.rest.git.deleteRef({ owner, repo, ref: `tags/${tag}` });
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+            core.warning(`Deleted unauthorized release ${tag} created by ${author || "unknown"}.`);
diff --git a/.github/workflows/win-crash-survival-e2e.yml b/.github/workflows/win-crash-survival-e2e.yml
index fb1d63a440a..8a645fd8ef8 100644
--- a/.github/workflows/win-crash-survival-e2e.yml
+++ b/.github/workflows/win-crash-survival-e2e.yml
@@ -77,7 +77,6 @@ jobs:
               '!config/reliability-gates.jsonc',
               '!config/max-lines-baseline.txt',
               '!config/vitest.config.ts',
-              'config/build-plugins/**',
               'native/**',
               'resources/**',
               'electron.vite.config.ts',
diff --git a/.gitignore b/.gitignore
index fc40e495e7a..64854199a35 100644
--- a/.gitignore
+++ b/.gitignore
@@ -94,6 +94,7 @@ docs/**
 !docs/readme/
 !docs/readme/**
 !docs/STYLEGUIDE.md
+!docs/ai-vault-process-isolation-plan.md
 !docs/mobile-terminal-shortcut-bar.md
 !docs/reference/
 !docs/reference/git-compatibility.md
@@ -101,6 +102,7 @@ docs/**
 !docs/reference/linux-glibc-compatibility.md
 !docs/reference/relay-grace-time-reconfiguration.md
 !docs/reference/remote-wire-compatibility.md
+!docs/reference/renderer-agent-status-performance.md
 !docs/reference/windows-setup-shell.md
 
 # Stably CLI (only docs/ are tracked)
diff --git a/.oxlintrc.json b/.oxlintrc.json
index 0f679f17d52..97a2b68701a 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -56,6 +56,7 @@
     "react-hooks/rules-of-hooks": "error",
     "react-hooks/exhaustive-deps": "warn",
     "typescript/array-type": "error",
+    "typescript/consistent-generic-constructors": "error",
     "typescript/consistent-indexed-object-style": "error",
     "typescript/consistent-type-assertions": "error",
     "typescript/consistent-type-definitions": ["error", "type"],
@@ -68,12 +69,16 @@
     "typescript/prefer-function-type": "error",
     "typescript/prefer-includes": "error",
     "typescript/prefer-optional-chain": "error",
+    "typescript/prefer-ts-expect-error": "error",
     "typescript/switch-exhaustiveness-check": [
       "error",
       { "allowDefaultCaseForExhaustiveSwitch": false }
     ],
     "curly": "error",
     "no-unneeded-ternary": "error",
+    "no-else-return": "error",
+    "prefer-exponentiation-operator": "error",
+    "prefer-object-has-own": "error",
     "no-restricted-imports": [
       "error",
       {
@@ -90,11 +95,16 @@
     "no-useless-return": "error",
     "prefer-template": "error",
     "unicorn/consistent-empty-array-spread": "error",
+    "unicorn/consistent-existence-index-check": "error",
+    "unicorn/empty-brace-spaces": "error",
     "unicorn/error-message": "error",
     "unicorn/no-array-fill-with-reference-type": "warn",
     "unicorn/no-array-reverse": "error",
     "unicorn/no-instanceof-builtins": "error",
+    "unicorn/no-typeof-undefined": "error",
+    "unicorn/no-unnecessary-array-splice-count": "error",
     "unicorn/no-useless-promise-resolve-reject": "error",
+    "unicorn/no-zero-fractions": "error",
     "unicorn/prefer-array-find": "error",
     "unicorn/prefer-array-flat-map": "warn",
     "unicorn/prefer-array-index-of": "error",
diff --git a/AGENTS.md b/AGENTS.md
index 67bcd37a538..58698e46a2e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,6 +2,10 @@
 
 All UI work — layout, color, typography, spacing, component selection, UX behavior — must follow [`docs/STYLEGUIDE.md`](./docs/STYLEGUIDE.md). Use the tokens defined in `src/renderer/src/assets/main.css` (the canonical source) and the shadcn primitives in `src/renderer/src/components/ui/`. Don't invent new color values, font sizes, or shadow tiers when a documented one already covers the role. When STYLEGUIDE.md is silent, follow the resolution order in its final section.
 
+## Electron UI Validation
+
+Use the `$electron` skill and Playwright CDP for rendered Orca UI checks. Do not use computer-use for Orca UI validation.
+
 # Style
 ## Concise/Brief Non-obviosu comments ONLY
   * DO NOT: be verbose, explain the obvious, walk through the code ("WHY not HOW")
diff --git a/README.md b/README.md
index 670b54e2835..b679cb95c3d 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,7 @@
 
 Monitor and steer your agents from your phone — get notified when an agent finishes and send follow-ups from anywhere.
 
-[iOS App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) · [TestFlight](https://testflight.apple.com/join/YjeGMQBA) · [Android APK 0.0.37](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.37/app-release.apk) · [Docs →](https://www.onorca.dev/docs/mobile)
+[iOS App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) · [TestFlight](https://testflight.apple.com/join/YjeGMQBA) · [Android APK 0.0.42](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.42/app-release.apk) · [Docs →](https://www.onorca.dev/docs/mobile)
 
 </td>
 <td width="50%">
@@ -230,7 +230,7 @@ yay -S stably-orca-bin
 Pair with your desktop app to monitor and steer your agents from your phone.
 
 - **iOS:** [Download on the App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) or [join TestFlight](https://testflight.apple.com/join/YjeGMQBA)
-- **Android:** [Download APK 0.0.37](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.37/app-release.apk)
+- **Android:** [Download APK 0.0.42](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.42/app-release.apk)
 
 ---
 
diff --git a/config/build-plugins/plain-node-entry-guard.ts b/config/build-plugins/plain-node-entry-guard.ts
index b4b86a31c31..45d34b944f7 100644
--- a/config/build-plugins/plain-node-entry-guard.ts
+++ b/config/build-plugins/plain-node-entry-guard.ts
@@ -1,7 +1,8 @@
-import { spawnSync } from 'node:child_process'
+import { spawn } from 'node:child_process'
 import { join } from 'node:path'
 import type { Plugin, Rollup } from 'vite'
 
+type NormalizedInputOptions = Rollup.NormalizedInputOptions
 type NormalizedOutputOptions = Rollup.NormalizedOutputOptions
 type OutputBundle = Rollup.OutputBundle
 type OutputChunk = Rollup.OutputChunk
@@ -42,9 +43,34 @@ const WORKER_THREAD_ENTRY_NAMES = [
   'port-scan-command-worker-entry'
 ] as const
 
+export const GUARDED_ENTRY_NAMES = [
+  ...PLAIN_NODE_ENTRY_NAMES,
+  ...WORKER_THREAD_ENTRY_NAMES
+] as const
+
 type EntryRuntime = 'plain-Node process' | 'worker thread'
 
-const ELECTRON_REQUIRE_RE = /require\(\s*["']electron["']\s*\)/
+// Subpaths (electron/main) are as unloadable as the bare module under plain Node.
+const ELECTRON_REQUIRE_RE = /require\(\s*["'`]electron(?:\/[^"'`]+)?["'`]\s*\)/
+
+// Why: writeBundle skips any name missing from the bundle, so a renamed or
+// removed rollup input would silently drop that entry from the guard and let the
+// regression back in. Pin the lists to the input keys at build start instead.
+function assertEntryNamesAreRollupInputs(input: NormalizedInputOptions['input']): void {
+  if (typeof input === 'string' || Array.isArray(input)) {
+    return
+  }
+  const inputNames = new Set(Object.keys(input))
+  const missing = GUARDED_ENTRY_NAMES.filter((name) => !inputNames.has(name))
+  if (missing.length > 0) {
+    throw new Error(
+      `[plain-node-entry-guard] guarded ${missing.map((name) => `"${name}"`).join(', ')} ` +
+        `${missing.length === 1 ? 'is not a rollup input' : 'are not rollup inputs'} anymore. ` +
+        `Update PLAIN_NODE_ENTRY_NAMES/WORKER_THREAD_ENTRY_NAMES in plain-node-entry-guard.ts to ` +
+        `the current entry names — a stale name silently stops guarding that entry.`
+    )
+  }
+}
 
 function collectReachableChunks(
   entry: OutputChunk,
@@ -89,41 +115,125 @@ function assertNoElectronRequire(
   }
 }
 
+// Owned by the argv parser in src/main/daemon/daemon-entry.ts — keep in sync.
+const DAEMON_USAGE_PREFIX = 'Usage: daemon-entry'
+
+export type SmokeTimings = {
+  timeoutMs: number
+  // daemon-entry traps SIGTERM and awaits a native shutdown, so the deadline
+  // needs an uncatchable follow-up to stay a deadline.
+  killGraceMs: number
+}
+
+const DEFAULT_SMOKE_TIMINGS: SmokeTimings = { timeoutMs: 15_000, killGraceMs: 2_000 }
+
+// Bound the wait for stderr to flush after exit; a grandchild inheriting stdio
+// can hold the pipes open long after the child is gone.
+const SMOKE_STDERR_DRAIN_MS = 250
+
+type SmokeResult = {
+  status: number | null
+  signal: NodeJS.Signals | null
+  stderr: string
+  error?: Error
+  timedOut: boolean
+}
+
+// Why not spawnSync({ timeout }): its timeout only sends killSignal and then
+// keeps blocking until the child exits, so a child that traps SIGTERM hangs the
+// build forever. Escalate to SIGKILL instead.
+function runDaemonEntry(entryPath: string, timings: SmokeTimings): Promise<SmokeResult> {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, [entryPath], { stdio: ['ignore', 'ignore', 'pipe'] })
+    let stderr = ''
+    let timedOut = false
+    let settled = false
+    let forceKillTimer: NodeJS.Timeout | undefined
+    let drainTimer: NodeJS.Timeout | undefined
+
+    child.stderr.setEncoding('utf8')
+    child.stderr.on('data', (chunk: string) => {
+      stderr += chunk
+    })
+
+    const deadlineTimer = setTimeout(() => {
+      timedOut = true
+      child.kill('SIGTERM')
+      forceKillTimer = setTimeout(() => child.kill('SIGKILL'), timings.killGraceMs)
+    }, timings.timeoutMs)
+
+    const finish = (status: number | null, signal: NodeJS.Signals | null, error?: Error): void => {
+      if (settled) {
+        return
+      }
+      settled = true
+      clearTimeout(deadlineTimer)
+      clearTimeout(forceKillTimer)
+      clearTimeout(drainTimer)
+      resolve({ status, signal, stderr, error, timedOut })
+    }
+
+    child.on('error', (error: Error) => finish(null, null, error))
+    // 'close' gives the full stderr; 'exit' is the fallback so a held-open pipe
+    // cannot outlast the process itself.
+    child.on('close', (status, signal) => finish(status, signal))
+    child.on('exit', (status, signal) => {
+      drainTimer = setTimeout(() => finish(status, signal), SMOKE_STDERR_DRAIN_MS)
+    })
+  })
+}
+
 // Why: proves the whole daemon-entry graph resolves under plain Node (no
 // unresolved requires). require("electron") does not throw in a dev tree with
 // node_modules present, so the static scan above — not this smoke — is the
 // electron regression guard; this only catches gross load failures.
-function smokeLoadDaemonEntry(outputDir: string): void {
+async function smokeLoadDaemonEntry(outputDir: string, timings: SmokeTimings): Promise<void> {
   const entryPath = join(outputDir, 'daemon-entry.js')
-  const result = spawnSync(process.execPath, [entryPath], {
-    encoding: 'utf8',
-    timeout: 15_000
-  })
+  const result = await runDaemonEntry(entryPath, timings)
   if (result.error) {
     throw new Error(
       `[plain-node-entry-guard] could not smoke-load daemon-entry.js under plain Node: ` +
         `${result.error.message}`
     )
   }
-  const stderr = result.stderr ?? ''
+  // Almost always means the daemon stopped rejecting an empty argv and started
+  // listening instead.
+  if (result.timedOut) {
+    throw new Error(
+      `[plain-node-entry-guard] daemon-entry.js did not exit within ${timings.timeoutMs}ms on an ` +
+        `empty argv under plain Node, so the smoke killed it.`
+    )
+  }
+  if (result.signal) {
+    throw new Error(
+      `[plain-node-entry-guard] daemon-entry.js was killed by ${result.signal} under plain Node.`
+    )
+  }
+  const stderr = result.stderr
   if (/Cannot find module|MODULE_NOT_FOUND/.test(stderr)) {
     throw new Error(
       `[plain-node-entry-guard] daemon-entry.js failed to load under plain Node:\n${stderr}`
     )
   }
-  if (!stderr.includes('Usage: daemon-entry')) {
+  if (result.status === 0 || !stderr.includes(DAEMON_USAGE_PREFIX)) {
     throw new Error(
-      `[plain-node-entry-guard] daemon-entry.js did not reach argv parsing under plain Node ` +
-        `(expected the "Usage: daemon-entry" error). stderr:\n${stderr}`
+      `[plain-node-entry-guard] daemon-entry.js did not reject an empty argv under plain Node ` +
+        `(expected a non-zero exit and the "${DAEMON_USAGE_PREFIX}" error, got exit ` +
+        `${result.status}). stderr:\n${stderr}`
     )
   }
 }
 
-export function createPlainNodeEntryGuardPlugin(): Plugin {
+export function createPlainNodeEntryGuardPlugin(
+  smokeTimings: SmokeTimings = DEFAULT_SMOKE_TIMINGS
+): Plugin {
   let daemonOutputDir: string | undefined
 
   return {
     name: 'orca-plain-node-entry-guard',
+    buildStart(options: NormalizedInputOptions) {
+      assertEntryNamesAreRollupInputs(options.input)
+    },
     writeBundle(options: NormalizedOutputOptions, bundle: OutputBundle) {
       // Why: skip in `electron-vite dev` watch mode — the smoke would respawn on
       // every rebuild, and the guard only needs to gate produced builds.
@@ -159,11 +269,11 @@ export function createPlainNodeEntryGuardPlugin(): Plugin {
         daemonOutputDir = options.dir
       }
     },
-    closeBundle() {
+    async closeBundle() {
       if (daemonOutputDir) {
         const outputDir = daemonOutputDir
         daemonOutputDir = undefined
-        smokeLoadDaemonEntry(outputDir)
+        await smokeLoadDaemonEntry(outputDir, smokeTimings)
       }
     }
   }
diff --git a/config/electron-builder.config.cjs b/config/electron-builder.config.cjs
index 9933df8156e..b01c26997e1 100644
--- a/config/electron-builder.config.cjs
+++ b/config/electron-builder.config.cjs
@@ -166,6 +166,12 @@ module.exports = {
   // Why: sherpa-onnx native bindings (platform-specific subpackages) must be
   // unpacked because they ship .node addons + .dylib/.so files that cannot be
   // dlopen()'d from inside the asar archive.
+  // Why: the OpenCode SQLite worker entry is also spawned by the scanner
+  // service, which runs under ELECTRON_RUN_AS_NODE and so cannot see into
+  // app.asar. Left packed, that spawn fails closed and every OpenCode session
+  // disappears from Agent Session History in packaged builds only. Worker
+  // entries reached solely from the Electron main process stay packed, since
+  // asar redirects their app.asar paths.
   asarUnpack: [
     'out/package.json',
     'out/cli/**',
@@ -182,6 +188,8 @@ module.exports = {
     'out/main/grok/**',
     'out/main/hermes/**',
     'out/main/daemon-entry.js',
+    'out/main/session-scanner-service-entry.js',
+    'out/main/session-scanner-opencode-sqlite-worker-entry.js',
     'out/main/plugin-host-entry.js',
     'out/main/computer-sidecar.js',
     'out/main/parcel-watcher-process-entry.js',
diff --git a/config/electron-vite-target.config.ts b/config/electron-vite-target.config.ts
index 60651dd6590..490fa654f5b 100644
--- a/config/electron-vite-target.config.ts
+++ b/config/electron-vite-target.config.ts
@@ -8,7 +8,7 @@ const configByTarget = {
   renderer: { renderer: electronViteConfig.renderer }
 }
 
-if (!target || !Object.prototype.hasOwnProperty.call(configByTarget, target)) {
+if (!target || !Object.hasOwn(configByTarget, target)) {
   throw new Error(`Invalid ORCA_ELECTRON_VITE_TARGET: ${target ?? '<unset>'}`)
 }
 
diff --git a/config/localization-coverage-allowlist.json b/config/localization-coverage-allowlist.json
index b37d3374bf5..1f445997bda 100644
--- a/config/localization-coverage-allowlist.json
+++ b/config/localization-coverage-allowlist.json
@@ -1,13 +1,6 @@
 [
   {
-    "filePath": "src/renderer/src/lib/agent-background-session-test-state.ts",
-    "kind": "object-property:title",
-    "text": "Terminal 1",
-    "dynamic": false,
-    "count": 1
-  },
-  {
-    "filePath": "src/renderer/src/components/sidebar/WorktreeCard.tsx",
+    "filePath": "src/renderer/src/components/sidebar/worktree-card-meta-row.tsx",
     "kind": "jsx-attribute:label",
     "text": "sidebar",
     "dynamic": false,
diff --git a/config/max-lines-baseline.txt b/config/max-lines-baseline.txt
index 3275e33987a..59368273624 100644
--- a/config/max-lines-baseline.txt
+++ b/config/max-lines-baseline.txt
@@ -232,10 +232,8 @@ inline src/renderer/src/components/settings/AgentsPane.tsx
 inline src/renderer/src/components/settings/RepositoryHooksSection.tsx
 inline src/renderer/src/components/settings/RuntimeEnvironmentsPane.tsx
 inline src/renderer/src/components/settings/Settings.tsx
-inline src/renderer/src/components/settings/SettingsFormControls.tsx
 inline src/renderer/src/components/sidebar/RemoteFileBrowser.tsx
 inline src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.tsx
-inline src/renderer/src/components/sidebar/WorktreeCard.tsx
 inline src/renderer/src/components/sidebar/WorktreeContextMenu.tsx
 inline src/renderer/src/components/sidebar/WorktreeList.lineage-child-card.test.ts
 inline src/renderer/src/components/sidebar/WorktreeList.tsx
@@ -246,7 +244,6 @@ inline src/renderer/src/components/stats/usage-overview-model.ts
 inline src/renderer/src/components/status-bar/ResourceUsageStatusSegment.tsx
 inline src/renderer/src/components/status-bar/StatusBar.tsx
 inline src/renderer/src/components/status-bar/WorkspaceSpaceManagerPanel.tsx
-inline src/renderer/src/components/tab-bar/TabBar.tsx
 inline src/renderer/src/components/tab-bar/TabBar.windows-shell-launch.test.ts
 inline src/renderer/src/components/tab-group/useTabDragSplit.ts
 inline src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts
@@ -270,7 +267,6 @@ inline src/renderer/src/hooks/useComposerState.ts
 inline src/renderer/src/hooks/useEditorExternalWatch.ts
 inline src/renderer/src/hooks/useIpcEvents.test.ts
 inline src/renderer/src/hooks/useIpcEvents.ts
-inline src/renderer/src/hooks/useIssueMetadata.ts
 inline src/renderer/src/hooks/useSettingsNavigationMetadata.ts
 inline src/renderer/src/lib/active-agent-note-send.test.ts
 inline src/renderer/src/lib/file-type-icons.ts
@@ -342,7 +338,6 @@ mobile-config app/h/*/source-control/*.tsx
 mobile-config app/h/*/tasks.tsx
 mobile-config app/index.tsx
 mobile-config app/pair-scan.tsx
-mobile-config app/terminal-settings.tsx
 mobile-config app/troubleshoot.tsx
 mobile-config scripts/mock-server.ts
 mobile-config scripts/repro-terminal-colors.ts
diff --git a/config/oxlint-code-quality-native-plugins.json b/config/oxlint-code-quality-native-plugins.json
index 5d9cd118e74..5f2fb031a51 100644
--- a/config/oxlint-code-quality-native-plugins.json
+++ b/config/oxlint-code-quality-native-plugins.json
@@ -16,6 +16,7 @@
     "import/namespace": "warn",
     "import/no-cycle": ["warn", { "maxDepth": 3 }],
     "import/no-duplicates": "warn",
+    "import/no-empty-named-blocks": "warn",
     "import/no-self-import": "warn"
   },
   "overrides": [
diff --git a/config/oxlint-code-quality-type-aware.json b/config/oxlint-code-quality-type-aware.json
index 4c0e01fa748..8ae3cbab60e 100644
--- a/config/oxlint-code-quality-type-aware.json
+++ b/config/oxlint-code-quality-type-aware.json
@@ -12,6 +12,7 @@
   },
   "rules": {
     "typescript/await-thenable": "warn",
+    "typescript/no-redundant-type-constituents": "warn",
     "typescript/restrict-plus-operands": "warn",
     "typescript/restrict-template-expressions": "warn",
     "typescript/switch-exhaustiveness-check": [
diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc
index 3993a178f38..c9bf94a1731 100644
--- a/config/reliability-gates.jsonc
+++ b/config/reliability-gates.jsonc
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-08-09",
+  "updatedAt": "2026-08-12",
   "policy": {
     "maturityLevels": ["experimental", "soak", "blocking", "accepted-gap", "deprecated"],
     "blockingPromotion": {
@@ -10,6 +10,103 @@
     }
   },
   "gates": [
+    {
+      "id": "terminal-session.shell-ready-exec-prompt-fallback",
+      "title": "Startup exec falls back to the identified shell's line editor",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "terminal-session-readiness",
+      "layer": "posix-pty-and-shell-startup",
+      "surfaces": ["queued terminal startup commands", "zsh and bash startup files"],
+      "platforms": ["macos", "linux"],
+      "providers": ["local", "local-daemon", "ssh-daemon", "ssh-relay", "paired-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["local", "local-daemon", "ssh-relay"],
+      "coverageNotes": "Real macOS node-pty integration covers zsh 5.9 .zshenv/.zprofile and bash 3.2 profile replacement shells, including exec -a names, same-shell and child-process silent reads, a blocking zle-line-init hook, non-shell readline replacements, and a non-shell image renamed zsh. An Ubuntu 20.04 container confirms compatible zsh/bash termios. Deterministic owner contracts cover local, daemon, and SSH relay identity stripping plus provider- and renderer-owned delivery. Renderer-owned relay fallback publishes the existing ready marker, so mixed client/host versions need no new wire capability. Live SSH, paired-runtime, and WSL remain gaps.",
+      "motivatingLinks": ["https://github.com/stablyai/orca/issues/13767"],
+      "invariant": "Before user startup files run, the wrapper publishes its shell PID. If a later exec discards the ready marker, prompt fallback releases queued startup input only after the launched shell's actual executable image with that exact PID owns the PTY foreground, emits its post-hook line-editor enable sequence, and exposes zle/readline termios; startup reads, line-init hooks, child foreground processes, and non-shell readline replacements cannot trigger early fallback release.",
+      "oracle": "Run the real generated wrappers under node-pty with disposable zsh and bash startup files. Plain and exec -a replacement shells must receive one queued command at their first completed line editor without waiting for the 15-second timeout. The identical oracle must time out without the startup identity and prompt fallback. Same-shell reads, child-process reads, a blocking zle-line-init hook, sqlite3, and sqlite3 renamed zsh must not trigger prompt fallback. Relay owner coverage must strip the identity and release through the same prompt contract.",
+      "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/line-editor-ready-output-scanner.test.ts src/main/shell-startup-identity-scanner.test.ts src/main/shell-prompt-readiness-probe.test.ts src/shared/pty-slave-line-discipline-echo.test.ts src/shared/shell-process-readiness.test.ts src/main/daemon/session.test.ts src/main/daemon/shell-ready.test.ts src/main/providers/local-pty-shell-ready.test.ts src/main/providers/local-pty-provider.test.ts src/relay/pty-shell-launch.test.ts src/relay/pty-handler.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/relay/pty-handler.test.ts"
+      ],
+      "testFiles": [
+        "src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts",
+        "src/main/line-editor-ready-output-scanner.test.ts",
+        "src/main/shell-startup-identity-scanner.test.ts",
+        "src/main/shell-prompt-readiness-probe.test.ts",
+        "src/shared/pty-slave-line-discipline-echo.test.ts",
+        "src/shared/shell-process-readiness.test.ts",
+        "src/main/daemon/session.test.ts",
+        "src/main/daemon/shell-ready.test.ts",
+        "src/main/providers/local-pty-shell-ready.test.ts",
+        "src/main/providers/local-pty-provider.test.ts",
+        "src/relay/pty-shell-launch.test.ts",
+        "src/relay/pty-handler.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts",
+          "assertions": [
+            "real zsh .zshenv/.zprofile and bash profile replacement shells receive queued input exactly once",
+            "same-shell raw silent reads retain queued input",
+            "child-process raw silent reads retain queued input while the identified shell is not foreground",
+            "a blocking zle-line-init read retains queued input until the hook completes",
+            "sqlite3 and a sqlite3 image renamed zsh cannot impersonate the launched shell executable path",
+            "zsh configurations without a line-editor enable sequence retain the existing timeout backstop"
+          ]
+        },
+        {
+          "file": "src/relay/pty-handler.test.ts",
+          "assertions": [
+            "the SSH relay owner strips startup identity and releases provider-delivered input through prompt readiness",
+            "renderer-owned SSH delivery receives the existing ready marker after authoritative relay prompt readiness",
+            "normal renderer-owned ready markers pass through unchanged and retain no readiness state"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/line-editor-ready-output-scanner.test.ts src/main/shell-startup-identity-scanner.test.ts src/main/shell-prompt-readiness-probe.test.ts src/shared/pty-slave-line-discipline-echo.test.ts src/shared/shell-process-readiness.test.ts src/main/daemon/session.test.ts src/main/daemon/shell-ready.test.ts src/main/providers/local-pty-shell-ready.test.ts src/main/providers/local-pty-provider.test.ts src/relay/pty-shell-launch.test.ts src/relay/pty-handler.test.ts",
+          "result": "passed",
+          "durationSeconds": 4,
+          "summary": "All real exec, silent-read, line-init-hook, renamed-image, disabled-bracketed-paste, and relay-owner oracles plus identity, foreground, executable-image, protocol, and line-editor contracts passed."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 6,
+        "scope": "real local zsh/bash exec and silent-read integration gate"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "Fresh deterministic local runs pass; CI and soak history have not started."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Oracle SHA-256 b13b08006a38b2adc2acb51ae9342909514e55ab4822fac4fbb76cd49b344cc6 is byte-identical across runs. Latest main 09ec516ae5 and the candidate with its production implementation reverted both failed exactly the three zsh .zprofile/.zshenv and bash exec cases by deterministic 5-second timeout; the zle-line-init oracle also exposed unsafe baseline delivery, while all ten other safety controls passed. The candidate passed all 14 on macOS."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "The normal ready-marker path cancels before external probing. A missing marker triggers a debounced stty read only after a line-editor enable sequence, followed by narrow PID status and executable-image inspection only when termios matches. Slow ordinary startup output triggers zero probes; rejected protocol emissions are capped at four probes per startup. There is no per-command hook or steady-state polling."
+      },
+      "promotionCriteria": [
+        "Collect Linux, SSH-daemon, and paired-runtime live evidence.",
+        "Collect CI and soak history without unexplained flakes.",
+        "Keep same-shell, child-process, line-init-hook, and non-shell readline contracts green."
+      ],
+      "knownGaps": [
+        "The fallback requires a readable POSIX PTY slave; WSL through wsl.exe, ConPTY, and native Windows retain the existing timeout backstop.",
+        "An exec integration that forks a replacement shell instead of retaining the identified shell PID retains the existing timeout backstop.",
+        "A zsh configuration that disables bracketed-paste output emits no safe post-hook protocol signal and retains the existing timeout backstop.",
+        "The pre-existing timeout backstop can still deliver queued input to a non-shell replacement after it expires; this fallback prevents indefinite startup hangs and is unchanged by the prompt fallback.",
+        "The fallback restores safe startup-command delivery but cannot recreate OSC 133 hooks or overlay restores already discarded by exec.",
+        "Startup code running in the launched shell can deliberately spoof the public line-editor enable sequence after configuring matching termios; the existing timeout path already trusts a public OSC marker from the same startup code."
+      ],
+      "demotionRule": "Keep experimental or demote if prompt fallback enters a normal, child, or line-init read; a non-shell executable triggers prompt fallback; the identified shell PID is not foreground; delivery duplicates; ordinary startup output spawns probes; probe attempts exceed four; or the focused gate flakes without an identified harness defect."
+    },
     {
       "id": "editor.restored-sibling-owner-reparent",
       "title": "Restored sibling tabs migrate filesystem authority before becoming editable",
@@ -1361,6 +1458,319 @@
       ],
       "demotionRule": "Demote if a retired runtime transport can leave a renderer subscription without a close event, if a close is delivered more than once, if one failing teardown strands its sibling subscriptions, if payload frames from a retired transport reach the renderer, or if a revealed remote terminal can stay blank or reject input after a reconnect."
     },
+    {
+      "id": "browser-session.remote-terminal-link-ownership",
+      "title": "Paired terminal links open one browser on their owning runtime",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "browser-runtime",
+      "layer": "renderer-paired-runtime-routing",
+      "surfaces": [
+        "paired remote terminal HTTP links",
+        "terminal link action destinations",
+        "runtime-owned managed browser creation"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["remote-runtime", "ssh"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["remote-runtime", "ssh"],
+      "coverageNotes": "A headed macOS desktop host and separate paired Electron client exercise a real mirrored terminal link, owner-asserted host browser creation, exact host/client page identity, rendered DOM, explicit browser-tab activation, client external-browser suppression, exact host/client close convergence, and continued original-PTY liveness. Unit contracts cover OSC, WebLinksAddon, click fallback, explicit System Browser routing, failed creation, incapable runtimes, and unchanged direct SSH behavior.",
+      "motivatingLinks": [
+        "https://stablygroup.slack.com/archives/C0AK2T3JEF4/p1786567689897109",
+        "https://github.com/stablyai/orca/issues/12418"
+      ],
+      "invariant": "Selecting Orca Browser for an HTTP link in a runtime-owned terminal creates exactly one browser page on that owning runtime and exactly one mirrored client browser workspace, with matching remote page identity and no client external-browser call. Explicit System Browser remains client-owned, direct SSH remains system-browser-only, and unknown or mismatched owners fail closed.",
+      "oracle": "Use the focused routing contracts as the byte-identical baseline/candidate oracle. Require runtime OSC, WebLinksAddon, click fallback, action-menu, and modifier paths to target the exact owner without client fallback, while direct SSH and generic remote document links stay external. Separately run one byte-identical headed paired Electron journey on the candidate and with only runtime browser registration disabled. Require one new host browser tab, one new client mirror with exact page identity, rendered fixture DOM, explicit browser-tab activation, zero client shell.openExternal calls, exact close convergence, unchanged terminal counts, and continued output on the original PTY.",
+      "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts src/renderer/src/lib/http-link-routing.test.ts src/renderer/src/lib/http-link-modifier-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts",
+        "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-browser-link.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
+      ],
+      "testFiles": [
+        "src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts",
+        "src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts",
+        "src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts",
+        "src/renderer/src/lib/http-link-routing.test.ts",
+        "src/renderer/src/lib/http-link-modifier-routing.test.ts",
+        "src/renderer/src/lib/workspace-browser-tab-open.test.ts",
+        "tests/e2e/paired-remote-terminal-browser-link.spec.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts",
+          "assertions": [
+            "OSC, WebLinksAddon, and click-fallback activations route through the exact runtime owner",
+            "direct SSH continues to use only the system browser"
+          ]
+        },
+        {
+          "file": "src/renderer/src/lib/workspace-browser-tab-open.test.ts",
+          "assertions": [
+            "an asserted runtime cannot fall back to a client browser",
+            "mismatched and incapable runtime owners fail closed"
+          ]
+        },
+        {
+          "file": "tests/e2e/paired-remote-terminal-browser-link.spec.ts",
+          "assertions": [
+            "one terminal action produces one host page and one client mirror with exact identity",
+            "the host browser renders the fixture while client external navigation stays empty",
+            "an explicit browser-tab click reveals the exact mirror",
+            "closing the mirror returns host and client inventories to baseline",
+            "the original remote PTY accepts and renders fresh output after browser close"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts",
+          "result": "failed",
+          "durationSeconds": 2.58,
+          "summary": "Latest main e4c278eb523 failed 6/25 owner-routing assertions: runtime terminal links called the viewing client's external browser and the managed-browser helper did not enforce an asserted runtime owner."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts src/renderer/src/lib/http-link-routing.test.ts src/renderer/src/lib/http-link-modifier-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts",
+          "result": "passed",
+          "durationSeconds": 1.83,
+          "summary": "Candidate passed 84/84 across six focused routing, modifier, availability, owner assertion, failure, SSH, and system-browser contract files."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-browser-link.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 32.9,
+          "summary": "Candidate created one host browser and one client mirror with matching page identity, rendered the fixture, activated on an explicit tab click, made zero client external-browser calls, converged both inventories after exact UI close, and delivered fresh output on the original remote PTY."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-browser-link.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "failed",
+          "durationSeconds": 60,
+          "summary": "The byte-identical final Electron oracle failed at its exact host/client identity barrier when the sole source delta replaced src/renderer/src/store/index.ts registration lines 110-113 with registerRuntimeHttpLinkBrowserOpener(null); no host-owned browser appeared within the deterministic 60-second bound."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 45,
+        "scope": "six focused renderer contract files plus one isolated headed paired-runtime journey"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "The focused contracts are deterministic and the headed paired-runtime journey passed locally after its PTY namespace oracle was corrected; longer CI and soak history is not yet available."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "The focused owner-routing oracle is red on latest main e4c278eb523 and green on the candidate. The byte-identical headed Electron oracle is green on the candidate and red when the sole source delta replaces the runtime browser opener registration with registerRuntimeHttpLinkBrowserOpener(null); candidate evidence proves exact host/client identity, rendered content, explicit activation, exact close convergence, original-PTY survival, and absence of client external navigation."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "The production change adds no timer, polling, retry, subprocess, stream opcode, RPC method, or host publication. Each link hover or activation performs bounded in-memory owner and capability lookups; an Orca Browser action issues the same single browser creation and snapshot reconciliation already used by the tab bar."
+      },
+      "promotionCriteria": [
+        "Collect Linux and physical Windows paired-server evidence.",
+        "Collect a live headless-serve terminal-link journey.",
+        "Collect 100 consecutive focused CI passes or 14 days without an unexplained flake."
+      ],
+      "knownGaps": [
+        "Live paired-server validation currently covers macOS only.",
+        "A live headless-serve journey and multiple simultaneous viewers are not exercised by the Electron journey.",
+        "Direct SSH intentionally retains its existing system-browser-only semantics.",
+        "Terminal-link activation does not change the existing asynchronous host/client focus policy."
+      ],
+      "demotionRule": "Demote if one runtime terminal link creates a client-owned or duplicate browser, targets a runtime other than the pane owner, invokes the client external browser for Orca Browser, or removes the source terminal."
+    },
+    {
+      "id": "browser-session.remote-html-preview-ownership",
+      "title": "Paired HTML previews keep one host page and one stable client split",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "browser-runtime",
+      "layer": "renderer-paired-runtime-reconciliation",
+      "surfaces": [
+        "paired remote HTML file preview",
+        "background preview creation and explicit browser activation",
+        "client-only split placement",
+        "remote browser close convergence"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["remote-runtime"],
+      "coverageNotes": "A headed macOS desktop host and separate paired web client exercise the Explorer eye-button path with a real remote file URL, host browser DOM, renderer split layout, background preview creation, explicit browser activation, and browser close. Unit contracts cover owning-runtime routing, one-shot split placement, focused and unfocused creation, manual moves, overlapping opens, failure cleanup, and teardown. Linux, Windows, and a live headless-server journey remain gaps.",
+      "motivatingLinks": [
+        "https://linear.app/stably/issue/STA-3872/unable-to-open-html-files-in-remote-server",
+        "https://github.com/stablyai/orca/pull/13876"
+      ],
+      "invariant": "Opening one HTML preview from a paired client creates exactly one browser page on the worktree-owning runtime and exactly one mirrored client browser workspace. The preview remains in the requested client-side split without taking focus from the editor, an explicit browser click activates it authoritatively, and closing it removes only the browser identities while the source editor and terminal survive.",
+      "oracle": "Open a real HTML file through Explorer on a separate client paired to an isolated headed desktop host. Require one new host browser tab, one client browser workspace and unified tab, two visible split groups, an exact client-handle-to-host-page identity, rendered fixture DOM, editor focus after preview creation, host and client browser focus only after an explicit click, and browser-only close convergence with the editor and terminal still visible. Run the byte-identical Electron test on latest main, the candidate, and the candidate with the claimed fix disabled.",
+      "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-browser.test.ts src/main/runtime/rpc/methods/browser.test.ts src/renderer/src/lib/file-preview.test.ts src/renderer/src/runtime/web-session-browser-placement.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/runtime/remote-server-parity.test.ts",
+        "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+        "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=3",
+        "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+        "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
+      ],
+      "testFiles": [
+        "src/main/runtime/orca-runtime-browser.test.ts",
+        "src/main/runtime/rpc/methods/browser.test.ts",
+        "src/renderer/src/lib/file-preview.test.ts",
+        "src/renderer/src/runtime/web-session-browser-placement.test.ts",
+        "src/renderer/src/runtime/web-runtime-session.test.ts",
+        "src/renderer/src/runtime/web-session-tabs-sync.test.ts",
+        "src/renderer/src/runtime/remote-server-parity.test.ts",
+        "tests/e2e/paired-remote-html-browser-focus.spec.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/runtime/web-session-browser-placement.test.ts",
+          "assertions": [
+            "pending page placements are bounded and independently reserve shared groups",
+            "worktree and environment teardown clear only their own placement state"
+          ]
+        },
+        {
+          "file": "src/renderer/src/runtime/web-session-tabs-sync.test.ts",
+          "assertions": [
+            "a host browser page stays in its exact client-owned preview group",
+            "a reserved empty split survives a pre-publication host snapshot",
+            "later client moves supersede initial preview placement"
+          ]
+        },
+        {
+          "file": "src/renderer/src/runtime/remote-server-parity.test.ts",
+          "assertions": [
+            "a caller-created browser gains focus when the exact predecessor tab is still visible"
+          ]
+        },
+        {
+          "file": "tests/e2e/paired-remote-html-browser-focus.spec.ts",
+          "assertions": [
+            "one HTML open produces one client workspace, one client unified tab, and one host page",
+            "the source editor and remote frame remain visible in separate groups",
+            "preview creation leaves the editor active, an explicit browser click is authoritative, and close preserves the editor and terminal"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-browser.test.ts src/main/runtime/rpc/methods/browser.test.ts src/renderer/src/lib/file-preview.test.ts src/renderer/src/runtime/web-session-browser-placement.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/runtime/remote-server-parity.test.ts",
+          "result": "passed",
+          "durationSeconds": 3.48,
+          "summary": "Seven focused host and renderer contract files passed 183/183 tests, covering owning-runtime routing, focused and unfocused creation, placement, reconciliation, failure cleanup, and teardown."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=3",
+          "result": "passed",
+          "durationSeconds": 16.1,
+          "summary": "The candidate passed exact host/client cardinality, split stability, rendered DOM, focus authority, close convergence, and surviving editor and terminal."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "failed",
+          "durationSeconds": 11.6,
+          "summary": "Latest-main a90a18d43da333e1cc327779a3f9912a78308848 failed the byte-identical 5806b23f oracle because the HTML preview collapsed into the source editor group instead of retaining its requested split."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 6.5,
+          "summary": "Rebased candidate b7de9c0961a4edf389a29079b2b4d5250184b57e passed the byte-identical 5806b23f oracle: one host page, one client workspace, requested split, rendered DOM, stable focus, and browser-only close."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "failed",
+          "durationSeconds": 10.9,
+          "summary": "Rebased candidate b7de9c0961a4edf389a29079b2b4d5250184b57e with only the side-preview owning-runtime routing seam disabled failed the byte-identical 5806b23f oracle with two client workspaces."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 7.6,
+          "summary": "Final candidate d5767481b982b736e7cc5b4653b2a32a61280638 on merge-base 36d45af062ec4022265aabac8fc6a9d36eecedf1 passed the byte-identical 5806b23f oracle after final review and rebase: one host page, one client workspace, requested split, rendered DOM, stable focus, and browser-only close."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "failed",
+          "durationSeconds": 11.8,
+          "summary": "Latest-main 346e59c879 failed the byte-identical 2ec1dcf1 oracle with two client HTML browser workspaces instead of one."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 8.4,
+          "summary": "Candidate d05217c40d passed the byte-identical 2ec1dcf1 oracle: one host page, one client workspace, stable split, rendered DOM, editor focus after creation, explicit-click browser focus, and browser-only close."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "failed",
+          "durationSeconds": 12.3,
+          "summary": "Candidate d05217c40d with only the side-preview focusOnCreate:false call disabled failed the byte-identical 2ec1dcf1 oracle because preview creation activated the browser instead of preserving editor focus."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 60,
+        "scope": "seven focused host/renderer contracts plus one isolated headed paired-runtime journey"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "The candidate passed isolated local macOS Electron runs before and after the final rebase; longer CI and soak history is not yet available."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "The byte-identical 2ec1dcf1 Electron oracle is red on latest main 346e59c879, green on candidate d05217c40d, and red when only the candidate's side-preview focusOnCreate:false call is disabled. Latest main created two client browser workspaces; the disabled candidate focused the browser before an explicit click. Historical 5806b23f evidence separately proves the owning-runtime routing seam."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "The change adds no timer, polling, retry, subprocess, RPC method, stream opcode, receipt ledger, or host publication. Side previews install no focus listener and record no focus intent. Focused browser creation performs one bounded scan of the current worktree's local tabs. Pending client placements are capped at 128 and cleared on adoption, failure, or worktree/environment teardown."
+      },
+      "promotionCriteria": [
+        "Collect Linux and physical Windows paired-server evidence.",
+        "Collect a live headless-serve HTML preview journey.",
+        "Collect 100 consecutive focused CI passes or 14 days without an unexplained flake."
+      ],
+      "knownGaps": [
+        "Live paired-server validation currently covers macOS only.",
+        "A live headless-serve journey and multiple simultaneous viewers are not exercised by the Electron journey.",
+        "Direct SSH remote file URLs remain intentionally unsupported and local file previews retain their existing path."
+      ],
+      "demotionRule": "Demote if one paired HTML action can create duplicate client or host browser identities, lose the requested split, steal editor focus before an explicit browser click, lose browser focus after that click, or remove unrelated editor or terminal state on close."
+    },
     {
       "id": "browser-stream.bounded-reconnect",
       "title": "Remote browser streams recover within a bounded retry budget",
@@ -1969,7 +2379,7 @@
       "invariant": "Close permanently removes the owned provider session, agent descendants, and resume authority even when no TerminalPane is mounted; a terminating id remains reserved through natural exit, duplicate callers await the same completion, and immediate teardown upgrades any graceful request without signalling a recycled PID or a descendant tree after root ownership is lost; process-table work is locale-stable, bounded, fresh for each post-start request, same-turn coalesced, and begins within the requesting caller's deadline, including bulk worktree cleanup; detach and park preserve ownership; aliases prevent a detached agent's immutable physical pane key from being retired with its former tab.",
       "oracle": "Capture the exact PTY before parking, prove it remains listed while the view is absent, close through the product state boundary, and poll the provider inventory until that exact ID disappears; an agent-marked PTY's detached-pgid child is alive before close and absent afterward; unit tests keep a naturally exited id reserved without re-killing its PID or signalling its captured tree, upgrade pending and post-snapshot graceful kills to immediate, force ps into the C locale, coalesce each bounded bulk-shutdown batch, share duplicate teardown completion, coalesce 20 same-turn process-table requests, start one shared successor without waiting for the prior scan, terminate cyclic-looking traversal, retain the source scan's timestamp, bound both read phases, avoid ambiguous SIGKILL, and assert canonical owner dedupe, exact pane tombstones, chained detach transfer, and restart alias restoration.",
       "commands": [
-        "pnpm dlx node@24 ./node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-pane-authority.test.ts src/main/ipc/agent-hooks.test.ts src/main/ipc/agent-pane-authority-ownership.test.ts src/main/ipc/pty-management.test.ts src/main/persistence.test.ts src/renderer/src/store/slices/agent-pane-authority.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/renderer/src/store/slices/terminal-tab-retirement.test.ts src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
+        "pnpm dlx node@24 ./node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-pane-authority.test.ts src/main/ipc/agent-hooks.test.ts src/main/ipc/agent-pane-authority-ownership.test.ts src/main/ipc/pty-management.test.ts src/main/persistence.test.ts src/renderer/src/store/slices/agent-pane-authority.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/renderer/src/store/slices/terminal-tab-retirement.test.ts src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/pty-descendant-termination.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/providers/local-pty-provider.test.ts src/main/runtime/worktree-teardown.test.ts",
         "pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1",
         "pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1"
@@ -1989,11 +2399,18 @@
         "src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
         "src/renderer/src/store/slices/terminal-tab-retirement.test.ts",
         "src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts",
+        "tests/e2e/completed-worker-retirement-resume.unit.test.ts",
         "src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
         "tests/e2e/terminal-parked-close-retirement.spec.ts",
         "tests/e2e/agent-descendant-process-kill.spec.ts"
       ],
       "assertionRefs": [
+        {
+          "file": "tests/e2e/completed-worker-retirement-resume.unit.test.ts",
+          "assertions": [
+            "explicit close revokes the exact live recovery record both before and after PTY exit removes the tab, while PTY exit alone preserves interrupted-session recovery"
+          ]
+        },
         {
           "file": "tests/e2e/terminal-parked-close-retirement.spec.ts",
           "assertions": [
@@ -2433,7 +2850,7 @@
           "platform": "macos",
           "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts",
           "result": "passed",
-          "durationSeconds": 0.4,
+          "durationSeconds": 0.34,
           "summary": "1 test file passed, 58 tests passed; covers cwdFallback forwarding only for local fresh spawns and metadata handoff."
         },
         {
@@ -2711,11 +3128,13 @@
       "oracle": "Renderer-state tests assert provider-session ownership across preserved and queued panes. Main/provider contracts assert atomic attach-only adoption, stable host/worktree/tab/leaf identity, no fresh spawn on adoption, and safe paired-runtime cancellation. The Electron oracle creates inactive runtime-owned Codex and Setup PTYs plus an unrelated canary, seeds an exact resumable provider session, removes only the target renderer projections, and activates the workspace. It requires byte-stable handle, PTY, incarnation, tab, leaf, process PID, renderer graph, persisted binding, runtime id, graph epoch, and daemon PID across first mount and reload; PID-specific DOM keyboard I/O must remain live with one launch, zero resume argv, zero signals, zero interruption text, and no canary mutation.",
       "commands": [
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts --reporter=verbose",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/ipc/pty.test.ts src/main/runtime/orca-runtime.test.ts src/renderer/src/lib/pane-manager/pane-fit.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts",
         "pnpm exec electron-vite build --mode e2e && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/live-background-terminal-mount-authority.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
       ],
       "testFiles": [
         "src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
+        "tests/e2e/completed-worker-retirement-resume.unit.test.ts",
         "src/main/providers/local-pty-provider.test.ts",
         "src/main/daemon/terminal-host.test.ts",
         "src/main/daemon/daemon-pty-adapter.test.ts",
@@ -2727,6 +3146,13 @@
         "tests/e2e/live-background-terminal-mount-authority.spec.ts"
       ],
       "assertionRefs": [
+        {
+          "file": "tests/e2e/completed-worker-retirement-resume.unit.test.ts",
+          "assertions": [
+            "completed and explicitly retired workers retain no provider-resume authority on first workspace activation",
+            "the original tab, leaf, PTY, provider session, release state, replacement count, queued resume argv, emitted restored banner, and unrelated canary remain exact across restart"
+          ]
+        },
         {
           "file": "src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
           "assertions": [
@@ -3217,6 +3643,7 @@
       "commands": [
         "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/settings.test.ts src/main/ipc/runtime-environments.test.ts src/renderer/src/store/slices/settings.test.ts src/renderer/src/store/slices/browser.test.ts src/renderer/src/components/settings/browser-session-host-selection.test.ts src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts src/renderer/src/components/status-bar/SshStatusSegment.test.ts src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts src/renderer/src/hooks/useIpcEvents.test.ts src/renderer/src/web/web-preload-api.test.ts --maxWorkers=1",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts src/renderer/src/components/sidebar/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts src/renderer/src/components/sidebar/worktree-list-host-filtering.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/selectors.test.ts src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees.test.ts --maxWorkers=1",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts src/renderer/src/runtime/runtime-server-directory-browser.test.ts src/renderer/src/store/slices/repos-paired-runtime-add.test.ts --maxWorkers=1",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts src/renderer/src/components/sidebar/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts src/renderer/src/components/sidebar/worktree-list-host-filtering.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/selectors.test.ts src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees.test.ts src/renderer/src/runtime/web-runtime-session.test.ts --maxWorkers=1",
         "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
         "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
@@ -3230,11 +3657,14 @@
         "src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts",
         "src/renderer/src/components/status-bar/SshStatusSegment.test.ts",
         "src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts",
+        "src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts",
         "src/renderer/src/hooks/useIpcEvents.test.ts",
         "src/renderer/src/web/web-preload-api.test.ts",
         "src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx",
         "src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx",
         "src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts",
+        "src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx",
+        "src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx",
         "src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts",
         "src/renderer/src/components/sidebar/project-added-default-checkout.test.ts",
         "src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts",
@@ -3246,6 +3676,7 @@
         "src/renderer/src/lib/resolved-worktree-execution-host.test.ts",
         "src/renderer/src/lib/worktree-runtime-owner.test.ts",
         "src/renderer/src/store/selectors.test.ts",
+        "src/renderer/src/store/slices/repos-paired-runtime-add.test.ts",
         "src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts",
         "src/renderer/src/store/slices/repos-project-groups.test.ts",
         "src/renderer/src/store/slices/repos-selected-owner-routing.test.ts",
@@ -3255,6 +3686,34 @@
         "tests/e2e/pr11346-selected-runtime-add.spec.ts"
       ],
       "assertionRefs": [
+        {
+          "file": "src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts",
+          "assertions": [
+            "paired web hides the viewing computer as an Add Project filesystem authority and selects the paired runtime"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts",
+          "assertions": [
+            "paired runtime browsing opens the host browser without invoking native pickFolders while desktop local and SSH routes remain intact"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx",
+          "assertions": ["paired runtime browsing renders the in-app host filesystem browser"]
+        },
+        {
+          "file": "src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx",
+          "assertions": [
+            "host-scoped Add Project actions remain disabled until a paired runtime is selectable"
+          ]
+        },
+        {
+          "file": "src/renderer/src/store/slices/repos-paired-runtime-add.test.ts",
+          "assertions": [
+            "an explicitly selected paired runtime submits repo.add to that runtime without native repo or folder-picker calls"
+          ]
+        },
         {
           "file": "src/main/ipc/settings.test.ts",
           "assertions": [
@@ -3656,9 +4115,7 @@
         },
         {
           "file": "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
-          "assertions": [
-            "risky-output atlas recovery is bounded, coalesced, and survives a throwing manager"
-          ]
+          "assertions": ["continues recovery when a manager throws after scheduling"]
         },
         {
           "file": "src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
@@ -4315,14 +4772,16 @@
       "providers": ["paired-runtime", "ssh"],
       "coveredPlatforms": ["macos"],
       "coveredProviders": ["paired-runtime"],
-      "coverageNotes": "Deterministic headed macOS runs launch an isolated Orca desktop server and a separate paired web client. A byte-identical headless run uses an isolated `orca serve` host. Both create six real paired host PTYs with bounded high-output scrollback, prove sustained output while all six client xterms are warm-mounted but hidden causes zero renderer scheduler work, ordinary-park five xterms without enabling the lossy retention budget, assert bounded cells/heap/timer lag, then restore the bounded authoritative tail exactly once on the original PTY including output produced while parked and continued input/output. The headed oracle additionally keeps every remote target workspace and terminal unmounted in the host renderer before and after client recovery. A separate headed desktop-client journey relaunches the host main process while retaining the daemon and a daemon-backgrounded PTY, then requires first-observation foreground sync and continued input/output on the same PTY. Unit coverage keeps layout versions out of snapshot output high-waters when a restored snapshot has no output sequence and retries an existing subscriber only after authoritative provider inventory proves the retained PTY exists. Separate headed/headless ACK-starvation tests recover one stalled stream without replacing its PTY. A headed output-drop oracle proves a successful snapshot probe cannot certify a stale live stream when the authoritative PTY sequence advanced beyond the client high-water. Unit coverage requires an unsequenced client to establish a first-probe baseline, remain attached at the same sequence, and recover only after a later probe advances. A capability-disabled run proves legacy hosts retain the prior lossy limit/TTL fallback. Unit tests cover exact-owner capability routing, raw-stream release, singleton side-effect facts with timed handoff cleanup, 64 simultaneous synthetic-title sources with zero decorative client events after convergence, per-client late-subscribe recovery, semantic bell/title transitions, local animation-frame preservation, legacy no-output-pause delivery gating with exact snapshot restore, provider-authoritative snapshots, 128 active streams plus retry after a 129th-stream capacity rejection, capacity-pressure backoff, full split-leaf remint reconciliation, truncation, and manual-disconnect queue fencing. Linux, Windows, live SSH, and production-scale paired hosts remain gaps.",
+      "coverageNotes": "Deterministic headed macOS runs launch an isolated Orca desktop server and a separate paired web client. A byte-identical headless run uses an isolated `orca serve` host. Both create six real paired host PTYs with bounded high-output scrollback, prove sustained output while all six client xterms are warm-mounted but hidden causes zero renderer scheduler work, then drive 180 timed real-PTY spinner frames through a second production `session.tabs.subscribeAll` transport and the real Zustand store. Each worktree must publish and apply only its exact initial-working and final-idle titles. Both topologies ordinary-park five xterms without enabling the lossy retention budget, assert bounded cells/heap/timer lag, then restore the bounded authoritative tail exactly once on the original PTY including output produced while parked and continued input/output. The headed oracle additionally keeps every remote target workspace and terminal unmounted in the host renderer before and after client recovery. Production-parity React contracts reproduce and remove the independent cold-park watcher/title feedback loop, including memo-cache discard, StrictMode cleanup replay, detached split-PTY replacement, and the zero-park fast path. A deterministic cross-boundary contract drives 24 real PTY trackers in distinct worktrees through 2,880 decorative spinner and bare-native redraw chunks and counts host publications, serialized bytes, renderer apply calls, and store mutations while preserving exact per-PTY raw chunks and per-worktree semantic transitions. Fake-clock continuation beyond the 30-minute stale boundary requires one deduplicated refresh per worktree every 15 minutes, globally spaced by at least 50 ms, with every mirrored working status still fresh. Exact-identical Pi plus rotating normalized Pi/Grok frames renew coarse working/permission state; rich prompt/tool/question fields retain their original 30-minute lease, and `stateStartedAt`/acknowledgement identity remain stable across title/hook source swaps. A separate headed desktop-client journey relaunches the host main process while retaining the daemon and a daemon-backgrounded PTY, then requires first-observation foreground sync and continued input/output on the same PTY. Unit coverage keeps layout versions out of snapshot output high-waters when a restored snapshot has no output sequence and retries an existing subscriber only after authoritative provider inventory proves the retained PTY exists. Separate headed/headless ACK-starvation tests recover one stalled stream without replacing its PTY. A headed output-drop oracle proves a successful snapshot probe cannot certify a stale live stream when the authoritative PTY sequence advanced beyond the client high-water. Unit coverage requires an unsequenced client to establish a first-probe baseline, remain attached at the same sequence, and recover only after a later probe advances. A capability-disabled run proves legacy hosts retain the prior lossy limit/TTL fallback. Unit tests cover exact-owner capability routing, raw-stream release, singleton side-effect facts with timed handoff cleanup, 64 simultaneous synthetic-title sources with zero decorative client events after convergence, per-client late-subscribe recovery, semantic bell/title transitions, local animation-frame preservation, legacy no-output-pause delivery gating with exact snapshot restore, provider-authoritative snapshots, 128 active streams plus retry after a 129th-stream capacity rejection, capacity-pressure backoff, full split-leaf remint reconciliation, truncation, and manual-disconnect queue fencing. Linux, Windows, live SSH, and production-scale paired hosts remain gaps.",
       "motivatingLinks": [
         "https://github.com/stablyai/orca/issues/8652",
         "https://github.com/stablyai/orca/pull/10625"
       ],
-      "invariant": "A host advertising terminal.paired-parking.v1 keeps the PTY and bounded authoritative history alive while an ordinary hidden-view park destroys the client xterm and releases its raw per-PTY stream. Reveal must restore up to the requested 5,000 rows, parked-time side effects/output, the same PTY identity, and continued input/output. After a host main-process relaunch, unknown local delivery-sync state must not be treated as proof that a surviving daemon PTY is already foregrounded. If subscription precedes provider readiness, authoritative inventory must reconsider that existing subscriber without spawning, resizing, or changing reconnect state. A snapshot without an output high-water must keep it unknown rather than borrowing a layout version that can suppress newer live output. Hosts without the capability must gate hidden raw output before xterm scheduling and repaint from the authoritative snapshot on reveal while retaining the existing limit/TTL force-parking fallback. After a paired client's first semantic title state, decorative spinner frequency must add zero encrypted client-event frames; local title animation and semantic title, status, bell, completion, and query facts remain intact. A paired terminal stream whose delivery credits stop progressing must replace only that stream; command silence first probes authoritative state and replaces the stream if the probe times out or proves the PTY advanced beyond the client's delivered output sequence. When no comparable delivery high-water exists, the first sequenced probe establishes a baseline and only later advancement proves staleness. A same-sequence snapshot remains valid proof of a responsive silent command. A successful status probe may replace a pre-ready shared-control socket without rejecting or duplicating calls already waiting for that transport. Manual disconnect must retain pairing while preventing queued or passive calls and subscriptions from recreating transport until explicit Connect.",
-      "oracle": "Run one byte-identical six-terminal oracle against an isolated headed desktop host and an isolated headless `orca serve` host. Stage at least 1,000,000 xterm cells, enable ordinary parking with the lossy retention budget disabled, require exactly one mounted manager and five parked tabs, at most 45% retained cells, no more than 16 MiB heap growth, and under 500 ms timer drift. In headed mode, require the host renderer to remain on its original workspace with zero target terminal managers mounted throughout client park, reveal, and live I/O. While a tab is parked, require authoritative terminal.read to observe new PTY output; reveal it and require the original PTY, a marker within the requested 5,000-row history, the parked marker, and post-reveal input/output. Drive 64 host PTYs through ten 80 ms synthetic title frames, require zero paired client events after the first frame per PTY while all 640 local frames remain observable, attach a late client and require one current frame per PTY, then require semantic bell and idle transitions on both clients. Reconstruct a legacy subscribed stream with no outputPause capability, hide a chatty pane, require no hidden xterm writes, reveal it, and require one authoritative snapshot plus continued live output. Drop and acknowledge output only for one original paired-client stream, prove the fixture process consumed input while the host model advanced and the client stayed stale, then require the command snapshot probe to replace that stream, repaint exact fixture output, preserve authoritative PTY identity and target-tab cardinality, and resume live I/O. For a client without a delivered sequence, require the first numeric probe to establish a baseline without replacement, a same-sequence probe to remain attached, and a later advanced probe to replace only that stream. Withhold the first encrypted shared-control ready frame, start one RPC, trigger a status-probe refresh, and require two connections, one host delivery, successful response, and zero retained request bytes. Admit 128 active streams, reject the 129th as retryable, release one stream, then require the retry to attach and publish a snapshot without multiplying retained subscribers. Disable terminal.paired-parking.v1 and require the same oracle to fail before parking, while the legacy limit-one fallback separately passes. Also preserve truncated first paint, ACK-starved same-PTY recovery, responsive silent-command snapshot probes, dead-stream probe timeout recovery, and queued manual-disconnect fencing.",
+      "invariant": "A host advertising terminal.paired-parking.v1 keeps the PTY and bounded authoritative history alive while an ordinary hidden-view park destroys the client xterm and releases its raw per-PTY stream. Reveal must restore up to the requested 5,000 rows, parked-time side effects/output, the same PTY identity, and continued input/output. Parked watcher synchronization compares parking semantics rather than fresh object identity, owns setup and cleanup across StrictMode replay, reconciles real PTY/layout changes, and performs no terminal-state scan when nothing is parked. After a host main-process relaunch, unknown local delivery-sync state must not be treated as proof that a surviving daemon PTY is already foregrounded. If subscription precedes provider readiness, authoritative inventory must reconsider that existing subscriber without spawning, resizing, or changing reconnect state. A snapshot without an output high-water must keep it unknown rather than borrowing a layout version that can suppress newer live output. Hosts without the capability must gate hidden raw output before xterm scheduling and repaint from the authoritative snapshot on reveal while retaining the existing limit/TTL force-parking fallback. After the first semantic title state, decorative spinner frequency must add zero paired client-event frames and zero full session-tabs work between status-freshness leases regardless of hidden worktree count. Continuous working or permission evidence may refresh each affected worktree once per 15 minutes through one globally spaced FIFO so current and legacy viewers do not decay before 30 minutes; sibling PTYs share that worktree refresh, while local title animation, raw output, and semantic title, status, bell, completion, and query facts remain intact. A paired terminal stream whose delivery credits stop progressing must replace only that stream; command silence first probes authoritative state and replaces the stream if the probe times out or proves the PTY advanced beyond the client's delivered output sequence. When no comparable delivery high-water exists, the first sequenced probe establishes a baseline and only later advancement proves staleness. A same-sequence snapshot remains valid proof of a responsive silent command. A successful status probe may replace a pre-ready shared-control socket without rejecting or duplicating calls already waiting for that transport. Manual disconnect must retain pairing while preventing queued or passive calls and subscriptions from recreating transport until explicit Connect.",
+      "oracle": "Run one byte-identical six-terminal oracle against an isolated headed desktop host and an isolated headless `orca serve` host. Stage at least 1,000,000 xterm cells, hide all six warm managers, emit an initial working title followed by 30 timed real-PTY spinner frames and a final idle title per worktree, and observe a second real session-tabs subscription plus the production renderer store. Require exactly two transport envelopes and two title mutations per worktree, no decorative title crossing either boundary, and positive decoded-envelope bytes. Enable ordinary parking with the lossy retention budget disabled, require exactly one mounted manager and five parked tabs, at most 45% retained cells, no more than 16 MiB heap growth, and under 500 ms timer drift. In headed mode, require the host renderer to remain on its original workspace with zero target terminal managers mounted throughout client park, reveal, and live I/O. While a tab is parked, require authoritative terminal.read to observe new PTY output; reveal it and require the original PTY, a marker within the requested 5,000-row history, the parked marker, and post-reveal input/output. Drive 24 real PTY title trackers in distinct worktrees through 40 decorative spinner frames each, then 40 spinner frames alternating with Cursor's bare native identity redraw, using fake clocks. Require all 2,880 raw chunks exactly and zero host session-tabs publications, serialized bytes, renderer apply calls, and renderer store mutations. Continue decorative evidence beyond 30 minutes, require exactly one refresh per worktree per 15-minute lease through a FIFO spaced by at least 50 ms, and require all 24 viewer statuses to remain working and fresh; then require one exact semantic idle transition and one visible-output chunk per PTY. Require ordinary and interior-Braille title changes to publish. Drive 64 host PTYs through ten 80 ms synthetic title frames, require zero paired client events after the first frame per PTY while all 640 local frames remain observable, attach a late client and require one current frame per PTY, then require semantic bell and idle transitions on both clients. Reconstruct a legacy subscribed stream with no outputPause capability, hide a chatty pane, require no hidden xterm writes, reveal it, and require one authoritative snapshot plus continued live output. Drop and acknowledge output only for one original paired-client stream, prove the fixture process consumed input while the host model advanced and the client stayed stale, then require the command snapshot probe to replace that stream, repaint exact fixture output, preserve authoritative PTY identity and target-tab cardinality, and resume live I/O. For a client without a delivered sequence, require the first numeric probe to establish a baseline without replacement, a same-sequence probe to remain attached, and a later advanced probe to replace only that stream. Withhold the first encrypted shared-control ready frame, start one RPC, trigger a status-probe refresh, and require two connections, one host delivery, successful response, and zero retained request bytes. Admit 128 active streams, reject the 129th as retryable, release one stream, then require the retry to attach and publish a snapshot without multiplying retained subscribers. Disable terminal.paired-parking.v1 and require the same oracle to fail before parking, while the legacy limit-one fallback separately passes. Also preserve truncated first paint, ACK-starved same-PTY recovery, responsive silent-command snapshot probes, dead-stream probe timeout recovery, and queued manual-disconnect fencing.",
       "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts --maxWorkers=1",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts --maxWorkers=1",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts src/renderer/src/components/terminal-pane/terminal-parked-watcher-partial-reconciliation.test.ts src/renderer/src/components/terminal-pane/terminal-parking-e2e-overrides.test.ts src/renderer/src/runtime/remote-runtime-terminal-stall-recovery.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/web/web-preload-api.test.ts src/main/ipc/runtime-environments.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal-subscriber-driven-daemon-attach.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime-shared-control-connection.test.ts",
@@ -4335,11 +4794,20 @@
         "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
         "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
         "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
+        "ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
         "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
         "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
         "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-parked-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
       ],
       "testFiles": [
+        "src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts",
+        "src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts",
+        "tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts",
+        "tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts",
+        "src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx",
+        "src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx",
+        "src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx",
+        "src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts",
         "src/main/runtime/orca-runtime.test.ts",
         "src/renderer/src/web/web-preload-api.test.ts",
         "src/main/ipc/runtime-environments.test.ts",
@@ -4371,6 +4839,59 @@
         "tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts"
       ],
       "assertionRefs": [
+        {
+          "file": "src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts",
+          "assertions": [
+            "one globally spaced FIFO refreshes each continuously active worktree before status expiry",
+            "sibling PTYs deduplicate to one worktree refresh while semantic transitions bypass the queue",
+            "sole-source PTY teardown removes queued work while sibling PTY sources remain deduplicated",
+            "worktree, pending-queue, and timer state is removed on teardown"
+          ]
+        },
+        {
+          "file": "src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts",
+          "assertions": [
+            "a live pending question remains visible under the current live shell title but cannot cross a later working interval, identity-only owner title, or provider generation",
+            "inherited tool names, stale rows, resume-only rows, and unconfirmed restored rows cannot reopen a shell-reclaimed pane"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx",
+          "assertions": [
+            "parked terminal and unified-label title republication settles without a maximum-depth loop",
+            "equivalent semantic inputs remain stable when React discards memoized identities"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx",
+          "assertions": [
+            "StrictMode cleanup replay restores watcher ownership",
+            "detached split-PTY and layout replacement reconciles",
+            "unparked unrelated writes perform zero PTY-map reads"
+          ]
+        },
+        {
+          "file": "tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts",
+          "assertions": [
+            "2,880 decorative spinner and bare-native real-PTY OSC chunks publish zero session-tabs snapshots or serialized bytes after semantic convergence",
+            "the viewer performs zero snapshot applies and zero store mutations during decorative activity",
+            "after 30 minutes, one globally spaced refresh per worktree keeps every mirrored working status fresh",
+            "exact Pi and rotating normalized Pi/Grok frames renew explicit and fallback status without changing stateStartedAt or acknowledgement semantics",
+            "matching title evidence renews retained OSC hook status without resetting stateStartedAt, then drops unverifiable prompt metadata after the hook row expires",
+            "renderer-authored rich status keeps its original lease, then renews only coarse title-confirmed state and provider identity",
+            "ordinary-shell title transitions replace working stateStartedAt with the completion transition time",
+            "decorative heartbeats remain blocked until unknown foreground ownership resolves, then resume at the bounded interval",
+            "tracked terminal state reset clears delayed foreground ownership markers",
+            "raw chunks, semantic idle transitions, and visible output remain exact"
+          ]
+        },
+        {
+          "file": "tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts",
+          "assertions": [
+            "pending renderer, retained OSC, and live-hook questions survive the shell title that currently obscures them",
+            "a new working interval, provider generation, or identity owner strips the prior question"
+          ]
+        },
         {
           "file": "src/main/runtime/terminal-subscriber-driven-daemon-attach.test.ts",
           "assertions": ["retries an existing subscriber when provider inventory becomes ready"]
@@ -4425,6 +4946,7 @@
           "assertions": [
             "ordinary-parks paired terminals and restores authoritative host scrollback",
             "warm-mounted hidden paired streams schedule zero renderer output work under sustained host output",
+            "six hidden real PTYs publish and apply only exact working and idle title transitions across paired transport",
             "client recovery completes while every target terminal remains unmounted in the host renderer"
           ]
         },
@@ -4433,6 +4955,7 @@
           "assertions": [
             "ordinary-parks paired terminals against an isolated headless Orca host",
             "cold-activates only visible paired terminals against an isolated headless host",
+            "the headless host bounds real-PTY decorative title transport and production store application",
             "the headless host shares the zero-hidden-renderer-work and exact-restoration contract"
           ]
         },
@@ -4527,6 +5050,42 @@
         }
       ],
       "evidenceRuns": [
+        {
+          "date": "2026-08-10",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts --maxWorkers=1",
+          "result": "passed",
+          "durationSeconds": 1.56,
+          "summary": "All 16 production-parity parking/watcher contracts passed on the combined candidate, covering the maximum-depth loop, semantic stability, StrictMode ownership, split-PTY reconciliation, and zero-park fast path."
+        },
+        {
+          "date": "2026-08-10",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
+          "result": "passed",
+          "durationSeconds": 27.6,
+          "summary": "The isolated headed desktop host and separate encrypted paired client drove 180 timed decorative real-PTY titles across six hidden worktrees and observed exactly 12 semantic transport envelopes and 12 production store title mutations, then reduced six managers to one, stayed within heap/cell/timer budgets, restored the bounded host tail exactly, and continued input/output while the host renderer retained zero target managers."
+        },
+        {
+          "date": "2026-08-10",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 33.9,
+          "summary": "The isolated headless `orca serve` host passed the same six-worktree real-title transport/store bound, parking, and exact-restoration oracle; a second scenario proved cold activation mounted only the visible paired terminal."
+        },
+        {
+          "date": "2026-08-10",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts --maxWorkers=1",
+          "result": "passed",
+          "durationSeconds": 5.62,
+          "summary": "Forty-two deterministic contracts passed. The real-PTY cross-boundary contract delivered all 2,880 decorative spinner and bare-native redraw chunks with zero hot-path host publications, serialized bytes, renderer applies, or store mutations; continued past 30 minutes with one globally spaced freshness refresh per worktree every 15 minutes; kept all 24 mirrored statuses working; and preserved stable stateStartedAt. Exact-identical Pi and rotating normalized Pi/Grok frames renewed renderer-authored and retained-hook status without changing acknowledgement semantics. Rich status could not cross task completion, permission, provider-generation, or identity-owner boundaries, while neutral titles preserved same-task prompt and acknowledgement identity until authoritative shell evidence. Fresh renderer, retained OSC, and live-hook questions remained visible under the current shell title, but a later working interval, identity-only owner title, or provider generation stripped them; inherited tools and stale, resume-only, restored, or prior-interval questions stayed suppressed. After each rich source's original lease expired, title evidence kept only coarse working state and provider identity fresh while dropping unverifiable prompts. Unknown foreground ownership held publications at zero until resolution, then resumed the bounded heartbeat; tracked terminal state reset removed its delayed marker. The focused heartbeat contracts proved worktree deduplication, FIFO fairness, semantic bypass, PTY-source teardown, and timer cleanup. Causal-disable controls made ownership, teardown, retained source-switch, renderer rich-TTL, completion-transition, boundary-ordering, and live-question oracles fail; restoring the production corrections returned green."
+        },
         {
           "date": "2026-08-07",
           "runner": "local",
@@ -4691,11 +5250,11 @@
       },
       "redGreenEvidence": {
         "status": "complete",
-        "evidence": "The six-PTY ordinary-parking oracle was red in two independently observed stages: the parked paired remount first used detached attach and restored only rows 5,963–5,999, then the requested snapshot still lost to the current-screen replay until park reveals explicitly entered the capability-gated reattach coordinator. The candidate is green on headed and headless hosts, while disabling terminal.paired-parking.v1 makes the byte-identical oracle fail at its capability precondition and leaves the separately tested legacy lossy fallback green. The 64-PTY decorative-title control delivered 576 client events after convergence on unmodified main; the candidate delivers zero while preserving all 640 local frames, one current frame to a late client, and bell/idle transitions to both clients. The legacy no-output-pause control failed to request a reveal snapshot and kept hidden bytes on the xterm path; the candidate gates those bytes locally and restores one authoritative snapshot before live output. With stalled-stream recovery disabled, the host cursor advanced but the client remained frozen; enabling it repainted the marker with the same PTY and tab. The sequence-gap unit and headed paired oracle are red on current main and with only the new probe decision reverted: the authoritative host advances while the client stays stale after a successful probe. The candidate replaces the stream, repaints the marker, preserves PTY identity, and resumes I/O. Reverting the active-stream limit to 64 makes the exact 128-stream contract fail at 64; restoring 128 admits every intended stream, rejects 129, and reattaches it after one slot releases. The host-relaunch oracle fails when unknown delivery state is coerced to foregrounded or a layout version becomes an output high-water; the candidate foregrounds the preserved daemon PTY once and resumes same-PTY input/output. When authoritative inventory overlaps a refused in-flight attach, removing only the post-settlement retry leaves the existing subscriber without daemon output; the candidate retains one waiter across repeated inventory publications, retries exactly once, and restores live output."
+        "evidence": "The six-PTY ordinary-parking oracle was red in two independently observed stages: the parked paired remount first used detached attach and restored only rows 5,963–5,999, then the requested snapshot still lost to the current-screen replay until park reveals explicitly entered the capability-gated reattach coordinator. The candidate is green on headed and headless hosts, while disabling terminal.paired-parking.v1 makes the byte-identical oracle fail at its capability precondition and leaves the separately tested legacy lossy fallback green. The parked-title production-parity control throws Maximum update depth exceeded on the affected parking synchronization and settles with semantic dependencies; forced memo-cache discard, StrictMode cleanup replay, and split-PTY replacement are independently red before their corrections and green on the combined candidate. The real-PTY session-tabs oracle produces 96 full snapshots, 64,032 serialized bytes, 96 renderer applies, and 96 store mutations on unmodified main and on a one-line causal revert before reaching the alternating native-title phase; the candidate produces zero in all four dimensions while preserving all 2,880 redraw chunks and 24 exact semantic transitions. The 64-PTY decorative-title control delivered 576 client events after convergence on unmodified main; the candidate delivers zero while preserving all 640 local frames, one current frame to a late client, and bell/idle transitions to both clients. The legacy no-output-pause control failed to request a reveal snapshot and kept hidden bytes on the xterm path; the candidate gates those bytes locally and restores one authoritative snapshot before live output. With stalled-stream recovery disabled, the host cursor advanced but the client remained frozen; enabling it repainted the marker with the same PTY and tab. The sequence-gap unit and headed paired oracle are red on current main and with only the new probe decision reverted: the authoritative host advances while the client stays stale after a successful probe. The candidate replaces the stream, repaints the marker, preserves PTY identity, and resumes I/O. Reverting the active-stream limit to 64 makes the exact 128-stream contract fail at 64; restoring 128 admits every intended stream, rejects 129, and reattaches it after one slot releases. The host-relaunch oracle fails when unknown delivery state is coerced to foregrounded or a layout version becomes an output high-water; the candidate foregrounds the preserved daemon PTY once and resumes same-PTY input/output. When authoritative inventory overlaps a refused in-flight attach, removing only the post-settlement retry leaves the existing subscriber without daemon output; the candidate retains one waiter across repeated inventory publications, retries exactly once, and restores live output."
       },
       "performanceBudget": {
         "required": true,
-        "evidence": "Before ordinary parking, six warm-mounted hidden paired xterms receive zero raw frames and schedule zero renderer output drains while host models continue ingesting sustained output. Ordinary parking then retains the host PTY and bounded 5,000-row provider model while destroying five client xterms. Decorative title ticks are collapsed per paired subscriber before JSON serialization and encryption; semantic facts remain on the singleton client-event stream. Headed and headless oracles require exact reduction from six managers to one, at least 55% staged xterm-cell release, no more than 16 MiB heap growth, and under 500 ms timer drift. Legacy hosts retain the prior 12-worktree/45-minute lossy force-parking policy but now gate hidden raw output before xterm scheduling and restore from a bounded snapshot on reveal. Stream recovery adds no polling and is scoped to one stream. Provider-ready reconciliation runs only for PTYs returned by a successful controller inventory, requires an existing remote subscriber, and retains at most one post-settlement waiter per PTY while attach deduplication remains active."
+        "evidence": "Before ordinary parking, six warm-mounted hidden paired xterms receive zero raw frames and schedule zero renderer output drains while host models continue ingesting sustained output. The headed and headless production transports each admit only the initial and final semantic title snapshots per worktree across 180 timed decorative frames, and the real store performs only those 12 exact title mutations. Ordinary parking then retains the host PTY and bounded 5,000-row provider model while destroying five client xterms. Parked watcher synchronization is keyed by bounded parking semantics rather than fresh object identities; unrelated store writes perform zero PTY-map reads when no tab is parked, while parked reconciliation remains bounded by the worktree's terminal tabs and assignments. Decorative title ticks are collapsed both on the paired client-event channel and at the authoritative real-PTY session-tabs classifier before snapshot construction, serialization, transport, recovery, or store application; semantic facts remain exact. Headed and headless oracles require exact reduction from six managers to one, at least 55% staged xterm-cell release, no more than 16 MiB heap growth, and under 500 ms timer drift. The forced hidden-worktree retention policy keeps at most four otherwise un-parkable worktrees mounted and force-parks all after 15 minutes; the separate ordinary hot-retain policy keeps at most four recently visible worktrees warm for five minutes. Legacy hosts still gate hidden raw output before xterm scheduling and restore from a bounded snapshot on reveal. Stream recovery adds no polling and is scoped to one stream. Provider-ready reconciliation runs only for PTYs returned by a successful controller inventory, requires an existing remote subscriber, and retains at most one post-settlement waiter per PTY while attach deduplication remains active."
       },
       "promotionCriteria": [
         "Collect 100 consecutive CI passes or 14 days of soak history for the headed and headless parking commands.",
@@ -4712,7 +5271,7 @@
         "The legacy protocol shape is deterministic unit coverage; a packaged pre-v1.4.163 host has not yet run the full headed memory oracle.",
         "The live windows-issues incident recorded two fast snapshot-probe successes while fresh output remained stale, but that release did not log the returned snapshot sequence; the deterministic sequence-gap oracle matches the observed false-health boundary without proving the field transport's lower-level drop mechanism."
       ],
-      "demotionRule": "Keep experimental or demote to protection none if decorative title frequency changes paired client-event volume after convergence, a semantic fact is dropped, paired first paint is blank, passive work reconnects after manual disconnect, a capable hidden paired manager survives ordinary parking, a legacy hidden pane schedules raw xterm output or bypasses its fallback, reveal loses requested bounded history or live PTY identity, retained buffer cells do not fall, or either headed/headless scenario flakes."
+      "demotionRule": "Keep experimental or demote to protection none if decorative title frequency changes paired client-event or session-tabs publication volume after convergence, a semantic fact is dropped, paired first paint is blank, passive work reconnects after manual disconnect, a capable hidden paired manager survives ordinary parking, a legacy hidden pane schedules raw xterm output or bypasses its fallback, reveal loses requested bounded history or live PTY identity, retained buffer cells do not fall, or either headed/headless scenario flakes."
     },
     {
       "id": "terminal-performance.no-hot-list-sessions",
@@ -6585,7 +7144,7 @@
     },
     {
       "id": "terminal-input.ime-and-synthetic-forwarding",
-      "title": "IME, native text, and synthetic input commit exactly once and do not leak preedit bytes",
+      "title": "IME, native text, and synthetic input commit exactly once, do not leak preedit bytes, and pair every claimed press with one release",
       "maturity": "experimental",
       "protection": "partial",
       "owner": "terminal-input",
@@ -6602,18 +7161,19 @@
       "providers": ["local", "daemon", "ssh", "remote-runtime"],
       "coveredPlatforms": ["macos", "linux"],
       "coveredProviders": [],
-      "coverageNotes": "Local macOS and containerized Linux evidence, deterministic renderer-unit coverage for the Linux/Sogou candidate-key policy including the legacy orphaned-keyup fallback, and Electron/CDP live-PTY Sogou-style repros. Real Linux/Sogou OS IME automation, Windows ConPTY post-agent reset, and the CJK/Vietnamese/Arabic matrix remain registered gaps.",
+      "coverageNotes": "Local macOS and containerized Linux evidence, deterministic renderer-unit coverage for the Linux/Sogou candidate-key policy including the legacy orphaned-keyup fallback, Electron/CDP live-PTY Sogou-style repros, and a macOS renderer/main slice for Preview kitty commits: claimed press/release pairing in both keyup orderings, and snapshot flag provenance where a proven 0, a proven non-zero, and an absent field stay three distinct facts from daemon through the sequenced remote SnapshotStart frame. Real Linux/Sogou OS IME automation, Windows ConPTY post-agent reset, and the CJK/Vietnamese/Arabic matrix remain registered gaps.",
       "motivatingLinks": [
         "https://github.com/stablyai/orca/pull/6699",
         "https://github.com/stablyai/orca/pull/6682",
         "https://github.com/stablyai/orca/pull/6513",
         "https://github.com/stablyai/orca/pull/6999"
       ],
-      "invariant": "Composition, native text forwarding, synthetic input, paste, and platform keyboard bypass paths must not send preedit/control bytes before commit and must commit text exactly once to the intended PTY.",
-      "oracle": "The current renderer-unit slice asserts native text commits route to the intended PTY once, composition/preedit bookkeeping does not leak premature text, input-source classification handles synthetic/native paths, paste/runtime forwarding avoids duplicate terminal payloads for covered fixtures, and Linux/Sogou candidate Space/digit selectors do not leak keydown/keypress/keyup while ordinary and long-held letter-to-digit typing remains available. The Electron/CDP live-PTY repro verifies Sogou-style Space and digit selectors submit only the committed Chinese text, while the legacy orphaned-letter-keyup sequence sends no selector byte to the PTY. Real legacy IME commit preservation and the full CJK/Vietnamese/Arabic/JIS-yen matrix run in follow-up platform soak where automation is possible.",
+      "invariant": "Composition, native text forwarding, synthetic input, paste, and platform keyboard bypass paths must not send preedit/control bytes before commit and must commit text exactly once to the intended PTY. When the snapshot source proves kitty state, macOS Preview commits must use the application's effective flags after the sequenced snapshot and every proven replay/live transition, and a claimed press delivered under report_event_types must produce exactly one matching release regardless of whether keyup arrives before or after insertText and regardless of xterm's defensive internal reset.",
+      "oracle": "Exact outbound bytes from the REAL native-text forwarder behind installPreviewImeBridge after initial snapshot restore, replacement resync, live transitions, and both keydown->insertText->keyup and keydown->keyup->insertText orderings; a wiring-only mock is supporting evidence, not the oracle. The current renderer-unit slice asserts native text commits route to the intended PTY once, composition/preedit bookkeeping does not leak premature text, input-source classification handles synthetic/native paths, paste/runtime forwarding avoids duplicate terminal payloads for covered fixtures, and Linux/Sogou candidate Space/digit selectors do not leak keydown/keypress/keyup while ordinary and long-held letter-to-digit typing remains available. The Electron/CDP live-PTY repro verifies Sogou-style Space and digit selectors submit only the committed Chinese text, while the legacy orphaned-letter-keyup sequence sends no selector byte to the PTY. Real legacy IME commit preservation and the full CJK/Vietnamese/Arabic/JIS-yen matrix run in follow-up platform soak where automation is possible.",
       "commands": [
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/shared/terminal-kitty-keyboard-mode-tracker.test.ts src/main/ipc/terminal-preview.test.ts src/main/ipc/terminal-preview-output-stream.test.ts src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts src/main/daemon/daemon-pty-adapter.test.ts",
         "pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts"
       ],
       "testFiles": [
@@ -6626,6 +7186,14 @@
         "src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
         "src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts",
         "src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
+        "src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts",
+        "src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts",
+        "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx",
+        "src/shared/terminal-kitty-keyboard-mode-tracker.test.ts",
+        "src/main/ipc/terminal-preview.test.ts",
+        "src/main/ipc/terminal-preview-output-stream.test.ts",
+        "src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts",
+        "src/main/daemon/daemon-pty-adapter.test.ts",
         "tests/e2e/chinese-ime-chat-input-repro.spec.ts"
       ],
       "assertionRefs": [
@@ -6690,6 +7258,65 @@
             "macOS standalone Process key behavior and composition-owned key suppression stay intact"
           ]
         },
+        {
+          "file": "src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts",
+          "assertions": [
+            "the real forwarder behind the Preview bridge encodes the commit from the snapshot-proven flags before any live output",
+            "flags 0/1 commit raw text, flags 2 add one CSI-u release, flags 8 emit one CSI-u press, and flags 10 emit a CSI-u press followed by exactly one release",
+            "both keydown->insertText->keyup and keydown->keyup->insertText orderings produce the same bytes",
+            "the release is emitted by the forwarder while xterm's internal kitty flags stay 0",
+            "the mutable flags getter is read exactly once, at commit time, never on keydown or keyup",
+            "auto-repeat, two-key rollover, a swallowed commit, a retired claim, blur, and disposal each emit at most one release and never synthesize one"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts",
+          "assertions": [
+            "a Preview opened on a snapshot carrying flags 8 adopts 8 before any live output",
+            "a replacement snapshot whose ANSI carries no kitty bytes keeps its proven flags, and a proven 0 clears an earlier 8",
+            "a missing field leaves the mirror unproven at the raw-text fallback and a later live negotiation still upgrades it",
+            "restored flags land on the screen the snapshot scan selected",
+            "a proven post-snapshot suffix advances the stack while redelivered bytes apply idempotently"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx",
+          "assertions": [
+            "the Preview hands the forwarder the live kitty mirror seeded from the snapshot's proven flags"
+          ]
+        },
+        {
+          "file": "src/shared/terminal-kitty-keyboard-mode-tracker.test.ts",
+          "assertions": [
+            "a fresh PTY's known 0 is distinguishable from a snapshot's unproven 0 fallback",
+            "restoreSnapshotFlags proves only the active screen and rejects non-safe-integer values",
+            "provenance survives absolute sets, screen switches, RIS and DECSTR, but a pop past omitted push history returns to unknown rather than a manufactured 0"
+          ]
+        },
+        {
+          "file": "src/main/ipc/terminal-preview.test.ts",
+          "assertions": [
+            "terminalPreview:connect returns image, sequence, and kitty flags from the same capture, including after an overflow retry"
+          ]
+        },
+        {
+          "file": "src/main/ipc/terminal-preview-output-stream.test.ts",
+          "assertions": [
+            "fully covered chunks are dropped, a sliced or strictly newer sequenced suffix gets live mode semantics, and an unsliceable or metadata-less overlap gets replay semantics"
+          ]
+        },
+        {
+          "file": "src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts",
+          "assertions": [
+            "SnapshotStart decodes proven 0 and 8 with their seq into requested and host-pushed snapshot paths",
+            "negative, fractional, unsafe, and non-numeric values are treated as absent rather than clamped",
+            "an old host that omits the field stays usable and is never coerced to a proven 0"
+          ]
+        },
+        {
+          "file": "src/main/daemon/daemon-pty-adapter.test.ts",
+          "assertions": ["daemon provider snapshots publish proven kitty flags including a known 0"]
+        },
         {
           "file": "tests/e2e/chinese-ime-chat-input-repro.spec.ts",
           "assertions": [
@@ -6701,6 +7328,15 @@
         }
       ],
       "evidenceRuns": [
+        {
+          "date": "2026-08-11",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/shared/terminal-kitty-keyboard-mode-tracker.test.ts src/main/ipc/terminal-preview.test.ts src/main/ipc/terminal-preview-output-stream.test.ts src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts src/main/daemon/daemon-pty-adapter.test.ts",
+          "result": "passed",
+          "durationSeconds": 9.84,
+          "summary": "8 test file(s) passed, 288 tests, covering the Preview kitty slice: real forwarder bytes at snapshot-proven flags, press/release pairing across both keyup/insertText orderings, and flag provenance where a proven 0, a proven non-zero, and an absent field stay three distinct facts — asserted on the daemon snapshot and on a host-pushed remote snapshot that carries the flags with their sequence. The emitter-side rule that a remote SnapshotStart withholds flags without a seq has no direct assertion yet; the client-side gate is what these files pin."
+        },
         {
           "date": "2026-08-09",
           "runner": "local",
@@ -6766,7 +7402,7 @@
       },
       "redGreenEvidence": {
         "status": "partial",
-        "evidence": "Focused tests cover existing native-text, input-source, paste/runtime forwarding, Linux/Sogou candidate selector, post-composition guard contracts, and live-PTY Sogou-style candidate commits. Needs intentional-break proof for duplicate native text forwarding and composition preedit leakage, plus the broader language/platform matrix."
+        "evidence": "Focused tests cover existing native-text, input-source, paste/runtime forwarding, Linux/Sogou candidate selector, post-composition guard contracts, live-PTY Sogou-style candidate commits, and the Preview kitty slice (press/release pairing in both keyup orderings, and snapshot flag provenance separating a proven 0 from an absent field). Needs intentional-break proof for duplicate native text forwarding and composition preedit leakage, plus the broader language/platform matrix."
       },
       "performanceBudget": {
         "required": true,
@@ -6779,7 +7415,9 @@
       ],
       "knownGaps": [
         "Current commands include renderer-unit coverage and a CDP-driven Electron repro; real OS IME automation may need manual or soak evidence.",
-        "Backspace/Enter during composition, JIS yen, Arabic/RTL, paste edge cases, and Windows ConPTY post-agent key reset still need representative gate coverage."
+        "Backspace/Enter during composition, JIS yen, Arabic/RTL, paste edge cases, and Windows ConPTY post-agent key reset still need representative gate coverage.",
+        "An older remote host omits the optional SnapshotStart kitty field, so a new client falls back to raw commits until live negotiation is observed.",
+        "Snapshot authorities expose only the active screen's effective flags, not kitty's complete two-screen push stacks; a pop that crosses the restored boundary degrades to unknown rather than a proven value."
       ],
       "demotionRule": "Cannot promote if success is based only on DOM text without PTY byte/cell evidence."
     },
@@ -7122,14 +7760,16 @@
       "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
       "coveredPlatforms": ["macos"],
       "coveredProviders": ["local", "daemon"],
-      "coverageNotes": "Runtime and provider-contract tests on macOS cover exact-PTY authorization, local/daemon fresh confirmation, exact ConPTY membership, and unsupported-provider fail-closed behavior. Physical Windows, live Linux, SSH, WSL, and remote-runtime validation remain explicit gaps; providers without confirmation preserve conservative refusal on a shell conflict.",
+      "coverageNotes": "Runtime and provider-contract tests on macOS cover exact-PTY authorization, verified managed-Claude launch identity, local/daemon fresh confirmation, exact ConPTY membership, and unsupported-provider fail-closed behavior. Physical Windows, live Linux, SSH, WSL, and remote-runtime validation remain explicit gaps; providers without confirmation preserve conservative refusal when no verified launch identity exists.",
       "motivatingLinks": ["https://github.com/stablyai/orca/issues/8303"],
-      "invariant": "A guarded note send writes only to the exact PTY binding checked by the guard and only while permission/wait evidence allows input; fresh hook state conflicting with an ordinary shell foreground requires fresh provider confirmation of a recognized agent in that PTY.",
-      "oracle": "Fresh explicit state plus ordinary PowerShell plus confirmed recognized agent is sendable on the same PTY. Confirmed shell/non-agent, unavailable confirmation, PTY exit, handle rebind, or a callback PTY mismatch returns a refusal or not-writable result and writes zero bytes.",
+      "invariant": "A guarded note send writes only to the exact PTY binding checked by the guard and only while permission/wait evidence allows input; a generic busy title requires independent agent identity from the title, a verified managed launch bound to the current PTY incarnation, or the foreground process; fresh hook state conflicting with an ordinary shell foreground requires fresh provider confirmation of a recognized agent in that PTY.",
+      "oracle": "A quarter-circle Claude task title authorizes without a provider lookup only on the exact PTY incarnation carrying verified managed-Claude launch identity; the same title in a bare pane, with an unverified launch hint, or after PTY incarnation replacement is refused while current Claude activity remains a working signal. Fresh explicit state plus ordinary PowerShell plus confirmed recognized agent is sendable on the same PTY. Confirmed shell/non-agent, unavailable confirmation, PTY exit, handle rebind, or a callback PTY mismatch returns a refusal or not-writable result and writes zero bytes.",
       "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/quarter-circle-title-send-authorization.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send.test.ts src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx"
       ],
       "testFiles": [
+        "src/main/runtime/quarter-circle-title-send-authorization.test.ts",
         "src/main/runtime/orca-runtime.test.ts",
         "src/main/runtime/rpc/terminal-send.test.ts",
         "src/main/ipc/pty.test.ts",
@@ -7142,6 +7782,14 @@
         "src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx"
       ],
       "assertionRefs": [
+        {
+          "file": "src/main/runtime/quarter-circle-title-send-authorization.test.ts",
+          "assertions": [
+            "a verified managed-Claude launch authorizes a task-text quarter-circle title without foreground-process work",
+            "a bare pane, an unverified launch hint, and a replacement PTY incarnation remain refused",
+            "quarter circles remain working signals and braille authorization is unchanged"
+          ]
+        },
         {
           "file": "src/main/runtime/orca-runtime.test.ts",
           "assertions": [
@@ -7209,6 +7857,15 @@
         }
       ],
       "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/quarter-circle-title-send-authorization.test.ts",
+          "result": "passed",
+          "durationSeconds": 20.9,
+          "summary": "The focused file passed 9 tests, including current-incarnation managed-Claude authorization with zero foreground calls and fail-closed bare, unverified, and replacement-incarnation quarter-circle titles."
+        },
         {
           "date": "2026-07-11",
           "runner": "local",
@@ -7229,11 +7886,11 @@
       },
       "redGreenEvidence": {
         "status": "partial",
-        "evidence": "Removing strong confirmation fails the shell-conflict success oracle, while removing either exact-binding comparison fails zero-write rebind coverage; saved intentional-break and physical Windows evidence remain missing."
+        "evidence": "Before the verified-launch fallback, the managed-Claude unavailable-foreground case failed with isRunningAgent false; the focused file passed 7 tests after the fix. Removing the launch-incarnation comparison makes the replacement-incarnation refusal fail. Removing strong confirmation fails the shell-conflict success oracle, while removing either exact-binding comparison fails zero-write rebind coverage; physical Windows evidence remains missing."
       },
       "performanceBudget": {
         "required": true,
-        "evidence": "Confirmation is invoked at most once per status evaluation and only for fresh explicit hook state whose ordinary foreground result is a shell. Count tests prove permission/title blockers and ordinary recognized-agent evidence add zero confirmations; no polling, retry, session listing, provider fanout, or runtime-global cache is added, and existing provider snapshot dedup remains authoritative."
+        "evidence": "Confirmation is invoked at most once per status evaluation and only for fresh explicit hook state whose ordinary foreground result is a shell. Count tests prove verified managed-Claude launch identity, permission/title blockers, and ordinary recognized-agent evidence add zero provider calls; no polling, retry, session listing, provider fanout, or runtime-global cache is added, and existing provider snapshot dedup remains authoritative."
       },
       "promotionCriteria": [
         "Run the browser annotation existing-agent and repeat-send path in Electron on Windows ConPTY without a recognition refusal.",
@@ -7246,7 +7903,7 @@
         "SSH, WSL, legacy daemon, and remote-runtime providers without confirmation remain intentionally fail-closed on an ordinary-shell conflict; no live artifacts cover those degraded paths.",
         "No live Linux PTY, paired-web, mobile/relay, restore/replay, or multi-window artifact is attached; those surfaces receive no renderer, persistence, or protocol change."
       ],
-      "demotionRule": "Keep non-blocking or demote to protection none if provider confirmation becomes unconditional, exact-PTY mismatch can write bytes, unsupported providers fail open, or the focused gate flakes without an actionable product or harness defect."
+      "demotionRule": "Keep non-blocking or demote to protection none if a generic busy title authorizes without exact title, verified-launch, or foreground identity; provider confirmation becomes unconditional; exact-PTY mismatch can write bytes; unsupported providers fail open; or the focused gate flakes without an actionable product or harness defect."
     },
     {
       "id": "terminal-input.agent-prompt-injection",
@@ -7391,19 +8048,25 @@
       "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
       "coveredPlatforms": ["macos"],
       "coveredProviders": ["local", "daemon", "ssh"],
-      "coverageNotes": "A deterministic service-state-machine oracle now models a current-contract worker and coordinator whose renderer graph identities disappear across an app/runtime update. It exercises the production verifier with restored PTY and hydrated hook commitments, proves authenticated completion replay across a fresh runtime, explicit takeover, ordinary mail routing, remote-attachment process fencing, retained Task/Dispatch/terminal identity, and unchanged fixture marker bytes, and rejects foreign pane evidence. Other deterministic units cover authority-aware legacy formatting, exact legacy worker identity planning, local worker presentation, retained-output reads after adoption, reveal-failure warnings, stable-pane Run/Dispatch routing, creator pane/process/Run-generation fencing, indexed retained-Run lookup scaling, the SSH in-process CLI fallback, and federated non-reveal. Two isolated macOS Electron journeys launch fake Codex workers through the real RPC path and record append-only spawn/interruption ledgers. They assert immediate inactive presentation, one live agent PID, stable PTY/incarnation/tab/leaf/worktree/Task/Dispatch identity, and no interruption after workspace re-entry; the restart journey additionally removes renderer ownership, marks the Dispatch legacy, retains the daemon process across an app restart, and proves exact background adoption with readable ACK output and no resume replay. Distinct A/B artifacts plus live SSH, WSL, folder, remote-runtime, Linux, and Windows cutover journeys remain explicit gaps.",
-      "motivatingLinks": ["https://github.com/stablyai/orca/pull/11107#discussion_r3663321387"],
-      "invariant": "Starting a worker in the coordinator's current workspace must materialize one inactive terminal tab before worker-start returns, preserve coordinator focus, and remain exactly once after workspace re-entry. After an app update or restart, an exact live legacy worker must fence automatic provider resume, adopt its original PTY into its original background pane, retain readable output, and clear the resume record without spawning, writing, signalling, interrupting, replacing, or focusing the worker. A current-contract worker whose renderer graph identity is temporarily absent must retain its Dispatch capability and settle exactly once from exact hook-attested handle, pane, and process evidence; otherwise only an exact attested coordinator may take over. An exact existing target workspace must receive a discoverable tab without stealing coordinator focus; if renderer reveal fails, worker-start must expose that the live worker remains background-only. Run and Dispatch checks must resolve through the caller's stable pane identity when a terminal handle is reminted, while a live handle outranks mismatched pane metadata. A nested worker's creator edge requires the current creator pane, process incarnation, and owning Run generation; reminting and rebinding that pane to another Run must remove the stale edge. Explicit legacy terminal inspection remains handle-scoped, and remote or headless worker presentation remains background-only.",
+      "coverageNotes": "A deterministic service-state-machine oracle now models a current-contract worker and coordinator whose renderer graph identities disappear across an app/runtime update. It exercises the production verifier with restored PTY and hydrated hook commitments, proves authenticated completion replay across a fresh runtime, explicit takeover, ordinary mail routing, remote-attachment process fencing, retained Task/Dispatch/terminal identity, and unchanged fixture marker bytes, and rejects foreign pane evidence. Other deterministic units cover authority-aware legacy formatting, exact legacy worker identity planning, local worker presentation, retained-output reads after adoption, reveal-failure warnings, stable-pane Run/Dispatch routing, creator pane/process/Run-generation fencing, indexed retained-Run lookup scaling, the SSH in-process CLI fallback, exact legacy Task/Dispatch/report-receipt verification, JSON rejection envelopes, and capability-negotiated Run-home settlement with lost-ack replay. Three isolated macOS Electron journeys launch fake Codex workers through the real RPC path. The compiled-CLI journey spawns fresh out/cli processes for rejected and accepted worker_done plus worker-release, then independently verifies runtime and SQLite state. The presentation and restart journeys assert immediate inactive presentation, one live agent PID, stable PTY/incarnation/tab/leaf/worktree/Task/Dispatch identity, and no interruption after workspace re-entry; the restart journey additionally proves exact background adoption with readable ACK output and no resume replay. Distinct A/B artifacts plus live SSH, WSL, folder, remote-runtime, Linux, and Windows cutover journeys remain explicit gaps.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/pull/11107#discussion_r3663321387",
+        "https://github.com/stablyai/orca/issues/13858"
+      ],
+      "invariant": "Starting a worker in the coordinator's current workspace must materialize one inactive terminal tab before worker-start returns, preserve coordinator focus, and remain exactly once after workspace re-entry. After an app update or restart, an exact live legacy worker must fence automatic provider resume, adopt its original PTY into its original background pane, retain readable output, and clear the resume record without spawning, writing, signalling, interrupting, replacing, or focusing the worker. A current-contract worker whose renderer graph identity is temporarily absent must retain its Dispatch capability and settle exactly once from exact hook-attested handle, pane, and process evidence; otherwise only an exact attested coordinator may take over. A worker_done caller may report success only after the owning runtime returns an explicit lifecycle verdict or authoritative reads prove that the exact Task, Dispatch, and worker report receipt settled the expected outcome. A federated worker may accept only the Run-home runtime's settlement verdict. An exact existing target workspace must receive a discoverable tab without stealing coordinator focus; if renderer reveal fails, worker-start must expose that the live worker remains background-only. Run and Dispatch checks must resolve through the caller's stable pane identity when a terminal handle is reminted, while a live handle outranks mismatched pane metadata. A nested worker's creator edge requires the current creator pane, process incarnation, and owning Run generation; reminting and rebinding that pane to another Run must remove the stale edge. Explicit legacy terminal inspection remains handle-scoped, and remote or headless worker presentation remains background-only.",
       "oracle": "Drive Run create, Task create, and worker-start through production Electron runtimes with a deterministic Codex fixture. Require append-only ledgers with one still-live PID and no interruption, a visible inactive worker tab while the coordinator stays active, Run delivery through stable pane identity, and stable PTY/incarnation, tab, leaf, worktree, Task, and Dispatch across workspace re-entry. In a restart journey, retain the original daemon PTY and PID, remove renderer ownership, retain sleeping-session evidence, mark the Dispatch legacy, relaunch, and require exact inactive tab adoption, readable ACK output, cleared resume state, one spawn, and no resume argv or Conversation interrupted text after another workspace round trip. The service oracle removes renderer lookup identity from current-contract callers while retaining real restored-PTY and hook commitments, replays authenticated completion and takeover across fresh runtimes, and requires one Task, Dispatch, terminal authority, message, mutation, ordinary-mail delivery, remote process fencing, and unchanged fixture marker bytes while foreign pane evidence remains rejected. Unit tests separately remint a creator pane and process from Run A into Run B, require the nested Run A worker to fall back to its current coordinator, require indexed query plans, and bound 300 Task reads with 50,000 retained Runs. They also assert authority-specific legacy affordances, exact identity and owner matching, retained-output fallback, pane-stable routing, federated non-activation, and SSH fallback parity.",
       "commands": [
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration.test.ts src/main/ssh/ssh-remote-orca-cli.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/rpc/methods/orchestration-federation.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/orchestration-legacy-worker-terminal-recovery.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts",
         "pnpm run test:e2e -- tests/e2e/orchestration-worker-terminal-visibility.spec.ts --workers=1",
-        "pnpm run test:e2e -- tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts --workers=1"
+        "pnpm run test:e2e -- tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts --workers=1",
+        "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
       ],
       "testFiles": [
         "src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts",
@@ -7412,13 +8075,18 @@
         "src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts",
         "src/main/runtime/orca-runtime.test.ts",
         "src/cli/handlers/orchestration.test.ts",
+        "src/cli/handlers/orchestration-lifecycle-rejection.test.ts",
+        "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts",
+        "src/cli/handlers/orchestration-migration.test.ts",
         "src/cli/handlers/orchestration-check-identity.test.ts",
         "src/cli/handlers/orchestration-worker-cli.test.ts",
         "src/main/runtime/rpc/methods/orchestration.test.ts",
         "src/main/runtime/rpc/methods/orchestration-federation.test.ts",
+        "src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts",
         "src/main/ssh/ssh-remote-orca-cli.test.ts",
         "tests/e2e/orchestration-worker-terminal-visibility.spec.ts",
-        "tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts"
+        "tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts",
+        "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts"
       ],
       "assertionRefs": [
         {
@@ -7461,6 +8129,27 @@
             "current formatting remains unchanged"
           ]
         },
+        {
+          "file": "src/cli/handlers/orchestration-lifecycle-rejection.test.ts",
+          "assertions": [
+            "an explicit current worker_done verdict completes without a compatibility read",
+            "a worker_done response without a lifecycle verdict checks the exact authoritative Dispatch and report receipt",
+            "legacy succeeded and failed reports require matching terminal Task and Dispatch state",
+            "stopped or stale Dispatches cannot impersonate report settlement",
+            "an idempotent retry accepts the first authoritative report from the same worker",
+            "a Run-home relay rejection reaches the CLI error boundary"
+          ]
+        },
+        {
+          "file": "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts",
+          "assertions": ["a rejected lifecycle verdict is emitted as a JSON ok=false envelope"]
+        },
+        {
+          "file": "src/cli/handlers/orchestration-migration.test.ts",
+          "assertions": [
+            "first and replayed legacy worker_done settlements are accepted from their authoritative runtime verdict"
+          ]
+        },
         {
           "file": "src/cli/handlers/orchestration-check-identity.test.ts",
           "assertions": [
@@ -7484,6 +8173,20 @@
             "a live handle cannot be retargeted by mismatched pane metadata"
           ]
         },
+        {
+          "file": "src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts",
+          "assertions": [
+            "a remote worker_done waits for Run-home settlement even when an older CLI omits the wait hint",
+            "older negotiated federation protocols reject before queueing",
+            "a committed settlement is replayed after an acknowledgment is lost",
+            "an aborted settlement wait returns operation_unknown instead of accepted success",
+            "an already-aborted signal registers no settlement waiter",
+            "a Run-home terminal verdict settles the remote attachment and revokes its capability",
+            "a terminal verdict cannot settle an unrelated relay item",
+            "a terminal verdict cannot contradict the exact queued worker report outcome",
+            "a rejected report replays its exact verdict without mutating durable rejection mail twice"
+          ]
+        },
         {
           "file": "src/main/runtime/rpc/methods/orchestration-federation.test.ts",
           "assertions": ["federated worker placement explicitly sets activate=false"]
@@ -7514,9 +8217,27 @@
             "sleeping-session, resume-claim, and pending-startup state are cleared after adoption",
             "no second spawn, resume argv, input, signal, interruption, or duplicate tab occurs after workspace re-entry"
           ]
+        },
+        {
+          "file": "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts",
+          "assertions": [
+            "a compiled CLI worker_done with the wrong identity exits nonzero with ok=false",
+            "the exact Task and Dispatch remain dispatched after rejection",
+            "the correct worker identity receives an explicit completed lifecycle verdict",
+            "an independent runtime read observes the Dispatch completed"
+          ]
         }
       ],
       "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 20,
+          "summary": "The combined candidate passed one real Electron and compiled-CLI journey: wrong worker identity exited nonzero with ok=false while Dispatch stayed dispatched, the exact worker received an explicit completed verdict, and runtime state independently reached completed."
+        },
         {
           "date": "2026-08-03",
           "runner": "local",
@@ -7562,6 +8283,24 @@
           "durationSeconds": 5.27,
           "summary": "Five focused files passed with 216 tests, covering visible inactive local worker creation, reveal-failure warnings, stable-pane mailbox routing, live-handle precedence, and SSH fallback parity."
         },
+        {
+          "date": "2026-08-11",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.4,
+          "summary": "Three focused files passed 12 deterministic tests covering explicit current and Run-home verdicts, JSON failure output, exact report and terminal-state verification for stripped responses, stale/stopped rejection, idempotent retry, and first/replayed attested legacy settlements."
+        },
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
+          "result": "passed",
+          "durationSeconds": 4.58,
+          "summary": "Nine deterministic tests passed for protocol negotiation, Run-home completion and rejection, already-aborted waits, authoritative remote-attachment settlement bound to the exact queued worker_done outcome, and exact verdict replay after lost acknowledgments without mutating durable rejection mail twice."
+        },
         {
           "date": "2026-07-28",
           "runner": "local",
@@ -7596,11 +8335,11 @@
       },
       "flakeHistory": {
         "status": "unknown",
-        "evidence": "The deterministic units and two isolated Electron journeys pass locally; CI and soak history are not yet available."
+        "evidence": "The deterministic units and three isolated Electron journeys pass locally; CI and soak history are not yet available."
       },
       "redGreenEvidence": {
-        "status": "partial",
-        "evidence": "The byte-identical 5f45c270f1 service oracle is red as the sole overlay 063340a8ba on origin/main@34291f07e9, green on candidate@2748b0b29b, red with current-authority propagation actually disabled in child 08a7db37bf, and green again after revert d2a4e2e024. The focused presentation and stale-handle tests failed against the earlier pre-fix implementation. The restart journey additionally failed first on empty retained output while the original PTY/PID remained live, then passed after the scoped recovered-worker snapshot fallback. The live incident and pre-fix Electron topology showed workspace re-entry replaying provider resume against a worker whose tab binding was missing. Distinct installed A/B and CI artifacts are still needed."
+        "status": "complete",
+        "evidence": "The byte-identical compiled-CLI Electron oracle failed on latest main 5ea7df1a5b because a wrong worker identity exited zero with ok=true while Dispatch stayed dispatched, passed on combined candidate d697666ce8 with a nonzero ok=false rejection and explicit completed verdict for the exact worker, and reproduced the main failure when the claimed production files were disabled at merge-base 64aec94cb2. The earlier byte-identical service oracle was also red on main, green on candidate, red with authority propagation disabled, and green after restore. Distinct installed A/B and CI artifacts are still needed."
       },
       "performanceBudget": {
         "required": true,
@@ -7761,25 +8500,55 @@
       "platforms": ["macos", "linux", "windows"],
       "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
       "coveredPlatforms": ["macos"],
-      "coveredProviders": ["local"],
-      "coverageNotes": "Deterministic service tests cover release-versus-reuse ordering, transactional retain and takeover cancellation, exact host/pane/process identity, conservative schema-v23 backfill, immutable transcript and bounded terminal archives, mutation restart, reset cleanup, replay idempotency, and 50-resource accounting. Live SSH, WSL, Windows, paired-runtime, and provider-close lost-ack journeys remain explicit gaps.",
-      "motivatingLinks": ["https://github.com/stablyai/orca/pull/12355", "STA-905"],
-      "invariant": "A settled Dispatch may close only its one coordinator-created terminal lease. Explicit reuse, real user input, retain, identity or host change, ambiguity, and another resource for the same exact host/pane/process must fence closure. Output preservation and the requested-to-releasing transition are atomic, archives remain readable without the provider file, retries resume idempotently, and orchestration reset removes archive and authority state.",
-      "oracle": "Record release intent for a settled owner, attempt exact reuse before close, and require worker-start to fail with terminal_release_in_progress while the terminal stays open; then release the original owner exactly once. Race retain and real user input against a controlled archive promise and require no committed archive or close. Change host or process identity and inject duplicate resource evidence to require retention. Freeze a structured transcript, delete its source file, and require archived worker-read to return the same bounded redacted messages. Restart a pending mutation, reset orchestration state, and create 50 resources while asserting replay convergence, zero orphan rows, two-query worker listing, and no unrelated close.",
+      "coveredProviders": ["local", "ssh"],
+      "coverageNotes": "Deterministic service tests cover release-versus-reuse ordering, transactional retain and takeover cancellation, exact host/pane/process identity, dead external/user-owned/transferred/stopped/abandoned reconciliation, conservative unknown provider and legacy metadata handling, immutable transcript and bounded terminal archives, mutation restart, reset cleanup, replay idempotency, and 50-resource accounting. A macOS Electron journey invokes the freshly compiled worker-release CLI after the worker process disappears, then independently checks released SQLite state and coordinator liveness. Injected inventories cover local and SSH provider routing; live SSH, WSL, Windows, paired-runtime, and provider-close lost-ack journeys remain explicit gaps.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/pull/12355",
+        "https://github.com/stablyai/orca/issues/13860",
+        "STA-905",
+        "STA-3932"
+      ],
+      "invariant": "A settled Dispatch may close only its one coordinator-created terminal lease. Explicit reuse, real user input, retain, identity or host change, ambiguity, and another resource for the same exact host/pane/process must fence closure. Once the authoritative owning provider positively excludes the resource's exact immutable process incarnation, even an external, user-owned, or transferred dead resource must converge to released without any process close. Unknown host scope, missing incarnation metadata, or unavailable inventory must remain retained. Output preservation and the requested-to-releasing transition are atomic, archives remain readable without the provider file, retries resume idempotently, and orchestration reset removes archive and authority state.",
+      "oracle": "Record release intent for a settled owner, attempt exact reuse before close, and require worker-start to fail with terminal_release_in_progress while the terminal stays open; then release the original owner exactly once. Race retain and real user input against a controlled archive promise and require no committed archive or close. For retained external, user-owned, transferred, stopped, and abandoned resources, run one fresh inventory against the exact local/WSL or SSH provider: an exact live incarnation and every unknown inventory shape stay retained, while positive absence atomically sets ownership_state and release_state to released with processAction none and zero closeTerminal calls. Change host or process identity and inject duplicate resource evidence to require retention. Freeze a structured transcript, delete its source file, and require archived worker-read to return the same bounded redacted messages. Restart a pending mutation, reset orchestration state, and create 50 resources while asserting replay convergence, zero orphan rows, two-query worker listing, and no unrelated close.",
       "commands": [
-        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts src/renderer/src/lib/worker-terminal-takeover-report.test.ts --reporter=dot"
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts src/renderer/src/lib/worker-terminal-takeover-report.test.ts --reporter=dot",
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts src/renderer/src/lib/worker-terminal-takeover-report.test.ts --reporter=dot",
+        "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts --reporter=verbose",
+        "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
       ],
       "testFiles": [
+        "src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts",
         "src/main/runtime/rpc/methods/orchestration-worker-release.test.ts",
         "src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts",
         "src/main/runtime/rpc/orchestration-mutation-ledger.test.ts",
         "src/main/runtime/orchestration/worker-transcript-read.test.ts",
-        "src/renderer/src/lib/worker-terminal-takeover-report.test.ts"
+        "src/renderer/src/lib/worker-terminal-takeover-report.test.ts",
+        "tests/e2e/completed-worker-retirement-resume.unit.test.ts",
+        "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts"
       ],
       "assertionRefs": [
+        {
+          "file": "src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts",
+          "assertions": [
+            "classifies only an exact incarnation as live on its owning provider",
+            "keeps missing or malformed identity and unavailable inventory unknown",
+            "does not inspect an unproven host scope",
+            "uses the local provider inventory for local and WSL scopes"
+          ]
+        },
+        {
+          "file": "tests/e2e/completed-worker-retirement-resume.unit.test.ts",
+          "assertions": [
+            "an already-exited succeeded Dispatch reaches released while its late exact close revokes the missing tab's stale resume record"
+          ]
+        },
         {
           "file": "src/main/runtime/rpc/methods/orchestration-worker-release.test.ts",
           "assertions": [
+            "reconciles a dead external terminal without closing a process",
+            "reconciles a dead user-taken-over terminal without closing a process",
+            "reconciles a dead stopped or abandoned worker without closing a process",
+            "reconciles dead transferred ownership after the current owner settles",
             "rejects exact reuse after release intent instead of closing the new worker",
             "lets an explicit retain cancel a release while output capture is pending",
             "retains when the terminal host scope changed instead of closing",
@@ -7799,9 +8568,36 @@
             "coalesces overlapping reconciliation passes and closes each resource once",
             "keeps live terminals bounded across 50 settled workers while controls survive"
           ]
+        },
+        {
+          "file": "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts",
+          "assertions": [
+            "compiled worker-release reconciles a dead external retained resource to released",
+            "the CLI reports processAction none instead of closing a process",
+            "SQLite independently records released ownership and release state",
+            "the unrelated coordinator terminal remains live"
+          ]
         }
       ],
       "evidenceRuns": [
+        {
+          "date": "2026-08-12",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 20,
+          "summary": "The combined candidate's compiled worker-release returned released with processAction none after positive process absence; an independent SQLite read showed both states released and the coordinator terminal remained live."
+        },
+        {
+          "date": "2026-08-11",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts src/renderer/src/lib/worker-terminal-takeover-report.test.ts --reporter=dot",
+          "result": "passed",
+          "durationSeconds": 4.98,
+          "summary": "Six focused files passed 67 tests on the rebased candidate, covering dead external, user-owned, stopped, abandoned, and transferred reconciliation; exact local/WSL/SSH provider routing; malformed, missing, and unavailable inventory retention; zero process closes; existing lease, archive, recovery, mutation, and renderer-input contracts."
+        },
         {
           "date": "2026-08-03",
           "runner": "local",
@@ -7813,20 +8609,20 @@
         }
       ],
       "runtimeBudget": {
-        "p95Seconds": 8,
-        "scope": "deterministic runtime, SQLite, transcript, renderer-input, and mutation contracts"
+        "p95Seconds": 45,
+        "scope": "deterministic runtime, SQLite, transcript, renderer-input, mutation contracts, and one compiled-CLI Electron journey"
       },
       "flakeHistory": {
         "status": "unknown",
-        "evidence": "First local deterministic run only; focused CI and soak history are not yet available."
+        "evidence": "Repeated local deterministic runs pass; focused CI and soak history are not yet available."
       },
       "redGreenEvidence": {
         "status": "complete",
-        "evidence": "The byte-identical 56-test oracle produced 12 deterministic failures and 44 passes with production restored to exact PR head 4aa66b62e3, including ready reuse during release, unsafe migration, stale archives, mutable transcript output, host/identity close gaps, and mutation replay loss. Candidate 457bc4edd1 passed all 56; restoring the same five production files to 4aa66b62e3 reproduced the same red state."
+        "evidence": "The byte-identical compiled-CLI Electron oracle left the dead resource external/retained on latest main 5ea7df1a5b, passed on combined candidate d697666ce8 with released/released SQLite state and processAction none, and reproduced external/retained after disabling the claimed production files at merge-base 64aec94cb2. The earlier unchanged three-case dead external/user-owned/transferred service oracle likewise failed 3/3 on main, passed 3/3 on candidate, and failed 3/3 with production restored; every run asserted durable state and zero terminal close calls."
       },
       "performanceBudget": {
         "required": true,
-        "evidence": "Release performs constant-count indexed resource and identity queries plus one bounded archive capture. Worker-list uses two set queries rather than one resource lookup per worker. Reconciliation remains serial and adds no polling, timers, subprocesses, renderer subscriptions, or provider-wide listing."
+        "evidence": "Normal owned release performs constant-count indexed resource and identity queries plus one bounded archive capture. A retained release performs exactly one bounded inventory against its authoritative local/WSL or specific SSH provider, with no retry, polling, timer, subprocess, renderer subscription, or per-session follow-up fanout. Worker-list uses two set queries rather than one resource lookup per worker."
       },
       "promotionCriteria": [
         "Collect 100 consecutive focused CI passes or 14 days of soak history.",
@@ -7837,7 +8633,7 @@
       "knownGaps": [
         "Provider close has no durable cross-process operation receipt, so a crash after host mutation but before SQLite settlement remains release_pending until exact inventory returns.",
         "Federated release remains explicitly unsupported and retained.",
-        "Mobile/direct remote input takeover and live Linux, Windows, WSL, SSH, headed, and headless paired-runtime release are not exercised."
+        "Mobile/direct remote input takeover and live Linux, Windows, WSL, SSH, headed, and headless paired-runtime release are not exercised; the current fix changes provider inventory classification and SQLite state only, not ConPTY, filesystem, update, sleep, firewall, or window lifecycle semantics."
       ],
       "demotionRule": "Keep experimental or demote if release can overlap exact reuse, close a conflicting lease, lose immutable output, retain reset archives, fan out per worker, or any focused ordering test flakes without a product or harness defect."
     },
@@ -8251,6 +9047,166 @@
       "knownGaps": ["No manifest command yet.", "No startup color-query contract is wired."],
       "demotionRule": "Cannot promote if success is based only on absence of visible artifacts."
     },
+    {
+      "id": "terminal-input.cooked-reply-queue",
+      "title": "Cooked-echo-safe terminal reply backlog stays bounded without evicting ordinary input",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "terminal-runtime",
+      "layer": "renderer-provider-contract",
+      "surfaces": [
+        "desktop terminal input",
+        "OSC 10/11 replies",
+        "mode-2031 replies",
+        "local PTY",
+        "daemon and SSH PTYs"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "daemon", "ssh"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["local", "ssh"],
+      "coverageNotes": "Deterministic renderer and IPC-transport tests prove count and text ceilings, oldest-reply shedding, explicit query-reply source routing, ordinary-input preservation, one-reply-per-write delivery, real xterm OSC reply generation, drain-failure containment, and clear/reuse generation fencing. Live macOS Electron tests cover local PTY OSC replies and interactive typing; a macOS-hosted Docker OpenSSH test proves a real Linux SSH process receives xterm's OSC reply through the same queue. No live daemon, WSL, physical Linux/Windows client, or mixed-version run is registered.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/issues/13137",
+        "https://github.com/stablyai/orca/issues/7329"
+      ],
+      "invariant": "The desktop PTY input queue retains at most 64 explicitly sourced pending cooked-echo-safe replies and 4096 UTF-16 code units. Overflow removes the oldest pending query-reply entries, never ordinary input or reply-shaped bytes from the ordinary path, so later user input has a finite reply backlog; every retained reply reaches the established provider path as one atomic write. Drain failures settle without an unhandled rejection and cannot clear a newer queue generation.",
+      "oracle": "Synchronously enqueue 10,000 cooked-echo-safe query replies before the scheduled drain and assert that only the initial immediate reply and newest 64 pending replies are written, each as one provider write, before a trailing keystroke. Repeat behind 10,000 ordinary inputs and through the real IPC transport, requiring ordinary and reply-shaped ordinary-path bytes to survive while only the newest 64 explicit replies remain. Exercise the text ceiling, real xterm OSC 10/11 generation, provider-write failure, rejected yield, and clear/reuse generation fencing.",
+      "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts src/shared/terminal-query-reply.test.ts src/shared/pty-startup-ingress-live-query-reply.test.ts",
+        "pnpm exec playwright test tests/e2e/terminal-osc-color-queries.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+        "pnpm exec playwright test tests/e2e/terminal-typing-latency.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+        "ORCA_E2E_SSH_DOCKER=1 pnpm exec playwright test tests/e2e/pty-input-write-queue-ssh.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
+      ],
+      "testFiles": [
+        "src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts",
+        "src/renderer/src/components/terminal-pane/pty-transport.test.ts",
+        "src/shared/terminal-query-reply.test.ts",
+        "src/shared/pty-startup-ingress-live-query-reply.test.ts",
+        "tests/e2e/terminal-osc-color-queries.spec.ts",
+        "tests/e2e/terminal-typing-latency.spec.ts",
+        "tests/e2e/pty-input-write-queue-ssh.spec.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts",
+          "assertions": [
+            "a synchronous 10,000-reply flood writes only the immediate first and newest 64 pending replies before a trailing keystroke",
+            "10,000 ordinary queued inputs survive a later reply flood while reply retention remains bounded",
+            "reply-shaped bytes from the ordinary input path never enter the shed-able reply budget",
+            "reply count and text overflow remove only the oldest pending replies",
+            "real xterm OSC 10/11 query handlers remain subject to the same retention ceiling",
+            "retained cooked-echo-safe replies stay one provider write each",
+            "provider-write and yield failures settle without unhandled rejection, repeated same-generation admission, or stale-generation clearing",
+            "clear releases saturated reply accounting and fences in-flight validation before later input"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/terminal-pane/pty-transport.test.ts",
+          "assertions": [
+            "sendInputImmediate applies the reply ceiling while sendInput preserves a reply-shaped ordinary payload in exact IPC write order",
+            "a thrown renderer write triggers one owning-transport recovery callback and rejects later input in that queue generation"
+          ]
+        },
+        {
+          "file": "src/shared/terminal-query-reply.test.ts",
+          "assertions": [
+            "only complete cooked-echo-risk replies are classified and consecutive replies extract losslessly"
+          ]
+        },
+        {
+          "file": "src/shared/pty-startup-ingress-live-query-reply.test.ts",
+          "assertions": [
+            "repeated live query replies are delivered independently and their cooked echoes stay hidden"
+          ]
+        },
+        {
+          "file": "tests/e2e/terminal-osc-color-queries.spec.ts",
+          "assertions": [
+            "real Electron xterm OSC 10/11 replies reach the active local PTY as separate writes"
+          ]
+        },
+        {
+          "file": "tests/e2e/terminal-typing-latency.spec.ts",
+          "assertions": [
+            "real keyboard input reaches and echoes from the active local PTY within the interactive latency ceilings"
+          ]
+        },
+        {
+          "file": "tests/e2e/pty-input-write-queue-ssh.spec.ts",
+          "assertions": [
+            "a real Linux SSH process emits an OSC query and receives xterm's synthetic reply through the live PTY queue"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-08-09",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts src/shared/terminal-query-reply.test.ts src/shared/pty-startup-ingress-live-query-reply.test.ts",
+          "result": "passed",
+          "durationSeconds": 2.35,
+          "summary": "Four files and 138 tests passed, including explicit IPC reply-source routing, the 10,000-reply count ceiling, text ceiling, 10,000-entry ordinary backlog preservation, real xterm OSC query flood, single-shot drain-failure recovery, one-reply-per-write echo containment, and clear/reuse generation fencing."
+        },
+        {
+          "date": "2026-08-09",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec playwright test tests/e2e/terminal-osc-color-queries.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 13.2,
+          "summary": "The real Electron/xterm OSC 10/11 query path wrote the exact foreground and background replies separately to the active local PTY."
+        },
+        {
+          "date": "2026-08-09",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec playwright test tests/e2e/terminal-typing-latency.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 10.6,
+          "summary": "Real keyboard events traversed xterm and the input queue to a local interactive PTY with every sampled key echoed inside the latency ceiling."
+        },
+        {
+          "date": "2026-08-09",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_E2E_SSH_DOCKER=1 pnpm exec playwright test tests/e2e/pty-input-write-queue-ssh.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "result": "passed",
+          "durationSeconds": 36.8,
+          "summary": "A real Linux process behind Docker OpenSSH emitted an OSC 10 query and observed xterm's synthetic RGB reply after it traversed the live renderer queue, Electron IPC, SSH provider, and relay PTY."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 120,
+        "scope": "focused unit, local Electron, and Docker SSH contracts"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "Ten consecutive local unit-gate runs passed 1,380 tests in 29.57 seconds total with no fixed timing sleeps. The exact Docker SSH OSC oracle passed three consecutive runs before extraction into its dedicated spec and then passed the registered dedicated command once. CI and the normal soak window are not yet available."
+      },
+      "redGreenEvidence": {
+        "status": "partial",
+        "evidence": "Without the branch's admission cap, the 10,000-reply fixture writes all replies before the trailing keystroke. Before the source-routing repair, the queue had no API capable of distinguishing reply-shaped ordinary input; before failure containment, a thrown provider write rejected waitForDrain and Vitest recorded an unhandled rejection; the first containment pass retried a failed generation and invoked recovery twice; before generation fencing, a rejected stale yield cleared fresh input. No saved intentional-break artifact is attached yet."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Pending cooked replies are capped at 64 and 4096 UTF-16 code units. Explicit source routing and separate sequence-merged FIFOs keep ordinary input out of the fixed-size reply store; oldest-reply eviction uses an amortized O(1) head advance without scanning ordinary input, consumed prefixes compact at a fixed threshold, and drain coalescing reads the stored classification without repeated reply-regex scans. A synchronous flood forwards only the immediate first and newest 64 replies before the trailing key. Ten complete gate runs, including two 10,000-entry flood shapes each, finished in 29.57 seconds with zero failures. The change adds no polling, timers, listeners, subprocesses, or network retries."
+      },
+      "promotionCriteria": [
+        "Run the gate on Windows and Linux CI.",
+        "Exercise a live daemon PTY with cooked echo enabled and record exact shell-visible and provider-visible bytes.",
+        "Attach an intentional-break run proving reply overflow cannot evict ordinary input or exceed either ceiling.",
+        "Accumulate the normal soak window with zero unexplained flakes."
+      ],
+      "knownGaps": [
+        "No live daemon, WSL, physical Linux/Windows client, mixed-version, or network-fault run is registered.",
+        "The remote-runtime transport has a separate immediate-input queue and is unaffected by this gate.",
+        "Ordinary-input queue growth predates this change and is outside this reply-only gate.",
+        "Reply overload intentionally sheds the oldest synthetic replies; live application behavior under a pathological query flood is not measured."
+      ],
+      "demotionRule": "Keep experimental or revert if ordinary input is evicted, pending replies exceed either ceiling, retained replies are coalesced, a trailing key sits behind more than the bounded reply window, or the gate develops unexplained flakes."
+    },
     {
       "id": "terminal-query.mobile-view-authority",
       "title": "Mobile xterm answers live terminal queries exactly once without replay or floor side effects",
@@ -8721,7 +9677,7 @@
     },
     {
       "id": "terminal-render.atlas-recovery-fanout",
-      "title": "Terminal atlas recovery stays bounded to visible renderers",
+      "title": "Ordinary terminal output avoids shared atlas recovery fanout",
       "maturity": "experimental",
       "protection": "partial",
       "owner": "terminal-rendering",
@@ -8730,31 +9686,33 @@
         "WebGL rendering",
         "document visibility",
         "hidden terminal output",
+        "alternate-screen redraws",
         "paired terminal traffic"
       ],
       "platforms": ["macos", "linux", "windows"],
       "providers": ["local", "daemon", "ssh", "remote-runtime"],
       "coveredPlatforms": ["macos"],
       "coveredProviders": ["local"],
-      "coverageNotes": "A deterministic renderer contract models one visible manager plus 64 mounted hidden managers, hidden synchronized/TUI output, and five minutes of sustained streaming recovery requests. A macOS Electron run verifies that a document visibility cycle preserves real WebGL atlases and terminal pixels. Production v1.4.163 evidence linked the same 49-manager fanout to paired traffic, but the candidate has not been rerun against an isolated live paired server.",
+      "coverageNotes": "Deterministic renderer contracts require foreground renderer-risk, synchronized, hidden, and alternate-screen PTY output to stay on pane-local repaint paths without a global atlas reset. Separate contracts preserve explicit paste, reveal, visibility-resume, system-resume, and confirmed-desync recovery. A macOS Electron run verifies that a document visibility cycle preserves real WebGL atlases and terminal pixels; the candidate has not been rerun against an isolated live paired server.",
       "motivatingLinks": [
         "https://github.com/stablyai/orca/pull/7054",
         "https://github.com/stablyai/orca/pull/7604",
         "https://github.com/stablyai/orca/issues/12094"
       ],
-      "invariant": "Ordinary document visibility transitions and hidden terminal output must not clear the shared WebGL glyph atlas. Heavy reset-and-refresh recovery may touch only managers with visible terminal surfaces; hidden managers recover when revealed. Sustained streaming recovery requests must keep resets rate-bounded without starving repair. Genuine OS resume remains a heavy recovery trigger.",
-      "oracle": "Dispatch a visible document visibilitychange and require atlas-preserving wake recovery; register one visible manager and 64 hidden managers and require exactly one reset and one refresh; parse hidden synchronized and high-confidence TUI output and require zero global atlas-recovery schedules. Across five minutes of 300ms streaming recovery requests, require more than one but at most 75 resets, no internal or trailing repair gap above 6.5 seconds, atlas-preserving presentation while a reset is suppressed, and one delayed wipe for a final suppressed settle. Separately, drive an Electron visibility cycle with two real WebGL panes, require zero atlas clears, and retain at least 85% of each pane's baseline ink pixels.",
+      "invariant": "Ordinary PTY output must never clear the shared WebGL glyph atlas, including synchronized frames, hidden output, renderer-risk glyphs, and alternate-screen entry, redraw, or exit. Affected visible panes still receive pane-local refresh after parsing. Explicit paste, reveal, visibility-resume, system-resume, context-loss, and confirmed-desync recovery remain available and may reset visible renderers.",
+      "oracle": "Parse foreground renderer-risk, synchronized, hidden, and alternate-screen PTY output and require pane-local refresh where needed with zero calls to shared reset-and-refresh recovery. Require the atlas-recovery module to expose only explicit lifecycle entry points, then verify paste and tab reveal still perform their recovery bursts. Dispatch a visible document visibilitychange and require atlas-preserving wake recovery; register one visible manager and 64 hidden managers and require heavy recovery to reset and refresh only the visible manager. Separately, drive an Electron visibility cycle with two real WebGL panes, require zero atlas clears, and retain at least 85% of each pane's baseline ink pixels.",
       "commands": [
-        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.test.ts src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
-        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery-rate.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
         "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
         "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
       ],
       "testFiles": [
         "src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts",
         "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.test.ts",
-        "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery-rate.test.ts",
+        "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
         "src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts",
+        "src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts",
+        "src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
         "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
         "tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts"
       ],
@@ -8770,22 +9728,28 @@
           ]
         },
         {
-          "file": "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery-rate.test.ts",
-          "assertions": [
-            "sustained streaming requests keep atlas resets rate-bounded with no repair starvation",
-            "suppressed resets present live buffers, cancel repair during resumed output, receive a trailing repair after settle, and clean up pending timers"
-          ]
+          "file": "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
+          "assertions": ["limits atlas recovery to explicit renderer lifecycle events"]
         },
         {
           "file": "src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts",
           "assertions": ["bounds atlas recovery to visible managers"]
         },
+        {
+          "file": "src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts",
+          "assertions": ["persists and recovers after the same cells stay missing twice"]
+        },
+        {
+          "file": "src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
+          "assertions": ["recovers a context-lost pane on the next rendering resume"]
+        },
         {
           "file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
           "assertions": [
-            "defers hidden synchronized-output atlas recovery until reveal",
-            "defers hidden high-confidence TUI redraw recovery until reveal",
-            "advances hidden rewrite state without scheduling atlas recovery"
+            "keeps hidden synchronized output off the global atlas recovery path",
+            "refreshes renderer-risk output without clearing the shared glyph atlas",
+            "refreshes alternate-screen redraws without clearing the shared glyph atlas",
+            "avoids atlas clears when one chunk enters and exits alternate screen"
           ]
         },
         {
@@ -8797,22 +9761,13 @@
       ],
       "evidenceRuns": [
         {
-          "date": "2026-08-04",
+          "date": "2026-08-10",
           "runner": "local",
           "platform": "macos",
-          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery-rate.test.ts",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
           "result": "passed",
-          "durationSeconds": 0.5,
-          "summary": "Seven deterministic tests passed for sustained reset cadence, bounded repair gaps, suppressed presentation with trailing repair, clock rollback, one-shot bypasses, and pending-timer cleanup."
-        },
-        {
-          "date": "2026-08-01",
-          "runner": "local",
-          "platform": "macos",
-          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.test.ts src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
-          "result": "passed",
-          "durationSeconds": 26,
-          "summary": "All 577 focused renderer contracts passed, including atlas-preserving visibility, visible-only recovery fanout, and hidden-output rewrite-state coverage."
+          "durationSeconds": 47,
+          "summary": "All 625 focused renderer contracts passed on the final head for atlas-preserving visibility, visible-only heavy recovery fanout, confirmed-desync and context-loss recovery, explicit lifecycle recovery, pane-local foreground redraws, and zero ordinary-output atlas resets."
         },
         {
           "date": "2026-08-01",
@@ -8843,15 +9798,15 @@
       },
       "redGreenEvidence": {
         "status": "complete",
-        "evidence": "With the fix disabled, the byte-identical unit oracle observed clearGlyphAtlases=true, reset/refreshed all 65 managers, and scheduled hidden synchronized/TUI recovery one to three times. Restoring the fix made every assertion pass."
+        "evidence": "Before the change, foreground renderer-risk and alternate-screen PTY writes requested terminal-output atlas recovery after parsing; hidden synchronized/TUI output also drove the same path. The updated oracle spies on that request before its removed 200ms debounce and on the eventual shared reset, while explicit lifecycle recovery remains required."
       },
       "performanceBudget": {
         "required": true,
-        "evidence": "A recovery with one visible and 64 hidden managers performs one reset and one refresh instead of 65 of each. Hidden synchronized/TUI output schedules zero global recovery work. Sustained 300ms recovery requests keep full atlas resets at or below 75 over five minutes while preserving a 6.5-second maximum repair gap. A final suppressed settle schedules one cancelable repair at the next budget boundary; resumed streaming cancels it. The rate budget adds no polling, recurring timer, provider call, or parking change."
+        "evidence": "A 120-frame foreground redraw at 300ms cadence produced 13 terminal-output atlas reset cycles before the change and zero afterward over 37.470 seconds. Ordinary PTY output now adds no atlas debounce, retry timer, buffer-switch listener, global manager traversal, provider call, or recurring work; pane-local refresh remains for renderer-risk output. Explicit heavy recovery still touches visible managers only."
       },
       "promotionCriteria": [
         "Accumulate stable macOS Electron runs with real BrowserWindow visibility transitions.",
-        "Run an isolated headed paired-server terminal flood and verify bounded renderer CPU and atlas diagnostics.",
+        "Run an isolated headed paired-server terminal flood and verify renderer CPU and atlas diagnostics remain flat under ordinary output.",
         "Add Linux and Windows WebGL visibility evidence before claiming cross-platform visual coverage."
       ],
       "knownGaps": [
@@ -8859,7 +9814,7 @@
         "No isolated live paired-server candidate run is recorded; remote-runtime coverage is a provider-agnostic renderer contract plus production incident evidence.",
         "The gate counts recovery fanout and pixel retention but does not impose an end-to-end renderer frame-latency threshold."
       ],
-      "demotionRule": "Demote if hidden managers re-enter reset/refresh recovery, ordinary visibility clears the atlas, real WebGL pixels regress, or the focused Electron test cannot remain deterministic."
+      "demotionRule": "Demote if ordinary PTY output re-enters shared reset/refresh recovery, pane-local redraw coverage regresses, ordinary visibility clears the atlas, real WebGL pixels regress, or the focused Electron test cannot remain deterministic."
     },
     {
       "id": "terminal-render.atlas-identity-invalidation",
diff --git a/config/scripts/audit-localization-coverage.mjs b/config/scripts/audit-localization-coverage.mjs
index fd750a9150d..e25a7bc222e 100644
--- a/config/scripts/audit-localization-coverage.mjs
+++ b/config/scripts/audit-localization-coverage.mjs
@@ -7,6 +7,9 @@ import process from 'node:process'
 import ts from 'typescript-api'
 
 const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts'])
+// Why: test-only modules live beside their spec as `*-test-harness.ts` / `*-fixtures.ts` here, not under `__tests__/`.
+const TEST_SUPPORT_FILE_PATTERN =
+  /[.-](?:test-harness|test-fixtures?|test-state|test-support|fixtures?)\.[cm]?[jt]sx?$/
 const SKIP_PATH_PARTS = new Set(['.git', 'dist', 'node_modules', 'out', '__snapshots__', 'assets'])
 const LOCALIZATION_CALL_NAMES = new Set(['t', 'translate'])
 const USER_VISIBLE_JSX_ATTRIBUTES = new Set([
@@ -73,13 +76,14 @@ function normalizePath(root, filePath) {
   return path.relative(root, filePath).split(path.sep).join('/')
 }
 
-function isSkippedFile(root, filePath) {
+export function isSkippedFile(root, filePath) {
   const relative = normalizePath(root, filePath)
   if (
     relative.endsWith('.d.ts') ||
     relative.includes('.test.') ||
     relative.includes('.spec.') ||
-    relative.includes('/__tests__/')
+    relative.includes('/__tests__/') ||
+    TEST_SUPPORT_FILE_PATTERN.test(relative)
   ) {
     return true
   }
diff --git a/config/scripts/audit-localization-coverage.test.mjs b/config/scripts/audit-localization-coverage.test.mjs
index 291e6e29595..477054f2e8f 100644
--- a/config/scripts/audit-localization-coverage.test.mjs
+++ b/config/scripts/audit-localization-coverage.test.mjs
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 
-import { collectLocalizationCandidates } from './audit-localization-coverage.mjs'
+import { collectLocalizationCandidates, isSkippedFile } from './audit-localization-coverage.mjs'
 
 const ROOT = process.cwd()
 
@@ -42,3 +42,23 @@ describe('localization coverage candidates', () => {
     expect(reports).toEqual([])
   })
 })
+
+describe('localization coverage file skipping', () => {
+  function skipped(relativePath) {
+    return isSkippedFile(ROOT, `${ROOT}/${relativePath}`)
+  }
+
+  it('skips test-only modules that sit beside their spec', () => {
+    expect(skipped('src/renderer/src/components/browser-pane/stream-test-harness.ts')).toBe(true)
+    expect(skipped('src/renderer/src/hooks/ipc-events-test-fixtures.ts')).toBe(true)
+    expect(skipped('src/renderer/src/lib/session-test-state.ts')).toBe(true)
+    expect(skipped('src/renderer/src/store/slices/routing-fixture.ts')).toBe(true)
+    expect(skipped('src/renderer/src/components/tab-bar/icon-stub.fixture.tsx')).toBe(true)
+  })
+
+  it('still scans shipped modules whose names merely mention a fixture concept', () => {
+    expect(skipped('src/renderer/src/components/browser-pane/fixture-picker.tsx')).toBe(false)
+    expect(skipped('src/renderer/src/components/settings/fixtures-panel.tsx')).toBe(false)
+    expect(skipped('src/renderer/src/components/browser-pane/BrowserPane.tsx')).toBe(false)
+  })
+})
diff --git a/config/scripts/build-notification-status-macos.mjs b/config/scripts/build-notification-status-macos.mjs
index e8150e32b6f..41d4c84a4af 100644
--- a/config/scripts/build-notification-status-macos.mjs
+++ b/config/scripts/build-notification-status-macos.mjs
@@ -79,7 +79,7 @@ try {
 
 function readArg(name) {
   const index = args.indexOf(name)
-  return index >= 0 ? args[index + 1] : undefined
+  return index !== -1 ? args[index + 1] : undefined
 }
 
 function embeddedInfoPlist(identifier) {
diff --git a/config/scripts/build-relay.mjs b/config/scripts/build-relay.mjs
index a63cce53e95..23ad74ab47a 100644
--- a/config/scripts/build-relay.mjs
+++ b/config/scripts/build-relay.mjs
@@ -18,6 +18,7 @@ const __dirname = import.meta.dirname
 const ROOT = join(__dirname, '..', '..')
 const RELAY_ENTRY = join(ROOT, 'src', 'relay', 'relay.ts')
 const WATCHER_ENTRY = join(ROOT, 'src', 'main', 'ipc', 'parcel-watcher-process-entry.ts')
+const AI_VAULT_SERVICE_ENTRY = join(ROOT, 'src', 'relay', 'ai-vault-service-entry.ts')
 const MANAGED_HOOK_RUNTIME_ENTRY = join(
   ROOT,
   'src',
@@ -88,6 +89,21 @@ for (const platform of PLATFORMS) {
     }
   })
 
+  await build({
+    entryPoints: [AI_VAULT_SERVICE_ENTRY],
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    format: 'cjs',
+    outfile: join(outDir, 'relay-ai-vault-service.js'),
+    external: ['electron'],
+    sourcemap: false,
+    minify: true,
+    define: {
+      'process.env.NODE_ENV': '"production"'
+    }
+  })
+
   await build({
     entryPoints: [MANAGED_HOOK_RUNTIME_ENTRY],
     bundle: true,
@@ -110,10 +126,12 @@ for (const platform of PLATFORMS) {
   // so a companion-only change always deploys beside the matching relay host.
   const relayContent = readFileSync(join(outDir, 'relay.js'))
   const watcherContent = readFileSync(join(outDir, 'relay-watcher.js'))
+  const aiVaultServiceContent = readFileSync(join(outDir, 'relay-ai-vault-service.js'))
   const managedHookRuntimeContent = readFileSync(join(outDir, 'managed-hook-runtime.js'))
   const hash = createHash('sha256')
     .update(relayContent)
     .update(watcherContent)
+    .update(aiVaultServiceContent)
     .update(managedHookRuntimeContent)
   // Why: changing the remote node-pty patch must select a fresh immutable Windows relay directory.
   if (platform.startsWith('win32-')) {
diff --git a/config/scripts/build-windows-cli-launcher.mjs b/config/scripts/build-windows-cli-launcher.mjs
index 6f9b86bdb4b..27c17b3d15c 100644
--- a/config/scripts/build-windows-cli-launcher.mjs
+++ b/config/scripts/build-windows-cli-launcher.mjs
@@ -56,5 +56,5 @@ function findFrameworkCompiler(env) {
 
 function readArg(name) {
   const index = process.argv.indexOf(name)
-  return index >= 0 ? process.argv[index + 1] : undefined
+  return index !== -1 ? process.argv[index + 1] : undefined
 }
diff --git a/config/scripts/computer-use-modifier-safety.test.mjs b/config/scripts/computer-use-modifier-safety.test.mjs
index 725f17fdf4c..2a3234d3d9c 100644
--- a/config/scripts/computer-use-modifier-safety.test.mjs
+++ b/config/scripts/computer-use-modifier-safety.test.mjs
@@ -11,7 +11,7 @@ function source(path) {
 function sourceBetween(contents, startMarker, endMarker) {
   const start = contents.indexOf(startMarker)
   const end = contents.indexOf(endMarker, start + startMarker.length)
-  if (start < 0 || end < 0) {
+  if (start === -1 || end === -1) {
     throw new Error(`Missing source boundary: ${startMarker} → ${endMarker}`)
   }
   return contents.slice(start, end)
diff --git a/config/scripts/electron-builder-config.test.mjs b/config/scripts/electron-builder-config.test.mjs
index 2ecda0e80eb..edb6d6ed5db 100644
--- a/config/scripts/electron-builder-config.test.mjs
+++ b/config/scripts/electron-builder-config.test.mjs
@@ -4,6 +4,9 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
 
+const REPO_ROOT = join(import.meta.dirname, '..', '..')
+const SRC_MAIN_DIR = join(REPO_ROOT, 'src', 'main')
+
 const require = createRequire(import.meta.url)
 const electronBuilderConfig = require('../electron-builder.config.cjs')
 const { FileMatcher } = require('app-builder-lib/out/fileMatcher')
@@ -171,6 +174,29 @@ describe('electron-builder config', () => {
     )
   })
 
+  // Why: the scanner service is forked with ELECTRON_RUN_AS_NODE, so asar is
+  // invisible to it and a packed worker entry fails closed — dropping every
+  // OpenCode session in packaged builds while dev stays green. Three legs must
+  // agree on the filename, so all three are read rather than hardcoded.
+  it('unpacks the OpenCode SQLite worker entry the scanner service forks', async () => {
+    const spawnSource = await readFile(
+      join(SRC_MAIN_DIR, 'ai-vault', 'session-scanner-opencode-sqlite-worker-spawn.ts'),
+      'utf8'
+    )
+    const entryFilename = spawnSource.match(/WORKER_ENTRY_FILENAME = '([^']+)'/)?.[1]
+
+    expect(entryFilename).toBeDefined()
+    expect(electronBuilderConfig.asarUnpack).toContain(`out/main/${entryFilename}`)
+
+    // Why: the emitted path comes from the rollup input key under
+    // entryFileNames '[name].js', not from the source filename — renaming the
+    // key alone would leave the other two legs agreeing on a file that no
+    // longer exists.
+    const viteConfig = await readFile(join(REPO_ROOT, 'electron.vite.config.ts'), 'utf8')
+    expect(viteConfig).toContain("entryFileNames: '[name].js'")
+    expect(viteConfig).toMatch(new RegExp(`'${entryFilename.replace(/\.js$/, '')}':\\s*resolve\\(`))
+  })
+
   it('keeps the worker-thread hang watchdog inside app.asar', () => {
     expect(electronBuilderConfig.asarUnpack).not.toContain(
       'out/main/main-thread-hang-watchdog-entry.js'
diff --git a/config/scripts/electron-vite-output-contract.test.ts b/config/scripts/electron-vite-output-contract.test.ts
index f59f4a80f88..818b380fc2f 100644
--- a/config/scripts/electron-vite-output-contract.test.ts
+++ b/config/scripts/electron-vite-output-contract.test.ts
@@ -196,7 +196,8 @@ describe('Electron Vite output contract', () => {
   })
 
   it('rejects prototype properties as build targets', () => {
-    expect(targetConfig).toContain('Object.prototype.hasOwnProperty.call(configByTarget, target)')
+    // Own-property check only: an inherited key like `constructor` must not select a build target.
+    expect(targetConfig).toContain('Object.hasOwn(configByTarget, target)')
   })
 
   it('gives the dev terminal daemon helper the TCC identity watched by Orca', () => {
diff --git a/config/scripts/ensure-native-runtime.mjs b/config/scripts/ensure-native-runtime.mjs
index 98b064cd30d..44261e968a9 100644
--- a/config/scripts/ensure-native-runtime.mjs
+++ b/config/scripts/ensure-native-runtime.mjs
@@ -45,7 +45,7 @@ function readRuntimeArg() {
   }
 
   const runtimeIndex = process.argv.indexOf('--runtime')
-  if (runtimeIndex >= 0) {
+  if (runtimeIndex !== -1) {
     return process.argv[runtimeIndex + 1]
   }
 
diff --git a/config/scripts/generate-skill-bundle-manifest.mjs b/config/scripts/generate-skill-bundle-manifest.mjs
index 899cb6436df..226ea74c4fb 100644
--- a/config/scripts/generate-skill-bundle-manifest.mjs
+++ b/config/scripts/generate-skill-bundle-manifest.mjs
@@ -227,7 +227,7 @@ function readGitBlobs(objectShas) {
   let offset = 0
   for (const requestedSha of uniqueShas) {
     const headerEnd = output.indexOf(10, offset)
-    if (headerEnd < 0) {
+    if (headerEnd === -1) {
       throw new Error(`Missing git cat-file header for ${requestedSha}`)
     }
     const header = output.subarray(offset, headerEnd).toString('utf8')
@@ -648,8 +648,8 @@ async function main() {
   const argv = process.argv.slice(2)
   const rebuildFromTags = argv.includes('--rebuild-from-tags')
   const releaseIndex = argv.indexOf('--release')
-  const releaseVersion = releaseIndex >= 0 ? argv[releaseIndex + 1] : null
-  if (releaseIndex >= 0 && !releaseVersion) {
+  const releaseVersion = releaseIndex !== -1 ? argv[releaseIndex + 1] : null
+  if (releaseIndex !== -1 && !releaseVersion) {
     throw new Error('--release requires a version argument, e.g. --release 1.4.160')
   }
 
diff --git a/config/scripts/idle-cpu-process-sampling.mjs b/config/scripts/idle-cpu-process-sampling.mjs
new file mode 100644
index 00000000000..81f9218e5ad
--- /dev/null
+++ b/config/scripts/idle-cpu-process-sampling.mjs
@@ -0,0 +1,323 @@
+import { execFileSync, spawnSync } from 'node:child_process'
+
+function parseCpuTimeSeconds(value) {
+  const trimmed = String(value || '').trim()
+  if (!trimmed) {
+    return null
+  }
+  const [dayOrTime, maybeTime] = trimmed.includes('-') ? trimmed.split('-', 2) : [null, trimmed]
+  const days = dayOrTime === null ? 0 : Number(dayOrTime)
+  const parts = maybeTime.split(':').map(Number)
+  if (!Number.isFinite(days) || parts.some((part) => !Number.isFinite(part))) {
+    return null
+  }
+  if (parts.length === 3) {
+    return days * 86400 + parts[0] * 3600 + parts[1] * 60 + parts[2]
+  }
+  if (parts.length === 2) {
+    return days * 86400 + parts[0] * 60 + parts[1]
+  }
+  if (parts.length === 1) {
+    return days * 86400 + parts[0]
+  }
+  return null
+}
+
+function parseUnixProcesses(stdout) {
+  const rows = []
+  for (const raw of stdout.split('\n')) {
+    const line = raw.trim()
+    if (!line) {
+      continue
+    }
+    const match = line.match(/^(\d+)\s+(\d+)\s+([\d.]+)\s+(\d+)\s+(\S+)\s+(.+)$/)
+    if (!match) {
+      continue
+    }
+    rows.push({
+      pid: Number(match[1]),
+      ppid: Number(match[2]),
+      percentCpu: Number(match[3]),
+      rssBytes: Number(match[4]) * 1024,
+      cpuTimeSeconds: parseCpuTimeSeconds(match[5]),
+      command: match[6]
+    })
+  }
+  return rows
+}
+
+function readUnixProcesses() {
+  const stdout = execFileSync('ps', ['-axo', 'pid=,ppid=,pcpu=,rss=,cputime=,command='], {
+    encoding: 'utf8',
+    env: { ...process.env, LC_ALL: 'C', LANG: 'C' },
+    maxBuffer: 20 * 1024 * 1024
+  })
+  return parseUnixProcesses(stdout)
+}
+
+function readWindowsProcesses() {
+  const script =
+    'Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,WorkingSetSize,CommandLine | ConvertTo-Json -Compress'
+  const result = spawnSync('powershell.exe', ['-NoProfile', '-Command', script], {
+    encoding: 'utf8',
+    maxBuffer: 20 * 1024 * 1024
+  })
+  if (result.status !== 0) {
+    throw new Error(result.stderr || 'PowerShell process enumeration failed')
+  }
+  const parsed = JSON.parse(result.stdout || '[]')
+  const entries = Array.isArray(parsed) ? parsed : [parsed]
+  return entries.map((entry) => ({
+    pid: Number(entry.ProcessId),
+    ppid: Number(entry.ParentProcessId),
+    percentCpu: 0,
+    cpuTimeSeconds: null,
+    rssBytes: Number(entry.WorkingSetSize) || 0,
+    command: String(entry.CommandLine || '')
+  }))
+}
+
+export function readProcessRows() {
+  return process.platform === 'win32' ? readWindowsProcesses() : readUnixProcesses()
+}
+
+export function descendantsOf(rows, rootPid) {
+  const children = new Map()
+  for (const row of rows) {
+    const list = children.get(row.ppid) ?? []
+    list.push(row)
+    children.set(row.ppid, list)
+  }
+  const result = []
+  const stack = [rootPid]
+  const seen = new Set()
+  while (stack.length > 0) {
+    const pid = stack.pop()
+    if (seen.has(pid)) {
+      continue
+    }
+    seen.add(pid)
+    const row = rows.find((candidate) => candidate.pid === pid)
+    if (row) {
+      result.push(row)
+    }
+    for (const child of children.get(pid) ?? []) {
+      stack.push(child.pid)
+    }
+  }
+  return result
+}
+
+export function classify(row, rootPid) {
+  const command = row.command.toLowerCase()
+  if (row.pid === rootPid) {
+    return 'main'
+  }
+  if (command.includes('daemon-entry')) {
+    return 'daemon'
+  }
+  if (command.includes('--type=gpu-process')) {
+    return 'gpu'
+  }
+  if (command.includes('--type=renderer')) {
+    return 'renderer'
+  }
+  if (command.includes('--type=utility')) {
+    return 'utility'
+  }
+  if (command.includes('--type=')) {
+    return 'electron-other'
+  }
+  if (command.includes('node') || command.includes('/pi') || command.endsWith(' pi')) {
+    return 'agent-or-node'
+  }
+  return 'other-descendant'
+}
+
+const DEFAULT_WORKLOAD_OVERRUN_LIMIT_MS = 120_000
+
+export async function sampleProcessTreeUntilWorkloadsComplete({
+  rootPid,
+  requestedDurationMs,
+  intervalMs,
+  workloadPromise,
+  maxWorkloadOverrunMs = DEFAULT_WORKLOAD_OVERRUN_LIMIT_MS,
+  readRows = readProcessRows,
+  now = Date.now,
+  wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+}) {
+  const samplingStartedAt = now()
+  const requestedDeadline = samplingStartedAt + requestedDurationMs
+  const hardDeadline = requestedDeadline + maxWorkloadOverrunMs
+  let workloadSettled = false
+  let workloadResult
+  let workloadError
+  let workloadSettledAt = null
+  void workloadPromise.then(
+    (result) => {
+      workloadResult = result
+      workloadSettled = true
+      workloadSettledAt = now()
+    },
+    (error) => {
+      workloadError = error
+      workloadSettled = true
+      workloadSettledAt = now()
+    }
+  )
+  const samples = []
+  let previousSnapshot = null
+  const needsFinalWorkloadSample = () =>
+    workloadSettledAt !== null && (previousSnapshot?.at ?? -Infinity) < workloadSettledAt
+  while (
+    now() <= requestedDeadline ||
+    samples.length === 0 ||
+    !workloadSettled ||
+    needsFinalWorkloadSample()
+  ) {
+    const sampledAt = now()
+    if (workloadError) {
+      throw workloadError
+    }
+    if (
+      (!workloadSettled && sampledAt >= hardDeadline) ||
+      (workloadSettledAt !== null && workloadSettledAt > hardDeadline)
+    ) {
+      throw new Error(
+        `Benchmark workload exceeded the ${maxWorkloadOverrunMs}ms sampling overrun limit`
+      )
+    }
+    const processRows = descendantsOf(readRows(), rootPid)
+    const rawProcesses = processRows.map((row) => ({ ...row, kind: classify(row, rootPid) }))
+    if (previousSnapshot) {
+      const elapsedSeconds = Math.max(0.001, (sampledAt - previousSnapshot.at) / 1000)
+      const previousByPid = new Map(previousSnapshot.processes.map((proc) => [proc.pid, proc]))
+      const processes = rawProcesses.map((row) => {
+        const previous = previousByPid.get(row.pid)
+        const canComputeDelta =
+          typeof row.cpuTimeSeconds === 'number' && typeof previous?.cpuTimeSeconds === 'number'
+        const cpu = canComputeDelta
+          ? Math.max(0, ((row.cpuTimeSeconds - previous.cpuTimeSeconds) / elapsedSeconds) * 100)
+          : row.percentCpu
+        return { ...row, cpu }
+      })
+      samples.push({
+        at: sampledAt,
+        elapsedMs: sampledAt - previousSnapshot.at,
+        totalCpuPercent: processes.reduce((sum, proc) => sum + proc.cpu, 0),
+        totalRssBytes: processes.reduce((sum, proc) => sum + proc.rssBytes, 0),
+        processes
+      })
+    }
+    previousSnapshot = { at: sampledAt, processes: rawProcesses }
+    await wait(intervalMs)
+  }
+  if (workloadError) {
+    throw workloadError
+  }
+  const measuredDurationMs = Math.max(
+    0,
+    (previousSnapshot?.at ?? samplingStartedAt) - samplingStartedAt
+  )
+  return {
+    samples,
+    workloadResult,
+    samplingWindow: {
+      requestedDurationMs,
+      measuredDurationMs,
+      maxWorkloadOverrunMs,
+      extendedForWorkload: workloadSettledAt !== null && workloadSettledAt > requestedDeadline,
+      workloadSettledElapsedMs:
+        workloadSettledAt === null ? null : Math.max(0, workloadSettledAt - samplingStartedAt),
+      workloadSettledBeforeStop: workloadSettled
+    }
+  }
+}
+
+function mean(values) {
+  return values.length === 0 ? 0 : values.reduce((sum, value) => sum + value, 0) / values.length
+}
+
+function percentile(sorted, fraction) {
+  if (sorted.length === 0) {
+    return 0
+  }
+  const index = Math.min(sorted.length - 1, Math.ceil(sorted.length * fraction) - 1)
+  return sorted[index]
+}
+
+export function summarizeSamples(samples) {
+  const byKind = new Map()
+  for (const sample of samples) {
+    for (const proc of sample.processes) {
+      const bucket = byKind.get(proc.kind) ?? { cpuValues: [], rssValues: [], maxProcessCount: 0 }
+      bucket.cpuValues.push(proc.cpu)
+      bucket.rssValues.push(proc.rssBytes)
+      byKind.set(proc.kind, bucket)
+    }
+    const counts = new Map()
+    for (const proc of sample.processes) {
+      counts.set(proc.kind, (counts.get(proc.kind) ?? 0) + 1)
+    }
+    for (const [kind, count] of counts) {
+      byKind.get(kind).maxProcessCount = Math.max(byKind.get(kind).maxProcessCount, count)
+    }
+  }
+  const summary = {}
+  for (const [kind, values] of byKind) {
+    const cpuSorted = [...values.cpuValues].sort((a, b) => a - b)
+    const rssSumBySample = samples.map((sample) =>
+      sample.processes
+        .filter((proc) => proc.kind === kind)
+        .reduce((sum, proc) => sum + proc.rssBytes, 0)
+    )
+    summary[kind] = {
+      meanCpuPercent: mean(values.cpuValues),
+      p95CpuPercent: percentile(cpuSorted, 0.95),
+      maxCpuPercent: Math.max(0, ...values.cpuValues),
+      meanRssBytes: mean(rssSumBySample),
+      maxProcessCount: values.maxProcessCount
+    }
+  }
+  summary.total = {
+    meanCpuPercent: mean(samples.map((sample) => sample.totalCpuPercent)),
+    p95CpuPercent: percentile(
+      samples.map((sample) => sample.totalCpuPercent).sort((a, b) => a - b),
+      0.95
+    ),
+    meanRssBytes: mean(samples.map((sample) => sample.totalRssBytes))
+  }
+  return summary
+}
+
+export function summarizeProcessInventory(samples) {
+  const inventory = {}
+  for (const sample of samples) {
+    const counts = new Map()
+    for (const proc of sample.processes) {
+      counts.set(proc.kind, (counts.get(proc.kind) ?? 0) + 1)
+      const entry = inventory[proc.kind] ?? {
+        maxProcessCount: 0,
+        maxCpuPercent: 0,
+        commandSamples: []
+      }
+      entry.maxCpuPercent = Math.max(entry.maxCpuPercent, proc.cpu)
+      if (!entry.commandSamples.includes(proc.command) && entry.commandSamples.length < 6) {
+        entry.commandSamples.push(proc.command)
+      }
+      inventory[proc.kind] = entry
+    }
+    for (const [kind, count] of counts) {
+      inventory[kind].maxProcessCount = Math.max(inventory[kind].maxProcessCount, count)
+    }
+  }
+  return inventory
+}
+
+export function terminateProcesses(processes) {
+  for (const proc of processes) {
+    try {
+      process.kill(proc.pid)
+    } catch {}
+  }
+}
diff --git a/config/scripts/idle-cpu-process-sampling.test.mjs b/config/scripts/idle-cpu-process-sampling.test.mjs
new file mode 100644
index 00000000000..d452c6e3ce0
--- /dev/null
+++ b/config/scripts/idle-cpu-process-sampling.test.mjs
@@ -0,0 +1,65 @@
+import { describe, expect, it } from 'vitest'
+import { sampleProcessTreeUntilWorkloadsComplete } from './idle-cpu-process-sampling.mjs'
+
+function createClock(workloadCompletesAt) {
+  let currentMs = 0
+  let resolveWorkload
+  const workloadPromise = new Promise((resolve) => {
+    resolveWorkload = resolve
+  })
+  const wait = async (durationMs) => {
+    currentMs += durationMs
+    if (currentMs >= workloadCompletesAt) {
+      resolveWorkload('complete')
+    }
+    await Promise.resolve()
+  }
+  const readRows = () => [
+    {
+      pid: 10,
+      ppid: 0,
+      percentCpu: 0,
+      rssBytes: 1_024,
+      cpuTimeSeconds: currentMs / 2_000,
+      command: 'electron'
+    }
+  ]
+  return { now: () => currentMs, readRows, wait, workloadPromise }
+}
+
+describe('idle CPU process sampling window', () => {
+  it('extends through a slow workload and captures a final CPU delta', async () => {
+    const clock = createClock(40)
+    const result = await sampleProcessTreeUntilWorkloadsComplete({
+      rootPid: 10,
+      requestedDurationMs: 20,
+      intervalMs: 10,
+      maxWorkloadOverrunMs: 100,
+      ...clock
+    })
+
+    expect(result.workloadResult).toBe('complete')
+    expect(result.samples.map((sample) => sample.at)).toEqual([10, 20, 30, 40])
+    expect(result.samplingWindow).toEqual({
+      requestedDurationMs: 20,
+      measuredDurationMs: 40,
+      maxWorkloadOverrunMs: 100,
+      extendedForWorkload: true,
+      workloadSettledElapsedMs: 40,
+      workloadSettledBeforeStop: true
+    })
+  })
+
+  it('invalidates a run that reaches the workload overrun guard', async () => {
+    const clock = createClock(Infinity)
+    await expect(
+      sampleProcessTreeUntilWorkloadsComplete({
+        rootPid: 10,
+        requestedDurationMs: 20,
+        intervalMs: 10,
+        maxWorkloadOverrunMs: 20,
+        ...clock
+      })
+    ).rejects.toThrow('exceeded the 20ms sampling overrun limit')
+  })
+})
diff --git a/config/scripts/idle-cpu-renderer-scale-fixture.mjs b/config/scripts/idle-cpu-renderer-scale-fixture.mjs
new file mode 100644
index 00000000000..4759b768e27
--- /dev/null
+++ b/config/scripts/idle-cpu-renderer-scale-fixture.mjs
@@ -0,0 +1,202 @@
+export async function configureRendererScaleFixture(page, options, repoPath) {
+  return page.evaluate(
+    ({ agentsPerWorktree, lineageDepth, repoPath }) => {
+      const store = window.__store
+      if (!store) {
+        throw new Error('window.__store is not available')
+      }
+      const normalizePath = (value) =>
+        String(value ?? '')
+          .replaceAll('\\', '/')
+          .toLowerCase()
+      const primaryPath = normalizePath(repoPath)
+      const compare = (left, right) => (left < right ? -1 : left > right ? 1 : 0)
+      const state = store.getState()
+      const worktrees = Object.values(state.worktreesByRepo)
+        .flat()
+        .filter((worktree) => !worktree.isArchived)
+        .sort((left, right) => {
+          const primaryOrder =
+            Number(normalizePath(right.path) === primaryPath) -
+            Number(normalizePath(left.path) === primaryPath)
+          return (
+            primaryOrder ||
+            compare(normalizePath(left.path), normalizePath(right.path)) ||
+            compare(left.id, right.id)
+          )
+        })
+      const appliedLineageDepth = Math.min(lineageDepth, Math.max(0, worktrees.length - 1))
+      if (lineageDepth === 0 && agentsPerWorktree === 0) {
+        return {
+          applied: false,
+          requestedLineageDepth: lineageDepth,
+          appliedLineageDepth,
+          agentsPerWorktree,
+          seededAgentRows: 0
+        }
+      }
+
+      state.setActiveView('terminal')
+      state.setSidebarOpen(true)
+      state.setGroupBy('none')
+      state.setSortBy('recent')
+      state.setShowActiveOnly(false)
+      state.setShowSleepingWorkspaces(true)
+      state.setHideDefaultBranchWorkspace(false)
+      state.setFilterRepoIds([])
+
+      const lineageById = { ...store.getState().worktreeLineageById }
+      const lineageParentIds = new Set()
+      if (appliedLineageDepth > 0) {
+        for (const worktree of worktrees) {
+          delete lineageById[worktree.id]
+          if (!worktree.instanceId) {
+            throw new Error(`Worktree ${worktree.id} has no instanceId for lineage seeding`)
+          }
+        }
+        for (let index = 1; index < worktrees.length; index += 1) {
+          const child = worktrees[index]
+          const parent = worktrees[Math.min(index - 1, appliedLineageDepth - 1)]
+          lineageParentIds.add(parent.id)
+          lineageById[child.id] = {
+            worktreeId: child.id,
+            worktreeInstanceId: child.instanceId,
+            parentWorktreeId: parent.id,
+            parentWorktreeInstanceId: parent.instanceId,
+            origin: 'manual',
+            capture: { source: 'manual-action', confidence: 'explicit' },
+            createdAt: 1_700_000_000_000 + index
+          }
+        }
+      }
+      const collapsedGroups = new Set(store.getState().collapsedGroups)
+      for (const parentId of lineageParentIds) {
+        collapsedGroups.delete(`lineage:${parentId}`)
+      }
+      store.setState({ worktreeLineageById: lineageById, collapsedGroups })
+
+      let seededAgentRows = 0
+      if (agentsPerWorktree > 0) {
+        store.getState().setWorktreeCardMode('Default')
+        store.getState().setAgentActivityDisplayMode('full')
+        const fixtureNow = Date.now()
+        worktrees.forEach((worktree, worktreeIndex) => {
+          const next = store.getState()
+          const tab =
+            next.tabsByWorktree[worktree.id]?.[0] ??
+            next.createTab(worktree.id, undefined, undefined, {
+              activate: false,
+              id: `idle-cpu-tab-${worktreeIndex}`
+            })
+          for (let agentIndex = 0; agentIndex < agentsPerWorktree; agentIndex += 1) {
+            const agentType = agentIndex % 2 === 0 ? 'codex' : 'claude'
+            const leafSequence =
+              BigInt(worktreeIndex) * BigInt(agentsPerWorktree) + BigInt(agentIndex + 1)
+            const leafId = `00000000-0000-4000-8000-${leafSequence.toString(16).padStart(12, '0')}`
+            store.getState().setAgentStatus(
+              `${tab.id}:${leafId}`,
+              {
+                state: 'working',
+                prompt: `Idle CPU agent ${worktreeIndex + 1}.${agentIndex + 1}`,
+                agentType
+              },
+              agentType,
+              { updatedAt: fixtureNow, stateStartedAt: fixtureNow },
+              { tabId: tab.id, worktreeId: worktree.id }
+            )
+            seededAgentRows += 1
+          }
+        })
+      }
+      return {
+        applied: true,
+        requestedLineageDepth: lineageDepth,
+        appliedLineageDepth,
+        lineageEdges: appliedLineageDepth > 0 ? Math.max(0, worktrees.length - 1) : 0,
+        expandedLineageGroups: lineageParentIds.size,
+        agentsPerWorktree,
+        seededAgentRows,
+        orderedWorktreeIds: worktrees.map((worktree) => worktree.id)
+      }
+    },
+    { agentsPerWorktree: options.agentsPerWorktree, lineageDepth: options.lineageDepth, repoPath }
+  )
+}
+
+export async function collectRendererCensus(page, configuredLineageDepth) {
+  return page.evaluate((configuredDepth) => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('window.__store is not available')
+    }
+    const worktrees = Object.values(state.worktreesByRepo).flat()
+    const worktreeIds = new Set(worktrees.map((worktree) => worktree.id))
+    const lineageDepthById = new Map()
+    const getDepth = (worktreeId, trail = new Set()) => {
+      if (lineageDepthById.has(worktreeId)) {
+        return lineageDepthById.get(worktreeId)
+      }
+      const lineage = state.worktreeLineageById[worktreeId]
+      if (!lineage || !worktreeIds.has(lineage.parentWorktreeId) || trail.has(worktreeId)) {
+        return 0
+      }
+      const nextTrail = new Set(trail)
+      nextTrail.add(worktreeId)
+      const depth = 1 + getDepth(lineage.parentWorktreeId, nextTrail)
+      lineageDepthById.set(worktreeId, depth)
+      return depth
+    }
+    const logicalDepths = worktrees.map((worktree) => getDepth(worktree.id))
+    const lineageParentIds = new Set(
+      Object.values(state.worktreeLineageById)
+        .filter((lineage) => worktreeIds.has(lineage.worktreeId))
+        .map((lineage) => lineage.parentWorktreeId)
+    )
+    const sidebar = document.querySelector('[data-worktree-sidebar]')
+    const mountedWorktreeIds = [
+      ...new Set(
+        [...(sidebar?.querySelectorAll('[data-worktree-id]') ?? [])]
+          .map((element) => element.getAttribute('data-worktree-id'))
+          .filter(Boolean)
+      )
+    ]
+    const mountedAgentRows = [...(sidebar?.querySelectorAll('*') ?? [])].filter(
+      (element) =>
+        element.classList.contains('group/agent-row') ||
+        element.classList.contains('compact-agent-row')
+    ).length
+    let diagnosticCensus = null
+    try {
+      diagnosticCensus = window.__orcaTypingDiagnostic?.report().census ?? null
+    } catch {}
+    const collapsedLineageGroups = [...lineageParentIds].filter((parentId) =>
+      state.collapsedGroups.has(`lineage:${parentId}`)
+    ).length
+    return {
+      capturedAt: new Date().toISOString(),
+      worktrees: {
+        store: worktrees.length,
+        mountedCards: sidebar?.querySelectorAll('[data-worktree-card-surface]').length ?? 0,
+        mountedUnique: mountedWorktreeIds.length,
+        mountedIds: mountedWorktreeIds.slice(0, 100),
+        mountedIdsTruncated: Math.max(0, mountedWorktreeIds.length - 100)
+      },
+      agentRows: {
+        storeLive: Object.keys(state.agentStatusByPaneKey ?? {}).length,
+        storeRetained: Object.keys(state.retainedAgentsByPaneKey ?? {}).length,
+        mounted: mountedAgentRows,
+        diagnosticMounted: diagnosticCensus?.agentRows.mountedDom ?? null
+      },
+      storeListeners: diagnosticCensus?.storeListeners ?? null,
+      lineage: {
+        configuredDepth,
+        measuredMaxDepth: Math.max(0, ...logicalDepths),
+        edges: logicalDepths.filter((depth) => depth > 0).length,
+        groups: lineageParentIds.size,
+        expandedGroups: lineageParentIds.size - collapsedLineageGroups,
+        collapsedGroups: collapsedLineageGroups
+      },
+      diagnostic: diagnosticCensus
+    }
+  }, configuredLineageDepth)
+}
diff --git a/config/scripts/idle-cpu-renderer-timing-probe.mjs b/config/scripts/idle-cpu-renderer-timing-probe.mjs
new file mode 100644
index 00000000000..b010bcb3433
--- /dev/null
+++ b/config/scripts/idle-cpu-renderer-timing-probe.mjs
@@ -0,0 +1,191 @@
+const RENDERER_TIMER_INTERVAL_MS = 100
+
+export async function startRendererTimingProbe(page) {
+  await page.evaluate((timerIntervalMs) => {
+    const maxSamples = 5_000
+    const maxEntries = 80
+    let phaseStartedAt = performance.now()
+    let phaseStartedAtIso = new Date().toISOString()
+    let timerId = null
+    let driftCount = 0
+    let driftSamples = []
+    let longTaskEntries = []
+    let observer = null
+    let longTaskSupported = false
+
+    const round = (value) => Math.round(value * 100) / 100
+    const summarize = (values, totalCount = values.length) => {
+      const sorted = [...values].sort((left, right) => left - right)
+      const percentile = (fraction) =>
+        sorted.length === 0
+          ? null
+          : sorted[Math.min(sorted.length - 1, Math.ceil(sorted.length * fraction) - 1)]
+      return {
+        count: totalCount,
+        retainedCount: sorted.length,
+        mean:
+          sorted.length === 0
+            ? null
+            : round(sorted.reduce((sum, value) => sum + value, 0) / sorted.length),
+        p50: sorted.length === 0 ? null : round(percentile(0.5)),
+        p95: sorted.length === 0 ? null : round(percentile(0.95)),
+        max: sorted.length === 0 ? null : round(sorted.at(-1))
+      }
+    }
+    const recordLongTasks = (entries) => {
+      for (const entry of entries) {
+        longTaskEntries.push({
+          startTime: entry.startTime,
+          duration: entry.duration,
+          name: entry.name
+        })
+        if (longTaskEntries.length > maxSamples) {
+          longTaskEntries.shift()
+        }
+      }
+    }
+    try {
+      longTaskSupported = PerformanceObserver.supportedEntryTypes?.includes('longtask') === true
+      if (longTaskSupported) {
+        observer = new PerformanceObserver((list) => recordLongTasks(list.getEntries()))
+        observer.observe({ type: 'longtask', buffered: true })
+      }
+    } catch {
+      observer = null
+      longTaskSupported = false
+    }
+    const scheduleTimer = () => {
+      const expectedAt = performance.now() + timerIntervalMs
+      timerId = setTimeout(() => {
+        driftCount += 1
+        driftSamples.push(Math.max(0, performance.now() - expectedAt))
+        if (driftSamples.length > maxSamples) {
+          driftSamples.shift()
+        }
+        scheduleTimer()
+      }, timerIntervalMs)
+    }
+    const snapshot = (reset) => {
+      if (observer) {
+        recordLongTasks(observer.takeRecords())
+      }
+      const capturedAt = performance.now()
+      const phaseLongTasks = longTaskEntries.filter((entry) => entry.startTime >= phaseStartedAt)
+      const durations = phaseLongTasks.map((entry) => entry.duration)
+      const result = {
+        startedAt: phaseStartedAtIso,
+        capturedAt: new Date().toISOString(),
+        durationMs: round(capturedAt - phaseStartedAt),
+        timerIntervalMs,
+        timerDriftMs: summarize(driftSamples, driftCount),
+        longTasks: {
+          supported: longTaskSupported,
+          ...summarize(durations),
+          totalDurationMs: round(durations.reduce((sum, value) => sum + value, 0)),
+          entries: phaseLongTasks.slice(-maxEntries).map((entry) => ({
+            startMs: round(entry.startTime - phaseStartedAt),
+            durationMs: round(entry.duration),
+            name: entry.name
+          })),
+          entriesTruncated: Math.max(0, phaseLongTasks.length - maxEntries)
+        }
+      }
+      if (reset) {
+        phaseStartedAt = capturedAt
+        phaseStartedAtIso = new Date().toISOString()
+        driftCount = 0
+        driftSamples = []
+        longTaskEntries = []
+      }
+      return result
+    }
+    scheduleTimer()
+    window.__orcaIdleCpuTimingProbe = {
+      snapshot: () => snapshot(true),
+      stop: () => {
+        if (timerId !== null) {
+          clearTimeout(timerId)
+        }
+        const result = snapshot(false)
+        observer?.disconnect()
+        return result
+      }
+    }
+  }, RENDERER_TIMER_INTERVAL_MS)
+}
+
+export async function snapshotRendererTimingProbe(page) {
+  return page.evaluate(() => window.__orcaIdleCpuTimingProbe?.snapshot() ?? null)
+}
+
+export async function stopRendererTimingProbe(page) {
+  return page.evaluate(() => window.__orcaIdleCpuTimingProbe?.stop() ?? null)
+}
+
+export async function runZustandPublications(page, count, intervalMs) {
+  return page.evaluate(
+    ({ count, intervalMs }) =>
+      new Promise((resolve, reject) => {
+        const store = window.__store
+        if (!store) {
+          reject(new Error('window.__store is not available'))
+          return
+        }
+        const maxSamples = 5_000
+        const startedAt = performance.now()
+        const startedAtIso = new Date().toISOString()
+        const schedulingDriftMs = []
+        let completed = 0
+        const finish = () => {
+          const sorted = [...schedulingDriftMs].sort((left, right) => left - right)
+          const percentile = (fraction) =>
+            sorted.length === 0
+              ? null
+              : sorted[Math.min(sorted.length - 1, Math.ceil(sorted.length * fraction) - 1)]
+          const round = (value) => Math.round(value * 100) / 100
+          resolve({
+            requested: count,
+            completed,
+            intervalMs,
+            startedAt: startedAtIso,
+            completedAt: new Date().toISOString(),
+            durationMs: round(performance.now() - startedAt),
+            schedulingDriftMs: {
+              retainedCount: sorted.length,
+              p50: sorted.length === 0 ? null : round(percentile(0.5)),
+              p95: sorted.length === 0 ? null : round(percentile(0.95)),
+              max: sorted.length === 0 ? null : round(sorted.at(-1))
+            }
+          })
+        }
+        const publish = () => {
+          const publishedAt = performance.now()
+          const scheduledAt = startedAt + completed * intervalMs
+          schedulingDriftMs.push(Math.max(0, publishedAt - scheduledAt))
+          if (schedulingDriftMs.length > maxSamples) {
+            schedulingDriftMs.shift()
+          }
+          try {
+            // Why: an empty partial notifies every subscriber without changing domain state.
+            store.setState({})
+          } catch (error) {
+            reject(error)
+            return
+          }
+          completed += 1
+          if (completed >= count) {
+            finish()
+            return
+          }
+          const nextAt = startedAt + completed * intervalMs
+          setTimeout(publish, Math.max(0, nextAt - performance.now()))
+        }
+        if (count === 0) {
+          finish()
+        } else {
+          setTimeout(publish, 0)
+        }
+      }),
+    { count, intervalMs }
+  )
+}
diff --git a/config/scripts/install-electron-package-binary.mjs b/config/scripts/install-electron-package-binary.mjs
index f75d1eae30a..314cd31710f 100644
--- a/config/scripts/install-electron-package-binary.mjs
+++ b/config/scripts/install-electron-package-binary.mjs
@@ -28,6 +28,8 @@ const transientDownloadErrorCodes = new Set([
   'EAI_AGAIN',
   'ECONNREFUSED',
   'ECONNRESET',
+  // GitHub release CDN can refuse HTTP/2 streams under load; retry like socket resets.
+  'ERR_HTTP2_STREAM_ERROR',
   'ENETDOWN',
   'ENETRESET',
   'ENETUNREACH',
@@ -185,7 +187,9 @@ async function downloadElectronArtifactWithRetry(downloadOptions) {
 function getDownloadRetryDelays() {
   const configured = process.env.ORCA_ELECTRON_PACKAGE_RETRY_DELAYS_MS
   if (!configured) {
-    return [1_000, 3_000]
+    // Why: GitHub release CDN returns intermittent 503 / HTTP2 stream refusals
+    // under CI fan-out; a few short attempts still exhaust during outages.
+    return [1_000, 3_000, 5_000, 10_000]
   }
 
   const delays = configured.split(',').map(Number)
@@ -200,7 +204,7 @@ function isTransientDownloadError(error) {
     if (transientDownloadErrorCodes.has(candidate?.code)) {
       return true
     }
-    const statusCode = candidate?.statusCode ?? candidate?.response?.statusCode
+    const statusCode = getDownloadErrorStatusCode(candidate)
     if (
       statusCode === 408 ||
       statusCode === 425 ||
@@ -213,6 +217,13 @@ function isTransientDownloadError(error) {
   return false
 }
 
+function getDownloadErrorStatusCode(error) {
+  // @electron/get FetchDownloader uses Fetch Response.status; older got uses statusCode.
+  return (
+    error?.statusCode ?? error?.status ?? error?.response?.statusCode ?? error?.response?.status
+  )
+}
+
 function getErrorChain(error) {
   const errors = []
   let candidate = error
@@ -225,7 +236,7 @@ function getErrorChain(error) {
 
 function formatDownloadError(error) {
   for (const candidate of getErrorChain(error)) {
-    const statusCode = candidate?.statusCode ?? candidate?.response?.statusCode
+    const statusCode = getDownloadErrorStatusCode(candidate)
     if (statusCode) {
       return `HTTP ${statusCode}`
     }
diff --git a/config/scripts/install-electron-package-binary.test.mjs b/config/scripts/install-electron-package-binary.test.mjs
index 2c37f95cfbe..ad04336e8e7 100644
--- a/config/scripts/install-electron-package-binary.test.mjs
+++ b/config/scripts/install-electron-package-binary.test.mjs
@@ -118,6 +118,58 @@ describe('install-electron-package-binary', () => {
     }
   })
 
+  it('retries HTTP/2 stream refusal Electron download failures', () => {
+    const projectDir = mkTempProject()
+
+    try {
+      writeFakeElectronPackage(projectDir)
+      writeFakeElectronGet(projectDir, {
+        downloadFailures: 1,
+        downloadErrorCode: 'ERR_HTTP2_STREAM_ERROR'
+      })
+      writeFakeExtractor(projectDir, { createExecutable: true })
+
+      const result = runInstallScript(projectDir, {
+        ORCA_ELECTRON_PACKAGE_RETRY_DELAYS_MS: '0,0'
+      })
+
+      expect(result.status, result.stderr).toBe(0)
+      expect(
+        readFileSync(join(projectDir, 'electron-get.log'), 'utf8').trim().split('\n')
+      ).toHaveLength(2)
+      expect(result.stderr).toContain(
+        'Transient Electron download failure (ERR_HTTP2_STREAM_ERROR)'
+      )
+    } finally {
+      rmSync(projectDir, { recursive: true, force: true })
+    }
+  })
+
+  it('retries Electron download HTTP 503 failures from Fetch Response.status', () => {
+    const projectDir = mkTempProject()
+
+    try {
+      writeFakeElectronPackage(projectDir)
+      writeFakeElectronGet(projectDir, {
+        downloadFailures: 1,
+        downloadHttpStatus: 503
+      })
+      writeFakeExtractor(projectDir, { createExecutable: true })
+
+      const result = runInstallScript(projectDir, {
+        ORCA_ELECTRON_PACKAGE_RETRY_DELAYS_MS: '0,0'
+      })
+
+      expect(result.status, result.stderr).toBe(0)
+      expect(
+        readFileSync(join(projectDir, 'electron-get.log'), 'utf8').trim().split('\n')
+      ).toHaveLength(2)
+      expect(result.stderr).toContain('Transient Electron download failure (HTTP 503)')
+    } finally {
+      rmSync(projectDir, { recursive: true, force: true })
+    }
+  })
+
   it('fails after exhausting transient Electron download retries', () => {
     const projectDir = mkTempProject()
 
@@ -279,7 +331,12 @@ module.exports = path.join(__dirname, 'dist', fs.readFileSync(pathFile, 'utf8'))
 
 function writeFakeElectronGet(
   projectDir,
-  { downloadNeverSettles = false, downloadFailures = 0, downloadErrorCode = 'ECONNRESET' } = {}
+  {
+    downloadNeverSettles = false,
+    downloadFailures = 0,
+    downloadErrorCode = 'ECONNRESET',
+    downloadHttpStatus = null
+  } = {}
 ) {
   const getDir = join(projectDir, 'node_modules', 'electron', 'node_modules', '@electron', 'get')
   mkdirSync(getDir, { recursive: true })
@@ -299,6 +356,11 @@ exports.downloadArtifact = async function downloadArtifact(details) {
     return new Promise(() => {})
   }
   if (downloadAttempt <= ${JSON.stringify(downloadFailures)}) {
+    if (${JSON.stringify(downloadHttpStatus)} != null) {
+      const error = new Error('Response code ' + ${JSON.stringify(downloadHttpStatus)})
+      error.response = { status: ${JSON.stringify(downloadHttpStatus)} }
+      throw error
+    }
     const cause = Object.assign(new Error('download failed'), {
       code: ${JSON.stringify(downloadErrorCode)}
     })
diff --git a/config/scripts/legacy-worker-recovery-persistence-benchmark.mjs b/config/scripts/legacy-worker-recovery-persistence-benchmark.mjs
new file mode 100644
index 00000000000..76555d4e78e
--- /dev/null
+++ b/config/scripts/legacy-worker-recovery-persistence-benchmark.mjs
@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+// Run: node config/scripts/legacy-worker-recovery-persistence-benchmark.mjs
+import { closeSync, fsyncSync, openSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtemp, open, readFile, rename } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { fileURLToPath } from 'node:url'
+
+const repoRoot = fileURLToPath(new URL('../..', import.meta.url))
+const runtimePath = join(repoRoot, 'src/main/runtime/orca-runtime.ts')
+const args = new Map(
+  process.argv.slice(2).map((value, index, values) => [value, values[index + 1]])
+)
+const fixtureMiB = Number(args.get('--fixture-mib') ?? 24)
+const trials = Number(args.get('--trials') ?? 3)
+const jsonOutput = process.argv.includes('--json')
+
+if (!Number.isInteger(fixtureMiB) || fixtureMiB < 1 || !Number.isInteger(trials) || trials < 1) {
+  throw new Error('fixture-mib and trials must be positive integers')
+}
+
+const runtimeSource = await readFile(runtimePath, 'utf8')
+const recoveryStart = runtimeSource.indexOf(
+  'private async persistLegacyWorkerTerminalRecoveryBatch'
+)
+const recoveryEnd = runtimeSource.indexOf(
+  'private reconcileMissingLegacyWorkerTerminal',
+  recoveryStart
+)
+const recoverySource = runtimeSource.slice(recoveryStart, recoveryEnd)
+if (
+  recoveryStart === -1 ||
+  recoveryEnd === -1 ||
+  !recoverySource.includes('await this.flushWorkspaceSessionOrThrowAsync()') ||
+  recoverySource.includes('flushOrThrow()')
+) {
+  throw new Error('recovery persistence implementation changed; update this benchmark')
+}
+
+const root = await mkdtemp(join(tmpdir(), 'orca-legacy-recovery-benchmark-'))
+const filler = 'x'.repeat(fixtureMiB * 1024 * 1024)
+
+function payload(state) {
+  return JSON.stringify({ state, filler })
+}
+
+function writeDurableSync(path, body) {
+  const tempPath = `${path}.sync.tmp`
+  writeFileSync(tempPath, body)
+  const fd = openSync(tempPath, 'r')
+  try {
+    fsyncSync(fd)
+  } finally {
+    closeSync(fd)
+  }
+  renameSync(tempPath, path)
+}
+
+async function writeDurableAsync(path, body) {
+  const tempPath = `${path}.async.tmp`
+  const handle = await open(tempPath, 'w')
+  try {
+    await handle.writeFile(body)
+    await handle.sync()
+  } finally {
+    await handle.close()
+  }
+  await rename(tempPath, path)
+}
+
+async function measure(run) {
+  let maxEventLoopDelayMs = 0
+  let expected = performance.now() + 1
+  const timer = setInterval(() => {
+    const now = performance.now()
+    maxEventLoopDelayMs = Math.max(maxEventLoopDelayMs, now - expected)
+    expected = now + 1
+  }, 1)
+  await new Promise((resolve) => setTimeout(resolve, 5))
+  const startedAt = performance.now()
+  await run()
+  const durationMs = performance.now() - startedAt
+  await new Promise((resolve) => setTimeout(resolve, 5))
+  clearInterval(timer)
+  return { durationMs, maxEventLoopDelayMs }
+}
+
+function median(values) {
+  const sorted = [...values].sort((a, b) => a - b)
+  return sorted[Math.floor(sorted.length / 2)]
+}
+
+async function runLegacy(path) {
+  const state = { fenced: false, surfacePresent: true, recoveryRecordPresent: true }
+  state.fenced = true
+  writeDurableSync(path, payload(state))
+  state.surfacePresent = false
+  writeDurableSync(path, payload(state))
+  state.recoveryRecordPresent = false
+  writeDurableSync(path, payload(state))
+}
+
+async function runBatched(path) {
+  const state = { fenced: false, surfacePresent: true, recoveryRecordPresent: true }
+  state.fenced = true
+  state.surfacePresent = false
+  state.recoveryRecordPresent = false
+  await writeDurableAsync(path, payload(state))
+}
+
+try {
+  const legacy = []
+  const batched = []
+  for (let index = 0; index < trials; index += 1) {
+    legacy.push(await measure(() => runLegacy(join(root, `legacy-${index}.json`))))
+    batched.push(await measure(() => runBatched(join(root, `batched-${index}.json`))))
+  }
+  const result = {
+    benchmark: 'legacy-worker-recovery-persistence',
+    fixtureMiB,
+    trials,
+    legacy: {
+      durableWrites: 3,
+      medianDurationMs: median(legacy.map((sample) => sample.durationMs)),
+      medianMaxEventLoopDelayMs: median(legacy.map((sample) => sample.maxEventLoopDelayMs))
+    },
+    batchedAsync: {
+      durableWrites: 1,
+      medianDurationMs: median(batched.map((sample) => sample.durationMs)),
+      medianMaxEventLoopDelayMs: median(batched.map((sample) => sample.maxEventLoopDelayMs))
+    }
+  }
+  if (jsonOutput) {
+    console.log(JSON.stringify(result))
+  } else {
+    console.log(JSON.stringify(result, null, 2))
+  }
+} finally {
+  rmSync(root, { recursive: true, force: true })
+}
diff --git a/config/scripts/locale-ko-key-overrides.json b/config/scripts/locale-ko-key-overrides.json
index e8d13941ffa..bd0c3c15aee 100644
--- a/config/scripts/locale-ko-key-overrides.json
+++ b/config/scripts/locale-ko-key-overrides.json
@@ -1058,36 +1058,6 @@
   "auto.components.feature.wall.EditorAnimatedVisual.e16479c1c5": {
     "ko": "[data-slash-menu] [data-slash-row].slash-active { background: rgba(24,24,27,0.07); box-shadow: inset 0 0 0 1px rgba(24,24,27,0.06); } [data-md-active-line][data-role=\"active\"] { color: rgb(113 113 122); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12.5px; } [data-md-active-line][data-role=\"h1\"] { color: inherit; font-family: inherit; font-size: 18px; font-weight: 700; letter-spacing: -0.01em; line-height: 1.2; margin-top: 6px; } [data-md-caret] { display: inline-block; width: 1.5px; height: 1em; background: currentColor; vertical-align: -2px; margin-left: 1px; animation: md-caret-blink 1.05s steps(1) infinite; } @keyframes md-caret-blink { 0%, 50% { opacity: 1 } 51%, 100% { opacity: 0 } } @keyframes md-block-in { from { opacity: 0; transform: translateY(-2px); } to { opacity: 1; transform: none; } } @keyframes md-cursor-ripple { 0% { transform: scale(0.4); opacity: 0.9; } 100% { transform: scale(1.4); opacity: 0; } } [data-clicking=\"1\"] [data-cursor-ripple] { animation: md-cursor-ripple 460ms ease-out forwards; }"
   },
-  "auto.components.feature.wall.FeatureTourPreview.04d54d50ec": {
-    "ko": "orca · zsh"
-  },
-  "auto.components.feature.wall.FeatureTourPreview.304ad0dfc1": {
-    "ko": "생각 중..."
-  },
-  "auto.components.feature.wall.FeatureTourPreview.3822d8d14b": {
-    "ko": "fix/worktree-picker-truncates"
-  },
-  "auto.components.feature.wall.FeatureTourPreview.47f16ecf34": {
-    "ko": "여러 작업을 동시에 진행하세요. 각 워크스페이스는 브랜치, terminal, agent 활동을 함께 보관합니다."
-  },
-  "auto.components.feature.wall.FeatureTourPreview.5d6ee181b6": {
-    "ko": "워크스페이스를 열어 terminal로 돌아가고, 테스트와 로그, agents 용으로 패널을 나누세요."
-  },
-  "auto.components.feature.wall.FeatureTourPreview.6218a9014d": {
-    "ko": "pnpm playwright test"
-  },
-  "auto.components.feature.wall.FeatureTourPreview.6ed43cb0e0": {
-    "ko": "dashboard.spec.ts"
-  },
-  "auto.components.feature.wall.FeatureTourPreview.70aa182266": {
-    "ko": "목표를 넘겨두고 자리를 비우세요. 코디네이터 agent가 작업을 나누어 병렬 PR을 만듭니다."
-  },
-  "auto.components.feature.wall.FeatureTourPreview.f10c14dd9d": {
-    "ko": "탭을 오갈 필요 없이 GitHub 또는 Linear 백로그에서 선택하고 한 번의 클릭으로 워크스페이스를 시작하세요."
-  },
-  "auto.components.feature.wall.FeatureTourWorkspaceCard.9220794f6a": {
-    "ko": "작업 중"
-  },
   "auto.components.feature.wall.FeatureWallSetupChecklist.713cc529a5": {
     "ko": "마일스톤"
   },
@@ -1502,12 +1472,6 @@
   "auto.components.new.workspace.ProjectCombobox.search": {
     "ko": "프로젝트 검색..."
   },
-  "auto.components.new.workspace.ProjectHostSetupCombobox.empty": {
-    "ko": "이 프로젝트에 준비된 호스트가 없습니다."
-  },
-  "auto.components.new.workspace.ProjectHostSetupCombobox.placeholder": {
-    "ko": "호스트 선택"
-  },
   "auto.components.notification.sound.options.0acd3d384e": {
     "ko": "클랙"
   },
@@ -1520,9 +1484,6 @@
   "auto.components.notification.sound.options.86af8d938c": {
     "ko": "봉 소리"
   },
-  "auto.components.onboarding.AgentFeatureSetupStep.97dcdc010f": {
-    "ko": "기능 활성화"
-  },
   "auto.components.onboarding.AgentStep.1eee1c7bd8": {
     "ko": "PATH에서 agents를 찾지 못했습니다. 나중에 설치할 항목을 선택하거나 빈 terminal로 계속 진행하세요."
   },
@@ -1538,12 +1499,6 @@
   "auto.components.onboarding.AgentStep.yoloPermissionsTooltip": {
     "ko": "중단을 줄이기 위해 agents 권한 확인을 건너뜁니다."
   },
-  "auto.components.onboarding.FeatureSetupChecklist.01426f3a23": {
-    "ko": "Agents가 사이트를 탐색하고, 페이지를 검사하고, 브라우저 작업을 처리할 수 있습니다."
-  },
-  "auto.components.onboarding.FeatureSetupChecklist.c5292c409d": {
-    "ko": "Agents는 요청 시 앱 창을 검사하고 로컬 앱을 작동할 수 있습니다."
-  },
   "auto.components.onboarding.IntegrationsStep.0b4a7d23ab": {
     "ko": "로그인 중"
   },
@@ -1556,18 +1511,6 @@
   "auto.components.onboarding.OnboardingFlow.windowsTerminalSubtitle": {
     "ko": "새 창에서 사용할 기본 셸과 terminal에서 오른쪽 클릭이 동작하는 방식을 선택하세요."
   },
-  "auto.components.onboarding.RepoStep.466108ab89": {
-    "ko": "선택한 호스트에 존재하는 경로를 입력하세요."
-  },
-  "auto.components.onboarding.RepoStep.6558d50c69": {
-    "ko": "한 번에 여러 repos를 가져오고 싶으신가요? 상위 폴더를 선택하세요."
-  },
-  "auto.components.onboarding.RepoStep.c33b190ca3": {
-    "ko": "호스트 경로만"
-  },
-  "auto.components.onboarding.RepoStep.cf23006ba7": {
-    "ko": "선택한 호스트"
-  },
   "auto.components.onboarding.ThemeStep.7ee9234e54": {
     "ko": "Ghostty 설정을 찾았습니다."
   },
@@ -4976,9 +4919,6 @@
   "auto.components.ui.color.picker.faa855a582": {
     "ko": "Hex"
   },
-  "auto.components.ui.team.multi.combobox.18ec58881e": {
-    "ko": "팀 검색..."
-  },
   "auto.components.workspace.cleanup.WorkspaceCleanupDialog.1b18868569": {
     "ko": "리뷰 필요"
   },
diff --git a/config/scripts/macos-computer-helper-owner-loss-benchmark.mjs b/config/scripts/macos-computer-helper-owner-loss-benchmark.mjs
index 8724cf8faf4..b6f1d9571a5 100644
--- a/config/scripts/macos-computer-helper-owner-loss-benchmark.mjs
+++ b/config/scripts/macos-computer-helper-owner-loss-benchmark.mjs
@@ -210,7 +210,7 @@ function connectInvalidPeer(socketPath) {
     const onData = (chunk) => {
       buffer += chunk
       const newline = buffer.indexOf('\n')
-      if (newline < 0) {
+      if (newline === -1) {
         return
       }
       let response
diff --git a/config/scripts/mjpeg-frame-parser-alloc-benchmark.mjs b/config/scripts/mjpeg-frame-parser-alloc-benchmark.mjs
index 86791745c10..5e350bb24f8 100644
--- a/config/scripts/mjpeg-frame-parser-alloc-benchmark.mjs
+++ b/config/scripts/mjpeg-frame-parser-alloc-benchmark.mjs
@@ -54,7 +54,7 @@ function extractOld(pending, chunk, maxPendingBytes = 2 * 1024 * 1024) {
   const frames = []
   while (cursor.length > 0) {
     const frameStart = cursor.indexOf(JPEG_START)
-    if (frameStart < 0) {
+    if (frameStart === -1) {
       const keepLastByte = cursor.at(-1) === 0xff
       return { frames, pending: keepLastByte ? Buffer.from([0xff]) : Buffer.alloc(0) }
     }
@@ -62,7 +62,7 @@ function extractOld(pending, chunk, maxPendingBytes = 2 * 1024 * 1024) {
       cursor = cursor.subarray(frameStart)
     }
     const frameEnd = cursor.indexOf(JPEG_END, JPEG_START.length)
-    if (frameEnd < 0) {
+    if (frameEnd === -1) {
       const tail = cursor.length <= maxPendingBytes ? cursor : cursor.subarray(-maxPendingBytes)
       return { frames, pending: trackedCopy(tail) }
     }
@@ -79,7 +79,7 @@ function extractNew(pending, chunk, maxPendingBytes = 2 * 1024 * 1024) {
   const frames = []
   while (cursor.length > 0) {
     const frameStart = cursor.indexOf(JPEG_START)
-    if (frameStart < 0) {
+    if (frameStart === -1) {
       const keepLastByte = cursor.at(-1) === 0xff
       return { frames, pending: keepLastByte ? Buffer.from([0xff]) : Buffer.alloc(0) }
     }
@@ -87,7 +87,7 @@ function extractNew(pending, chunk, maxPendingBytes = 2 * 1024 * 1024) {
       cursor = cursor.subarray(frameStart)
     }
     const frameEnd = cursor.indexOf(JPEG_END, JPEG_START.length)
-    if (frameEnd < 0) {
+    if (frameEnd === -1) {
       const tail = cursor.length <= maxPendingBytes ? cursor : cursor.subarray(-maxPendingBytes)
       return { frames, pending: trackedCopy(tail) }
     }
diff --git a/config/scripts/orchestration-skill-guidance.test.mjs b/config/scripts/orchestration-skill-guidance.test.mjs
index 080cb4fa785..b9a88ae12ad 100644
--- a/config/scripts/orchestration-skill-guidance.test.mjs
+++ b/config/scripts/orchestration-skill-guidance.test.mjs
@@ -281,7 +281,7 @@ describe('orchestration skill guidance', () => {
     expect(workerLoop).toContain('opaque provider model id with `--model`')
     expect(workerLoop).toContain('`--effort` requires `--model`')
     expect(workerLoop).toContain('neither option can combine with `--terminal`')
-    expect(workerLoop).toContain('--agent claude --model aws-bedrock-opus-5 --effort high --json')
+    expect(workerLoop).toContain('--agent claude --model opus --effort high --json')
     expect(workerLoop).toContain('`launch.requested` and `launch.effective`')
   })
 
diff --git a/config/scripts/package-electron-runtime-contract.test.mjs b/config/scripts/package-electron-runtime-contract.test.mjs
index 2c8dc4555c0..1b695086808 100644
--- a/config/scripts/package-electron-runtime-contract.test.mjs
+++ b/config/scripts/package-electron-runtime-contract.test.mjs
@@ -197,8 +197,13 @@ describe('Electron runtime package contract', () => {
     expect(relayBuild).toContain("'parcel-watcher-process-entry.ts'")
     expect(relayBuild).toContain("outfile: join(outDir, 'relay-watcher.js')")
     expect(relayBuild).toContain("readFileSync(join(outDir, 'relay-watcher.js'))")
+    expect(relayBuild).toContain("outfile: join(outDir, 'relay-ai-vault-service.js')")
+    expect(relayBuild).toContain("readFileSync(join(outDir, 'relay-ai-vault-service.js'))")
     expect(builderConfig).toContain("from: 'out/relay'")
     expect(remoteCommands).toContain("joinRemotePath(host, remoteRelayDir, 'relay-watcher.js')")
+    expect(remoteCommands).toContain(
+      "joinRemotePath(host, remoteRelayDir, 'relay-ai-vault-service.js')"
+    )
 
     const assertRelayGate = (steps, publishStepName) => {
       const names = steps.map((step) => step.name)
diff --git a/config/scripts/plain-node-entry-guard.test.ts b/config/scripts/plain-node-entry-guard.test.ts
index d65b29cd253..673b796fd43 100644
--- a/config/scripts/plain-node-entry-guard.test.ts
+++ b/config/scripts/plain-node-entry-guard.test.ts
@@ -3,7 +3,10 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import type { Plugin, Rollup } from 'vite'
 import { afterEach, describe, expect, it } from 'vitest'
-import { createPlainNodeEntryGuardPlugin } from '../build-plugins/plain-node-entry-guard'
+import {
+  createPlainNodeEntryGuardPlugin,
+  GUARDED_ENTRY_NAMES
+} from '../build-plugins/plain-node-entry-guard'
 
 let outputDir: string | undefined
 
@@ -45,16 +48,16 @@ function runWriteBundle(plugin: Plugin, dir: string, code = ''): void {
   )
 }
 
-function runCloseBundle(plugin: Plugin): void {
+async function runCloseBundle(plugin: Plugin): Promise<void> {
   const hook = plugin.closeBundle
   if (typeof hook !== 'function') {
     throw new Error('Expected closeBundle hook')
   }
-  hook.call({} as never)
+  await hook.call({} as never)
 }
 
 describe('plain Node entry guard', () => {
-  it('smoke-loads the daemon after output files are written', () => {
+  it('smoke-loads the daemon after output files are written', async () => {
     const dir = createOutputDir()
     const plugin = createPlainNodeEntryGuardPlugin()
 
@@ -64,17 +67,17 @@ describe('plain Node entry guard', () => {
       'console.error("Usage: daemon-entry <socket>"); process.exit(1)\n'
     )
 
-    expect(() => runCloseBundle(plugin)).not.toThrow()
+    await expect(runCloseBundle(plugin)).resolves.toBeUndefined()
   })
 
-  it('runs the deferred smoke from closeBundle', () => {
+  it('runs the deferred smoke from closeBundle', async () => {
     const dir = createOutputDir()
     const plugin = createPlainNodeEntryGuardPlugin()
 
     runWriteBundle(plugin, dir)
     writeFileSync(join(dir, 'daemon-entry.js'), "require('./missing-module')\n")
 
-    expect(() => runCloseBundle(plugin)).toThrow('failed to load under plain Node')
+    await expect(runCloseBundle(plugin)).rejects.toThrow('failed to load under plain Node')
   })
 
   it('rejects Electron imports during the static bundle scan', () => {
@@ -84,6 +87,70 @@ describe('plain Node entry guard', () => {
       'requires electron'
     )
   })
+
+  it('rejects Electron subpath requires', () => {
+    const plugin = createPlainNodeEntryGuardPlugin()
+
+    expect(() => runWriteBundle(plugin, createOutputDir(), 'require("electron/main")')).toThrow(
+      'requires electron'
+    )
+  })
+
+  it('fails the smoke when the daemon exits zero on an empty argv', async () => {
+    const dir = createOutputDir()
+    const plugin = createPlainNodeEntryGuardPlugin()
+
+    runWriteBundle(plugin, dir)
+    writeFileSync(join(dir, 'daemon-entry.js'), 'console.error("Usage: daemon-entry <socket>")\n')
+
+    await expect(runCloseBundle(plugin)).rejects.toThrow('did not reject an empty argv')
+  })
+
+  // daemon-entry installs a SIGTERM handler, so the smoke deadline only holds if
+  // it escalates to SIGKILL — spawnSync's own timeout would block here forever.
+  it('kills a daemon that traps SIGTERM and never exits', async () => {
+    const dir = createOutputDir()
+    const plugin = createPlainNodeEntryGuardPlugin({ timeoutMs: 250, killGraceMs: 250 })
+
+    runWriteBundle(plugin, dir)
+    writeFileSync(
+      join(dir, 'daemon-entry.js'),
+      "process.on('SIGTERM', () => {}); setInterval(() => {}, 1000)\n"
+    )
+
+    await expect(runCloseBundle(plugin)).rejects.toThrow('did not exit within 250ms')
+  }, 10_000)
+})
+
+// Why: writeBundle skips names absent from the bundle, so a renamed rollup input
+// would silently stop guarding that entry instead of failing the build.
+describe('guarded entry names', () => {
+  function runBuildStart(plugin: Plugin, input: unknown): void {
+    const hook = plugin.buildStart
+    if (typeof hook !== 'function') {
+      throw new Error('Expected buildStart hook')
+    }
+    hook.call({} as never, { input } as Rollup.NormalizedInputOptions)
+  }
+
+  it('rejects a guarded name that is no longer a rollup input', () => {
+    const plugin = createPlainNodeEntryGuardPlugin()
+    const input = Object.fromEntries(
+      GUARDED_ENTRY_NAMES.filter((name) => name !== 'stt-worker').map((name) => [
+        name,
+        `${name}.ts`
+      ])
+    )
+
+    expect(() => runBuildStart(plugin, input)).toThrow('"stt-worker"')
+  })
+
+  it('passes when every guarded name is a rollup input', () => {
+    const plugin = createPlainNodeEntryGuardPlugin()
+    const input = Object.fromEntries(GUARDED_ENTRY_NAMES.map((name) => [name, `${name}.ts`]))
+
+    expect(() => runBuildStart(plugin, input)).not.toThrow()
+  })
 })
 
 // Why (#11161): Electron's module is not registered on worker threads either —
diff --git a/config/scripts/pr-workflow-parallelism.test.mjs b/config/scripts/pr-workflow-parallelism.test.mjs
index 5b3b66dea3f..165931dbeb1 100644
--- a/config/scripts/pr-workflow-parallelism.test.mjs
+++ b/config/scripts/pr-workflow-parallelism.test.mjs
@@ -8,6 +8,7 @@ const dependencyAction = parse(
 )
 const packageJson = JSON.parse(readFileSync('package.json', 'utf8'))
 const shellContractFiles = [
+  'src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts',
   'src/main/daemon/shell-ready.test.ts',
   'src/main/providers/local-pty-shell-ready.test.ts',
   'src/main/providers/__tests__/shell-ready-framework-example.test.ts',
@@ -75,6 +76,7 @@ describe('PR workflow parallelism', () => {
 
     expect(shellStep).toBeDefined()
     expect(shellInstall).toBeDefined()
+    expect(shellStep.run.split(/\s+/)).toContain('--maxWorkers=1')
     // Why the whole workflow, not just the general shards: any other lane installing
     // these shells would silently start running the real-shell tests twice.
     expect(jobsInstallingPackages).toEqual(['shell_contracts'])
diff --git a/config/scripts/relay-watcher-fault-harness.mjs b/config/scripts/relay-watcher-fault-harness.mjs
index b27a1f945d9..784abfc4850 100644
--- a/config/scripts/relay-watcher-fault-harness.mjs
+++ b/config/scripts/relay-watcher-fault-harness.mjs
@@ -94,7 +94,7 @@ function waitForStdoutSentinel(proc, protocol, stderr) {
         stdoutBuffer = Buffer.concat([stdoutBuffer, chunk])
         const sentinel = Buffer.from(protocol.RELAY_SENTINEL)
         const index = stdoutBuffer.indexOf(sentinel)
-        if (index < 0) {
+        if (index === -1) {
           return
         }
         settled = true
@@ -148,7 +148,7 @@ function createRelayClient(entryPath, args, env, protocol) {
     stdoutBuffer = Buffer.concat([stdoutBuffer, chunk])
     const sentinel = Buffer.from(protocol.RELAY_SENTINEL)
     const index = stdoutBuffer.indexOf(sentinel)
-    if (index < 0) {
+    if (index === -1) {
       return
     }
     ready = true
diff --git a/config/scripts/remote-shared-control-retirement-probe.ts b/config/scripts/remote-shared-control-retirement-probe.ts
index 63abd01e376..30edeb9802a 100644
--- a/config/scripts/remote-shared-control-retirement-probe.ts
+++ b/config/scripts/remote-shared-control-retirement-probe.ts
@@ -5,7 +5,8 @@ import {
   resolveEnvironment,
   resolveEnvironmentPairingOffer
 } from '../../src/shared/runtime-environment-store'
-import type { MemorySnapshot, RuntimeStatus } from '../../src/shared/types'
+import type { MemorySnapshot } from '../../src/shared/types'
+import type { RuntimeStatus } from '../../src/shared/runtime-types'
 
 async function main(): Promise<void> {
   const environmentName = process.env.ORCA_PROBE_ENVIRONMENT_NAME
diff --git a/config/scripts/run-ai-vault-typing-bench.mjs b/config/scripts/run-ai-vault-typing-bench.mjs
new file mode 100644
index 00000000000..e4dd25b24ed
--- /dev/null
+++ b/config/scripts/run-ai-vault-typing-bench.mjs
@@ -0,0 +1,50 @@
+import { spawn } from 'node:child_process'
+
+const npxCommand = process.platform === 'win32' ? 'npx.cmd' : 'npx'
+const knobByFlag = {
+  '--iterations': 'ORCA_AI_VAULT_BENCH_ITERATIONS',
+  '--sessions': 'ORCA_AI_VAULT_BENCH_SESSIONS',
+  '--payload-kib': 'ORCA_AI_VAULT_BENCH_PAYLOAD_KIB',
+  '--keys': 'ORCA_AI_VAULT_BENCH_KEYS',
+  '--cadence-ms': 'ORCA_AI_VAULT_BENCH_CADENCE_MS',
+  '--label': 'ORCA_AI_VAULT_BENCH_LABEL'
+}
+
+const env = { ...process.env, ORCA_AI_VAULT_TYPING_BENCH: '1' }
+const passthroughArgs = []
+const argv = process.argv.slice(2)
+for (let index = 0; index < argv.length; index += 1) {
+  if (argv[index] === '--') {
+    continue
+  }
+  const knob = knobByFlag[argv[index]]
+  if (knob) {
+    env[knob] = argv[++index]
+  } else {
+    passthroughArgs.push(argv[index])
+  }
+}
+
+const child = spawn(
+  npxCommand,
+  [
+    'playwright',
+    'test',
+    'tests/e2e/terminal-ai-vault-typing-latency.spec.ts',
+    '--config',
+    'tests/playwright.config.ts',
+    '--project',
+    'electron-headless',
+    '--workers=1',
+    ...passthroughArgs
+  ],
+  { stdio: 'inherit', env }
+)
+
+child.on('exit', (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal)
+    return
+  }
+  process.exit(code ?? 1)
+})
diff --git a/config/scripts/run-idle-cpu-benchmark.mjs b/config/scripts/run-idle-cpu-benchmark.mjs
index 53cabd3380b..3892de8845d 100644
--- a/config/scripts/run-idle-cpu-benchmark.mjs
+++ b/config/scripts/run-idle-cpu-benchmark.mjs
@@ -1,15 +1,34 @@
 #!/usr/bin/env node
 import { _electron as electron } from '@stablyai/playwright-test'
-import { execFileSync, spawnSync } from 'node:child_process'
+import { execFileSync } from 'node:child_process'
 import { existsSync, mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
+import {
+  descendantsOf,
+  readProcessRows,
+  sampleProcessTreeUntilWorkloadsComplete,
+  summarizeProcessInventory,
+  summarizeSamples,
+  terminateProcesses
+} from './idle-cpu-process-sampling.mjs'
+import {
+  collectRendererCensus,
+  configureRendererScaleFixture
+} from './idle-cpu-renderer-scale-fixture.mjs'
+import {
+  runZustandPublications,
+  snapshotRendererTimingProbe,
+  startRendererTimingProbe,
+  stopRendererTimingProbe
+} from './idle-cpu-renderer-timing-probe.mjs'
 import { installSyntheticVisibleSpinners } from './idle-cpu-synthetic-spinners.mjs'
 
 const DEFAULT_WARMUP_MS = 15_000
 const DEFAULT_SAMPLE_MS = 30_000
 const DEFAULT_INTERVAL_MS = 1_000
 const DEFAULT_WORKTREE_COUNT = 1
+const DEFAULT_ZUSTAND_PUBLICATION_INTERVAL_MS = 100
 const ONBOARDING_FINAL_STEP = 3
 const ONBOARDING_FLOW_VERSION = 2
 
@@ -19,6 +38,10 @@ function parseArgs(argv) {
     sampleMs: DEFAULT_SAMPLE_MS,
     intervalMs: DEFAULT_INTERVAL_MS,
     worktrees: DEFAULT_WORKTREE_COUNT,
+    lineageDepth: 0,
+    agentsPerWorktree: 0,
+    zustandPublications: 0,
+    zustandPublicationIntervalMs: DEFAULT_ZUSTAND_PUBLICATION_INTERVAL_MS,
     skipBuild: false,
     headful: false,
     output: null,
@@ -47,6 +70,14 @@ function parseArgs(argv) {
       options.intervalMs = Number(readValue())
     } else if (arg === '--worktrees') {
       options.worktrees = Number(readValue())
+    } else if (arg === '--lineage-depth') {
+      options.lineageDepth = Number(readValue())
+    } else if (arg === '--agents-per-worktree') {
+      options.agentsPerWorktree = Number(readValue())
+    } else if (arg === '--zustand-publications') {
+      options.zustandPublications = Number(readValue())
+    } else if (arg === '--zustand-publication-interval-ms') {
+      options.zustandPublicationIntervalMs = Number(readValue())
     } else if (arg === '--output') {
       options.output = readValue()
     } else if (arg === '--skip-build') {
@@ -73,6 +104,10 @@ function parseArgs(argv) {
     'sampleMs',
     'intervalMs',
     'worktrees',
+    'lineageDepth',
+    'agentsPerWorktree',
+    'zustandPublications',
+    'zustandPublicationIntervalMs',
     'syntheticVisibleSpinners',
     'syntheticSpinnerSteps'
   ]) {
@@ -82,16 +117,33 @@ function parseArgs(argv) {
   }
   options.worktrees = Math.max(1, Math.floor(options.worktrees))
   options.intervalMs = Math.max(250, Math.floor(options.intervalMs))
+  options.lineageDepth = Math.floor(options.lineageDepth)
+  options.agentsPerWorktree = Math.floor(options.agentsPerWorktree)
+  options.zustandPublications = Math.floor(options.zustandPublications)
+  options.zustandPublicationIntervalMs = Math.max(
+    1,
+    Math.floor(options.zustandPublicationIntervalMs)
+  )
   options.syntheticVisibleSpinners = Math.max(0, Math.floor(options.syntheticVisibleSpinners))
   options.syntheticSpinnerSteps = Math.max(1, Math.floor(options.syntheticSpinnerSteps))
   if (!['smooth', 'steps'].includes(options.syntheticSpinnerAnimation)) {
     throw new Error(`Invalid --synthetic-spinner-animation: ${options.syntheticSpinnerAnimation}`)
   }
+  if (options.lineageDepth > 0 && options.worktrees < 2) {
+    throw new Error('--lineage-depth requires at least two --worktrees')
+  }
+  const publicationSpanMs =
+    Math.max(0, options.zustandPublications - 1) * options.zustandPublicationIntervalMs
+  if (publicationSpanMs > options.sampleMs) {
+    throw new Error(
+      `Zustand publication span ${publicationSpanMs}ms exceeds --sample-ms ${options.sampleMs}`
+    )
+  }
   return options
 }
 function printUsage() {
   console.log(
-    `Usage: node config/scripts/run-idle-cpu-benchmark.mjs [options]\n\nOptions:\n  --warmup-ms <n>    Time to wait after app readiness before sampling (default ${DEFAULT_WARMUP_MS})\n  --sample-ms <n>    Sampling window duration (default ${DEFAULT_SAMPLE_MS})\n  --interval-ms <n>  Sampling cadence (default ${DEFAULT_INTERVAL_MS})\n  --worktrees <n>    Seed repo worktree count, including primary (default ${DEFAULT_WORKTREE_COUNT})\n  --headful          Show the Electron window while measuring\n  --skip-build       Reuse out/main/index.js instead of building first\n  --output <path>    Write JSON report to this path\n  --disable-renderer-animations  Inject measurement-only CSS that disables animations/transitions\n  --synthetic-visible-spinners <n>  Measurement-only: add visible working spinners\n  --synthetic-spinner-animation <smooth|steps>  Spinner animation style (default smooth)\n  --synthetic-spinner-steps <n>  Step count for --synthetic-spinner-animation steps (default 12)\n`
+    `Usage: node config/scripts/run-idle-cpu-benchmark.mjs [options]\n\nOptions:\n  --warmup-ms <n>    Time to wait after app readiness before sampling (default ${DEFAULT_WARMUP_MS})\n  --sample-ms <n>    Sampling window duration (default ${DEFAULT_SAMPLE_MS})\n  --interval-ms <n>  Sampling cadence (default ${DEFAULT_INTERVAL_MS})\n  --worktrees <n>    Seed repo worktree count, including primary (default ${DEFAULT_WORKTREE_COUNT})\n  --lineage-depth <n>  Nest all worktrees under one expanded lineage, up to this depth\n  --agents-per-worktree <n>  Seed this many visible inline agent rows per worktree\n  --zustand-publications <n>  Publish exactly this many store updates during sampling\n  --zustand-publication-interval-ms <n>  Publication cadence (default ${DEFAULT_ZUSTAND_PUBLICATION_INTERVAL_MS})\n  --headful          Show the Electron window while measuring\n  --skip-build       Reuse out/main/index.js instead of building first\n  --output <path>    Write JSON report to this path\n  --disable-renderer-animations  Inject measurement-only CSS that disables animations/transitions\n  --synthetic-visible-spinners <n>  Measurement-only: add visible working spinners\n  --synthetic-spinner-animation <smooth|steps>  Spinner animation style (default smooth)\n  --synthetic-spinner-steps <n>  Step count for --synthetic-spinner-animation steps (default 12)\n`
   )
 }
 function run(command, args, options = {}) {
@@ -188,140 +240,6 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms))
 }
 
-function parseCpuTimeSeconds(value) {
-  const trimmed = String(value || '').trim()
-  if (!trimmed) {
-    return null
-  }
-  const [dayOrTime, maybeTime] = trimmed.includes('-') ? trimmed.split('-', 2) : [null, trimmed]
-  const days = dayOrTime === null ? 0 : Number(dayOrTime)
-  const parts = maybeTime.split(':').map(Number)
-  if (!Number.isFinite(days) || parts.some((part) => !Number.isFinite(part))) {
-    return null
-  }
-  if (parts.length === 3) {
-    return days * 86400 + parts[0] * 3600 + parts[1] * 60 + parts[2]
-  }
-  if (parts.length === 2) {
-    return days * 86400 + parts[0] * 60 + parts[1]
-  }
-  if (parts.length === 1) {
-    return days * 86400 + parts[0]
-  }
-  return null
-}
-
-function parseUnixProcesses(stdout) {
-  const rows = []
-  for (const raw of stdout.split('\n')) {
-    const line = raw.trim()
-    if (!line) {
-      continue
-    }
-    const match = line.match(/^(\d+)\s+(\d+)\s+([\d.]+)\s+(\d+)\s+(\S+)\s+(.+)$/)
-    if (!match) {
-      continue
-    }
-    rows.push({
-      pid: Number(match[1]),
-      ppid: Number(match[2]),
-      percentCpu: Number(match[3]),
-      rssBytes: Number(match[4]) * 1024,
-      cpuTimeSeconds: parseCpuTimeSeconds(match[5]),
-      command: match[6]
-    })
-  }
-  return rows
-}
-
-function readUnixProcesses() {
-  const stdout = execFileSync('ps', ['-axo', 'pid=,ppid=,pcpu=,rss=,cputime=,command='], {
-    encoding: 'utf8',
-    env: { ...process.env, LC_ALL: 'C', LANG: 'C' },
-    maxBuffer: 20 * 1024 * 1024
-  })
-  return parseUnixProcesses(stdout)
-}
-
-function readWindowsProcesses() {
-  const script =
-    'Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,WorkingSetSize,CommandLine | ConvertTo-Json -Compress'
-  const result = spawnSync('powershell.exe', ['-NoProfile', '-Command', script], {
-    encoding: 'utf8',
-    maxBuffer: 20 * 1024 * 1024
-  })
-  if (result.status !== 0) {
-    throw new Error(result.stderr || 'PowerShell process enumeration failed')
-  }
-  const parsed = JSON.parse(result.stdout || '[]')
-  const entries = Array.isArray(parsed) ? parsed : [parsed]
-  return entries.map((entry) => ({
-    pid: Number(entry.ProcessId),
-    ppid: Number(entry.ParentProcessId),
-    percentCpu: 0,
-    cpuTimeSeconds: null,
-    rssBytes: Number(entry.WorkingSetSize) || 0,
-    command: String(entry.CommandLine || '')
-  }))
-}
-
-function readProcessRows() {
-  return process.platform === 'win32' ? readWindowsProcesses() : readUnixProcesses()
-}
-
-function descendantsOf(rows, rootPid) {
-  const children = new Map()
-  for (const row of rows) {
-    const list = children.get(row.ppid) ?? []
-    list.push(row)
-    children.set(row.ppid, list)
-  }
-  const result = []
-  const stack = [rootPid]
-  const seen = new Set()
-  while (stack.length > 0) {
-    const pid = stack.pop()
-    if (seen.has(pid)) {
-      continue
-    }
-    seen.add(pid)
-    const row = rows.find((candidate) => candidate.pid === pid)
-    if (row) {
-      result.push(row)
-    }
-    for (const child of children.get(pid) ?? []) {
-      stack.push(child.pid)
-    }
-  }
-  return result
-}
-
-function classify(row, rootPid) {
-  const command = row.command.toLowerCase()
-  if (row.pid === rootPid) {
-    return 'main'
-  }
-  if (command.includes('daemon-entry')) {
-    return 'daemon'
-  }
-  if (command.includes('--type=gpu-process')) {
-    return 'gpu'
-  }
-  if (command.includes('--type=renderer')) {
-    return 'renderer'
-  }
-  if (command.includes('--type=utility')) {
-    return 'utility'
-  }
-  if (command.includes('--type=')) {
-    return 'electron-other'
-  }
-  if (command.includes('node') || command.includes('/pi') || command.endsWith(' pi')) {
-    return 'agent-or-node'
-  }
-  return 'other-descendant'
-}
-
 async function collectRendererIdleState(page) {
   return page.evaluate(() => {
     const describeElement = (element) => {
@@ -364,93 +282,6 @@ async function collectRendererIdleState(page) {
   })
 }
 
-function summarizeSamples(samples) {
-  const byKind = new Map()
-  for (const sample of samples) {
-    for (const proc of sample.processes) {
-      const bucket = byKind.get(proc.kind) ?? { cpuValues: [], rssValues: [], maxProcessCount: 0 }
-      bucket.cpuValues.push(proc.cpu)
-      bucket.rssValues.push(proc.rssBytes)
-      byKind.set(proc.kind, bucket)
-    }
-    const counts = new Map()
-    for (const proc of sample.processes) {
-      counts.set(proc.kind, (counts.get(proc.kind) ?? 0) + 1)
-    }
-    for (const [kind, count] of counts) {
-      byKind.get(kind).maxProcessCount = Math.max(byKind.get(kind).maxProcessCount, count)
-    }
-  }
-  const summary = {}
-  for (const [kind, values] of byKind) {
-    const cpuSorted = [...values.cpuValues].sort((a, b) => a - b)
-    const rssSumBySample = samples.map((sample) =>
-      sample.processes
-        .filter((proc) => proc.kind === kind)
-        .reduce((sum, proc) => sum + proc.rssBytes, 0)
-    )
-    summary[kind] = {
-      meanCpuPercent: mean(values.cpuValues),
-      p95CpuPercent: percentile(cpuSorted, 0.95),
-      maxCpuPercent: Math.max(0, ...values.cpuValues),
-      meanRssBytes: mean(rssSumBySample),
-      maxProcessCount: values.maxProcessCount
-    }
-  }
-  summary.total = {
-    meanCpuPercent: mean(samples.map((sample) => sample.totalCpuPercent)),
-    p95CpuPercent: percentile(
-      samples.map((sample) => sample.totalCpuPercent).sort((a, b) => a - b),
-      0.95
-    ),
-    meanRssBytes: mean(samples.map((sample) => sample.totalRssBytes))
-  }
-  return summary
-}
-
-function summarizeProcessInventory(samples) {
-  const inventory = {}
-  for (const sample of samples) {
-    const counts = new Map()
-    for (const proc of sample.processes) {
-      counts.set(proc.kind, (counts.get(proc.kind) ?? 0) + 1)
-      const entry = inventory[proc.kind] ?? {
-        maxProcessCount: 0,
-        maxCpuPercent: 0,
-        commandSamples: []
-      }
-      entry.maxCpuPercent = Math.max(entry.maxCpuPercent, proc.cpu)
-      if (!entry.commandSamples.includes(proc.command) && entry.commandSamples.length < 6) {
-        entry.commandSamples.push(proc.command)
-      }
-      inventory[proc.kind] = entry
-    }
-    for (const [kind, count] of counts) {
-      inventory[kind].maxProcessCount = Math.max(inventory[kind].maxProcessCount, count)
-    }
-  }
-  return inventory
-}
-function mean(values) {
-  return values.length === 0 ? 0 : values.reduce((sum, value) => sum + value, 0) / values.length
-}
-
-function percentile(sorted, fraction) {
-  if (sorted.length === 0) {
-    return 0
-  }
-  const index = Math.min(sorted.length - 1, Math.ceil(sorted.length * fraction) - 1)
-  return sorted[index]
-}
-
-function terminateProcesses(processes) {
-  for (const proc of processes) {
-    try {
-      process.kill(proc.pid)
-    } catch {}
-  }
-}
-
 async function main() {
   const options = parseArgs(process.argv.slice(2))
   const root = path.resolve(import.meta.dirname, '..', '..')
@@ -491,6 +322,11 @@ async function main() {
     const page = await app.firstWindow({ timeout: 120_000 })
     await page.waitForLoadState('domcontentloaded')
     await page.waitForFunction(() => Boolean(window.__store), null, { timeout: 30_000 })
+    await page.waitForFunction(
+      () => window.__store?.getState().workspaceSessionReady === true,
+      null,
+      { timeout: 60_000 }
+    )
     const measurementCss = []
     if (options.disableRendererAnimations) {
       measurementCss.push(
@@ -506,63 +342,111 @@ async function main() {
       options.syntheticSpinnerAnimation,
       options.syntheticSpinnerSteps
     )
-    await page.evaluate(async (repoPath) => {
-      await window.api.repos.add({ path: repoPath })
+    const fixtureState = await page.evaluate(async (repoPath) => {
+      const added = await window.api.repos.add({ path: repoPath })
+      if ('error' in added) {
+        return { error: added.error }
+      }
       const store = window.__store
       await store?.getState().fetchRepos()
-      const repo = store?.getState().repos.find((candidate) => candidate.path === repoPath)
+      const repo = store?.getState().repos.find((candidate) => candidate.id === added.repo.id)
       if (repo) {
-        await store.getState().updateRepo(repo.id, { externalWorktreeVisibility: 'show' })
-        await store.getState().fetchWorktrees(repo.id)
+        const detected = await store
+          .getState()
+          .fetchWorktrees(repo.id, { requireAuthoritative: true })
+        const importedWorktreePaths = (
+          store.getState().detectedWorktreesByRepo[repo.id]?.worktrees ?? []
+        )
+          .filter((worktree) => !worktree.selectedCheckout)
+          .map((worktree) => worktree.path)
+        const updated = await store.getState().updateRepo(repo.id, {
+          externalWorktreeVisibility: 'show',
+          importedExternalWorktreePaths: importedWorktreePaths,
+          externalWorktreeInboxBaselinePaths: importedWorktreePaths
+        })
+        const refreshed = await store
+          .getState()
+          .fetchWorktrees(repo.id, { requireAuthoritative: true })
+        return {
+          detected,
+          updated,
+          refreshed,
+          detectedCount: store.getState().detectedWorktreesByRepo[repo.id]?.worktrees.length ?? 0,
+          importedCount: importedWorktreePaths.length,
+          visibleCount: store.getState().worktreesByRepo[repo.id]?.length ?? 0
+        }
       }
+      return { error: 'repo-not-found' }
     }, repoDir)
+    console.log(`[idle-cpu] fixture ${JSON.stringify(fixtureState)}`)
     await page.waitForFunction(
-      () => window.__store?.getState().workspaceSessionReady === true,
+      (expectedWorktrees) => {
+        const state = window.__store?.getState()
+        return (
+          state?.workspaceSessionReady === true &&
+          Object.values(state.worktreesByRepo).flat().length === expectedWorktrees
+        )
+      },
+      options.worktrees,
+      { timeout: 180_000 }
+    )
+    const scaleFixtureState = await configureRendererScaleFixture(page, options, repoDir)
+    if (scaleFixtureState.applied) {
+      console.log(`[idle-cpu] scale fixture ${JSON.stringify(scaleFixtureState)}`)
+    }
+    await page.waitForFunction(
+      (expectedAgentRows) => {
+        const state = window.__store?.getState()
+        return (
+          state !== undefined &&
+          Object.keys(state.agentStatusByPaneKey ?? {}).length >= expectedAgentRows
+        )
+      },
+      scaleFixtureState.seededAgentRows,
+      { timeout: 30_000 }
+    )
+    await page.waitForFunction(
+      () => Boolean(document.querySelector('[data-worktree-sidebar] [data-worktree-id]')),
       null,
-      { timeout: 60_000 }
+      { timeout: 30_000 }
     )
     console.log(
-      `[idle-cpu] root pid=${rootPid}; warmup=${options.warmupMs}ms sample=${options.sampleMs}ms interval=${options.intervalMs}ms worktrees=${options.worktrees}`
+      `[idle-cpu] root pid=${rootPid}; warmup=${options.warmupMs}ms sample=${options.sampleMs}ms interval=${options.intervalMs}ms worktrees=${options.worktrees} lineage-depth=${options.lineageDepth} agents/worktree=${options.agentsPerWorktree} publications=${options.zustandPublications}`
     )
+    await startRendererTimingProbe(page)
     await sleep(options.warmupMs)
     const rendererIdleState = await collectRendererIdleState(page)
-    const deadline = Date.now() + options.sampleMs
-    const samples = []
-    let previousSnapshot = null
-    while (Date.now() <= deadline || samples.length === 0) {
-      const sampledAt = Date.now()
-      const processRows = descendantsOf(readProcessRows(), rootPid)
-      const rawProcesses = processRows.map((row) => ({ ...row, kind: classify(row, rootPid) }))
-      if (previousSnapshot) {
-        const elapsedSeconds = Math.max(0.001, (sampledAt - previousSnapshot.at) / 1000)
-        const previousByPid = new Map(previousSnapshot.processes.map((proc) => [proc.pid, proc]))
-        const processes = rawProcesses.map((row) => {
-          const previous = previousByPid.get(row.pid)
-          const canComputeDelta =
-            typeof row.cpuTimeSeconds === 'number' && typeof previous?.cpuTimeSeconds === 'number'
-          const cpu = canComputeDelta
-            ? Math.max(0, ((row.cpuTimeSeconds - previous.cpuTimeSeconds) / elapsedSeconds) * 100)
-            : row.percentCpu
-          return { ...row, cpu }
-        })
-        samples.push({
-          at: sampledAt,
-          elapsedMs: sampledAt - previousSnapshot.at,
-          totalCpuPercent: processes.reduce((sum, proc) => sum + proc.cpu, 0),
-          totalRssBytes: processes.reduce((sum, proc) => sum + proc.rssBytes, 0),
-          processes
-        })
-      }
-      previousSnapshot = { at: sampledAt, processes: rawProcesses }
-      await sleep(options.intervalMs)
-    }
+    const rendererCensusBefore = await collectRendererCensus(page, options.lineageDepth)
+    const rendererTimingBefore = await snapshotRendererTimingProbe(page)
+    const publicationPromise = runZustandPublications(
+      page,
+      options.zustandPublications,
+      options.zustandPublicationIntervalMs
+    )
+    const sampled = await sampleProcessTreeUntilWorkloadsComplete({
+      rootPid,
+      requestedDurationMs: options.sampleMs,
+      intervalMs: options.intervalMs,
+      workloadPromise: publicationPromise
+    })
+    const samples = sampled.samples
+    const zustandPublications = sampled.workloadResult
+    const rendererTimingAfter = await stopRendererTimingProbe(page)
+    const rendererCensusAfter = await collectRendererCensus(page, options.lineageDepth)
     const report = {
       benchmark: 'orca-idle-cpu',
       createdAt: new Date().toISOString(),
       options,
       rootPid,
       platform: { platform: process.platform, arch: process.arch, cpus: os.cpus().length },
+      fixtureState,
+      scaleFixtureState,
       rendererIdleState,
+      rendererCensusBefore,
+      rendererCensusAfter,
+      rendererTiming: { before: rendererTimingBefore, after: rendererTimingAfter },
+      zustandPublications,
+      samplingWindow: sampled.samplingWindow,
       sampleCount: samples.length,
       summary: summarizeSamples(samples),
       processInventory: summarizeProcessInventory(samples),
@@ -578,7 +462,13 @@ async function main() {
         {
           summary: report.summary,
           processInventory: report.processInventory,
-          sampleCount: report.sampleCount
+          sampleCount: report.sampleCount,
+          scaleFixtureState: report.scaleFixtureState,
+          rendererCensusBefore: report.rendererCensusBefore,
+          rendererCensusAfter: report.rendererCensusAfter,
+          rendererTiming: report.rendererTiming,
+          zustandPublications: report.zustandPublications,
+          samplingWindow: report.samplingWindow
         },
         null,
         2
diff --git a/config/scripts/run-ssh-staged-upload-reliability.mjs b/config/scripts/run-ssh-staged-upload-reliability.mjs
index 4fadf6f3001..fb3d0040350 100644
--- a/config/scripts/run-ssh-staged-upload-reliability.mjs
+++ b/config/scripts/run-ssh-staged-upload-reliability.mjs
@@ -17,8 +17,8 @@ const defaultFiles = [
 const cliArguments = process.argv.slice(2)
 const powerShellFlag = cliArguments.indexOf('--powershell')
 const configuredPowerShell =
-  powerShellFlag >= 0 ? cliArguments[powerShellFlag + 1] : process.env.ORCA_POWERSHELL_EXECUTABLE
-if (powerShellFlag >= 0 && !configuredPowerShell) {
+  powerShellFlag !== -1 ? cliArguments[powerShellFlag + 1] : process.env.ORCA_POWERSHELL_EXECUTABLE
+if (powerShellFlag !== -1 && !configuredPowerShell) {
   console.error('--powershell requires an executable path')
   process.exit(2)
 }
diff --git a/config/scripts/terminal-e2e-helpers.mjs b/config/scripts/terminal-e2e-helpers.mjs
index 2f89f1a7f90..8b698416326 100644
--- a/config/scripts/terminal-e2e-helpers.mjs
+++ b/config/scripts/terminal-e2e-helpers.mjs
@@ -222,8 +222,8 @@ if (process.argv[1]?.endsWith('terminal-e2e-helpers.mjs')) {
   const args = process.argv.slice(2)
   const portIdx = args.indexOf('--port')
   const cmdIdx = args.indexOf('--command')
-  const port = portIdx >= 0 ? Number(args[portIdx + 1]) : 9444
-  const command = cmdIdx >= 0 ? args[cmdIdx + 1] : null
+  const port = portIdx !== -1 ? Number(args[portIdx + 1]) : 9444
+  const command = cmdIdx !== -1 ? args[cmdIdx + 1] : null
 
   const term = new OrcaTerminal(port)
   console.log('Connecting to Orca on CDP port', port, '...')
diff --git a/config/scripts/verify-agent-hook-stdin-lifecycle.mjs b/config/scripts/verify-agent-hook-stdin-lifecycle.mjs
index 06ee9734783..187b5aa3fc2 100644
--- a/config/scripts/verify-agent-hook-stdin-lifecycle.mjs
+++ b/config/scripts/verify-agent-hook-stdin-lifecycle.mjs
@@ -5,6 +5,7 @@ import {
   accessSync,
   chmodSync,
   constants as fsConstants,
+  mkdirSync,
   mkdtempSync,
   readFileSync,
   rmSync,
@@ -141,7 +142,7 @@ function readGeneratedScripts(home, minMtime) {
     const body = readFileSync(path, 'utf8')
     const captureIndex = body.indexOf('payload=$(cat)')
     const firstExitIndex = body.indexOf('exit 0')
-    if (captureIndex < 0 || firstExitIndex <= captureIndex) {
+    if (captureIndex === -1 || firstExitIndex <= captureIndex) {
       throw new Error([fileName, ' can exit before capturing stdin'].join(''))
     }
     return { body, fileName, path, source }
@@ -311,43 +312,37 @@ async function verifyForwarding(scripts, home, payload) {
   }
 }
 
-// Why: rewrite from the path embedded in the installed command, not a
-// reconstructed join(home, ...). That way missing/failing-script cases cannot
-// silently re-run the real script if the install layout changes.
-function rewriteLauncherScriptPath(command, nextPath) {
-  const match = /if \[ -f '([^']+)'/.exec(command)
-  if (!match) {
-    throw new Error('Installed launcher command did not reference a quoted script path')
-  }
-  return command.replaceAll(match[1], nextPath)
-}
-
 async function verifyInstalledLauncher(home, payload) {
   const settingsPath = join(home, '.claude', 'settings.json')
   const settings = JSON.parse(readFileSync(settingsPath, 'utf8'))
   const command = findStrings(settings).find(
     (value) => value.includes('claude-hook.sh') && value.includes('if [ -f ')
   )
-  if (!command || !command.includes('] && [ -r ') || !command.includes('else cat >/dev/null')) {
+  if (
+    !command ||
+    !command.includes('"$HOME/.orca/agent-hooks/claude-hook.sh"') ||
+    !command.includes('] && [ -r ') ||
+    !command.includes('else { command -p cat')
+  ) {
     throw new Error('Electron did not install the guarded Claude launcher')
   }
   const scratch = mkdtempSync(join(tmpdir(), 'orca-hook-launcher-'))
   try {
-    const missingPath = join(scratch, 'missing-hook.sh')
     const missingResult = await runShell(
-      rewriteLauncherScriptPath(command, missingPath),
+      command,
       payload,
-      withoutOrcaEnvironment({ HOME: home })
+      withoutOrcaEnvironment({ HOME: scratch })
     )
     assertSuccessfulWrite(missingResult, 'installed missing-script launcher')
 
-    const failingPath = join(scratch, 'failing-hook.sh')
+    const failingPath = join(scratch, '.orca', 'agent-hooks', 'claude-hook.sh')
+    mkdirSync(join(scratch, '.orca', 'agent-hooks'), { recursive: true })
     writeFileSync(failingPath, '#!/bin/sh\ncat >/dev/null\nexit 7\n', 'utf8')
     chmodSync(failingPath, 0o755)
     const failingResult = await runShell(
-      rewriteLauncherScriptPath(command, failingPath),
+      command,
       payload,
-      withoutOrcaEnvironment({ HOME: home })
+      withoutOrcaEnvironment({ HOME: scratch })
     )
     if (failingResult.exitCode !== 7 || failingResult.stdinErrors.length > 0) {
       throw new Error('Installed launcher did not preserve a running script failure')
diff --git a/config/scripts/verify-computer-native.mjs b/config/scripts/verify-computer-native.mjs
index 91c27e03a5b..56efeb33521 100644
--- a/config/scripts/verify-computer-native.mjs
+++ b/config/scripts/verify-computer-native.mjs
@@ -27,6 +27,12 @@ const checks = [
     ],
     enabled: true
   },
+  {
+    name: 'Linux snapshot renderer tests',
+    command: 'python3',
+    args: ['native/computer-use-linux/runtime_render_test.py'],
+    enabled: true
+  },
   {
     name: 'native provider argument guardrails',
     run: verifyNativeArgumentGuardrails,
@@ -69,6 +75,19 @@ const checks = [
     run: verifyWindowsProviderHandshake,
     enabled: process.platform === 'win32'
   },
+  {
+    name: 'Windows snapshot renderer tests',
+    command: 'powershell.exe',
+    args: [
+      '-NoLogo',
+      '-NoProfile',
+      '-ExecutionPolicy',
+      'Bypass',
+      '-File',
+      'native/computer-use-windows/runtime-render.test.ps1'
+    ],
+    enabled: process.platform === 'win32'
+  },
   {
     name: 'macOS helper app bundle and signature',
     run: verifyMacOSHelperApp,
@@ -470,11 +489,11 @@ function verifyNativeArgumentGuardrails() {
 
 function powerShellFunctionBody(source, name) {
   const start = source.indexOf(`function ${name}`)
-  if (start < 0) {
+  if (start === -1) {
     return null
   }
   const bodyStart = source.indexOf('{', start)
-  if (bodyStart < 0) {
+  if (bodyStart === -1) {
     return null
   }
   let depth = 0
@@ -494,11 +513,11 @@ function powerShellFunctionBody(source, name) {
 
 function swiftFunctionBody(source, name) {
   const start = source.indexOf(`func ${name}`)
-  if (start < 0) {
+  if (start === -1) {
     return null
   }
   const bodyStart = source.indexOf('{', start)
-  if (bodyStart < 0) {
+  if (bodyStart === -1) {
     return null
   }
   let depth = 0
diff --git a/config/scripts/windows-ssh-attach-console-repro.mjs b/config/scripts/windows-ssh-attach-console-repro.mjs
index db3a7de23d2..ce0b9b1d40a 100644
--- a/config/scripts/windows-ssh-attach-console-repro.mjs
+++ b/config/scripts/windows-ssh-attach-console-repro.mjs
@@ -153,6 +153,7 @@ function prepareRelayTree(runDir, nodePtyDir) {
   for (const filename of [
     'relay.js',
     'relay-watcher.js',
+    'relay-ai-vault-service.js',
     'managed-hook-runtime.js',
     NODE_PTY_PATCH_FILENAME,
     '.version'
diff --git a/config/scripts/worktree-refresh-churn-benchmark.mjs b/config/scripts/worktree-refresh-churn-benchmark.mjs
new file mode 100644
index 00000000000..67265305322
--- /dev/null
+++ b/config/scripts/worktree-refresh-churn-benchmark.mjs
@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+import { performance } from 'node:perf_hooks'
+import { planWorktreeSortOrderUpdates } from '../../src/shared/worktree-sort-order-update.ts'
+import { reuseEqualCatalogRows } from '../../src/renderer/src/store/slices/worktree-catalog-reconciliation.ts'
+
+const WORKTREE_COUNT = 655
+const TAB_COUNT = 1_895
+const REFRESH_COUNT = 10
+const ROUNDS = 15
+const BATCHES_PER_ROUND = 25
+
+function makeFixture() {
+  const worktrees = Array.from({ length: WORKTREE_COUNT }, (_, index) => ({
+    id: `repo-${index % 15}::/workspace/${index}`,
+    sortOrder: WORKTREE_COUNT - index,
+    lastActivityAt: index % 19,
+    isArchived: false
+  }))
+  const tabs = Array.from({ length: TAB_COUNT }, (_, index) => ({
+    worktreeId: worktrees[index % worktrees.length].id,
+    live: index % 3 === 0
+  }))
+  return { worktrees, tabs }
+}
+
+function runSidebarProjection(worktrees, tabs) {
+  const liveTabsByWorktree = new Map()
+  for (const tab of tabs) {
+    if (tab.live) {
+      liveTabsByWorktree.set(tab.worktreeId, (liveTabsByWorktree.get(tab.worktreeId) ?? 0) + 1)
+    }
+  }
+  const sorted = [...worktrees].sort(
+    (left, right) =>
+      (liveTabsByWorktree.get(right.id) ?? 0) - (liveTabsByWorktree.get(left.id) ?? 0) ||
+      right.lastActivityAt - left.lastActivityAt ||
+      right.sortOrder - left.sortOrder
+  )
+  return sorted.map((worktree) => worktree.id)
+}
+
+function runBaseline() {
+  const fixture = makeFixture()
+  const metaById = new Map(fixture.worktrees.map((worktree) => [worktree.id, worktree]))
+  const requestedIds = fixture.worktrees.map((worktree) => worktree.id)
+  let catalog = fixture.worktrees
+  let publications = 0
+  let persistenceWrites = 0
+  for (let refresh = 0; refresh < REFRESH_COUNT; refresh += 1) {
+    const now = 1_000_000 + refresh
+    requestedIds.forEach((worktreeId, index) => {
+      metaById.set(worktreeId, {
+        ...metaById.get(worktreeId),
+        sortOrder: now - index * 1000
+      })
+      persistenceWrites += 1
+    })
+    const incoming = structuredClone(requestedIds.map((worktreeId) => metaById.get(worktreeId)))
+    const reconciled = reuseEqualCatalogRows(catalog, incoming)
+    if (reconciled !== catalog) {
+      catalog = reconciled
+      publications += 1
+      runSidebarProjection(catalog, fixture.tabs)
+    }
+  }
+  return { publications, persistenceWrites }
+}
+
+function runCandidate() {
+  const fixture = makeFixture()
+  const metaById = new Map(fixture.worktrees.map((worktree) => [worktree.id, worktree]))
+  const requestedIds = fixture.worktrees.map((worktree) => worktree.id)
+  let catalog = fixture.worktrees
+  let publications = 0
+  let persistenceWrites = 0
+  for (let refresh = 0; refresh < REFRESH_COUNT; refresh += 1) {
+    const updates = planWorktreeSortOrderUpdates(
+      requestedIds,
+      (worktreeId) => metaById.get(worktreeId),
+      1_000_000 + refresh
+    )
+    for (const update of updates) {
+      metaById.set(update.worktreeId, {
+        ...metaById.get(update.worktreeId),
+        sortOrder: update.sortOrder
+      })
+    }
+    persistenceWrites += updates.length
+    const incoming = structuredClone(requestedIds.map((worktreeId) => metaById.get(worktreeId)))
+    const reconciled = reuseEqualCatalogRows(catalog, incoming)
+    if (reconciled !== catalog) {
+      catalog = reconciled
+      publications += 1
+      runSidebarProjection(catalog, fixture.tabs)
+    }
+  }
+  return { publications, persistenceWrites }
+}
+
+function measureBatch(run) {
+  let counters
+  const startedAt = performance.now()
+  for (let batch = 0; batch < BATCHES_PER_ROUND; batch += 1) {
+    counters = run()
+  }
+  return { elapsedMs: (performance.now() - startedAt) / BATCHES_PER_ROUND, counters }
+}
+
+function measureComparison() {
+  runBaseline()
+  runCandidate()
+  const samples = Array.from({ length: ROUNDS }, (_, round) => {
+    let baseline
+    let candidate
+    if (round % 2 === 0) {
+      baseline = measureBatch(runBaseline)
+      candidate = measureBatch(runCandidate)
+    } else {
+      candidate = measureBatch(runCandidate)
+      baseline = measureBatch(runBaseline)
+    }
+    return { baseline, candidate, ratio: candidate.elapsedMs / baseline.elapsedMs }
+  }).sort((left, right) => left.ratio - right.ratio)
+  return samples[Math.floor(samples.length / 2)]
+}
+
+const { baseline, candidate } = measureComparison()
+if (baseline.counters.publications !== REFRESH_COUNT || candidate.counters.publications !== 0) {
+  throw new Error('Benchmark fixture no longer reproduces the refresh feedback loop')
+}
+
+console.log(
+  `Worktree refresh churn: ${WORKTREE_COUNT} worktrees, ${TAB_COUNT} tabs, ${REFRESH_COUNT} refreshes`
+)
+console.log(
+  `Before: ${baseline.elapsedMs.toFixed(3)} ms, ${baseline.counters.publications} catalog publications, ${baseline.counters.persistenceWrites} rank writes`
+)
+console.log(
+  `After:  ${candidate.elapsedMs.toFixed(3)} ms, ${candidate.counters.publications} catalog publications, ${candidate.counters.persistenceWrites} rank writes`
+)
+console.log(
+  `Reduction: ${((1 - candidate.elapsedMs / baseline.elapsedMs) * 100).toFixed(1)}% CPU, 100% feedback publications`
+)
diff --git a/config/scripts/wsl-git-shell-benchmark.mjs b/config/scripts/wsl-git-shell-benchmark.mjs
index 00ea47ded0a..d29aaea2824 100644
--- a/config/scripts/wsl-git-shell-benchmark.mjs
+++ b/config/scripts/wsl-git-shell-benchmark.mjs
@@ -175,7 +175,7 @@ async function main() {
         wslShellArgs(distro, ['/bin/sh', '-lc', escapeWslShCommandForWindows(script)])
       )
       const markerOffset = result.stdout.indexOf(outputMarker)
-      if (markerOffset < 0) {
+      if (markerOffset === -1) {
         throw new Error('Login shell did not emit the Git output marker')
       }
       result.stdout = result.stdout.subarray(markerOffset + Buffer.byteLength(outputMarker))
diff --git a/config/tsconfig.cli.json b/config/tsconfig.cli.json
index 14295cb475a..572e9dcd0f9 100644
--- a/config/tsconfig.cli.json
+++ b/config/tsconfig.cli.json
@@ -12,6 +12,8 @@
     "../src/main/agent-hooks/local-agent-cli-presence.ts",
     "../src/main/agent-hooks/managed-agent-hook-controls.ts",
     "../src/main/agent-hooks/managed-agent-hook-registry.ts",
+    "../src/main/agent-hooks/managed-hook-script-refresh.ts",
+    "../src/main/agent-hooks/runtime-home-hook-command.ts",
     "../src/main/amp/hook-service.ts",
     "../src/main/antigravity/hook-service.ts",
     "../src/main/claude/hook-settings.ts",
@@ -74,6 +76,7 @@
     "../src/main/openclaude/hook-service.ts",
     "../src/main/rolling-file-backup.ts",
     "../src/main/startup/hydrate-shell-path.ts",
+    "../src/main/startup/windows-shell-path-ownership.ts",
     // Why: serve-electron-flag-parity.test.ts checks the Electron-side serve argv rewrite against this
     // project's serve spec; the module has no imports, so listing it pulls in nothing else.
     "../src/main/startup/serve-mode-argv.ts",
diff --git a/config/vitest.config.ts b/config/vitest.config.ts
index 735e1b2a0af..d23bee128c9 100644
--- a/config/vitest.config.ts
+++ b/config/vitest.config.ts
@@ -16,7 +16,8 @@ export default defineConfig({
   test: {
     environment: 'node',
     // Why: Node 26's undefined Web Storage globals prevent Vitest from installing happy-dom's.
-    execArgv: ['--no-experimental-webstorage'],
+    // Why --expose-gc: retention tests need a deterministic collection point to measure what a queue really holds.
+    execArgv: ['--no-experimental-webstorage', '--expose-gc'],
     // Why: happy-dom drops MutationObserver callbacks on GC; keep them alive like a browser does.
     setupFiles: [resolve('config/scripts/happy-dom-mutation-observer-retention.ts')],
     include: [
diff --git a/docs/STYLEGUIDE.md b/docs/STYLEGUIDE.md
index d795f74039a..a76d981dd2f 100644
--- a/docs/STYLEGUIDE.md
+++ b/docs/STYLEGUIDE.md
@@ -67,9 +67,9 @@ A common point of drift. Use these conventions for any list-style row (worktrees
 
 - **Idle:** transparent background.
 - **Hover:** `bg-accent` (in the worktree sidebar, `bg-sidebar-accent`).
-- **Keyboard-selected (cmdk highlight):** `data-[selected=true]:bg-accent` plus a `border-border` outline so the active row stays visible while the user types. The `data-selected` attribute is set by `cmdk` automatically.
+- **Keyboard-selected (cmdk highlight):** do **not** rely on flat `bg-accent` alone on light popover/dialog surfaces — `--accent` (#f5f5f5) is nearly identical to `--background` (#fff), so the cursor vanishes. Use the jump-palette recipe in `main.css` (`.jump-palette-item[data-selected='true']`): `color-mix` foreground into background (~12%) plus an inset ring. Expose the mix as `--jump-palette-selection-surface` when nested cutouts (status pips) must match. The `data-selected` attribute is set by `cmdk` automatically.
 - **Persistent "current" / "active" row** (e.g. the worktree the user is viewing): also `bg-accent`, _plus_ a `data-current="true"` attribute so CSS or future styling can distinguish it from the cmdk highlight.
-- **Don't:** hardcode `bg-[#ededed]` / `bg-[#333333]` or invent a "selected" color. The accent token already adapts to light/dark and matches the rest of the app.
+- **Don't:** hardcode `bg-[#ededed]` / `bg-[#333333]` or invent a "selected" color. Mix from existing tokens (`foreground`/`background`/`accent`) so light/dark stay aligned.
 
 ### Color mixing
 
@@ -110,7 +110,7 @@ Don't add a fourth level. If something needs more emphasis than "floating," you'
 
 Use the shadcn primitives in `src/renderer/src/components/ui/` before writing anything custom. The shadcn-style wrappers in this folder follow a consistent pattern:
 
-- Most carry a `data-slot="<name>"` attribute on their root for CSS targeting — do not strip it. (The non-shadcn helpers in this folder — `sonner`, `repo-multi-combobox`, `team-multi-combobox` — don't follow this pattern and shouldn't be modeled when adding new primitives that should.)
+- Most carry a `data-slot="<name>"` attribute on their root for CSS targeting — do not strip it. (The non-shadcn helpers in this folder — `sonner` and `repo-multi-combobox` — don't follow this pattern and shouldn't be modeled when adding new primitives that should.)
 - Use `cn()` for class merging. Pass user `className` last so callers can override.
 - Use `class-variance-authority` (CVA) for variants when there are multiple.
 
@@ -148,7 +148,7 @@ When a control has multiple plausible primitives, use this fork:
 | Drawer / panel sliding in from an edge                       | `Sheet`                                                              | `Dialog` centered                     |
 | Single choice from a known list                              | `Select`                                                             | Custom listbox                        |
 | Single choice with search / fuzzy filtering                  | `Command` inside `Popover`                                           | `Select` (no search)                  |
-| Multi-select with search                                     | `repo-multi-combobox` / `team-multi-combobox` (mirror their pattern) | Roll a new one                        |
+| Multi-select with search                                     | `repo-multi-combobox` (mirror its pattern)                           | Roll a new one                        |
 | Transient confirmation ("Saved", "Copied")                   | `sonner` toast                                                       | `Dialog`, inline banner               |
 | Persistent inline status ("3 errors")                        | inline text + `Badge`                                                | toast (toasts disappear)              |
 
diff --git a/docs/ai-vault-process-isolation-plan.md b/docs/ai-vault-process-isolation-plan.md
new file mode 100644
index 00000000000..f9be048a12a
--- /dev/null
+++ b/docs/ai-vault-process-isolation-plan.md
@@ -0,0 +1,596 @@
+# AI Vault process isolation architecture and implementation plan
+
+Status: implemented behind the documented desktop/runtime kill switch, with local build, parity, Electron, and A/B validation complete.
+
+Last updated: 2026-08-09.
+
+## Decision summary
+
+AI Vault will remain part of the integrated Orca renderer, but its host-side work will move behind a persistent service-process boundary.
+
+The target has three rules:
+
+1. The desktop and Orca runtime route local Vault scans and title resolution to one lazy, supervised Vault service process per host process.
+2. The SSH relay routes Vault work to a relay-side Vault service process. The relay event loop that handles PTYs must not scan or parse Vault data.
+3. The renderer publishes completed Vault results at low priority after terminal input is quiet. xterm and the Vault panel remain in the same renderer.
+
+This is deliberately not a separate `WebContentsView`, window, or embedded app. The measurements below show bounded CPU contention under an exaggerated scan, but no renderer long tasks and no evidence that a second Chromium renderer is justified.
+
+The public Electron IPC, runtime RPC, and SSH relay method names and result meanings remain unchanged in the initial migration. The process boundary is host-internal.
+
+## Goals
+
+- A Vault scan, parser fault, cache fault, or memory spike cannot crash the terminal daemon, relay PTY loop, Electron main process, or runtime host.
+- Terminal input remains responsive while a local, runtime, or SSH Vault refresh is active.
+- Vault work has bounded concurrency, queue depth, memory, result size, cancellation latency, and wall time.
+- The service can be restarted without restarting the app, runtime, relay, or terminals.
+- Existing local, folder-workspace, WSL, runtime, and SSH behavior remains compatible.
+- Mixed-version remote peers continue to work.
+- The architecture is conventional and debuggable: integrated UI, thin routers, dedicated background services.
+
+## Non-goals
+
+- Treating the service process as a security sandbox. It runs trusted Orca code with the same user identity.
+- Rewriting the scanner or changing session discovery semantics during the process migration.
+- Moving xterm into another renderer.
+- Adding a process per window, worktree, repository, or SSH request.
+- Removing the old-relay compatibility fallback in the same change.
+- Making pagination a public wire dependency before mixed-version fallback behavior exists.
+
+## Current architecture and coupling
+
+| Path                                    | Current execution                                                            | Remaining coupling                                                                                                           |
+| --------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
+| Desktop local scan and title resolution | Persistent `worker_threads.Worker` from `session-scanner-worker-spawn.ts`    | Separate V8 isolate, but the same OS process, priority class, failure domain, and overall memory accounting as Electron main |
+| Orca runtime scan and title resolution  | The same worker client used by runtime RPC methods                           | Same-process CPU, memory, and lifecycle coupling with the runtime host                                                       |
+| SSH relay scan and title resolution     | `AiVaultHandler` calls the remote scanner and title reader inside `relay.ts` | Vault discovery, reads, parsing, cache work, and PTY routing share one event loop and process                                |
+| Old SSH relay fallback                  | Desktop main crawls the host through the SSH filesystem provider             | Compatibility path can consume desktop and SSH multiplexer work; complete remote isolation is impossible without a new relay |
+| Renderer result publication             | `setScanResult(result)` and `setSessions(result.sessions)` immediately       | Deserialization, projection, filtering, grouping, and React rendering share the renderer thread with xterm                   |
+
+The current local worker already provides meaningful isolation. It allows one active request, bounds the queue at 16, supports cancellation, and uses 130-second scan and 15-second title timeouts. The migration should preserve those properties instead of replacing them with an unbounded child-process API.
+
+The terminal backend is already a detached daemon process. A Vault service beside it fits the existing process model; it does not require a terminal redesign.
+
+## Feature-parity contract
+
+The migration changes execution ownership only. Unless a separate product change is approved, the service-on and worker-fallback paths must be observably equivalent after normalizing `scannedAt` and process metrics.
+
+| Capability            | Required behavior after migration                                                                                                                                                                                       | Owner                                                                       |
+| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
+| Agent discovery       | Preserve every `AI_VAULT_AGENTS` source: Claude, Codex, Hermes, Pi, OMP, Prime Agent, Cursor, Gemini, Antigravity, Rovo Dev, Copilot, OpenCode, Grok, OpenClaw, Devin, Droid, and Kimi                                  | Service scanner, using existing source adapters                             |
+| Session result        | Preserve every `AiVaultSession` field, including host/platform identity, paths, Codex home, timestamps, previews, token/message counts, queued/recoverable state, subagent count, resume command, and subagent metadata | Service result builder; router validates/restamps only where it does today  |
+| Scope and depth       | Preserve workspace/project/all scoping, guaranteed older in-scope sessions, 250/500/1000/unlimited depth, sorting, deduplication, and issue rows                                                                        | Service per-host scan; router multi-host merge; renderer view projection    |
+| Host routing          | Preserve local, all-host, individual SSH, and individual runtime selection with the same per-host time budgets and partial-failure issue behavior                                                                       | Router                                                                      |
+| Dynamic roots         | Preserve environment overrides, managed/per-account Codex homes, runtime Codex homes, WSL default and Orca-owned homes, and every platform-specific agent root                                                          | Router resolves dynamic homes per request; service discovers within them    |
+| Refresh semantics     | Preserve TTL reuse, force refresh, request-token cancellation, force preemption, coalescing, window-focus refresh, and new-agent-session refresh throttling                                                             | Router coordinator plus service cancellation                                |
+| Title synchronization | Preserve local, SSH, and runtime Claude/Codex title resolution and the existing input-quiet tab-title gate                                                                                                              | Service title operation plus existing host routing                          |
+| Subagent expansion    | Preserve local-only Claude and OMP child listing, path containment, status, issue rows, and retry behavior. Runtime/SSH/web remain empty until a separately negotiated feature exists                                   | Service interactive operation; router retains current host gate             |
+| First-prompt copy     | Preserve local-only on-demand full prompt parsing, OpenCode row lookup, truncation safety, injected-turn suppression, and preview fallback. Runtime/SSH/web remain preview-only                                         | Service interactive operation; router retains current host gate             |
+| Resume                | Preserve provider-specific resume commands, Codex-home preparation, account targeting, execution-host targeting, platform quoting, OMP path resume, drag/drop, and new-tab launch                                       | Existing router/renderer paths; they consume an unchanged session result    |
+| Logs and live state   | Preserve View Log/Open Log, reveal/copy path, working-directory action, read-only editor behavior, live tail, original-pane jump, and worktree jump                                                                     | Existing filesystem/editor/native-chat paths; outside the service migration |
+| Delete                | Preserve local-only gating, liveness checks, OS trash/WSL deletion, companion artifacts, idempotency, and rejection reasons                                                                                             | Trusted router executor; invalidate router and service caches on success    |
+| View behavior         | Preserve search, agent toggles, sort/group, hide-empty/recoverable-empty logic, persisted view options, collapsed groups, and host/scope controls                                                                       | Renderer; unchanged apart from publication scheduling                       |
+| Compatibility         | Preserve current web/runtime limitations, old-relay fallback, mixed-version result meaning, and unavailable-host issue rows                                                                                             | Router and existing public transports                                       |
+
+Add a backend-equivalence suite that runs the same golden corpus through the current worker and the service process, normalizes only `scannedAt`, and deep-compares the complete results. The corpus must cover every agent, OpenCode SQLite and legacy formats, append-only incremental parsing, recoverable empty sessions, Claude/OMP subagents, managed Codex homes, duplicate Codex roots, WSL-shaped roots, scope inclusion, corrupt/partial files, and issue overflow.
+
+No field may be dropped to reduce IPC size during the migration. Any later payload reduction requires an independently versioned compatibility plan because resume, drag/drop, log actions, and project ownership consume fields that may not be visibly rendered in the list.
+
+## Target topology
+
+```text
+Desktop / runtime host
+
+  Integrated renderer
+    ├─ xterm UI ─────────── terminal IPC/router ───────── terminal daemon
+    └─ AI Vault panel ───── Vault IPC/RPC router ──────── Vault service process
+                               │
+                               └─ host merge + compatibility routing
+
+SSH execution host
+
+  Desktop ── existing SSH Vault RPC ── relay router ───── Vault service sidecar
+                                      └────────────────── PTY handler/event loop
+```
+
+The two relay branches share only the relay's bounded request/response routing. Filesystem discovery, transcript reads, JSON parsing, SQLite access, parse caches, and title caches execute in the sidecar.
+
+## Process ownership
+
+- Desktop: one Vault service per Electron main process, shared by every window and workspace.
+- Orca runtime: one Vault service per runtime host process, shared by all connected clients.
+- SSH relay: one Vault service per live relay daemon, shared across relay reconnects and requests.
+- WSL: preserve current source ownership initially. The Windows local service invokes the existing WSL-aware adapters; do not add a process per distro in this migration.
+- Old relay: retain the bounded desktop fallback only when the relay method is unavailable. A new relay whose sidecar fails must return an issue instead of scanning inline on the relay loop.
+
+## Service responsibilities
+
+The service owns:
+
+- Source discovery and filesystem metadata reads.
+- Transcript streaming and parsing for all supported agents.
+- OpenCode SQLite reads and its nested worker lifecycle.
+- In-memory and persisted session parse caches.
+- The bounded title index and transcript title resolution.
+- On-demand Claude/OMP subagent listing and full first-user-prompt extraction.
+- Scan parse concurrency and cooperative cancellation.
+- Result construction, deduplication, sorting, and internal paging.
+- Per-request metrics that contain counts and timings, not session content.
+
+The router owns:
+
+- Electron IPC, runtime RPC, or relay method registration.
+- Authentication and connection ownership already enforced by that transport.
+- Public argument validation and execution-host selection.
+- Resolution of dynamic host inputs such as managed Codex homes and WSL distro homes; resolved roots are passed with each scan so a long-lived service cannot retain stale account configuration.
+- Multi-host result merging.
+- Request coalescing and mapping caller cancellation to the service request.
+- Validation of service responses before publishing them across a public boundary.
+- Compatibility fallback selection.
+- Local deletion, liveness checks, OS trash integration, and cache-invalidation commands sent to the service after a successful mutation.
+
+The renderer owns only view state, filtering/grouping of the returned page, user actions, and low-priority result publication.
+
+## Internal process protocol
+
+Add a versioned, private protocol in `src/main/ai-vault/session-scanner-service-protocol.ts`. It is not a remote wire protocol.
+
+Parent to service:
+
+```ts
+type ServiceRequest =
+  | { type: 'init'; protocol: 1; host: HostDescriptor; cache: CacheOptions }
+  | { type: 'request'; id: number; operation: 'scan'; options: ScanOptions }
+  | { type: 'request'; id: number; operation: 'titles'; requests: TitleRequest[] }
+  | { type: 'request'; id: number; operation: 'subagents'; request: SubagentRequest }
+  | { type: 'request'; id: number; operation: 'firstPrompt'; request: FirstPromptRequest }
+  | { type: 'invalidate'; paths: string[]; generation: number }
+  | { type: 'cancel'; id: number }
+  | { type: 'shutdown' }
+```
+
+Service to parent:
+
+```ts
+type ServiceResponse =
+  | { type: 'ready'; protocol: 1; pid: number; capabilities: ServiceCapabilities }
+  | { type: 'result'; id: number; operation: 'scan'; value: ScanPage; metrics: ScanMetrics }
+  | { type: 'result'; id: number; operation: 'titles'; value: TitlesResult }
+  | { type: 'result'; id: number; operation: 'subagents'; value: SubagentListResult }
+  | { type: 'result'; id: number; operation: 'firstPrompt'; value: FirstPromptResult }
+  | { type: 'invalidated'; generation: number }
+  | { type: 'error'; id: number; code: ServiceErrorCode; message: string; retryable: boolean }
+  | { type: 'fatal'; code: ServiceErrorCode; message: string }
+```
+
+Protocol rules:
+
+- Validate every incoming and outgoing message. Ignore an unknown response ID and terminate on a protocol-version mismatch.
+- Use monotonically increasing safe-integer request IDs scoped to the child lifetime.
+- Preserve the existing shared limits for request counts, scope-path count and length, title requests, and session depth.
+- Keep one cache-mutating lane for scans and title resolution, plus one independent interactive-read lane for subagent and first-prompt reads. Title resolution stays serialized with scans because both mutate the shared parse/title caches; the independent operations do not. Queue at most 16 calls across both lanes.
+- Coalesce equivalent scans. Replace an older queued background scan with the newest one.
+- Queue priority is first-prompt/subagent reads, queued title reads, forced foreground refresh, initial foreground load, then background refresh. Priority never preempts an active request; explicit cancellation does.
+- Keep the existing 130-second scan and 15-second title deadlines. A timeout terminates and replaces the service because a timed-out parser cannot be assumed healthy.
+- Cancellation rejects the caller immediately, sends `cancel`, and gives the service 2 seconds to acknowledge or finish. The service is terminated if it remains stuck.
+- Continue returning the last good renderer result when a refresh fails.
+- Invalidation is a control message, not queued scan work. The parent invalidates its result/host caches immediately and waits for the service acknowledgement before allowing a non-forced post-delete list result to reuse service cache state.
+- Instrument serialized response size. Warn at 8 MiB. Do not reject legacy unlimited results until internal paging and public fallback are implemented.
+
+The first implementation may reuse the current plain-object Node IPC serialization. The payload does not require handles, sockets, or transferable buffers.
+
+## Lifecycle and supervision
+
+### Startup
+
+- Start lazily on the first scan or title request.
+- Resolve an explicit entry path; packaged Electron must use `app.asar.unpacked` because `ELECTRON_RUN_AS_NODE=1` bypasses Electron's asar loader.
+- Fork with `stdio: ['ignore', 'ignore', 'pipe', 'ipc']`, `ELECTRON_RUN_AS_NODE=1`, and `windowsHide: true` on Windows.
+- Require a `ready` message within 5 seconds. A request does not enter its operation timeout until the service is ready.
+- Pipe a bounded stderr tail into the existing diagnostic log. Never allow child output backpressure to stall the child.
+
+### Steady state
+
+- Reuse the process and caches across calls.
+- Keep current parse concurrency at eight for the first A/B. Process isolation is not permission to increase concurrency.
+- Set best-effort below-normal priority with `os.setPriority(child.pid, PRIORITY_BELOW_NORMAL)`. Failure to lower priority is observable but not fatal.
+- Start with `--max-old-space-size=384`. Treat an out-of-memory exit as a service failure; keep terminals and the last Vault snapshot alive.
+- Exit after 10 minutes with no active or queued request. Persisted parse-cache state makes a later cold process cheaper.
+
+### Faults and restart
+
+- Reject the active request on exit, disconnect, malformed protocol, or timeout.
+- Retry queued work in a new process only when it is safe and has not been cancelled.
+- Back off at 250 ms, 1 second, then 5 seconds.
+- Open a 60-second circuit breaker after three unexpected exits in 60 seconds. Manual refresh may make one explicit restart attempt.
+- On idle or orderly app/runtime/relay shutdown, flush any debounced parse-cache persistence, send the final acknowledgement, and exit. The parent waits at most 2 seconds, then terminates. Never hold host shutdown indefinitely.
+
+## Resource and quality-of-service policy
+
+The process boundary supplies crash and heap isolation. Priority and bounds supply responsiveness.
+
+- CPU: below-normal process priority, scan concurrency eight, one scan at a time.
+- Memory: 384 MiB V8 old-space starting cap, 4,096 title-cache entries, current parse-cache eviction, and response-size telemetry.
+- Queue: 16 calls, coalescing, background replacement, explicit priority.
+- I/O: stream transcripts; do not read an entire store into memory. Preserve current per-file streaming behavior.
+- UI: defer result publication until terminal input has been quiet for 100 ms, with a 1-second maximum deferral so the panel cannot starve.
+- React: publish inside `startTransition`; keep the previous snapshot visible while the transition is pending.
+- Unlimited history: retain behavior during migration. Add internal pages before enforcing a hard serialized-result cap.
+
+Process priority is best effort and cross-platform. Correctness must not depend on a particular scheduler implementation.
+
+## Renderer publication
+
+`ai-vault-session-refresh.ts` should stop applying a completed result immediately.
+
+Add `ai-vault-session-publication-gate.ts` with this behavior:
+
+1. Cache the validated result immediately so another caller can reuse it.
+2. If no terminal has received input in the last 100 ms, publish now inside `startTransition`.
+3. Otherwise retain only the newest pending result and wait for quiet.
+4. Publish after 1 second even if input continues, using a transition and one bounded page.
+5. Cancel a pending publication when the scope, host, or component request token changes.
+
+Reuse the existing terminal-input quiet signal used by AI Vault tab-title synchronization rather than adding global key listeners per panel.
+
+A separate Vault renderer remains a contingency only if post-service measurements show repeated renderer tasks over 50 ms that cannot be removed with publication scheduling, paging, and list virtualization.
+
+## Desktop and runtime implementation
+
+Create these concrete modules:
+
+- `src/main/ai-vault/session-scanner-service-entry.ts`: process entry, init/ready handshake, request dispatch, cancellation, cache initialization, and shutdown.
+- `src/main/ai-vault/session-scanner-service-client.ts`: queue, deadlines, cancellation, validation, and restart policy.
+- `src/main/ai-vault/session-scanner-service-spawn.ts`: lazy shared client and public scan/title functions.
+- `src/main/ai-vault/session-scanner-service-entry-path.ts`: dev, E2E, and packaged path resolution.
+- `src/main/ai-vault/session-scanner-service-protocol.ts`: message types, schemas, and error codes.
+- `src/main/ai-vault/session-scanner-service-priority.ts`: best-effort process priority policy.
+
+Reuse the scanner and cache modules without moving their business logic. Replace imports in:
+
+- `src/main/ai-vault/cached-session-list.ts`
+- `src/main/ai-vault/session-title-resolver.ts`
+- `src/main/ipc/ai-vault-subagent-list.ts`
+- `src/main/ai-vault/session-first-user-prompt-read.ts`
+- `src/main/ipc/ai-vault-delete.ts` for acknowledged service-cache invalidation after a successful delete
+- `src/main/ipc/ai-vault.ts`
+- `src/main/runtime/rpc/methods/ai-vault.ts`
+
+Promote the parse-cache flush currently exposed only for tests into an internal production shutdown function. Idle and orderly service exits must await it within the shutdown grace period.
+
+Keep the current worker implementation behind the rollout switch until the new process passes packaging and fault-injection coverage. Remove it in a later cleanup change, not in the initial migration.
+
+## SSH relay sidecar implementation
+
+Create:
+
+- `src/relay/ai-vault-service-entry.ts`: bundled Node sidecar entry using the remote scanner and title reader.
+- `src/relay/ai-vault-service-client.ts`: relay-owned supervisor and internal protocol adapter.
+- `src/relay/ai-vault-service-priority.ts`: the same best-effort QoS policy without Electron imports.
+
+Change `src/relay/ai-vault-handler.ts` so it validates public params and forwards them to the sidecar. It must no longer import or call `scanRemoteAiVaultSessions` or `readAiVaultSessionTitlesFromFiles` in the relay process.
+
+`relay.ts` creates the client once, injects it into `AiVaultHandler`, and shuts it down with relay lifecycle. The PTY handler does not depend on sidecar readiness.
+
+If the sidecar cannot start or crashes:
+
+- Return a normal `AiVaultListResult` containing a host issue and no new sessions.
+- Do not scan inline in the relay.
+- Keep all PTYs, reconnect state, and other relay methods available.
+- Allow the next manual refresh to cross the restart circuit breaker once.
+
+Build `relay-ai-vault-service.js` for every current relay platform in `config/scripts/build-relay.mjs`. Include its bytes in the immutable relay content hash so a sidecar-only change deploys a new relay directory. The bundle must target Node 18 and rely only on Node built-ins plus already supported optional externals.
+
+## Remote compatibility
+
+The first implementation adds no public method, stream opcode, required field, or changed result meaning.
+
+- Current desktop with new relay: calls the existing Vault relay methods; the new relay handles them through its sidecar.
+- New desktop with current relay: calls the same methods and receives the same result shape.
+- New desktop with an older relay lacking the method: uses the existing budgeted SSH filesystem fallback.
+- Old desktop with new relay: unknown internal sidecar details never cross the wire.
+
+Do not make a new client depend on internal paging fields from an older host. If public paging is added later, use optional request/result fields and fall back to the existing complete-result call when the host does not return paging capability.
+
+The old-relay fallback is the explicit isolation exception. Keep its total budget and cancellation. Do not broaden when it is selected. Once relay adoption data shows the fallback is rare, it can be reduced or removed in a separate compatibility decision.
+
+## Folder workspaces, WSL, and paths
+
+- Scope paths remain opaque filesystem paths. Do not require a `.git` directory or worktree metadata.
+- Continue using `path.join` and the existing host-platform path adapters.
+- Keep Windows batch and shell selection unrelated to terminal-shell preference.
+- Preserve WSL host identity and cache scoping; capability and cache state must not leak between distros or native Windows.
+- An SSH service reads only the remote host's paths. A desktop service must not interpret remote paths as local paths.
+- Title requests must continue through the existing readable-path resolution and allowed-root validation before opening a transcript.
+- Subagent and first-prompt requests remain local-only and must validate renderer-provided paths against the same agent-source roots used for discovery, including managed and WSL roots. Tightening path validation must ship with parity fixtures so legitimate current roots are not rejected.
+
+## Security boundary
+
+The service is a performance and reliability boundary, not a privilege boundary.
+
+- It has the same OS user and must access the same agent stores.
+- Do not expose its IPC channel to renderer code or the network.
+- The parent passes validated options; the service validates again before filesystem access.
+- Do not log prompts, titles, transcript paths, environment values, or raw service messages.
+- Preserve symlink and allowed-root checks for title reads.
+- Inherit only the environment needed for current agent-home discovery and process operation. Document any removed variables with cross-platform tests before tightening further.
+
+## Packaging
+
+Desktop packaging changes:
+
+- Add `session-scanner-service-entry` to the main inputs in `electron.vite.config.ts`.
+- Add `out/main/session-scanner-service-entry.js` to `asarUnpack` in `config/electron-builder.config.cjs`.
+- Reuse the existing unpacked entry-path pattern used by other forked processes.
+- Add a packaged smoke test that resolves the real unpacked path, starts the service, scans one fixture, and shuts down.
+
+Relay packaging changes:
+
+- Bundle the sidecar beside `relay.js` and `relay-watcher.js` for every supported OS/architecture.
+- Include it in `.version` content hashing and deploy completeness assertions.
+- Verify reconnect and versioned-install cleanup keep the matching relay and sidecar together.
+- No new native module is required, so the Linux glibc floor should remain unchanged. Continue running the packaging verifier.
+
+## Observability
+
+Add spans and counters for:
+
+- Service start, ready latency, PID, restart reason, circuit-breaker state, and idle exit.
+- Queue depth, queue wait, priority class, coalesced calls, and dropped background calls.
+- Discovery duration, parse duration, candidates, bytes read, cache reuse, incremental parses, full parses, and result count.
+- Parent/child serialization duration and serialized bytes.
+- Child RSS and heap-used snapshots at request completion.
+- Renderer result receipt, quiet-wait duration, transition publication duration, and displayed session count.
+- Relay sidecar failures separately from PTY and relay-loop health.
+
+Metrics must use counts, byte sizes, and durations only. Paths and transcript-derived content stay out of logs.
+
+## Verification matrix
+
+The design is not ready for default-on until each layer below passes with both the worker fallback and process backend where applicable.
+
+| Layer               | Required coverage                                                                                                                                                                                             |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Pure parser         | Existing fixtures for every agent and format; incremental append, corrupt/partial input, title precedence, usage, previews, queued prompts, recoverable empties, and subagent counts                          |
+| Backend equivalence | Worker versus process deep equality for complete list, title, subagent, and first-prompt results; only `scannedAt` and internal metrics may differ                                                            |
+| Cache               | Cold/warm/incremental scans, persistence restart, atomic save failure, corrupt cache, app-version mismatch, delete generation guard, service invalidation acknowledgement, and idle-exit flush                |
+| Queue/lifecycle     | Both logical lanes, priority, coalescing, 16-call bound, cancellation before/while queued/active, deadlines, malformed IPC, crash, OOM, backoff, circuit breaker, and shutdown                                |
+| Desktop Electron    | Visible list, scope/host/depth controls, refresh/cancel, first-prompt copy, Claude/OMP expansion, delete, View/Open Log, live tail, resume, drag/drop, and service-crash terminal typing through Electron/CDP |
+| Runtime/web         | List/title/resume parity, host restamping, managed Codex homes, unchanged no-op cancellation limitation, and unchanged unavailable subagent/first-prompt/delete behavior                                      |
+| SSH relay           | All-agent remote list, title resolution, scope truncation, sidecar crash/timeout/OOM, PTY typing/output/reconnect continuity, old-relay fallback, and both mixed-version directions                           |
+| Windows/WSL         | Native and per-distro roots, UNC paths, WSL deletion, priority failure fallback, hidden child windows, packaged entry path, and host-isolated cache/source state                                              |
+| Linux/package       | Ubuntu 20.04/glibc floor, Node 18 relay bundle, packaged entry smoke, sidecar deploy/hash completeness, and no undeclared native dependency                                                                   |
+| Folder workspace    | Workspace/project scope, ownership mapping, resume target, path actions, and deletion without assuming Git metadata                                                                                           |
+
+The Electron feature-parity run must assert visible behavior rather than only inspecting the store. Service fault tests additionally assert PTY markers so a Vault failure cannot pass while silently disrupting terminals.
+
+## Failure behavior
+
+| Failure                            | User-visible Vault behavior                                                    | Terminal behavior                         |
+| ---------------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------- |
+| Service fails to start             | Keep last result and show a retryable host issue                               | Unchanged                                 |
+| Service crashes during scan        | Reject refresh, restart under backoff, keep last result                        | Unchanged                                 |
+| Service exceeds memory cap         | Treat as crash and reduce confidence telemetry; do not remove the cap silently | Unchanged                                 |
+| Scan or cancellation hangs         | Kill and replace service after the deadline/grace                              | Unchanged                                 |
+| Queue is full                      | Coalesce or drop background work; foreground call gets a clear retryable error | Unchanged                                 |
+| Relay sidecar unavailable          | Remote Vault host shows an issue                                               | Relay PTYs and reconnect remain available |
+| Renderer publication is superseded | Drop the stale result and publish the newest scope only                        | Unchanged                                 |
+| Old relay has no Vault method      | Use the existing bounded desktop fallback                                      | Existing compatibility limitation remains |
+
+## Benchmark methodology
+
+The new `bench:ai-vault-typing` command launches a fresh Electron app through Playwright's Electron/CDP path and uses an isolated home.
+
+Each iteration:
+
+1. Keeps the Vault panel mounted in both arms.
+2. Seeds 300 new, newer-mtime Codex JSONL transcripts in the isolated home.
+3. Alternates arm order to reduce warm-up bias.
+4. Runs paced raw-mode terminal echo typing as the control.
+5. Runs the same typing while programmatically starting a forced visible Vault refresh as treatment.
+6. Verifies the newest seeded title is visible, proving the full scan and UI path completed.
+
+The renderer records keydown-to-xterm-parse, keydown-to-xterm-render, long tasks, timer drift, animation-frame gaps, refresh duration, and missing echoes without polling or serializing the terminal buffer for each key.
+
+Raw reports are written to the ignored `tests/tools/benchmarks/results/` directory.
+
+## Current measurements
+
+Machine: Apple M5 Pro, 64 GiB RAM, macOS 26.5.1. These are local-host measurements on the current worker-thread architecture after the recently merged performance work.
+
+Pre-implementation parity baseline:
+
+- 90 Vault-focused unit/integration test files passed: 778 tests covering parsers, caches, routing, deletion, resume, renderer projection, subagents, first prompts, and runtime contracts.
+- Electron/CDP parity spot-check passed for long View Log tail stability, single-file session deletion, and Claude companion-directory deletion: 3 tests.
+- The representative, stress, and final benchmark smoke runs all completed with visible Vault results and zero missing terminal echoes.
+
+### Representative pass
+
+Configuration: 3 iterations, 300 new sessions per iteration, 128 KiB assistant payload per session, 100 keys per arm at 30 ms cadence, 118.4 MB total seeded data.
+
+| Metric                         |              Control |      Refresh active |
+| ------------------------------ | -------------------: | ------------------: |
+| Parse p50 / p95 / max          |  1.3 / 2.5 / 29.8 ms |  1.3 / 2.0 / 5.4 ms |
+| Render p50 / p95 / max         | 5.9 / 10.0 / 35.4 ms | 5.8 / 9.5 / 10.6 ms |
+| Worst timer drift              |              14.2 ms |             24.5 ms |
+| Worst frame gap                |               9.4 ms |             24.9 ms |
+| Renderer long tasks over 50 ms |                    0 |                   0 |
+| Missing echoes                 |              0 / 300 |             0 / 300 |
+| Refresh duration p50 / max     |                    — |    103.5 / 204.2 ms |
+
+There is no treatment-side typing regression in this pass. The current worker is doing useful work and should remain the rollback path during migration.
+
+### Stress pass
+
+Configuration: 2 iterations, 300 new sessions per iteration, 512 KiB assistant payload per session, 120 keys per arm at 30 ms cadence, 314.9 MB total seeded data.
+
+| Metric                         |             Control |       Refresh active |
+| ------------------------------ | ------------------: | -------------------: |
+| Parse p50 / p95 / max          | 1.3 / 1.9 / 19.7 ms |  1.4 / 4.7 / 13.8 ms |
+| Render p50 / p95 / max         | 5.6 / 9.4 / 23.8 ms | 6.0 / 11.2 / 16.3 ms |
+| Worst timer drift              |              9.3 ms |              43.6 ms |
+| Worst frame gap                |              9.4 ms |              50.0 ms |
+| Renderer long tasks over 50 ms |                   0 |                    0 |
+| Missing echoes                 |             0 / 240 |              0 / 240 |
+| Refresh duration p50 / max     |                   — |     276.3 / 453.5 ms |
+
+The exaggerated workload causes measurable but bounded whole-system contention. It does not show renderer result application becoming a long task. This is evidence for a lower-priority service process and against a second Chromium renderer.
+
+### Measurement limits
+
+- One high-end macOS machine does not establish Windows, Linux, low-core, battery, or memory-pressure behavior.
+- The benchmark covers the local service path, not the currently unisolated SSH relay path.
+- Raw shell echo is a stable latency probe, not a full-screen TUI workload.
+- A child process still competes for machine-wide CPU; the expected benefit comes from priority, heap/failure isolation, and supervision, not from eliminating CPU cost.
+
+## Post-implementation A/B
+
+Run the same build with the rollout switch off and on, alternating launch order:
+
+```bash
+ORCA_AI_VAULT_SERVICE_PROCESS=0 pnpm bench:ai-vault-typing -- --label worker-control
+ORCA_AI_VAULT_SERVICE_PROCESS=1 pnpm bench:ai-vault-typing -- --label process-treatment
+```
+
+Run at least five representative and five stress passes on:
+
+- macOS Apple Silicon.
+- Windows x64 with a folder workspace and a WSL-backed source present.
+- Ubuntu 20.04-compatible x64 packaging/runtime.
+- A 4-core or smaller machine or constrained CI runner.
+
+Add a Docker SSH variant that runs the same terminal probe while the remote sidecar scans. A fault arm kills the sidecar during typing and verifies the PTY marker stream and reconnect remain healthy.
+
+## Implemented result
+
+The implementation now matches the target topology:
+
+- Desktop and runtime list scans, title resolution, subagent reads, and first-prompt reads use a lazy supervised child process by default outside unit tests. `ORCA_AI_VAULT_SERVICE_PROCESS=0` retains the worker fallback.
+- Successful local deletion remains in the trusted main process and acknowledges child parse-cache invalidation. In-flight parses cannot restore an invalidated entry.
+- The SSH relay handler no longer imports the remote scanner, transcript title reader, or filesystem provider. It forwards existing public methods to `relay-ai-vault-service.js`; sidecar failure returns a normal host issue.
+- All six relay platform bundles include the sidecar, hash its bytes into `.version`, and require it in remote-install completeness probes.
+- Renderer results cache immediately, retain only the newest pending publication, wait for 100 ms of input quiet, publish in a React transition, and cannot defer beyond one second.
+- Desktop and relay supervisors bound the queue at 16, cap old-space at 384 MiB, use below-normal priority where supported, enforce ready/operation/cancellation/shutdown deadlines, and restart with bounded backoff plus a three-fault circuit breaker.
+
+Local validation on 2026-08-09:
+
+- Electron E2E build emitted `out/main/session-scanner-service-entry.js`; every relay target built `relay-ai-vault-service.js` successfully.
+- Real built-child smoke checks passed for the desktop service title lane and relay sidecar list lane.
+- Vault, runtime, renderer, relay, and remote-install focused tests passed 900/901 in one loaded run. The single unrelated 150 ms map micro-benchmark measured 184 ms during that parallel run and passed at 30 ms alone.
+- Electron/CDP feature checks passed for long View Log stability, single-file deletion, and Claude companion-directory deletion with the process backend enabled.
+
+Representative A/B configuration: 3 iterations, 300 sessions per iteration, 128 KiB payloads, and 100 keys at 30 ms cadence.
+
+| Metric                | Worker control | Worker refresh | Process control | Process refresh |
+| --------------------- | -------------: | -------------: | --------------: | --------------: |
+| Parse p95             |         2.0 ms |         1.9 ms |          6.2 ms |          6.4 ms |
+| Render p95            |         9.6 ms |         9.6 ms |         11.0 ms |         12.3 ms |
+| Worst timer drift     |         9.4 ms |        17.4 ms |         10.4 ms |         12.0 ms |
+| Worst frame gap       |         9.4 ms |         9.4 ms |         16.8 ms |         16.2 ms |
+| Long tasks over 50 ms |              0 |              0 |               0 |               0 |
+| Missing echoes        |        0 / 300 |        0 / 300 |         0 / 300 |         0 / 300 |
+| Refresh p50 / max     |              — | 74.9 / 76.9 ms |               — | 83.2 / 165.1 ms |
+
+The process arm stayed well inside every acceptance budget. It did not outperform the already-optimized worker on raw parse latency; its value is the intended heap, crash, priority, relay-loop, and lifecycle isolation while preserving terminal responsiveness.
+
+Windows/WSL, Ubuntu 20.04, constrained-core, packaged-app launch, and Docker SSH fault measurements remain release/CI matrix work because they cannot be truthfully produced on this macOS host. The implementation includes their path, platform, packaging, Node 18, and mixed-version compatibility requirements; default rollback remains one environment variable.
+
+## Acceptance criteria
+
+Correctness:
+
+- Zero missing terminal echoes.
+- The latest seeded Vault session is visibly published in every treatment arm.
+- Local, runtime, SSH, WSL, and folder-workspace session fixtures remain equivalent to the current scanner.
+- Cancellation, force-preemption, host merging, title resolution, and unlimited history preserve current semantics.
+
+Performance:
+
+- Treatment parse p95 is no more than 10 ms above its paired control.
+- Treatment render p95 is no more than 15 ms above its paired control.
+- Median active-key render latency remains at or below 75 ms; worst remains below 300 ms.
+- No renderer task attributable to Vault result publication exceeds 50 ms in the representative run.
+- No relay PTY input/output stall exceeds the terminal reliability budget while its sidecar scans or crashes.
+
+Isolation:
+
+- Killing or exhausting the desktop service does not crash Electron main, runtime RPC, renderer, or terminal daemon.
+- Killing or exhausting the relay sidecar does not interrupt PTYs, relay reconnect, or non-Vault methods.
+- The service respects queue, timeout, idle, and heap bounds.
+- Packaged app and relay artifacts contain and launch the correct entry for every supported platform.
+
+## Phased implementation plan
+
+### Phase 0 — measurement harness (completed in this change)
+
+- Add `terminal-ai-vault-typing-latency.spec.ts` and its focused corpus/renderer probes.
+- Add `run-ai-vault-typing-bench.mjs` and `pnpm bench:ai-vault-typing`.
+- Capture representative and stress baselines.
+
+Exit: reproducible JSON report, visible Vault completion assertion, zero missing echoes.
+
+### Phase 1 — desktop and runtime service behind a switch
+
+- Add the private service protocol, entry-path resolver, process entry, client, priority policy, and supervisor.
+- Reuse current scanner/cache implementations.
+- Route desktop IPC and runtime RPC through the service when `ORCA_AI_VAULT_SERVICE_PROCESS` is enabled.
+- Keep the worker path as the disabled-switch fallback.
+- Add unit tests for ready timeout, queue priority, coalescing, cancellation, operation timeout, crash, restart backoff, circuit breaker, idle exit, malformed messages, and packaged path resolution.
+- Add E2E fault injection that kills the service during active terminal typing.
+
+Exit: desktop/runtime correctness parity, packaging smoke test, representative/stress A/B within budgets.
+
+### Phase 2 — make the desktop/runtime process the default
+
+- Enable the process by default in development, E2E, and canary builds.
+- Collect process RSS, restart, timeout, and latency telemetry without content.
+- Validate Windows, Linux, WSL, and constrained-runner results.
+- Keep `ORCA_AI_VAULT_SERVICE_PROCESS=0` as a release kill switch for one stable cycle.
+
+Exit: no unexplained crash or timeout increase and all acceptance gates green.
+
+### Phase 3 — SSH relay sidecar
+
+- Add the relay sidecar entry and supervisor.
+- Remove scanner/parser/cache imports from the relay handler.
+- Add the sidecar to every relay bundle, content hash, deploy manifest, and completeness test.
+- Add Docker SSH scan, typing, sidecar-crash, reconnect, old-relay fallback, and mixed-version tests.
+- Make inline relay scanning impossible; sidecar failure returns a host issue.
+
+Exit: remote typing and fault gates green; current public relay methods unchanged.
+
+### Phase 4 — renderer quiet publication
+
+- Add the shared quiet-publication gate and React transition.
+- Retain only the newest pending result per scope/host.
+- Add supersession, starvation timeout, unmount, and rapid-host-switch tests.
+- Re-run the Electron benchmark with large result counts and active filtering/grouping.
+
+Exit: no Vault-attributable renderer long task over 50 ms in the representative gate.
+
+### Phase 5 — hardening and cleanup
+
+- Remove the worker implementation after one stable release if the kill switch was unused.
+- Decide whether public optional paging is necessary from serialized-size and renderer-publication telemetry.
+- Promote `bench:ai-vault-typing` from an experimental benchmark to the terminal reliability gate.
+- Document operational recovery and service diagnostics.
+
+Exit: kill switch and dead worker code removed only after evidence supports it.
+
+## Rollback
+
+- Desktop/runtime: set `ORCA_AI_VAULT_SERVICE_PROCESS=0` to restore the current worker path without changing public APIs or stored data.
+- Renderer: disable quiet publication and apply the validated complete result directly.
+- Relay: deploy the prior immutable relay version. A new relay must never fall back to inline scanning when its sidecar fails.
+- Parse-cache format remains unchanged during migration, so rollback does not require cache conversion.
+
+## Confidence and remaining questions
+
+Confidence in the overall topology is about 90%. Confidence that a separate Vault renderer is unnecessary is higher because both baseline passes recorded zero renderer long tasks. Confidence that the local child process alone will materially improve normal typing latency is lower: the current worker already performs well, and the process migration is primarily buying priority, heap, crash, and lifecycle isolation.
+
+The remaining implementation questions are deliberately narrow:
+
+1. Is 384 MiB the right old-space cap on Windows/Linux and for unlimited histories? Resolve with packaged stress runs before default-on.
+2. Does the 10-minute idle exit improve retained memory without creating noticeable cold-refresh churn? Resolve with startup/RSS telemetry.
+3. Is public paging necessary? Add it only if response-size or renderer-publication evidence crosses the stated budgets.
+4. How large is the current SSH relay impact on low-core hosts? Resolve with the Phase 3 Docker and constrained-runner typing gate; it does not change the decision to remove scans from the relay loop.
diff --git a/docs/assets/caffeinate-agent-menu-after.png b/docs/assets/caffeinate-agent-menu-after.png
new file mode 100644
index 00000000000..393fbd5c0b1
Binary files /dev/null and b/docs/assets/caffeinate-agent-menu-after.png differ
diff --git a/docs/assets/caffeinate-agent-menu-before.png b/docs/assets/caffeinate-agent-menu-before.png
new file mode 100644
index 00000000000..7c12d9ca581
Binary files /dev/null and b/docs/assets/caffeinate-agent-menu-before.png differ
diff --git a/docs/assets/readme-downloads.svg b/docs/assets/readme-downloads.svg
index 7414e4cea7a..610bdb8b92e 100644
--- a/docs/assets/readme-downloads.svg
+++ b/docs/assets/readme-downloads.svg
@@ -1,5 +1,5 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="downloads: 17m">
-  <title>downloads: 17m</title>
+<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="downloads: 19m">
+  <title>downloads: 19m</title>
   <linearGradient id="s" x2="0" y2="100%">
     <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
     <stop offset="1" stop-opacity=".1"/>
@@ -15,7 +15,7 @@
   <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="11">
     <text x="37" y="15" fill="#010101" fill-opacity=".3">downloads</text>
     <text x="37" y="14">downloads</text>
-    <text x="90" y="15" fill="#010101" fill-opacity=".3">17m</text>
-    <text x="90" y="14">17m</text>
+    <text x="90" y="15" fill="#010101" fill-opacity=".3">19m</text>
+    <text x="90" y="14">19m</text>
   </g>
 </svg>
diff --git a/docs/readme/README.ko.md b/docs/readme/README.ko.md
index e247ace7d7c..d02a025cb5f 100644
--- a/docs/readme/README.ko.md
+++ b/docs/readme/README.ko.md
@@ -36,7 +36,7 @@
 
 휴대폰에서 에이전트를 모니터링하고 조종하세요 — 에이전트가 완료되면 알림을 받고 어디서든 후속 지시를 보낼 수 있습니다.
 
-[iOS App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) · [Android APK](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.37/app-release.apk) · [문서 →](https://www.onorca.dev/docs/mobile)
+[iOS App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) · [TestFlight](https://testflight.apple.com/join/YjeGMQBA) · [Android APK 0.0.42](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.42/app-release.apk) · [문서 →](https://www.onorca.dev/docs/mobile)
 
 </td>
 <td width="50%">
@@ -179,12 +179,14 @@ diff의 어느 줄에든 코멘트를 남기고 에이전트에게 바로 보내
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Cursor logo" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="GitHub Copilot logo" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="OpenCode logo" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
+  <a href="https://mimo.xiaomi.com/coder"><kbd><img src="https://www.google.com/s2/favicons?domain=mimo.xiaomi.com&sz=64" alt="MiMo Code logo" width="16" valign="middle" /> MiMo Code</kbd></a> &nbsp;
   <a href="https://ampcode.com/manual#install"><kbd><img src="https://www.google.com/s2/favicons?domain=ampcode.com&sz=64" alt="Amp logo" width="16" valign="middle" /> Amp</kbd></a> &nbsp;
   <a href="https://openclaude.gitlawb.com/"><kbd><img src="../../resources/openclaude-logo.png" alt="OpenClaude logo" width="16" valign="middle" /> OpenClaude</kbd></a> &nbsp;
   <a href="https://antigravity.google/docs/cli-overview"><kbd><img src="https://www.google.com/s2/favicons?domain=antigravity.google&sz=64" alt="Antigravity logo" width="16" valign="middle" /> Antigravity</kbd></a> &nbsp;
   <a href="https://pi.dev"><kbd><img src="https://pi.dev/favicon.svg" alt="Pi logo" width="16" valign="middle" /> Pi</kbd></a> &nbsp;
   <a href="https://omp.sh"><kbd><img src="https://omp.sh/favicon.svg" alt="oh-my-pi logo" width="16" valign="middle" /> oh-my-pi</kbd></a> &nbsp;
   <a href="https://hermes-agent.nousresearch.com/docs/"><kbd><img src="https://www.google.com/s2/favicons?domain=nousresearch.com&sz=64" alt="Hermes Agent logo" width="16" valign="middle" /> Hermes Agent</kbd></a> &nbsp;
+  <a href="https://devin.ai/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=devin.ai&sz=64" alt="Devin logo" width="16" valign="middle" /> Devin</kbd></a> &nbsp;
   <a href="https://block.github.io/goose/docs/quickstart/"><kbd><img src="https://www.google.com/s2/favicons?domain=goose-docs.ai&sz=64" alt="Goose logo" width="16" valign="middle" /> Goose</kbd></a> &nbsp;
   <a href="https://docs.augmentcode.com/cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=augmentcode.com&sz=64" alt="Auggie logo" width="16" valign="middle" /> Auggie</kbd></a> &nbsp;
   <a href="https://github.com/autohandai/code-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=autohand.ai&sz=64" alt="Autohand Code logo" width="16" valign="middle" /> Autohand Code</kbd></a> &nbsp;
@@ -211,6 +213,7 @@ diff의 어느 줄에든 코멘트를 남기고 에이전트에게 바로 보내
 
 - **[onOrca.dev에서 다운로드](https://onorca.dev/download)**
 - 또는 빌드를 직접 받기: [macOS Apple Silicon](https://github.com/stablyai/orca/releases/latest/download/orca-macos-arm64.dmg) · [macOS Intel](https://github.com/stablyai/orca/releases/latest/download/orca-macos-x64.dmg) · [Windows (.exe)](https://github.com/stablyai/orca/releases/latest/download/orca-windows-setup.exe) · [Linux AppImage](https://github.com/stablyai/orca/releases/latest/download/orca-linux.AppImage) · [전체 빌드](https://github.com/stablyai/orca/releases/latest)
+- headless Linux 서버에서 `orca serve`를 실행하시나요? [Headless Linux 서버 가이드](../reference/headless-linux-server.md)를 확인하세요.
 
 _또는 패키지 매니저로 설치:_
 
@@ -226,8 +229,8 @@ yay -S stably-orca-bin
 
 데스크톱 앱과 페어링해 휴대폰에서 에이전트를 모니터링하고 조종하세요.
 
-- **iOS:** [App Store에서 다운로드](https://apps.apple.com/us/app/orca-ide/id6766130217)
-- **Android:** [APK 다운로드](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.37/app-release.apk)
+- **iOS:** [App Store에서 다운로드](https://apps.apple.com/us/app/orca-ide/id6766130217) 또는 [TestFlight 참여](https://testflight.apple.com/join/YjeGMQBA)
+- **Android:** [APK 0.0.42 다운로드](https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.42/app-release.apk)
 
 ---
 
@@ -235,6 +238,10 @@ yay -S stably-orca-bin
 
 - **Discord:** **[Discord](https://discord.gg/fzjDKHxv8Q)** 커뮤니티에 참여하세요.
 - **Twitter / X:** 업데이트와 공지는 **[@orca_build](https://x.com/orca_build)** 를 팔로우하세요.
+- **WeChat:** QR 코드를 스캔해 Orca 커뮤니티 WeChat 그룹 7에 참여하세요.
+
+  <img src="../assets/wechat-qr-group7.jpg" alt="Orca 커뮤니티 WeChat 그룹 7 QR 코드" width="160" />
+
 - **피드백과 아이디어:** 우리는 빠르게 출시합니다. 필요한 기능이 있나요? [새 기능을 요청](https://github.com/stablyai/orca/issues)하세요.
 - **개인정보 보호:** Orca가 수집하는 익명 사용 데이터와 수집 거부 방법은 [개인정보 및 텔레메트리 문서](https://www.onorca.dev/docs/telemetry)를 참고하세요.
 - **응원하기:** 이 리포지토리에 [Star](https://github.com/stablyai/orca)를 눌러 매일 공개되는 릴리스 소식을 확인해 주세요.
@@ -249,6 +256,14 @@ yay -S stably-orca-bin
   <img src="https://contrib.rocks/image?repo=stablyai/orca" alt="Orca 기여자" />
 </a>
 
+<p align="center">
+  <img src="../assets/star-history.png" alt="stablyai/orca GitHub Star 히스토리 차트" width="880" />
+</p>
+
+## 서명된 빌드
+
+Windows 코드 서명은 [SignPath.io](https://signpath.io)가 후원·제공하며, 인증서는 [SignPath Foundation](https://signpath.org)에서 제공합니다.
+
 ## 라이선스
 
 Orca는 [MIT 라이선스](../../LICENSE)에 따라 자유롭게 사용할 수 있는 오픈 소스입니다.
diff --git a/docs/reference/renderer-agent-status-performance.md b/docs/reference/renderer-agent-status-performance.md
new file mode 100644
index 00000000000..8ed43d868ce
--- /dev/null
+++ b/docs/reference/renderer-agent-status-performance.md
@@ -0,0 +1,328 @@
+# Renderer agent-status performance
+
+## Status
+
+This design is adopted for the renderer's high-frequency agent-status path. It
+keeps the existing event semantics while bounding the amount of synchronous
+store fanout performed for one IPC burst.
+
+It lands in slices. This document and the `bench:idle-cpu` harness land first so
+the store changes can be reviewed against a baseline someone else measured. Until
+the store slice lands, the `setAgentStatuses` / `transactAgentStatuses` actions
+and the agent-status write workload described below are not yet on `main`; the
+harness measures scale, listener census, and raw publication fanout only.
+
+## Context
+
+Orca can display a large expanded worktree lineage inside one virtualized list
+row. Virtualizing the root row does not virtualize its descendants, so a
+100-worktree lineage can mount 100 `WorktreeCard` instances at once.
+
+Agent-status IPC events are bursty. The renderer already groups live events into
+a 33 ms window, but the original flush applied every queued event with a
+separate Zustand write. Zustand synchronously visits every listener for every
+publication. The resulting work therefore grew with both the number of status
+events and the number of mounted subscriptions:
+
+```text
+burst work ~= status events x store listeners x selector work
+```
+
+A production trace captured the renderer repeatedly entering
+`flushLiveAgentStatusBurst -> applyAgentStatus -> setAgentStatus -> setState`
+through `Set.forEach`. A deterministic 100-worktree fixture reproduces the
+structural multiplier; see "Baseline on `main`" below for the currently measured
+listener count and publication cost.
+
+The production app later recovered substantially when all configured remote
+hosts were removed. Host removal can stop relay/reconnect traffic, remove
+mounted remote worktrees, or both, depending on host type and removal options.
+That observation identifies remote presence as the production trigger but does
+not by itself distinguish traffic volume from mounted-listener fanout.
+
+A read-only reconnect audit ruled out systematic double status emission from a
+full PTY replay: replay bytes bypass OSC status parsing. Reconnect still causes
+a full terminal-buffer repaint for every attached remote pane, which is a
+separate source of renderer work and remains a follow-up investigation.
+
+## Goals
+
+- Keep a large expanded lineage responsive during dense agent-status traffic.
+- Preserve every ordered status transition, including repeated updates for one
+  pane inside the same burst.
+- Publish agent-status state once for a deferred live burst.
+- Preserve selector identity and child render isolation.
+- Make the regression reproducible without relying on a user's production data.
+
+## Non-goals
+
+- Changing the client/server status payload or remote protocol.
+- Deduplicating status events by pane.
+- Changing agent freshness, retention, history, title, completion, or provider
+  session behavior.
+- Changing remote reconnect, PTY replay, or terminal repaint behavior.
+- Redesigning lineage presentation or collapsing worktrees automatically.
+
+## Design
+
+### Bound mounted subscription fanout
+
+Sidebar components select cohesive state bundles with shallow equality instead
+of registering one listener per field. Derived arrays and maps retain their
+existing shallow identity behavior so unrelated store writes do not rerender a
+card. Full agent-list mode keeps its child-level subscription boundary; compact
+mode passes the already selected rows to avoid selecting the same inputs twice.
+
+The deterministic 100-worktree fixture pins the resulting listener budget:
+
+| Surface                        | Listener budget |
+| ------------------------------ | --------------: |
+| Worktree card state and caches |               2 |
+| Agent-row inputs               |               1 |
+| Worktree activity status       |               1 |
+| Closed context menu            |               1 |
+
+Unmount tests require the listener count to return to its prior baseline. In the
+bundled prototype, the fixture without seeded agents fell from 8,518 listeners
+to 1,218; with 100 visible agent rows the candidate mounted 1,618. Compare
+against the census in "Baseline on `main`", which the harness reports directly.
+
+### Share working-spinner phase without per-element animation queries
+
+Working rows keep the existing compositor-driven CSS animation and shared
+visual phase. Each mount derives one negative animation delay from the document
+timeline instead of querying `getAnimations()` and mutating the animation start
+time. This removes per-row Web Animations setup from dense status transitions
+without adding a JavaScript animation clock.
+
+### Fold a burst in event order
+
+The store exposes the single-update action and two batch forms:
+
+- `setAgentStatus(paneKey, payload, ...)` retains the positional single-update
+  API for the immediate live path.
+- `setAgentStatuses(updates)` applies a prebuilt ordered list, while
+  `transactAgentStatuses(operation)` lets IPC derive each update against the
+  exact staged state before the single commit.
+
+Both entry points reuse the same single-update state transition. The batch
+reducer passes each resulting state into the next update, so a sequence such as
+`working -> waiting -> done` retains the same history and timestamps as three
+sequential calls. Updates are never keyed or deduplicated before the fold.
+
+The live IPC queue is spliced before it is processed. This preserves the
+existing reentrancy guarantee: a synchronous subscriber can enqueue another
+event without causing the current queue to be drained recursively. The first
+event outside an active burst remains immediate; events accumulated within the
+33 ms window are applied as one ordered transaction. Startup snapshots and
+bounded pending-hydration retries use the same transaction path instead of
+publishing once per restored pane.
+
+Each transaction builds pane-routing ownership once with the same first-match
+semantics as the standalone resolver. Split-layout leaf membership is indexed
+once per layout root, so a large snapshot performs linear tab and leaf work
+instead of rescanning every mounted worktree for every pane.
+
+### Run effects after the transaction
+
+Generated-title work that requires committed state is deferred until after the
+transaction. Accepted updates also request freshness scheduling; the outer batch
+coalesces those requests and schedules the shared freshness timer once after its
+single commit. Generated-title requests are folded in event order and published
+together, including first-write and forced-replacement semantics. Resolved tab
+titles are projected while the transaction folds, then final title changes are
+published together. Completion-triggered review refreshes remain deferred
+microtasks.
+
+Bulk title application preserves event order and duplicate-tab behavior while
+indexing owners once, cloning each changed owner array once, and replacing each
+top-level map once. This keeps the post-commit title phase linear in mounted
+tabs plus changed titles.
+
+This separation is important: invoking store actions from inside a Zustand
+updater would re-enter the store, while running an effect before the commit
+would let it observe stale state.
+
+## Semantic invariants
+
+Sequential and batched application must agree on:
+
+- live and retained agent maps;
+- state history, `updatedAt`, and `stateStartedAt`;
+- agent identity, model, prompt, tools, assistant messages, and subagents;
+- orchestration and provider-session continuity;
+- sleeping-session and launch-config recovery records;
+- retired/closed-pane rejection and inherited-status suppression;
+- retention cleanup and live-map eviction;
+- `agentStatusEpoch` and `sortEpoch`;
+- automation completion observation across intermediate transitions;
+- generated-title inputs, freshness scheduling, and completion refreshes.
+
+Equivalence tests use fixed timestamps and include repeated same-pane
+transitions. A publication-count test subscribes to the real store and requires
+one notification for a non-empty batch and none for an empty batch.
+
+## Benchmark contract
+
+The benchmark launches an E2E-mode Electron build with the store exposed only
+for instrumentation. It creates 100 worktrees in one expanded lineage, verifies
+100 mounted cards, captures the store listener census, and then applies seeded
+ordered agent-status traffic through the real store action.
+
+The benchmark measures the synchronous store action, not the live IPC leading
+edge or post-commit notification path. A real-store snapshot test covers the
+end-to-end budget for 100 panes with auto-generated titles enabled: one status,
+one bulk generated-title, and one bulk resolved-title publication. Disabling
+generated titles removes that middle publication, independent of pane count.
+
+The artifact records only fixed diagnostic fields needed for comparison:
+
+- requested and completed batches and updates;
+- store action calls and observed publications;
+- elapsed time, throughput, and scheduling drift;
+- final-state verification;
+- renderer mean, p95, and maximum CPU;
+- renderer timer drift and long tasks;
+- mounted-card and listener counts.
+
+Raw process inventories, temporary paths, pane identifiers, and DOM text are
+diagnostic-only and must not be embedded in the shareable report.
+
+Run baseline and candidate on the same machine and OS with the same Electron
+build mode. CPU samples from macOS and Linux are comparable within that
+constraint; Windows process CPU collection currently cannot support this
+comparison.
+
+## Harness
+
+`pnpm run bench:idle-cpu` drives `config/scripts/run-idle-cpu-benchmark.mjs`,
+which composes four modules:
+
+| Module                                | Responsibility                                                                                    |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------- |
+| `idle-cpu-renderer-scale-fixture.mjs` | Seeds the lineage, agent rows, and sidebar view state; takes the mounted-card and listener census |
+| `idle-cpu-renderer-timing-probe.mjs`  | In-page timer drift and long-task probe; runs the no-op publication workload                      |
+| `idle-cpu-process-sampling.mjs`       | Classifies the Electron process tree and samples per-role CPU/RSS                                 |
+| `idle-cpu-synthetic-spinners.mjs`     | Measurement-only visible spinners                                                                 |
+
+The sampling window extends past `--sample-ms` until the workload settles, and
+fails the run rather than reporting a truncated window if the workload overruns
+the guard. That is why a 2,000-publication run reports a measured window longer
+than the requested one.
+
+`--zustand-publications` publishes an empty partial through the real store, so
+each publication costs exactly one full subscriber visit and nothing else. It
+isolates the `listeners x selector work` half of the burst-cost model from
+agent-status payload work, and it is store-API independent — it measures the
+same thing before and after the batching slice.
+
+The agent-status write workload (`--agent-status-batches`,
+`--agent-status-write-mode`) is not in this harness yet. It depends on
+`setAgentStatuses`, so it lands with the store slice.
+
+## Baseline on `main`
+
+Measured on `main` at `077f5a11cd4` (macOS, arm64, 16 CPUs), Electron built with
+`electron-vite --mode e2e`, headless, 100 worktrees at lineage depth 99 with 100
+seeded agent rows, 10 s warmup and a 30 s sampling window.
+
+Fixture scale is confirmed by the census rather than assumed: 100 store
+worktrees, 100 mounted cards, 100 mounted agent rows, and **9,279 store
+listeners**. That listener count is the multiplier the design targets.
+
+2,000 no-op store publications at a 1 ms cadence, three repetitions. The
+listener census was 9,279 in every run.
+
+| Measure                  |      Median | Runs                           |
+| ------------------------ | ----------: | ------------------------------ |
+| Wall time to complete    | 12,325.7 ms | 13,148.6 / 12,325.7 / 11,870.5 |
+| p50 scheduling drift     |  5,150.3 ms | 5,432.3 / 5,150.3 / 4,945.2    |
+| p95 scheduling drift     |  9,802.9 ms | 10,570.4 / 9,802.9 / 9,390.0   |
+| Renderer mean CPU        |      18.25% | 20.25 / 18.25 / 15.88          |
+| Renderer p95 CPU         |      32.59% | 40.07 / 32.59 / 31.28          |
+| Renderer timer drift p95 |      7.0 ms | 7.3 / 5.3 / 7.0                |
+
+2,000 publications requested over 2 s take about 12 s, so the renderer sustains
+roughly 160 publications per second at this scale. Each publication is
+individually short - the long-task observer recorded zero entries in all three
+runs - so the cost surfaces as scheduling drift and sustained CPU rather than as
+discrete long tasks. Compare drift and CPU here, not long-task counts.
+
+The idle control at the same scale with `--zustand-publications 0` reports 6.63%
+renderer mean CPU, 17.11% p95, and 1.6 ms p95 timer drift. Roughly 11.6 points
+of mean renderer CPU are therefore attributable to publication fanout rather than
+to the mounted fixture itself. 200 spinner animations run in both cases, so the
+control also bounds the animation cost out of the comparison.
+
+Reproduce with:
+
+```bash
+pnpm run bench:idle-cpu -- --worktrees 100 --lineage-depth 99 \
+  --agents-per-worktree 1 --warmup-ms 10000 --sample-ms 30000 \
+  --zustand-publications 2000 --zustand-publication-interval-ms 1 \
+  --output /tmp/idle-cpu-baseline.json
+```
+
+## Results
+
+Three repetitions used 100 mounted worktrees, lineage depth 99, 100 seeded
+agent rows, and verified final state. Medians from the regenerated evidence set
+are:
+
+| Single 2,000-update burst | Sequential |    Batched |
+| ------------------------- | ---------: | ---------: |
+| Status-state publications |      2,000 |          1 |
+| Store action time         | 3,692.0 ms |   188.7 ms |
+| Update throughput         |    541.7/s | 10,598.8/s |
+| Renderer mean CPU         |      36.2% |       2.9% |
+| Renderer p95 CPU          |     107.3% |       8.2% |
+| p95 long task             |   4,653 ms |     216 ms |
+
+The direct store transaction performs 99.95% fewer status-state publications,
+spends 94.9% less time in the store action, and processes updates 19.6 times
+faster. Renderer mean CPU falls 92.0%, renderer p95 CPU falls 92.4%, and the p95
+long task falls 95.4%.
+
+The 60-burst × 32-update case at 33 ms is a sustained saturation stress, not a
+real-time production SLO. Publications fall from 1,920 to 60 and median store
+action time falls from 2,791.9 ms to 323.3 ms. Median completion time falls from
+5,298.2 ms to 2,710.6 ms, p95 scheduling drift falls from 3,073.0 ms to 664.9
+ms, and long-task count falls from 57 to 1. Renderer p95 CPU remains saturated
+and noisy in this cadence, so it is not used as the discriminating measure.
+
+The 20-pane artificial OpenCode regression passes with 12.4 ms median key echo,
+25.2 ms worst key echo, 19.4 ms maximum timer drift, and zero dropped renderer
+backlogs.
+
+These figures come from the bundled prototype and are restated here as the
+target. They are re-measured with the harness when the store slice lands.
+
+## Acceptance criteria
+
+- The 100-worktree fixture stays at or below the pinned listener budgets.
+- A deferred transaction performs one status-state publication while preserving
+  ordered final state, including live-map eviction at the 500-row cap.
+- A 100-pane startup snapshot performs one status and one bulk resolved-title
+  publication with generated titles disabled; enabling generated titles adds at
+  most one ordered bulk publication while preserving final statuses and titles.
+- Sequential-versus-batch equivalence tests pass across same-pane transitions
+  and side-effect-bearing updates.
+- Renderer CPU tails and scheduling drift improve in repeated candidate runs.
+- The 20-pane artificial terminal test reports no dropped output backlog and no
+  material typing-latency regression.
+- Web typecheck, focused unit tests, lint, max-lines ratchet, and E2E build pass.
+
+## Compatibility
+
+This is renderer-local. It adds no RPC field, stream opcode, persisted data, Git
+command, or provider-specific contract. Native, WSL, SSH, relay, folder
+workspace, and git-worktree status events enter the same renderer action. Mixed
+client/server versions therefore need no capability negotiation.
+
+## Failure containment
+
+The first live event remains immediate. Startup replay and bounded pending
+retries fold synchronously without waiting for the 33 ms live-burst window, but
+publish their accepted updates together. Empty batches are no-ops. If an update
+is stale or targets retired authority, the reducer skips only that update and
+continues folding later events in order.
diff --git a/electron.vite.config.ts b/electron.vite.config.ts
index ff8360a138d..7db7df7ca69 100644
--- a/electron.vite.config.ts
+++ b/electron.vite.config.ts
@@ -220,6 +220,9 @@ export const electronViteConfig: UserConfig = {
           'session-scanner-worker-entry': resolve(
             'src/main/ai-vault/session-scanner-worker-entry.ts'
           ),
+          'session-scanner-service-entry': resolve(
+            'src/main/ai-vault/session-scanner-service-entry.ts'
+          ),
           // Why: libuv spawns processes inline on the calling loop, so the port
           // scan's probe commands run on a worker thread instead of the UI one.
           'port-scan-command-worker-entry': resolve(
diff --git a/mobile/.oxlintrc.json b/mobile/.oxlintrc.json
index 51dd82305f1..877a6d7e123 100644
--- a/mobile/.oxlintrc.json
+++ b/mobile/.oxlintrc.json
@@ -93,12 +93,6 @@
         "max-lines": ["error", { "max": 531, "skipBlankLines": true, "skipComments": true }]
       }
     },
-    {
-      "files": ["app/terminal-settings.tsx"],
-      "rules": {
-        "max-lines": ["error", { "max": 514, "skipBlankLines": true, "skipComments": true }]
-      }
-    },
     {
       "files": ["scripts/mock-server.ts"],
       "rules": {
diff --git a/mobile/app/h/[hostId]/session/[worktreeId].tsx b/mobile/app/h/[hostId]/session/[worktreeId].tsx
index 105f14e8c70..cf0f1dd7edb 100644
--- a/mobile/app/h/[hostId]/session/[worktreeId].tsx
+++ b/mobile/app/h/[hostId]/session/[worktreeId].tsx
@@ -154,7 +154,7 @@ import { ActionSheetModal } from '../../../../src/components/ActionSheetModal'
 import { MobileAgentIcon } from '../../../../src/components/MobileAgentIcon'
 import { TextInputModal } from '../../../../src/components/TextInputModal'
 import { ConfirmModal } from '../../../../src/components/ConfirmModal'
-import { MobileRichMarkdownEditor } from '../../../../src/components/MobileRichMarkdownEditor'
+import { MobileMarkdownReader } from '../../../../src/session/MobileMarkdownReader'
 import { MobileSyntaxSegments } from '../../../../src/components/MobileSyntaxSegments'
 import {
   CustomKeyModal,
@@ -267,7 +267,6 @@ import {
   TERMINAL_GESTURE_INPUT_REFILL_PER_SECOND,
   updateTerminalCwdFromStreamEvent
 } from '../../../../src/session/mobile-session-route-helpers'
-import { resolveMarkdownFloatingActionsBottom } from '../../../../src/session/markdown-floating-actions-layout'
 import { resolveTabStripScrollOffset } from '../../../../src/session/tab-strip-scroll'
 import { activateOpenedSourceControlDiffTab } from '../../../../src/session/opened-mobile-session-tab'
 import {
@@ -275,7 +274,7 @@ import {
   dismissMobileSessionCreateWarningState,
   reconcileMobileSessionCreateWarningState
 } from '../../../../src/session/mobile-session-create-warning-state'
-import { colors, spacing } from '../../../../src/theme/mobile-theme'
+import { colors } from '../../../../src/theme/mobile-theme'
 import { QuickCommandsTabButton } from '../../../../src/session/QuickCommandsTabButton'
 import { styles } from '../../../../src/session/mobile-session-styles'
 import type { DiffComment, TerminalQuickCommand } from '../../../../../src/shared/types'
@@ -302,132 +301,6 @@ import type {
 
 const TERMINAL_KEYBOARD_DISMISS_ACTION_SHEET_FALLBACK_MS = 450
 
-function MarkdownReader({
-  documentId,
-  doc,
-  onRefresh,
-  onChange,
-  onSave,
-  onCopy,
-  onDiscard,
-  keyboardLift
-}: {
-  documentId: string
-  doc: MarkdownDocState | undefined
-  onRefresh: () => void
-  onChange: (content: string) => void
-  onSave: () => void
-  onCopy: () => void
-  onDiscard: () => void
-  keyboardLift: number
-}) {
-  // Native Keyboard events under-report the WebView editor's covered area, so prefer the larger WebView-measured inset.
-  const [webviewKeyboardInset, setWebviewKeyboardInset] = useState(0)
-  const effectiveKeyboardLift = Math.max(keyboardLift, webviewKeyboardInset)
-  if (!doc || doc.status === 'loading') {
-    return (
-      <View style={styles.markdownState}>
-        <ActivityIndicator size="small" color={colors.textSecondary} />
-      </View>
-    )
-  }
-  if (doc.status === 'error') {
-    return (
-      <View style={styles.markdownState}>
-        <Text style={styles.markdownError}>{doc.message}</Text>
-        <Pressable style={styles.markdownRefreshButton} onPress={onRefresh}>
-          <RefreshCw size={14} color={colors.textPrimary} />
-          <Text style={styles.markdownRefreshText}>Retry</Text>
-        </Pressable>
-      </View>
-    )
-  }
-
-  const statusText = doc.saveError
-    ? doc.saveError
-    : doc.readOnlyReason
-      ? 'Read only'
-      : doc.stale
-        ? 'Changed on desktop'
-        : null
-  const showRefresh = (doc.stale && !doc.isDirty) || !doc.editable
-  const showCopy = doc.saveError || !doc.editable
-  const showSave = doc.isDirty || doc.saving
-  const showFloatingActions = statusText || showRefresh || showCopy || showSave
-
-  return (
-    <View style={styles.markdownEditor}>
-      <MobileRichMarkdownEditor
-        key={documentId}
-        content={doc.localContent}
-        editable={doc.editable && !doc.saving}
-        onChange={onChange}
-        onKeyboardInsetChange={setWebviewKeyboardInset}
-      />
-      {showFloatingActions ? (
-        <View
-          pointerEvents="box-none"
-          style={[
-            styles.markdownFloatingBar,
-            // Why: editor focus lives in a WebView, so lift native Save/Discard controls instead of resizing it.
-            {
-              bottom: resolveMarkdownFloatingActionsBottom({
-                keyboardLift: effectiveKeyboardLift,
-                restingBottom: spacing.lg,
-                liftedClearance: spacing.md
-              })
-            }
-          ]}
-        >
-          {statusText ? (
-            <Text
-              style={[styles.markdownFloatingStatus, doc.saveError ? styles.markdownError : null]}
-              numberOfLines={2}
-            >
-              {statusText}
-            </Text>
-          ) : null}
-          <View style={styles.markdownFloatingActions}>
-            {showCopy ? (
-              <Pressable style={styles.markdownFloatingButton} onPress={onCopy}>
-                <Text style={styles.markdownFloatingButtonText}>Copy</Text>
-              </Pressable>
-            ) : null}
-            {showRefresh ? (
-              <Pressable style={styles.markdownFloatingButton} onPress={onRefresh}>
-                <RefreshCw size={13} color={colors.textPrimary} />
-                <Text style={styles.markdownFloatingButtonText}>Refresh</Text>
-              </Pressable>
-            ) : null}
-            {doc.isDirty ? (
-              <Pressable style={styles.markdownFloatingButton} onPress={onDiscard}>
-                <Text style={styles.markdownFloatingButtonText}>Discard</Text>
-              </Pressable>
-            ) : null}
-            {showSave ? (
-              <Pressable
-                style={[
-                  styles.markdownFloatingButton,
-                  styles.markdownSaveButton,
-                  (!doc.editable || !doc.isDirty || doc.saving) && styles.markdownButtonDisabled
-                ]}
-                disabled={!doc.editable || !doc.isDirty || doc.saving}
-                onPress={onSave}
-              >
-                {doc.saving ? (
-                  <ActivityIndicator size="small" color={colors.textPrimary} />
-                ) : (
-                  <Text style={styles.markdownFloatingButtonText}>Save</Text>
-                )}
-              </Pressable>
-            ) : null}
-          </View>
-        </View>
-      ) : null}
-    </View>
-  )
-}
-
 function DiffLineRow({
   line,
   title,
@@ -4636,7 +4509,7 @@ export default function SessionScreen() {
               </View>
             ) : activeMarkdownTab ? (
               <View style={styles.markdownFrame}>
-                <MarkdownReader
+                <MobileMarkdownReader
                   documentId={activeMarkdownTab.id}
                   doc={markdownDocs.get(activeMarkdownTab.id)}
                   onRefresh={() => void readMarkdownTab(activeMarkdownTab)}
diff --git a/mobile/app/h/[hostId]/tasks.tsx b/mobile/app/h/[hostId]/tasks.tsx
index 677ded5aa78..553490b4748 100644
--- a/mobile/app/h/[hostId]/tasks.tsx
+++ b/mobile/app/h/[hostId]/tasks.tsx
@@ -115,13 +115,15 @@ import {
 import { colors, radii, spacing, typography } from '../../../src/theme/mobile-theme'
 import { triggerMediumImpact } from '../../../src/platform/haptics'
 import {
-  type GitHubProjectSortDirection,
-  type GitHubProjectTable as SharedGitHubProjectTable,
   groupRows,
   isIterationCurrent,
   sortRows,
   type ProjectGroup
-} from '../../../src/tasks/mobile-github-project-group-sort'
+} from '../../../../src/shared/github-project-group-sort'
+import type {
+  GitHubProjectSortDirection,
+  GitHubProjectTable as SharedGitHubProjectTable
+} from '../../../../src/shared/github-project-types'
 import {
   CROSS_REPO_DISPLAY_LIMIT,
   isGitHubWorkItemsSshRemoteRequiredError,
diff --git a/mobile/app/terminal-settings.tsx b/mobile/app/terminal-settings.tsx
index e55819aa22a..860f906e77b 100644
--- a/mobile/app/terminal-settings.tsx
+++ b/mobile/app/terminal-settings.tsx
@@ -1,5 +1,5 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { View, Text, StyleSheet, Pressable, Switch } from 'react-native'
+import { View, Text, Pressable, Switch } from 'react-native'
 import { useSafeAreaInsets } from 'react-native-safe-area-context'
 import { GestureHandlerRootView } from 'react-native-gesture-handler'
 import Animated, {
@@ -9,7 +9,7 @@ import Animated, {
 } from 'react-native-reanimated'
 import { useRouter } from 'expo-router'
 import { ChevronLeft, ChevronRight, Smartphone, Type } from 'lucide-react-native'
-import { colors, radii, spacing, typography } from '../src/theme/mobile-theme'
+import { colors, spacing } from '../src/theme/mobile-theme'
 import { loadHosts } from '../src/transport/host-store'
 import type { HostProfile } from '../src/transport/types'
 import { useFocusedSettingsHostClients } from '../src/transport/settings-host-client-connections'
@@ -17,6 +17,7 @@ import type { RpcClient } from '../src/transport/rpc-client'
 import { PickerModal, type PickerOption } from '../src/components/PickerModal'
 import { TerminalShortcutSettings } from '../src/components/TerminalShortcutSettings'
 import { setTerminalAutoRestoreFitMsForHost } from '../src/terminal/terminal-auto-restore-fit-state'
+import { terminalSettingsScreenStyles as styles } from '../src/terminal/terminal-settings-screen-styles'
 import {
   loadTerminalAutocompleteEnabled,
   loadTerminalTextScale,
@@ -380,92 +381,3 @@ export default function TerminalSettingsScreen() {
     </GestureHandlerRootView>
   )
 }
-
-const styles = StyleSheet.create({
-  container: {
-    flex: 1,
-    backgroundColor: colors.bgBase,
-    paddingHorizontal: spacing.lg,
-    paddingTop: 0
-  },
-  topRow: {
-    flexDirection: 'row',
-    alignItems: 'center',
-    marginTop: spacing.sm,
-    marginBottom: spacing.lg
-  },
-  backButton: {
-    width: 36,
-    height: 36,
-    borderRadius: 18,
-    alignItems: 'center',
-    justifyContent: 'center',
-    marginRight: spacing.sm
-  },
-  heading: {
-    fontSize: 20,
-    fontWeight: '700',
-    color: colors.textPrimary
-  },
-  scrollContent: {
-    paddingBottom: spacing.xl
-  },
-  groupHeading: {
-    fontSize: 11,
-    fontWeight: '600',
-    color: colors.textMuted,
-    letterSpacing: 0.5,
-    marginBottom: spacing.xs,
-    paddingHorizontal: spacing.xs
-  },
-  groupDescription: {
-    fontSize: typography.bodySize - 1,
-    color: colors.textSecondary,
-    lineHeight: 20,
-    paddingHorizontal: spacing.xs
-  },
-  section: {
-    backgroundColor: colors.bgPanel,
-    borderRadius: radii.card,
-    overflow: 'hidden'
-  },
-  sectionTopGap: {
-    marginTop: spacing.sm
-  },
-  inputGroupGap: {
-    marginTop: spacing.xl
-  },
-  emptyText: {
-    fontSize: typography.bodySize,
-    color: colors.textSecondary,
-    padding: spacing.md
-  },
-  row: {
-    flexDirection: 'row',
-    alignItems: 'center',
-    gap: spacing.sm + 2,
-    paddingVertical: spacing.md,
-    paddingHorizontal: spacing.md + 2
-  },
-  rowPressed: {
-    backgroundColor: colors.bgRaised
-  },
-  rowContent: {
-    flex: 1
-  },
-  rowLabel: {
-    fontSize: typography.bodySize,
-    fontWeight: '500',
-    color: colors.textPrimary
-  },
-  rowSublabel: {
-    fontSize: typography.bodySize - 2,
-    color: colors.textSecondary,
-    marginTop: 2
-  },
-  separator: {
-    height: StyleSheet.hairlineWidth,
-    backgroundColor: colors.borderSubtle,
-    marginHorizontal: spacing.md
-  }
-})
diff --git a/mobile/fastlane/Fastfile b/mobile/fastlane/Fastfile
index 6e66a72bada..204c14672b6 100644
--- a/mobile/fastlane/Fastfile
+++ b/mobile/fastlane/Fastfile
@@ -253,6 +253,9 @@ platform :ios do
     upload_to_testflight(
       api_key: api_key,
       app_identifier: BUNDLE_ID,
+      # distribute_only means there is no local .ipa to sniff, so fastlane would
+      # otherwise fall through to an interactive platform prompt and crash in CI.
+      app_platform: "ios",
       app_version: version,
       build_number: build_number,
       distribute_only: true,
diff --git a/mobile/src/components/MobilePrBasePicker.tsx b/mobile/src/components/MobilePrBasePicker.tsx
deleted file mode 100644
index be9f92d65fc..00000000000
--- a/mobile/src/components/MobilePrBasePicker.tsx
+++ /dev/null
@@ -1,170 +0,0 @@
-import { useCallback, useEffect, useRef, useState } from 'react'
-import { Pressable, StyleSheet, Text, TextInput, View } from 'react-native'
-import { Check, ChevronDown } from 'lucide-react-native'
-import { colors, radii, spacing, typography } from '../theme/mobile-theme'
-import type { RpcClient } from '../transport/rpc-client'
-import { searchBaseRefs } from '../source-control/mobile-base-ref-search'
-
-type Props = {
-  client: RpcClient | null
-  worktreeId: string
-  value: string
-  onChange: (ref: string) => void
-  editable?: boolean
-}
-
-// Base-branch field for the create-PR composer: a free-text input that also searches
-// repo refs (debounced) and offers matches to tap — the RN analogue of desktop's
-// base-ref combobox. Free text stays valid so an SSH-only / unmatched ref can still
-// be entered.
-export function MobilePrBasePicker({
-  client,
-  worktreeId,
-  value,
-  onChange,
-  editable = true
-}: Props) {
-  const [results, setResults] = useState<string[]>([])
-  const [focused, setFocused] = useState(false)
-  const timer = useRef<ReturnType<typeof setTimeout> | null>(null)
-  // Guards: drop results after unmount, and ignore an earlier search whose response
-  // arrives after a later one (out-of-order network) so stale matches can't clobber.
-  const mounted = useRef(true)
-  const seq = useRef(0)
-
-  useEffect(() => {
-    return () => {
-      mounted.current = false
-      if (timer.current) {
-        clearTimeout(timer.current)
-      }
-    }
-  }, [])
-
-  const queryRefs = useCallback(
-    (query: string) => {
-      if (timer.current) {
-        clearTimeout(timer.current)
-      }
-      if (!client || query.trim().length === 0) {
-        // Advance the generation so an earlier in-flight search can't land and
-        // repopulate results after the input was cleared.
-        seq.current += 1
-        setResults([])
-        return
-      }
-      timer.current = setTimeout(() => {
-        const requestSeq = ++seq.current
-        void searchBaseRefs(client, worktreeId, query.trim())
-          .then((refs) => {
-            if (!mounted.current || requestSeq !== seq.current) {
-              return
-            }
-            setResults(refs.filter((r) => r !== query).slice(0, 6))
-          })
-          // Why: a rejected ref search must not escape as an unhandled rejection;
-          // drop to an empty result set (free text stays valid to submit).
-          .catch(() => {
-            if (mounted.current && requestSeq === seq.current) {
-              setResults([])
-            }
-          })
-      }, 200)
-    },
-    [client, worktreeId]
-  )
-
-  return (
-    <View>
-      <View style={[styles.inputShell, !editable && styles.inputShellDisabled]}>
-        <TextInput
-          style={styles.input}
-          value={value}
-          onChangeText={(text) => {
-            onChange(text)
-            queryRefs(text)
-          }}
-          onFocus={() => setFocused(true)}
-          onBlur={() => setFocused(false)}
-          placeholder="main"
-          placeholderTextColor={colors.textMuted}
-          autoCapitalize="none"
-          autoCorrect={false}
-          editable={editable}
-        />
-        <ChevronDown size={14} color={colors.textSecondary} strokeWidth={2.2} />
-      </View>
-      {focused && results.length > 0 ? (
-        <View style={styles.results}>
-          {results.map((ref) => (
-            <Pressable
-              key={ref}
-              style={({ pressed }) => [styles.resultRow, pressed && styles.resultRowPressed]}
-              onPress={() => {
-                onChange(ref)
-                setResults([])
-              }}
-            >
-              <Text style={styles.resultText} numberOfLines={1}>
-                {ref}
-              </Text>
-              {ref === value ? (
-                <Check size={14} color={colors.textPrimary} strokeWidth={2.2} />
-              ) : null}
-            </Pressable>
-          ))}
-        </View>
-      ) : null}
-    </View>
-  )
-}
-
-const styles = StyleSheet.create({
-  inputShell: {
-    minHeight: 40,
-    flexDirection: 'row',
-    alignItems: 'center',
-    gap: spacing.xs,
-    backgroundColor: colors.bgRaised,
-    borderRadius: radii.input,
-    paddingHorizontal: spacing.md,
-    paddingVertical: spacing.xs
-  },
-  inputShellDisabled: {
-    opacity: 0.6
-  },
-  input: {
-    flex: 1,
-    minWidth: 0,
-    padding: 0,
-    color: colors.textPrimary,
-    fontSize: typography.bodySize,
-    fontFamily: typography.monoFamily
-  },
-  results: {
-    marginTop: spacing.xs,
-    borderWidth: StyleSheet.hairlineWidth,
-    borderColor: colors.borderSubtle,
-    borderRadius: radii.input,
-    backgroundColor: colors.bgPanel,
-    overflow: 'hidden'
-  },
-  resultRow: {
-    minHeight: 40,
-    flexDirection: 'row',
-    alignItems: 'center',
-    justifyContent: 'space-between',
-    gap: spacing.sm,
-    paddingHorizontal: spacing.md,
-    borderBottomWidth: StyleSheet.hairlineWidth,
-    borderBottomColor: colors.borderSubtle
-  },
-  resultRowPressed: { backgroundColor: colors.bgRaised },
-  resultText: {
-    flex: 1,
-    minWidth: 0,
-    color: colors.textPrimary,
-    fontSize: typography.bodySize,
-    fontFamily: typography.monoFamily
-  }
-})
diff --git a/mobile/src/components/MobileRichMarkdownEditor.test.tsx b/mobile/src/components/MobileRichMarkdownEditor.test.tsx
new file mode 100644
index 00000000000..20b17098d14
--- /dev/null
+++ b/mobile/src/components/MobileRichMarkdownEditor.test.tsx
@@ -0,0 +1,84 @@
+import { createElement, createRef, forwardRef, useImperativeHandle } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  MobileRichMarkdownEditor,
+  type MobileRichMarkdownEditorHandle
+} from './MobileRichMarkdownEditor'
+
+const mocks = vi.hoisted(() => ({
+  dismissKeyboard: vi.fn(),
+  injectJavaScript: vi.fn()
+}))
+
+vi.mock('react-native', async () => {
+  const React = await import('react')
+  return {
+    Keyboard: { dismiss: mocks.dismissKeyboard },
+    Linking: { openURL: vi.fn() },
+    Pressable: 'Pressable',
+    ScrollView: ({ children, ...props }: { children?: unknown }) =>
+      React.createElement('ScrollView', props, children),
+    StyleSheet: { create: (styles: unknown) => styles, hairlineWidth: 1 },
+    View: 'View'
+  }
+})
+
+vi.mock('react-native-webview', () => {
+  const WebView = forwardRef((props: Record<string, unknown>, ref) => {
+    useImperativeHandle(ref, () => ({ injectJavaScript: mocks.injectJavaScript }))
+    return createElement('WebView', props)
+  })
+  return { WebView, default: WebView }
+})
+
+vi.mock('lucide-react-native', () => ({
+  Bold: 'Bold',
+  ChevronDown: 'ChevronDown',
+  Code2: 'Code2',
+  FileCode2: 'FileCode2',
+  Heading1: 'Heading1',
+  Heading2: 'Heading2',
+  Heading3: 'Heading3',
+  ImageIcon: 'ImageIcon',
+  Italic: 'Italic',
+  Keyboard: 'Keyboard',
+  Link: 'Link',
+  List: 'List',
+  ListOrdered: 'ListOrdered',
+  ListTodo: 'ListTodo',
+  Pilcrow: 'Pilcrow',
+  Quote: 'Quote',
+  Strikethrough: 'Strikethrough'
+}))
+
+describe('MobileRichMarkdownEditor', () => {
+  let renderer: ReactTestRenderer | null = null
+
+  afterEach(() => {
+    act(() => renderer?.unmount())
+    renderer = null
+    vi.clearAllMocks()
+  })
+
+  it('exposes WebView keyboard dismissal to its native parent', () => {
+    const editorRef = createRef<MobileRichMarkdownEditorHandle>()
+    act(() => {
+      renderer = create(
+        createElement(MobileRichMarkdownEditor, {
+          ref: editorRef,
+          content: '',
+          editable: true,
+          onChange: vi.fn()
+        })
+      )
+    })
+
+    act(() => editorRef.current?.dismissKeyboard())
+
+    expect(mocks.injectJavaScript).toHaveBeenCalledWith(
+      expect.stringContaining('window.__orcaRichMarkdown.dismissKeyboard()')
+    )
+    expect(mocks.dismissKeyboard).toHaveBeenCalledOnce()
+  })
+})
diff --git a/mobile/src/components/MobileRichMarkdownEditor.tsx b/mobile/src/components/MobileRichMarkdownEditor.tsx
index c9e0b44e082..8fbcaa149e7 100644
--- a/mobile/src/components/MobileRichMarkdownEditor.tsx
+++ b/mobile/src/components/MobileRichMarkdownEditor.tsx
@@ -1,5 +1,15 @@
-import { memo, useCallback, useEffect, useMemo, useRef, type ComponentType } from 'react'
-import { Linking, Pressable, ScrollView, StyleSheet, View } from 'react-native'
+import {
+  forwardRef,
+  memo,
+  useCallback,
+  useEffect,
+  useImperativeHandle,
+  useMemo,
+  useRef,
+  type ComponentType,
+  type ForwardedRef
+} from 'react'
+import { Keyboard, Linking, Pressable, ScrollView, StyleSheet, View } from 'react-native'
 import {
   Bold,
   Code2,
@@ -77,6 +87,10 @@ type Props = {
   onKeyboardInsetChange?: (bottom: number) => void
 }
 
+export type MobileRichMarkdownEditorHandle = {
+  dismissKeyboard: () => void
+}
+
 type EditorWebViewMessage =
   | { type: 'ready' }
   | { type: 'change'; markdown: string; generation: number }
@@ -107,12 +121,10 @@ const TOOLBAR_ITEMS: ToolbarItem[] = [
   { command: 'codeBlock', label: 'Code block', icon: FileCode2 }
 ]
 
-function MobileRichMarkdownEditorInner({
-  content,
-  editable,
-  onChange,
-  onKeyboardInsetChange
-}: Props) {
+function MobileRichMarkdownEditorInner(
+  { content, editable, onChange, onKeyboardInsetChange }: Props,
+  ref: ForwardedRef<MobileRichMarkdownEditorHandle>
+) {
   const webViewRef = useRef<WebView>(null)
   const readyRef = useRef(false)
   const documentGenerationRef = useRef(0)
@@ -227,6 +239,15 @@ function MobileRichMarkdownEditorInner({
     [inject]
   )
 
+  const dismissKeyboard = useCallback(() => {
+    // Why: the caret lives in the WebView, so the injected blur is what closes the keyboard;
+    // Keyboard.dismiss only clears a native TextInput that stole focus first.
+    inject('window.__orcaRichMarkdown && window.__orcaRichMarkdown.dismissKeyboard();')
+    Keyboard.dismiss()
+  }, [inject])
+
+  useImperativeHandle(ref, () => ({ dismissKeyboard }), [dismissKeyboard])
+
   return (
     <View style={styles.container}>
       <View style={styles.toolbar}>
@@ -278,7 +299,7 @@ function MobileRichMarkdownEditorInner({
   )
 }
 
-export const MobileRichMarkdownEditor = memo(MobileRichMarkdownEditorInner)
+export const MobileRichMarkdownEditor = memo(forwardRef(MobileRichMarkdownEditorInner))
 
 const styles = StyleSheet.create({
   container: {
diff --git a/mobile/src/components/MobileSearchField.tsx b/mobile/src/components/MobileSearchField.tsx
index 2dfd6bf26e4..cbeab92c208 100644
--- a/mobile/src/components/MobileSearchField.tsx
+++ b/mobile/src/components/MobileSearchField.tsx
@@ -149,8 +149,7 @@ const styles = StyleSheet.create({
     flexDirection: 'row',
     alignItems: 'center',
     gap: spacing.sm,
-    // Why: bgRaised lifts the field off bgBase/bgPanel so search is an obvious
-    // control, matching TextInputModal / MobilePrBasePicker input shells.
+    // Keep search visually distinct from surrounding panels.
     backgroundColor: colors.bgRaised,
     borderWidth: 1,
     borderColor: colors.borderSubtle,
diff --git a/mobile/src/components/mobile-markdown-preview-html.ts b/mobile/src/components/mobile-markdown-preview-html.ts
index 8b2d247f8f2..8bb5fca0934 100644
--- a/mobile/src/components/mobile-markdown-preview-html.ts
+++ b/mobile/src/components/mobile-markdown-preview-html.ts
@@ -97,7 +97,7 @@ function attrValue(tag: string, name: string): string {
     const valueStart = cursor
     if (quote) {
       const valueEnd = tag.indexOf(quote, cursor)
-      if (valueEnd < 0) {
+      if (valueEnd === -1) {
         return ''
       }
       cursor = valueEnd + 1
diff --git a/mobile/src/components/mobile-markdown-preview-tag-stripper.ts b/mobile/src/components/mobile-markdown-preview-tag-stripper.ts
index 90e3c3cc3cc..6eeca2aa612 100644
--- a/mobile/src/components/mobile-markdown-preview-tag-stripper.ts
+++ b/mobile/src/components/mobile-markdown-preview-tag-stripper.ts
@@ -191,7 +191,7 @@ function closingMarkupTagNames(value: string): Set<string> {
   let cursor = 0
   while (cursor < value.length) {
     const start = value.indexOf('<', cursor)
-    if (start < 0) {
+    if (start === -1) {
       return names
     }
     const end = findMobileMarkdownMarkupTagEnd(value, start + 1)
@@ -228,7 +228,7 @@ export function stripMobileMarkdownMarkupTags(value: string): string {
   const closingTagNames = closingMarkupTagNames(value)
   while (cursor < value.length) {
     const start = value.indexOf('<', cursor)
-    if (start < 0) {
+    if (start === -1) {
       return output + value.slice(cursor)
     }
     output += value.slice(cursor, start)
@@ -261,7 +261,7 @@ export function stripMobileMarkdownMarkupTags(value: string): string {
         !/[-:]/.test(name) &&
         !knownMarkupTagNames.has(lowerName) &&
         !closingTagNames.has(lowerName)
-      if (isNestedGeneric && nestedStart >= 0) {
+      if (isNestedGeneric && nestedStart !== -1) {
         output += value.slice(start, nestedStart)
         cursor = nestedStart
         continue
diff --git a/mobile/src/components/mobile-rich-markdown-editor-html.test.ts b/mobile/src/components/mobile-rich-markdown-editor-html.test.ts
index f21674478b1..b8321c7a2f2 100644
--- a/mobile/src/components/mobile-rich-markdown-editor-html.test.ts
+++ b/mobile/src/components/mobile-rich-markdown-editor-html.test.ts
@@ -11,9 +11,7 @@ function editorScript(): string {
   return script ?? ''
 }
 
-function extractFunctionSource(script: string, name: string): string {
-  const start = script.indexOf(`function ${name}`)
-  expect(start).toBeGreaterThanOrEqual(0)
+function extractBracedSource(script: string, start: number, label: string): string {
   const bodyStart = script.indexOf('{', start)
   let depth = 0
   for (let index = bodyStart; index < script.length; index += 1) {
@@ -28,7 +26,19 @@ function extractFunctionSource(script: string, name: string): string {
       }
     }
   }
-  throw new Error(`Could not extract ${name}`)
+  throw new Error(`Could not extract ${label}`)
+}
+
+function extractFunctionSource(script: string, name: string): string {
+  const start = script.indexOf(`function ${name}`)
+  expect(start).toBeGreaterThanOrEqual(0)
+  return extractBracedSource(script, start, name)
+}
+
+function extractEditorListenerSource(script: string, type: string): string {
+  const start = script.indexOf(`editor.addEventListener('${type}'`)
+  expect(start).toBeGreaterThanOrEqual(0)
+  return `${extractBracedSource(script, start, `${type} listener`)});`
 }
 
 function runtimeMarkdownToHtml(markdown: string, editable: boolean): string {
@@ -65,6 +75,134 @@ function runtimeListMarkdown(): (list: unknown) => string {
   return new Function(sources)() as (list: unknown) => string
 }
 
+type FakeRange = {
+  commonAncestorContainer: unknown
+  cloneRange: () => FakeRange
+  selectNodeContents: (node: unknown) => void
+  collapse: (toStart: boolean) => void
+}
+
+function createFakeRange(container: unknown): FakeRange {
+  const range: FakeRange = {
+    commonAncestorContainer: container,
+    cloneRange: () => createFakeRange(range.commonAncestorContainer),
+    selectNodeContents: (node) => {
+      range.commonAncestorContainer = node
+    },
+    collapse: () => {}
+  }
+  return range
+}
+
+type FakeClickEvent = {
+  clientX: number
+  clientY: number
+  target: { closest: (selector: string) => unknown }
+  preventDefault: () => void
+}
+
+// Drives the editor's real selection and click handling against a stub DOM whose blur
+// drops the selection, the way WebKit does.
+function createSelectionRuntime(caretContainer: string | null) {
+  const liveNodes = new Set(caretContainer ? [caretContainer] : [])
+  const listeners = new Map<string, (event: FakeClickEvent) => void>()
+  let focused = caretContainer != null
+  let ranges: FakeRange[] = caretContainer ? [createFakeRange(caretContainer)] : []
+  let caretAtPoint: string | null = null
+
+  const editor = {
+    contains: (node: unknown) => typeof node === 'string' && liveNodes.has(node),
+    focus: () => {
+      focused = true
+      fakeDocument.activeElement = editor
+    },
+    blur: () => {
+      focused = false
+      fakeDocument.activeElement = null
+      ranges = []
+    },
+    addEventListener: (type: string, handler: (event: FakeClickEvent) => void) => {
+      listeners.set(type, handler)
+    }
+  }
+  const fakeDocument: {
+    activeElement: unknown
+    createRange: () => FakeRange
+    caretRangeFromPoint: () => FakeRange | null
+  } = {
+    activeElement: focused ? editor : null,
+    createRange: () => createFakeRange('detached'),
+    caretRangeFromPoint: () => (caretAtPoint ? createFakeRange(caretAtPoint) : null)
+  }
+  const fakeWindow = {
+    getSelection: () => ({
+      get rangeCount() {
+        return ranges.length
+      },
+      getRangeAt: (index: number) => ranges[index],
+      removeAllRanges: () => {
+        ranges = []
+      },
+      addRange: (range: FakeRange) => {
+        ranges = [range]
+      }
+    })
+  }
+
+  const script = editorScript()
+  const sources = [
+    'var editor = arguments[0];',
+    'var document = arguments[1];',
+    'var window = arguments[2];',
+    'var editable = true;',
+    'var savedSelectionRange = null;',
+    'var selectionDroppedOnBlur = false;',
+    'function post() {}',
+    'function emitChange() {}',
+    extractFunctionSource(script, 'focusEditor'),
+    extractFunctionSource(script, 'rememberSelection'),
+    extractFunctionSource(script, 'applySelectionRange'),
+    extractFunctionSource(script, 'caretRangeAtPoint'),
+    extractFunctionSource(script, 'dismissKeyboard'),
+    extractFunctionSource(script, 'restoreSelectionOrEnd'),
+    extractEditorListenerSource(script, 'click'),
+    'return { dismissKeyboard: dismissKeyboard, restoreSelectionOrEnd: restoreSelectionOrEnd };'
+  ].join('\n')
+  const api = new Function(sources)(editor, fakeDocument, fakeWindow) as {
+    dismissKeyboard: () => void
+    restoreSelectionOrEnd: () => void
+  }
+
+  return {
+    dismissKeyboard: api.dismissKeyboard,
+    restoreSelectionOrEnd: api.restoreSelectionOrEnd,
+    tapAt: (container: string, options?: { uneditableAncestor?: string }) => {
+      liveNodes.add(container)
+      caretAtPoint = container
+      listeners.get('click')?.({
+        clientX: 12,
+        clientY: 34,
+        target: {
+          closest: (selector: string) =>
+            selector === '[contenteditable="false"]' ? (options?.uneditableAncestor ?? null) : null
+        },
+        preventDefault: () => {}
+      })
+    },
+    detachEditorContent: () => liveNodes.clear(),
+    selectedContainer: () => {
+      if (ranges.length === 0) {
+        return null
+      }
+      const container = ranges[0].commonAncestorContainer
+      return container === editor ? 'editor-end' : (container as string)
+    },
+    get focused() {
+      return focused
+    }
+  }
+}
+
 describe('mobile rich markdown editor HTML', () => {
   it('builds parseable WebView JavaScript', () => {
     const script = editorScript()
@@ -233,4 +371,64 @@ describe('mobile rich markdown editor HTML', () => {
     expect(emitChange).not.toContain('window.setTimeout')
     expect(emitChange).toContain('generation: pendingGeneration')
   })
+
+  it('exposes a keyboard dismissal command that blurs WebView focus', () => {
+    const script = editorScript()
+    const dismissKeyboard = extractFunctionSource(script, 'dismissKeyboard')
+
+    expect(dismissKeyboard).toContain('rememberSelection()')
+    expect(dismissKeyboard).toContain('document.activeElement.blur()')
+    expect(dismissKeyboard).toContain('editor.blur()')
+    expect(script).toContain('dismissKeyboard: dismissKeyboard')
+  })
+
+  it('reclaims editor focus at the tapped caret after keyboard dismissal', () => {
+    const runtime = createSelectionRuntime('paragraph-3')
+
+    runtime.dismissKeyboard()
+    runtime.tapAt('paragraph-7')
+
+    expect(runtime.focused).toBe(true)
+    expect(runtime.selectedContainer()).toBe('paragraph-7')
+  })
+
+  it('leaves task-list label taps to the checkbox instead of refocusing the editor', () => {
+    const runtime = createSelectionRuntime('paragraph-3')
+
+    runtime.dismissKeyboard()
+    runtime.tapAt('paragraph-7', { uneditableAncestor: 'task-label' })
+
+    expect(runtime.focused).toBe(false)
+    expect(runtime.selectedContainer()).toBe(null)
+  })
+
+  it('restores the pre-dismissal caret so commands do not insert at the document end', () => {
+    const runtime = createSelectionRuntime('paragraph-3')
+
+    runtime.dismissKeyboard()
+    expect(runtime.selectedContainer()).toBe(null)
+
+    runtime.restoreSelectionOrEnd()
+
+    expect(runtime.selectedContainer()).toBe('paragraph-3')
+    expect(runtime.focused).toBe(true)
+  })
+
+  it('falls back to the document end when no caret was ever placed', () => {
+    const runtime = createSelectionRuntime(null)
+
+    runtime.restoreSelectionOrEnd()
+
+    expect(runtime.selectedContainer()).toBe('editor-end')
+  })
+
+  it('drops a remembered caret whose nodes left the document', () => {
+    const runtime = createSelectionRuntime('paragraph-3')
+
+    runtime.dismissKeyboard()
+    runtime.detachEditorContent()
+    runtime.restoreSelectionOrEnd()
+
+    expect(runtime.selectedContainer()).toBe('editor-end')
+  })
 })
diff --git a/mobile/src/components/mobile-rich-markdown-editor-html.ts b/mobile/src/components/mobile-rich-markdown-editor-html.ts
index 32fc12b59b2..b7ff1649075 100644
--- a/mobile/src/components/mobile-rich-markdown-editor-html.ts
+++ b/mobile/src/components/mobile-rich-markdown-editor-html.ts
@@ -1,5 +1,7 @@
 import { colors } from '../theme/mobile-theme'
+import { MOBILE_RICH_MARKDOWN_KEYBOARD_DISMISS_SCRIPT } from './mobile-rich-markdown-keyboard-dismiss-script'
 import { MOBILE_RICH_MARKDOWN_KEYBOARD_INSET_SCRIPT } from './mobile-rich-markdown-editor-keyboard-inset-script'
+import { MOBILE_RICH_MARKDOWN_SELECTION_SCRIPT } from './mobile-rich-markdown-selection-script'
 
 export function escapeInjectedJavaScriptString(value: string): string {
   return JSON.stringify(value).replace(/<\/script/gi, '<\\/script')
@@ -559,6 +561,9 @@ export function buildMobileRichMarkdownEditorHtml(): string {
         window.clearTimeout(inputTimer);
         documentGeneration = Number(generation) || 0;
         suppressInput = true;
+        // Why: replacing innerHTML detaches the remembered caret's nodes.
+        savedSelectionRange = null;
+        selectionDroppedOnBlur = false;
         lastMarkdown = String(markdown || '');
         editor.innerHTML = markdownToHtml(lastMarkdown);
         syncTaskCheckboxesDisabled();
@@ -571,39 +576,8 @@ export function buildMobileRichMarkdownEditorHtml(): string {
         syncTaskCheckboxesDisabled();
       }
 
-      function focusEditor() {
-        editor.focus();
-      }
-
-      function restoreSelectionOrEnd() {
-        focusEditor();
-        var selection = window.getSelection();
-        if (!selection || selection.rangeCount > 0) return;
-        var range = document.createRange();
-        range.selectNodeContents(editor);
-        range.collapse(false);
-        selection.removeAllRanges();
-        selection.addRange(range);
-      }
-
-      function wrapSelection(tagName) {
-        restoreSelectionOrEnd();
-        var selection = window.getSelection();
-        if (!selection || selection.rangeCount === 0) return;
-        var range = selection.getRangeAt(0);
-        if (range.collapsed) return;
-        var wrapper = document.createElement(tagName);
-        try {
-          range.surroundContents(wrapper);
-        } catch (_error) {
-          wrapper.appendChild(range.extractContents());
-          range.insertNode(wrapper);
-        }
-        selection.removeAllRanges();
-        selection.selectAllChildren(wrapper);
-        emitChange();
-      }
-
+${MOBILE_RICH_MARKDOWN_SELECTION_SCRIPT}
+${MOBILE_RICH_MARKDOWN_KEYBOARD_DISMISS_SCRIPT}
       function runCommand(command) {
         if (!editable || editor.getAttribute('contenteditable') !== 'true') return;
         restoreSelectionOrEnd();
@@ -632,6 +606,7 @@ export function buildMobileRichMarkdownEditorHtml(): string {
       }
 
       editor.addEventListener('input', function () {
+        selectionDroppedOnBlur = false;
         if (editable) emitChange();
       });
       editor.addEventListener('change', function (event) {
@@ -654,7 +629,19 @@ export function buildMobileRichMarkdownEditorHtml(): string {
           return;
         }
         var input = event.target && event.target.closest && event.target.closest('input[type="checkbox"]');
-        if (!input) return;
+        if (!input) {
+          if (!editable) return;
+          // Why: a task-list label forwards its click to the checkbox, so refocusing here would steal it and re-open the keyboard.
+          var uneditable = event.target && event.target.closest && event.target.closest('[contenteditable="false"]');
+          if (uneditable && uneditable !== editor) return;
+          selectionDroppedOnBlur = false;
+          if (document.activeElement === editor) return;
+          // Why: refocusing after a dismissal otherwise types at the stale caret, not where the user tapped.
+          var caret = caretRangeAtPoint(event.clientX, event.clientY);
+          focusEditor();
+          if (caret && editor.contains(caret.commonAncestorContainer)) applySelectionRange(caret);
+          return;
+        }
         if (!editable) {
           event.preventDefault();
           return;
@@ -670,7 +657,7 @@ export function buildMobileRichMarkdownEditorHtml(): string {
         }
       });
 
-      window.__orcaRichMarkdown = { setMarkdown: setMarkdown, setEditable: setEditable, runCommand: runCommand, currentMarkdown: currentMarkdown };
+      window.__orcaRichMarkdown = { setMarkdown: setMarkdown, setEditable: setEditable, runCommand: runCommand, currentMarkdown: currentMarkdown, dismissKeyboard: dismissKeyboard };
 ${MOBILE_RICH_MARKDOWN_KEYBOARD_INSET_SCRIPT}
       post({ type: 'ready' });
     })();
diff --git a/mobile/src/components/mobile-rich-markdown-keyboard-dismiss-script.ts b/mobile/src/components/mobile-rich-markdown-keyboard-dismiss-script.ts
new file mode 100644
index 00000000000..a4520ce4261
--- /dev/null
+++ b/mobile/src/components/mobile-rich-markdown-keyboard-dismiss-script.ts
@@ -0,0 +1,13 @@
+// Composed into the editor document after MOBILE_RICH_MARKDOWN_SELECTION_SCRIPT, whose
+// rememberSelection/selectionDroppedOnBlur this depends on.
+export const MOBILE_RICH_MARKDOWN_KEYBOARD_DISMISS_SCRIPT = `
+      function dismissKeyboard() {
+        // Why: WebKit discards the DOM selection on blur, so capture the caret before it goes.
+        rememberSelection();
+        selectionDroppedOnBlur = true;
+        if (document.activeElement && document.activeElement.blur) {
+          document.activeElement.blur();
+        }
+        editor.blur();
+      }
+`
diff --git a/mobile/src/components/mobile-rich-markdown-selection-script.ts b/mobile/src/components/mobile-rich-markdown-selection-script.ts
new file mode 100644
index 00000000000..c649bd09ed8
--- /dev/null
+++ b/mobile/src/components/mobile-rich-markdown-selection-script.ts
@@ -0,0 +1,71 @@
+// Caret and selection management for the WebView editor. Split out so the editor
+// document script stays inside its line budget.
+export const MOBILE_RICH_MARKDOWN_SELECTION_SCRIPT = `
+      var savedSelectionRange = null;
+      var selectionDroppedOnBlur = false;
+
+      function focusEditor() {
+        editor.focus();
+      }
+
+      function rememberSelection() {
+        var selection = window.getSelection();
+        if (!selection || selection.rangeCount === 0) return;
+        var range = selection.getRangeAt(0);
+        if (editor.contains(range.commonAncestorContainer)) savedSelectionRange = range.cloneRange();
+      }
+
+      function applySelectionRange(range) {
+        var selection = window.getSelection();
+        if (!selection) return;
+        selection.removeAllRanges();
+        selection.addRange(range);
+        savedSelectionRange = range.cloneRange();
+      }
+
+      function caretRangeAtPoint(x, y) {
+        if (document.caretRangeFromPoint) return document.caretRangeFromPoint(x, y);
+        if (!document.caretPositionFromPoint) return null;
+        var position = document.caretPositionFromPoint(x, y);
+        if (!position) return null;
+        var range = document.createRange();
+        range.setStart(position.offsetNode, position.offset);
+        range.collapse(true);
+        return range;
+      }
+
+      function restoreSelectionOrEnd() {
+        focusEditor();
+        var selection = window.getSelection();
+        if (!selection) return;
+        // Why: the blur dropped the live selection, so commands would otherwise insert at the document end.
+        if (selectionDroppedOnBlur && savedSelectionRange && editor.contains(savedSelectionRange.commonAncestorContainer)) {
+          selectionDroppedOnBlur = false;
+          applySelectionRange(savedSelectionRange);
+          return;
+        }
+        if (selection.rangeCount > 0) return;
+        var range = document.createRange();
+        range.selectNodeContents(editor);
+        range.collapse(false);
+        applySelectionRange(range);
+      }
+
+      function wrapSelection(tagName) {
+        restoreSelectionOrEnd();
+        var selection = window.getSelection();
+        if (!selection || selection.rangeCount === 0) return;
+        var range = selection.getRangeAt(0);
+        if (range.collapsed) return;
+        var wrapper = document.createElement(tagName);
+        try {
+          range.surroundContents(wrapper);
+        } catch (_error) {
+          wrapper.appendChild(range.extractContents());
+          range.insertNode(wrapper);
+        }
+        selection.removeAllRanges();
+        selection.selectAllChildren(wrapper);
+        emitChange();
+      }
+`
diff --git a/mobile/src/components/pr-sidebar/MobilePrComposeForm.tsx b/mobile/src/components/pr-sidebar/MobilePrComposeForm.tsx
deleted file mode 100644
index d832d38c88d..00000000000
--- a/mobile/src/components/pr-sidebar/MobilePrComposeForm.tsx
+++ /dev/null
@@ -1,289 +0,0 @@
-import { useCallback, useState } from 'react'
-import { ActivityIndicator, Pressable, Switch, Text, TextInput, View } from 'react-native'
-import {
-  ArrowRight,
-  GitMerge,
-  GitPullRequestArrow,
-  Sparkles,
-  TriangleAlert,
-  X
-} from 'lucide-react-native'
-import { colors } from '../../theme/mobile-theme'
-import type { RpcClient } from '../../transport/rpc-client'
-import type { RpcSuccess } from '../../transport/types'
-import { triggerError, triggerSuccess } from '../../platform/haptics'
-import {
-  createMobilePr,
-  getMobilePrCreateSuccessWarning,
-  shouldPushBeforeMobilePrCreate,
-  type MobilePrPrefill
-} from '../../source-control/mobile-pr-create'
-import { hostedReviewCopy } from '../../source-control/hosted-review-copy'
-import {
-  getPrComposeDisabledReason,
-  isBaseHeadDistinct
-} from '../../source-control/pr-compose-validation'
-import { MobilePrBasePicker } from '../MobilePrBasePicker'
-import { mobilePrComposeFormStyles as styles } from './mobile-pr-compose-form-styles'
-
-export type PrComposePrefill = MobilePrPrefill
-
-type Props = {
-  client: RpcClient | null
-  worktreeId: string
-  prefill: PrComposePrefill
-  // Head branch — enables the base≠head guard and the "from <branch>" hint.
-  head?: string | null
-  onCancel: () => void
-  onCreated: (url: string, warning?: string) => void
-}
-
-// A plain View keeps the compose form usable inside the PR sidebar ScrollView.
-export function MobilePrComposeForm({
-  client,
-  worktreeId,
-  prefill,
-  head,
-  onCancel,
-  onCreated
-}: Props) {
-  const copy = hostedReviewCopy(prefill.provider)
-  const ReviewIcon = prefill.provider === 'gitlab' ? GitMerge : GitPullRequestArrow
-  const [title, setTitle] = useState(prefill.title)
-  const [body, setBody] = useState(prefill.body)
-  const [base, setBase] = useState(prefill.base)
-  const [draft, setDraft] = useState(false)
-  const [generating, setGenerating] = useState(false)
-  const [submitting, setSubmitting] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-  const pushBeforeCreate = shouldPushBeforeMobilePrCreate(prefill)
-
-  const generate = useCallback(async () => {
-    if (!client || generating) {
-      return
-    }
-    setGenerating(true)
-    setError(null)
-    try {
-      const response = await client.sendRequest('git.generatePullRequestFields', {
-        worktree: `id:${worktreeId}`,
-        base,
-        title,
-        body,
-        draft
-      })
-      if (!response.ok) {
-        setError(response.error?.message || 'Failed to generate PR fields')
-        return
-      }
-      const result = (response as RpcSuccess).result as {
-        success?: boolean
-        fields?: { base: string; title: string; body: string; draft: boolean }
-        error?: string
-      }
-      if (result.success && result.fields) {
-        setBase(result.fields.base || base)
-        setTitle(result.fields.title || title)
-        setBody(result.fields.body || body)
-        setDraft(result.fields.draft)
-      } else if (result.error) {
-        setError(result.error)
-      }
-    } catch (err) {
-      triggerError()
-      setError(err instanceof Error ? err.message : 'Failed to generate PR fields')
-    } finally {
-      setGenerating(false)
-    }
-  }, [base, body, client, draft, generating, title, worktreeId])
-
-  const headRef = head ?? ''
-  const baseConflict = base.trim().length > 0 && !isBaseHeadDistinct(base, headRef)
-  const submitDisabledReason = getPrComposeDisabledReason({
-    title,
-    base,
-    head: headRef,
-    generating,
-    reviewLabel: copy.reviewLabel
-  })
-  const canSubmit = submitDisabledReason === null
-  const fieldsLocked = submitting || generating
-
-  const submit = useCallback(async () => {
-    if (!client || submitting || !canSubmit) {
-      return
-    }
-    setSubmitting(true)
-    setError(null)
-    try {
-      const outcome = await createMobilePr(client, worktreeId, {
-        provider: prefill.provider,
-        base,
-        // Send the same head the submit guard validated against, so the PR opens
-        // from the validated branch instead of a host-inferred one.
-        ...(head ? { head } : {}),
-        title,
-        body,
-        draft,
-        pushBeforeCreate
-      })
-      if (outcome.ok) {
-        triggerSuccess()
-        const warning = getMobilePrCreateSuccessWarning(outcome, prefill.provider)
-        if (warning) {
-          setError(warning)
-        }
-        onCreated(outcome.url, warning)
-      } else {
-        triggerError()
-        setError(outcome.error)
-      }
-    } finally {
-      setSubmitting(false)
-    }
-  }, [
-    base,
-    body,
-    canSubmit,
-    client,
-    copy.titleLabel,
-    draft,
-    head,
-    onCreated,
-    prefill.provider,
-    pushBeforeCreate,
-    submitting,
-    title,
-    worktreeId
-  ])
-
-  return (
-    <View style={styles.root}>
-      <View style={styles.headingRow}>
-        <View style={styles.headingTitle}>
-          <ReviewIcon size={14} color={colors.textSecondary} strokeWidth={2.2} />
-          <Text style={styles.heading}>New {copy.reviewLabel}</Text>
-        </View>
-        <View style={styles.headingActions}>
-          <Pressable
-            style={({ pressed }) => [styles.genButton, pressed && styles.genButtonPressed]}
-            disabled={generating || submitting}
-            onPress={() => void generate()}
-            accessibilityRole="button"
-            accessibilityLabel={`Generate ${copy.reviewLabel} details with AI`}
-          >
-            {generating ? (
-              <ActivityIndicator size="small" color={colors.textSecondary} />
-            ) : (
-              <Sparkles size={13} color={colors.textSecondary} strokeWidth={2.1} />
-            )}
-            <Text style={styles.genButtonText}>{generating ? 'Generating…' : 'Generate'}</Text>
-          </Pressable>
-          <Pressable
-            style={styles.iconButton}
-            onPress={onCancel}
-            disabled={submitting}
-            accessibilityRole="button"
-            accessibilityLabel="Cancel"
-            hitSlop={8}
-          >
-            <X size={16} color={colors.textSecondary} strokeWidth={2.2} />
-          </Pressable>
-        </View>
-      </View>
-
-      {head ? (
-        <View style={styles.branchFlow}>
-          <Text style={styles.branchToken} numberOfLines={1}>
-            {head}
-          </Text>
-          <ArrowRight size={12} color={colors.textSecondary} strokeWidth={2.2} />
-          <Text
-            style={[styles.branchToken, baseConflict && styles.branchTokenError]}
-            numberOfLines={1}
-          >
-            {base || 'base'}
-          </Text>
-        </View>
-      ) : null}
-
-      <View style={styles.fieldStack}>
-        <TextInput
-          style={styles.titleInput}
-          value={title}
-          onChangeText={setTitle}
-          placeholder="Title"
-          placeholderTextColor={colors.textMuted}
-          editable={!fieldsLocked}
-          accessibilityLabel={`${copy.titleLabel} title`}
-        />
-        <TextInput
-          style={styles.bodyInput}
-          value={body}
-          onChangeText={setBody}
-          placeholder="Description (optional)"
-          placeholderTextColor={colors.textMuted}
-          multiline
-          editable={!fieldsLocked}
-          accessibilityLabel={`${copy.titleLabel} description`}
-        />
-      </View>
-
-      {generating ? (
-        <View style={styles.notice}>
-          <Sparkles size={13} color={colors.textSecondary} strokeWidth={2.1} />
-          <Text style={styles.noticeText}>Generating title and description…</Text>
-        </View>
-      ) : null}
-
-      <View style={styles.baseRow}>
-        <Text style={styles.baseLabel}>Base</Text>
-        <View style={styles.baseControl}>
-          <MobilePrBasePicker
-            client={client}
-            worktreeId={worktreeId}
-            value={base}
-            onChange={setBase}
-            editable={!fieldsLocked}
-          />
-        </View>
-      </View>
-
-      <View style={styles.draftRow}>
-        <Text style={styles.draftText}>Create as draft</Text>
-        <Switch value={draft} onValueChange={setDraft} disabled={fieldsLocked} />
-      </View>
-      {error || submitDisabledReason ? (
-        <View style={styles.notice}>
-          <TriangleAlert size={13} color={colors.statusRed} strokeWidth={2.1} />
-          <Text style={[styles.noticeText, styles.errorText]}>{error ?? submitDisabledReason}</Text>
-        </View>
-      ) : null}
-      <Pressable
-        style={({ pressed }) => [
-          styles.submit,
-          (submitting || !canSubmit) && styles.submitDisabled,
-          pressed && styles.submitPressed
-        ]}
-        disabled={submitting || !canSubmit}
-        onPress={() => void submit()}
-        accessibilityRole="button"
-      >
-        {submitting ? (
-          <ActivityIndicator size="small" color={colors.bgBase} />
-        ) : (
-          <ReviewIcon size={14} color={colors.bgBase} strokeWidth={2.2} />
-        )}
-        <Text style={styles.submitText}>
-          {pushBeforeCreate
-            ? draft
-              ? `Push & create draft ${copy.shortLabel}`
-              : `Push & create ${copy.shortLabel}`
-            : draft
-              ? `Create draft ${copy.shortLabel}`
-              : `Create ${copy.shortLabel}`}
-        </Text>
-      </Pressable>
-    </View>
-  )
-}
diff --git a/mobile/src/components/pr-sidebar/PRCommentCard.tsx b/mobile/src/components/pr-sidebar/PRCommentCard.tsx
index ce1ef33cb96..23d768b7814 100644
--- a/mobile/src/components/pr-sidebar/PRCommentCard.tsx
+++ b/mobile/src/components/pr-sidebar/PRCommentCard.tsx
@@ -7,7 +7,7 @@ import { canEditComment, isResolvableComment } from '../../session/pr-comment-ac
 import { ConfirmModal } from '../ConfirmModal'
 import { CommentMarkdown } from './CommentMarkdown'
 import { PRCommentComposer } from './PRCommentComposer'
-import { formatPrCommentRelativeTime } from './pr-comment-time'
+import { formatPrCommentRelativeTime } from '../../../../src/shared/pr-comment-time'
 import { prCommentsStyles as styles } from './pr-comments-styles'
 
 export type PRCommentRepoSlug = { owner: string; repo: string; host?: string }
diff --git a/mobile/src/components/pr-sidebar/PRCommentsSection.tsx b/mobile/src/components/pr-sidebar/PRCommentsSection.tsx
index bb473307619..8fb5de31037 100644
--- a/mobile/src/components/pr-sidebar/PRCommentsSection.tsx
+++ b/mobile/src/components/pr-sidebar/PRCommentsSection.tsx
@@ -12,12 +12,14 @@ import { CommentMarkdown } from './CommentMarkdown'
 import { PRCommentCard, type PRCommentCardActions } from './PRCommentCard'
 import { PRCommentComposer } from './PRCommentComposer'
 import {
-  PR_COMMENT_AUDIENCE_FILTERS,
   filterPRCommentsByAudience,
   getPRCommentAudienceCounts,
-  getPRCommentAudienceEmptyLabel,
   type PRCommentAudienceFilter
-} from './pr-comment-audience'
+} from '../../../../src/shared/pr-comment-audience'
+import {
+  PR_COMMENT_AUDIENCE_FILTERS,
+  getPRCommentAudienceEmptyLabel
+} from './pr-comment-audience-labels'
 import {
   getPRCommentGroupCount,
   getPRCommentGroupId,
@@ -25,7 +27,7 @@ import {
   groupPRComments,
   isResolvedPRCommentGroup,
   type PRCommentGroup
-} from './pr-comment-groups'
+} from '../../../../src/shared/pr-comment-groups'
 import { prCommentsStyles as styles } from './pr-comments-styles'
 import { mobilePrSidebarStyles as shared } from './mobile-pr-sidebar-styles'
 
diff --git a/mobile/src/components/pr-sidebar/mobile-pr-compose-form-styles.ts b/mobile/src/components/pr-sidebar/mobile-pr-compose-form-styles.ts
deleted file mode 100644
index 587082d972f..00000000000
--- a/mobile/src/components/pr-sidebar/mobile-pr-compose-form-styles.ts
+++ /dev/null
@@ -1,165 +0,0 @@
-import { StyleSheet } from 'react-native'
-import { colors, radii, spacing, typography } from '../../theme/mobile-theme'
-
-export const mobilePrComposeFormStyles = StyleSheet.create({
-  root: {
-    gap: spacing.sm
-  },
-  headingRow: {
-    flexDirection: 'row',
-    alignItems: 'center',
-    justifyContent: 'space-between',
-    gap: spacing.sm,
-    marginBottom: spacing.xs
-  },
-  headingTitle: {
-    flex: 1,
-    minWidth: 0,
-    flexDirection: 'row',
-    alignItems: 'center',
-    gap: spacing.xs
-  },
-  heading: {
-    color: colors.textPrimary,
-    fontSize: typography.bodySize,
-    fontWeight: '700'
-  },
-  headingActions: {
-    flexDirection: 'row',
-    alignItems: 'center',
-    gap: spacing.xs
-  },
-  genButton: {
-    minHeight: 32,
-    flexDirection: 'row',
-    alignItems: 'center',
-    justifyContent: 'center',
-    gap: spacing.xs,
-    paddingHorizontal: spacing.sm,
-    borderRadius: radii.button,
-    borderWidth: StyleSheet.hairlineWidth,
-    borderColor: colors.borderSubtle,
-    backgroundColor: colors.bgPanel
-  },
-  genButtonPressed: {
-    opacity: 0.7
-  },
-  genButtonText: {
-    color: colors.textSecondary,
-    fontSize: typography.metaSize,
-    fontWeight: '700'
-  },
-  iconButton: {
-    minWidth: 32,
-    minHeight: 32,
-    alignItems: 'center',
-    justifyContent: 'center',
-    borderRadius: radii.button
-  },
-  branchFlow: {
-    minHeight: 28,
-    flexDirection: 'row',
-    alignItems: 'center',
-    gap: spacing.xs
-  },
-  branchToken: {
-    maxWidth: 116,
-    color: colors.textPrimary,
-    fontSize: typography.metaSize,
-    fontFamily: typography.monoFamily
-  },
-  branchTokenError: {
-    color: colors.statusRed
-  },
-  fieldStack: {
-    gap: spacing.sm
-  },
-  titleInput: {
-    minHeight: 40,
-    backgroundColor: colors.bgRaised,
-    borderRadius: radii.input,
-    paddingHorizontal: spacing.md,
-    paddingVertical: spacing.sm,
-    color: colors.textPrimary,
-    fontSize: typography.bodySize,
-    fontWeight: '600'
-  },
-  bodyInput: {
-    backgroundColor: colors.bgRaised,
-    borderRadius: radii.input,
-    paddingHorizontal: spacing.md,
-    paddingVertical: spacing.sm,
-    color: colors.textPrimary,
-    fontSize: typography.bodySize,
-    // Why: a moderate fixed height avoids over-expanding inside the sidebar scroll.
-    minHeight: 120,
-    textAlignVertical: 'top'
-  },
-  baseRow: {
-    minHeight: 40,
-    flexDirection: 'row',
-    alignItems: 'center',
-    gap: spacing.sm
-  },
-  baseLabel: {
-    color: colors.textSecondary,
-    fontSize: typography.metaSize,
-    width: 36
-  },
-  baseControl: {
-    flex: 1,
-    minWidth: 0
-  },
-  draftRow: {
-    minHeight: 36,
-    flexDirection: 'row',
-    alignItems: 'center',
-    justifyContent: 'space-between',
-    gap: spacing.sm,
-    borderWidth: StyleSheet.hairlineWidth,
-    borderColor: colors.borderSubtle,
-    borderRadius: radii.button,
-    backgroundColor: colors.bgPanel,
-    paddingHorizontal: spacing.sm
-  },
-  draftText: {
-    color: colors.textPrimary,
-    fontSize: typography.metaSize,
-    fontWeight: '700'
-  },
-  notice: {
-    flexDirection: 'row',
-    alignItems: 'flex-start',
-    gap: spacing.xs
-  },
-  noticeText: {
-    flex: 1,
-    color: colors.textSecondary,
-    fontSize: typography.metaSize,
-    lineHeight: 18
-  },
-  errorText: {
-    color: colors.statusRed
-  },
-  submit: {
-    marginTop: spacing.xs,
-    minHeight: 44,
-    borderRadius: radii.button,
-    backgroundColor: colors.textPrimary,
-    flexDirection: 'row',
-    alignItems: 'center',
-    justifyContent: 'center',
-    gap: spacing.xs
-  },
-  submitDisabled: {
-    opacity: 0.45
-  },
-  submitPressed: {
-    opacity: 0.8
-  },
-  submitText: {
-    color: colors.bgBase,
-    fontSize: typography.bodySize,
-    fontWeight: '700'
-  }
-})
diff --git a/mobile/src/components/pr-sidebar/pr-comment-audience-labels.ts b/mobile/src/components/pr-sidebar/pr-comment-audience-labels.ts
new file mode 100644
index 00000000000..43f0d54289f
--- /dev/null
+++ b/mobile/src/components/pr-sidebar/pr-comment-audience-labels.ts
@@ -0,0 +1,18 @@
+import type { PRCommentAudienceFilter } from '../../../../src/shared/pr-comment-audience'
+
+export const PR_COMMENT_AUDIENCE_FILTERS = [
+  { value: 'all', label: 'All' },
+  { value: 'human', label: 'Humans' },
+  { value: 'bot', label: 'Bots' }
+] satisfies { value: PRCommentAudienceFilter; label: string }[]
+
+export function getPRCommentAudienceEmptyLabel(filter: PRCommentAudienceFilter): string {
+  switch (filter) {
+    case 'bot':
+      return 'No bot comments.'
+    case 'human':
+      return 'No human comments.'
+    case 'all':
+      return 'No comments yet.'
+  }
+}
diff --git a/mobile/src/components/pr-sidebar/pr-comment-groups.ts b/mobile/src/components/pr-sidebar/pr-comment-groups.ts
deleted file mode 100644
index 78bff853478..00000000000
--- a/mobile/src/components/pr-sidebar/pr-comment-groups.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-import type { PRComment } from '../../../../src/shared/types'
-
-// Thread grouping for the PR comment timeline, ported from the desktop helper
-// (src/renderer/src/lib/pr-comment-groups.ts) minus the DOM class constants.
-// Inline review comments sharing a threadId collapse into a root + replies; all
-// other comments are standalone. Upstream order is preserved.
-export type PRCommentGroup =
-  | { kind: 'standalone'; comment: PRComment }
-  | { kind: 'thread'; threadId: string; root: PRComment; replies: PRComment[] }
-
-export function groupPRComments(comments: PRComment[]): PRCommentGroup[] {
-  const threadMap = new Map<string, { root: PRComment; replies: PRComment[] }>()
-  const groupsByFirstComment = new Map<PRComment, PRCommentGroup>()
-
-  for (const comment of comments) {
-    if (!comment.threadId) {
-      groupsByFirstComment.set(comment, { kind: 'standalone', comment })
-      continue
-    }
-    const existing = threadMap.get(comment.threadId)
-    if (existing) {
-      existing.replies.push(comment)
-      continue
-    }
-    threadMap.set(comment.threadId, { root: comment, replies: [] })
-  }
-
-  const emitted = new Set<string>()
-  const groups: PRCommentGroup[] = []
-  for (const comment of comments) {
-    if (!comment.threadId) {
-      const group = groupsByFirstComment.get(comment)
-      if (group) {
-        groups.push(group)
-      }
-      continue
-    }
-    if (emitted.has(comment.threadId)) {
-      continue
-    }
-    emitted.add(comment.threadId)
-    const thread = threadMap.get(comment.threadId)
-    if (thread) {
-      groups.push({ kind: 'thread', threadId: comment.threadId, ...thread })
-    }
-  }
-  return groups
-}
-
-export function getPRCommentGroupComments(group: PRCommentGroup): PRComment[] {
-  return group.kind === 'thread' ? [group.root, ...group.replies] : [group.comment]
-}
-
-export function getPRCommentGroupRoot(group: PRCommentGroup): PRComment {
-  return group.kind === 'thread' ? group.root : group.comment
-}
-
-export function getPRCommentGroupCount(group: PRCommentGroup): number {
-  return getPRCommentGroupComments(group).length
-}
-
-export function isResolvedPRCommentGroup(group: PRCommentGroup): boolean {
-  return getPRCommentGroupRoot(group).isResolved === true
-}
-
-export function getPRCommentGroupId(group: PRCommentGroup): string {
-  return group.kind === 'thread' ? `thread:${group.threadId}` : `comment:${group.comment.id}`
-}
diff --git a/mobile/src/components/pr-sidebar/pr-comment-presentation.test.ts b/mobile/src/components/pr-sidebar/pr-comment-presentation.test.ts
deleted file mode 100644
index e01fb4166dc..00000000000
--- a/mobile/src/components/pr-sidebar/pr-comment-presentation.test.ts
+++ /dev/null
@@ -1,81 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import type { PRComment } from '../../../../src/shared/types'
-import {
-  createBotAuthorOverrideSet,
-  filterPRCommentsByAudience,
-  getPRCommentAudienceCounts,
-  isBotPRComment
-} from './pr-comment-audience'
-import { groupPRComments, isResolvedPRCommentGroup } from './pr-comment-groups'
-import { formatPrCommentRelativeTime } from './pr-comment-time'
-
-function comment(overrides: Partial<PRComment> & { id: number }): PRComment {
-  return {
-    author: 'octocat',
-    authorAvatarUrl: '',
-    body: '',
-    createdAt: '',
-    url: '',
-    ...overrides
-  }
-}
-
-describe('pr comment audience', () => {
-  it('classifies app bots, [bot] suffix, and known automation logins', () => {
-    expect(isBotPRComment(comment({ id: 1, author: 'alice' }))).toBe(false)
-    expect(isBotPRComment(comment({ id: 2, author: 'alice', isBot: true }))).toBe(true)
-    expect(isBotPRComment(comment({ id: 3, author: 'renovate[bot]' }))).toBe(true)
-    expect(isBotPRComment(comment({ id: 4, author: 'coderabbitai' }))).toBe(true)
-  })
-
-  it('counts and filters by audience', () => {
-    const comments = [
-      comment({ id: 1, author: 'alice' }),
-      comment({ id: 2, author: 'dependabot[bot]' }),
-      comment({ id: 3, author: 'bob' })
-    ]
-    expect(getPRCommentAudienceCounts(comments)).toEqual({ all: 3, human: 2, bot: 1 })
-    expect(filterPRCommentsByAudience(comments, 'bot').map((c) => c.id)).toEqual([2])
-    expect(filterPRCommentsByAudience(comments, 'human').map((c) => c.id)).toEqual([1, 3])
-    expect(filterPRCommentsByAudience(comments, 'all')).toHaveLength(3)
-  })
-
-  it('classifies desktop-marked bot authors via overrides (desktop parity)', () => {
-    const overrides = createBotAuthorOverrideSet([' GretelFlux '])
-    const comments = [comment({ id: 1, author: 'alice' }), comment({ id: 2, author: 'gretelflux' })]
-    expect(isBotPRComment(comments[1])).toBe(false)
-    expect(isBotPRComment(comments[1], overrides)).toBe(true)
-    expect(getPRCommentAudienceCounts(comments, overrides)).toEqual({ all: 2, human: 1, bot: 1 })
-    expect(filterPRCommentsByAudience(comments, 'bot', overrides).map((c) => c.id)).toEqual([2])
-  })
-})
-
-describe('pr comment groups', () => {
-  it('threads comments sharing a threadId as root + replies, preserving order', () => {
-    const comments = [
-      comment({ id: 1, author: 'a' }),
-      comment({ id: 2, author: 'b', threadId: 't1', isResolved: true }),
-      comment({ id: 3, author: 'c', threadId: 't1' })
-    ]
-    const groups = groupPRComments(comments)
-    expect(groups).toHaveLength(2)
-    expect(groups[0]).toEqual({ kind: 'standalone', comment: comments[0] })
-    expect(groups[1].kind).toBe('thread')
-    if (groups[1].kind === 'thread') {
-      expect(groups[1].root.id).toBe(2)
-      expect(groups[1].replies.map((r) => r.id)).toEqual([3])
-    }
-    expect(isResolvedPRCommentGroup(groups[1])).toBe(true)
-  })
-})
-
-describe('pr comment relative time', () => {
-  const now = Date.parse('2026-06-16T12:00:00Z')
-  it('formats buckets and rejects bad input', () => {
-    expect(formatPrCommentRelativeTime('2026-06-16T11:59:30Z', now)).toBe('just now')
-    expect(formatPrCommentRelativeTime('2026-06-16T11:30:00Z', now)).toBe('30m ago')
-    expect(formatPrCommentRelativeTime('2026-06-16T09:00:00Z', now)).toBe('3h ago')
-    expect(formatPrCommentRelativeTime('2026-06-10T12:00:00Z', now)).toBe('6d ago')
-    expect(formatPrCommentRelativeTime('not-a-date', now)).toBe('')
-  })
-})
diff --git a/mobile/src/components/pr-sidebar/pr-comment-time.ts b/mobile/src/components/pr-sidebar/pr-comment-time.ts
deleted file mode 100644
index 47d78ea8a2f..00000000000
--- a/mobile/src/components/pr-sidebar/pr-comment-time.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-// Relative timestamp for PR comments (ISO string in, "Xm/Xh/Xd/Xmo/Xy" out),
-// mirroring the desktop formatRelativeTime so the timeline reads the same. Pure +
-// unit-testable; nowMs is passed in (Date.now() is unavailable in some contexts).
-export function formatPrCommentRelativeTime(iso: string, nowMs: number): string {
-  const ts = Date.parse(iso)
-  if (Number.isNaN(ts)) {
-    return ''
-  }
-  const delta = nowMs - ts
-  if (delta < 60_000) {
-    return 'just now'
-  }
-  const minutes = Math.floor(delta / 60_000)
-  if (minutes < 60) {
-    return `${minutes}m ago`
-  }
-  const hours = Math.floor(minutes / 60)
-  if (hours < 24) {
-    return `${hours}h ago`
-  }
-  const days = Math.floor(hours / 24)
-  if (days < 30) {
-    return `${days}d ago`
-  }
-  const months = Math.floor(days / 30)
-  if (months < 12) {
-    return `${months}mo ago`
-  }
-  return `${Math.floor(months / 12)}y ago`
-}
diff --git a/mobile/src/files/file-tree.ts b/mobile/src/files/file-tree.ts
index 71f26ca155b..8a3e795ac2d 100644
--- a/mobile/src/files/file-tree.ts
+++ b/mobile/src/files/file-tree.ts
@@ -132,7 +132,7 @@ export function getDirectoryCacheState(
 ): DirectoryState | undefined {
   // Why: repository paths are arbitrary object keys; inherited keys like
   // "constructor" must not masquerade as loaded directory state.
-  return Object.prototype.hasOwnProperty.call(cache, relativePath) ? cache[relativePath] : undefined
+  return Object.hasOwn(cache, relativePath) ? cache[relativePath] : undefined
 }
 
 export function joinRelativePath(parentPath: string, name: string): string {
diff --git a/mobile/src/hooks/use-active-worktree-scroll.ts b/mobile/src/hooks/use-active-worktree-scroll.ts
index 7600f3ceafe..ff0441c85a8 100644
--- a/mobile/src/hooks/use-active-worktree-scroll.ts
+++ b/mobile/src/hooks/use-active-worktree-scroll.ts
@@ -37,7 +37,7 @@ export function useActiveWorktreeScroll<T extends WithId, S>(
     (worktreeId: string): boolean => {
       for (let sectionIndex = 0; sectionIndex < sections.length; sectionIndex++) {
         const itemIndex = sections[sectionIndex].data.findIndex((w) => w.worktreeId === worktreeId)
-        if (itemIndex >= 0) {
+        if (itemIndex !== -1) {
           sectionListRef.current?.scrollToLocation({
             sectionIndex,
             itemIndex,
diff --git a/mobile/src/session/MobileMarkdownReader.test.tsx b/mobile/src/session/MobileMarkdownReader.test.tsx
new file mode 100644
index 00000000000..c6ff322acba
--- /dev/null
+++ b/mobile/src/session/MobileMarkdownReader.test.tsx
@@ -0,0 +1,119 @@
+import { createElement, forwardRef, useImperativeHandle } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { MobileMarkdownReader } from './MobileMarkdownReader'
+import type { MarkdownDocState } from './mobile-session-route-types'
+
+const mocks = vi.hoisted(() => ({
+  dismissKeyboard: vi.fn(),
+  reportKeyboardInset: null as ((bottom: number) => void) | null
+}))
+
+vi.mock('react-native', async () => {
+  const React = await import('react')
+  return {
+    ActivityIndicator: 'ActivityIndicator',
+    Platform: { OS: 'ios', select: (choices: Record<string, unknown>) => choices.ios },
+    Pressable: ({ children, ...props }: { children?: unknown }) =>
+      React.createElement('Pressable', props, children),
+    StyleSheet: { create: (styles: unknown) => styles, hairlineWidth: 1 },
+    Text: 'Text',
+    View: 'View'
+  }
+})
+
+vi.mock('lucide-react-native', () => ({
+  ChevronDown: 'ChevronDown',
+  Keyboard: 'KeyboardIcon',
+  RefreshCw: 'RefreshCw'
+}))
+
+vi.mock('../components/MobileRichMarkdownEditor', () => {
+  const Editor = forwardRef(
+    (props: { onKeyboardInsetChange?: (bottom: number) => void }, ref: unknown) => {
+      mocks.reportKeyboardInset = props.onKeyboardInsetChange ?? null
+      useImperativeHandle(ref as never, () => ({ dismissKeyboard: mocks.dismissKeyboard }))
+      return createElement('MobileRichMarkdownEditor')
+    }
+  )
+  return { MobileRichMarkdownEditor: Editor }
+})
+
+const readyDoc: MarkdownDocState = {
+  status: 'ready',
+  content: '# Notes',
+  localContent: '# Notes',
+  baseVersion: '1',
+  isDirty: false,
+  editable: true
+}
+
+describe('MobileMarkdownReader', () => {
+  let renderer: ReactTestRenderer | null = null
+
+  function render(keyboardLift: number, doc: MarkdownDocState = readyDoc): ReactTestRenderer {
+    act(() => {
+      renderer = create(
+        createElement(MobileMarkdownReader, {
+          documentId: 'doc-1',
+          doc,
+          keyboardLift,
+          onRefresh: vi.fn(),
+          onChange: vi.fn(),
+          onSave: vi.fn(),
+          onCopy: vi.fn(),
+          onDiscard: vi.fn()
+        })
+      )
+    })
+    return renderer as unknown as ReactTestRenderer
+  }
+
+  function dismissButtons(instance: ReactTestRenderer) {
+    return instance.root.findAll(
+      (node) =>
+        typeof node.type === 'string' && node.props?.accessibilityLabel === 'Dismiss keyboard'
+    )
+  }
+
+  afterEach(() => {
+    act(() => renderer?.unmount())
+    renderer = null
+    mocks.reportKeyboardInset = null
+    vi.clearAllMocks()
+  })
+
+  it('offers keyboard dismissal while the keyboard covers the editor', () => {
+    const instance = render(291)
+
+    const [button] = dismissButtons(instance)
+    expect(button).toBeDefined()
+
+    act(() => button.props.onPress())
+
+    expect(mocks.dismissKeyboard).toHaveBeenCalledOnce()
+  })
+
+  it('hides the floating row entirely on a clean document with the keyboard closed', () => {
+    const instance = render(0)
+
+    expect(dismissButtons(instance)).toHaveLength(0)
+    expect(instance.root.findAllByType('Text')).toHaveLength(0)
+  })
+
+  it('keeps document actions available without offering dismissal when the keyboard is closed', () => {
+    const instance = render(0, { ...readyDoc, isDirty: true })
+
+    expect(dismissButtons(instance)).toHaveLength(0)
+    expect(instance.root.findAllByType('Text').length).toBeGreaterThan(0)
+  })
+
+  it('treats a WebView-reported inset as an open keyboard when native lift reports none', () => {
+    const instance = render(0)
+    expect(dismissButtons(instance)).toHaveLength(0)
+
+    act(() => mocks.reportKeyboardInset?.(291))
+
+    expect(dismissButtons(instance)).toHaveLength(1)
+  })
+})
diff --git a/mobile/src/session/MobileMarkdownReader.tsx b/mobile/src/session/MobileMarkdownReader.tsx
new file mode 100644
index 00000000000..a84599ded3a
--- /dev/null
+++ b/mobile/src/session/MobileMarkdownReader.tsx
@@ -0,0 +1,172 @@
+import { useRef, useState } from 'react'
+import { ActivityIndicator, Pressable, Text, View } from 'react-native'
+import { ChevronDown, Keyboard as KeyboardIcon, RefreshCw } from 'lucide-react-native'
+import {
+  MobileRichMarkdownEditor,
+  type MobileRichMarkdownEditorHandle
+} from '../components/MobileRichMarkdownEditor'
+import { colors, spacing } from '../theme/mobile-theme'
+import {
+  resolveMarkdownFloatingActionsBottom,
+  shouldShowMarkdownFloatingActions
+} from './markdown-floating-actions-layout'
+import type { MarkdownDocState } from './mobile-session-route-types'
+import { styles } from './mobile-session-styles'
+
+type Props = {
+  documentId: string
+  doc: MarkdownDocState | undefined
+  onRefresh: () => void
+  onChange: (content: string) => void
+  onSave: () => void
+  onCopy: () => void
+  onDiscard: () => void
+  keyboardLift: number
+}
+
+export function MobileMarkdownReader({
+  documentId,
+  doc,
+  onRefresh,
+  onChange,
+  onSave,
+  onCopy,
+  onDiscard,
+  keyboardLift
+}: Props) {
+  const editorRef = useRef<MobileRichMarkdownEditorHandle>(null)
+  // Native Keyboard events under-report the WebView editor's covered area, so prefer the larger WebView-measured inset.
+  const [webviewKeyboardInset, setWebviewKeyboardInset] = useState(0)
+  const effectiveKeyboardLift = Math.max(keyboardLift, webviewKeyboardInset)
+  const keyboardOpen = effectiveKeyboardLift > 0
+
+  if (!doc || doc.status === 'loading') {
+    return (
+      <View style={styles.markdownState}>
+        <ActivityIndicator size="small" color={colors.textSecondary} />
+      </View>
+    )
+  }
+  if (doc.status === 'error') {
+    return (
+      <View style={styles.markdownState}>
+        <Text style={styles.markdownError}>{doc.message}</Text>
+        <Pressable style={styles.markdownRefreshButton} onPress={onRefresh}>
+          <RefreshCw size={14} color={colors.textPrimary} />
+          <Text style={styles.markdownRefreshText}>Retry</Text>
+        </Pressable>
+      </View>
+    )
+  }
+
+  const statusText = doc.saveError
+    ? doc.saveError
+    : doc.readOnlyReason
+      ? 'Read only'
+      : doc.stale
+        ? 'Changed on desktop'
+        : null
+  const showRefresh = Boolean((doc.stale && !doc.isDirty) || !doc.editable)
+  const showCopy = Boolean(doc.saveError || !doc.editable)
+  const showSave = Boolean(doc.isDirty || doc.saving)
+  const showFloatingActions = shouldShowMarkdownFloatingActions({
+    keyboardLift: effectiveKeyboardLift,
+    hasStatus: statusText != null,
+    showRefresh,
+    showCopy,
+    showSave
+  })
+
+  return (
+    <View style={styles.markdownEditor}>
+      <MobileRichMarkdownEditor
+        ref={editorRef}
+        key={documentId}
+        content={doc.localContent}
+        editable={doc.editable && !doc.saving}
+        onChange={onChange}
+        onKeyboardInsetChange={setWebviewKeyboardInset}
+      />
+      {showFloatingActions ? (
+        <View
+          pointerEvents="box-none"
+          style={[
+            styles.markdownFloatingBar,
+            // Why: editor focus lives in a WebView, so lift native Save/Discard controls instead of resizing it.
+            {
+              bottom: resolveMarkdownFloatingActionsBottom({
+                keyboardLift: effectiveKeyboardLift,
+                restingBottom: spacing.lg,
+                liftedClearance: spacing.md
+              })
+            }
+          ]}
+        >
+          {statusText ? (
+            <Text
+              style={[styles.markdownFloatingStatus, doc.saveError ? styles.markdownError : null]}
+              numberOfLines={2}
+            >
+              {statusText}
+            </Text>
+          ) : null}
+          <View style={styles.markdownFloatingActions}>
+            {keyboardOpen ? (
+              <Pressable
+                style={[styles.markdownFloatingButton, styles.markdownKeyboardDismissButton]}
+                onPress={() => editorRef.current?.dismissKeyboard()}
+                hitSlop={8}
+                accessibilityRole="button"
+                accessibilityLabel="Dismiss keyboard"
+                accessibilityHint="Hides the software keyboard and keeps the markdown editor open."
+              >
+                <View style={styles.keyboardDismissGlyph}>
+                  <KeyboardIcon size={15} color={colors.textSecondary} strokeWidth={2} />
+                  <ChevronDown
+                    size={10}
+                    color={colors.textSecondary}
+                    strokeWidth={2.5}
+                    style={styles.keyboardDismissChevron}
+                  />
+                </View>
+              </Pressable>
+            ) : null}
+            {showCopy ? (
+              <Pressable style={styles.markdownFloatingButton} onPress={onCopy}>
+                <Text style={styles.markdownFloatingButtonText}>Copy</Text>
+              </Pressable>
+            ) : null}
+            {showRefresh ? (
+              <Pressable style={styles.markdownFloatingButton} onPress={onRefresh}>
+                <RefreshCw size={13} color={colors.textPrimary} />
+                <Text style={styles.markdownFloatingButtonText}>Refresh</Text>
+              </Pressable>
+            ) : null}
+            {doc.isDirty ? (
+              <Pressable style={styles.markdownFloatingButton} onPress={onDiscard}>
+                <Text style={styles.markdownFloatingButtonText}>Discard</Text>
+              </Pressable>
+            ) : null}
+            {showSave ? (
+              <Pressable
+                style={[
+                  styles.markdownFloatingButton,
+                  styles.markdownSaveButton,
+                  (!doc.editable || !doc.isDirty || doc.saving) && styles.markdownButtonDisabled
+                ]}
+                disabled={!doc.editable || !doc.isDirty || doc.saving}
+                onPress={onSave}
+              >
+                {doc.saving ? (
+                  <ActivityIndicator size="small" color={colors.textPrimary} />
+                ) : (
+                  <Text style={styles.markdownFloatingButtonText}>Save</Text>
+                )}
+              </Pressable>
+            ) : null}
+          </View>
+        </View>
+      ) : null}
+    </View>
+  )
+}
diff --git a/mobile/src/session/MobileNativeChatComposer.test.ts b/mobile/src/session/MobileNativeChatComposer.test.ts
index eaf50ba08ab..1d1b0288467 100644
--- a/mobile/src/session/MobileNativeChatComposer.test.ts
+++ b/mobile/src/session/MobileNativeChatComposer.test.ts
@@ -298,11 +298,12 @@ describe('MobileNativeChatComposer', () => {
   })
 
   it('moves the caret to the insert point after an autocomplete pick, then releases control', async () => {
+    const onChangeText = vi.fn()
     await act(async () => {
       renderer = create(
         createElement(MobileNativeChatComposer, {
           value: '/c',
-          onChangeText: vi.fn(),
+          onChangeText,
           onSend: vi.fn().mockResolvedValue(true),
           agent: 'claude'
         })
@@ -325,6 +326,7 @@ describe('MobileNativeChatComposer', () => {
       (node) => node.type === 'Pressable' && !node.props.accessibilityLabel
     )[0] as { props: { onPress: () => void } }
     await act(async () => firstSuggestion.props.onPress())
+    expect(onChangeText).toHaveBeenCalledWith('/clear ')
     // `/clear ` is 7 chars — the caret jumps just past the inserted command + space.
     expect(input().props.selection).toEqual({ start: 7, end: 7 })
     // The next native selection event releases control so manual placement still works.
diff --git a/mobile/src/session/MobileNativeChatMessage.tsx b/mobile/src/session/MobileNativeChatMessage.tsx
index 97e92decc4d..0a676061e5b 100644
--- a/mobile/src/session/MobileNativeChatMessage.tsx
+++ b/mobile/src/session/MobileNativeChatMessage.tsx
@@ -276,7 +276,6 @@ function AgentControls({
 
 function MobileNativeChatMessageImpl({
   message,
-  queued,
   toolsExpanded = false,
   fontScale = 1,
   messageIndex,
@@ -284,7 +283,6 @@ function MobileNativeChatMessageImpl({
   onOpenFile
 }: {
   message: NativeChatMessage
-  queued?: boolean
   toolsExpanded?: boolean
   /** Multiplies all chat text sizes for pinch-to-zoom (1 = no change). */
   fontScale?: number
@@ -328,27 +326,24 @@ function MobileNativeChatMessageImpl({
 
   // Copy + scroll-to-top, shown inline with the first tool call (or after the
   // prose when there are no tools).
-  const controls =
-    isAgent && !queued ? (
-      <AgentControls
-        onCopy={handleCopy}
-        onScrollToTop={
-          onScrollToMessage && messageIndex !== undefined
-            ? () => onScrollToMessage(messageIndex)
-            : undefined
-        }
-      />
-    ) : null
+  const controls = isAgent ? (
+    <AgentControls
+      onCopy={handleCopy}
+      onScrollToTop={
+        onScrollToMessage && messageIndex !== undefined
+          ? () => onScrollToMessage(messageIndex)
+          : undefined
+      }
+    />
+  ) : null
 
   return (
     <View style={[styles.row, isUser && styles.rowUser]}>
-      {isUser && queued ? <Text style={styles.queuedTag}>Queued</Text> : null}
       <View
         style={[
           styles.content,
           isUser && styles.userBubble,
           isReasoning && styles.reasoning,
-          queued && styles.queued,
           copied && styles.copied
         ]}
       >
diff --git a/mobile/src/session/MobileNativeChatView.test.ts b/mobile/src/session/MobileNativeChatView.test.ts
index fb4072c4f2d..1021671b837 100644
--- a/mobile/src/session/MobileNativeChatView.test.ts
+++ b/mobile/src/session/MobileNativeChatView.test.ts
@@ -71,6 +71,7 @@ type Overrides = {
   onClearSendError?: () => void
   inputLockReason?: 'disconnected' | 'waiting' | null
   onSend?: (text: string) => Promise<boolean>
+  pending?: Parameters<typeof MobileNativeChatView>[0]['pending']
 }
 
 function assistantTurn(id: string, text: string): NativeChatMessage {
@@ -117,6 +118,13 @@ describe('MobileNativeChatView', () => {
     return (list.props.data as { id: string }[]).map((row) => row.id)
   }
 
+  function renderedRow(id: string): ReturnType<typeof createElement> {
+    const list = renderer!.root.find((node) => node.type === 'FlatList')
+    const data = list.props.data as NativeChatMessage[]
+    const index = data.findIndex((row) => row.id === id)
+    return list.props.renderItem({ item: data[index], index })
+  }
+
   function banners(): ReactTestInstance[] {
     return renderer!.root.findAll((node) => node.props.accessibilityRole === 'alert')
   }
@@ -187,6 +195,15 @@ describe('MobileNativeChatView', () => {
     expect(listIds()).toEqual(['a1', 'streaming'])
   })
 
+  it('renders an accepted optimistic image send without a queued state', async () => {
+    await render({
+      pending: [{ id: 'pending-1', text: 'look', images: ['file:///phone-photo.jpg'] }]
+    })
+
+    expect(listIds()).toEqual(['pending-1'])
+    expect(renderedRow('pending-1').props).not.toHaveProperty('queued')
+  })
+
   it('keeps a visible lock through a subscribed-end lease blip', async () => {
     vi.useFakeTimers()
     try {
diff --git a/mobile/src/session/MobileNativeChatView.tsx b/mobile/src/session/MobileNativeChatView.tsx
index 697887bfe75..190001417a3 100644
--- a/mobile/src/session/MobileNativeChatView.tsx
+++ b/mobile/src/session/MobileNativeChatView.tsx
@@ -58,8 +58,7 @@ type Props = {
   loadingEarlier?: boolean
   onLoadEarlier?: () => void
   onSend: (text: string) => Promise<boolean>
-  /** Optimistic queued sends (owned by the route so they survive view switches). */
-  /** Optimistic user echoes, including any ridden-along image preview URIs. */
+  /** Accepted user echoes awaiting transcript replacement, including image previews. */
   pending: MobileNativeChatPendingItem[]
   /** Local photo URIs retained when the authoritative transcript replaces an
    *  optimistic image bubble. */
@@ -176,9 +175,8 @@ export function MobileNativeChatView({
     []
   )
 
-  const pendingIds = useMemo(() => new Set(pending.map((p) => p.id)), [pending])
   // `data` is the list source: folded transcript + synthetic streaming bubble +
-  // route-owned optimistic queued messages. Memoize on the same deps so the
+  // route-owned accepted echoes. Memoize on the same deps so the
   // downstream autoscroll effects/`renderItem` keep referential stability.
   const { data } = useMemo(
     () =>
@@ -248,7 +246,6 @@ export function MobileNativeChatView({
     ({ item, index }: { item: NativeChatMessage; index: number }) => (
       <MobileNativeChatMessage
         message={item}
-        queued={pendingIds.has(item.id)}
         toolsExpanded={toolsExpanded}
         fontScale={fontScale}
         messageIndex={index}
@@ -256,7 +253,7 @@ export function MobileNativeChatView({
         onOpenFile={onOpenFile}
       />
     ),
-    [pendingIds, toolsExpanded, fontScale, onScrollToMessage, onOpenFile]
+    [toolsExpanded, fontScale, onScrollToMessage, onOpenFile]
   )
 
   const emptyState = mobileNativeChatEmptyState(status, agent ?? null, error)
diff --git a/mobile/src/session/QuickCommandRow.tsx b/mobile/src/session/QuickCommandRow.tsx
new file mode 100644
index 00000000000..401305b298c
--- /dev/null
+++ b/mobile/src/session/QuickCommandRow.tsx
@@ -0,0 +1,199 @@
+import { useEffect, useRef, useState } from 'react'
+import { View, Text, Pressable, StyleSheet } from 'react-native'
+import * as Clipboard from 'expo-clipboard'
+import { Check, Copy, Pencil, Play, Trash2 } from 'lucide-react-native'
+import { colors, spacing, typography } from '../theme/mobile-theme'
+import { MobileAgentIcon } from '../components/MobileAgentIcon'
+import type { TerminalQuickCommand } from '../../../src/shared/types'
+import {
+  getQuickCommandDisplayPreview,
+  getTerminalQuickCommandBody,
+  isAgentQuickCommand
+} from '../terminal/quick-commands'
+
+type QuickCommandRowProps = {
+  command: TerminalQuickCommand
+  first: boolean
+  onLaunch: (command: TerminalQuickCommand) => void
+  onEdit: (command: TerminalQuickCommand) => void
+  onDelete: (command: TerminalQuickCommand) => void
+  disabled: boolean
+}
+
+type CopyFeedback = {
+  body: string
+  status: 'copied' | 'failed'
+}
+
+export function QuickCommandRow({
+  command,
+  first,
+  onLaunch,
+  onEdit,
+  onDelete,
+  disabled
+}: QuickCommandRowProps) {
+  const isAgent = isAgentQuickCommand(command)
+  const body = getTerminalQuickCommandBody(command)
+  const canCopy = body.trim().length > 0
+  // Why: key feedback to the copied body so a prop change drops stale labels
+  // without setState-in-effect (react-doctor no-adjust-state-on-prop-change).
+  const [feedback, setFeedback] = useState<CopyFeedback | null>(null)
+  const copyResetTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+  const mountedRef = useRef(true)
+  const copyStatus: 'idle' | 'copied' | 'failed' =
+    feedback != null && feedback.body === body ? feedback.status : 'idle'
+
+  useEffect(() => {
+    mountedRef.current = true
+    return () => {
+      mountedRef.current = false
+      if (copyResetTimerRef.current) {
+        clearTimeout(copyResetTimerRef.current)
+      }
+    }
+  }, [])
+
+  // Drop any pending reset timer when the body changes; display status is already idle.
+  useEffect(() => {
+    if (copyResetTimerRef.current) {
+      clearTimeout(copyResetTimerRef.current)
+      copyResetTimerRef.current = null
+    }
+  }, [body])
+
+  const handleCopy = async (): Promise<void> => {
+    if (!canCopy || disabled) {
+      return
+    }
+    try {
+      await Clipboard.setStringAsync(body)
+      if (!mountedRef.current) {
+        return
+      }
+      setFeedback({ body, status: 'copied' })
+    } catch {
+      if (!mountedRef.current) {
+        return
+      }
+      setFeedback({ body, status: 'failed' })
+    }
+    if (copyResetTimerRef.current) {
+      clearTimeout(copyResetTimerRef.current)
+    }
+    copyResetTimerRef.current = setTimeout(() => {
+      copyResetTimerRef.current = null
+      if (mountedRef.current) {
+        setFeedback(null)
+      }
+    }, 1500)
+  }
+
+  const copyDisabled = disabled || !canCopy
+  const copyLabel =
+    copyStatus === 'copied'
+      ? 'Copied'
+      : copyStatus === 'failed'
+        ? "Couldn't copy"
+        : canCopy
+          ? `Copy ${command.label}`
+          : 'Nothing to copy'
+  const copyIconColor =
+    copyStatus === 'copied'
+      ? colors.statusGreen
+      : copyStatus === 'failed'
+        ? colors.statusRed
+        : colors.textSecondary
+
+  return (
+    <View style={[styles.row, !first && styles.rowBorder, disabled && styles.disabled]}>
+      <Pressable
+        style={({ pressed }) => [styles.rowMain, pressed && !disabled && styles.pressed]}
+        disabled={disabled}
+        onPress={() => onLaunch(command)}
+        accessibilityRole="button"
+        accessibilityLabel={`Run ${command.label}`}
+      >
+        <View style={styles.rowIcon}>
+          {isAgent ? (
+            <MobileAgentIcon agentId={command.agent} size={16} />
+          ) : (
+            <Play size={14} color={colors.textPrimary} fill={colors.textPrimary} />
+          )}
+        </View>
+        <View style={styles.rowText}>
+          <Text style={styles.rowLabel} numberOfLines={1}>
+            {command.label}
+          </Text>
+          <Text style={[styles.rowPreview, !isAgent && styles.mono]} numberOfLines={1}>
+            {getQuickCommandDisplayPreview(command)}
+          </Text>
+        </View>
+      </Pressable>
+      <Pressable
+        style={({ pressed }) => [
+          styles.rowAction,
+          // Why: row already dims when `disabled`; only dim again for empty body.
+          !canCopy && styles.disabled,
+          pressed && !copyDisabled && styles.pressed
+        ]}
+        disabled={copyDisabled}
+        onPress={() => void handleCopy()}
+        accessibilityRole="button"
+        accessibilityLabel={copyLabel}
+        accessibilityState={{ disabled: copyDisabled }}
+      >
+        {copyStatus === 'copied' ? (
+          <Check size={15} color={copyIconColor} />
+        ) : (
+          <Copy size={15} color={copyIconColor} />
+        )}
+      </Pressable>
+      <Pressable
+        style={({ pressed }) => [styles.rowAction, pressed && !disabled && styles.pressed]}
+        disabled={disabled}
+        onPress={() => onEdit(command)}
+        accessibilityLabel={`Edit ${command.label}`}
+      >
+        <Pencil size={15} color={colors.textSecondary} />
+      </Pressable>
+      <Pressable
+        style={({ pressed }) => [styles.rowAction, pressed && !disabled && styles.pressed]}
+        disabled={disabled}
+        onPress={() => onDelete(command)}
+        accessibilityLabel={`Delete ${command.label}`}
+      >
+        <Trash2 size={15} color={colors.statusRed} />
+      </Pressable>
+    </View>
+  )
+}
+
+const styles = StyleSheet.create({
+  pressed: { backgroundColor: colors.bgRaised },
+  disabled: { opacity: 0.45 },
+  row: { flexDirection: 'row', alignItems: 'center' },
+  rowBorder: { borderTopWidth: StyleSheet.hairlineWidth, borderTopColor: colors.borderSubtle },
+  rowMain: {
+    flex: 1,
+    flexDirection: 'row',
+    alignItems: 'center',
+    gap: spacing.md,
+    paddingVertical: spacing.md,
+    paddingLeft: spacing.md,
+    minWidth: 0
+  },
+  rowIcon: {
+    width: 26,
+    height: 26,
+    borderRadius: 6,
+    backgroundColor: colors.bgRaised,
+    alignItems: 'center',
+    justifyContent: 'center'
+  },
+  rowText: { flex: 1, minWidth: 0 },
+  rowLabel: { fontSize: 14, fontWeight: '600', color: colors.textPrimary },
+  rowPreview: { fontSize: 12, color: colors.textSecondary, marginTop: 1 },
+  mono: { fontFamily: typography.monoFamily },
+  rowAction: { width: 40, height: 44, alignItems: 'center', justifyContent: 'center' }
+})
diff --git a/mobile/src/session/QuickCommandsList.test.ts b/mobile/src/session/QuickCommandsList.test.ts
index a396932acb6..37e41990a08 100644
--- a/mobile/src/session/QuickCommandsList.test.ts
+++ b/mobile/src/session/QuickCommandsList.test.ts
@@ -17,6 +17,7 @@ vi.mock('react-native', () => ({
 
 vi.mock('lucide-react-native', () => ({
   Check: 'Check',
+  Copy: 'Copy',
   Pencil: 'Pencil',
   Play: 'Play',
   Plus: 'Plus',
@@ -24,6 +25,8 @@ vi.mock('lucide-react-native', () => ({
   Trash2: 'Trash2'
 }))
 
+vi.mock('expo-clipboard', () => ({ setStringAsync: vi.fn() }))
+
 vi.mock('../components/MobileAgentIcon', () => ({ MobileAgentIcon: 'MobileAgentIcon' }))
 
 describe('QuickCommandsList search', () => {
diff --git a/mobile/src/session/QuickCommandsList.tsx b/mobile/src/session/QuickCommandsList.tsx
index 2c76884d335..e8781163691 100644
--- a/mobile/src/session/QuickCommandsList.tsx
+++ b/mobile/src/session/QuickCommandsList.tsx
@@ -1,14 +1,11 @@
 import { View, Text, Pressable, TextInput, StyleSheet, ActivityIndicator } from 'react-native'
-import { Pencil, Plus, Search, Trash2, Check, Play } from 'lucide-react-native'
-import { colors, spacing, typography } from '../theme/mobile-theme'
+import { Check, Plus, Search } from 'lucide-react-native'
+import { colors, spacing } from '../theme/mobile-theme'
 import { MobileAgentIcon } from '../components/MobileAgentIcon'
 import { MOBILE_AGENT_CATALOG } from '../tasks/mobile-agent-catalog'
 import type { TerminalQuickCommand, TuiAgent } from '../../../src/shared/types'
-import {
-  getQuickCommandDisplayPreview,
-  isAgentQuickCommand,
-  supportsTerminalAgentQuickCommand
-} from '../terminal/quick-commands'
+import { supportsTerminalAgentQuickCommand } from '../terminal/quick-commands'
+import { QuickCommandRow } from './QuickCommandRow'
 
 export const QUICK_COMMAND_SUPPORTED_AGENTS = MOBILE_AGENT_CATALOG.filter((entry) =>
   supportsTerminalAgentQuickCommand(entry.id)
@@ -162,67 +159,6 @@ function QuickCommandGroup({
   )
 }
 
-function QuickCommandRow({
-  command,
-  first,
-  onLaunch,
-  onEdit,
-  onDelete,
-  disabled
-}: {
-  command: TerminalQuickCommand
-  first: boolean
-  onLaunch: (command: TerminalQuickCommand) => void
-  onEdit: (command: TerminalQuickCommand) => void
-  onDelete: (command: TerminalQuickCommand) => void
-  disabled: boolean
-}) {
-  const isAgent = isAgentQuickCommand(command)
-  return (
-    <View style={[styles.row, !first && styles.rowBorder, disabled && styles.disabled]}>
-      <Pressable
-        style={({ pressed }) => [styles.rowMain, pressed && !disabled && styles.pressed]}
-        disabled={disabled}
-        onPress={() => onLaunch(command)}
-        accessibilityRole="button"
-        accessibilityLabel={`Run ${command.label}`}
-      >
-        <View style={styles.rowIcon}>
-          {isAgent ? (
-            <MobileAgentIcon agentId={command.agent} size={16} />
-          ) : (
-            <Play size={14} color={colors.textPrimary} fill={colors.textPrimary} />
-          )}
-        </View>
-        <View style={styles.rowText}>
-          <Text style={styles.rowLabel} numberOfLines={1}>
-            {command.label}
-          </Text>
-          <Text style={[styles.rowPreview, !isAgent && styles.mono]} numberOfLines={1}>
-            {getQuickCommandDisplayPreview(command)}
-          </Text>
-        </View>
-      </Pressable>
-      <Pressable
-        style={({ pressed }) => [styles.rowAction, pressed && !disabled && styles.pressed]}
-        disabled={disabled}
-        onPress={() => onEdit(command)}
-        accessibilityLabel={`Edit ${command.label}`}
-      >
-        <Pencil size={15} color={colors.textSecondary} />
-      </Pressable>
-      <Pressable
-        style={({ pressed }) => [styles.rowAction, pressed && !disabled && styles.pressed]}
-        disabled={disabled}
-        onPress={() => onDelete(command)}
-        accessibilityLabel={`Delete ${command.label}`}
-      >
-        <Trash2 size={15} color={colors.statusRed} />
-      </Pressable>
-    </View>
-  )
-}
-
 export function QuickCommandAgentPicker({
   selected,
   onSelect
@@ -292,15 +228,6 @@ const styles = StyleSheet.create({
   group: { backgroundColor: colors.bgPanel, borderRadius: 12, overflow: 'hidden' },
   row: { flexDirection: 'row', alignItems: 'center' },
   rowBorder: { borderTopWidth: StyleSheet.hairlineWidth, borderTopColor: colors.borderSubtle },
-  rowMain: {
-    flex: 1,
-    flexDirection: 'row',
-    alignItems: 'center',
-    gap: spacing.md,
-    paddingVertical: spacing.md,
-    paddingLeft: spacing.md,
-    minWidth: 0
-  },
   rowIcon: {
     width: 26,
     height: 26,
@@ -309,11 +236,6 @@ const styles = StyleSheet.create({
     alignItems: 'center',
     justifyContent: 'center'
   },
-  rowText: { flex: 1, minWidth: 0 },
-  rowLabel: { fontSize: 14, fontWeight: '600', color: colors.textPrimary },
-  rowPreview: { fontSize: 12, color: colors.textSecondary, marginTop: 1 },
-  mono: { fontFamily: typography.monoFamily },
-  rowAction: { width: 40, height: 44, alignItems: 'center', justifyContent: 'center' },
   agentLabel: { flex: 1, fontSize: 14, color: colors.textPrimary },
   addRow: {
     flexDirection: 'row',
diff --git a/mobile/src/session/markdown-floating-actions-layout.test.ts b/mobile/src/session/markdown-floating-actions-layout.test.ts
index 021b8de958c..a4e139acc2f 100644
--- a/mobile/src/session/markdown-floating-actions-layout.test.ts
+++ b/mobile/src/session/markdown-floating-actions-layout.test.ts
@@ -1,5 +1,8 @@
 import { describe, expect, it } from 'vitest'
-import { resolveMarkdownFloatingActionsBottom } from './markdown-floating-actions-layout'
+import {
+  resolveMarkdownFloatingActionsBottom,
+  shouldShowMarkdownFloatingActions
+} from './markdown-floating-actions-layout'
 
 describe('resolveMarkdownFloatingActionsBottom', () => {
   it('keeps markdown actions at their resting bottom when the keyboard is closed', () => {
@@ -22,3 +25,28 @@ describe('resolveMarkdownFloatingActionsBottom', () => {
     ).toBe(303)
   })
 })
+
+describe('shouldShowMarkdownFloatingActions', () => {
+  const idle = {
+    keyboardLift: 0,
+    hasStatus: false,
+    showRefresh: false,
+    showCopy: false,
+    showSave: false
+  }
+
+  it('shows the floating row for keyboard dismissal without document actions', () => {
+    expect(shouldShowMarkdownFloatingActions({ ...idle, keyboardLift: 291 })).toBe(true)
+  })
+
+  it('hides the floating row on a clean document with the keyboard closed', () => {
+    expect(shouldShowMarkdownFloatingActions(idle)).toBe(false)
+  })
+
+  it.each(['hasStatus', 'showRefresh', 'showCopy', 'showSave'] as const)(
+    'shows the floating row for %s alone',
+    (field) => {
+      expect(shouldShowMarkdownFloatingActions({ ...idle, [field]: true })).toBe(true)
+    }
+  )
+})
diff --git a/mobile/src/session/markdown-floating-actions-layout.ts b/mobile/src/session/markdown-floating-actions-layout.ts
index 06aa5b9223f..bc506a88a9d 100644
--- a/mobile/src/session/markdown-floating-actions-layout.ts
+++ b/mobile/src/session/markdown-floating-actions-layout.ts
@@ -9,3 +9,19 @@ export function resolveMarkdownFloatingActionsBottom({
 }): number {
   return keyboardLift > 0 ? keyboardLift + liftedClearance : restingBottom
 }
+
+export function shouldShowMarkdownFloatingActions({
+  keyboardLift,
+  hasStatus,
+  showRefresh,
+  showCopy,
+  showSave
+}: {
+  keyboardLift: number
+  hasStatus: boolean
+  showRefresh: boolean
+  showCopy: boolean
+  showSave: boolean
+}): boolean {
+  return keyboardLift > 0 || hasStatus || showRefresh || showCopy || showSave
+}
diff --git a/mobile/src/session/mobile-diff-review-screen-model.ts b/mobile/src/session/mobile-diff-review-screen-model.ts
index 3dcaed35716..f8f1ceedf99 100644
--- a/mobile/src/session/mobile-diff-review-screen-model.ts
+++ b/mobile/src/session/mobile-diff-review-screen-model.ts
@@ -100,7 +100,7 @@ export function nextReviewIndexAfterMarkReviewed({
   const wrappedIndex = filteredQueue.findIndex(
     (item) => item.key !== currentItemKey && !item.isReviewed
   )
-  const targetIndex = nextIndex >= 0 ? nextIndex : wrappedIndex >= 0 ? wrappedIndex : null
+  const targetIndex = nextIndex !== -1 ? nextIndex : wrappedIndex !== -1 ? wrappedIndex : null
   if (targetIndex === null) {
     return null
   }
diff --git a/mobile/src/session/mobile-native-chat-draft-reconcile.ts b/mobile/src/session/mobile-native-chat-draft-reconcile.ts
index 360fd22587b..a6f599b7458 100644
--- a/mobile/src/session/mobile-native-chat-draft-reconcile.ts
+++ b/mobile/src/session/mobile-native-chat-draft-reconcile.ts
@@ -87,7 +87,7 @@ export function mergeLandedImagePreviewEchoes(
   const entries = Object.entries(previous[sessionKey] ?? {})
   for (const preview of landed) {
     const existingIndex = entries.findIndex(([messageId]) => messageId === preview.messageId)
-    if (existingIndex >= 0) {
+    if (existingIndex !== -1) {
       entries.splice(existingIndex, 1)
     }
     entries.push([preview.messageId, preview.images])
diff --git a/mobile/src/session/mobile-native-chat-message-styles.ts b/mobile/src/session/mobile-native-chat-message-styles.ts
index df1bad92815..ad7cf4b4009 100644
--- a/mobile/src/session/mobile-native-chat-message-styles.ts
+++ b/mobile/src/session/mobile-native-chat-message-styles.ts
@@ -49,15 +49,6 @@ export const styles = StyleSheet.create({
   reasoning: {
     opacity: 0.7
   },
-  queued: {
-    opacity: 0.55
-  },
-  queuedTag: {
-    color: colors.textMuted,
-    fontSize: 11,
-    fontWeight: '600',
-    marginBottom: 2
-  },
   toolRun: {
     marginTop: spacing.xs
   },
diff --git a/mobile/src/session/mobile-native-chat-render-data.ts b/mobile/src/session/mobile-native-chat-render-data.ts
index 1ab2c0b03c3..73a45db6962 100644
--- a/mobile/src/session/mobile-native-chat-render-data.ts
+++ b/mobile/src/session/mobile-native-chat-render-data.ts
@@ -51,7 +51,7 @@ export function foldMobileNativeChatMessages(messages: NativeChatMessage[]): Nat
 
 /** Assemble the list data the chat renders: the folded transcript, then a
  *  synthetic bubble for the streaming text the gate let through, then the
- *  route-owned optimistic "queued" messages at the tail. */
+ *  route-owned accepted optimistic messages at the tail. */
 export function buildMobileNativeChatTransientData({
   folded,
   streaming,
diff --git a/mobile/src/session/mobile-native-chat-send-classification.ts b/mobile/src/session/mobile-native-chat-send-classification.ts
index 18568c05789..2a34efabdd2 100644
--- a/mobile/src/session/mobile-native-chat-send-classification.ts
+++ b/mobile/src/session/mobile-native-chat-send-classification.ts
@@ -2,7 +2,7 @@
 // (src/renderer/src/components/native-chat/NativeChatComposer.tsx): slash/skill
 // sends are TUI control actions, not chat turns — they never echo as a user
 // bubble, because the transcript will never contain a matching user turn and
-// the optimistic echo would sit at "Queued" forever.
+// the optimistic echo would never reconcile.
 
 import {
   getNativeChatAgentProfile,
diff --git a/mobile/src/session/mobile-native-chat-send.test.ts b/mobile/src/session/mobile-native-chat-send.test.ts
index ccdacfd7b3e..cc70e2e3b0f 100644
--- a/mobile/src/session/mobile-native-chat-send.test.ts
+++ b/mobile/src/session/mobile-native-chat-send.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { RpcClient } from '../transport/rpc-client'
 import { markRpcDeliveryUnknown } from '../transport/rpc-delivery-ambiguity'
 import { LogicalClientCutoverError } from '../transport/stable-logical-rpc-client'
@@ -7,10 +7,13 @@ import {
   openMobileNativeChatSendBudget,
   clearMobileNativeChatInput,
   sendMobileNativeChatMessage,
-  sendMobileNativeChatMessageWithOutcome
+  sendMobileNativeChatMessageWithOutcome,
+  typeMobileNativeChatCommandWithOutcome
 } from './mobile-native-chat-send'
 import { buildAgentTuiClearInputForText } from '../../../src/shared/agent-tui-input-clear'
 
+afterEach(() => vi.useRealTimers())
+
 function clientWithResponse(response: unknown): RpcClient {
   return {
     sendRequest: vi.fn().mockResolvedValue(response)
@@ -290,6 +293,65 @@ describe('sendMobileNativeChatMessage', () => {
   })
 })
 
+describe('typeMobileNativeChatCommandWithOutcome', () => {
+  it('writes the Codex picker command as keys instead of one pasted text write', async () => {
+    vi.useFakeTimers()
+    const client = clientWithResponse({
+      id: 'request',
+      ok: true,
+      result: { send: { accepted: true } },
+      _meta: { runtimeId: 'runtime' }
+    })
+    const result = typeMobileNativeChatCommandWithOutcome({
+      client,
+      terminal: 'term',
+      command: '/model'
+    })
+    await vi.runAllTimersAsync()
+
+    await expect(result).resolves.toBe('accepted')
+    expect(
+      vi.mocked(client.sendRequest).mock.calls.map((call) => {
+        const params = call[1] as { text: string; enter: boolean }
+        return { text: params.text, enter: params.enter }
+      })
+    ).toEqual(
+      ['\x15', '/', 'm', 'o', 'd', 'e', 'l', '\r'].map((text) => ({
+        text,
+        enter: false
+      }))
+    )
+  })
+
+  it('retires a parked launch draft only with the final typed Enter', async () => {
+    vi.useFakeTimers()
+    const client = clientWithResponse({
+      id: 'request',
+      ok: true,
+      result: { send: { accepted: true } },
+      _meta: { runtimeId: 'runtime' }
+    })
+    const result = typeMobileNativeChatCommandWithOutcome({
+      client,
+      terminal: 'term',
+      command: '/model',
+      resolvedLaunchDraft: { text: 'seed', createdAt: 7 }
+    })
+    await vi.runAllTimersAsync()
+    await result
+
+    const params = vi.mocked(client.sendRequest).mock.calls.map((call) => call[1]) as Array<{
+      text: string
+      resolvedLaunchDraft?: { text: string; createdAt: number }
+    }>
+    expect(params.slice(0, -1).every((entry) => entry.resolvedLaunchDraft === undefined)).toBe(true)
+    expect(params.at(-1)).toMatchObject({
+      text: '\r',
+      resolvedLaunchDraft: { text: 'seed', createdAt: 7 }
+    })
+  })
+})
+
 describe('clearMobileNativeChatInput', () => {
   const accepted = {
     id: 'request',
diff --git a/mobile/src/session/mobile-native-chat-send.ts b/mobile/src/session/mobile-native-chat-send.ts
index ce432c3efb9..28f91759168 100644
--- a/mobile/src/session/mobile-native-chat-send.ts
+++ b/mobile/src/session/mobile-native-chat-send.ts
@@ -2,6 +2,7 @@ import type { RpcClient } from '../transport/rpc-client'
 import { isRpcDeliveryUnknown } from '../transport/rpc-delivery-ambiguity'
 import { isLogicalClientCutoverError } from '../transport/stable-logical-rpc-client'
 import { isTerminalSendRpcAccepted } from '../terminal/terminal-send-rpc-response'
+import { typeAgentTuiCommand } from '../../../src/shared/agent-tui-command-typing'
 
 type MobileTerminalClient = {
   id: string
@@ -93,6 +94,35 @@ export async function sendMobileNativeChatMessage(
   return (await sendMobileNativeChatMessageWithOutcome(args)) === 'accepted'
 }
 
+export async function typeMobileNativeChatCommandWithOutcome(args: {
+  client: RpcClient
+  terminal: string
+  command: string
+  resolvedLaunchDraft?: { text: string; createdAt: number }
+  mobileClient?: MobileTerminalClient
+  deadline?: number
+}): Promise<MobileNativeChatSendOutcome> {
+  let writeIndex = 0
+  return typeAgentTuiCommand({
+    command: args.command,
+    write: (key) => {
+      const isSubmit = writeIndex === args.command.length + 1
+      writeIndex += 1
+      return sendMobileNativeChatMessageWithOutcome({
+        client: args.client,
+        terminal: args.terminal,
+        text: key,
+        enter: false,
+        ...(isSubmit && args.resolvedLaunchDraft
+          ? { resolvedLaunchDraft: args.resolvedLaunchDraft }
+          : {}),
+        ...(args.mobileClient ? { mobileClient: args.mobileClient } : {}),
+        ...(args.deadline === undefined ? {} : { deadline: args.deadline })
+      })
+    }
+  })
+}
+
 /**
  * Clear the agent's input line as its OWN write, before any body.
  *
diff --git a/mobile/src/session/mobile-session-review-comment-styles.ts b/mobile/src/session/mobile-session-review-comment-styles.ts
index 8d8b2d11ccd..a3b80615446 100644
--- a/mobile/src/session/mobile-session-review-comment-styles.ts
+++ b/mobile/src/session/mobile-session-review-comment-styles.ts
@@ -159,6 +159,11 @@ export const mobileSessionReviewCommentStyles = StyleSheet.create({
     paddingHorizontal: spacing.md,
     paddingVertical: spacing.xs
   },
+  markdownKeyboardDismissButton: {
+    width: 34,
+    justifyContent: 'center',
+    paddingHorizontal: 0
+  },
   markdownSaveButton: {
     backgroundColor: colors.bgRaised
   },
diff --git a/mobile/src/session/use-mobile-native-chat-message-send.test.ts b/mobile/src/session/use-mobile-native-chat-message-send.test.ts
index 06b30f5cdb4..dd67cf46da8 100644
--- a/mobile/src/session/use-mobile-native-chat-message-send.test.ts
+++ b/mobile/src/session/use-mobile-native-chat-message-send.test.ts
@@ -7,8 +7,10 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const sendWithOutcome = vi.fn()
 const clearInputWrite = vi.fn()
+const typeCommandWithOutcome = vi.fn()
 vi.mock('./mobile-native-chat-send', () => ({
   sendMobileNativeChatMessageWithOutcome: (...args: unknown[]) => sendWithOutcome(...args),
+  typeMobileNativeChatCommandWithOutcome: (...args: unknown[]) => typeCommandWithOutcome(...args),
   clearMobileNativeChatInput: (...args: unknown[]) => clearInputWrite(...args),
   openMobileNativeChatSendBudget: () => Date.now() + 15_000,
   MOBILE_NATIVE_CHAT_SEND_TIMEOUT_MS: 15_000,
@@ -84,6 +86,8 @@ describe('useMobileNativeChatMessageSend', () => {
     sendWithOutcome.mockResolvedValue('accepted')
     clearInputWrite.mockReset()
     clearInputWrite.mockResolvedValue(true)
+    typeCommandWithOutcome.mockReset()
+    typeCommandWithOutcome.mockResolvedValue('accepted')
     acceptSend.mockReset()
     holdUnconfirmedSend.mockReset()
     onCommandSend.mockReset()
@@ -215,24 +219,46 @@ describe('useMobileNativeChatMessageSend', () => {
     expect(onCommandSend).toHaveBeenCalledWith('/clear')
   })
 
-  it('never creates an optimistic echo for an unknown slash token', async () => {
-    // `/model` is not in Claude's autocomplete catalog, but the session-option
-    // recorder still recognizes it without claiming a generic command ran.
-    mount(() => null)
-    await act(async () => {
-      await api!.send('/model sonnet')
-    })
-    expect(acceptSend).not.toHaveBeenCalled()
-    expect(onCommandSend).toHaveBeenCalledWith('/model sonnet')
-  })
+  it.each(['claude', 'openclaude'] as const)(
+    'keeps %s composer slash sends pasted',
+    async (agent) => {
+      // `/model` is not in Claude's autocomplete catalog, but the session-option
+      // recorder still recognizes it without claiming a generic command ran.
+      mount(() => null, agent)
+      await act(async () => {
+        await api!.send('/model sonnet')
+      })
+      expect(acceptSend).not.toHaveBeenCalled()
+      expect(onCommandSend).toHaveBeenCalledWith('/model sonnet')
+      expect(sendWithOutcome).toHaveBeenCalledOnce()
+      expect(typeCommandWithOutcome).not.toHaveBeenCalled()
+    }
+  )
 
-  it('classifies per agent: /model is a catalog command for Codex', async () => {
+  it('types Codex composer slash sends instead of pasting them', async () => {
     mount(() => null, 'codex')
     await act(async () => {
       await api!.send('/model')
     })
     expect(acceptSend).not.toHaveBeenCalled()
     expect(onCommandSend).toHaveBeenCalledWith('/model')
+    expect(typeCommandWithOutcome).toHaveBeenCalledWith(
+      expect.objectContaining({ command: '/model', terminal: 'term' })
+    )
+    expect(sendWithOutcome).not.toHaveBeenCalled()
+  })
+
+  it('keeps Codex skill sends pasted', async () => {
+    mount(() => null, 'codex')
+    await act(async () => {
+      await api!.send('$ref-oss')
+    })
+    expect(acceptSend).not.toHaveBeenCalled()
+    expect(onCommandSend).toHaveBeenCalledWith('$ref-oss')
+    expect(sendWithOutcome).toHaveBeenCalledWith(
+      expect.objectContaining({ text: '$ref-oss', terminal: 'term' })
+    )
+    expect(typeCommandWithOutcome).not.toHaveBeenCalled()
   })
 
   it('holds only chat sends for transcript confirmation on a lost ack', async () => {
@@ -248,16 +274,44 @@ describe('useMobileNativeChatMessageSend', () => {
     expect(holdUnconfirmedSend).toHaveBeenCalledTimes(1)
   })
 
-  it('dispatchCommand surfaces the outcome without echo or composer sync', async () => {
-    mount(() => ({ text: DRAFT, createdAt: 1 }))
+  it.each(['claude', 'openclaude'] as const)(
+    'keeps %s session-option commands pasted',
+    async (agent) => {
+      mount(() => ({ text: DRAFT, createdAt: 1 }), agent)
+      let outcome: string | undefined
+      await act(async () => {
+        outcome = await api!.dispatchCommand('/model sonnet', { delivery: 'type' })
+      })
+      expect(outcome).toBe('accepted')
+      expect(acceptSend).not.toHaveBeenCalled()
+      expect(onCommandSend).not.toHaveBeenCalled()
+      expect(sentArgs().resolvedLaunchDraft).toBeUndefined()
+    }
+  )
+
+  it('routes typed picker commands around the pasted composer-text send', async () => {
+    mount(() => null, 'codex')
     let outcome: string | undefined
     await act(async () => {
-      outcome = await api!.dispatchCommand('/model sonnet')
+      outcome = await api!.dispatchCommand('/model', { delivery: 'type' })
     })
     expect(outcome).toBe('accepted')
-    expect(acceptSend).not.toHaveBeenCalled()
-    expect(onCommandSend).not.toHaveBeenCalled()
-    expect(sentArgs().resolvedLaunchDraft).toBeUndefined()
+    expect(typeCommandWithOutcome).toHaveBeenCalledWith(
+      expect.objectContaining({ command: '/model', terminal: 'term' })
+    )
+    expect(sendWithOutcome).not.toHaveBeenCalled()
+  })
+
+  it('types Codex session-option commands without caller delivery metadata', async () => {
+    mount(() => null, 'codex')
+    await act(async () => {
+      await api!.dispatchCommand('/model')
+    })
+
+    expect(typeCommandWithOutcome).toHaveBeenCalledWith(
+      expect.objectContaining({ command: '/model', terminal: 'term' })
+    )
+    expect(sendWithOutcome).not.toHaveBeenCalled()
   })
 
   it('binds classification to the agent that started the send', async () => {
diff --git a/mobile/src/session/use-mobile-native-chat-message-send.ts b/mobile/src/session/use-mobile-native-chat-message-send.ts
index 1d59e25431c..17f34b86d27 100644
--- a/mobile/src/session/use-mobile-native-chat-message-send.ts
+++ b/mobile/src/session/use-mobile-native-chat-message-send.ts
@@ -4,8 +4,11 @@ import {
   clearMobileNativeChatInput,
   openMobileNativeChatSendBudget,
   sendMobileNativeChatMessageWithOutcome,
+  typeMobileNativeChatCommandWithOutcome,
   type MobileNativeChatSendOutcome
 } from './mobile-native-chat-send'
+import type { CatalogCommandDelivery } from '../../../src/shared/agent-session-option-catalog'
+import { isSlashCommandDraft } from '../../../src/shared/native-chat-slash-commands'
 import { healMobileNativeChatStaleInput } from './mobile-native-chat-stale-input'
 import { classifyMobileNativeChatSend } from './mobile-native-chat-send-classification'
 import {
@@ -32,7 +35,10 @@ export type MobileNativeChatMessageSend = {
   answerQuestion: (text: string) => Promise<boolean>
   /** Session-option command dispatch (e.g. `/model sonnet`) — never touches the
    *  composer draft; callers need the outcome to track dispatched state. */
-  dispatchCommand: (text: string) => Promise<MobileNativeChatSendOutcome>
+  dispatchCommand: (
+    text: string,
+    options?: { delivery?: CatalogCommandDelivery }
+  ) => Promise<MobileNativeChatSendOutcome>
 }
 
 /** The native-chat send seam: one write path shared by composer sends, image
@@ -150,40 +156,42 @@ export function useMobileNativeChatMessageSend(args: {
           return 'rejected'
         }
       }
-      const outcome = await sendMobileNativeChatMessageWithOutcome({
-        client,
-        terminal: handle,
-        text,
-        // Why: pre-clear only when nothing was deliberately pasted first. The heal
-        // above fires only for terminals a mobile image paste marked, so a desktop
-        // launch-draft prefill parked on the input line would otherwise glue onto
-        // this message. An image send already led its own paste with Ctrl+U, and a
-        // second one here would wipe the image it just pasted (desktop's image path
-        // likewise clears once, before the paste, and never again).
-        //
-        // Also skipped once the dedicated clear above ran: the line is already
-        // empty, and a Ctrl+U written immediately before body text in the SAME
-        // write reaches the agent as a literal control character rather than a
-        // keypress (observed live as a stray \x15 heading the received message).
-        clearInputFirst: !images?.length && !seededLaunchDraft,
-        ...(syncComposer && typeof seededLaunchDraft?.createdAt === 'number'
-          ? {
-              resolvedLaunchDraft: {
-                text: seededLaunchDraft.text,
-                createdAt: seededLaunchDraft.createdAt
-              }
-            }
-          : {}),
-        deadline,
-        ...(deviceTokenRef.current
-          ? { mobileClient: { id: deviceTokenRef.current, type: 'mobile' } }
-          : {})
-      })
+      const classification = classifyMobileNativeChatSend(agent, text)
+      const mobileClient = deviceTokenRef.current
+        ? { id: deviceTokenRef.current, type: 'mobile' as const }
+        : undefined
+      const resolvedLaunchDraft =
+        syncComposer && typeof seededLaunchDraft?.createdAt === 'number'
+          ? { text: seededLaunchDraft.text, createdAt: seededLaunchDraft.createdAt }
+          : undefined
+      const outcome =
+        agent === 'codex' &&
+        classification !== 'chat' &&
+        isSlashCommandDraft(text) &&
+        !images?.length
+          ? await typeMobileNativeChatCommandWithOutcome({
+              client,
+              terminal: handle,
+              command: text,
+              ...(resolvedLaunchDraft ? { resolvedLaunchDraft } : {}),
+              ...(mobileClient ? { mobileClient } : {}),
+              deadline
+            })
+          : await sendMobileNativeChatMessageWithOutcome({
+              client,
+              terminal: handle,
+              text,
+              // Why: an image send already cleared before its paste; a second
+              // clear here would wipe the image before submission.
+              clearInputFirst: !images?.length && !seededLaunchDraft,
+              ...(resolvedLaunchDraft ? { resolvedLaunchDraft } : {}),
+              deadline,
+              ...(mobileClient ? { mobileClient } : {})
+            })
       // Why (desktop parity): a slash/skill send dispatches into the agent's own
       // TUI, not the conversation — the transcript never echoes it as a user
-      // turn, so an optimistic bubble would sit at "Queued" forever and the
+      // turn, so an optimistic bubble would never reconcile and the
       // unconfirmed hold could never observe a landing.
-      const classification = classifyMobileNativeChatSend(agent, text)
       if (outcome === 'unknown') {
         if (classification === 'chat') {
           // Why: an ack-lost send usually WAS delivered (issue seen on cellular
@@ -269,12 +277,41 @@ export function useMobileNativeChatMessageSend(args: {
   // spaces a send's body and its Enter ~500ms apart — so without this lock an
   // apply lands between them and is submitted as part of the user's prompt.
   const dispatchCommand = useCallback(
-    async (text: string): Promise<MobileNativeChatSendOutcome> => {
+    async (
+      text: string,
+      _options?: { delivery?: CatalogCommandDelivery }
+    ): Promise<MobileNativeChatSendOutcome> => {
       const terminal = handleRef.current
       if (terminal && !acquireMobileNativeChatTerminalWrite(terminal)) {
         return 'rejected'
       }
       try {
+        if (agentRef.current === 'codex') {
+          if (!client || !terminal || !enabled) {
+            return 'rejected'
+          }
+          const deadline = openMobileNativeChatSendBudget()
+          const mobileClient = deviceTokenRef.current
+            ? { id: deviceTokenRef.current, type: 'mobile' as const }
+            : undefined
+          if (
+            !(await healMobileNativeChatStaleInput({
+              client,
+              terminal,
+              deviceToken: deviceTokenRef.current,
+              deadline
+            }))
+          ) {
+            return 'rejected'
+          }
+          return typeMobileNativeChatCommandWithOutcome({
+            client,
+            terminal,
+            command: text,
+            ...(mobileClient ? { mobileClient } : {}),
+            deadline
+          })
+        }
         return await sendMessage(text, undefined, false, false)
       } finally {
         if (terminal) {
@@ -282,7 +319,7 @@ export function useMobileNativeChatMessageSend(args: {
         }
       }
     },
-    [handleRef, sendMessage]
+    [client, deviceTokenRef, enabled, handleRef, sendMessage]
   )
 
   return { send, sendWithOutcome, answerQuestion, dispatchCommand }
diff --git a/mobile/src/session/use-mobile-native-chat-session-options.test.ts b/mobile/src/session/use-mobile-native-chat-session-options.test.ts
index d7cab9a4c37..a587f3c5747 100644
--- a/mobile/src/session/use-mobile-native-chat-session-options.test.ts
+++ b/mobile/src/session/use-mobile-native-chat-session-options.test.ts
@@ -14,7 +14,7 @@ describe('useMobileNativeChatSessionOptions', () => {
   let renderer: ReactTestRenderer | null = null
   let api: MobileNativeChatSessionOptionsController | null = null
   let hookArgs: HookArgs
-  const dispatchCommand = vi.fn<(command: string) => Promise<MobileNativeChatSendOutcome>>()
+  const dispatchCommand = vi.fn<HookArgs['dispatchCommand']>()
   const onAgentPicker = vi.fn()
 
   function Probe(): null {
@@ -97,14 +97,23 @@ describe('useMobileNativeChatSessionOptions', () => {
     expect(api!.snapshot[0]).toMatchObject({ valueSource: 'unknown' })
   })
 
-  it('applies Codex model changes through the native command', async () => {
+  it('types the Codex picker command and switches to the terminal', async () => {
     mount({ agent: 'codex' })
-    expect(api!.snapshot[0]?.action).toBeUndefined()
+    expect(api!.snapshot[0]?.action).toEqual({ type: 'agent-picker' })
     await act(async () => {
-      await api!.setOption('model', 'gpt-5.5')
+      await api!.invokeAction('model')
     })
-    expect(dispatchCommand).toHaveBeenCalledWith('/model gpt-5.5')
-    expect(onAgentPicker).not.toHaveBeenCalled()
+    expect(dispatchCommand).toHaveBeenCalledWith('/model', { delivery: 'type' })
+    expect(onAgentPicker).toHaveBeenCalledOnce()
+  })
+
+  it('types the Codex effort picker command', async () => {
+    mount({ agent: 'codex', reportedModel: 'gpt-5.5' })
+    await act(async () => {
+      await api!.invokeAction('effort')
+    })
+    expect(dispatchCommand).toHaveBeenCalledWith('/model', { delivery: 'type' })
+    expect(onAgentPicker).toHaveBeenCalledOnce()
   })
 
   it('seeds the current model from a hook-reported provider model', () => {
diff --git a/mobile/src/session/use-mobile-native-chat-session-options.ts b/mobile/src/session/use-mobile-native-chat-session-options.ts
index 09779756631..66a929aeb56 100644
--- a/mobile/src/session/use-mobile-native-chat-session-options.ts
+++ b/mobile/src/session/use-mobile-native-chat-session-options.ts
@@ -2,6 +2,7 @@ import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } fr
 import {
   getAgentSessionOptionCatalog,
   type AgentSessionOptionCatalog,
+  type CatalogCommandDelivery,
   type CatalogModel
 } from '../../../src/shared/agent-session-option-catalog'
 import type {
@@ -95,7 +96,10 @@ export function useMobileNativeChatSessionOptions(args: {
   scopeKey: string | null
   /** Provider model from live agent status, when the hook reported one. */
   reportedModel: string | null
-  dispatchCommand: (command: string) => Promise<MobileNativeChatSendOutcome>
+  dispatchCommand: (
+    command: string,
+    options?: { delivery?: CatalogCommandDelivery }
+  ) => Promise<MobileNativeChatSendOutcome>
   /** A model change that must happen in the agent's own TUI picker was
    *  dispatched — bring the terminal view forward. */
   onAgentPicker?: () => void
@@ -297,7 +301,9 @@ export function useMobileNativeChatSessionOptions(args: {
                 ?.options.find((option) => option.id === id)?.apply
         const midSession = apply?.midSession
         if (midSession?.kind === 'agent-picker') {
-          const outcome = await dispatchCommand(midSession.command)
+          const outcome = midSession.delivery
+            ? await dispatchCommand(midSession.command, { delivery: midSession.delivery })
+            : await dispatchCommand(midSession.command)
           if (outcome === 'rejected') {
             return false
           }
diff --git a/mobile/src/session/use-mobile-native-chat-session.test.ts b/mobile/src/session/use-mobile-native-chat-session.test.ts
index dfe5f285937..2ff97a3370c 100644
--- a/mobile/src/session/use-mobile-native-chat-session.test.ts
+++ b/mobile/src/session/use-mobile-native-chat-session.test.ts
@@ -109,7 +109,10 @@ describe('useMobileNativeChatSession', () => {
       await Promise.resolve()
     })
 
-    expect(state?.messages).toEqual([])
+    // The retained window keeps rendering while the source is gone; what must
+    // never land is the page that resolved after it disappeared.
+    expect(state?.messages.map((entry) => entry.id)).not.toContain('stale-page')
+    expect(state?.messages).toHaveLength(40)
     expect(state?.status).toBe('idle')
     expect(state?.loadingEarlier).toBe(false)
   })
@@ -557,6 +560,30 @@ describe('useMobileNativeChatSession transcriptLoading', () => {
     })
   })
 
+  it('keeps the retained transcript rendered when the stream reports an error', async () => {
+    // A transient read failure must not blank a conversation the user is looking
+    // at; the last settled list for this identity stays until a read supersedes it.
+    let emitFrame: (frame: unknown) => void = () => {}
+    const client = {
+      subscribe: vi.fn((_method: string, _params: unknown, onData: (frame: unknown) => void) => {
+        emitFrame = onData
+        onData({ type: 'snapshot', messages: [message('a-1')], hasMore: false })
+        return () => {}
+      })
+    } as unknown as RpcClient
+    await mountAt(client, 'session-a')
+    expect(renders.at(-1)).toMatchObject({ status: 'ready', ids: ['a-1'] })
+
+    renders.length = 0
+    await act(async () => emitFrame({ type: 'error', message: 'stream broke' }))
+
+    expect(renders.at(-1)).toMatchObject({
+      status: 'error',
+      transcriptLoading: false,
+      ids: ['a-1']
+    })
+  })
+
   it('never holds a cached list across a host/workspace source change', async () => {
     const firstClient = {
       subscribe: vi.fn((_method: string, _params: unknown, onData: (frame: unknown) => void) => {
diff --git a/mobile/src/session/use-mobile-native-chat-session.ts b/mobile/src/session/use-mobile-native-chat-session.ts
index 656847079f9..a79b5648dd7 100644
--- a/mobile/src/session/use-mobile-native-chat-session.ts
+++ b/mobile/src/session/use-mobile-native-chat-session.ts
@@ -273,11 +273,12 @@ export function useMobileNativeChatSession(args: {
     })()
   }, [client, agent, sessionId, transcriptPath, hasMore, setList])
 
+  // Held for any unsettled read, not just an in-flight one: a stream error or a
+  // dropped client would otherwise trade the conversation for an error card.
   const visibleMessages = transcriptRetentionRef.current.visible({
     identity,
     messages,
-    settled: settledReady,
-    loading: status === 'loading'
+    settled: settledReady
   })
 
   return {
diff --git a/mobile/src/source-control/mobile-base-ref-search.test.ts b/mobile/src/source-control/mobile-base-ref-search.test.ts
deleted file mode 100644
index b59b4fe8da2..00000000000
--- a/mobile/src/source-control/mobile-base-ref-search.test.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { mapBaseRefResults } from './mobile-base-ref-search'
-
-describe('mapBaseRefResults', () => {
-  it('extracts a clean string list from a well-formed payload', () => {
-    expect(mapBaseRefResults({ refs: ['main', 'dev'] })).toEqual(['main', 'dev'])
-  })
-
-  it('returns [] for malformed payloads and drops bad entries', () => {
-    expect(mapBaseRefResults(null)).toEqual([])
-    expect(mapBaseRefResults({})).toEqual([])
-    expect(mapBaseRefResults({ refs: 'x' })).toEqual([])
-    expect(mapBaseRefResults({ refs: ['ok', 2, '', null, 'two'] })).toEqual(['ok', 'two'])
-  })
-})
diff --git a/mobile/src/source-control/mobile-base-ref-search.ts b/mobile/src/source-control/mobile-base-ref-search.ts
deleted file mode 100644
index 84a962a41e5..00000000000
--- a/mobile/src/source-control/mobile-base-ref-search.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-import type { RpcClient } from '../transport/rpc-client'
-import type { RpcSuccess } from '../transport/types'
-import { mobileRepoSelectorFromWorktreeId } from './mobile-pr-create'
-
-export function mapBaseRefResults(raw: unknown): string[] {
-  if (raw === null || typeof raw !== 'object') {
-    return []
-  }
-  const refs = (raw as { refs?: unknown }).refs
-  if (!Array.isArray(refs)) {
-    return []
-  }
-  return refs.filter((r): r is string => typeof r === 'string' && r.length > 0)
-}
-
-export async function searchBaseRefs(
-  client: Pick<RpcClient, 'sendRequest'>,
-  worktreeId: string,
-  query: string,
-  limit = 20
-): Promise<string[]> {
-  const response = await client.sendRequest('repo.searchRefs', {
-    repo: mobileRepoSelectorFromWorktreeId(worktreeId),
-    query,
-    limit
-  })
-  if (!response.ok) {
-    return []
-  }
-  return mapBaseRefResults((response as RpcSuccess).result)
-}
diff --git a/mobile/src/source-control/mobile-create-pr-action.test.ts b/mobile/src/source-control/mobile-create-pr-action.test.ts
index c665b034f7f..ec399b45913 100644
--- a/mobile/src/source-control/mobile-create-pr-action.test.ts
+++ b/mobile/src/source-control/mobile-create-pr-action.test.ts
@@ -1,8 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import type {
   HostedReviewCreationBlockedReason,
-  HostedReviewCreationEligibility,
-  HostedReviewProvider
+  HostedReviewCreationEligibility
 } from '../../../src/shared/hosted-review'
 import {
   buildMobileCreatePrAction,
@@ -146,7 +145,7 @@ describe('buildMobileCreatePrAction', () => {
 
   it('keeps a disabled status row for providers without review creation', () => {
     const { descriptor } = action({
-      eligibility: eligibility({ provider: 'bitbucket' as HostedReviewProvider })
+      eligibility: eligibility({ provider: 'unsupported' })
     })
 
     expect(descriptor).toMatchObject({
@@ -211,7 +210,7 @@ describe('cold-mount layout stability (issue #8411)', () => {
       'unsupported provider',
       {
         kind: 'ready',
-        eligibility: eligibility({ provider: 'bitbucket' as HostedReviewProvider })
+        eligibility: eligibility({ provider: 'unsupported' })
       } satisfies MobileCreatePrEligibilityState
     ],
     ['eligibility error', { kind: 'error' } satisfies MobileCreatePrEligibilityState]
diff --git a/mobile/src/source-control/mobile-create-pr-action.ts b/mobile/src/source-control/mobile-create-pr-action.ts
index fe75cc60a58..3268a1796c3 100644
--- a/mobile/src/source-control/mobile-create-pr-action.ts
+++ b/mobile/src/source-control/mobile-create-pr-action.ts
@@ -72,7 +72,7 @@ export function buildMobileCreatePrAction({
   }
   // Why: mirror desktop's structural provider gate (supportsHostedReviewCreation)
   // instead of relying on the host always emitting a hidden blockedReason for
-  // non-creatable providers like bitbucket.
+  // non-creatable providers.
   if (!supportsHostedReviewCreation(eligibility.provider)) {
     return {
       visible: true,
diff --git a/mobile/src/source-control/mobile-source-control-primary-action-decision.ts b/mobile/src/source-control/mobile-source-control-primary-action-decision.ts
deleted file mode 100644
index eb0927bcff6..00000000000
--- a/mobile/src/source-control/mobile-source-control-primary-action-decision.ts
+++ /dev/null
@@ -1,268 +0,0 @@
-import type { MobileGitUpstreamStatus } from './mobile-git-status'
-
-export type MobileSourceControlPrimaryActionKind =
-  | 'commit'
-  | 'stage'
-  | 'push'
-  | 'pull'
-  | 'sync'
-  | 'publish'
-
-export type MobileSourceControlRemoteOpKind =
-  | 'push'
-  | 'force_push'
-  | 'pull'
-  | 'sync'
-  | 'fetch'
-  | 'fast_forward'
-  | 'publish'
-  | 'rebase'
-
-export type MobileSourceControlPrimaryActionTitleIntent =
-  | 'commit_in_progress'
-  | 'force_push_in_progress'
-  | 'action_in_progress'
-  | 'remote_operation_in_progress'
-  | 'remote_operation_blocks_commit'
-  | 'resolve_conflicts_before_commit'
-  | 'commit_staged_changes'
-  | 'enter_commit_message'
-  | 'stage_all_changes'
-  | 'stage_file_to_commit'
-  | 'checkout_branch_before_publish'
-  | 'publish_branch'
-  | 'force_push_with_lease'
-  | 'sync_counts'
-  | 'pull_count'
-  | 'push_count'
-  | 'nothing_to_commit_up_to_date'
-
-export type MobileSourceControlPrimaryActionDecision = {
-  kind: MobileSourceControlPrimaryActionKind
-  disabled: boolean
-  labelIntent: MobileSourceControlPrimaryActionKind | 'force_push'
-  titleIntent: MobileSourceControlPrimaryActionTitleIntent
-  count?: number
-  ahead?: number
-  behind?: number
-  upstreamName?: string
-  requiresForceWithLease?: boolean
-}
-
-export type MobileSourceControlPrimaryActionDecisionInputs = {
-  stagedCount: number
-  hasUnstagedChanges: boolean
-  hasStageableChanges: boolean
-  hasPartiallyStagedChanges: boolean
-  hasMessage: boolean
-  hasUnresolvedConflicts: boolean
-  isCommitting: boolean
-  isRemoteOperationActive: boolean
-  upstreamStatus: MobileGitUpstreamStatus | undefined
-  inFlightRemoteOpKind?: MobileSourceControlRemoteOpKind | null
-  branchCommitsAhead?: number
-  hasCurrentBranch?: boolean
-}
-
-// Why: Metro cannot load runtime modules from the desktop/root `src/shared`
-// tree. Keep this mobile mirror narrow and parity-tested against the shared
-// commit-area decision core so the semantic ladder cannot drift silently.
-export function resolveMobileSourceControlCommitAreaPrimaryActionDecision(
-  inputs: MobileSourceControlPrimaryActionDecisionInputs
-): MobileSourceControlPrimaryActionDecision {
-  const {
-    stagedCount,
-    hasUnstagedChanges,
-    hasStageableChanges,
-    hasMessage,
-    hasUnresolvedConflicts,
-    isCommitting,
-    isRemoteOperationActive,
-    upstreamStatus,
-    branchCommitsAhead,
-    hasCurrentBranch = true
-  } = inputs
-
-  if (isCommitting) {
-    return {
-      kind: 'commit',
-      labelIntent: 'commit',
-      titleIntent: 'commit_in_progress',
-      disabled: true
-    }
-  }
-
-  if (isRemoteOperationActive) {
-    return resolveMobilePrimaryActionDuringRemoteOp(inputs)
-  }
-
-  if (hasUnresolvedConflicts) {
-    return {
-      kind: 'commit',
-      labelIntent: 'commit',
-      titleIntent: 'resolve_conflicts_before_commit',
-      disabled: true
-    }
-  }
-
-  const hasStaged = stagedCount > 0
-
-  if (hasStaged && hasMessage) {
-    return {
-      kind: 'commit',
-      labelIntent: 'commit',
-      titleIntent: 'commit_staged_changes',
-      disabled: false
-    }
-  }
-
-  if (hasStaged && !hasMessage) {
-    return {
-      kind: 'commit',
-      labelIntent: 'commit',
-      titleIntent: 'enter_commit_message',
-      disabled: true
-    }
-  }
-
-  if (!hasStaged && hasStageableChanges) {
-    return {
-      kind: 'stage',
-      labelIntent: 'stage',
-      titleIntent: 'stage_all_changes',
-      disabled: false
-    }
-  }
-
-  if (!upstreamStatus) {
-    return {
-      kind: 'commit',
-      labelIntent: 'commit',
-      titleIntent: 'stage_file_to_commit',
-      disabled: true
-    }
-  }
-
-  if (!upstreamStatus.hasUpstream) {
-    if (!hasCurrentBranch) {
-      return {
-        kind: 'commit',
-        labelIntent: 'commit',
-        titleIntent: 'checkout_branch_before_publish',
-        disabled: true
-      }
-    }
-    return {
-      kind: 'publish',
-      labelIntent: 'publish',
-      titleIntent: 'publish_branch',
-      disabled: false
-    }
-  }
-
-  if (upstreamStatus.ahead > 0 && upstreamStatus.behind > 0) {
-    if (shouldForcePushWithLeaseForMobileUpstream(upstreamStatus)) {
-      return {
-        kind: 'push',
-        labelIntent: 'force_push',
-        titleIntent: 'force_push_with_lease',
-        disabled: false,
-        count: branchCommitsAhead,
-        upstreamName: upstreamStatus.upstreamName,
-        requiresForceWithLease: true
-      }
-    }
-    return {
-      kind: 'sync',
-      labelIntent: 'sync',
-      titleIntent: 'sync_counts',
-      disabled: false,
-      ahead: upstreamStatus.ahead,
-      behind: upstreamStatus.behind
-    }
-  }
-
-  if (upstreamStatus.behind > 0) {
-    return {
-      kind: 'pull',
-      labelIntent: 'pull',
-      titleIntent: 'pull_count',
-      disabled: false,
-      count: upstreamStatus.behind
-    }
-  }
-
-  if (upstreamStatus.ahead > 0) {
-    return {
-      kind: 'push',
-      labelIntent: 'push',
-      titleIntent: 'push_count',
-      disabled: false,
-      count: upstreamStatus.ahead
-    }
-  }
-
-  return {
-    kind: 'commit',
-    labelIntent: 'commit',
-    titleIntent: hasUnstagedChanges ? 'stage_file_to_commit' : 'nothing_to_commit_up_to_date',
-    disabled: true
-  }
-}
-
-function resolveMobilePrimaryActionDuringRemoteOp(
-  inputs: MobileSourceControlPrimaryActionDecisionInputs
-): MobileSourceControlPrimaryActionDecision {
-  const { inFlightRemoteOpKind, hasUnresolvedConflicts } = inputs
-  const candidate = resolveMobileSourceControlCommitAreaPrimaryActionDecision({
-    ...inputs,
-    isRemoteOperationActive: false
-  })
-  const inFlightIsPrimaryKind =
-    inFlightRemoteOpKind === 'push' ||
-    inFlightRemoteOpKind === 'pull' ||
-    inFlightRemoteOpKind === 'sync' ||
-    inFlightRemoteOpKind === 'publish'
-
-  if (inFlightRemoteOpKind === 'force_push') {
-    return {
-      kind: 'push',
-      labelIntent: 'force_push',
-      titleIntent: 'force_push_in_progress',
-      disabled: true,
-      requiresForceWithLease: true
-    }
-  }
-
-  if (inFlightIsPrimaryKind && candidate.kind !== inFlightRemoteOpKind) {
-    return {
-      kind: inFlightRemoteOpKind,
-      labelIntent: inFlightRemoteOpKind,
-      titleIntent: 'action_in_progress',
-      disabled: true
-    }
-  }
-
-  const titleIntent = hasUnresolvedConflicts
-    ? 'resolve_conflicts_before_commit'
-    : candidate.kind === 'commit'
-      ? 'remote_operation_blocks_commit'
-      : 'remote_operation_in_progress'
-
-  return {
-    ...candidate,
-    titleIntent,
-    disabled: true
-  }
-}
-
-function shouldForcePushWithLeaseForMobileUpstream(
-  status: MobileGitUpstreamStatus | undefined
-): boolean {
-  return (
-    status?.hasUpstream === true &&
-    status.ahead > 0 &&
-    status.behind > 0 &&
-    status.behindCommitsArePatchEquivalent === true
-  )
-}
diff --git a/mobile/src/source-control/mobile-source-control-primary-action.test.ts b/mobile/src/source-control/mobile-source-control-primary-action.test.ts
index 0b127d9bde3..8314ecb2d80 100644
--- a/mobile/src/source-control/mobile-source-control-primary-action.test.ts
+++ b/mobile/src/source-control/mobile-source-control-primary-action.test.ts
@@ -1,9 +1,4 @@
 import { describe, expect, it, vi } from 'vitest'
-import { resolveSourceControlCommitAreaPrimaryActionDecision } from '../../../src/shared/source-control-primary-action-decision'
-import {
-  resolveMobileSourceControlCommitAreaPrimaryActionDecision,
-  type MobileSourceControlPrimaryActionDecisionInputs
-} from './mobile-source-control-primary-action-decision'
 import {
   buildMobileSourceControlPrimaryAction,
   type MobileSourceControlPrimaryActionArgs,
@@ -159,113 +154,3 @@ describe('buildMobileSourceControlPrimaryAction', () => {
     expect(action.disabled).toBe(false)
   })
 })
-
-function decisionInputs(
-  overrides: Partial<MobileSourceControlPrimaryActionDecisionInputs> = {}
-): MobileSourceControlPrimaryActionDecisionInputs {
-  return {
-    stagedCount: 0,
-    hasUnstagedChanges: false,
-    hasStageableChanges: false,
-    hasPartiallyStagedChanges: false,
-    hasMessage: false,
-    hasUnresolvedConflicts: false,
-    isCommitting: false,
-    isRemoteOperationActive: false,
-    upstreamStatus: undefined,
-    ...overrides
-  }
-}
-
-describe('mobile source-control primary action decision parity', () => {
-  it.each([
-    {
-      name: 'dirty tree stages first',
-      input: decisionInputs({
-        hasUnstagedChanges: true,
-        hasStageableChanges: true,
-        upstreamStatus: { hasUpstream: true, ahead: 0, behind: 2 }
-      })
-    },
-    {
-      name: 'staged message commits',
-      input: decisionInputs({ stagedCount: 1, hasMessage: true })
-    },
-    {
-      name: 'staged without message blocks commit',
-      input: decisionInputs({ stagedCount: 1, hasMessage: false })
-    },
-    {
-      name: 'unresolved conflicts block commit',
-      input: decisionInputs({ stagedCount: 1, hasMessage: true, hasUnresolvedConflicts: true })
-    },
-    {
-      name: 'unpublished branch publishes',
-      input: decisionInputs({
-        upstreamStatus: { hasUpstream: false, ahead: 0, behind: 0 },
-        hasCurrentBranch: true
-      })
-    },
-    {
-      name: 'detached head blocks publish',
-      input: decisionInputs({
-        upstreamStatus: { hasUpstream: false, ahead: 0, behind: 0 },
-        hasCurrentBranch: false
-      })
-    },
-    {
-      name: 'tracked ahead pushes',
-      input: decisionInputs({ upstreamStatus: { hasUpstream: true, ahead: 2, behind: 0 } })
-    },
-    {
-      name: 'tracked behind pulls',
-      input: decisionInputs({ upstreamStatus: { hasUpstream: true, ahead: 0, behind: 3 } })
-    },
-    {
-      name: 'tracked diverged syncs',
-      input: decisionInputs({ upstreamStatus: { hasUpstream: true, ahead: 2, behind: 3 } })
-    },
-    {
-      name: 'patch-equivalent diverged force-pushes with lease',
-      input: decisionInputs({
-        branchCommitsAhead: 4,
-        upstreamStatus: {
-          hasUpstream: true,
-          upstreamName: 'origin/feature',
-          ahead: 10,
-          behind: 2,
-          behindCommitsArePatchEquivalent: true
-        }
-      })
-    },
-    {
-      name: 'in-flight pull mirrors pull',
-      input: decisionInputs({
-        isRemoteOperationActive: true,
-        inFlightRemoteOpKind: 'pull',
-        upstreamStatus: { hasUpstream: true, ahead: 2, behind: 0 }
-      })
-    },
-    {
-      name: 'in-flight force push mirrors force push',
-      input: decisionInputs({
-        isRemoteOperationActive: true,
-        inFlightRemoteOpKind: 'force_push',
-        upstreamStatus: { hasUpstream: true, ahead: 2, behind: 0 }
-      })
-    },
-    {
-      name: 'in-flight push blocks committable candidate',
-      input: decisionInputs({
-        isRemoteOperationActive: true,
-        inFlightRemoteOpKind: 'push',
-        stagedCount: 1,
-        hasMessage: true
-      })
-    }
-  ])('matches the shared commit-area decision for $name', ({ input }) => {
-    expect(resolveMobileSourceControlCommitAreaPrimaryActionDecision(input)).toEqual(
-      resolveSourceControlCommitAreaPrimaryActionDecision(input)
-    )
-  })
-})
diff --git a/mobile/src/source-control/mobile-source-control-primary-action.ts b/mobile/src/source-control/mobile-source-control-primary-action.ts
index f62a7770d16..2a993967b52 100644
--- a/mobile/src/source-control/mobile-source-control-primary-action.ts
+++ b/mobile/src/source-control/mobile-source-control-primary-action.ts
@@ -1,14 +1,17 @@
 import {
-  resolveMobileSourceControlCommitAreaPrimaryActionDecision,
-  type MobileSourceControlPrimaryActionDecision,
-  type MobileSourceControlPrimaryActionKind,
-  type MobileSourceControlRemoteOpKind
-} from './mobile-source-control-primary-action-decision'
+  resolveSourceControlCommitAreaPrimaryActionDecision,
+  type SourceControlCommitAreaPrimaryActionDecision,
+  type SourceControlRemoteOpKind
+} from '../../../src/shared/source-control-primary-action-decision'
 import type { MobileGitBranchCompareResult } from './mobile-branch-compare'
 import type { MobileGitStatusResult } from './mobile-git-status'
 
 type GitStep = { method: string; params?: Record<string, unknown> }
 
+type MobileSourceControlPrimaryActionKind = SourceControlCommitAreaPrimaryActionDecision['kind']
+type MobileSourceControlPrimaryActionDecision = SourceControlCommitAreaPrimaryActionDecision
+type MobileSourceControlRemoteOpKind = SourceControlRemoteOpKind
+
 export type MobileSourceControlPrimaryAction = {
   kind: MobileSourceControlPrimaryActionKind
   label: string
@@ -44,7 +47,7 @@ export type MobileSourceControlPrimaryActionArgs = {
 export function buildMobileSourceControlPrimaryAction(
   args: MobileSourceControlPrimaryActionArgs
 ): MobileSourceControlPrimaryAction {
-  const decision = resolveMobileSourceControlCommitAreaPrimaryActionDecision({
+  const decision = resolveSourceControlCommitAreaPrimaryActionDecision({
     stagedCount: args.stagedCount,
     hasUnstagedChanges: args.unstagedCount > 0,
     hasStageableChanges: args.stageablePaths.length > 0,
@@ -167,8 +170,16 @@ function getMobilePrimaryActionHint(decision: MobileSourceControlPrimaryActionDe
       return 'Stage at least one file to commit.'
     case 'checkout_branch_before_publish':
       return 'Check out a branch before publishing commits.'
+    case 'checking_review_status':
+      return 'Checking review status.'
+    case 'review_already_merged':
+      return 'Nothing to commit. The review is already merged.'
     case 'publish_branch':
       return 'Publish this branch to origin.'
+    case 'push_linked_review':
+      return 'Push updates to the linked review branch.'
+    case 'linked_review_target_unavailable':
+      return 'The linked review branch is unavailable.'
     case 'force_push_with_lease':
       return 'Force push with lease to update the remote branch.'
     case 'sync_counts':
diff --git a/mobile/src/source-control/pr-compose-validation.test.ts b/mobile/src/source-control/pr-compose-validation.test.ts
deleted file mode 100644
index d0f76f55e4b..00000000000
--- a/mobile/src/source-control/pr-compose-validation.test.ts
+++ /dev/null
@@ -1,84 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  canSubmitPrCompose,
-  getPrComposeDisabledReason,
-  isBaseHeadDistinct
-} from './pr-compose-validation'
-
-describe('isBaseHeadDistinct', () => {
-  it('is true when base and head differ', () => {
-    expect(isBaseHeadDistinct('main', 'feature')).toBe(true)
-  })
-
-  it('is false when they match after normalization (case-insensitive, prefix-stripped)', () => {
-    expect(isBaseHeadDistinct('main', 'main')).toBe(false)
-    expect(isBaseHeadDistinct('refs/heads/main', 'main')).toBe(false)
-    expect(isBaseHeadDistinct('origin/Main', 'main')).toBe(false)
-    expect(isBaseHeadDistinct('upstream/main', 'refs/heads/main')).toBe(false)
-  })
-
-  it('is false for an empty base', () => {
-    expect(isBaseHeadDistinct('', 'feature')).toBe(false)
-  })
-})
-
-describe('canSubmitPrCompose', () => {
-  it('requires a non-empty title and a distinct base', () => {
-    expect(canSubmitPrCompose('Title', 'main', 'feature')).toBe(true)
-    expect(canSubmitPrCompose('   ', 'main', 'feature')).toBe(false)
-    expect(canSubmitPrCompose('Title', 'main', 'main')).toBe(false)
-  })
-})
-
-describe('getPrComposeDisabledReason', () => {
-  it('returns null when the form can submit', () => {
-    expect(
-      getPrComposeDisabledReason({
-        title: 'Title',
-        base: 'main',
-        head: 'feature',
-        generating: false,
-        reviewLabel: 'pull request'
-      })
-    ).toBeNull()
-  })
-
-  it('names the active blocker', () => {
-    expect(
-      getPrComposeDisabledReason({
-        title: 'Title',
-        base: 'main',
-        head: 'feature',
-        generating: true,
-        reviewLabel: 'pull request'
-      })
-    ).toBe('Wait for generation to finish.')
-    expect(
-      getPrComposeDisabledReason({
-        title: '',
-        base: 'main',
-        head: 'feature',
-        generating: false,
-        reviewLabel: 'merge request'
-      })
-    ).toBe('Enter a merge request title.')
-    expect(
-      getPrComposeDisabledReason({
-        title: 'Title',
-        base: '',
-        head: 'feature',
-        generating: false,
-        reviewLabel: 'pull request'
-      })
-    ).toBe('Choose a base branch.')
-    expect(
-      getPrComposeDisabledReason({
-        title: 'Title',
-        base: 'main',
-        head: 'main',
-        generating: false,
-        reviewLabel: 'pull request'
-      })
-    ).toBe('Base branch must differ from the head branch.')
-  })
-})
diff --git a/mobile/src/source-control/pr-compose-validation.ts b/mobile/src/source-control/pr-compose-validation.ts
deleted file mode 100644
index c04f5c3f5b2..00000000000
--- a/mobile/src/source-control/pr-compose-validation.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-// Ref normalizers ported from src/shared/hosted-review-refs.ts (value-imported, not
-// referenced across the package boundary — Metro's resolver is rooted at mobile/ and
-// can't bundle a runtime import from repo-root/src, unlike erased `import type`s).
-// Keep in sync with the shared versions so mobile and desktop compare refs identically.
-function normalizeHeadRef(ref: string): string {
-  return ref
-    .trim()
-    .replace(/^refs\/heads\//, '')
-    .replace(/^refs\/remotes\/[^/]+\//, '')
-}
-
-function normalizeBaseRef(ref: string): string {
-  return normalizeHeadRef(ref).replace(/^(origin|upstream)\//, '')
-}
-
-// Submit-gating for the create-PR composer, matching desktop CreatePullRequestDialog:
-// the base ref must be non-empty and must differ from the head branch after ref
-// normalization (strip refs/heads, remote prefixes, origin/upstream), case-insensitive.
-export function isBaseHeadDistinct(base: string, head: string): boolean {
-  const b = normalizeBaseRef(base).toLowerCase()
-  const h = normalizeHeadRef(head).toLowerCase()
-  return b.length > 0 && b !== h
-}
-
-export function canSubmitPrCompose(title: string, base: string, head: string): boolean {
-  return title.trim().length > 0 && isBaseHeadDistinct(base, head)
-}
-
-export function getPrComposeDisabledReason({
-  title,
-  base,
-  head,
-  generating,
-  reviewLabel
-}: {
-  title: string
-  base: string
-  head: string
-  generating: boolean
-  reviewLabel: string
-}): string | null {
-  if (generating) {
-    return 'Wait for generation to finish.'
-  }
-  if (title.trim().length === 0) {
-    return `Enter a ${reviewLabel} title.`
-  }
-  if (base.trim().length === 0) {
-    return 'Choose a base branch.'
-  }
-  if (!isBaseHeadDistinct(base, head)) {
-    return 'Base branch must differ from the head branch.'
-  }
-  return null
-}
diff --git a/mobile/src/tasks/mobile-github-project-group-sort.ts b/mobile/src/tasks/mobile-github-project-group-sort.ts
deleted file mode 100644
index 7b86d3c38c0..00000000000
--- a/mobile/src/tasks/mobile-github-project-group-sort.ts
+++ /dev/null
@@ -1,261 +0,0 @@
-export type GitHubProjectSortDirection = 'ASC' | 'DESC'
-
-export type GitHubProjectFieldValue =
-  | { kind: 'text'; text: string }
-  | { kind: 'number'; number: number }
-  | { kind: 'date'; date: string }
-  | { kind: 'single-select'; optionId: string; name: string }
-  | { kind: 'iteration'; iterationId: string; title: string }
-  | { kind: 'labels'; labels: Array<{ name: string }> }
-  | { kind: 'users'; users: Array<{ login: string }> }
-
-export type GitHubProjectField = {
-  id: string
-  name: string
-  kind: string
-  options?: Array<{ id: string }>
-  iterations?: Array<{
-    id: string
-    title?: string
-    startDate: string
-    duration: number
-    completed: boolean
-  }>
-}
-
-export type GitHubProjectRow = {
-  position?: number | null
-  fieldValuesByFieldId: Record<string, GitHubProjectFieldValue>
-}
-
-export type GitHubProjectSort = {
-  direction: GitHubProjectSortDirection
-  field: GitHubProjectField
-}
-
-export type GitHubProjectTable = {
-  selectedView: {
-    groupByFields: GitHubProjectField[]
-    sortByFields: GitHubProjectSort[]
-  }
-  rows: GitHubProjectRow[]
-}
-
-export type ProjectGroup = {
-  key: string
-  label: string
-  iteration: {
-    startDate: string
-    duration: number
-    completed: boolean
-  } | null
-  rows: GitHubProjectRow[]
-}
-
-const EMPTY_GROUP_KEY = '__empty__'
-const UNKNOWN_INDEX_SENTINEL = Number.MAX_SAFE_INTEGER
-
-function labelForEmpty(field: GitHubProjectField): string {
-  return `No ${field.name}`
-}
-
-function deriveStringValue(value: GitHubProjectFieldValue): string {
-  switch (value.kind) {
-    case 'text':
-      return value.text
-    case 'number':
-      return String(value.number)
-    case 'date':
-      return value.date
-    case 'single-select':
-      return value.name
-    case 'iteration':
-      return value.title
-    case 'labels':
-      return value.labels.map((label) => label.name).join(', ')
-    case 'users':
-      return value.users.map((user) => user.login).join(', ')
-  }
-}
-
-function getFieldValueForGrouping(
-  row: GitHubProjectRow,
-  field: GitHubProjectField
-): { key: string; label: string; orderHint: number; iteration: ProjectGroup['iteration'] } {
-  const value = row.fieldValuesByFieldId[field.id]
-  if (!value) {
-    return {
-      key: EMPTY_GROUP_KEY,
-      label: labelForEmpty(field),
-      orderHint: UNKNOWN_INDEX_SENTINEL,
-      iteration: null
-    }
-  }
-  if (field.kind === 'iteration' && value.kind === 'iteration') {
-    const iterations = field.iterations ?? []
-    const idx = iterations.findIndex((it) => it.id === value.iterationId)
-    const meta = iterations.find((it) => it.id === value.iterationId)
-    return {
-      key: value.iterationId,
-      label: value.title || meta?.title || 'Iteration',
-      orderHint: idx === -1 ? UNKNOWN_INDEX_SENTINEL - 1 : idx,
-      iteration: meta
-        ? { startDate: meta.startDate, duration: meta.duration, completed: meta.completed }
-        : null
-    }
-  }
-  if (field.kind === 'single-select' && value.kind === 'single-select') {
-    const idx = (field.options ?? []).findIndex((option) => option.id === value.optionId)
-    return {
-      key: value.optionId,
-      label: value.name,
-      orderHint: idx === -1 ? UNKNOWN_INDEX_SENTINEL - 1 : idx,
-      iteration: null
-    }
-  }
-  const label = deriveStringValue(value)
-  return { key: `raw:${label}`, label, orderHint: 0, iteration: null }
-}
-
-export function groupRows(
-  table: GitHubProjectTable,
-  rowsInOrder: GitHubProjectRow[]
-): ProjectGroup[] {
-  const groupField = table.selectedView.groupByFields[0]
-  if (!groupField) {
-    return [{ key: 'all', label: '', iteration: null, rows: rowsInOrder }]
-  }
-  const buckets = new Map<
-    string,
-    {
-      label: string
-      orderHint: number
-      iteration: ProjectGroup['iteration']
-      rows: GitHubProjectRow[]
-    }
-  >()
-  for (const row of rowsInOrder) {
-    const { key, label, orderHint, iteration } = getFieldValueForGrouping(row, groupField)
-    let bucket = buckets.get(key)
-    if (!bucket) {
-      bucket = { label, orderHint, iteration, rows: [] }
-      buckets.set(key, bucket)
-    }
-    bucket.rows.push(row)
-  }
-  const entries = Array.from(buckets.entries())
-  entries.sort((a, b) => {
-    if (a[0] === EMPTY_GROUP_KEY) {
-      return 1
-    }
-    if (b[0] === EMPTY_GROUP_KEY) {
-      return -1
-    }
-    if (groupField.kind === 'iteration' || groupField.kind === 'single-select') {
-      return a[1].orderHint - b[1].orderHint
-    }
-    return a[1].label.localeCompare(b[1].label)
-  })
-  return entries.map(([key, value]) => ({
-    key,
-    label: value.label,
-    iteration: value.iteration,
-    rows: value.rows
-  }))
-}
-
-function compareSort(a: GitHubProjectRow, b: GitHubProjectRow, sort: GitHubProjectSort): number {
-  const field = sort.field
-  const aValue = a.fieldValuesByFieldId[field.id]
-  const bValue = b.fieldValuesByFieldId[field.id]
-  if (!aValue && !bValue) {
-    return 0
-  }
-  if (!aValue) {
-    return 1
-  }
-  if (!bValue) {
-    return -1
-  }
-
-  let cmp = 0
-  if (
-    field.kind === 'single-select' &&
-    aValue.kind === 'single-select' &&
-    bValue.kind === 'single-select'
-  ) {
-    const options = field.options ?? []
-    const aIdx = options.findIndex((option) => option.id === aValue.optionId)
-    const bIdx = options.findIndex((option) => option.id === bValue.optionId)
-    cmp =
-      (aIdx === -1 ? UNKNOWN_INDEX_SENTINEL : aIdx) - (bIdx === -1 ? UNKNOWN_INDEX_SENTINEL : bIdx)
-  } else if (
-    field.kind === 'iteration' &&
-    aValue.kind === 'iteration' &&
-    bValue.kind === 'iteration'
-  ) {
-    const iterations = field.iterations ?? []
-    const aIdx = iterations.findIndex((iteration) => iteration.id === aValue.iterationId)
-    const bIdx = iterations.findIndex((iteration) => iteration.id === bValue.iterationId)
-    cmp =
-      (aIdx === -1 ? UNKNOWN_INDEX_SENTINEL : aIdx) - (bIdx === -1 ? UNKNOWN_INDEX_SENTINEL : bIdx)
-  } else if (aValue.kind === 'number' && bValue.kind === 'number') {
-    cmp = aValue.number - bValue.number
-  } else if (aValue.kind === 'date' && bValue.kind === 'date') {
-    cmp = aValue.date.localeCompare(bValue.date)
-  } else if (aValue.kind === 'text' && bValue.kind === 'text') {
-    cmp = aValue.text.localeCompare(bValue.text)
-  } else if (aValue.kind === 'users' && bValue.kind === 'users') {
-    const aLogin = aValue.users[0]?.login ?? ''
-    const bLogin = bValue.users[0]?.login ?? ''
-    if (!aLogin && !bLogin) {
-      cmp = 0
-    } else if (!aLogin) {
-      cmp = 1
-    } else if (!bLogin) {
-      cmp = -1
-    } else {
-      cmp = aLogin.localeCompare(bLogin)
-    }
-  } else if (aValue.kind === 'labels' && bValue.kind === 'labels') {
-    const aName = aValue.labels[0]?.name ?? ''
-    const bName = bValue.labels[0]?.name ?? ''
-    if (!aName && !bName) {
-      cmp = 0
-    } else if (!aName) {
-      cmp = 1
-    } else if (!bName) {
-      cmp = -1
-    } else {
-      cmp = aName.localeCompare(bName)
-    }
-  } else {
-    return 0
-  }
-  return sort.direction === 'DESC' ? -cmp : cmp
-}
-
-export function sortRows(table: GitHubProjectTable, rows: GitHubProjectRow[]): GitHubProjectRow[] {
-  const sorts = table.selectedView.sortByFields
-  const out = [...rows]
-  out.sort((a, b) => {
-    for (const sort of sorts) {
-      const cmp = compareSort(a, b, sort)
-      if (cmp !== 0) {
-        return cmp
-      }
-    }
-    return (a.position ?? UNKNOWN_INDEX_SENTINEL) - (b.position ?? UNKNOWN_INDEX_SENTINEL)
-  })
-  return out
-}
-
-export function isIterationCurrent(iteration: { startDate: string; duration: number }): boolean {
-  const start = new Date(`${iteration.startDate}T00:00:00Z`).getTime()
-  if (Number.isNaN(start)) {
-    return false
-  }
-  const end = start + iteration.duration * 86_400_000
-  const now = Date.now()
-  return now >= start && now < end
-}
diff --git a/mobile/src/terminal/quick-commands.ts b/mobile/src/terminal/quick-commands.ts
index 40f92a55439..d6e6b86caf3 100644
--- a/mobile/src/terminal/quick-commands.ts
+++ b/mobile/src/terminal/quick-commands.ts
@@ -2,6 +2,7 @@ import type { TerminalQuickCommand, TuiAgent } from '../../../src/shared/types'
 import {
   applyTerminalQuickCommandMutation,
   flattenTerminalQuickCommand,
+  getTerminalQuickCommandBody,
   isTerminalAgentQuickCommand,
   MAX_QUICK_COMMANDS,
   MAX_QUICK_COMMAND_AGENT_PROMPT_LENGTH,
@@ -20,6 +21,7 @@ import { MOBILE_TUI_AGENT_LABELS } from '../tasks/mobile-tui-agents'
 // — agent-branded labels, native row truncation, and the launch plan — live here.
 export {
   isTerminalAgentQuickCommand as isAgentQuickCommand,
+  getTerminalQuickCommandBody,
   terminalQuickCommandMatchesRepo as quickCommandMatchesRepo,
   supportsTerminalAgentQuickCommand,
   MAX_QUICK_COMMANDS,
diff --git a/mobile/src/terminal/terminal-settings-screen-styles.ts b/mobile/src/terminal/terminal-settings-screen-styles.ts
new file mode 100644
index 00000000000..a3ff5c8dd6d
--- /dev/null
+++ b/mobile/src/terminal/terminal-settings-screen-styles.ts
@@ -0,0 +1,91 @@
+import { StyleSheet } from 'react-native'
+import { colors, radii, spacing, typography } from '../theme/mobile-theme'
+
+export const terminalSettingsScreenStyles = StyleSheet.create({
+  container: {
+    flex: 1,
+    backgroundColor: colors.bgBase,
+    paddingHorizontal: spacing.lg,
+    paddingTop: 0
+  },
+  topRow: {
+    flexDirection: 'row',
+    alignItems: 'center',
+    marginTop: spacing.sm,
+    marginBottom: spacing.lg
+  },
+  backButton: {
+    width: 36,
+    height: 36,
+    borderRadius: 18,
+    alignItems: 'center',
+    justifyContent: 'center',
+    marginRight: spacing.sm
+  },
+  heading: {
+    fontSize: 20,
+    fontWeight: '700',
+    color: colors.textPrimary
+  },
+  scrollContent: {
+    paddingBottom: spacing.xl
+  },
+  groupHeading: {
+    fontSize: 11,
+    fontWeight: '600',
+    color: colors.textMuted,
+    letterSpacing: 0.5,
+    marginBottom: spacing.xs,
+    paddingHorizontal: spacing.xs
+  },
+  groupDescription: {
+    fontSize: typography.bodySize - 1,
+    color: colors.textSecondary,
+    lineHeight: 20,
+    paddingHorizontal: spacing.xs
+  },
+  section: {
+    backgroundColor: colors.bgPanel,
+    borderRadius: radii.card,
+    overflow: 'hidden'
+  },
+  sectionTopGap: {
+    marginTop: spacing.sm
+  },
+  inputGroupGap: {
+    marginTop: spacing.xl
+  },
+  emptyText: {
+    fontSize: typography.bodySize,
+    color: colors.textSecondary,
+    padding: spacing.md
+  },
+  row: {
+    flexDirection: 'row',
+    alignItems: 'center',
+    gap: spacing.sm + 2,
+    paddingVertical: spacing.md,
+    paddingHorizontal: spacing.md + 2
+  },
+  rowPressed: {
+    backgroundColor: colors.bgRaised
+  },
+  rowContent: {
+    flex: 1
+  },
+  rowLabel: {
+    fontSize: typography.bodySize,
+    fontWeight: '500',
+    color: colors.textPrimary
+  },
+  rowSublabel: {
+    fontSize: typography.bodySize - 2,
+    color: colors.textSecondary,
+    marginTop: 2
+  },
+  separator: {
+    height: StyleSheet.hairlineWidth,
+    backgroundColor: colors.borderSubtle,
+    marginHorizontal: spacing.md
+  }
+})
diff --git a/mobile/src/transport/host-store.ts b/mobile/src/transport/host-store.ts
index 99421ffd192..c32ac44ac77 100644
--- a/mobile/src/transport/host-store.ts
+++ b/mobile/src/transport/host-store.ts
@@ -182,7 +182,7 @@ async function persistHost(host: HostProfile, requireExisting: boolean): Promise
         }
       }
       let next: StoredHostProfile[]
-      if (index >= 0) {
+      if (index !== -1) {
         updatedExistingHost = true
         // Why: an authoritative save is the safe point to collapse pre-existing duplicate rows to the preserved host id.
         next = hosts
@@ -195,7 +195,7 @@ async function persistHost(host: HostProfile, requireExisting: boolean): Promise
         next = [...hosts.filter(({ id }) => !duplicateHostIds.has(id)), stored]
       }
       if (duplicateHostIds.size > 0) {
-        if (index < 0) {
+        if (index === -1) {
           // Why: process death between the early token write and metadata publication must leave cleanup discoverable.
           await recordHostCredentialCleanupIntent(stored.id)
           cleanupIntentRecordedBeforeMetadata = true
@@ -304,7 +304,7 @@ export async function updateHostNameAndEndpoint(
 ): Promise<void> {
   await mutateStoredHosts((hosts) => {
     const index = hosts.findIndex((host) => host.id === hostId)
-    if (index < 0) {
+    if (index === -1) {
       throw new Error('Host not found')
     }
     const next = hosts.slice()
@@ -321,7 +321,7 @@ export async function updateLastConnected(hostId: string): Promise<void> {
   try {
     await mutateStoredHosts((hosts) => {
       const index = hosts.findIndex((h) => h.id === hostId)
-      if (index < 0) {
+      if (index === -1) {
         return hosts
       }
       const next = hosts.slice()
diff --git a/mobile/src/transport/mobile-relay-host-overlay-store.ts b/mobile/src/transport/mobile-relay-host-overlay-store.ts
index 7f1519eb5c9..4960fbec3f0 100644
--- a/mobile/src/transport/mobile-relay-host-overlay-store.ts
+++ b/mobile/src/transport/mobile-relay-host-overlay-store.ts
@@ -80,7 +80,7 @@ export async function saveMobileRelayHostOverlay(overlay: MobileRelayHostOverlay
   const validated = MobileRelayHostOverlaySchema.parse(overlay)
   return mutateOverlays((overlays) => {
     const index = overlays.findIndex(({ hostId }) => hostId === validated.hostId)
-    if (index < 0) {
+    if (index === -1) {
       return [...overlays, validated]
     }
     const next = overlays.slice()
diff --git a/mobile/src/transport/pairing-connection-attempt.test.ts b/mobile/src/transport/pairing-connection-attempt.test.ts
deleted file mode 100644
index b05867eb7c0..00000000000
--- a/mobile/src/transport/pairing-connection-attempt.test.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { startPairingConnectionAttempt } from './pairing-connection-attempt'
-
-describe('pairing connection attempt cleanup', () => {
-  afterEach(() => {
-    vi.useRealTimers()
-  })
-
-  it('closes the temporary client when the overall pairing timeout fires', () => {
-    vi.useFakeTimers()
-    const closeClient = vi.fn()
-
-    const attempt = startPairingConnectionAttempt({ timeoutMs: 25_000, closeClient })
-
-    expect(attempt.timedOut).toBe(false)
-    vi.advanceTimersByTime(24_999)
-    expect(closeClient).not.toHaveBeenCalled()
-
-    vi.advanceTimersByTime(1)
-    expect(attempt.timedOut).toBe(true)
-    expect(closeClient).toHaveBeenCalledTimes(1)
-
-    attempt.dispose()
-    expect(closeClient).toHaveBeenCalledTimes(1)
-  })
-
-  it('clears the timeout and closes the temporary client when disposed early', () => {
-    vi.useFakeTimers()
-    const closeClient = vi.fn()
-
-    const attempt = startPairingConnectionAttempt({ timeoutMs: 25_000, closeClient })
-    attempt.dispose()
-
-    expect(attempt.timedOut).toBe(false)
-    expect(closeClient).toHaveBeenCalledTimes(1)
-
-    vi.advanceTimersByTime(25_000)
-    expect(attempt.timedOut).toBe(false)
-    expect(closeClient).toHaveBeenCalledTimes(1)
-  })
-})
diff --git a/mobile/src/transport/pairing-connection-attempt.ts b/mobile/src/transport/pairing-connection-attempt.ts
deleted file mode 100644
index 0a2d564949a..00000000000
--- a/mobile/src/transport/pairing-connection-attempt.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-export type PairingConnectionAttempt = {
-  readonly timedOut: boolean
-  dispose: () => void
-}
-
-export function startPairingConnectionAttempt({
-  timeoutMs,
-  closeClient
-}: {
-  timeoutMs: number
-  closeClient: () => void
-}): PairingConnectionAttempt {
-  let disposed = false
-  let clientClosed = false
-  let timedOut = false
-  let timer: ReturnType<typeof setTimeout> | null = null
-
-  function closeClientOnce() {
-    if (clientClosed) {
-      return
-    }
-    clientClosed = true
-    closeClient()
-  }
-
-  function dispose() {
-    if (disposed) {
-      return
-    }
-    disposed = true
-    if (timer) {
-      clearTimeout(timer)
-      timer = null
-    }
-    closeClientOnce()
-  }
-
-  timer = setTimeout(() => {
-    timer = null
-    timedOut = true
-    dispose()
-  }, timeoutMs)
-
-  return {
-    get timedOut() {
-      return timedOut
-    },
-    dispose
-  }
-}
diff --git a/mobile/src/transport/rpc-response-shape.ts b/mobile/src/transport/rpc-response-shape.ts
index 54903f5f3e1..61ecaf57362 100644
--- a/mobile/src/transport/rpc-response-shape.ts
+++ b/mobile/src/transport/rpc-response-shape.ts
@@ -13,7 +13,7 @@ export function isRpcResponse(value: unknown): value is RpcResponse {
     return false
   }
   if (response.ok === true) {
-    return Object.prototype.hasOwnProperty.call(response, 'result')
+    return Object.hasOwn(response, 'result')
   }
   return (
     response.ok === false &&
diff --git a/native/computer-use-linux/runtime.py b/native/computer-use-linux/runtime.py
index baeed544bd6..ac53f6cf65f 100644
--- a/native/computer-use-linux/runtime.py
+++ b/native/computer-use-linux/runtime.py
@@ -408,8 +408,11 @@ def render_accessibility_tree(root, window_rect, root_path, compact_browser_tabs
         item = record(node, len(records), path, window_rect)
         child_items = list(children(node))
         role_key = (item["controlType"] or "").lower()
-        summary_values = text_snippets(node, limit=8, max_depth=4)
-        generic_summary = " ".join(summary_values) if role_key in {"panel", "filler", "unknown", "section"} and not item["name"] and not item["value"] and len(summary_values) >= 2 and is_plain_text_subtree(node) else None
+        generic_summary = None
+        if role_key in {"panel", "filler", "unknown", "section"} and not item["name"] and not item["value"]:
+            summary_values = text_snippets(node, limit=8, max_depth=4)
+            if len(summary_values) >= 2 and is_plain_text_subtree(node):
+                generic_summary = " ".join(summary_values)
         if should_elide(item, len(child_items), generic_summary):
             for child_index, child in child_items:
                 walk(child, depth, path + [child_index])
diff --git a/native/computer-use-linux/runtime_render_test.py b/native/computer-use-linux/runtime_render_test.py
new file mode 100644
index 00000000000..83a600c7d2d
--- /dev/null
+++ b/native/computer-use-linux/runtime_render_test.py
@@ -0,0 +1,198 @@
+import importlib.util
+import sys
+import types
+import unittest
+from pathlib import Path
+
+
+class FakeStateType:
+    PROTECTED = 1
+    SELECTED = 2
+
+
+class FakeText:
+    @staticmethod
+    def get_character_count(node):
+        return len(node.value)
+
+    @staticmethod
+    def get_text(node, start, end):
+        return node.value[start:end]
+
+
+def load_runtime():
+    gi = types.ModuleType("gi")
+    repository = types.ModuleType("gi.repository")
+    gi.require_version = lambda *_: None
+    repository.Atspi = types.SimpleNamespace(StateType=FakeStateType, Text=FakeText)
+    repository.Gdk = types.SimpleNamespace()
+    repository.GdkPixbuf = types.SimpleNamespace()
+    gi.repository = repository
+    sys.modules["gi"] = gi
+    sys.modules["gi.repository"] = repository
+
+    path = Path(__file__).with_name("runtime.py")
+    spec = importlib.util.spec_from_file_location("orca_linux_runtime_test", path)
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+runtime = load_runtime()
+
+
+class FakeAccessible:
+    def __init__(self, role, name="", value="", children=(), counter=None):
+        self.role = role
+        self.name = name
+        self.value = value
+        self.children = list(children)
+        self.counter = counter or {"child_reads": 0}
+        for child in self.children:
+            child.use_counter(self.counter)
+
+    def use_counter(self, counter):
+        self.counter = counter
+        for child in self.children:
+            child.use_counter(counter)
+
+    def get_child_count(self):
+        self.counter["child_reads"] += 1
+        return len(self.children)
+
+    def get_child_at_index(self, index):
+        self.counter["child_reads"] += 1
+        return self.children[index]
+
+    def get_role_name(self):
+        return self.role
+
+    def get_name(self):
+        return self.name
+
+    def get_accessible_id(self):
+        return ""
+
+    def get_toolkit_name(self):
+        return "fake"
+
+    def get_component_iface(self):
+        return None
+
+    def get_state_set(self):
+        return None
+
+    def get_n_actions(self):
+        return 0
+
+    def is_text(self):
+        return bool(self.value)
+
+    def get_text_iface(self):
+        return self if self.value else None
+
+    def get_value_iface(self):
+        return None
+
+
+class FailingChildrenAccessible(FakeAccessible):
+    def get_child_count(self):
+        raise RuntimeError("defunct node")
+
+
+def render(root):
+    return runtime.render_accessibility_tree(root, None, [0])
+
+
+class RuntimeRenderTest(unittest.TestCase):
+    def test_named_non_generic_node_skips_unused_summary_walk(self):
+        root = FakeAccessible("button", "Save", children=[FakeAccessible("text", "unused")])
+
+        records, lines, truncation = render(root)
+
+        self.assertEqual([record["name"] for record in records], ["Save"])
+        self.assertEqual(lines, ["0 button Save"])
+        self.assertEqual(root.counter["child_reads"], 2)
+        self.assertFalse(truncation["truncated"])
+
+    def test_named_generic_node_skips_unused_summary_walk(self):
+        root = FakeAccessible("section", "Details", children=[FakeAccessible("text", "body")])
+
+        records, lines, _ = render(root)
+
+        self.assertEqual([record["name"] for record in records], ["Details", "body"])
+        self.assertEqual(lines, ["0 section Details", "\t1 text body"])
+        self.assertEqual(root.counter["child_reads"], 3)
+
+    def test_unnamed_generic_node_keeps_plain_text_summary(self):
+        root = FakeAccessible(
+            "section",
+            children=[FakeAccessible("text", "Alpha"), FakeAccessible("text", "Beta")],
+        )
+
+        records, lines, _ = render(root)
+
+        self.assertEqual(len(records), 1)
+        self.assertEqual(lines, ["0 section, Text: Alpha Beta"])
+        self.assertEqual(root.counter["child_reads"], 13)
+
+    def test_row_keeps_its_specific_summary_walk(self):
+        root = FakeAccessible(
+            "row",
+            "Invoice",
+            children=[FakeAccessible("text", "Alpha"), FakeAccessible("text", "Beta")],
+        )
+
+        records, lines, _ = render(root)
+
+        self.assertEqual([record["name"] for record in records], ["Invoice", "Alpha", "Beta"])
+        self.assertEqual(lines, ["0 row Invoice, Text: Alpha Beta", "\t1 text Alpha", "\t2 text Beta"])
+        self.assertEqual(root.counter["child_reads"], 10)
+
+    def test_empty_generic_wrapper_keeps_elision_path_and_depth(self):
+        root = FakeAccessible("section", children=[FakeAccessible("button", "Continue")])
+
+        records, lines, _ = render(root)
+
+        self.assertEqual([record["runtimeId"] for record in records], [[0, 0]])
+        self.assertEqual(lines, ["0 button Continue"])
+
+    def test_child_failure_keeps_fail_soft_row_output(self):
+        root = FailingChildrenAccessible("row", "Invoice")
+
+        records, lines, truncation = render(root)
+
+        self.assertEqual([record["name"] for record in records], ["Invoice"])
+        self.assertEqual(lines, ["0 row Invoice"])
+        self.assertFalse(truncation["truncated"])
+
+    def test_node_limit_keeps_exact_prefix_and_truncation(self):
+        root = FakeAccessible(
+            "document",
+            "Results",
+            children=[FakeAccessible("text", f"Item {index}") for index in range(runtime.MAX_NODES)],
+        )
+
+        records, _, truncation = render(root)
+
+        self.assertEqual(len(records), runtime.MAX_NODES)
+        self.assertEqual(records[-1]["name"], f"Item {runtime.MAX_NODES - 2}")
+        self.assertTrue(truncation["truncated"])
+        self.assertFalse(truncation["maxDepthReached"])
+
+    def test_depth_limit_keeps_exact_prefix_and_flag(self):
+        root = FakeAccessible("document", "Depth 65")
+        for depth in range(runtime.MAX_DEPTH, -1, -1):
+            root = FakeAccessible("document", f"Depth {depth}", children=[root])
+
+        records, _, truncation = render(root)
+
+        self.assertEqual(len(records), runtime.MAX_DEPTH + 1)
+        self.assertEqual(records[-1]["name"], f"Depth {runtime.MAX_DEPTH}")
+        self.assertTrue(truncation["truncated"])
+        self.assertTrue(truncation["maxDepthReached"])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/native/computer-use-windows/runtime-render.test.ps1 b/native/computer-use-windows/runtime-render.test.ps1
new file mode 100644
index 00000000000..3e52b1a203e
--- /dev/null
+++ b/native/computer-use-windows/runtime-render.test.ps1
@@ -0,0 +1,224 @@
+$ErrorActionPreference = "Stop"
+
+function Assert-TestEqual($Actual, $Expected, [string]$Label) {
+    if ($Actual -ne $Expected) {
+        throw "$Label expected '$Expected', received '$Actual'"
+    }
+}
+
+Add-Type -TypeDefinition @"
+using System.Collections;
+using System.Collections.Generic;
+
+public sealed class OrcaRenderTestCounter {
+    public int FindAll;
+}
+
+public sealed class OrcaRenderTestBounds {
+    public bool IsEmpty = true;
+    public double X;
+    public double Y;
+    public double Width;
+    public double Height;
+}
+
+public sealed class OrcaRenderTestControlType {
+    public string ProgrammaticName = "";
+}
+
+public sealed class OrcaRenderTestCurrent {
+    public string AutomationId = "";
+    public OrcaRenderTestBounds BoundingRectangle = new OrcaRenderTestBounds();
+    public string ClassName = "fake";
+    public OrcaRenderTestControlType ControlType = new OrcaRenderTestControlType();
+    public bool IsPassword;
+    public string LocalizedControlType = "";
+    public string Name = "";
+    public long NativeWindowHandle;
+}
+
+public sealed class OrcaRenderTestPatternCurrent {
+    public bool IsSelected;
+    public string Value = "";
+}
+
+public sealed class OrcaRenderTestPattern {
+    public OrcaRenderTestPatternCurrent Current = new OrcaRenderTestPatternCurrent();
+}
+
+public sealed class OrcaRenderTestCollection : IEnumerable {
+    private readonly OrcaRenderTestElement[] values;
+
+    public OrcaRenderTestCollection(OrcaRenderTestElement[] values) {
+        this.values = values;
+    }
+
+    public int Count {
+        get { return values.Length; }
+    }
+
+    public OrcaRenderTestElement Item(int index) {
+        return values[index];
+    }
+
+    public IEnumerator GetEnumerator() {
+        return values.GetEnumerator();
+    }
+}
+
+public sealed class OrcaRenderTestElement {
+    public readonly List<OrcaRenderTestElement> Children =
+        new List<OrcaRenderTestElement>();
+    public OrcaRenderTestCounter Counter = new OrcaRenderTestCounter();
+    public readonly OrcaRenderTestCurrent Current = new OrcaRenderTestCurrent();
+    public bool FailFindAll;
+    public int RuntimeIdValue;
+    public string ValueText = "";
+
+    public OrcaRenderTestCollection FindAll(object scope, object condition) {
+        Counter.FindAll++;
+        if (FailFindAll) {
+            throw new System.InvalidOperationException("defunct node");
+        }
+        return new OrcaRenderTestCollection(Children.ToArray());
+    }
+
+    public OrcaRenderTestPattern GetCurrentPattern(object pattern) {
+        OrcaRenderTestPattern result = new OrcaRenderTestPattern();
+        result.Current.Value = ValueText;
+        return result;
+    }
+
+    public int[] GetRuntimeId() {
+        return new int[] { RuntimeIdValue };
+    }
+
+    public object[] GetSupportedPatterns() {
+        return new object[0];
+    }
+}
+"@
+
+function New-TestCounter {
+    New-Object -TypeName OrcaRenderTestCounter
+}
+
+function New-TestElement {
+    param(
+        [string]$Role,
+        [string]$Name = "",
+        [string]$Value = "",
+        [object[]]$Children = @(),
+        $Counter = $(New-TestCounter),
+        [switch]$FailFindAll,
+        [int]$RuntimeId = 1
+    )
+    $element = New-Object -TypeName OrcaRenderTestElement
+    $element.Counter = $Counter
+    $element.FailFindAll = [bool]$FailFindAll
+    $element.RuntimeIdValue = $RuntimeId
+    $element.ValueText = $Value
+    $element.Current.ControlType.ProgrammaticName = $Role
+    $element.Current.LocalizedControlType = $Role
+    $element.Current.Name = $Name
+    foreach ($child in @($Children)) {
+        [void]$element.Children.Add($child)
+    }
+    $element
+}
+
+$operationPath = Join-Path ([IO.Path]::GetTempPath()) ("orca-runtime-render-test-" + [guid]::NewGuid() + ".json")
+try {
+    Set-Content -LiteralPath $operationPath -Encoding UTF8 -Value '{"tool":"handshake"}'
+    $runtimeOutput = . (Join-Path $PSScriptRoot "runtime.ps1") -OperationPath $operationPath
+    $handshake = $runtimeOutput | ConvertFrom-Json
+    Assert-TestEqual $handshake.ok $true "runtime handshake"
+
+    $counter = New-TestCounter
+    $leaf = New-TestElement -Role "text" -Name "unused" -Counter $counter -RuntimeId 2
+    $root = New-TestElement -Role "button" -Name "Save" -Children @($leaf) -Counter $counter
+    $tree = Render-OrcaTree $root $null
+    Assert-TestEqual $tree.elements.Count 1 "named control record count"
+    Assert-TestEqual ([string]$tree.lines[0]) "0 button Save" "named control line"
+    Assert-TestEqual $counter.findAll 1 "named control child enumeration"
+
+    $counter = New-TestCounter
+    $leaf = New-TestElement -Role "text" -Name "body" -Counter $counter -RuntimeId 2
+    $root = New-TestElement -Role "group" -Name "Details" -Children @($leaf) -Counter $counter
+    $tree = Render-OrcaTree $root $null
+    Assert-TestEqual (($tree.elements | ForEach-Object { $_.name }) -join "|") "Details|body" "named generic records"
+    Assert-TestEqual (@($tree.lines) -join "|") "0 group Details|`t1 text body" "named generic lines"
+    Assert-TestEqual $counter.findAll 2 "named generic child enumeration"
+
+    $counter = New-TestCounter
+    $alpha = New-TestElement -Role "text" -Name "Alpha" -Counter $counter -RuntimeId 2
+    $beta = New-TestElement -Role "text" -Name "Beta" -Counter $counter -RuntimeId 3
+    $root = New-TestElement -Role "group" -Children @($alpha, $beta) -Counter $counter
+    $tree = Render-OrcaTree $root $null
+    Assert-TestEqual $tree.elements.Count 1 "anonymous generic record count"
+    Assert-TestEqual ([string]$tree.lines[0]) "0 group, Text: Alpha Beta" "anonymous generic summary"
+    Assert-TestEqual $counter.findAll 7 "anonymous generic child enumeration"
+
+    $counter = New-TestCounter
+    $alpha = New-TestElement -Role "text" -Name "Alpha" -Counter $counter -RuntimeId 2
+    $beta = New-TestElement -Role "text" -Name "Beta" -Counter $counter -RuntimeId 3
+    $root = New-TestElement -Role "row" -Name "Invoice" -Children @($alpha, $beta) -Counter $counter
+    $tree = Render-OrcaTree $root $null
+    Assert-TestEqual (($tree.elements | ForEach-Object { $_.name }) -join "|") "Invoice|Alpha|Beta" "row records"
+    Assert-TestEqual ([string]$tree.lines[0]) "0 row Invoice, Text: Alpha Beta" "row summary"
+    Assert-TestEqual $counter.findAll 6 "row child enumeration"
+
+    $counter = New-TestCounter
+    $button = New-TestElement -Role "button" -Name "Continue" -Counter $counter -RuntimeId 2
+    $root = New-TestElement -Role "group" -Children @($button) -Counter $counter
+    $tree = Render-OrcaTree $root $null
+    Assert-TestEqual $tree.elements.Count 1 "elided wrapper record count"
+    Assert-TestEqual ([string]$tree.lines[0]) "0 button Continue" "elided wrapper line"
+    Assert-TestEqual $counter.findAll 4 "elided wrapper child enumeration"
+
+    $counter = New-TestCounter
+    $root = New-TestElement -Role "row" -Name "Invoice" -Counter $counter -FailFindAll
+    $tree = Render-OrcaTree $root $null
+    Assert-TestEqual $tree.elements.Count 1 "failed child read record count"
+    Assert-TestEqual ([string]$tree.lines[0]) "0 row Invoice" "failed child read line"
+    Assert-TestEqual $counter.findAll 2 "failed child read retries"
+
+    $originalMaxNodes = $MaxNodes
+    try {
+        $MaxNodes = 3
+        $counter = New-TestCounter
+        $children = @()
+        for ($index = 0; $index -lt 3; $index++) {
+            $children += New-TestElement -Role "text" -Name "Item $index" -Counter $counter -RuntimeId ($index + 2)
+        }
+        $root = New-TestElement -Role "document" -Name "Results" -Children $children -Counter $counter
+        $tree = Render-OrcaTree $root $null
+        Assert-TestEqual $tree.elements.Count 3 "node limit record count"
+        Assert-TestEqual ([string]$tree.elements[-1].name) "Item 1" "node limit prefix"
+        Assert-TestEqual $tree.truncation.truncated $true "node limit truncation"
+        Assert-TestEqual $tree.truncation.maxDepthReached $false "node limit depth flag"
+    } finally {
+        $MaxNodes = $originalMaxNodes
+    }
+
+    $originalMaxDepth = $MaxDepth
+    try {
+        $MaxDepth = 2
+        $counter = New-TestCounter
+        $root = New-TestElement -Role "document" -Name "Depth 3" -Counter $counter -RuntimeId 4
+        for ($depth = 2; $depth -ge 0; $depth--) {
+            $root = New-TestElement -Role "document" -Name "Depth $depth" -Children @($root) -Counter $counter -RuntimeId ($depth + 1)
+        }
+        $tree = Render-OrcaTree $root $null
+        Assert-TestEqual $tree.elements.Count 3 "depth limit record count"
+        Assert-TestEqual ([string]$tree.elements[-1].name) "Depth 2" "depth limit prefix"
+        Assert-TestEqual $tree.truncation.truncated $true "depth limit truncation"
+        Assert-TestEqual $tree.truncation.maxDepthReached $true "depth limit flag"
+    } finally {
+        $MaxDepth = $originalMaxDepth
+    }
+
+    Write-Output "windows-snapshot-render-tests-ok"
+} finally {
+    Remove-Item -LiteralPath $operationPath -Force -ErrorAction SilentlyContinue
+}
diff --git a/native/computer-use-windows/runtime.ps1 b/native/computer-use-windows/runtime.ps1
index 39ab77e1704..2aa581901e6 100644
--- a/native/computer-use-windows/runtime.ps1
+++ b/native/computer-use-windows/runtime.ps1
@@ -561,10 +561,12 @@ function Render-OrcaTree($RootElement, $WindowFrame, [bool]$CompactBrowserTabs =
         $title = if ([string]::IsNullOrWhiteSpace($record.name)) { $record.automationId } else { $record.name }
         $role = if ([string]::IsNullOrWhiteSpace($record.localizedControlType)) { $record.controlType } else { $record.localizedControlType }
         $roleKey = $role.ToLowerInvariant()
-        $snippets = @(Get-OrcaTextSnippets $Node 8 4)
         $genericSummary = $null
-        if (($roleKey -in @("pane", "group", "custom", "unknown")) -and [string]::IsNullOrWhiteSpace($title) -and [string]::IsNullOrWhiteSpace($record.value) -and $snippets.Count -ge 2 -and (Test-OrcaPlainTextSubtree $Node)) {
-            $genericSummary = ($snippets -join " ")
+        if (($roleKey -in @("pane", "group", "custom", "unknown")) -and [string]::IsNullOrWhiteSpace($title) -and [string]::IsNullOrWhiteSpace($record.value)) {
+            $snippets = @(Get-OrcaTextSnippets $Node 8 4)
+            if ($snippets.Count -ge 2 -and (Test-OrcaPlainTextSubtree $Node)) {
+                $genericSummary = ($snippets -join " ")
+            }
         }
         if (($roleKey -in @("pane", "group", "custom", "unknown")) -and [string]::IsNullOrWhiteSpace($title) -and [string]::IsNullOrWhiteSpace($record.value) -and $meaningfulActions.Count -eq 0 -and $null -eq $genericSummary -and $children.Count -le 1) {
             for ($i = 0; $i -lt $children.Count; $i++) {
diff --git a/package.json b/package.json
index 06407e81144..6a0e4f33814 100644
--- a/package.json
+++ b/package.json
@@ -115,7 +115,9 @@
     "bench:main-thread-jank": "pnpm run ensure:electron-runtime && node tests/tools/benchmarks/main-thread-jank-bench.mjs",
     "bench:worktree-deletion": "node tests/tools/benchmarks/worktree-deletion-dev-bench.mjs",
     "bench:zustand-selector-fanout": "node config/scripts/zustand-selector-fanout-benchmark.mjs",
+    "bench:worktree-refresh-churn": "node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/worktree-refresh-churn-benchmark.mjs",
     "bench:multi-workspace-typing": "pnpm run ensure:electron-runtime && node config/scripts/run-multi-workspace-typing-bench.mjs",
+    "bench:ai-vault-typing": "pnpm run ensure:electron-runtime && node config/scripts/run-ai-vault-typing-bench.mjs",
     "bench:cold-park-reveal": "pnpm run ensure:electron-runtime && node tests/tools/benchmarks/terminal-cold-park-reveal-bench.mjs",
     "bench:cold-park-resource": "pnpm run ensure:electron-runtime && node tests/tools/benchmarks/terminal-cold-park-resource-bench.mjs",
     "bench:compare": "node config/scripts/compare-benchmark-artifacts.mjs",
@@ -215,7 +217,7 @@
     "mermaid": "^11.16.1",
     "monaco-editor": "^0.55.1",
     "oxfmt": "^0.52.0",
-    "oxlint": "^1.75.0",
+    "oxlint": "^1.77.0",
     "oxlint-plugin-react-doctor": "0.9.1",
     "oxlint-tsgolint": "7.0.2001",
     "pdfjs-dist": "^6.2.108",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1872f9860e8..57885d16e25 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -294,8 +294,8 @@ importers:
         specifier: ^0.52.0
         version: 0.52.0
       oxlint:
-        specifier: ^1.75.0
-        version: 1.75.0(oxlint-tsgolint@7.0.2001)
+        specifier: ^1.77.0
+        version: 1.77.0(oxlint-tsgolint@7.0.2001)
       oxlint-plugin-react-doctor:
         specifier: 0.9.1
         version: 0.9.1
@@ -1488,124 +1488,124 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@oxlint/binding-android-arm-eabi@1.75.0':
-    resolution: {integrity: sha512-lutovtFzJqlRaqpZrCqSSGaHZzl9nIxxpjLzhSRLunN6dCLylj0uzlCyQGaQDIys7rrv8kVXiFO+R4Zpn0bX7g==}
+  '@oxlint/binding-android-arm-eabi@1.77.0':
+    resolution: {integrity: sha512-E06sKWS6PiI6HRxS1wyQg22HvApt01hI7fV+T3wUk3OSbaaP4a3hYGY/MIQDmASqCiRjBdpRQYkgMkqH82cWmQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxlint/binding-android-arm64@1.75.0':
-    resolution: {integrity: sha512-hXI0hDgHkw4w5nfru72aG7y+2iQJmC4waH/KV6H/hbgA6yAP5jYNx0P9yug15Hs0tWl/+mda3Jjn/2gmDT48tw==}
+  '@oxlint/binding-android-arm64@1.77.0':
+    resolution: {integrity: sha512-NvsKz0KZxTp9cYWPLf+FXaSZwB3oO3peAjtukpOMBgse2vhQSoIIVqeO1yR0lEo/UcdZIDL18uq+kL0LzQ0ytA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxlint/binding-darwin-arm64@1.75.0':
-    resolution: {integrity: sha512-D91BWbK/dMYfCcrghspPIuKs2D9LF4Z/OabVSQjw1AO6PWxArD7teDA48bm0ySFqWDaPVqmQRl5GMWNglTXyrQ==}
+  '@oxlint/binding-darwin-arm64@1.77.0':
+    resolution: {integrity: sha512-bgjTn6nW4bQCFBvSvuHCpDD+sONvmpo4lGI4PxzMt1quBA+xYxhczk6RiCn3GZ9gY8uhaBbwhj9MdKGfu6T9DA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxlint/binding-darwin-x64@1.75.0':
-    resolution: {integrity: sha512-02mpwzf12BonZ6PT0TuQoomvEh2kVl2WGBIKWezCyToIS+rYkQZ6GXnARBAl9A4Ovm2V+Xe7M4KretyqmmcnJQ==}
+  '@oxlint/binding-darwin-x64@1.77.0':
+    resolution: {integrity: sha512-aotaIttH1R6j1Rwhx0M0htgeZyGtVQqYNTVEYMN/UcgHPquGA6kmk9OyuDc3a2GKUQBC+3C3GVQCcrRPMYqAFA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxlint/binding-freebsd-x64@1.75.0':
-    resolution: {integrity: sha512-qZJgLnDaBsiL5YESx2t/TZ8eXkL9fEkKoXEdzegROhlz9A0lgyGnZ0dAzJrh7LJAHQl2K9RdRueN2s/9N7+odg==}
+  '@oxlint/binding-freebsd-x64@1.77.0':
+    resolution: {integrity: sha512-nNx/wta7ksRAdYvq+l4AWjXkLxEXHALhENxjj2cYbQAIR4ybaA5L+hCbE63HOmft5czQ6ks+hb8vmEAnn7YGPg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.75.0':
-    resolution: {integrity: sha512-7XlaWA5BJD3XpCfrEqjEe6Zseeb14S7QGa304XfwKignRaKQ+eIj775BQ7nIslggWickl4IsPUFqJ+/gAyNHVg==}
+  '@oxlint/binding-linux-arm-gnueabihf@1.77.0':
+    resolution: {integrity: sha512-tMLLjM7xXtzXisVCzkOTXNCy9bZVId2wteNwjohlFDR/jY6WagpEDA1c1wu4xRc20Hojaxj+V6DSR7gbKxijWA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm-musleabihf@1.75.0':
-    resolution: {integrity: sha512-av6Tpv8yrcMMMOadOqENBhlsLRcGFXXwoQ0hzHhsmS9FJ4Wioy8we427GbcMe2XTxmL2e60T67H1Dyr3up+tAA==}
+  '@oxlint/binding-linux-arm-musleabihf@1.77.0':
+    resolution: {integrity: sha512-MiAFDFaqR0tmHTAyo0YDcZ5hyLREdYw/RQhc2R3cbT+8O3tB+zqPM2th9TTQ+Uo3jn/embS+DO+HyX9ztCPkOQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm64-gnu@1.75.0':
-    resolution: {integrity: sha512-WcUhd8fHT5plrA14lANevl+hOl815mVI5t2hU21oFWrZKFXIVV/Sr4rWQV0NzSvzBupbMLNc5ErEA6Ehxh5jMg==}
+  '@oxlint/binding-linux-arm64-gnu@1.77.0':
+    resolution: {integrity: sha512-/xqQ3B16i1T4cyt/9Mn+4CpzhUXoBXp7kVpIwzOXNFLj5JmK1bIjsbSnX296Gg8A/o7oDtKWikFgBx0SLwztkw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-arm64-musl@1.75.0':
-    resolution: {integrity: sha512-UWzp5wRHFe/ESO3+eEaxXsTkYTGLYjnTsi/I5neEacXSItQ6WNleapfOAeA4x2b8nyhJ4uQxqvtv9pHv8kWJtQ==}
+  '@oxlint/binding-linux-arm64-musl@1.77.0':
+    resolution: {integrity: sha512-LSbwuRKiNCenPDcbARqAZ5RfBy7gmj7vOvfJRLeCDU3gFtSxWbhv/+VTlaUqzUhNj1gFLHB8h7ALnxa/Az6z6g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-ppc64-gnu@1.75.0':
-    resolution: {integrity: sha512-XEVRwGMLKCUKrvhLAz4F6AIh8MJrQVdSZtAmPpRZt9tGPsUnamPOcl3dS/ZQzJnar/Ymgc//+xho0L60Emzuxg==}
+  '@oxlint/binding-linux-ppc64-gnu@1.77.0':
+    resolution: {integrity: sha512-QWdcH31mXEUe5Nq1s0CfCpceaKjIo9uZtwDjAuL681g1axf+5x8xrg/eXWaw//4NCxYZ4V4e5Hu5tvdR+pTBlg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-gnu@1.75.0':
-    resolution: {integrity: sha512-mAG4DUXqfLC8cTjMD2kt3jDmVzFREYtDyeLNdLdsCcBc4Zbl2EMuiFektGBilQwkNjYnMvCqJs55U+Hyb+b+jw==}
+  '@oxlint/binding-linux-riscv64-gnu@1.77.0':
+    resolution: {integrity: sha512-GnOfYgJxbcElOiPZaDFDl406ONddwvOWk2jvAAAEjwAl4GofNoHF+/HHUIBYa6bFCArlcGPi0XjC4cU1pkgF/Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-musl@1.75.0':
-    resolution: {integrity: sha512-95hrAvriAlI+pekSomTFIn0+bawMDlDwTNVmdjsFusTHyL2JWh7TWvRNG/Lkim72uN8OiCcO9wcaC6omLP5E3w==}
+  '@oxlint/binding-linux-riscv64-musl@1.77.0':
+    resolution: {integrity: sha512-AyEMTUCf0xY+hHF+IxqXFQIX0yQOIR8ykpY0lJNOw9xYqOzUX8dyZfRvlG0RfXwuQn2eonf/8NrMmDSZJjdqsA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-s390x-gnu@1.75.0':
-    resolution: {integrity: sha512-4b6f2+FrtruAESrCqIKcrarzfrSx+wk2QNcp+RT91/Prc+pMQMAfyZ1rG1c3tFQNl8Bc616tx40uNXyxNBRPbQ==}
+  '@oxlint/binding-linux-s390x-gnu@1.77.0':
+    resolution: {integrity: sha512-sPLzEcNvxd/oyVQ5oZo92CiHkFkpBeRop13E/P3TPY+hZfXHKCOWKI70TE2RYwMKFJDc20EMjH16L7NZICtKTw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-gnu@1.75.0':
-    resolution: {integrity: sha512-nshAhrUvXFUWOvqQ2soIw7HFNWvpvEV4o0cYSqPtzLiPF5gKyYTDOOTJ6Rn8g8K/iGvPIrbDA4v8+5MvnjJrrg==}
+  '@oxlint/binding-linux-x64-gnu@1.77.0':
+    resolution: {integrity: sha512-1Oh2ssH2L7lwyvkdSqaMUfsGfwU2Wfvew+obBUYjRVqhpBcUpwnsPSEr1IzVi9XqkuY10geiLsNKecqaZC34Dw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-musl@1.75.0':
-    resolution: {integrity: sha512-e4jNxLKnxLC6sYBQRxrI2pgIIxnmMtF8U/VwNYcjTT/CLS+spH624cYVnj07bTKwaEWT37/e025isOs6j/0xqA==}
+  '@oxlint/binding-linux-x64-musl@1.77.0':
+    resolution: {integrity: sha512-0j/2wRgNGO+Qj/M1uu/p57h/hFTTWWcfie0ufkbabeus2s5+/QqkCflnMOwLLN5m2GsNeWp4xdl4cPa4n7QCOQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-openharmony-arm64@1.75.0':
-    resolution: {integrity: sha512-hZ2lH+1qLf/DiEP9UWuQTK2JWj/BgvMB4jhIV4SmNU1wfEiYYX4TynQyAZXx0j9X4qRYizAL042SKaV+8ynh4w==}
+  '@oxlint/binding-openharmony-arm64@1.77.0':
+    resolution: {integrity: sha512-BJ/j54qS0usEnyDkLYURMj2iiD9h5Cyy+ppzeMSXBGRXaGRNWnj1Mw14NqWMR5E/PzdgB30OOCCzLzbRoduafw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxlint/binding-win32-arm64-msvc@1.75.0':
-    resolution: {integrity: sha512-Ilj6PNzGDS3bCU0MSJH7Msh0NhH+T/mRp2shwg+q+GHeVlPwP5LEboW96aW+3kVKFk6zYZy1Xi5pZkqZh6X8KQ==}
+  '@oxlint/binding-win32-arm64-msvc@1.77.0':
+    resolution: {integrity: sha512-Yh8w+g2Lpx7StrvtYkoz9JJvXjB9wxgFChFNb85nrXm/wj/XTwGWS1hve9+900HL7llrntYB3YP+y32E3tRqzA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxlint/binding-win32-ia32-msvc@1.75.0':
-    resolution: {integrity: sha512-QVit2nOEOiPhkmsrksPSkoGCdnZRNkspt8fwoYyP09te1VEbnSj4LAxua4rc8FKTmWkySVe05j8iz9GXYfF1AQ==}
+  '@oxlint/binding-win32-ia32-msvc@1.77.0':
+    resolution: {integrity: sha512-zja5b7+6a7UsRFgAQSrnax5vrzliEyNPLCjfXONu/vTWswaIVZGFajJZptaeRvPE4LghtFdAzVFlexTm7MVTGA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxlint/binding-win32-x64-msvc@1.75.0':
-    resolution: {integrity: sha512-DSxnNkBUAYARPwJtR12Ig3deWr8w0H997xP6jy33i+e0SyYJw8FKuz4+cZtpmPEhQmvlPJE3X/2vNxDmLkd/rA==}
+  '@oxlint/binding-win32-x64-msvc@1.77.0':
+    resolution: {integrity: sha512-+teyvPDZ2RjUvo+SuCqS/UhaJl1QtdW5fWT5NJTV61V5MIuIS90Db9LixmtEGvXixyttiK62P96MSu3UlpviBw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -5541,8 +5541,8 @@ packages:
     resolution: {integrity: sha512-KjK/XLcXr1DSyonKhsuFqJRiuKqcyG9j3LJ8nkOsrLzGvodBPqzHOKauy10asLMDI0sUpvb+1sxlzff3udZvfg==}
     hasBin: true
 
-  oxlint@1.75.0:
-    resolution: {integrity: sha512-m9WzjRcRYA/uqIZDa9tclrieoPJ/ln1QYTKdFx6NUOs8uY5DiHlIwRQoCrHT6OM6O3ww3l2skY5gO7G7ZphE7g==}
+  oxlint@1.77.0:
+    resolution: {integrity: sha512-qnGh8XJHaQ0dprrDXNQZgS0FgjI6v+V3+X8DwmaV++5Aamy6jGKfDdQ1TUvhUxtmKFAbEf4/WeO5QZX+5WSngg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -7809,61 +7809,61 @@ snapshots:
   '@oxlint-tsgolint/win32-x64@7.0.2001':
     optional: true
 
-  '@oxlint/binding-android-arm-eabi@1.75.0':
+  '@oxlint/binding-android-arm-eabi@1.77.0':
     optional: true
 
-  '@oxlint/binding-android-arm64@1.75.0':
+  '@oxlint/binding-android-arm64@1.77.0':
     optional: true
 
-  '@oxlint/binding-darwin-arm64@1.75.0':
+  '@oxlint/binding-darwin-arm64@1.77.0':
     optional: true
 
-  '@oxlint/binding-darwin-x64@1.75.0':
+  '@oxlint/binding-darwin-x64@1.77.0':
     optional: true
 
-  '@oxlint/binding-freebsd-x64@1.75.0':
+  '@oxlint/binding-freebsd-x64@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.75.0':
+  '@oxlint/binding-linux-arm-gnueabihf@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-musleabihf@1.75.0':
+  '@oxlint/binding-linux-arm-musleabihf@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-gnu@1.75.0':
+  '@oxlint/binding-linux-arm64-gnu@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-musl@1.75.0':
+  '@oxlint/binding-linux-arm64-musl@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-ppc64-gnu@1.75.0':
+  '@oxlint/binding-linux-ppc64-gnu@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-gnu@1.75.0':
+  '@oxlint/binding-linux-riscv64-gnu@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-musl@1.75.0':
+  '@oxlint/binding-linux-riscv64-musl@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-s390x-gnu@1.75.0':
+  '@oxlint/binding-linux-s390x-gnu@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-gnu@1.75.0':
+  '@oxlint/binding-linux-x64-gnu@1.77.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-musl@1.75.0':
+  '@oxlint/binding-linux-x64-musl@1.77.0':
     optional: true
 
-  '@oxlint/binding-openharmony-arm64@1.75.0':
+  '@oxlint/binding-openharmony-arm64@1.77.0':
     optional: true
 
-  '@oxlint/binding-win32-arm64-msvc@1.75.0':
+  '@oxlint/binding-win32-arm64-msvc@1.77.0':
     optional: true
 
-  '@oxlint/binding-win32-ia32-msvc@1.75.0':
+  '@oxlint/binding-win32-ia32-msvc@1.77.0':
     optional: true
 
-  '@oxlint/binding-win32-x64-msvc@1.75.0':
+  '@oxlint/binding-win32-x64-msvc@1.77.0':
     optional: true
 
   '@parcel/watcher-android-arm64@2.5.6':
@@ -12174,27 +12174,27 @@ snapshots:
       '@oxlint-tsgolint/win32-arm64': 7.0.2001
       '@oxlint-tsgolint/win32-x64': 7.0.2001
 
-  oxlint@1.75.0(oxlint-tsgolint@7.0.2001):
+  oxlint@1.77.0(oxlint-tsgolint@7.0.2001):
     optionalDependencies:
-      '@oxlint/binding-android-arm-eabi': 1.75.0
-      '@oxlint/binding-android-arm64': 1.75.0
-      '@oxlint/binding-darwin-arm64': 1.75.0
-      '@oxlint/binding-darwin-x64': 1.75.0
-      '@oxlint/binding-freebsd-x64': 1.75.0
-      '@oxlint/binding-linux-arm-gnueabihf': 1.75.0
-      '@oxlint/binding-linux-arm-musleabihf': 1.75.0
-      '@oxlint/binding-linux-arm64-gnu': 1.75.0
-      '@oxlint/binding-linux-arm64-musl': 1.75.0
-      '@oxlint/binding-linux-ppc64-gnu': 1.75.0
-      '@oxlint/binding-linux-riscv64-gnu': 1.75.0
-      '@oxlint/binding-linux-riscv64-musl': 1.75.0
-      '@oxlint/binding-linux-s390x-gnu': 1.75.0
-      '@oxlint/binding-linux-x64-gnu': 1.75.0
-      '@oxlint/binding-linux-x64-musl': 1.75.0
-      '@oxlint/binding-openharmony-arm64': 1.75.0
-      '@oxlint/binding-win32-arm64-msvc': 1.75.0
-      '@oxlint/binding-win32-ia32-msvc': 1.75.0
-      '@oxlint/binding-win32-x64-msvc': 1.75.0
+      '@oxlint/binding-android-arm-eabi': 1.77.0
+      '@oxlint/binding-android-arm64': 1.77.0
+      '@oxlint/binding-darwin-arm64': 1.77.0
+      '@oxlint/binding-darwin-x64': 1.77.0
+      '@oxlint/binding-freebsd-x64': 1.77.0
+      '@oxlint/binding-linux-arm-gnueabihf': 1.77.0
+      '@oxlint/binding-linux-arm-musleabihf': 1.77.0
+      '@oxlint/binding-linux-arm64-gnu': 1.77.0
+      '@oxlint/binding-linux-arm64-musl': 1.77.0
+      '@oxlint/binding-linux-ppc64-gnu': 1.77.0
+      '@oxlint/binding-linux-riscv64-gnu': 1.77.0
+      '@oxlint/binding-linux-riscv64-musl': 1.77.0
+      '@oxlint/binding-linux-s390x-gnu': 1.77.0
+      '@oxlint/binding-linux-x64-gnu': 1.77.0
+      '@oxlint/binding-linux-x64-musl': 1.77.0
+      '@oxlint/binding-openharmony-arm64': 1.77.0
+      '@oxlint/binding-win32-arm64-msvc': 1.77.0
+      '@oxlint/binding-win32-ia32-msvc': 1.77.0
+      '@oxlint/binding-win32-x64-msvc': 1.77.0
       oxlint-tsgolint: 7.0.2001
 
   p-cancelable@2.1.1: {}
diff --git a/skill-guides/orchestration.md b/skill-guides/orchestration.md
index bc7b1cbbe3e..20b70a15b63 100644
--- a/skill-guides/orchestration.md
+++ b/skill-guides/orchestration.md
@@ -195,7 +195,7 @@ orca orchestration worker-start --task <task_b> --worktree current --agent claud
 For a per-invocation Claude, Codex, or Cursor launch, pass an opaque provider model id with `--model`; add `--effort` only when that agent/model supports the level. These options apply only to fresh agent terminals, override general agent default arguments, and are reported under `launch.requested` and `launch.effective` in the receipt:
 
 ```bash
-orca orchestration worker-start --task <task_id> --worktree current --agent claude --model aws-bedrock-opus-5 --effort high --json
+orca orchestration worker-start --task <task_id> --worktree current --agent claude --model opus --effort high --json
 ```
 
 `--effort` requires `--model`, and neither option can combine with `--terminal`. A connected worker server must advertise launch-preference support before Orca forwards either option.
diff --git a/src/cli/bundled-skill-guides.ts b/src/cli/bundled-skill-guides.ts
index 487c9152b89..e0a65fc876f 100644
--- a/src/cli/bundled-skill-guides.ts
+++ b/src/cli/bundled-skill-guides.ts
@@ -30,7 +30,7 @@ const ORCA_LINEAR_MARKDOWN = "---\nname: orca-linear\ndescription: >-\n  Use Orc
 const ORCA_PER_WORKSPACE_ENV_MARKDOWN = "---\nname: orca-per-workspace-env\ndescription: >-\n  Set up, review, debug, or validate Orca per-workspace environment recipes —\n  on-demand, disposable runtimes (cloud sandboxes, VMs, or local) created fresh\n  for each workspace. Covers first-time setup (provider prerequisites, the\n  reusable base snapshot, the coding-agent auth snapshot, credentials, and\n  state), not just the per-workspace lifecycle scripts. Use to stand up\n  per-workspace environments, fix an `environmentRecipes` entry in `orca.yaml`, scaffold\n  provider lifecycle scripts, or resolve an `orca vm recipe doctor` failure.\n---\n\n# Per-Workspace Environments\n\nHelp a user stand up and maintain a repo-owned per-workspace environment recipe end to end. Each\nworkspace gets its own on-demand, disposable runtime (a cloud sandbox, a VM, or a local one),\ncreated fresh and torn down after.\n\nOrca is a **thin wrapper**: you guide, detect, and scaffold; you never own the user's cloud account,\nbilling, images, or credentials.\n\n- **You DO:** sequence the setup, detect what's detectable (provider CLI present/logged-in? recipe\n  present? `doctor` passing?), scaffold provider-templated scripts the user fills in, drive the slow\n  snapshot/auth phases with the user, and always show the next action.\n- **You DO NOT:** create accounts, choose plans/regions, invent org/project/scope ids, store or print\n  secrets, or run anything that spends money without an explicit user OK.\n\nFirst-time setup has **four phases before the per-workspace recipe runs** — easy to miss, so walk\nthem in order:\n\n1. **Prerequisites** — cloud account, provider CLI, scope/project, plan limits, git token (§2).\n2. **Base snapshot** — reusable image: tools + repo + headless build, snapshotted once (§3).\n3. **Agent-auth snapshot** — boot the base, run interactive device-auth, re-snapshot (§4).\n4. **State** — thread snapshot id / scope / project / port between phases via a state file (§6).\n\nThen the **per-workspace contract** (create/suspend/resume/destroy) runs fast (§8).\n\n**The one branch that shapes everything — connection mode:** **Orca-server** (`create` runs `orca serve`\nin the env and emits a `pairingCode`; §7c/§7f) vs **SSH** (`create` runs no server and emits a\n`connection.type:\"ssh\"` block Orca dials into; §7g/§7h). Settle this first — it changes the `create`\noutput shape and half the templates.\n\n**Quick-start (happy path):** interview the user (connection mode Orca-server vs SSH, provider, agent CLI,\ngit auth — §1.2) + read the provider's CLI docs → scaffold `scripts/orca-vm/` from §7 → run the\nbase-snapshot script, then the auth script (you invoke these by hand; not via `orca.yaml`) → wire\n`environmentRecipes` in `orca.yaml` → `orca vm recipe doctor <id> --json` (free) → then the `--provision`\nself-test loop (§9) until it passes.\n\n---\n\n## 1. Setup workflow\n\nDrive these with the user. **[CHECKPOINT]** steps need explicit confirmation — they spend money, take\na long time, or need the user at the keyboard. Never create an Orca workspace or commit unless asked.\n\n1. **Inspect the repo** for an existing `environmentRecipes` entry, `scripts/orca-vm/`, a state file, or setup\n   notes. If a working recipe exists, jump to Doctor (§9) instead of rebuilding.\n2. **Interview the user up front** — gather these choices and confirm them back before scaffolding\n   anything. Don't pick for them (§11); don't guess.\n   - **Connection mode:** how Orca attaches to the environment — an **Orca server** (the VM runs\n     `orca serve` and Orca pairs over its pairing URL; worked example §7f) or **SSH** (Orca connects to\n     the host over SSH; §7g). This decides the recipe's connection shape, so settle it first.\n   - **Provider:** Vercel Sandbox, Fly, Modal, an existing SSH host, … For non-obvious providers, also\n     ask scope/project/region and plan limits (§2). Then **read that provider's CLI/SDK docs** (or\n     `<cli> --help`) before scaffolding — you need its exact create/exec/snapshot/remove verbs.\n     If a provider advertises `ssh`, verify whether it exposes a real dialable SSH target\n     (host/port/user/key or proxy command) or only a provider-mediated interactive shell; Orca SSH mode\n     needs the former.\n   - **Coding-agent CLI + account:** which agent runs in the VM (`codex`, `claude`, …) and that the user\n     has an account for it — it gets logged in during the Phase-3 auth snapshot (§4).\n   - **Git auth:** the token source for cloning a private repo (`GH_TOKEN`/`GITHUB_TOKEN` or `gh auth\n     token`; §5).\n3. **Check prerequisites (§2)** — detect the provider CLI + auth and confirm the items above are in\n   place before any paid step.\n4. **Scaffold scripts + state file** from §7 (worked Vercel example: §7f; SSH host: §7g; Docker SSH:\n   §7h; Windows: §7i), filling in the provider's real commands. Make them executable.\n5. **[CHECKPOINT] Build the base snapshot (§3)** — paid, slow.\n6. **[CHECKPOINT] Authenticate the agent (§4)** — interactive; the user follows a URL/code. **You cannot\n   drive this step** — you run commands non-interactively, so there's no TTY for `docker exec -it` /\n   `ssh -t` to prompt against. The **user** runs the Phase-3 login in their own terminal (or via the\n   Claude Code harness bang-prefix — `! <cmd>`, with the required space after `!`); you scaffold and drive\n   the non-interactive phases around it. After kicking it off, **ask the user to report back once the login\n   finishes** — you can't observe it completing, and you need that confirmation before resuming the\n   non-interactive steps (base/auth commit, doctor, provision).\n7. **Wire the recipe** so `orca.yaml` points create/suspend/resume/destroy at the scripts (§8). The\n   workspace composer reads `environmentRecipes` from the project's primary checkout of `orca.yaml`, **not** from\n   a feature branch or worktree. So a recipe added only on a branch won't appear as a \"Run on\" option\n   until that `orca.yaml` change is committed and merged to the project's primary branch. Tell the user\n   this up front: `doctor`/`--provision` validate the scripts from the working copy on any branch, but\n   creating a workspace from the recipe in the picker needs it on primary.\n8. **Dry-run doctor** — `orca vm recipe doctor <recipe-id> --repo-path <repo> --json` (free, static; §9).\n   Fix every failure before going live.\n9. **[CHECKPOINT] Live self-test** — get the user's OK once, then run\n   `orca vm recipe doctor <recipe-id> --provision --json` as a loop: it runs create → validates →\n   destroys, and on failure returns a full transcript. Read it, fix the scripts, and re-run yourself until\n   it passes (§9). Spends cloud money; the one approval covers the loop.\n10. **[CHECKPOINT] Optional workspace test** — only if asked: create a workspace via the picker, then\n    verify sleep/wake/delete.\n\n---\n\n## 2. Phase 1 — Prerequisites\n\nThe user's responsibility; verify what's verifiable, ask for the rest, invent nothing. State which\nitems you verified vs. which the user asserted.\n\n- **Connection mode** (Orca server vs SSH) confirmed with the user — see §1 step 2; it shapes the recipe.\n- **Cloud account + plan** that allows sandboxes/VMs. Ask.\n- **Provider CLI installed + authenticated** — detect (`command -v <cli>`), check auth (e.g.\n  `vercel whoami`). If missing, point at the provider's docs; don't log them in.\n- **Scope / project / region** the sandboxes live under. Ask; flows into every script via state.\n- **Plan / timeout / RAM caps.** Record them — e.g. Vercel Hobby caps sandbox timeout at **45m**,\n  which limits both the base build and per-workspace runtime (see §10).\n- **Git token for private repos** (`GH_TOKEN`/`GITHUB_TOKEN`, or the provider's git auth; can fall back\n  to `gh auth token`). See §5.\n- **Coding-agent CLI choice** (`codex`, `claude`…) and that the user has an account — it gets\n  authenticated into the VM in Phase 3.\n\n---\n\n## 3. Phase 2 — Base snapshot (the reusable image)\n\nBuild **once**, snapshot, and every workspace boots from it in seconds instead of rebuilding.\nProvisioning + building takes a while (often ~20–30 min), so it runs behind a checkpoint. The script\nshape is §7a; key points:\n\n- Build the **headless Electron main only** (not the renderer) so it fits in plan RAM.\n- Use the VM image's package manager (`apt`/`dnf`/`apk`, per the base distro — not the provider brand).\n- Clone with the git token via `GIT_ASKPASS` (§5).\n- **Trap errors and remove the half-built sandbox** so a crash doesn't leave a paid resource running.\n- Snapshot the stopped sandbox, parse the snapshot id, and write it + scope/project/port/repo to state.\n\n---\n\n## 4. Phase 3 — Agent-auth snapshot (interactive)\n\nThe base snapshot has the agent CLI installed but **not logged in**, and per-workspace VMs are\nephemeral — so authenticate once and bake it into a second snapshot layer. Script shape is §7b:\n\n1. Boot a sandbox from the base `snapshotId` (from state).\n2. Run the agent's login **interactively** (`--interactive --tty`); the user completes the URL/code in\n   their browser. On a **headless VM this must be the device-auth flow** (e.g. `codex login --device-auth`),\n   **not** plain `codex login`: the default OAuth login starts a loopback callback server on a container\n   port the host browser can't reach, so it hangs. Device-auth instead prints a URL + code the user opens\n   on the **host**.\n3. Verify login; **refuse to snapshot an unauthenticated VM.** Prefer the status command's **exit code**\n   (most agent CLIs exit non-zero when unauthenticated). If you grep instead, agent status often goes to\n   **stderr** (e.g. `codex login status` prints \"Logged in using ChatGPT\" there), so **fold stderr first**\n   (`... 2>&1 | grep …`) and match the agent's **exact success line** — never `grep -qi 'logged in'`, which\n   also matches \"**not** logged in\" and would commit an unauthenticated image.\n4. Re-snapshot, parse the new id, and overwrite `snapshotId` in state to the authenticated image\n   (recording `authSourceSnapshotId`). Remove the auth sandbox.\n\n**You can't drive step 2 yourself** (you run commands non-interactively — no TTY). The **user** runs it in\ntheir own terminal, or via the Claude Code harness bang-prefix (`! <cmd>`, with the required space after\n`!`). You scaffold/boot the sandbox and run steps 3–4, but **you cannot observe the interactive login\nfinishing** — so **ask the user to tell you when it's done** before you verify and re-snapshot.\n\nIf the agent's credentials are short-lived, warn that the snapshot may need periodic re-auth (§10).\n\nFor disposable runtimes, do **not** treat a host agent config directory (for example `~/.codex`) as the\nauth snapshot by bind-mounting or copying it wholesale. Agent homes often contain sqlite state, hook\napproval state, caches, logs, and host-specific env/config. Instead, authenticate/configure the agent\ninside the disposable runtime and snapshot/commit that runtime layer.\n\n---\n\n## 5. Credentials\n\n- **Never** commit secrets or put them in `userData`, recipe JSON, comments, docs, or the state file.\n- **Git token:** read from env (`GH_TOKEN`/`GITHUB_TOKEN`), falling back to `gh auth token`. Pass to the\n  VM only via the provider's ephemeral `--env`. Inside the VM, use a `GIT_ASKPASS` helper with\n  `x-access-token` (not the token in the clone URL) and `GIT_TERMINAL_PROMPT=0` so a missing token fails\n  fast instead of hanging. When you write the helper from inside `bash -lc` under `set -u`, escape the\n  positional arg and the token (`\\$1`, `\\$GH_TOKEN`) so they land **literally** and resolve at git-runtime\n  — an unescaped `$1` aborts with \"unbound variable\", and a literal `$GH_TOKEN` keeps the real token out of\n  the written file. `rm -f` the helper after the clone/fetch.\n- **Provider auth:** rely on the provider CLI's logged-in session, not checked-in keys.\n- **Agent auth:** lives in the authenticated snapshot (Phase 3) — never a file you write or commit.\n- State holds only **non-secret** wiring (snapshot ids, scope, project, port, repo url/ref).\n\n---\n\n## 6. State file\n\nA repo-local JSON file (e.g. `scripts/orca-vm/<provider>-state.json`) threads non-secret values between\nphases. Each script resolves values as **env var → state → built-in fallback**, and merges its outputs\nback. Phase 2 writes the base `snapshotId`; Phase 3 overwrites it with the authenticated snapshot;\nper-workspace `create` boots from `snapshotId`.\n\n```json\n{\n  \"baseName\": \"orca-base\",\n  \"snapshotId\": \"snap_authenticated_image_id\",\n  \"authSourceSnapshotId\": \"snap_base_image_id\",\n  \"scope\": \"<provider-scope>\",\n  \"project\": \"<provider-project>\",\n  \"port\": 7331,\n  \"repoUrl\": \"https://host/org/repo.git\",\n  \"repoRef\": \"main\",\n  \"projectRoot\": \"/abs/path/on/remote/repo\"\n}\n```\n\n---\n\n## 7. Script templates (provider-agnostic shapes)\n\nScaffold under `scripts/orca-vm/`. These are **shapes** — fill in the provider's real commands. All\nreserve stdout for the final JSON and log progress to stderr. Include a shared `json_value <key>` /\n`env_value <NAME>` reader (env → state → fallback) in each.\n\n**Where each script runs:**\n\n- **Local-side** (`create`/`suspend`/`resume`/`destroy` + the base-snapshot/auth scripts the user\n  invokes) runs **on the user's desktop**, so it must run on their OS. macOS/Linux: `#!/usr/bin/env\n  bash`, `set -euo pipefail`, quoted paths. **Windows:** a bare `.sh` won't run — scaffold `.ps1`/`.cmd`\n  or require WSL/Git-Bash and point `orca.yaml` at the right launcher.\n- **Remote-side** (commands you `exec` *inside* the Linux VM) always runs in the VM's Linux shell, so\n  bash is fine there regardless of the user's OS.\n\n### 7a. Base-snapshot (`<provider>-base-snapshot.sh`) — Phase 2\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve base_name/repo_url/repo_ref/project_root/port/scope/project/timeout (env→state→fallback)\n# resolve gh token: GH_TOKEN | GITHUB_TOKEN | `gh auth token`\n# 1. provision a sandbox (timeout/vcpus/published port/snapshot retention); trap: remove on error\n# 2. remote exec (long timeout): install pkgs + gh + corepack/pnpm + agent CLI;\n#    clone with GIT_ASKPASS(token); write headless main-only build config;\n#    dev setup; pnpm install; build CLI; build headless electron main; smoke-check tools\n# 3. snapshot stopped sandbox; parse snapshot id (fail if unparseable)\n# 4. merge { baseName, snapshotId, projectRoot, repoUrl, repoRef, port, scope, project } into state\n# print only the state JSON to stdout\n```\n\nWorked Vercel commands for this phase are in §7f. You run this script by hand (not via `orca.yaml`),\nafter exporting the first-run inputs the state file doesn't have yet — e.g. provider scope/project, the\nrepo URL/ref, and a git token (`GH_TOKEN`); later runs read them back from state.\n\n### 7b. Auth (`<provider>-base-auth.sh`) — Phase 3\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# read source snapshot from state.snapshotId (fail if absent); auth_name=\"${base_name}-auth\"\n# 1. boot sandbox from source snapshot; trap: remove on error\n# 2. INTERACTIVE/TTY remote exec: agent login — user completes URL/code. Headless VM: MUST use the\n#    device-auth flow (e.g. `codex login --device-auth`) — plain OAuth login binds a loopback callback\n#    port the host can't reach and hangs. User runs this themselves (you have no interactive TTY); ask\n#    them to report back when it's done before continuing.\n# 3. verify login, then refuse to snapshot if not logged in. Prefer the status command's EXIT CODE (most\n#    agent CLIs exit non-zero when unauthenticated) over string-matching. If you must grep, fold stderr\n#    first (`status 2>&1 | grep …` — many agents print the success line there) and match the agent's exact\n#    success line; never `grep -qi 'logged in'`, which also matches \"not logged in\". Codex example: §7f.\n# 4. snapshot; parse new id\n# 5. merge { snapshotId:<new>, authSourceSnapshotId:<source> } into state; remove auth sandbox\n# print only the state JSON to stdout\n```\n\n### 7c. Create (`<provider>-create.sh`) — per workspace\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# read authenticated snapshotId/scope/project/port/repo*/project_root (env→state→fallback)\n# fail clearly if snapshotId is missing (point back to Phases 2–3)\n# name = orca-${ORCA_VM_RECIPE_ID}-${ORCA_VM_INSTANCE_ID} (sanitized, length-capped)\n# 1. boot sandbox from snapshotId with a published port; capture the public URL → pairing address\n#    (an externally reachable wss:// URL); trap: remove sandbox on error\n# 2. remote exec: ensure repo at desired commit; rebuild only if commit changed (cache marker)\n# 3. remote exec: start orca serve in the background and read the recipe JSON it writes (see below)\n# 4. print serve's JSON to stdout, optionally enriched with userData:\n#    { schemaVersion:1, pairingCode, projectRoot, userData:{ provider, resourceId:name, snapshotId } }\n```\n\n**The exact `orca serve` invocation and its output (verified — do not improvise the flags).** Inside the\nVM, run:\n\n```bash\norca serve \\\n  --port \"$PORT\" \\\n  --project-root \"$ABS_REPO_PATH_ON_REMOTE\" \\\n  --pairing-address \"$EXTERNAL_WSS_URL\" \\\n  --recipe-json\n```\n\n**Binary name:** in a VM built from source (the Phase-2 flow), run it as `pnpm exec orca-dev serve …`\nfrom the repo root — `orca-dev` is the in-repo entrypoint and is what the §7f example uses. Plain\n`orca serve …` is the same command when the built CLI is installed on the VM's PATH. The flags/output\nare identical either way.\n\nThere is **no `--host` flag**. `--project-root` must be an absolute directory on the remote. With\n`--recipe-json` the server **stays running** and prints exactly this single object to **stdout**, then\nkeeps serving:\n\n```json\n{ \"schemaVersion\": 1, \"pairingCode\": \"<orca pairing URL>\", \"projectRoot\": \"<the --project-root you passed>\" }\n```\n\n`pairingCode` is the pairing URL, already pointing at whatever you passed as `--pairing-address` — so set\n`--pairing-address` to the externally reachable address and **pass `pairingCode` through unchanged; never\nhand-rewrite it**. Because serve runs in the foreground and doesn't exit, redirect its stdout to a file\nand poll until that file parses as JSON (and bail if the process dies — dump its stderr log). Your\n`create` script then prints that JSON (optionally merging `userData`). Concrete pattern: §7f.\n\n### 7d. Suspend / resume / destroy — per workspace\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\npayload=\"$(cat)\"                       # Orca passes lifecycle JSON on stdin\nresource_id=\"$(node -e 'const d=JSON.parse(process.argv[1]); process.stdout.write(d.recipeResult?.userData?.resourceId ?? \"\")' \"$payload\")\"\n[ -n \"$resource_id\" ] || { echo \"No resource id in lifecycle payload\" >&2; exit 1; }\n# suspend: provider suspend \"$resource_id\"\n# resume:  provider resume \"$resource_id\"; then RE-EMIT fresh recipe JSON (pairing may change)\n# destroy: provider remove \"$resource_id\"   (or set destroy: none in orca.yaml)\n```\n\n### 7e. State file — scaffold with scope/project/repo filled in and snapshot ids empty (§6).\n\n### 7f. Worked example — Vercel Sandbox (all three phases)\n\nA real, working shape (the Vercel surface is a CLI: `vercel sandbox create|exec|snapshot|remove`). Adapt\nnames; verify flags against `vercel sandbox --help` for the user's CLI version before relying on them.\nThese ground §7a (base snapshot) and §7b (auth), which are otherwise generic skeletons.\n\n**Phase 2 — base snapshot (§7a):** provision → install tools + clone + headless build → snapshot.\n\n```bash\n# provision a fresh build sandbox (retain a couple of snapshots); trap-remove on error\nvercel sandbox create --name \"$base\" --runtime node24 --timeout 30m --vcpus 4 --publish-port \"$port\" \\\n  --snapshot-expiration 30d --keep-last-snapshots 2 \"${vercel_args[@]}\" >&2\n# remote build (long timeout): install pkgs+gh+pnpm+agent CLI, clone with GIT_ASKPASS (write the helper\n# with LITERAL \\$1/\\$GH_TOKEN so they resolve at git-runtime, not write-time — see §5/§7f create — then\n# `rm -f /tmp/askpass.sh`), write the headless main-only build config (drop the renderer), dev setup,\n# build CLI + headless main, smoke-check\nvercel sandbox exec \"$base\" \"${vercel_args[@]}\" --timeout 25m --env \"GH_TOKEN=$gh_token\" … -- bash -lc '…build…' >&2\n# snapshot the STOPPED sandbox and parse the id from CLI output (fail if unparseable)\nout=\"$(vercel sandbox snapshot \"$base\" --stop --expiration 30d \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$out\" >&2\nsnapshot_id=\"$(printf '%s\\n' \"$out\" | sed -nE 's/.*(snap_[A-Za-z0-9]+).*/\\1/p' | tail -1)\"\n# merge { baseName, snapshotId, scope, project, port, repoUrl, repoRef, projectRoot } into state; print state JSON\n```\n\n**Phase 3 — agent-auth snapshot (§7b):** boot the base, log the agent in interactively, re-snapshot.\n(`codex` below is an example — substitute the user's chosen agent's login/status verbs, e.g. `claude`.)\n\n```bash\nvercel sandbox create --name \"$auth\" --snapshot \"$snapshot_id\" --timeout 30m --publish-port \"$port\" \"${vercel_args[@]}\" >&2\n# INTERACTIVE — the USER runs this in their own terminal (you have no interactive TTY) and completes the\n# URL/code on the HOST. --device-auth is MANDATORY on a headless VM: plain `codex login` binds a loopback\n# callback port the host browser can't reach and hangs. Ask the user to report back when login finishes.\nvercel sandbox exec --interactive --tty \"$auth\" \"${vercel_args[@]}\" -- bash -lc 'codex login --device-auth'\n# refuse to snapshot an unauthenticated VM — fold stderr, match codex's exact success line (§4)\nvercel sandbox exec \"$auth\" \"${vercel_args[@]}\" --timeout 30s -- bash -lc 'codex login status 2>&1' | grep -Eqi 'Logged in using ChatGPT|Logged in via device' \\\n  || { echo \"agent not logged in; not snapshotting\" >&2; exit 1; }\nout=\"$(vercel sandbox snapshot \"$auth\" --stop --expiration 30d \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$out\" >&2\nnew_id=\"$(printf '%s\\n' \"$out\" | sed -nE 's/.*(snap_[A-Za-z0-9]+).*/\\1/p' | tail -1)\"\n# overwrite state.snapshotId = new_id, record authSourceSnapshotId = snapshot_id; remove the auth sandbox\n```\n\n**Per-workspace `create`** (the fast path):\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve from env→state→fallback: snapshot_id, scope, project, port, repo_url, repo_ref, project_root\nvercel_args=(); [ -n \"$scope\" ] && vercel_args+=(--scope \"$scope\"); [ -n \"$project\" ] && vercel_args+=(--project \"$project\")\n[ -n \"$snapshot_id\" ] || { echo \"snapshotId missing — run Phases 2–3 first\" >&2; exit 1; }\ngh_token=\"${GH_TOKEN:-${GITHUB_TOKEN:-$(command -v gh >/dev/null 2>&1 && gh auth token 2>/dev/null || true)}}\"\nname=\"orca-${ORCA_VM_RECIPE_ID:-vercel-sandbox}-${ORCA_VM_INSTANCE_ID:-$(date +%s)}\"  # sanitize+cap to 63 chars\n\n# Arm cleanup BEFORE create so a failing create can't leak a half-built paid sandbox.\ncleanup_on_error() { [ \"$?\" -ne 0 ] && vercel sandbox remove \"$name\" \"${vercel_args[@]}\" >/dev/null 2>&1 || true; }\ntrap cleanup_on_error EXIT\n\n# 1. boot from the authenticated snapshot, publish the serve port\ncreate_output=\"$(vercel sandbox create --name \"$name\" --snapshot \"$snapshot_id\" \\\n  --timeout 30m --publish-port \"$port\" \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$create_output\" >&2\n# Vercel prints the published https URL; derive the external wss:// pairing address from it\npublic_url=\"$(printf '%s\\n' \"$create_output\" | sed -nE 's#.*(https://[^[:space:]]+\\.vercel\\.run).*#\\1#p' | head -1)\"\n[ -n \"$public_url\" ] || { echo \"no published URL in create output\" >&2; exit 1; }\npairing_ws=\"${public_url/https:\\/\\//wss://}\"\n\n# 2. (remote) ensure the repo is at the right commit; rebuild only if the commit changed (cache marker)\nvercel sandbox exec \"$name\" \"${vercel_args[@]}\" --timeout 20m \\\n  --env \"GH_TOKEN=$gh_token\" --env \"ORCA_PROJECT_ROOT=$project_root\" \\\n  --env \"ORCA_REPO_URL=$repo_url\" --env \"ORCA_REPO_REF=$repo_ref\" \\\n  -- bash -lc 'set -euo pipefail; cd \"$ORCA_PROJECT_ROOT\"; \\\n    # Re-establish git auth for the private-repo fetch (why + full rationale: §5); else it hangs on a prompt.\n    # Load-bearing escaping: \\$1 and \\$GH_TOKEN must land LITERALLY and resolve at git-runtime. Test after\n    # any edit here — reformatting the nested printf/node quoting silently breaks the fetch or leaks the token.\n    if [ -n \"${GH_TOKEN:-}\" ]; then \\\n      printf \"%s\\n\" \"#!/usr/bin/env bash\" \"case \\\"\\$1\\\" in *Username*) echo x-access-token;; *Password*) echo \\\"\\$GH_TOKEN\\\";; esac\" > /tmp/askpass.sh; \\\n      chmod 700 /tmp/askpass.sh; export GIT_ASKPASS=/tmp/askpass.sh GIT_TERMINAL_PROMPT=0; fi; \\\n    git fetch origin \"$ORCA_REPO_REF\"; \\\n    git checkout -B \"$ORCA_REPO_REF\" FETCH_HEAD; \\\n    rm -f /tmp/askpass.sh; \\\n    c=\"$(git rev-parse HEAD)\"; [ -f .orca-built ] && [ \"$(cat .orca-built)\" = \"$c\" ] || { \\\n      pnpm install --prefer-offline && pnpm run build:cli && \\\n      node config/scripts/run-electron-vite-build.mjs --config config/electron-vite.vm-serve.config.ts && \\\n      printf \"%s\" \"$c\" > .orca-built; }' >&2\n\n# 3. (remote) start orca serve in the background, writing recipe JSON to a file; poll until it parses\nrecipe_json=\"$(vercel sandbox exec \"$name\" \"${vercel_args[@]}\" --timeout 60s \\\n  --env \"ORCA_PORT=$port\" --env \"ORCA_PROJECT_ROOT=$project_root\" --env \"ORCA_PAIRING_ADDRESS=$pairing_ws\" \\\n  -- bash -lc 'set -euo pipefail; cd \"$ORCA_PROJECT_ROOT\"; rm -f /tmp/orca-recipe.json /tmp/orca-serve.log; \\\n    nohup pnpm exec orca-dev serve --port \"$ORCA_PORT\" --project-root \"$ORCA_PROJECT_ROOT\" \\\n      --pairing-address \"$ORCA_PAIRING_ADDRESS\" --recipe-json >/tmp/orca-recipe.json 2>/tmp/orca-serve.log </dev/null & \\\n    pid=$!; for _ in $(seq 1 80); do \\\n      node -e \"JSON.parse(require(\\\"node:fs\\\").readFileSync(\\\"/tmp/orca-recipe.json\\\",\\\"utf8\\\"))\" >/dev/null 2>&1 && { cat /tmp/orca-recipe.json; exit 0; }; \\\n      kill -0 \"$pid\" 2>/dev/null || { cat /tmp/orca-serve.log >&2; exit 1; }; sleep 0.25; \\\n    done; cat /tmp/orca-serve.log >&2; echo \"serve recipe JSON timed out\" >&2; exit 1')\"\n\n# 4. print serve's JSON enriched with userData (single object on stdout)\nnode -e 'const p=JSON.parse(process.argv[1]); console.log(JSON.stringify({...p, schemaVersion:1,\n  userData:{...p.userData, provider:\"vercel-sandbox\", resourceId:process.argv[2], snapshotId:process.argv[3]}}))' \\\n  \"$recipe_json\" \"$name\" \"$snapshot_id\"\ntrap - EXIT\n```\n\n`suspend`/`resume`/`destroy` use `vercel sandbox stop|...|remove \"$resource_id\"` reading\n`userData.resourceId` from stdin (§7d). This is the **Orca-server** connection mode (the recipe emits a\npairing URL). If the user chose **SSH** in the §1 interview, use §7g instead.\n\n### 7g. Worked example — existing SSH host (SSH connection mode)\n\nSSH mode is **fundamentally different from §7c/§7f**, not a relabeling of them:\n\n- **`create` does NOT run `orca serve` and does NOT emit a `pairingCode`.** Orca itself connects to the\n  host over its SSH relay, brings up the git + filesystem providers, and imports the repo. The script's\n  only job is to make the host ready and **print SSH connection details** Orca will dial.\n- The result uses a `connection` block with `type: \"ssh\"` and a `target`, **not** the flat\n  `pairingCode`/`projectRoot` shape. Exact shape (Orca rejects anything else):\n\n```json\n{\n  \"schemaVersion\": 1,\n  \"connection\": {\n    \"type\": \"ssh\",\n    \"projectRoot\": \"/abs/path/to/repo/on/host\",\n    \"target\": {\n      \"label\": \"my-box\",\n      \"host\": \"192.0.2.10\",\n      \"port\": 22,\n      \"username\": \"ubuntu\",\n      \"identityFile\": \"~/.ssh/id_ed25519\",\n      \"jumpHost\": \"bastion.example.com\",\n      \"proxyCommand\": \"cloudflared access ssh --hostname %h\",\n      \"relayGracePeriodSeconds\": 0,\n      \"portForwards\": []\n    }\n  }\n}\n```\n\n`label`, `host`, `port`, `username` are required; the rest are optional — omit any you don't need.\n\n**Networking → which `target` fields to set** (how *your desktop* reaches the box — there is no\n`orca serve` URL in SSH mode):\n\n- Public IP / DNS, or a Tailscale/VPN address → `host`; SSH port → `port` (usually 22).\n- Key auth → `identityFile` (add `identitiesOnly: true` if the agent has many keys).\n- Through a bastion → `jumpHost` (a `user@host` ProxyJump) **or** a full `proxyCommand` (e.g. an access\n  proxy). Use one, not both.\n- A service port the workspace needs → add entries to `portForwards`.\n- `relayGracePeriodSeconds` (optional): how long Orca keeps the SSH relay alive after the workspace\n  detaches before tearing it down; `0` = tear down immediately. Leave it off unless the user wants a\n  reconnect grace window.\n\n**Toolchain & agent auth on a persistent (no-snapshot) host — do this ONCE, by hand, before wiring the\nrecipe** (there's no base image to bake; the host *is* the base). Run the §7f Phase-2 install steps and\nthe §7f Phase-3 `<agent> login --device-auth` **directly over SSH on the host** (interactive, e.g.\n`ssh -t user@host '<agent> login --device-auth'`). After that the host stays ready across workspaces.\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve from env→state→fallback (default unset optionals to \"\"): ssh_username, host,\n#   ssh_port (default 22), identity_file, jump_host, proxy_command, project_root, repo_url, repo_ref\n: \"${identity_file:=}\"; : \"${jump_host:=}\"; : \"${proxy_command:=}\"   # avoid set -u aborts on optionals\ngh_token=\"${GH_TOKEN:-${GITHUB_TOKEN:-$(command -v gh >/dev/null 2>&1 && gh auth token 2>/dev/null || true)}}\"\nssh_target=\"${ssh_username}@${host}\"\nssh_opts=(-p \"$ssh_port\"); [ -n \"$identity_file\" ] && ssh_opts+=(-i \"$identity_file\")\n# Why: a fresh host's key isn't in known_hosts; a StrictHostKeyChecking prompt would HANG a\n# non-interactive create. Pre-add the key (or set the option) so it can't block.\nssh-keyscan -p \"$ssh_port\" \"$host\" >> \"$HOME/.ssh/known_hosts\" 2>/dev/null || true\n\n# 1. ensure the repo is present and at the right commit on the host (NO orca serve here)\nssh \"${ssh_opts[@]}\" \"$ssh_target\" \\\n  \"GH_TOKEN='$gh_token' GIT_TERMINAL_PROMPT=0 bash -lc '\n     set -euo pipefail\n     [ -d \\\"$project_root/.git\\\" ] || git clone \\\"$repo_url\\\" \\\"$project_root\\\"\n     cd \\\"$project_root\\\" && git fetch origin \\\"$repo_ref\\\" && git checkout -B \\\"$repo_ref\\\" FETCH_HEAD\n   '\" >&2\n\n# 2. print the SSH connection block (NO pairingCode, NO orca serve). host/port/username tell Orca's\n#    relay how to dial in; identityFile/jumpHost/proxyCommand/portForwards are emitted when set.\nnode -e 'const [host,port,user,idf,jh,pc,root]=process.argv.slice(1);\n  const target={ label:\"per-workspace-host\", host, port:Number(port), username:user };\n  if(idf) target.identityFile=idf; if(jh) target.jumpHost=jh; if(pc) target.proxyCommand=pc;\n  // add target.portForwards=[...] here if the workspace needs forwarded service ports\n  console.log(JSON.stringify({ schemaVersion:1, connection:{ type:\"ssh\", projectRoot:root, target } }))' \\\n  \"$host\" \"$ssh_port\" \"$ssh_username\" \"$identity_file\" \"$jump_host\" \"$proxy_command\" \"$project_root\"\n```\n\n`suspend`/`resume`/`destroy`: on a persistent host there's usually nothing to tear down — set\n`destroy: none` and omit suspend/resume. (Orca still disconnects/reconnects its own SSH relay on\nsleep/wake/delete — that's separate from these scripts.)\n\nIf the SSH host is instead an **ephemeral/snapshot-capable VM** (your hypervisor, or a cloud VM with\nimage support), keep the §7f Phase-2/3 base-image model for provisioning, but still emit the\n`connection.type:\"ssh\"` block above instead of starting `orca serve`.\n\n### 7h. Worked example — local Docker SSH (SSH connection mode)\n\nLocal Docker can model an ephemeral SSH VM without cloud cost: build a base image with `sshd`, tools,\nrepo prerequisites, and the agent CLI; run an **interactive auth container** once; then `docker commit`\nthat container as the authenticated image used by per-workspace `create`.\n\nKey points:\n\n- Publish container SSH to a random localhost port (`-p 127.0.0.1::22`) and emit\n  `connection.type:\"ssh\"` with `host:\"127.0.0.1\"`, that port, `username`, `identityFile`, and\n  `identitiesOnly:true`.\n- Generate a repo-local SSH key if needed, but gitignore the private/public key files.\n- **Bake SSH host keys into the base image** (`ssh-keygen -A` at **build** time; at runtime only generate\n  if absent). Ephemeral containers all present the **same** host key, so `known_hosts` on `127.0.0.1`\n  doesn't churn as the published port rotates across workspaces (otherwise every container's freshly\n  generated key collides on `localhost` and trips host-key-changed warnings).\n- The auth image is the Docker equivalent of Phase 3: the **user** runs the agent login **inside** the\n  container (you can't drive it — you have no interactive TTY), configures proxy env/config, approves\n  hooks, and you commit once they report it's done. On a headless container use the **device-auth** flow\n  (§4). Verify login before committing — exit code, or fold stderr and match the exact success line (§4).\n- Do not bind-mount or copy the host's full agent home into the image. Let each container have writable\n  agent state; only the committed auth image should carry reusable authenticated state.\n- If committing from an interactive shell, force the runtime entrypoint back to `sshd`:\n  `docker commit --change='ENTRYPOINT [\"/usr/local/bin/orca-docker-ssh-entrypoint\"]' …`.\n- `destroy` should read `recipeResult.userData.resourceId` and run `docker rm -f \"$resource_id\"`.\n\nValidation before wiring/live use:\n\n```bash\ndocker image inspect \"$auth_image\" --format '{{json .Config.Entrypoint}}'\ndocker run -d --name \"$name\" -p 127.0.0.1::22 -e \"ORCA_SSH_PUBLIC_KEY=$pubkey\" \"$auth_image\"\ndocker ps -a --filter \"name=$name\"\ndocker logs \"$name\"\nssh -i \"$key\" -p \"$port\" -o IdentitiesOnly=yes user@127.0.0.1 'codex --version'\n```\n\nIf the container exits immediately, inspect logs before the cleanup trap removes it; a committed\ninteractive image with `ENTRYPOINT [\"bash\"]` is a common cause.\n\nAlso confirm the **host key is stable** across containers: the SSH `ssh -i … 127.0.0.1` dial should not\ntrigger a host-key-changed warning when a second container reuses the port. If it does, the host keys\nweren't baked into the base image (see the `ssh-keygen -A` point above).\n\n### 7i. Windows local-side scripts\n\nThe local-side scripts run on the user's desktop. On **Windows**, a bare `.sh` won't execute. Either\nrequire WSL/Git-Bash (and point `orca.yaml` at e.g. `bash ./scripts/orca-vm/<name>.sh` via a `.cmd`\nlauncher), or scaffold PowerShell equivalents. Minimal PowerShell shape:\n\n```powershell\n#requires -Version 5\n$ErrorActionPreference = 'Stop'\n# resolve env→state→fallback; run the provider CLI / ssh the same way;\n# capture provider output; build the result object for the chosen mode and write ONE line of JSON to stdout.\n# Orca-server mode: @{ schemaVersion=1; pairingCode=$pairingCode; projectRoot=$projectRoot; userData=@{...} }\n# SSH mode:        @{ schemaVersion=1; connection=@{ type=\"ssh\"; projectRoot=$projectRoot;\n#                     target=@{ label=$label; host=$host; port=$port; username=$user } } }  (see §7g/§7h)\n($result | ConvertTo-Json -Compress -Depth 6)\n# progress/errors → Write-Error / the error stream, never stdout.\n```\n\nThe remote-side commands you run *inside* the Linux VM stay bash regardless of the desktop OS.\n\n---\n\n## 8. Per-workspace recipe contract (the fast path)\n\nOnce the authenticated snapshot exists, this runs on every workspace create. Define recipes in\n`orca.yaml`:\n\n```yaml\nenvironmentRecipes:\n  - id: cloud-sandbox\n    name: Cloud Sandbox\n    create: ./scripts/orca-vm/cloud-sandbox-create.sh\n    suspend: ./scripts/orca-vm/cloud-sandbox-suspend.sh\n    resume: ./scripts/orca-vm/cloud-sandbox-resume.sh\n    destroy: ./scripts/orca-vm/cloud-sandbox-destroy.sh\n```\n\n`create` runs **locally from the repo root** and prints **one** JSON object to stdout. Its shape depends\non the connection mode chosen in §1:\n\n**Orca-server mode** — boot the env, start `orca serve` in it, and print serve's result:\n\n```json\n{\n  \"schemaVersion\": 1,\n  \"pairingCode\": \"orca-pairing-code-or-url\",\n  \"projectRoot\": \"/absolute/path/to/repo/on/remote\",\n  \"userData\": { \"provider\": \"example\", \"resourceId\": \"provider-resource-id\" }\n}\n```\n\nHere `pairingCode` (from `orca serve --recipe-json`) and `projectRoot` are required; `schemaVersion` (`1`)\nand `userData` are optional.\n\n**SSH mode** — do **not** run `orca serve`; print the `connection.type:\"ssh\"` block instead (full shape +\nworked script in §7g). `pairingCode` is **not** used in SSH mode.\n\nLifecycle hooks (all run locally):\n\n- `create`: required. Prints recipe result JSON.\n- `suspend`: optional. Sleep; reads lifecycle payload on stdin.\n- `resume`: optional. Wake; reads payload on stdin and **prints fresh recipe JSON** (pairing may change).\n- `destroy`: optional unless `destroy: none`. Delete/cleanup; reads payload on stdin.\n\nStart Orca remotely with `orca serve --port \"$PORT\" --project-root \"$ABS_ROOT\" --pairing-address\n\"$EXTERNAL_WSS_URL\" --recipe-json` (exact flags + output in §7c). Set `--pairing-address` to the\nexternally reachable address so the emitted `pairingCode` is reachable; tunneling/port mapping is the\nscript's job.\n\nBackward compatibility: `command`→`create`, `cleanup`→`destroy`, `cleanup: none`→`destroy: none`.\nPrefer the lifecycle names.\n\n---\n\n## 9. Doctor and validation\n\nValidate in two stages — the cheap dry run first, then the live self-test.\n\n### Dry run (free, non-destructive) — always do this first\n\n`orca vm recipe doctor <recipe-id> --repo-path <repo> --json` validates **static wiring only** — it does\n**not** boot anything. It checks: local-host execution (v1), repo path, recipe id exists,\ncreate/destroy/suspend/resume command paths resolve, suspend/resume are paired, and each script is\nexecutable (POSIX exec bit; skipped on Windows). Fix every failure here before spending any cloud money.\n\n### Live self-test (`--provision`) — diagnose and iterate yourself\n\n`orca vm recipe doctor <recipe-id> --repo-path <repo> --provision --json` actually runs the recipe end\nto end: it executes `create`, validates the returned recipe JSON, then runs `destroy` to **tear the\nenvironment back down** (so the test leaves nothing running, as long as `destroy` works). It spends real\ncloud money, so get the user's OK **once** before starting — that one approval covers the whole loop\nbelow; do not re-ask before each run.\n\nOn failure, the JSON result includes a `provisionTranscript` with the **complete** captured output of\neach stage so you can self-diagnose without asking the user to relay logs:\n\n```json\n{\n  \"ok\": false,\n  \"checks\": [ { \"id\": \"recipe.provision\", \"status\": \"fail\", \"message\": \"…\" } ],\n  \"provisionTranscript\": {\n    \"provision\": { \"exitCode\": 0, \"signal\": null, \"stdout\": \"…\", \"stderr\": \"…\", \"parseError\": \"…\" },\n    \"destroy\":   { \"exitCode\": 0, \"signal\": null, \"stdout\": \"…\", \"stderr\": \"…\" }\n  }\n}\n```\n\n**Run it as a loop:** read `provisionTranscript.provision.stderr` / `.stdout` / `.parseError` (and\n`destroy.*`), fix the script, and re-run `--provision` until `ok` is `true` — iterating on your own\nrather than waiting for the user to paste errors. Common reads: a non-empty `stderr` with `exitCode 0`\nplus a `parseError` means `create` ran but printed something other than the single recipe-result JSON on\nstdout (often a stray `echo` — route it to stderr, see §10); a non-zero `exitCode` is a provider/script\nfailure described in `stderr`. Each stream is redacted and capped (head+tail) — large logs keep both the\nsetup context and the failure.\n\nThe self-test cannot see provider-side truth beyond what the scripts print, so still confirm: state has a\npopulated **authenticated** `snapshotId` (Phases 2–3 done), and `destroy` is implemented/tested (or\nexplicitly `none` — in which case the self-test won't tear down, so clean up manually).\n\nFor SSH recipes, also smoke-test the exact emitted target before declaring success: dial the host/port\nwith the identity/proxy settings, run `pwd`, verify the repo path, check the agent binary, and confirm\n`destroy` removes the provider resource/container. For Docker, inspect the auth image entrypoint and do a\nstartup-only `docker run` before the full clone/install path.\n\n---\n\n## 10. Failure modes\n\n- **Build exceeds plan timeout (e.g. Hobby 45m).** Use enough vCPUs and a timeout covering the build;\n  else split work or use a higher plan. The cap also limits per-workspace runtime — surface it.\n- **Build exceeds plan RAM.** Build the **headless main only** (drop the renderer) — the biggest fitter.\n- **Private-repo clone hangs/fails.** Wrong/missing token. Use `GIT_ASKPASS` + `GIT_TERMINAL_PROMPT=0`\n  so it fails fast instead of prompting.\n- **`GIT_ASKPASS` helper aborts the clone with \"`$1: unbound variable`\".** The `printf`/heredoc that writes\n  the helper inside `bash -lc` under `set -u` expanded `$1`/`$GH_TOKEN` at **write** time. Escape them\n  (`\\$1`, `\\$GH_TOKEN`) so they land literally and resolve at git-runtime; this also keeps the real token\n  out of the file. `rm -f` the helper afterward (§5, §7f).\n- **Agent verified as \"not logged in\" despite a good login.** `codex login status` (and similar) print\n  \"Logged in …\" to **stderr**; an stdout-only `grep` misses it. Prefer the status **exit code**; if you\n  grep, fold stderr first (`status 2>&1 | grep …`) and match the exact success line — not `grep -qi\n  'logged in'`, which also matches \"not logged in\".\n- **Headless agent login hangs.** Plain OAuth `login` starts a loopback callback server on a VM/container\n  port the host browser can't reach. Use the **device-auth** flow (`login --device-auth`) — it prints a\n  URL + code the user opens on the host.\n- **`known_hosts` host-key churn on local Docker.** Each ephemeral container regenerating its SSH host key\n  collides on `127.0.0.1` as the published port rotates. Bake host keys into the base image at build time\n  (`ssh-keygen -A`; runtime generates only if absent) so all containers share one stable key (§7h).\n- **Snapshot expired/evicted.** If `create` hits an unknown snapshot id, rerun Phases 2–3 and update\n  `snapshotId`.\n- **Agent auth didn't persist.** Confirm `snapshotId` points at the **authenticated** snapshot; re-run\n  Phase 3. Warn that short-lived tokens may need periodic re-auth.\n- **Agent auth copied from the host breaks.** Do not bind-mount/copy a full host agent home; sqlite\n  files can be unwritable or host-specific, hooks may need approval again, and config may reference\n  local-only env vars. Authenticate inside the runtime and snapshot/commit that layer.\n- **Docker auth image exits immediately.** Inspect `docker image inspect … .Config.Entrypoint` and\n  `docker logs`. If the image was committed from an interactive shell, reset the entrypoint to the SSH\n  entrypoint during `docker commit`.\n- **Leaked paid resource.** Every long script must trap errors and remove the sandbox it created.\n- **`create` emits non-JSON on stdout.** A stray `echo` corrupts the result — stdout is for the final\n  JSON only; everything else to stderr. The `--provision` self-test surfaces this as `exitCode 0` + a\n  `parseError` with the offending stdout in `provisionTranscript` (§9).\n\n---\n\n## 11. Boundaries\n\n- Don't create accounts, choose plans/regions, or invent scope/project/org/image/billing ids.\n- Don't invent or store credentials; no secrets in `userData`, state, comments, docs, or commits.\n- Don't run paid/long phases (base snapshot, auth, live test) without an explicit OK.\n- Don't hide provider errors behind generic messages — preserve actionable stderr.\n- Don't make Orca own provider lifecycle beyond invoking the configured scripts.\n- Don't commit or create an Orca workspace unless asked.\n"
 
 // oxfmt-ignore
-const ORCHESTRATION_MARKDOWN = "---\nname: orchestration\ndescription: >-\n  Use Orca orchestration for structured multi-agent coordination: threaded\n  messages, blocking ask/reply flows, task dispatch, worker_done/escalation\n  waits, task DAGs, decision gates, coordinator loops, or decomposing work\n  across agents. Use `orca-cli` instead for full ownership handoffs, including\n  requests phrased as \"hand off\", \"handoff\", \"handover\", \"give this to another\n  agent\", or \"another worktree\" when the user did not explicitly ask to\n  supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for\n  ordinary terminal control, lightweight terminal prompts, shell commands, Orca\n  worktree management, reading or waiting on terminals, and automation of the\n  browser embedded inside Orca. Use Computer Use for browser windows, webviews,\n  Orca app UI, or desktop UI outside Orca's embedded browser.\n---\n\n# Orca Inter-Agent Orchestration\n\nOrchestration is Orca's structured coordination layer for agent messages, task ownership, dispatch state, and worker completion tracking.\n\nUse this skill when coordination state matters. For lightweight terminal prompts or basic worktree/terminal/built-in-browser control, use `orca-cli`.\n\n## Tool Boundary\n\nIf a task says to use Orca orchestration, the coordinator must create or bind a Run, create the Task with `orca orchestration task-create`, then attach the worker with either the preferred `orca orchestration worker-start` composition or the low-level `orca orchestration dispatch --inject` path.\n\nDo not substitute non-Orca subagent tools, generic agent-spawn APIs, or chat-only parallel worker features. Those may create useful workers, but they do not create Orca task/dispatch provenance, injected lifecycle preambles, `worker_done` authority, or decision gates.\n\nBefore claiming a worker was orchestrated, verify the task/dispatch exists:\n\n```bash\norca orchestration task-list --json\norca orchestration dispatch-show --task <task_id> --json\n```\n\nIf the work was accidentally run outside Orca orchestration, say so plainly. To repair provenance, rerun or revalidate the needed work through a fresh Orca terminal plus injected dispatch; do not retroactively describe the external worker as orchestrated.\n\n## When To Use\n\n- Send/reply/ask between agent terminals with persistent messages.\n- Dispatch structured tasks to workers and wait for `worker_done` or `escalation`.\n- Track task DAGs with dependencies.\n- Run coordinator loops or decision gates.\n\nDo not use orchestration merely because the user says \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or asks for another worktree/agent/model/effort. Those are full ownership transfers unless the user explicitly asks to supervise, monitor, wait for worker completion/results, coordinate a DAG, use decision gates, or keep a blocking ask/reply loop.\n\n## Preconditions\n\n- `orca status --json` should show a running runtime.\n- `orca` must be on PATH (`orca-ide` on Linux).\n- The orchestration experimental feature must be enabled in Settings > Experimental.\n- `orca orchestration` commands are RPC calls to the running Orca runtime.\n\n## Contract Migration\n\nOrca adopts a live pre-update orchestration assignment into an ordinary Run. Adoption preserves the existing agent process, PTY/session, terminal handle, tab/leaf/pane, worktree or folder workspace, Task, and Dispatch; it never restarts or replaces the worker. The retired scheduler is not revived, and a newly created attempt uses the current grammar.\n\nTreat the authority label on injected or formatted messages as definitive:\n\n- `[LEGACY COMPATIBILITY]` is live and attested. Run only the exact supported command printed with the message, using the same CLI executable and arguments that the original prompt supplied.\n- `[LEGACY RECOVERY REPLAY — MAY HAVE BEEN SEEN]` is one bounded, at-least-once cutover replay. Process it idempotently and acknowledge it only through the exact displayed guidance.\n- `[LEGACY READ-ONLY]` is inspection-only. It has no reply, acknowledgment, or lifecycle action.\n- An unlabeled current message uses the current guide and current grammar.\n\nAn explicitly selected current Run, attested current Run binding, current Dispatch, or federated attachment takes precedence over legacy fallback. A retained adoption record alone never turns a current command into a legacy call.\n\nDatabase provenance, an old-looking terminal, or a legacy Run ID does not prove mutation authority. If the runtime cannot prove liveness, principal ownership, capability, or the exact legacy contract, it degrades to read-only inspection and must not fall back to local execution. Exact recovery may restore the already-live PTY once in its original inactive background tab. It must not spawn, write, signal, stop, switch, focus, split, or inject a terminal. Loss of lifecycle authority does not invalidate the existing assignment, process, or filesystem work.\n\nCompatibility retries have narrow guarantees. A pending ask, a reply, a final Dispatch settlement, and a consuming check have durable recovery identities. A-era heartbeat and escalation calls remain at-least-once across a manual A-to-B retry because identical later signals may be intentional. If an A-era ask may already have been answered, run the exact non-consuming recovery check printed by the runtime first; after its answer is printed and acknowledged, a new invocation with the same question creates a new question. Never guess among multiple identical question threads.\n\nWhen a compatibility or recovery command returns structured next-step arguments, run those exact arguments with the same CLI executable. The arguments intentionally omit the executable name so the guidance works with `orca`, `orca-ide`, `orca-dev`, or another configured Orca CLI command. Do not translate the command from memory, broaden its recipient, or retry it as a current mutation unless the returned guidance explicitly says to.\n\nOn packaged Windows, a legacy ask uses a two-step commit/resume protocol. The initial command durably commits the question, prints its exact `ask --resume <message_id>` command, and exits with launcher status `75`; it does not wait for the answer. Run that exact resume command after the launcher or update boundary. Resume is idempotent and read-oriented: it waits for the already-committed question and does not create another one. For a WSL process that received compatibility proof at launch, use the printed executable `orca-ide` WSL resume command so the same distro and packaged launcher authority are preserved; do not substitute a PATH-resolved local CLI. Older WSL processes that never received the hidden launch token remain lifecycle read-only after the update, even while their terminal and filesystem work continue.\n\nLegacy inspection remains available without consuming mail:\n\n```bash\norca orchestration run-list --json\n# run_legacy_local is an empty audit tombstone after adoption.\norca orchestration run-show --id run_legacy_local --json\n# In run-list, find the ordinary Run whose objective is:\n# \"Recovered orchestration work from a contract update\"\norca orchestration run-show --id <adopted_run_id> --json\norca orchestration task-list --run <adopted_run_id> --json\norca orchestration inbox --full --json\norca orchestration check --terminal <legacy_handle> --peek --format --json\norca terminal read --terminal <legacy_handle> --json\norca terminal wait --terminal <legacy_handle> --for tui-idle --timeout-ms 60000 --json\n```\n\nIf the original coordinator is unavailable or cannot prove its retained authority, a current coordinator may explicitly take over the adopted Run from its own live agent terminal:\n\n```bash\norca orchestration run-use --id <adopted_run_id> --takeover-legacy --json\norca orchestration check --run <adopted_run_id> --json\n```\n\nTakeover fences only the old coordinator, binds the current one, and moves pending worker mail into current Run Delivery. It is bound to the authenticated invoking terminal; `--from` cannot name another coordinator. Live legacy workers keep their original Tasks, Dispatches, processes, filesystems, and old prompt commands; their later questions, escalations, and completion reports route to the current coordinator. Do not use takeover while the original coordinator is still actively coordinating, because its later lifecycle mutations are rejected.\n\nDo not launch a replacement editor merely because the desktop app or runtime was updated. If adoption cannot prove continuing authority, keep the original worker as the only editor until it reaches a stable handoff point, then use a new current Dispatch in a conflict-free placement for any remaining work.\n\n## Ownership\n\nNew orchestration messages and tasks belong to one explicitly bound Run. A Run is only a durable namespace and coordinator inbox; it never schedules or places workers. Lifecycle authority comes from the active Dispatch, and terminal handles remain routing metadata rather than durable identity. Send `worker_done` and `heartbeat` from the worker's own terminal; Orca routes them to that Dispatch's Run.\n\nClassify inherited context before sending lifecycle messages:\n\n- Coordinated subtask: a live coordinator owns the DAG and waits on this dispatch. Follow the preamble exactly, including `worker_done`, heartbeat/status, `ask`, and `escalation`.\n- Full handoff means ownership transfer, not supervised dispatch. The original actor is not monitoring a DAG, so do not create lifecycle obligations unless the user explicitly asks you to supervise.\n- Classify requests containing \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"another agent\", or \"another worktree\" as full handoffs by default, even when the user names a custom model or reasoning effort.\n- Use supervised orchestration only when the user explicitly asks you to \"supervise\", \"monitor\", \"wait\", \"track completion\", \"wait for worker_done\", return results, coordinate a DAG, use a decision gate, or manage ask/reply flow.\n- Do not use `orca orchestration dispatch --inject` for full handoffs. It injects a coordinator preamble that tells the worker to send `worker_done`, heartbeat, and `ask` messages, then end its turn under the original terminal's dispatch lifecycle.\n- Do not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. Do not peek at terminal output after prompt delivery to monitor progress.\n- A review-only `worker_done` reports findings; it does not authorize coordinator file edits. After a review-only completion, synthesize findings, ask a decision gate if ownership is unclear, and dispatch or hand off fixes unless the user explicitly asked the coordinator to own fixes.\n- If the user's plan names a next owner agent (for example, \"then use opencode to create a PR\"), post-review corrections and PR prep belong to that named owner. The coordinator routes, synthesizes, asks decision gates when needed, and supervises; the named owner edits files and creates the PR.\n\nIf unclear, inspect orchestration state before sending lifecycle messages:\n\n```bash\norca orchestration task-list --json\norca terminal list --json\n# If inherited context includes a task id:\norca orchestration dispatch-show --task <task_id> --json\n```\n\n## Messaging\n\n```bash\norca orchestration send --subject <text> [--to <run:id|dispatch:id|legacy_handle>] [--from <handle>] [--body <text>] [--type <type>] [--priority <level>] [--thread-id <id>] [--payload <json>] [--json]\norca orchestration check [--terminal <handle>] [--ack <delivery_id>] [--peek|--all] [--types <type,...>] [--format] [--wait] [--timeout-ms <n>] [--json]\norca orchestration reply --id <msg_id> --body <text> [--from <handle>] [--json]\norca orchestration ask (--question <text>|--resume <msg_id>) [--options <csv>] [--timeout-ms <n>] [--from <handle>] [--json]\norca orchestration inbox [--limit <n>] [--json]\n```\n\nRules:\n\n- Omit `--from` unless impersonating another terminal; Orca auto-resolves it from the current terminal.\n- A coordinator `check` returns the bound Run's oldest FIFO Delivery (up to 50 messages) and replays that exact batch until `--ack <delivery_id>`. Process every message before acknowledging; `check --ack <id> --wait` acknowledges, checks, and waits in one operation.\n- Use `--peek` and `--all` only for read-only history/debugging. Type filters decide when a waiter wakes; the returned actionable Delivery is still the oldest full batch.\n- Use `dispatch:<id>` for coordinator guidance to one supervised worker. Orca routes that stable address locally or through the connected-server relay; do not substitute a remote terminal handle.\n- Terminal handles remain appropriate for low-level pre-Dispatch messaging. Prefer `agentTerminalHandle` from the create response, fall back to `startupTerminal.handle` for older runtimes, then re-resolve with `orca terminal list --worktree ... --json` if missing or stale. Continue with the replacement handle only; never dual-send to old and new handles.\n- `terminal list --json` omits `visualLayouts` because handle recovery does not need topology. Add `--include-visual-layouts` only for explicit tab and pane inspection.\n- `orca orchestration check --peek --format --json` returns locally formatted unread mail without consuming it; it never writes to terminal input or remotely wakes another terminal. Use `orchestration dispatch --inject` to deliver a tracked task, or `terminal send` when an existing agent needs a free-form prompt.\n- While supervising workers manually, use `check --wait --types worker_done,escalation,question --timeout-ms <n>` instead of sleep/poll loops. Process the whole Delivery, reply to `question` messages with `orca orchestration reply --id <msg_id> --body <answer> --json`, then acknowledge and keep waiting.\n- Treat a `check --wait` timeout or `{count:0}` as a checkpoint, not a worker failure. Long coding tasks routinely run 15-60 minutes; keep using rolling waits unless you receive `worker_done`/`escalation`, the terminal exits or disappears, or the user explicitly asks you to stop.\n- Heartbeats and visible terminal activity mean the worker is alive, not done. Do not stop, close, kill, or restart a worker just because it has not produced a completion message yet.\n- Use `ask` when a worker needs a blocking answer from the coordinator; it defaults to the active Dispatch's Run. Timeout or disconnect leaves the question pending, so resume by its original message ID instead of asking again.\n- `check --wait` returns one bounded Delivery, not every future completion. Process every message, acknowledge it, then keep waiting until every expected Dispatch settles.\n- Group addresses include `@all`, `@idle`, `@claude`, `@codex`, `@opencode`, `@gemini`, `@droid`, `@grok`, `@cursor`, and `@worktree:<id>`.\n- Message types include `status`, `dispatch`, `worker_done`, `merge_ready`, `escalation`, `handoff`, `question`, `decision_gate` (legacy/gates), and `heartbeat`.\n- Use group addresses only for messages that are genuinely useful to many terminals, such as `status` broadcasts or intentional fan-out questions. Do not send dispatch lifecycle messages to groups.\n- `worker_done` belongs to the active Dispatch and defaults to its Run mailbox; never target a group.\n- A valid `worker_done` for the active `taskId` + `dispatchId` marks the task and dispatch completed automatically. Do not follow it with `task-update --status completed`; reserve manual updates for explicit recovery or overrides.\n- `heartbeat` is also Dispatch-scoped. Include both IDs and omit `--to` so Orca uses the owning Run; use `status` for broad progress updates.\n\n## Tasks And Dispatch\n\nA Run is the namespace/inbox, a Task is the work item, and a Dispatch assigns one Task attempt to a terminal. Create or bind a Run once before the common loop.\n\n```bash\norca orchestration run-create --objective <text> --json\norca orchestration task-create --spec <text> [--deps <json_array>] [--parent <task_id>] [--json]\norca orchestration task-list [--status <status>] [--ready] [--brief] [--json]\norca orchestration task-update --id <task_id> --status <status> [--result <json>] [--json]\norca orchestration dispatch --task <task_id> --to <handle> [--from <handle>] [--inject] [--json]\norca orchestration dispatch-show --task <task_id> [--json]\n```\n\nTask statuses: `pending`, `ready`, `dispatched`, `completed`, `failed`, `blocked`.\n\nDispatch rules:\n\n- `--inject` sends the task spec plus preamble into a recognized agent CLI so it can report `worker_done`.\n- If the target is a bare shell, omit `--inject`, dispatch for tracking if needed, then send the prompt manually with `orca terminal send --terminal <handle> --text <prompt> --enter --json`.\n- After 3 consecutive failures on one task, the dispatch context circuit-breaks and the task is marked failed.\n- Use `task-list --brief --json` for coordinator sweeps; it collapses whitespace and caps each echoed spec at 160 characters (`spec_truncated` marks shortened rows). Omit `--brief` when the full spec is required, or when an older CLI rejects it as an unknown flag.\n\n## Preferred Supervised Worker Loop\n\nUse `worker-start` for the normal supervised path. It composes the existing worktree, terminal, readiness, and dispatch primitives while returning exact created/reused effects. Agents still choose placement and concurrency; Orca does not schedule workers or infer conflicts.\n\nCreate the Run and every independent Task first, then start all independent workers before waiting:\n\n```bash\norca orchestration run-create --objective \"<objective>\" --json\norca orchestration task-create --spec \"<worker A task>\" --json\norca orchestration task-create --spec \"<worker B task>\" --json\norca orchestration worker-start --task <task_a> --worktree current --agent codex --json\norca orchestration worker-start --task <task_b> --worktree current --agent claude --json\n```\n\n`current` and exact existing worktrees create a fresh agent terminal and do not rerun setup. Reuse an existing agent only with `--terminal <handle>`.\n\nFor a per-invocation Claude, Codex, or Cursor launch, pass an opaque provider model id with `--model`; add `--effort` only when that agent/model supports the level. These options apply only to fresh agent terminals, override general agent default arguments, and are reported under `launch.requested` and `launch.effective` in the receipt:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree current --agent claude --model aws-bedrock-opus-5 --effort high --json\n```\n\n`--effort` requires `--model`, and neither option can combine with `--terminal`. A connected worker server must advertise launch-preference support before Orca forwards either option.\n\nFor a new worktree, setup runs by default and agent-first creation reuses the returned startup agent terminal:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree new-child --name <name> --agent codex --setup run --json\n# Independent/top-level:\norca orchestration worker-start --task <task_id> --worktree new-top-level --name <name> --agent codex --setup run --json\n```\n\nSetup normally starts alongside the agent. Only a repository explicitly configured with `wait-for-setup` delays agent launch until setup succeeds. Use `--setup skip` or `--setup inherit` only for a concrete reason.\n\nRead the returned receipt before continuing: `ready` plus setup `running` is normal for start-immediately, while wait-for-setup returns setup `succeeded` before accepting task input. A failed or unknown start exits nonzero; inspect its `stage`, `effects`, and `residualResources` instead of guessing or automatically retrying. A wait-for-setup timeout can honestly leave setup `running`, which is not proof of failure.\n\nTo run the worker on another connected Orca server, add `--on <saved-environment>`. The Run and Tasks remain authoritative on the current server; later commands route by Dispatch ID, so never repeat `--on`:\n\n```bash\n# Mac Run home -> Windows worker (the reverse is identical from a Windows Run home)\norca orchestration worker-start --task <task_id> --on windows --worktree new-top-level --repo <exact_remote_repo_selector> --name <name> --agent codex --setup run --json\norca orchestration worker-show --dispatch <dispatch_id> --json\norca orchestration worker-read --dispatch <dispatch_id> --limit 50 --json\norca orchestration send --to dispatch:<dispatch_id> --subject \"Follow-up\" --body \"<attempt-specific guidance>\" --json\n```\n\nRemote `current` and `new-child` are intentionally invalid because those words are ambiguous across servers. Use an exact discovered remote worktree selector or `new-top-level` with an explicit remote repo selector.\n\nThe follow-up is structured inbox mail, not prompt injection. The worker's next\n`orchestration check` receives it even when the Dispatch is on another connected Orca server.\n\n`worker-read` defaults to `--source auto`: Orca returns the exact hook-reported Codex, Claude, OpenClaude, or Grok transcript when it can prove the worker session, otherwise it returns bounded terminal output with `source: \"terminal\"` and a typed `fallbackReason`. Continue with the returned top-level `cursor`; it stays pinned to that exact source. If Orca reports `source_changed`, start a fresh read without the old cursor. Never supply or guess a provider session ID or transcript path.\n\nWait until every expected Dispatch settles, not for a fixed number of batches:\n\n```bash\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n# Process every message. For each accepted worker_done that is not immediately reused:\norca orchestration worker-release --dispatch <dispatch_id> --json\n# Acknowledge only after every message and required release decision is handled:\norca orchestration check --ack <delivery_id> --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\nAfter processing each accepted `worker_done`, choose the terminal's next owner before you acknowledge the Delivery or wait again. If the same exact agent has an immediate follow-up Task, read the `worker.agent_terminal_handle` field of `worker-show --dispatch <dispatch_id> --json`, then run `orca orchestration worker-start --task <next_task_id> --terminal <handle> --json` so Orca transfers cleanup ownership to the new Dispatch. Otherwise run `orca orchestration worker-release --dispatch <dispatch_id> --json`.\n\nRun `worker-release` after both succeeded and failed `worker_done` reports unless the user explicitly asked to keep that worker live. Release is post-completion cleanup, not cancellation: Orca first preserves inspectable output, then closes only the exact agent terminal owned by that settled Dispatch. Reused or pre-existing terminals, setup terminals, coordinators, active workers, user-taken-over terminals, and identities Orca cannot prove are retained. If the user explicitly asks to keep the live terminal for debugging, record that exception with `orca orchestration worker-retain --dispatch <dispatch_id> --json` instead of silently skipping cleanup. When the user is finished, the same Dispatch can be passed to `worker-release`, which clears the requested retention and releases the terminal.\n\nDo not release a worker because of a timeout, TUI idle state, heartbeat, status, question, escalation, or rejected/stale `worker_done`. If release returns `release_pending` or `release_unknown`, do not substitute `terminal close`; follow the exact recovery action in the receipt. A replayed Delivery may repeat `worker-release` safely.\n\nWorkers report exactly once using the IDs and capability injected by Orca; they do not supply Run/server/terminal identity:\n\n```bash\norca orchestration send --type worker_done --subject \"<status>\" --body \"<what changed, findings, and what remains>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a,path/b\" --json\n# On failure, use --outcome failed; never encode failure only in prose.\n```\n\nA worker question defaults to its owning Run. Timeout leaves it pending:\n\n```bash\norca orchestration ask --question \"<question>\" --options \"yes,no\" --timeout-ms 600000 --json\norca orchestration ask --resume <message_id> --timeout-ms 600000 --json\n# Coordinator:\norca orchestration reply --id <message_id> --body \"<answer>\" --json\n```\n\nRecovery is conditional, never a fixed destructive sequence:\n\n- `worker-show --dispatch <id>` says `ready`: keep waiting or read bounded output.\n- It proves `failed` or `stopped`: start a replacement with `worker-start --task <task> --retry-of <id>` plus an explicit `--on`/`--worktree` and `--agent`/`--terminal` choice. Retry does not silently inherit placement.\n- It remains `outcome_unknown`: either `worker-stop --dispatch <id>` and inspect again, or explicitly `worker-abandon --dispatch <id>` while accepting that resources may still be live. Abandon performs no remote, process, or filesystem action.\n- `worker-stop` closes only the exact supervised agent terminal. It never deletes the worktree, setup terminal, configured tabs, or unrelated processes.\n\nLow-level `worktree create`, `terminal create`, and `dispatch --inject` remain valid recipes for custom argv or topology that `worker-start` does not express.\n\n## Gates And Legacy Inspection\n\n```bash\norca orchestration gate-create --task <task_id> --question <text> [--options <json_array>] [--json]\norca orchestration gate-resolve --id <gate_id> --resolution <text> [--json]\norca orchestration gate-list [--task <task_id>] [--status <status>] [--json]\n```\n\nUse `ask` for worker-to-coordinator questions; it creates a `question` message that the coordinator answers with `reply`. Use `gate-create` only for coordinator-managed task DAG decisions, not for answering a worker's `ask`.\n\n`coordinator-start`, `coordinator-stop`, `run`, and `run-stop` are retired scheduler commands. They perform no effects and return the current-skill recovery action. They are not aliases for lightweight Run creation or binding.\n\nRecovery only: `orca orchestration reset --tasks|--messages|--all --json` clears the selected local orchestration database state. Do not run it during active coordination unless explicitly abandoning that state.\n\n## Full Handoffs\n\nFor full ownership transfer, use non-lifecycle terminal/worktree commands and then stop monitoring unless the user asks for supervision.\n\nTreat these as full handoff requests by default: \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"send this to another agent\", \"another agent\", \"another worktree\", or \"launch another agent to own this.\" Custom model or reasoning effort words such as `gpt-5.5`, `high`, or `xhigh` do not make the handoff supervised.\n\nSupervised orchestration remains available only when the user explicitly asks for supervision or coordination: \"supervise\", \"monitor\", \"wait for worker_done\", \"wait for results\", \"track completion\", \"DAG\", \"decision gate\", \"ask/reply\", or \"coordinate workers.\"\n\nDo not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. `task-create` is also forbidden because it records coordinator-owned tracking state; if a task row is needed, the user asked for supervised orchestration. Do not create a `taskId`/`dispatchId`, inject a lifecycle preamble, wait for completion, or read the worker terminal after prompt delivery except to avoid losing the initial prompt.\n\nNew top-level worktree handoff:\n\n```bash\norca worktree create --name <task-name> --no-parent --agent codex --prompt \"<task brief>\" --setup run --json\n```\n\nBefore creating a new worktree from an active feature branch, decide and state whether the desired Orca lineage is child or top-level. Use child worktree lineage only when the new work is conceptually stacked under or dependent on the active worktree. For independent repo-wide fixes, standalone feature work, or unrelated follow-up tasks, create a top-level worktree with `--no-parent`.\n\nExisting terminal handoff:\n\n```bash\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nCustom Codex model/effort handoff:\n\n`orca worktree create --agent codex --prompt ...` launches the known Codex agent but does not accept Codex-specific `--model` or `-c model_reasoning_effort=...` arguments. When the user asks for a specific Codex model or effort, create the independent worktree first, launch Codex with the requested command in that worktree, wait only for TUI readiness if prompt delivery would otherwise race startup, send the prompt, and stop.\n\nThe two-step custom-argv path cannot enforce a repository's explicit `wait-for-setup` startup policy because the later `terminal create` is not the startup owned by `worktree create`. Use it only when the repository starts agents immediately. If the repository requires `wait-for-setup`, use an agent-first configured launcher that can preserve sequencing, or stop and ask rather than silently bypassing the policy.\n\nNote: when no repo default-terminal configuration supplies a primary terminal, bare create opens a fallback shell before `terminal create` adds the agent. Configured default tabs are materialized instead and may run real commands. Prefer `--agent` whenever custom argv is not required. With the two-step path, target only the agent handle; close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell.\n\nUse the exact full `<repo-id>::<path>` worktree id returned by `orca worktree create --json`; a bare repo id cannot target the new worktree.\n\n```bash\norca worktree create --name <task-name> --no-parent --setup run --json\norca terminal create --worktree id:<newFullWorktreeId> --title <task-name> --command 'codex --model gpt-5.5 -c model_reasoning_effort=\"xhigh\"' --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nWait only for `tui-idle` when needed to avoid losing the prompt. Do not monitor task completion.\n\n`--no-parent` only controls Orca lineage; it does not choose the Git base. If the work should start from the repo default base, omit `--base-branch` so Orca uses that default, or explicitly pass the repo default base (`origin/main`, `origin/master`, or the `orca repo show --repo <selector> --json` value); never base it on the current feature branch unless the user explicitly asks for stacked work or \"branch from current\". Put current-branch context in the prompt instead.\n\n## Worker Terminals\n\nChoose the worker location before creating a terminal. `Fresh worker` means a fresh agent session, not a new git worktree. For parallel work, create one fresh agent terminal per worker in the same required worktree, falling back to the active worktree when none is named. If the task says current worktree only, depends on uncommitted files/artifacts, or must validate/PR the current branch, keep every worker in the active worktree:\n\n```bash\norca terminal create --worktree active --title <task-name> --command \"codex\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nReuse an idle agent in the required worktree only if the prompt allows reuse; otherwise create a fresh terminal there. Create a new worktree only when the user explicitly requests one or a concrete checkout or filesystem conflict makes sharing unsafe or impossible; if the user did not request it, state that conflict before running `worktree create`. Independent tasks, parallel execution, convenience, or a preference for separate checkouts are not isolation requirements.\n\nWhen a new worktree is allowed, use child lineage for isolated work that is stacked under or dependent on the active worktree, and use `--no-parent` when it is not stacked. Decide the Git base separately: `--no-parent` makes the worktree top-level in Orca, while omitted `--base-branch` uses the repo default base.\n\nFor every new worktree, pass `--setup run` so any configured repository setup hook runs. This does not mean waiting for setup before agent launch: preserve the repository's startup policy, whose default starts setup and the agent side by side. Use `--setup skip` or `--setup inherit` only when there is a concrete task-specific reason, and state that reason before creating the worktree. This rule does not rerun setup for current or existing worktrees.\n\n```bash\norca worktree create --name <task-name> --agent codex --setup run --json\n# or: --agent claude | omp | pi | grok | ...\n# Read <handle> from agentTerminalHandle, falling back to startupTerminal.handle.\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nFor new-worktree workers, read the id and `agentTerminalHandle` from `worktree create`, falling back to `startupTerminal.handle` for older runtimes. Use that as the sole worker handle when present; otherwise use `terminal list` to resolve the agent handle. Omit `--repo` only inside an Orca-managed worktree; otherwise pass `--repo <selector>`.\n\n**For an allowed new worktree, use agent-first:** `--agent` reveals the new worktree and launches the selected agent **in its first terminal**, without adding a separate fallback shell for that worker. Pass `--setup run`; repo setup and default-terminal settings may add intentional tabs or splits. Do **not** run bare `worktree create` and then `terminal create --command <agent>` for the same worker when agent-first create is available: without configured default tabs, that two-step path leaves a fallback shell + agent pair. Only use it when custom agent argv is required (for example Codex model/effort flags) or when an older CLI rejects `--agent`; if you must, message only the agent handle. Configured default tabs are intentional surfaces, so close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell. Do not run `worktree create` when the task must stay in the current worktree.\n\nUse `orca worktree create --prompt ...` or `orca terminal send ...` for full handoffs or untracked/lightweight prompts. Those paths do not attach `taskId`/`dispatchId`; the worker should not send lifecycle messages unless the prompt supplies a live orchestration preamble.\n\nSidebar lineage and orchestration lifecycle are related but not identical. A same-worktree worker may appear as a peer under that worktree in the sidebar while remaining a child dispatch in orchestration state; only an actual child worktree creates visible parent/child worktree lineage.\n\nOther terminal commands coordinators often need:\n\n```bash\norca terminal list [--worktree <selector>] [--include-visual-layouts] [--json]\norca terminal create [--worktree <selector>] [--title <text>] [--command <cmd>] [--json]\norca terminal split --terminal <handle> [--direction horizontal|vertical] [--command <cmd>] [--json]\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms <n> --json\norca terminal read --terminal <handle> --json\norca terminal send --terminal <handle> --text <text> --enter --json\n```\n\nIf an older CLI rejects `worktree create --agent`, create the worktree normally, then run `orca terminal create --worktree <selector> --command \"codex\" --json` or `--command \"claude\"`.\n\nWait for `tui-idle` before dispatching. Always pass `--timeout-ms`; real coding tasks can take 15-60 minutes. During supervision, use rolling `check --wait` windows. If a window returns no matching message, inspect `task-list`, `terminal read`, or `terminal wait --for tui-idle` as a liveness checkpoint; if the terminal is still working or producing activity, keep waiting instead of retrying the task.\n\n## Agent Guidance\n\n- Workers with a valid live preamble must send `worker_done` exactly once from their own terminal with an explicit `--outcome succeeded` or `--outcome failed`:\n  `orca orchestration send --type worker_done --subject \"<short status>\" --body \"<3-sentence summary: what you did, what you found, what's left>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a\" --report-path \"<optional>\" --json`\n- A failed outcome is still a terminal report, but Orca records both the Dispatch and Task as failed. Never encode failure only in the subject/body.\n- After sending `worker_done`, end your turn and idle at the agent prompt. The coordinator may reuse or release this terminal after it processes your report; do not start more work, poll, or attempt to close the terminal yourself. If it reuses you, it re-engages you with a fresh preamble + TASK block delivered as new terminal input.\n- For long tasks, send heartbeat/status only when the preamble asks for it, including both IDs:\n  `orca orchestration send --type heartbeat --subject \"alive\" --payload '{\"taskId\":\"<task_id>\",\"dispatchId\":\"<dispatch_id>\",\"phase\":\"implementing\"}' --json`\n- If blocked before completion, use `ask`; use `escalation` only when ownership is valid and the coordinator must intervene.\n- Treat preambles inherited through terminal history or full handoffs as stale unless the current prompt explicitly keeps that coordinator in the loop.\n- Coordinators must account for every settled worker terminal before waiting again or ending the turn: immediately reuse the exact worker for a new Dispatch, explicitly retain it at the user's request with `worker-retain`, or run `worker-release`. Do not leave a completed worker live merely to inspect output; released workers remain readable through `worker-read`.\n- Coordinators should use `task-list --ready` as external memory, dispatch parallel waves, and avoid dependency chains deeper than 3-4 steps.\n\n## Example\n\n```bash\norca terminal create --worktree active --title login-css-worker --command \"claude\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration task-create --spec \"Fix the login button CSS\" --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\n## Next Action\n\nCoordinator: confirm `orca status --json`, create or bind a Run, inspect `task-list`/`dispatch-show` if inheriting state, then use the explicit supervised loop (`task-create` -> `worker-start` -> `check --wait`). Use low-level terminal creation plus `dispatch --inject` only when the composed start does not express the needed topology. After every accepted `worker_done`, either transfer the exact terminal to an immediate follow-up Dispatch or run `worker-release` before the next wait.\n\nWorker: if the current prompt contains a live dispatch preamble, do the task, use `ask` for blocking questions, and send `worker_done` once with the required payload. If the preamble is stale or absent, do not send lifecycle messages; inspect state or treat the prompt as an ordinary handoff.\n"
+const ORCHESTRATION_MARKDOWN = "---\nname: orchestration\ndescription: >-\n  Use Orca orchestration for structured multi-agent coordination: threaded\n  messages, blocking ask/reply flows, task dispatch, worker_done/escalation\n  waits, task DAGs, decision gates, coordinator loops, or decomposing work\n  across agents. Use `orca-cli` instead for full ownership handoffs, including\n  requests phrased as \"hand off\", \"handoff\", \"handover\", \"give this to another\n  agent\", or \"another worktree\" when the user did not explicitly ask to\n  supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for\n  ordinary terminal control, lightweight terminal prompts, shell commands, Orca\n  worktree management, reading or waiting on terminals, and automation of the\n  browser embedded inside Orca. Use Computer Use for browser windows, webviews,\n  Orca app UI, or desktop UI outside Orca's embedded browser.\n---\n\n# Orca Inter-Agent Orchestration\n\nOrchestration is Orca's structured coordination layer for agent messages, task ownership, dispatch state, and worker completion tracking.\n\nUse this skill when coordination state matters. For lightweight terminal prompts or basic worktree/terminal/built-in-browser control, use `orca-cli`.\n\n## Tool Boundary\n\nIf a task says to use Orca orchestration, the coordinator must create or bind a Run, create the Task with `orca orchestration task-create`, then attach the worker with either the preferred `orca orchestration worker-start` composition or the low-level `orca orchestration dispatch --inject` path.\n\nDo not substitute non-Orca subagent tools, generic agent-spawn APIs, or chat-only parallel worker features. Those may create useful workers, but they do not create Orca task/dispatch provenance, injected lifecycle preambles, `worker_done` authority, or decision gates.\n\nBefore claiming a worker was orchestrated, verify the task/dispatch exists:\n\n```bash\norca orchestration task-list --json\norca orchestration dispatch-show --task <task_id> --json\n```\n\nIf the work was accidentally run outside Orca orchestration, say so plainly. To repair provenance, rerun or revalidate the needed work through a fresh Orca terminal plus injected dispatch; do not retroactively describe the external worker as orchestrated.\n\n## When To Use\n\n- Send/reply/ask between agent terminals with persistent messages.\n- Dispatch structured tasks to workers and wait for `worker_done` or `escalation`.\n- Track task DAGs with dependencies.\n- Run coordinator loops or decision gates.\n\nDo not use orchestration merely because the user says \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or asks for another worktree/agent/model/effort. Those are full ownership transfers unless the user explicitly asks to supervise, monitor, wait for worker completion/results, coordinate a DAG, use decision gates, or keep a blocking ask/reply loop.\n\n## Preconditions\n\n- `orca status --json` should show a running runtime.\n- `orca` must be on PATH (`orca-ide` on Linux).\n- The orchestration experimental feature must be enabled in Settings > Experimental.\n- `orca orchestration` commands are RPC calls to the running Orca runtime.\n\n## Contract Migration\n\nOrca adopts a live pre-update orchestration assignment into an ordinary Run. Adoption preserves the existing agent process, PTY/session, terminal handle, tab/leaf/pane, worktree or folder workspace, Task, and Dispatch; it never restarts or replaces the worker. The retired scheduler is not revived, and a newly created attempt uses the current grammar.\n\nTreat the authority label on injected or formatted messages as definitive:\n\n- `[LEGACY COMPATIBILITY]` is live and attested. Run only the exact supported command printed with the message, using the same CLI executable and arguments that the original prompt supplied.\n- `[LEGACY RECOVERY REPLAY — MAY HAVE BEEN SEEN]` is one bounded, at-least-once cutover replay. Process it idempotently and acknowledge it only through the exact displayed guidance.\n- `[LEGACY READ-ONLY]` is inspection-only. It has no reply, acknowledgment, or lifecycle action.\n- An unlabeled current message uses the current guide and current grammar.\n\nAn explicitly selected current Run, attested current Run binding, current Dispatch, or federated attachment takes precedence over legacy fallback. A retained adoption record alone never turns a current command into a legacy call.\n\nDatabase provenance, an old-looking terminal, or a legacy Run ID does not prove mutation authority. If the runtime cannot prove liveness, principal ownership, capability, or the exact legacy contract, it degrades to read-only inspection and must not fall back to local execution. Exact recovery may restore the already-live PTY once in its original inactive background tab. It must not spawn, write, signal, stop, switch, focus, split, or inject a terminal. Loss of lifecycle authority does not invalidate the existing assignment, process, or filesystem work.\n\nCompatibility retries have narrow guarantees. A pending ask, a reply, a final Dispatch settlement, and a consuming check have durable recovery identities. A-era heartbeat and escalation calls remain at-least-once across a manual A-to-B retry because identical later signals may be intentional. If an A-era ask may already have been answered, run the exact non-consuming recovery check printed by the runtime first; after its answer is printed and acknowledged, a new invocation with the same question creates a new question. Never guess among multiple identical question threads.\n\nWhen a compatibility or recovery command returns structured next-step arguments, run those exact arguments with the same CLI executable. The arguments intentionally omit the executable name so the guidance works with `orca`, `orca-ide`, `orca-dev`, or another configured Orca CLI command. Do not translate the command from memory, broaden its recipient, or retry it as a current mutation unless the returned guidance explicitly says to.\n\nOn packaged Windows, a legacy ask uses a two-step commit/resume protocol. The initial command durably commits the question, prints its exact `ask --resume <message_id>` command, and exits with launcher status `75`; it does not wait for the answer. Run that exact resume command after the launcher or update boundary. Resume is idempotent and read-oriented: it waits for the already-committed question and does not create another one. For a WSL process that received compatibility proof at launch, use the printed executable `orca-ide` WSL resume command so the same distro and packaged launcher authority are preserved; do not substitute a PATH-resolved local CLI. Older WSL processes that never received the hidden launch token remain lifecycle read-only after the update, even while their terminal and filesystem work continue.\n\nLegacy inspection remains available without consuming mail:\n\n```bash\norca orchestration run-list --json\n# run_legacy_local is an empty audit tombstone after adoption.\norca orchestration run-show --id run_legacy_local --json\n# In run-list, find the ordinary Run whose objective is:\n# \"Recovered orchestration work from a contract update\"\norca orchestration run-show --id <adopted_run_id> --json\norca orchestration task-list --run <adopted_run_id> --json\norca orchestration inbox --full --json\norca orchestration check --terminal <legacy_handle> --peek --format --json\norca terminal read --terminal <legacy_handle> --json\norca terminal wait --terminal <legacy_handle> --for tui-idle --timeout-ms 60000 --json\n```\n\nIf the original coordinator is unavailable or cannot prove its retained authority, a current coordinator may explicitly take over the adopted Run from its own live agent terminal:\n\n```bash\norca orchestration run-use --id <adopted_run_id> --takeover-legacy --json\norca orchestration check --run <adopted_run_id> --json\n```\n\nTakeover fences only the old coordinator, binds the current one, and moves pending worker mail into current Run Delivery. It is bound to the authenticated invoking terminal; `--from` cannot name another coordinator. Live legacy workers keep their original Tasks, Dispatches, processes, filesystems, and old prompt commands; their later questions, escalations, and completion reports route to the current coordinator. Do not use takeover while the original coordinator is still actively coordinating, because its later lifecycle mutations are rejected.\n\nDo not launch a replacement editor merely because the desktop app or runtime was updated. If adoption cannot prove continuing authority, keep the original worker as the only editor until it reaches a stable handoff point, then use a new current Dispatch in a conflict-free placement for any remaining work.\n\n## Ownership\n\nNew orchestration messages and tasks belong to one explicitly bound Run. A Run is only a durable namespace and coordinator inbox; it never schedules or places workers. Lifecycle authority comes from the active Dispatch, and terminal handles remain routing metadata rather than durable identity. Send `worker_done` and `heartbeat` from the worker's own terminal; Orca routes them to that Dispatch's Run.\n\nClassify inherited context before sending lifecycle messages:\n\n- Coordinated subtask: a live coordinator owns the DAG and waits on this dispatch. Follow the preamble exactly, including `worker_done`, heartbeat/status, `ask`, and `escalation`.\n- Full handoff means ownership transfer, not supervised dispatch. The original actor is not monitoring a DAG, so do not create lifecycle obligations unless the user explicitly asks you to supervise.\n- Classify requests containing \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"another agent\", or \"another worktree\" as full handoffs by default, even when the user names a custom model or reasoning effort.\n- Use supervised orchestration only when the user explicitly asks you to \"supervise\", \"monitor\", \"wait\", \"track completion\", \"wait for worker_done\", return results, coordinate a DAG, use a decision gate, or manage ask/reply flow.\n- Do not use `orca orchestration dispatch --inject` for full handoffs. It injects a coordinator preamble that tells the worker to send `worker_done`, heartbeat, and `ask` messages, then end its turn under the original terminal's dispatch lifecycle.\n- Do not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. Do not peek at terminal output after prompt delivery to monitor progress.\n- A review-only `worker_done` reports findings; it does not authorize coordinator file edits. After a review-only completion, synthesize findings, ask a decision gate if ownership is unclear, and dispatch or hand off fixes unless the user explicitly asked the coordinator to own fixes.\n- If the user's plan names a next owner agent (for example, \"then use opencode to create a PR\"), post-review corrections and PR prep belong to that named owner. The coordinator routes, synthesizes, asks decision gates when needed, and supervises; the named owner edits files and creates the PR.\n\nIf unclear, inspect orchestration state before sending lifecycle messages:\n\n```bash\norca orchestration task-list --json\norca terminal list --json\n# If inherited context includes a task id:\norca orchestration dispatch-show --task <task_id> --json\n```\n\n## Messaging\n\n```bash\norca orchestration send --subject <text> [--to <run:id|dispatch:id|legacy_handle>] [--from <handle>] [--body <text>] [--type <type>] [--priority <level>] [--thread-id <id>] [--payload <json>] [--json]\norca orchestration check [--terminal <handle>] [--ack <delivery_id>] [--peek|--all] [--types <type,...>] [--format] [--wait] [--timeout-ms <n>] [--json]\norca orchestration reply --id <msg_id> --body <text> [--from <handle>] [--json]\norca orchestration ask (--question <text>|--resume <msg_id>) [--options <csv>] [--timeout-ms <n>] [--from <handle>] [--json]\norca orchestration inbox [--limit <n>] [--json]\n```\n\nRules:\n\n- Omit `--from` unless impersonating another terminal; Orca auto-resolves it from the current terminal.\n- A coordinator `check` returns the bound Run's oldest FIFO Delivery (up to 50 messages) and replays that exact batch until `--ack <delivery_id>`. Process every message before acknowledging; `check --ack <id> --wait` acknowledges, checks, and waits in one operation.\n- Use `--peek` and `--all` only for read-only history/debugging. Type filters decide when a waiter wakes; the returned actionable Delivery is still the oldest full batch.\n- Use `dispatch:<id>` for coordinator guidance to one supervised worker. Orca routes that stable address locally or through the connected-server relay; do not substitute a remote terminal handle.\n- Terminal handles remain appropriate for low-level pre-Dispatch messaging. Prefer `agentTerminalHandle` from the create response, fall back to `startupTerminal.handle` for older runtimes, then re-resolve with `orca terminal list --worktree ... --json` if missing or stale. Continue with the replacement handle only; never dual-send to old and new handles.\n- `terminal list --json` omits `visualLayouts` because handle recovery does not need topology. Add `--include-visual-layouts` only for explicit tab and pane inspection.\n- `orca orchestration check --peek --format --json` returns locally formatted unread mail without consuming it; it never writes to terminal input or remotely wakes another terminal. Use `orchestration dispatch --inject` to deliver a tracked task, or `terminal send` when an existing agent needs a free-form prompt.\n- While supervising workers manually, use `check --wait --types worker_done,escalation,question --timeout-ms <n>` instead of sleep/poll loops. Process the whole Delivery, reply to `question` messages with `orca orchestration reply --id <msg_id> --body <answer> --json`, then acknowledge and keep waiting.\n- Treat a `check --wait` timeout or `{count:0}` as a checkpoint, not a worker failure. Long coding tasks routinely run 15-60 minutes; keep using rolling waits unless you receive `worker_done`/`escalation`, the terminal exits or disappears, or the user explicitly asks you to stop.\n- Heartbeats and visible terminal activity mean the worker is alive, not done. Do not stop, close, kill, or restart a worker just because it has not produced a completion message yet.\n- Use `ask` when a worker needs a blocking answer from the coordinator; it defaults to the active Dispatch's Run. Timeout or disconnect leaves the question pending, so resume by its original message ID instead of asking again.\n- `check --wait` returns one bounded Delivery, not every future completion. Process every message, acknowledge it, then keep waiting until every expected Dispatch settles.\n- Group addresses include `@all`, `@idle`, `@claude`, `@codex`, `@opencode`, `@gemini`, `@droid`, `@grok`, `@cursor`, and `@worktree:<id>`.\n- Message types include `status`, `dispatch`, `worker_done`, `merge_ready`, `escalation`, `handoff`, `question`, `decision_gate` (legacy/gates), and `heartbeat`.\n- Use group addresses only for messages that are genuinely useful to many terminals, such as `status` broadcasts or intentional fan-out questions. Do not send dispatch lifecycle messages to groups.\n- `worker_done` belongs to the active Dispatch and defaults to its Run mailbox; never target a group.\n- A valid `worker_done` for the active `taskId` + `dispatchId` marks the task and dispatch completed automatically. Do not follow it with `task-update --status completed`; reserve manual updates for explicit recovery or overrides.\n- `heartbeat` is also Dispatch-scoped. Include both IDs and omit `--to` so Orca uses the owning Run; use `status` for broad progress updates.\n\n## Tasks And Dispatch\n\nA Run is the namespace/inbox, a Task is the work item, and a Dispatch assigns one Task attempt to a terminal. Create or bind a Run once before the common loop.\n\n```bash\norca orchestration run-create --objective <text> --json\norca orchestration task-create --spec <text> [--deps <json_array>] [--parent <task_id>] [--json]\norca orchestration task-list [--status <status>] [--ready] [--brief] [--json]\norca orchestration task-update --id <task_id> --status <status> [--result <json>] [--json]\norca orchestration dispatch --task <task_id> --to <handle> [--from <handle>] [--inject] [--json]\norca orchestration dispatch-show --task <task_id> [--json]\n```\n\nTask statuses: `pending`, `ready`, `dispatched`, `completed`, `failed`, `blocked`.\n\nDispatch rules:\n\n- `--inject` sends the task spec plus preamble into a recognized agent CLI so it can report `worker_done`.\n- If the target is a bare shell, omit `--inject`, dispatch for tracking if needed, then send the prompt manually with `orca terminal send --terminal <handle> --text <prompt> --enter --json`.\n- After 3 consecutive failures on one task, the dispatch context circuit-breaks and the task is marked failed.\n- Use `task-list --brief --json` for coordinator sweeps; it collapses whitespace and caps each echoed spec at 160 characters (`spec_truncated` marks shortened rows). Omit `--brief` when the full spec is required, or when an older CLI rejects it as an unknown flag.\n\n## Preferred Supervised Worker Loop\n\nUse `worker-start` for the normal supervised path. It composes the existing worktree, terminal, readiness, and dispatch primitives while returning exact created/reused effects. Agents still choose placement and concurrency; Orca does not schedule workers or infer conflicts.\n\nCreate the Run and every independent Task first, then start all independent workers before waiting:\n\n```bash\norca orchestration run-create --objective \"<objective>\" --json\norca orchestration task-create --spec \"<worker A task>\" --json\norca orchestration task-create --spec \"<worker B task>\" --json\norca orchestration worker-start --task <task_a> --worktree current --agent codex --json\norca orchestration worker-start --task <task_b> --worktree current --agent claude --json\n```\n\n`current` and exact existing worktrees create a fresh agent terminal and do not rerun setup. Reuse an existing agent only with `--terminal <handle>`.\n\nFor a per-invocation Claude, Codex, or Cursor launch, pass an opaque provider model id with `--model`; add `--effort` only when that agent/model supports the level. These options apply only to fresh agent terminals, override general agent default arguments, and are reported under `launch.requested` and `launch.effective` in the receipt:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree current --agent claude --model opus --effort high --json\n```\n\n`--effort` requires `--model`, and neither option can combine with `--terminal`. A connected worker server must advertise launch-preference support before Orca forwards either option.\n\nFor a new worktree, setup runs by default and agent-first creation reuses the returned startup agent terminal:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree new-child --name <name> --agent codex --setup run --json\n# Independent/top-level:\norca orchestration worker-start --task <task_id> --worktree new-top-level --name <name> --agent codex --setup run --json\n```\n\nSetup normally starts alongside the agent. Only a repository explicitly configured with `wait-for-setup` delays agent launch until setup succeeds. Use `--setup skip` or `--setup inherit` only for a concrete reason.\n\nRead the returned receipt before continuing: `ready` plus setup `running` is normal for start-immediately, while wait-for-setup returns setup `succeeded` before accepting task input. A failed or unknown start exits nonzero; inspect its `stage`, `effects`, and `residualResources` instead of guessing or automatically retrying. A wait-for-setup timeout can honestly leave setup `running`, which is not proof of failure.\n\nTo run the worker on another connected Orca server, add `--on <saved-environment>`. The Run and Tasks remain authoritative on the current server; later commands route by Dispatch ID, so never repeat `--on`:\n\n```bash\n# Mac Run home -> Windows worker (the reverse is identical from a Windows Run home)\norca orchestration worker-start --task <task_id> --on windows --worktree new-top-level --repo <exact_remote_repo_selector> --name <name> --agent codex --setup run --json\norca orchestration worker-show --dispatch <dispatch_id> --json\norca orchestration worker-read --dispatch <dispatch_id> --limit 50 --json\norca orchestration send --to dispatch:<dispatch_id> --subject \"Follow-up\" --body \"<attempt-specific guidance>\" --json\n```\n\nRemote `current` and `new-child` are intentionally invalid because those words are ambiguous across servers. Use an exact discovered remote worktree selector or `new-top-level` with an explicit remote repo selector.\n\nThe follow-up is structured inbox mail, not prompt injection. The worker's next\n`orchestration check` receives it even when the Dispatch is on another connected Orca server.\n\n`worker-read` defaults to `--source auto`: Orca returns the exact hook-reported Codex, Claude, OpenClaude, or Grok transcript when it can prove the worker session, otherwise it returns bounded terminal output with `source: \"terminal\"` and a typed `fallbackReason`. Continue with the returned top-level `cursor`; it stays pinned to that exact source. If Orca reports `source_changed`, start a fresh read without the old cursor. Never supply or guess a provider session ID or transcript path.\n\nWait until every expected Dispatch settles, not for a fixed number of batches:\n\n```bash\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n# Process every message. For each accepted worker_done that is not immediately reused:\norca orchestration worker-release --dispatch <dispatch_id> --json\n# Acknowledge only after every message and required release decision is handled:\norca orchestration check --ack <delivery_id> --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\nAfter processing each accepted `worker_done`, choose the terminal's next owner before you acknowledge the Delivery or wait again. If the same exact agent has an immediate follow-up Task, read the `worker.agent_terminal_handle` field of `worker-show --dispatch <dispatch_id> --json`, then run `orca orchestration worker-start --task <next_task_id> --terminal <handle> --json` so Orca transfers cleanup ownership to the new Dispatch. Otherwise run `orca orchestration worker-release --dispatch <dispatch_id> --json`.\n\nRun `worker-release` after both succeeded and failed `worker_done` reports unless the user explicitly asked to keep that worker live. Release is post-completion cleanup, not cancellation: Orca first preserves inspectable output, then closes only the exact agent terminal owned by that settled Dispatch. Reused or pre-existing terminals, setup terminals, coordinators, active workers, user-taken-over terminals, and identities Orca cannot prove are retained. If the user explicitly asks to keep the live terminal for debugging, record that exception with `orca orchestration worker-retain --dispatch <dispatch_id> --json` instead of silently skipping cleanup. When the user is finished, the same Dispatch can be passed to `worker-release`, which clears the requested retention and releases the terminal.\n\nDo not release a worker because of a timeout, TUI idle state, heartbeat, status, question, escalation, or rejected/stale `worker_done`. If release returns `release_pending` or `release_unknown`, do not substitute `terminal close`; follow the exact recovery action in the receipt. A replayed Delivery may repeat `worker-release` safely.\n\nWorkers report exactly once using the IDs and capability injected by Orca; they do not supply Run/server/terminal identity:\n\n```bash\norca orchestration send --type worker_done --subject \"<status>\" --body \"<what changed, findings, and what remains>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a,path/b\" --json\n# On failure, use --outcome failed; never encode failure only in prose.\n```\n\nA worker question defaults to its owning Run. Timeout leaves it pending:\n\n```bash\norca orchestration ask --question \"<question>\" --options \"yes,no\" --timeout-ms 600000 --json\norca orchestration ask --resume <message_id> --timeout-ms 600000 --json\n# Coordinator:\norca orchestration reply --id <message_id> --body \"<answer>\" --json\n```\n\nRecovery is conditional, never a fixed destructive sequence:\n\n- `worker-show --dispatch <id>` says `ready`: keep waiting or read bounded output.\n- It proves `failed` or `stopped`: start a replacement with `worker-start --task <task> --retry-of <id>` plus an explicit `--on`/`--worktree` and `--agent`/`--terminal` choice. Retry does not silently inherit placement.\n- It remains `outcome_unknown`: either `worker-stop --dispatch <id>` and inspect again, or explicitly `worker-abandon --dispatch <id>` while accepting that resources may still be live. Abandon performs no remote, process, or filesystem action.\n- `worker-stop` closes only the exact supervised agent terminal. It never deletes the worktree, setup terminal, configured tabs, or unrelated processes.\n\nLow-level `worktree create`, `terminal create`, and `dispatch --inject` remain valid recipes for custom argv or topology that `worker-start` does not express.\n\n## Gates And Legacy Inspection\n\n```bash\norca orchestration gate-create --task <task_id> --question <text> [--options <json_array>] [--json]\norca orchestration gate-resolve --id <gate_id> --resolution <text> [--json]\norca orchestration gate-list [--task <task_id>] [--status <status>] [--json]\n```\n\nUse `ask` for worker-to-coordinator questions; it creates a `question` message that the coordinator answers with `reply`. Use `gate-create` only for coordinator-managed task DAG decisions, not for answering a worker's `ask`.\n\n`coordinator-start`, `coordinator-stop`, `run`, and `run-stop` are retired scheduler commands. They perform no effects and return the current-skill recovery action. They are not aliases for lightweight Run creation or binding.\n\nRecovery only: `orca orchestration reset --tasks|--messages|--all --json` clears the selected local orchestration database state. Do not run it during active coordination unless explicitly abandoning that state.\n\n## Full Handoffs\n\nFor full ownership transfer, use non-lifecycle terminal/worktree commands and then stop monitoring unless the user asks for supervision.\n\nTreat these as full handoff requests by default: \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"send this to another agent\", \"another agent\", \"another worktree\", or \"launch another agent to own this.\" Custom model or reasoning effort words such as `gpt-5.5`, `high`, or `xhigh` do not make the handoff supervised.\n\nSupervised orchestration remains available only when the user explicitly asks for supervision or coordination: \"supervise\", \"monitor\", \"wait for worker_done\", \"wait for results\", \"track completion\", \"DAG\", \"decision gate\", \"ask/reply\", or \"coordinate workers.\"\n\nDo not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. `task-create` is also forbidden because it records coordinator-owned tracking state; if a task row is needed, the user asked for supervised orchestration. Do not create a `taskId`/`dispatchId`, inject a lifecycle preamble, wait for completion, or read the worker terminal after prompt delivery except to avoid losing the initial prompt.\n\nNew top-level worktree handoff:\n\n```bash\norca worktree create --name <task-name> --no-parent --agent codex --prompt \"<task brief>\" --setup run --json\n```\n\nBefore creating a new worktree from an active feature branch, decide and state whether the desired Orca lineage is child or top-level. Use child worktree lineage only when the new work is conceptually stacked under or dependent on the active worktree. For independent repo-wide fixes, standalone feature work, or unrelated follow-up tasks, create a top-level worktree with `--no-parent`.\n\nExisting terminal handoff:\n\n```bash\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nCustom Codex model/effort handoff:\n\n`orca worktree create --agent codex --prompt ...` launches the known Codex agent but does not accept Codex-specific `--model` or `-c model_reasoning_effort=...` arguments. When the user asks for a specific Codex model or effort, create the independent worktree first, launch Codex with the requested command in that worktree, wait only for TUI readiness if prompt delivery would otherwise race startup, send the prompt, and stop.\n\nThe two-step custom-argv path cannot enforce a repository's explicit `wait-for-setup` startup policy because the later `terminal create` is not the startup owned by `worktree create`. Use it only when the repository starts agents immediately. If the repository requires `wait-for-setup`, use an agent-first configured launcher that can preserve sequencing, or stop and ask rather than silently bypassing the policy.\n\nNote: when no repo default-terminal configuration supplies a primary terminal, bare create opens a fallback shell before `terminal create` adds the agent. Configured default tabs are materialized instead and may run real commands. Prefer `--agent` whenever custom argv is not required. With the two-step path, target only the agent handle; close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell.\n\nUse the exact full `<repo-id>::<path>` worktree id returned by `orca worktree create --json`; a bare repo id cannot target the new worktree.\n\n```bash\norca worktree create --name <task-name> --no-parent --setup run --json\norca terminal create --worktree id:<newFullWorktreeId> --title <task-name> --command 'codex --model gpt-5.5 -c model_reasoning_effort=\"xhigh\"' --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nWait only for `tui-idle` when needed to avoid losing the prompt. Do not monitor task completion.\n\n`--no-parent` only controls Orca lineage; it does not choose the Git base. If the work should start from the repo default base, omit `--base-branch` so Orca uses that default, or explicitly pass the repo default base (`origin/main`, `origin/master`, or the `orca repo show --repo <selector> --json` value); never base it on the current feature branch unless the user explicitly asks for stacked work or \"branch from current\". Put current-branch context in the prompt instead.\n\n## Worker Terminals\n\nChoose the worker location before creating a terminal. `Fresh worker` means a fresh agent session, not a new git worktree. For parallel work, create one fresh agent terminal per worker in the same required worktree, falling back to the active worktree when none is named. If the task says current worktree only, depends on uncommitted files/artifacts, or must validate/PR the current branch, keep every worker in the active worktree:\n\n```bash\norca terminal create --worktree active --title <task-name> --command \"codex\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nReuse an idle agent in the required worktree only if the prompt allows reuse; otherwise create a fresh terminal there. Create a new worktree only when the user explicitly requests one or a concrete checkout or filesystem conflict makes sharing unsafe or impossible; if the user did not request it, state that conflict before running `worktree create`. Independent tasks, parallel execution, convenience, or a preference for separate checkouts are not isolation requirements.\n\nWhen a new worktree is allowed, use child lineage for isolated work that is stacked under or dependent on the active worktree, and use `--no-parent` when it is not stacked. Decide the Git base separately: `--no-parent` makes the worktree top-level in Orca, while omitted `--base-branch` uses the repo default base.\n\nFor every new worktree, pass `--setup run` so any configured repository setup hook runs. This does not mean waiting for setup before agent launch: preserve the repository's startup policy, whose default starts setup and the agent side by side. Use `--setup skip` or `--setup inherit` only when there is a concrete task-specific reason, and state that reason before creating the worktree. This rule does not rerun setup for current or existing worktrees.\n\n```bash\norca worktree create --name <task-name> --agent codex --setup run --json\n# or: --agent claude | omp | pi | grok | ...\n# Read <handle> from agentTerminalHandle, falling back to startupTerminal.handle.\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nFor new-worktree workers, read the id and `agentTerminalHandle` from `worktree create`, falling back to `startupTerminal.handle` for older runtimes. Use that as the sole worker handle when present; otherwise use `terminal list` to resolve the agent handle. Omit `--repo` only inside an Orca-managed worktree; otherwise pass `--repo <selector>`.\n\n**For an allowed new worktree, use agent-first:** `--agent` reveals the new worktree and launches the selected agent **in its first terminal**, without adding a separate fallback shell for that worker. Pass `--setup run`; repo setup and default-terminal settings may add intentional tabs or splits. Do **not** run bare `worktree create` and then `terminal create --command <agent>` for the same worker when agent-first create is available: without configured default tabs, that two-step path leaves a fallback shell + agent pair. Only use it when custom agent argv is required (for example Codex model/effort flags) or when an older CLI rejects `--agent`; if you must, message only the agent handle. Configured default tabs are intentional surfaces, so close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell. Do not run `worktree create` when the task must stay in the current worktree.\n\nUse `orca worktree create --prompt ...` or `orca terminal send ...` for full handoffs or untracked/lightweight prompts. Those paths do not attach `taskId`/`dispatchId`; the worker should not send lifecycle messages unless the prompt supplies a live orchestration preamble.\n\nSidebar lineage and orchestration lifecycle are related but not identical. A same-worktree worker may appear as a peer under that worktree in the sidebar while remaining a child dispatch in orchestration state; only an actual child worktree creates visible parent/child worktree lineage.\n\nOther terminal commands coordinators often need:\n\n```bash\norca terminal list [--worktree <selector>] [--include-visual-layouts] [--json]\norca terminal create [--worktree <selector>] [--title <text>] [--command <cmd>] [--json]\norca terminal split --terminal <handle> [--direction horizontal|vertical] [--command <cmd>] [--json]\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms <n> --json\norca terminal read --terminal <handle> --json\norca terminal send --terminal <handle> --text <text> --enter --json\n```\n\nIf an older CLI rejects `worktree create --agent`, create the worktree normally, then run `orca terminal create --worktree <selector> --command \"codex\" --json` or `--command \"claude\"`.\n\nWait for `tui-idle` before dispatching. Always pass `--timeout-ms`; real coding tasks can take 15-60 minutes. During supervision, use rolling `check --wait` windows. If a window returns no matching message, inspect `task-list`, `terminal read`, or `terminal wait --for tui-idle` as a liveness checkpoint; if the terminal is still working or producing activity, keep waiting instead of retrying the task.\n\n## Agent Guidance\n\n- Workers with a valid live preamble must send `worker_done` exactly once from their own terminal with an explicit `--outcome succeeded` or `--outcome failed`:\n  `orca orchestration send --type worker_done --subject \"<short status>\" --body \"<3-sentence summary: what you did, what you found, what's left>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a\" --report-path \"<optional>\" --json`\n- A failed outcome is still a terminal report, but Orca records both the Dispatch and Task as failed. Never encode failure only in the subject/body.\n- After sending `worker_done`, end your turn and idle at the agent prompt. The coordinator may reuse or release this terminal after it processes your report; do not start more work, poll, or attempt to close the terminal yourself. If it reuses you, it re-engages you with a fresh preamble + TASK block delivered as new terminal input.\n- For long tasks, send heartbeat/status only when the preamble asks for it, including both IDs:\n  `orca orchestration send --type heartbeat --subject \"alive\" --payload '{\"taskId\":\"<task_id>\",\"dispatchId\":\"<dispatch_id>\",\"phase\":\"implementing\"}' --json`\n- If blocked before completion, use `ask`; use `escalation` only when ownership is valid and the coordinator must intervene.\n- Treat preambles inherited through terminal history or full handoffs as stale unless the current prompt explicitly keeps that coordinator in the loop.\n- Coordinators must account for every settled worker terminal before waiting again or ending the turn: immediately reuse the exact worker for a new Dispatch, explicitly retain it at the user's request with `worker-retain`, or run `worker-release`. Do not leave a completed worker live merely to inspect output; released workers remain readable through `worker-read`.\n- Coordinators should use `task-list --ready` as external memory, dispatch parallel waves, and avoid dependency chains deeper than 3-4 steps.\n\n## Example\n\n```bash\norca terminal create --worktree active --title login-css-worker --command \"claude\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration task-create --spec \"Fix the login button CSS\" --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\n## Next Action\n\nCoordinator: confirm `orca status --json`, create or bind a Run, inspect `task-list`/`dispatch-show` if inheriting state, then use the explicit supervised loop (`task-create` -> `worker-start` -> `check --wait`). Use low-level terminal creation plus `dispatch --inject` only when the composed start does not express the needed topology. After every accepted `worker_done`, either transfer the exact terminal to an immediate follow-up Dispatch or run `worker-release` before the next wait.\n\nWorker: if the current prompt contains a live dispatch preamble, do the task, use `ask` for blocking questions, and send `worker_done` once with the required payload. If the preamble is stale or absent, do not send lifecycle messages; inspect state or treat the prompt as an ordinary handoff.\n"
 
 // Why: no current guide has bundled reference documents, so --full is byte-identical for now.
 // oxfmt-ignore
diff --git a/src/cli/handlers/emulator.test.ts b/src/cli/handlers/emulator.test.ts
index 07bdd51e2f5..ff0dc5f141a 100644
--- a/src/cli/handlers/emulator.test.ts
+++ b/src/cli/handlers/emulator.test.ts
@@ -1,5 +1,5 @@
 import path from 'node:path'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { callMock, remoteMock } = vi.hoisted(() => ({
   callMock: vi.fn(),
@@ -29,6 +29,9 @@ import { main } from '../index'
 import { okFixture, queueFixtures } from '../test-fixtures'
 
 describe('orca emulator CLI handlers', () => {
+  const originalWorkspaceId = process.env.ORCA_WORKSPACE_ID
+  const originalWorktreeId = process.env.ORCA_WORKTREE_ID
+
   beforeEach(() => {
     vi.restoreAllMocks()
     callMock.mockReset()
@@ -38,6 +41,19 @@ describe('orca emulator CLI handlers', () => {
     process.exitCode = undefined
   })
 
+  afterEach(() => {
+    if (originalWorkspaceId === undefined) {
+      delete process.env.ORCA_WORKSPACE_ID
+    } else {
+      process.env.ORCA_WORKSPACE_ID = originalWorkspaceId
+    }
+    if (originalWorktreeId === undefined) {
+      delete process.env.ORCA_WORKTREE_ID
+    } else {
+      process.env.ORCA_WORKTREE_ID = originalWorktreeId
+    }
+  })
+
   it('resolves relative APK paths before calling the runtime', async () => {
     queueFixtures(callMock, okFixture('req_install', { ok: true }))
 
@@ -73,6 +89,46 @@ describe('orca emulator CLI handlers', () => {
     )
   })
 
+  it('uses the folder workspace exported by the current Orca terminal', async () => {
+    process.env.ORCA_WORKSPACE_ID = 'folder:folder-1'
+    delete process.env.ORCA_WORKTREE_ID
+    callMock.mockResolvedValue(
+      okFixture('req_attach', {
+        attached: true,
+        info: { deviceUdid: 'device-1', streamUrl: 'scrcpy://device-1' }
+      })
+    )
+
+    await main(['emulator', 'attach', 'device-1'], '/folder/project')
+
+    expect(callMock).toHaveBeenCalledOnce()
+    expect(callMock).toHaveBeenCalledWith(
+      'emulator.attach',
+      { device: 'device-1', worktree: 'folder:folder-1', focus: false },
+      { timeoutMs: 180_000 }
+    )
+  })
+
+  it('uses the current git worktree exported by the Orca terminal', async () => {
+    process.env.ORCA_WORKSPACE_ID = 'folder:stale-parent'
+    process.env.ORCA_WORKTREE_ID = 'repo-1::/repo/project '
+    callMock.mockResolvedValue(
+      okFixture('req_attach', {
+        attached: true,
+        info: { deviceUdid: 'device-1', streamUrl: 'scrcpy://device-1' }
+      })
+    )
+
+    await main(['emulator', 'attach', 'device-1'], '/repo/project')
+
+    expect(callMock).toHaveBeenCalledOnce()
+    expect(callMock).toHaveBeenCalledWith(
+      'emulator.attach',
+      { device: 'device-1', worktree: 'repo-1::/repo/project ', focus: false },
+      { timeoutMs: 180_000 }
+    )
+  })
+
   it('rejects relative APK paths for remote runtimes', async () => {
     remoteMock.mockReturnValue(true)
 
diff --git a/src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts b/src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts
new file mode 100644
index 00000000000..a7b1766437e
--- /dev/null
+++ b/src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts
@@ -0,0 +1,51 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { reportCliError } from '../format'
+import { ORCHESTRATION_HANDLERS } from './orchestration'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+it('prints a rejected lifecycle verdict as a JSON failure envelope', async () => {
+  const log = vi.spyOn(console, 'log').mockImplementation(() => {})
+  const client = {
+    call: vi.fn().mockResolvedValue({
+      result: {
+        message: { id: 'msg_rejected' },
+        lifecycle: {
+          action: 'rejected',
+          code: 'sender_not_assignee',
+          reason: 'dispatch ctx_1 expected the assigned pane'
+        }
+      }
+    })
+  }
+  let rejection: unknown
+  try {
+    await ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_foreign'],
+        ['to', 'term_coord'],
+        ['subject', 'done'],
+        ['type', 'worker_done'],
+        ['outcome', 'succeeded']
+      ]),
+      client,
+      cwd: '/tmp/repo',
+      json: true
+    } as never)
+  } catch (error) {
+    rejection = error
+  }
+
+  expect(rejection).toBeDefined()
+  reportCliError(rejection, true, { commandPath: ['orchestration', 'send'] })
+
+  expect(JSON.parse(String(log.mock.calls[0]?.[0]))).toMatchObject({
+    ok: false,
+    error: {
+      code: 'sender_not_assignee',
+      message: 'dispatch ctx_1 expected the assigned pane'
+    }
+  })
+})
diff --git a/src/cli/handlers/orchestration-lifecycle-rejection.test.ts b/src/cli/handlers/orchestration-lifecycle-rejection.test.ts
index c55eed4391d..369edf9c4f6 100644
--- a/src/cli/handlers/orchestration-lifecycle-rejection.test.ts
+++ b/src/cli/handlers/orchestration-lifecycle-rejection.test.ts
@@ -10,9 +10,11 @@ import { ORCHESTRATION_HANDLERS } from './orchestration'
 
 afterEach(() => {
   process.exitCode = originalExitCode
+  vi.clearAllMocks()
+  callMock.mockReset()
 })
 
-it('prints a lifecycle rejection and exits unsuccessfully', async () => {
+it('raises a lifecycle rejection for the CLI error boundary', async () => {
   const response = {
     result: {
       message: { id: 'msg_rejected' },
@@ -25,22 +27,328 @@ it('prints a lifecycle rejection and exits unsuccessfully', async () => {
   }
   callMock.mockResolvedValueOnce(response)
 
+  await expect(
+    ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_foreign'],
+        ['to', 'term_coord'],
+        ['subject', 'done'],
+        ['type', 'worker_done'],
+        ['outcome', 'succeeded']
+      ]),
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: false
+    } as never)
+  ).rejects.toMatchObject({
+    code: 'sender_not_assignee',
+    message: 'dispatch ctx_1 expected the assigned pane'
+  })
+  expect(printResult).not.toHaveBeenCalled()
+})
+
+it('raises a Run-home relay rejection for the CLI error boundary', async () => {
+  callMock.mockResolvedValueOnce({
+    result: {
+      relay: {
+        messageId: 'relay_rejected',
+        sequence: 1,
+        dispatchId: 'ctx_1',
+        destination: 'run_home',
+        accepted: true
+      },
+      lifecycle: {
+        action: 'rejected',
+        code: 'task_dispatch_mismatch',
+        reason: 'wrong task',
+        authority: 'run_home'
+      }
+    }
+  })
+
+  await expect(
+    ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_worker'],
+        ['subject', 'done'],
+        ['type', 'worker_done'],
+        ['task-id', 'task_wrong'],
+        ['dispatch-id', 'ctx_1'],
+        ['outcome', 'succeeded']
+      ]),
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: true
+    } as never)
+  ).rejects.toMatchObject({ code: 'task_dispatch_mismatch', message: 'wrong task' })
+  expect(printResult).not.toHaveBeenCalled()
+})
+
+it('accepts an explicit current settlement without a compatibility read', async () => {
+  callMock.mockResolvedValueOnce({
+    result: { message: { id: 'msg_done' }, lifecycle: { action: 'completed' } }
+  })
+
   await ORCHESTRATION_HANDLERS['orchestration send']({
     flags: new Map([
-      ['from', 'term_foreign'],
-      ['to', 'term_coord'],
+      ['from', 'term_worker'],
       ['subject', 'done'],
       ['type', 'worker_done'],
+      ['task-id', 'task_1'],
+      ['dispatch-id', 'ctx_1'],
       ['outcome', 'succeeded']
     ]),
     client: { call: callMock },
     cwd: '/tmp/repo',
-    json: false
+    json: true
   } as never)
 
-  expect(process.exitCode).toBe(1)
-  const formatter = vi.mocked(printResult).mock.calls[0]?.[2]
-  expect(formatter?.(response.result)).toBe(
-    'Rejected msg_rejected: dispatch ctx_1 expected the assigned pane'
-  )
+  expect(callMock).toHaveBeenCalledOnce()
+})
+
+it('fails closed when an older runtime leaves worker_done dispatched without a verdict', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: { message: { id: 'msg_unconfirmed', run_id: 'run_1' } }
+    })
+    .mockResolvedValueOnce({
+      result: { dispatch: { id: 'ctx_1', status: 'dispatched' } }
+    })
+    .mockResolvedValueOnce({ result: { tasks: [] } })
+
+  await expect(
+    ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_foreign'],
+        ['subject', 'done'],
+        ['type', 'worker_done'],
+        ['task-id', 'task_1'],
+        ['dispatch-id', 'ctx_1'],
+        ['outcome', 'succeeded']
+      ]),
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: true
+    } as never)
+  ).rejects.toMatchObject({ code: 'operation_unknown' })
+
+  expect(callMock).toHaveBeenNthCalledWith(2, 'orchestration.dispatchShow', { task: 'task_1' })
+  expect(callMock).toHaveBeenNthCalledWith(3, 'orchestration.taskList', {
+    status: 'completed',
+    run: 'run_1'
+  })
+})
+
+it('normalizes compatibility-read failures to operation_unknown', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: { message: { id: 'msg_unconfirmed', run_id: 'run_1' } }
+    })
+    .mockRejectedValueOnce(new Error('runtime disconnected'))
+    .mockResolvedValueOnce({ result: { tasks: [] } })
+
+  await expect(
+    ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_worker'],
+        ['subject', 'done'],
+        ['type', 'worker_done'],
+        ['task-id', 'task_1'],
+        ['dispatch-id', 'ctx_1'],
+        ['outcome', 'succeeded']
+      ]),
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: true
+    } as never)
+  ).rejects.toMatchObject({ code: 'operation_unknown' })
+})
+
+it('accepts a legacy response only after the authoritative dispatch is terminal', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: { message: { id: 'msg_legacy_completed', run_id: 'run_1' } }
+    })
+    .mockResolvedValueOnce({
+      result: { dispatch: { id: 'ctx_1', status: 'completed' } }
+    })
+    .mockResolvedValueOnce({
+      result: {
+        tasks: [
+          {
+            id: 'task_1',
+            status: 'completed',
+            result: JSON.stringify({
+              provenance: 'worker_report',
+              messageId: 'msg_legacy_completed',
+              outcome: 'succeeded'
+            })
+          }
+        ]
+      }
+    })
+
+  await ORCHESTRATION_HANDLERS['orchestration send']({
+    flags: new Map([
+      ['from', 'term_worker'],
+      ['subject', 'done'],
+      ['type', 'worker_done'],
+      ['task-id', 'task_1'],
+      ['dispatch-id', 'ctx_1'],
+      ['outcome', 'succeeded']
+    ]),
+    client: { call: callMock },
+    cwd: '/tmp/repo',
+    json: true
+  } as never)
+
+  expect(callMock).toHaveBeenCalledTimes(3)
+  expect(callMock).toHaveBeenNthCalledWith(2, 'orchestration.dispatchShow', { task: 'task_1' })
+})
+
+it('accepts a legacy failed report only after the authoritative dispatch failed', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: { message: { id: 'msg_legacy_failed', run_id: 'run_1' } }
+    })
+    .mockResolvedValueOnce({ result: { dispatch: { id: 'ctx_1', status: 'failed' } } })
+    .mockResolvedValueOnce({
+      result: {
+        tasks: [
+          {
+            id: 'task_1',
+            status: 'failed',
+            result: JSON.stringify({
+              provenance: 'worker_report',
+              messageId: 'msg_legacy_failed',
+              outcome: 'failed'
+            })
+          }
+        ]
+      }
+    })
+
+  await ORCHESTRATION_HANDLERS['orchestration send']({
+    flags: new Map([
+      ['from', 'term_worker'],
+      ['subject', 'failed'],
+      ['type', 'worker_done'],
+      ['task-id', 'task_1'],
+      ['dispatch-id', 'ctx_1'],
+      ['outcome', 'failed']
+    ]),
+    client: { call: callMock },
+    cwd: '/tmp/repo',
+    json: true
+  } as never)
+
+  expect(callMock).toHaveBeenCalledTimes(3)
+})
+
+it('accepts an idempotent retry whose first report already settled', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: {
+        message: { id: 'msg_retry', run_id: 'run_1', from_handle: 'term_worker' }
+      }
+    })
+    .mockResolvedValueOnce({ result: { dispatch: { id: 'ctx_1', status: 'completed' } } })
+    .mockResolvedValueOnce({
+      result: {
+        tasks: [
+          {
+            id: 'task_1',
+            status: 'completed',
+            result: JSON.stringify({
+              provenance: 'worker_report',
+              messageId: 'msg_first',
+              reportedBy: 'term_worker',
+              outcome: 'succeeded'
+            })
+          }
+        ]
+      }
+    })
+
+  await ORCHESTRATION_HANDLERS['orchestration send']({
+    flags: new Map([
+      ['from', 'term_worker'],
+      ['subject', 'done'],
+      ['type', 'worker_done'],
+      ['task-id', 'task_1'],
+      ['dispatch-id', 'ctx_1'],
+      ['outcome', 'succeeded']
+    ]),
+    client: { call: callMock },
+    cwd: '/tmp/repo',
+    json: true
+  } as never)
+
+  expect(callMock).toHaveBeenCalledTimes(3)
+})
+
+it('rejects an unrelated failed Dispatch that left its Task blocked', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: { message: { id: 'msg_after_stop', run_id: 'run_1' } }
+    })
+    .mockResolvedValueOnce({ result: { dispatch: { id: 'ctx_1', status: 'failed' } } })
+    .mockResolvedValueOnce({ result: { tasks: [] } })
+
+  await expect(
+    ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_worker'],
+        ['subject', 'failed'],
+        ['type', 'worker_done'],
+        ['task-id', 'task_1'],
+        ['dispatch-id', 'ctx_1'],
+        ['outcome', 'failed']
+      ]),
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: true
+    } as never)
+  ).rejects.toMatchObject({ code: 'operation_unknown' })
+})
+
+it('rejects a terminal Dispatch with the wrong identity', async () => {
+  callMock
+    .mockResolvedValueOnce({
+      result: { message: { id: 'msg_stale', run_id: 'run_1' } }
+    })
+    .mockResolvedValueOnce({
+      result: { dispatch: { id: 'ctx_replacement', status: 'completed' } }
+    })
+    .mockResolvedValueOnce({
+      result: {
+        tasks: [
+          {
+            id: 'task_1',
+            status: 'completed',
+            result: JSON.stringify({
+              provenance: 'worker_report',
+              messageId: 'msg_stale',
+              outcome: 'succeeded'
+            })
+          }
+        ]
+      }
+    })
+
+  await expect(
+    ORCHESTRATION_HANDLERS['orchestration send']({
+      flags: new Map([
+        ['from', 'term_worker'],
+        ['subject', 'done'],
+        ['type', 'worker_done'],
+        ['task-id', 'task_1'],
+        ['dispatch-id', 'ctx_1'],
+        ['outcome', 'succeeded']
+      ]),
+      client: { call: callMock },
+      cwd: '/tmp/repo',
+      json: true
+    } as never)
+  ).rejects.toMatchObject({ code: 'operation_unknown' })
 })
diff --git a/src/cli/handlers/orchestration-migration.test.ts b/src/cli/handlers/orchestration-migration.test.ts
index a1a117b90b3..863720eaab1 100644
--- a/src/cli/handlers/orchestration-migration.test.ts
+++ b/src/cli/handlers/orchestration-migration.test.ts
@@ -12,33 +12,43 @@ afterEach(() => {
 })
 
 describe('orchestration CLI migration recovery', () => {
-  it('forwards legacy worker_done without inventing a completion outcome', async () => {
-    process.env.ORCA_PANE_KEY = 'tab-worker:leaf-worker'
-    const call = vi.fn().mockResolvedValue({ result: { message: { id: 'msg_done' } } })
+  it.each([false, true])(
+    'accepts an attested legacy worker_done settlement (replayed: %s)',
+    async (replayed) => {
+      process.env.ORCA_PANE_KEY = 'tab-worker:leaf-worker'
+      const call = vi.fn().mockResolvedValue({
+        result: {
+          message: { id: 'msg_done' },
+          lifecycle: { action: 'settled', outcome: 'succeeded', duplicate: replayed }
+        }
+      })
 
-    await ORCHESTRATION_HANDLERS['orchestration send']({
-      flags: new Map<string, string | boolean>([
-        ['from', 'term_worker'],
-        ['subject', 'Done'],
-        ['type', 'worker_done']
-      ]),
-      client: { call },
-      cwd: '/tmp/repo',
-      json: true
-    } as never)
+      await ORCHESTRATION_HANDLERS['orchestration send']({
+        flags: new Map<string, string | boolean>([
+          ['from', 'term_worker'],
+          ['subject', 'Done'],
+          ['type', 'worker_done']
+        ]),
+        client: { call },
+        cwd: '/tmp/repo',
+        json: true
+      } as never)
 
-    expect(call).toHaveBeenCalledWith('orchestration.send', {
-      from: 'term_worker',
-      to: undefined,
-      run: undefined,
-      subject: 'Done',
-      body: undefined,
-      type: 'worker_done',
-      priority: undefined,
-      threadId: undefined,
-      payload: undefined,
-      senderPaneKey: 'tab-worker:leaf-worker',
-      devMode: false
-    })
-  })
+      expect(call).toHaveBeenCalledWith('orchestration.send', {
+        from: 'term_worker',
+        to: undefined,
+        run: undefined,
+        subject: 'Done',
+        body: undefined,
+        type: 'worker_done',
+        priority: undefined,
+        threadId: undefined,
+        payload: undefined,
+        senderPaneKey: 'tab-worker:leaf-worker',
+        waitForLifecycleSettlement: true,
+        devMode: false
+      })
+      expect(call).toHaveBeenCalledOnce()
+    }
+  )
 })
diff --git a/src/cli/handlers/orchestration-worker-settlement.ts b/src/cli/handlers/orchestration-worker-settlement.ts
new file mode 100644
index 00000000000..8b9425391ee
--- /dev/null
+++ b/src/cli/handlers/orchestration-worker-settlement.ts
@@ -0,0 +1,147 @@
+import type { RuntimeClient } from '../runtime-client'
+import { RuntimeClientError } from '../runtime-client'
+
+export async function requireWorkerDoneSettlement(
+  client: RuntimeClient,
+  type: string | undefined,
+  payload: string | undefined,
+  result: unknown
+): Promise<void> {
+  if (type !== 'worker_done' || hasLifecycleVerdict(result)) {
+    return
+  }
+  const target = parseWorkerDoneTarget(payload)
+  const receipt = parseWorkerDoneReceipt(result)
+  if (target && receipt) {
+    const [dispatchVerification, taskVerification] = await Promise.all([
+      client.call<{ dispatch: { id: string; status: string } | null }>(
+        'orchestration.dispatchShow',
+        { task: target.taskId }
+      ),
+      client.call<{
+        tasks: { id: string; status: string; result: string | null }[]
+      }>('orchestration.taskList', { status: target.expectedStatus, run: receipt.runId })
+    ]).catch(() => {
+      throw workerDoneSettlementUnknown()
+    })
+    const task = taskVerification.result.tasks.find((candidate) => candidate.id === target.taskId)
+    if (
+      dispatchVerification.result.dispatch?.id === target.dispatchId &&
+      dispatchVerification.result.dispatch.status === target.expectedStatus &&
+      task?.status === target.expectedStatus &&
+      isExactWorkerReport(task.result, receipt, target.outcome)
+    ) {
+      return
+    }
+  }
+  throw workerDoneSettlementUnknown()
+}
+
+function workerDoneSettlementUnknown(): RuntimeClientError {
+  return new RuntimeClientError(
+    'operation_unknown',
+    'The runtime accepted worker_done but did not confirm that the exact report settled its Task and Dispatch. Retry from the assigned worker after verifying its active Dispatch.'
+  )
+}
+
+function parseWorkerDoneReceipt(
+  result: unknown
+): { messageId: string; runId: string; fromHandle?: string } | undefined {
+  if (!result || typeof result !== 'object' || !('message' in result)) {
+    return undefined
+  }
+  const message = (result as { message?: unknown }).message
+  if (!message || typeof message !== 'object') {
+    return undefined
+  }
+  const {
+    id,
+    run_id: runId,
+    from_handle: fromHandle
+  } = message as {
+    id?: unknown
+    run_id?: unknown
+    from_handle?: unknown
+  }
+  return typeof id === 'string' && typeof runId === 'string'
+    ? {
+        messageId: id,
+        runId,
+        ...(typeof fromHandle === 'string' ? { fromHandle } : {})
+      }
+    : undefined
+}
+
+function isExactWorkerReport(
+  result: string | null | undefined,
+  receipt: { messageId: string; fromHandle?: string },
+  outcome: 'succeeded' | 'failed'
+): boolean {
+  if (!result) {
+    return false
+  }
+  try {
+    const parsed = JSON.parse(result) as Record<string, unknown>
+    return (
+      parsed.provenance === 'worker_report' &&
+      parsed.outcome === outcome &&
+      (parsed.messageId === receipt.messageId ||
+        (receipt.fromHandle !== undefined && parsed.reportedBy === receipt.fromHandle))
+    )
+  } catch {
+    return false
+  }
+}
+
+function hasLifecycleVerdict(result: unknown): boolean {
+  if (!result || typeof result !== 'object' || !('lifecycle' in result)) {
+    return false
+  }
+  const lifecycle = (result as { lifecycle?: unknown }).lifecycle
+  if (!lifecycle || typeof lifecycle !== 'object') {
+    return false
+  }
+  const action = (lifecycle as { action?: unknown }).action
+  if ('relay' in result) {
+    return (
+      (lifecycle as { authority?: unknown }).authority === 'run_home' &&
+      (action === 'completed' || action === 'failed' || action === 'rejected')
+    )
+  }
+  if (action === 'settled') {
+    const outcome = (lifecycle as { outcome?: unknown }).outcome
+    return outcome === 'succeeded' || outcome === 'failed'
+  }
+  return action === 'completed' || action === 'failed' || action === 'rejected'
+}
+
+function parseWorkerDoneTarget(payload: string | undefined):
+  | {
+      taskId: string
+      dispatchId: string
+      outcome: 'succeeded' | 'failed'
+      expectedStatus: 'completed' | 'failed'
+    }
+  | undefined {
+  if (!payload) {
+    return undefined
+  }
+  try {
+    const parsed = JSON.parse(payload) as Record<string, unknown>
+    if (
+      typeof parsed.taskId !== 'string' ||
+      typeof parsed.dispatchId !== 'string' ||
+      (parsed.outcome !== 'succeeded' && parsed.outcome !== 'failed')
+    ) {
+      return undefined
+    }
+    return {
+      taskId: parsed.taskId,
+      dispatchId: parsed.dispatchId,
+      outcome: parsed.outcome,
+      expectedStatus: parsed.outcome === 'succeeded' ? 'completed' : 'failed'
+    }
+  } catch {
+    return undefined
+  }
+}
diff --git a/src/cli/handlers/orchestration.test.ts b/src/cli/handlers/orchestration.test.ts
index ef7299efb43..c43f7b45b62 100644
--- a/src/cli/handlers/orchestration.test.ts
+++ b/src/cli/handlers/orchestration.test.ts
@@ -50,7 +50,7 @@ afterEach(() => {
 
 describe('orchestration send structured payload flags', () => {
   beforeEach(() => {
-    callMock.mockReset().mockResolvedValue({ result: { message: { id: 'msg_1' } } })
+    callMock.mockReset().mockResolvedValue({ result: { lifecycle: { action: 'completed' } } })
     getTerminalHandleMock.mockReset()
     delete process.env.ORCA_TERMINAL_HANDLE
     delete process.env.ORCA_PANE_KEY
@@ -94,6 +94,7 @@ describe('orchestration send structured payload flags', () => {
         filesModified: ['src/a.ts', 'src/b.ts'],
         reportPath: 'reports/done.md'
       }),
+      waitForLifecycleSettlement: true,
       devMode: false
     })
   })
@@ -207,6 +208,7 @@ describe('orchestration send structured payload flags', () => {
       priority: undefined,
       threadId: undefined,
       payload: JSON.stringify({ outcome: 'succeeded' }),
+      waitForLifecycleSettlement: true,
       devMode: false
     })
   })
@@ -233,6 +235,7 @@ describe('orchestration send structured payload flags', () => {
       priority: undefined,
       threadId: undefined,
       payload: JSON.stringify({ outcome: 'succeeded' }),
+      waitForLifecycleSettlement: true,
       devMode: false
     })
   })
diff --git a/src/cli/handlers/orchestration.ts b/src/cli/handlers/orchestration.ts
index 5be6e62394d..771b8367b88 100644
--- a/src/cli/handlers/orchestration.ts
+++ b/src/cli/handlers/orchestration.ts
@@ -8,6 +8,7 @@ import {
   getRequiredStringFlag
 } from '../flags'
 import { RuntimeClientError } from '../runtime-client'
+import { requireWorkerDoneSettlement } from './orchestration-worker-settlement'
 import { getTerminalHandle } from '../selectors'
 import {
   clampOrchestrationAskTimeoutMs,
@@ -90,14 +91,13 @@ const WORKER_TERMINAL_LIST_STATES = [
   'released'
 ] as const
 
-type LifecycleSendRejection = {
-  action: 'rejected'
-  code: string
-  reason: string
-}
+type LifecycleSendResult =
+  | { action: 'completed' | 'failed'; authority?: 'run_home' }
+  | { action: 'settled'; outcome: 'succeeded' | 'failed'; duplicate?: boolean }
+  | { action: 'rejected'; code: string; reason: string }
 
 type OrchestrationSendResult =
-  | { message: { id: string }; lifecycle?: LifecycleSendRejection }
+  | { message: { id: string; run_id?: string }; lifecycle?: LifecycleSendResult }
   | { messages: { id: string }[]; recipients: number }
   | {
       relay: {
@@ -107,7 +107,7 @@ type OrchestrationSendResult =
         destination?: 'run_home' | 'worker'
         accepted: true
       }
-      lifecycle?: { action: 'completed' | 'failed' }
+      lifecycle?: LifecycleSendResult
     }
 
 function resolveCompatibilityCliCommand(): 'orca' | 'orca-ide' | 'orca-dev' {
@@ -579,6 +579,7 @@ export const ORCHESTRATION_HANDLERS: Record<string, CommandHandler> = {
       payload: getOptionalStructuredMessagePayload(flags),
       // Why: pane key is the remint-stable sender identity the runtime verifies lifecycle ownership against; older runtimes strip it.
       senderPaneKey: process.env.ORCA_PANE_KEY || undefined,
+      waitForLifecycleSettlement: type === 'worker_done' ? true : undefined,
       devMode: isDevCliInvocation()
     }
     const dispatchCapability = getOptionalStringFlag(flags, 'dispatch-capability')
@@ -589,15 +590,12 @@ export const ORCHESTRATION_HANDLERS: Record<string, CommandHandler> = {
       sendParams,
       dispatchCapability ? { orchestrationCapability: dispatchCapability } : undefined
     )
-    if ('message' in result.result && result.result.lifecycle?.action === 'rejected') {
-      // Why: a rejected lifecycle signal isn't completion; non-zero exit stops workers from treating it as such.
-      process.exitCode = 1
+    await requireWorkerDoneSettlement(client, type, sendParams.payload, result.result)
+    if ('lifecycle' in result.result && result.result.lifecycle?.action === 'rejected') {
+      throw new RuntimeClientError(result.result.lifecycle.code, result.result.lifecycle.reason)
     }
     printResult(result, json, (r) => {
       if ('message' in r) {
-        if (r.lifecycle?.action === 'rejected') {
-          return `Rejected ${r.message.id}: ${r.lifecycle.reason}`
-        }
         return `Sent ${r.message.id}`
       }
       if ('relay' in r) {
diff --git a/src/cli/selectors.ts b/src/cli/selectors.ts
index 3729b8598a7..aef583ad0ac 100644
--- a/src/cli/selectors.ts
+++ b/src/cli/selectors.ts
@@ -237,6 +237,14 @@ export async function getEmulatorWorktreeSelector(
   if (client.isRemote) {
     return undefined
   }
+  const terminalWorktreeId = process.env.ORCA_WORKTREE_ID
+  if (terminalWorktreeId?.trim()) {
+    return terminalWorktreeId
+  }
+  const folderWorkspaceId = process.env.ORCA_WORKSPACE_ID?.trim()
+  if (folderWorkspaceId?.startsWith('folder:')) {
+    return folderWorkspaceId
+  }
   try {
     return await resolveCurrentWorktreeSelector(cwd, client)
   } catch {
diff --git a/src/main/agent-hooks/hook-stdin-contract.ts b/src/main/agent-hooks/hook-stdin-contract.ts
index a85997d87de..fb7b3d85487 100644
--- a/src/main/agent-hooks/hook-stdin-contract.ts
+++ b/src/main/agent-hooks/hook-stdin-contract.ts
@@ -29,9 +29,12 @@ export const WINDOWS_HOOK_STDIN_READER = '"%SystemRoot%\\System32\\more.com"'
 export const WINDOWS_HOOK_STDIN_DRAIN_COMMAND = `${WINDOWS_HOOK_STDIN_READER} >nul 2>nul`
 
 // Why (#11549): missing Orca context means the hook ran outside an Orca pane, where the caller
-// may abandon stdin rather than close it — more.com then drains forever and strands a visible
-// cmd.exe per hook event. Batch can exit instead because it streams to curl rather than
-// capturing, so unlike the POSIX/PowerShell hooks it loses no payload by giving up stdin.
+// may abandon stdin rather than close it — a read-to-EOF then blocks forever and strands a
+// visible window per hook event. The Windows rule: a hook must check the Orca env before it
+// owns stdin, and exit without reading when the env is missing — the payload is discarded on
+// that path anyway. This applies to .cmd, the copilot .ps1, and the Git Bash kimi .sh alike.
+// POSIX hooks keep capture-first: their callers close stdin, and exiting mid-write there
+// surfaces as EPIPE the agent can see (#8110).
 export function buildWindowsHookEnvironmentGuardLines(): string[] {
   return [
     'if "%ORCA_AGENT_HOOK_PORT%"=="" exit /b 0',
diff --git a/src/main/agent-hooks/installer-utils-remote.ts b/src/main/agent-hooks/installer-utils-remote.ts
index aa7e47d258a..b4518220e90 100644
--- a/src/main/agent-hooks/installer-utils-remote.ts
+++ b/src/main/agent-hooks/installer-utils-remote.ts
@@ -8,8 +8,6 @@
 // We deliberately keep the JSON merge logic in the existing
 // `installer-utils.ts` and only swap fs primitives — the JSON shape and
 // managed-command matching must stay identical to the local install.
-//
-// See docs/design/agent-status-over-ssh.md §8 (commit #8).
 
 import { randomUUID } from 'node:crypto'
 import type { SFTPWrapper, FileEntryWithStats } from 'ssh2'
@@ -83,9 +81,9 @@ export async function writeHooksJsonRemote(
   }
 }
 
-/** Write the managed hook script to the remote and chmod 0o755. POSIX-only —
- *  the relay deliberately does not support Windows-remote in v1 (see design
- *  doc §3 + §6). */
+/** Write the managed hook script to the remote and chmod 0o755. POSIX-only:
+ *  the payload is a shell script and every path here is POSIX-joined, so a
+ *  Windows SSH target would need a separate installer, not a tweak to this one. */
 export async function writeManagedScriptRemote(
   sftp: SFTPWrapper,
   remotePath: string,
diff --git a/src/main/agent-hooks/installer-utils.test.ts b/src/main/agent-hooks/installer-utils.test.ts
index 75aabc6fc7e..2013865aa96 100644
--- a/src/main/agent-hooks/installer-utils.test.ts
+++ b/src/main/agent-hooks/installer-utils.test.ts
@@ -24,7 +24,6 @@ import {
   removeManagedCommands,
   wrapPosixHookCommand,
   wrapWindowsCmdHookCommand,
-  wrapWindowsGitBashHookCommand,
   readHooksJsonWithRaw,
   wrapWindowsHookCommand,
   writeManagedScript,
@@ -32,6 +31,7 @@ import {
   type HooksConfig
 } from './installer-utils'
 import { POSIX_HOOK_STDIN_DRAIN_COMMAND } from './hook-stdin-contract'
+import { wrapRuntimeHomeHookCommand } from './runtime-home-hook-command'
 
 let tmpDir: string
 let configPath: string
@@ -320,6 +320,53 @@ describe('removeManagedCommands', () => {
 
     expect(cleaned).toEqual([{ hooks: [{ type: 'command', command: 'echo keep me' }] }])
   })
+
+  it('removes exec-form hooks whose managed script path is an argument', () => {
+    const cleaned = removeManagedCommands(
+      [
+        {
+          hooks: [
+            {
+              type: 'command',
+              command: 'C:\\Windows\\System32\\conhost.exe',
+              args: [
+                '--headless',
+                'C:\\Windows\\System32\\cmd.exe',
+                '/d',
+                '/c',
+                'C:\\Users\\alice\\.orca\\agent-hooks\\copilot-hook.cmd'
+              ]
+            },
+            { type: 'command', command: 'echo keep me' }
+          ]
+        }
+      ],
+      match
+    )
+
+    expect(cleaned).toEqual([{ hooks: [{ type: 'command', command: 'echo keep me' }] }])
+  })
+
+  it('preserves user hooks with malformed args fields', () => {
+    const definitions = [
+      {
+        hooks: [
+          {
+            type: 'command' as const,
+            command: 'echo keep me',
+            args: 'not-an-array' as unknown as string[]
+          },
+          {
+            type: 'command' as const,
+            command: 'echo keep me too',
+            args: [42] as unknown as string[]
+          }
+        ]
+      }
+    ]
+
+    expect(removeManagedCommands(definitions, match)).toEqual(definitions)
+  })
 })
 
 describe('hookDefinitionHasManagedCommand', () => {
@@ -338,6 +385,34 @@ describe('hookDefinitionHasManagedCommand', () => {
         match
       )
     ).toBe(true)
+    expect(
+      hookDefinitionHasManagedCommand(
+        {
+          hooks: [
+            {
+              type: 'command',
+              command: 'C:\\Windows\\System32\\conhost.exe',
+              args: ['--headless', 'C:\\Users\\alice\\.orca\\agent-hooks\\copilot-hook.cmd']
+            }
+          ]
+        },
+        match
+      )
+    ).toBe(true)
+    expect(
+      hookDefinitionHasManagedCommand(
+        {
+          hooks: [
+            {
+              type: 'command',
+              command: 'echo no',
+              args: 'not-an-array' as unknown as string[]
+            }
+          ]
+        },
+        match
+      )
+    ).toBe(false)
     expect(hookDefinitionHasManagedCommand({ bash: 'echo no' }, match)).toBe(false)
   })
 })
@@ -573,28 +648,87 @@ describe('wrapWindowsCmdHookCommand', () => {
   })
 })
 
-describe('wrapWindowsGitBashHookCommand', () => {
-  it('guards the forward-slash fast path and drains when missing', () => {
-    expect(
-      wrapWindowsGitBashHookCommand('C:\\Users\\alice\\.orca\\agent-hooks\\claude-hook.cmd')
-    ).toBe(
-      `if [ -f 'C:/Users/alice/.orca/agent-hooks/claude-hook.cmd' ]; then 'C:/Users/alice/.orca/agent-hooks/claude-hook.cmd'; else ${POSIX_HOOK_STDIN_DRAIN_COMMAND}; fi`
+describe('wrapRuntimeHomeHookCommand', () => {
+  it('selects the runtime platform variant under HOME', () => {
+    const command = wrapRuntimeHomeHookCommand('claude-hook')
+
+    expect(command).toContain('case "${OSTYPE-}" in msys*|cygwin*|win32*)')
+    expect(command).toContain('case "$HOME" in *\\&*|*\\^*|*\\(*|*\\)*|*\\;*|*,*|*=*|*%*|*\\!*)')
+    expect(command).not.toContain('uname')
+    expect(command).toContain('"$HOME/.orca/agent-hooks/claude-hook.cmd"')
+    expect(command).toContain('/bin/sh "$HOME/.orca/agent-hooks/claude-hook.sh"')
+    expect(command).not.toMatch(/[A-Z]:[\\/]|\/Users\/|\/home\//)
+  })
+
+  it('rejects a script base name that could inject shell syntax', () => {
+    expect(() => wrapRuntimeHomeHookCommand('claude-hook; echo injected')).toThrow(
+      'Invalid managed script base name'
     )
   })
 
-  it('falls back to the encoded launcher when bash would split the path', () => {
-    const scriptPath = 'C:\\Users\\Jane Doe\\.orca\\agent-hooks\\claude-hook.cmd'
-    const command = wrapWindowsGitBashHookCommand(scriptPath)
-    expect(command).toMatch(qualifiedWindowsPowerShellCommand)
-    expect(decodeWindowsHookCommand(command)).toBe(expectedDecodedWindowsHookCommand(scriptPath))
+  it('executes the destination HOME script for the current runtime', () => {
+    const sourceHome = join(tmpDir, 'source profile')
+    const destinationHome = join(tmpDir, "destination $HOME ' & profile")
+    const sourceScriptDir = join(sourceHome, '.orca', 'agent-hooks')
+    const destinationScriptDir = join(destinationHome, '.orca', 'agent-hooks')
+    mkdirSync(sourceScriptDir, { recursive: true })
+    mkdirSync(destinationScriptDir, { recursive: true })
+    const windowsExitCode = process.platform === 'win32' ? 7 : 9
+    const posixExitCode = process.platform === 'win32' ? 9 : 7
+    writeFileSync(
+      join(destinationScriptDir, 'claude-hook.cmd'),
+      `@echo off\r\nexit /b ${windowsExitCode}\r\n`,
+      'utf-8'
+    )
+    writeFileSync(
+      join(destinationScriptDir, 'claude-hook.sh'),
+      `#!/bin/sh\nexit ${posixExitCode}\n`,
+      'utf-8'
+    )
+    writeFileSync(join(sourceScriptDir, 'claude-hook.cmd'), '@echo off\r\nexit /b 9\r\n', 'utf-8')
+    writeFileSync(join(sourceScriptDir, 'claude-hook.sh'), '#!/bin/sh\nexit 9\n', 'utf-8')
+    chmodSync(join(destinationScriptDir, 'claude-hook.sh'), 0o755)
+
+    const shell =
+      process.platform === 'win32'
+        ? join(process.env.ProgramFiles ?? 'C:\\Program Files', 'Git', 'bin', 'bash.exe')
+        : '/bin/sh'
+    const result = spawnSync(shell, ['-c', wrapRuntimeHomeHookCommand('claude-hook')], {
+      env: {
+        ...process.env,
+        HOME: destinationHome.replaceAll('\\', '/'),
+        USERPROFILE: destinationHome
+      }
+    })
+
+    expect(result.error).toBeUndefined()
+    expect(result.status, result.stderr.toString()).toBe(7)
   })
 
-  it('falls back to the encoded launcher when bash metacharacters are present', () => {
-    const scriptPath = 'C:\\Users\\alice & bob\\.orca\\agent-hooks\\claude-hook.cmd'
-    const command = wrapWindowsGitBashHookCommand(scriptPath)
-    expect(command).toMatch(qualifiedWindowsPowerShellCommand)
-    expect(command).not.toContain('& bob')
-    expect(decodeWindowsHookCommand(command)).toBe(expectedDecodedWindowsHookCommand(scriptPath))
+  it.skipIf(process.platform !== 'win32')('keeps common Windows profiles on the fast path', () => {
+    const destinationHome = join(tmpDir, 'destination 国際 profile')
+    const scriptDir = join(destinationHome, '.orca', 'agent-hooks')
+    mkdirSync(scriptDir, { recursive: true })
+    writeFileSync(join(scriptDir, 'claude-hook.cmd'), '@echo off\r\nexit /b 7\r\n', 'utf-8')
+    const gitBash = join(process.env.ProgramFiles ?? 'C:\\Program Files', 'Git', 'bin', 'bash.exe')
+    const result = spawnSync(gitBash, ['-c', wrapRuntimeHomeHookCommand('claude-hook')], {
+      env: { ...process.env, HOME: destinationHome.replaceAll('\\', '/') }
+    })
+
+    expect(result.error).toBeUndefined()
+    expect(result.status, result.stderr.toString()).toBe(7)
+  })
+
+  it('drains stdin when HOME is unavailable', () => {
+    const command = `unset HOME; ${wrapRuntimeHomeHookCommand('claude-hook')}`
+    const shell =
+      process.platform === 'win32'
+        ? join(process.env.ProgramFiles ?? 'C:\\Program Files', 'Git', 'bin', 'bash.exe')
+        : '/bin/sh'
+    const result = spawnSync(shell, ['-c', command], { input: Buffer.alloc(1_000_000, 'x') })
+
+    expect(result.error).toBeUndefined()
+    expect(result.status).toBe(0)
   })
 })
 
diff --git a/src/main/agent-hooks/installer-utils.ts b/src/main/agent-hooks/installer-utils.ts
index a6d5d61fd41..f6e4c131826 100644
--- a/src/main/agent-hooks/installer-utils.ts
+++ b/src/main/agent-hooks/installer-utils.ts
@@ -20,6 +20,7 @@ import { writeRollingFileBackup } from '../rolling-file-backup'
 export type HookCommandConfig = {
   type: 'command'
   command: string
+  args?: string[]
   timeout?: number
   async?: boolean
   statusMessage?: string
@@ -151,16 +152,6 @@ export function wrapWindowsCmdHookCommand(scriptPath: string): string {
   return WINDOWS_CMD_SAFE_PATH.test(scriptPath) ? scriptPath : wrapWindowsHookCommand(scriptPath)
 }
 
-export const WINDOWS_GIT_BASH_SAFE_PATH = /^[A-Za-z0-9_.:/~-]+$/
-
-export function wrapWindowsGitBashHookCommand(scriptPath: string): string {
-  const bashPath = scriptPath.replaceAll('\\', '/')
-  // Why: Claude's Git Bash runner can execute a forward-slash .cmd directly; unsafe paths stay encoded.
-  return WINDOWS_GIT_BASH_SAFE_PATH.test(bashPath)
-    ? `if [ -f ${quotePosixShellString(bashPath)} ]; then ${quotePosixShellString(bashPath)}; else ${POSIX_HOOK_STDIN_DRAIN_COMMAND}; fi`
-    : wrapWindowsHookCommand(scriptPath)
-}
-
 /**
  * Extra form lines inserted before the final `payload@-` line (each should end with ` ^`).
  * Used by Grok to attach `grokHome` without fragile string replace on the shared template.
@@ -215,7 +206,8 @@ export function removeManagedCommands(
     const directManagedKeys = directCommandKeys.filter((key) => isManagedCommand(definition[key]))
     const hasNestedHooks = Array.isArray(definition.hooks)
     const hasManagedNestedHook =
-      hasNestedHooks && definition.hooks!.some((hook) => isManagedCommand(hook.command))
+      hasNestedHooks &&
+      definition.hooks!.some((hook) => hookHasManagedCommand(hook, isManagedCommand))
 
     if (directManagedKeys.length === 0 && !hasManagedNestedHook) {
       return [definition]
@@ -227,7 +219,9 @@ export function removeManagedCommands(
     }
 
     if (hasManagedNestedHook) {
-      const filteredHooks = definition.hooks!.filter((hook) => !isManagedCommand(hook.command))
+      const filteredHooks = definition.hooks!.filter(
+        (hook) => !hookHasManagedCommand(hook, isManagedCommand)
+      )
       if (filteredHooks.length > 0) {
         nextDefinition.hooks = filteredHooks
       } else {
@@ -246,6 +240,11 @@ export function removeManagedCommands(
   })
 }
 
+function hookHasManagedCommand(hook: HookCommandConfig, matches: (value?: string) => boolean) {
+  const args = Array.isArray(hook.args) ? hook.args : []
+  return matches(hook.command) || args.some((arg) => typeof arg === 'string' && matches(arg))
+}
+
 export function hookDefinitionHasManagedCommand(
   definition: HookDefinition,
   isManagedCommand: (command: string | undefined) => boolean
@@ -255,7 +254,7 @@ export function hookDefinitionHasManagedCommand(
     isManagedCommand(definition.bash) ||
     isManagedCommand(definition.powershell) ||
     (Array.isArray(definition.hooks) &&
-      definition.hooks.some((hook) => isManagedCommand(hook.command)))
+      definition.hooks.some((hook) => hookHasManagedCommand(hook, isManagedCommand)))
   )
 }
 
diff --git a/src/main/agent-hooks/managed-agent-hook-controls.test.ts b/src/main/agent-hooks/managed-agent-hook-controls.test.ts
index f87fd8a06dd..60004f94df0 100644
--- a/src/main/agent-hooks/managed-agent-hook-controls.test.ts
+++ b/src/main/agent-hooks/managed-agent-hook-controls.test.ts
@@ -7,7 +7,9 @@ const mocks = vi.hoisted(() => ({
   removeClaude: vi.fn(),
   removeCodex: vi.fn(),
   statusClaude: vi.fn(),
-  statusCodex: vi.fn()
+  statusCodex: vi.fn(),
+  refreshClaude: vi.fn(),
+  refreshCodex: vi.fn()
 }))
 
 vi.mock('./local-agent-cli-presence', () => ({
@@ -26,6 +28,10 @@ vi.mock('./managed-agent-hook-registry', () => ({
   MANAGED_AGENT_HOOK_STATUS_READERS: [
     ['claude', mocks.statusClaude],
     ['codex', mocks.statusCodex]
+  ],
+  MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS: [
+    ['claude', mocks.refreshClaude],
+    ['codex', mocks.refreshCodex]
   ]
 }))
 
@@ -51,6 +57,8 @@ describe('managed agent hook controls', () => {
     mocks.installCodex.mockReturnValue(status('codex', 'installed'))
     mocks.removeClaude.mockReturnValue(status('claude', 'not_installed'))
     mocks.removeCodex.mockReturnValue(status('codex', 'not_installed'))
+    mocks.refreshClaude.mockResolvedValue(undefined)
+    mocks.refreshCodex.mockResolvedValue(undefined)
   })
 
   it('installs only agents with positively detected CLIs', async () => {
@@ -73,6 +81,78 @@ describe('managed agent hook controls', () => {
     ])
   })
 
+  it('refreshes existing scripts for agents whose CLI is no longer detected', async () => {
+    mocks.detect.mockResolvedValue({
+      claude: { state: 'missing' },
+      codex: { state: 'found' }
+    })
+
+    await installManagedAgentHooks({ agentCmdOverrides: {} })
+
+    // Why (#11549 aftermath): the skipped agent's user-wide config still invokes the
+    // script, so a stale (leaking) script must not be frozen by the presence gate.
+    expect(mocks.refreshClaude).toHaveBeenCalledTimes(1)
+    expect(mocks.refreshCodex).toHaveBeenCalledTimes(1)
+    expect(mocks.installClaude).not.toHaveBeenCalled()
+  })
+
+  it('refreshes existing scripts even when CLI detection rejects', async () => {
+    mocks.detect.mockRejectedValue(new Error('detection unavailable'))
+
+    await installManagedAgentHooks({ agentCmdOverrides: {} })
+
+    expect(mocks.refreshClaude).toHaveBeenCalledTimes(1)
+    expect(mocks.refreshCodex).toHaveBeenCalledTimes(1)
+  })
+
+  it('awaits each script refresh before probing for CLIs', async () => {
+    let releaseRefresh: (() => void) | undefined
+    mocks.refreshClaude.mockImplementation(
+      () =>
+        new Promise<void>((resolve) => {
+          releaseRefresh = resolve
+        })
+    )
+    mocks.detect.mockResolvedValue({
+      claude: { state: 'missing' },
+      codex: { state: 'missing' }
+    })
+
+    const install = installManagedAgentHooks({ agentCmdOverrides: {} })
+    await Promise.resolve()
+
+    expect(mocks.detect).not.toHaveBeenCalled()
+    releaseRefresh?.()
+    await install
+    expect(mocks.detect).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps installing when a script refresh throws', async () => {
+    mocks.refreshClaude.mockRejectedValue(new Error('disk full'))
+    mocks.detect.mockResolvedValue({
+      claude: { state: 'found' },
+      codex: { state: 'found' }
+    })
+
+    const results = await installManagedAgentHooks({ agentCmdOverrides: {} })
+
+    expect(mocks.installClaude).toHaveBeenCalledTimes(1)
+    expect(mocks.installCodex).toHaveBeenCalledTimes(1)
+    expect(results).toEqual([
+      expect.objectContaining({ agent: 'claude', state: 'installed' }),
+      expect.objectContaining({ agent: 'codex', state: 'installed' })
+    ])
+  })
+
+  it('only refreshes scripts for the selected agents', async () => {
+    mocks.detect.mockResolvedValue({ codex: { state: 'found' } })
+
+    await installManagedAgentHooks({ agentCmdOverrides: {} }, { agents: ['codex'] })
+
+    expect(mocks.refreshClaude).not.toHaveBeenCalled()
+    expect(mocks.refreshCodex).toHaveBeenCalledTimes(1)
+  })
+
   it('fails closed when CLI detection rejects', async () => {
     mocks.detect.mockRejectedValue(new Error('detection unavailable'))
 
diff --git a/src/main/agent-hooks/managed-agent-hook-controls.ts b/src/main/agent-hooks/managed-agent-hook-controls.ts
index 0e767ee72b0..0de10c6417c 100644
--- a/src/main/agent-hooks/managed-agent-hook-controls.ts
+++ b/src/main/agent-hooks/managed-agent-hook-controls.ts
@@ -9,6 +9,7 @@ import { detectLocalManagedAgentCliPresence } from './local-agent-cli-presence'
 import {
   MANAGED_AGENT_HOOK_INSTALLERS,
   MANAGED_AGENT_HOOK_REMOVERS,
+  MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS,
   MANAGED_AGENT_HOOK_STATUS_READERS,
   type ManagedAgentHookInstaller
 } from './managed-agent-hook-registry'
@@ -87,10 +88,29 @@ function runInstaller(
   }
 }
 
+// Why (#11549 aftermath): a CLI that falls off PATH keeps its user-wide config invoking
+// Orca's script, but the presence gate below then skips install() forever, freezing the
+// script at whatever Orca generated last. Existing scripts are Orca-owned, so bring them
+// current before any gating; creating new ones remains install()'s presence-gated job.
+async function refreshExistingManagedScripts(options: InstallOptions): Promise<void> {
+  const allowed = options.agents ? new Set(options.agents) : null
+  for (const [agent, refresh] of MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS) {
+    if (allowed !== null && !allowed.has(agent)) {
+      continue
+    }
+    try {
+      await refresh()
+    } catch (error) {
+      console.error(`[agent-hooks] Failed to refresh ${agent} managed script:`, error)
+    }
+  }
+}
+
 export async function installManagedAgentHooks(
   settings: ManagedHookSettings = null,
   options: InstallOptions = {}
 ): Promise<AgentHookInstallStatus[]> {
+  await refreshExistingManagedScripts(options)
   const installers = selectedInstallers(options)
   const disabled = new Set(normalizeDisabledTuiAgents(settings?.disabledTuiAgents))
   const enabledInstallers = installers.filter(([agent]) => !disabled.has(agent))
diff --git a/src/main/agent-hooks/managed-agent-hook-registry.ts b/src/main/agent-hooks/managed-agent-hook-registry.ts
index 1c17da381ce..4772a763b6c 100644
--- a/src/main/agent-hooks/managed-agent-hook-registry.ts
+++ b/src/main/agent-hooks/managed-agent-hook-registry.ts
@@ -16,6 +16,7 @@ import { kimiHookService } from '../kimi/hook-service'
 import { openClaudeHookService } from '../openclaude/hook-service'
 
 export type ManagedAgentHookInstaller = readonly [HookInstallAgent, () => AgentHookInstallStatus]
+export type ManagedAgentHookScriptRefresher = readonly [HookInstallAgent, () => Promise<void>]
 export type ManagedAgentHookRemover = readonly [HookInstallAgent, () => AgentHookInstallStatus]
 export type ManagedAgentHookStatusReader = readonly [HookInstallAgent, () => AgentHookInstallStatus]
 
@@ -36,6 +37,27 @@ export const MANAGED_AGENT_HOOK_INSTALLERS: readonly ManagedAgentHookInstaller[]
   ['kimi', () => kimiHookService.install()]
 ]
 
+// Why: covers the shared launcher/statusline scripts under ~/.orca/agent-hooks — the files a
+// user-wide agent config keeps invoking after the CLI falls off PATH. Amp and Hermes write
+// provider-native plugin code into their own config dirs with their own install lifecycles,
+// not shared launchers, so they are deliberately absent. Enforced by the coverage test in
+// managed-hook-script-refresh.test.ts: a new installer that writes a launcher without adding
+// a refresher here fails that test.
+export const MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS: readonly ManagedAgentHookScriptRefresher[] = [
+  ['claude', () => claudeHookService.refreshManagedScripts()],
+  ['openclaude', () => openClaudeHookService.refreshManagedScripts()],
+  ['codex', () => codexHookService.refreshManagedScripts()],
+  ['gemini', () => geminiHookService.refreshManagedScripts()],
+  ['antigravity', () => antigravityHookService.refreshManagedScripts()],
+  ['cursor', () => cursorHookService.refreshManagedScripts()],
+  ['droid', () => droidHookService.refreshManagedScripts()],
+  ['command-code', () => commandCodeHookService.refreshManagedScripts()],
+  ['grok', () => grokHookService.refreshManagedScripts()],
+  ['copilot', () => copilotHookService.refreshManagedScripts()],
+  ['devin', () => devinHookService.refreshManagedScripts()],
+  ['kimi', () => kimiHookService.refreshManagedScripts()]
+]
+
 export const MANAGED_AGENT_HOOK_REMOVERS: readonly ManagedAgentHookRemover[] = [
   ['claude', () => claudeHookService.remove()],
   ['openclaude', () => openClaudeHookService.remove()],
diff --git a/src/main/agent-hooks/managed-hook-owner-identity.ts b/src/main/agent-hooks/managed-hook-owner-identity.ts
index 7f60956e6e4..51f299595cd 100644
--- a/src/main/agent-hooks/managed-hook-owner-identity.ts
+++ b/src/main/agent-hooks/managed-hook-owner-identity.ts
@@ -32,7 +32,7 @@ function hasCode(error: unknown, code: string): boolean {
 
 export function parseLinuxStartTicks(statLine: string): string | null {
   const commandEnd = statLine.lastIndexOf(')')
-  if (commandEnd < 0) {
+  if (commandEnd === -1) {
     return null
   }
   // Field 22 is index 19 after removing pid and the parenthesized command.
diff --git a/src/main/agent-hooks/managed-hook-runtime.test.ts b/src/main/agent-hooks/managed-hook-runtime.test.ts
index 456a741df87..5422de4e692 100644
--- a/src/main/agent-hooks/managed-hook-runtime.test.ts
+++ b/src/main/agent-hooks/managed-hook-runtime.test.ts
@@ -1,5 +1,38 @@
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { resolveRelayGrokHome } from './managed-hook-runtime'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeChildProcess from 'node:child_process'
+
+// Why: the probe spawns a real login shell, and `resolveRelayGrokHome` swallows every
+// spawn failure into its fallback. Left unmocked this asserts the runner's scheduling
+// latency, not the parser: on a loaded sharded CI box the 8s timeout expires and the
+// first case silently flips to the fallback path.
+vi.mock('node:child_process', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeChildProcess>()
+  return { ...actual, execFile: vi.fn() }
+})
+
+const { execFile } = await import('node:child_process')
+const execFileMock = vi.mocked(execFile)
+const { resolveRelayGrokHome } = await import('./managed-hook-runtime')
+
+type ExecFileCallback = (error: Error | null, result?: { stdout: string; stderr: string }) => void
+
+function stubProbeOutput(stdout: string): void {
+  execFileMock.mockImplementation(((...args: unknown[]) => {
+    ;(args.at(-1) as ExecFileCallback)(null, { stdout, stderr: '' })
+    return undefined
+  }) as unknown as typeof execFile)
+}
+
+function stubProbeFailure(error: Error): void {
+  execFileMock.mockImplementation(((...args: unknown[]) => {
+    ;(args.at(-1) as ExecFileCallback)(error)
+    return undefined
+  }) as unknown as typeof execFile)
+}
+
+beforeEach(() => {
+  execFileMock.mockReset()
+})
 
 afterEach(() => {
   vi.unstubAllEnvs()
@@ -8,14 +41,39 @@ afterEach(() => {
 describe.runIf(process.platform !== 'win32')('resolveRelayGrokHome', () => {
   it('uses the login-shell GROK_HOME and normalizes trailing separators', async () => {
     vi.stubEnv('SHELL', '/bin/sh')
-    vi.stubEnv('GROK_HOME', '/srv/grok///')
+    stubProbeOutput('/srv/grok///\n')
 
     await expect(resolveRelayGrokHome('/home/orca')).resolves.toBe('/srv/grok')
+
+    const [shell, args] = execFileMock.mock.calls[0] ?? []
+    expect(shell).toBe('/bin/sh')
+    // `sh`/`dash` reject `-lc`, so the mode choice is part of the contract under test.
+    expect(args?.[0]).toBe('-c')
+  })
+
+  it('passes -lc to a login shell that supports it', async () => {
+    vi.stubEnv('SHELL', '/bin/zsh')
+    stubProbeOutput('/srv/grok\n')
+
+    await expect(resolveRelayGrokHome('/home/orca')).resolves.toBe('/srv/grok')
+
+    const [shell, args] = execFileMock.mock.calls[0] ?? []
+    expect(shell).toBe('/bin/zsh')
+    expect(args?.[0]).toBe('-lc')
   })
 
   it('falls back when the login-shell GROK_HOME is not an absolute POSIX path', async () => {
     vi.stubEnv('SHELL', '/bin/sh')
-    vi.stubEnv('GROK_HOME', '../relative')
+    stubProbeOutput('../relative\n')
+
+    await expect(resolveRelayGrokHome('/home/orca')).resolves.toBe('/home/orca/.grok')
+  })
+
+  // Why: this is the branch that made the old test flaky — pin it so a probe failure is
+  // an asserted fallback rather than an invisible substitution for a real answer.
+  it('falls back when the probe fails or times out', async () => {
+    vi.stubEnv('SHELL', '/bin/sh')
+    stubProbeFailure(Object.assign(new Error('spawn timed out'), { killed: true }))
 
     await expect(resolveRelayGrokHome('/home/orca')).resolves.toBe('/home/orca/.grok')
   })
diff --git a/src/main/agent-hooks/managed-hook-script-refresh-main-thread.test.ts b/src/main/agent-hooks/managed-hook-script-refresh-main-thread.test.ts
new file mode 100644
index 00000000000..e80011d803f
--- /dev/null
+++ b/src/main/agent-hooks/managed-hook-script-refresh-main-thread.test.ts
@@ -0,0 +1,101 @@
+import type * as NodeFsModule from 'node:fs'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import type * as NodeFsPromisesModule from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import type * as NodeOsModule from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const state = vi.hoisted(() => ({
+  home: '',
+  syncCalls: [] as { name: string; target: string }[],
+  blockAsyncReads: false
+}))
+
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeFsModule>()
+  const wrapped: Record<string, unknown> = { ...actual }
+  for (const [name, value] of Object.entries(actual)) {
+    if (!name.endsWith('Sync') || typeof value !== 'function') {
+      continue
+    }
+    const original = value as ((...args: unknown[]) => unknown) & Record<string, unknown>
+    const recorder = (...args: unknown[]): unknown => {
+      state.syncCalls.push({ name, target: typeof args[0] === 'string' ? args[0] : '' })
+      return original(...args)
+    }
+    Object.assign(recorder, original)
+    wrapped[name] = recorder
+  }
+  return { ...wrapped, default: wrapped }
+})
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeFsPromisesModule>()
+  return {
+    ...actual,
+    default: actual,
+    readFile: (...args: Parameters<typeof actual.readFile>) =>
+      state.blockAsyncReads && String(args[0]).startsWith(state.home)
+        ? new Promise<never>(() => {})
+        : actual.readFile(...args)
+  }
+})
+
+vi.mock('node:os', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeOsModule>()
+  return { ...actual, default: actual, homedir: () => state.home }
+})
+
+vi.mock('electron', () => ({ app: { getPath: () => '/tmp/orca-user-data' } }))
+
+import { MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS } from './managed-agent-hook-registry'
+
+function syncCallsUnderHome(): string[] {
+  return state.syncCalls
+    .filter((call) => call.target.startsWith(state.home))
+    .map((call) => `${call.name}(${call.target})`)
+}
+
+describe('managed hook script refresh stays off the main thread', () => {
+  beforeEach(async () => {
+    state.home = await mkdtemp(join(tmpdir(), 'orca-hook-refresh-main-thread-'))
+    state.syncCalls = []
+    state.blockAsyncReads = false
+  })
+
+  afterEach(async () => {
+    state.blockAsyncReads = false
+    await rm(state.home, { recursive: true, force: true })
+  })
+
+  it('uses no synchronous HOME filesystem calls for missing or stale scripts', async () => {
+    const hooksDir = join(state.home, '.orca', 'agent-hooks')
+    const claudeScript = join(
+      hooksDir,
+      process.platform === 'win32' ? 'claude-hook.cmd' : 'claude-hook.sh'
+    )
+    await mkdir(hooksDir, { recursive: true })
+    await writeFile(claudeScript, 'stale', 'utf-8')
+    state.syncCalls = []
+
+    for (const [, refresh] of MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS) {
+      await refresh()
+    }
+
+    expect(syncCallsUnderHome()).toEqual([])
+  })
+
+  it('keeps the event loop responsive while a HOME read is stalled', async () => {
+    state.blockAsyncReads = true
+    const refresh = MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS[0][1]()
+    let settled = false
+    void refresh.then(() => {
+      settled = true
+    })
+
+    await new Promise<void>((resolve) => setTimeout(resolve, 5))
+
+    expect(settled).toBe(false)
+  })
+})
diff --git a/src/main/agent-hooks/managed-hook-script-refresh.test.ts b/src/main/agent-hooks/managed-hook-script-refresh.test.ts
new file mode 100644
index 00000000000..799f8acf58c
--- /dev/null
+++ b/src/main/agent-hooks/managed-hook-script-refresh.test.ts
@@ -0,0 +1,206 @@
+// Why (#11549 aftermath): a CLI that falls off PATH keeps its user-wide config invoking
+// Orca's script while the presence gate skips install() forever. These tests pin the
+// repair — existing scripts come current, missing ones are never created.
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  existsSync,
+  chmodSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  utimesSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type * as osModule from 'node:os'
+
+let isolatedUserDataDir = ''
+let previousUserDataPath: string | undefined
+
+beforeEach(() => {
+  previousUserDataPath = process.env.ORCA_USER_DATA_PATH
+  isolatedUserDataDir = mkdtempSync(join(tmpdir(), 'orca-hook-refresh-user-data-'))
+  process.env.ORCA_USER_DATA_PATH = isolatedUserDataDir
+})
+
+afterEach(() => {
+  if (previousUserDataPath === undefined) {
+    delete process.env.ORCA_USER_DATA_PATH
+  } else {
+    process.env.ORCA_USER_DATA_PATH = previousUserDataPath
+  }
+  rmSync(isolatedUserDataDir, { recursive: true, force: true })
+})
+
+const { homedirMock } = vi.hoisted(() => ({
+  homedirMock: vi.fn<() => string>()
+}))
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => '/tmp/orca-user-data'
+  }
+}))
+
+vi.mock('os', async (importOriginal) => {
+  const actual = await importOriginal<typeof osModule>()
+  return {
+    ...actual,
+    homedir: homedirMock.mockImplementation(actual.homedir)
+  }
+})
+
+import { refreshManagedScriptIfPresent } from './managed-hook-script-refresh'
+import {
+  MANAGED_AGENT_HOOK_INSTALLERS,
+  MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS
+} from './managed-agent-hook-registry'
+import { ClaudeHookService } from '../claude/hook-service'
+
+async function withPlatform<T>(platform: NodeJS.Platform, run: () => T | Promise<T>): Promise<T> {
+  const original = Object.getOwnPropertyDescriptor(process, 'platform')
+  Object.defineProperty(process, 'platform', { configurable: true, value: platform })
+  try {
+    return await run()
+  } finally {
+    if (original) {
+      Object.defineProperty(process, 'platform', original)
+    }
+  }
+}
+
+const STALE_WINDOWS_HOOK = [
+  '@echo off',
+  'setlocal',
+  'if "%ORCA_AGENT_HOOK_PORT%"=="" goto :orca_agent_hook_drain_stdin',
+  ':orca_agent_hook_drain_stdin',
+  '"%SystemRoot%\\System32\\more.com" >nul 2>nul',
+  'exit /b 0',
+  ''
+].join('\r\n')
+
+describe('refreshManagedScriptIfPresent', () => {
+  it('rewrites an existing script and refuses to create a missing one', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'orca-hook-refresh-unit-'))
+    try {
+      const present = join(dir, 'present.cmd')
+      writeFileSync(present, 'stale')
+      expect(await refreshManagedScriptIfPresent(present, 'fresh')).toBe(true)
+      expect(readFileSync(present, 'utf8')).toBe('fresh')
+
+      if (process.platform !== 'win32') {
+        chmodSync(present, 0o600)
+      }
+      const fixedTime = new Date(1_000)
+      utimesSync(present, fixedTime, fixedTime)
+      expect(await refreshManagedScriptIfPresent(present, 'fresh')).toBe(true)
+      expect(statSync(present).mtimeMs).toBe(fixedTime.getTime())
+      if (process.platform !== 'win32') {
+        expect(statSync(present).mode & 0o777).toBe(0o755)
+      }
+
+      const missing = join(dir, 'missing.cmd')
+      expect(await refreshManagedScriptIfPresent(missing, 'fresh')).toBe(false)
+      expect(existsSync(missing)).toBe(false)
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+})
+
+describe('managed hook script refresh', () => {
+  it('brings a stale leaking script current without touching agent config', async () => {
+    const home = mkdtempSync(join(tmpdir(), 'orca-hook-refresh-'))
+    homedirMock.mockReturnValue(home)
+    try {
+      // Why: the bug population has a script (from a past install) but no reachable
+      // CLI — and possibly no config dir Orca may create. Seed only the script.
+      const hooksDir = join(home, '.orca', 'agent-hooks')
+      mkdirSync(hooksDir, { recursive: true })
+      writeFileSync(join(hooksDir, 'claude-hook.cmd'), STALE_WINDOWS_HOOK)
+
+      await withPlatform('win32', () => new ClaudeHookService().refreshManagedScripts())
+
+      const refreshed = readFileSync(join(hooksDir, 'claude-hook.cmd'), 'utf8')
+      expect(refreshed).toContain('if "%ORCA_AGENT_HOOK_PORT%"=="" exit /b 0')
+      expect(refreshed).not.toContain('if "%ORCA_AGENT_HOOK_PORT%"=="" goto')
+      // Why: refresh must not resurrect config for a CLI the user may have removed.
+      expect(existsSync(join(home, '.claude'))).toBe(false)
+      // Why: the statusline script was never installed here, so it must not appear.
+      expect(existsSync(join(hooksDir, 'claude-statusline.cmd'))).toBe(false)
+    } finally {
+      homedirMock.mockImplementation(() => process.env.HOME ?? tmpdir())
+      rmSync(home, { recursive: true, force: true })
+    }
+  })
+
+  it('covers every shared launcher script with a refresher', async () => {
+    const home = mkdtempSync(join(tmpdir(), 'orca-hook-refresh-coverage-'))
+    homedirMock.mockReturnValue(home)
+    const previousGrokHome = process.env.GROK_HOME
+    const previousKimiHome = process.env.KIMI_CODE_HOME
+    delete process.env.GROK_HOME
+    delete process.env.KIMI_CODE_HOME
+    try {
+      await withPlatform('win32', () => {
+        for (const [, install] of MANAGED_AGENT_HOOK_INSTALLERS) {
+          install()
+        }
+      })
+      const hooksDir = join(home, '.orca', 'agent-hooks')
+      const files = readdirSync(hooksDir)
+      expect(files.length).toBeGreaterThan(0)
+      const refresherAgents = MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS.map(([agent]) => agent)
+      // Why: an installer that writes a shared launcher but skips the refresher list would
+      // recreate the frozen-stale-script class this suite exists to prevent.
+      for (const file of files) {
+        expect(
+          refresherAgents.some((agent) => file.startsWith(`${agent}-`)),
+          `${file} is written to ~/.orca/agent-hooks but no refresher owns it`
+        ).toBe(true)
+      }
+      // Why: the reverse direction — a refresher naming an agent that writes nothing is a
+      // stale registry entry, likely a renamed script file.
+      for (const agent of refresherAgents) {
+        expect(
+          files.some((file) => file.startsWith(`${agent}-`)),
+          `refresher for ${agent} matches no installed script`
+        ).toBe(true)
+      }
+    } finally {
+      homedirMock.mockImplementation(() => process.env.HOME ?? tmpdir())
+      if (previousGrokHome === undefined) {
+        delete process.env.GROK_HOME
+      } else {
+        process.env.GROK_HOME = previousGrokHome
+      }
+      if (previousKimiHome === undefined) {
+        delete process.env.KIMI_CODE_HOME
+      } else {
+        process.env.KIMI_CODE_HOME = previousKimiHome
+      }
+      rmSync(home, { recursive: true, force: true })
+    }
+  })
+
+  it('creates nothing anywhere when no managed scripts exist', async () => {
+    const home = mkdtempSync(join(tmpdir(), 'orca-hook-refresh-empty-'))
+    homedirMock.mockReturnValue(home)
+    try {
+      await withPlatform('win32', async () => {
+        for (const [agent, refresh] of MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS) {
+          await expect(refresh(), `${agent} refresh on empty home`).resolves.toBeUndefined()
+        }
+      })
+      // Why: a refresh pass on a machine with no prior installs must be a strict no-op.
+      expect(readdirSync(home)).toEqual([])
+    } finally {
+      homedirMock.mockImplementation(() => process.env.HOME ?? tmpdir())
+      rmSync(home, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/src/main/agent-hooks/managed-hook-script-refresh.ts b/src/main/agent-hooks/managed-hook-script-refresh.ts
new file mode 100644
index 00000000000..5842a9dfbfe
--- /dev/null
+++ b/src/main/agent-hooks/managed-hook-script-refresh.ts
@@ -0,0 +1,90 @@
+import { randomUUID } from 'node:crypto'
+import { chmod, readFile, rename, rm, stat, writeFile } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { grantDirAclAsync, isPermissionError } from '../win32-utils'
+
+type ExistingScript = { exists: false } | { exists: true; content: string | null }
+
+function isMissingPathError(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}
+
+async function readExistingScript(scriptPath: string): Promise<ExistingScript> {
+  try {
+    return { exists: true, content: await readFile(scriptPath, 'utf-8') }
+  } catch (error) {
+    if (isMissingPathError(error)) {
+      return { exists: false }
+    }
+    try {
+      await stat(scriptPath)
+      return { exists: true, content: null }
+    } catch (statError) {
+      if (isMissingPathError(statError)) {
+        return { exists: false }
+      }
+      throw error
+    }
+  }
+}
+
+async function scriptStillExists(scriptPath: string): Promise<boolean> {
+  try {
+    await stat(scriptPath)
+    return true
+  } catch (error) {
+    if (isMissingPathError(error)) {
+      return false
+    }
+    throw error
+  }
+}
+
+async function writeScriptWithAclRetry(scriptPath: string, content: string): Promise<void> {
+  try {
+    await writeFile(scriptPath, content, 'utf-8')
+  } catch (error) {
+    if (isPermissionError(error) && process.platform === 'win32') {
+      try {
+        await grantDirAclAsync(dirname(scriptPath))
+        await writeFile(scriptPath, content, 'utf-8')
+        return
+      } catch {
+        // Re-throw the original permission error.
+      }
+    }
+    throw error
+  }
+}
+
+// Why: refresh must not block Electron's main thread or create state for an absent CLI.
+export async function refreshManagedScriptIfPresent(
+  scriptPath: string,
+  content: string
+): Promise<boolean> {
+  const existing = await readExistingScript(scriptPath)
+  if (!existing.exists) {
+    return false
+  }
+  if (existing.content === content) {
+    if (process.platform !== 'win32') {
+      await chmod(scriptPath, 0o755)
+    }
+    return true
+  }
+
+  const tmpPath = join(dirname(scriptPath), `.${Date.now()}-${randomUUID()}.tmp`)
+  try {
+    await writeScriptWithAclRetry(tmpPath, content)
+    if (process.platform !== 'win32') {
+      await chmod(tmpPath, 0o755)
+    }
+    if (!(await scriptStillExists(scriptPath))) {
+      return false
+    }
+    await rename(tmpPath, scriptPath)
+    return true
+  } finally {
+    await rm(tmpPath, { force: true }).catch(() => undefined)
+  }
+}
diff --git a/src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts b/src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts
index 2ccfe4e54dd..f805e6c25f1 100644
--- a/src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts
+++ b/src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts
@@ -79,12 +79,9 @@ import { GeminiHookService } from '../gemini/hook-service'
 import { GrokHookService } from '../grok/hook-service'
 import { KimiHookService } from '../kimi/hook-service'
 import { openClaudeHookService } from '../openclaude/hook-service'
-import {
-  wrapPosixHookCommand,
-  wrapWindowsGitBashHookCommand,
-  wrapWindowsHookCommand
-} from './installer-utils'
+import { wrapPosixHookCommand, wrapWindowsHookCommand } from './installer-utils'
 import { POSIX_HOOK_STDIN_READER } from './hook-stdin-contract'
+import { wrapRuntimeHomeHookCommand } from './runtime-home-hook-command'
 import { createAgentHookMemorySftp } from './agent-hook-memory-sftp.test-fixture'
 
 const REMOTE_HOME = '/home/dev'
@@ -296,13 +293,17 @@ describe('Windows managed hook stdin structure', () => {
         claude.indexOf('if not "%DEVIN_PROJECT_DIR%"=="" goto :orca_agent_hook_drain_stdin')
       )
 
+      // Why (#11549 class): every Windows-local hook now guards before owning stdin —
+      // the caller may abandon the pipe, and the payload is discarded on this path anyway.
       const copilot = readFileSync(join(hooksDir, 'copilot-hook.ps1'), 'utf8')
-      expect(copilot.indexOf('[Console]::In.ReadToEnd()')).toBeLessThan(
-        copilot.indexOf('if (-not $env:ORCA_AGENT_HOOK_PORT')
+      expect(copilot.indexOf('if (-not $env:ORCA_AGENT_HOOK_PORT')).toBeGreaterThan(-1)
+      expect(copilot.indexOf('if (-not $env:ORCA_AGENT_HOOK_PORT')).toBeLessThan(
+        copilot.indexOf('[Console]::In.ReadToEnd()')
       )
       const kimi = readFileSync(join(hooksDir, 'kimi-hook.sh'), 'utf8')
-      expect(kimi.indexOf(`payload=$(${POSIX_HOOK_STDIN_READER})`)).toBeLessThan(
-        kimi.indexOf('exit 0')
+      expect(kimi.indexOf('if [ -z "$ORCA_AGENT_HOOK_PORT" ]')).toBeGreaterThan(-1)
+      expect(kimi.indexOf('if [ -z "$ORCA_AGENT_HOOK_PORT" ]')).toBeLessThan(
+        kimi.indexOf(`payload=$(${POSIX_HOOK_STDIN_READER})`)
       )
     } finally {
       homedirMock.mockImplementation(() => process.env.HOME ?? tmpdir())
@@ -321,7 +322,7 @@ describe('Windows managed hook stdin structure', () => {
   })
 
   it.skipIf(process.platform !== 'win32')(
-    'exits 0 for every local script and missing-script launcher, and only .cmd drops stdin',
+    'exits 0 for every local script and missing-script launcher, dropping stdin only without Orca env',
     async () => {
       const home = mkdtempSync(join(tmpdir(), 'orca-hook-stdin-windows-live-'))
       homedirMock.mockReturnValue(home)
@@ -359,16 +360,13 @@ describe('Windows managed hook stdin structure', () => {
               : [scriptPath]
           const result = await runHookProcess(executable, args, hookEnvironment())
           expect(result.exitCode, `${fileName} exit code`).toBe(0)
-          if (fileName.endsWith('.cmd')) {
-            // Why (#11549): these guards exit rather than own stdin, so the writer breaks —
-            // EPIPE, or ECONNRESET when Windows tears the pipe down first. hookEnvironment()
-            // strips every ORCA_* var, so the relaxation only ever covers the missing-env
-            // path — a happy-path case added to this loop must not reuse it.
-            for (const error of result.stdinErrors) {
-              expect(['EPIPE', 'ECONNRESET'], `${fileName} stdin error`).toContain(error.code)
-            }
-          } else {
-            expect(result.stdinErrors, `${fileName} stdin errors`).toHaveLength(0)
+          // Why (#11549 class): every Windows-local hook exits before owning stdin when the
+          // Orca env is missing, so the writer may break — EPIPE, or ECONNRESET when Windows
+          // tears the pipe down first. hookEnvironment() strips every ORCA_* var, so this
+          // relaxation only ever covers the missing-env path — a happy-path case added to
+          // this loop must not reuse it.
+          for (const error of result.stdinErrors) {
+            expect(['EPIPE', 'ECONNRESET'], `${fileName} stdin error`).toContain(error.code)
           }
         }
 
@@ -387,9 +385,9 @@ describe('Windows managed hook stdin structure', () => {
             args: ['/d', '/c', wrapWindowsHookCommand(missingScript)]
           },
           {
-            name: 'Git Bash fast path',
+            name: 'portable Git Bash launcher',
             executable: gitBash,
-            args: ['-lc', wrapWindowsGitBashHookCommand(missingScript)]
+            args: ['-lc', wrapRuntimeHomeHookCommand('missing-orca-hook')]
           }
         ]
         for (const launcher of launcherCases) {
diff --git a/src/main/agent-hooks/runtime-home-hook-command.ts b/src/main/agent-hooks/runtime-home-hook-command.ts
new file mode 100644
index 00000000000..3ae887fc054
--- /dev/null
+++ b/src/main/agent-hooks/runtime-home-hook-command.ts
@@ -0,0 +1,22 @@
+import { POSIX_HOOK_STDIN_DRAIN_COMMAND } from './hook-stdin-contract'
+
+const MANAGED_SCRIPT_BASE_NAME = /^[A-Za-z0-9_-]+$/
+const WINDOWS_GIT_BASH_RUNTIME_HOME_UNSAFE = '*\\&*|*\\^*|*\\(*|*\\)*|*\\;*|*,*|*=*|*%*|*\\!*'
+
+export function wrapRuntimeHomeHookCommand(scriptBaseName: string): string {
+  if (!MANAGED_SCRIPT_BASE_NAME.test(scriptBaseName)) {
+    throw new Error(`Invalid managed script base name: ${scriptBaseName}`)
+  }
+  const windowsScript = `"$HOME/.orca/agent-hooks/${scriptBaseName}.cmd"`
+  const posixScript = `"$HOME/.orca/agent-hooks/${scriptBaseName}.sh"`
+  const drain = POSIX_HOOK_STDIN_DRAIN_COMMAND
+  const powershell = '"$SYSTEMROOT/System32/WindowsPowerShell/v1.0/powershell.exe"'
+  const powershellCommand = `$homePath = $env:HOME -replace '^/([A-Za-z])/', '$1:/'; $scriptPath = Join-Path $homePath '.orca\\agent-hooks\\${scriptBaseName}.cmd'; if (Test-Path -LiteralPath $scriptPath -PathType Leaf) { & $scriptPath; exit $LASTEXITCODE }; [Console]::In.ReadToEnd() | Out-Null; exit 0`
+  const encodedCommand = Buffer.from(powershellCommand, 'utf16le').toString('base64')
+  const powershellInvocation = `${powershell} -NoProfile -ExecutionPolicy Bypass -EncodedCommand ${encodedCommand}`
+  const encodedWindowsBranch = `if [ -f ${powershell} ]; then ${powershellInvocation}; else ${drain}; fi`
+  const windowsBranch = `if [ -f ${windowsScript} ]; then case "$HOME" in ${WINDOWS_GIT_BASH_RUNTIME_HOME_UNSAFE}) ${encodedWindowsBranch} ;; *) ${windowsScript} ;; esac; else ${drain}; fi`
+  const posixBranch = `if [ -f ${posixScript} ] && [ -r ${posixScript} ] && [ -x ${posixScript} ]; then /bin/sh ${posixScript}; else ${drain}; fi`
+  // Why: OSTYPE is shell-owned, so platform selection adds no process to every hook invocation.
+  return `if [ -z "\${HOME-}" ]; then ${drain}; else case "\${OSTYPE-}" in msys*|cygwin*|win32*) ${windowsBranch} ;; *) ${posixBranch} ;; esac; fi`
+}
diff --git a/src/main/agent-hooks/server.ts b/src/main/agent-hooks/server.ts
index e5ef70e1395..4dc64d523de 100644
--- a/src/main/agent-hooks/server.ts
+++ b/src/main/agent-hooks/server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable max-lines -- Why: this file owns the loopback HTTP adapter, the on-disk last-status persistence layer (hydrate, sanitize, TTL, atomic write, drop), and the relay ingest path in one place so the cache lifecycle (set → schedule → drain) lives next to the surfaces that mutate it. Splitting would force mutual `private` accessor scaffolding for a single class. */
-// Why: this main-process adapter keeps listener internals in shared/ (`src/shared/agent-hook-listener.ts`) so the relay can host the same pipeline without Electron. See docs/design/agent-status-over-ssh.md §5.
+// Why: this main-process adapter keeps listener internals in shared/ (`src/shared/agent-hook-listener.ts`) so the relay can host the same pipeline without Electron; parsing that drifts back into this file stops applying to SSH panes.
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'
 import { createHash, randomBytes, randomUUID } from 'node:crypto'
 import { chmodSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs'
diff --git a/src/main/agent-hooks/wsl-hook-relay-manager.test.ts b/src/main/agent-hooks/wsl-hook-relay-manager.test.ts
index cb538595c19..4d2ae9b7bb5 100644
--- a/src/main/agent-hooks/wsl-hook-relay-manager.test.ts
+++ b/src/main/agent-hooks/wsl-hook-relay-manager.test.ts
@@ -233,13 +233,6 @@ describe('WslHookRelayManager', () => {
     return { manager: new WslHookRelayManager(deps), deps }
   }
 
-  it('exposes the stable guest endpoint instance key with a port fallback', () => {
-    expect(createManager({}).manager.getInstanceKey()).toBe('testinstance')
-    expect(createManager({ instanceKey: () => 'unsafe/key' }).manager.getInstanceKey()).toBe(
-      'port43117'
-    )
-  })
-
   it('starts one relay per distro, installs hooks, exposes the guest endpoint path, and forwards envelopes', async () => {
     const { manager, deps } = createManager({})
     manager.ensureForDistro('Ubuntu')
diff --git a/src/main/agent-hooks/wsl-hook-relay-manager.ts b/src/main/agent-hooks/wsl-hook-relay-manager.ts
index 828e2fa888a..74d163ca42f 100644
--- a/src/main/agent-hooks/wsl-hook-relay-manager.ts
+++ b/src/main/agent-hooks/wsl-hook-relay-manager.ts
@@ -109,15 +109,6 @@ export class WslHookRelayManager {
     return this.stateFor(distro)?.opencodeOverlayDir ?? null
   }
 
-  getInstanceKey(): string | null {
-    const stableKey = sanitizeWslHookInstanceKey(this.deps.instanceKey() ?? undefined)
-    if (stableKey) {
-      return stableKey
-    }
-    const port = Number(this.deps.hookCoordsEnv().ORCA_AGENT_HOOK_PORT ?? '')
-    return Number.isInteger(port) && port > 0 ? `port${port}` : null
-  }
-
   /** Kills every live relay. Non-permanent (hooks switched off mid-session) leaves the
    *  manager reusable, so re-enabling hooks can start relays again without an app restart. */
   disposeAll({ permanent = true }: { permanent?: boolean } = {}): void {
@@ -181,7 +172,8 @@ export class WslHookRelayManager {
     }
     // Why: restart-stable instance identity keeps the guest endpoint file at
     // ONE path across restarts so daemon-surviving agents re-coordinate.
-    const instanceKey = this.getInstanceKey() ?? `port${port}`
+    const instanceKey =
+      sanitizeWslHookInstanceKey(this.deps.instanceKey() ?? undefined) ?? `port${port}`
     if (existing) {
       this.recovery.clearTimers(existing)
     }
diff --git a/src/main/ai-vault/cached-session-list.ts b/src/main/ai-vault/cached-session-list.ts
index ad7e81893b3..960bbc5576c 100644
--- a/src/main/ai-vault/cached-session-list.ts
+++ b/src/main/ai-vault/cached-session-list.ts
@@ -1,8 +1,8 @@
 import { join } from 'node:path'
 import {
-  resetAiVaultScannerWorkerForTests,
-  scanAiVaultSessionsInWorker
-} from './session-scanner-worker-spawn'
+  resetAiVaultScannerBackgroundForTests,
+  scanAiVaultSessionsInBackground
+} from './session-scanner-background'
 import { getWslHomeAsync, listWslDistrosAsync } from '../wsl'
 import type { AiVaultListArgs, AiVaultListResult } from '../../shared/ai-vault-types'
 import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
@@ -77,7 +77,7 @@ export async function listAiVaultSessions(
     start: async (scanSignal) => {
       const additionalCodexSessionsDirs =
         sources.getAdditionalCodexHomePaths?.().map((homePath) => join(homePath, 'sessions')) ?? []
-      const result = await scanAiVaultSessionsInWorker(
+      const result = await scanAiVaultSessionsInBackground(
         {
           limit: args?.limit,
           unlimited: args?.unlimited,
@@ -142,5 +142,5 @@ export function resetAiVaultSessionListCacheForTests(): void {
   invalidateAiVaultSessionListCache()
   scanCoordinator = new AiVaultScanCoordinator()
   sources = {}
-  resetAiVaultScannerWorkerForTests()
+  resetAiVaultScannerBackgroundForTests()
 }
diff --git a/src/main/ai-vault/session-first-user-prompt-handler.ts b/src/main/ai-vault/session-first-user-prompt-handler.ts
new file mode 100644
index 00000000000..d20a3508202
--- /dev/null
+++ b/src/main/ai-vault/session-first-user-prompt-handler.ts
@@ -0,0 +1,20 @@
+import type {
+  AiVaultFirstUserPromptArgs,
+  AiVaultFirstUserPromptResult
+} from '../../shared/ai-vault-types'
+import { readAiVaultFirstUserPromptInBackground } from './session-scanner-background'
+
+export function handleAiVaultGetFirstUserPrompt(
+  args?: AiVaultFirstUserPromptArgs
+): Promise<AiVaultFirstUserPromptResult> {
+  if (!args || typeof args.filePath !== 'string' || typeof args.agent !== 'string') {
+    return Promise.resolve({ prompt: null })
+  }
+  return readAiVaultFirstUserPromptInBackground({
+    agent: args.agent,
+    filePath: args.filePath,
+    sessionId: typeof args.sessionId === 'string' ? args.sessionId : undefined,
+    executionHostId: args.executionHostId,
+    codexHome: args.codexHome
+  })
+}
diff --git a/src/main/ai-vault/session-first-user-prompt-read.ts b/src/main/ai-vault/session-first-user-prompt-read.ts
index b656494f61c..f250846a20e 100644
--- a/src/main/ai-vault/session-first-user-prompt-read.ts
+++ b/src/main/ai-vault/session-first-user-prompt-read.ts
@@ -1,7 +1,6 @@
 import { stat } from 'node:fs/promises'
 import type {
   AiVaultAgent,
-  AiVaultFirstUserPromptArgs,
   AiVaultFirstUserPromptResult,
   AiVaultSession
 } from '../../shared/ai-vault-types'
@@ -22,22 +21,6 @@ export type ReadAiVaultFirstUserPromptArgs = {
 
 export type ReadAiVaultFirstUserPromptResult = AiVaultFirstUserPromptResult
 
-/** IPC-safe entry: validates untyped payload then reads the full first prompt. */
-export async function handleAiVaultGetFirstUserPrompt(
-  args?: AiVaultFirstUserPromptArgs
-): Promise<AiVaultFirstUserPromptResult> {
-  if (!args || typeof args.filePath !== 'string' || typeof args.agent !== 'string') {
-    return { prompt: null }
-  }
-  return readAiVaultFirstUserPrompt({
-    agent: args.agent,
-    filePath: args.filePath,
-    sessionId: typeof args.sessionId === 'string' ? args.sessionId : undefined,
-    executionHostId: args.executionHostId,
-    codexHome: args.codexHome
-  })
-}
-
 /**
  * Re-parse one session transcript under full first-prompt capture and return
  * the untruncated first real user ask for copy/reuse.
diff --git a/src/main/ai-vault/session-parse-cache-persistence.ts b/src/main/ai-vault/session-parse-cache-persistence.ts
index 9239d4ccfe2..93e17941ab8 100644
--- a/src/main/ai-vault/session-parse-cache-persistence.ts
+++ b/src/main/ai-vault/session-parse-cache-persistence.ts
@@ -86,8 +86,8 @@ export function scheduleSessionParseCachePersist(stats: SessionParseStats): void
   }
 }
 
-/** Run any pending debounced save immediately and wait for it. Test-only. */
-export async function flushSessionParseCachePersistForTests(): Promise<void> {
+/** Run any pending debounced save immediately and wait for it before process exit. */
+export async function flushSessionParseCachePersist(): Promise<void> {
   if (saveTimer) {
     clearTimeout(saveTimer)
     saveTimer = null
@@ -99,6 +99,8 @@ export async function flushSessionParseCachePersistForTests(): Promise<void> {
   await lastSave
 }
 
+export const flushSessionParseCachePersistForTests = flushSessionParseCachePersist
+
 async function loadPersistedEntries(current: SessionParseCachePersistenceOptions): Promise<void> {
   await sweepOrphanedTempFiles(current.filePath)
   try {
diff --git a/src/main/ai-vault/session-scanner-background.test.ts b/src/main/ai-vault/session-scanner-background.test.ts
new file mode 100644
index 00000000000..0b0ca493db4
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-background.test.ts
@@ -0,0 +1,36 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { shouldUseAiVaultServiceProcess } from './session-scanner-background'
+
+const originalBackend = process.env.ORCA_AI_VAULT_SERVICE_PROCESS
+const originalNodeEnv = process.env.NODE_ENV
+
+afterEach(() => {
+  if (originalBackend === undefined) {
+    delete process.env.ORCA_AI_VAULT_SERVICE_PROCESS
+  } else {
+    process.env.ORCA_AI_VAULT_SERVICE_PROCESS = originalBackend
+  }
+  process.env.NODE_ENV = originalNodeEnv
+})
+
+describe('shouldUseAiVaultServiceProcess', () => {
+  it('keeps unit tests on the worker fallback by default', () => {
+    delete process.env.ORCA_AI_VAULT_SERVICE_PROCESS
+    process.env.NODE_ENV = 'test'
+    expect(shouldUseAiVaultServiceProcess()).toBe(false)
+  })
+
+  it('defaults non-test hosts to the service process', () => {
+    delete process.env.ORCA_AI_VAULT_SERVICE_PROCESS
+    process.env.NODE_ENV = 'production'
+    expect(shouldUseAiVaultServiceProcess()).toBe(true)
+  })
+
+  it.each([
+    ['1', true],
+    ['0', false]
+  ] as const)('honors the explicit %s kill switch', (value, expected) => {
+    process.env.ORCA_AI_VAULT_SERVICE_PROCESS = value
+    expect(shouldUseAiVaultServiceProcess()).toBe(expected)
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-background.ts b/src/main/ai-vault/session-scanner-background.ts
new file mode 100644
index 00000000000..fb80afa2def
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-background.ts
@@ -0,0 +1,80 @@
+import type { AiVaultListResult, AiVaultSubagentListResult } from '../../shared/ai-vault-types'
+import type {
+  AiVaultSessionTitleRequest,
+  AiVaultSessionTitlesResult
+} from '../../shared/ai-vault-session-title'
+import {
+  readAiVaultFirstUserPrompt,
+  type ReadAiVaultFirstUserPromptArgs,
+  type ReadAiVaultFirstUserPromptResult
+} from './session-first-user-prompt-read'
+import {
+  invalidateAiVaultServiceCache,
+  listAiVaultSubagentSessionsInService,
+  readAiVaultFirstUserPromptInService,
+  resetAiVaultScannerServiceForTests,
+  resolveAiVaultSessionTitlesInService,
+  scanAiVaultSessionsInService
+} from './session-scanner-service-spawn'
+import type { AiVaultServiceSubagentRequest } from './session-scanner-service-protocol'
+import {
+  resetAiVaultScannerWorkerForTests,
+  resolveAiVaultSessionTitlesInWorker,
+  scanAiVaultSessionsInWorker
+} from './session-scanner-worker-spawn'
+import type { AiVaultWorkerScanOptions } from './session-scanner-worker-protocol'
+import { listLocalAiVaultSubagentSessions } from './session-subagent-reader'
+
+export function shouldUseAiVaultServiceProcess(): boolean {
+  const configured = process.env.ORCA_AI_VAULT_SERVICE_PROCESS
+  if (configured === '1') {
+    return true
+  }
+  if (configured === '0') {
+    return false
+  }
+  return process.env.NODE_ENV !== 'test'
+}
+
+export function scanAiVaultSessionsInBackground(
+  options: AiVaultWorkerScanOptions,
+  signal?: AbortSignal
+): Promise<AiVaultListResult> {
+  return shouldUseAiVaultServiceProcess()
+    ? scanAiVaultSessionsInService(options, signal)
+    : scanAiVaultSessionsInWorker(options, signal)
+}
+
+export function resolveAiVaultSessionTitlesInBackground(
+  requests: AiVaultSessionTitleRequest[],
+  signal?: AbortSignal
+): Promise<AiVaultSessionTitlesResult> {
+  return shouldUseAiVaultServiceProcess()
+    ? resolveAiVaultSessionTitlesInService(requests, signal)
+    : resolveAiVaultSessionTitlesInWorker(requests, signal)
+}
+
+export function listAiVaultSubagentSessionsInBackground(
+  request: AiVaultServiceSubagentRequest
+): Promise<AiVaultSubagentListResult> {
+  return shouldUseAiVaultServiceProcess()
+    ? listAiVaultSubagentSessionsInService(request)
+    : listLocalAiVaultSubagentSessions(request)
+}
+
+export function readAiVaultFirstUserPromptInBackground(
+  request: ReadAiVaultFirstUserPromptArgs
+): Promise<ReadAiVaultFirstUserPromptResult> {
+  return shouldUseAiVaultServiceProcess()
+    ? readAiVaultFirstUserPromptInService(request)
+    : readAiVaultFirstUserPrompt(request)
+}
+
+export function invalidateAiVaultBackgroundCache(paths: string[]): Promise<void> {
+  return shouldUseAiVaultServiceProcess() ? invalidateAiVaultServiceCache(paths) : Promise.resolve()
+}
+
+export function resetAiVaultScannerBackgroundForTests(): void {
+  resetAiVaultScannerServiceForTests()
+  resetAiVaultScannerWorkerForTests()
+}
diff --git a/src/main/ai-vault/session-scanner-discovery-wsl-gate.test.ts b/src/main/ai-vault/session-scanner-discovery-wsl-gate.test.ts
new file mode 100644
index 00000000000..ce24afccc2c
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-discovery-wsl-gate.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
+import { walkSessionFiles } from './session-scanner-discovery'
+
+describe('walkSessionFiles WSL gate refusals', () => {
+  it('rethrows gate refusals instead of reporting an empty tree', async () => {
+    const refusal = new WslTranscriptFsError('timeout', 'slow share')
+    await expect(
+      walkSessionFiles('\\\\wsl.localhost\\Ubuntu\\home\\ada\\.codex\\sessions', 'codex', [], {
+        extensions: new Set(['.jsonl']),
+        readDirectory: async () => {
+          throw refusal
+        }
+      })
+    ).rejects.toBe(refusal)
+  })
+
+  it('still treats ordinary readdir failures as an empty tree', async () => {
+    await expect(
+      walkSessionFiles('/missing/root', 'codex', [], {
+        extensions: new Set(['.jsonl']),
+        readDirectory: async () => {
+          throw Object.assign(new Error('no such directory'), { code: 'ENOENT' })
+        }
+      })
+    ).resolves.toEqual([])
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-discovery.ts b/src/main/ai-vault/session-scanner-discovery.ts
index 031f94f3619..7f72082a266 100644
--- a/src/main/ai-vault/session-scanner-discovery.ts
+++ b/src/main/ai-vault/session-scanner-discovery.ts
@@ -2,6 +2,7 @@ import type { Dirent } from 'node:fs'
 import { readdir, stat } from 'node:fs/promises'
 import { extname, join } from 'node:path'
 import type { AiVaultAgent, AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { WslTranscriptFsError } from '../native-chat/wsl-transcript-fs-gate'
 import type { FileWithMtime, SessionFileDiscovery } from './session-scanner-types'
 import { errorMessage } from './session-scanner-values'
 
@@ -64,8 +65,13 @@ export async function walkSessionFiles(
     entries = options.readDirectory
       ? await options.readDirectory(dirPath)
       : await readdir(dirPath, { withFileTypes: true })
-  } catch {
+  } catch (error) {
     options.signal?.throwIfAborted()
+    // Why: a gate refusal means the scan could not run, not that the tree is
+    // empty — swallowing it would misreport a stalled distro as "no transcript".
+    if (error instanceof WslTranscriptFsError) {
+      throw error
+    }
     return []
   }
 
diff --git a/src/main/ai-vault/session-scanner-service-client-state.ts b/src/main/ai-vault/session-scanner-service-client-state.ts
new file mode 100644
index 00000000000..ea56bd534f5
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-client-state.ts
@@ -0,0 +1,184 @@
+import type { ChildProcess } from 'node:child_process'
+import type {
+  AiVaultServiceInit,
+  AiVaultServiceLane,
+  AiVaultServiceRequest
+} from './session-scanner-service-protocol'
+
+export const AI_VAULT_SERVICE_READY_TIMEOUT_MS = 5_000
+export const AI_VAULT_SERVICE_SCAN_TIMEOUT_MS = 130_000
+export const AI_VAULT_SERVICE_INTERACTIVE_TIMEOUT_MS = 15_000
+export const AI_VAULT_SERVICE_MAX_CALLS = 16
+export const AI_VAULT_SERVICE_IDLE_TIMEOUT_MS = 10 * 60_000
+export const AI_VAULT_SERVICE_SHUTDOWN_TIMEOUT_MS = 2_000
+
+export type AiVaultServiceProcessFactory = () => ChildProcess
+export type AiVaultServiceClientOptions = {
+  processFactory: AiVaultServiceProcessFactory
+  init: Omit<AiVaultServiceInit, 'type' | 'protocol'>
+  idleTimeoutMs?: number
+  onStderr?: (text: string) => void
+}
+
+export type AiVaultServiceInvalidation = {
+  resolve: () => void
+  reject: (error: Error) => void
+  timer: NodeJS.Timeout
+}
+
+export class AiVaultServiceInvalidations {
+  private readonly pending = new Map<number, AiVaultServiceInvalidation>()
+  private generation = 0
+
+  get size(): number {
+    return this.pending.size
+  }
+
+  open(
+    timeoutMs: number,
+    onTimeout: (generation: number) => void,
+    send: (generation: number) => void
+  ): Promise<void> {
+    const generation = ++this.generation
+    return new Promise<void>((resolve, reject) => {
+      const timer = setTimeout(() => onTimeout(generation), timeoutMs)
+      timer.unref?.()
+      this.pending.set(generation, { resolve, reject, timer })
+      send(generation)
+    })
+  }
+
+  settle(generation: number): boolean {
+    const entry = this.pending.get(generation)
+    if (!entry) {
+      return false
+    }
+    clearTimeout(entry.timer)
+    this.pending.delete(generation)
+    entry.resolve()
+    return true
+  }
+
+  rejectAll(error: Error): void {
+    for (const entry of this.pending.values()) {
+      clearTimeout(entry.timer)
+      entry.reject(error)
+    }
+    this.pending.clear()
+  }
+}
+
+export function createAiVaultServiceReadyWaiter(
+  timeoutMs: number,
+  onTimeout: () => void
+): AiVaultServiceReadyWaiter {
+  let resolve!: (child: ChildProcess) => void
+  let reject!: (error: Error) => void
+  const promise = new Promise<ChildProcess>((resolveReady, rejectReady) => {
+    resolve = resolveReady
+    reject = rejectReady
+  })
+  const timer = setTimeout(onTimeout, timeoutMs)
+  timer.unref?.()
+  return { promise, resolve, reject, timer }
+}
+
+export function retireAiVaultServiceChild(child: ChildProcess): void {
+  child.removeAllListeners('message')
+  child.removeAllListeners('disconnect')
+  child.removeAllListeners('error')
+  child.removeAllListeners('exit')
+  const killTimer = setTimeout(() => child.kill(), AI_VAULT_SERVICE_SHUTDOWN_TIMEOUT_MS)
+  killTimer.unref?.()
+  child.once('exit', () => clearTimeout(killTimer))
+  child.send({ type: 'shutdown' }, () => undefined)
+  child.unref()
+}
+
+export function armAiVaultServiceCancellationTimeout(
+  call: AiVaultServicePendingCall,
+  onExpired: () => void
+): void {
+  if (call.timer) {
+    clearTimeout(call.timer)
+  }
+  call.timer = setTimeout(onExpired, AI_VAULT_SERVICE_SHUTDOWN_TIMEOUT_MS)
+  call.timer.unref?.()
+}
+
+/**
+ * A cold start that faults before the request reached the child self-heals on
+ * the scheduled respawn. Requeue once; the caller rejects when this returns false.
+ */
+export function requeueAiVaultServiceStart(
+  call: AiVaultServicePendingCall,
+  queue: AiVaultServicePendingCall[]
+): boolean {
+  if (call.sent || call.cancelled || call.startRetried) {
+    return false
+  }
+  call.startRetried = true
+  queue.unshift(call)
+  return true
+}
+
+export function clearAiVaultServiceCall(call: AiVaultServicePendingCall): void {
+  if (call.timer) {
+    clearTimeout(call.timer)
+    call.timer = null
+  }
+  if (call.signal && call.onAbort) {
+    call.signal.removeEventListener('abort', call.onAbort)
+    call.onAbort = null
+  }
+}
+
+export function rejectAiVaultServiceCall(call: AiVaultServicePendingCall, error: Error): void {
+  clearAiVaultServiceCall(call)
+  if (!call.cancelled) {
+    call.reject(error)
+  }
+}
+
+export type AiVaultServicePendingCall = {
+  request: AiVaultServiceRequest
+  lane: AiVaultServiceLane
+  signal?: AbortSignal
+  resolve: (value: unknown) => void
+  reject: (error: Error) => void
+  timer: NodeJS.Timeout | null
+  onAbort: (() => void) | null
+  cancelled: boolean
+  /** Whether the child received the request; an unsent call gets no reply. */
+  sent: boolean
+  startRetried: boolean
+}
+
+export type AiVaultServiceReadyWaiter = {
+  promise: Promise<ChildProcess>
+  resolve: (child: ChildProcess) => void
+  reject: (error: Error) => void
+  timer: NodeJS.Timeout
+}
+
+export class AiVaultServiceIdleRetirement {
+  private timer: NodeJS.Timeout | null = null
+
+  clear(): void {
+    if (this.timer) {
+      clearTimeout(this.timer)
+      this.timer = null
+    }
+  }
+
+  schedule(busy: boolean, timeoutMs: number, retire: () => void): void {
+    if (busy || this.timer) {
+      return
+    }
+    this.timer = setTimeout(() => {
+      this.timer = null
+      retire()
+    }, timeoutMs)
+    this.timer.unref?.()
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-service-client.test.ts b/src/main/ai-vault/session-scanner-service-client.test.ts
new file mode 100644
index 00000000000..6dd415cafa5
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-client.test.ts
@@ -0,0 +1,334 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { AiVaultScannerServiceClient } from './session-scanner-service-client'
+import { AI_VAULT_SERVICE_READY_TIMEOUT_MS } from './session-scanner-service-client-state'
+import {
+  AiVaultServiceTestChild,
+  aiVaultServiceRequestId,
+  readyAiVaultServiceChild
+} from './session-scanner-service-test-child'
+
+function setup(idleTimeoutMs?: number): {
+  child: AiVaultServiceTestChild
+  client: AiVaultScannerServiceClient
+} {
+  const child = new AiVaultServiceTestChild()
+  const client = new AiVaultScannerServiceClient({
+    processFactory: () => child.asChildProcess(),
+    init: { sessionParseCache: null },
+    idleTimeoutMs
+  })
+  return { child, client }
+}
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('AiVaultScannerServiceClient', () => {
+  it('waits for ready and runs cache and interactive lanes independently', async () => {
+    const { child, client } = setup()
+    const titles = client.request({ type: 'request', operation: 'titles', requests: [] })
+    const subagents = client.request({
+      type: 'request',
+      operation: 'subagents',
+      request: { agent: 'claude', parentFilePath: '/tmp/parent.jsonl' }
+    })
+
+    expect(child.sent).toEqual([expect.objectContaining({ type: 'init', protocol: 1 })])
+    readyAiVaultServiceChild(child)
+    await Promise.resolve()
+    expect(child.sent).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ operation: 'titles' }),
+        expect.objectContaining({ operation: 'subagents' })
+      ])
+    )
+
+    child.emit('message', {
+      type: 'result',
+      id: aiVaultServiceRequestId(child, 'titles'),
+      operation: 'titles',
+      value: { titles: [] }
+    })
+    child.emit('message', {
+      type: 'result',
+      id: aiVaultServiceRequestId(child, 'subagents'),
+      operation: 'subagents',
+      value: { sessions: [], issues: [] }
+    })
+    await expect(titles).resolves.toEqual({ titles: [] })
+    await expect(subagents).resolves.toEqual({ sessions: [], issues: [] })
+    client.dispose()
+  })
+
+  it('bounds active and queued calls together at sixteen', async () => {
+    const { child, client } = setup()
+    const calls = Array.from({ length: 16 }, () =>
+      client.request({ type: 'request', operation: 'titles', requests: [] })
+    )
+
+    await expect(
+      client.request({ type: 'request', operation: 'titles', requests: [] })
+    ).rejects.toThrow('queue is full')
+    readyAiVaultServiceChild(child)
+    client.dispose()
+    await Promise.all(calls.map((call) => expect(call).rejects.toThrow('disposed')))
+  })
+
+  it('cancels active work and kills a child that ignores cancellation', async () => {
+    vi.useFakeTimers()
+    const { child, client } = setup()
+    const controller = new AbortController()
+    const request = client.request(
+      { type: 'request', operation: 'titles', requests: [] },
+      controller.signal
+    )
+    readyAiVaultServiceChild(child)
+    await Promise.resolve()
+    const id = aiVaultServiceRequestId(child, 'titles')
+
+    controller.abort()
+    await expect(request).rejects.toMatchObject({ name: 'AbortError' })
+    expect(child.sent).toContainEqual({ type: 'cancel', id })
+    vi.advanceTimersByTime(1_999)
+    expect(child.killed).toBe(false)
+    vi.advanceTimersByTime(1)
+    expect(child.killed).toBe(true)
+    client.dispose()
+  })
+
+  it('drops a call cancelled before the child received it', async () => {
+    vi.useFakeTimers()
+    const { child, client } = setup()
+    const controller = new AbortController()
+    const cancelled = client.request(
+      { type: 'request', operation: 'titles', requests: [] },
+      controller.signal
+    )
+
+    controller.abort()
+    await expect(cancelled).rejects.toMatchObject({ name: 'AbortError' })
+    expect(child.sent).not.toContainEqual(expect.objectContaining({ type: 'cancel' }))
+
+    readyAiVaultServiceChild(child)
+    const next = client.request({ type: 'request', operation: 'titles', requests: [] })
+    await Promise.resolve()
+    child.emit('message', {
+      type: 'result',
+      id: aiVaultServiceRequestId(child, 'titles'),
+      operation: 'titles',
+      value: { titles: [] }
+    })
+    await expect(next).resolves.toEqual({ titles: [] })
+    vi.advanceTimersByTime(2_000)
+
+    expect(child.killed).toBe(false)
+    client.dispose()
+  })
+
+  it('retries once when the first cold start misses the ready deadline', async () => {
+    vi.useFakeTimers()
+    const children: AiVaultServiceTestChild[] = []
+    const client = new AiVaultScannerServiceClient({
+      processFactory: () => {
+        const child = new AiVaultServiceTestChild(12_345 + children.length)
+        children.push(child)
+        return child.asChildProcess()
+      },
+      init: { sessionParseCache: null }
+    })
+    const titles = client.request({ type: 'request', operation: 'titles', requests: [] })
+    expect(children).toHaveLength(1)
+
+    vi.advanceTimersByTime(AI_VAULT_SERVICE_READY_TIMEOUT_MS)
+    expect(children[0]!.killed).toBe(true)
+    await Promise.resolve()
+    vi.advanceTimersByTime(250)
+    expect(children).toHaveLength(2)
+    readyAiVaultServiceChild(children[1]!)
+    await Promise.resolve()
+    children[1]!.emit('message', {
+      type: 'result',
+      id: aiVaultServiceRequestId(children[1]!, 'titles'),
+      operation: 'titles',
+      value: { titles: [] }
+    })
+
+    await expect(titles).resolves.toEqual({ titles: [] })
+    client.dispose()
+  })
+
+  it('surfaces the startup error when the retried cold start also fails', async () => {
+    vi.useFakeTimers()
+    const children: AiVaultServiceTestChild[] = []
+    const client = new AiVaultScannerServiceClient({
+      processFactory: () => {
+        const child = new AiVaultServiceTestChild(12_345 + children.length)
+        children.push(child)
+        return child.asChildProcess()
+      },
+      init: { sessionParseCache: null }
+    })
+    const titles = client.request({ type: 'request', operation: 'titles', requests: [] })
+
+    vi.advanceTimersByTime(AI_VAULT_SERVICE_READY_TIMEOUT_MS)
+    await Promise.resolve()
+    vi.advanceTimersByTime(250)
+    expect(children).toHaveLength(2)
+    vi.advanceTimersByTime(AI_VAULT_SERVICE_READY_TIMEOUT_MS)
+
+    await expect(titles).rejects.toThrow('did not become ready')
+    client.dispose()
+  })
+
+  it('acknowledges cache invalidation through the running child', async () => {
+    const { child, client } = setup()
+    const invalidation = client.invalidate(['/tmp/deleted.jsonl'])
+    readyAiVaultServiceChild(child)
+    await vi.waitFor(() =>
+      expect(child.sent).toContainEqual({
+        type: 'invalidate',
+        generation: 1,
+        paths: ['/tmp/deleted.jsonl']
+      })
+    )
+    child.emit('message', { type: 'invalidated', generation: 1 })
+
+    await expect(invalidation).resolves.toBeUndefined()
+    client.dispose()
+  })
+
+  it('leaves a scanning child alone when cache invalidation is slow to acknowledge', async () => {
+    vi.useFakeTimers()
+    const { child, client } = setup()
+    const scan = client.request({ type: 'request', operation: 'scan', options: {} })
+    readyAiVaultServiceChild(child)
+    await Promise.resolve()
+
+    const invalidation = client.invalidate(['/tmp/deleted.jsonl'])
+    await Promise.resolve()
+    vi.advanceTimersByTime(AI_VAULT_SERVICE_READY_TIMEOUT_MS)
+
+    // The scan owns liveness through its own 130s deadline; killing the child
+    // here would abort it and burn a slot toward the restart circuit.
+    await expect(invalidation).resolves.toBeUndefined()
+    expect(child.killed).toBe(false)
+
+    child.emit('message', {
+      type: 'result',
+      id: aiVaultServiceRequestId(child, 'scan'),
+      operation: 'scan',
+      value: { result: { sessions: [], issues: [], scannedAt: '2026-08-10' }, durationMs: 1 }
+    })
+    await expect(scan).resolves.toMatchObject({ result: { sessions: [] } })
+    client.dispose()
+  })
+
+  it('replaces a child that does not acknowledge cache invalidation', async () => {
+    vi.useFakeTimers()
+    const children: AiVaultServiceTestChild[] = []
+    const client = new AiVaultScannerServiceClient({
+      processFactory: () => {
+        const child = new AiVaultServiceTestChild(12_345 + children.length)
+        children.push(child)
+        return child.asChildProcess()
+      },
+      init: { sessionParseCache: null }
+    })
+    const invalidation = client.invalidate(['/tmp/deleted.jsonl'])
+    readyAiVaultServiceChild(children[0]!)
+    await Promise.resolve()
+
+    vi.advanceTimersByTime(AI_VAULT_SERVICE_READY_TIMEOUT_MS)
+
+    await expect(invalidation).rejects.toThrow('cache invalidation timed out')
+    expect(children[0]!.killed).toBe(true)
+    const titles = client.request({ type: 'request', operation: 'titles', requests: [] })
+    expect(children).toHaveLength(1)
+    vi.advanceTimersByTime(250)
+    expect(children).toHaveLength(2)
+    readyAiVaultServiceChild(children[1]!)
+    await Promise.resolve()
+    children[1]!.emit('message', {
+      type: 'result',
+      id: aiVaultServiceRequestId(children[1]!, 'titles'),
+      operation: 'titles',
+      value: { titles: [] }
+    })
+
+    await expect(titles).resolves.toEqual({ titles: [] })
+    client.dispose()
+  })
+
+  it('keeps invalidation-only children alive through acknowledgement, then retires them', async () => {
+    vi.useFakeTimers()
+    const children: AiVaultServiceTestChild[] = []
+    const client = new AiVaultScannerServiceClient({
+      processFactory: () => {
+        const child = new AiVaultServiceTestChild(12_345 + children.length)
+        children.push(child)
+        return child.asChildProcess()
+      },
+      init: { sessionParseCache: null },
+      idleTimeoutMs: 100
+    })
+
+    const first = client.request({ type: 'request', operation: 'titles', requests: [] })
+    readyAiVaultServiceChild(children[0]!)
+    await Promise.resolve()
+    children[0]!.emit('message', {
+      type: 'result',
+      id: aiVaultServiceRequestId(children[0]!, 'titles'),
+      operation: 'titles',
+      value: { titles: [] }
+    })
+    await first
+    vi.advanceTimersByTime(100)
+
+    const invalidation = client.invalidate(['/tmp/deleted.jsonl'])
+    readyAiVaultServiceChild(children[1]!)
+    await Promise.resolve()
+    vi.advanceTimersByTime(100)
+    expect(children[1]!.sent).not.toContainEqual({ type: 'shutdown' })
+    children[1]!.emit('message', { type: 'invalidated', generation: 1 })
+    await invalidation
+    vi.advanceTimersByTime(100)
+
+    expect(children[1]!.sent).toContainEqual({ type: 'shutdown' })
+    client.dispose()
+  })
+
+  it('faults the child on malformed output without affecting later processes', async () => {
+    const { child, client } = setup()
+    const request = client.request({ type: 'request', operation: 'titles', requests: [] })
+    readyAiVaultServiceChild(child)
+    await Promise.resolve()
+
+    child.emit('message', { nope: true })
+
+    await expect(request).rejects.toThrow('malformed')
+    expect(child.killed).toBe(true)
+    client.dispose()
+  })
+
+  it('retires an idle child gracefully, then kills it after the shutdown bound', async () => {
+    vi.useFakeTimers()
+    const { child, client } = setup(100)
+    const request = client.request({ type: 'request', operation: 'titles', requests: [] })
+    readyAiVaultServiceChild(child)
+    await Promise.resolve()
+    child.emit('message', {
+      type: 'result',
+      id: aiVaultServiceRequestId(child, 'titles'),
+      operation: 'titles',
+      value: { titles: [] }
+    })
+    await request
+
+    vi.advanceTimersByTime(100)
+    expect(child.sent).toContainEqual({ type: 'shutdown' })
+    vi.advanceTimersByTime(2_000)
+    expect(child.killed).toBe(true)
+    client.dispose()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-service-client.ts b/src/main/ai-vault/session-scanner-service-client.ts
new file mode 100644
index 00000000000..4f46dc643c5
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-client.ts
@@ -0,0 +1,325 @@
+import type { ChildProcess } from 'node:child_process'
+import { createAiVaultScanCancelledError } from './ai-vault-scan-cancellation'
+import {
+  AI_VAULT_SERVICE_IDLE_TIMEOUT_MS,
+  AI_VAULT_SERVICE_INTERACTIVE_TIMEOUT_MS,
+  AI_VAULT_SERVICE_MAX_CALLS,
+  AI_VAULT_SERVICE_READY_TIMEOUT_MS,
+  AI_VAULT_SERVICE_SCAN_TIMEOUT_MS,
+  AiVaultServiceIdleRetirement,
+  AiVaultServiceInvalidations,
+  armAiVaultServiceCancellationTimeout,
+  clearAiVaultServiceCall,
+  createAiVaultServiceReadyWaiter,
+  rejectAiVaultServiceCall,
+  requeueAiVaultServiceStart,
+  retireAiVaultServiceChild,
+  type AiVaultServiceClientOptions,
+  type AiVaultServicePendingCall,
+  type AiVaultServiceReadyWaiter
+} from './session-scanner-service-client-state'
+import { AiVaultServiceRestartPolicy } from './session-scanner-service-restart-policy'
+import {
+  AI_VAULT_SERVICE_PROTOCOL_VERSION,
+  aiVaultServiceLane,
+  isAiVaultServiceChildMessage,
+  type AiVaultServiceChildMessage,
+  type AiVaultServiceInit,
+  type AiVaultServiceRequest,
+  type AiVaultServiceRequestBody,
+  type AiVaultServiceResultValue
+} from './session-scanner-service-protocol'
+
+export class AiVaultScannerServiceClient {
+  private child: ChildProcess | null = null
+  private readyWaiter: AiVaultServiceReadyWaiter | null = null
+  private readonly active = new Map<AiVaultServicePendingCall['lane'], AiVaultServicePendingCall>()
+  private readonly queue: AiVaultServicePendingCall[] = []
+  private readonly invalidations = new AiVaultServiceInvalidations()
+  private nextId = 1
+  private readonly idleRetirement = new AiVaultServiceIdleRetirement()
+  private readonly restartPolicy = new AiVaultServiceRestartPolicy()
+  private disposed = false
+
+  constructor(private readonly options: AiVaultServiceClientOptions) {}
+
+  request<T>(body: AiVaultServiceRequestBody, signal?: AbortSignal): Promise<T> {
+    if (this.disposed) {
+      return Promise.reject(new Error('AI Vault service client was disposed.'))
+    }
+    if (signal?.aborted) {
+      return Promise.reject(createAiVaultScanCancelledError())
+    }
+    if (this.queue.length + this.active.size >= AI_VAULT_SERVICE_MAX_CALLS) {
+      return Promise.reject(new Error('AI Vault service queue is full.'))
+    }
+    const request = { ...body, id: this.nextId++ } as AiVaultServiceRequest
+    return new Promise<T>((resolve, reject) => {
+      const call: AiVaultServicePendingCall = {
+        request,
+        lane: aiVaultServiceLane(request.operation),
+        signal,
+        resolve: resolve as (value: unknown) => void,
+        reject,
+        timer: null,
+        onAbort: null,
+        cancelled: false,
+        sent: false,
+        startRetried: false
+      }
+      if (signal) {
+        call.onAbort = () => this.cancel(call)
+        signal.addEventListener('abort', call.onAbort, { once: true })
+      }
+      this.queue.push(call)
+      this.idleRetirement.clear()
+      this.pump()
+    })
+  }
+
+  async invalidate(paths: string[]): Promise<void> {
+    if (paths.length === 0 || this.disposed) {
+      return
+    }
+    this.idleRetirement.clear()
+    const child = await this.ensureChild()
+    return this.invalidations.open(
+      AI_VAULT_SERVICE_READY_TIMEOUT_MS,
+      (generation) => this.onInvalidationDeadline(generation),
+      (generation) => child.send({ type: 'invalidate', generation, paths })
+    )
+  }
+
+  /**
+   * The deadline is a startup-sized budget, but a child mid-scan can be slow to
+   * turn the channel around. Fork IPC ordering already guarantees the child
+   * applies the invalidation before any request sent after it, so a busy child
+   * owes nothing here — only an idle one that misses the deadline is wedged.
+   */
+  private onInvalidationDeadline(generation: number): void {
+    if (this.active.size > 0) {
+      this.invalidations.settle(generation)
+      return
+    }
+    this.onFault(new Error('AI Vault service cache invalidation timed out.'))
+  }
+
+  dispose(): void {
+    if (this.disposed) {
+      return
+    }
+    this.disposed = true
+    this.restartPolicy.dispose()
+    this.idleRetirement.clear()
+    const error = new Error('AI Vault service client was disposed.')
+    for (const call of [...this.active.values(), ...this.queue]) {
+      rejectAiVaultServiceCall(call, error)
+    }
+    this.active.clear()
+    this.queue.length = 0
+    this.invalidations.rejectAll(error)
+    this.retireChild()
+  }
+
+  private pump(): void {
+    if (this.restartPolicy.restartScheduled) {
+      return
+    }
+    for (const lane of ['cache', 'interactive'] as const) {
+      if (this.active.has(lane)) {
+        continue
+      }
+      const index = this.queue.findIndex((call) => call.lane === lane)
+      if (index === -1) {
+        continue
+      }
+      const call = this.queue.splice(index, 1)[0]!
+      this.active.set(lane, call)
+      void this.ensureChild().then(
+        (child) => this.sendCall(child, call),
+        (error: Error) => {
+          if (this.active.get(lane) !== call) {
+            return
+          }
+          this.active.delete(lane)
+          this.retryStartOrReject(call, error)
+          this.pump()
+        }
+      )
+    }
+    this.scheduleIdleIfNeeded()
+  }
+
+  private sendCall(child: ChildProcess, call: AiVaultServicePendingCall): void {
+    if (call.cancelled || this.active.get(call.lane) !== call) {
+      return
+    }
+    const timeoutMs =
+      call.request.operation === 'scan'
+        ? AI_VAULT_SERVICE_SCAN_TIMEOUT_MS
+        : AI_VAULT_SERVICE_INTERACTIVE_TIMEOUT_MS
+    call.timer = setTimeout(() => {
+      this.onFault(new Error(`AI Vault service timed out after ${timeoutMs}ms.`))
+    }, timeoutMs)
+    call.timer.unref?.()
+    call.sent = true
+    child.send(call.request)
+  }
+
+  private retryStartOrReject(call: AiVaultServicePendingCall, error: Error): void {
+    if (
+      this.disposed ||
+      !this.restartPolicy.restartScheduled ||
+      !requeueAiVaultServiceStart(call, this.queue)
+    ) {
+      rejectAiVaultServiceCall(call, error)
+    }
+  }
+
+  private ensureChild(): Promise<ChildProcess> {
+    if (this.child && !this.readyWaiter) {
+      return Promise.resolve(this.child)
+    }
+    if (this.readyWaiter) {
+      return this.readyWaiter.promise
+    }
+    const startError = this.restartPolicy.startError()
+    if (startError) {
+      return Promise.reject(startError)
+    }
+    let child: ChildProcess
+    try {
+      child = this.options.processFactory()
+    } catch (error) {
+      this.restartPolicy.recordFault(() => this.pump())
+      return Promise.reject(error instanceof Error ? error : new Error(String(error)))
+    }
+    this.child = child
+    const waiter = createAiVaultServiceReadyWaiter(AI_VAULT_SERVICE_READY_TIMEOUT_MS, () =>
+      this.onFault(new Error('AI Vault service did not become ready.'))
+    )
+    this.readyWaiter = waiter
+    child.on('message', (message) => this.onMessage(message))
+    child.on('error', (error) => this.onFault(error))
+    child.on('disconnect', () => this.onFault(new Error('AI Vault service disconnected.')))
+    child.on('exit', (code) => this.onFault(new Error(`AI Vault service exited (${code}).`)))
+    child.stderr?.on('data', (chunk: Buffer) => this.options.onStderr?.(String(chunk)))
+    child.send({
+      type: 'init',
+      protocol: AI_VAULT_SERVICE_PROTOCOL_VERSION,
+      ...this.options.init
+    } satisfies AiVaultServiceInit)
+    return waiter.promise
+  }
+
+  private onMessage(raw: unknown): void {
+    if (!isAiVaultServiceChildMessage(raw)) {
+      this.onFault(new Error('AI Vault service sent a malformed message.'))
+      return
+    }
+    const message = raw as AiVaultServiceChildMessage
+    if (message.type === 'ready') {
+      const waiter = this.readyWaiter
+      if (!waiter || !this.child) {
+        return
+      }
+      clearTimeout(waiter.timer)
+      this.readyWaiter = null
+      waiter.resolve(this.child)
+      return
+    }
+    if (message.type === 'invalidated') {
+      if (this.invalidations.settle(message.generation)) {
+        this.scheduleIdleIfNeeded()
+      }
+      return
+    }
+    const call = [...this.active.values()].find((entry) => entry.request.id === message.id)
+    if (!call) {
+      return
+    }
+    this.active.delete(call.lane)
+    clearAiVaultServiceCall(call)
+    if (!call.cancelled) {
+      if (message.type === 'error') {
+        call.reject(new Error(message.message))
+      } else {
+        call.resolve((message as { value: AiVaultServiceResultValue['value'] }).value)
+      }
+    }
+    this.pump()
+  }
+
+  private cancel(call: AiVaultServicePendingCall): void {
+    if (call.cancelled) {
+      return
+    }
+    call.cancelled = true
+    call.reject(createAiVaultScanCancelledError())
+    const queuedIndex = this.queue.indexOf(call)
+    if (queuedIndex !== -1) {
+      this.queue.splice(queuedIndex, 1)
+      clearAiVaultServiceCall(call)
+      this.pump()
+      return
+    }
+    if (this.active.get(call.lane) === call) {
+      // Why: a call cancelled before it reached the child gets no acknowledgement,
+      // so waiting on one would kill a healthy service and stall the lane.
+      if (!call.sent) {
+        this.active.delete(call.lane)
+        clearAiVaultServiceCall(call)
+        this.pump()
+        return
+      }
+      this.child?.send({ type: 'cancel', id: call.request.id })
+      armAiVaultServiceCancellationTimeout(call, () =>
+        this.onFault(new Error('AI Vault service did not cancel within 2000ms.'))
+      )
+    }
+  }
+
+  private onFault(error: Error): void {
+    const child = this.child
+    if (!child) {
+      return
+    }
+    this.child = null
+    child.removeAllListeners()
+    child.kill()
+    if (this.readyWaiter) {
+      clearTimeout(this.readyWaiter.timer)
+      this.readyWaiter.reject(error)
+      this.readyWaiter = null
+    }
+    // Recorded before the pending calls are settled so retryStartOrReject can see
+    // whether a respawn is actually coming.
+    this.restartPolicy.recordFault(() => this.pump())
+    const active = [...this.active.values()]
+    this.active.clear()
+    for (const call of active) {
+      this.retryStartOrReject(call, error)
+    }
+    this.invalidations.rejectAll(error)
+  }
+
+  private scheduleIdleIfNeeded(): void {
+    this.idleRetirement.schedule(
+      this.active.size > 0 || this.queue.length > 0 || this.invalidations.size > 0 || !this.child,
+      this.options.idleTimeoutMs ?? AI_VAULT_SERVICE_IDLE_TIMEOUT_MS,
+      () => this.retireChild()
+    )
+  }
+
+  private retireChild(): void {
+    this.idleRetirement.clear()
+    const child = this.child
+    this.child = null
+    if (!child) {
+      return
+    }
+    retireAiVaultServiceChild(child)
+  }
+}
+
+export type { AiVaultServiceProcessFactory } from './session-scanner-service-client-state'
diff --git a/src/main/ai-vault/session-scanner-service-entry-path.test.ts b/src/main/ai-vault/session-scanner-service-entry-path.test.ts
new file mode 100644
index 00000000000..7723a4f8fe7
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-entry-path.test.ts
@@ -0,0 +1,58 @@
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import {
+  resolveAiVaultServiceEntryPath,
+  resolveAiVaultServiceEntryPathWithoutApp
+} from './session-scanner-service-entry-path'
+
+describe('resolveAiVaultServiceEntryPath', () => {
+  it('uses the adjacent electron-vite output when present', () => {
+    const outMain = join(process.cwd(), 'out', 'main')
+    const adjacent = join(outMain, 'session-scanner-service-entry.js')
+
+    expect(resolveAiVaultServiceEntryPath(outMain, false, (path) => path === adjacent)).toBe(
+      adjacent
+    )
+  })
+
+  it('uses the nested output from a project root', () => {
+    expect(resolveAiVaultServiceEntryPath(process.cwd(), false, () => false)).toBe(
+      join(process.cwd(), 'out', 'main', 'session-scanner-service-entry.js')
+    )
+  })
+
+  it('uses app.asar.unpacked for packaged Electron', () => {
+    const appPath = join('C:', 'Orca', 'resources', 'app.asar')
+
+    expect(resolveAiVaultServiceEntryPath(appPath, true)).toBe(
+      join(
+        'C:',
+        'Orca',
+        'resources',
+        'app.asar.unpacked',
+        'out',
+        'main',
+        'session-scanner-service-entry.js'
+      )
+    )
+  })
+
+  it('uses resourcesPath from packaged Electron-as-Node runtimes', () => {
+    const resourcesPath = join('Applications', 'Orca.app', 'Contents', 'Resources')
+    const entry = join(
+      resourcesPath,
+      'app.asar.unpacked',
+      'out',
+      'main',
+      'session-scanner-service-entry.js'
+    )
+
+    expect(
+      resolveAiVaultServiceEntryPathWithoutApp(
+        '/unrelated/cwd',
+        resourcesPath,
+        (path) => path === entry
+      )
+    ).toBe(entry)
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-service-entry-path.ts b/src/main/ai-vault/session-scanner-service-entry-path.ts
new file mode 100644
index 00000000000..5f334aa7c44
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-entry-path.ts
@@ -0,0 +1,52 @@
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+
+type ElectronAppPath = { getAppPath(): string; isPackaged: boolean }
+
+function loadElectronApp(): ElectronAppPath | null {
+  try {
+    return require('electron').app ?? null
+  } catch {
+    return null
+  }
+}
+
+export function resolveAiVaultServiceEntryPath(
+  appPath: string,
+  isPackaged: boolean,
+  pathExists: (candidate: string) => boolean = existsSync
+): string {
+  const basePath = isPackaged ? appPath.replace('app.asar', 'app.asar.unpacked') : appPath
+  const adjacentEntry = join(basePath, 'session-scanner-service-entry.js')
+  if (!isPackaged && pathExists(adjacentEntry)) {
+    return adjacentEntry
+  }
+  return join(basePath, 'out', 'main', 'session-scanner-service-entry.js')
+}
+
+export function resolveAiVaultServiceEntryPathWithoutApp(
+  cwd: string,
+  resourcesPath: string | undefined,
+  pathExists: (candidate: string) => boolean = existsSync
+): string {
+  if (resourcesPath) {
+    const packagedEntry = join(
+      resourcesPath,
+      'app.asar.unpacked',
+      'out',
+      'main',
+      'session-scanner-service-entry.js'
+    )
+    if (pathExists(packagedEntry)) {
+      return packagedEntry
+    }
+  }
+  return resolveAiVaultServiceEntryPath(cwd, false, pathExists)
+}
+
+export function getAiVaultServiceEntryPath(): string {
+  const app = loadElectronApp()
+  return app
+    ? resolveAiVaultServiceEntryPath(app.getAppPath(), app.isPackaged)
+    : resolveAiVaultServiceEntryPathWithoutApp(process.cwd(), process.resourcesPath)
+}
diff --git a/src/main/ai-vault/session-scanner-service-entry.test.ts b/src/main/ai-vault/session-scanner-service-entry.test.ts
new file mode 100644
index 00000000000..70dae0d764b
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-entry.test.ts
@@ -0,0 +1,94 @@
+import { beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AI_VAULT_SERVICE_PROTOCOL_VERSION } from './session-scanner-service-protocol'
+
+const invalidateSessionParseCacheEntry = vi.hoisted(() => vi.fn())
+const scanAiVaultSessions = vi.hoisted(() => vi.fn())
+
+// Only the invalidation hook is replaced; the title reader shares this module.
+vi.mock('./session-scanner-parse-cache', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  invalidateSessionParseCacheEntry
+}))
+vi.mock('./session-scanner', () => ({ scanAiVaultSessions }))
+vi.mock('./session-parse-cache-persistence', () => ({
+  flushSessionParseCachePersist: vi.fn(() => Promise.resolve()),
+  initSessionParseCachePersistence: vi.fn()
+}))
+vi.mock('./session-subagent-reader', () => ({
+  listLocalAiVaultSubagentSessions: vi.fn(() => Promise.resolve({ sessions: [], issues: [] }))
+}))
+
+const sent: { type: string; id?: number }[] = []
+
+function emit(message: unknown): void {
+  process.emit('message', message as never, undefined as never)
+}
+
+async function runScan(id: number): Promise<void> {
+  emit({ type: 'request', id, operation: 'scan', options: {} })
+  await vi.waitFor(() => expect(sent.some((message) => message.id === id)).toBe(true))
+}
+
+function invalidationsFor(path: string): number {
+  return invalidateSessionParseCacheEntry.mock.calls.filter((call) => call[0] === path).length
+}
+
+describe('AI Vault service entry cache invalidation', () => {
+  beforeAll(async () => {
+    process.send = ((message: { type: string; id?: number }) => {
+      sent.push(message)
+      return true
+    }) as typeof process.send
+    await import('./session-scanner-service-entry')
+    emit({ type: 'init', protocol: AI_VAULT_SERVICE_PROTOCOL_VERSION })
+  })
+
+  beforeEach(() => {
+    sent.length = 0
+    invalidateSessionParseCacheEntry.mockClear()
+    scanAiVaultSessions.mockResolvedValue({ sessions: [], issues: [], scannedAt: '2026-08-10' })
+  })
+
+  it('re-applies an invalidation once and then stops re-evicting the path', async () => {
+    emit({ type: 'invalidate', generation: 1, paths: ['/transcripts/a.jsonl'] })
+    expect(invalidationsFor('/transcripts/a.jsonl')).toBe(1)
+
+    // The request that overlapped the invalidation still gets the re-apply, so a
+    // read that started before it cannot leave pre-edit content cached.
+    await runScan(1)
+    expect(invalidationsFor('/transcripts/a.jsonl')).toBe(2)
+
+    // Every later request must not keep paying for a consumed invalidation.
+    await runScan(2)
+    expect(invalidationsFor('/transcripts/a.jsonl')).toBe(2)
+  })
+
+  it('keeps re-applying while another request is still executing', async () => {
+    let releaseSlowScan: (() => void) | undefined
+    scanAiVaultSessions.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          releaseSlowScan = () =>
+            resolve({ sessions: [], issues: [], scannedAt: '2026-08-10' } as never)
+        })
+    )
+    // 'subagents' runs on the interactive lane, so it overlaps the cache-lane
+    // scan; 'titles' would not, it shares the cache lane with scans.
+    emit({ type: 'request', id: 10, operation: 'scan', options: {} })
+    await vi.waitFor(() => expect(releaseSlowScan).toBeDefined())
+
+    emit({ type: 'invalidate', generation: 2, paths: ['/transcripts/b.jsonl'] })
+    emit({ type: 'request', id: 11, operation: 'subagents', request: {} })
+    await vi.waitFor(() => expect(sent.some((message) => message.id === 11)).toBe(true))
+
+    // The scan is still reading, so the path stays armed rather than draining.
+    expect(invalidationsFor('/transcripts/b.jsonl')).toBe(2)
+
+    releaseSlowScan?.()
+    await vi.waitFor(() => expect(sent.some((message) => message.id === 10)).toBe(true))
+    expect(invalidationsFor('/transcripts/b.jsonl')).toBe(3)
+
+    await runScan(12)
+    expect(invalidationsFor('/transcripts/b.jsonl')).toBe(3)
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-service-entry.ts b/src/main/ai-vault/session-scanner-service-entry.ts
new file mode 100644
index 00000000000..74a5ea9c355
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-entry.ts
@@ -0,0 +1,204 @@
+import type { AiVaultSessionTitle } from '../../shared/ai-vault-session-title'
+import { readAiVaultFirstUserPrompt } from './session-first-user-prompt-read'
+import {
+  flushSessionParseCachePersist,
+  initSessionParseCachePersistence
+} from './session-parse-cache-persistence'
+import { scanAiVaultSessions } from './session-scanner'
+import { invalidateSessionParseCacheEntry } from './session-scanner-parse-cache'
+import {
+  AI_VAULT_SERVICE_PROTOCOL_VERSION,
+  aiVaultServiceLane,
+  cacheServiceTitle,
+  isAiVaultServiceRequest,
+  type AiVaultServiceChildMessage,
+  type AiVaultServiceParentMessage,
+  type AiVaultServiceRequest,
+  type AiVaultServiceResultValue
+} from './session-scanner-service-protocol'
+import { readAiVaultSessionTitlesFromFiles } from './session-title-file-reader'
+import { resolveHostReadableAiVaultTitleRequests } from './session-title-request-paths'
+import { listLocalAiVaultSubagentSessions } from './session-subagent-reader'
+
+if (!process.send) {
+  throw new Error('AI Vault service requires a parent IPC channel.')
+}
+
+const controllers = new Map<number, AbortController>()
+const cancelled = new Set<number>()
+const pending = new Set<number>()
+const titleIndex = new Map<string, AiVaultSessionTitle>()
+const invalidatedPaths = new Set<string>()
+let initialized = false
+let shuttingDown = false
+let cacheLane = Promise.resolve()
+let interactiveLane = Promise.resolve()
+
+function send(message: AiVaultServiceChildMessage): void {
+  process.send?.(message)
+}
+
+function titleKey(request: { agent: string; sessionId: string }): string {
+  return `${request.agent}\0${request.sessionId}`
+}
+
+async function executeRequest(request: AiVaultServiceRequest): Promise<AiVaultServiceResultValue> {
+  const controller = new AbortController()
+  controllers.set(request.id, controller)
+  try {
+    if (cancelled.delete(request.id)) {
+      controller.abort()
+    }
+    if (request.operation === 'titles') {
+      const requests = await resolveHostReadableAiVaultTitleRequests(
+        request.requests,
+        controller.signal
+      )
+      return {
+        operation: 'titles',
+        value: await readAiVaultSessionTitlesFromFiles(requests, {
+          signal: controller.signal,
+          cache: {
+            get: (entry) => titleIndex.get(titleKey(entry)) ?? null,
+            set: (title) => cacheServiceTitle(titleIndex, title)
+          }
+        })
+      }
+    }
+    if (request.operation === 'subagents') {
+      return {
+        operation: 'subagents',
+        value: await listLocalAiVaultSubagentSessions(request.request)
+      }
+    }
+    if (request.operation === 'firstPrompt') {
+      return {
+        operation: 'firstPrompt',
+        value: await readAiVaultFirstUserPrompt(request.request)
+      }
+    }
+    const startedAt = performance.now()
+    const result = await scanAiVaultSessions({ ...request.options, signal: controller.signal })
+    for (const session of result.sessions) {
+      if ((session.agent === 'claude' || session.agent === 'codex') && session.title.trim()) {
+        cacheServiceTitle(titleIndex, {
+          agent: session.agent,
+          sessionId: session.sessionId,
+          title: session.title.trim()
+        })
+      }
+    }
+    return {
+      operation: 'scan',
+      value: { result, durationMs: performance.now() - startedAt }
+    }
+  } finally {
+    controllers.delete(request.id)
+    cancelled.delete(request.id)
+    for (const path of invalidatedPaths) {
+      invalidateSessionParseCacheEntry(path)
+    }
+    // Why: the re-apply only protects reads that overlapped the invalidation.
+    // Once nothing else is executing it has done its job, and holding the paths
+    // would re-evict them on every later request for the life of the process.
+    if (controllers.size === 0) {
+      invalidatedPaths.clear()
+    }
+  }
+}
+
+async function handleRequest(request: AiVaultServiceRequest): Promise<void> {
+  try {
+    const value = await executeRequest(request)
+    send({ type: 'result', id: request.id, ...value })
+  } catch (error) {
+    send({
+      type: 'error',
+      id: request.id,
+      message: error instanceof Error ? error.message : String(error),
+      retryable: true
+    })
+  } finally {
+    pending.delete(request.id)
+  }
+}
+
+function queueRequest(request: AiVaultServiceRequest): void {
+  if (pending.size >= 16) {
+    send({
+      type: 'error',
+      id: request.id,
+      message: 'AI Vault service queue is full.',
+      retryable: true
+    })
+    return
+  }
+  pending.add(request.id)
+  if (aiVaultServiceLane(request.operation) === 'interactive') {
+    interactiveLane = interactiveLane.then(() => handleRequest(request))
+    return
+  }
+  cacheLane = cacheLane.then(() => handleRequest(request))
+}
+
+async function shutdown(): Promise<void> {
+  if (shuttingDown) {
+    return
+  }
+  shuttingDown = true
+  for (const controller of controllers.values()) {
+    controller.abort()
+  }
+  await Promise.allSettled([cacheLane, interactiveLane])
+  await flushSessionParseCachePersist()
+  process.disconnect?.()
+}
+
+process.on('message', (raw: AiVaultServiceParentMessage) => {
+  if (raw?.type === 'init') {
+    if (initialized || raw.protocol !== AI_VAULT_SERVICE_PROTOCOL_VERSION) {
+      void shutdown()
+      return
+    }
+    initialized = true
+    if (raw.sessionParseCache) {
+      initSessionParseCachePersistence(raw.sessionParseCache)
+    }
+    send({ type: 'ready', protocol: AI_VAULT_SERVICE_PROTOCOL_VERSION, pid: process.pid })
+    return
+  }
+  if (!initialized || shuttingDown) {
+    return
+  }
+  if (raw?.type === 'cancel') {
+    cancelled.add(raw.id)
+    controllers.get(raw.id)?.abort()
+    return
+  }
+  if (raw?.type === 'invalidate') {
+    for (const path of raw.paths) {
+      invalidatedPaths.delete(path)
+      invalidatedPaths.add(path)
+      invalidateSessionParseCacheEntry(path)
+    }
+    while (invalidatedPaths.size > 4_096) {
+      const oldest = invalidatedPaths.values().next().value
+      if (oldest === undefined) {
+        break
+      }
+      invalidatedPaths.delete(oldest)
+    }
+    titleIndex.clear()
+    send({ type: 'invalidated', generation: raw.generation })
+    return
+  }
+  if (raw?.type === 'shutdown') {
+    void shutdown()
+    return
+  }
+  if (isAiVaultServiceRequest(raw)) {
+    queueRequest(raw)
+  }
+})
+
+process.on('disconnect', () => void shutdown())
diff --git a/src/main/ai-vault/session-scanner-service-env.test.ts b/src/main/ai-vault/session-scanner-service-env.test.ts
new file mode 100644
index 00000000000..5d06c0508e8
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-env.test.ts
@@ -0,0 +1,134 @@
+import { describe, expect, it } from 'vitest'
+import { buildAiVaultServiceEnv, buildRelayAiVaultServiceEnv } from './session-scanner-service-env'
+
+describe('buildAiVaultServiceEnv', () => {
+  it('drops Node flag injection variables so the forked heap cap and loader stand', () => {
+    const env = buildAiVaultServiceEnv(
+      {
+        NODE_OPTIONS: '--max-old-space-size=8192 --require=/tmp/evil.js',
+        NODE_REPL_EXTERNAL_MODULE: '/tmp/evil.js',
+        NODE_PATH: '/tmp/evil-modules',
+        PATH: '/usr/bin'
+      },
+      'linux'
+    )
+
+    expect(env.NODE_OPTIONS).toBeUndefined()
+    expect(env.NODE_REPL_EXTERNAL_MODULE).toBeUndefined()
+    expect(env.NODE_PATH).toBeUndefined()
+    expect(env.PATH).toBe('/usr/bin')
+  })
+
+  it('drops an unrecognised variable rather than carrying a shell-exported secret', () => {
+    const env = buildAiVaultServiceEnv(
+      { AWS_SECRET_ACCESS_KEY: 'shhh', HOME: '/home/dev' },
+      'linux'
+    )
+
+    expect(env.AWS_SECRET_ACCESS_KEY).toBeUndefined()
+    expect(env.HOME).toBe('/home/dev')
+  })
+
+  it('keeps the agent-home variables the scanner discovers sessions through', () => {
+    const env = buildAiVaultServiceEnv(
+      {
+        CODEX_HOME: '/home/dev/.codex',
+        COPILOT_HOME: '/home/dev/.copilot',
+        DEVIN_HOME: '/home/dev/.devin',
+        GROK_HOME: '/home/dev/.grok',
+        KIMI_CODE_HOME: '/home/dev/.kimi-code',
+        OMP_CODING_AGENT_DIR: '/home/dev/.omp/agent/sessions',
+        OPENCLAW_STATE_DIR: '/home/dev/.openclaw',
+        PI_CODING_AGENT_DIR: '/home/dev/.pi/agent/sessions',
+        PRIME_AGENT_CODING_AGENT_DIR: '/home/dev/.prime/agent',
+        PRIME_AGENT_CODING_AGENT_SESSION_DIR: '/home/dev/.prime/legacy-sessions',
+        PRIME_AGENT_SESSION_DIR: '/home/dev/.prime/sessions'
+      },
+      'linux'
+    )
+
+    expect(env).toEqual({
+      CODEX_HOME: '/home/dev/.codex',
+      COPILOT_HOME: '/home/dev/.copilot',
+      DEVIN_HOME: '/home/dev/.devin',
+      GROK_HOME: '/home/dev/.grok',
+      KIMI_CODE_HOME: '/home/dev/.kimi-code',
+      OMP_CODING_AGENT_DIR: '/home/dev/.omp/agent/sessions',
+      OPENCLAW_STATE_DIR: '/home/dev/.openclaw',
+      PI_CODING_AGENT_DIR: '/home/dev/.pi/agent/sessions',
+      PRIME_AGENT_CODING_AGENT_DIR: '/home/dev/.prime/agent',
+      PRIME_AGENT_CODING_AGENT_SESSION_DIR: '/home/dev/.prime/legacy-sessions',
+      PRIME_AGENT_SESSION_DIR: '/home/dev/.prime/sessions',
+      ELECTRON_RUN_AS_NODE: '1'
+    })
+  })
+
+  it('keeps the OpenCode data-directory and database overrides', () => {
+    const env = buildAiVaultServiceEnv(
+      { XDG_DATA_HOME: '/home/dev/data', OPENCODE_DB: 'opencode-alt.db' },
+      'linux'
+    )
+
+    expect(env.XDG_DATA_HOME).toBe('/home/dev/data')
+    expect(env.OPENCODE_DB).toBe('opencode-alt.db')
+  })
+
+  it('runs the forked Electron binary as plain Node', () => {
+    expect(buildAiVaultServiceEnv({}, 'linux').ELECTRON_RUN_AS_NODE).toBe('1')
+  })
+
+  it('ignores a POSIX variable that only matches an allowed name by case', () => {
+    expect(buildAiVaultServiceEnv({ codex_home: '/tmp/spoof' }, 'linux')).toEqual({
+      ELECTRON_RUN_AS_NODE: '1'
+    })
+  })
+
+  it('resolves a lowercased Windows variable the OS would still honour', () => {
+    const env = buildAiVaultServiceEnv({ codex_home: 'C:\\codex', Path: 'C:\\bin' }, 'win32')
+
+    expect(env.CODEX_HOME).toBe('C:\\codex')
+    expect(env.PATH).toBe('C:\\bin')
+  })
+
+  it('spells SystemRoot the way Windows Node expects', () => {
+    expect(buildAiVaultServiceEnv({ SystemRoot: 'C:\\Windows' }, 'win32').SystemRoot).toBe(
+      'C:\\Windows'
+    )
+  })
+
+  it('does not mutate the caller environment', () => {
+    const baseEnv = { NODE_OPTIONS: '--inspect', HOME: '/home/dev' }
+    buildAiVaultServiceEnv(baseEnv, 'linux')
+
+    expect(baseEnv.NODE_OPTIONS).toBe('--inspect')
+  })
+})
+
+describe('buildRelayAiVaultServiceEnv', () => {
+  it('drops Node flag injection variables', () => {
+    const env = buildRelayAiVaultServiceEnv(
+      { NODE_OPTIONS: '--max-old-space-size=8192', NODE_PATH: '/tmp/evil', HOME: '/home/ada' },
+      'linux'
+    )
+
+    expect(env.NODE_OPTIONS).toBeUndefined()
+    expect(env.NODE_PATH).toBeUndefined()
+    expect(env.HOME).toBe('/home/ada')
+  })
+
+  // The sidecar takes remoteHome and hostPlatform from its init message, so an
+  // agent-home override on the remote host is not part of how it finds roots.
+  it('withholds the agent-home variables the desktop child needs', () => {
+    const env = buildRelayAiVaultServiceEnv(
+      { CODEX_HOME: '/remote/.codex', PATH: '/usr/bin' },
+      'linux'
+    )
+
+    expect(env.CODEX_HOME).toBeUndefined()
+    expect(env.PATH).toBe('/usr/bin')
+  })
+
+  it('stays plain Node rather than an Electron child', () => {
+    expect(buildRelayAiVaultServiceEnv({}, 'linux').ELECTRON_RUN_AS_NODE).toBeUndefined()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-service-env.ts b/src/main/ai-vault/session-scanner-service-env.ts
new file mode 100644
index 00000000000..1bfb75344ca
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-env.ts
@@ -0,0 +1,98 @@
+/**
+ * Environments for the AI Vault service children.
+ *
+ * Deliberately allowlists, never `...process.env` (the plugin worker takes the
+ * same stance): the children are forked with a heap cap and no loader, and an
+ * ambient NODE_OPTIONS would raise the cap or `--require` code straight into
+ * them. Shell-exported secrets have no business in a transcript reader either.
+ */
+
+// What Node and libuv need to start and resolve a home, temp dir and locale.
+const RUNTIME_ENV_ALLOWLIST = [
+  'PATH',
+  'HOME',
+  'USERPROFILE',
+  'LANG',
+  'LC_ALL',
+  'LC_CTYPE',
+  'TZ',
+  'TMPDIR',
+  'TEMP',
+  'TMP',
+  // Why: Windows Node/libuv need these to resolve DLLs and the machine root.
+  'SYSTEMROOT',
+  'SYSTEMDRIVE',
+  'WINDIR',
+  'COMSPEC',
+  'PATHEXT',
+  'PROCESSOR_ARCHITECTURE',
+  'NUMBER_OF_PROCESSORS'
+] as const
+
+// Why: the desktop child resolves agent roots from its own environment, so
+// dropping one hides every session of a user who relocated that agent's home.
+const AGENT_ROOT_ENV_ALLOWLIST = [
+  'CODEX_HOME',
+  'COPILOT_HOME',
+  'DEVIN_HOME',
+  'GROK_HOME',
+  'KIMI_CODE_HOME',
+  'OMP_CODING_AGENT_DIR',
+  'OPENCLAW_STATE_DIR',
+  'OPENCODE_DB',
+  'PI_CODING_AGENT_DIR',
+  'PRIME_AGENT_CODING_AGENT_DIR',
+  'PRIME_AGENT_CODING_AGENT_SESSION_DIR',
+  'PRIME_AGENT_SESSION_DIR',
+  // Why: OpenCode has no home variable — its store hangs off the XDG data dir,
+  // so this one is an agent root here rather than generic runtime state.
+  'XDG_DATA_HOME'
+] as const
+
+function pickAllowedEnv(
+  keys: readonly string[],
+  baseEnv: NodeJS.ProcessEnv,
+  platform: NodeJS.Platform
+): NodeJS.ProcessEnv {
+  const windowsLookup = new Map<string, string>()
+  if (platform === 'win32') {
+    // Why: Windows resolves env names case-insensitively, so a lowercased
+    // `codex_home` still reaches the child; folding on POSIX instead would
+    // promote an attacker-set `path` over the real one.
+    for (const [key, value] of Object.entries(baseEnv)) {
+      if (typeof value === 'string') {
+        windowsLookup.set(key.toUpperCase(), value)
+      }
+    }
+  }
+  const env: NodeJS.ProcessEnv = {}
+  for (const key of keys) {
+    const value = platform === 'win32' ? windowsLookup.get(key) : baseEnv[key]
+    if (value !== undefined) {
+      env[key === 'SYSTEMROOT' ? 'SystemRoot' : key] = value
+    }
+  }
+  return env
+}
+
+/** Desktop: forked from the Electron binary, so it also needs run-as-node. */
+export function buildAiVaultServiceEnv(
+  baseEnv: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform
+): NodeJS.ProcessEnv {
+  const env = pickAllowedEnv(
+    [...RUNTIME_ENV_ALLOWLIST, ...AGENT_ROOT_ENV_ALLOWLIST],
+    baseEnv,
+    platform
+  )
+  env.ELECTRON_RUN_AS_NODE = '1'
+  return env
+}
+
+/** Relay: the sidecar takes every root from its init message, not the environment. */
+export function buildRelayAiVaultServiceEnv(
+  baseEnv: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform
+): NodeJS.ProcessEnv {
+  return pickAllowedEnv(RUNTIME_ENV_ALLOWLIST, baseEnv, platform)
+}
diff --git a/src/main/ai-vault/session-scanner-service-priority.ts b/src/main/ai-vault/session-scanner-service-priority.ts
new file mode 100644
index 00000000000..e0a22b340e5
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-priority.ts
@@ -0,0 +1,13 @@
+import { constants, setPriority } from 'node:os'
+
+export function lowerAiVaultServicePriority(pid: number | undefined): boolean {
+  if (pid === undefined || !Number.isSafeInteger(pid) || pid <= 0) {
+    return false
+  }
+  try {
+    setPriority(pid, constants.priority.PRIORITY_BELOW_NORMAL)
+    return true
+  } catch {
+    return false
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-service-protocol.ts b/src/main/ai-vault/session-scanner-service-protocol.ts
new file mode 100644
index 00000000000..f2842751eb1
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-protocol.ts
@@ -0,0 +1,118 @@
+import type { AiVaultListResult, AiVaultSubagentListResult } from '../../shared/ai-vault-types'
+import type {
+  AiVaultSessionTitle,
+  AiVaultSessionTitleRequest,
+  AiVaultSessionTitlesResult
+} from '../../shared/ai-vault-session-title'
+import type { ReadAiVaultFirstUserPromptArgs } from './session-first-user-prompt-read'
+import type { SessionParseCachePersistenceOptions } from './session-parse-cache-persistence'
+import type { AiVaultWorkerScanOptions } from './session-scanner-worker-protocol'
+
+export const AI_VAULT_SERVICE_PROTOCOL_VERSION = 1
+
+export type AiVaultServiceLane = 'cache' | 'interactive'
+export type AiVaultServiceOperation = 'scan' | 'titles' | 'subagents' | 'firstPrompt'
+
+export type AiVaultServiceSubagentRequest = {
+  agent: 'claude' | 'omp'
+  parentFilePath: string
+}
+
+export type AiVaultServiceInit = {
+  type: 'init'
+  protocol: typeof AI_VAULT_SERVICE_PROTOCOL_VERSION
+  sessionParseCache: SessionParseCachePersistenceOptions | null
+}
+
+export type AiVaultServiceRequestBody =
+  | { type: 'request'; operation: 'scan'; options: AiVaultWorkerScanOptions }
+  | {
+      type: 'request'
+      operation: 'titles'
+      requests: AiVaultSessionTitleRequest[]
+    }
+  | {
+      type: 'request'
+      operation: 'subagents'
+      request: AiVaultServiceSubagentRequest
+    }
+  | {
+      type: 'request'
+      operation: 'firstPrompt'
+      request: ReadAiVaultFirstUserPromptArgs
+    }
+
+export type AiVaultServiceRequest = AiVaultServiceRequestBody & { id: number }
+
+export type AiVaultServiceParentMessage =
+  | AiVaultServiceInit
+  | AiVaultServiceRequest
+  | { type: 'cancel'; id: number }
+  | { type: 'invalidate'; generation: number; paths: string[] }
+  | { type: 'shutdown' }
+
+export type AiVaultServiceResultValue =
+  | { operation: 'scan'; value: { result: AiVaultListResult; durationMs: number } }
+  | { operation: 'titles'; value: AiVaultSessionTitlesResult }
+  | { operation: 'subagents'; value: AiVaultSubagentListResult }
+  | { operation: 'firstPrompt'; value: { prompt: string | null } }
+
+export type AiVaultServiceChildMessage =
+  | {
+      type: 'ready'
+      protocol: typeof AI_VAULT_SERVICE_PROTOCOL_VERSION
+      pid: number
+    }
+  | ({ type: 'result'; id: number } & AiVaultServiceResultValue)
+  | { type: 'error'; id: number; message: string; retryable: boolean }
+  | { type: 'invalidated'; generation: number }
+
+export function aiVaultServiceLane(operation: AiVaultServiceOperation): AiVaultServiceLane {
+  return operation === 'subagents' || operation === 'firstPrompt' ? 'interactive' : 'cache'
+}
+
+export function isAiVaultServiceRequest(value: unknown): value is AiVaultServiceRequest {
+  if (!value || typeof value !== 'object') {
+    return false
+  }
+  const message = value as Record<string, unknown>
+  return (
+    message.type === 'request' &&
+    Number.isSafeInteger(message.id) &&
+    (message.operation === 'scan' ||
+      message.operation === 'titles' ||
+      message.operation === 'subagents' ||
+      message.operation === 'firstPrompt')
+  )
+}
+
+export function isAiVaultServiceChildMessage(value: unknown): value is AiVaultServiceChildMessage {
+  if (!value || typeof value !== 'object') {
+    return false
+  }
+  const message = value as Record<string, unknown>
+  if (message.type === 'ready') {
+    return message.protocol === AI_VAULT_SERVICE_PROTOCOL_VERSION && Number.isInteger(message.pid)
+  }
+  if (message.type === 'invalidated') {
+    return Number.isSafeInteger(message.generation)
+  }
+  return (message.type === 'result' || message.type === 'error') && Number.isSafeInteger(message.id)
+}
+
+export function cacheServiceTitle(
+  titleIndex: Map<string, AiVaultSessionTitle>,
+  title: AiVaultSessionTitle,
+  maxEntries = 4_096
+): void {
+  const key = `${title.agent}\0${title.sessionId}`
+  titleIndex.delete(key)
+  titleIndex.set(key, title)
+  while (titleIndex.size > maxEntries) {
+    const oldest = titleIndex.keys().next().value
+    if (oldest === undefined) {
+      break
+    }
+    titleIndex.delete(oldest)
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-service-restart-policy.test.ts b/src/main/ai-vault/session-scanner-service-restart-policy.test.ts
new file mode 100644
index 00000000000..98dfadf91e3
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-restart-policy.test.ts
@@ -0,0 +1,48 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { AiVaultServiceRestartPolicy } from './session-scanner-service-restart-policy'
+
+afterEach(() => vi.useRealTimers())
+
+describe('AiVaultServiceRestartPolicy', () => {
+  it('keeps one pending restart when faults overlap', () => {
+    vi.useFakeTimers()
+    const policy = new AiVaultServiceRestartPolicy()
+    const restart = vi.fn()
+
+    policy.recordFault(restart)
+    policy.recordFault(restart)
+    vi.advanceTimersByTime(10_000)
+
+    expect(restart).toHaveBeenCalledTimes(1)
+  })
+
+  it('cancels the pending restart on dispose after overlapping faults', () => {
+    vi.useFakeTimers()
+    const policy = new AiVaultServiceRestartPolicy()
+    const restart = vi.fn()
+
+    policy.recordFault(restart)
+    policy.recordFault(restart)
+    policy.dispose()
+    vi.advanceTimersByTime(10_000)
+
+    expect(restart).not.toHaveBeenCalled()
+    expect(policy.restartScheduled).toBe(false)
+  })
+
+  it('opens the circuit after three faults inside the window', () => {
+    let now = 0
+    const policy = new AiVaultServiceRestartPolicy(() => now)
+
+    expect(policy.startError()).toBeNull()
+    for (let index = 0; index < 3; index += 1) {
+      policy.recordFault(() => undefined)
+      now += 1_000
+    }
+
+    expect(policy.startError()?.message).toContain('circuit is open')
+    now += 60_000
+    expect(policy.startError()).toBeNull()
+    policy.dispose()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-service-restart-policy.ts b/src/main/ai-vault/session-scanner-service-restart-policy.ts
new file mode 100644
index 00000000000..605e6c9731b
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-restart-policy.ts
@@ -0,0 +1,49 @@
+const AI_VAULT_SERVICE_FAULT_WINDOW_MS = 60_000
+const AI_VAULT_SERVICE_RESTART_DELAYS_MS = [250, 1_000, 5_000] as const
+
+export class AiVaultServiceRestartPolicy {
+  private faults: number[] = []
+  private circuitUntil = 0
+  private timer: NodeJS.Timeout | null = null
+
+  constructor(private readonly now: () => number = Date.now) {}
+
+  get restartScheduled(): boolean {
+    return this.timer !== null
+  }
+
+  startError(): Error | null {
+    return this.now() < this.circuitUntil
+      ? new Error('AI Vault service restart circuit is open.')
+      : null
+  }
+
+  recordFault(restart: () => void): void {
+    const now = this.now()
+    this.faults = [
+      ...this.faults.filter((time) => now - time < AI_VAULT_SERVICE_FAULT_WINDOW_MS),
+      now
+    ]
+    if (this.faults.length >= 3) {
+      this.circuitUntil = now + AI_VAULT_SERVICE_FAULT_WINDOW_MS
+    }
+    const delay = AI_VAULT_SERVICE_RESTART_DELAYS_MS[Math.min(this.faults.length - 1, 2)]
+    // Why: a second fault before the pending restart fires would otherwise strand
+    // the old timer, leaving a restart that dispose() can no longer cancel.
+    if (this.timer) {
+      clearTimeout(this.timer)
+    }
+    this.timer = setTimeout(() => {
+      this.timer = null
+      restart()
+    }, delay)
+    this.timer.unref?.()
+  }
+
+  dispose(): void {
+    if (this.timer) {
+      clearTimeout(this.timer)
+      this.timer = null
+    }
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-service-spawn.test.ts b/src/main/ai-vault/session-scanner-service-spawn.test.ts
new file mode 100644
index 00000000000..5c64a13ecb4
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-spawn.test.ts
@@ -0,0 +1,47 @@
+import type { ChildProcess } from 'node:child_process'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const forkMock = vi.hoisted(() => vi.fn())
+
+vi.mock('node:child_process', () => ({ fork: forkMock }))
+vi.mock('node:fs', () => ({ existsSync: () => true }))
+
+const { spawnAiVaultServiceProcess } = await import('./session-scanner-service-spawn')
+
+function forkOptions(): { env?: NodeJS.ProcessEnv; execArgv?: string[] } {
+  return forkMock.mock.calls.at(-1)?.[2] ?? {}
+}
+
+describe('spawnAiVaultServiceProcess', () => {
+  beforeEach(() => {
+    forkMock.mockReset()
+    forkMock.mockReturnValue({ pid: undefined, unref: vi.fn() } as unknown as ChildProcess)
+  })
+
+  it('keeps NODE_OPTIONS out of the child so the heap cap and loader stand', () => {
+    vi.stubEnv('NODE_OPTIONS', '--max-old-space-size=8192 --require=/tmp/evil.js')
+    spawnAiVaultServiceProcess()
+    const options = forkOptions()
+
+    // Asserted first: omitting `env` entirely inherits everything, and would
+    // leave the NODE_OPTIONS assertion below passing for the wrong reason.
+    expect(options.env).toBeDefined()
+    expect(options.env?.NODE_OPTIONS).toBeUndefined()
+    expect(options.execArgv).toEqual(['--max-old-space-size=384'])
+    vi.unstubAllEnvs()
+  })
+
+  it('still passes through a relocated agent home', () => {
+    vi.stubEnv('CODEX_HOME', '/home/dev/elsewhere/.codex')
+    spawnAiVaultServiceProcess()
+
+    expect(forkOptions().env?.CODEX_HOME).toBe('/home/dev/elsewhere/.codex')
+    vi.unstubAllEnvs()
+  })
+
+  it('runs the forked Electron binary as plain Node', () => {
+    spawnAiVaultServiceProcess()
+
+    expect(forkOptions().env?.ELECTRON_RUN_AS_NODE).toBe('1')
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-service-spawn.ts b/src/main/ai-vault/session-scanner-service-spawn.ts
new file mode 100644
index 00000000000..9fd20cfe57e
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-spawn.ts
@@ -0,0 +1,91 @@
+import { fork, type ChildProcess } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import type { AiVaultListResult, AiVaultSubagentListResult } from '../../shared/ai-vault-types'
+import type {
+  AiVaultSessionTitleRequest,
+  AiVaultSessionTitlesResult
+} from '../../shared/ai-vault-session-title'
+import { withSpan } from '../observability/tracer'
+import type {
+  ReadAiVaultFirstUserPromptArgs,
+  ReadAiVaultFirstUserPromptResult
+} from './session-first-user-prompt-read'
+import { getSessionParseCachePersistenceOptions } from './session-parse-cache-persistence'
+import { buildAiVaultServiceEnv } from './session-scanner-service-env'
+import { AiVaultScannerServiceClient } from './session-scanner-service-client'
+import { getAiVaultServiceEntryPath } from './session-scanner-service-entry-path'
+import { lowerAiVaultServicePriority } from './session-scanner-service-priority'
+import type { AiVaultServiceSubagentRequest } from './session-scanner-service-protocol'
+import type { AiVaultWorkerScanOptions } from './session-scanner-worker-protocol'
+
+export function spawnAiVaultServiceProcess(): ChildProcess {
+  const entryPath = getAiVaultServiceEntryPath()
+  if (!existsSync(entryPath)) {
+    throw new Error(`AI Vault service entry not found: ${entryPath}`)
+  }
+  const child = fork(entryPath, [], {
+    stdio: ['ignore', 'ignore', 'pipe', 'ipc'],
+    execArgv: ['--max-old-space-size=384'],
+    env: buildAiVaultServiceEnv(),
+    ...(process.platform === 'win32' ? { windowsHide: true } : {})
+  })
+  lowerAiVaultServicePriority(child.pid)
+  child.unref()
+  return child
+}
+
+let sharedClient: AiVaultScannerServiceClient | null = null
+
+function getSharedClient(): AiVaultScannerServiceClient {
+  sharedClient ??= new AiVaultScannerServiceClient({
+    processFactory: spawnAiVaultServiceProcess,
+    init: { sessionParseCache: getSessionParseCachePersistenceOptions() },
+    onStderr: (text) => console.error('[ai-vault-service]', text.trimEnd())
+  })
+  return sharedClient
+}
+
+export function scanAiVaultSessionsInService(
+  options: AiVaultWorkerScanOptions,
+  signal?: AbortSignal
+): Promise<AiVaultListResult> {
+  return withSpan('aiVault.scan.service', async (span) => {
+    const value = await getSharedClient().request<{
+      result: AiVaultListResult
+      durationMs: number
+    }>({ type: 'request', operation: 'scan', options }, signal)
+    span.setAttribute('serviceDurationMs', value.durationMs)
+    span.setAttribute('sessions', value.result.sessions.length)
+    return value.result
+  })
+}
+
+export function resolveAiVaultSessionTitlesInService(
+  requests: AiVaultSessionTitleRequest[],
+  signal?: AbortSignal
+): Promise<AiVaultSessionTitlesResult> {
+  return getSharedClient().request({ type: 'request', operation: 'titles', requests }, signal)
+}
+
+export function listAiVaultSubagentSessionsInService(
+  request: AiVaultServiceSubagentRequest,
+  signal?: AbortSignal
+): Promise<AiVaultSubagentListResult> {
+  return getSharedClient().request({ type: 'request', operation: 'subagents', request }, signal)
+}
+
+export function readAiVaultFirstUserPromptInService(
+  request: ReadAiVaultFirstUserPromptArgs,
+  signal?: AbortSignal
+): Promise<ReadAiVaultFirstUserPromptResult> {
+  return getSharedClient().request({ type: 'request', operation: 'firstPrompt', request }, signal)
+}
+
+export function invalidateAiVaultServiceCache(paths: string[]): Promise<void> {
+  return sharedClient?.invalidate(paths) ?? Promise.resolve()
+}
+
+export function resetAiVaultScannerServiceForTests(): void {
+  sharedClient?.dispose()
+  sharedClient = null
+}
diff --git a/src/main/ai-vault/session-scanner-service-test-child.ts b/src/main/ai-vault/session-scanner-service-test-child.ts
new file mode 100644
index 00000000000..3fa1a84ec02
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-service-test-child.ts
@@ -0,0 +1,52 @@
+import { EventEmitter } from 'node:events'
+import type { ChildProcess } from 'node:child_process'
+
+export class AiVaultServiceTestChild extends EventEmitter {
+  readonly sent: unknown[] = []
+  readonly stderr = new EventEmitter()
+  readonly pid: number
+  killed = false
+  unrefed = false
+
+  constructor(pid = 12_345) {
+    super()
+    this.pid = pid
+  }
+
+  send(message: unknown, callback?: (error: Error | null) => void): boolean {
+    this.sent.push(message)
+    callback?.(null)
+    return true
+  }
+
+  kill(): boolean {
+    this.killed = true
+    return true
+  }
+
+  unref(): this {
+    this.unrefed = true
+    return this
+  }
+
+  asChildProcess(): ChildProcess {
+    return this as unknown as ChildProcess
+  }
+}
+
+export function readyAiVaultServiceChild(child: AiVaultServiceTestChild): void {
+  child.emit('message', { type: 'ready', protocol: 1, pid: child.pid })
+}
+
+export function aiVaultServiceRequestId(child: AiVaultServiceTestChild, operation: string): number {
+  const request = child.sent.find(
+    (message) =>
+      typeof message === 'object' &&
+      message !== null &&
+      (message as { operation?: string }).operation === operation
+  ) as { id?: number } | undefined
+  if (request?.id === undefined) {
+    throw new Error(`No ${operation} request was sent.`)
+  }
+  return request.id
+}
diff --git a/src/main/ai-vault/session-scanner-worker-client.ts b/src/main/ai-vault/session-scanner-worker-client.ts
index 6b780c5086d..70e75c4f982 100644
--- a/src/main/ai-vault/session-scanner-worker-client.ts
+++ b/src/main/ai-vault/session-scanner-worker-client.ts
@@ -176,7 +176,7 @@ export class AiVaultScannerWorkerClient {
       return
     }
     const index = this.queue.indexOf(call)
-    if (index >= 0) {
+    if (index !== -1) {
       this.queue.splice(index, 1)
       this.clearCall(call)
     }
diff --git a/src/main/ai-vault/session-subagent-reader.ts b/src/main/ai-vault/session-subagent-reader.ts
new file mode 100644
index 00000000000..5921419c54a
--- /dev/null
+++ b/src/main/ai-vault/session-subagent-reader.ts
@@ -0,0 +1,12 @@
+import type { AiVaultSubagentListResult } from '../../shared/ai-vault-types'
+import { listClaudeSubagentSessions } from './session-scanner-claude-subagents'
+import { listOmpSubagentSessions } from './session-scanner-omp-subagent-listing'
+import type { AiVaultServiceSubagentRequest } from './session-scanner-service-protocol'
+
+export function listLocalAiVaultSubagentSessions(
+  request: AiVaultServiceSubagentRequest
+): Promise<AiVaultSubagentListResult> {
+  return request.agent === 'claude'
+    ? listClaudeSubagentSessions({ parentFilePath: request.parentFilePath })
+    : listOmpSubagentSessions({ parentFilePath: request.parentFilePath })
+}
diff --git a/src/main/ai-vault/session-title-request-paths.ts b/src/main/ai-vault/session-title-request-paths.ts
index 86e78ebc397..5e25e512d92 100644
--- a/src/main/ai-vault/session-title-request-paths.ts
+++ b/src/main/ai-vault/session-title-request-paths.ts
@@ -1,5 +1,6 @@
 import type { AiVaultSessionTitleRequest } from '../../shared/ai-vault-session-title'
 import { toHostReadableTranscriptPath } from '../native-chat/host-readable-transcript-path'
+import { wslTranscriptFsRefusal } from '../native-chat/wsl-transcript-fs-gate'
 
 export function resolveHostReadableAiVaultTitleRequests(
   requests: AiVaultSessionTitleRequest[],
@@ -10,7 +11,15 @@ export function resolveHostReadableAiVaultTitleRequests(
       if (!request.transcriptPath || signal?.aborted) {
         return request
       }
-      const transcriptPath = await toHostReadableTranscriptPath(request.transcriptPath)
+      let transcriptPath: string | null
+      try {
+        transcriptPath = await toHostReadableTranscriptPath(request.transcriptPath)
+      } catch (error) {
+        // Why: one stalled distro's path must not fail the whole titles batch;
+        // degrade to the id-only shape like any unreadable path.
+        void wslTranscriptFsRefusal(error) // rethrows anything that is not a gate refusal
+        transcriptPath = null
+      }
       return transcriptPath && !signal?.aborted
         ? { ...request, transcriptPath }
         : { agent: request.agent, sessionId: request.sessionId }
diff --git a/src/main/ai-vault/session-title-resolver.ts b/src/main/ai-vault/session-title-resolver.ts
index db1881f5ee3..80518000e09 100644
--- a/src/main/ai-vault/session-title-resolver.ts
+++ b/src/main/ai-vault/session-title-resolver.ts
@@ -5,7 +5,7 @@ import {
   type AiVaultSessionTitleRequest,
   type AiVaultSessionTitlesResult
 } from '../../shared/ai-vault-session-title'
-import { resolveAiVaultSessionTitlesInWorker } from './session-scanner-worker-spawn'
+import { resolveAiVaultSessionTitlesInBackground } from './session-scanner-background'
 
 const TRANSCRIPT_PATH_MAX_LENGTH = 32_768
 
@@ -42,5 +42,5 @@ export async function resolveLocalAiVaultSessionTitles(
       deduped.set(key, normalized)
     }
   }
-  return resolveAiVaultSessionTitlesInWorker([...deduped.values()], signal)
+  return resolveAiVaultSessionTitlesInBackground([...deduped.values()], signal)
 }
diff --git a/src/main/antigravity/hook-service.ts b/src/main/antigravity/hook-service.ts
index e83160a3549..535eb3a3682 100644
--- a/src/main/antigravity/hook-service.ts
+++ b/src/main/antigravity/hook-service.ts
@@ -25,6 +25,7 @@ import {
   writeHooksJsonRemote,
   writeManagedScriptRemote
 } from '../agent-hooks/installer-utils-remote'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
 import {
   buildPosixHookPayloadCapture,
   buildWindowsHookEnvironmentGuardLines,
@@ -296,6 +297,18 @@ function removeInstalledConfig(config: HooksConfig): void {
 }
 
 export class AntigravityHookService {
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(getManagedScriptPath(), getManagedScript())
+    if (process.platform === 'win32') {
+      for (const event of ANTIGRAVITY_EVENTS) {
+        await refreshManagedScriptIfPresent(
+          getWindowsWrapperScriptPath(event),
+          getWindowsWrapperScript(event.eventName)
+        )
+      }
+    }
+  }
+
   getStatus(): AgentHookInstallStatus {
     const configPath = getConfigPath()
     const scriptPath = getManagedScriptPath()
diff --git a/src/main/artifacts/artifact-cloud-recovery.test.ts b/src/main/artifacts/artifact-cloud-recovery.test.ts
new file mode 100644
index 00000000000..f57b53c2b02
--- /dev/null
+++ b/src/main/artifacts/artifact-cloud-recovery.test.ts
@@ -0,0 +1,346 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('electron', () => ({
+  app: { isPackaged: false },
+  safeStorage: { isEncryptionAvailable: () => false }
+}))
+
+import { ArtifactCloudService } from './artifact-cloud-service'
+
+const createdPaths: string[] = []
+const apiUrl = 'http://localhost:3000'
+const writeRequest = {
+  sourceKey: '/repo/report.html',
+  content: '<h1>Recovery</h1>',
+  contentType: 'text/html' as const,
+  fileName: 'report.html',
+  apiUrl,
+  authToken: 'token-a'
+}
+
+afterEach(async () => {
+  vi.unstubAllGlobals()
+  await Promise.all(
+    createdPaths.splice(0).map((path) => rm(path, { recursive: true, force: true }))
+  )
+})
+
+describe('ArtifactCloudService committed response loss recovery', () => {
+  it('reconciles one remotely revocable artifact after a committed create loses its response', async () => {
+    const userDataPath = await createUserDataPath()
+    const server = new ArtifactFaultServer()
+    server.loseNextCreateResponse = true
+    vi.stubGlobal('fetch', server.fetch)
+
+    await expect(service(userDataPath).publish(writeRequest)).rejects.toThrow('response lost')
+    expect(server.createMutations).toBe(1)
+    expect(server.artifactSlugs()).toEqual(['artifact-1'])
+    await expect(publishedLink(userDataPath)).resolves.toBeNull()
+
+    await expect(
+      service(userDataPath).publish({ ...writeRequest, content: '<h1>Changed after loss</h1>' })
+    ).resolves.toMatchObject({
+      status: 'ok',
+      value: { item: { artifact: { slug: 'artifact-1' } } }
+    })
+    expect(server.createMutations).toBe(1)
+    expect(server.artifactSlugs()).toEqual(['artifact-1'])
+    expect(server.artifactContent('artifact-1')).toBe('<h1>Changed after loss</h1>')
+    await expect(publishedLink(userDataPath)).resolves.toBe('https://share.onorca.dev/a/artifact-1')
+  })
+
+  it('replays the exact create when content is unchanged after response loss', async () => {
+    const userDataPath = await createUserDataPath()
+    const server = new ArtifactFaultServer()
+    server.loseNextCreateResponse = true
+    vi.stubGlobal('fetch', server.fetch)
+
+    await expect(service(userDataPath).publish(writeRequest)).rejects.toThrow('response lost')
+    await expect(service(userDataPath).publish(writeRequest)).resolves.toMatchObject({
+      status: 'ok',
+      value: { item: { artifact: { slug: 'artifact-1' } } }
+    })
+    expect(server.createMutations).toBe(1)
+    expect(server.artifactContent('artifact-1')).toBe(writeRequest.content)
+  })
+
+  it('updates a recovered share when its content changed after response loss', async () => {
+    const userDataPath = await createUserDataPath()
+    const server = new ArtifactFaultServer()
+    server.loseNextCreateResponse = true
+    vi.stubGlobal('fetch', server.fetch)
+
+    await expect(service(userDataPath).share(writeRequest)).rejects.toThrow('response lost')
+    await expect(
+      service(userDataPath).share({ ...writeRequest, content: '<h1>Changed share</h1>' })
+    ).resolves.toMatchObject({
+      status: 'ok',
+      value: { artifact: { slug: 'artifact-1' } }
+    })
+    expect(server.createMutations).toBe(1)
+    expect(server.artifactContent('artifact-1')).toBe('<h1>Changed share</h1>')
+  })
+
+  it('retains recovery until a changed-content update succeeds', async () => {
+    const userDataPath = await createUserDataPath()
+    const server = new ArtifactFaultServer()
+    server.loseNextCreateResponse = true
+    vi.stubGlobal('fetch', server.fetch)
+
+    await expect(service(userDataPath).share(writeRequest)).rejects.toThrow('response lost')
+    server.rejectNextUpdateStatus = 503
+    const changed = { ...writeRequest, content: '<h1>Changed after update failure</h1>' }
+    await expect(service(userDataPath).share(changed)).rejects.toMatchObject({ statusCode: 503 })
+    await expect(service(userDataPath).share(changed)).resolves.toMatchObject({
+      status: 'ok',
+      value: { artifact: { slug: 'artifact-1' } }
+    })
+    expect(server.createMutations).toBe(1)
+    expect(server.artifactSlugs()).toEqual(['artifact-1'])
+    expect(server.artifactContent('artifact-1')).toBe(changed.content)
+  })
+
+  it('clears the durable mapping when a committed delete retry returns 404', async () => {
+    const userDataPath = await createUserDataPath()
+    const server = new ArtifactFaultServer()
+    vi.stubGlobal('fetch', server.fetch)
+    await service(userDataPath).publish(writeRequest)
+
+    server.loseNextDeleteResponse = true
+    await expect(
+      service(userDataPath).unshare({
+        sourceKey: writeRequest.sourceKey,
+        apiUrl,
+        authToken: 'token-a'
+      })
+    ).rejects.toThrow('response lost')
+    expect(server.deleteMutations).toBe(1)
+    expect(server.artifactSlugs()).toEqual([])
+    await expect(publishedLink(userDataPath)).resolves.toBe('https://share.onorca.dev/a/artifact-1')
+
+    await expect(
+      service(userDataPath).unshare({
+        sourceKey: writeRequest.sourceKey,
+        apiUrl,
+        authToken: 'token-a'
+      })
+    ).resolves.toEqual({ status: 'ok', value: undefined })
+    expect(server.deleteMutations).toBe(1)
+    expect(server.artifactSlugs()).toEqual([])
+    await expect(publishedLink(userDataPath)).resolves.toBeNull()
+  })
+
+  it('keeps the durable mapping when a delete receives an unrelated 404', async () => {
+    const userDataPath = await createUserDataPath()
+    const server = new ArtifactFaultServer()
+    vi.stubGlobal('fetch', server.fetch)
+    await service(userDataPath).publish(writeRequest)
+
+    server.rejectNextDeleteCode = 'not_found'
+    await expect(
+      service(userDataPath).unshare({
+        sourceKey: writeRequest.sourceKey,
+        apiUrl,
+        authToken: 'token-a'
+      })
+    ).rejects.toMatchObject({ statusCode: 404, errorCode: 'not_found' })
+    expect(server.deleteMutations).toBe(0)
+    expect(server.artifactSlugs()).toEqual(['artifact-1'])
+    await expect(publishedLink(userDataPath)).resolves.toBe('https://share.onorca.dev/a/artifact-1')
+  })
+
+  it('drops an uncommitted validation failure so corrected content can create', async () => {
+    const userDataPath = await createUserDataPath()
+    const server = new ArtifactFaultServer()
+    server.rejectNextCreateStatus = 422
+    vi.stubGlobal('fetch', server.fetch)
+
+    await expect(service(userDataPath).publish(writeRequest)).rejects.toMatchObject({
+      statusCode: 422
+    })
+    await expect(
+      service(userDataPath).publish({ ...writeRequest, content: '<h1>Corrected</h1>' })
+    ).resolves.toMatchObject({
+      status: 'ok',
+      value: { item: { artifact: { slug: 'artifact-1' } } }
+    })
+    expect(server.createMutations).toBe(1)
+    expect(server.artifactContent('artifact-1')).toBe('<h1>Corrected</h1>')
+  })
+
+  it('keeps a replay intent when validation changes after the original commit', async () => {
+    const userDataPath = await createUserDataPath()
+    const server = new ArtifactFaultServer()
+    server.loseNextCreateResponse = true
+    vi.stubGlobal('fetch', server.fetch)
+
+    await expect(service(userDataPath).publish(writeRequest)).rejects.toThrow('response lost')
+    server.rejectNextCreateStatus = 422
+    const changed = { ...writeRequest, content: '<h1>Changed after validation</h1>' }
+    await expect(service(userDataPath).publish(changed)).rejects.toMatchObject({ statusCode: 422 })
+    await expect(service(userDataPath).publish(changed)).resolves.toMatchObject({
+      status: 'ok',
+      value: { item: { artifact: { slug: 'artifact-1' } } }
+    })
+    expect(server.createMutations).toBe(1)
+    expect(server.artifactContent('artifact-1')).toBe(changed.content)
+  })
+})
+
+class ArtifactFaultServer {
+  readonly fetch = vi.fn(this.handle.bind(this))
+  createMutations = 0
+  deleteMutations = 0
+  loseNextCreateResponse = false
+  loseNextDeleteResponse = false
+  rejectNextCreateStatus: number | null = null
+  rejectNextDeleteCode: string | null = null
+  rejectNextUpdateStatus: number | null = null
+  private readonly artifacts = new Map<string, string>()
+  private readonly createsByKey = new Map<string, { body: string; response: object }>()
+
+  artifactSlugs(): string[] {
+    return [...this.artifacts.keys()].sort()
+  }
+
+  artifactContent(slug: string): string | undefined {
+    const body = this.artifacts.get(slug)
+    return body ? (JSON.parse(body) as { content?: string }).content : undefined
+  }
+
+  private async handle(input: string | URL | Request, init?: RequestInit): Promise<Response> {
+    const method = init?.method ?? 'GET'
+    if (method === 'POST') {
+      return this.create(init)
+    }
+    if (method === 'PUT') {
+      return this.update(String(input), init)
+    }
+    if (method === 'DELETE') {
+      return this.delete(String(input))
+    }
+    throw new Error(`Unexpected artifact request: ${method} ${String(input)}`)
+  }
+
+  private create(init?: RequestInit): Response {
+    if (this.rejectNextCreateStatus !== null) {
+      const status = this.rejectNextCreateStatus
+      this.rejectNextCreateStatus = null
+      return jsonResponse({ code: 'artifact_validation_failed' }, status)
+    }
+    const key = new Headers(init?.headers).get('idempotency-key')
+    if (new Headers(init?.headers).get('authorization') !== 'Bearer token-a') {
+      throw new Error('Missing artifact authorization')
+    }
+    if (!key) {
+      throw new Error('Missing idempotency key')
+    }
+    const body = String(init?.body)
+    const existing = this.createsByKey.get(key)
+    if (existing) {
+      if (existing.body !== body) {
+        throw new Error('Idempotency key reused with another request')
+      }
+      return jsonResponse(existing.response, 201)
+    }
+
+    this.createMutations += 1
+    const slug = `artifact-${this.createMutations}`
+    const response = createResponseBody(slug)
+    this.createsByKey.set(key, { body, response })
+    this.artifacts.set(slug, body)
+    if (this.loseNextCreateResponse) {
+      this.loseNextCreateResponse = false
+      throw new TypeError('response lost after committed create')
+    }
+    return jsonResponse(response, 201)
+  }
+
+  private delete(url: string): Response {
+    if (this.rejectNextDeleteCode !== null) {
+      const code = this.rejectNextDeleteCode
+      this.rejectNextDeleteCode = null
+      return jsonResponse({ code }, 404)
+    }
+    const slug = decodeURIComponent(url.slice(url.lastIndexOf('/') + 1))
+    if (!this.artifacts.delete(slug)) {
+      return jsonResponse({ code: 'artifact_not_found' }, 404)
+    }
+    this.deleteMutations += 1
+    if (this.loseNextDeleteResponse) {
+      this.loseNextDeleteResponse = false
+      throw new TypeError('response lost after committed delete')
+    }
+    return new Response(null, { status: 204 })
+  }
+
+  private update(url: string, init?: RequestInit): Response {
+    if (this.rejectNextUpdateStatus !== null) {
+      const status = this.rejectNextUpdateStatus
+      this.rejectNextUpdateStatus = null
+      return jsonResponse({ code: 'artifact_update_failed' }, status)
+    }
+    const slug = decodeURIComponent(url.slice(url.lastIndexOf('/') + 1))
+    if (!this.artifacts.has(slug)) {
+      return jsonResponse({ code: 'artifact_not_found' }, 404)
+    }
+    const headers = new Headers(init?.headers)
+    if (
+      headers.get('authorization') !== 'Bearer token-a' ||
+      headers.get('x-orca-edit-token') !== `edit-${slug}`
+    ) {
+      return jsonResponse({ code: 'artifact_forbidden' }, 403)
+    }
+    this.artifacts.set(slug, String(init?.body))
+    return jsonResponse(createResponseBody(slug), 200)
+  }
+}
+
+async function createUserDataPath(): Promise<string> {
+  const path = await mkdtemp(join(tmpdir(), 'orca-artifact-recovery-'))
+  createdPaths.push(path)
+  return path
+}
+
+function service(userDataPath: string): ArtifactCloudService {
+  return new ArtifactCloudService(userDataPath, () => true)
+}
+
+async function publishedLink(userDataPath: string): Promise<string | null> {
+  const result = await service(userDataPath).getPublishedLink({
+    sourceKey: writeRequest.sourceKey,
+    apiUrl,
+    authToken: 'token-a'
+  })
+  return result.status === 'ok' ? (result.value?.shareUrl ?? null) : null
+}
+
+function jsonResponse(body: object, status: number): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'content-type': 'application/json' }
+  })
+}
+
+function createResponseBody(slug: string): object {
+  return {
+    artifact: {
+      version: 1,
+      slug,
+      title: null,
+      originalFileName: 'report.html',
+      sourceContentType: 'text/html',
+      renderedContentType: 'text/html',
+      createdAt: '2026-08-06T00:00:00.000Z',
+      updatedAt: '2026-08-06T00:00:00.000Z',
+      expiresAt: '2026-09-06T00:00:00.000Z',
+      byteSize: 17,
+      deletedAt: null
+    },
+    shareUrl: `https://share.onorca.dev/a/${slug}`,
+    editToken: `edit-${slug}`
+  }
+}
diff --git a/src/main/artifacts/artifact-cloud-request.ts b/src/main/artifacts/artifact-cloud-request.ts
index 6f1e0bb0f7b..4ad4633dac9 100644
--- a/src/main/artifacts/artifact-cloud-request.ts
+++ b/src/main/artifacts/artifact-cloud-request.ts
@@ -1,7 +1,14 @@
 import type { ArtifactWriteRequest } from '../../shared/artifacts'
 import { OrcaCloudRequestError } from '../orca-profiles/profile-cloud-client'
 
-export function artifactWriteBody(request: ArtifactWriteRequest): Record<string, string> {
+export type ArtifactWriteBody = {
+  content: string
+  contentType: ArtifactWriteRequest['contentType']
+  fileName: string
+  title?: string
+}
+
+export function artifactWriteBody(request: ArtifactWriteRequest): ArtifactWriteBody {
   return {
     content: request.content,
     contentType: request.contentType,
diff --git a/src/main/artifacts/artifact-cloud-service.ts b/src/main/artifacts/artifact-cloud-service.ts
index 6abb0525e9c..83b9836f940 100644
--- a/src/main/artifacts/artifact-cloud-service.ts
+++ b/src/main/artifacts/artifact-cloud-service.ts
@@ -12,6 +12,7 @@ import type {
 import { assertArtifactSharingAllowed } from '../../shared/artifact-sharing-gate'
 import { ensureActiveOrcaProfile } from '../orca-profiles/profile-index-store'
 import { getOrcaCloudAuthConfig } from '../orca-profiles/profile-cloud-auth-config'
+import { prepareArtifactCloudUse } from '../orca-profiles/profile-artifact-cloud-cleanup'
 import { runWithFreshOrcaCloudSession } from '../orca-profiles/profile-cloud-session-refresh'
 import {
   allowsArtifactCloudAuthOverride,
@@ -28,6 +29,7 @@ import {
 import type { ActiveOrcaProfileState } from '../orca-profiles/profile-index-store'
 import { artifactRequest, artifactWriteBody } from './artifact-cloud-request'
 import { ArtifactPublisher } from './artifact-publisher'
+import { OrcaCloudRequestError } from '../orca-profiles/profile-cloud-client'
 
 type ArtifactAuthContext = {
   profileId: string
@@ -35,6 +37,28 @@ type ArtifactAuthContext = {
   assertCurrent: () => void
 }
 
+async function deleteArtifactRequest(
+  apiUrl: string,
+  token: string,
+  path: string,
+  editToken?: string
+): Promise<void> {
+  try {
+    await artifactRequest<void>(apiUrl, token, path, {
+      method: 'DELETE',
+      ...(editToken ? { editToken } : {})
+    })
+  } catch (error) {
+    if (
+      !(error instanceof OrcaCloudRequestError) ||
+      error.statusCode !== 404 ||
+      error.errorCode !== 'artifact_not_found'
+    ) {
+      throw error
+    }
+  }
+}
+
 function tokenFingerprint(token: string): string {
   return createHash('sha256').update(token).digest('hex')
 }
@@ -227,10 +251,8 @@ export class ArtifactCloudService {
         }
         return this.publisher.runForSlug(record.slug, auth, async () => {
           auth.assertCurrent()
-          await artifactRequest<void>(apiUrl, token, `/${record.slug}`, {
-            method: 'DELETE',
-            editToken: record.editToken
-          })
+          await deleteArtifactRequest(apiUrl, token, `/${record.slug}`, record.editToken)
+          auth.assertCurrent()
           removeArtifactShareRecords(auth.profileId, this.userDataPath, auth.scope, {
             sourceKey: request.sourceKey,
             slug: record.slug
@@ -244,9 +266,8 @@ export class ArtifactCloudService {
     return this.withAuth(options, (token, apiUrl, auth) =>
       this.publisher.runForSlug(id, auth, async () => {
         auth.assertCurrent()
-        await artifactRequest<void>(apiUrl, token, `/${encodeURIComponent(id)}`, {
-          method: 'DELETE'
-        })
+        await deleteArtifactRequest(apiUrl, token, `/${encodeURIComponent(id)}`)
+        auth.assertCurrent()
         removeArtifactShareRecords(auth.profileId, this.userDataPath, auth.scope, { slug: id })
       })
     )
@@ -258,6 +279,7 @@ export class ArtifactCloudService {
   ): Promise<ArtifactCloudOperation<T>> {
     const apiUrl = resolveArtifactCloudApiUrl(options.apiUrl)
     const active = ensureActiveOrcaProfile(this.userDataPath)
+    prepareArtifactCloudUse(active.profile, this.userDataPath)
     if (options.authToken?.trim()) {
       if (!allowsArtifactCloudAuthOverride()) {
         throw new Error(
diff --git a/src/main/artifacts/artifact-create-intent-store.test.ts b/src/main/artifacts/artifact-create-intent-store.test.ts
new file mode 100644
index 00000000000..dfcbe003df7
--- /dev/null
+++ b/src/main/artifacts/artifact-create-intent-store.test.ts
@@ -0,0 +1,319 @@
+import { execFileSync } from 'node:child_process'
+import { mkdtemp, readFile, readdir, rm, stat, truncate, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ARTIFACT_CLI_MAX_RPC_BYTES, artifactWriteRequestByteLength } from '../../shared/artifacts'
+import {
+  MAX_ARTIFACT_CREATE_INTENT_BYTES,
+  MAX_PENDING_ARTIFACT_CREATES,
+  clearArtifactCreateIntents,
+  getArtifactCreateIntent,
+  getOrCreateArtifactCreateIntent,
+  removeArtifactCreateIntent
+} from './artifact-create-intent-store'
+import type { ArtifactShareScope } from './artifact-share-record-store'
+
+vi.mock('node:child_process', () => ({ execFile: vi.fn(), execFileSync: vi.fn() }))
+
+const createdPaths: string[] = []
+const scope: ArtifactShareScope = {
+  cloudUserId: 'user-a',
+  cloudProfileId: 'cloud-a',
+  cloudOrganizationId: 'org-a',
+  apiOrigin: 'https://share.onorca.dev'
+}
+const body = {
+  content: '<h1>Original</h1>',
+  contentType: 'text/html' as const,
+  fileName: 'report.html',
+  title: 'Original'
+}
+
+afterEach(async () => {
+  await Promise.all(
+    createdPaths.splice(0).map((path) => rm(path, { recursive: true, force: true }))
+  )
+})
+
+describe('artifact create intent store', () => {
+  it('retains the first key and exact request until the matching create completes', async () => {
+    const userDataPath = await createUserDataPath()
+    const sourceKey = String.raw`C:\repo\report.html`
+    const first = getOrCreateArtifactCreateIntent(
+      'local-profile',
+      userDataPath,
+      sourceKey,
+      scope,
+      'key-a',
+      body
+    )
+    const retry = getOrCreateArtifactCreateIntent(
+      'local-profile',
+      userDataPath,
+      sourceKey,
+      scope,
+      'key-b',
+      { ...body, content: '<h1>Changed</h1>' }
+    )
+
+    expect(first).toEqual(retry)
+    expect(retry).toMatchObject({ idempotencyKey: 'key-a', body })
+    removeArtifactCreateIntent('local-profile', userDataPath, sourceKey, scope, 'key-b')
+    expect(getArtifactCreateIntent('local-profile', userDataPath, sourceKey, scope)).not.toBeNull()
+    removeArtifactCreateIntent('local-profile', userDataPath, sourceKey, scope, 'key-a')
+    expect(getArtifactCreateIntent('local-profile', userDataPath, sourceKey, scope)).toBeNull()
+  })
+
+  it.each([
+    ['user', { cloudUserId: 'user-b' }],
+    ['profile', { cloudProfileId: 'cloud-b' }],
+    ['organization', { cloudOrganizationId: 'org-b' }],
+    ['API origin', { apiOrigin: 'http://localhost:3000' }]
+  ])('isolates recovery intent by %s', async (_name, changedScope) => {
+    const userDataPath = await createUserDataPath()
+    const sourceKey = '/repo/report.html'
+    getOrCreateArtifactCreateIntent('local-profile', userDataPath, sourceKey, scope, 'key-a', body)
+
+    expect(
+      getArtifactCreateIntent('local-profile', userDataPath, sourceKey, {
+        ...scope,
+        ...changedScope
+      })
+    ).toBeNull()
+  })
+
+  it('bounds unresolved payload storage without dropping an existing intent', async () => {
+    const userDataPath = await createUserDataPath()
+    for (let index = 0; index < MAX_PENDING_ARTIFACT_CREATES; index += 1) {
+      getOrCreateArtifactCreateIntent(
+        'local-profile',
+        userDataPath,
+        `/repo/report-${index}.html`,
+        scope,
+        `key-${index}`,
+        body
+      )
+    }
+
+    expect(() =>
+      getOrCreateArtifactCreateIntent(
+        'local-profile',
+        userDataPath,
+        '/repo/overflow.html',
+        scope,
+        'overflow-key',
+        body
+      )
+    ).toThrow(/waiting for recovery/)
+    expect(
+      getOrCreateArtifactCreateIntent(
+        'local-profile',
+        userDataPath,
+        '/repo/report-0.html',
+        scope,
+        'replacement-key',
+        { ...body, content: 'replacement' }
+      ).idempotencyKey
+    ).toBe('key-0')
+  })
+
+  it('clears pending content at the profile lifecycle boundary', async () => {
+    const userDataPath = await createUserDataPath()
+    const directory = join(userDataPath, 'profiles', 'local-profile', 'artifact-create-intents')
+    getOrCreateArtifactCreateIntent(
+      'local-profile',
+      userDataPath,
+      '/repo/report.html',
+      scope,
+      'key-a',
+      body
+    )
+
+    clearArtifactCreateIntents('local-profile', userDataPath)
+
+    expect(
+      getArtifactCreateIntent('local-profile', userDataPath, '/repo/report.html', scope)
+    ).toBeNull()
+    expect(await readdir(directory)).toEqual([])
+  })
+
+  it('removes crash-left temporary writes before admitting another intent', async () => {
+    const userDataPath = await createUserDataPath()
+    const directory = join(userDataPath, 'profiles', 'local-profile', 'artifact-create-intents')
+    getOrCreateArtifactCreateIntent(
+      'local-profile',
+      userDataPath,
+      '/repo/report.html',
+      scope,
+      'key-a',
+      body
+    )
+    removeArtifactCreateIntent('local-profile', userDataPath, '/repo/report.html', scope, 'key-a')
+    await writeFile(join(directory, 'crash-left.tmp'), 'partial')
+
+    getOrCreateArtifactCreateIntent(
+      'local-profile',
+      userDataPath,
+      '/repo/other.html',
+      scope,
+      'key-b',
+      body
+    )
+
+    expect((await readdir(directory)).some((name) => name.endsWith('.tmp'))).toBe(false)
+  })
+
+  it('hardens one Windows journal directory without per-file PowerShell launches', async () => {
+    const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    vi.mocked(execFileSync).mockImplementation((file) =>
+      String(file).endsWith('whoami.exe') ? '"USER","S-1-5-21-1000"' : ''
+    )
+    try {
+      const userDataPath = await createUserDataPath()
+      getOrCreateArtifactCreateIntent(
+        'local-profile',
+        userDataPath,
+        '/repo/report.html',
+        scope,
+        'key-a',
+        body
+      )
+      getOrCreateArtifactCreateIntent(
+        'local-profile',
+        userDataPath,
+        '/repo/other.html',
+        scope,
+        'key-b',
+        body
+      )
+
+      const powershellCalls = vi
+        .mocked(execFileSync)
+        .mock.calls.filter(([file]) => String(file).endsWith('powershell.exe'))
+      expect(powershellCalls).toHaveLength(1)
+      expect((powershellCalls[0]![1] as string[]).at(-1)).toBe('1')
+    } finally {
+      if (originalPlatform) {
+        Object.defineProperty(process, 'platform', originalPlatform)
+      }
+      vi.mocked(execFileSync).mockReset()
+    }
+  })
+
+  it('refuses to overwrite an unreadable matching intent', async () => {
+    const userDataPath = await createUserDataPath()
+    const directory = join(userDataPath, 'profiles', 'local-profile', 'artifact-create-intents')
+    getOrCreateArtifactCreateIntent(
+      'local-profile',
+      userDataPath,
+      '/repo/report.html',
+      scope,
+      'key-a',
+      body
+    )
+    const [fileName] = await readdir(directory)
+    await writeFile(join(directory, fileName), '{broken-json')
+
+    expect(() =>
+      getOrCreateArtifactCreateIntent(
+        'local-profile',
+        userDataPath,
+        '/repo/report.html',
+        scope,
+        'key-b',
+        body
+      )
+    ).toThrow(/could not be read safely/)
+  })
+
+  it('removes an unreadable intent after its mutation completes', async () => {
+    const userDataPath = await createUserDataPath()
+    const directory = join(userDataPath, 'profiles', 'local-profile', 'artifact-create-intents')
+    getOrCreateArtifactCreateIntent(
+      'local-profile',
+      userDataPath,
+      '/repo/report.html',
+      scope,
+      'key-a',
+      body
+    )
+    const [fileName] = await readdir(directory)
+    await writeFile(join(directory, fileName), '{broken-json')
+
+    expect(() =>
+      removeArtifactCreateIntent('local-profile', userDataPath, '/repo/report.html', scope, 'key-a')
+    ).not.toThrow()
+    expect(await readdir(directory)).toEqual([])
+  })
+
+  it('rejects a persisted content type outside the artifact allowlist', async () => {
+    const userDataPath = await createUserDataPath()
+    const directory = join(userDataPath, 'profiles', 'local-profile', 'artifact-create-intents')
+    getOrCreateArtifactCreateIntent(
+      'local-profile',
+      userDataPath,
+      '/repo/report.html',
+      scope,
+      'key-a',
+      body
+    )
+    const [fileName] = await readdir(directory)
+    const path = join(directory, fileName)
+    const intent = JSON.parse(await readFile(path, 'utf8')) as { body: { contentType: string } }
+    intent.body.contentType = 'application/octet-stream'
+    await writeFile(path, JSON.stringify(intent))
+
+    expect(() =>
+      getArtifactCreateIntent('local-profile', userDataPath, '/repo/report.html', scope)
+    ).toThrow(/unsupported format/)
+  })
+
+  it('persists a valid artifact request near the RPC limit', async () => {
+    const userDataPath = await createUserDataPath()
+    const nearLimitBody = { ...body, content: 'x'.repeat(ARTIFACT_CLI_MAX_RPC_BYTES - 200) }
+    expect(
+      artifactWriteRequestByteLength({ sourceKey: '/repo/report.html', ...nearLimitBody })
+    ).toBeLessThanOrEqual(ARTIFACT_CLI_MAX_RPC_BYTES)
+
+    expect(() =>
+      getOrCreateArtifactCreateIntent(
+        'local-profile',
+        userDataPath,
+        '/repo/report.html',
+        scope,
+        'key-a',
+        nearLimitBody
+      )
+    ).not.toThrow()
+    const directory = join(userDataPath, 'profiles', 'local-profile', 'artifact-create-intents')
+    const [fileName] = await readdir(directory)
+    expect((await stat(join(directory, fileName))).size).toBeGreaterThan(ARTIFACT_CLI_MAX_RPC_BYTES)
+  })
+
+  it('rejects an oversized recovery record before reading it', async () => {
+    const userDataPath = await createUserDataPath()
+    const directory = join(userDataPath, 'profiles', 'local-profile', 'artifact-create-intents')
+    getOrCreateArtifactCreateIntent(
+      'local-profile',
+      userDataPath,
+      '/repo/report.html',
+      scope,
+      'key-a',
+      body
+    )
+    const [fileName] = await readdir(directory)
+    await truncate(join(directory, fileName), MAX_ARTIFACT_CREATE_INTENT_BYTES + 1)
+
+    expect(() =>
+      getArtifactCreateIntent('local-profile', userDataPath, '/repo/report.html', scope)
+    ).toThrow(/exceeds the supported size/)
+  })
+})
+
+async function createUserDataPath(): Promise<string> {
+  const path = await mkdtemp(join(tmpdir(), 'orca-artifact-create-intents-'))
+  createdPaths.push(path)
+  return path
+}
diff --git a/src/main/artifacts/artifact-create-intent-store.ts b/src/main/artifacts/artifact-create-intent-store.ts
new file mode 100644
index 00000000000..d544d04ceec
--- /dev/null
+++ b/src/main/artifacts/artifact-create-intent-store.ts
@@ -0,0 +1,255 @@
+import { createHash, randomBytes } from 'node:crypto'
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
+import { join } from 'node:path'
+import { ARTIFACT_CLI_MAX_RPC_BYTES } from '../../shared/artifacts'
+import {
+  bestEffortFsyncDirectorySync,
+  fsyncFileSync,
+  hardenSecurePath
+} from '../../shared/secure-file'
+import { getOrcaProfileDirectory } from '../orca-profiles/profile-storage-paths'
+import type { ArtifactWriteBody } from './artifact-cloud-request'
+import type { ArtifactShareScope } from './artifact-share-record-store'
+
+export const MAX_PENDING_ARTIFACT_CREATES = 32
+export const MAX_ARTIFACT_CREATE_INTENT_BYTES = ARTIFACT_CLI_MAX_RPC_BYTES + 128 * 1024
+
+const MAX_HARDENED_INTENT_DIRECTORIES = 64
+const hardenedIntentDirectories = new Set<string>()
+
+export type ArtifactCreateIntent = {
+  version: 1
+  sourceKey: string
+  scope: ArtifactShareScope
+  idempotencyKey: string
+  body: ArtifactWriteBody
+}
+
+function intentDirectory(profileId: string, userDataPath: string): string {
+  return join(getOrcaProfileDirectory(profileId, userDataPath), 'artifact-create-intents')
+}
+
+function ensureIntentDirectory(profileId: string, userDataPath: string): string {
+  const directory = intentDirectory(profileId, userDataPath)
+  mkdirSync(directory, { recursive: true, mode: 0o700 })
+  if (!hardenedIntentDirectories.has(directory)) {
+    hardenSecurePath(directory, {
+      isDirectory: true,
+      platform: process.platform,
+      sync: true
+    })
+    if (hardenedIntentDirectories.size >= MAX_HARDENED_INTENT_DIRECTORIES) {
+      const oldest = hardenedIntentDirectories.values().next().value
+      if (oldest !== undefined) {
+        hardenedIntentDirectories.delete(oldest)
+      }
+    }
+    hardenedIntentDirectories.add(directory)
+  }
+  return directory
+}
+
+function removeTemporaryIntents(directory: string): void {
+  for (const name of readdirSync(directory)) {
+    if (name.endsWith('.tmp')) {
+      rmSync(join(directory, name), { force: true })
+    }
+  }
+}
+
+function writeIntent(path: string, directory: string, serializedIntent: string): void {
+  // Child files inherit the once-hardened directory ACL, avoiding per-create PowerShell launches.
+  const temporaryPath = `${path}.${process.pid}.${Date.now()}.${randomBytes(4).toString('hex')}.tmp`
+  try {
+    writeFileSync(temporaryPath, serializedIntent, {
+      encoding: 'utf8',
+      mode: 0o600
+    })
+    fsyncFileSync(temporaryPath)
+    renameSync(temporaryPath, path)
+    bestEffortFsyncDirectorySync(directory)
+  } catch (error) {
+    rmSync(temporaryPath, { force: true })
+    throw error
+  }
+}
+
+function intentPath(
+  profileId: string,
+  userDataPath: string,
+  sourceKey: string,
+  scope: ArtifactShareScope
+): string {
+  const identity = JSON.stringify([
+    sourceKey,
+    scope.cloudUserId,
+    scope.cloudProfileId,
+    scope.cloudOrganizationId,
+    scope.apiOrigin
+  ])
+  const fileName = `${createHash('sha256').update(identity).digest('hex')}.json`
+  return join(intentDirectory(profileId, userDataPath), fileName)
+}
+
+function scopeMatches(left: ArtifactShareScope, right: ArtifactShareScope): boolean {
+  return (
+    left.cloudUserId === right.cloudUserId &&
+    left.cloudProfileId === right.cloudProfileId &&
+    left.cloudOrganizationId === right.cloudOrganizationId &&
+    left.apiOrigin === right.apiOrigin
+  )
+}
+
+function isWriteBody(value: unknown): value is ArtifactWriteBody {
+  if (!value || typeof value !== 'object') {
+    return false
+  }
+  const body = value as Partial<ArtifactWriteBody>
+  return (
+    typeof body.content === 'string' &&
+    (body.contentType === 'text/html' || body.contentType === 'text/markdown') &&
+    typeof body.fileName === 'string' &&
+    (body.title === undefined || typeof body.title === 'string')
+  )
+}
+
+function isScope(value: unknown): value is ArtifactShareScope {
+  if (!value || typeof value !== 'object') {
+    return false
+  }
+  const scope = value as Partial<ArtifactShareScope>
+  return [
+    scope.cloudUserId,
+    scope.cloudProfileId,
+    scope.cloudOrganizationId,
+    scope.apiOrigin
+  ].every((field) => typeof field === 'string')
+}
+
+function readIntent(path: string): ArtifactCreateIntent {
+  let size: number
+  try {
+    size = statSync(path).size
+  } catch (error) {
+    throw new Error('Artifact create recovery record could not be read safely.', { cause: error })
+  }
+  if (size > MAX_ARTIFACT_CREATE_INTENT_BYTES) {
+    throw new Error('Artifact create recovery record exceeds the supported size.')
+  }
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(readFileSync(path, 'utf8'))
+  } catch (error) {
+    throw new Error('Artifact create recovery record could not be read safely.', { cause: error })
+  }
+  if (!parsed || typeof parsed !== 'object') {
+    throw new Error('Artifact create recovery record has an unsupported format.')
+  }
+  const intent = parsed as Partial<ArtifactCreateIntent>
+  if (
+    intent.version !== 1 ||
+    typeof intent.sourceKey !== 'string' ||
+    typeof intent.idempotencyKey !== 'string' ||
+    !intent.idempotencyKey ||
+    !isScope(intent.scope) ||
+    !isWriteBody(intent.body)
+  ) {
+    throw new Error('Artifact create recovery record has an unsupported format.')
+  }
+  return intent as ArtifactCreateIntent
+}
+
+export function getArtifactCreateIntent(
+  profileId: string,
+  userDataPath: string,
+  sourceKey: string,
+  scope: ArtifactShareScope
+): ArtifactCreateIntent | null {
+  const path = intentPath(profileId, userDataPath, sourceKey, scope)
+  if (!existsSync(path)) {
+    return null
+  }
+  const intent = readIntent(path)
+  if (intent.sourceKey !== sourceKey || !scopeMatches(intent.scope, scope)) {
+    throw new Error('Artifact create recovery record does not match its storage identity.')
+  }
+  return intent
+}
+
+export function getOrCreateArtifactCreateIntent(
+  profileId: string,
+  userDataPath: string,
+  sourceKey: string,
+  scope: ArtifactShareScope,
+  idempotencyKey: string,
+  body: ArtifactWriteBody
+): ArtifactCreateIntent {
+  const existing = getArtifactCreateIntent(profileId, userDataPath, sourceKey, scope)
+  if (existing) {
+    return existing
+  }
+  const directory = ensureIntentDirectory(profileId, userDataPath)
+  removeTemporaryIntents(directory)
+  const pendingCount = readdirSync(directory).filter((name) => name.endsWith('.json')).length
+  if (pendingCount >= MAX_PENDING_ARTIFACT_CREATES) {
+    throw new Error('Too many artifact creates are waiting for recovery. Retry an earlier share.')
+  }
+  const intent: ArtifactCreateIntent = {
+    version: 1,
+    sourceKey,
+    scope,
+    idempotencyKey,
+    body
+  }
+  const serializedIntent = JSON.stringify(intent, null, 2)
+  if (Buffer.byteLength(serializedIntent, 'utf8') > MAX_ARTIFACT_CREATE_INTENT_BYTES) {
+    throw new Error('Artifact create recovery record exceeds the supported size.')
+  }
+  writeIntent(intentPath(profileId, userDataPath, sourceKey, scope), directory, serializedIntent)
+  return intent
+}
+
+export function removeArtifactCreateIntent(
+  profileId: string,
+  userDataPath: string,
+  sourceKey: string,
+  scope: ArtifactShareScope,
+  expectedIdempotencyKey: string
+): void {
+  const path = intentPath(profileId, userDataPath, sourceKey, scope)
+  if (!existsSync(path)) {
+    return
+  }
+  let matches = true
+  try {
+    matches = readIntent(path).idempotencyKey === expectedIdempotencyKey
+  } catch {
+    // An unreadable record cannot be replayed, so a completed mutation may discard it safely.
+  }
+  if (matches) {
+    rmSync(path, { force: true })
+    bestEffortFsyncDirectorySync(intentDirectory(profileId, userDataPath))
+  }
+}
+
+export function clearArtifactCreateIntents(profileId: string, userDataPath: string): void {
+  const directory = intentDirectory(profileId, userDataPath)
+  if (!existsSync(directory)) {
+    return
+  }
+  for (const name of readdirSync(directory)) {
+    if (name.endsWith('.json') || name.endsWith('.tmp')) {
+      rmSync(join(directory, name), { force: true })
+    }
+  }
+  bestEffortFsyncDirectorySync(directory)
+}
diff --git a/src/main/artifacts/artifact-publisher.ts b/src/main/artifacts/artifact-publisher.ts
index 8f03c4e5b68..d70958e6b6f 100644
--- a/src/main/artifacts/artifact-publisher.ts
+++ b/src/main/artifacts/artifact-publisher.ts
@@ -4,7 +4,17 @@ import type {
   ArtifactWriteRequest
 } from '../../shared/artifacts'
 import { OrcaCloudRequestError } from '../orca-profiles/profile-cloud-client'
-import { artifactRequest, artifactWriteBody } from './artifact-cloud-request'
+import {
+  artifactRequest,
+  type ArtifactWriteBody,
+  artifactWriteBody
+} from './artifact-cloud-request'
+import {
+  type ArtifactCreateIntent,
+  getArtifactCreateIntent,
+  getOrCreateArtifactCreateIntent,
+  removeArtifactCreateIntent
+} from './artifact-create-intent-store'
 import {
   type ArtifactShareScope,
   getArtifactShareRecord,
@@ -15,6 +25,30 @@ import {
 
 type ArtifactCreateResponse = ArtifactListItem & { editToken: string }
 
+type ArtifactCreateOutcome = {
+  editToken: string
+  intent: ArtifactCreateIntent
+  result: ArtifactPublishResult
+}
+
+function artifactWriteBodiesMatch(left: ArtifactWriteBody, right: ArtifactWriteBody): boolean {
+  return (
+    left.content === right.content &&
+    left.contentType === right.contentType &&
+    left.fileName === right.fileName &&
+    left.title === right.title
+  )
+}
+
+function discardsCreateIntent(error: unknown): boolean {
+  return (
+    error instanceof OrcaCloudRequestError &&
+    error.statusCode >= 400 &&
+    error.statusCode < 500 &&
+    ![408, 409, 425, 429].includes(error.statusCode)
+  )
+}
+
 type ArtifactPublishAuthContext = {
   profileId: string
   scope: ArtifactShareScope
@@ -51,7 +85,23 @@ export class ArtifactPublisher {
   ): Promise<ArtifactListItem> {
     return this.runForSource(request.sourceKey, auth, async () => {
       auth.assertCurrent()
-      return (await this.create(request, token, apiUrl, auth, idempotencyKey)).item
+      const pending = getArtifactCreateIntent(
+        auth.profileId,
+        this.userDataPath,
+        request.sourceKey,
+        auth.scope
+      )
+      const created = await this.create(request, token, apiUrl, auth, idempotencyKey, pending)
+      if (pending && !artifactWriteBodiesMatch(pending.body, artifactWriteBody(request))) {
+        const item = await this.updateExisting(request, token, apiUrl, auth, {
+          slug: created.result.item.artifact.slug,
+          editToken: created.editToken
+        })
+        this.removeCreateIntent(request, auth, created.intent)
+        return item
+      }
+      this.removeCreateIntent(request, auth, created.intent)
+      return created.result.item
     })
   }
 
@@ -64,6 +114,25 @@ export class ArtifactPublisher {
   ): Promise<ArtifactPublishResult> {
     return this.runForSource(request.sourceKey, auth, async () => {
       auth.assertCurrent()
+      const pending = getArtifactCreateIntent(
+        auth.profileId,
+        this.userDataPath,
+        request.sourceKey,
+        auth.scope
+      )
+      if (pending) {
+        const created = await this.create(request, token, apiUrl, auth, idempotencyKey, pending)
+        if (artifactWriteBodiesMatch(pending.body, artifactWriteBody(request))) {
+          this.removeCreateIntent(request, auth, created.intent)
+          return created.result
+        }
+        const item = await this.updateExisting(request, token, apiUrl, auth, {
+          slug: created.result.item.artifact.slug,
+          editToken: created.editToken
+        })
+        this.removeCreateIntent(request, auth, created.intent)
+        return { change: 'created', item }
+      }
       const record = getArtifactShareRecord(
         auth.profileId,
         this.userDataPath,
@@ -72,24 +141,8 @@ export class ArtifactPublisher {
       )
       if (record) {
         try {
-          return await this.runForSlug(record.slug, auth, async () => {
-            auth.assertCurrent()
-            const item = await artifactRequest<ArtifactListItem>(apiUrl, token, `/${record.slug}`, {
-              method: 'PUT',
-              editToken: record.editToken,
-              body: artifactWriteBody(request)
-            })
-            auth.assertCurrent()
-            refreshArtifactShareRecordExpiration(
-              auth.profileId,
-              this.userDataPath,
-              request.sourceKey,
-              auth.scope,
-              record,
-              item.artifact.expiresAt
-            )
-            return { change: 'updated', item }
-          })
+          const item = await this.updateExisting(request, token, apiUrl, auth, record)
+          return { change: 'updated', item }
         } catch (error) {
           if (!(error instanceof OrcaCloudRequestError) || error.statusCode !== 404) {
             throw error
@@ -101,7 +154,9 @@ export class ArtifactPublisher {
           })
         }
       }
-      return this.create(request, token, apiUrl, auth, idempotencyKey)
+      const created = await this.create(request, token, apiUrl, auth, idempotencyKey, null)
+      this.removeCreateIntent(request, auth, created.intent)
+      return created.result
     })
   }
 
@@ -121,18 +176,72 @@ export class ArtifactPublisher {
     return this.runSerialized(artifactOperationQueueKey('slug', auth, slug), operation)
   }
 
+  private updateExisting(
+    request: ArtifactWriteRequest,
+    token: string,
+    apiUrl: string,
+    auth: ArtifactPublishAuthContext,
+    record: { slug: string; editToken: string }
+  ): Promise<ArtifactListItem> {
+    return this.runForSlug(record.slug, auth, async () => {
+      auth.assertCurrent()
+      const item = await artifactRequest<ArtifactListItem>(apiUrl, token, `/${record.slug}`, {
+        method: 'PUT',
+        editToken: record.editToken,
+        body: artifactWriteBody(request)
+      })
+      auth.assertCurrent()
+      refreshArtifactShareRecordExpiration(
+        auth.profileId,
+        this.userDataPath,
+        request.sourceKey,
+        auth.scope,
+        record,
+        item.artifact.expiresAt
+      )
+      return item
+    })
+  }
+
   private async create(
     request: ArtifactWriteRequest,
     token: string,
     apiUrl: string,
     auth: ArtifactPublishAuthContext,
-    idempotencyKey: string
-  ): Promise<ArtifactPublishResult> {
-    const response = await artifactRequest<ArtifactCreateResponse>(apiUrl, token, '', {
-      method: 'POST',
-      body: artifactWriteBody(request),
-      idempotencyKey
-    })
+    idempotencyKey: string,
+    pending: ArtifactCreateIntent | null
+  ): Promise<ArtifactCreateOutcome> {
+    const replaying = pending !== null
+    const intent =
+      pending ??
+      getOrCreateArtifactCreateIntent(
+        auth.profileId,
+        this.userDataPath,
+        request.sourceKey,
+        auth.scope,
+        idempotencyKey,
+        artifactWriteBody(request)
+      )
+    let response: ArtifactCreateResponse
+    try {
+      response = await artifactRequest<ArtifactCreateResponse>(apiUrl, token, '', {
+        method: 'POST',
+        body: intent.body,
+        idempotencyKey: intent.idempotencyKey
+      })
+    } catch (error) {
+      // A replay may outlive its server receipt, so never abandon a possibly committed artifact.
+      if (!replaying && discardsCreateIntent(error)) {
+        removeArtifactCreateIntent(
+          auth.profileId,
+          this.userDataPath,
+          request.sourceKey,
+          auth.scope,
+          intent.idempotencyKey
+        )
+      }
+      throw error
+    }
     auth.assertCurrent()
     saveArtifactShareRecord(auth.profileId, this.userDataPath, request.sourceKey, {
       slug: response.artifact.slug,
@@ -142,11 +251,29 @@ export class ArtifactPublisher {
       ...auth.scope
     })
     return {
-      change: 'created',
-      item: { artifact: response.artifact, shareUrl: response.shareUrl }
+      editToken: response.editToken,
+      intent,
+      result: {
+        change: 'created',
+        item: { artifact: response.artifact, shareUrl: response.shareUrl }
+      }
     }
   }
 
+  private removeCreateIntent(
+    request: ArtifactWriteRequest,
+    auth: ArtifactPublishAuthContext,
+    intent: ArtifactCreateIntent
+  ): void {
+    removeArtifactCreateIntent(
+      auth.profileId,
+      this.userDataPath,
+      request.sourceKey,
+      auth.scope,
+      intent.idempotencyKey
+    )
+  }
+
   private async runSerialized<T>(key: string, operation: () => Promise<T>): Promise<T> {
     const previous = this.queues.get(key) ?? Promise.resolve()
     let release = (): void => {}
diff --git a/src/main/artifacts/artifact-recovery-directory-fsync.test.ts b/src/main/artifacts/artifact-recovery-directory-fsync.test.ts
new file mode 100644
index 00000000000..c815d91560d
--- /dev/null
+++ b/src/main/artifacts/artifact-recovery-directory-fsync.test.ts
@@ -0,0 +1,88 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import type * as NodeFs from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+
+const fsyncMockState = vi.hoisted(() => ({
+  directoryDescriptor: -1,
+  directoryErrorCode: 'EINVAL'
+}))
+
+vi.mock('node:fs', async () => {
+  const actual = await vi.importActual<typeof NodeFs>('node:fs')
+  return {
+    ...actual,
+    closeSync: (descriptor: number) => {
+      if (descriptor !== fsyncMockState.directoryDescriptor) {
+        actual.closeSync(descriptor)
+      }
+    },
+    fsyncSync: (descriptor: number) => {
+      if (descriptor === fsyncMockState.directoryDescriptor) {
+        throw Object.assign(new Error('directory fsync failed'), {
+          code: fsyncMockState.directoryErrorCode
+        })
+      }
+      return actual.fsyncSync(descriptor)
+    },
+    openSync: (path: string, flags: string | number) =>
+      actual.statSync(path).isDirectory()
+        ? fsyncMockState.directoryDescriptor
+        : actual.openSync(path, flags)
+  }
+})
+
+import { bestEffortFsyncDirectorySync, writeDurableSecureJsonFile } from '../../shared/secure-file'
+import {
+  clearArtifactCreateIntents,
+  getOrCreateArtifactCreateIntent
+} from './artifact-create-intent-store'
+
+const createdPaths: string[] = []
+
+afterEach(() => {
+  fsyncMockState.directoryErrorCode = 'EINVAL'
+  for (const path of createdPaths.splice(0)) {
+    rmSync(path, { recursive: true, force: true })
+  }
+})
+
+it('skips directory fsync on Windows and propagates I/O failures elsewhere', () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-artifact-directory-fsync-eio-'))
+  createdPaths.push(directory)
+  fsyncMockState.directoryErrorCode = 'EIO'
+
+  const fsyncDirectory = (): void => bestEffortFsyncDirectorySync(directory)
+  if (process.platform === 'win32') {
+    expect(fsyncDirectory).not.toThrow()
+  } else {
+    expect(fsyncDirectory).toThrow('directory fsync failed')
+  }
+})
+
+it('keeps durable artifact records usable when directory fsync is unsupported', () => {
+  const userDataPath = mkdtempSync(join(tmpdir(), 'orca-artifact-directory-fsync-'))
+  createdPaths.push(userDataPath)
+  const recordPath = join(userDataPath, 'artifact-shares.json')
+
+  expect(() => writeDurableSecureJsonFile(recordPath, { ok: true })).not.toThrow()
+  expect(JSON.parse(readFileSync(recordPath, 'utf8'))).toEqual({ ok: true })
+
+  expect(() =>
+    getOrCreateArtifactCreateIntent(
+      'local-profile',
+      userDataPath,
+      '/repo/report.html',
+      {
+        cloudUserId: 'user-a',
+        cloudProfileId: 'profile-a',
+        cloudOrganizationId: 'org-a',
+        apiOrigin: 'https://share.onorca.dev'
+      },
+      'key-a',
+      { content: 'hello', contentType: 'text/markdown', fileName: 'report.md' }
+    )
+  ).not.toThrow()
+  expect(() => clearArtifactCreateIntents('local-profile', userDataPath)).not.toThrow()
+})
diff --git a/src/main/artifacts/artifact-share-record-store.ts b/src/main/artifacts/artifact-share-record-store.ts
index 174856eaee4..a16ec19333c 100644
--- a/src/main/artifacts/artifact-share-record-store.ts
+++ b/src/main/artifacts/artifact-share-record-store.ts
@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto'
 import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { writeSecureJsonFile } from '../../shared/secure-file'
+import { writeDurableSecureJsonFile, writeSecureJsonFile } from '../../shared/secure-file'
 import { getOrcaProfileDirectory } from '../orca-profiles/profile-storage-paths'
 
 export type ArtifactShareScope = {
@@ -183,7 +183,7 @@ export function saveArtifactShareRecord(
   const records = readRecords(profileId, userDataPath)
   records.shares[sourceKey] = { ...record, savedAt: Date.now() }
   records.shares = pruneRecords(records.shares, Date.now()).shares
-  writeSecureJsonFile(recordPath(profileId, userDataPath), records)
+  writeDurableSecureJsonFile(recordPath(profileId, userDataPath), records)
 }
 
 export function refreshArtifactShareRecordExpiration(
@@ -228,7 +228,7 @@ export function removeArtifactShareRecords(
       delete records.shares[sourceKey]
     }
   }
-  writeSecureJsonFile(recordPath(profileId, userDataPath), records)
+  writeDurableSecureJsonFile(recordPath(profileId, userDataPath), records)
 }
 
 export function clearArtifactShareRecords(profileId: string, userDataPath: string): void {
@@ -238,7 +238,7 @@ export function clearArtifactShareRecords(profileId: string, userDataPath: strin
   } catch {
     // Clearing must recover sign-out from an unreadable token index.
   }
-  writeSecureJsonFile(recordPath(profileId, userDataPath), {
+  writeDurableSecureJsonFile(recordPath(profileId, userDataPath), {
     version: 2,
     lifecycleGeneration: lifecycleGeneration + 1,
     lifecycleNonce: randomUUID(),
diff --git a/src/main/automations/hermes-cron-output.ts b/src/main/automations/hermes-cron-output.ts
index db1e054f7e8..581b7f998d1 100644
--- a/src/main/automations/hermes-cron-output.ts
+++ b/src/main/automations/hermes-cron-output.ts
@@ -470,7 +470,7 @@ function findMatchingSessionRunIndex(
     (sessionRun, index) =>
       !usedSessionRunIndexes.has(index) && getRunKey(sessionRun) === outputRunKey
   )
-  if (exactMatchIndex >= 0) {
+  if (exactMatchIndex !== -1) {
     return exactMatchIndex
   }
 
@@ -798,7 +798,7 @@ function readHermesSessionDbRunRefs(jobId: string): HermesSessionRunRef[] {
   }
 }
 
-function readHermesSessionDbRunById(jobId: string, runId: string): unknown | null {
+function readHermesSessionDbRunById(jobId: string, runId: string): unknown {
   if (!existsSync(HERMES_STATE_DB)) {
     return null
   }
diff --git a/src/main/bitbucket/bitbucket-auth-config.ts b/src/main/bitbucket/bitbucket-auth-config.ts
new file mode 100644
index 00000000000..83a4c7cf49d
--- /dev/null
+++ b/src/main/bitbucket/bitbucket-auth-config.ts
@@ -0,0 +1,42 @@
+import { Buffer } from 'node:buffer'
+
+export const DEFAULT_API_BASE_URL = 'https://api.bitbucket.org/2.0'
+
+// Two interchangeable Bitbucket Cloud auth shapes: a single access token (Bearer)
+// or an email + API token pair (HTTP Basic). Either satisfies `hasAuth`, and both
+// may come from env vars or the in-app credential store.
+export type BitbucketAuthConfig = {
+  baseUrl: string
+  accessToken: string | null
+  email: string | null
+  apiToken: string | null
+}
+
+export function envValue(name: string): string | null {
+  const value = process.env[name]?.trim() ?? ''
+  return value.length > 0 ? value : null
+}
+
+export function getEnvAuthConfig(): BitbucketAuthConfig {
+  return {
+    baseUrl: envValue('ORCA_BITBUCKET_API_BASE_URL') ?? DEFAULT_API_BASE_URL,
+    accessToken: envValue('ORCA_BITBUCKET_ACCESS_TOKEN'),
+    email: envValue('ORCA_BITBUCKET_EMAIL'),
+    apiToken: envValue('ORCA_BITBUCKET_API_TOKEN')
+  }
+}
+
+export function hasAuth(config: BitbucketAuthConfig): boolean {
+  return Boolean(config.accessToken || (config.email && config.apiToken))
+}
+
+export function authHeaders(config: BitbucketAuthConfig): Record<string, string> {
+  if (config.accessToken) {
+    return { Authorization: `Bearer ${config.accessToken}` }
+  }
+  if (config.email && config.apiToken) {
+    const encoded = Buffer.from(`${config.email}:${config.apiToken}`).toString('base64')
+    return { Authorization: `Basic ${encoded}` }
+  }
+  return {}
+}
diff --git a/src/main/bitbucket/client.test.ts b/src/main/bitbucket/client.test.ts
index dd55bfad6d2..c3fc53de289 100644
--- a/src/main/bitbucket/client.test.ts
+++ b/src/main/bitbucket/client.test.ts
@@ -124,6 +124,127 @@ describe('Bitbucket client', () => {
     ).resolves.toMatchObject({ number: 42 })
   })
 
+  it('hides a MERGED PR matched only by feature-branch name so a new PR can be created', async () => {
+    const fetchMock = vi.fn(async (url: string) => {
+      if (url.includes('/statuses/build')) {
+        return Response.json({ values: [] })
+      }
+      return Response.json({
+        values: [
+          { ...bitbucketPr(7), state: 'MERGED', source: { branch: { name: 'feature/login' } } }
+        ]
+      })
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    // Why: a merged branch match is history. Returning it made eligibility
+    // report "a pull request already exists" and blocked the branch's next PR.
+    await expect(
+      getBitbucketPullRequestForBranch('/repo', 'refs/heads/feature/login')
+    ).resolves.toBeNull()
+  })
+
+  it('keeps a DECLINED PR on a feature branch visible', async () => {
+    const fetchMock = vi.fn(async (url: string) => {
+      if (url.includes('/statuses/build')) {
+        return Response.json({ values: [] })
+      }
+      return Response.json({
+        values: [
+          { ...bitbucketPr(9), state: 'DECLINED', source: { branch: { name: 'feature/login' } } }
+        ]
+      })
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    // Why: only merged matches are hidden. Hiding declined too made a declined
+    // PR permanently invisible off the default branch, unlike every other provider.
+    await expect(
+      getBitbucketPullRequestForBranch('/repo', 'refs/heads/feature/login')
+    ).resolves.toMatchObject({ number: 9, state: 'closed' })
+  })
+
+  it('returns null instead of querying anonymously when no credential resolves', async () => {
+    delete process.env.ORCA_BITBUCKET_EMAIL
+    delete process.env.ORCA_BITBUCKET_API_TOKEN
+    const fetchMock = vi.fn()
+    vi.stubGlobal('fetch', fetchMock)
+
+    // Why: an unauthenticated query 404s on private repos, which would read as
+    // "no pull request" and offer Create for a branch that already has one.
+    await expect(
+      getBitbucketPullRequestForBranch('/repo', 'refs/heads/feature/login')
+    ).resolves.toBeNull()
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('fetches an explicitly linked DECLINED PR before the branch index', async () => {
+    const fetchMock = vi.fn(async (url: string) => {
+      if (url.endsWith('/pullrequests/7')) {
+        return Response.json({ ...bitbucketPr(7), state: 'DECLINED' })
+      }
+      if (url.includes('/statuses/build')) {
+        return Response.json({ values: [] })
+      }
+      return new Response('branch index unavailable', { status: 503 })
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(
+      getBitbucketPullRequestForBranchOrThrow('/repo', 'refs/heads/feature/login', 7)
+    ).resolves.toMatchObject({ number: 7, state: 'closed' })
+    expect(fetchMock.mock.calls.map(([url]) => url)).not.toContainEqual(
+      expect.stringContaining('/pullrequests?')
+    )
+  })
+
+  it('falls back to the branch index when a linked PR number is stale', async () => {
+    const branchPR = bitbucketPr(7)
+    const fetchMock = vi.fn(async (url: string) => {
+      if (url.endsWith('/pullrequests/99')) {
+        return new Response('not found', { status: 404 })
+      }
+      if (url.includes('/statuses/build')) {
+        return Response.json({ values: [] })
+      }
+      return Response.json({
+        values: [{ ...branchPR, source: { ...branchPR.source, branch: { name: 'feature/login' } } }]
+      })
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(
+      getBitbucketPullRequestForBranchOrThrow('/repo', 'refs/heads/feature/login', 99)
+    ).resolves.toMatchObject({ number: 7, state: 'open' })
+    expect(fetchMock.mock.calls.map(([url]) => url)).toEqual([
+      expect.stringContaining('/pullrequests/99'),
+      expect.stringContaining('/pullrequests?'),
+      expect.stringContaining('/statuses/build')
+    ])
+  })
+
+  it('does not report an unreachable host as an auth failure (STA-3944)', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => {
+        throw new Error('network down')
+      })
+    )
+    await expect(getBitbucketAuthStatus()).resolves.toMatchObject({
+      configured: true,
+      authenticated: true
+    })
+
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => new Response(null, { status: 401 }))
+    )
+    await expect(getBitbucketAuthStatus()).resolves.toMatchObject({
+      configured: true,
+      authenticated: false
+    })
+  })
+
   it('fetches a branch pull request and commit build status', async () => {
     const fetchMock = vi.fn(async (url: string, _init?: RequestInit) => {
       if (url.includes('/statuses/build')) {
diff --git a/src/main/bitbucket/client.ts b/src/main/bitbucket/client.ts
index e5163bd525a..deb856a66d1 100644
--- a/src/main/bitbucket/client.ts
+++ b/src/main/bitbucket/client.ts
@@ -1,4 +1,3 @@
-import { Buffer } from 'node:buffer'
 import type { CheckStatus } from '../../shared/types'
 import {
   deriveBitbucketBuildStatus,
@@ -8,25 +7,26 @@ import {
   type RawBitbucketBuildStatus,
   type RawBitbucketPullRequest
 } from './pull-request-mappers'
-import { shouldHideNonOpenReviewOnDefaultBranch } from '../source-control/repo-default-branch'
 import { getBitbucketRepoRef, type BitbucketRepoRef } from './repository-ref'
+import { shouldHideNonOpenReviewOnDefaultBranch } from '../source-control/repo-default-branch'
 import {
   getHostedReviewLocalGitOptions,
   type HostedReviewExecutionOptions
 } from '../source-control/hosted-review-git-options'
 import { cancelUnreadResponseBody } from '../lib/unread-response-body'
+import { authHeaders, getEnvAuthConfig, hasAuth } from './bitbucket-auth-config'
+import { accountNameFromUser, fetchBitbucketUserResult } from './user-request'
+import {
+  getStoredBitbucketCredentialError,
+  getStoredBitbucketMetadata,
+  hasStoredBitbucketCredential,
+  loadStoredBitbucketSecret
+} from './credential-store'
+import { resolveBitbucketAuthConfig, storedAuthConfig } from './resolve-auth'
 
-const DEFAULT_API_BASE_URL = 'https://api.bitbucket.org/2.0'
 const REQUEST_TIMEOUT_MS = 5000
 const ALL_PULL_REQUEST_STATES = ['OPEN', 'MERGED', 'DECLINED', 'SUPERSEDED'] as const
 
-type BitbucketAuthConfig = {
-  baseUrl: string
-  accessToken: string | null
-  email: string | null
-  apiToken: string | null
-}
-
 export type BitbucketAuthStatus = {
   configured: boolean
   authenticated: boolean
@@ -38,42 +38,16 @@ type RequestOptions = {
   timeoutMs?: number
 }
 
-function envValue(name: string): string | null {
-  const value = process.env[name]?.trim() ?? ''
-  return value.length > 0 ? value : null
-}
-
-function getAuthConfig(): BitbucketAuthConfig {
-  return {
-    baseUrl: envValue('ORCA_BITBUCKET_API_BASE_URL') ?? DEFAULT_API_BASE_URL,
-    accessToken: envValue('ORCA_BITBUCKET_ACCESS_TOKEN'),
-    email: envValue('ORCA_BITBUCKET_EMAIL'),
-    apiToken: envValue('ORCA_BITBUCKET_API_TOKEN')
-  }
-}
-
-function hasAuth(config: BitbucketAuthConfig): boolean {
-  return Boolean(config.accessToken || (config.email && config.apiToken))
-}
-
-function authHeaders(config: BitbucketAuthConfig): Record<string, string> {
-  if (config.accessToken) {
-    return { Authorization: `Bearer ${config.accessToken}` }
-  }
-  if (config.email && config.apiToken) {
-    const encoded = Buffer.from(`${config.email}:${config.apiToken}`).toString('base64')
-    return { Authorization: `Basic ${encoded}` }
-  }
-  return {}
-}
-
 function isStringArray(value: string | readonly string[]): value is readonly string[] {
   return Array.isArray(value)
 }
 
-function apiUrl(path: string, searchParams?: RequestOptions['searchParams']): string {
-  const config = getAuthConfig()
-  const base = config.baseUrl.replace(/\/+$/, '')
+function apiUrl(
+  baseUrl: string,
+  path: string,
+  searchParams?: RequestOptions['searchParams']
+): string {
+  const base = baseUrl.replace(/\/+$/, '')
   const url = new URL(`${base}${path}`)
   if (searchParams) {
     for (const [key, value] of Object.entries(searchParams)) {
@@ -95,11 +69,24 @@ async function requestJson<T>(
   // Why: the existing-review lookup behind Create must distinguish a real
   // transport/auth failure from an accepted "no PR". When true, a failed request
   // throws instead of collapsing to null so callers never report false not_found.
-  throwOnFailure = false
+  throwOnFailure = false,
+  // Why: a linked PR number can be stale (deleted PR, wrong repo). A 404 there
+  // must fall through to the branch lookup rather than throw and hide the
+  // branch's real review, so only that caller opts into it.
+  notFoundIsNull = false
 ): Promise<T | null> {
-  const config = getAuthConfig()
+  const config = resolveBitbucketAuthConfig()
+  // Why: a denied keychain prompt leaves no usable credential. Issuing the
+  // request anyway gets a 404 on private repos, which reads as "no pull
+  // request" and offers Create for a branch that already has one.
+  if (!hasAuth(config)) {
+    if (throwOnFailure) {
+      throw new Error('Bitbucket request failed: no usable credential')
+    }
+    return null
+  }
   try {
-    const response = await fetch(apiUrl(path, options.searchParams), {
+    const response = await fetch(apiUrl(config.baseUrl, path, options.searchParams), {
       headers: {
         Accept: 'application/json',
         ...authHeaders(config)
@@ -108,6 +95,9 @@ async function requestJson<T>(
     })
     if (!response.ok) {
       await cancelUnreadResponseBody(response)
+      if (response.status === 404 && notFoundIsNull) {
+        return null
+      }
       if (throwOnFailure) {
         throw new Error(`Bitbucket request failed: HTTP ${response.status}`)
       }
@@ -157,21 +147,40 @@ async function normalizePullRequest(
   return mapBitbucketPullRequest(raw, status)
 }
 
+// Never decrypts. Env credentials are checked live; a stored credential is
+// revalidated only when its secret already sits in memory from an earlier API
+// call, and otherwise trusted from plaintext metadata — decrypting here would
+// prompt for keychain access every time Settings opens.
 export async function getBitbucketAuthStatus(): Promise<BitbucketAuthStatus> {
-  const config = getAuthConfig()
-  if (!hasAuth(config)) {
-    return { configured: false, authenticated: false, account: null }
+  const env = getEnvAuthConfig()
+  if (hasAuth(env)) {
+    const result = await fetchBitbucketUserResult(env)
+    return {
+      configured: true,
+      // Why (STA-3944): only a rejection means the credential is bad. An
+      // unreachable host must not render as "Auth failed" and send the user
+      // off to regenerate a token that still works.
+      authenticated: result.ok || result.reason === 'unreachable',
+      account: result.ok ? accountNameFromUser(result.user) : null
+    }
   }
-  const user = await requestJson<{
-    username?: string | null
-    display_name?: string | null
-    account_id?: string | null
-  }>('/user', { timeoutMs: 4000 })
-  return {
-    configured: true,
-    authenticated: user !== null,
-    account: user?.username ?? user?.display_name ?? user?.account_id ?? null
+  const metadata = getStoredBitbucketMetadata()
+  if (metadata && hasStoredBitbucketCredential()) {
+    if (getStoredBitbucketCredentialError()) {
+      return { configured: true, authenticated: false, account: metadata.account }
+    }
+    const cached = loadStoredBitbucketSecret()
+    if (!cached) {
+      return { configured: true, authenticated: true, account: metadata.account }
+    }
+    const result = await fetchBitbucketUserResult(storedAuthConfig(metadata, cached))
+    return {
+      configured: true,
+      authenticated: result.ok || result.reason === 'unreachable',
+      account: (result.ok ? accountNameFromUser(result.user) : null) ?? metadata.account
+    }
   }
+  return { configured: false, authenticated: false, account: null }
 }
 
 export async function getBitbucketPullRequest(
@@ -216,6 +225,18 @@ export async function getBitbucketPullRequestForBranch(
     return null
   }
 
+  if (typeof linkedPRNumber === 'number') {
+    const raw = await requestJson<RawBitbucketPullRequest>(
+      `/repositories/${encodedRepoPath(repo)}/pullrequests/${encodeURIComponent(String(linkedPRNumber))}`,
+      {},
+      throwOnFailure,
+      true
+    )
+    if (raw) {
+      return normalizePullRequest(repo, raw)
+    }
+  }
+
   if (branchName) {
     const query = [
       `source.branch.name = "${escapeBitbucketQueryString(branchName)}"`,
@@ -235,10 +256,16 @@ export async function getBitbucketPullRequestForBranch(
     )
     const raw = list?.values?.[0]
     if (raw) {
-      // Why (#9171): discard a non-open implicit branch match on the repo
-      // default branch and fall through to the linked-number fallback below.
+      const state = mapBitbucketPullRequestState(raw.state)
+      // Why: a merged PR we only matched by branch name is history, not review
+      // context (GitHub's isMergedImplicitPR rule). Keeping it reported "a pull
+      // request already exists" and blocked the branch's next PR. Scoped to
+      // merged so a declined PR stays visible off the default branch, matching
+      // every other provider; the linked lookup above already returned early
+      // for an explicitly linked review.
+      const isMergedImplicitMatch = state === 'merged'
       const hideOnDefaultBranch = await shouldHideNonOpenReviewOnDefaultBranch({
-        state: mapBitbucketPullRequestState(raw.state),
+        state,
         reviewNumber: raw.id ?? null,
         linkedReviewNumber: linkedPRNumber,
         branchName,
@@ -246,21 +273,13 @@ export async function getBitbucketPullRequestForBranch(
         connectionId,
         localGitOptions: getHostedReviewLocalGitOptions(options)
       })
-      if (!hideOnDefaultBranch) {
+      if (!isMergedImplicitMatch && !hideOnDefaultBranch) {
         return normalizePullRequest(repo, raw)
       }
     }
   }
 
-  if (typeof linkedPRNumber !== 'number') {
-    return null
-  }
-  const raw = await requestJson<RawBitbucketPullRequest>(
-    `/repositories/${encodedRepoPath(repo)}/pullrequests/${encodeURIComponent(String(linkedPRNumber))}`,
-    {},
-    throwOnFailure
-  )
-  return raw ? normalizePullRequest(repo, raw) : null
+  return null
 }
 
 /**
diff --git a/src/main/bitbucket/credential-connection.test.ts b/src/main/bitbucket/credential-connection.test.ts
new file mode 100644
index 00000000000..0026e6901cb
--- /dev/null
+++ b/src/main/bitbucket/credential-connection.test.ts
@@ -0,0 +1,187 @@
+import { mkdtempSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import type * as Os from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const OLD_ENV = process.env
+const OLD_FETCH = globalThis.fetch
+let tempHome = ''
+
+async function loadModule() {
+  vi.resetModules()
+  vi.doMock('electron', () => ({
+    safeStorage: {
+      isEncryptionAvailable: () => true,
+      encryptString: (value: string) => Buffer.from(value),
+      decryptString: (value: Buffer) => value.toString('utf-8')
+    }
+  }))
+  vi.doMock('node:os', async () => {
+    const actual = await vi.importActual<typeof Os>('node:os')
+    return { ...actual, homedir: () => tempHome }
+  })
+  return import('./credential-connection')
+}
+
+beforeEach(() => {
+  process.env = { ...OLD_ENV }
+  for (const key of [
+    'ORCA_BITBUCKET_ACCESS_TOKEN',
+    'ORCA_BITBUCKET_EMAIL',
+    'ORCA_BITBUCKET_API_TOKEN',
+    'ORCA_BITBUCKET_API_BASE_URL'
+  ]) {
+    delete process.env[key]
+  }
+  tempHome = mkdtempSync(join(tmpdir(), 'orca-bitbucket-conn-'))
+})
+
+afterEach(() => {
+  process.env = OLD_ENV
+  globalThis.fetch = OLD_FETCH
+})
+
+describe('Bitbucket credential connection', () => {
+  it('verifies credentials before saving and reports a stored connection', async () => {
+    const conn = await loadModule()
+    globalThis.fetch = vi.fn(async () =>
+      Response.json({ username: 'ada' })
+    ) as unknown as typeof fetch
+
+    await expect(
+      conn.connectBitbucket({
+        authMode: 'basic',
+        email: 'ada@example.com',
+        apiToken: 'tok'
+      })
+    ).resolves.toEqual({ ok: true, account: 'ada' })
+
+    expect(conn.getBitbucketConnectionStatus()).toEqual({
+      configured: true,
+      source: 'stored',
+      account: 'ada',
+      authMode: 'basic',
+      email: 'ada@example.com',
+      baseUrl: null
+    })
+  })
+
+  it('sends Basic auth built from the entered email and API token', async () => {
+    const conn = await loadModule()
+    const fetchSpy = vi.fn(async () => Response.json({ username: 'ada' }))
+    globalThis.fetch = fetchSpy as unknown as typeof fetch
+
+    await conn.connectBitbucket({ authMode: 'basic', email: 'ada@example.com', apiToken: 'tok' })
+
+    const [url, init] = fetchSpy.mock.calls[0] as unknown as [string, RequestInit]
+    expect(url).toBe('https://api.bitbucket.org/2.0/user')
+    expect((init.headers as Record<string, string>).Authorization).toBe(
+      `Basic ${Buffer.from('ada@example.com:tok').toString('base64')}`
+    )
+  })
+
+  it('rejects credentials that fail the /user check without saving them', async () => {
+    const conn = await loadModule()
+    globalThis.fetch = vi.fn(
+      async () => new Response(null, { status: 401 })
+    ) as unknown as typeof fetch
+
+    const result = await conn.connectBitbucket({
+      authMode: 'token',
+      accessToken: 'bad'
+    })
+    expect(result.ok).toBe(false)
+    expect(conn.getBitbucketConnectionStatus().source).toBe('none')
+  })
+
+  it('separates a rejected credential from an unreachable host (STA-3944)', async () => {
+    const conn = await loadModule()
+
+    globalThis.fetch = vi.fn(
+      async () => new Response(null, { status: 401 })
+    ) as unknown as typeof fetch
+    const rejected = await conn.connectBitbucket({ authMode: 'token', accessToken: 'bad' })
+    expect(!rejected.ok && rejected.error).toMatch(/rejected these credentials/i)
+
+    // Why: a timeout or 5xx says nothing about the token; calling it invalid
+    // sends the user off to regenerate a credential that still works.
+    for (const failure of [
+      async () => {
+        throw new Error('network down')
+      },
+      async () => new Response(null, { status: 503 })
+    ]) {
+      globalThis.fetch = vi.fn(failure) as unknown as typeof fetch
+      const unreachable = await conn.connectBitbucket({ authMode: 'token', accessToken: 'good' })
+      expect(!unreachable.ok && unreachable.error).toMatch(/could not reach bitbucket/i)
+    }
+    expect(conn.getBitbucketConnectionStatus().source).toBe('none')
+  })
+
+  it('rejects an incomplete basic-auth credential before making a request', async () => {
+    const conn = await loadModule()
+    const fetchSpy = vi.fn()
+    globalThis.fetch = fetchSpy as unknown as typeof fetch
+
+    const result = await conn.connectBitbucket({
+      authMode: 'basic',
+      email: 'ada@example.com'
+    })
+    expect(result.ok).toBe(false)
+    expect(fetchSpy).not.toHaveBeenCalled()
+  })
+
+  it('reports environment variables as the source and takes precedence over stored creds', async () => {
+    const conn = await loadModule()
+    globalThis.fetch = vi.fn(async () =>
+      Response.json({ username: 'ada' })
+    ) as unknown as typeof fetch
+    await conn.connectBitbucket({
+      authMode: 'basic',
+      email: 'ada@example.com',
+      apiToken: 'tok'
+    })
+
+    process.env.ORCA_BITBUCKET_ACCESS_TOKEN = 'env-token'
+    expect(conn.getBitbucketConnectionStatus()).toMatchObject({
+      configured: true,
+      source: 'environment',
+      authMode: 'token'
+    })
+  })
+
+  it('lets an env API base URL override the stored one without env credentials', async () => {
+    const conn = await loadModule()
+    globalThis.fetch = vi.fn(async () =>
+      Response.json({ username: 'ada' })
+    ) as unknown as typeof fetch
+    await conn.connectBitbucket({
+      authMode: 'basic',
+      email: 'ada@example.com',
+      apiToken: 'tok',
+      baseUrl: 'https://stored.example.com/2.0'
+    })
+
+    // Only the base URL is in the env, so `hasAuth(env)` is false — precedence
+    // is per-setting, not all-or-nothing.
+    process.env.ORCA_BITBUCKET_API_BASE_URL = 'https://env.example.com/2.0'
+    const { resolveBitbucketAuthConfig } = await import('./resolve-auth')
+    expect(resolveBitbucketAuthConfig().baseUrl).toBe('https://env.example.com/2.0')
+  })
+
+  it('clears the stored connection on disconnect', async () => {
+    const conn = await loadModule()
+    globalThis.fetch = vi.fn(async () =>
+      Response.json({ username: 'ada' })
+    ) as unknown as typeof fetch
+    await conn.connectBitbucket({
+      authMode: 'basic',
+      email: 'ada@example.com',
+      apiToken: 'tok'
+    })
+
+    conn.disconnectBitbucket()
+    expect(conn.getBitbucketConnectionStatus().source).toBe('none')
+  })
+})
diff --git a/src/main/bitbucket/credential-connection.ts b/src/main/bitbucket/credential-connection.ts
new file mode 100644
index 00000000000..c36980e8e79
--- /dev/null
+++ b/src/main/bitbucket/credential-connection.ts
@@ -0,0 +1,115 @@
+import {
+  DEFAULT_API_BASE_URL,
+  envValue,
+  getEnvAuthConfig,
+  hasAuth,
+  type BitbucketAuthConfig
+} from './bitbucket-auth-config'
+import { accountNameFromUser, fetchBitbucketUserResult } from './user-request'
+import {
+  clearStoredBitbucketCredential,
+  getStoredBitbucketMetadata,
+  hasStoredBitbucketCredential,
+  saveBitbucketCredential
+} from './credential-store'
+import type {
+  BitbucketConnectArgs,
+  BitbucketConnectResult,
+  BitbucketConnectionStatus
+} from '../../shared/bitbucket-credentials'
+
+export type { BitbucketConnectArgs, BitbucketConnectResult, BitbucketConnectionStatus }
+
+const VERIFY_TIMEOUT_MS = 6000
+
+function normalize(value: string | null | undefined): string | null {
+  const trimmed = value?.trim() ?? ''
+  return trimmed.length > 0 ? trimmed : null
+}
+
+function buildCandidateConfig(input: BitbucketConnectArgs): BitbucketAuthConfig {
+  return {
+    baseUrl: normalize(input.baseUrl) ?? DEFAULT_API_BASE_URL,
+    accessToken: input.authMode === 'token' ? normalize(input.accessToken) : null,
+    email: input.authMode === 'basic' ? normalize(input.email) : null,
+    apiToken: input.authMode === 'basic' ? normalize(input.apiToken) : null
+  }
+}
+
+// Verifying against `/user` before persisting keeps the stored "connected
+// account" honest and lets the dialog reject a dead token inline.
+export async function connectBitbucket(
+  input: BitbucketConnectArgs
+): Promise<BitbucketConnectResult> {
+  const config = buildCandidateConfig(input)
+  if (!hasAuth(config)) {
+    return {
+      ok: false,
+      error:
+        input.authMode === 'token'
+          ? 'Enter an access token.'
+          : 'Enter both an email and an API token.'
+    }
+  }
+  const result = await fetchBitbucketUserResult(config, VERIFY_TIMEOUT_MS)
+  if (!result.ok) {
+    return {
+      ok: false,
+      // Why (STA-3944): telling someone their token is invalid when the network
+      // is down sends them to regenerate a credential that was fine.
+      error:
+        result.reason === 'rejected'
+          ? 'Bitbucket rejected these credentials. Check the email and token, then try again.'
+          : 'Could not reach Bitbucket. Check your connection or the API base URL, then try again.'
+    }
+  }
+  const account = accountNameFromUser(result.user)
+  saveBitbucketCredential({
+    authMode: input.authMode,
+    email: config.email,
+    baseUrl: normalize(input.baseUrl),
+    account,
+    accessToken: config.accessToken,
+    apiToken: config.apiToken
+  })
+  return { ok: true, account }
+}
+
+export function disconnectBitbucket(): void {
+  clearStoredBitbucketCredential()
+}
+
+// Reads env vars and plaintext metadata only — never decrypts — so the Settings
+// card can call it on every open without a keychain prompt.
+export function getBitbucketConnectionStatus(): BitbucketConnectionStatus {
+  const env = getEnvAuthConfig()
+  if (hasAuth(env)) {
+    return {
+      configured: true,
+      source: 'environment',
+      account: null,
+      authMode: env.accessToken ? 'token' : 'basic',
+      email: env.email,
+      baseUrl: envValue('ORCA_BITBUCKET_API_BASE_URL')
+    }
+  }
+  if (hasStoredBitbucketCredential()) {
+    const metadata = getStoredBitbucketMetadata()
+    return {
+      configured: true,
+      source: 'stored',
+      account: metadata?.account ?? null,
+      authMode: metadata?.authMode ?? null,
+      email: metadata?.email ?? null,
+      baseUrl: metadata?.baseUrl ?? null
+    }
+  }
+  return {
+    configured: false,
+    source: 'none',
+    account: null,
+    authMode: null,
+    email: null,
+    baseUrl: null
+  }
+}
diff --git a/src/main/bitbucket/credential-store.test.ts b/src/main/bitbucket/credential-store.test.ts
new file mode 100644
index 00000000000..4edd11b0444
--- /dev/null
+++ b/src/main/bitbucket/credential-store.test.ts
@@ -0,0 +1,367 @@
+import { existsSync, mkdtempSync, statSync } from 'node:fs'
+import type * as Fs from 'node:fs'
+import { tmpdir } from 'node:os'
+import type * as Os from 'node:os'
+import { join } from 'node:path'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+let tempHome = ''
+const decryptStringMock = vi.fn((value: Buffer) => value.toString('utf-8'))
+
+async function loadStore(
+  options: {
+    unlinkError?: NodeJS.ErrnoException
+    writeError?: Error
+    shortWrites?: boolean
+  } = {}
+) {
+  vi.resetModules()
+  // Why: doMock registrations outlive resetModules, so an injected failure from
+  // one case would leak into every later one in this file.
+  vi.doUnmock('node:fs')
+  vi.doMock('electron', () => ({
+    safeStorage: {
+      isEncryptionAvailable: () => true,
+      encryptString: (value: string) => Buffer.from(value),
+      decryptString: decryptStringMock
+    }
+  }))
+  vi.doMock('node:os', async () => {
+    const actual = await vi.importActual<typeof Os>('node:os')
+    return { ...actual, homedir: () => tempHome }
+  })
+  if (options.shortWrites) {
+    vi.doMock('node:fs', async () => {
+      const actual = await vi.importActual<typeof Fs>('node:fs')
+      return {
+        ...actual,
+        // Why: write(2) may return a short count; publishing without looping
+        // would rename a truncated credential into place.
+        writeSync: (fd: number, data: Buffer, offset = 0, length = data.length) =>
+          actual.writeSync(fd, data, offset, Math.min(1, length))
+      }
+    })
+  }
+  if (options.writeError) {
+    const error = options.writeError
+    vi.doMock('node:fs', async () => {
+      const actual = await vi.importActual<typeof Fs>('node:fs')
+      return {
+        ...actual,
+        writeSync: () => {
+          throw error
+        }
+      }
+    })
+  }
+  if (options.unlinkError) {
+    // Why mocked: chmod-based failure injection is not portable — Windows has no
+    // POSIX modes and a root/elevated runner can unlink through a 0500 directory.
+    const error = options.unlinkError
+    vi.doMock('node:fs', async () => {
+      const actual = await vi.importActual<typeof Fs>('node:fs')
+      return {
+        ...actual,
+        unlinkSync: () => {
+          throw error
+        }
+      }
+    })
+  }
+  return import('./credential-store')
+}
+
+beforeEach(() => {
+  tempHome = mkdtempSync(join(tmpdir(), 'orca-bitbucket-store-'))
+  decryptStringMock.mockClear()
+})
+
+describe('Bitbucket credential store', () => {
+  it('persists plaintext metadata and an encrypted secret, then reads them back', async () => {
+    const store = await loadStore()
+    store.saveBitbucketCredential({
+      authMode: 'basic',
+      email: 'ada@example.com',
+      baseUrl: null,
+      account: 'ada',
+      accessToken: null,
+      apiToken: 'secret-token'
+    })
+
+    expect(store.hasStoredBitbucketCredential()).toBe(true)
+    expect(store.getStoredBitbucketMetadata()).toMatchObject({
+      authMode: 'basic',
+      email: 'ada@example.com',
+      account: 'ada'
+    })
+    expect(store.loadStoredBitbucketSecret()).toMatchObject({
+      accessToken: null,
+      apiToken: 'secret-token',
+      // Why (STA-3941): auth fields live in the envelope so a torn write cannot
+      // pair a new secret with a stale email.
+      authMode: 'basic',
+      email: 'ada@example.com'
+    })
+  })
+
+  it('writes both credential files 0600', async () => {
+    const store = await loadStore()
+    store.saveBitbucketCredential({
+      authMode: 'token',
+      email: null,
+      baseUrl: null,
+      account: 'dev',
+      accessToken: 'access-secret',
+      apiToken: null
+    })
+
+    for (const file of ['bitbucket-credential.enc', 'bitbucket-credential.json']) {
+      expect(statSync(join(tempHome, '.orca', file)).mode & 0o777).toBe(0o600)
+    }
+  })
+
+  it('re-tightens permissions when overwriting an existing credential', async () => {
+    const store = await loadStore()
+    const save = (account: string): void =>
+      store.saveBitbucketCredential({
+        authMode: 'token',
+        email: null,
+        baseUrl: null,
+        account,
+        accessToken: 'access-secret',
+        apiToken: null
+      })
+    save('first')
+    // Why: writeFileSync's mode is ignored for an existing file, so a loosened
+    // credential would stay world-readable across a reconnect.
+    const { chmodSync } = await import('node:fs')
+    for (const file of ['bitbucket-credential.enc', 'bitbucket-credential.json']) {
+      chmodSync(join(tempHome, '.orca', file), 0o644)
+    }
+    save('second')
+
+    for (const file of ['bitbucket-credential.enc', 'bitbucket-credential.json']) {
+      expect(statSync(join(tempHome, '.orca', file)).mode & 0o777).toBe(0o600)
+    }
+  })
+
+  it('does not decrypt for metadata/status reads — only on a forced secret load', async () => {
+    const store = await loadStore()
+    store.saveBitbucketCredential({
+      authMode: 'token',
+      email: null,
+      baseUrl: 'https://api.bitbucket.org/2.0',
+      account: 'dev',
+      accessToken: 'access-secret',
+      apiToken: null
+    })
+
+    // Simulate a fresh session: caches cleared, files still on disk.
+    store._resetBitbucketCredentialCache()
+
+    expect(store.getStoredBitbucketMetadata()?.account).toBe('dev')
+    expect(store.hasStoredBitbucketCredential()).toBe(true)
+    expect(decryptStringMock).not.toHaveBeenCalled()
+
+    // Without force, the secret stays unread.
+    expect(store.loadStoredBitbucketSecret()).toBeNull()
+    expect(decryptStringMock).not.toHaveBeenCalled()
+
+    // Forcing the load decrypts exactly once, then caches.
+    expect(store.loadStoredBitbucketSecret({ force: true })).toMatchObject({
+      accessToken: 'access-secret',
+      apiToken: null,
+      authMode: 'token'
+    })
+    expect(decryptStringMock).toHaveBeenCalledTimes(1)
+    expect(store.loadStoredBitbucketSecret()).not.toBeNull()
+    expect(decryptStringMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('rejects non-string fields from hand-edited metadata and secret files', async () => {
+    const store = await loadStore()
+    const { writeFileSync } = await import('node:fs')
+    store.saveBitbucketCredential({
+      authMode: 'basic',
+      email: 'ada@example.com',
+      baseUrl: null,
+      account: 'ada',
+      accessToken: null,
+      apiToken: 'secret-token'
+    })
+
+    writeFileSync(
+      join(tempHome, '.orca', 'bitbucket-credential.json'),
+      JSON.stringify({ version: 1, authMode: 'basic', email: { evil: true }, account: 42 })
+    )
+    writeFileSync(
+      join(tempHome, '.orca', 'bitbucket-credential.enc'),
+      JSON.stringify({ accessToken: ['nope'], apiToken: 7 })
+    )
+    store._resetBitbucketCredentialCache()
+
+    expect(store.getStoredBitbucketMetadata()).toMatchObject({ email: null, account: null })
+    expect(store.loadStoredBitbucketSecret({ force: true })).toMatchObject({
+      accessToken: null,
+      apiToken: null
+    })
+  })
+
+  it('keeps the previous credential intact when the secret write fails (STA-3941)', async () => {
+    const store = await loadStore()
+    store.saveBitbucketCredential({
+      authMode: 'basic',
+      email: 'ada@example.com',
+      baseUrl: null,
+      account: 'ada',
+      accessToken: null,
+      apiToken: 'first-token'
+    })
+    const { readFileSync } = await import('node:fs')
+    const before = readFileSync(join(tempHome, '.orca', 'bitbucket-credential.enc'))
+
+    // Why: a direct write truncates in place, so a failure mid-write used to
+    // destroy the only working credential. The temp+rename path cannot.
+    const failing = await loadStore({ writeError: new Error('disk full') })
+    expect(() =>
+      failing.saveBitbucketCredential({
+        authMode: 'basic',
+        email: 'grace@example.com',
+        baseUrl: null,
+        account: 'grace',
+        accessToken: null,
+        apiToken: 'second-token'
+      })
+    ).toThrow(/disk full/)
+
+    expect(readFileSync(join(tempHome, '.orca', 'bitbucket-credential.enc'))).toEqual(before)
+    expect(existsSync(join(tempHome, '.orca', 'bitbucket-credential.enc.tmp'))).toBe(false)
+  })
+
+  it('authenticates from the envelope when metadata is stale (STA-3941)', async () => {
+    const store = await loadStore()
+    store.saveBitbucketCredential({
+      authMode: 'basic',
+      email: 'grace@example.com',
+      baseUrl: null,
+      account: 'grace',
+      accessToken: null,
+      apiToken: 'second-token'
+    })
+
+    // Simulate an interrupt between publishing the secret and the metadata:
+    // metadata still describes the previous connection.
+    const { writeFileSync } = await import('node:fs')
+    writeFileSync(
+      join(tempHome, '.orca', 'bitbucket-credential.json'),
+      JSON.stringify({
+        version: 1,
+        authMode: 'basic',
+        email: 'ada@example.com',
+        baseUrl: null,
+        account: 'ada',
+        updatedAt: ''
+      })
+    )
+    store._resetBitbucketCredentialCache()
+
+    const { resolveBitbucketAuthConfig } = await import('./resolve-auth')
+    // Auth follows the envelope, so the pair stays usable; only the displayed
+    // account is stale until the next status refresh.
+    expect(resolveBitbucketAuthConfig()).toMatchObject({
+      email: 'grace@example.com',
+      apiToken: 'second-token'
+    })
+  })
+
+  it('still authenticates a credential saved before the envelope carried auth fields', async () => {
+    const store = await loadStore()
+    store.saveBitbucketCredential({
+      authMode: 'basic',
+      email: 'ada@example.com',
+      baseUrl: null,
+      account: 'ada',
+      accessToken: null,
+      apiToken: 'legacy-token'
+    })
+    const { writeFileSync } = await import('node:fs')
+    // Legacy envelopes held only the two tokens.
+    writeFileSync(
+      join(tempHome, '.orca', 'bitbucket-credential.enc'),
+      JSON.stringify({ accessToken: null, apiToken: 'legacy-token' })
+    )
+    store._resetBitbucketCredentialCache()
+
+    const { resolveBitbucketAuthConfig } = await import('./resolve-auth')
+    expect(resolveBitbucketAuthConfig()).toMatchObject({
+      email: 'ada@example.com',
+      apiToken: 'legacy-token'
+    })
+  })
+
+  it('writes the whole credential even when the filesystem short-writes (STA-3941)', async () => {
+    const store = await loadStore({ shortWrites: true })
+    store.saveBitbucketCredential({
+      authMode: 'basic',
+      email: 'ada@example.com',
+      baseUrl: null,
+      account: 'ada',
+      accessToken: null,
+      apiToken: 'a-token-long-enough-to-need-several-writes'
+    })
+    store._resetBitbucketCredentialCache()
+
+    expect(store.loadStoredBitbucketSecret({ force: true })).toMatchObject({
+      apiToken: 'a-token-long-enough-to-need-several-writes',
+      email: 'ada@example.com'
+    })
+    expect(store.getStoredBitbucketMetadata()?.account).toBe('ada')
+  })
+
+  it('clears both files and in-memory state on disconnect', async () => {
+    const store = await loadStore()
+    store.saveBitbucketCredential({
+      authMode: 'basic',
+      email: 'ada@example.com',
+      baseUrl: null,
+      account: 'ada',
+      accessToken: null,
+      apiToken: 'secret-token'
+    })
+
+    store.clearStoredBitbucketCredential()
+
+    expect(store.hasStoredBitbucketCredential()).toBe(false)
+    expect(store.getStoredBitbucketMetadata()).toBeNull()
+    expect(existsSync(join(tempHome, '.orca', 'bitbucket-credential.enc'))).toBe(false)
+    expect(existsSync(join(tempHome, '.orca', 'bitbucket-credential.json'))).toBe(false)
+  })
+
+  it('surfaces a non-ENOENT delete failure instead of silently keeping the files', async () => {
+    const denied: NodeJS.ErrnoException = Object.assign(new Error('permission denied'), {
+      code: 'EACCES'
+    })
+    const store = await loadStore({ unlinkError: denied })
+    store.saveBitbucketCredential({
+      authMode: 'basic',
+      email: 'ada@example.com',
+      baseUrl: null,
+      account: 'ada',
+      accessToken: null,
+      apiToken: 'secret-token'
+    })
+
+    // Clearing memory while the files survive would resurrect the credential on
+    // the next launch, so the failure has to reach the caller.
+    expect(() => store.clearStoredBitbucketCredential()).toThrow(/permission denied/)
+    expect(existsSync(join(tempHome, '.orca', 'bitbucket-credential.enc'))).toBe(true)
+  })
+
+  it('ignores a missing file on disconnect', async () => {
+    const missing: NodeJS.ErrnoException = Object.assign(new Error('no such file'), {
+      code: 'ENOENT'
+    })
+    const store = await loadStore({ unlinkError: missing })
+    expect(() => store.clearStoredBitbucketCredential()).not.toThrow()
+  })
+})
diff --git a/src/main/bitbucket/credential-store.ts b/src/main/bitbucket/credential-store.ts
new file mode 100644
index 00000000000..4bf4544ae7c
--- /dev/null
+++ b/src/main/bitbucket/credential-store.ts
@@ -0,0 +1,216 @@
+import { existsSync, mkdirSync, readFileSync, unlinkSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import {
+  CredentialDecryptionError,
+  credentialFileHasContent,
+  readStoredCredentialToken,
+  writeCredentialFileAtomic,
+  writeEncryptedCredential
+} from '../integration-credential-file'
+import type { BitbucketAuthMode } from '../../shared/bitbucket-credentials'
+
+// Why: the secret stays encrypted via safeStorage while this metadata stays
+// plaintext, so status reads render the connected account without decrypting —
+// otherwise every Settings open would trigger an OS keychain prompt.
+export type BitbucketStoredMetadata = {
+  version: 1
+  authMode: BitbucketAuthMode
+  email: string | null
+  baseUrl: string | null
+  account: string | null
+  updatedAt: string
+}
+
+// Why (STA-3941): the envelope carries everything auth needs, so a torn write
+// between the two files can only leave stale display metadata — never a new
+// secret paired with an old email that cannot authenticate. Fields are optional
+// because credentials saved before this change hold only the two tokens.
+export type BitbucketStoredSecret = {
+  accessToken: string | null
+  apiToken: string | null
+  authMode?: BitbucketAuthMode
+  email?: string | null
+  baseUrl?: string | null
+}
+
+export type BitbucketCredentialSaveInput = {
+  authMode: BitbucketAuthMode
+  email: string | null
+  baseUrl: string | null
+  account: string | null
+  accessToken: string | null
+  apiToken: string | null
+}
+
+let cachedMetadata: BitbucketStoredMetadata | null = null
+let metadataLoadedFromDisk = false
+let cachedSecret: BitbucketStoredSecret | null = null
+let credentialError: string | null = null
+
+function getOrcaDir(): string {
+  return join(homedir(), '.orca')
+}
+
+function getMetadataPath(): string {
+  return join(getOrcaDir(), 'bitbucket-credential.json')
+}
+
+function getSecretPath(): string {
+  return join(getOrcaDir(), 'bitbucket-credential.enc')
+}
+
+function ensureOrcaDir(): void {
+  const dir = getOrcaDir()
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true })
+  }
+}
+
+// Why: hand-edited or truncated JSON must not put a non-string into an auth
+// header, so every field is narrowed rather than trusted.
+function asOptionalString(value: unknown): string | null {
+  return typeof value === 'string' ? value : null
+}
+
+function readMetadataFromDisk(): BitbucketStoredMetadata | null {
+  const path = getMetadataPath()
+  if (!existsSync(path)) {
+    return null
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8')) as Partial<BitbucketStoredMetadata>
+    if (parsed.authMode !== 'token' && parsed.authMode !== 'basic') {
+      return null
+    }
+    return {
+      version: 1,
+      authMode: parsed.authMode,
+      email: asOptionalString(parsed.email),
+      baseUrl: asOptionalString(parsed.baseUrl),
+      account: asOptionalString(parsed.account),
+      updatedAt: asOptionalString(parsed.updatedAt) ?? ''
+    }
+  } catch {
+    return null
+  }
+}
+
+export function getStoredBitbucketMetadata(): BitbucketStoredMetadata | null {
+  if (!metadataLoadedFromDisk) {
+    cachedMetadata = readMetadataFromDisk()
+    metadataLoadedFromDisk = true
+  }
+  return cachedMetadata
+}
+
+// Cheap "is a credential saved?" check: metadata present and a non-empty secret
+// file. Never decrypts, so it is safe on every status poll.
+export function hasStoredBitbucketCredential(): boolean {
+  return getStoredBitbucketMetadata() !== null && credentialFileHasContent(getSecretPath())
+}
+
+export function getStoredBitbucketCredentialError(): string | null {
+  return credentialError
+}
+
+// Cache-first; only touches the keychain when `force` is set and the secret is
+// not already in memory (mirrors Linear's `loadToken({ force })`). Throws
+// CredentialDecryptionError when ciphertext cannot be decrypted.
+export function loadStoredBitbucketSecret(
+  options: { force?: boolean } = {}
+): BitbucketStoredSecret | null {
+  if (cachedSecret !== null) {
+    return cachedSecret
+  }
+  if (!options.force) {
+    return null
+  }
+  const path = getSecretPath()
+  if (!existsSync(path)) {
+    return null
+  }
+  try {
+    const token = readStoredCredentialToken('Bitbucket', readFileSync(path))
+    if (!token) {
+      return null
+    }
+    const parsed = JSON.parse(token) as Partial<BitbucketStoredSecret>
+    cachedSecret = {
+      accessToken: asOptionalString(parsed.accessToken),
+      apiToken: asOptionalString(parsed.apiToken),
+      ...(parsed.authMode === 'token' || parsed.authMode === 'basic'
+        ? { authMode: parsed.authMode }
+        : {}),
+      email: asOptionalString(parsed.email),
+      baseUrl: asOptionalString(parsed.baseUrl)
+    }
+    credentialError = null
+    return cachedSecret
+  } catch (error) {
+    if (error instanceof CredentialDecryptionError) {
+      credentialError = error.message
+      throw error
+    }
+    return null
+  }
+}
+
+export function saveBitbucketCredential(input: BitbucketCredentialSaveInput): void {
+  ensureOrcaDir()
+  const secret: BitbucketStoredSecret = {
+    accessToken: input.accessToken,
+    apiToken: input.apiToken,
+    authMode: input.authMode,
+    email: input.email,
+    baseUrl: input.baseUrl
+  }
+  writeEncryptedCredential('Bitbucket', getSecretPath(), JSON.stringify(secret))
+  const metadata: BitbucketStoredMetadata = {
+    version: 1,
+    authMode: input.authMode,
+    email: input.email,
+    baseUrl: input.baseUrl,
+    account: input.account,
+    updatedAt: new Date().toISOString()
+  }
+  writeCredentialFileAtomic(
+    getMetadataPath(),
+    Buffer.from(JSON.stringify(metadata, null, 2), 'utf-8')
+  )
+  cachedMetadata = metadata
+  metadataLoadedFromDisk = true
+  cachedSecret = secret
+  credentialError = null
+}
+
+// Why: swallowing a non-ENOENT unlink failure would clear memory while the
+// files survive, so the credential silently returns on the next launch.
+export function clearStoredBitbucketCredential(): void {
+  try {
+    for (const path of [getSecretPath(), getMetadataPath()]) {
+      try {
+        unlinkSync(path)
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+          throw error
+        }
+      }
+    }
+  } finally {
+    // Why: on a partial delete the caches must still be dropped, or the session
+    // keeps authenticating with a credential the user just disconnected.
+    cachedMetadata = null
+    metadataLoadedFromDisk = true
+    cachedSecret = null
+    credentialError = null
+  }
+}
+
+/** @internal - tests need a clean in-memory cache between cases. */
+export function _resetBitbucketCredentialCache(): void {
+  cachedMetadata = null
+  metadataLoadedFromDisk = false
+  cachedSecret = null
+  credentialError = null
+}
diff --git a/src/main/bitbucket/pull-request-creation.test.ts b/src/main/bitbucket/pull-request-creation.test.ts
new file mode 100644
index 00000000000..ab06200e22e
--- /dev/null
+++ b/src/main/bitbucket/pull-request-creation.test.ts
@@ -0,0 +1,180 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  createBitbucketPullRequest,
+  isBitbucketReviewCreationAuthenticated
+} from './pull-request-creation'
+import { _resetBitbucketRepoRefCache } from './repository-ref'
+
+const { gitExecFileAsyncMock, getSshGitProviderMock } = vi.hoisted(() => ({
+  gitExecFileAsyncMock: vi.fn(),
+  getSshGitProviderMock: vi.fn()
+}))
+
+vi.mock('../git/runner', () => ({
+  gitExecFileAsync: gitExecFileAsyncMock
+}))
+
+vi.mock('../providers/ssh-git-dispatch', () => ({
+  getSshGitProvider: getSshGitProviderMock,
+  getSshGitProviderGeneration: () => 0
+}))
+
+vi.mock('../source-control/pull-request-template', () => ({
+  readHostedPullRequestTemplate: vi.fn(async () => 'Template body')
+}))
+
+const OLD_ENV = process.env
+const OLD_FETCH = globalThis.fetch
+
+const CREATE_INPUT = {
+  provider: 'bitbucket',
+  base: 'main',
+  head: 'feature/login',
+  title: 'Add login'
+} as const
+
+function createdPullRequestResponse(): Response {
+  return Response.json({
+    id: 42,
+    title: 'Add login',
+    state: 'OPEN',
+    updated_on: '2026-08-11T00:00:00Z',
+    links: { html: { href: 'https://bitbucket.org/team/repo/pull-requests/42' } },
+    source: { branch: { name: 'feature/login' } },
+    destination: { branch: { name: 'main' } }
+  })
+}
+
+describe('Bitbucket pull request creation', () => {
+  beforeEach(() => {
+    process.env = { ...OLD_ENV, ORCA_BITBUCKET_ACCESS_TOKEN: 'bb-token' }
+    gitExecFileAsyncMock.mockReset()
+    getSshGitProviderMock.mockReset()
+    gitExecFileAsyncMock.mockResolvedValue({
+      stdout: 'https://bitbucket.org/team/repo.git\n',
+      stderr: ''
+    })
+    _resetBitbucketRepoRefCache()
+  })
+
+  afterEach(() => {
+    process.env = OLD_ENV
+    globalThis.fetch = OLD_FETCH
+    _resetBitbucketRepoRefCache()
+  })
+
+  it('posts the Bitbucket source/destination create body to the repository endpoint', async () => {
+    const fetchMock = vi.fn(async (input: string | URL | Request, init?: RequestInit) => {
+      const url = new URL(String(input))
+      expect(url.origin).toBe('https://api.bitbucket.org')
+      expect(url.pathname).toBe('/2.0/repositories/team/repo/pullrequests')
+      const requestInit = init!
+      expect(requestInit.method).toBe('POST')
+      expect((requestInit.headers as Record<string, string>).Authorization).toBe('Bearer bb-token')
+      expect(JSON.parse(String(requestInit.body))).toEqual({
+        title: 'Add login',
+        description: '',
+        source: { branch: { name: 'feature/login' } },
+        destination: { branch: { name: 'main' } }
+      })
+      return createdPullRequestResponse()
+    })
+    globalThis.fetch = fetchMock as unknown as typeof fetch
+
+    await expect(createBitbucketPullRequest('/repo', CREATE_INPUT)).resolves.toEqual({
+      ok: true,
+      number: 42,
+      url: 'https://bitbucket.org/team/repo/pull-requests/42'
+    })
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('uses the stored credential when no environment variable is set', async () => {
+    delete process.env.ORCA_BITBUCKET_ACCESS_TOKEN
+    const fetchMock = vi.fn(async () => createdPullRequestResponse())
+    globalThis.fetch = fetchMock as unknown as typeof fetch
+
+    const result = await createBitbucketPullRequest('/repo', CREATE_INPUT)
+
+    // No env var and no stored credential: fail closed rather than POST anonymously.
+    expect(result).toMatchObject({ ok: false, code: 'auth_required' })
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('ignores a draft request rather than dead-ending a hidden persisted default', async () => {
+    const fetchMock = vi.fn(async () => createdPullRequestResponse())
+    globalThis.fetch = fetchMock as unknown as typeof fetch
+
+    // Why: the composer hides the Draft toggle for Bitbucket, so a `true` here
+    // is an unreachable persisted default the user cannot clear.
+    await expect(
+      createBitbucketPullRequest('/repo', { ...CREATE_INPUT, draft: true })
+    ).resolves.toMatchObject({ ok: true, number: 42 })
+    expect(JSON.parse(String((fetchMock.mock.calls[0] as never[])[1]['body']))).not.toHaveProperty(
+      'draft'
+    )
+  })
+
+  it('reports authenticated only when a credential resolves', async () => {
+    expect(isBitbucketReviewCreationAuthenticated()).toBe(true)
+    delete process.env.ORCA_BITBUCKET_ACCESS_TOKEN
+    expect(isBitbucketReviewCreationAuthenticated()).toBe(false)
+  })
+
+  it('maps a duplicate-branch rejection to already_exists with the existing review', async () => {
+    let call = 0
+    const fetchMock = vi.fn(async () => {
+      call += 1
+      if (call === 1) {
+        return Response.json(
+          { error: { message: 'There is already a pull request for this branch.' } },
+          { status: 400 }
+        )
+      }
+      return Response.json({
+        values: [
+          {
+            id: 7,
+            title: 'Add login',
+            state: 'OPEN',
+            updated_on: '2026-08-11T00:00:00Z',
+            links: { html: { href: 'https://bitbucket.org/team/repo/pull-requests/7' } },
+            source: { branch: { name: 'feature/login' } },
+            destination: { branch: { name: 'main' } }
+          }
+        ]
+      })
+    })
+    globalThis.fetch = fetchMock as unknown as typeof fetch
+
+    expect(await createBitbucketPullRequest('/repo', CREATE_INPUT)).toMatchObject({
+      ok: false,
+      code: 'already_exists',
+      existingReview: { number: 7, url: 'https://bitbucket.org/team/repo/pull-requests/7' }
+    })
+  })
+
+  it('maps a 401 to auth_required pointing at both credential paths', async () => {
+    globalThis.fetch = vi.fn(async () =>
+      Response.json({ error: { message: 'Unauthorized' } }, { status: 401 })
+    ) as unknown as typeof fetch
+
+    const result = await createBitbucketPullRequest('/repo', CREATE_INPUT)
+
+    expect(result).toMatchObject({ ok: false, code: 'auth_required' })
+    expect(!result.ok && result.error).toContain('Settings')
+  })
+
+  it('refuses a non-Bitbucket remote', async () => {
+    gitExecFileAsyncMock.mockResolvedValue({
+      stdout: 'https://github.com/team/repo.git\n',
+      stderr: ''
+    })
+    globalThis.fetch = vi.fn() as unknown as typeof fetch
+
+    await expect(createBitbucketPullRequest('/repo', CREATE_INPUT)).resolves.toMatchObject({
+      ok: false,
+      code: 'unsupported_provider'
+    })
+  })
+})
diff --git a/src/main/bitbucket/pull-request-creation.ts b/src/main/bitbucket/pull-request-creation.ts
new file mode 100644
index 00000000000..3d5e11f8392
--- /dev/null
+++ b/src/main/bitbucket/pull-request-creation.ts
@@ -0,0 +1,226 @@
+import type { CreateHostedReviewInput, CreateHostedReviewResult } from '../../shared/hosted-review'
+import {
+  normalizeHostedReviewBaseRef,
+  normalizeHostedReviewHeadRef
+} from '../../shared/hosted-review-refs'
+import {
+  HostedReviewApiRequestError,
+  requestHostedReviewJson
+} from '../source-control/hosted-review-api-request'
+import { readHostedPullRequestTemplate } from '../source-control/pull-request-template'
+import { authHeaders, getEnvAuthConfig, hasAuth } from './bitbucket-auth-config'
+import { resolveBitbucketAuthConfig } from './resolve-auth'
+import { hasStoredBitbucketCredential } from './credential-store'
+import { getBitbucketPullRequestForBranch } from './client'
+import { mapBitbucketPullRequest, type RawBitbucketPullRequest } from './pull-request-mappers'
+import { getBitbucketRepoRef, type BitbucketRepoRef } from './repository-ref'
+import type { HostedReviewExecutionOptions } from '../source-control/hosted-review-git-options'
+import { getHostedReviewLocalGitOptions } from '../source-control/hosted-review-git-options'
+
+const CREATE_REQUEST_TIMEOUT_MS = 60_000
+
+// Why: eligibility is evaluated proactively for the sidebar, so this must not
+// decrypt — forcing the secret open here would pop an OS keychain prompt just
+// from opening a worktree. Presence is enough; the create call itself still
+// fails closed if the credential turns out to be unusable.
+export function isBitbucketReviewCreationAuthenticated(): boolean {
+  return hasAuth(getEnvAuthConfig()) || hasStoredBitbucketCredential()
+}
+
+function encodedRepoPath(repo: BitbucketRepoRef): string {
+  return `${encodeURIComponent(repo.workspace)}/${encodeURIComponent(repo.repoSlug)}`
+}
+
+function apiErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
+
+function classifyCreateError(error: unknown): CreateHostedReviewResult {
+  const message = apiErrorMessage(error)
+  if (message) {
+    console.warn('createBitbucketPullRequest failed:', message)
+  }
+  const lower = message.toLowerCase()
+  const status = error instanceof HostedReviewApiRequestError ? error.status : null
+  if (status === 401 || status === 403 || lower.includes('unauthorized')) {
+    return {
+      ok: false,
+      code: 'auth_required',
+      error:
+        'Create PR failed: Bitbucket is not authenticated. Next step: connect Bitbucket in Settings > Integrations, or set ORCA_BITBUCKET_* in this environment.'
+    }
+  }
+  // Bitbucket answers a duplicate source branch with 400 plus this phrasing
+  // rather than a 409, so the text is the only reliable signal.
+  if (lower.includes('already exists') || lower.includes('already a pull request')) {
+    return {
+      ok: false,
+      code: 'already_exists',
+      error: 'A pull request already exists for this branch.'
+    }
+  }
+  if (error instanceof HostedReviewApiRequestError && error.timedOut) {
+    return {
+      ok: false,
+      code: 'unknown_completion',
+      error: 'PR creation may have completed. Refreshing branch review state...'
+    }
+  }
+  if (status === 400 || status === 422) {
+    return {
+      ok: false,
+      code: 'validation',
+      error:
+        'Create PR failed: Bitbucket rejected the pull request. Check the base branch and branch state, then try again.'
+    }
+  }
+  if (status === 404) {
+    return {
+      ok: false,
+      code: 'validation',
+      error:
+        'Create PR failed: Bitbucket could not find the repository. Check that the credential has write access to it.'
+    }
+  }
+  return {
+    ok: false,
+    code: 'unknown',
+    error: 'Create PR failed: Bitbucket could not create the pull request. Try again in a moment.'
+  }
+}
+
+async function findExistingPullRequest(
+  repoPath: string,
+  head: string,
+  connectionId?: string | null,
+  options: HostedReviewExecutionOptions = {}
+): Promise<{ number: number; url: string } | null> {
+  const existing = await getBitbucketPullRequestForBranch(
+    repoPath,
+    head,
+    null,
+    connectionId,
+    options
+  )
+  return existing ? { number: existing.number, url: existing.url } : null
+}
+
+export async function createBitbucketPullRequest(
+  repoPath: string,
+  input: CreateHostedReviewInput,
+  connectionId?: string | null,
+  options: HostedReviewExecutionOptions = {}
+): Promise<CreateHostedReviewResult> {
+  if (input.provider !== 'bitbucket') {
+    return {
+      ok: false,
+      code: 'unsupported_provider',
+      error: 'Creating reviews for this provider is not supported yet.'
+    }
+  }
+
+  const config = resolveBitbucketAuthConfig()
+  if (!hasAuth(config)) {
+    return {
+      ok: false,
+      code: 'auth_required',
+      error:
+        'Create PR failed: Bitbucket is not connected. Next step: connect Bitbucket in Settings > Integrations.'
+    }
+  }
+
+  const repo = await getBitbucketRepoRef(
+    repoPath,
+    connectionId,
+    getHostedReviewLocalGitOptions(options)
+  )
+  if (!repo) {
+    return {
+      ok: false,
+      code: 'unsupported_provider',
+      error: 'Creating pull requests requires a Bitbucket remote.'
+    }
+  }
+
+  const base = normalizeHostedReviewBaseRef(input.base)
+  const head = input.head ? normalizeHostedReviewHeadRef(input.head) : ''
+  const title = input.title.trim()
+  if (!base || !head || !title) {
+    return {
+      ok: false,
+      code: 'validation',
+      error: 'Create PR failed: base branch, head branch, and title are required.'
+    }
+  }
+  if (head.toLowerCase() === base.toLowerCase()) {
+    return {
+      ok: false,
+      code: 'validation',
+      error: 'Create PR failed: choose a different base branch before creating a pull request.'
+    }
+  }
+  // Why: Bitbucket Cloud has no draft pull requests and the composer hides the
+  // toggle, so `draft` here can only be an unreachable persisted default —
+  // rejecting it would dead-end the user with no control to clear.
+  const description =
+    input.useTemplate && !input.body?.trim()
+      ? await readHostedPullRequestTemplate(repoPath, connectionId)
+      : (input.body ?? '')
+  const requestBody = {
+    title,
+    description,
+    source: { branch: { name: head } },
+    destination: { branch: { name: base } }
+  }
+
+  try {
+    const raw = await requestHostedReviewJson<RawBitbucketPullRequest>(
+      new URL(
+        `${config.baseUrl.replace(/\/+$/, '')}/repositories/${encodedRepoPath(repo)}/pullrequests`
+      ),
+      {
+        method: 'POST',
+        headers: {
+          Accept: 'application/json',
+          'Content-Type': 'application/json',
+          ...authHeaders(config)
+        },
+        body: JSON.stringify(requestBody)
+      },
+      CREATE_REQUEST_TIMEOUT_MS
+    )
+    const created = mapBitbucketPullRequest(raw, 'neutral')
+    if (created) {
+      return { ok: true, number: created.number, url: created.url }
+    }
+    const found = await findExistingPullRequest(repoPath, head, connectionId, options).catch(
+      () => null
+    )
+    return found
+      ? { ok: true, ...found }
+      : {
+          ok: false,
+          code: 'unknown_completion',
+          error: 'PR creation may have completed. Refreshing branch review state...'
+        }
+  } catch (error) {
+    const classified = classifyCreateError(error)
+    if (
+      !classified.ok &&
+      (classified.code === 'already_exists' || classified.code === 'unknown_completion')
+    ) {
+      const existing = await findExistingPullRequest(repoPath, head, connectionId, options).catch(
+        () => null
+      )
+      if (existing) {
+        return {
+          ok: false,
+          code: 'already_exists',
+          error: 'A pull request already exists for this branch.',
+          existingReview: existing
+        }
+      }
+    }
+    return classified
+  }
+}
diff --git a/src/main/bitbucket/resolve-auth.ts b/src/main/bitbucket/resolve-auth.ts
new file mode 100644
index 00000000000..4a90f22780e
--- /dev/null
+++ b/src/main/bitbucket/resolve-auth.ts
@@ -0,0 +1,53 @@
+import {
+  DEFAULT_API_BASE_URL,
+  envValue,
+  getEnvAuthConfig,
+  hasAuth,
+  type BitbucketAuthConfig
+} from './bitbucket-auth-config'
+import {
+  getStoredBitbucketMetadata,
+  loadStoredBitbucketSecret,
+  type BitbucketStoredMetadata,
+  type BitbucketStoredSecret
+} from './credential-store'
+
+/**
+ * Why (STA-3941): the encrypted envelope is authoritative for auth. Plaintext
+ * metadata is only consulted for credentials written before the envelope
+ * carried these fields, so a torn write between the two files degrades to stale
+ * display data rather than a secret paired with the wrong email.
+ */
+export function storedAuthConfig(
+  metadata: BitbucketStoredMetadata | null,
+  secret: BitbucketStoredSecret
+): BitbucketAuthConfig {
+  const authMode = secret.authMode ?? metadata?.authMode ?? null
+  const email = secret.authMode ? (secret.email ?? null) : (metadata?.email ?? null)
+  const baseUrl = secret.authMode ? (secret.baseUrl ?? null) : (metadata?.baseUrl ?? null)
+  return {
+    // Why: an explicit ORCA_BITBUCKET_API_BASE_URL still wins even when the
+    // credential itself is stored — env precedence is per-setting, not all-or-nothing.
+    baseUrl: envValue('ORCA_BITBUCKET_API_BASE_URL') ?? baseUrl ?? DEFAULT_API_BASE_URL,
+    accessToken: authMode === 'token' ? secret.accessToken : null,
+    email: authMode === 'basic' ? email : null,
+    apiToken: authMode === 'basic' ? secret.apiToken : null
+  }
+}
+
+// Env vars win over in-app credentials so existing headless/SSH setups keep
+// working unchanged. The stored secret is decrypted lazily and only here, on a
+// real API call — never on a status read.
+export function resolveBitbucketAuthConfig(): BitbucketAuthConfig {
+  const env = getEnvAuthConfig()
+  if (hasAuth(env)) {
+    return env
+  }
+  try {
+    const secret = loadStoredBitbucketSecret({ force: true })
+    return secret ? storedAuthConfig(getStoredBitbucketMetadata(), secret) : env
+  } catch {
+    // Decryption denied or unavailable: fall through as unauthenticated.
+    return env
+  }
+}
diff --git a/src/main/bitbucket/status-no-decrypt.test.ts b/src/main/bitbucket/status-no-decrypt.test.ts
new file mode 100644
index 00000000000..946f1aea4aa
--- /dev/null
+++ b/src/main/bitbucket/status-no-decrypt.test.ts
@@ -0,0 +1,127 @@
+import { mkdtempSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import type * as Os from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+// Why: opening Settings renders the Bitbucket card, which runs the preflight
+// status (getBitbucketAuthStatus) and the card's status IPC
+// (getBitbucketConnectionStatus). Neither may decrypt the stored secret, or the
+// OS would prompt to unlock the keychain on every Settings open. These tests
+// simulate a cold session (files on disk, memory cache empty).
+
+const decryptSpy = vi.fn((value: Buffer) => value.toString('utf-8'))
+const OLD_ENV = process.env
+const OLD_FETCH = globalThis.fetch
+let tempHome = ''
+
+vi.mock('../git/runner', () => ({ gitExecFileAsync: vi.fn() }))
+
+async function loadModules() {
+  vi.resetModules()
+  vi.doMock('electron', () => ({
+    safeStorage: {
+      isEncryptionAvailable: () => true,
+      encryptString: (value: string) => Buffer.from(value),
+      decryptString: decryptSpy
+    }
+  }))
+  vi.doMock('node:os', async () => {
+    const actual = await vi.importActual<typeof Os>('node:os')
+    return { ...actual, homedir: () => tempHome }
+  })
+  // Stub repo detection so the PR fetch reaches the auth-resolution path.
+  vi.doMock('./repository-ref', () => ({
+    getBitbucketRepoRef: async () => ({ workspace: 'acme', repoSlug: 'app' })
+  }))
+  const store = await import('./credential-store')
+  const client = await import('./client')
+  const connection = await import('./credential-connection')
+  return { store, client, connection }
+}
+
+beforeEach(() => {
+  process.env = { ...OLD_ENV }
+  for (const key of [
+    'ORCA_BITBUCKET_ACCESS_TOKEN',
+    'ORCA_BITBUCKET_EMAIL',
+    'ORCA_BITBUCKET_API_TOKEN',
+    'ORCA_BITBUCKET_API_BASE_URL'
+  ]) {
+    delete process.env[key]
+  }
+  tempHome = mkdtempSync(join(tmpdir(), 'orca-bb-nodecrypt-'))
+  decryptSpy.mockClear()
+})
+
+afterEach(() => {
+  process.env = OLD_ENV
+  globalThis.fetch = OLD_FETCH
+})
+
+const STORED_BASIC_CREDENTIAL = {
+  authMode: 'basic',
+  email: 'ada@example.com',
+  baseUrl: null,
+  account: 'ada',
+  accessToken: null,
+  apiToken: 'secret-token'
+} as const
+
+describe('Bitbucket status reads never decrypt the stored secret', () => {
+  it('renders connected state from plaintext metadata without touching the keychain', async () => {
+    const { store, client, connection } = await loadModules()
+    const fetchSpy = vi.fn()
+    globalThis.fetch = fetchSpy as unknown as typeof fetch
+    store.saveBitbucketCredential(STORED_BASIC_CREDENTIAL)
+
+    // Simulate relaunch: secret is on disk but the memory cache is cold, so a
+    // decrypt here would surface to the user as a keychain prompt.
+    store._resetBitbucketCredentialCache()
+    decryptSpy.mockClear()
+
+    const auth = await client.getBitbucketAuthStatus()
+    const status = connection.getBitbucketConnectionStatus()
+
+    expect(auth).toEqual({ configured: true, authenticated: true, account: 'ada' })
+    expect(status).toMatchObject({ source: 'stored', account: 'ada', authMode: 'basic' })
+    expect(decryptSpy).not.toHaveBeenCalled()
+    // A stored credential is trusted from metadata rather than revalidated.
+    expect(fetchSpy).not.toHaveBeenCalled()
+  })
+
+  it('stays cold across repeated status reads, then decrypts once for a real API call', async () => {
+    const { store, client, connection } = await loadModules()
+    store.saveBitbucketCredential(STORED_BASIC_CREDENTIAL)
+    store._resetBitbucketCredentialCache()
+    decryptSpy.mockClear()
+
+    for (let i = 0; i < 3; i += 1) {
+      await client.getBitbucketAuthStatus()
+      connection.getBitbucketConnectionStatus()
+    }
+    expect(decryptSpy).not.toHaveBeenCalled()
+
+    globalThis.fetch = vi.fn(async () => Response.json({ values: [] })) as unknown as typeof fetch
+    await client.getBitbucketPullRequest('/repo', 1, null)
+    expect(decryptSpy).toHaveBeenCalledTimes(1)
+  })
+
+  it('revalidates a stored credential once its secret is already warm in memory', async () => {
+    const { store, client } = await loadModules()
+    store.saveBitbucketCredential(STORED_BASIC_CREDENTIAL)
+    decryptSpy.mockClear()
+
+    // Saving leaves the secret cached, so status can check /user for free.
+    const fetchSpy = vi.fn(async () => new Response(null, { status: 401 }))
+    globalThis.fetch = fetchSpy as unknown as typeof fetch
+
+    await expect(client.getBitbucketAuthStatus()).resolves.toEqual({
+      configured: true,
+      authenticated: false,
+      account: 'ada'
+    })
+    expect(fetchSpy).toHaveBeenCalledTimes(1)
+    expect(decryptSpy).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/bitbucket/user-request.ts b/src/main/bitbucket/user-request.ts
new file mode 100644
index 00000000000..bc9d344e5ca
--- /dev/null
+++ b/src/main/bitbucket/user-request.ts
@@ -0,0 +1,65 @@
+import { authHeaders, type BitbucketAuthConfig } from './bitbucket-auth-config'
+import { cancelUnreadResponseBody } from '../lib/unread-response-body'
+
+const USER_REQUEST_TIMEOUT_MS = 4000
+
+export type RawBitbucketUser = {
+  username?: string | null
+  display_name?: string | null
+  account_id?: string | null
+}
+
+/**
+ * Why (STA-3944): a timeout, DNS failure, 5xx, or unparseable body says nothing
+ * about the credential. Collapsing those to the same miss as a 401 told users
+ * their token was invalid when the network was simply unreachable.
+ */
+export type BitbucketUserResult =
+  | { ok: true; user: RawBitbucketUser }
+  | { ok: false; reason: 'rejected' | 'unreachable' }
+
+export function accountNameFromUser(user: RawBitbucketUser | null): string | null {
+  return user?.username ?? user?.display_name ?? user?.account_id ?? null
+}
+
+// Shared by live env-var status checks and by connect-time verification, so a
+// credential is proven against `/user` before it is ever persisted.
+export async function fetchBitbucketUserResult(
+  config: BitbucketAuthConfig,
+  timeoutMs: number = USER_REQUEST_TIMEOUT_MS
+): Promise<BitbucketUserResult> {
+  let response: Response
+  try {
+    const base = config.baseUrl.replace(/\/+$/, '')
+    response = await fetch(`${base}/user`, {
+      headers: {
+        Accept: 'application/json',
+        ...authHeaders(config)
+      },
+      signal: AbortSignal.timeout(timeoutMs)
+    })
+  } catch {
+    return { ok: false, reason: 'unreachable' }
+  }
+  if (!response.ok) {
+    await cancelUnreadResponseBody(response)
+    // Only the credential-bearing statuses are the credential's fault; 5xx and
+    // the rest are the server or the path in between.
+    const rejected = response.status === 401 || response.status === 403
+    return { ok: false, reason: rejected ? 'rejected' : 'unreachable' }
+  }
+  try {
+    return { ok: true, user: (await response.json()) as RawBitbucketUser }
+  } catch {
+    return { ok: false, reason: 'unreachable' }
+  }
+}
+
+/** Convenience for callers that only need the account, not the failure reason. */
+export async function fetchBitbucketUser(
+  config: BitbucketAuthConfig,
+  timeoutMs: number = USER_REQUEST_TIMEOUT_MS
+): Promise<RawBitbucketUser | null> {
+  const result = await fetchBitbucketUserResult(config, timeoutMs)
+  return result.ok ? result.user : null
+}
diff --git a/src/main/browser/agent-browser-bridge.test.ts b/src/main/browser/agent-browser-bridge.test.ts
index b9f5a9bd92d..125949f3a50 100644
--- a/src/main/browser/agent-browser-bridge.test.ts
+++ b/src/main/browser/agent-browser-bridge.test.ts
@@ -74,8 +74,8 @@ type ExecFileCallback = (error: unknown, stdout?: string, stderr?: string) => vo
 }
 
 function mockBrowserManager(
-  tabs: Map<string, number> = new Map([['tab-1', 100]]),
-  worktrees: Map<string, string> = new Map(),
+  tabs = new Map<string, number>([['tab-1', 100]]),
+  worktrees = new Map<string, string>(),
   overrides: Partial<BrowserManager> = {}
 ): BrowserManager {
   return {
diff --git a/src/main/browser/browser-cookie-import-google-exclusion.test.ts b/src/main/browser/browser-cookie-import-google-exclusion.test.ts
new file mode 100644
index 00000000000..d1e13737b1d
--- /dev/null
+++ b/src/main/browser/browser-cookie-import-google-exclusion.test.ts
@@ -0,0 +1,320 @@
+/**
+ * STA-3811: an import must never write and never remove a google.com-family cookie, on any
+ * path. Removing 'google.com' from NON_TRANSPLANTABLE_DOMAINS flips every test here red.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  appGetPathMock,
+  clearPendingCookieImportMock,
+  execFileSyncMock,
+  sessionFromPartitionMock,
+  setPendingCookieImportMock
+} = vi.hoisted(() => ({
+  appGetPathMock: vi.fn(),
+  clearPendingCookieImportMock: vi.fn(),
+  execFileSyncMock: vi.fn(),
+  sessionFromPartitionMock: vi.fn(),
+  setPendingCookieImportMock: vi.fn()
+}))
+
+vi.mock('./browser-session-registry', () => ({
+  browserSessionRegistry: {
+    setPendingCookieImport: setPendingCookieImportMock,
+    clearPendingCookieImport: clearPendingCookieImportMock
+  }
+}))
+vi.mock('node:child_process', () => ({ execFileSync: execFileSyncMock }))
+vi.mock('electron', () => ({
+  app: { getPath: appGetPathMock },
+  dialog: { showOpenDialog: vi.fn() },
+  session: { fromPartition: sessionFromPartitionMock }
+}))
+
+import { importCookiesFromBrowser, importCookiesFromFile } from './browser-cookie-import'
+import { createChromiumCookieTestDatabase } from './browser-cookie-import-test-database'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { DatabaseSync } from 'node:sqlite'
+
+function existingCookie(domain: string, name: string) {
+  return { domain, name, path: '/', secure: true, sameSite: 'unspecified', value: 'live' }
+}
+
+const INCOMING = [
+  { domain: '.google.com', name: 'SAPISID', value: 'transplanted', secure: true },
+  { domain: 'accounts.google.com', name: '__Secure-1PSID', value: 'transplanted', secure: true },
+  { domain: '.youtube.com', name: 'LOGIN_INFO', value: 'transplanted', secure: true },
+  { domain: '.linear.app', name: 'session', value: 'new', secure: true }
+]
+
+describe('file import excludes the Google cookie family', () => {
+  let cookiesGetMock: ReturnType<typeof vi.fn>
+  let cookiesRemoveMock: ReturnType<typeof vi.fn>
+  let cookiesSetMock: ReturnType<typeof vi.fn>
+  let tmpDir: string
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    tmpDir = mkdtempSync(join(tmpdir(), 'orca-google-exclusion-file-'))
+    cookiesGetMock = vi.fn().mockResolvedValue([])
+    cookiesRemoveMock = vi.fn().mockResolvedValue(undefined)
+    cookiesSetMock = vi.fn().mockResolvedValue(undefined)
+    sessionFromPartitionMock.mockReturnValue({
+      cookies: { get: cookiesGetMock, remove: cookiesRemoveMock, set: cookiesSetMock }
+    })
+  })
+
+  afterEach(() => {
+    rmSync(tmpDir, { recursive: true, force: true })
+  })
+
+  function writeCookies(cookies: unknown[]): string {
+    const filePath = join(tmpDir, 'cookies.json')
+    writeFileSync(filePath, JSON.stringify(cookies))
+    return filePath
+  }
+
+  it('writes no Google cookie and removes none, whatever is already in the jar', async () => {
+    cookiesGetMock.mockResolvedValue([
+      existingCookie('.google.com', 'SID'),
+      existingCookie('accounts.google.com', '__Secure-1PSID'),
+      existingCookie('.linear.app', 'old-linear')
+    ])
+
+    const result = await importCookiesFromFile(writeCookies(INCOMING), 'persist:test')
+
+    expect(result.ok && result.summary).toMatchObject({
+      totalCookies: 4,
+      importedCookies: 2,
+      skippedCookies: 2,
+      googleCookiesSkipped: 2,
+      domains: ['linear.app', 'youtube.com']
+    })
+    expect(cookiesRemoveMock.mock.calls).toEqual([['https://linear.app/', 'old-linear']])
+    expect(cookiesSetMock.mock.calls.map(([details]) => details.domain)).toEqual([
+      '.youtube.com',
+      '.linear.app'
+    ])
+  })
+
+  it('leaves Google cookies from an older import in place too', async () => {
+    cookiesGetMock.mockResolvedValue([existingCookie('.google.com', 'SAPISID')])
+
+    const result = await importCookiesFromFile(
+      writeCookies([{ domain: '.google.com', name: 'SAPISID', value: 'newer', secure: true }]),
+      'persist:test'
+    )
+
+    expect(result.ok && result.summary).toMatchObject({
+      totalCookies: 1,
+      importedCookies: 0,
+      skippedCookies: 1,
+      googleCookiesSkipped: 1,
+      domains: []
+    })
+    expect(cookiesRemoveMock).not.toHaveBeenCalled()
+    expect(cookiesSetMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('native Chromium import excludes the Google cookie family', () => {
+  let clearStorageDataMock: ReturnType<typeof vi.fn>
+  let cookiesGetMock: ReturnType<typeof vi.fn>
+  let cookiesRemoveMock: ReturnType<typeof vi.fn>
+  let cookiesSetMock: ReturnType<typeof vi.fn>
+  let tmpDir: string
+  let platformSpy: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    tmpDir = mkdtempSync(join(tmpdir(), 'orca-google-exclusion-native-'))
+    appGetPathMock.mockReturnValue(join(tmpDir, 'userData'))
+    execFileSyncMock.mockImplementation(() => {
+      throw new Error('OS browser version lookup unavailable')
+    })
+    clearStorageDataMock = vi.fn().mockResolvedValue(undefined)
+    cookiesGetMock = vi.fn().mockResolvedValue([])
+    cookiesRemoveMock = vi.fn().mockResolvedValue(undefined)
+    cookiesSetMock = vi.fn().mockResolvedValue(undefined)
+    sessionFromPartitionMock.mockReturnValue({
+      cookies: {
+        flushStore: vi.fn().mockResolvedValue(undefined),
+        get: cookiesGetMock,
+        remove: cookiesRemoveMock,
+        set: cookiesSetMock
+      },
+      clearStorageData: clearStorageDataMock
+    })
+    platformSpy = vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+  })
+
+  afterEach(() => {
+    platformSpy.mockRestore()
+    rmSync(tmpDir, { recursive: true, force: true })
+  })
+
+  function seedSource(rows: { domain: string; name: string; value: string }[]): string {
+    const sourceCookiesPath = join(tmpDir, 'Chrome', 'Default', 'Network', 'Cookies')
+    createChromiumCookieTestDatabase(sourceCookiesPath, rows).close()
+    return sourceCookiesPath
+  }
+
+  function seedTarget(rows: { domain: string; name: string; value: string }[]): void {
+    const targetCookiesPath = join(tmpDir, 'userData', 'Partitions', 'test', 'Network', 'Cookies')
+    createChromiumCookieTestDatabase(targetCookiesPath, rows).close()
+  }
+
+  it('never clears or reconstructs live Google cookies before importing', async () => {
+    const sourceCookiesPath = seedSource([
+      { domain: '.google.com', name: 'SID', value: 'transplanted-sid' },
+      { domain: '.example.com', name: 'session', value: 'new' }
+    ])
+    seedTarget([{ domain: '.google.com', name: 'SID', value: 'live-sid' }])
+    cookiesGetMock.mockResolvedValue([
+      existingCookie('.google.com', 'SID'),
+      existingCookie('.example.com', 'stale')
+    ])
+
+    const result = await importCookiesFromBrowser(chromeBrowser(sourceCookiesPath), 'persist:test')
+
+    expect(result.ok && result.summary).toMatchObject({
+      totalCookies: 2,
+      importedCookies: 1,
+      skippedCookies: 1,
+      googleCookiesSkipped: 1,
+      domains: ['example.com']
+    })
+    expect(clearStorageDataMock).not.toHaveBeenCalled()
+    expect(cookiesRemoveMock).toHaveBeenCalledOnce()
+    expect(cookiesRemoveMock).toHaveBeenCalledWith('https://example.com/', 'stale')
+    expect(cookiesSetMock.mock.calls.map(([details]) => details.domain)).toEqual(['.example.com'])
+  })
+
+  it('reports an excluded Google row even when its encrypted value is invalid', async () => {
+    const sourceCookiesPath = join(tmpDir, 'Chrome', 'Default', 'Network', 'Cookies')
+    createChromiumCookieTestDatabase(sourceCookiesPath, [
+      {
+        domain: '.google.com',
+        name: 'SID',
+        value: '',
+        encryptedValue: Buffer.from('v10-invalid')
+      },
+      { domain: '.example.com', name: 'session', value: 'new' }
+    ]).close()
+    seedTarget([])
+
+    const result = await importCookiesFromBrowser(chromeBrowser(sourceCookiesPath), 'persist:test')
+
+    expect(result.ok && result.summary).toMatchObject({
+      totalCookies: 2,
+      importedCookies: 1,
+      skippedCookies: 1,
+      googleCookiesSkipped: 1
+    })
+    expect(execFileSyncMock).not.toHaveBeenCalled()
+    expect(cookiesSetMock.mock.calls.map(([details]) => details.name)).toEqual(['session'])
+  })
+
+  it('does not request an encryption key for excluded Google rows', async () => {
+    const sourceCookiesPath = join(tmpDir, 'Chrome', 'Default', 'Network', 'Cookies')
+    createChromiumCookieTestDatabase(sourceCookiesPath, [
+      {
+        domain: '.google.com',
+        name: 'SID',
+        value: '',
+        encryptedValue: Buffer.from('v10-invalid')
+      }
+    ]).close()
+    seedTarget([])
+
+    const result = await importCookiesFromBrowser(chromeBrowser(sourceCookiesPath), 'persist:test')
+
+    expect(result.ok && result.summary).toEqual({
+      totalCookies: 1,
+      importedCookies: 0,
+      skippedCookies: 1,
+      googleCookiesSkipped: 1,
+      domains: []
+    })
+    expect(execFileSyncMock).not.toHaveBeenCalled()
+    expect(clearStorageDataMock).not.toHaveBeenCalled()
+    expect(cookiesSetMock).not.toHaveBeenCalled()
+  })
+
+  it('keeps the live Google rows in the staged restart-fallback database', async () => {
+    const sourceCookiesPath = seedSource([
+      { domain: '.google.com', name: 'SID', value: 'transplanted-sid' },
+      { domain: '.example.com', name: 'session', value: 'new' }
+    ])
+    seedTarget([
+      { domain: '.google.com', name: 'SID', value: 'live-sid' },
+      { domain: '.example.com', name: 'stale', value: 'stale' }
+    ])
+    // Why: a rejected set() forces the staged DB to be kept for cold-restart replay.
+    cookiesSetMock.mockRejectedValue(new Error('cookie rejected'))
+
+    const result = await importCookiesFromBrowser(chromeBrowser(sourceCookiesPath), 'persist:test')
+
+    expect(result.ok).toBe(true)
+    expect(setPendingCookieImportMock).toHaveBeenCalledTimes(1)
+    const [partition, stagedPath] = setPendingCookieImportMock.mock.calls[0]
+    expect(partition).toBe('persist:test')
+    expect(readStagedRows(stagedPath)).toEqual([
+      { host_key: '.example.com', name: 'session', value: 'new' },
+      { host_key: '.google.com', name: 'SID', value: 'live-sid' }
+    ])
+  })
+
+  it('fails the import without reconstructing Google cookies when selective removal rejects', async () => {
+    const sourceCookiesPath = seedSource([
+      { domain: '.example.com', name: 'session', value: 'new' }
+    ])
+    seedTarget([{ domain: '.example.com', name: 'stale', value: 'stale' }])
+    cookiesGetMock.mockResolvedValue([
+      existingCookie('.google.com', 'SID'),
+      existingCookie('.example.com', 'removed-first'),
+      existingCookie('.other.test', 'stale')
+    ])
+    cookiesRemoveMock.mockImplementation(async (_url: string, name: string) => {
+      if (name === 'stale') {
+        throw new Error('cookie store unavailable')
+      }
+    })
+
+    const result = await importCookiesFromBrowser(chromeBrowser(sourceCookiesPath), 'persist:test')
+
+    expect(result).toMatchObject({ ok: false })
+    expect(result.ok || result.reason).toContain('Could not clear existing cookies')
+    expect(clearStorageDataMock).not.toHaveBeenCalled()
+    expect(cookiesRemoveMock.mock.calls.map(([, name]) => name)).toEqual(['removed-first', 'stale'])
+    expect(cookiesSetMock.mock.calls.map(([details]) => details.name)).toEqual(['removed-first'])
+    expect(setPendingCookieImportMock).not.toHaveBeenCalled()
+  })
+})
+
+// Why: freshly imported rows store the decrypted value as a BLOB; read both forms as text.
+function readStagedRows(stagedPath: string): { host_key: string; name: string; value: string }[] {
+  const stagedDb = new DatabaseSync(stagedPath, { readOnly: true })
+  const rows = stagedDb
+    .prepare('SELECT host_key, name, value FROM cookies ORDER BY host_key, name')
+    .all() as { host_key: string; name: string; value: string | Uint8Array }[]
+  stagedDb.close()
+  return rows.map((row) => ({
+    ...row,
+    value: typeof row.value === 'string' ? row.value : Buffer.from(row.value).toString('latin1')
+  }))
+}
+
+function chromeBrowser(cookiesPath: string) {
+  return {
+    family: 'chrome' as const,
+    label: 'Google Chrome',
+    cookiesPath,
+    keychainService: 'Chrome Safe Storage',
+    keychainAccount: 'Chrome',
+    profiles: [{ name: 'Default', directory: 'Default' }],
+    selectedProfile: 'Default'
+  }
+}
diff --git a/src/main/browser/browser-cookie-import-partition.electron.test.ts b/src/main/browser/browser-cookie-import-partition.electron.test.ts
new file mode 100644
index 00000000000..494ebbd9e2b
--- /dev/null
+++ b/src/main/browser/browser-cookie-import-partition.electron.test.ts
@@ -0,0 +1,194 @@
+import { spawnSync } from 'node:child_process'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, describe, expect, it } from 'vitest'
+import { build as buildVite } from 'vite'
+import { createChromiumCookieTestDatabase } from './browser-cookie-import-test-database'
+
+const electronBinary = createRequire(import.meta.url)('electron') as string
+const fixtureRoots: string[] = []
+
+afterAll(() => {
+  for (const root of fixtureRoots) {
+    rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 })
+  }
+})
+
+type FixtureResult = {
+  before: Record<string, unknown>
+  after: Record<string, unknown>
+  electronCookieKeys: string[]
+  importResult: Record<string, unknown>
+  remainingNames: string[]
+}
+
+function buildFixtureMain(
+  importPath: string,
+  resultPath: string,
+  sourceCookiesPath: string
+): string {
+  return `
+const { app, BrowserWindow, session } = require('electron')
+const { writeFileSync } = require('node:fs')
+const { importCookiesFromBrowser } = require(${JSON.stringify(importPath)})
+const resultPath = ${JSON.stringify(resultPath)}
+let currentStep = 'starting'
+const mark = (step) => {
+  currentStep = step
+  writeFileSync(resultPath, JSON.stringify({ step }))
+}
+
+async function run() {
+  const timeout = setTimeout(() => {
+    writeFileSync(resultPath, JSON.stringify({ step: 'timed out after ' + currentStep }))
+    app.exit(1)
+  }, 15000)
+  await app.whenReady()
+  mark('ready')
+  const partition = 'persist:partition-cookie-test'
+  const targetSession = session.fromPartition(partition)
+  const window = new BrowserWindow({ show: false, webPreferences: { partition } })
+  mark('window created')
+  await window.loadURL('data:text/html,<title>cookie fixture</title>')
+  mark('window loaded')
+  const debug = window.webContents.debugger
+  debug.attach('1.3')
+  mark('debugger attached')
+  await debug.sendCommand('Network.enable')
+  mark('network enabled')
+  await debug.sendCommand('Network.setCookie', {
+    url: 'https://accounts.google.com/',
+    name: 'partitioned-google',
+    value: 'live-value',
+    secure: true,
+    httpOnly: true,
+    sameSite: 'None',
+    partitionKey: { topLevelSite: 'https://example.com', hasCrossSiteAncestor: true }
+  })
+  mark('partitioned cookie set')
+  await targetSession.cookies.set({
+    url: 'https://stale.example/',
+    name: 'stale',
+    value: 'remove-me',
+    secure: true
+  })
+  mark('ordinary cookie set')
+
+  const beforeCookies = (await debug.sendCommand('Network.getAllCookies')).cookies
+  const before = beforeCookies.find((cookie) => cookie.name === 'partitioned-google')
+  const electronCookie = (await targetSession.cookies.get({ name: 'partitioned-google' }))[0]
+  if (!before || !electronCookie) throw new Error('Partitioned fixture cookie was not created')
+  mark('cookies read')
+
+  const importResult = await importCookiesFromBrowser({
+    family: 'chrome',
+    label: 'Chromium fixture',
+    cookiesPath: ${JSON.stringify(sourceCookiesPath)},
+    profiles: [{ name: 'Default', directory: 'Default' }],
+    selectedProfile: 'Default'
+  }, partition)
+  if (!importResult.ok) throw new Error('Native import failed: ' + importResult.reason)
+  mark('native import complete')
+
+  const afterCookies = (await debug.sendCommand('Network.getAllCookies')).cookies
+  const after = afterCookies.find((cookie) => cookie.name === 'partitioned-google')
+  if (!after) throw new Error('Partitioned Google cookie was removed')
+  clearTimeout(timeout)
+  writeFileSync(resultPath, JSON.stringify({
+    before,
+    after,
+    electronCookieKeys: Object.keys(electronCookie).sort(),
+    importResult,
+    remainingNames: afterCookies.map((cookie) => cookie.name).sort()
+  }))
+  debug.detach()
+  window.destroy()
+  app.exit(0)
+}
+
+run().catch((error) => {
+  writeFileSync(resultPath, JSON.stringify({ step: currentStep, error: String(error?.stack || error) }))
+  app.exit(1)
+})
+`
+}
+
+async function runFixture(): Promise<FixtureResult> {
+  const root = mkdtempSync(join(tmpdir(), 'orca-partition-cookie-'))
+  fixtureRoots.push(root)
+  const importPath = join(root, 'browser-cookie-import.cjs')
+  const registryStubPath = join(root, 'browser-session-registry.cjs')
+  const resultPath = join(root, 'result.json')
+  const sourceCookiesPath = join(root, 'source', 'Network', 'Cookies')
+  const fixturePath = join(root, 'main.cjs')
+  createChromiumCookieTestDatabase(sourceCookiesPath, [
+    { domain: '.example.com', name: 'imported', value: 'new-value' }
+  ]).close()
+  writeFileSync(
+    registryStubPath,
+    'exports.browserSessionRegistry = { clearPendingCookieImport() {}, setPendingCookieImport() {} }\n'
+  )
+  await buildVite({
+    configFile: false,
+    logLevel: 'silent',
+    plugins: [
+      {
+        name: 'stub-browser-session-registry',
+        resolveId(source, importer) {
+          return source === './browser-session-registry' &&
+            importer?.endsWith('browser-cookie-import.ts')
+            ? registryStubPath
+            : null
+        }
+      }
+    ],
+    build: {
+      emptyOutDir: false,
+      lib: {
+        entry: join(process.cwd(), 'src/main/browser/browser-cookie-import.ts'),
+        formats: ['cjs'],
+        fileName: () => 'browser-cookie-import.cjs'
+      },
+      outDir: root,
+      target: 'node20',
+      rollupOptions: { external: ['electron', /^node:/] }
+    }
+  })
+  writeFileSync(fixturePath, buildFixtureMain(importPath, resultPath, sourceCookiesPath))
+  const { ELECTRON_RUN_AS_NODE: _electronRunAsNode, ...env } = process.env
+  const electronArgs = [fixturePath, `--user-data-dir=${join(root, 'profile')}`]
+  const executable = process.platform === 'linux' ? 'xvfb-run' : electronBinary
+  const args =
+    process.platform === 'linux'
+      ? ['--auto-servernum', electronBinary, ...electronArgs, '--no-sandbox']
+      : electronArgs
+  const run = spawnSync(executable, args, {
+    encoding: 'utf8',
+    env,
+    timeout: 60_000
+  })
+  const fixtureResult = existsSync(resultPath) ? readFileSync(resultPath, 'utf8') : 'no result'
+  expect(run.error).toBeUndefined()
+  expect(run.status, `${fixtureResult}\n${run.stdout}\n${run.stderr}`).toBe(0)
+  return JSON.parse(fixtureResult) as FixtureResult
+}
+
+describe('native Chromium excluded partition cookie under Electron', () => {
+  it('survives selective clearing unchanged without a lossy Electron reconstruction', async () => {
+    const result = await runFixture()
+
+    expect(result.before.partitionKey).toEqual({
+      topLevelSite: 'https://example.com',
+      hasCrossSiteAncestor: true
+    })
+    expect(result.electronCookieKeys).not.toContain('partitionKey')
+    expect(result.after).toEqual(result.before)
+    expect(result.importResult).toMatchObject({
+      ok: true,
+      summary: { importedCookies: 1, domains: ['example.com'] }
+    })
+    expect(result.remainingNames).toEqual(['imported', 'partitioned-google'])
+  }, 90_000)
+})
diff --git a/src/main/browser/browser-cookie-import-policy.test.ts b/src/main/browser/browser-cookie-import-policy.test.ts
index 31ca329bf8f..96d023fd2f5 100644
--- a/src/main/browser/browser-cookie-import-policy.test.ts
+++ b/src/main/browser/browser-cookie-import-policy.test.ts
@@ -1,8 +1,12 @@
 import { describe, expect, it, vi } from 'vitest'
+import { DatabaseSync } from 'node:sqlite'
 import type { Cookie } from 'electron'
 import {
   isGoogleSourceBoundCookie,
+  isNonTransplantableCookieDomain,
+  NON_TRANSPLANTABLE_HOST_KEY_SQL,
   normalizeCookieDomain,
+  removeAllCookiesExcept,
   replaceCookiesForImportedDomains
 } from './browser-cookie-import-policy'
 
@@ -147,3 +151,166 @@ describe('replaceCookiesForImportedDomains', () => {
     })
   })
 })
+
+describe('isNonTransplantableCookieDomain', () => {
+  it('covers the whole google.com registrable family', () => {
+    expect(isNonTransplantableCookieDomain('google.com')).toBe(true)
+    expect(isNonTransplantableCookieDomain('.google.com')).toBe(true)
+    expect(isNonTransplantableCookieDomain('accounts.google.com')).toBe(true)
+    expect(isNonTransplantableCookieDomain('MAIL.Google.Com')).toBe(true)
+  })
+
+  it('does not match lookalikes or unrelated sites', () => {
+    expect(isNonTransplantableCookieDomain('withgoogle.com')).toBe(false)
+    expect(isNonTransplantableCookieDomain('google.com.evil.example')).toBe(false)
+    expect(isNonTransplantableCookieDomain('notgoogle.com')).toBe(false)
+    expect(isNonTransplantableCookieDomain('linear.app')).toBe(false)
+    expect(isNonTransplantableCookieDomain('')).toBe(false)
+  })
+
+  // Why: youtube.com re-issues its cookies from a transplanted session, so excluding it would
+  // drop imports users asked for. Locking it in keeps a future "just add it too" edit honest.
+  it('deliberately leaves youtube.com transplantable', () => {
+    expect(isNonTransplantableCookieDomain('.youtube.com')).toBe(false)
+    expect(isNonTransplantableCookieDomain('accounts.youtube.com')).toBe(false)
+  })
+})
+
+describe('NON_TRANSPLANTABLE_HOST_KEY_SQL', () => {
+  it('selects the google.com family and nothing that merely looks like it', () => {
+    const db = new DatabaseSync(':memory:')
+    db.exec('CREATE TABLE cookies (host_key TEXT)')
+    for (const hostKey of [
+      'google.com',
+      '.google.com',
+      'accounts.google.com',
+      'withgoogle.com',
+      'google.com.evil.example',
+      '.youtube.com',
+      '.linear.app'
+    ]) {
+      db.prepare('INSERT INTO cookies (host_key) VALUES (?)').run(hostKey)
+    }
+
+    const matched = db
+      .prepare(
+        `SELECT host_key FROM cookies WHERE ${NON_TRANSPLANTABLE_HOST_KEY_SQL} ORDER BY host_key`
+      )
+      .all() as { host_key: string }[]
+    db.close()
+
+    expect(matched.map((row) => row.host_key)).toEqual([
+      '.google.com',
+      'accounts.google.com',
+      'google.com'
+    ])
+  })
+})
+
+describe('removeAllCookiesExcept', () => {
+  it('never removes or reconstructs excluded Google cookies', async () => {
+    const get = vi
+      .fn()
+      .mockResolvedValue([
+        cookie('.google.com', 'SID'),
+        cookie('accounts.google.com', 'ACCOUNT'),
+        cookie('.example.com', 'session'),
+        cookie('other.test', 'tracker', '/scoped')
+      ])
+    const remove = vi.fn().mockResolvedValue(undefined)
+    const set = vi.fn().mockResolvedValue(undefined)
+
+    await removeAllCookiesExcept({ get, remove, set }, (existingCookie) =>
+      isNonTransplantableCookieDomain(existingCookie.domain ?? '')
+    )
+
+    expect(remove.mock.calls).toEqual([
+      ['https://example.com/', 'session'],
+      ['https://other.test/scoped', 'tracker']
+    ])
+    expect(set).not.toHaveBeenCalled()
+  })
+
+  it('restores removed non-Google cookies when another removal fails', async () => {
+    const get = vi
+      .fn()
+      .mockResolvedValue([
+        cookie('.google.com', 'SID'),
+        cookie('.example.com', 'first', '/one'),
+        cookie('.example.com', 'second', '/two'),
+        cookie('.example.com', 'third', '/three')
+      ])
+    const remove = vi.fn().mockImplementation(async (_url: string, name: string) => {
+      if (name === 'second') {
+        throw new Error('store unavailable')
+      }
+    })
+    const set = vi.fn().mockResolvedValue(undefined)
+
+    await expect(
+      removeAllCookiesExcept({ get, remove, set }, (existingCookie) =>
+        isNonTransplantableCookieDomain(existingCookie.domain ?? '')
+      )
+    ).rejects.toThrow('Could not clear existing cookies')
+    expect(remove).toHaveBeenCalledTimes(3)
+    expect(set.mock.calls.map(([details]) => details.name).sort()).toEqual(['first', 'third'])
+  })
+
+  it('bounds parallel removals so large cookie jars do not clear serially or fan out', async () => {
+    const get = vi
+      .fn()
+      .mockResolvedValue(
+        Array.from({ length: 12 }, (_, index) => cookie('.example.com', `${index}`))
+      )
+    let releaseRemovals: (() => void) | undefined
+    const removalsReleased = new Promise<void>((resolve) => {
+      releaseRemovals = resolve
+    })
+    let active = 0
+    let maxActive = 0
+    const remove = vi.fn().mockImplementation(async () => {
+      active++
+      maxActive = Math.max(maxActive, active)
+      await removalsReleased
+      active--
+    })
+    const set = vi.fn().mockResolvedValue(undefined)
+
+    const clearing = removeAllCookiesExcept({ get, remove, set }, () => false)
+    await vi.waitFor(() => expect(remove).toHaveBeenCalledTimes(8))
+    expect(maxActive).toBe(8)
+    releaseRemovals?.()
+    await clearing
+
+    expect(remove).toHaveBeenCalledTimes(12)
+    expect(set).not.toHaveBeenCalled()
+  })
+
+  it('serializes cookies that share Electron removal coordinates', async () => {
+    const get = vi
+      .fn()
+      .mockResolvedValue([
+        cookie('.example.com', 'session'),
+        { ...cookie('example.com', 'session'), hostOnly: true }
+      ])
+    let releaseFirst: (() => void) | undefined
+    const firstReleased = new Promise<void>((resolve) => {
+      releaseFirst = resolve
+    })
+    const remove = vi
+      .fn()
+      .mockImplementationOnce(() => firstReleased)
+      .mockResolvedValueOnce(undefined)
+    const set = vi.fn().mockResolvedValue(undefined)
+
+    const clearing = removeAllCookiesExcept({ get, remove, set }, () => false)
+    await vi.waitFor(() => expect(remove).toHaveBeenCalledOnce())
+    releaseFirst?.()
+    await clearing
+
+    expect(remove.mock.calls).toEqual([
+      ['https://example.com/', 'session'],
+      ['https://example.com/', 'session']
+    ])
+  })
+})
diff --git a/src/main/browser/browser-cookie-import-policy.ts b/src/main/browser/browser-cookie-import-policy.ts
index 216542f08ea..4fa7f44ddd9 100644
--- a/src/main/browser/browser-cookie-import-policy.ts
+++ b/src/main/browser/browser-cookie-import-policy.ts
@@ -1,5 +1,6 @@
 import type { Cookie, Cookies } from 'electron'
 import { parse as parseDomain } from 'psl'
+import { mapSettledWithConcurrency } from '../../shared/map-with-concurrency'
 
 const GOOGLE_SOURCE_BOUND_COOKIE_NAMES = new Set([
   'SIDCC',
@@ -53,6 +54,36 @@ export function normalizeCookieImportDomain(domain: string): string | null {
   return normalized
 }
 
+// Why (STA-3811): registrable families whose sessions are device-bound server-side, so a
+// transplanted cookie is rejected (or flagged and expired within ~1h) no matter how faithfully
+// it is copied. Signing in directly inside Orca is the only path that produces a working
+// session, so an import must never write these cookies and never remove them either — the
+// live session is always more valuable than anything an import could put in its place.
+// Adding a site is one entry here.
+// youtube.com is deliberately NOT listed: YouTube accepts a transplanted session and re-issues
+// its cookies via the accounts.youtube.com relay, so excluding it would silently drop imports
+// users actually asked for.
+const NON_TRANSPLANTABLE_DOMAINS = ['google.com'] as const
+const COOKIE_CLEAR_CONCURRENCY = 8
+
+export function isNonTransplantableCookieDomain(domain: string): boolean {
+  const normalized = normalizeCookieDomain(domain)
+  if (!normalized) {
+    return false
+  }
+  return NON_TRANSPLANTABLE_DOMAINS.some(
+    (root) => normalized === root || normalized.endsWith(`.${root}`)
+  )
+}
+
+// Why: Chromium stores host_key lowercase as 'google.com', '.google.com' or 'sub.google.com';
+// the LIKE pattern covers the leading-dot row and cannot match lookalikes ('withgoogle.com').
+export const NON_TRANSPLANTABLE_HOST_KEY_SQL = NON_TRANSPLANTABLE_DOMAINS.map(
+  (root) => `host_key = '${root}' OR host_key LIKE '%.${root}'`
+).join(' OR ')
+
+// Why: subsumed by the domain exclusion above for google.com — kept because it is the general
+// rule for rotation-only cookies and applies to any family added without a full exclusion.
 export function isGoogleSourceBoundCookie(name: string, domain: string): boolean {
   if (!GOOGLE_SOURCE_BOUND_COOKIE_NAMES.has(name)) {
     return false
@@ -165,6 +196,54 @@ export async function restoreImportedDomainCookies(
   }
 }
 
+// Why: Electron cannot round-trip partition identity, so excluded cookies must never be removed.
+export async function removeAllCookiesExcept(
+  store: Pick<Cookies, 'get' | 'remove' | 'set'>,
+  isExcluded: (cookie: Cookie) => boolean
+): Promise<void> {
+  const existingCookies = await store.get({})
+  const removableGroups = new Map<string, { cookie: Cookie; url: string }[]>()
+  for (const cookie of existingCookies) {
+    if (isExcluded(cookie)) {
+      continue
+    }
+    const domain = cookie.domain ? normalizeCookieDomain(cookie.domain) : null
+    const url = domain ? cookieRemovalUrl(cookie, domain) : null
+    if (!url) {
+      continue
+    }
+    const key = JSON.stringify([url, cookie.name])
+    const group = removableGroups.get(key) ?? []
+    group.push({ cookie, url })
+    removableGroups.set(key, group)
+  }
+
+  const removedCookies: Cookie[] = []
+  const results = await mapSettledWithConcurrency(
+    [...removableGroups.values()],
+    COOKIE_CLEAR_CONCURRENCY,
+    async (group) => {
+      // Why: identical removal coordinates must stay ordered instead of racing.
+      for (const { cookie, url } of group) {
+        await store.remove(url, cookie.name)
+        removedCookies.push(cookie)
+      }
+    }
+  )
+  const failures = results.flatMap((result) =>
+    result.status === 'rejected' ? [result.reason] : []
+  )
+  if (failures.length === 0) {
+    return
+  }
+  try {
+    await restoreImportedDomainCookies(store, removedCookies)
+  } catch (restoreError) {
+    throw new AggregateError([...failures, restoreError], 'Cookie clearing and rollback failed')
+  }
+  throw new AggregateError(failures, 'Could not clear existing cookies')
+}
+
 export async function replaceCookiesForImportedDomains(
   store: Pick<Cookies, 'get' | 'remove' | 'set'>,
   importedDomains: readonly string[]
diff --git a/src/main/browser/browser-cookie-import-replacement.test.ts b/src/main/browser/browser-cookie-import-replacement.test.ts
index 74c2ec432f1..8b5c07bb057 100644
--- a/src/main/browser/browser-cookie-import-replacement.test.ts
+++ b/src/main/browser/browser-cookie-import-replacement.test.ts
@@ -59,10 +59,11 @@ describe('validated cookie replacement', () => {
     return filePath
   }
 
-  it('filters Google source-bound cookies before replacing imported domain scopes', async () => {
+  it('keeps Google out of the replace scope so its cookies are never removed', async () => {
     cookiesGetMock.mockResolvedValue([
       cookie('.google.com', 'old-google'),
       cookie('.accounts.google.com', 'old-accounts', '/signin'),
+      cookie('.example.com', 'old-example'),
       cookie('.unrelated.com', 'keep'),
       cookie('.google.com.evil.example', 'keep-suffix-confusion')
     ])
@@ -76,15 +77,13 @@ describe('validated cookie replacement', () => {
 
     expect(result.ok && result.summary).toMatchObject({
       totalCookies: 3,
-      importedCookies: 2,
-      skippedCookies: 1,
-      domains: ['example.com', 'google.com']
+      importedCookies: 1,
+      skippedCookies: 2,
+      googleCookiesSkipped: 2,
+      domains: ['example.com']
     })
-    expect(cookiesRemoveMock.mock.calls).toEqual([
-      ['https://google.com/', 'old-google'],
-      ['https://accounts.google.com/signin', 'old-accounts']
-    ])
-    expect(cookiesSetMock.mock.calls.map(([details]) => details.name)).toEqual(['SAPISID', 'SIDCC'])
+    expect(cookiesRemoveMock.mock.calls).toEqual([['https://example.com/', 'old-example']])
+    expect(cookiesSetMock.mock.calls.map(([details]) => details.name)).toEqual(['SIDCC'])
     expect(Math.max(...cookiesRemoveMock.mock.invocationCallOrder)).toBeLessThan(
       Math.min(...cookiesSetMock.mock.invocationCallOrder)
     )
@@ -101,6 +100,7 @@ describe('validated cookie replacement', () => {
       totalCookies: 1,
       importedCookies: 0,
       skippedCookies: 1,
+      googleCookiesSkipped: 1,
       domains: []
     })
     expect(cookiesGetMock).not.toHaveBeenCalled()
@@ -185,6 +185,7 @@ describe('native Chromium integrity-cookie accounting', () => {
     sessionFromPartitionMock.mockReset().mockReturnValue({
       cookies: {
         flushStore: vi.fn().mockResolvedValue(undefined),
+        get: vi.fn().mockResolvedValue([]),
         remove: vi.fn().mockResolvedValue(undefined),
         set: cookiesSetMock
       },
@@ -196,7 +197,7 @@ describe('native Chromium integrity-cookie accounting', () => {
     rmSync(tmpDir, { recursive: true, force: true })
   })
 
-  it('includes domain-scoped integrity cookies in skippedCookies', async () => {
+  it('counts every excluded Google cookie in skippedCookies', async () => {
     const sourceCookiesPath = join(tmpDir, 'Chrome', 'Default', 'Network', 'Cookies')
     const targetCookiesPath = join(tmpDir, 'userData', 'Partitions', 'test', 'Network', 'Cookies')
     createChromiumCookieTestDatabase(sourceCookiesPath, [
@@ -214,11 +215,12 @@ describe('native Chromium integrity-cookie accounting', () => {
       )
       expect(result.ok && result.summary).toMatchObject({
         totalCookies: 3,
-        importedCookies: 2,
-        skippedCookies: 1,
-        domains: ['example.com', 'google.com']
+        importedCookies: 1,
+        skippedCookies: 2,
+        googleCookiesSkipped: 2,
+        domains: ['example.com']
       })
-      expect(cookiesSetMock.mock.calls.map(([details]) => details.name)).toEqual(['SAPISID', 'AEC'])
+      expect(cookiesSetMock.mock.calls.map(([details]) => details.name)).toEqual(['AEC'])
     } finally {
       platformSpy.mockRestore()
     }
@@ -247,6 +249,7 @@ describe('native Chromium integrity-cookie accounting', () => {
         totalCookies: 3,
         importedCookies: 0,
         skippedCookies: 3,
+        googleCookiesSkipped: 2,
         domains: []
       })
       expect(clearStorageDataMock).not.toHaveBeenCalled()
diff --git a/src/main/browser/browser-cookie-import.test.ts b/src/main/browser/browser-cookie-import.test.ts
index aefdd27fbf5..d2d4ffd4836 100644
--- a/src/main/browser/browser-cookie-import.test.ts
+++ b/src/main/browser/browser-cookie-import.test.ts
@@ -445,6 +445,7 @@ describe('importCookiesFromBrowser Chromium', () => {
     sessionFromPartitionMock.mockReset()
     sessionFromPartitionMock.mockReturnValue({
       cookies: {
+        get: vi.fn().mockResolvedValue([]),
         set: cookiesSetMock,
         remove: cookiesRemoveMock,
         flushStore: cookiesFlushStoreMock
@@ -510,7 +511,7 @@ describe('importCookiesFromBrowser Chromium', () => {
         ['', '-wal', '-shm'].map((suffix) => readFileSync(sourceCookiesPath + suffix))
       ).toEqual(sourceFilesBefore)
       expect(cookiesRemoveMock).not.toHaveBeenCalled()
-      expect(clearStorageDataMock).toHaveBeenCalledWith({ storages: ['cookies'] })
+      expect(clearStorageDataMock).not.toHaveBeenCalled()
       // Why: STA-3514 — imports must never impersonate the source browser; the
       // session keeps the engine UA the registry set at startup.
       expect(setUserAgentMock).not.toHaveBeenCalled()
diff --git a/src/main/browser/browser-cookie-import.ts b/src/main/browser/browser-cookie-import.ts
index 66a3afdb3cf..2a7bed19950 100644
--- a/src/main/browser/browser-cookie-import.ts
+++ b/src/main/browser/browser-cookie-import.ts
@@ -76,8 +76,11 @@ import type {
 import { browserSessionRegistry } from './browser-session-registry'
 import {
   isGoogleSourceBoundCookie,
+  isNonTransplantableCookieDomain,
+  NON_TRANSPLANTABLE_HOST_KEY_SQL,
   normalizeCookieDomain,
   normalizeCookieImportDomain,
+  removeAllCookiesExcept,
   replaceCookiesForImportedDomains,
   restoreImportedDomainCookies,
   type CookieImportMode
@@ -571,13 +574,20 @@ async function importValidatedCookies(
     }
     return valid
   })
-  const importableCookies = validDomainCookies.filter(
+  const sourceBoundFiltered = validDomainCookies.filter(
     (cookie) => !isGoogleSourceBoundCookie(cookie.name, cookie.domain)
   )
-  const integritySkipped = validDomainCookies.length - importableCookies.length
+  // Why: dropping these before the replace scope is computed is what keeps the existing
+  // Google session intact — replaceCookiesForImportedDomains only clears domains we import.
+  const importableCookies = sourceBoundFiltered.filter(
+    (cookie) => !isNonTransplantableCookieDomain(cookie.domain)
+  )
+  const integritySkipped = validDomainCookies.length - sourceBoundFiltered.length
+  const nonTransplantableSkipped = sourceBoundFiltered.length - importableCookies.length
+  const googleCookiesSkipped = integritySkipped + nonTransplantableSkipped
   const invalidDomainSkipped = cookies.length - validDomainCookies.length
   diag(
-    `importValidatedCookies: ${cookies.length} validated, ${invalidDomainSkipped} unsafe-domain skipped, ${integritySkipped} source-bound skipped of ${totalInput} total, partition="${targetPartition}"`
+    `importValidatedCookies: ${cookies.length} validated, ${invalidDomainSkipped} unsafe-domain skipped, ${integritySkipped} source-bound skipped, ${nonTransplantableSkipped} non-transplantable skipped of ${totalInput} total, partition="${targetPartition}"`
   )
   const targetSession = session.fromPartition(targetPartition)
   let importedCount = 0
@@ -684,6 +694,7 @@ async function importValidatedCookies(
     totalCookies: totalInput,
     importedCookies: importedCount,
     skippedCookies: skipped,
+    ...(googleCookiesSkipped > 0 ? { googleCookiesSkipped } : {}),
     domains: [...domainSet].sort()
   }
 
@@ -902,7 +913,7 @@ export function buildChromiumCookieInsertParams(
       return decryptedValue
     }
 
-    const sourceHasColumn = Object.prototype.hasOwnProperty.call(sourceRow, column.name)
+    const sourceHasColumn = Object.hasOwn(sourceRow, column.name)
     const sourceValue = sourceHasColumn ? normalizeSqliteCookieValue(sourceRow[column.name]) : null
     if (sourceValue !== null) {
       return sourceValue
@@ -1548,7 +1559,10 @@ export async function importCookiesFromBrowser(
         const targetCols: string[] = targetColumnInfo.map((r) => r.name)
         colList = targetCols.join(', ')
         placeholders = targetCols.map(() => '?').join(', ')
-        stagingDb.exec('DELETE FROM cookies')
+        // Why: the staged DB replaces the whole live DB at cold start, so it is a clear step
+        // like any other — keep the live non-transplantable rows in it rather than replaying
+        // a wipe the in-memory path was not allowed to perform.
+        stagingDb.exec(`DELETE FROM cookies WHERE NOT (${NON_TRANSPLANTABLE_HOST_KEY_SQL})`)
       } catch (err) {
         diag(`  staging database unusable, restart fallback disabled: ${String(err)}`)
         stagingAvailable = false
@@ -1578,7 +1592,12 @@ export async function importCookiesFromBrowser(
 
     const needsSourceKey = sourceRows.some((sourceRow) => {
       const encRaw = sourceRow.encrypted_value
-      return encRaw instanceof Uint8Array && encRaw.length > 0
+      if (!(encRaw instanceof Uint8Array) || encRaw.length === 0) {
+        return false
+      }
+      const domain = sourceRow.host_key as string
+      const name = sourceRow.name as string
+      return !(isGoogleSourceBoundCookie(name, domain) || isNonTransplantableCookieDomain(domain))
     })
     const sourceKey = needsSourceKey
       ? getEncryptionKey(browser.keychainService!, browser.keychainAccount!, browser)
@@ -1596,6 +1615,7 @@ export async function importCookiesFromBrowser(
     let imported = 0
     let skipped = 0
     let integritySkipped = 0
+    let nonTransplantableSkipped = 0
     let memoryLoaded = 0
     let memoryFailed = 0
     const domainSet = new Set<string>()
@@ -1640,6 +1660,20 @@ export async function importCookiesFromBrowser(
     }
 
     for (const sourceRow of sourceRows) {
+      const domain = sourceRow.host_key as string
+      const name = sourceRow.name as string
+
+      if (isGoogleSourceBoundCookie(name, domain)) {
+        integritySkipped++
+        continue
+      }
+
+      // Why: transplanting these replaces a working sign-in with a session the site rejects.
+      if (isNonTransplantableCookieDomain(domain)) {
+        nonTransplantableSkipped++
+        continue
+      }
+
       const encRaw = sourceRow.encrypted_value
       // Why: node:sqlite returns BLOBs as Uint8Array; treat any other type as missing, not an empty buffer that would silently blank the cookie value.
       const encBuf = encRaw instanceof Uint8Array ? Buffer.from(encRaw) : null
@@ -1661,14 +1695,6 @@ export async function importCookiesFromBrowser(
         decryptedValue = Buffer.alloc(0)
       }
 
-      const domain = sourceRow.host_key as string
-      const name = sourceRow.name as string
-
-      if (isGoogleSourceBoundCookie(name, domain)) {
-        integritySkipped++
-        continue
-      }
-
       let validDomain = sourceDomainValidity.get(domain)
       if (validDomain === undefined) {
         validDomain = normalizeCookieImportDomain(domain) !== null
@@ -1718,7 +1744,10 @@ export async function importCookiesFromBrowser(
       // the optional staging DB is unavailable.
       imported++
     }
-    diag(`  skipped ${integritySkipped} Google integrity cookies (SIDCC/STRP/AEC)`)
+    diag(
+      `  skipped ${integritySkipped} Google integrity cookies (SIDCC/STRP/AEC) and ${nonTransplantableSkipped} non-transplantable-domain cookies`
+    )
+    const googleCookiesSkipped = integritySkipped + nonTransplantableSkipped
 
     if (decryptedCookies.length === 0) {
       closeStagingDb()
@@ -1729,7 +1758,8 @@ export async function importCookiesFromBrowser(
         summary: {
           totalCookies: sourceRows.length,
           importedCookies: 0,
-          skippedCookies: skipped + integritySkipped,
+          skippedCookies: skipped + integritySkipped + nonTransplantableSkipped,
+          ...(googleCookiesSkipped > 0 ? { googleCookiesSkipped } : {}),
           domains: []
         }
       }
@@ -1747,8 +1777,12 @@ export async function importCookiesFromBrowser(
       diag(`  staging skipped: ${imported} cookies will load in-memory only`)
     }
 
-    // Why: clear stale cookies first; mixing them with the imported set makes sites like Google reject the session.
-    await targetSession.clearStorageData({ storages: ['cookies'] })
+    // Why: clear stale cookies first; mixing them with the imported set makes sites reject the
+    // session. Non-transplantable families are exempt — nothing was imported for them, and their
+    // live session is the only one that works.
+    await removeAllCookiesExcept(targetSession.cookies, (cookie) =>
+      isNonTransplantableCookieDomain(cookie.domain ?? '')
+    )
     diag(
       `  cleared existing session cookies before loading ${decryptedCookies.length} imported cookies`
     )
@@ -1816,7 +1850,8 @@ export async function importCookiesFromBrowser(
     const summary: BrowserCookieImportSummary = {
       totalCookies: sourceRows.length,
       importedCookies: imported,
-      skippedCookies: skipped + integritySkipped,
+      skippedCookies: skipped + integritySkipped + nonTransplantableSkipped,
+      ...(googleCookiesSkipped > 0 ? { googleCookiesSkipped } : {}),
       domains: [...domainSet].sort(),
       ...(warning ? { warning } : {})
     }
diff --git a/src/main/browser/browser-google-auth-ua.ts b/src/main/browser/browser-google-auth-ua.ts
index 4392e6351c2..16ed14eb80f 100644
--- a/src/main/browser/browser-google-auth-ua.ts
+++ b/src/main/browser/browser-google-auth-ua.ts
@@ -49,3 +49,11 @@ export function setUserAgentHeader(headers: Record<string, string>, value: strin
   const existing = Object.keys(headers).find((key) => key.toLowerCase() === 'user-agent')
   headers[existing ?? 'User-Agent'] = value
 }
+
+// Why: the outgoing header carries the WebContents UA override, so reading it
+// (case-insensitively) tells us whether a request originated from the Firefox
+// auth document even when its destination host isn't an auth host.
+export function currentUserAgent(headers: Record<string, string>): string | undefined {
+  const existing = Object.keys(headers).find((key) => key.toLowerCase() === 'user-agent')
+  return existing ? headers[existing] : undefined
+}
diff --git a/src/main/browser/browser-session-registry.persistence.test.ts b/src/main/browser/browser-session-registry.persistence.test.ts
index f5f9bb7a7b2..f27a861a45c 100644
--- a/src/main/browser/browser-session-registry.persistence.test.ts
+++ b/src/main/browser/browser-session-registry.persistence.test.ts
@@ -24,7 +24,7 @@ function seedMeta(fsState: FsState, meta: unknown): void {
 
 function installModuleMocks(
   fsState: FsState,
-  copyFailures: Set<string> = new Set()
+  copyFailures = new Set<string>()
 ): {
   sessionFromPartitionMock: ReturnType<typeof vi.fn>
   setupClientHintsOverrideMock: ReturnType<typeof vi.fn>
diff --git a/src/main/browser/browser-session-registry.test.ts b/src/main/browser/browser-session-registry.test.ts
index 44e1b6b8e92..9f32e4f379d 100644
--- a/src/main/browser/browser-session-registry.test.ts
+++ b/src/main/browser/browser-session-registry.test.ts
@@ -28,6 +28,7 @@ vi.mock('./browser-manager', () => ({
 }))
 
 import { browserSessionRegistry } from './browser-session-registry'
+import { googleAuthUserAgent } from './browser-google-auth-ua'
 import { setupClientHintsOverride } from './browser-session-ua'
 import { ORCA_BROWSER_PARTITION } from '../../shared/constants'
 import {
@@ -440,6 +441,81 @@ describe('BrowserSessionRegistry', () => {
       expect(modified['sec-ch-ua-platform']).toBeUndefined()
     })
 
+    it('strips client hints on a cross-host request that carries the Firefox auth UA', () => {
+      const onBeforeSendHeaders = vi.fn()
+      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
+      setupClientHintsOverride(
+        mockSess,
+        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.6890.3 Safari/537.36'
+      )
+
+      const callback = vi.fn()
+      const listener = onBeforeSendHeaders.mock.calls[0][1]
+      // Subresource/XHR to a non-auth Google host while the auth document is on
+      // screen: the WebContents Firefox UA leaks onto the request header.
+      listener(
+        {
+          url: 'https://play.google.com/log',
+          requestHeaders: {
+            'User-Agent': googleAuthUserAgent(),
+            'sec-ch-ua': 'old',
+            'sec-ch-ua-full-version-list': 'old',
+            'sec-ch-ua-platform': '"macOS"',
+            'sec-ch-ua-mobile': '?0'
+          }
+        },
+        callback
+      )
+      const modified = callback.mock.calls[0][0].requestHeaders
+      // UA stays Firefox and every client hint is dropped — one consistent identity.
+      expect(modified['User-Agent']).toBe(googleAuthUserAgent())
+      expect(modified['sec-ch-ua']).toBeUndefined()
+      expect(modified['sec-ch-ua-full-version-list']).toBeUndefined()
+      expect(modified['sec-ch-ua-platform']).toBeUndefined()
+      expect(modified['sec-ch-ua-mobile']).toBeUndefined()
+    })
+
+    it('keeps the clean Chrome identity on cross-host requests that carry the Chrome UA', () => {
+      const onBeforeSendHeaders = vi.fn()
+      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
+      const chromeUa =
+        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.6890.3 Safari/537.36'
+      setupClientHintsOverride(mockSess, chromeUa)
+
+      const callback = vi.fn()
+      const listener = onBeforeSendHeaders.mock.calls[0][1]
+      // Regression guard: non-Google sites (Cloudflare) must keep Chrome hints.
+      listener(
+        {
+          url: 'https://example.com/api',
+          requestHeaders: { 'User-Agent': chromeUa, 'sec-ch-ua': 'old' }
+        },
+        callback
+      )
+      expect(callback.mock.calls[0][0].requestHeaders['sec-ch-ua']).toContain('Google Chrome')
+    })
+
+    it('does not strip hints for the Firefox UA when googleAuthOverride is disabled', () => {
+      const onBeforeSendHeaders = vi.fn()
+      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
+      const chromeUa =
+        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.6890.3 Safari/537.36'
+      setupClientHintsOverride(mockSess, chromeUa, { googleAuthOverride: false })
+
+      const callback = vi.fn()
+      const listener = onBeforeSendHeaders.mock.calls[0][1]
+      listener(
+        {
+          url: 'https://play.google.com/log',
+          requestHeaders: { 'User-Agent': googleAuthUserAgent(), 'sec-ch-ua': 'old' }
+        },
+        callback
+      )
+      // Imported-native profiles never install the Firefox switch, so the strip
+      // branch stays inert and hints are aligned to Chrome instead.
+      expect(callback.mock.calls[0][0].requestHeaders['sec-ch-ua']).toContain('Google Chrome')
+    })
+
     it('keeps Chrome client hints on Google app subdomains (not auth hosts)', () => {
       const onBeforeSendHeaders = vi.fn()
       const mockSess = { webRequest: { onBeforeSendHeaders } } as never
diff --git a/src/main/browser/browser-session-ua.ts b/src/main/browser/browser-session-ua.ts
index 092b79995d8..96c55cf5ac9 100644
--- a/src/main/browser/browser-session-ua.ts
+++ b/src/main/browser/browser-session-ua.ts
@@ -1,6 +1,7 @@
 import type { Session } from 'electron'
 
 import {
+  currentUserAgent,
   googleAuthUserAgent,
   isGoogleAuthUrl,
   setUserAgentHeader,
@@ -48,6 +49,18 @@ export function setupClientHintsOverride(
       callback({ requestHeaders: headers })
       return
     }
+    if (options.googleAuthOverride !== false && currentUserAgent(headers) === firefoxUa) {
+      // Why: while the auth document is on screen the WebContents UA is Firefox,
+      // so its cross-host subresource/XHR requests (gstatic, play.google.com, the
+      // sign-in challenge endpoints) reach here carrying the Firefox UA yet still
+      // bearing Chromium client hints. Rewriting those to Chrome pairs a Firefox
+      // UA with Chrome hints — a sharper cross-host identity tell than either
+      // alone, which can stall Google's password-submit challenge. Real Firefox
+      // sends no client hints, so strip them to keep one identity for the flow.
+      stripClientHints(headers)
+      callback({ requestHeaders: headers })
+      return
+    }
     if (chromeHints) {
       for (const key of Object.keys(headers)) {
         const lower = key.toLowerCase()
diff --git a/src/main/browser/browser-text-insertion.ts b/src/main/browser/browser-text-insertion.ts
index 4d89b3a06fa..6c04fd52ae5 100644
--- a/src/main/browser/browser-text-insertion.ts
+++ b/src/main/browser/browser-text-insertion.ts
@@ -1,22 +1,10 @@
 import { measureClipboardTextByteLength } from '../../shared/clipboard-text'
 import { yieldToEventLoop } from '../../shared/event-loop-yield'
+import { getUtf8ChunkEndIndex } from '../../shared/utf8-byte-limits'
 import type { CdpCommandSender } from './snapshot-engine'
 
 export const BROWSER_TEXT_INSERT_CHUNK_BYTES = 64 * 1024
 
-function getUtf8ByteLengthForCodePoint(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
-
 export function splitBrowserTextInsertionChunks(
   text: string,
   maxChunkBytes = BROWSER_TEXT_INSERT_CHUNK_BYTES
@@ -38,24 +26,11 @@ export function* iterateBrowserTextInsertionChunks(
     return
   }
 
-  let currentStart = 0
-  let currentBytes = 0
-  let index = 0
-  while (index < text.length) {
-    const codePoint = text.codePointAt(index) ?? 0
-    const codeUnitLength = codePoint > 0xffff ? 2 : 1
-    const nextIndex = index + codeUnitLength
-    const characterBytes = getUtf8ByteLengthForCodePoint(codePoint)
-    if (currentBytes > 0 && currentBytes + characterBytes > normalizedMax) {
-      yield text.slice(currentStart, index)
-      currentStart = index
-      currentBytes = 0
-    }
-    currentBytes += characterBytes
-    index = nextIndex
-  }
-  if (currentStart < text.length) {
-    yield text.slice(currentStart)
+  let startIndex = 0
+  while (startIndex < text.length) {
+    const endIndex = getUtf8ChunkEndIndex(text, startIndex, normalizedMax)
+    yield text.slice(startIndex, endIndex)
+    startIndex = endIndex
   }
 }
 
@@ -68,8 +43,7 @@ export async function insertTextThroughCdp(
   let chunk = chunks.next()
   while (!chunk.done) {
     await sender('Input.insertText', { text: chunk.value })
-    // Why: browser automation text can be paste-sized; yielding keeps the main
-    // process responsive between bounded CDP payloads.
+    // Keep paste-sized insertion from monopolizing the main process.
     chunk = chunks.next()
     if (options?.yieldBetweenChunks !== false && !chunk.done) {
       await yieldToEventLoop()
diff --git a/src/main/browser/browser-webauthn-access.ts b/src/main/browser/browser-webauthn-access.ts
index 4f04065e36c..60da5b1e297 100644
--- a/src/main/browser/browser-webauthn-access.ts
+++ b/src/main/browser/browser-webauthn-access.ts
@@ -15,7 +15,7 @@ function isSecureBrowserOrigin(rawOrigin: string | undefined): boolean {
   }
 }
 
-function isFidoHidDevice(device: Electron.HIDDevice | unknown): device is Electron.HIDDevice {
+function isFidoHidDevice(device: unknown): device is Electron.HIDDevice {
   if (!device || typeof device !== 'object') {
     return false
   }
diff --git a/src/main/browser/cdp-bridge-integration.test.ts b/src/main/browser/cdp-bridge-integration.test.ts
index b3b1fae9401..b3b836d07b0 100644
--- a/src/main/browser/cdp-bridge-integration.test.ts
+++ b/src/main/browser/cdp-bridge-integration.test.ts
@@ -212,7 +212,7 @@ function createMockGuest(
       removeListener: vi.fn((event: string, handler: (...args: unknown[]) => void) => {
         const handlers = debuggerListeners.get(event) ?? []
         const idx = handlers.indexOf(handler)
-        if (idx >= 0) {
+        if (idx !== -1) {
           handlers.splice(idx, 1)
         }
       }),
diff --git a/src/main/claude-usage/store.test.ts b/src/main/claude-usage/store.test.ts
index 751ee0c0dae..3609399ac33 100644
--- a/src/main/claude-usage/store.test.ts
+++ b/src/main/claude-usage/store.test.ts
@@ -1,20 +1,12 @@
-import { mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import type * as FsPromises from 'node:fs/promises'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { ClaudeUsagePersistedState } from './types'
 import type * as Scanner from './scanner'
 
-const { getPathMock, writeOpens, writeGate } = vi.hoisted(() => ({
-  getPathMock: vi.fn(() => '/tmp/orca-test-userdata'),
-  // Why only mode 'w': the durable write also opens the directory read-only to fsync it, so counting
-  // every open would hide a regression back to multiple full-cache rewrites per scan.
-  writeOpens: { value: 0, inFlight: 0, maxConcurrent: 0 },
-  writeGate: {
-    blocked: false,
-    waiters: [] as (() => void)[]
-  }
+const { getPathMock } = vi.hoisted(() => ({
+  getPathMock: vi.fn(() => '/tmp/orca-test-userdata')
 }))
 
 vi.mock('electron', () => ({
@@ -23,29 +15,6 @@ vi.mock('electron', () => ({
   }
 }))
 
-vi.mock('node:fs/promises', async () => {
-  const actual = await vi.importActual<typeof FsPromises>('node:fs/promises')
-  return {
-    ...actual,
-    open: (async (...args: Parameters<typeof actual.open>) => {
-      if (args[1] !== 'w') {
-        return actual.open(...args)
-      }
-      writeOpens.value += 1
-      writeOpens.inFlight += 1
-      writeOpens.maxConcurrent = Math.max(writeOpens.maxConcurrent, writeOpens.inFlight)
-      try {
-        if (writeGate.blocked) {
-          await new Promise<void>((resolve) => writeGate.waiters.push(resolve))
-        }
-        return await actual.open(...args)
-      } finally {
-        writeOpens.inFlight -= 1
-      }
-    }) as typeof actual.open
-  }
-})
-
 vi.mock('./scanner', async (importOriginal) => ({
   ...(await importOriginal<typeof Scanner>()),
   scanClaudeUsageFiles: vi.fn()
@@ -54,12 +23,15 @@ vi.mock('./scanner', async (importOriginal) => ({
 import { ClaudeUsageStore, initClaudeUsagePath } from './store'
 import { scanClaudeUsageFiles } from './scanner'
 
-function createStoreWithState(state: Partial<ClaudeUsagePersistedState>): ClaudeUsageStore {
-  const store = new ClaudeUsageStore({
+function createBackingStore(): ConstructorParameters<typeof ClaudeUsageStore>[0] {
+  return {
     getRepos: () => [],
-    getAllWorktreeMeta: () => ({}),
-    getWorktreeMeta: () => undefined
-  } as never)
+    getAllWorktreeMeta: () => ({})
+  }
+}
+
+function createStoreWithState(state: Partial<ClaudeUsagePersistedState>): ClaudeUsageStore {
+  const store = new ClaudeUsageStore(createBackingStore())
 
   ;(store as unknown as { state: ClaudeUsagePersistedState }).state = {
     schemaVersion: 1,
@@ -86,11 +58,6 @@ describe('ClaudeUsageStore', () => {
     tempUserData = mkdtempSync(join(tmpdir(), 'orca-claude-usage-store-'))
     getPathMock.mockReturnValue(tempUserData)
     initClaudeUsagePath()
-    writeOpens.value = 0
-    writeOpens.inFlight = 0
-    writeOpens.maxConcurrent = 0
-    writeGate.blocked = false
-    writeGate.waiters = []
     vi.mocked(scanClaudeUsageFiles).mockReset()
     vi.mocked(scanClaudeUsageFiles).mockResolvedValue({
       processedFiles: [],
@@ -106,6 +73,17 @@ describe('ClaudeUsageStore', () => {
     rmSync(tempUserData, { recursive: true, force: true })
   })
 
+  it('defaults a null legacy opt-in while invalidating the cache', () => {
+    writeFileSync(
+      join(tempUserData, 'orca-claude-usage.json'),
+      JSON.stringify({ schemaVersion: 4, scanState: { enabled: null } })
+    )
+
+    const store = new ClaudeUsageStore(createBackingStore())
+
+    expect(store.getScanState().enabled).toBe(false)
+  })
+
   it('reports no data for Orca scope when only non-Orca usage exists', async () => {
     const store = createStoreWithState({
       sessions: [
@@ -617,64 +595,7 @@ describe('ClaudeUsageStore', () => {
     expect(refreshMock).toHaveBeenCalledWith(false)
   })
 
-  it('persists setEnabled via async durable write without leaving tmp files', async () => {
-    const store = createStoreWithState({
-      schemaVersion: 5,
-      scanState: {
-        enabled: false,
-        lastScanStartedAt: null,
-        lastScanCompletedAt: null,
-        lastScanError: null
-      }
-    })
-
-    await store.setEnabled(true)
-
-    expect(writeOpens.value).toBe(1)
-    expect(readdirSync(tempUserData).filter((f) => f.endsWith('.tmp'))).toHaveLength(0)
-    const persisted = JSON.parse(
-      readFileSync(join(tempUserData, 'orca-claude-usage.json'), 'utf-8')
-    )
-    expect(persisted.scanState.enabled).toBe(true)
-    // Pretty-print preserved for human inspection of the analytics cache.
-    expect(readFileSync(join(tempUserData, 'orca-claude-usage.json'), 'utf-8')).toContain('\n')
-  })
-
-  it('vetoes a stale concurrent async write so the newer snapshot wins', async () => {
-    const store = createStoreWithState({
-      schemaVersion: 5,
-      scanState: {
-        enabled: true,
-        lastScanStartedAt: null,
-        lastScanCompletedAt: null,
-        lastScanError: null
-      }
-    })
-    const internals = store as unknown as {
-      writeToDisk: () => Promise<void>
-      state: ClaudeUsagePersistedState
-    }
-
-    writeGate.blocked = true
-    const first = internals.writeToDisk()
-    await vi.waitFor(() => expect(writeGate.waiters.length).toBe(1))
-
-    internals.state.scanState.enabled = false
-    writeGate.blocked = false
-    const second = internals.writeToDisk()
-    writeGate.waiters.splice(0).forEach((resolve) => resolve())
-    await Promise.all([first, second])
-
-    expect(
-      JSON.parse(readFileSync(join(tempUserData, 'orca-claude-usage.json'), 'utf-8')).scanState
-        .enabled
-    ).toBe(false)
-    expect(readdirSync(tempUserData).filter((f) => f.endsWith('.tmp'))).toHaveLength(0)
-    // Serialized, so the superseded write can be skipped safely rather than racing the newer one.
-    expect(writeOpens.maxConcurrent).toBe(1)
-  })
-
-  it('persists a successful refresh with one full-cache write', async () => {
+  it('adapts Claude scans to pretty-printed cache persistence', async () => {
     const store = createStoreWithState({
       schemaVersion: 5,
       scanState: {
@@ -687,25 +608,7 @@ describe('ClaudeUsageStore', () => {
 
     await store.refresh(true)
 
-    // Why exactly one: scan start used to rewrite the whole 20 MB cache before any result changed.
-    expect(writeOpens.value).toBe(1)
-    expect(readdirSync(tempUserData).filter((f) => f.endsWith('.tmp'))).toHaveLength(0)
-    expect(
-      JSON.parse(readFileSync(join(tempUserData, 'orca-claude-usage.json'), 'utf-8')).scanState
-    ).toMatchObject({
-      lastScanStartedAt: new Date('2026-04-09T12:00:00.000-04:00').getTime(),
-      lastScanCompletedAt: new Date('2026-04-09T12:00:00.000-04:00').getTime(),
-      lastScanError: null
-    })
-  })
-
-  it('sweeps a usage temp file orphaned by a crash between write and rename', async () => {
-    const orphan = join(tempUserData, 'orca-claude-usage.json.999.1.abc.tmp')
-    writeFileSync(orphan, '{}')
-
-    createStoreWithState({})
-    await vi.waitFor(() =>
-      expect(readdirSync(tempUserData).filter((f) => f.endsWith('.tmp'))).toHaveLength(0)
-    )
+    expect(scanClaudeUsageFiles).toHaveBeenCalledWith([], [])
+    expect(readFileSync(join(tempUserData, 'orca-claude-usage.json'), 'utf-8')).toContain('\n')
   })
 })
diff --git a/src/main/claude-usage/store.ts b/src/main/claude-usage/store.ts
index 180f7660b6b..66085504089 100644
--- a/src/main/claude-usage/store.ts
+++ b/src/main/claude-usage/store.ts
@@ -1,14 +1,11 @@
-/* eslint-disable max-lines -- Why: this store is the single main-process owner for Claude usage persistence, scan gating, and query semantics. Keeping those policy decisions together avoids split-brain range/scope logic across multiple files. */
+/* eslint-disable max-lines -- Why: Claude pricing, range, scope, breakdown, and automation-attribution policies remain one cohesive store. */
 import { app } from 'electron'
-import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
 import type {
   ClaudeUsageBreakdownKind,
   ClaudeUsageBreakdownRow,
   ClaudeUsageDailyPoint,
   ClaudeUsageRange,
-  ClaudeUsageScanState,
   ClaudeUsageScope,
   ClaudeUsageSessionRow,
   ClaudeUsageSnapshot,
@@ -16,16 +13,15 @@ import type {
 } from '../../shared/claude-usage-types'
 import type { AutomationRunUsage } from '../../shared/automations-types'
 import type { Store } from '../persistence'
-import { loadKnownUsageWorktreesByRepo, type UsageWorktreeRef } from '../usage-worktree-metadata'
 import type { ClaudeUsagePersistedState } from './types'
-import { createWorktreeRefs } from '../usage/usage-worktree-refs'
 import { getSessionProjectLabel, scanClaudeUsageFiles } from './scanner'
+import { getLocalUsageDay, getUsageRangeCutoff } from '../usage/usage-calendar-range'
+import { UsageProviderStoreLifecycle } from '../usage/usage-provider-store-lifecycle'
 
 // Why: v5 widens Claude ownership keys (message-id / uuid fallbacks). Older
 // caches either lack ownership or used narrower keys and can under/over-count
 // after fork reclaim (#8006).
 const SCHEMA_VERSION = 5
-const STALE_MS = 5 * 60_000
 const AUTOMATION_ATTRIBUTION_WINDOW_MS = 5 * 60_000
 
 // Why: capture the path after configureDevUserDataPath() but before app.setName()
@@ -130,6 +126,21 @@ function getDefaultState(): ClaudeUsagePersistedState {
   }
 }
 
+function normalizePersistedState(state: ClaudeUsagePersistedState): ClaudeUsagePersistedState {
+  if (state.schemaVersion === SCHEMA_VERSION) {
+    return state
+  }
+  // Scanner changes invalidate totals, but preserving enabled keeps existing tracking on.
+  const defaults = getDefaultState()
+  return {
+    ...defaults,
+    scanState: {
+      ...defaults.scanState,
+      enabled: state.scanState.enabled ?? defaults.scanState.enabled
+    }
+  }
+}
+
 export function initClaudeUsagePath(): void {
   _claudeUsageFile = join(app.getPath('userData'), 'orca-claude-usage.json')
 }
@@ -288,120 +299,22 @@ function estimateCostUsd(
   )
 }
 
-function getRangeCutoff(range: ClaudeUsageRange): string | null {
-  if (range === 'all') {
-    return null
-  }
-  const days = range === '7d' ? 7 : range === '30d' ? 30 : 90
-  const now = new Date()
-  now.setHours(0, 0, 0, 0)
-  now.setDate(now.getDate() - (days - 1))
-  const year = now.getFullYear()
-  const month = String(now.getMonth() + 1).padStart(2, '0')
-  const day = String(now.getDate()).padStart(2, '0')
-  return `${year}-${month}-${day}`
-}
-
-function getLocalDay(timestamp: string): string | null {
-  const parsed = new Date(timestamp)
-  if (Number.isNaN(parsed.getTime())) {
-    return null
-  }
-  const year = parsed.getFullYear()
-  const month = String(parsed.getMonth() + 1).padStart(2, '0')
-  const day = String(parsed.getDate()).padStart(2, '0')
-  return `${year}-${month}-${day}`
-}
-
-function getWorktreeFingerprint(worktreesByRepo: Map<string, UsageWorktreeRef[]>): string {
-  const rows = [...worktreesByRepo.entries()]
-    .flatMap(([repoId, worktrees]) =>
-      worktrees.map((worktree) =>
-        JSON.stringify({
-          repoId,
-          worktreeId: worktree.worktreeId,
-          path: worktree.path,
-          displayName: worktree.displayName
-        })
-      )
-    )
-    .sort()
-  return JSON.stringify(rows)
-}
-
-export class ClaudeUsageStore {
-  private state: ClaudeUsagePersistedState
-  private readonly store: Store
-  private scanPromise: Promise<void> | null = null
-  // Why: the 20 MB usage JSON must not block the Electron main thread; the writer serializes writes
-  // and vetoes superseded renames.
-  private readonly writer = new UsageCacheSnapshotWriter('[claude-usage]', getClaudeUsageFile)
-
-  constructor(store: Store) {
-    this.store = store
-    this.state = this.load()
-  }
-
-  private load(): ClaudeUsagePersistedState {
-    try {
-      const usageFile = getClaudeUsageFile()
-      if (!existsSync(usageFile)) {
-        return getDefaultState()
-      }
-      const parsed = JSON.parse(readFileSync(usageFile, 'utf-8')) as ClaudeUsagePersistedState
-      if (parsed.schemaVersion !== SCHEMA_VERSION) {
-        // Why: scanner semantics affect persisted totals, so old Claude caches
-        // must be rebuilt after parser/source changes instead of reused briefly.
-        // Preserve scanState.enabled so existing users keep tracking on across
-        // schema bumps; the next refresh will repopulate the analytics.
-        const defaults = getDefaultState()
-        return {
-          ...defaults,
-          scanState: {
-            ...defaults.scanState,
-            enabled: parsed.scanState?.enabled ?? defaults.scanState.enabled
-          }
-        }
-      }
-      return {
-        ...getDefaultState(),
-        ...parsed,
-        scanState: {
-          ...getDefaultState().scanState,
-          ...parsed.scanState
-        }
-      }
-    } catch (error) {
-      // Why: Claude usage is a local analytics feature, not primary workspace
-      // state. A corrupt cache should degrade to a fresh rebuild instead of
-      // preventing Orca from booting, but we leave the file on disk for debugging.
-      console.error('[claude-usage] Failed to load persisted state, starting fresh:', error)
-      return getDefaultState()
-    }
-  }
-
-  private writeToDisk(): Promise<void> {
-    // Pretty-print preserved: humans inspect this analytics cache on disk.
-    return this.writer.write(() => JSON.stringify(this.state, null, 2))
-  }
-
-  /** Await queued cache writes so quit does not drop the final snapshot. */
-  flush(): Promise<void> {
-    return this.writer.flush()
-  }
-
-  async setEnabled(enabled: boolean): Promise<ClaudeUsageScanState> {
-    this.state.scanState.enabled = enabled
-    await this.writeToDisk()
-    return this.getScanState()
-  }
-
-  getScanState(): ClaudeUsageScanState {
-    return {
-      ...this.state.scanState,
-      isScanning: this.scanPromise !== null,
-      hasAnyClaudeData: this.state.sessions.length > 0 || this.state.dailyAggregates.length > 0
-    }
+export class ClaudeUsageStore extends UsageProviderStoreLifecycle<
+  'processedFiles',
+  ClaudeUsagePersistedState,
+  'hasAnyClaudeData'
+> {
+  constructor(store: Pick<Store, 'getRepos' | 'getAllWorktreeMeta'>) {
+    super(store, {
+      logTag: '[claude-usage]',
+      resolveCacheFile: getClaudeUsageFile,
+      createDefaultState: getDefaultState,
+      normalizeState: normalizePersistedState,
+      sourceKey: 'processedFiles',
+      dataPresenceKey: 'hasAnyClaudeData',
+      jsonIndent: 2,
+      scan: scanClaudeUsageFiles
+    })
   }
 
   getSnapshot(
@@ -419,63 +332,6 @@ export class ClaudeUsageStore {
     }
   }
 
-  async refresh(force = false): Promise<ClaudeUsageScanState> {
-    if (!this.state.scanState.enabled) {
-      return this.getScanState()
-    }
-    const currentWorktreeFingerprint = await this.getCurrentWorktreeFingerprint()
-    if (!force && this.state.scanState.lastScanCompletedAt) {
-      const ageMs = Date.now() - this.state.scanState.lastScanCompletedAt
-      if (ageMs < STALE_MS && this.state.worktreeFingerprint === currentWorktreeFingerprint) {
-        return this.getScanState()
-      }
-    }
-    await this.runScan()
-    return this.getScanState()
-  }
-
-  private async runScan(): Promise<void> {
-    if (this.scanPromise) {
-      await this.scanPromise
-      return
-    }
-
-    this.state.scanState.lastScanStartedAt = Date.now()
-    this.state.scanState.lastScanError = null
-
-    // Why no write here: persisting scan-start would rewrite the whole multi-MB cache before a single
-    // result changed. The completion/failure write below persists the same fields.
-
-    // Why: assign scanPromise before any await so concurrent refresh shares one scan.
-    this.scanPromise = (async () => {
-      try {
-        const repos = this.store.getRepos()
-        const worktreesByRepo = loadKnownUsageWorktreesByRepo(this.store, repos)
-        const worktreeFingerprint = getWorktreeFingerprint(worktreesByRepo)
-        const result = await scanClaudeUsageFiles(
-          createWorktreeRefs(repos, worktreesByRepo),
-          this.state.worktreeFingerprint === worktreeFingerprint ? this.state.processedFiles : []
-        )
-        this.state.processedFiles = result.processedFiles
-        this.state.sessions = result.sessions
-        this.state.dailyAggregates = result.dailyAggregates
-        this.state.worktreeFingerprint = worktreeFingerprint
-        this.state.scanState.lastScanCompletedAt = Date.now()
-        this.state.scanState.lastScanError = null
-        // Why swallow: persistence is a cache concern. A disk failure must not turn a good scan into
-        // a scan error and reject refresh() for every query caller; writeToDisk already logs it.
-        await this.writeToDisk().catch(() => {})
-      } catch (error) {
-        this.state.scanState.lastScanError = error instanceof Error ? error.message : String(error)
-        await this.writeToDisk().catch(() => {})
-      } finally {
-        this.scanPromise = null
-      }
-    })()
-
-    await this.scanPromise
-  }
-
   async getSummary(scope: ClaudeUsageScope, range: ClaudeUsageRange): Promise<ClaudeUsageSummary> {
     await this.refresh(false)
     return this.buildSummary(scope, range)
@@ -843,7 +699,7 @@ export class ClaudeUsageStore {
   }
 
   private getFilteredDaily(scope: ClaudeUsageScope, range: ClaudeUsageRange) {
-    const cutoff = getRangeCutoff(range)
+    const cutoff = getUsageRangeCutoff(range)
     return this.state.dailyAggregates.filter((entry) => {
       if (cutoff && entry.day < cutoff) {
         return false
@@ -856,12 +712,12 @@ export class ClaudeUsageStore {
   }
 
   private getFilteredSessions(scope: ClaudeUsageScope, range: ClaudeUsageRange) {
-    const cutoff = getRangeCutoff(range)
+    const cutoff = getUsageRangeCutoff(range)
     return this.state.sessions.filter((session) => {
       // Why: daily aggregates use local calendar days, so session filtering has
       // to use the same conversion or the sessions table/counts can disagree
       // with the chart around UTC day boundaries.
-      const day = getLocalDay(session.lastTimestamp)
+      const day = getLocalUsageDay(session.lastTimestamp)
       if (!day) {
         return false
       }
@@ -883,10 +739,4 @@ export class ClaudeUsageStore {
       Boolean(lastScanError) || lastScanCompletedAt === null || lastScanCompletedAt < completedAt
     )
   }
-
-  private async getCurrentWorktreeFingerprint(): Promise<string> {
-    const repos = this.store.getRepos()
-    const worktreesByRepo = loadKnownUsageWorktreesByRepo(this.store, repos)
-    return getWorktreeFingerprint(worktreesByRepo)
-  }
 }
diff --git a/src/main/claude/hook-service.test.ts b/src/main/claude/hook-service.test.ts
index 0d390c3a9e3..b3fa02debc5 100644
--- a/src/main/claude/hook-service.test.ts
+++ b/src/main/claude/hook-service.test.ts
@@ -17,18 +17,34 @@ vi.mock('electron', () => ({
 import type { SFTPWrapper } from 'ssh2'
 import { createManagedCommandMatcher } from '../agent-hooks/installer-utils'
 import { ClaudeHookService } from './hook-service'
-import { OPENCLAUDE_HOOK_SETTINGS } from './hook-settings'
+import { getWindowsManagedLifecycleHook, OPENCLAUDE_HOOK_SETTINGS } from './hook-settings'
 
 const CLAUDE_SCRIPT_FILE_NAME = process.platform === 'win32' ? 'claude-hook.cmd' : 'claude-hook.sh'
 const STATUSLINE_SCRIPT_FILE_NAME =
   process.platform === 'win32' ? 'claude-statusline.cmd' : 'claude-statusline.sh'
 const OPENCLAUDE_SCRIPT_FILE_NAME =
   process.platform === 'win32' ? 'openclaude-hook.cmd' : 'openclaude-hook.sh'
-const WINDOWS_POWERSHELL_LAUNCHER =
-  /^[A-Za-z]:\/[^"]*\/System32\/WindowsPowerShell\/v1\.0\/powershell\.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand \S+$/
 const isClaudeManagedCommand = createManagedCommandMatcher(CLAUDE_SCRIPT_FILE_NAME)
 const isOpenClaudeManagedCommand = createManagedCommandMatcher(OPENCLAUDE_SCRIPT_FILE_NAME)
 
+type TestHook = { command: string; args?: string[] }
+
+function hasManagedCommand(hook: TestHook, matcher: (command: string | undefined) => boolean) {
+  return matcher(hook.command) || hook.args?.some(matcher) === true
+}
+
+describe('getWindowsManagedLifecycleHook', () => {
+  it('resolves the managed script from the runtime Windows profile', () => {
+    const scriptPath = 'C:\\Users\\%name%\\a^b&c\\.orca\\agent-hooks\\claude-hook.cmd'
+    const hook = getWindowsManagedLifecycleHook(scriptPath)
+
+    expect(hook.args?.[0]).toBe('--headless')
+    expect(hook.args?.[1]).toMatch(/\\System32\\cmd\.exe$/i)
+    expect(hook.args?.at(-1)).toBe('%USERPROFILE%\\.orca\\agent-hooks\\claude-hook.cmd')
+    expect(hook.args).not.toContain(scriptPath)
+  })
+})
+
 type FakeFs = {
   files: Map<string, string>
   dirs: Set<string>
@@ -162,18 +178,27 @@ describe('ClaudeHookService.install', () => {
           AWS_REGION: 'us-west-2'
         }
       })
-      const legacyCommands = legacy.hooks.Stop.flatMap(
-        (definition: { hooks: { command: string }[] }) =>
-          definition.hooks.map((hook) => hook.command)
+      const legacyHooks = legacy.hooks.Stop.flatMap(
+        (definition: { hooks: TestHook[] }) => definition.hooks
       )
-      expect(legacyCommands).toContain('/usr/local/bin/user-hook')
-      expect(legacyCommands.some((command: string) => isClaudeManagedCommand(command))).toBe(true)
+      expect(legacyHooks.map((hook: TestHook) => hook.command)).toContain(
+        '/usr/local/bin/user-hook'
+      )
+      const managedHook = legacyHooks.find((hook: TestHook) =>
+        hasManagedCommand(hook, isClaudeManagedCommand)
+      )
+      expect(JSON.stringify(managedHook)).not.toContain(tmpHome.replaceAll('\\', '/'))
       expect(
-        legacyCommands.some((command: string) =>
-          command.includes('/Users/old/.orca/agent-hooks/claude-hook.sh')
+        legacyHooks.some((hook: TestHook) => hasManagedCommand(hook, isClaudeManagedCommand))
+      ).toBe(true)
+      expect(
+        legacyHooks.some((hook: TestHook) =>
+          hook.command.includes('/Users/old/.orca/agent-hooks/claude-hook.sh')
         )
       ).toBe(false)
-      expect(isClaudeManagedCommand(legacy.hooks.StopFailure[0].hooks[0].command)).toBe(true)
+      expect(hasManagedCommand(legacy.hooks.StopFailure[0].hooks[0], isClaudeManagedCommand)).toBe(
+        true
+      )
       expect(
         readFileSync(join(tmpHome, '.orca', 'agent-hooks', CLAUDE_SCRIPT_FILE_NAME), 'utf-8')
       ).toContain('DEVIN_PROJECT_DIR')
@@ -194,7 +219,13 @@ describe('ClaudeHookService.install', () => {
         readFileSync(join(tmpHome, '.claude', 'settings.json'), 'utf-8')
       ) as { statusLine?: { type: string; command: string } }
       expect(settings.statusLine?.type).toBe('command')
-      expect(settings.statusLine?.command).toContain('claude-statusline')
+      expect(settings.statusLine?.command).toContain(
+        '"$HOME/.orca/agent-hooks/claude-statusline.cmd"'
+      )
+      expect(settings.statusLine?.command).toContain(
+        '"$HOME/.orca/agent-hooks/claude-statusline.sh"'
+      )
+      expect(settings.statusLine?.command).not.toContain(tmpHome.replaceAll('\\', '/'))
 
       const script = readFileSync(
         join(tmpHome, '.orca', 'agent-hooks', STATUSLINE_SCRIPT_FILE_NAME),
@@ -307,12 +338,8 @@ describe('ClaudeHookService.install', () => {
     }
   })
 
-  // Why: #6078 — Claude Code runs hooks through Git Bash, and an unquoted path
-  // with a space (e.g. `C:/Users/Jane Doe`) splits at the space. The managed
-  // command must use an encoded launcher so Git Bash/cmd.exe never splits or
-  // expands the raw path before invoking the managed .cmd.
   it.skipIf(process.platform !== 'win32')(
-    'wraps the managed hook command to survive spaces in the profile path (#6078)',
+    'runs portable managed hooks through headless exec form',
     () => {
       const tmpHome = mkdtempSync(join(tmpdir(), 'orca claude home with spaces '))
       vi.stubEnv('HOME', tmpHome)
@@ -322,11 +349,26 @@ describe('ClaudeHookService.install', () => {
 
         const settings = JSON.parse(
           readFileSync(join(tmpHome, '.claude', 'settings.json'), 'utf-8')
-        ) as { hooks: Record<string, { hooks: { command: string }[] }[]> }
+        ) as { hooks: Record<string, { hooks: TestHook[] }[]> }
+
+        const system32 = join(process.env.SystemRoot ?? 'C:\\Windows', 'System32')
+        const scriptPath = join(tmpHome, '.orca', 'agent-hooks', CLAUDE_SCRIPT_FILE_NAME)
+        const runtimeScriptPath = join(
+          '%USERPROFILE%',
+          '.orca',
+          'agent-hooks',
+          CLAUDE_SCRIPT_FILE_NAME
+        )
 
         for (const eventName of ['UserPromptSubmit', 'Stop', 'StopFailure']) {
-          const command = settings.hooks[eventName]?.[0]?.hooks?.[0]?.command
-          expect(command).toMatch(WINDOWS_POWERSHELL_LAUNCHER)
+          const hook = settings.hooks[eventName]?.[0]?.hooks?.[0]
+          expect(hook).toEqual({
+            type: 'command',
+            command: join(system32, 'conhost.exe'),
+            args: ['--headless', join(system32, 'cmd.exe'), '/d', '/c', runtimeScriptPath],
+            timeout: 10
+          })
+          expect(hook.args).not.toContain(scriptPath)
         }
       } finally {
         vi.unstubAllEnvs()
@@ -335,9 +377,6 @@ describe('ClaudeHookService.install', () => {
     }
   )
 
-  // Why: the launcher must stay PowerShell-encoded for Git Bash, but the hook
-  // POST inside the .cmd should use curl.exe so each hook spawns one
-  // interpreter, not two. Posting via a second PowerShell was the slow path.
   it.skipIf(process.platform !== 'win32')(
     'posts from the managed .cmd via curl.exe, not a second PowerShell',
     () => {
@@ -372,11 +411,7 @@ describe('ClaudeHookService.installRemote', () => {
     const settings = fs.files.get('/home/dev/.claude/settings.json')
     expect(settings).toBeTruthy()
     const parsed = JSON.parse(settings!)
-    // Why: every load-bearing event must be present and point at the
-    // remote-shaped script path with the guarded launcher applied. Drift in
-    // any of these is a real bug — Claude
-    // Code rejects unknown shapes silently and the agent-hooks pipeline
-    // goes dark.
+    // Why: Claude silently rejects drifted hook shapes, so assert every load-bearing event.
     for (const event of [
       // Why: SessionStart is the only signal a resumed/idle session ever emits;
       // without it the sidebar row waits for the first prompt (STA-3386).
@@ -394,8 +429,8 @@ describe('ClaudeHookService.installRemote', () => {
     ]) {
       expect(parsed.hooks[event]).toBeTruthy()
       const cmd = parsed.hooks[event][0].hooks[0].command as string
-      expect(cmd).toContain('/home/dev/.orca/agent-hooks/claude-hook.sh')
-      expect(cmd).toMatch(/^if \[ -f /)
+      expect(cmd).toContain('"$HOME/.orca/agent-hooks/claude-hook.sh"')
+      expect(cmd).not.toContain('/home/dev/.orca/agent-hooks/claude-hook.sh')
     }
     // Managed script body
     const script = fs.files.get('/home/dev/.orca/agent-hooks/claude-hook.sh')
@@ -487,9 +522,9 @@ describe('OpenClaudeHookService-compatible install', () => {
       for (const event of ['UserPromptSubmit', 'Stop', 'StopFailure']) {
         const command = parsed.hooks[event][0].hooks[0].command as string
         expect(isOpenClaudeManagedCommand(command)).toBe(true)
-        if (process.platform !== 'win32') {
-          expect(command).toMatch(/^if \[ -f /)
-        }
+        expect(command).toContain('"$HOME/.orca/agent-hooks/openclaude-hook.cmd"')
+        expect(command).toContain('"$HOME/.orca/agent-hooks/openclaude-hook.sh"')
+        expect(command).not.toContain(tmpHome.replaceAll('\\', '/'))
       }
       expect(
         readFileSync(join(tmpHome, '.orca', 'agent-hooks', OPENCLAUDE_SCRIPT_FILE_NAME), 'utf-8')
@@ -518,7 +553,8 @@ describe('OpenClaudeHookService-compatible install', () => {
     })
     const parsed = JSON.parse(fs.files.get('/home/dev/.openclaude/settings.json')!)
     const command = parsed.hooks.StopFailure[0].hooks[0].command as string
-    expect(command).toContain('/home/dev/.orca/agent-hooks/openclaude-hook.sh')
+    expect(command).toContain('"$HOME/.orca/agent-hooks/openclaude-hook.sh"')
+    expect(command).not.toContain('/home/dev/.orca/agent-hooks/openclaude-hook.sh')
     expect(fs.files.get('/home/dev/.orca/agent-hooks/openclaude-hook.sh')).toContain('/hook/claude')
   })
 })
diff --git a/src/main/claude/hook-service.ts b/src/main/claude/hook-service.ts
index ba2dfac1351..47269b1e17d 100644
--- a/src/main/claude/hook-service.ts
+++ b/src/main/claude/hook-service.ts
@@ -2,6 +2,7 @@ import { existsSync, rmSync, writeFileSync } from 'node:fs'
 import type { SFTPWrapper } from 'ssh2'
 import type { AgentHookInstallState, AgentHookInstallStatus } from '../../shared/agent-hook-types'
 import {
+  buildManagedCommandHook,
   buildWindowsAgentHookCurlPostCommand,
   readHooksJson,
   writeHooksJson,
@@ -13,6 +14,7 @@ import {
   writeHooksJsonRemote,
   writeManagedScriptRemote
 } from '../agent-hooks/installer-utils-remote'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
 import {
   buildPosixHookPayloadCapture,
   buildWindowsHookEnvironmentGuardLines,
@@ -28,6 +30,7 @@ import {
   getManagedScriptFileName,
   getConfigPath,
   getManagedCommand,
+  getManagedLifecycleHook,
   getManagedScriptPath,
   getPosixManagedScriptFileName,
   getRemoteConfigPath,
@@ -36,6 +39,7 @@ import {
   getStatusLineScriptFileName,
   getStatusLineScriptPath,
   getStatusLineSlotState,
+  hasSameManagedHookInvocation,
   removeManagedHooks,
   removeManagedStatusLine,
   type ClaudeCompatibleHookSettings
@@ -139,7 +143,7 @@ export class ClaudeHookService {
     }
 
     // Why: report partial registration instead of a false installed state.
-    const command = getManagedCommand(scriptPath)
+    const expectedHook = getManagedLifecycleHook(scriptPath, this.options.settings)
     const missing: string[] = []
     let presentCount = 0
     for (const event of CLAUDE_EVENTS) {
@@ -147,7 +151,7 @@ export class ClaudeHookService {
         ? config.hooks![event.eventName]!
         : []
       const hasCommand = definitions.some((definition) =>
-        (definition.hooks ?? []).some((hook) => hook.command === command)
+        (definition.hooks ?? []).some((hook) => hasSameManagedHookInvocation(hook, expectedHook))
       )
       if (hasCommand) {
         presentCount += 1
@@ -171,6 +175,18 @@ export class ClaudeHookService {
     return { agent: this.options.agent, state, configPath, managedHooksPresent, detail }
   }
 
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(
+      getManagedScriptPath(this.options.settings),
+      getManagedScript('local', { skipWhenDevinImportsClaude: this.options.agent === 'claude' })
+    )
+    // Why: no agent gate — the statusline script only ever exists for claude, so presence is the gate.
+    await refreshManagedScriptIfPresent(
+      getStatusLineScriptPath(this.options.settings),
+      getManagedStatusLineScript('local')
+    )
+  }
+
   install(): AgentHookInstallStatus {
     const configPath = getConfigPath(this.options.settings)
     const scriptPath = getManagedScriptPath(this.options.settings)
@@ -185,10 +201,10 @@ export class ClaudeHookService {
       }
     }
 
-    const command = getManagedCommand(scriptPath)
+    const hook = getManagedLifecycleHook(scriptPath, this.options.settings)
     let nextConfig = applyManagedHooks(
       config,
-      command,
+      hook,
       getManagedScriptFileName(this.options.settings)
     )
     writeManagedScript(
@@ -246,9 +262,9 @@ export class ClaudeHookService {
         }
       }
 
-      // Why: the POSIX wrapper is identical regardless of where the script lands; only the path differs.
-      const command = getRemoteManagedCommand(remoteScriptPath)
-      const nextConfig = applyManagedHooks(config, command, remoteScriptFileName)
+      // Why: settings resolve HOME at runtime while SFTP still targets the discovered remote home.
+      const hook = buildManagedCommandHook(getRemoteManagedCommand(remoteScriptPath))
+      const nextConfig = applyManagedHooks(config, hook, remoteScriptFileName)
 
       // Why: write scripts before settings to avoid settings pointing to missing scripts.
       // Why: SSH scripts always use POSIX .sh paths, regardless of the local OS.
diff --git a/src/main/claude/hook-settings.ts b/src/main/claude/hook-settings.ts
index de932276545..d39b8e27bcb 100644
--- a/src/main/claude/hook-settings.ts
+++ b/src/main/claude/hook-settings.ts
@@ -1,30 +1,34 @@
 import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { basename, extname, join, win32 } from 'node:path'
 import {
   buildManagedCommandHook,
   createManagedCommandMatcher,
   getSharedManagedScriptPath,
   isPlainObject,
+  MANAGED_HOOK_TIMEOUT_SECONDS,
   removeManagedCommands,
-  wrapPosixHookCommand,
-  wrapWindowsGitBashHookCommand,
+  type HookCommandConfig,
   type HookDefinition,
   type HooksConfig
 } from '../agent-hooks/installer-utils'
+import { wrapRuntimeHomeHookCommand } from '../agent-hooks/runtime-home-hook-command'
 
 export type ClaudeCompatibleHookSettings = {
   configDirName: '.claude' | '.openclaude'
   scriptBaseName: 'claude-hook' | 'openclaude-hook'
+  supportsExecHookArgs: boolean
 }
 
 export const CLAUDE_HOOK_SETTINGS: ClaudeCompatibleHookSettings = {
   configDirName: '.claude',
-  scriptBaseName: 'claude-hook'
+  scriptBaseName: 'claude-hook',
+  supportsExecHookArgs: true
 }
 
 export const OPENCLAUDE_HOOK_SETTINGS: ClaudeCompatibleHookSettings = {
   configDirName: '.openclaude',
-  scriptBaseName: 'openclaude-hook'
+  scriptBaseName: 'openclaude-hook',
+  supportsExecHookArgs: false
 }
 
 export const CLAUDE_EVENTS = [
@@ -105,18 +109,57 @@ export function getRemoteConfigPath(remoteHome: string, settings = CLAUDE_HOOK_S
 }
 
 export function getManagedCommand(scriptPath: string): string {
-  return process.platform === 'win32'
-    ? wrapWindowsGitBashHookCommand(scriptPath)
-    : wrapPosixHookCommand(scriptPath)
+  const scriptFileName = basename(scriptPath)
+  const extension = extname(scriptFileName)
+  return wrapRuntimeHomeHookCommand(
+    extension ? scriptFileName.slice(0, -extension.length) : scriptFileName
+  )
+}
+
+export function getManagedLifecycleHook(
+  scriptPath: string,
+  settings = CLAUDE_HOOK_SETTINGS
+): HookCommandConfig {
+  if (process.platform !== 'win32' || !settings.supportsExecHookArgs) {
+    return buildManagedCommandHook(getManagedCommand(scriptPath))
+  }
+  return getWindowsManagedLifecycleHook(scriptPath)
+}
+
+export function getWindowsManagedLifecycleHook(scriptPath: string): HookCommandConfig {
+  const system32 = win32.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32')
+  const runtimeScriptPath = win32.join(
+    '%USERPROFILE%',
+    '.orca',
+    'agent-hooks',
+    win32.basename(scriptPath)
+  )
+  // Why: Claude's Windows shell form opens Git Bash consoles; exec form hosts the client in a windowless console.
+  return {
+    type: 'command',
+    command: win32.join(system32, 'conhost.exe'),
+    args: ['--headless', win32.join(system32, 'cmd.exe'), '/d', '/c', runtimeScriptPath],
+    timeout: MANAGED_HOOK_TIMEOUT_SECONDS
+  }
+}
+
+export function hasSameManagedHookInvocation(
+  actual: HookCommandConfig,
+  expected: HookCommandConfig
+): boolean {
+  return (
+    actual.command === expected.command &&
+    JSON.stringify(actual.args ?? []) === JSON.stringify(expected.args ?? [])
+  )
 }
 
 export function getRemoteManagedCommand(scriptPath: string): string {
-  return wrapPosixHookCommand(scriptPath)
+  return getManagedCommand(scriptPath)
 }
 
 export function applyManagedHooks(
   config: HooksConfig,
-  command: string,
+  hook: HookCommandConfig,
   scriptFileName = getManagedScriptFileName()
 ): HooksConfig {
   const nextHooks = { ...config.hooks }
@@ -127,7 +170,7 @@ export function applyManagedHooks(
     const cleaned = removeManagedCommands(current, isManagedCommand)
     const definition: HookDefinition = {
       ...event.definition,
-      hooks: [buildManagedCommandHook(command)]
+      hooks: [hook]
     }
     nextHooks[event.eventName] = [...cleaned, definition]
   }
diff --git a/src/main/cli/cli-installer.test.ts b/src/main/cli/cli-installer.test.ts
index 9c17fd21116..180611c1590 100644
--- a/src/main/cli/cli-installer.test.ts
+++ b/src/main/cli/cli-installer.test.ts
@@ -489,7 +489,7 @@ describe('CliInstaller', () => {
     const registryReader = new WindowsUserPathRegistryReader({
       platform: 'win32',
       registryLoader: async () => ({
-        HK: { CU: 0x80000001 },
+        HK: { CU: 0x80000001, LM: 0x80000002 },
         getRegistryKey: () => ({
           Path: { name: 'Path', type: 2, value: registryPath }
         })
diff --git a/src/main/cli/windows-user-path-registry.test.ts b/src/main/cli/windows-user-path-registry.test.ts
index 12beca13852..7f919694626 100644
--- a/src/main/cli/windows-user-path-registry.test.ts
+++ b/src/main/cli/windows-user-path-registry.test.ts
@@ -7,7 +7,7 @@ import {
 
 function registryModule(pathValue?: string, type = 2) {
   return {
-    HK: { CU: 0x80000001 },
+    HK: { CU: 0x80000001, LM: 0x80000002 },
     REG: { SZ: 1, EXPAND_SZ: 2 },
     getRegistryKey: vi.fn(() =>
       pathValue === undefined ? {} : { Path: { name: 'Path', type, value: pathValue } }
diff --git a/src/main/cli/windows-user-path-registry.ts b/src/main/cli/windows-user-path-registry.ts
index d3e493fd87d..90e8ba7863e 100644
--- a/src/main/cli/windows-user-path-registry.ts
+++ b/src/main/cli/windows-user-path-registry.ts
@@ -1,26 +1,17 @@
-import { createRequire } from 'node:module'
+import {
+  loadWindowsNativeRegistry,
+  WINDOWS_REG_EXPAND_SZ,
+  WINDOWS_REG_SZ,
+  type WindowsNativeRegistryModule
+} from '../windows-native-registry'
 
 export type WindowsUserPathReadResult =
   | { state: 'success'; value: string | null; expandable: boolean }
   | { state: 'unknown'; detail: string }
 
-type RegistryValue = {
-  name?: unknown
-  type?: unknown
-  value?: unknown
-}
-
-type WindowsRegistryModule = {
-  HK: { CU: number }
-  getRegistryKey: (
-    root: number,
-    path: string
-  ) => Record<string, RegistryValue | undefined> | null | undefined
-}
-
 type WindowsUserPathRegistryReaderOptions = {
   platform?: NodeJS.Platform
-  registryLoader?: () => Promise<WindowsRegistryModule>
+  registryLoader?: () => Promise<WindowsNativeRegistryModule>
   now?: () => number
   cacheTtlMs?: number
 }
@@ -28,19 +19,9 @@ type WindowsUserPathRegistryReaderOptions = {
 const DEFAULT_CACHE_TTL_MS = 1_000
 const USER_ENVIRONMENT_KEY = 'Environment'
 const USER_PATH_VALUE = 'Path'
-const REG_SZ = 1
-const REG_EXPAND_SZ = 2
-const requireFromMain = createRequire(__filename)
-
-async function loadWindowsRegistryModule(): Promise<WindowsRegistryModule> {
-  // Why: the optional dependency is not present in non-Windows installs, so
-  // TypeScript and the main bundle must not resolve it eagerly.
-  return requireFromMain('windows-native-registry') as WindowsRegistryModule
-}
-
 export class WindowsUserPathRegistryReader {
   private readonly platform: NodeJS.Platform
-  private readonly registryLoader: () => Promise<WindowsRegistryModule>
+  private readonly registryLoader: () => Promise<WindowsNativeRegistryModule>
   private readonly now: () => number
   private readonly cacheTtlMs: number
   private cached: { readAt: number; result: WindowsUserPathReadResult } | null = null
@@ -49,7 +30,7 @@ export class WindowsUserPathRegistryReader {
 
   constructor(options: WindowsUserPathRegistryReaderOptions = {}) {
     this.platform = options.platform ?? process.platform
-    this.registryLoader = options.registryLoader ?? loadWindowsRegistryModule
+    this.registryLoader = options.registryLoader ?? (async () => loadWindowsNativeRegistry())
     this.now = options.now ?? Date.now
     this.cacheTtlMs = options.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS
   }
@@ -123,7 +104,7 @@ export class WindowsUserPathRegistryReader {
         return { state: 'success', value: null, expandable: false }
       }
       if (
-        (pathEntry.type !== REG_SZ && pathEntry.type !== REG_EXPAND_SZ) ||
+        (pathEntry.type !== WINDOWS_REG_SZ && pathEntry.type !== WINDOWS_REG_EXPAND_SZ) ||
         typeof pathEntry.value !== 'string'
       ) {
         return {
@@ -134,7 +115,7 @@ export class WindowsUserPathRegistryReader {
       return {
         state: 'success',
         value: pathEntry.value || null,
-        expandable: pathEntry.type === REG_EXPAND_SZ
+        expandable: pathEntry.type === WINDOWS_REG_EXPAND_SZ
       }
     } catch {
       return {
diff --git a/src/main/cli/wsl-cli-installer.test.ts b/src/main/cli/wsl-cli-installer.test.ts
index 13bd8088de3..581c6f075b6 100644
--- a/src/main/cli/wsl-cli-installer.test.ts
+++ b/src/main/cli/wsl-cli-installer.test.ts
@@ -313,7 +313,7 @@ describe('WslCliInstaller', () => {
 
   it('generates a launcher that forwards arguments through a PowerShell file bridge', () => {
     const launcher = _internals.buildWslLauncher(
-      'C:\\Program Files\\Orca\\orca.cmd',
+      'C:\\Program Files\\Orca\\resources\\bin\\orca.exe',
       '/home/alice/.local/share/orca/orca-wsl-bridge.ps1'
     )
     const bridge = _internals.buildWslBridgeScript()
@@ -333,21 +333,22 @@ describe('WslCliInstaller', () => {
     )
     expect(launcher).toContain('"$ORCA_WIN_LAUNCHER" -WslCwd "$ORCA_WSL_CWD_WIN" "$@"')
     expect(launcher).not.toContain('-Command')
-    expect(bridge).toContain('[CmdletBinding(PositionalBinding=$false)]')
-    expect(bridge).toContain('[Parameter(Mandatory=$true, Position=0)]')
-    expect(bridge).toContain('[string]$WslCwd')
-    expect(bridge).toContain('[Parameter(ValueFromRemainingArguments=$true)]')
+    expect(bridge).not.toContain('[CmdletBinding')
+    expect(bridge).not.toMatch(/^param\(/m)
+    expect(bridge).toContain("$args[1] -eq '-WslCwd'")
+    expect(bridge).toContain('[string]$OrcaLauncher = $args[0]')
+    expect(bridge).toContain('$WslCwd = $args[2]')
+    expect(bridge).toContain('$ForwardArgs = @($args[$ForwardArgStart..($args.Count - 1)])')
     expect(bridge).toContain('if ([string]::IsNullOrEmpty($WslCwd))')
     expect(bridge).toContain('$env:ORCA_CLI_CWD = $WslCwd')
     expect(bridge).toContain('Push-Location -LiteralPath (Split-Path -Parent $OrcaLauncher)')
-    expect(bridge).toContain('& $OrcaLauncher @ForwardArgs')
-    const nullExitCodeBranch = bridge.indexOf('if ($null -eq $LASTEXITCODE)')
-    const invocationFailureBranch = bridge.indexOf('if (-not $?)')
-    expect(nullExitCodeBranch).toBeGreaterThan(-1)
-    // Why: native launchers can set a non-zero LASTEXITCODE while $? is false;
-    // checking the native status first preserves that specific exit code.
-    expect(nullExitCodeBranch).toBeLessThan(invocationFailureBranch)
-    expect(bridge).toContain('$exitCode = $LASTEXITCODE')
+    expect(bridge).toContain('function ConvertTo-NativeCommandLineArgument')
+    expect(bridge).toContain("[void]$Quoted.Append([char]'\\', $BackslashCount * 2 + 1)")
+    expect(bridge).toContain('$StartInfo.UseShellExecute = $false')
+    expect(bridge).toContain('[System.Diagnostics.Process]::Start($StartInfo)')
+    expect(bridge).toContain('$Process.WaitForExit()')
+    expect(bridge).toContain('$exitCode = $Process.ExitCode')
+    expect(bridge).not.toContain('& $OrcaLauncher @ForwardArgs')
     expect(bridge).toContain('Remove-Item Env:ORCA_CLI_CWD -ErrorAction SilentlyContinue')
     expect(bridge).toContain('catch')
     expect(bridge).toContain('$exitCode = 1')
diff --git a/src/main/cli/wsl-cli-installer.ts b/src/main/cli/wsl-cli-installer.ts
index f6a1684e19c..3dee00a871b 100644
--- a/src/main/cli/wsl-cli-installer.ts
+++ b/src/main/cli/wsl-cli-installer.ts
@@ -379,7 +379,7 @@ export class WslCliInstaller {
   private async readCommandFile(
     distro: string,
     commandPath: string
-  ): Promise<string | 'not_file' | null> {
+  ): Promise<(string & {}) | 'not_file' | null> {
     const output = await this.run(
       distro,
       [
diff --git a/src/main/cli/wsl-cli-powershell-boundary.test.ts b/src/main/cli/wsl-cli-powershell-boundary.test.ts
new file mode 100644
index 00000000000..7e706a0ed12
--- /dev/null
+++ b/src/main/cli/wsl-cli-powershell-boundary.test.ts
@@ -0,0 +1,120 @@
+import { spawnSync } from 'node:child_process'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { buildWslBridgeScript, buildWslLauncher } from './wsl-cli-scripts'
+
+const FORWARDED_ARGS = [
+  'terminal',
+  'wait',
+  '--terminal',
+  'term_example',
+  '--for',
+  'tui-idle',
+  '--wsl',
+  'forwarded-wsl-value',
+  '--orca',
+  'forwarded-orca-value',
+  '--debug',
+  'forwarded-debug-value',
+  '--deps',
+  '["task_907c556bfed6"]',
+  '--quoted-text',
+  'tell me "what is next"',
+  '--empty',
+  '',
+  '--trailing-backslash',
+  'C:\\path with spaces\\',
+  '--',
+  'tail'
+]
+
+describe('WSL CLI PowerShell boundary', () => {
+  it('keeps forwarded argv outside PowerShell parsing', () => {
+    const launcher = buildWslLauncher('C:\\Program Files\\Orca\\orca.exe')
+    const bridge = buildWslBridgeScript()
+
+    expect(launcher).toContain('"$ORCA_WIN_LAUNCHER" -WslCwd "$ORCA_WSL_CWD_WIN" "$@"')
+    expect(bridge).not.toContain('[CmdletBinding')
+    expect(bridge).not.toMatch(/^param\(/m)
+    expect(bridge).toContain('$ForwardArgs = @($args[$ForwardArgStart..($args.Count - 1)])')
+    expect(bridge).toContain('function ConvertTo-NativeCommandLineArgument')
+    expect(bridge).toContain('$StartInfo.UseShellExecute = $false')
+  })
+
+  it.skipIf(process.platform !== 'win32')(
+    'preserves native argv and exit status through Windows PowerShell 5.1',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-wsl-powershell-boundary-'))
+      const fixtureDir = join(root, 'fixture with spaces')
+      const bridgePath = join(fixtureDir, 'orca-wsl-bridge.ps1')
+      const targetPath = join(fixtureDir, 'argv-target.cjs')
+      const wslCwd = join(root, 'WSL cwd with spaces')
+
+      try {
+        await mkdir(fixtureDir)
+        await writeFile(bridgePath, buildWslBridgeScript(), 'utf8')
+        await writeFile(
+          targetPath,
+          'process.stdout.write(JSON.stringify({ argv: process.argv.slice(2), cwd: process.env.ORCA_CLI_CWD ?? null }))\n',
+          'utf8'
+        )
+        const invocations = [
+          {
+            bridgeArgs: [process.execPath, '-WslCwd', wslCwd, targetPath, ...FORWARDED_ARGS],
+            expected: { argv: FORWARDED_ARGS, cwd: wslCwd }
+          },
+          {
+            bridgeArgs: [process.execPath, '-WslCwd', wslCwd, targetPath],
+            expected: { argv: [], cwd: wslCwd }
+          },
+          {
+            bridgeArgs: [process.execPath, targetPath, ...FORWARDED_ARGS],
+            expected: { argv: FORWARDED_ARGS, cwd: null }
+          }
+        ]
+        for (const { bridgeArgs, expected } of invocations) {
+          const result = spawnSync(
+            'powershell.exe',
+            [
+              '-NoProfile',
+              '-NonInteractive',
+              '-ExecutionPolicy',
+              'Bypass',
+              '-File',
+              bridgePath,
+              ...bridgeArgs
+            ],
+            { encoding: 'utf8', env: { ...process.env, ORCA_CLI_CWD: 'stale' } }
+          )
+
+          expect(result.error).toBeUndefined()
+          expect(result.stderr).toBe('')
+          expect(result.status).toBe(0)
+          expect(JSON.parse(result.stdout.trim())).toEqual(expected)
+        }
+
+        const exitResult = spawnSync(
+          'powershell.exe',
+          [
+            '-NoProfile',
+            '-NonInteractive',
+            '-ExecutionPolicy',
+            'Bypass',
+            '-File',
+            bridgePath,
+            process.execPath,
+            '-e',
+            'process.exit(23)'
+          ],
+          { encoding: 'utf8' }
+        )
+        expect(exitResult.error).toBeUndefined()
+        expect(exitResult.status).toBe(23)
+      } finally {
+        await rm(root, { recursive: true, force: true })
+      }
+    }
+  )
+})
diff --git a/src/main/cli/wsl-cli-registration-registry.ts b/src/main/cli/wsl-cli-registration-registry.ts
index d1a84a42f52..99d3faff5d4 100644
--- a/src/main/cli/wsl-cli-registration-registry.ts
+++ b/src/main/cli/wsl-cli-registration-registry.ts
@@ -138,7 +138,7 @@ async function readState(userDataPath: string): Promise<WslCliRegistrationRegist
 function upsertDistro(distros: string[], distro: string): string[] {
   const key = normalizeWslDistroKey(distro)
   const existingIndex = distros.findIndex((entry) => normalizeWslDistroKey(entry) === key)
-  if (existingIndex < 0) {
+  if (existingIndex === -1) {
     return [...distros, distro.trim()]
   }
   return distros.map((entry, index) => (index === existingIndex ? distro.trim() : entry))
diff --git a/src/main/cli/wsl-cli-scripts.ts b/src/main/cli/wsl-cli-scripts.ts
index 3297b9be9c1..3dba83bd30c 100644
--- a/src/main/cli/wsl-cli-scripts.ts
+++ b/src/main/cli/wsl-cli-scripts.ts
@@ -34,35 +34,75 @@ exec "$ORCA_POWERSHELL" -NoProfile -ExecutionPolicy Bypass -File "$ORCA_BRIDGE_P
 
 export function buildWslBridgeScript(): string {
   return `${BRIDGE_MANAGED_MARKER}
-[CmdletBinding(PositionalBinding=$false)]
-param(
-  [Parameter(Mandatory=$true, Position=0)]
-  [string]$OrcaLauncher,
+function ConvertTo-NativeCommandLineArgument {
+  param([AllowEmptyString()][string]$Value)
 
-  [string]$WslCwd,
+  if ($Value.Length -gt 0 -and $Value -notmatch '[\\s"]') {
+    return $Value
+  }
 
-  [Parameter(ValueFromRemainingArguments=$true)]
-  [string[]]$ForwardArgs
-)
+  $Quoted = [System.Text.StringBuilder]::new()
+  [void]$Quoted.Append([char]'"')
+  [int]$BackslashCount = 0
+  foreach ($Character in $Value.ToCharArray()) {
+    if ($Character -eq [char]'\\') {
+      $BackslashCount += 1
+      continue
+    }
+    if ($Character -eq [char]'"') {
+      [void]$Quoted.Append([char]'\\', $BackslashCount * 2 + 1)
+      [void]$Quoted.Append([char]'"')
+    } else {
+      [void]$Quoted.Append([char]'\\', $BackslashCount)
+      [void]$Quoted.Append($Character)
+    }
+    $BackslashCount = 0
+  }
+  [void]$Quoted.Append([char]'\\', $BackslashCount * 2)
+  [void]$Quoted.Append([char]'"')
+  return $Quoted.ToString()
+}
 
 $exitCode = 0
 try {
+  # Why: a param block prefix-binds forwarded flags such as --for in PowerShell 5.1.
+  if ($args.Count -lt 1) {
+    throw 'Invalid Orca WSL CLI bridge invocation.'
+  }
+  [string]$OrcaLauncher = $args[0]
+  [string]$WslCwd = ''
+  [int]$ForwardArgStart = 1
+  if ($args.Count -ge 2 -and $args[1] -eq '-WslCwd') {
+    if ($args.Count -lt 3) {
+      throw 'Invalid Orca WSL CLI bridge invocation.'
+    }
+    $WslCwd = $args[2]
+    $ForwardArgStart = 3
+  }
+  [string[]]$ForwardArgs = @()
+  if ($args.Count -gt $ForwardArgStart) {
+    $ForwardArgs = @($args[$ForwardArgStart..($args.Count - 1)])
+  }
   if ([string]::IsNullOrEmpty($WslCwd)) {
     Remove-Item Env:ORCA_CLI_CWD -ErrorAction SilentlyContinue
   } else {
     $env:ORCA_CLI_CWD = $WslCwd
   }
   Push-Location -LiteralPath (Split-Path -Parent $OrcaLauncher)
-  & $OrcaLauncher @ForwardArgs
-  if ($null -eq $LASTEXITCODE) {
-    if (-not $?) {
-      $exitCode = 1
-    } else {
-      $exitCode = 0
-    }
-  } else {
-    $exitCode = $LASTEXITCODE
+  # Why: Windows PowerShell 5.1 cannot losslessly splat strings to native argv.
+  $StartInfo = [System.Diagnostics.ProcessStartInfo]::new()
+  $StartInfo.FileName = $OrcaLauncher
+  $StartInfo.Arguments = (($ForwardArgs | ForEach-Object {
+    ConvertTo-NativeCommandLineArgument $_
+  }) -join ' ')
+  $StartInfo.UseShellExecute = $false
+  $Process = [System.Diagnostics.Process]::Start($StartInfo)
+  if ($null -eq $Process) {
+    throw 'Unable to start the Orca Windows CLI launcher.'
   }
+  $Process.WaitForExit()
+  $exitCode = $Process.ExitCode
+  $Process.Dispose()
 } catch {
   Write-Error $_
   $exitCode = 1
diff --git a/src/main/codex-accounts/runtime-home-service.test.ts b/src/main/codex-accounts/runtime-home-service.test.ts
index 15a48821501..966d901f994 100644
--- a/src/main/codex-accounts/runtime-home-service.test.ts
+++ b/src/main/codex-accounts/runtime-home-service.test.ts
@@ -1206,6 +1206,44 @@ describe('CodexRuntimeHomeService', () => {
     }
   })
 
+  it('resolves only Orca-owned homes used by live retained host shells', async () => {
+    const accountHome = createManagedAuth(
+      testState.userDataDir,
+      'account-1',
+      createCodexAuthJson('managed@example.com', 'acct-managed', 'managed')
+    )
+    const unownedHome = join(testState.fakeHomeDir, 'unowned-codex-home')
+    mkdirSync(unownedHome, { recursive: true })
+    writeFileSync(join(unownedHome, '.orca-managed-home'), 'account-2\n', 'utf-8')
+    writePaneRegistry({
+      'shared-pane': { selectionKey: 'host', accountId: null, homeRoute: 'shared-home' },
+      'account-pane': { selectionKey: 'host', accountId: 'account-1', homeRoute: 'account-home' },
+      'unowned-pane': { selectionKey: 'host', accountId: 'account-2', homeRoute: 'account-home' },
+      'real-pane': { selectionKey: 'host', accountId: null, homeRoute: 'real-home' },
+      'wsl-pane': { selectionKey: 'wsl:Ubuntu', accountId: null, homeRoute: 'wsl-home' }
+    })
+    const settings = createSettings({
+      codexManagedAccounts: [
+        createCodexAccountRecord('account-1', 'managed@example.com', 'acct-managed', accountHome),
+        createCodexAccountRecord('account-2', 'other@example.com', 'acct-other', unownedHome)
+      ]
+    })
+    const store = createStore(settings)
+    const { CodexRuntimeHomeService } = await import('./runtime-home-service')
+    const service = new CodexRuntimeHomeService(store as never)
+
+    expect(
+      service.getRetainedHostCodexHookHomePaths([
+        'shared-pane',
+        'account-pane',
+        'unowned-pane',
+        'real-pane',
+        'wsl-pane',
+        'unknown-pane'
+      ])
+    ).toEqual([getRuntimeCodexHomePath(), accountHome])
+  })
+
   it('keeps pre-rollout shared-home panes authenticated on the real-home lane', async () => {
     const oldSystemAuth = createCodexAuthJson('system@example.com', 'acct-system', 'old-system')
     const systemAuth = createCodexAuthJson('system@example.com', 'acct-system', 'system')
diff --git a/src/main/codex-accounts/runtime-home-service.ts b/src/main/codex-accounts/runtime-home-service.ts
index 68d054f3571..2d4b8239aad 100644
--- a/src/main/codex-accounts/runtime-home-service.ts
+++ b/src/main/codex-accounts/runtime-home-service.ts
@@ -83,6 +83,7 @@ import { migrateLegacySharedAuthToPerAccountHome } from './legacy-shared-auth-mi
 import { CodexCredentialAbsenceGrace } from './codex-credential-absence-grace'
 import { syncLegacySharedCodexConfigForRetainedPanes } from './legacy-shared-config-compatibility'
 import {
+  getCodexPaneAccount,
   hasRecordedLegacySharedCodexPane,
   type CodexPaneHomeRoute
 } from '../codex/codex-pane-account-registry'
@@ -545,6 +546,40 @@ export class CodexRuntimeHomeService {
     return this.isHostSystemDefaultRealHome() ? 'real-home' : 'shared-home'
   }
 
+  getRetainedHostCodexHookHomePaths(ptyIds: readonly string[]): string[] {
+    const settings = this.store.getSettings()
+    const homes = new Map<string, string>()
+    for (const ptyId of ptyIds) {
+      const record = getCodexPaneAccount(ptyId)
+      if (!record || record.selectionKey !== 'host') {
+        continue
+      }
+      if (
+        record.homeRoute === undefined ||
+        record.homeRoute === 'shared-home' ||
+        record.homeRoute === 'custom-home'
+      ) {
+        const homePath = this.getRuntimeHomePath()
+        homes.set(normalizeRuntimePathForComparison(homePath), homePath)
+        continue
+      }
+      if (record.homeRoute !== 'account-home' || !record.accountId) {
+        continue
+      }
+      const account = settings.codexManagedAccounts.find(
+        (candidate) => candidate.id === record.accountId
+      )
+      if (!account || this.getWslManagedHomePath(account)) {
+        continue
+      }
+      const homePath = this.getTrustedSelfContainedManagedHomePath(account)
+      if (homePath) {
+        homes.set(normalizeRuntimePathForComparison(homePath), homePath)
+      }
+    }
+    return [...homes.values()]
+  }
+
   // Why: the real-home hook installer flips this gate off when the trust-grant
   // client reports the host incapable, keeping that host byte-identical to the
   // managed lane instead of shipping status-blind panes.
diff --git a/src/main/codex-accounts/service.ts b/src/main/codex-accounts/service.ts
index b55c9b50315..eef834af323 100644
--- a/src/main/codex-accounts/service.ts
+++ b/src/main/codex-accounts/service.ts
@@ -1311,7 +1311,7 @@ export class CodexAccountService {
 
     const managedRootMarker = '/.local/share/orca/codex-accounts/'
     const markerIndex = wslInfo.linuxPath.indexOf(managedRootMarker)
-    if (markerIndex < 0) {
+    if (markerIndex === -1) {
       return null
     }
     const wslHome = wslInfo.linuxPath.slice(0, markerIndex)
diff --git a/src/main/codex-usage/store-snapshot.benchmark.test.ts b/src/main/codex-usage/store-snapshot.benchmark.test.ts
index 6ecd39963b9..dbd1482f34c 100644
--- a/src/main/codex-usage/store-snapshot.benchmark.test.ts
+++ b/src/main/codex-usage/store-snapshot.benchmark.test.ts
@@ -16,8 +16,8 @@ vi.mock('electron', () => ({
 function createStoreWithState(state: CodexUsagePersistedState): CodexUsageStore {
   const store = new CodexUsageStore({
     getRepos: () => [],
-    getWorktreeMeta: () => undefined
-  } as never)
+    getAllWorktreeMeta: () => ({})
+  })
 
   ;(store as unknown as { state: CodexUsagePersistedState }).state = state
   return store
diff --git a/src/main/codex-usage/store.test.ts b/src/main/codex-usage/store.test.ts
index 83e5a43fabd..dc5d7b9fe56 100644
--- a/src/main/codex-usage/store.test.ts
+++ b/src/main/codex-usage/store.test.ts
@@ -1,25 +1,12 @@
 /* eslint-disable max-lines */
-import { mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
-import type * as FsPromises from 'node:fs/promises'
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type {
-  CodexUsageDailyAggregate,
-  CodexUsagePersistedFile,
-  CodexUsagePersistedState,
-  CodexUsageSession
-} from './types'
+import type { CodexUsagePersistedState } from './types'
 
-const { getPathMock, writeOpens, writeGate } = vi.hoisted(() => ({
-  getPathMock: vi.fn(() => '/tmp/orca-test-userdata'),
-  // Why only mode 'w': the durable write also opens the directory read-only to fsync it, so counting
-  // every open would hide a regression back to multiple full-cache rewrites per scan.
-  writeOpens: { value: 0, inFlight: 0, maxConcurrent: 0 },
-  writeGate: {
-    blocked: false,
-    waiters: [] as (() => void)[]
-  }
+const { getPathMock } = vi.hoisted(() => ({
+  getPathMock: vi.fn(() => '/tmp/orca-test-userdata')
 }))
 
 vi.mock('electron', () => ({
@@ -28,29 +15,6 @@ vi.mock('electron', () => ({
   }
 }))
 
-vi.mock('node:fs/promises', async () => {
-  const actual = await vi.importActual<typeof FsPromises>('node:fs/promises')
-  return {
-    ...actual,
-    open: (async (...args: Parameters<typeof actual.open>) => {
-      if (args[1] !== 'w') {
-        return actual.open(...args)
-      }
-      writeOpens.value += 1
-      writeOpens.inFlight += 1
-      writeOpens.maxConcurrent = Math.max(writeOpens.maxConcurrent, writeOpens.inFlight)
-      try {
-        if (writeGate.blocked) {
-          await new Promise<void>((resolve) => writeGate.waiters.push(resolve))
-        }
-        return await actual.open(...args)
-      } finally {
-        writeOpens.inFlight -= 1
-      }
-    }) as typeof actual.open
-  }
-})
-
 vi.mock('./scanner', () => ({
   scanCodexUsageFiles: vi.fn()
 }))
@@ -58,27 +22,7 @@ vi.mock('./scanner', () => ({
 import { CodexUsageStore, initCodexUsagePath, normalizePersistedState } from './store'
 import { scanCodexUsageFiles } from './scanner'
 
-type ScanResult = {
-  processedFiles: CodexUsagePersistedFile[]
-  sessions: CodexUsageSession[]
-  dailyAggregates: CodexUsageDailyAggregate[]
-}
-
-function createDeferred<T>(): {
-  promise: Promise<T>
-  resolve: (value: T) => void
-  reject: (reason?: unknown) => void
-} {
-  let resolve!: (value: T) => void
-  let reject!: (reason?: unknown) => void
-  const promise = new Promise<T>((promiseResolve, promiseReject) => {
-    resolve = promiseResolve
-    reject = promiseReject
-  })
-  return { promise, resolve, reject }
-}
-
-function createEmptyScanResult(): ScanResult {
+function createEmptyScanResult() {
   return {
     processedFiles: [],
     sessions: [],
@@ -89,9 +33,8 @@ function createEmptyScanResult(): ScanResult {
 function createStoreWithState(state: Partial<CodexUsagePersistedState>): CodexUsageStore {
   const store = new CodexUsageStore({
     getRepos: () => [],
-    getAllWorktreeMeta: () => ({}),
-    getWorktreeMeta: () => undefined
-  } as never)
+    getAllWorktreeMeta: () => ({})
+  })
 
   ;(store as unknown as { state: CodexUsagePersistedState }).state = {
     schemaVersion: 1,
@@ -118,11 +61,6 @@ describe('CodexUsageStore', () => {
     tempUserData = mkdtempSync(join(tmpdir(), 'orca-codex-usage-store-'))
     getPathMock.mockReturnValue(tempUserData)
     initCodexUsagePath()
-    writeOpens.value = 0
-    writeOpens.inFlight = 0
-    writeOpens.maxConcurrent = 0
-    writeGate.blocked = false
-    writeGate.waiters = []
     vi.mocked(scanCodexUsageFiles).mockReset()
     vi.mocked(scanCodexUsageFiles).mockResolvedValue(createEmptyScanResult())
     vi.useFakeTimers()
@@ -134,7 +72,7 @@ describe('CodexUsageStore', () => {
     rmSync(tempUserData, { recursive: true, force: true })
   })
 
-  it('persists a successful refresh with one compact async disk write', async () => {
+  it('adapts Codex scans to compact cache persistence', async () => {
     const store = createStoreWithState({
       schemaVersion: 5,
       scanState: {
@@ -147,92 +85,9 @@ describe('CodexUsageStore', () => {
 
     await store.refresh(true)
 
-    // Why exactly one: a refresh that rewrites the whole 60 MB cache twice is the regression this guards.
-    expect(writeOpens.value).toBe(1)
-    expect(readdirSync(tempUserData).filter((f) => f.endsWith('.tmp'))).toHaveLength(0)
     const persistedJson = readFileSync(join(tempUserData, 'orca-codex-usage.json'), 'utf-8')
+    expect(scanCodexUsageFiles).toHaveBeenCalledWith([], [])
     expect(persistedJson).toBe(JSON.stringify(JSON.parse(persistedJson)))
-    expect(persistedJson).not.toContain('\n')
-    expect(JSON.parse(persistedJson).scanState).toMatchObject({
-      enabled: true,
-      lastScanStartedAt: new Date('2026-04-10T12:00:00.000-04:00').getTime(),
-      lastScanCompletedAt: new Date('2026-04-10T12:00:00.000-04:00').getTime(),
-      lastScanError: null
-    })
-  })
-
-  it('keeps scan start visible in memory while scan-start persistence is skipped', async () => {
-    const pendingScan = createDeferred<ScanResult>()
-    vi.mocked(scanCodexUsageFiles).mockReturnValueOnce(pendingScan.promise)
-    const store = createStoreWithState({
-      schemaVersion: 5,
-      scanState: {
-        enabled: true,
-        lastScanStartedAt: null,
-        lastScanCompletedAt: null,
-        lastScanError: 'previous failure'
-      }
-    })
-
-    const refreshPromise = store.refresh(true)
-    await Promise.resolve()
-
-    expect(store.getScanState()).toMatchObject({
-      isScanning: true,
-      lastScanStartedAt: new Date('2026-04-10T12:00:00.000-04:00').getTime(),
-      lastScanError: null
-    })
-    expect(writeOpens.value).toBe(0)
-
-    pendingScan.resolve(createEmptyScanResult())
-    await refreshPromise
-
-    expect(store.getScanState().isScanning).toBe(false)
-    expect(writeOpens.value).toBe(1)
-  })
-
-  it('vetoes a stale concurrent async write so the newer snapshot wins without leaking tmp files', async () => {
-    const store = createStoreWithState({
-      schemaVersion: 5,
-      scanState: {
-        enabled: true,
-        lastScanStartedAt: null,
-        lastScanCompletedAt: null,
-        lastScanError: null
-      }
-    })
-    const internals = store as unknown as {
-      writeToDisk: () => Promise<void>
-      state: CodexUsagePersistedState
-    }
-
-    writeGate.blocked = true
-    const first = internals.writeToDisk()
-    await vi.waitFor(() => expect(writeGate.waiters.length).toBe(1))
-
-    internals.state.scanState.enabled = false
-    writeGate.blocked = false
-    const second = internals.writeToDisk()
-    writeGate.waiters.splice(0).forEach((resolve) => resolve())
-    await Promise.all([first, second])
-
-    expect(
-      JSON.parse(readFileSync(join(tempUserData, 'orca-codex-usage.json'), 'utf-8')).scanState
-        .enabled
-    ).toBe(false)
-    expect(readdirSync(tempUserData).filter((f) => f.endsWith('.tmp'))).toHaveLength(0)
-    // Serialized, so the superseded write can be skipped safely rather than racing the newer one.
-    expect(writeOpens.maxConcurrent).toBe(1)
-  })
-
-  it('sweeps a usage temp file orphaned by a crash between write and rename', async () => {
-    const orphan = join(tempUserData, 'orca-codex-usage.json.999.1.abc.tmp')
-    writeFileSync(orphan, '{}')
-
-    createStoreWithState({})
-    await vi.waitFor(() =>
-      expect(readdirSync(tempUserData).filter((f) => f.endsWith('.tmp'))).toHaveLength(0)
-    )
   })
 
   it('reports no data for Orca scope when only non-Orca Codex usage exists', async () => {
diff --git a/src/main/codex-usage/store.ts b/src/main/codex-usage/store.ts
index 10aad99fbbf..c1784f556a1 100644
--- a/src/main/codex-usage/store.ts
+++ b/src/main/codex-usage/store.ts
@@ -1,14 +1,11 @@
-/* eslint-disable max-lines -- Why: this store owns Codex analytics persistence, scan policy, and renderer query semantics. Keeping them together prevents the Codex range/scope rules from drifting away from the scanner’s event model. */
+/* eslint-disable max-lines -- Why: Codex pricing, range, scope, breakdown, and automation-attribution policies remain one cohesive store. */
 import { app } from 'electron'
 import { join } from 'node:path'
-import { existsSync, readFileSync } from 'node:fs'
-import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
 import type {
   CodexUsageBreakdownKind,
   CodexUsageBreakdownRow,
   CodexUsageDailyPoint,
   CodexUsageRange,
-  CodexUsageScanState,
   CodexUsageScope,
   CodexUsageSessionRow,
   CodexUsageSnapshot,
@@ -16,13 +13,12 @@ import type {
 } from '../../shared/codex-usage-types'
 import type { AutomationRunUsage } from '../../shared/automations-types'
 import type { Store } from '../persistence'
-import { loadKnownUsageWorktreesByRepo, type UsageWorktreeRef } from '../usage-worktree-metadata'
 import type { CodexUsagePersistedState } from './types'
-import { createWorktreeRefs } from '../usage/usage-worktree-refs'
 import { CODEX_USAGE_SCHEMA_VERSION, codexUsageProvider } from './codex-usage-provider'
+import { getLocalUsageDay, getUsageRangeCutoff } from '../usage/usage-calendar-range'
+import { UsageProviderStoreLifecycle } from '../usage/usage-provider-store-lifecycle'
 
 const SCHEMA_VERSION = CODEX_USAGE_SCHEMA_VERSION
-const STALE_MS = 5 * 60_000
 const AUTOMATION_ATTRIBUTION_WINDOW_MS = 5 * 60_000
 
 let _codexUsageFile: string | null = null
@@ -308,31 +304,6 @@ function estimateCostUsd(
   )
 }
 
-function getRangeCutoff(range: CodexUsageRange): string | null {
-  if (range === 'all') {
-    return null
-  }
-  const days = range === '7d' ? 7 : range === '30d' ? 30 : 90
-  const now = new Date()
-  now.setHours(0, 0, 0, 0)
-  now.setDate(now.getDate() - (days - 1))
-  const year = now.getFullYear()
-  const month = String(now.getMonth() + 1).padStart(2, '0')
-  const day = String(now.getDate()).padStart(2, '0')
-  return `${year}-${month}-${day}`
-}
-
-function getLocalDay(timestamp: string): string | null {
-  const parsed = new Date(timestamp)
-  if (Number.isNaN(parsed.getTime())) {
-    return null
-  }
-  const year = parsed.getFullYear()
-  const month = String(parsed.getMonth() + 1).padStart(2, '0')
-  const day = String(parsed.getDate()).padStart(2, '0')
-  return `${year}-${month}-${day}`
-}
-
 type ScopedCodexUsageModelRow = {
   modelKey: string
   modelLabel: string
@@ -345,78 +316,21 @@ type ScopedCodexUsageModelRow = {
   totalTokens: number
 }
 
-function getWorktreeFingerprint(worktreesByRepo: Map<string, UsageWorktreeRef[]>): string {
-  const rows = [...worktreesByRepo.entries()]
-    .flatMap(([repoId, worktrees]) =>
-      worktrees.map((worktree) =>
-        JSON.stringify({
-          repoId,
-          worktreeId: worktree.worktreeId,
-          path: worktree.path,
-          displayName: worktree.displayName
-        })
-      )
-    )
-    .sort()
-  return JSON.stringify(rows)
-}
-
-export class CodexUsageStore {
-  private state: CodexUsagePersistedState
-  private readonly store: Store
-  private scanPromise: Promise<void> | null = null
-  // Why: the 60 MB usage JSON must not block the Electron main thread; the writer serializes writes
-  // and vetoes superseded renames.
-  private readonly writer = new UsageCacheSnapshotWriter('[codex-usage]', getCodexUsageFile)
-
-  constructor(store: Store) {
-    this.store = store
-    this.state = this.load()
-  }
-
-  private load(): CodexUsagePersistedState {
-    try {
-      const usageFile = getCodexUsageFile()
-      if (!existsSync(usageFile)) {
-        return getDefaultState()
-      }
-      const parsed = JSON.parse(readFileSync(usageFile, 'utf-8')) as CodexUsagePersistedState
-      return normalizePersistedState({
-        ...getDefaultState(),
-        ...parsed,
-        scanState: {
-          ...getDefaultState().scanState,
-          ...parsed.scanState
-        }
-      })
-    } catch (error) {
-      console.error('[codex-usage] Failed to load persisted state, starting fresh:', error)
-      return getDefaultState()
-    }
-  }
-
-  private writeToDisk(): Promise<void> {
-    // Compact: this cache reaches 60 MB, and pretty-printing it costs main-thread time per scan.
-    return this.writer.write(() => JSON.stringify(this.state))
-  }
-
-  /** Await queued cache writes so quit does not drop the final snapshot. */
-  flush(): Promise<void> {
-    return this.writer.flush()
-  }
-
-  async setEnabled(enabled: boolean): Promise<CodexUsageScanState> {
-    this.state.scanState.enabled = enabled
-    await this.writeToDisk()
-    return this.getScanState()
-  }
-
-  getScanState(): CodexUsageScanState {
-    return {
-      ...this.state.scanState,
-      isScanning: this.scanPromise !== null,
-      hasAnyCodexData: this.state.sessions.length > 0 || this.state.dailyAggregates.length > 0
-    }
+export class CodexUsageStore extends UsageProviderStoreLifecycle<
+  'processedFiles',
+  CodexUsagePersistedState,
+  'hasAnyCodexData'
+> {
+  constructor(store: Pick<Store, 'getRepos' | 'getAllWorktreeMeta'>) {
+    super(store, {
+      logTag: '[codex-usage]',
+      resolveCacheFile: getCodexUsageFile,
+      createDefaultState: getDefaultState,
+      normalizeState: normalizePersistedState,
+      sourceKey: 'processedFiles',
+      dataPresenceKey: 'hasAnyCodexData',
+      scan: codexUsageProvider.scan
+    })
   }
 
   getSnapshot(
@@ -434,61 +348,6 @@ export class CodexUsageStore {
     }
   }
 
-  async refresh(force = false): Promise<CodexUsageScanState> {
-    if (!this.state.scanState.enabled) {
-      return this.getScanState()
-    }
-    const currentWorktreeFingerprint = await this.getCurrentWorktreeFingerprint()
-    if (!force && this.state.scanState.lastScanCompletedAt) {
-      const ageMs = Date.now() - this.state.scanState.lastScanCompletedAt
-      if (ageMs < STALE_MS && this.state.worktreeFingerprint === currentWorktreeFingerprint) {
-        return this.getScanState()
-      }
-    }
-    await this.runScan()
-    return this.getScanState()
-  }
-
-  private async runScan(): Promise<void> {
-    if (this.scanPromise) {
-      await this.scanPromise
-      return
-    }
-
-    this.state.scanState.lastScanStartedAt = Date.now()
-    this.state.scanState.lastScanError = null
-    // Why no write here: persisting scan-start would rewrite the whole multi-MB cache before a single
-    // result changed. The completion/failure write below persists the same fields.
-
-    this.scanPromise = (async () => {
-      try {
-        const repos = this.store.getRepos()
-        const worktreesByRepo = loadKnownUsageWorktreesByRepo(this.store, repos)
-        const worktreeFingerprint = getWorktreeFingerprint(worktreesByRepo)
-        const result = await codexUsageProvider.scan(
-          createWorktreeRefs(repos, worktreesByRepo),
-          this.state.worktreeFingerprint === worktreeFingerprint ? this.state.processedFiles : []
-        )
-        this.state.processedFiles = result.processedFiles
-        this.state.sessions = result.sessions
-        this.state.dailyAggregates = result.dailyAggregates
-        this.state.worktreeFingerprint = worktreeFingerprint
-        this.state.scanState.lastScanCompletedAt = Date.now()
-        this.state.scanState.lastScanError = null
-        // Why swallow: persistence is a cache concern. A disk failure must not turn a good scan into
-        // a scan error and reject refresh() for every query caller; writeToDisk already logs it.
-        await this.writeToDisk().catch(() => {})
-      } catch (error) {
-        this.state.scanState.lastScanError = error instanceof Error ? error.message : String(error)
-        await this.writeToDisk().catch(() => {})
-      } finally {
-        this.scanPromise = null
-      }
-    })()
-
-    await this.scanPromise
-  }
-
   async getSummary(scope: CodexUsageScope, range: CodexUsageRange): Promise<CodexUsageSummary> {
     await this.refresh(false)
     return this.buildSummary(scope, range)
@@ -888,7 +747,7 @@ export class CodexUsageStore {
   }
 
   private getFilteredDaily(scope: CodexUsageScope, range: CodexUsageRange) {
-    const cutoff = getRangeCutoff(range)
+    const cutoff = getUsageRangeCutoff(range)
     return this.state.dailyAggregates.filter((entry) => {
       if (cutoff && entry.day < cutoff) {
         return false
@@ -901,9 +760,9 @@ export class CodexUsageStore {
   }
 
   private getFilteredSessions(scope: CodexUsageScope, range: CodexUsageRange) {
-    const cutoff = getRangeCutoff(range)
+    const cutoff = getUsageRangeCutoff(range)
     return this.state.sessions.filter((session) => {
-      const day = getLocalDay(session.lastTimestamp)
+      const day = getLocalUsageDay(session.lastTimestamp)
       if (!day) {
         return false
       }
@@ -975,10 +834,4 @@ export class CodexUsageStore {
       Boolean(lastScanError) || lastScanCompletedAt === null || lastScanCompletedAt < completedAt
     )
   }
-
-  private async getCurrentWorktreeFingerprint(): Promise<string> {
-    const repos = this.store.getRepos()
-    const worktreesByRepo = loadKnownUsageWorktreesByRepo(this.store, repos)
-    return getWorktreeFingerprint(worktreesByRepo)
-  }
 }
diff --git a/src/main/codex/codex-pane-account-registry.ts b/src/main/codex/codex-pane-account-registry.ts
index 640dcd17506..39853471683 100644
--- a/src/main/codex/codex-pane-account-registry.ts
+++ b/src/main/codex/codex-pane-account-registry.ts
@@ -111,6 +111,7 @@ function isShellStartupHomeOverride(value: unknown): value is CodexShellStartupH
     typeof context.home === 'string' &&
     context.home.length > 0 &&
     (context.shell === undefined || typeof context.shell === 'string') &&
+    (context.configHome === undefined || typeof context.configHome === 'string') &&
     typeof context.codexHome === 'string' &&
     context.codexHome.length > 0
   )
@@ -207,6 +208,7 @@ function shellStartupHomeOverridesEqual(
   return (
     left?.home === right?.home &&
     left?.shell === right?.shell &&
+    left?.configHome === right?.configHome &&
     left?.codexHome === right?.codexHome
   )
 }
@@ -225,6 +227,13 @@ export function getCodexPaneAccount(ptyId: string): CodexPaneAccountRecord | nul
   return readRegistry().panes[ptyId] ?? null
 }
 
+/** `custom-home` stays conservative because it can mask a non-comparable shared-home route. */
+export function isCodexPaneHomeRouteProvenAwayFromSharedHome(
+  route: CodexPaneHomeRoute | undefined
+): boolean {
+  return route === 'real-home' || route === 'account-home' || route === 'wsl-home'
+}
+
 /**
  * Reports the lane each given PTY launched from, omitting panes with no record.
  *
@@ -256,6 +265,18 @@ export function hasRecordedLegacySharedCodexPane(): boolean {
   )
 }
 
+/** True when startup may need to repair hooks for a retained managed host pane. */
+export function hasRecordedManagedHostCodexPane(): boolean {
+  return Object.values(readRegistry().panes).some(
+    (record) =>
+      record.selectionKey === 'host' &&
+      (record.homeRoute === undefined ||
+        record.homeRoute === 'shared-home' ||
+        record.homeRoute === 'custom-home' ||
+        (record.homeRoute === 'account-home' && record.accountId !== null))
+  )
+}
+
 /** Drops records whose daemon PTYs are authoritatively absent. */
 export function reconcileCodexPaneAccountsWithLivePtys(livePtyIds: readonly string[]): void {
   const registry = readRegistry()
diff --git a/src/main/codex/codex-real-home-path.test.ts b/src/main/codex/codex-real-home-path.test.ts
index 7dc961c7a18..25d4f2b5bba 100644
--- a/src/main/codex/codex-real-home-path.test.ts
+++ b/src/main/codex/codex-real-home-path.test.ts
@@ -1,4 +1,4 @@
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, sep } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
@@ -11,9 +11,15 @@ import {
 import { __resetShellStartupEnvCache } from '../pty/shell-startup-env'
 
 const temporaryHomes: string[] = []
+const savedConfigHome = process.env.XDG_CONFIG_HOME
 
 afterEach(() => {
   __resetShellStartupEnvCache()
+  if (savedConfigHome === undefined) {
+    delete process.env.XDG_CONFIG_HOME
+  } else {
+    process.env.XDG_CONFIG_HOME = savedConfigHome
+  }
   for (const path of temporaryHomes.splice(0)) {
     rmSync(path, { recursive: true, force: true })
   }
@@ -56,6 +62,9 @@ describe('hasCustomCodexHomeOverride', () => {
       temporaryHomes.push(paneHome)
       writeFileSync(join(paneHome, '.zshrc'), 'export CODEX_HOME="$HOME/custom-codex-home"\n')
 
+      // Why cleared: the context records XDG_CONFIG_HOME, so a developer machine
+      // that sets one would otherwise change the recorded shape.
+      delete process.env.XDG_CONFIG_HOME
       expect(hasCustomCodexHomeOverrideForLaunch({ HOME: paneHome, SHELL: '/bin/zsh' })).toBe(true)
       const override = getCustomCodexHomeOverrideForLaunch({
         HOME: paneHome,
@@ -75,4 +84,50 @@ describe('hasCustomCodexHomeOverride', () => {
       ).toBe(true)
     }
   )
+
+  // Why: a fish user who exports XDG_CONFIG_HOME from config.fish never passes it to
+  // a Dock-launched Orca, so the launch env is the only place it appears. Reading the
+  // main process env instead scans ~/.config and misses the override entirely.
+  it.skipIf(process.platform === 'win32')(
+    'resolves a fish override under the launch env XDG_CONFIG_HOME, not the process one',
+    () => {
+      const paneHome = mkdtempSync(join(tmpdir(), 'orca-codex-fish-home-'))
+      temporaryHomes.push(paneHome)
+      const configHome = join(paneHome, 'xdg')
+      mkdirSync(join(configHome, 'fish'), { recursive: true })
+      writeFileSync(
+        join(configHome, 'fish', 'config.fish'),
+        'set -gx CODEX_HOME "$HOME/custom-codex-home"\n'
+      )
+      // The decoy fish reads only if XDG_CONFIG_HOME is ignored.
+      mkdirSync(join(paneHome, '.config', 'fish'), { recursive: true })
+      writeFileSync(
+        join(paneHome, '.config', 'fish', 'config.fish'),
+        'set -gx CODEX_HOME /wrong-default-config-home\n'
+      )
+      delete process.env.XDG_CONFIG_HOME
+
+      const launchEnv = {
+        HOME: paneHome,
+        SHELL: '/opt/homebrew/bin/fish',
+        XDG_CONFIG_HOME: configHome
+      }
+      const override = getCustomCodexHomeOverrideForLaunch(launchEnv)
+
+      expect(override).toEqual({
+        source: 'shell-startup',
+        context: {
+          home: paneHome,
+          shell: '/opt/homebrew/bin/fish',
+          configHome,
+          codexHome: join(paneHome, 'custom-codex-home')
+        }
+      })
+      // And the recorded configHome is what a later re-check resolves against.
+      expect(
+        override?.source === 'shell-startup' &&
+          shellStartupCodexHomeOverrideMatches(override.context)
+      ).toBe(true)
+    }
+  )
 })
diff --git a/src/main/codex/codex-real-home-path.ts b/src/main/codex/codex-real-home-path.ts
index 700359d4f37..60c644032f8 100644
--- a/src/main/codex/codex-real-home-path.ts
+++ b/src/main/codex/codex-real-home-path.ts
@@ -5,6 +5,8 @@ import { readShellStartupEnvVar } from '../pty/shell-startup-env'
 export type CodexShellStartupHomeOverride = {
   home: string
   shell?: string
+  /** Why recorded: fish reads config under it, so re-reads must use the same root. */
+  configHome?: string
   codexHome: string
 }
 
@@ -54,7 +56,10 @@ export function getCustomCodexHomeOverrideForLaunch(
   }
   const home = launchEnv ? getLaunchEnvValue(launchEnv, 'HOME') : process.env.HOME
   const shell = launchEnv ? getLaunchEnvValue(launchEnv, 'SHELL') : process.env.SHELL
-  const shellCodexHome = readShellStartupEnvVar('CODEX_HOME', home, shell)
+  const configHome = launchEnv
+    ? getLaunchEnvValue(launchEnv, 'XDG_CONFIG_HOME')
+    : process.env.XDG_CONFIG_HOME
+  const shellCodexHome = readShellStartupEnvVar('CODEX_HOME', home, shell, configHome)
   if (!home || !shellCodexHome || !hasCustomCodexHomeOverride({ CODEX_HOME: shellCodexHome })) {
     return null
   }
@@ -63,6 +68,7 @@ export function getCustomCodexHomeOverrideForLaunch(
     context: {
       home,
       ...(shell ? { shell } : {}),
+      ...(configHome ? { configHome } : {}),
       codexHome: shellCodexHome
     }
   }
@@ -85,7 +91,8 @@ export function shellStartupCodexHomeOverrideMatches(
   const currentCodexHome = readShellStartupEnvVar(
     'CODEX_HOME',
     currentContext.home,
-    currentContext.shell
+    currentContext.shell,
+    currentContext.configHome
   )
   return Boolean(
     currentCodexHome &&
@@ -101,15 +108,16 @@ export function shellStartupCodexHomeOverrideContextsEqual(
   return (
     normalizePathForComparison(left.home) === normalizePathForComparison(right.home) &&
     left.shell === right.shell &&
+    left.configHome === right.configHome &&
     normalizePathForComparison(left.codexHome) === normalizePathForComparison(right.codexHome)
   )
 }
 
 function getLaunchEnvValue(
   launchEnv: NodeJS.ProcessEnv,
-  key: 'CODEX_HOME' | 'ORCA_CODEX_HOME' | 'HOME' | 'SHELL'
+  key: 'CODEX_HOME' | 'ORCA_CODEX_HOME' | 'HOME' | 'SHELL' | 'XDG_CONFIG_HOME'
 ): string | undefined {
-  return Object.prototype.hasOwnProperty.call(launchEnv, key) ? launchEnv[key] : process.env[key]
+  return Object.hasOwn(launchEnv, key) ? launchEnv[key] : process.env[key]
 }
 
 function normalizePathForComparison(value: string): string {
diff --git a/src/main/codex/codex-session-migration-ignored-launches.ts b/src/main/codex/codex-session-migration-ignored-launches.ts
new file mode 100644
index 00000000000..fcddb0393bf
--- /dev/null
+++ b/src/main/codex/codex-session-migration-ignored-launches.ts
@@ -0,0 +1,35 @@
+import {
+  CODEX_SESSION_MIGRATION_LEASE_RETENTION_MS,
+  evictStaleLeaseEntries
+} from './codex-session-migration-recent-exits'
+
+type IgnoredLaunch = { recordedAt: number }
+
+/** Lease ids whose reattach was proven away from the shared home, so their exit owes no scan. */
+export class CodexSessionMigrationIgnoredLaunches {
+  private readonly launches = new Map<string, IgnoredLaunch>()
+
+  add(leaseId: string): void {
+    const now = Date.now()
+    this.launches.delete(leaseId)
+    this.launches.set(leaseId, { recordedAt: now })
+    evictStaleLeaseEntries(this.launches, now)
+  }
+
+  has(leaseId: string): boolean {
+    const launch = this.launches.get(leaseId)
+    if (!launch) {
+      return false
+    }
+    // Why: an entry whose exit never arrived must age out, or it absorbs a later exit and strands that launch active.
+    if (Date.now() - launch.recordedAt > CODEX_SESSION_MIGRATION_LEASE_RETENTION_MS) {
+      this.launches.delete(leaseId)
+      return false
+    }
+    return true
+  }
+
+  delete(leaseId: string): boolean {
+    return this.has(leaseId) && this.launches.delete(leaseId)
+  }
+}
diff --git a/src/main/codex/codex-session-migration-recent-exits.test.ts b/src/main/codex/codex-session-migration-recent-exits.test.ts
new file mode 100644
index 00000000000..84d08768402
--- /dev/null
+++ b/src/main/codex/codex-session-migration-recent-exits.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { CodexSessionMigrationRecentExits } from './codex-session-migration-recent-exits'
+
+describe('CodexSessionMigrationRecentExits', () => {
+  it('refreshes a rerecorded ID before evicting the oldest entry', () => {
+    const exits = new CodexSessionMigrationRecentExits()
+    for (let index = 0; index < 256; index += 1) {
+      exits.record(`pty-${index}`, index + 1)
+    }
+
+    exits.record('pty-0', 500)
+    exits.record('pty-overflow', 501)
+
+    expect(exits.matchesAfter('pty-0', 499)).toBe(true)
+    expect(exits.matchesAfter('pty-1', 0)).toBe(false)
+  })
+})
diff --git a/src/main/codex/codex-session-migration-recent-exits.ts b/src/main/codex/codex-session-migration-recent-exits.ts
new file mode 100644
index 00000000000..2a92441537b
--- /dev/null
+++ b/src/main/codex/codex-session-migration-recent-exits.ts
@@ -0,0 +1,60 @@
+export const CODEX_SESSION_MIGRATION_LEASE_RETENTION_MS = 60_000
+const MAX_ENTRIES = 256
+
+type RecentPtyExit = { sequence: number; recordedAt: number }
+
+// Why: one aging policy for every lease-keyed migration map, so none can grow for the process lifetime.
+export function evictStaleLeaseEntries<T extends { recordedAt: number }>(
+  entries: Map<string, T>,
+  now: number
+): void {
+  for (const [leaseId, entry] of entries) {
+    if (now - entry.recordedAt > CODEX_SESSION_MIGRATION_LEASE_RETENTION_MS) {
+      entries.delete(leaseId)
+    }
+  }
+  while (entries.size > MAX_ENTRIES) {
+    const oldestLeaseId = entries.keys().next().value
+    if (oldestLeaseId === undefined) {
+      break
+    }
+    entries.delete(oldestLeaseId)
+  }
+}
+
+export class CodexSessionMigrationRecentExits {
+  private readonly exits = new Map<string, RecentPtyExit>()
+
+  record(leaseId: string, sequence: number): void {
+    const now = Date.now()
+    this.exits.delete(leaseId)
+    this.exits.set(leaseId, { sequence, recordedAt: now })
+    evictStaleLeaseEntries(this.exits, now)
+  }
+
+  consumeAfter(leaseId: string, startedSequence: number | undefined): RecentPtyExit | null {
+    const exit = this.exits.get(leaseId)
+    this.exits.delete(leaseId)
+    if (
+      !exit ||
+      startedSequence === undefined ||
+      exit.sequence <= startedSequence ||
+      Date.now() - exit.recordedAt > CODEX_SESSION_MIGRATION_LEASE_RETENTION_MS
+    ) {
+      return null
+    }
+    return exit
+  }
+
+  matchesAfter(leaseId: string, startedSequence: number | undefined): boolean {
+    const exit = this.exits.get(leaseId)
+    if (!exit) {
+      return false
+    }
+    if (Date.now() - exit.recordedAt > CODEX_SESSION_MIGRATION_LEASE_RETENTION_MS) {
+      this.exits.delete(leaseId)
+      return false
+    }
+    return startedSequence !== undefined && exit.sequence > startedSequence
+  }
+}
diff --git a/src/main/codex/codex-session-migration-scheduler.test.ts b/src/main/codex/codex-session-migration-scheduler.test.ts
index 9f9aed3173c..b495afb8e0e 100644
--- a/src/main/codex/codex-session-migration-scheduler.test.ts
+++ b/src/main/codex/codex-session-migration-scheduler.test.ts
@@ -491,6 +491,174 @@ describe('createCodexSessionMigrationScheduler', () => {
     await vi.waitFor(() => expect(finishScheduledRun).toHaveBeenCalledOnce())
   })
 
+  it('keeps an ignored reattach exit from poisoning a same-ID launch already starting', async () => {
+    const startBackfill = vi.fn().mockResolvedValue({ stopped: false })
+    const scheduler = createCodexSessionMigrationScheduler({
+      isEligible: () => true,
+      isQuitting: () => false,
+      resolveSystemCodexHomePathOverride: () => undefined,
+      startBackfill,
+      startIndexHeal: vi.fn().mockResolvedValue(null),
+      initialDelayMs: 1_000
+    })
+
+    scheduler.ignoreLaunch('stable-pty', 1)
+    scheduler.finishLaunch('stable-pty', 3)
+    scheduler.beginLaunch('stable-pty', false, new Date(), 2)
+    await vi.advanceTimersByTimeAsync(1_000)
+
+    expect(startBackfill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        scanDates: expect.any(Array),
+        writeCompletionMarker: false,
+        writeBoundedCompletionMarker: false
+      }),
+      undefined
+    )
+  })
+
+  it('matches an ignored reattach exit that arrived before its lifecycle callback', async () => {
+    const startBackfill = vi.fn().mockResolvedValue({ stopped: false })
+    const scheduler = createCodexSessionMigrationScheduler({
+      isEligible: () => true,
+      isQuitting: () => false,
+      resolveSystemCodexHomePathOverride: () => undefined,
+      startBackfill,
+      startIndexHeal: vi.fn().mockResolvedValue(null),
+      initialDelayMs: 1_000
+    })
+
+    scheduler.finishLaunch('stable-pty', 2)
+    scheduler.ignoreLaunch('stable-pty', 1)
+    scheduler.beginLaunch('stable-pty', false, new Date(), 3)
+    await vi.advanceTimersByTimeAsync(1_000)
+
+    expect(startBackfill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        scanDates: expect.any(Array),
+        writeCompletionMarker: false,
+        writeBoundedCompletionMarker: false
+      }),
+      undefined
+    )
+  })
+
+  it('keeps a newer same-ID launch active while the ignored incarnation exits', async () => {
+    const startBackfill = vi.fn().mockResolvedValue({ stopped: false })
+    const scheduler = createCodexSessionMigrationScheduler({
+      isEligible: () => true,
+      isQuitting: () => false,
+      resolveSystemCodexHomePathOverride: () => undefined,
+      startBackfill,
+      startIndexHeal: vi.fn().mockResolvedValue(null),
+      initialDelayMs: 1_000
+    })
+
+    scheduler.ignoreLaunch('stable-pty', 1)
+    scheduler.beginLaunch('stable-pty', false, new Date(), 2)
+    scheduler.finishLaunch('stable-pty', 3)
+    await vi.advanceTimersByTimeAsync(1_000)
+
+    expect(startBackfill).toHaveBeenCalledWith(
+      expect.objectContaining({ writeCompletionMarker: false }),
+      undefined
+    )
+
+    scheduler.finishLaunch('stable-pty', 4)
+    await vi.advanceTimersByTimeAsync(1_000)
+    expect(startBackfill).toHaveBeenLastCalledWith(
+      expect.objectContaining({ writeCompletionMarker: true }),
+      undefined
+    )
+  })
+
+  it('releases a stranded active launch once the ignored incarnation ages out', async () => {
+    const startBackfill = vi.fn().mockResolvedValue({ stopped: false })
+    const scheduler = createCodexSessionMigrationScheduler({
+      isEligible: () => true,
+      isQuitting: () => false,
+      resolveSystemCodexHomePathOverride: () => undefined,
+      startBackfill,
+      startIndexHeal: vi.fn().mockResolvedValue(null),
+      initialDelayMs: 1_000
+    })
+
+    // The ignored incarnation never reports its exit, so only the newer launch ever finishes.
+    scheduler.ignoreLaunch('stable-pty', 1)
+    scheduler.beginLaunch('stable-pty', false, new Date(), 2)
+    await vi.advanceTimersByTimeAsync(61_000)
+    expect(startBackfill).toHaveBeenLastCalledWith(
+      expect.objectContaining({ writeCompletionMarker: false }),
+      undefined
+    )
+
+    scheduler.finishLaunch('stable-pty', 3)
+    await vi.advanceTimersByTimeAsync(1_000)
+    expect(startBackfill).toHaveBeenLastCalledWith(
+      expect.objectContaining({ writeCompletionMarker: true }),
+      undefined
+    )
+  })
+
+  it('keeps late duplicate ignored callbacks from poisoning reuse', async () => {
+    const startBackfill = vi.fn().mockResolvedValue({ stopped: false })
+    const scheduler = createCodexSessionMigrationScheduler({
+      isEligible: () => true,
+      isQuitting: () => false,
+      resolveSystemCodexHomePathOverride: () => undefined,
+      startBackfill,
+      startIndexHeal: vi.fn().mockResolvedValue(null),
+      initialDelayMs: 1_000
+    })
+
+    scheduler.ignoreLaunch('stable-pty', 1)
+    scheduler.finishLaunch('stable-pty', 3)
+    scheduler.ignoreLaunch('stable-pty', 2)
+    scheduler.ignoreLaunch('stable-pty', 2)
+    scheduler.beginLaunch('stable-pty', false, new Date(), 4)
+    await vi.advanceTimersByTimeAsync(1_000)
+    expect(startBackfill).toHaveBeenCalledTimes(1)
+
+    scheduler.finishLaunch('stable-pty', 5)
+    await vi.advanceTimersByTimeAsync(1_000)
+    expect(startBackfill).toHaveBeenCalledTimes(2)
+    expect(startBackfill).toHaveBeenLastCalledWith(
+      expect.objectContaining({ writeCompletionMarker: true }),
+      undefined
+    )
+  })
+
+  it('keeps three exit-before-callback reattaches from stranding a reused ID', async () => {
+    const startBackfill = vi.fn().mockResolvedValue({ stopped: false })
+    const scheduler = createCodexSessionMigrationScheduler({
+      isEligible: () => true,
+      isQuitting: () => false,
+      resolveSystemCodexHomePathOverride: () => undefined,
+      startBackfill,
+      startIndexHeal: vi.fn().mockResolvedValue(null),
+      initialDelayMs: 1_000
+    })
+
+    scheduler.finishLaunch('stable-pty', 4)
+    scheduler.ignoreLaunch('stable-pty', 1)
+    scheduler.ignoreLaunch('stable-pty', 2)
+    scheduler.ignoreLaunch('stable-pty', 3)
+    scheduler.beginLaunch('stable-pty', false, new Date(), 5)
+    await vi.advanceTimersByTimeAsync(1_000)
+    expect(startBackfill).toHaveBeenLastCalledWith(
+      expect.objectContaining({ writeCompletionMarker: false }),
+      undefined
+    )
+
+    scheduler.finishLaunch('stable-pty', 6)
+    await vi.advanceTimersByTimeAsync(1_000)
+    expect(startBackfill).toHaveBeenCalledTimes(2)
+    expect(startBackfill).toHaveBeenLastCalledWith(
+      expect.objectContaining({ writeCompletionMarker: true }),
+      undefined
+    )
+  })
+
   it('does not consume an exit from an earlier stable-id incarnation', async () => {
     const startBackfill = vi.fn().mockResolvedValue({ stopped: false })
     const scheduler = createCodexSessionMigrationScheduler({
diff --git a/src/main/codex/codex-session-migration-scheduler.ts b/src/main/codex/codex-session-migration-scheduler.ts
index 28ce4b991da..9f08d83c5ea 100644
--- a/src/main/codex/codex-session-migration-scheduler.ts
+++ b/src/main/codex/codex-session-migration-scheduler.ts
@@ -1,4 +1,6 @@
 import { getCodexSessionBackfillDate } from './codex-session-backfill-date'
+import { CodexSessionMigrationIgnoredLaunches } from './codex-session-migration-ignored-launches'
+import { CodexSessionMigrationRecentExits } from './codex-session-migration-recent-exits'
 import type {
   CodexSessionBackfillDate,
   CodexSessionBackfillOptions
@@ -9,11 +11,6 @@ type MigrationRun = (
   systemCodexHomePathOverride?: string
 ) => Promise<unknown>
 
-const EARLY_PTY_EXIT_RETENTION_MS = 60_000
-const MAX_EARLY_PTY_EXITS = 256
-
-type EarlyPtyExit = { sequence: number; recordedAt: number }
-
 export type CodexSessionMigrationScheduler = {
   beginLaunch(
     leaseId: string,
@@ -21,6 +18,7 @@ export type CodexSessionMigrationScheduler = {
     startedAt?: Date,
     startedSequence?: number
   ): void
+  ignoreLaunch(leaseId: string, startedSequence: number): void
   finishLaunch(leaseId: string, exitSequence?: number): void
   scheduleInitialRun(): void
   scheduleRun(fullScanRequired?: boolean): void
@@ -46,7 +44,10 @@ export function createCodexSessionMigrationScheduler(args: {
   let pendingFullScan = false
   let migrationTask: Promise<void> | null = null
   const activeLaunches = new Map<string, Date>()
-  const earlyPtyExits = new Map<string, EarlyPtyExit>()
+  // Why: non-shared reattach exits must not masquerade as exit-before-begin races for a reused id.
+  const ignoredLaunches = new CodexSessionMigrationIgnoredLaunches()
+  const ignoredPtyExits = new CodexSessionMigrationRecentExits()
+  const earlyPtyExits = new CodexSessionMigrationRecentExits()
   let activeRunStopObserved = false
   let rerunRequested = false
 
@@ -194,18 +195,38 @@ export function createCodexSessionMigrationScheduler(args: {
       if (args.isQuitting() || activeLaunches.has(leaseId)) {
         return
       }
-      if (consumeEarlyPtyExit(earlyPtyExits, leaseId, startedSequence)) {
+      if (earlyPtyExits.consumeAfter(leaseId, startedSequence)) {
         scheduleRun(true)
         return
       }
       activeLaunches.set(leaseId, startedAt)
       scheduleRun(fullScanRequired)
     },
+    ignoreLaunch(leaseId, startedSequence): void {
+      if (args.isQuitting() || ignoredLaunches.has(leaseId)) {
+        return
+      }
+      if (ignoredPtyExits.matchesAfter(leaseId, startedSequence)) {
+        return
+      }
+      const earlyExit = earlyPtyExits.consumeAfter(leaseId, startedSequence)
+      if (earlyExit) {
+        ignoredPtyExits.record(leaseId, earlyExit.sequence)
+        return
+      }
+      ignoredLaunches.add(leaseId)
+    },
     finishLaunch(leaseId, exitSequence): void {
+      if (ignoredLaunches.delete(leaseId)) {
+        if (exitSequence !== undefined) {
+          ignoredPtyExits.record(leaseId, exitSequence)
+        }
+        return
+      }
       const startedAt = activeLaunches.get(leaseId)
       if (!startedAt) {
         if (exitSequence !== undefined) {
-          recordEarlyPtyExit(earlyPtyExits, leaseId, exitSequence)
+          earlyPtyExits.record(leaseId, exitSequence)
         }
         return
       }
@@ -253,42 +274,6 @@ function compareBackfillDates(
   return left.join('-').localeCompare(right.join('-'))
 }
 
-function recordEarlyPtyExit(
-  exits: Map<string, EarlyPtyExit>,
-  leaseId: string,
-  sequence: number
-): void {
-  const now = Date.now()
-  for (const [id, exit] of exits) {
-    if (now - exit.recordedAt > EARLY_PTY_EXIT_RETENTION_MS) {
-      exits.delete(id)
-    }
-  }
-  exits.set(leaseId, { sequence, recordedAt: now })
-  while (exits.size > MAX_EARLY_PTY_EXITS) {
-    const oldestLeaseId = exits.keys().next().value
-    if (oldestLeaseId === undefined) {
-      break
-    }
-    exits.delete(oldestLeaseId)
-  }
-}
-
-function consumeEarlyPtyExit(
-  exits: Map<string, EarlyPtyExit>,
-  leaseId: string,
-  startedSequence: number | undefined
-): boolean {
-  const exit = exits.get(leaseId)
-  exits.delete(leaseId)
-  return (
-    exit !== undefined &&
-    startedSequence !== undefined &&
-    exit.sequence > startedSequence &&
-    Date.now() - exit.recordedAt <= EARLY_PTY_EXIT_RETENTION_MS
-  )
-}
-
 function isStoppedMigrationResult(result: unknown): boolean {
   return Boolean(result && typeof result === 'object' && 'stopped' in result && result.stopped)
 }
diff --git a/src/main/codex/codex-session-resume-home.test.ts b/src/main/codex/codex-session-resume-home.test.ts
index 75d91d7ab34..2f0aa5429c6 100644
--- a/src/main/codex/codex-session-resume-home.test.ts
+++ b/src/main/codex/codex-session-resume-home.test.ts
@@ -140,7 +140,7 @@ describe('resolveTrustedCodexSessionResumeHome', () => {
         trustedCodexHomes: [homePath],
         ...withoutHomeRanking,
         fileIsRegular: () => true,
-        listSessionFiles: async function* (): AsyncIterable<string> {
+        async *listSessionFiles(): AsyncIterable<string> {
           yield extendedEntry
         }
       })
@@ -153,7 +153,7 @@ describe('resolveTrustedCodexSessionResumeHome', () => {
         trustedCodexHomes: [homePath],
         ...withoutHomeRanking,
         fileIsRegular: () => true,
-        listSessionFiles: async function* (): AsyncIterable<string> {
+        async *listSessionFiles(): AsyncIterable<string> {
           yield `\\\\.\\C:\\Users\\Example\\.codex\\sessions\\2026\\07\\20\\rollout-${sessionId}.jsonl`
         }
       })
diff --git a/src/main/codex/codex-stale-pane-accounts.test.ts b/src/main/codex/codex-stale-pane-accounts.test.ts
index c5ee4802e5b..ebc953a4be7 100644
--- a/src/main/codex/codex-stale-pane-accounts.test.ts
+++ b/src/main/codex/codex-stale-pane-accounts.test.ts
@@ -8,6 +8,8 @@ import {
   forgetCodexPaneAccount,
   getCodexPaneAccount,
   hasRecordedLegacySharedCodexPane,
+  hasRecordedManagedHostCodexPane,
+  isCodexPaneHomeRouteProvenAwayFromSharedHome,
   reconcileCodexPaneAccountsWithLivePtys,
   recordCodexPaneAccount
 } from './codex-pane-account-registry'
@@ -46,6 +48,17 @@ afterEach(() => {
 })
 
 describe('codex pane account registry', () => {
+  it.each([
+    ['real-home', true],
+    ['account-home', true],
+    ['wsl-home', true],
+    ['shared-home', false],
+    ['custom-home', false],
+    [undefined, false]
+  ] as const)('classifies whether %s proves a pane avoided the shared home', (route, expected) => {
+    expect(isCodexPaneHomeRouteProvenAwayFromSharedHome(route)).toBe(expected)
+  })
+
   it('survives a process restart so a daemon-backed shell stays attributable', () => {
     recordCodexPaneAccount('pty-1', {
       selectionKey: 'host',
@@ -125,6 +138,40 @@ describe('codex pane account registry', () => {
     expect(hasRecordedLegacySharedCodexPane()).toBe(true)
   })
 
+  it('requests startup inventory only for managed host panes', () => {
+    recordCodexPaneAccount('pty-real', {
+      selectionKey: 'host',
+      accountId: null,
+      homeRoute: 'real-home'
+    })
+    recordCodexPaneAccount('pty-wsl', {
+      selectionKey: 'wsl:Ubuntu',
+      accountId: 'account-wsl',
+      homeRoute: 'account-home'
+    })
+
+    expect(hasRecordedManagedHostCodexPane()).toBe(false)
+
+    recordCodexPaneAccount('pty-shared', {
+      selectionKey: 'host',
+      accountId: null,
+      homeRoute: 'shared-home'
+    })
+
+    expect(hasRecordedManagedHostCodexPane()).toBe(true)
+
+    forgetCodexPaneAccount('pty-shared')
+    expect(hasRecordedManagedHostCodexPane()).toBe(false)
+
+    recordCodexPaneAccount('pty-account', {
+      selectionKey: 'host',
+      accountId: 'account-host',
+      homeRoute: 'account-home'
+    })
+
+    expect(hasRecordedManagedHostCodexPane()).toBe(true)
+  })
+
   it('drops leaked records that are absent from the authoritative daemon inventory', () => {
     recordCodexPaneAccount('pty-live', {
       selectionKey: 'host',
diff --git a/src/main/codex/hook-service.ts b/src/main/codex/hook-service.ts
index 1c4052cefca..3bf087b14d9 100644
--- a/src/main/codex/hook-service.ts
+++ b/src/main/codex/hook-service.ts
@@ -19,6 +19,7 @@ import {
   writeManagedScript,
   type HookDefinition
 } from '../agent-hooks/installer-utils'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
 import { resolveHooksJsonWritePath } from '../agent-hooks/hook-config-write-path'
 import { writeFileAtomically } from '../codex-accounts/fs-utils'
 import {
@@ -1021,6 +1022,10 @@ function getWslReconciliationKey(runtimeHomePath: string): string {
 }
 
 export class CodexHookService {
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(getManagedScriptPath(), getManagedScript())
+  }
+
   private readonly wslReconciliationGeneration = new Map<string, number>()
 
   private supersedeWslReconciliation(runtimeHomePath: string | null | undefined): number {
diff --git a/src/main/codex/retained-codex-hook-state.test.ts b/src/main/codex/retained-codex-hook-state.test.ts
new file mode 100644
index 00000000000..642b8bc7476
--- /dev/null
+++ b/src/main/codex/retained-codex-hook-state.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { AgentHookInstallStatus } from '../../shared/agent-hook-types'
+import { reconcileRetainedCodexHookHomes } from './retained-codex-hook-state'
+
+function status(state: 'installed' | 'not_installed' | 'error'): AgentHookInstallStatus {
+  return {
+    agent: 'codex',
+    state,
+    configPath: '/runtime/hooks.json',
+    managedHooksPresent: state === 'installed',
+    detail: state === 'error' ? 'failed' : null
+  }
+}
+
+describe('retained Codex hook state', () => {
+  it('repairs Orca hooks before a retained shell can launch Codex', () => {
+    const install = vi.fn(() => status('installed'))
+    const refreshRuntimeUserHooks = vi.fn(() => status('not_installed'))
+
+    reconcileRetainedCodexHookHomes({
+      hookService: { install, refreshRuntimeUserHooks },
+      hooksEnabled: true,
+      runtimeHomePaths: ['/orca/shared-home', '/orca/account-home']
+    })
+
+    expect(install).toHaveBeenCalledTimes(2)
+    expect(install).toHaveBeenNthCalledWith(1, '/orca/shared-home')
+    expect(install).toHaveBeenNthCalledWith(2, '/orca/account-home')
+    expect(refreshRuntimeUserHooks).not.toHaveBeenCalled()
+  })
+
+  it('removes only Orca hooks from retained homes when hooks are disabled', () => {
+    const install = vi.fn(() => status('installed'))
+    const refreshRuntimeUserHooks = vi.fn(() => status('not_installed'))
+
+    reconcileRetainedCodexHookHomes({
+      hookService: { install, refreshRuntimeUserHooks },
+      hooksEnabled: false,
+      runtimeHomePaths: ['/orca/shared-home']
+    })
+
+    expect(refreshRuntimeUserHooks).toHaveBeenCalledWith('/orca/shared-home')
+    expect(install).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/codex/retained-codex-hook-state.ts b/src/main/codex/retained-codex-hook-state.ts
new file mode 100644
index 00000000000..ccdf8c86af3
--- /dev/null
+++ b/src/main/codex/retained-codex-hook-state.ts
@@ -0,0 +1,26 @@
+import type { AgentHookInstallStatus } from '../../shared/agent-hook-types'
+
+type RetainedCodexHookService = {
+  install: (runtimeHomePath: string) => AgentHookInstallStatus
+  refreshRuntimeUserHooks: (runtimeHomePath: string) => AgentHookInstallStatus
+}
+
+export function reconcileRetainedCodexHookHomes(args: {
+  hookService: RetainedCodexHookService
+  hooksEnabled: boolean
+  runtimeHomePaths: readonly string[]
+}): void {
+  for (const runtimeHomePath of args.runtimeHomePaths) {
+    try {
+      const status = args.hooksEnabled
+        ? args.hookService.install(runtimeHomePath)
+        : args.hookService.refreshRuntimeUserHooks(runtimeHomePath)
+      if (status.state === 'error') {
+        console.warn('[codex-hook-service] failed to reconcile retained Codex home', status.detail)
+      }
+    } catch (error) {
+      // Why: a retained home repair is best-effort; daemon availability must not depend on a writable Codex config.
+      console.warn('[codex-hook-service] failed to reconcile retained Codex home', error)
+    }
+  }
+}
diff --git a/src/main/command-code/hook-service.ts b/src/main/command-code/hook-service.ts
index 2906ffd2da3..1e1ab9e56af 100644
--- a/src/main/command-code/hook-service.ts
+++ b/src/main/command-code/hook-service.ts
@@ -14,6 +14,7 @@ import {
   writeManagedScript,
   type HookDefinition
 } from '../agent-hooks/installer-utils'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
 import {
   readHooksJsonRemote,
   writeHooksJsonRemote,
@@ -88,6 +89,10 @@ function buildInstalledConfig(
 }
 
 export class CommandCodeHookService {
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(getManagedScriptPath(), buildCommandCodeManagedScript())
+  }
+
   getStatus(): AgentHookInstallStatus {
     const configPath = getConfigPath()
     const scriptPath = getManagedScriptPath()
diff --git a/src/main/computer/key-mapping.test.ts b/src/main/computer/key-mapping.test.ts
deleted file mode 100644
index 6b599cd483c..00000000000
--- a/src/main/computer/key-mapping.test.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { parseKey } from './key-mapping'
-
-describe('parseKey', () => {
-  it.each([
-    ['a', { key: 'a', modifiers: [] }],
-    ['7', { key: '7', modifiers: [] }],
-    [';', { key: ';', modifiers: [] }],
-    ['+', { key: '+', modifiers: [] }],
-    ['Return', { key: 'Enter', modifiers: [] }],
-    ['Escape', { key: 'Escape', modifiers: [] }],
-    ['BackSpace', { key: 'Backspace', modifiers: [] }],
-    ['Tab', { key: 'Tab', modifiers: [] }],
-    ['space', { key: 'Space', modifiers: [] }],
-    ['Page_Up', { key: 'PageUp', modifiers: [] }],
-    ['Page_Down', { key: 'PageDown', modifiers: [] }],
-    ['Home', { key: 'Home', modifiers: [] }],
-    ['End', { key: 'End', modifiers: [] }],
-    ['Up', { key: 'ArrowUp', modifiers: [] }],
-    ['Down', { key: 'ArrowDown', modifiers: [] }],
-    ['Left', { key: 'ArrowLeft', modifiers: [] }],
-    ['Right', { key: 'ArrowRight', modifiers: [] }],
-    ['Delete', { key: 'Delete', modifiers: [] }],
-    ['Insert', { key: 'Insert', modifiers: [] }],
-    ['F1', { key: 'F1', modifiers: [] }],
-    ['F24', { key: 'F24', modifiers: [] }],
-    ['KP_0', { key: 'Numpad0', modifiers: [] }],
-    ['KP_9', { key: 'Numpad9', modifiers: [] }],
-    ['KP_Add', { key: 'NumpadAdd', modifiers: [] }],
-    ['KP_Subtract', { key: 'NumpadSubtract', modifiers: [] }],
-    ['KP_Multiply', { key: 'NumpadMultiply', modifiers: [] }],
-    ['KP_Divide', { key: 'NumpadDivide', modifiers: [] }],
-    ['KP_Enter', { key: 'NumpadEnter', modifiers: [] }]
-  ])('maps %s', (input, expected) => {
-    expect(parseKey(input)).toEqual(expected)
-  })
-
-  it.each([
-    ['ctrl+a', { key: 'a', modifiers: ['Ctrl'] }],
-    ['control+a', { key: 'a', modifiers: ['Ctrl'] }],
-    ['ctrl+shift+t', { key: 't', modifiers: ['Ctrl', 'Shift'] }],
-    ['alt+F4', { key: 'F4', modifiers: ['Alt'] }],
-    ['cmd+a', { key: 'a', modifiers: ['Meta'] }],
-    ['command+a', { key: 'a', modifiers: ['Meta'] }],
-    ['CmdOrCtrl+a', { key: 'a', modifiers: [process.platform === 'darwin' ? 'Meta' : 'Ctrl'] }],
-    ['ctrl++', { key: '+', modifiers: ['Ctrl'] }],
-    ['ctrl+shift++', { key: '+', modifiers: ['Ctrl', 'Shift'] }],
-    ['super+Left', { key: 'ArrowLeft', modifiers: ['Meta'] }],
-    ['win+Right', { key: 'ArrowRight', modifiers: ['Meta'] }]
-  ])('maps chord %s', (input, expected) => {
-    expect(parseKey(input)).toEqual(expected)
-  })
-
-  it('rejects unknown modifiers and key names', () => {
-    expect(() => parseKey('hyper+a')).toThrow(expect.objectContaining({ code: 'invalid_argument' }))
-    expect(() => parseKey('NotAKey')).toThrow(expect.objectContaining({ code: 'invalid_argument' }))
-    expect(() => parseKey('F25')).toThrow(expect.objectContaining({ code: 'invalid_argument' }))
-  })
-})
diff --git a/src/main/computer/key-mapping.ts b/src/main/computer/key-mapping.ts
deleted file mode 100644
index 4634f241268..00000000000
--- a/src/main/computer/key-mapping.ts
+++ /dev/null
@@ -1,128 +0,0 @@
-import { RuntimeClientError } from './runtime-client-error'
-
-export type KeyChord = {
-  key: string
-  modifiers: string[]
-}
-
-const MODIFIER_NAMES: Record<string, string> = {
-  ctrl: 'Ctrl',
-  control: 'Ctrl',
-  shift: 'Shift',
-  alt: 'Alt',
-  meta: 'Meta',
-  super: 'Meta',
-  cmd: 'Meta',
-  command: 'Meta',
-  win: 'Meta'
-}
-
-const PLATFORM_MODIFIER_NAMES: Record<string, () => string> = {
-  cmdorctrl: () => (process.platform === 'darwin' ? 'Meta' : 'Ctrl'),
-  commandorcontrol: () => (process.platform === 'darwin' ? 'Meta' : 'Ctrl')
-}
-
-const KEY_NAMES: Record<string, string> = {
-  Return: 'Enter',
-  Enter: 'Enter',
-  Escape: 'Escape',
-  Esc: 'Escape',
-  BackSpace: 'Backspace',
-  Backspace: 'Backspace',
-  Tab: 'Tab',
-  space: 'Space',
-  Space: 'Space',
-  Page_Up: 'PageUp',
-  Page_Down: 'PageDown',
-  Home: 'Home',
-  End: 'End',
-  Up: 'ArrowUp',
-  Down: 'ArrowDown',
-  Left: 'ArrowLeft',
-  Right: 'ArrowRight',
-  Delete: 'Delete',
-  Insert: 'Insert',
-  KP_Add: 'NumpadAdd',
-  KP_Subtract: 'NumpadSubtract',
-  KP_Multiply: 'NumpadMultiply',
-  KP_Divide: 'NumpadDivide',
-  KP_Enter: 'NumpadEnter'
-}
-
-export function parseKey(input: string): KeyChord {
-  const parts = splitKeyChord(input)
-  if (parts.length === 0) {
-    throw new RuntimeClientError('invalid_argument', 'key must not be empty')
-  }
-
-  const keyPart = parts.at(-1)!
-  const modifiers = parts.slice(0, -1).map(parseModifier)
-  return {
-    key: parseBaseKey(keyPart),
-    modifiers: dedupeModifiers(modifiers)
-  }
-}
-
-function splitKeyChord(input: string): string[] {
-  const trimmed = input.trim()
-  // Why: `+` is both the chord separator and a printable key users can press.
-  if (trimmed === '+') {
-    return ['+']
-  }
-  if (trimmed.endsWith('+')) {
-    return [
-      ...trimmed
-        .slice(0, -1)
-        .split('+')
-        .map((part) => part.trim())
-        .filter(Boolean),
-      '+'
-    ]
-  }
-  return input
-    .split('+')
-    .map((part) => part.trim())
-    .filter(Boolean)
-}
-
-function parseModifier(input: string): string {
-  const platformModifier = PLATFORM_MODIFIER_NAMES[input.toLowerCase()]
-  if (platformModifier) {
-    return platformModifier()
-  }
-  const modifier = MODIFIER_NAMES[input.toLowerCase()]
-  if (!modifier) {
-    throw new RuntimeClientError('invalid_argument', `unknown modifier '${input}'`)
-  }
-  return modifier
-}
-
-function parseBaseKey(input: string): string {
-  const mapped = KEY_NAMES[input]
-  if (mapped) {
-    return mapped
-  }
-  if (/^F([1-9]|1[0-9]|2[0-4])$/.test(input)) {
-    return input
-  }
-  const keypadDigit = input.match(/^KP_([0-9])$/)
-  if (keypadDigit) {
-    return `Numpad${keypadDigit[1]}`
-  }
-  if (isPrintableAscii(input)) {
-    return input
-  }
-  throw new RuntimeClientError('invalid_argument', `unknown key '${input}'`)
-}
-
-function isPrintableAscii(input: string): boolean {
-  if (input.length !== 1) {
-    return false
-  }
-  const code = input.charCodeAt(0)
-  return code >= 0x20 && code <= 0x7e
-}
-
-function dedupeModifiers(modifiers: string[]): string[] {
-  return [...new Set(modifiers)]
-}
diff --git a/src/main/computer/macos-native-provider-transport.ts b/src/main/computer/macos-native-provider-transport.ts
index 54c4cf773aa..1048ce5a94c 100644
--- a/src/main/computer/macos-native-provider-transport.ts
+++ b/src/main/computer/macos-native-provider-transport.ts
@@ -52,7 +52,7 @@ export function consumeNativeProviderLines(
   let remaining = buffer
   while (true) {
     const newline = remaining.indexOf('\n')
-    if (newline < 0) {
+    if (newline === -1) {
       return remaining
     }
     const line = remaining.slice(0, newline)
diff --git a/src/main/computer/permissions.test.ts b/src/main/computer/permissions.test.ts
deleted file mode 100644
index fd94f389b34..00000000000
--- a/src/main/computer/permissions.test.ts
+++ /dev/null
@@ -1,120 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-
-const {
-  notificationCtorMock,
-  notificationIsSupportedMock,
-  notificationOnMock,
-  notificationRemoveListenerMock,
-  notificationShowMock,
-  shellOpenExternalMock,
-  isTrustedAccessibilityClientMock
-} = vi.hoisted(() => {
-  const notificationOnMock = vi.fn()
-  const notificationRemoveListenerMock = vi.fn()
-  const notificationShowMock = vi.fn()
-  const notificationCtorMock = vi.fn(function () {
-    return {
-      on: notificationOnMock,
-      removeListener: notificationRemoveListenerMock,
-      show: notificationShowMock
-    }
-  })
-  return {
-    notificationCtorMock,
-    notificationIsSupportedMock: vi.fn(() => true),
-    notificationOnMock,
-    notificationRemoveListenerMock,
-    notificationShowMock,
-    shellOpenExternalMock: vi.fn(),
-    isTrustedAccessibilityClientMock: vi.fn(() => false)
-  }
-})
-
-vi.mock('electron', () => ({
-  Notification: Object.assign(notificationCtorMock, {
-    isSupported: notificationIsSupportedMock
-  }),
-  shell: {
-    openExternal: shellOpenExternalMock
-  },
-  systemPreferences: {
-    isTrustedAccessibilityClient: isTrustedAccessibilityClientMock
-  }
-}))
-
-import { notifyPermissionRequired } from './permissions'
-
-describe('notifyPermissionRequired', () => {
-  const originalPlatform = process.platform
-
-  beforeEach(() => {
-    vi.useFakeTimers()
-    vi.clearAllTimers()
-    notificationCtorMock.mockClear()
-    notificationIsSupportedMock.mockReset()
-    notificationIsSupportedMock.mockReturnValue(true)
-    notificationOnMock.mockClear()
-    notificationRemoveListenerMock.mockClear()
-    notificationShowMock.mockClear()
-    shellOpenExternalMock.mockClear()
-    Object.defineProperty(process, 'platform', { value: originalPlatform, configurable: true })
-  })
-
-  afterEach(() => {
-    vi.useRealTimers()
-    Object.defineProperty(process, 'platform', { value: originalPlatform, configurable: true })
-  })
-
-  function getNotificationEventHandler(eventName: string): (...args: unknown[]) => void {
-    const call = notificationOnMock.mock.calls.find((c: unknown[]) => c[0] === eventName)
-    if (!call) {
-      throw new Error(`Notification ${eventName} handler not registered`)
-    }
-    return call[1] as (...args: unknown[]) => void
-  }
-
-  it('clears the retained notification fallback timer when the notification closes', () => {
-    notifyPermissionRequired('Enable accessibility')
-
-    expect(notificationShowMock).toHaveBeenCalledTimes(1)
-    expect(vi.getTimerCount()).toBe(1)
-
-    const closeHandler = getNotificationEventHandler('close')
-    closeHandler()
-
-    expect(vi.getTimerCount()).toBe(0)
-    expect(notificationRemoveListenerMock).toHaveBeenCalledWith('close', closeHandler)
-    expect(notificationRemoveListenerMock).toHaveBeenCalledWith('click', expect.any(Function))
-  })
-
-  it('opens macOS Accessibility settings on click after releasing notification state', () => {
-    Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true })
-    notifyPermissionRequired('Enable accessibility')
-
-    getNotificationEventHandler('click')()
-
-    expect(shellOpenExternalMock).toHaveBeenCalledWith(
-      expect.stringContaining('Privacy_Accessibility')
-    )
-    expect(vi.getTimerCount()).toBe(0)
-  })
-
-  it('clears retained notification state when native delivery fails', () => {
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    try {
-      notifyPermissionRequired('Enable accessibility')
-      expect(vi.getTimerCount()).toBe(1)
-
-      const failedHandler = getNotificationEventHandler('failed')
-      failedHandler({}, 'Application is not code signed')
-
-      expect(warn).toHaveBeenCalledWith(
-        expect.stringContaining('Accessibility permission notification failed')
-      )
-      expect(vi.getTimerCount()).toBe(0)
-      expect(notificationRemoveListenerMock).toHaveBeenCalledWith('failed', failedHandler)
-    } finally {
-      warn.mockRestore()
-    }
-  })
-})
diff --git a/src/main/computer/permissions.ts b/src/main/computer/permissions.ts
deleted file mode 100644
index a98f01c3dbc..00000000000
--- a/src/main/computer/permissions.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-import { Notification, shell } from 'electron'
-
-const ACCESSIBILITY_SETTINGS_URL =
-  'x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility'
-
-const activePermissionNotifications = new Set<Notification>()
-
-/** Surface a notification through Orca's existing notification system (do not duplicate UI). */
-export function notifyPermissionRequired(instructions: string): void {
-  if (!Notification.isSupported()) {
-    return
-  }
-
-  const notification = new Notification({
-    title: 'Accessibility permission required',
-    body: instructions
-  })
-  activePermissionNotifications.add(notification)
-
-  let releaseTimer: ReturnType<typeof setTimeout> | null = null
-  let released = false
-  function release(): void {
-    if (released) {
-      return
-    }
-    released = true
-    activePermissionNotifications.delete(notification)
-    notification.removeListener('close', release)
-    notification.removeListener('click', onClick)
-    notification.removeListener('failed', onFailed)
-    if (releaseTimer) {
-      clearTimeout(releaseTimer)
-      releaseTimer = null
-    }
-  }
-  function onClick(): void {
-    release()
-    if (process.platform === 'darwin') {
-      void shell.openExternal(ACCESSIBILITY_SETTINGS_URL)
-    }
-  }
-  function onFailed(_event: unknown, error?: string): void {
-    // Why: Electron 42 reports macOS UNNotification delivery failures here,
-    // most commonly when a local validation build is not code-signed.
-    console.warn(
-      `[computer] Accessibility permission notification failed${error ? `: ${error}` : '.'}`
-    )
-    release()
-  }
-  notification.on('close', release)
-  notification.on('click', onClick)
-  notification.on('failed', onFailed)
-  releaseTimer = setTimeout(release, 5 * 60 * 1000)
-  if (typeof releaseTimer.unref === 'function') {
-    releaseTimer.unref()
-  }
-  notification.show()
-}
diff --git a/src/main/copilot/hook-service.ts b/src/main/copilot/hook-service.ts
index 6a8206d0b59..425efe4f00d 100644
--- a/src/main/copilot/hook-service.ts
+++ b/src/main/copilot/hook-service.ts
@@ -17,6 +17,7 @@ import {
   writeManagedScript,
   type HookDefinition
 } from '../agent-hooks/installer-utils'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
 import {
   readHooksJsonRemote,
   writeHooksJsonRemote,
@@ -117,7 +118,6 @@ function getManagedScript(target: 'local' | 'posix' = 'local'): string {
   if (target === 'local' && process.platform === 'win32') {
     return [
       "Write-Output '{}'",
-      '$inputData = [Console]::In.ReadToEnd()',
       // Why: endpoint.cmd is cmd syntax, not PowerShell. Parse its `set KEY=...`
       // lines so surviving PTYs can refresh to the current Orca server.
       'if ($env:ORCA_AGENT_HOOK_ENDPOINT -and (Test-Path -LiteralPath $env:ORCA_AGENT_HOOK_ENDPOINT)) {',
@@ -129,7 +129,11 @@ function getManagedScript(target: 'local' | 'posix' = 'local'): string {
       '    }',
       '  } catch {}',
       '}',
+      // Why (#11549 class): missing Orca context means a user-wide hook fired outside an
+      // Orca pane. ReadToEnd blocks forever if that caller abandons the pipe, so the guard
+      // must run before the hook owns stdin; the payload would be discarded anyway.
       'if (-not $env:ORCA_AGENT_HOOK_PORT -or -not $env:ORCA_AGENT_HOOK_TOKEN -or -not $env:ORCA_PANE_KEY) { exit 0 }',
+      '$inputData = [Console]::In.ReadToEnd()',
       'if ([string]::IsNullOrWhiteSpace($inputData)) { exit 0 }',
       'try {',
       '  $payload = $inputData | ConvertFrom-Json',
@@ -183,6 +187,10 @@ function getManagedScript(target: 'local' | 'posix' = 'local'): string {
 }
 
 export class CopilotHookService {
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(getManagedScriptPath(), getManagedScript())
+  }
+
   getStatus(): AgentHookInstallStatus {
     const configPath = getConfigPath()
     const scriptPath = getManagedScriptPath()
diff --git a/src/main/cursor/hook-service.ts b/src/main/cursor/hook-service.ts
index 7b5f3b90dda..ab9d07b25eb 100644
--- a/src/main/cursor/hook-service.ts
+++ b/src/main/cursor/hook-service.ts
@@ -15,6 +15,7 @@ import {
   writeManagedScript,
   type HookDefinition
 } from '../agent-hooks/installer-utils'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
 import {
   readHooksJsonRemote,
   writeHooksJsonRemote,
@@ -101,6 +102,10 @@ function getManagedScript(target: 'local' | 'posix' = 'local'): string {
 }
 
 export class CursorHookService {
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(getManagedScriptPath(), getManagedScript())
+  }
+
   getStatus(): AgentHookInstallStatus {
     const configPath = getConfigPath()
     const scriptPath = getManagedScriptPath()
@@ -211,7 +216,7 @@ export class CursorHookService {
     return this.getStatus()
   }
 
-  // Installs managed Cursor hooks on an SSH remote (POSIX-only). See docs/design/agent-status-over-ssh.md §8.
+  // Installs managed Cursor hooks on an SSH remote (POSIX-only); the managed script/JSON shape must match local install() or remote panes report a different status.
   async installRemote(sftp: SFTPWrapper, remoteHome: string): Promise<AgentHookInstallStatus> {
     const remoteConfigPath = `${remoteHome.replace(/\/$/, '')}/.cursor/hooks.json`
     const remoteScriptPath = `${remoteHome.replace(/\/$/, '')}/.orca/agent-hooks/cursor-hook.sh`
diff --git a/src/main/daemon/binary-frame.test.ts b/src/main/daemon/binary-frame.test.ts
deleted file mode 100644
index 81148f18a59..00000000000
--- a/src/main/daemon/binary-frame.test.ts
+++ /dev/null
@@ -1,167 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-import { encodeFrame, createFrameParser, FrameType, FRAME_HEADER_SIZE } from './binary-frame'
-
-describe('encodeFrame', () => {
-  it('encodes a data frame with correct header', () => {
-    const payload = Buffer.from('hello')
-    const frame = encodeFrame(FrameType.Data, payload)
-
-    expect(frame.length).toBe(FRAME_HEADER_SIZE + payload.length)
-    expect(frame[0]).toBe(FrameType.Data)
-    expect(frame.readUInt32BE(1)).toBe(payload.length)
-    expect(frame.subarray(FRAME_HEADER_SIZE).toString()).toBe('hello')
-  })
-
-  it('encodes a resize frame', () => {
-    const payload = Buffer.from(JSON.stringify({ cols: 120, rows: 40 }))
-    const frame = encodeFrame(FrameType.Resize, payload)
-
-    expect(frame[0]).toBe(FrameType.Resize)
-    expect(frame.readUInt32BE(1)).toBe(payload.length)
-  })
-
-  it('encodes an exit frame with exit code', () => {
-    const payload = Buffer.from(JSON.stringify({ code: 0 }))
-    const frame = encodeFrame(FrameType.Exit, payload)
-
-    expect(frame[0]).toBe(FrameType.Exit)
-    const decoded = JSON.parse(frame.subarray(FRAME_HEADER_SIZE).toString())
-    expect(decoded.code).toBe(0)
-  })
-
-  it('encodes empty payload', () => {
-    const frame = encodeFrame(FrameType.Kill, Buffer.alloc(0))
-
-    expect(frame.length).toBe(FRAME_HEADER_SIZE)
-    expect(frame[0]).toBe(FrameType.Kill)
-    expect(frame.readUInt32BE(1)).toBe(0)
-  })
-
-  it('throws on payload exceeding max size', () => {
-    const oversized = Buffer.alloc(1024 * 1024 + 1)
-    expect(() => encodeFrame(FrameType.Data, oversized)).toThrow()
-  })
-})
-
-describe('createFrameParser', () => {
-  it('parses a single complete frame', () => {
-    const onFrame = vi.fn()
-    const parser = createFrameParser(onFrame)
-
-    const payload = Buffer.from('test data')
-    const frame = encodeFrame(FrameType.Data, payload)
-    parser.feed(frame)
-
-    expect(onFrame).toHaveBeenCalledOnce()
-    expect(onFrame.mock.calls[0][0]).toBe(FrameType.Data)
-    expect(onFrame.mock.calls[0][1].toString()).toBe('test data')
-  })
-
-  it('parses multiple frames in one chunk', () => {
-    const onFrame = vi.fn()
-    const parser = createFrameParser(onFrame)
-
-    const frame1 = encodeFrame(FrameType.Data, Buffer.from('one'))
-    const frame2 = encodeFrame(FrameType.Data, Buffer.from('two'))
-    parser.feed(Buffer.concat([frame1, frame2]))
-
-    expect(onFrame).toHaveBeenCalledTimes(2)
-    expect(onFrame.mock.calls[0][1].toString()).toBe('one')
-    expect(onFrame.mock.calls[1][1].toString()).toBe('two')
-  })
-
-  it('handles frame split across header boundary', () => {
-    const onFrame = vi.fn()
-    const parser = createFrameParser(onFrame)
-
-    const payload = Buffer.from('split test')
-    const frame = encodeFrame(FrameType.Data, payload)
-
-    // Split in the middle of the header (3 bytes, then the rest)
-    parser.feed(frame.subarray(0, 3))
-    expect(onFrame).not.toHaveBeenCalled()
-
-    parser.feed(frame.subarray(3))
-    expect(onFrame).toHaveBeenCalledOnce()
-    expect(onFrame.mock.calls[0][1].toString()).toBe('split test')
-  })
-
-  it('handles frame split in the middle of payload', () => {
-    const onFrame = vi.fn()
-    const parser = createFrameParser(onFrame)
-
-    const payload = Buffer.from('payload split')
-    const frame = encodeFrame(FrameType.Data, payload)
-
-    // Split after header + 3 bytes of payload
-    const splitPoint = FRAME_HEADER_SIZE + 3
-    parser.feed(frame.subarray(0, splitPoint))
-    expect(onFrame).not.toHaveBeenCalled()
-
-    parser.feed(frame.subarray(splitPoint))
-    expect(onFrame).toHaveBeenCalledOnce()
-    expect(onFrame.mock.calls[0][1].toString()).toBe('payload split')
-  })
-
-  it('handles byte-by-byte feeding', () => {
-    const onFrame = vi.fn()
-    const parser = createFrameParser(onFrame)
-
-    const frame = encodeFrame(FrameType.Exit, Buffer.from('{"code":42}'))
-
-    for (let i = 0; i < frame.length; i++) {
-      parser.feed(frame.subarray(i, i + 1))
-    }
-
-    expect(onFrame).toHaveBeenCalledOnce()
-    expect(onFrame.mock.calls[0][0]).toBe(FrameType.Exit)
-    expect(JSON.parse(onFrame.mock.calls[0][1].toString())).toEqual({ code: 42 })
-  })
-
-  it('handles zero-length payload frame', () => {
-    const onFrame = vi.fn()
-    const parser = createFrameParser(onFrame)
-
-    const frame = encodeFrame(FrameType.Kill, Buffer.alloc(0))
-    parser.feed(frame)
-
-    expect(onFrame).toHaveBeenCalledOnce()
-    expect(onFrame.mock.calls[0][0]).toBe(FrameType.Kill)
-    expect(onFrame.mock.calls[0][1].length).toBe(0)
-  })
-
-  it('parses different frame types correctly', () => {
-    const onFrame = vi.fn()
-    const parser = createFrameParser(onFrame)
-
-    const frames = [
-      encodeFrame(FrameType.Data, Buffer.from('data')),
-      encodeFrame(FrameType.Resize, Buffer.from('resize')),
-      encodeFrame(FrameType.Signal, Buffer.from('signal'))
-    ]
-
-    parser.feed(Buffer.concat(frames))
-
-    expect(onFrame).toHaveBeenCalledTimes(3)
-    expect(onFrame.mock.calls[0][0]).toBe(FrameType.Data)
-    expect(onFrame.mock.calls[1][0]).toBe(FrameType.Resize)
-    expect(onFrame.mock.calls[2][0]).toBe(FrameType.Signal)
-  })
-
-  it('resets buffer state', () => {
-    const onFrame = vi.fn()
-    const parser = createFrameParser(onFrame)
-
-    // Feed partial frame then reset
-    const frame = encodeFrame(FrameType.Data, Buffer.from('lost'))
-    parser.feed(frame.subarray(0, 3))
-    parser.reset()
-
-    // Feed a new complete frame
-    const frame2 = encodeFrame(FrameType.Data, Buffer.from('fresh'))
-    parser.feed(frame2)
-
-    expect(onFrame).toHaveBeenCalledOnce()
-    expect(onFrame.mock.calls[0][1].toString()).toBe('fresh')
-  })
-})
diff --git a/src/main/daemon/binary-frame.ts b/src/main/daemon/binary-frame.ts
deleted file mode 100644
index e8c4fd6ae90..00000000000
--- a/src/main/daemon/binary-frame.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-export { FrameType } from './types'
-import type { FrameType } from './types'
-import { FRAME_HEADER_SIZE, FRAME_MAX_PAYLOAD } from './types'
-
-export { FRAME_HEADER_SIZE }
-
-export function encodeFrame(type: FrameType, payload: Buffer): Buffer {
-  if (payload.length > FRAME_MAX_PAYLOAD) {
-    throw new Error(`Frame payload ${payload.length} exceeds max ${FRAME_MAX_PAYLOAD}`)
-  }
-
-  const frame = Buffer.allocUnsafe(FRAME_HEADER_SIZE + payload.length)
-  frame[0] = type
-  frame.writeUInt32BE(payload.length, 1)
-  payload.copy(frame, FRAME_HEADER_SIZE)
-  return frame
-}
-
-export type FrameParser = {
-  feed(chunk: Buffer): void
-  reset(): void
-}
-
-export function createFrameParser(
-  onFrame: (type: FrameType, payload: Buffer) => void
-): FrameParser {
-  let buffer: Buffer = Buffer.alloc(0)
-
-  function parse(): void {
-    while (buffer.length >= FRAME_HEADER_SIZE) {
-      const payloadLength = buffer.readUInt32BE(1)
-      const totalLength = FRAME_HEADER_SIZE + payloadLength
-
-      if (buffer.length < totalLength) {
-        break
-      }
-
-      const type = buffer[0] as FrameType
-      const payload = buffer.subarray(FRAME_HEADER_SIZE, totalLength)
-      buffer = buffer.subarray(totalLength)
-
-      onFrame(type, payload)
-    }
-  }
-
-  return {
-    feed(chunk: Buffer): void {
-      buffer = buffer.length === 0 ? chunk : Buffer.concat([buffer, chunk])
-      parse()
-    },
-
-    reset(): void {
-      buffer = Buffer.alloc(0)
-    }
-  }
-}
diff --git a/src/main/daemon/daemon-errors.test.ts b/src/main/daemon/daemon-errors.test.ts
index d12ce645ee7..71374415772 100644
--- a/src/main/daemon/daemon-errors.test.ts
+++ b/src/main/daemon/daemon-errors.test.ts
@@ -2,8 +2,15 @@ import { describe, expect, it } from 'vitest'
 import {
   DaemonProtocolError,
   decodeDaemonResponseError,
-  SessionNotFoundError
+  isDaemonEndpointGoneError,
+  SessionNotFoundError,
+  TerminalHostGoneError
 } from './daemon-errors'
+import { mapRuntimeError } from '../runtime/rpc/errors'
+
+function socketError(code: string, syscall: string): Error & { code: string; syscall: string } {
+  return Object.assign(new Error(`${syscall} ${code}`), { code, syscall })
+}
 
 describe('decodeDaemonResponseError', () => {
   it('types the exact legacy session-absence response', () => {
@@ -18,3 +25,44 @@ describe('decodeDaemonResponseError', () => {
     )
   })
 })
+
+describe('isDaemonEndpointGoneError', () => {
+  it('recognizes a missing Windows named pipe', () => {
+    const err = Object.assign(
+      new Error('connect ENOENT \\\\?\\pipe\\orca-terminal-host-v30-14cb7f94b511'),
+      { code: 'ENOENT', syscall: 'connect' }
+    )
+    expect(isDaemonEndpointGoneError(err)).toBe(true)
+  })
+
+  it('recognizes a refused socket', () => {
+    expect(isDaemonEndpointGoneError(socketError('ECONNREFUSED', 'connect'))).toBe(true)
+  })
+
+  it('ignores a missing token file, which does not prove the endpoint is gone', () => {
+    expect(isDaemonEndpointGoneError(socketError('ENOENT', 'open'))).toBe(false)
+  })
+
+  it('ignores connect failures that are not proof of absence', () => {
+    for (const code of ['ETIMEDOUT', 'ECONNRESET', 'EPIPE', 'EACCES']) {
+      expect(isDaemonEndpointGoneError(socketError(code, 'connect'))).toBe(false)
+    }
+  })
+
+  it('ignores non-socket errors and non-objects', () => {
+    expect(isDaemonEndpointGoneError(new Error('Connection lost'))).toBe(false)
+    expect(isDaemonEndpointGoneError('connect ENOENT')).toBe(false)
+    expect(isDaemonEndpointGoneError(null)).toBe(false)
+    expect(isDaemonEndpointGoneError(undefined)).toBe(false)
+  })
+
+  it('keeps the host-gone marker across runtime RPC error mapping', () => {
+    const response = mapRuntimeError(
+      'req-1',
+      { runtimeId: 'runtime-1' },
+      new TerminalHostGoneError()
+    )
+
+    expect(response.error).toEqual({ code: 'runtime_error', message: 'terminal_host_gone' })
+  })
+})
diff --git a/src/main/daemon/daemon-errors.ts b/src/main/daemon/daemon-errors.ts
index bddb3690a4a..d5b7dc2418e 100644
--- a/src/main/daemon/daemon-errors.ts
+++ b/src/main/daemon/daemon-errors.ts
@@ -28,6 +28,24 @@ export class TerminalSessionOwnerUnverifiedError extends Error {
   }
 }
 
+export class TerminalHostGoneError extends Error {
+  constructor() {
+    super('terminal_host_gone')
+    this.name = 'TerminalHostGoneError'
+  }
+}
+
+// Connect ENOENT/ECONNREFUSED proves the endpoint is absent; open ENOENT can be a missing token file.
+export function isDaemonEndpointGoneError(err: unknown): boolean {
+  const candidate = err as { code?: unknown; syscall?: unknown } | null
+  return (
+    typeof candidate === 'object' &&
+    candidate !== null &&
+    candidate.syscall === 'connect' &&
+    (candidate.code === 'ENOENT' || candidate.code === 'ECONNREFUSED')
+  )
+}
+
 export function decodeDaemonResponseError(message: string): Error {
   const prefix = 'Session not found: '
   return message.startsWith(prefix)
diff --git a/src/main/daemon/daemon-foreground-confirmation-protocol.test.ts b/src/main/daemon/daemon-foreground-confirmation-protocol.test.ts
index 07f291a60ff..7ce08eaf83b 100644
--- a/src/main/daemon/daemon-foreground-confirmation-protocol.test.ts
+++ b/src/main/daemon/daemon-foreground-confirmation-protocol.test.ts
@@ -3,7 +3,7 @@ import { PREVIOUS_DAEMON_PROTOCOL_VERSIONS, PROTOCOL_VERSION } from './types'
 
 describe('foreground-confirmation daemon protocol', () => {
   it('rejects daemons from before the fresh-confirmation RPC', () => {
-    expect(PROTOCOL_VERSION).toBe(32)
+    expect(PROTOCOL_VERSION).toBe(33)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(19)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(22)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(23)
@@ -15,5 +15,6 @@ describe('foreground-confirmation daemon protocol', () => {
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(29)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(30)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(31)
+    expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(32)
   })
 })
diff --git a/src/main/daemon/daemon-incarnation-evidence.ts b/src/main/daemon/daemon-incarnation-evidence.ts
index 01d9ffc97c5..f5c88935998 100644
--- a/src/main/daemon/daemon-incarnation-evidence.ts
+++ b/src/main/daemon/daemon-incarnation-evidence.ts
@@ -237,7 +237,7 @@ async function probeWindowsProcess(
 
 export function parseLinuxProcessState(statLine: string): string | null {
   const commandEnd = statLine.lastIndexOf(')')
-  if (commandEnd < 0) {
+  if (commandEnd === -1) {
     return null
   }
   return (
diff --git a/src/main/daemon/daemon-protocol-version.test.ts b/src/main/daemon/daemon-protocol-version.test.ts
index 53ad0c06341..d47eecc9722 100644
--- a/src/main/daemon/daemon-protocol-version.test.ts
+++ b/src/main/daemon/daemon-protocol-version.test.ts
@@ -8,6 +8,7 @@ import {
   MODE_2031_UNSUBSCRIBE_FACT_PROTOCOL_VERSION,
   SNAPSHOT_SERIALIZER_FIDELITY_DAEMON_PROTOCOL_VERSION,
   STABLE_PANE_ATTACH_ONLY_DAEMON_PROTOCOL_VERSION,
+  WSL_POSIX_CWD_DAEMON_PROTOCOL_VERSION,
   PREVIOUS_DAEMON_PROTOCOL_VERSIONS,
   PROTOCOL_VERSION,
   supportsMode2031UnsubscribeFact
@@ -15,7 +16,8 @@ import {
 
 describe('daemon protocol version', () => {
   it('ships bounded history transfer after the 2031-unsubscribe fact', () => {
-    expect(PROTOCOL_VERSION).toBe(32)
+    expect(PROTOCOL_VERSION).toBe(33)
+    expect(WSL_POSIX_CWD_DAEMON_PROTOCOL_VERSION).toBe(33)
     expect(SNAPSHOT_SERIALIZER_FIDELITY_DAEMON_PROTOCOL_VERSION).toBe(32)
     expect(STABLE_PANE_ATTACH_ONLY_DAEMON_PROTOCOL_VERSION).toBe(31)
     expect(HISTORY_SEED_TRANSFER_PROTOCOL_VERSION).toBe(30)
@@ -25,7 +27,7 @@ describe('daemon protocol version', () => {
     expect(AGENT_SESSION_CLAIM_DAEMON_PROTOCOL_VERSION).toBe(26)
     expect(AGENT_SESSION_CREATE_OPERATION_DAEMON_PROTOCOL_VERSION).toBe(26)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toEqual(
-      Array.from({ length: 31 }, (_, index) => index + 1)
+      Array.from({ length: 32 }, (_, index) => index + 1)
     )
   })
 
diff --git a/src/main/daemon/daemon-protocol-version.ts b/src/main/daemon/daemon-protocol-version.ts
index fee06b235f2..64c4d559670 100644
--- a/src/main/daemon/daemon-protocol-version.ts
+++ b/src/main/daemon/daemon-protocol-version.ts
@@ -1,6 +1,7 @@
 // Why: daemons survive app updates, so wire behavior must be version-gated.
-// v32 carries the corrected terminal snapshot serializer; older owners remain attachable.
-export const PROTOCOL_VERSION = 32
+// v33 preserves selected-WSL POSIX cwd semantics; older owners remain attachable.
+export const PROTOCOL_VERSION = 33
+export const WSL_POSIX_CWD_DAEMON_PROTOCOL_VERSION = 33
 export const SNAPSHOT_SERIALIZER_FIDELITY_DAEMON_PROTOCOL_VERSION = 32
 export const STABLE_PANE_ATTACH_ONLY_DAEMON_PROTOCOL_VERSION = 31
 export const HISTORY_SEED_TRANSFER_PROTOCOL_VERSION = 30
@@ -26,7 +27,7 @@ export const CLEAN_DISCONNECT_PROTOCOL_VERSION = 24
 export const MODE_2031_UNSUBSCRIBE_FACT_PROTOCOL_VERSION = 29
 export const PREVIOUS_DAEMON_PROTOCOL_VERSIONS = [
   1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27,
-  28, 29, 30, 31
+  28, 29, 30, 31, 32
 ] as const
 
 export function supportsPtyStartupIngress(protocolVersion: number): boolean {
diff --git a/src/main/daemon/daemon-pty-adapter.test.ts b/src/main/daemon/daemon-pty-adapter.test.ts
index 7a697e6d96c..b138fbe3b8d 100644
--- a/src/main/daemon/daemon-pty-adapter.test.ts
+++ b/src/main/daemon/daemon-pty-adapter.test.ts
@@ -1321,6 +1321,60 @@ describe('DaemonPtyAdapter (IPtyProvider)', () => {
         source: 'headless'
       })
     })
+
+    // A proven `0` and an absent field are different facts. Dropping
+    // the zero left consumers unable to tell "the app negotiated nothing" from
+    // "this source could not say", which is what makes Preview guess wrong.
+    it('publishes proven kitty flags including a known zero', async () => {
+      const { id } = await adapter.spawn({ cols: 80, rows: 24 })
+      lastSubprocess._simulateData('plain output\r\n')
+
+      await expect(adapter.getBufferSnapshot(id)).resolves.toMatchObject({
+        kittyKeyboardFlags: 0
+      })
+
+      lastSubprocess._simulateData('\x1b[>8u')
+      await expect(adapter.getBufferSnapshot(id)).resolves.toMatchObject({
+        kittyKeyboardFlags: 8
+      })
+    })
+
+    // The other half of that contract: a daemon that cannot say must leave the
+    // key absent, so consumers keep the state unknown instead of reading a `0`.
+    it('omits kitty flags when the daemon snapshot has none', async () => {
+      const { id } = await adapter.spawn({ cols: 80, rows: 24 })
+      lastSubprocess._simulateData('plain output\r\n')
+      const realRequest = DaemonClient.prototype.request
+      const legacyClient = vi
+        .spyOn(DaemonClient.prototype, 'request')
+        .mockImplementation(async function (this: DaemonClient, type, payload, timeoutMs) {
+          const result = await realRequest.call(this, type, payload, timeoutMs)
+          if (type !== 'getSnapshot') {
+            return result
+          }
+          const { snapshot } = result as { snapshot: { modes: Record<string, unknown> } }
+          const { kittyKeyboardFlags: _omitted, ...modes } = snapshot.modes
+          return { snapshot: { ...snapshot, modes } }
+        })
+
+      const snapshot = await adapter.getBufferSnapshot(id)
+      legacyClient.mockRestore()
+
+      expect(snapshot).not.toBeNull()
+      expect(snapshot).not.toHaveProperty('kittyKeyboardFlags')
+    })
+
+    it('exposes live state separately from the visible frame', async () => {
+      const { id } = await adapter.spawn({ cols: 80, rows: 24 })
+      lastSubprocess._simulateData('\x1b[?1049h\x1b[?1004h\x1b[?25lframe')
+
+      const snapshot = await adapter.getBufferSnapshot(id)
+
+      expect(snapshot?.frameRestoreAnsi).toContain('\x1b[?1004h')
+      expect(snapshot?.frameRestoreAnsi).toContain('\x1b[?25l')
+      expect(snapshot?.frameRestoreAnsi).not.toContain('frame')
+      expect(snapshot?.data).toContain('frame')
+    })
   })
 
   describe('shutdown', () => {
@@ -1506,6 +1560,19 @@ describe('DaemonPtyAdapter (IPtyProvider)', () => {
       expect(result.snapshot).toContain('prompt$')
     })
 
+    it('publishes the alt-frame payload as explicit strings', async () => {
+      const sessionId = 'alt-frame-boundary'
+      await adapter.spawn({ cols: 80, rows: 24, sessionId })
+      lastSubprocess._simulateData('\x1b[?1049h\x1b[HSTATIC-ALT-FRAME')
+      await new Promise((r) => setTimeout(r, 50))
+
+      const result = await adapter.spawn({ cols: 80, rows: 24, sessionId })
+      expect(result.snapshotPrefixAnsi).toContain('\x1b[?1049h')
+      expect(result.snapshotFrameAnsi).toContain('STATIC-ALT-FRAME')
+      expect(result.snapshot).toBe([result.snapshotPrefixAnsi, result.snapshotFrameAnsi].join(''))
+      expect(result.snapshotFrameRestoreAnsi).not.toContain('STATIC-ALT-FRAME')
+    })
+
     it('returns the preserved sequence from attach-only adoption', async () => {
       const sessionId = 'attach-sequence-handoff'
       await adapter.spawn({ cols: 80, rows: 24, sessionId })
diff --git a/src/main/daemon/daemon-pty-adapter.ts b/src/main/daemon/daemon-pty-adapter.ts
index f8bdf30deab..9e8142922ac 100644
--- a/src/main/daemon/daemon-pty-adapter.ts
+++ b/src/main/daemon/daemon-pty-adapter.ts
@@ -59,6 +59,7 @@ import type {
   PtySpawnResult
 } from '../providers/types'
 import type { PtyProcessInspection } from '../providers/pty-process-inspection'
+import { parseTerminalKittyKeyboardFlags } from '../../shared/terminal-kitty-keyboard-flags'
 import { isShellProcess } from '../../shared/agent-detection'
 import { resolveWslSessionContext } from './wsl-session-context'
 import { normalizeWslColdRestoreCwd } from './wsl-cold-restore-cwd'
@@ -831,12 +832,15 @@ export class DaemonPtyAdapter implements IPtyProvider {
     }
 
     const isAltScreen = result.snapshot.modes.alternateScreen
-    const snapshotPayload =
-      result.snapshot.scrollbackAnsi +
-      result.snapshot.rehydrateSequences +
-      result.snapshot.snapshotAnsi
+    const snapshotPrefix = result.snapshot.scrollbackAnsi + result.snapshot.rehydrateSequences
+    const snapshotFrame = result.snapshot.snapshotAnsi
+    const snapshotPayload = snapshotPrefix + snapshotFrame
     // Why kitty flags ride beside the payload, not inside it: the snapshot reaches renderer xterms where POST_REPLAY_REATTACH_RESET's kitty reset must win (terminal-query-authority.md §kitty).
-    const kittyKeyboardFlags = result.snapshot.modes.kittyKeyboardFlags
+    // Why known `0` is no longer dropped: the pane tracker must be able to tell
+    // "the app negotiated nothing" from "this reattach proved nothing".
+    const kittyKeyboardFlags = parseTerminalKittyKeyboardFlags(
+      result.snapshot.modes.kittyKeyboardFlags
+    )
     return {
       id: sessionId,
       ...incarnationResult(),
@@ -847,8 +851,16 @@ export class DaemonPtyAdapter implements IPtyProvider {
       snapshot: snapshotPayload,
       snapshotCols: result.snapshot.cols,
       snapshotRows: result.snapshot.rows,
+      // Why only for an alt frame: normal history remains safe to replay at its capture grid.
+      ...(isAltScreen && snapshotFrame && result.snapshot.frameRestoreAnsi
+        ? {
+            snapshotPrefixAnsi: snapshotPrefix,
+            snapshotFrameAnsi: snapshotFrame,
+            snapshotFrameRestoreAnsi: result.snapshot.frameRestoreAnsi
+          }
+        : {}),
       ...(providerSequence ? { providerSequence } : {}),
-      ...(typeof kittyKeyboardFlags === 'number' && kittyKeyboardFlags > 0
+      ...(kittyKeyboardFlags !== undefined
         ? { snapshotKittyKeyboardFlags: kittyKeyboardFlags }
         : {}),
       isReattach: true,
@@ -1214,8 +1226,10 @@ export class DaemonPtyAdapter implements IPtyProvider {
       if (!snapshot || typeof snapshot.outputSequence !== 'number') {
         return null
       }
+      const kittyKeyboardFlags = parseTerminalKittyKeyboardFlags(snapshot.modes.kittyKeyboardFlags)
       return {
         data: snapshot.rehydrateSequences + snapshot.snapshotAnsi,
+        frameRestoreAnsi: snapshot.frameRestoreAnsi,
         scrollbackAnsi: snapshot.scrollbackAnsi,
         cols: snapshot.cols,
         rows: snapshot.rows,
@@ -1225,6 +1239,9 @@ export class DaemonPtyAdapter implements IPtyProvider {
         source: 'headless',
         oscLinks: snapshot.oscLinks,
         alternateScreen: snapshot.modes.alternateScreen,
+        // Why known `0` is carried too: it proves the app negotiated nothing at
+        // this boundary, which is a different fact from a source that cannot say.
+        ...(kittyKeyboardFlags !== undefined ? { kittyKeyboardFlags } : {}),
         ...(snapshot.pendingEscapeTailAnsi
           ? { pendingEscapeTailAnsi: snapshot.pendingEscapeTailAnsi }
           : {})
diff --git a/src/main/daemon/daemon-pty-provider.test.ts b/src/main/daemon/daemon-pty-provider.test.ts
deleted file mode 100644
index 50800ffec89..00000000000
--- a/src/main/daemon/daemon-pty-provider.test.ts
+++ /dev/null
@@ -1,198 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { mkdtempSync, rmSync } from 'node:fs'
-import { DaemonPtyProvider } from './daemon-pty-provider'
-import { DaemonServer } from './daemon-server'
-import type { SubprocessHandle } from './session'
-import { getDaemonSocketPath } from './daemon-spawner'
-
-function createTestDir(): string {
-  return mkdtempSync(join(tmpdir(), 'daemon-provider-test-'))
-}
-
-function createMockSubprocess(): SubprocessHandle & {
-  _simulateData: (data: string) => void
-  _simulateExit: (code: number) => void
-} {
-  let onDataCb: ((data: string) => void) | null = null
-  let onExitCb: ((code: number) => void) | null = null
-  return {
-    pid: 77777,
-    getForegroundProcess: vi.fn(() => null),
-    write: vi.fn(),
-    resize: vi.fn(),
-    kill: vi.fn(() => setTimeout(() => onExitCb?.(0), 5)),
-    forceKill: vi.fn(() => setTimeout(() => onExitCb?.(137), 5)),
-    signal: vi.fn(),
-    onData(cb) {
-      onDataCb = cb
-    },
-    onExit(cb) {
-      onExitCb = cb
-    },
-    dispose: vi.fn(),
-    _simulateData(data: string) {
-      onDataCb?.(data)
-    },
-    _simulateExit(code: number) {
-      onExitCb?.(code)
-    }
-  }
-}
-
-async function waitFor(predicate: () => boolean, timeoutMs = 2000): Promise<void> {
-  const start = Date.now()
-  while (!predicate()) {
-    if (Date.now() - start > timeoutMs) {
-      throw new Error('waitFor timed out')
-    }
-    await new Promise((r) => setTimeout(r, 10))
-  }
-}
-
-describe('DaemonPtyProvider', () => {
-  let dir: string
-  let socketPath: string
-  let tokenPath: string
-  let server: DaemonServer
-  let provider: DaemonPtyProvider
-  let lastSubprocess: ReturnType<typeof createMockSubprocess>
-
-  beforeEach(async () => {
-    dir = createTestDir()
-    socketPath = getDaemonSocketPath(dir)
-    tokenPath = join(dir, 'test.token')
-
-    server = new DaemonServer({
-      socketPath,
-      tokenPath,
-      spawnSubprocess: () => {
-        lastSubprocess = createMockSubprocess()
-        return lastSubprocess
-      }
-    })
-    await server.start()
-
-    provider = new DaemonPtyProvider({ socketPath, tokenPath })
-  })
-
-  afterEach(async () => {
-    await provider?.cleanup()
-    await server?.shutdown()
-    rmSync(dir, { recursive: true, force: true })
-  })
-
-  describe('spawn', () => {
-    it('creates a session in the daemon and returns an id', async () => {
-      const result = await provider.spawn({
-        cols: 80,
-        rows: 24,
-        sessionId: 'test-session'
-      })
-
-      expect(result.id).toBe('test-session')
-    })
-
-    it('spawns with cwd and env', async () => {
-      const result = await provider.spawn({
-        cols: 80,
-        rows: 24,
-        cwd: '/home/user',
-        env: { MY_VAR: 'hello' },
-        sessionId: 'session-with-env'
-      })
-
-      expect(result.id).toBe('session-with-env')
-    })
-  })
-
-  describe('write', () => {
-    it('sends data to the daemon session', async () => {
-      await provider.spawn({ cols: 80, rows: 24, sessionId: 's1' })
-
-      // Should not throw
-      provider.write('s1', 'ls\n')
-
-      // Give the fire-and-forget notify time to arrive
-      await new Promise((r) => setTimeout(r, 50))
-      expect(lastSubprocess.write).toHaveBeenCalledWith('ls\n')
-    })
-  })
-
-  describe('resize', () => {
-    it('resizes the daemon session', async () => {
-      await provider.spawn({ cols: 80, rows: 24, sessionId: 's1' })
-      provider.resize('s1', 120, 40)
-
-      await new Promise((r) => setTimeout(r, 50))
-      expect(lastSubprocess.resize).toHaveBeenCalledWith(120, 40)
-    })
-  })
-
-  describe('shutdown (kill session)', () => {
-    it('kills the session in the daemon', async () => {
-      await provider.spawn({ cols: 80, rows: 24, sessionId: 's1' })
-      await provider.shutdown('s1', { immediate: false })
-
-      expect(lastSubprocess.kill).toHaveBeenCalled()
-    })
-  })
-
-  describe('data events', () => {
-    it('delivers data events from the daemon to onData listeners', async () => {
-      const dataPayloads: { id: string; data: string }[] = []
-      provider.onData((payload) => dataPayloads.push(payload))
-
-      await provider.spawn({ cols: 80, rows: 24, sessionId: 's1' })
-
-      // Simulate PTY output from subprocess
-      lastSubprocess._simulateData('hello from shell')
-
-      await waitFor(() => dataPayloads.length > 0)
-      expect(dataPayloads[0]).toEqual({ id: 's1', data: 'hello from shell' })
-    })
-  })
-
-  describe('exit events', () => {
-    it('delivers exit events from the daemon to onExit listeners', async () => {
-      const exits: { id: string; code: number }[] = []
-      provider.onExit((payload) => exits.push(payload))
-
-      await provider.spawn({ cols: 80, rows: 24, sessionId: 's1' })
-
-      lastSubprocess._simulateExit(42)
-
-      await waitFor(() => exits.length > 0)
-      expect(exits[0]).toEqual({ id: 's1', code: 42, incarnationId: expect.any(String) })
-    })
-  })
-
-  describe('cleanup', () => {
-    it('disconnects from daemon without killing sessions', async () => {
-      await provider.spawn({ cols: 80, rows: 24, sessionId: 's1' })
-      await provider.cleanup()
-
-      // Session should still be alive in the daemon — verify by connecting a new provider
-      const provider2 = new DaemonPtyProvider({ socketPath, tokenPath })
-      const result = await provider2.spawn({ cols: 80, rows: 24, sessionId: 's1' })
-
-      // Should reattach (not create new) since the session is alive
-      // The daemon's createOrAttach returns isNew=false for existing sessions
-      expect(result.id).toBe('s1')
-      await provider2.cleanup()
-    })
-  })
-
-  describe('multiple sessions', () => {
-    it('handles multiple concurrent sessions', async () => {
-      const r1 = await provider.spawn({ cols: 80, rows: 24, sessionId: 'a' })
-      const r2 = await provider.spawn({ cols: 80, rows: 24, sessionId: 'b' })
-      const r3 = await provider.spawn({ cols: 80, rows: 24, sessionId: 'c' })
-
-      expect(r1.id).toBe('a')
-      expect(r2.id).toBe('b')
-      expect(r3.id).toBe('c')
-    })
-  })
-})
diff --git a/src/main/daemon/daemon-pty-provider.ts b/src/main/daemon/daemon-pty-provider.ts
deleted file mode 100644
index 2c75f9dcfb8..00000000000
--- a/src/main/daemon/daemon-pty-provider.ts
+++ /dev/null
@@ -1,141 +0,0 @@
-import { DaemonClient } from './client'
-import type { DaemonEvent, CreateOrAttachResult } from './types'
-import type { PtyIncarnationId } from '../../shared/pty-incarnation'
-
-export type DaemonPtyProviderOptions = {
-  socketPath: string
-  tokenPath: string
-}
-
-export type DaemonSpawnOptions = {
-  cols: number
-  rows: number
-  sessionId: string
-  cwd?: string
-  env?: Record<string, string>
-  envToDelete?: string[]
-  command?: string
-}
-
-export type DaemonSpawnResult = {
-  id: string
-  incarnationId?: PtyIncarnationId
-  isNew: boolean
-  pid: number | null
-}
-
-export class DaemonPtyProvider {
-  private client: DaemonClient
-  private dataListeners: ((payload: { id: string; data: string }) => void)[] = []
-  private exitListeners: ((payload: {
-    id: string
-    code: number
-    incarnationId?: PtyIncarnationId
-  }) => void)[] = []
-  private removeEventListener: (() => void) | null = null
-
-  constructor(opts: DaemonPtyProviderOptions) {
-    this.client = new DaemonClient({
-      socketPath: opts.socketPath,
-      tokenPath: opts.tokenPath
-    })
-  }
-
-  async spawn(opts: DaemonSpawnOptions): Promise<DaemonSpawnResult> {
-    await this.client.ensureConnected()
-    this.setupEventRouting()
-
-    const result = await this.client.request<CreateOrAttachResult>('createOrAttach', {
-      sessionId: opts.sessionId,
-      cols: opts.cols,
-      rows: opts.rows,
-      cwd: opts.cwd,
-      env: opts.env,
-      envToDelete: opts.envToDelete,
-      command: opts.command
-    })
-
-    return {
-      id: opts.sessionId,
-      ...(result.incarnationId ? { incarnationId: result.incarnationId } : {}),
-      isNew: result.isNew,
-      pid: result.pid
-    }
-  }
-
-  write(id: string, data: string): void {
-    this.client.notify('write', { sessionId: id, data })
-  }
-
-  resize(id: string, cols: number, rows: number): void {
-    this.client.notify('resize', { sessionId: id, cols, rows })
-  }
-
-  async shutdown(
-    id: string,
-    opts: { immediate?: boolean; keepHistory?: boolean; deadlineMs?: number }
-  ): Promise<void> {
-    // Why: convert the absolute teardown deadline to a relative timeout only here,
-    // at the RPC leaf; undefined keeps the DaemonClient 30s default.
-    await this.client.request(
-      'kill',
-      { sessionId: id, immediate: opts.immediate ?? false },
-      opts.deadlineMs !== undefined ? Math.max(1, opts.deadlineMs - Date.now()) : undefined
-    )
-  }
-
-  onData(callback: (payload: { id: string; data: string }) => void): () => void {
-    this.dataListeners.push(callback)
-    return () => {
-      const idx = this.dataListeners.indexOf(callback)
-      if (idx !== -1) {
-        this.dataListeners.splice(idx, 1)
-      }
-    }
-  }
-
-  onExit(
-    callback: (payload: { id: string; code: number; incarnationId?: PtyIncarnationId }) => void
-  ): () => void {
-    this.exitListeners.push(callback)
-    return () => {
-      const idx = this.exitListeners.indexOf(callback)
-      if (idx !== -1) {
-        this.exitListeners.splice(idx, 1)
-      }
-    }
-  }
-
-  async cleanup(): Promise<void> {
-    this.removeEventListener?.()
-    this.removeEventListener = null
-    this.client.disconnect()
-  }
-
-  private setupEventRouting(): void {
-    if (this.removeEventListener) {
-      return
-    }
-
-    this.removeEventListener = this.client.onEvent((raw) => {
-      const event = raw as DaemonEvent
-      if (event.type !== 'event') {
-        return
-      }
-
-      if (event.event === 'data') {
-        for (const listener of this.dataListeners) {
-          listener({ id: event.sessionId, data: event.payload.data })
-        }
-      } else if (event.event === 'exit') {
-        for (const listener of this.exitListeners) {
-          listener({
-            id: event.sessionId,
-            code: event.payload.code,
-            ...(event.payload.incarnationId ? { incarnationId: event.payload.incarnationId } : {})
-          })
-        }
-      }
-    })
-  }
-}
diff --git a/src/main/daemon/daemon-pty-router.test.ts b/src/main/daemon/daemon-pty-router.test.ts
index 026e8430c28..41cc8016169 100644
--- a/src/main/daemon/daemon-pty-router.test.ts
+++ b/src/main/daemon/daemon-pty-router.test.ts
@@ -408,7 +408,7 @@ describe('DaemonPtyRouter', () => {
     expect(current.confirmForegroundProcess).toHaveBeenCalledWith('current-session')
   })
 
-  it('preserves v30/v31 session owners and routes new sessions to v32', async () => {
+  it('preserves older session owners and routes new sessions to v33', async () => {
     const current = createAdapter('current', [], undefined, PROTOCOL_VERSION)
     const legacyV30 = createAdapter(
       'v30',
@@ -422,22 +422,27 @@ describe('DaemonPtyRouter', () => {
       undefined,
       STABLE_PANE_ATTACH_ONLY_DAEMON_PROTOCOL_VERSION
     )
-    const router = new DaemonPtyRouter({ current, legacy: [legacyV30, legacyV31] })
+    const legacyV32 = createAdapter('v32', ['v32-session'], undefined, 32)
+    const router = new DaemonPtyRouter({ current, legacy: [legacyV30, legacyV31, legacyV32] })
 
     await router.discoverLegacySessions()
 
     await router.spawn({ sessionId: 'v30-session', cols: 80, rows: 24 })
     await router.spawn({ sessionId: 'v31-session', cols: 80, rows: 24 })
+    await router.spawn({ sessionId: 'v32-session', cols: 80, rows: 24 })
     const fresh = await router.spawn({ cols: 80, rows: 24 })
     router.write('v30-session', 'old-v30\n')
     router.write('v31-session', 'old-v31\n')
+    router.write('v32-session', 'old-v32\n')
     router.write(fresh.id, 'new\n')
 
     expect(legacyV30.spawn).toHaveBeenCalledWith({ sessionId: 'v30-session', cols: 80, rows: 24 })
     expect(legacyV31.spawn).toHaveBeenCalledWith({ sessionId: 'v31-session', cols: 80, rows: 24 })
+    expect(legacyV32.spawn).toHaveBeenCalledWith({ sessionId: 'v32-session', cols: 80, rows: 24 })
     expect(current.spawn).toHaveBeenCalledWith({ cols: 80, rows: 24 })
     expect(legacyV30.write).toHaveBeenCalledWith('v30-session', 'old-v30\n')
     expect(legacyV31.write).toHaveBeenCalledWith('v31-session', 'old-v31\n')
+    expect(legacyV32.write).toHaveBeenCalledWith('v32-session', 'old-v32\n')
     expect(current.write).toHaveBeenCalledWith(fresh.id, 'new\n')
   })
 
diff --git a/src/main/daemon/daemon-server.ts b/src/main/daemon/daemon-server.ts
index 51d9d0913a2..731da9eefd5 100644
--- a/src/main/daemon/daemon-server.ts
+++ b/src/main/daemon/daemon-server.ts
@@ -145,7 +145,7 @@ export class DaemonServer {
   private transportSockets = new Set<Socket>()
   private createOrAttachInFlight = 0
   private idleShutdownState: 'running' | 'idle-shutdown-pending' | 'shutting-down' = 'running'
-  private initialAdoptionTimer: unknown | null = null
+  private initialAdoptionTimer: unknown = null
   private initialAdoptionDeadlineMs: number | null = null
   private retirementRequested = false
   private shutdownPromise: Promise<void> | null = null
diff --git a/src/main/daemon/headless-emulator.test.ts b/src/main/daemon/headless-emulator.test.ts
index 37633f32334..9ee6918113f 100644
--- a/src/main/daemon/headless-emulator.test.ts
+++ b/src/main/daemon/headless-emulator.test.ts
@@ -575,6 +575,55 @@ describe('HeadlessEmulator', () => {
   })
 
   describe('rehydration sequences', () => {
+    it('separates complete live state from an alternate-screen frame', async () => {
+      emulator = new HeadlessEmulator({ cols: 80, rows: 24 })
+      await emulator.write('\x1b[?1049h\x1b[?1004h\x1b[?25l\x1b[5;10H\x1b7\x1b[31;44;1mframe')
+
+      const snapshot = emulator.getSnapshot()
+
+      expect(snapshot.frameRestoreAnsi).toContain('\x1b[?1049h')
+      expect(snapshot.frameRestoreAnsi).toContain('\x1b[?1004h')
+      expect(snapshot.frameRestoreAnsi).toContain('\x1b[?25l')
+      expect(snapshot.frameRestoreAnsi).toContain('\x1b7')
+      expect(snapshot.frameRestoreAnsi).toContain('\x1b[31;44;1m')
+      expect(snapshot.frameRestoreAnsi).not.toContain('frame')
+
+      const restored = new HeadlessEmulator({ cols: 80, rows: 24 })
+      await restored.write(snapshot.frameRestoreAnsi ?? '')
+      expect(restored.isAlternateScreen).toBe(true)
+      await restored.write('X')
+      expect(restored.getSnapshot().snapshotAnsi).toContain('\x1b[31;44;1mX')
+      restored.dispose()
+    })
+
+    it('restores current and saved cursor rows relative to origin-mode margins', async () => {
+      emulator = new HeadlessEmulator({ cols: 20, rows: 10 })
+      await emulator.write('\x1b[?1049h\x1b[3;8r\x1b[?6h\x1b[2;7H\x1b7\x1b[4;5H')
+
+      const snapshot = emulator.getSnapshot()
+      const restored = new HeadlessEmulator({ cols: 20, rows: 10 })
+      await restored.write(snapshot.frameRestoreAnsi ?? '')
+      await restored.write('C\x1b8S')
+
+      expect(restored.getVisibleLines()[5]?.[4]).toBe('C')
+      expect(restored.getVisibleLines()[3]?.[6]).toBe('S')
+      restored.dispose()
+    })
+
+    it('restores a saved cursor from before the current origin-mode margins', async () => {
+      emulator = new HeadlessEmulator({ cols: 20, rows: 10 })
+      await emulator.write('\x1b[?1049h\x1b[1;3H\x1b7\x1b[3;8r\x1b[?6h\x1b[4;5H')
+
+      const snapshot = emulator.getSnapshot()
+      const restored = new HeadlessEmulator({ cols: 20, rows: 10 })
+      await restored.write(snapshot.frameRestoreAnsi ?? '')
+      await restored.write('C\x1b8S')
+
+      expect(restored.getVisibleLines()[5]?.[4]).toBe('C')
+      expect(restored.getVisibleLines()[0]?.[2]).toBe('S')
+      restored.dispose()
+    })
+
     it('generates rehydration for non-default modes', async () => {
       emulator = new HeadlessEmulator({ cols: 80, rows: 24 })
       await emulator.write('\x1b[?2004h')
diff --git a/src/main/daemon/headless-emulator.ts b/src/main/daemon/headless-emulator.ts
index 195b97a30f6..12be643d637 100644
--- a/src/main/daemon/headless-emulator.ts
+++ b/src/main/daemon/headless-emulator.ts
@@ -13,6 +13,7 @@ import { collectHeadlessOscLinkRanges } from './headless-osc-link-ranges'
 import { buildRehydrateSequences } from './terminal-mode-rehydrate-sequences'
 import { TerminalMouseModeMirror } from './terminal-mouse-mode-mirror'
 import { TerminalOscCwdTitleScanner } from './terminal-osc-cwd-title-scanner'
+import { buildFrameRestoreSnapshotFields } from './terminal-frame-restore-sequences'
 import { splitTerminalSnapshotAnsi } from './terminal-snapshot-ansi-buffers'
 import {
   installTerminalViewAttributeResponder,
@@ -255,6 +256,7 @@ export class HeadlessEmulator {
         this.restoredOscLinks
       ),
       rehydrateSequences: buildRehydrateSequences(modes),
+      ...buildFrameRestoreSnapshotFields(this.serializer, this.terminal, modes),
       cwd: this.oscText.cwd,
       modes,
       cols: this.terminal.cols,
@@ -266,10 +268,6 @@ export class HeadlessEmulator {
         ? { pendingEscapeTailAnsi: this.partialEscapeTail }
         : {})
     }
-    if (this.partialEscapeTail.length > 0) {
-      // Why a separate field: consumers write their own reset sequences after the body, and any ESC after a dangling partial would abort it.
-      snapshot.pendingEscapeTailAnsi = this.partialEscapeTail
-    }
     return snapshot
   }
 
diff --git a/src/main/daemon/macos-login-session-death-watch.ts b/src/main/daemon/macos-login-session-death-watch.ts
index 1f529ff3e00..e2df486e38f 100644
--- a/src/main/daemon/macos-login-session-death-watch.ts
+++ b/src/main/daemon/macos-login-session-death-watch.ts
@@ -66,9 +66,9 @@ export class MacosLoginSessionDeathWatch {
   private probeInFlight = false
   private stopped = false
   private retired = false
-  private scheduledProbeTimer: unknown | null = null
+  private scheduledProbeTimer: unknown = null
   private scheduledProbeAtMs: number | null = null
-  private ptyExitDebounceTimer: unknown | null = null
+  private ptyExitDebounceTimer: unknown = null
   private pendingProbeTrigger: string | null = null
   private probeAbortController: AbortController | null = null
 
diff --git a/src/main/daemon/node-pty-error-hints.test.ts b/src/main/daemon/node-pty-error-hints.test.ts
index e8fb5a0ef8c..f43951f05a6 100644
--- a/src/main/daemon/node-pty-error-hints.test.ts
+++ b/src/main/daemon/node-pty-error-hints.test.ts
@@ -50,7 +50,7 @@ describe('node-pty diagnostic error hints', () => {
 
   it('hints local wrapped spawn errors from pty allocation failures', () => {
     const message =
-      'Failed to spawn shell "/bin/zsh": node-pty: open_slave failed: EMFILE (errno 24, Too many open files) - slave=\'/dev/ttys003\' (shell: /bin/zsh, cwd: /tmp, arch: arm64, platform: darwin 25.0.0). If this persists, please file an issue.'
+      'Failed to spawn shell "/bin/zsh": node-pty: open_slave failed: EMFILE (errno 24, Too many open files) - slave=\'/dev/ttys003\' (shell: /bin/zsh, cwd: /tmp, arch: arm64, platform: darwin 25.0.0, orca: 1.4.178). If this persists, please file an issue.'
 
     expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT} ${message}`)
   })
diff --git a/src/main/daemon/production-launcher.test.ts b/src/main/daemon/production-launcher.test.ts
deleted file mode 100644
index 4404c5c2c99..00000000000
--- a/src/main/daemon/production-launcher.test.ts
+++ /dev/null
@@ -1,444 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
-import { createProductionLauncher } from './production-launcher'
-import { startDaemon, type DaemonHandle } from './daemon-main'
-import { DaemonClient } from './client'
-import type { SubprocessHandle } from './session'
-import { getDaemonSocketPath } from './daemon-spawner'
-
-const { forkMock } = vi.hoisted(() => ({
-  forkMock: vi.fn()
-}))
-
-vi.mock('child_process', async () => {
-  const actual = await vi.importActual<Record<string, unknown>>('child_process')
-  return { ...actual, fork: forkMock }
-})
-
-function createTestDir(): string {
-  return mkdtempSync(join(tmpdir(), 'prod-launcher-test-'))
-}
-
-function createMockSubprocess(): SubprocessHandle {
-  let onExitCb: ((code: number) => void) | null = null
-  return {
-    pid: 44444,
-    getForegroundProcess: vi.fn(() => null),
-    write: vi.fn(),
-    resize: vi.fn(),
-    kill: vi.fn(() => setTimeout(() => onExitCb?.(0), 5)),
-    forceKill: vi.fn(),
-    signal: vi.fn(),
-    onData(_cb: (data: string) => void) {},
-    onExit(cb: (code: number) => void) {
-      onExitCb = cb
-    },
-    dispose: vi.fn()
-  }
-}
-
-describe('createProductionLauncher', () => {
-  let dir: string
-  let handles: DaemonHandle[]
-
-  beforeEach(() => {
-    dir = createTestDir()
-    handles = []
-  })
-
-  afterEach(async () => {
-    for (const h of handles) {
-      await h.shutdown().catch(() => {})
-    }
-    forkMock.mockReset()
-    rmSync(dir, { recursive: true, force: true })
-  })
-
-  it('returns a launcher function', () => {
-    const launcher = createProductionLauncher({
-      getDaemonEntryPath: () => '/fake/path.js',
-      getAppVersion: () => '1.2.3'
-    })
-    expect(typeof launcher).toBe('function')
-  })
-
-  it('rejects either ownership argument without its pair before forking', async () => {
-    const launcher = createProductionLauncher({
-      getDaemonEntryPath: () => '/fake/path.js',
-      getAppVersion: () => '1.2.3'
-    })
-
-    await expect(
-      launcher(socketPathFor(dir), tokenPathFor(dir), join(dir, 'daemon.pid'))
-    ).rejects.toThrow('provided together')
-    await expect(
-      launcher(socketPathFor(dir), tokenPathFor(dir), undefined, 'launch-a')
-    ).rejects.toThrow('provided together')
-    expect(forkMock).not.toHaveBeenCalled()
-  })
-
-  it('can be used with DaemonSpawner (in-process fallback)', async () => {
-    // Use in-process launcher for testing (same as DaemonSpawner tests)
-    const launcher = async (socketPath: string, tokenPath: string) => {
-      const handle = await startDaemon({
-        socketPath,
-        tokenPath,
-        spawnSubprocess: () => createMockSubprocess()
-      })
-      handles.push(handle)
-      return { shutdown: () => handle.shutdown() }
-    }
-
-    const socketPath = getDaemonSocketPath(dir)
-    const tokenPath = join(dir, 'test.token')
-    const handle = await launcher(socketPath, tokenPath)
-
-    const client = new DaemonClient({ socketPath, tokenPath })
-    await client.ensureConnected()
-    expect(client.isConnected()).toBe(true)
-    client.disconnect()
-
-    await handle.shutdown()
-    handles.pop()
-  })
-
-  it('removes startup child listeners after readiness', async () => {
-    const handlers: Record<string, ((arg?: unknown) => void)[]> = {
-      message: [],
-      error: [],
-      exit: []
-    }
-    const child = {
-      pid: 12345,
-      killed: false,
-      on: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-        handlers[event]?.push(cb)
-        return child
-      }),
-      off: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-        handlers[event] = handlers[event]?.filter((handler) => handler !== cb) ?? []
-        return child
-      }),
-      kill: vi.fn(),
-      disconnect: vi.fn(),
-      unref: vi.fn()
-    }
-    forkMock.mockReturnValueOnce(child)
-
-    const launcher = createProductionLauncher({
-      getDaemonEntryPath: () => join(dir, 'daemon-entry.js'),
-      getAppVersion: () => '1.2.3'
-    })
-
-    const pidPath = join(dir, 'daemon.pid')
-    const launch = launcher(socketPathFor(dir), tokenPathFor(dir), pidPath, 'launch-a')
-    handlers.message[0]?.({
-      type: 'ready',
-      startedAtMs: 123_456,
-      linuxStartTicks: '4242',
-      bootId: 'boot-a'
-    })
-    const handle = await launch
-
-    expect(handle.shutdown).toEqual(expect.any(Function))
-    expect(handlers.message).toHaveLength(0)
-    expect(handlers.error).toHaveLength(0)
-    expect(handlers.exit).toHaveLength(0)
-    expect(child.disconnect).toHaveBeenCalled()
-    expect(child.unref).toHaveBeenCalled()
-    expect(forkMock).toHaveBeenCalledWith(
-      join(dir, 'daemon-entry.js'),
-      expect.arrayContaining([
-        '--pid-record',
-        pidPath,
-        '--launch-nonce',
-        'launch-a',
-        '--entry-path',
-        join(dir, 'daemon-entry.js'),
-        '--app-version',
-        '1.2.3'
-      ]),
-      expect.objectContaining({ stdio: ['ignore', 'ignore', 'ignore', 'ipc'] })
-    )
-  })
-
-  it('resolves shutdown only after observing child exit', async () => {
-    const handlers: Record<string, ((arg?: unknown) => void)[]> = {
-      message: [],
-      error: [],
-      exit: []
-    }
-    const child = {
-      pid: 12345,
-      connected: true,
-      exitCode: null as number | null,
-      signalCode: null as NodeJS.Signals | null,
-      on: vi.fn((event: string, callback: (arg?: unknown) => void) => {
-        handlers[event]?.push(callback)
-        return child
-      }),
-      once: vi.fn((event: string, callback: (arg?: unknown) => void) => {
-        handlers[event]?.push(callback)
-        return child
-      }),
-      off: vi.fn((event: string, callback: (arg?: unknown) => void) => {
-        handlers[event] = handlers[event]?.filter((handler) => handler !== callback) ?? []
-        return child
-      }),
-      kill: vi.fn((signal: NodeJS.Signals) => {
-        if (signal === 'SIGTERM') {
-          queueMicrotask(() => {
-            child.exitCode = 0
-            for (const callback of handlers.exit.slice()) {
-              callback(0)
-            }
-          })
-        }
-        return true
-      }),
-      disconnect: vi.fn(() => {
-        child.connected = false
-      }),
-      unref: vi.fn()
-    }
-    forkMock.mockReturnValueOnce(child)
-    const launcher = createProductionLauncher({
-      getDaemonEntryPath: () => join(dir, 'daemon-entry.js'),
-      getAppVersion: () => '1.2.3'
-    })
-    const pidPath = join(dir, 'daemon.pid')
-    writeFileSync(pidPath, JSON.stringify({ pid: 12345, launchNonce: 'launch-shutdown' }))
-    const launch = launcher(socketPathFor(dir), tokenPathFor(dir), pidPath, 'launch-shutdown')
-    handlers.message[0]?.({ type: 'ready', startedAtMs: 123_456 })
-    const handle = await launch
-
-    await expect(handle.shutdown()).resolves.toBeUndefined()
-
-    expect(child.kill).toHaveBeenCalledWith('SIGTERM')
-    expect(child.exitCode).toBe(0)
-    expect(existsSync(pidPath)).toBe(false)
-  })
-
-  it('rejects shutdown and releases child handles when SIGKILL never produces exit', async () => {
-    vi.useFakeTimers()
-    try {
-      const handlers: Record<string, ((arg?: unknown) => void)[]> = {
-        message: [],
-        error: [],
-        exit: []
-      }
-      const child = {
-        pid: 12345,
-        killed: false,
-        connected: false,
-        exitCode: null,
-        signalCode: null,
-        on: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-          handlers[event]?.push(cb)
-          return child
-        }),
-        once: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-          handlers[event]?.push(cb)
-          return child
-        }),
-        off: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-          handlers[event] = handlers[event]?.filter((handler) => handler !== cb) ?? []
-          return child
-        }),
-        kill: vi.fn(() => true),
-        disconnect: vi.fn(() => {
-          child.connected = false
-        }),
-        unref: vi.fn()
-      }
-      forkMock.mockReturnValueOnce(child)
-
-      const launcher = createProductionLauncher({
-        getDaemonEntryPath: () => join(dir, 'daemon-entry.js'),
-        getAppVersion: () => '1.2.3'
-      })
-
-      const launch = launcher(socketPathFor(dir), tokenPathFor(dir))
-      handlers.message[0]?.({ type: 'ready', startedAtMs: 123_456 })
-      const handle = await launch
-
-      const shutdown = expect(handle.shutdown()).rejects.toThrow(
-        'Daemon did not exit after SIGKILL'
-      )
-      expect(handlers.exit).toHaveLength(1)
-
-      await vi.advanceTimersByTimeAsync(6000)
-      await shutdown
-
-      expect(child.kill).toHaveBeenNthCalledWith(1, 'SIGTERM')
-      expect(child.kill).toHaveBeenNthCalledWith(2, 'SIGKILL')
-      expect(handlers.exit).toHaveLength(0)
-      expect(child.unref).toHaveBeenCalledTimes(2)
-    } finally {
-      vi.useRealTimers()
-    }
-  })
-
-  it('preserves readiness and signaling failures while releasing startup IPC', async () => {
-    vi.useFakeTimers()
-    try {
-      const handlers: Record<string, ((arg?: unknown) => void)[]> = {
-        message: [],
-        error: [],
-        exit: []
-      }
-      const signalError = Object.assign(new Error('permission denied'), { code: 'EACCES' })
-      const child = {
-        pid: 12345,
-        connected: true,
-        exitCode: null,
-        signalCode: null,
-        on: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-          handlers[event]?.push(cb)
-          return child
-        }),
-        once: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-          handlers[event]?.push(cb)
-          return child
-        }),
-        off: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-          handlers[event] = handlers[event]?.filter((handler) => handler !== cb) ?? []
-          return child
-        }),
-        kill: vi.fn(() => {
-          throw signalError
-        }),
-        disconnect: vi.fn(() => {
-          child.connected = false
-        }),
-        unref: vi.fn()
-      }
-      forkMock.mockReturnValueOnce(child)
-
-      const launcher = createProductionLauncher({
-        getDaemonEntryPath: () => join(dir, 'daemon-entry.js'),
-        getAppVersion: () => '1.2.3'
-      })
-      const launch = launcher(socketPathFor(dir), tokenPathFor(dir))
-      handlers.message[0]?.({ type: 'ready' })
-
-      const error = await launch.catch((caught: unknown) => caught)
-      expect(error).toBeInstanceOf(AggregateError)
-      expect((error as AggregateError).errors).toEqual([
-        expect.objectContaining({ message: 'Daemon readiness identity is incomplete' }),
-        signalError
-      ])
-      expect(child.disconnect).toHaveBeenCalledOnce()
-      expect(child.unref).toHaveBeenCalledOnce()
-      expect(handlers.message).toHaveLength(0)
-      expect(handlers.error).toHaveLength(0)
-      expect(handlers.exit).toHaveLength(0)
-    } finally {
-      vi.useRealTimers()
-    }
-  })
-
-  it('preserves exact PID ownership when child exit cannot be confirmed', async () => {
-    const handlers: Record<string, ((arg?: unknown) => void)[]> = {
-      message: [],
-      error: [],
-      exit: []
-    }
-    const signalError = Object.assign(new Error('signal blocked'), { code: 'EPERM' })
-    const child = {
-      pid: 12345,
-      connected: true,
-      exitCode: null,
-      signalCode: null,
-      on: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-        handlers[event]?.push(cb)
-        return child
-      }),
-      once: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-        handlers[event]?.push(cb)
-        return child
-      }),
-      off: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-        handlers[event] = handlers[event]?.filter((handler) => handler !== cb) ?? []
-        return child
-      }),
-      kill: vi.fn(() => {
-        throw signalError
-      }),
-      disconnect: vi.fn(() => {
-        child.connected = false
-      }),
-      unref: vi.fn()
-    }
-    forkMock.mockReturnValueOnce(child)
-    const launcher = createProductionLauncher({
-      getDaemonEntryPath: () => join(dir, 'daemon-entry.js'),
-      getAppVersion: () => '1.2.3'
-    })
-    const pidPath = join(dir, 'daemon.pid')
-    writeFileSync(pidPath, JSON.stringify({ pid: 12345, launchNonce: 'launch-b' }))
-
-    const launch = launcher(socketPathFor(dir), tokenPathFor(dir), pidPath, 'launch-b')
-    handlers.message[0]?.({ type: 'ready' })
-
-    const error = await launch.catch((caught: unknown) => caught)
-    expect(error).toBeInstanceOf(AggregateError)
-    expect((error as AggregateError).errors).toEqual([
-      expect.objectContaining({ message: 'Daemon readiness identity is incomplete' }),
-      signalError
-    ])
-    expect(child.disconnect).toHaveBeenCalledOnce()
-    expect(child.unref).toHaveBeenCalledOnce()
-    expect(existsSync(pidPath)).toBe(true)
-  })
-
-  it('removes exact child-side PID ownership after a pre-ready exit', async () => {
-    const handlers: Record<string, ((arg?: unknown) => void)[]> = {
-      message: [],
-      error: [],
-      exit: []
-    }
-    const child = {
-      pid: 12345,
-      connected: true,
-      exitCode: null as number | null,
-      signalCode: null as NodeJS.Signals | null,
-      on: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-        handlers[event]?.push(cb)
-        return child
-      }),
-      off: vi.fn((event: string, cb: (arg?: unknown) => void) => {
-        handlers[event] = handlers[event]?.filter((handler) => handler !== cb) ?? []
-        return child
-      }),
-      disconnect: vi.fn(() => {
-        child.connected = false
-      }),
-      unref: vi.fn()
-    }
-    forkMock.mockReturnValueOnce(child)
-    const pidPath = join(dir, 'daemon.pid')
-    writeFileSync(pidPath, JSON.stringify({ pid: 12345, launchNonce: 'launch-c' }))
-    const launcher = createProductionLauncher({
-      getDaemonEntryPath: () => join(dir, 'daemon-entry.js'),
-      getAppVersion: () => '1.2.3'
-    })
-
-    const launch = launcher(socketPathFor(dir), tokenPathFor(dir), pidPath, 'launch-c')
-    child.exitCode = 1
-    handlers.exit[0]?.(1)
-
-    await expect(launch).rejects.toThrow('Daemon process exited prematurely with code 1')
-    expect(existsSync(pidPath)).toBe(false)
-  })
-})
-
-function socketPathFor(dir: string): string {
-  return join(dir, 'test.sock')
-}
-
-function tokenPathFor(dir: string): string {
-  return join(dir, 'test.token')
-}
diff --git a/src/main/daemon/production-launcher.ts b/src/main/daemon/production-launcher.ts
deleted file mode 100644
index 342ff6e94ba..00000000000
--- a/src/main/daemon/production-launcher.ts
+++ /dev/null
@@ -1,242 +0,0 @@
-import { fork, type ChildProcess } from 'node:child_process'
-import {
-  unlinkOwnedDaemonPidFile,
-  type DaemonLauncher,
-  type DaemonProcessHandle
-} from './daemon-spawner'
-import { parseDaemonReadyIdentity, type DaemonReadyIdentity } from './daemon-ready-identity'
-
-const READY_TIMEOUT_MS = 10_000
-
-export type ProductionLauncherOptions = {
-  getDaemonEntryPath: () => string
-  getAppVersion: () => string
-}
-
-export function createProductionLauncher(opts: ProductionLauncherOptions): DaemonLauncher {
-  return async (
-    socketPath: string,
-    tokenPath: string,
-    pidPath?: string,
-    launchNonce?: string
-  ): Promise<DaemonProcessHandle> => {
-    if ((pidPath === undefined) !== (launchNonce === undefined)) {
-      // Why: partial ownership metadata would launch a v24 daemon that cannot
-      // prove which PID record it may remove during self-retirement.
-      throw new Error('Daemon PID path and launch nonce must be provided together')
-    }
-    const entryPath = opts.getDaemonEntryPath()
-
-    const appVersion = opts.getAppVersion()
-    const child = fork(
-      entryPath,
-      [
-        '--socket',
-        socketPath,
-        '--token',
-        tokenPath,
-        ...(pidPath && launchNonce
-          ? [
-              '--pid-record',
-              pidPath,
-              '--launch-nonce',
-              launchNonce,
-              '--entry-path',
-              entryPath,
-              '--app-version',
-              appVersion
-            ]
-          : [])
-      ],
-      {
-        // Why: detached daemon output is not consumed; ignored streams cannot
-        // keep Electron alive after the child and IPC channel are unreferenced.
-        stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
-        detached: true,
-        env: { ...process.env },
-        ...(process.platform === 'win32' ? { windowsHide: true } : {})
-      }
-    )
-
-    try {
-      await waitForReady(child)
-    } catch (error) {
-      return rejectAfterChildCleanup(child, error, pidPath, launchNonce)
-    }
-    if (!Number.isSafeInteger(child.pid) || (child.pid as number) <= 0) {
-      return rejectAfterChildCleanup(
-        child,
-        new Error('Daemon readiness identity is incomplete'),
-        pidPath,
-        launchNonce
-      )
-    }
-
-    // Unref so the Electron process can exit without waiting for the daemon
-    child.unref()
-    child.disconnect()
-
-    return {
-      shutdown: async () => {
-        await shutdownChild(child)
-        unlinkLaunchedDaemonPidFile(child, pidPath, launchNonce)
-      }
-    }
-  }
-}
-
-function waitForReady(child: ChildProcess): Promise<DaemonReadyIdentity> {
-  return new Promise((resolve, reject) => {
-    let timeout: ReturnType<typeof setTimeout> | undefined
-    let settled = false
-    function cleanupStartupListeners(): void {
-      if (timeout) {
-        clearTimeout(timeout)
-      }
-      child.off('message', onMessage)
-      child.off('error', onError)
-      child.off('exit', onExit)
-    }
-    function fail(error: Error): void {
-      if (settled) {
-        return
-      }
-      settled = true
-      cleanupStartupListeners()
-      reject(error)
-    }
-    function onMessage(msg: unknown): void {
-      if (msg && typeof msg === 'object' && (msg as Record<string, unknown>).type === 'ready') {
-        if (settled) {
-          return
-        }
-        const readyIdentity = parseDaemonReadyIdentity(msg)
-        if (!readyIdentity) {
-          fail(new Error('Daemon readiness identity is incomplete'))
-          return
-        }
-        settled = true
-        // Why: the daemon is detached after readiness, so startup listeners
-        // must not keep the child process closure alive for the daemon lifetime.
-        cleanupStartupListeners()
-        resolve(readyIdentity)
-      }
-    }
-    function onError(err: Error): void {
-      fail(new Error(`Daemon process error: ${err.message}`))
-    }
-    function onExit(code: number | null): void {
-      fail(new Error(`Daemon process exited prematurely with code ${code}`))
-    }
-
-    timeout = setTimeout(() => {
-      fail(new Error('Daemon failed to signal readiness within timeout'))
-    }, READY_TIMEOUT_MS)
-
-    child.on('message', onMessage)
-    child.on('error', onError)
-    child.on('exit', onExit)
-  })
-}
-
-async function shutdownChild(child: ChildProcess): Promise<void> {
-  try {
-    if (
-      (child.exitCode !== null && child.exitCode !== undefined) ||
-      (child.signalCode !== null && child.signalCode !== undefined)
-    ) {
-      return
-    }
-    await new Promise<void>((resolve, reject) => {
-      let settled = false
-      let timeout: ReturnType<typeof setTimeout>
-      let forceTimeout: ReturnType<typeof setTimeout> | undefined
-      function finish(error?: unknown): void {
-        if (settled) {
-          return
-        }
-        settled = true
-        clearTimeout(timeout)
-        if (forceTimeout) {
-          clearTimeout(forceTimeout)
-        }
-        child.off('exit', onExit)
-        if (error) {
-          reject(error)
-        } else {
-          resolve()
-        }
-      }
-
-      function onExit(): void {
-        finish()
-      }
-
-      timeout = setTimeout(() => {
-        try {
-          if (child.kill('SIGKILL') === false) {
-            finish(new Error('Failed to deliver SIGKILL to daemon'))
-            return
-          }
-        } catch (error) {
-          finish(isNoSuchProcessError(error) ? undefined : error)
-          return
-        }
-        // Why: signal delivery is not process exit; keep the listener for one
-        // bounded interval before releasing launcher-owned handles.
-        if (!settled) {
-          forceTimeout = setTimeout(
-            () => finish(new Error('Daemon did not exit after SIGKILL')),
-            1000
-          )
-        }
-      }, 5000)
-
-      child.once('exit', onExit)
-      try {
-        if (child.kill('SIGTERM') === false) {
-          finish(new Error('Failed to deliver SIGTERM to daemon'))
-        }
-      } catch (error) {
-        finish(isNoSuchProcessError(error) ? undefined : error)
-      }
-    })
-  } finally {
-    if (child.connected) {
-      child.disconnect()
-    }
-    child.unref()
-  }
-}
-
-async function rejectAfterChildCleanup(
-  child: ChildProcess,
-  launchError: unknown,
-  pidPath?: string,
-  launchNonce?: string
-): Promise<never> {
-  try {
-    await shutdownChild(child)
-  } catch (cleanupError) {
-    throw new AggregateError(
-      [launchError, cleanupError],
-      'Daemon launch and child cleanup both failed'
-    )
-  }
-  unlinkLaunchedDaemonPidFile(child, pidPath, launchNonce)
-  throw launchError
-}
-
-function unlinkLaunchedDaemonPidFile(
-  child: ChildProcess,
-  pidPath?: string,
-  launchNonce?: string
-): void {
-  if (pidPath && launchNonce && Number.isSafeInteger(child.pid) && (child.pid as number) > 0) {
-    unlinkOwnedDaemonPidFile(pidPath, child.pid as number, launchNonce)
-  }
-}
-
-function isNoSuchProcessError(error: unknown): boolean {
-  return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ESRCH'
-}
diff --git a/src/main/daemon/pty-subprocess.test.ts b/src/main/daemon/pty-subprocess.test.ts
index 9df17412c57..5322bd6294b 100644
--- a/src/main/daemon/pty-subprocess.test.ts
+++ b/src/main/daemon/pty-subprocess.test.ts
@@ -2613,6 +2613,8 @@ describe('createPtySubprocess', () => {
     spawnMock.mockImplementation(() => {
       throw new Error('File not found: ')
     })
+    const previousVersion = process.env.ORCA_APP_VERSION
+    process.env.ORCA_APP_VERSION = '1.4.178-test'
 
     try {
       expect(() =>
@@ -2623,9 +2625,14 @@ describe('createPtySubprocess', () => {
           shellOverride: 'not-a-real-shell.exe'
         })
       ).toThrow(
-        /Daemon failed to spawn shell "not-a-real-shell\.exe" with cwd ".+": File not found:/
+        /Daemon failed to spawn shell "not-a-real-shell\.exe" with cwd ".+": File not found:.*orca: 1\.4\.178-test/
       )
     } finally {
+      if (previousVersion === undefined) {
+        delete process.env.ORCA_APP_VERSION
+      } else {
+        process.env.ORCA_APP_VERSION = previousVersion
+      }
       if (platform) {
         Object.defineProperty(process, 'platform', platform)
       }
@@ -2958,36 +2965,39 @@ describe('createPtySubprocess', () => {
     expect(spawnCall[2].env.WSLENV ?? '').not.toContain(POWERLEVEL10K_WIZARD_DISABLE_ENV)
   })
 
-  it('keeps daemon WSL split panes in their distro when cwd is already POSIX', () => {
-    const proc = mockPtyProcess()
-    spawnMock.mockReturnValue(proc)
-    const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+  it.each(['/home/jin/repo/subdir', '/a', '/c'])(
+    'keeps daemon WSL split panes in their distro when cwd is POSIX (%s)',
+    (cwd) => {
+      const proc = mockPtyProcess()
+      spawnMock.mockReturnValue(proc)
+      const platform = Object.getOwnPropertyDescriptor(process, 'platform')
 
-    Object.defineProperty(process, 'platform', { value: 'win32' })
+      Object.defineProperty(process, 'platform', { value: 'win32' })
 
-    try {
-      createPtySubprocess({
-        sessionId: 'repo::\\\\wsl.localhost\\Ubuntu\\home\\jin\\repo@@deadbeef',
-        cols: 80,
-        rows: 24,
-        cwd: '/home/jin/repo/subdir',
-        shellOverride: 'wsl.exe'
-      })
-    } finally {
-      if (platform) {
-        Object.defineProperty(process, 'platform', platform)
+      try {
+        createPtySubprocess({
+          sessionId: 'repo::\\\\wsl.localhost\\Ubuntu\\home\\jin\\repo@@deadbeef',
+          cols: 80,
+          rows: 24,
+          cwd,
+          shellOverride: 'wsl.exe'
+        })
+      } finally {
+        if (platform) {
+          Object.defineProperty(process, 'platform', platform)
+        }
       }
-    }
 
-    expect(validateWorkingDirectoryMock).toHaveBeenCalledWith(
-      '\\\\wsl.localhost\\Ubuntu\\home\\jin\\repo\\subdir'
-    )
-    expect(spawnMock).toHaveBeenCalledWith(
-      'wsl.exe',
-      ['-d', 'Ubuntu', '--', 'sh', '-c', expect.stringContaining("cd '/home/jin/repo/subdir'")],
-      expect.objectContaining({ cwd: expect.any(String) })
-    )
-  })
+      expect(validateWorkingDirectoryMock).toHaveBeenCalledWith(
+        `\\\\wsl.localhost\\Ubuntu${cwd.replaceAll('/', '\\')}`
+      )
+      expect(spawnMock).toHaveBeenCalledWith(
+        'wsl.exe',
+        ['-d', 'Ubuntu', '--', 'sh', '-c', expect.stringContaining(`cd '${cwd}'`)],
+        expect.objectContaining({ cwd: expect.any(String) })
+      )
+    }
+  )
 
   // Why: node-pty's UnixTerminal.destroy() registers _socket.once('close', () =>
   // this.kill('SIGHUP')), and the socket 'close' event can fire concurrently
diff --git a/src/main/daemon/pty-subprocess.ts b/src/main/daemon/pty-subprocess.ts
index 6fe39f57fba..9b87da0c8d5 100644
--- a/src/main/daemon/pty-subprocess.ts
+++ b/src/main/daemon/pty-subprocess.ts
@@ -1,6 +1,7 @@
 /* eslint-disable max-lines -- Why: daemon PTY spawning must keep platform launch setup, preflight, and lifecycle guards in one execution path. */
 import * as pty from 'node-pty'
 import { statSync } from 'node:fs'
+import { release } from 'node:os'
 import { delimiter, win32 as pathWin32 } from 'node:path'
 import type { SubprocessHandle } from './session'
 import { DaemonProtocolError } from './types'
@@ -246,16 +247,25 @@ function removeInheritedElectronRunAsNode(env: Record<string, string>): void {
   delete env.ELECTRON_RUN_AS_NODE
 }
 
+function daemonEnvironmentDiagSuffix(): string {
+  const orca = process.env.ORCA_APP_VERSION?.trim() || '0.0.0-dev'
+  const systemVersion =
+    (process as NodeJS.Process & { getSystemVersion?: () => string }).getSystemVersion?.() ||
+    release()
+  const platform = `${process.platform} ${systemVersion}`
+  return ` (orca: ${orca}, arch: ${process.arch}, platform: ${platform})`
+}
+
 /**
  * Formats a daemon preflight failure with the same ENOENT details node-pty exposes.
  */
 function formatMissingDaemonPathError(kind: 'helper' | 'cwd', path: string): DaemonProtocolError {
   const detailName = kind === 'helper' ? 'helper' : 'cwd'
   const step = kind === 'helper' ? 'posix_spawn' : 'daemon_cwd'
+  const missingTarget = kind === 'helper' ? 'node-pty install' : 'working directory'
+  const diag = daemonEnvironmentDiagSuffix()
   return new DaemonProtocolError(
-    `Daemon's ${kind === 'helper' ? 'node-pty install' : 'working directory'} is gone ` +
-      `(worktree deleted?). Restart Orca. node-pty: ${step} failed: ENOENT ` +
-      `(errno 2, No such file or directory) - ${detailName}='${path}'`
+    `Daemon's ${missingTarget} is gone (worktree deleted?). Restart Orca. node-pty: ${step} failed: ENOENT (errno 2, No such file or directory) - ${detailName}='${path}'${diag}`
   )
 }
 
@@ -399,8 +409,9 @@ function preflightPosixPtySpawnEnvironment(validationCwd: string): void {
  */
 function formatPtySpawnError(err: unknown, shellPath: string, spawnCwd: string): Error {
   const message = err instanceof Error ? err.message : String(err)
+  const diag = daemonEnvironmentDiagSuffix()
   const formatted = new DaemonProtocolError(
-    `Daemon failed to spawn shell "${shellPath}" with cwd "${spawnCwd}": ${message}`
+    `Daemon failed to spawn shell "${shellPath}" with cwd "${spawnCwd}": ${message}${diag}`
   )
   if (err instanceof Error && err.stack) {
     formatted.stack = err.stack
@@ -1051,6 +1062,8 @@ export function createPtySubprocess(opts: PtySubprocessOptions): SubprocessHandl
   return {
     pid: proc.pid,
     shellPath,
+    shellCwd: spawnCwd,
+    shellPathEnv: env.PATH,
     ...(slavePath ? { slavePath } : {}),
     ...(startupCommandDeliveredInShellArgs ? { startupCommandDeliveredInShellArgs: true } : {}),
     getForegroundProcess: () => {
diff --git a/src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts b/src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts
new file mode 100644
index 00000000000..74907d84406
--- /dev/null
+++ b/src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts
@@ -0,0 +1,419 @@
+import { spawnSync } from 'node:child_process'
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { createPtySubprocess } from './pty-subprocess'
+import { Session } from './session'
+
+const describePosix = process.platform === 'win32' ? describe.skip : describe
+const hasZsh = process.platform !== 'win32' && spawnSync('/bin/zsh', ['--version']).status === 0
+const hasBash = process.platform !== 'win32' && spawnSync('/bin/bash', ['--version']).status === 0
+const COMMAND_OUTPUT = 'ORCA_STARTUP_COMMAND_RAN'
+const READ_STARTED_FILE = '.orca-read-started'
+
+type ShellFixture = {
+  name: string
+  shellPath: string
+  startupFile: string
+  replacement: string
+  command: string
+  instrumentationOutput: string
+  secretRead: string
+  childRead: string
+}
+
+const FIXTURES: ShellFixture[] = [
+  {
+    name: 'zsh profile',
+    shellPath: '/bin/zsh',
+    startupFile: '.zprofile',
+    replacement: 'exec -a kiro-cli-term /bin/zsh -o noglobalrcs -l -i',
+    command: `printf 'ORCA_STARTUP_%s:PF=%s\\n' COMMAND_RAN "\${(j:,:)precmd_functions}"\r`,
+    instrumentationOutput: `${COMMAND_OUTPUT}:PF=`,
+    secretRead: `: > "$HOME/${READ_STARTED_FILE}"; read -sk 1\n`,
+    childRead: `/bin/zsh -fc ': > "$HOME/${READ_STARTED_FILE}"; read -sk 1'\n`
+  },
+  {
+    name: 'zsh environment',
+    shellPath: '/bin/zsh',
+    startupFile: '.zshenv',
+    replacement: 'exec /bin/zsh -o noglobalrcs -l -i',
+    command: `printf 'ORCA_STARTUP_%s:PF=%s\\n' COMMAND_RAN "\${(j:,:)precmd_functions}"\r`,
+    instrumentationOutput: `${COMMAND_OUTPUT}:PF=`,
+    secretRead: `: > "$HOME/${READ_STARTED_FILE}"; read -sk 1\n`,
+    childRead: `/bin/zsh -fc ': > "$HOME/${READ_STARTED_FILE}"; read -sk 1'\n`
+  },
+  {
+    name: 'bash profile',
+    shellPath: '/bin/bash',
+    startupFile: '.bash_profile',
+    replacement: 'exec -a figterm-test /bin/bash --noprofile --norc -l -i',
+    command: `printf 'ORCA_STARTUP_%s:PC=%s\\n' COMMAND_RAN "$PROMPT_COMMAND"\r`,
+    instrumentationOutput: `${COMMAND_OUTPUT}:PC=`,
+    secretRead: `: > "$HOME/${READ_STARTED_FILE}"; read -s -n 1\n`,
+    childRead: `/bin/bash --noprofile --norc -c ': > "$HOME/${READ_STARTED_FILE}"; read -s -n 1'\n`
+  }
+]
+
+function count(text: string, needle: string): number {
+  return text.split(needle).length - 1
+}
+
+function waitForOutput(
+  subscribe: (settle: () => void) => void,
+  isDone: () => boolean,
+  timeoutMs = 5_000
+): Promise<void> {
+  if (isDone()) {
+    return Promise.resolve()
+  }
+  return new Promise<void>((resolve, reject) => {
+    const deadline = setTimeout(
+      () => reject(new Error('Timed out waiting for PTY output')),
+      timeoutMs
+    )
+    const settle = (): void => {
+      if (!isDone()) {
+        return
+      }
+      clearTimeout(deadline)
+      resolve()
+    }
+    subscribe(settle)
+    settle()
+  })
+}
+
+function waitForCondition(isDone: () => boolean, timeoutMs = 5_000): Promise<void> {
+  return new Promise<void>((resolve, reject) => {
+    const interval = setInterval(() => {
+      if (!isDone()) {
+        return
+      }
+      clearInterval(interval)
+      clearTimeout(deadline)
+      resolve()
+    }, 10)
+    const deadline = setTimeout(() => {
+      clearInterval(interval)
+      reject(new Error('Timed out waiting for fixture state'))
+    }, timeoutMs)
+  })
+}
+
+function runCleanupActions(...actions: (() => void)[]): void {
+  for (const action of actions) {
+    try {
+      action()
+    } catch {}
+  }
+}
+
+type RunningFixture = {
+  session: Session
+  subprocess: ReturnType<typeof createPtySubprocess>
+  output: () => string
+  readStarted: () => boolean
+  subscribe: (settle: () => void) => void
+  cleanup: () => Promise<void>
+}
+
+function startFixture(
+  fixture: ShellFixture,
+  startupContent: string,
+  extraFiles: Record<string, string> = {}
+): RunningFixture {
+  const tempHome = mkdtempSync(join(tmpdir(), 'orca-shell-ready-exec-'))
+  const previousHome = process.env.HOME
+  const previousZdotdir = process.env.ZDOTDIR
+  const previousOrigZdotdir = process.env.ORCA_ORIG_ZDOTDIR
+  let subprocess: ReturnType<typeof createPtySubprocess> | undefined
+  let session: Session | undefined
+  let consoleWarnSpy: { mockRestore: () => void } | undefined
+  try {
+    writeFileSync(join(tempHome, fixture.startupFile), startupContent)
+    for (const [fileName, content] of Object.entries(extraFiles)) {
+      writeFileSync(join(tempHome, fileName), content)
+    }
+    process.env.HOME = tempHome
+    delete process.env.ZDOTDIR
+    delete process.env.ORCA_ORIG_ZDOTDIR
+    consoleWarnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    subprocess = createPtySubprocess({
+      sessionId: `repro-13767-${fixture.startupFile}`,
+      cols: 80,
+      rows: 24,
+      cwd: tempHome,
+      command: fixture.command,
+      shellOverride: fixture.shellPath,
+      env: {
+        HOME: tempHome,
+        PATH: process.env.PATH ?? '/usr/bin:/bin',
+        SHELL: fixture.shellPath,
+        TERM: 'xterm-256color'
+      },
+      envToDelete: ['ORCA_EXEC_REPRO_DONE', 'ORCA_ORIG_ZDOTDIR', 'ZDOTDIR']
+    })
+    session = new Session({
+      sessionId: `repro-13767-${fixture.startupFile}`,
+      cols: 80,
+      rows: 24,
+      subprocess,
+      shellReadySupported: true
+    })
+    let output = ''
+    let onOutput = (): void => {}
+    session.attachClient({
+      onData: (data) => {
+        output += data
+        onOutput()
+      },
+      onExit: () => {}
+    })
+    session.write(fixture.command)
+    const runningSubprocess = subprocess
+    const runningSession = session
+    const activeConsoleWarnSpy = consoleWarnSpy
+
+    return {
+      session: runningSession,
+      subprocess: runningSubprocess,
+      output: () => output,
+      readStarted: () => existsSync(join(tempHome, READ_STARTED_FILE)),
+      subscribe: (settle) => {
+        onOutput = settle
+      },
+      cleanup: async () => {
+        if (runningSession.isAlive) {
+          try {
+            await runningSession.forceKillAndWaitForExit(3_000)
+          } catch {
+            runCleanupActions(() => runningSubprocess.forceKill())
+          }
+        }
+        runCleanupActions(
+          () => runningSession.dispose(),
+          () => activeConsoleWarnSpy.mockRestore(),
+          () => restoreEnvironment(previousHome, previousZdotdir, previousOrigZdotdir),
+          () => rmSync(tempHome, { recursive: true, force: true })
+        )
+      }
+    }
+  } catch (error) {
+    runCleanupActions(
+      () => subprocess?.forceKill(),
+      () => session?.dispose(),
+      () => !session && subprocess?.dispose(),
+      () => consoleWarnSpy?.mockRestore(),
+      () => restoreEnvironment(previousHome, previousZdotdir, previousOrigZdotdir),
+      () => rmSync(tempHome, { recursive: true, force: true })
+    )
+    throw error
+  }
+}
+
+function restoreEnvironment(
+  home: string | undefined,
+  zdotdir: string | undefined,
+  originalZdotdir: string | undefined
+): void {
+  setEnvironmentValue('HOME', home)
+  setEnvironmentValue('ZDOTDIR', zdotdir)
+  setEnvironmentValue('ORCA_ORIG_ZDOTDIR', originalZdotdir)
+}
+
+function setEnvironmentValue(key: string, value: string | undefined): void {
+  if (value === undefined) {
+    delete process.env[key]
+  } else {
+    process.env[key] = value
+  }
+}
+
+async function runExecOracle(fixture: ShellFixture): Promise<void> {
+  const running = startFixture(
+    fixture,
+    `if [[ -z "\${ORCA_EXEC_REPRO_DONE:-}" ]]; then
+  export ORCA_EXEC_REPRO_DONE=1
+  ${fixture.replacement}
+fi
+`
+  )
+  try {
+    await waitForOutput(running.subscribe, () => running.output().includes(COMMAND_OUTPUT))
+    expect(running.session.shellState).toBe('ready')
+    expect(count(running.output(), COMMAND_OUTPUT)).toBe(1)
+    expect(running.output()).toContain(fixture.instrumentationOutput)
+    expect(running.output()).not.toContain('orca-shell-start')
+  } finally {
+    await running.cleanup()
+  }
+}
+
+async function runReadOracle(fixture: ShellFixture, child: boolean): Promise<void> {
+  const running = startFixture(fixture, child ? fixture.childRead : fixture.secretRead)
+  try {
+    await waitForCondition(running.readStarted)
+    await new Promise((resolve) => setTimeout(resolve, 300))
+    expect(running.session.shellState).toBe('pending')
+    expect(running.output()).not.toContain(COMMAND_OUTPUT)
+
+    running.subprocess.write('x\r')
+    await waitForOutput(running.subscribe, () => running.output().includes(COMMAND_OUTPUT))
+    expect(count(running.output(), COMMAND_OUTPUT)).toBe(1)
+    expect(running.output()).not.toContain('orca-shell-start')
+  } finally {
+    await running.cleanup()
+  }
+}
+
+describePosix('#13767 shell-ready marker loss across exec', () => {
+  it('continues setup cleanup after force-kill failure', () => {
+    const dispose = vi.fn()
+    const restore = vi.fn()
+    runCleanupActions(
+      () => {
+        throw new Error('force kill failed')
+      },
+      dispose,
+      restore
+    )
+    expect(dispose).toHaveBeenCalledOnce()
+    expect(restore).toHaveBeenCalledOnce()
+  })
+
+  for (const fixture of FIXTURES) {
+    const runnable = fixture.shellPath.endsWith('zsh') ? hasZsh : hasBash
+    const testCase = runnable ? it : it.skip
+    testCase(
+      `releases at the real ${fixture.name} prompt after exec`,
+      () => runExecOracle(fixture),
+      10_000
+    )
+    testCase(
+      `keeps queued input out of a real ${fixture.name} silent read`,
+      () => runReadOracle(fixture, false),
+      10_000
+    )
+    testCase(
+      `keeps queued input out of a child read during ${fixture.name} startup`,
+      () => runReadOracle(fixture, true),
+      10_000
+    )
+  }
+
+  const zshFixture = FIXTURES[0] as ShellFixture
+  const zshTest = hasZsh ? it : it.skip
+  zshTest(
+    'keeps queued input out of a zle-line-init read after exec',
+    async () => {
+      const running = startFixture(
+        zshFixture,
+        `if [[ -z "\${ORCA_EXEC_REPRO_DONE:-}" ]]; then
+  export ORCA_EXEC_REPRO_DONE=1
+  exec env ZDOTDIR="$HOME" /bin/zsh -o noglobalrcs -l -i
+fi
+`,
+        {
+          '.zshrc': `zle-line-init() {
+  print -n 'HOOK_SECRET> '
+  read -sk 1
+  print -r -- HOOK_DONE
+}
+zle -N zle-line-init
+`
+        }
+      )
+      try {
+        try {
+          await waitForOutput(running.subscribe, () => running.output().includes('HOOK_SECRET> '))
+        } catch (error) {
+          throw new Error(`ZLE hook startup output: ${JSON.stringify(running.output())}`, {
+            cause: error
+          })
+        }
+        await new Promise((resolve) => setTimeout(resolve, 300))
+        expect(running.session.shellState).toBe('pending')
+        expect(running.output()).not.toContain(COMMAND_OUTPUT)
+
+        running.subprocess.write('x')
+        try {
+          await waitForOutput(running.subscribe, () => running.output().includes(COMMAND_OUTPUT))
+        } catch (error) {
+          throw new Error(`ZLE hook output: ${JSON.stringify(running.output())}`, { cause: error })
+        }
+        expect(running.output()).toContain('HOOK_DONE')
+        expect(count(running.output(), COMMAND_OUTPUT)).toBe(1)
+      } finally {
+        await running.cleanup()
+      }
+    },
+    10_000
+  )
+
+  const sqliteTest = hasZsh && existsSync('/usr/bin/sqlite3') ? it : it.skip
+  sqliteTest(
+    'does not treat an exec-replaced readline program as the shell prompt',
+    async () => {
+      const running = startFixture(zshFixture, 'exec /usr/bin/sqlite3\n')
+      try {
+        await waitForOutput(running.subscribe, () => running.output().includes('sqlite> '))
+        await new Promise((resolve) => setTimeout(resolve, 300))
+        expect(running.session.shellState).toBe('pending')
+        expect(running.output()).not.toContain(COMMAND_OUTPUT)
+      } finally {
+        await running.cleanup()
+      }
+    },
+    10_000
+  )
+
+  sqliteTest(
+    'does not trust a non-shell executable renamed to the shell basename',
+    async () => {
+      const running = startFixture(
+        zshFixture,
+        'ln -s /usr/bin/sqlite3 "$HOME/zsh" && exec "$HOME/zsh"\n'
+      )
+      try {
+        await waitForOutput(running.subscribe, () => running.output().includes('sqlite> '))
+        await new Promise((resolve) => setTimeout(resolve, 300))
+        expect(running.session.shellState).toBe('pending')
+        expect(running.output()).not.toContain(COMMAND_OUTPUT)
+      } finally {
+        await running.cleanup()
+      }
+    },
+    10_000
+  )
+
+  zshTest(
+    'retains the timeout backstop when zsh disables bracketed paste',
+    async () => {
+      const running = startFixture(
+        zshFixture,
+        `if [[ -z "\${ORCA_EXEC_REPRO_DONE:-}" ]]; then
+  export ORCA_EXEC_REPRO_DONE=1
+  exec env ZDOTDIR="$HOME" /bin/zsh -o noglobalrcs -l -i
+fi
+`,
+        {
+          '.zshrc': "zmodload zsh/zle\nunset zle_bracketed_paste\nPS1='NO_BRACKET_PROMPT> '\n"
+        }
+      )
+      try {
+        await waitForOutput(running.subscribe, () =>
+          running.output().includes('NO_BRACKET_PROMPT> ')
+        )
+        await new Promise((resolve) => setTimeout(resolve, 300))
+        expect(running.session.shellState).toBe('pending')
+        expect(running.output()).not.toContain(COMMAND_OUTPUT)
+      } finally {
+        await running.cleanup()
+      }
+    },
+    10_000
+  )
+})
diff --git a/src/main/daemon/session.ts b/src/main/daemon/session.ts
index f24a6a7fcc9..377f0fee184 100644
--- a/src/main/daemon/session.ts
+++ b/src/main/daemon/session.ts
@@ -13,6 +13,16 @@ import {
   scanForShellReady,
   type ShellReadyScanState
 } from '../shell-ready-marker-scanner'
+import {
+  createShellStartupIdentityScanState,
+  drainShellStartupIdentityHeldBytes,
+  scanForShellStartupIdentity,
+  type ShellStartupIdentityScanState
+} from '../shell-startup-identity-scanner'
+import {
+  createShellPromptReadinessProbe,
+  type ShellPromptReadinessProbe
+} from '../shell-prompt-readiness-probe'
 import { isPowerShellProcess } from '../../shared/shell-process-detection'
 import { killWithDescendantSweep } from '../pty-descendant-termination'
 import type { TuiAgent } from '../../shared/types'
@@ -60,6 +70,8 @@ export type SubprocessHandle = {
   /** Shell the subprocess actually spawned, after fallbacks. The host reconciles the caller's shell-ready
    *  assumption against it so a fallback shell without a ready marker never gates startup commands. */
   shellPath?: string
+  shellCwd?: string
+  shellPathEnv?: string
   /** Slave device path, so startup replies can read the line discipline's ECHO bit before
    *  writing. Absent on handles with no POSIX slave to read (ConPTY, tests). */
   slavePath?: string
@@ -125,6 +137,9 @@ export class Session {
   private releaseStartupDeviceAttributesResponder: (() => void) | null = null
   private startupDeviceAttributesQueryFilter: StartupDeviceAttributesQueryFilter | null = null
   private shellReadyScanState: ShellReadyScanState | null = null
+  private shellStartupIdentityScanState: ShellStartupIdentityScanState | null = null
+  private shellStartupPid: number | null = null
+  private shellPromptReadinessProbe: ShellPromptReadinessProbe | null = null
   private shellReadyTimer: ReturnType<typeof setTimeout> | null = null
   private killTimer: ReturnType<typeof setTimeout> | null = null
   private postReadyFlushGate: PostReadyFlushGate
@@ -170,6 +185,7 @@ export class Session {
     if (opts.shellReadySupported) {
       this._shellState = 'pending'
       this.shellReadyScanState = createShellReadyScanState()
+      this.shellStartupIdentityScanState = createShellStartupIdentityScanState()
       // Why: `write` queues everything until the ready marker, including the renderer's DA1
       // reply — and a shell that withholds its first prompt until DA1 is answered (fish) then
       // never emits the marker that would release it. Answer from the daemon, past the queue.
@@ -195,6 +211,16 @@ export class Session {
       onEmission: (emission) => this.emitSubprocessOutput(emission),
       ...(echoProbe ? { echoProbe } : {})
     })
+    if (this._shellState === 'pending') {
+      this.shellPromptReadinessProbe = createShellPromptReadinessProbe({
+        slavePath: this.subprocess.slavePath,
+        shellPath: this.subprocess.shellPath,
+        shellCwd: this.subprocess.shellCwd,
+        shellPathEnv: this.subprocess.shellPathEnv,
+        getShellPid: () => this.shellStartupPid,
+        onPromptReady: () => this.onShellPromptReady()
+      })
+    }
     this.subprocess.onData((data) => this.handleSubprocessData(data))
     this.subprocess.onExit((code) => this.handleSubprocessExit(code))
   }
@@ -603,6 +629,8 @@ export class Session {
       clearTimeout(this.shellReadyTimer)
       this.shellReadyTimer = null
     }
+    this.shellPromptReadinessProbe?.dispose()
+    this.shellPromptReadinessProbe = null
     this.shellReadyScanState = null
     this.preReadyStdinQueue = []
     this.postReadyFlushGate.clear()
@@ -649,6 +677,14 @@ export class Session {
     }
 
     let releaseStartupDeviceAttributes = false
+    if (this._shellState === 'pending' && this.shellStartupIdentityScanState) {
+      const scanned = scanForShellStartupIdentity(this.shellStartupIdentityScanState, data)
+      data = scanned.output
+      if (scanned.shellPid) {
+        this.shellStartupPid = scanned.shellPid
+        this.shellStartupIdentityScanState = null
+      }
+    }
     if (this._shellState === 'pending' && this.shellReadyScanState) {
       const scanned = scanForShellReady(this.shellReadyScanState, data)
       data = scanned.output
@@ -661,6 +697,9 @@ export class Session {
     }
 
     this.startupIngress.accept(data)
+    if (this._shellState === 'pending' && data.length > 0) {
+      this.shellPromptReadinessProbe?.notifyOutput(data)
+    }
     if (releaseStartupDeviceAttributes) {
       this.releaseStartupDeviceAttributes()
     }
@@ -696,6 +735,8 @@ export class Session {
     }
 
     this.releaseStartupDeviceAttributes()
+    this.shellPromptReadinessProbe?.dispose()
+    this.shellPromptReadinessProbe = null
     this.releaseHeldShellReadyBytes()
     this.startupIngress.drainAndClose()
     this._exitCode = code
@@ -727,10 +768,19 @@ export class Session {
   }
 
   private releaseHeldShellReadyBytes(): string {
-    if (!this.shellReadyScanState) {
+    if (!this.shellReadyScanState && !this.shellStartupIdentityScanState) {
       return ''
     }
-    const heldBytes = drainShellReadyHeldBytes(this.shellReadyScanState)
+    let heldBytes = this.shellStartupIdentityScanState
+      ? drainShellStartupIdentityHeldBytes(this.shellStartupIdentityScanState)
+      : ''
+    this.shellStartupIdentityScanState = null
+    if (this.shellReadyScanState && heldBytes) {
+      heldBytes = scanForShellReady(this.shellReadyScanState, heldBytes).output
+    }
+    if (this.shellReadyScanState) {
+      heldBytes += drainShellReadyHeldBytes(this.shellReadyScanState)
+    }
     this.shellReadyScanState = null
     // Why: scanning strips marker bytes before fan-out; if readiness never completes, release any held prefix before timeout/exit discards it.
     this.startupIngress.accept(heldBytes)
@@ -759,6 +809,9 @@ export class Session {
   private transitionToReady(postMarkerBytesObserved = false): void {
     this._shellState = 'ready'
     this.shellReadyScanState = null
+    this.shellStartupIdentityScanState = null
+    this.shellPromptReadinessProbe?.dispose()
+    this.shellPromptReadinessProbe = null
     if (this.shellReadyTimer) {
       clearTimeout(this.shellReadyTimer)
       this.shellReadyTimer = null
@@ -775,11 +828,25 @@ export class Session {
       return
     }
     this._shellState = 'timed_out'
+    this.shellPromptReadinessProbe?.dispose()
+    this.shellPromptReadinessProbe = null
     this.releaseStartupDeviceAttributes()
     this.releaseHeldShellReadyBytes()
     this.flushPreReadyQueue()
   }
 
+  private onShellPromptReady(): void {
+    if (this._shellState !== 'pending') {
+      return
+    }
+    console.warn(
+      `[Session] ${this.sessionId}: shell-ready wrapper was replaced before its marker; releasing at the identified shell prompt. OSC 133 integration may be unavailable.`
+    )
+    this.releaseHeldShellReadyBytes()
+    this.transitionToReady(true)
+    this.releaseStartupDeviceAttributes()
+  }
+
   private flushPreReadyQueue(): void {
     const queued = this.preReadyStdinQueue
     this.preReadyStdinQueue = []
diff --git a/src/main/daemon/shell-ready.test.ts b/src/main/daemon/shell-ready.test.ts
index 9610f2600d1..1739ba05c85 100644
--- a/src/main/daemon/shell-ready.test.ts
+++ b/src/main/daemon/shell-ready.test.ts
@@ -5,6 +5,7 @@ import { join } from 'node:path'
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import type * as ShellReadyModule from './shell-ready'
 import { getZshShellReadyMarkerRegistrationBlock } from '../shell-templates'
+import { fishRequirementViolation, resolveFishBinary } from '../../shared/fish-binary-requirement'
 
 async function importFreshShellReady(): Promise<typeof ShellReadyModule> {
   vi.resetModules()
@@ -16,8 +17,8 @@ const hasBash = process.platform !== 'win32' && spawnSync('bash', ['--version'])
 const itWithBash = hasBash ? it : it.skip
 const hasZsh = process.platform !== 'win32' && spawnSync('zsh', ['--version']).status === 0
 const itWithZsh = hasZsh ? it : it.skip
-const hasFish = process.platform !== 'win32' && spawnSync('fish', ['--version']).status === 0
-const itWithFish = hasFish ? it : it.skip
+const FISH = resolveFishBinary()
+const itWithFish = FISH.available ? it : it.skip
 
 const SHELL_READY_MARKER_OUTPUT = '\x1b]777;orca-shell-ready\x07'
 
@@ -166,6 +167,11 @@ function expectFinalZdotdirRestoreContext(content: string) {
 }
 
 describePosix('daemon shell-ready launch config', () => {
+  // Always runs, so the CI lane cannot report green with every live fish test skipped.
+  it('has the fish the live tests need when CI requires one', () => {
+    expect(fishRequirementViolation(FISH)).toBeNull()
+  })
+
   let previousUserDataPath: string | undefined
   let previousOrcaOrigZdotdir: string | undefined
   let userDataPath: string
@@ -456,6 +462,7 @@ describePosix('daemon shell-ready launch config', () => {
     const zshrc = readFileSync(join(userDataPath, 'shell-ready', 'zsh', '.zshrc'), 'utf8')
     const zlogin = readFileSync(join(userDataPath, 'shell-ready', 'zsh', '.zlogin'), 'utf8')
     expect(zshenv).toContain('_orca_user_zdotdir="${_orca_spawn_orig_zdotdir:-$HOME}"')
+    expect(zshenv).toContain('printf "\\033]777;orca-shell-start:%s\\007" "$$"')
     expect(zshenv).toContain('*/shell-ready/zsh) _orca_user_zdotdir="$HOME" ;;')
     expect(zshenv).toContain('""|*/shell-ready/zsh) export ORCA_ORIG_ZDOTDIR="$HOME" ;;')
     expectZdotdirSourceContext(zprofile, '.zprofile')
@@ -604,8 +611,6 @@ describePosix('daemon shell-ready launch config', () => {
       '[[ -n "${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="${ORCA_CODEX_HOME}"'
     const agentTeamsPathRestoreLine = '[[ -n "${ORCA_AGENT_TEAMS_SHIM_DIR:-}" ]] || return 0'
     const ompWrapperLine = 'command omp --extension "${ORCA_OMP_STATUS_EXTENSION}" "$@"'
-    const primeWrapperLine =
-      'command prime-agent --extension "${ORCA_PRIME_AGENT_STATUS_EXTENSION}" "$@"'
     expect(zshrc).toContain(restoreLine)
     expect(zlogin).toContain(restoreLine)
     expect(bashRc).toContain(restoreLine)
@@ -627,9 +632,12 @@ describePosix('daemon shell-ready launch config', () => {
     expect(zshrc).toContain(ompWrapperLine)
     expect(zlogin).toContain(ompWrapperLine)
     expect(bashRc).toContain(ompWrapperLine)
-    expect(zshrc).toContain(primeWrapperLine)
-    expect(zlogin).toContain(primeWrapperLine)
-    expect(bashRc).toContain(primeWrapperLine)
+    for (const wrapperFile of [zshrc, zlogin, bashRc]) {
+      expect(wrapperFile).not.toContain('prime-agent()')
+      expect(wrapperFile).not.toContain('__orca_prime_agent')
+      expect(wrapperFile).not.toContain('ORCA_PRIME_AGENT_STATUS_EXTENSION')
+      expect(wrapperFile).not.toContain('command prime-agent --extension')
+    }
   })
 
   // Why: regression guard for issue #2422 — bash wrapper must emit OSC 133 C/D so SSH sessions clear stale 'working' agent rows.
@@ -643,6 +651,7 @@ describePosix('daemon shell-ready launch config', () => {
     const bashRc = readFileSync(join(userDataPath, 'shell-ready', 'bash', 'rcfile'), 'utf8')
 
     expect(bashRc).toContain('printf "\\033]133;D;%s\\007"')
+    expect(bashRc).toContain('printf "\\033]777;orca-shell-start:%s\\007" "$$"')
     expect(bashRc).toContain('printf "\\033]133;C\\007"')
     // precmd is prepended (captures $? first), epilogue appended last, so a framework needing last position stays between them.
     expect(bashRc).toContain(
diff --git a/src/main/daemon/shell-ready.ts b/src/main/daemon/shell-ready.ts
index 27bcf6f48cb..2b1f27309f8 100644
--- a/src/main/daemon/shell-ready.ts
+++ b/src/main/daemon/shell-ready.ts
@@ -11,12 +11,12 @@ import {
   isPowerShellExecutableName
 } from '../powershell-osc133-bootstrap'
 import { getPosixOmpShellWrapper } from '../pty/omp-shell-wrapper'
-import { getPosixPrimeAgentShellWrapper } from '../pty/prime-agent-shell-wrapper'
 import {
   getFishShellReadyInitCommand,
   getZshEnvTemplate,
   getZshFinalZdotdirRestoreBlock,
   getZshShellReadyMarkerRegistrationBlock,
+  SHELL_STARTUP_IDENTITY_MARKER_BLOCK,
   getZshStartupFileSourceBlock
 } from '../shell-templates'
 
@@ -89,6 +89,7 @@ function shellReadyWrappersExist(): boolean {
 
 export function getDaemonBashShellReadyRcfileContent(): string {
   return `# Orca daemon bash shell-ready wrapper
+${SHELL_STARTUP_IDENTITY_MARKER_BLOCK}
 [[ -f /etc/profile ]] && source /etc/profile
 if [[ -f "$HOME/.bash_profile" ]]; then
   source "$HOME/.bash_profile"
@@ -123,7 +124,6 @@ __orca_restore_agent_teams_path
 [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
 [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
 ${getPosixOmpShellWrapper()}
-${getPosixPrimeAgentShellWrapper()}
 # Why: Codex must keep using Orca's runtime CODEX_HOME after profile scripts.
 [[ -n "\${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="\${ORCA_CODEX_HOME}"
 # Why: emit OSC 133 C/D so terminal-command-lifecycle can drop stale agent
@@ -245,7 +245,6 @@ if [[ ! -o login ]]; then
   [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
   [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
   ${getPosixOmpShellWrapper()}
-  ${getPosixPrimeAgentShellWrapper()}
   [[ -n "\${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="\${ORCA_CODEX_HOME}"
 fi
 __orca_osc133_precmd() {
@@ -309,7 +308,6 @@ __orca_restore_agent_teams_path
 [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
 [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
 ${getPosixOmpShellWrapper()}
-${getPosixPrimeAgentShellWrapper()}
 [[ -n "\${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="\${ORCA_CODEX_HOME}"
 ${getZshShellReadyMarkerRegistrationBlock(SHELL_READY_MARKER)}
 ${getZshFinalZdotdirRestoreBlock()}
@@ -388,7 +386,8 @@ function getWrappedShellLaunchConfig(
         ORCA_ORIG_ZDOTDIR: resolveOriginalZdotdir(),
         ORCA_ZSHENV_SOURCE_DIR: resolveOriginalZshenvSourceDir(),
         ZDOTDIR: join(root, 'zsh'),
-        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0'
+        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0',
+        ORCA_SHELL_STARTUP_IDENTITY: options.emitReadyMarker ? '1' : '0'
       },
       supportsReadyMarker: options.emitReadyMarker
     }
@@ -400,7 +399,8 @@ function getWrappedShellLaunchConfig(
     return {
       args: ['--rcfile', join(root, 'bash', 'rcfile')],
       env: {
-        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0'
+        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0',
+        ORCA_SHELL_STARTUP_IDENTITY: options.emitReadyMarker ? '1' : '0'
       },
       supportsReadyMarker: options.emitReadyMarker
     }
diff --git a/src/main/daemon/terminal-frame-restore-sequences.ts b/src/main/daemon/terminal-frame-restore-sequences.ts
new file mode 100644
index 00000000000..6d91771c4d2
--- /dev/null
+++ b/src/main/daemon/terminal-frame-restore-sequences.ts
@@ -0,0 +1,97 @@
+import type { Terminal } from '@xterm/headless'
+import type { SerializeAddon } from '@xterm/addon-serialize'
+import {
+  buildAbsoluteCursorRestoreSequence,
+  readSavedCursorRegister
+} from '../../shared/terminal-serialize-absolute-cursor'
+import type { SavedCursorRegister } from '../../shared/terminal-serialize-absolute-cursor'
+import type { TerminalModes } from './types'
+
+export function buildFrameRestoreSnapshotFields(
+  serializer: SerializeAddon,
+  terminal: Terminal,
+  modes: TerminalModes
+): { frameRestoreAnsi?: string } {
+  return modes.alternateScreen
+    ? {
+        frameRestoreAnsi: buildTerminalFrameRestoreSequences(
+          serializer,
+          terminal,
+          modes,
+          readSavedCursorRegister(terminal)
+        )
+      }
+    : {}
+}
+
+/** Restores live terminal state without replaying an alternate-screen frame. */
+function buildTerminalFrameRestoreSequences(
+  serializer: SerializeAddon,
+  terminal: Terminal,
+  modes: TerminalModes,
+  savedCursor: SavedCursorRegister | null
+): string {
+  const terminalModes = terminal.modes
+  const seqs: string[] = ['\x1b[0m\x1b[?1049h', serializeCurrentSgrState(serializer, terminal)]
+  if (terminalModes.applicationCursorKeysMode) {
+    seqs.push('\x1b[?1h')
+  }
+  if (terminalModes.applicationKeypadMode) {
+    seqs.push('\x1b[?66h')
+  }
+  if (terminalModes.bracketedPasteMode) {
+    seqs.push('\x1b[?2004h')
+  }
+  if (terminalModes.insertMode) {
+    seqs.push('\x1b[4h')
+  }
+  if (terminalModes.reverseWraparoundMode) {
+    seqs.push('\x1b[?45h')
+  }
+  if (terminalModes.sendFocusMode) {
+    seqs.push('\x1b[?1004h')
+  }
+  if (!terminalModes.wraparoundMode) {
+    seqs.push('\x1b[?7l')
+  }
+  switch (modes.mouseTracking ? (modes.mouseTrackingMode ?? 'vt200') : 'none') {
+    case 'x10':
+      seqs.push('\x1b[?9h')
+      break
+    case 'vt200':
+      seqs.push('\x1b[?1000h')
+      break
+    case 'drag':
+      seqs.push('\x1b[?1002h')
+      break
+    case 'any':
+      seqs.push('\x1b[?1003h')
+      break
+    case 'none':
+      break
+  }
+  if (modes.sgrMousePixelsMode) {
+    seqs.push('\x1b[?1016h')
+  } else if (modes.sgrMouseMode) {
+    seqs.push('\x1b[?1006h')
+  }
+  if (!terminalModes.showCursor) {
+    seqs.push('\x1b[?25l')
+  }
+  seqs.push(
+    buildAbsoluteCursorRestoreSequence(terminal, savedCursor, {
+      restoreModesWithoutCursor: true
+    })
+  )
+  return seqs.join('')
+}
+
+function serializeCurrentSgrState(serializer: SerializeAddon, terminal: Terminal): string {
+  // Unsupported addon behavior under our vendored patch: an out-of-range row emits only its authoritative pen-state diff.
+  const emptyRow = terminal.buffer.normal.length
+  return serializer.serialize({
+    range: { start: emptyRow, end: emptyRow },
+    excludeAltBuffer: true,
+    excludeModes: true
+  })
+}
diff --git a/src/main/daemon/terminal-session-teardown.ts b/src/main/daemon/terminal-session-teardown.ts
index 1ba58393721..352927a5dfd 100644
--- a/src/main/daemon/terminal-session-teardown.ts
+++ b/src/main/daemon/terminal-session-teardown.ts
@@ -39,9 +39,8 @@ export class TerminalSessionTeardown {
     }
     if (immediate) {
       return this.forceKillPlainShellSession(sessionId, session)
-    } else {
-      session.kill()
     }
+    session.kill()
   }
 
   /**
diff --git a/src/main/daemon/terminal-snapshot-serialize-roundtrip.test.ts b/src/main/daemon/terminal-snapshot-serialize-roundtrip.test.ts
index b54227652dd..f0927fcf379 100644
--- a/src/main/daemon/terminal-snapshot-serialize-roundtrip.test.ts
+++ b/src/main/daemon/terminal-snapshot-serialize-roundtrip.test.ts
@@ -70,6 +70,24 @@ async function roundTripStyles(source: string): Promise<Terminal> {
   return replay(addon.serialize())
 }
 
+describe('out-of-range SGR state serialization', () => {
+  it('emits only the live pen state for a row beyond the normal buffer', async () => {
+    const { terminal, addon } = createTerminal()
+    await write(terminal, '\x1b[31;44;1m')
+
+    // This deliberately pins unsupported SerializeAddon behavior used by
+    // terminal-frame-restore-sequences under Orca's vendored addon patch.
+    const outOfRangeRow = terminal.buffer.normal.length
+    expect(
+      addon.serialize({
+        range: { start: outOfRangeRow, end: outOfRangeRow },
+        excludeAltBuffer: true,
+        excludeModes: true
+      })
+    ).toBe('\x1b[31;44;1m')
+  })
+})
+
 describe('SGR intensity round-trip (BUG B, addon patch)', () => {
   it('restores bold set immediately after dim is cleared (minimized repro)', async () => {
     const restored = await roundTripStyles('\x1b[2mA\x1b[22m\x1b[1mB')
diff --git a/src/main/daemon/terminal-snapshot.ts b/src/main/daemon/terminal-snapshot.ts
index 653d8fc4bd6..6d378a8d107 100644
--- a/src/main/daemon/terminal-snapshot.ts
+++ b/src/main/daemon/terminal-snapshot.ts
@@ -9,6 +9,8 @@ export type TerminalSnapshot = {
   scrollbackAnsi: string
   oscLinks?: TerminalOscLinkRange[]
   rehydrateSequences: string
+  /** Live modes and cursor state that can be restored without the alt frame. */
+  frameRestoreAnsi?: string
   cwd: string | null
   modes: TerminalModes
   cols: number
diff --git a/src/main/daemon/terminal-view-attribute-responder.ts b/src/main/daemon/terminal-view-attribute-responder.ts
index ddd04bf11dc..decca3d3f99 100644
--- a/src/main/daemon/terminal-view-attribute-responder.ts
+++ b/src/main/daemon/terminal-view-attribute-responder.ts
@@ -57,7 +57,7 @@ function isValidColorIndex(value: number): boolean {
 function relativeLuminance([r, g, b]: TerminalViewRgb): number {
   const linear = (channel: number): number => {
     const c = channel / 255
-    return c <= 0.03928 ? c / 12.92 : Math.pow((c + 0.055) / 1.055, 2.4)
+    return c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4
   }
   return linear(r) * 0.2126 + linear(g) * 0.7152 + linear(b) * 0.0722
 }
diff --git a/src/main/daemon/types.ts b/src/main/daemon/types.ts
index 865572ea0b1..1f067885467 100644
--- a/src/main/daemon/types.ts
+++ b/src/main/daemon/types.ts
@@ -383,23 +383,6 @@ export type DaemonSessionInfo = SessionInfo & {
 // existing importers keep one types entry point.
 export * from './daemon-stream-events'
 
-// ─── Binary Frame Protocol (Daemon ↔ PTY Subprocess) ────────────────
-//
-// 5-byte header: [type:1][length:4 big-endian]
-// Followed by `length` bytes of payload.
-
-export const enum FrameType {
-  Data = 0x01,
-  Resize = 0x02,
-  Exit = 0x03,
-  Error = 0x04,
-  Kill = 0x05,
-  Signal = 0x06
-}
-
-export const FRAME_HEADER_SIZE = 5
-export const FRAME_MAX_PAYLOAD = 1024 * 1024 // 1MB
-
 // ─── Notify prefix ──────────────────────────────────────────────────
 // Requests with IDs starting with this prefix are fire-and-forget:
 // the daemon processes them but does not send a response.
diff --git a/src/main/daemon/xterm-env-polyfill.ts b/src/main/daemon/xterm-env-polyfill.ts
index 9ab12627299..27605b8fa9a 100644
--- a/src/main/daemon/xterm-env-polyfill.ts
+++ b/src/main/daemon/xterm-env-polyfill.ts
@@ -1,6 +1,6 @@
 // @xterm/headless checks for `window` to detect browser vs node environment.
 // In ELECTRON_RUN_AS_NODE mode, `window` is undefined. This polyfill must be
 // imported before any @xterm/headless import.
-if (typeof globalThis.window === 'undefined') {
+if (globalThis.window === undefined) {
   ;(globalThis as Record<string, unknown>).window = globalThis
 }
diff --git a/src/main/devin/hook-service.ts b/src/main/devin/hook-service.ts
index 82b00a71c3c..6cff0d2b824 100644
--- a/src/main/devin/hook-service.ts
+++ b/src/main/devin/hook-service.ts
@@ -5,6 +5,7 @@ import {
   writeHooksJson,
   writeManagedScript
 } from '../agent-hooks/installer-utils'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
 import {
   readTextFileRemote,
   writeHooksJsonRemote,
@@ -79,6 +80,10 @@ function getManagedScript(target: 'local' | 'posix' = 'local'): string {
 }
 
 export class DevinHookService {
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(getDevinManagedScriptPath(), getManagedScript())
+  }
+
   getStatus(): AgentHookInstallStatus {
     const configPath = getDevinConfigPath()
     const scriptPath = getDevinManagedScriptPath()
diff --git a/src/main/droid/hook-service.ts b/src/main/droid/hook-service.ts
index 508f24e98c8..fdef56a2401 100644
--- a/src/main/droid/hook-service.ts
+++ b/src/main/droid/hook-service.ts
@@ -16,6 +16,7 @@ import {
   type HookDefinition,
   type HooksConfig
 } from '../agent-hooks/installer-utils'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
 import {
   readHooksJsonRemote,
   writeHooksJsonRemote,
@@ -159,6 +160,10 @@ function buildInstalledDroidConfig(
 }
 
 export class DroidHookService {
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(getManagedScriptPath(), getManagedScript())
+  }
+
   getStatus(): AgentHookInstallStatus {
     const configPath = getConfigPath()
     const scriptPath = getManagedScriptPath()
diff --git a/src/main/emulator/android/adb-devices.ts b/src/main/emulator/android/adb-devices.ts
index 692bbb4d0fb..7264a825310 100644
--- a/src/main/emulator/android/adb-devices.ts
+++ b/src/main/emulator/android/adb-devices.ts
@@ -8,7 +8,7 @@ export type AndroidAdbDeviceState =
   | 'bootloader'
   | 'recovery'
   | 'no permissions'
-  | string
+  | (string & {})
 
 export type AndroidAdbDevice = {
   serial: string
diff --git a/src/main/emulator/android/scrcpy-control-protocol.test.ts b/src/main/emulator/android/scrcpy-control-protocol.test.ts
deleted file mode 100644
index 10e0e7a842a..00000000000
--- a/src/main/emulator/android/scrcpy-control-protocol.test.ts
+++ /dev/null
@@ -1,205 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  SCRCPY_CONTROL_MSG_TYPE,
-  encodeBackOrScreenOn,
-  encodeInjectKeycode,
-  encodeInjectText,
-  encodeInjectTouchEvent
-} from './scrcpy-control-protocol'
-
-describe('SCRCPY_CONTROL_MSG_TYPE', () => {
-  it('pins the v2.4 control message type codes', () => {
-    expect(SCRCPY_CONTROL_MSG_TYPE.INJECT_KEYCODE).toBe(0)
-    expect(SCRCPY_CONTROL_MSG_TYPE.INJECT_TEXT).toBe(1)
-    expect(SCRCPY_CONTROL_MSG_TYPE.INJECT_TOUCH_EVENT).toBe(2)
-    expect(SCRCPY_CONTROL_MSG_TYPE.INJECT_SCROLL_EVENT).toBe(3)
-    expect(SCRCPY_CONTROL_MSG_TYPE.BACK_OR_SCREEN_ON).toBe(4)
-  })
-})
-
-describe('encodeInjectTouchEvent', () => {
-  it('encodes a touch-down event with the full 32-byte field layout', () => {
-    const buf = encodeInjectTouchEvent({
-      action: 'down',
-      pointerId: 0x1122334455667788n,
-      x: 100,
-      y: 200,
-      screenWidth: 1080,
-      screenHeight: 1920
-    })
-
-    expect(buf.length).toBe(32)
-    expect(buf.readUInt8(0)).toBe(SCRCPY_CONTROL_MSG_TYPE.INJECT_TOUCH_EVENT)
-    expect(buf.readUInt8(0)).toBe(2)
-    expect(buf.readUInt8(1)).toBe(0) // AMOTION_EVENT_ACTION_DOWN
-    expect(buf.readBigUInt64BE(2)).toBe(0x1122334455667788n)
-    expect(buf.readInt32BE(10)).toBe(100)
-    expect(buf.readInt32BE(14)).toBe(200)
-    expect(buf.readUInt16BE(18)).toBe(1080)
-    expect(buf.readUInt16BE(20)).toBe(1920)
-    expect(buf.readUInt16BE(22)).toBe(0xffff) // default pressure 1.0 for down
-    expect(buf.readUInt32BE(24)).toBe(1) // AMOTION_EVENT_BUTTON_PRIMARY
-    expect(buf.readUInt32BE(28)).toBe(1) // buttons set while pressed
-  })
-
-  it('encodes a move event with action code 2 and full default pressure', () => {
-    const buf = encodeInjectTouchEvent({
-      action: 'move',
-      pointerId: 1n,
-      x: 5,
-      y: 6,
-      screenWidth: 720,
-      screenHeight: 1280
-    })
-
-    expect(buf.length).toBe(32)
-    expect(buf.readUInt8(1)).toBe(2) // AMOTION_EVENT_ACTION_MOVE
-    expect(buf.readUInt16BE(22)).toBe(0xffff)
-    expect(buf.readUInt32BE(28)).toBe(1)
-  })
-
-  it('encodes an up event with zero default pressure and cleared buttons', () => {
-    const buf = encodeInjectTouchEvent({
-      action: 'up',
-      pointerId: 1n,
-      x: 5,
-      y: 6,
-      screenWidth: 720,
-      screenHeight: 1280
-    })
-
-    expect(buf.length).toBe(32)
-    expect(buf.readUInt8(1)).toBe(1) // AMOTION_EVENT_ACTION_UP
-    expect(buf.readUInt16BE(22)).toBe(0) // default pressure 0 on up
-    expect(buf.readUInt32BE(24)).toBe(1) // actionButton stays primary
-    expect(buf.readUInt32BE(28)).toBe(0) // buttons cleared on up
-  })
-
-  it('writes negative coordinates as signed int32', () => {
-    const buf = encodeInjectTouchEvent({
-      action: 'move',
-      pointerId: 1n,
-      x: -3,
-      y: -7,
-      screenWidth: 1,
-      screenHeight: 1
-    })
-
-    expect(buf.readInt32BE(10)).toBe(-3)
-    expect(buf.readInt32BE(14)).toBe(-7)
-  })
-
-  it('encodes explicit fractional pressure as fixed-point u16', () => {
-    const buf = encodeInjectTouchEvent({
-      action: 'down',
-      pointerId: 1n,
-      x: 0,
-      y: 0,
-      screenWidth: 1,
-      screenHeight: 1,
-      pressure: 0.5
-    })
-
-    expect(buf.readUInt16BE(22)).toBe(Math.round(0.5 * 0xffff))
-  })
-
-  it('clamps pressure above 1 and below 0', () => {
-    const high = encodeInjectTouchEvent({
-      action: 'down',
-      pointerId: 1n,
-      x: 0,
-      y: 0,
-      screenWidth: 1,
-      screenHeight: 1,
-      pressure: 2
-    })
-    expect(high.readUInt16BE(22)).toBe(0xffff)
-
-    const low = encodeInjectTouchEvent({
-      action: 'down',
-      pointerId: 1n,
-      x: 0,
-      y: 0,
-      screenWidth: 1,
-      screenHeight: 1,
-      pressure: -1
-    })
-    expect(low.readUInt16BE(22)).toBe(0)
-  })
-})
-
-describe('encodeInjectKeycode', () => {
-  it('encodes a keycode-down event (14 bytes) with round-tripped fields', () => {
-    const buf = encodeInjectKeycode({
-      action: 'down',
-      keycode: 66, // AKEYCODE_ENTER
-      repeat: 3,
-      metaState: 0x1000
-    })
-
-    expect(buf.length).toBe(14)
-    expect(buf.readUInt8(0)).toBe(SCRCPY_CONTROL_MSG_TYPE.INJECT_KEYCODE)
-    expect(buf.readUInt8(0)).toBe(0)
-    expect(buf.readUInt8(1)).toBe(0) // AKEY_EVENT_ACTION_DOWN
-    expect(buf.readInt32BE(2)).toBe(66)
-    expect(buf.readInt32BE(6)).toBe(3)
-    expect(buf.readInt32BE(10)).toBe(0x1000)
-  })
-
-  it('encodes a keycode-up event and applies repeat/metaState defaults', () => {
-    const buf = encodeInjectKeycode({ action: 'up', keycode: 4 }) // AKEYCODE_BACK
-
-    expect(buf.length).toBe(14)
-    expect(buf.readUInt8(1)).toBe(1) // AKEY_EVENT_ACTION_UP
-    expect(buf.readInt32BE(2)).toBe(4)
-    expect(buf.readInt32BE(6)).toBe(0) // default repeat
-    expect(buf.readInt32BE(10)).toBe(0) // default metaState
-  })
-})
-
-describe('encodeInjectText', () => {
-  it('encodes the type byte, UTF-8 byte length header, and payload', () => {
-    const buf = encodeInjectText('hello')
-
-    expect(buf.readUInt8(0)).toBe(SCRCPY_CONTROL_MSG_TYPE.INJECT_TEXT)
-    expect(buf.readUInt8(0)).toBe(1)
-    expect(buf.readUInt32BE(1)).toBe(5)
-    expect(buf.subarray(5).toString('utf8')).toBe('hello')
-    expect(buf.length).toBe(5 + 5)
-  })
-
-  it('uses UTF-8 byte length (not string length) for multi-byte characters', () => {
-    const text = 'é' // one JS char, two UTF-8 bytes
-    const buf = encodeInjectText(text)
-
-    expect(text.length).toBe(1)
-    expect(buf.readUInt32BE(1)).toBe(2)
-    expect(buf.length).toBe(5 + 2)
-    expect(buf.subarray(5).toString('utf8')).toBe('é')
-  })
-
-  it('encodes an empty string as a 5-byte header with zero length', () => {
-    const buf = encodeInjectText('')
-
-    expect(buf.length).toBe(5)
-    expect(buf.readUInt32BE(1)).toBe(0)
-  })
-})
-
-describe('encodeBackOrScreenOn', () => {
-  it('encodes a 2-byte down message', () => {
-    const buf = encodeBackOrScreenOn('down')
-
-    expect(buf.length).toBe(2)
-    expect(buf.readUInt8(0)).toBe(SCRCPY_CONTROL_MSG_TYPE.BACK_OR_SCREEN_ON)
-    expect(buf.readUInt8(0)).toBe(4)
-    expect(buf.readUInt8(1)).toBe(0) // AKEY_EVENT_ACTION_DOWN
-  })
-
-  it('encodes a 2-byte up message', () => {
-    const buf = encodeBackOrScreenOn('up')
-
-    expect(buf.length).toBe(2)
-    expect(buf.readUInt8(1)).toBe(1) // AKEY_EVENT_ACTION_UP
-  })
-})
diff --git a/src/main/emulator/android/scrcpy-control-protocol.ts b/src/main/emulator/android/scrcpy-control-protocol.ts
deleted file mode 100644
index 4e35148948c..00000000000
--- a/src/main/emulator/android/scrcpy-control-protocol.ts
+++ /dev/null
@@ -1,91 +0,0 @@
-// scrcpy server control protocol v2.4
-// Byte-exact encoders for the scrcpy control socket. Every multi-byte field is
-// big-endian to match the server's DataInputStream reads.
-
-export const SCRCPY_CONTROL_MSG_TYPE = {
-  INJECT_KEYCODE: 0,
-  INJECT_TEXT: 1,
-  INJECT_TOUCH_EVENT: 2,
-  INJECT_SCROLL_EVENT: 3,
-  BACK_OR_SCREEN_ON: 4
-} as const
-
-export type ScrcpyKeyAction = 'down' | 'up'
-export type ScrcpyTouchAction = 'down' | 'up' | 'move'
-
-// AKEY_EVENT_ACTION_* / AMOTION_EVENT_ACTION_* codes the server forwards to Android.
-const KEY_ACTION_CODE: Record<ScrcpyKeyAction, number> = { down: 0, up: 1 }
-const TOUCH_ACTION_CODE: Record<ScrcpyTouchAction, number> = { down: 0, up: 1, move: 2 }
-
-// AMOTION_EVENT_BUTTON_PRIMARY — scrcpy reports the primary button for touches.
-const BUTTON_PRIMARY = 1
-// Pressure is a u16 fixed-point value where 0xFFFF represents 1.0.
-const PRESSURE_MAX = 0xffff
-
-function encodePressure(pressure: number): number {
-  const fixed = Math.round(pressure * PRESSURE_MAX)
-  if (fixed < 0) {
-    return 0
-  }
-  if (fixed > PRESSURE_MAX) {
-    return PRESSURE_MAX
-  }
-  return fixed
-}
-
-export function encodeInjectTouchEvent(p: {
-  action: ScrcpyTouchAction
-  pointerId: bigint
-  x: number
-  y: number
-  screenWidth: number
-  screenHeight: number
-  pressure?: number
-}): Buffer {
-  // A finger that lifts has no pressure; otherwise full pressure unless overridden.
-  const pressure = p.pressure ?? (p.action === 'up' ? 0 : 1)
-  const buf = Buffer.alloc(32)
-  buf.writeUInt8(SCRCPY_CONTROL_MSG_TYPE.INJECT_TOUCH_EVENT, 0)
-  buf.writeUInt8(TOUCH_ACTION_CODE[p.action], 1)
-  buf.writeBigUInt64BE(p.pointerId, 2)
-  buf.writeInt32BE(p.x, 10)
-  buf.writeInt32BE(p.y, 14)
-  buf.writeUInt16BE(p.screenWidth, 18)
-  buf.writeUInt16BE(p.screenHeight, 20)
-  buf.writeUInt16BE(encodePressure(pressure), 22)
-  buf.writeUInt32BE(BUTTON_PRIMARY, 24)
-  buf.writeUInt32BE(p.action === 'up' ? 0 : BUTTON_PRIMARY, 28)
-  return buf
-}
-
-export function encodeInjectKeycode(p: {
-  action: ScrcpyKeyAction
-  keycode: number
-  repeat?: number
-  metaState?: number
-}): Buffer {
-  const buf = Buffer.alloc(14)
-  buf.writeUInt8(SCRCPY_CONTROL_MSG_TYPE.INJECT_KEYCODE, 0)
-  buf.writeUInt8(KEY_ACTION_CODE[p.action], 1)
-  buf.writeInt32BE(p.keycode, 2)
-  buf.writeInt32BE(p.repeat ?? 0, 6)
-  buf.writeInt32BE(p.metaState ?? 0, 10)
-  return buf
-}
-
-export function encodeInjectText(text: string): Buffer {
-  // The length prefix is the UTF-8 byte count, which can exceed text.length.
-  const payload = Buffer.from(text, 'utf8')
-  const buf = Buffer.alloc(5 + payload.length)
-  buf.writeUInt8(SCRCPY_CONTROL_MSG_TYPE.INJECT_TEXT, 0)
-  buf.writeUInt32BE(payload.length, 1)
-  payload.copy(buf, 5)
-  return buf
-}
-
-export function encodeBackOrScreenOn(action: ScrcpyKeyAction): Buffer {
-  const buf = Buffer.alloc(2)
-  buf.writeUInt8(SCRCPY_CONTROL_MSG_TYPE.BACK_OR_SCREEN_ON, 0)
-  buf.writeUInt8(KEY_ACTION_CODE[action], 1)
-  return buf
-}
diff --git a/src/main/emulator/android/scrcpy-stream-session.ts b/src/main/emulator/android/scrcpy-stream-session.ts
index b7cec131e2c..0333e9ee5db 100644
--- a/src/main/emulator/android/scrcpy-stream-session.ts
+++ b/src/main/emulator/android/scrcpy-stream-session.ts
@@ -22,8 +22,7 @@ import { emulatorProbe, emulatorProbeError } from '../emulator-probe'
 
 // A live scrcpy session validated against a real emulator. The connection
 // handshake (dummy byte, 64-byte device name, codec meta) and the server option
-// set are coupled to the pinned scrcpy server version; the pure framing
-// (scrcpy-video-frame-parser) and control encoding (scrcpy-control-protocol) are
+// set are coupled to the pinned scrcpy server version; pure video framing is
 // unit-tested, while this orchestration is exercised live via probes.
 
 const DEVICE_NAME_BYTES = 64
@@ -198,7 +197,6 @@ export class ScrcpyStreamSession {
     socket.on('error', (error) =>
       emulatorProbeError('scrcpy.control.fail', error, { serial: this.options.serial })
     )
-    // Drop the ref on reset so sendControl() can't write to a dead socket (half-open session).
     socket.on('close', () => {
       if (this.controlSocket === socket) {
         this.controlSocket = null
@@ -253,11 +251,6 @@ export class ScrcpyStreamSession {
     }
   }
 
-  // Sends an encoded scrcpy control message (see scrcpy-control-protocol).
-  sendControl(message: Buffer): void {
-    this.controlSocket?.write(message)
-  }
-
   private fail(message: string): void {
     if (this.closed) {
       return
diff --git a/src/main/emulator/emulator-bridge.test.ts b/src/main/emulator/emulator-bridge.test.ts
index 33b4f9d2421..a880c0f15a3 100644
--- a/src/main/emulator/emulator-bridge.test.ts
+++ b/src/main/emulator/emulator-bridge.test.ts
@@ -216,6 +216,95 @@ describe('EmulatorBridge helper ownership', () => {
     expect(bridge.getActiveForWorktree('wt-1')).toBeNull()
   })
 
+  it('does not clean up a failed attach while another start claim can register the device', async () => {
+    const waitForEndpointReady = vi.fn(async () => true)
+    execServeSimCommandMock.mockResolvedValue({
+      device: 'device-1',
+      streamUrl: 'http://127.0.0.1:3102/stream.mjpeg',
+      wsUrl: 'ws://127.0.0.1:3102'
+    })
+    const bridge = new EmulatorBridge({ waitForEndpointReady })
+
+    const failedLease = await bridge.acquireHelperForDevice('device-1')
+    const survivingLease = await bridge.acquireHelperForDevice('device-1')
+
+    await failedLease.release({ cleanupIfUnused: true })
+    bridge.registerActiveEmulator('wt-surviving', survivingLease.info, { managed: true })
+    await survivingLease.release()
+
+    expect(killServeSimHelperProcessesForDeviceMock).not.toHaveBeenCalled()
+    expect(shutdownSimulatorDeviceMock).not.toHaveBeenCalled()
+    expect(bridge.getActiveForWorktree('wt-surviving')).toMatchObject({
+      deviceUdid: 'device-1'
+    })
+  })
+
+  it('cleans up a failed attach when no start claim or registered workspace remains', async () => {
+    const waitForEndpointReady = vi.fn(async () => true)
+    execServeSimCommandMock.mockResolvedValue({
+      device: 'device-1',
+      streamUrl: 'http://127.0.0.1:3102/stream.mjpeg',
+      wsUrl: 'ws://127.0.0.1:3102'
+    })
+    const bridge = new EmulatorBridge({ waitForEndpointReady })
+
+    const lease = await bridge.acquireHelperForDevice('device-1')
+    await lease.release({ cleanupIfUnused: true })
+
+    expect(killServeSimHelperProcessesForDeviceMock).toHaveBeenCalledWith('device-1', {
+      helperPid: undefined,
+      includeOrphaned: true
+    })
+    expect(shutdownSimulatorDeviceMock).toHaveBeenCalledWith('device-1')
+  })
+
+  it('keeps a shared device alive when one registered workspace detaches', async () => {
+    const bridge = new EmulatorBridge()
+    bridge.registerActiveEmulator('wt-1', session('device-1'), { managed: true })
+    bridge.registerActiveEmulator('wt-2', session('device-1'), { managed: true })
+
+    await bridge.stopActiveManagedForWorktree('wt-1', { shutdownDevice: true })
+
+    expect(killServeSimHelperProcessesForDeviceMock).not.toHaveBeenCalled()
+    expect(shutdownSimulatorDeviceMock).not.toHaveBeenCalled()
+    expect(bridge.getActiveForWorktree('wt-1')).toBeNull()
+    expect(bridge.getActiveForWorktree('wt-2')).toMatchObject({ deviceUdid: 'device-1' })
+  })
+
+  it('keeps a device alive when its last registered workspace closes during another attach', async () => {
+    let finishStart:
+      | ((info: Awaited<ReturnType<typeof execServeSimCommandMock>>) => void)
+      | undefined
+    execServeSimCommandMock.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          finishStart = resolve
+        })
+    )
+    const bridge = new EmulatorBridge({ waitForEndpointReady: vi.fn(async () => true) })
+    bridge.registerActiveEmulator('wt-closing', session('device-1'), { managed: true })
+
+    const leasePromise = bridge.acquireHelperForDevice('device-1')
+    await vi.waitFor(() => expect(execServeSimCommandMock).toHaveBeenCalledOnce())
+    const shutdown = bridge.shutdownActiveManagedForWorktree('wt-closing')
+    await Promise.resolve()
+
+    expect(killServeSimHelperProcessesForDeviceMock).not.toHaveBeenCalled()
+    finishStart?.({
+      device: 'device-1',
+      streamUrl: 'http://127.0.0.1:3102/stream.mjpeg',
+      wsUrl: 'ws://127.0.0.1:3102'
+    })
+    const lease = await leasePromise
+    bridge.registerActiveEmulator('wt-attaching', lease.info, { managed: true })
+    await lease.release()
+    await shutdown
+
+    expect(killServeSimHelperProcessesForDeviceMock).not.toHaveBeenCalled()
+    expect(shutdownSimulatorDeviceMock).not.toHaveBeenCalled()
+    expect(bridge.getActiveForWorktree('wt-attaching')).toMatchObject({ deviceUdid: 'device-1' })
+  })
+
   it('reuses the active helper for the same requested device', async () => {
     const waitForEndpointReady = vi.fn(async () => true)
     const bridge = new EmulatorBridge({ waitForEndpointReady })
@@ -267,7 +356,7 @@ describe('EmulatorBridge helper ownership', () => {
     })
     const bridge = new EmulatorBridge({ waitForEndpointReady })
 
-    const info = await bridge.startHelperForDevice('device-1')
+    const { info } = await bridge.acquireHelperForDevice('device-1')
 
     expect(info.deviceUdid).toBe('device-1')
     expect(waitForEndpointReady).toHaveBeenCalledTimes(2)
@@ -309,7 +398,7 @@ describe('EmulatorBridge helper ownership', () => {
     })
     const bridge = new EmulatorBridge({ waitForEndpointReady })
 
-    await expect(bridge.startHelperForDevice('device-1')).rejects.toMatchObject({
+    await expect(bridge.acquireHelperForDevice('device-1')).rejects.toMatchObject({
       code: 'emulator_helper_failed'
     })
 
@@ -334,7 +423,7 @@ describe('EmulatorBridge helper ownership', () => {
     })
     const bridge = new EmulatorBridge({ waitForEndpointReady })
 
-    await expect(bridge.startHelperForDevice('device-1')).rejects.toMatchObject({
+    await expect(bridge.acquireHelperForDevice('device-1')).rejects.toMatchObject({
       code: 'emulator_helper_failed'
     })
 
@@ -368,7 +457,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     bridge.registerActiveEmulator('wt-1', session('device-1'), { managed: true })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -401,7 +491,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     bridge.registerActiveEmulator('wt-1', session('device-1'), { managed: true })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -435,7 +526,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     bridge.registerActiveEmulator('wt-other', session('device-1'), { managed: true })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -465,7 +557,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     bridge.registerActiveEmulator('wt-1', session('device-active'), { managed: true })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -499,7 +592,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     )
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -530,7 +624,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     )
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -551,7 +646,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     bridge.registerActiveEmulator('wt-1', session('device-1'), { managed: true })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -575,7 +671,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     const bridge = new EmulatorBridge()
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: false,
@@ -599,7 +696,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     const bridge = new EmulatorBridge({ waitForEndpointReady })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
@@ -641,7 +739,8 @@ describe('RuntimeEmulatorCommands attach lifecycle', () => {
     const bridge = new EmulatorBridge({ waitForEndpointReady })
     const commands = new RuntimeEmulatorCommands({
       getEmulatorBridge: () => bridge,
-      resolveWorktreeSelector: vi.fn(async () => ({ id: 'wt-1' })),
+      resolveEmulatorWorkspaceId: vi.fn(async () => 'wt-1'),
+      resolveEmulatorCleanupWorkspaceId: vi.fn(async () => 'wt-1'),
       getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } }) as never,
       getSettings: () => ({
         mobileEmulatorEnabled: true,
diff --git a/src/main/emulator/emulator-bridge.ts b/src/main/emulator/emulator-bridge.ts
index 84ecbb7025e..b201b34963a 100644
--- a/src/main/emulator/emulator-bridge.ts
+++ b/src/main/emulator/emulator-bridge.ts
@@ -5,6 +5,11 @@ import type { SimulatorDevice } from './simctl-simulator-devices'
 import type { EmulatorBridgeOptions } from './emulator-bridge-types'
 import type { EmulatorGesturePoint } from './emulator-gesture-sender'
 import { EmulatorSessionRegistry } from './emulator-session-registry'
+import {
+  EmulatorStartLeaseRegistry,
+  type EmulatorStartLease
+} from './emulator-start-lease-registry'
+import { listAvailableEmulatorDevices } from './emulator-device-inventory'
 import { deriveAxUrlFromStreamUrl } from './serve-sim-detached-session'
 import { IosEmulatorBackend } from './backends/ios-emulator-backend'
 import { AndroidEmulatorBackend } from './backends/android-emulator-backend'
@@ -22,6 +27,7 @@ import type {
 // backend a command targets (by the session's recorded backend, else by device).
 export class EmulatorBridge {
   private readonly sessionRegistry = new EmulatorSessionRegistry()
+  private readonly startLeases = new EmulatorStartLeaseRegistry()
   private readonly backends: EmulatorBackend[]
   private readonly iosBackend: IosEmulatorBackend
   private readonly androidBackend: AndroidEmulatorBackend
@@ -41,19 +47,7 @@ export class EmulatorBridge {
   // Aggregated device list across host-supported backends (iOS simulators +
   // Android devices/AVDs), for the unified `orca emulator list`.
   async listAllDevices(): Promise<EmulatorDevice[]> {
-    const perBackend = await Promise.all(
-      this.backends.map(async (backend) => {
-        if (!backend.isSupportedOnHost()) {
-          return []
-        }
-        try {
-          return await backend.listDevices()
-        } catch {
-          return []
-        }
-      })
-    )
-    return perBackend.flat()
+    return listAvailableEmulatorDevices(this.backends)
   }
 
   // iOS-specific passthroughs kept for back-compat with the runtime + availability code.
@@ -85,14 +79,10 @@ export class EmulatorBridge {
     return this.sessionRegistry.getActiveForWorktree(worktreeId)
   }
 
-  getActiveBackendKind(worktreeId: string): EmulatorBackendKind | null {
-    return this.backendForActiveWorktree(worktreeId)?.kind ?? null
-  }
-
   // On a device switch, keep slow-to-boot Android emulators running for instant
   // switch-back; shut down other backends' devices so they are not leaked.
   async stopActiveForSwitch(worktreeId: string): Promise<string | null> {
-    const keepAlive = this.getActiveBackendKind(worktreeId) === 'android'
+    const keepAlive = this.backendForActiveWorktree(worktreeId)?.kind === 'android'
     return this.stopActiveForWorktreeInternal(worktreeId, { shutdownDevice: !keepAlive })
   }
 
@@ -146,18 +136,26 @@ export class EmulatorBridge {
     if (!session || (options.managedOnly && !session.managed)) {
       return null
     }
+    if (this.sessionRegistry.hasActiveWorktreeForSession(key)) {
+      return session.deviceUdid
+    }
     const backend = this.backendForKind(session.backend)
     if (!backend) {
       return null
     }
-    await backend.stopHelperForDevice(session.deviceUdid, {
-      helperPid: session.pid,
-      includeOrphaned: !options.managedOnly
-    })
-    if (options.shutdownDevice) {
-      await backend.shutdownDevice(session.deviceUdid).catch(() => {})
+    const sessionInfo = this.sessionRegistry.toSessionInfo(session)
+    await this.startLeases.cleanupWhenIdle(
+      backend,
+      sessionInfo,
+      (info) => this.sessionRegistry.hasActiveWorktreeForSession(info.deviceUdid),
+      {
+        includeOrphaned: !options.managedOnly,
+        shutdownDevice: options.shutdownDevice
+      }
+    )
+    if (!this.sessionRegistry.hasActiveWorktreeForSession(key)) {
+      this.sessionRegistry.clearSessionAndWorktrees(key)
     }
-    this.sessionRegistry.clearSessionAndWorktrees(key)
     return session.deviceUdid
   }
 
@@ -243,9 +241,11 @@ export class EmulatorBridge {
     return run(backend, device)
   }
 
-  async startHelperForDevice(device: string): Promise<EmulatorSessionInfo> {
+  async acquireHelperForDevice(device: string): Promise<EmulatorStartLease> {
     const backend = await this.backendForDevice(device)
-    return backend.startSession(device)
+    return this.startLeases.acquire(backend, device, (info) =>
+      this.sessionRegistry.hasActiveWorktreeForSession(info.deviceUdid)
+    )
   }
 
   async kill(device?: string, worktreeId?: string): Promise<string> {
diff --git a/src/main/emulator/emulator-device-inventory.ts b/src/main/emulator/emulator-device-inventory.ts
new file mode 100644
index 00000000000..35649b947f3
--- /dev/null
+++ b/src/main/emulator/emulator-device-inventory.ts
@@ -0,0 +1,19 @@
+import type { EmulatorBackend, EmulatorDevice } from './backends/emulator-backend'
+
+export async function listAvailableEmulatorDevices(
+  backends: EmulatorBackend[]
+): Promise<EmulatorDevice[]> {
+  const perBackend = await Promise.all(
+    backends.map(async (backend) => {
+      if (!backend.isSupportedOnHost()) {
+        return []
+      }
+      try {
+        return await backend.listDevices()
+      } catch {
+        return []
+      }
+    })
+  )
+  return perBackend.flat()
+}
diff --git a/src/main/emulator/emulator-session-registry.ts b/src/main/emulator/emulator-session-registry.ts
index b55578930e4..917b14a9e39 100644
--- a/src/main/emulator/emulator-session-registry.ts
+++ b/src/main/emulator/emulator-session-registry.ts
@@ -51,6 +51,14 @@ export class EmulatorSessionRegistry {
     return this.sessions.get(key)
   }
 
+  toSessionInfo(session: EmulatorSessionState): EmulatorSessionInfo {
+    return toSessionInfo(session)
+  }
+
+  hasActiveWorktreeForSession(key: string): boolean {
+    return [...this.activeByWorktree.values()].some((activeKey) => activeKey === key)
+  }
+
   listSessions(): EmulatorSessionState[] {
     return [...this.sessions.values()]
   }
diff --git a/src/main/emulator/emulator-start-lease-registry.test.ts b/src/main/emulator/emulator-start-lease-registry.test.ts
new file mode 100644
index 00000000000..f0b0e927569
--- /dev/null
+++ b/src/main/emulator/emulator-start-lease-registry.test.ts
@@ -0,0 +1,111 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { EmulatorBackend } from './backends/emulator-backend'
+import { EmulatorStartLeaseRegistry } from './emulator-start-lease-registry'
+import type { EmulatorSessionInfo } from './emulator-types'
+
+function makeBackend(): {
+  backend: EmulatorBackend
+  resolveDeviceId: ReturnType<typeof vi.fn>
+  startSession: ReturnType<typeof vi.fn>
+  stopHelperForDevice: ReturnType<typeof vi.fn>
+  shutdownDevice: ReturnType<typeof vi.fn>
+} {
+  const resolveDeviceId = vi.fn(async () => {
+    throw new Error('shutdown AVD cannot resolve before boot')
+  })
+  const startSession = vi.fn(
+    async (): Promise<EmulatorSessionInfo> => ({
+      deviceUdid: 'emulator-5554',
+      streamUrl: 'scrcpy://emulator-5554',
+      wsUrl: '',
+      streamCodec: 'h264',
+      backend: 'android'
+    })
+  )
+  const stopHelperForDevice = vi.fn(async () => {})
+  const shutdownDevice = vi.fn(async () => {})
+  const backend: EmulatorBackend = {
+    kind: 'android',
+    streamCodec: 'h264',
+    capabilities: {
+      install: false,
+      launch: false,
+      permissions: false,
+      accessibilityTree: false,
+      logcat: false
+    },
+    isSupportedOnHost: () => true,
+    checkAvailability: vi.fn(),
+    listDevices: vi.fn(async () => []),
+    ownsDevice: vi.fn(async () => true),
+    resolveDeviceId,
+    startSession,
+    stopHelperForDevice,
+    shutdownDevice,
+    isSessionReusable: vi.fn(async () => true),
+    tap: vi.fn(async () => {}),
+    gesture: vi.fn(async () => {}),
+    type: vi.fn(async () => {}),
+    button: vi.fn(async () => {}),
+    rotate: vi.fn(async () => {}),
+    exec: vi.fn(async () => undefined)
+  }
+  return { backend, resolveDeviceId, startSession, stopHelperForDevice, shutdownDevice }
+}
+
+describe('EmulatorStartLeaseRegistry', () => {
+  it('lets the backend boot a shutdown device before a canonical id exists', async () => {
+    const { backend, resolveDeviceId, startSession } = makeBackend()
+    const registry = new EmulatorStartLeaseRegistry()
+
+    const lease = await registry.acquire(backend, 'Pixel_Tablet', () => false)
+    await lease.release()
+
+    expect(resolveDeviceId).not.toHaveBeenCalled()
+    expect(startSession).toHaveBeenCalledWith('Pixel_Tablet')
+    expect(lease.info.deviceUdid).toBe('emulator-5554')
+  })
+
+  it('waits for pending cleanup before starting a new lease', async () => {
+    const { backend, startSession, stopHelperForDevice, shutdownDevice } = makeBackend()
+    let finishCleanup: (() => void) | undefined
+    stopHelperForDevice.mockImplementation(
+      () =>
+        new Promise<void>((resolve) => {
+          finishCleanup = resolve
+        })
+    )
+    const registry = new EmulatorStartLeaseRegistry()
+    const first = await registry.acquire(backend, 'Pixel_Tablet', () => false)
+
+    const cleanup = first.release({ cleanupIfUnused: true })
+    await vi.waitFor(() => expect(stopHelperForDevice).toHaveBeenCalledOnce())
+    const second = registry.acquire(backend, 'Pixel_Tablet', () => false)
+    await Promise.resolve()
+    expect(startSession).toHaveBeenCalledOnce()
+
+    finishCleanup?.()
+    await cleanup
+    const secondLease = await second
+
+    expect(shutdownDevice).toHaveBeenCalledOnce()
+    expect(startSession).toHaveBeenCalledTimes(2)
+    await secondLease.release()
+  })
+
+  it('claims synchronously before an earlier lease can start cleanup', async () => {
+    const { backend, stopHelperForDevice, shutdownDevice } = makeBackend()
+    const registry = new EmulatorStartLeaseRegistry()
+    const first = await registry.acquire(backend, 'Pixel_Tablet', () => false)
+
+    const second = registry.acquire(backend, 'Pixel_Tablet', () => false)
+    await first.release({ cleanupIfUnused: true })
+
+    expect(stopHelperForDevice).not.toHaveBeenCalled()
+    const secondLease = await second
+    await secondLease.release()
+
+    expect(stopHelperForDevice).toHaveBeenCalledOnce()
+    expect(shutdownDevice).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/emulator/emulator-start-lease-registry.ts b/src/main/emulator/emulator-start-lease-registry.ts
new file mode 100644
index 00000000000..94b1e6ce992
--- /dev/null
+++ b/src/main/emulator/emulator-start-lease-registry.ts
@@ -0,0 +1,127 @@
+import type { EmulatorBackend } from './backends/emulator-backend'
+import type { EmulatorSessionInfo } from './emulator-types'
+
+export type EmulatorStartLease = {
+  info: EmulatorSessionInfo
+  release(options?: { cleanupIfUnused?: boolean }): Promise<void>
+}
+
+type PendingCleanup = {
+  info: EmulatorSessionInfo
+  isRegistered: (info: EmulatorSessionInfo) => boolean
+  includeOrphaned: boolean
+  shutdownDevice: boolean
+}
+
+export class EmulatorStartLeaseRegistry {
+  private readonly claimsByBackend = new Map<EmulatorBackend, number>()
+  private readonly cleanupByBackend = new Map<EmulatorBackend, Promise<void>>()
+  private readonly pendingCleanupByBackend = new Map<EmulatorBackend, Map<string, PendingCleanup>>()
+
+  async acquire(
+    backend: EmulatorBackend,
+    device: string,
+    isRegistered: (info: EmulatorSessionInfo) => boolean
+  ): Promise<EmulatorStartLease> {
+    this.claimsByBackend.set(backend, (this.claimsByBackend.get(backend) ?? 0) + 1)
+    try {
+      await this.cleanupByBackend.get(backend)
+      const info = await backend.startSession(device)
+      let released = false
+      return {
+        info,
+        release: async (options = {}) => {
+          if (released) {
+            return
+          }
+          released = true
+          if (options.cleanupIfUnused) {
+            this.addPendingCleanup(backend, info, isRegistered, {
+              includeOrphaned: true,
+              shutdownDevice: true
+            })
+          }
+          await this.release(backend)
+        }
+      }
+    } catch (error) {
+      await this.release(backend)
+      throw error
+    }
+  }
+
+  async cleanupWhenIdle(
+    backend: EmulatorBackend,
+    info: EmulatorSessionInfo,
+    isRegistered: (info: EmulatorSessionInfo) => boolean,
+    options: { includeOrphaned?: boolean; shutdownDevice?: boolean } = {}
+  ): Promise<void> {
+    this.addPendingCleanup(backend, info, isRegistered, options)
+    await this.drainCleanup(backend)
+  }
+
+  private async release(backend: EmulatorBackend): Promise<void> {
+    const remaining = this.decrement(backend)
+    if (remaining > 0) {
+      return
+    }
+    await this.drainCleanup(backend)
+  }
+
+  private async drainCleanup(backend: EmulatorBackend): Promise<void> {
+    await this.cleanupByBackend.get(backend)
+    if ((this.claimsByBackend.get(backend) ?? 0) > 0) {
+      return
+    }
+    const pending = this.pendingCleanupByBackend.get(backend)
+    this.pendingCleanupByBackend.delete(backend)
+    if (!pending) {
+      return
+    }
+    const cleanup = Promise.allSettled(
+      [...pending.values()].map(async ({ info, isRegistered, includeOrphaned, shutdownDevice }) => {
+        if (isRegistered(info)) {
+          return
+        }
+        await backend.stopHelperForDevice(info.deviceUdid, {
+          helperPid: info.helperPid,
+          includeOrphaned
+        })
+        if (shutdownDevice) {
+          await backend.shutdownDevice(info.deviceUdid)
+        }
+      })
+    )
+      .then(() => undefined)
+      .finally(() => this.cleanupByBackend.delete(backend))
+    this.cleanupByBackend.set(backend, cleanup)
+    await cleanup
+  }
+
+  private addPendingCleanup(
+    backend: EmulatorBackend,
+    info: EmulatorSessionInfo,
+    isRegistered: (info: EmulatorSessionInfo) => boolean,
+    options: { includeOrphaned?: boolean; shutdownDevice?: boolean }
+  ): void {
+    const pending = this.pendingCleanupByBackend.get(backend) ?? new Map()
+    const existing = pending.get(info.deviceUdid)
+    pending.set(info.deviceUdid, {
+      info,
+      isRegistered,
+      includeOrphaned: options.includeOrphaned === true || existing?.includeOrphaned === true,
+      shutdownDevice: options.shutdownDevice === true || existing?.shutdownDevice === true
+    })
+    this.pendingCleanupByBackend.set(backend, pending)
+  }
+
+  private decrement(backend: EmulatorBackend): number {
+    const next = Math.max(0, (this.claimsByBackend.get(backend) ?? 1) - 1)
+    if (next === 0) {
+      this.claimsByBackend.delete(backend)
+    } else {
+      this.claimsByBackend.set(backend, next)
+    }
+    return next
+  }
+}
diff --git a/src/main/emulator/mjpeg-frame-parser.ts b/src/main/emulator/mjpeg-frame-parser.ts
index 841bc6a8c91..90733e2c1fe 100644
--- a/src/main/emulator/mjpeg-frame-parser.ts
+++ b/src/main/emulator/mjpeg-frame-parser.ts
@@ -32,7 +32,7 @@ export function extractJpegFrames(
 
   while (cursor.length > 0) {
     const frameStart = cursor.indexOf(JPEG_START)
-    if (frameStart < 0) {
+    if (frameStart === -1) {
       const keepLastByte = cursor.at(-1) === 0xff
       return { frames, pending: keepLastByte ? Buffer.from([0xff]) : Buffer.alloc(0) }
     }
@@ -41,7 +41,7 @@ export function extractJpegFrames(
     }
 
     const frameEnd = cursor.indexOf(JPEG_END, JPEG_START.length)
-    if (frameEnd < 0) {
+    if (frameEnd === -1) {
       return { frames, pending: trimPendingBuffer(cursor, maxPendingBytes) }
     }
 
diff --git a/src/main/gemini/hook-service.ts b/src/main/gemini/hook-service.ts
index 1615ea336f9..72ee056bd5f 100644
--- a/src/main/gemini/hook-service.ts
+++ b/src/main/gemini/hook-service.ts
@@ -16,6 +16,7 @@ import {
   writeManagedScript,
   type HookDefinition
 } from '../agent-hooks/installer-utils'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
 import {
   readHooksJsonRemote,
   writeHooksJsonRemote,
@@ -97,6 +98,10 @@ function getManagedScript(target: 'local' | 'posix' = 'local'): string {
 }
 
 export class GeminiHookService {
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(getManagedScriptPath(), getManagedScript())
+  }
+
   getStatus(): AgentHookInstallStatus {
     const configPath = getConfigPath()
     const scriptPath = getManagedScriptPath()
@@ -195,7 +200,7 @@ export class GeminiHookService {
     return this.getStatus()
   }
 
-  // POSIX-only remote install mirroring ClaudeHookService.installRemote. See docs/design/agent-status-over-ssh.md §8.
+  // POSIX-only remote install mirroring ClaudeHookService.installRemote; the managed script/JSON shape must match local install() or remote panes report a different status.
   async installRemote(sftp: SFTPWrapper, remoteHome: string): Promise<AgentHookInstallStatus> {
     const remoteConfigPath = `${remoteHome.replace(/\/$/, '')}/.gemini/settings.json`
     const remoteScriptPath = `${remoteHome.replace(/\/$/, '')}/.orca/agent-hooks/gemini-hook.sh`
diff --git a/src/main/git/git-capability-state.test.ts b/src/main/git/git-capability-state.test.ts
index 0d499aea163..b6e655efe62 100644
--- a/src/main/git/git-capability-state.test.ts
+++ b/src/main/git/git-capability-state.test.ts
@@ -1,13 +1,19 @@
-import { beforeEach, describe, expect, it } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   clearGitCapabilityStateForTests,
   getLocalGitCapabilityCache,
-  getSshGitCapabilityCache
+  getSshGitCapabilityCache,
+  withLocalGitCapabilityCacheForExecution
 } from './git-capability-state'
+import {
+  resetWslLinkedWorktreeGitRoutingForTests,
+  seedWslLinkedWorktreeGitRoutingForTests
+} from './wsl-linked-worktree-git-routing'
 
 describe('Git capability execution-host state', () => {
   beforeEach(() => {
     clearGitCapabilityStateForTests()
+    resetWslLinkedWorktreeGitRoutingForTests()
   })
 
   it('shares native state while isolating each WSL distro', () => {
@@ -34,4 +40,34 @@ describe('Git capability execution-host state', () => {
       getSshGitCapabilityCache(replacementProvider)
     )
   })
+
+  it('uses native capability state for a prepared host-routed WSL worktree', async () => {
+    const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    try {
+      seedWslLinkedWorktreeGitRoutingForTests(String.raw`C:\repo\linked`)
+
+      await expect(
+        withLocalGitCapabilityCacheForExecution(
+          { cwd: String.raw`C:\repo\linked`, wslDistro: 'Ubuntu' },
+          async (capabilities) => capabilities
+        )
+      ).resolves.toBe(getLocalGitCapabilityCache())
+      expect(getLocalGitCapabilityCache()).not.toBe(
+        getLocalGitCapabilityCache({ wslDistro: 'Ubuntu' })
+      )
+    } finally {
+      platform.mockRestore()
+    }
+  })
+
+  it('starts non-candidate capability work without an added async turn', async () => {
+    let started = false
+    const result = withLocalGitCapabilityCacheForExecution({ cwd: '/repo' }, async () => {
+      started = true
+      return 'done'
+    })
+
+    expect(started).toBe(true)
+    await expect(result).resolves.toBe('done')
+  })
 })
diff --git a/src/main/git/git-capability-state.ts b/src/main/git/git-capability-state.ts
index aec7a369a26..7721df722c8 100644
--- a/src/main/git/git-capability-state.ts
+++ b/src/main/git/git-capability-state.ts
@@ -1,9 +1,14 @@
 import { GitCapabilityCache } from '../../shared/git-capability-cache'
 import { parseWslUncPath } from '../../shared/wsl-paths'
+import {
+  isWslLinkedWorktreeGitRoutingCandidate,
+  prepareWslLinkedWorktreeGitRouting
+} from './wsl-linked-worktree-git-routing'
 
 type LocalGitCapabilityTarget = {
   cwd?: string
   wslDistro?: string
+  signal?: AbortSignal
 }
 
 const localCapabilitiesByExecutionHost = new Map<string, GitCapabilityCache>()
@@ -29,6 +34,28 @@ export function getLocalGitCapabilityCache(
   return cache
 }
 
+export function withLocalGitCapabilityCacheForExecution<T>(
+  target: LocalGitCapabilityTarget,
+  run: (capabilities: GitCapabilityCache) => Promise<T>
+): Promise<T> {
+  if (!target.cwd || !isWslLinkedWorktreeGitRoutingCandidate(target.cwd, target.wslDistro)) {
+    try {
+      return run(getLocalGitCapabilityCache(target))
+    } catch (error) {
+      return Promise.reject(error)
+    }
+  }
+  return prepareWslLinkedWorktreeGitRouting(target.cwd, target.wslDistro, {
+    signal: target.signal
+  }).then((usesHostGit) =>
+    run(
+      getLocalGitCapabilityCache(
+        usesHostGit ? { cwd: target.cwd } : { cwd: target.cwd, wslDistro: target.wslDistro }
+      )
+    )
+  )
+}
+
 export function getSshGitCapabilityCache(provider: object): GitCapabilityCache {
   let cache = sshCapabilitiesByProvider.get(provider)
   if (!cache) {
diff --git a/src/main/git/repo.ts b/src/main/git/repo.ts
index e609d90a981..26291ec5d39 100644
--- a/src/main/git/repo.ts
+++ b/src/main/git/repo.ts
@@ -932,7 +932,7 @@ export function parseAndFilterSearchRefDetails(
       .filter((line) => line.length > 0)
       .map((line) => {
         const nul = line.indexOf('\0')
-        if (nul < 0) {
+        if (nul === -1) {
           // Why: no NUL means an unexpected %(refname) format; drop it rather than hand callers an unusable "short" ref.
           return null
         }
diff --git a/src/main/git/runner-command-exec.test.ts b/src/main/git/runner-command-exec.test.ts
index 41975f9d665..8d07bd5c555 100644
--- a/src/main/git/runner-command-exec.test.ts
+++ b/src/main/git/runner-command-exec.test.ts
@@ -179,8 +179,8 @@ describe('commandExecFileAsync Windows command shims', () => {
 describe('runner execFile timeout handling', () => {
   beforeEach(() => {
     execFileMock.mockReset()
-    execFileSyncMock.mockReset()
     spawnMock.mockReset()
+    execFileSyncMock.mockReset()
     vi.useFakeTimers()
   })
 
@@ -232,6 +232,22 @@ describe('runner execFile timeout handling', () => {
     expect(child.kill).toHaveBeenCalled()
   })
 
+  it('kills an active gh execution when its caller aborts', async () => {
+    const child = createMockChildProcess(1234)
+    execFileMock.mockReturnValue(child)
+    const controller = new AbortController()
+    const promise = ghExecFileAsync(['api', 'repos/stablyai/orca/issues/5388'], {
+      cwd: '/repo',
+      signal: controller.signal
+    })
+    const rejection = expect(promise).rejects.toMatchObject({ name: 'AbortError' })
+
+    controller.abort()
+
+    await rejection
+    expect(child.kill).toHaveBeenCalled()
+  })
+
   it('honors explicit gh timeouts', async () => {
     const child = createMockChildProcess(1234)
     execFileMock.mockReturnValue(child)
diff --git a/src/main/git/runner-windows-host-environment.test.ts b/src/main/git/runner-windows-host-environment.test.ts
new file mode 100644
index 00000000000..e441b023ff4
--- /dev/null
+++ b/src/main/git/runner-windows-host-environment.test.ts
@@ -0,0 +1,266 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { execFileMock, spawnMock } = vi.hoisted(() => ({
+  execFileMock: vi.fn(),
+  spawnMock: vi.fn()
+}))
+
+vi.mock('node:child_process', () => ({
+  execFile: execFileMock,
+  execFileSync: vi.fn(),
+  spawn: spawnMock
+}))
+
+import {
+  awaitWindowsHostGitEnvironmentReady,
+  configureWindowsHostGitEnvironmentReadiness,
+  gitExecFileAsync,
+  gitExecFileAsyncBuffer,
+  gitSpawnAfterWindowsEnvironmentReady,
+  gitStreamStdout
+} from './runner'
+
+type MockChildProcess = EventEmitter & {
+  stdout: EventEmitter
+  stderr: EventEmitter
+  pid: number
+  kill: ReturnType<typeof vi.fn>
+}
+
+function createMockChildProcess(pid: number): MockChildProcess {
+  const child = new EventEmitter() as MockChildProcess
+  child.stdout = new EventEmitter()
+  child.stderr = new EventEmitter()
+  child.pid = pid
+  child.kill = vi.fn()
+  return child
+}
+
+function deferred(): { promise: Promise<void>; resolve: () => void } {
+  let resolve!: () => void
+  const promise = new Promise<void>((next) => {
+    resolve = next
+  })
+  return { promise, resolve }
+}
+
+async function withPlatform<T>(platform: NodeJS.Platform, fn: () => Promise<T>): Promise<T> {
+  const original = process.platform
+  Object.defineProperty(process, 'platform', { configurable: true, value: platform })
+  try {
+    return await fn()
+  } finally {
+    Object.defineProperty(process, 'platform', { configurable: true, value: original })
+  }
+}
+
+describe('Windows host Git environment readiness', () => {
+  const originalPath = process.env.Path
+
+  beforeEach(() => {
+    execFileMock.mockReset()
+    spawnMock.mockReset()
+  })
+
+  afterEach(() => {
+    configureWindowsHostGitEnvironmentReadiness(null)
+    if (originalPath === undefined) {
+      delete process.env.Path
+    } else {
+      process.env.Path = originalPath
+    }
+  })
+
+  it('waits for each native operation and refreshes a snapshotted PATH', async () => {
+    await withPlatform('win32', async () => {
+      const ready = deferred()
+      const waitUntilReady = vi.fn(() => ready.promise)
+      const child = createMockChildProcess(1234)
+      execFileMock.mockImplementation((_cmd, _args, _options, callback) => {
+        callback(null, 'ok', '')
+        return child
+      })
+      configureWindowsHostGitEnvironmentReadiness(waitUntilReady)
+      process.env.Path = 'hydrating-path'
+
+      const firstExec = gitExecFileAsync(['status'], {
+        cwd: String.raw`C:\repo`,
+        env: { Path: 'stale-path' }
+      })
+
+      expect(waitUntilReady).toHaveBeenCalledOnce()
+      expect(execFileMock).not.toHaveBeenCalled()
+      process.env.Path = 'hydrated-path'
+      ready.resolve()
+      await expect(firstExec).resolves.toEqual({ stdout: 'ok', stderr: '' })
+      expect(execFileMock.mock.calls[0]?.[2]?.env?.Path).toBe('hydrated-path')
+
+      await expect(gitExecFileAsync(['status'], { cwd: String.raw`C:\repo` })).resolves.toEqual({
+        stdout: 'ok',
+        stderr: ''
+      })
+      expect(waitUntilReady).toHaveBeenCalledTimes(2)
+    })
+  })
+
+  it('waits before native spawned Git and refreshes a snapshotted PATH', async () => {
+    await withPlatform('win32', async () => {
+      const ready = deferred()
+      const waitUntilReady = vi.fn(() => ready.promise)
+      const child = createMockChildProcess(1234)
+      spawnMock.mockReturnValue(child)
+      configureWindowsHostGitEnvironmentReadiness(waitUntilReady)
+      process.env.Path = 'hydrating-path'
+
+      const spawned = gitSpawnAfterWindowsEnvironmentReady(['clone', 'url', 'repo'], {
+        cwd: String.raw`C:\repo`,
+        env: { Path: 'stale-path' },
+        stdio: ['ignore', 'ignore', 'pipe']
+      })
+
+      expect(waitUntilReady).toHaveBeenCalledOnce()
+      expect(spawnMock).not.toHaveBeenCalled()
+      process.env.Path = 'hydrated-path'
+      ready.resolve()
+
+      await expect(spawned).resolves.toBe(child)
+      expect(spawnMock.mock.calls[0]?.[2]?.env?.Path).toBe('hydrated-path')
+    })
+  })
+
+  it('does not gate spawned Git routed through WSL on the Windows host profile', async () => {
+    await withPlatform('win32', async () => {
+      const waitUntilReady = vi.fn(() => new Promise<void>(() => {}))
+      const child = createMockChildProcess(1234)
+      spawnMock.mockReturnValue(child)
+      configureWindowsHostGitEnvironmentReadiness(waitUntilReady)
+
+      await expect(
+        gitSpawnAfterWindowsEnvironmentReady(['clone', 'url', 'repo'], {
+          cwd: String.raw`C:\repo`,
+          wslDistro: 'Ubuntu',
+          stdio: ['ignore', 'ignore', 'pipe']
+        })
+      ).resolves.toBe(child)
+
+      expect(waitUntilReady).not.toHaveBeenCalled()
+      expect(spawnMock).toHaveBeenCalled()
+    })
+  })
+
+  it('does not spawn Git when canceled during Windows environment readiness', async () => {
+    await withPlatform('win32', async () => {
+      const ready = deferred()
+      const controller = new AbortController()
+      configureWindowsHostGitEnvironmentReadiness(() => ready.promise)
+
+      const spawned = gitSpawnAfterWindowsEnvironmentReady(['status'], {
+        cwd: String.raw`C:\repo`,
+        signal: controller.signal,
+        stdio: ['ignore', 'ignore', 'pipe']
+      })
+      controller.abort()
+
+      await expect(spawned).rejects.toMatchObject({ name: 'AbortError' })
+      expect(spawnMock).not.toHaveBeenCalled()
+      ready.resolve()
+    })
+  })
+
+  it('cancels async Git immediately while Windows environment readiness is pending', async () => {
+    await withPlatform('win32', async () => {
+      const ready = deferred()
+      const controller = new AbortController()
+      configureWindowsHostGitEnvironmentReadiness(() => ready.promise)
+
+      const operation = gitExecFileAsync(['status'], {
+        cwd: String.raw`C:\repo`,
+        signal: controller.signal
+      })
+      controller.abort()
+
+      await expect(operation).rejects.toMatchObject({ name: 'AbortError' })
+      expect(execFileMock).not.toHaveBeenCalled()
+      ready.resolve()
+    })
+  })
+
+  it('does not gate WSL paths at a synchronous Git consumer boundary', async () => {
+    await withPlatform('win32', async () => {
+      const waitUntilReady = vi.fn(() => new Promise<void>(() => {}))
+      configureWindowsHostGitEnvironmentReadiness(waitUntilReady)
+
+      await expect(
+        awaitWindowsHostGitEnvironmentReady({
+          cwd: String.raw`\\wsl.localhost\Ubuntu\home\me\repo`
+        })
+      ).resolves.toBeUndefined()
+
+      expect(waitUntilReady).not.toHaveBeenCalled()
+    })
+  })
+
+  it('does not gate Git routed through WSL on the Windows host profile', async () => {
+    await withPlatform('win32', async () => {
+      const waitUntilReady = vi.fn(() => new Promise<void>(() => {}))
+      const child = createMockChildProcess(1234)
+      execFileMock.mockImplementation((_cmd, _args, _options, callback) => {
+        callback(null, 'ok', '')
+        return child
+      })
+      configureWindowsHostGitEnvironmentReadiness(waitUntilReady)
+
+      await expect(
+        gitExecFileAsync(['status'], {
+          cwd: String.raw`C:\repo`,
+          wslDistro: 'Ubuntu'
+        })
+      ).resolves.toEqual({ stdout: 'ok', stderr: '' })
+
+      expect(waitUntilReady).not.toHaveBeenCalled()
+      expect(execFileMock).toHaveBeenCalled()
+    })
+  })
+
+  it('gates buffered native Git reads on the current generation', async () => {
+    await withPlatform('win32', async () => {
+      const ready = deferred()
+      const child = createMockChildProcess(1234)
+      execFileMock.mockImplementation((_cmd, _args, _options, callback) => {
+        callback(null, Buffer.from('blob'), Buffer.alloc(0))
+        return child
+      })
+      configureWindowsHostGitEnvironmentReadiness(() => ready.promise)
+
+      const read = gitExecFileAsyncBuffer(['show', 'HEAD:file'], { cwd: String.raw`C:\repo` })
+      expect(execFileMock).not.toHaveBeenCalled()
+      ready.resolve()
+
+      await expect(read).resolves.toEqual({ stdout: Buffer.from('blob') })
+    })
+  })
+
+  it('gates native Git streams and refreshes their snapshotted PATH', async () => {
+    await withPlatform('win32', async () => {
+      const ready = deferred()
+      const child = createMockChildProcess(1234)
+      spawnMock.mockReturnValue(child)
+      configureWindowsHostGitEnvironmentReadiness(() => ready.promise)
+      process.env.Path = 'hydrated-stream-path'
+
+      const stream = gitStreamStdout(['status'], {
+        cwd: String.raw`C:\repo`,
+        env: { Path: 'stale-stream-path' },
+        onStdout: () => {}
+      })
+      expect(spawnMock).not.toHaveBeenCalled()
+      ready.resolve()
+      await vi.waitFor(() => expect(spawnMock).toHaveBeenCalledOnce())
+      expect(spawnMock.mock.calls[0]?.[2]?.env?.Path).toBe('hydrated-stream-path')
+      child.emit('close', 0)
+
+      await expect(stream).resolves.toEqual({ stoppedEarly: false })
+    })
+  })
+})
diff --git a/src/main/git/runner-wsl-direct-read.test.ts b/src/main/git/runner-wsl-direct-read.test.ts
index f90ea76ad9b..cc6e8364d7f 100644
--- a/src/main/git/runner-wsl-direct-read.test.ts
+++ b/src/main/git/runner-wsl-direct-read.test.ts
@@ -17,12 +17,18 @@ vi.mock('../observability/instrumentation', () => ({
 }))
 vi.mock('../diagnostics/main-thread-churn-probe', () => ({ recordSubprocessSpawn: vi.fn() }))
 
-import { gitExecFileAsync, gitStreamStdout } from './runner'
+import { gitExecFileAsync, gitSpawn, gitStreamStdout } from './runner'
 import {
   getWslGitReadEnvironment,
   resetWslGitReadEnvironmentForTests,
   seedWslGitReadEnvironmentForTests
 } from './wsl-git-read-environment'
+import {
+  prepareWslLinkedWorktreeGitRouting,
+  resetWslLinkedWorktreeGitRoutingForTests,
+  WSL_LINKED_WORKTREE_ROUTE_TTL_MS,
+  type WslLinkedWorktreeRoutingFileSystem
+} from './wsl-linked-worktree-git-routing'
 
 const DISTRO = 'Ubuntu'
 const LOGIN_ENVIRONMENT = {
@@ -71,10 +77,12 @@ describe('WSL direct Git reads', () => {
     execFileSyncMock.mockReset()
     spawnMock.mockReset()
     resetWslGitReadEnvironmentForTests()
+    resetWslLinkedWorktreeGitRoutingForTests()
   })
 
   afterEach(() => {
     resetWslGitReadEnvironmentForTests()
+    resetWslLinkedWorktreeGitRoutingForTests()
   })
 
   it('coalesces the login-shell environment probe per distro', async () => {
@@ -495,4 +503,125 @@ describe('WSL direct Git reads', () => {
       expect(execFileMock.mock.calls[0]?.[0]).toBe('git')
     })
   })
+
+  it('keeps gitSpawn cache-only while async linked-worktree discovery is pending', async () => {
+    await withPlatform('win32', async () => {
+      let releaseStat: (() => void) | undefined
+      const delayedStat = new Promise<void>((resolve) => {
+        releaseStat = resolve
+      })
+      const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+        stat: vi.fn(async () => {
+          await delayedStat
+          return { isDirectory: () => false, isFile: () => true }
+        }),
+        readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+      }
+      const pending = prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, DISTRO, {
+        platform: 'win32',
+        fileSystem
+      })
+      spawnMock.mockReturnValue(createMockChild())
+
+      gitSpawn(['ls-files'], {
+        cwd: String.raw`C:\repo`,
+        wslDistro: DISTRO,
+        stdio: ['ignore', 'pipe', 'pipe']
+      })
+
+      expect(fileSystem.stat).toHaveBeenCalledTimes(1)
+      expect(spawnMock.mock.calls[0]?.[0]).toBe('wsl.exe')
+      releaseStat?.()
+      await expect(pending).resolves.toBe(true)
+
+      gitSpawn(['ls-files'], {
+        cwd: String.raw`C:\repo`,
+        wslDistro: DISTRO,
+        stdio: ['ignore', 'pipe', 'pipe']
+      })
+      expect(fileSystem.stat).toHaveBeenCalledTimes(1)
+      expect(spawnMock.mock.calls[1]?.[0]).toBe('git')
+    })
+  })
+
+  it('aborts an async Git call while linked-worktree discovery remains pending', async () => {
+    await withPlatform('win32', async () => {
+      let releaseStat: (() => void) | undefined
+      const delayedStat = new Promise<void>((resolve) => {
+        releaseStat = resolve
+      })
+      const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+        stat: vi.fn(async () => {
+          await delayedStat
+          return { isDirectory: () => false, isFile: () => true }
+        }),
+        readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+      }
+      const discovery = prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, DISTRO, {
+        platform: 'win32',
+        fileSystem
+      })
+      const controller = new AbortController()
+
+      const command = gitExecFileAsync(['status', '--short'], {
+        cwd: String.raw`C:\repo`,
+        wslDistro: DISTRO,
+        signal: controller.signal
+      })
+      controller.abort()
+
+      await expect(command).rejects.toMatchObject({ name: 'AbortError' })
+      expect(execFileMock).not.toHaveBeenCalled()
+      releaseStat?.()
+      await expect(discovery).resolves.toBe(true)
+    })
+  })
+
+  it('keeps gitSpawn cache-only when a linked-worktree route expires', async () => {
+    await withPlatform('win32', async () => {
+      let currentTime = 1_000
+      const nowSpy = vi.spyOn(Date, 'now').mockImplementation(() => currentTime)
+      try {
+        const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+          stat: vi.fn(async () => ({ isDirectory: () => false, isFile: () => true })),
+          readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+        }
+        await prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, DISTRO, {
+          platform: 'win32',
+          fileSystem
+        })
+        spawnMock.mockReturnValue(createMockChild())
+
+        gitSpawn(['ls-files'], {
+          cwd: String.raw`C:\repo`,
+          wslDistro: DISTRO,
+          stdio: ['ignore', 'pipe', 'pipe']
+        })
+        currentTime += WSL_LINKED_WORKTREE_ROUTE_TTL_MS
+        gitSpawn(['ls-files'], {
+          cwd: String.raw`C:\repo`,
+          wslDistro: DISTRO,
+          stdio: ['ignore', 'pipe', 'pipe']
+        })
+
+        expect(spawnMock.mock.calls[0]?.[0]).toBe('git')
+        expect(spawnMock.mock.calls[1]?.[0]).toBe('wsl.exe')
+        expect(fileSystem.stat).toHaveBeenCalledTimes(1)
+
+        await prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, DISTRO, {
+          platform: 'win32',
+          fileSystem
+        })
+        gitSpawn(['ls-files'], {
+          cwd: String.raw`C:\repo`,
+          wslDistro: DISTRO,
+          stdio: ['ignore', 'pipe', 'pipe']
+        })
+        expect(fileSystem.stat).toHaveBeenCalledTimes(2)
+        expect(spawnMock.mock.calls[2]?.[0]).toBe('git')
+      } finally {
+        nowSpy.mockRestore()
+      }
+    })
+  })
 })
diff --git a/src/main/git/runner-wsl-linked-gitdir-timeout.test.ts b/src/main/git/runner-wsl-linked-gitdir-timeout.test.ts
new file mode 100644
index 00000000000..efc37c192f7
--- /dev/null
+++ b/src/main/git/runner-wsl-linked-gitdir-timeout.test.ts
@@ -0,0 +1,98 @@
+import { EventEmitter } from 'node:events'
+import type * as FsPromises from 'node:fs/promises'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const { execFileMock, statMock, readFileMock } = vi.hoisted(() => ({
+  execFileMock: vi.fn(),
+  statMock: vi.fn(),
+  readFileMock: vi.fn()
+}))
+
+vi.mock('node:child_process', () => ({
+  execFile: execFileMock,
+  execFileSync: vi.fn(),
+  spawn: vi.fn()
+}))
+
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof FsPromises>()),
+  stat: statMock,
+  readFile: readFileMock
+}))
+
+import { gitExecFileAsync } from './runner'
+import {
+  resetWslLinkedWorktreeGitRoutingForTests,
+  WSL_LINKED_WORKTREE_ROUTE_PROBE_TIMEOUT_MS
+} from './wsl-linked-worktree-git-routing'
+
+function createMockChild(): EventEmitter & { pid: number; kill: ReturnType<typeof vi.fn> } {
+  const child = new EventEmitter() as EventEmitter & {
+    pid: number
+    kill: ReturnType<typeof vi.fn>
+  }
+  child.pid = 1234
+  child.kill = vi.fn()
+  return child
+}
+
+async function withWindowsPlatform(run: () => Promise<void>): Promise<void> {
+  const original = process.platform
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  try {
+    await run()
+  } finally {
+    Object.defineProperty(process, 'platform', { configurable: true, value: original })
+  }
+}
+
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  resetWslLinkedWorktreeGitRoutingForTests()
+})
+
+describe('WSL linked-worktree routing probe timeout', () => {
+  it('retries discovery on the next production Git call', async () => {
+    vi.useFakeTimers()
+    await withWindowsPlatform(async () => {
+      statMock
+        .mockImplementationOnce(() => new Promise(() => {}))
+        .mockResolvedValue({ isDirectory: () => false, isFile: () => true })
+      readFileMock.mockResolvedValue('gitdir: C:/main/.git/worktrees/linked\n')
+      execFileMock.mockImplementation((command, _args, _options, callback) => {
+        const child = createMockChild()
+        queueMicrotask(() => {
+          if (command === 'wsl.exe') {
+            callback?.(
+              Object.assign(new Error('not a git repository'), { code: 128 }),
+              '',
+              'fatal: not a git repository'
+            )
+          } else {
+            callback?.(null, 'host git recovered\n', '')
+          }
+        })
+        return child
+      })
+
+      const first = gitExecFileAsync(['status', '--short'], {
+        cwd: String.raw`C:\repo`,
+        wslDistro: 'Ubuntu'
+      })
+      const firstFailure = expect(first).rejects.toThrow('not a git repository')
+      await vi.advanceTimersByTimeAsync(WSL_LINKED_WORKTREE_ROUTE_PROBE_TIMEOUT_MS)
+      await firstFailure
+
+      await expect(
+        gitExecFileAsync(['status', '--short'], {
+          cwd: String.raw`C:\repo`,
+          wslDistro: 'Ubuntu'
+        })
+      ).resolves.toEqual({ stdout: 'host git recovered\n', stderr: '' })
+
+      expect(statMock).toHaveBeenCalledTimes(2)
+      expect(execFileMock.mock.calls.map(([command]) => command)).toEqual(['wsl.exe', 'git'])
+    })
+  })
+})
diff --git a/src/main/git/runner-wsl-linked-gitdir-windows.test.ts b/src/main/git/runner-wsl-linked-gitdir-windows.test.ts
new file mode 100644
index 00000000000..1af46a51069
--- /dev/null
+++ b/src/main/git/runner-wsl-linked-gitdir-windows.test.ts
@@ -0,0 +1,161 @@
+import { execFileSync } from 'node:child_process'
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { listFilesWithGit } from '../ipc/filesystem-list-files-git-fallback'
+import { searchWithGitGrep } from '../ipc/filesystem-search-git'
+import {
+  gitExecFileAsync,
+  gitExecFileAsyncBuffer,
+  gitStreamStdout,
+  toLinuxPath,
+  toWindowsWslPath
+} from './runner'
+import { listWorktrees } from './worktree'
+import { resetWslLinkedWorktreeGitRoutingForTests } from './wsl-linked-worktree-git-routing'
+
+const distro = process.env.ORCA_TEST_WSL_DISTRO?.trim()
+const fixtureRoots: string[] = []
+const wslFixtureRoots: string[] = []
+
+function hostGit(args: string[], cwd: string): string {
+  return execFileSync('git', args, { cwd, encoding: 'utf8' })
+}
+
+function wslExec(args: string[]): string {
+  return execFileSync('wsl.exe', ['-d', distro!, '--exec', ...args], { encoding: 'utf8' })
+}
+
+afterEach(async () => {
+  await Promise.all(
+    fixtureRoots.splice(0).map((path) => rm(path, { recursive: true, force: true }))
+  )
+  for (const path of wslFixtureRoots.splice(0)) {
+    if (!/^\/tmp\/orca-wsl-native-[A-Za-z0-9]+$/.test(path)) {
+      throw new Error(`Refusing to remove unexpected WSL fixture path: ${path}`)
+    }
+    wslExec(['rm', '-rf', '--', path])
+  }
+})
+
+describe.runIf(process.platform === 'win32' && Boolean(distro))(
+  'Windows-authored linked worktree in WSL',
+  () => {
+    it('handles the worktree through the production Git runner', async () => {
+      const fixtureRoot = await mkdtemp(join(process.cwd(), '.wsl-linked-gitdir-'))
+      fixtureRoots.push(fixtureRoot)
+      const mainPath = join(fixtureRoot, 'main')
+      const linkedPath = join(fixtureRoot, 'linked')
+
+      hostGit(['init', mainPath], fixtureRoot)
+      hostGit(['config', 'user.name', 'Orca Test'], mainPath)
+      hostGit(['config', 'user.email', 'test@invalid'], mainPath)
+      await writeFile(join(mainPath, 'tracked.txt'), 'tracked\n')
+      hostGit(['add', 'tracked.txt'], mainPath)
+      hostGit(['commit', '-m', 'fixture'], mainPath)
+      hostGit(['worktree', 'add', '-b', 'linked', linkedPath], mainPath)
+      await writeFile(join(linkedPath, 'untracked.txt'), 'untracked\n')
+
+      const gitFile = await readFile(join(linkedPath, '.git'), 'utf8')
+      expect(gitFile).toMatch(/^gitdir: [A-Za-z]:\//)
+      expect(() =>
+        execFileSync(
+          'wsl.exe',
+          ['-d', distro!, '--exec', 'git', '-C', toLinuxPath(linkedPath), 'status', '--short'],
+          { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }
+        )
+      ).toThrow(/not a git repository/i)
+
+      await expect(listFilesWithGit(linkedPath, [], { wslDistro: distro! })).resolves.toEqual(
+        expect.arrayContaining(['tracked.txt', 'untracked.txt'])
+      )
+      resetWslLinkedWorktreeGitRoutingForTests()
+      await expect(
+        searchWithGitGrep(linkedPath, { query: 'tracked', rootPath: linkedPath }, 10, {
+          wslDistro: distro!
+        })
+      ).resolves.toMatchObject({ totalMatches: 2 })
+
+      let streamedStatus = ''
+      await expect(
+        gitStreamStdout(['status', '--short'], {
+          cwd: linkedPath,
+          wslDistro: distro!,
+          onStdout: (chunk) => {
+            streamedStatus += chunk
+          }
+        })
+      ).resolves.toEqual({ stoppedEarly: false })
+      expect(streamedStatus).toBe('?? untracked.txt\n')
+
+      await gitExecFileAsync(['add', '--', 'untracked.txt'], {
+        cwd: linkedPath,
+        wslDistro: distro!
+      })
+      await expect(
+        gitExecFileAsync(['status', '--short'], { cwd: linkedPath, wslDistro: distro! })
+      ).resolves.toMatchObject({ stdout: 'A  untracked.txt\n' })
+      await expect(
+        gitExecFileAsync(['status', '--short'], { cwd: linkedPath })
+      ).resolves.toMatchObject({ stdout: 'A  untracked.txt\n' })
+      await expect(
+        gitExecFileAsyncBuffer(['show', ':untracked.txt'], {
+          cwd: linkedPath,
+          wslDistro: distro!
+        })
+      ).resolves.toMatchObject({ stdout: Buffer.from('untracked\n') })
+
+      const folderPath = join(linkedPath, 'packages', 'app')
+      await mkdir(folderPath, { recursive: true })
+      await expect(
+        gitExecFileAsync(['rev-parse', '--show-toplevel'], {
+          cwd: folderPath,
+          wslDistro: distro!
+        })
+      ).resolves.toMatchObject({ stdout: `${linkedPath.replace(/\\/g, '/')}\n` })
+
+      const linkedExecPath = await gitExecFileAsync(['--exec-path'], {
+        cwd: linkedPath,
+        wslDistro: distro!
+      })
+      const mainExecPath = await gitExecFileAsync(['--exec-path'], {
+        cwd: mainPath,
+        wslDistro: distro!
+      })
+      expect(linkedExecPath.stdout).toMatch(/^[A-Za-z]:\//)
+      expect(mainExecPath.stdout).toMatch(/(?:^|\n)\/[^\n]+\n$/)
+      await expect(listWorktrees(linkedPath, { wslDistro: distro! })).resolves.toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ path: expect.stringMatching(/[\\/]linked$/) })
+        ])
+      )
+
+      const nestedPath = join(linkedPath, 'nested')
+      wslExec(['git', 'init', toLinuxPath(nestedPath)])
+      await expect(
+        gitExecFileAsync(['--exec-path'], { cwd: nestedPath, wslDistro: distro! })
+      ).resolves.toMatchObject({ stdout: expect.stringMatching(/(?:^|\n)\/[^\n]+\n$/) })
+    })
+
+    it('keeps WSL-native repositories on WSL Git', async () => {
+      const linuxRoot = wslExec(['mktemp', '-d', '/tmp/orca-wsl-native-XXXXXX']).trim()
+      wslFixtureRoots.push(linuxRoot)
+      const windowsRoot = toWindowsWslPath(linuxRoot, distro!)
+
+      wslExec(['git', 'init', linuxRoot])
+      wslExec(['git', '-C', linuxRoot, 'config', 'user.name', 'Orca Test'])
+      wslExec(['git', '-C', linuxRoot, 'config', 'user.email', 'test@invalid'])
+      await writeFile(join(windowsRoot, 'tracked.txt'), 'tracked\n')
+      wslExec(['git', '-C', linuxRoot, 'add', 'tracked.txt'])
+      wslExec(['git', '-C', linuxRoot, 'commit', '-m', 'fixture'])
+      await writeFile(join(windowsRoot, 'untracked.txt'), 'untracked\n')
+
+      await expect(
+        gitExecFileAsync(['status', '--short'], { cwd: windowsRoot, wslDistro: distro! })
+      ).resolves.toMatchObject({ stdout: expect.stringMatching(/(?:^|\n)\?\? untracked\.txt\n$/) })
+      await expect(
+        gitExecFileAsync(['--exec-path'], { cwd: windowsRoot, wslDistro: distro! })
+      ).resolves.toMatchObject({ stdout: expect.stringMatching(/(?:^|\n)\/[^\n]+\n$/) })
+    })
+  }
+)
diff --git a/src/main/git/runner.ts b/src/main/git/runner.ts
index ccde4a492f2..264bd7cbfca 100644
--- a/src/main/git/runner.ts
+++ b/src/main/git/runner.ts
@@ -48,6 +48,11 @@ import {
   peekWslGitReadEnvironment,
   type WslGitReadEnvironment
 } from './wsl-git-read-environment'
+import {
+  isWslLinkedWorktreeGitRoutingCandidate,
+  prepareWslLinkedWorktreeGitRouting,
+  usesHostGitForWslLinkedWorktree
+} from './wsl-linked-worktree-git-routing'
 // Re-exported for existing importers; lightweight consumers should import from './exec-error' to avoid this heavy module.
 import { extractExecError, parseRetryAfterMs } from './exec-error'
 export { extractExecError, parseRetryAfterMs }
@@ -177,12 +182,100 @@ function resolveHostGitHubCli(command: 'gh', args: string[]): ResolvedCommand {
 }
 
 let defaultWslDistroOverride: string | null = null
+let waitForWindowsHostGitEnvironment: (() => Promise<void>) | null = null
 
 // Why: allow host commands fallback to route through the user's pinned WSL distro when host execution fails.
 export function setDefaultWslDistroOverride(distro: string | null): void {
   defaultWslDistroOverride = distro
 }
 
+export function configureWindowsHostGitEnvironmentReadiness(
+  waitUntilReady: (() => Promise<void>) | null
+): void {
+  waitForWindowsHostGitEnvironment = waitUntilReady
+}
+
+export async function awaitWindowsHostGitEnvironmentReady(options: {
+  cwd: string
+  wslDistro?: string
+  signal?: AbortSignal
+}): Promise<void> {
+  const resolved = resolveGitCommand(['--version'], options)
+  await prepareWindowsHostGitEnvironment(resolved, undefined, options.signal)
+}
+
+function refreshWindowsHostPath(env: NodeJS.ProcessEnv | undefined): NodeJS.ProcessEnv | undefined {
+  if (!env) {
+    return undefined
+  }
+  const currentPath = process.env.Path ?? process.env.PATH
+  if (currentPath === undefined) {
+    return env
+  }
+  const next = { ...env }
+  const pathKeys = Object.keys(next).filter((key) => key.toLowerCase() === 'path')
+  if (pathKeys.length === 0) {
+    next[process.env.Path === undefined ? 'PATH' : 'Path'] = currentPath
+  } else {
+    for (const key of pathKeys) {
+      next[key] = currentPath
+    }
+  }
+  return next
+}
+
+function prepareWindowsHostGitEnvironment(
+  resolved: ResolvedCommand,
+  env: NodeJS.ProcessEnv | undefined,
+  signal?: AbortSignal
+): Promise<NodeJS.ProcessEnv | undefined> | null {
+  if (
+    process.platform !== 'win32' ||
+    resolved.wsl !== null ||
+    waitForWindowsHostGitEnvironment === null
+  ) {
+    return null
+  }
+  const ready = waitForWindowsHostGitEnvironment().then(() => refreshWindowsHostPath(env))
+  if (!signal) {
+    return ready
+  }
+  if (signal.aborted) {
+    return Promise.reject(createAbortError())
+  }
+  return new Promise((resolve, reject) => {
+    let settled = false
+    const cleanup = (): void => signal.removeEventListener('abort', onAbort)
+    const onAbort = (): void => {
+      if (settled) {
+        return
+      }
+      settled = true
+      cleanup()
+      reject(createAbortError())
+    }
+    signal.addEventListener('abort', onAbort, { once: true })
+    ready.then(
+      (value) => {
+        if (settled) {
+          return
+        }
+        settled = true
+        cleanup()
+        resolve(value)
+      },
+      (error) => {
+        if (settled) {
+          return
+        }
+        settled = true
+        cleanup()
+        reject(error)
+      }
+    )
+  })
+}
+
 function resolveDefaultWslCli(command: 'gh' | 'glab', args: string[]): ResolvedCommand | null {
   const distro = defaultWslDistroOverride ?? getDefaultWslDistro()
   return distro ? resolveCommand(command, args, undefined, distro) : null
@@ -335,6 +428,10 @@ function resolveGitCommand(
   options: GitExecOptions,
   forceLoginShell = false
 ): ResolvedCommand {
+  if (usesHostGitForWslLinkedWorktree(options.cwd, options.wslDistro)) {
+    // Why: WSL Git resolves a Windows-authored linked-worktree pointer relative to cwd.
+    return { binary: 'git', args, cwd: options.cwd, wsl: null, wslMode: null }
+  }
   if (!forceLoginShell && shouldAttemptWslDirectGit(options)) {
     const distro = wslDistroForCommand(options.cwd, options.wslDistro)
     const environment = distro ? peekWslGitReadEnvironment(distro) : undefined
@@ -908,13 +1005,7 @@ async function buildNetworkSshPolicyEnv(options: GitExecOptions): Promise<{
     return { env: promptEnv, mode: 'explicit-env' }
   }
 
-  const resolved = resolveCommand(
-    'git',
-    ['config', '--get', 'core.sshCommand'],
-    options.cwd,
-    options.wslDistro,
-    { useWslLoginShell: Boolean(options.wslDistro) }
-  )
+  const resolved = resolveGitCommand(['config', '--get', 'core.sshCommand'], options, true)
   let configuredCommand = ''
   try {
     const { stdout } = await execFileCapture(resolved.binary, resolved.args, {
@@ -964,10 +1055,23 @@ export async function gitExecFileAsync(
   return withGitSpan(
     { args, ...(options.cwd !== undefined ? { cwd: options.cwd } : {}) },
     async () => {
-      const resolved = resolveGitCommand(args, options)
-      const policy = options.useConfiguredSshCommandForNetwork
-        ? await buildNetworkSshPolicyEnv(options)
-        : { env: nonInteractiveGitEnv(options.env), mode: 'default' as const }
+      if (isWslLinkedWorktreeGitRoutingCandidate(options.cwd, options.wslDistro)) {
+        await prepareWslLinkedWorktreeGitRouting(options.cwd, options.wslDistro, {
+          signal: options.signal
+        })
+      }
+      let resolved = resolveGitCommand(args, options)
+      const environmentReady = prepareWindowsHostGitEnvironment(
+        resolved,
+        options.env,
+        options.signal
+      )
+      const env = environmentReady ? await environmentReady : options.env
+      const effectiveOptions = env === options.env ? options : { ...options, env }
+      resolved = resolveGitCommand(args, effectiveOptions)
+      const policy = effectiveOptions.useConfiguredSshCommandForNetwork
+        ? await buildNetworkSshPolicyEnv(effectiveOptions)
+        : { env: nonInteractiveGitEnv(effectiveOptions.env), mode: 'default' as const }
       const capture = (
         command: ResolvedCommand
       ): Promise<{ stdout: string | Buffer; stderr: string | Buffer }> =>
@@ -986,7 +1090,7 @@ export async function gitExecFileAsync(
       } catch (error) {
         if (directWslGitExitCode(error, resolved) !== null && !options.signal?.aborted) {
           const wasMissing = invalidateMissingDirectWslGit(error, resolved)
-          result = await capture(resolveGitCommand(args, options, true))
+          result = await capture(resolveGitCommand(args, effectiveOptions, true))
           // Why: matching failures can be normal Git control flow; only a successful login retry proves the direct environment was insufficient.
           disableDirectWslGitAfterSuccessfulFallback(wasMissing, resolved)
           const { stdout, stderr } = result
@@ -1055,9 +1159,15 @@ export async function gitExecFileAsyncBuffer(
   args: string[],
   options: { cwd: string; maxBuffer?: number; wslDistro?: string }
 ): Promise<{ stdout: Buffer }> {
-  const resolved = resolveCommand('git', args, options.cwd, options.wslDistro, {
-    useWslLoginShell: Boolean(options.wslDistro)
-  })
+  if (isWslLinkedWorktreeGitRoutingCandidate(options.cwd, options.wslDistro)) {
+    await prepareWslLinkedWorktreeGitRouting(options.cwd, options.wslDistro)
+  }
+  let resolved = resolveGitCommand(args, options, true)
+  const environmentReady = prepareWindowsHostGitEnvironment(resolved, undefined)
+  if (environmentReady) {
+    await environmentReady
+  }
+  resolved = resolveGitCommand(args, options, true)
   const { stdout } = (await execFileCapture(resolved.binary, resolved.args, {
     cwd: resolved.cwd,
     encoding: 'buffer',
@@ -1098,6 +1208,11 @@ export async function gitStreamStdout(
 ): Promise<GitStreamResult> {
   const maxBuffer = options.maxBuffer ?? DEFAULT_GIT_MAX_BUFFER
   return withGitSpan({ args, cwd: options.cwd }, async () => {
+    if (isWslLinkedWorktreeGitRoutingCandidate(options.cwd, options.wslDistro)) {
+      await prepareWslLinkedWorktreeGitRouting(options.cwd, options.wslDistro, {
+        signal: options.signal
+      })
+    }
     const gitOptions: GitExecOptions = {
       cwd: options.cwd,
       ...(options.env ? { env: options.env } : {}),
@@ -1106,6 +1221,15 @@ export async function gitStreamStdout(
       ...(options.signal ? { signal: options.signal } : {})
     }
     let resolved = resolveGitCommand(args, gitOptions)
+    const environmentReady = prepareWindowsHostGitEnvironment(
+      resolved,
+      gitOptions.env,
+      options.signal
+    )
+    if (environmentReady) {
+      gitOptions.env = await environmentReady
+    }
+    resolved = resolveGitCommand(args, gitOptions)
     const stream = (command: ResolvedCommand): Promise<GitStreamResult> =>
       new Promise<GitStreamResult>((resolve, reject) => {
         if (options.signal?.aborted) {
@@ -1115,7 +1239,7 @@ export async function gitStreamStdout(
         const stdio: SpawnOptions['stdio'] = ['ignore', 'pipe', 'pipe']
         const spawnOptions = {
           cwd: options.cwd,
-          env: nonInteractiveGitEnv(options.env),
+          env: nonInteractiveGitEnv(gitOptions.env),
           stdio,
           wslDistro: options.wslDistro,
           windowsHide: true
@@ -1289,13 +1413,34 @@ export function gitExecFileSync(
  * Spawn a git child process. Drop-in replacement for
  * `spawn('git', args, { cwd, stdio, ... })`.
  */
-export function gitSpawn(
+type GitSpawnOptions = SpawnOptions & { cwd: string; wslDistro?: string }
+
+export async function gitSpawnAfterWindowsEnvironmentReady(
   args: string[],
-  options: SpawnOptions & { cwd: string; wslDistro?: string }
-): ChildProcess {
+  options: GitSpawnOptions
+): Promise<ChildProcess> {
+  if (options.signal?.aborted) {
+    throw createAbortError()
+  }
+  const resolved = resolveGitCommand(args, {
+    cwd: options.cwd,
+    ...(options.wslDistro ? { wslDistro: options.wslDistro } : {}),
+    ...(options.env ? { env: options.env } : {})
+  })
+  const env = await (prepareWindowsHostGitEnvironment(resolved, options.env, options.signal) ??
+    options.env)
+  if (options.signal?.aborted) {
+    throw createAbortError()
+  }
+  return gitSpawn(args, env === options.env ? options : { ...options, env })
+}
+
+export function gitSpawn(args: string[], options: GitSpawnOptions): ChildProcess {
   const { wslDistro, ...spawnOptions } = options
-  const resolved = resolveCommand('git', args, options.cwd, wslDistro, {
-    useWslLoginShell: Boolean(wslDistro)
+  const resolved = resolveGitCommand(args, {
+    cwd: options.cwd,
+    ...(wslDistro ? { wslDistro } : {}),
+    ...(spawnOptions.env ? { env: spawnOptions.env } : {})
   })
   const spawnStartedAt = performance.now()
   const child = spawn(resolved.binary, resolved.args, {
@@ -1438,8 +1583,24 @@ const GH_RETRY_DELAYS_MS = [250, 1000] as const
 const GH_RETRY_AFTER_MAX_MS = 30_000
 const DEFAULT_GH_EXEC_TIMEOUT_MS = 30_000
 
-async function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms))
+async function sleep(ms: number, signal?: AbortSignal): Promise<void> {
+  if (signal?.aborted) {
+    throw createAbortError()
+  }
+  await new Promise<void>((resolve, reject) => {
+    const timer = setTimeout(finish, ms)
+    const onAbort = (): void => finish(createAbortError())
+    function finish(error?: Error): void {
+      clearTimeout(timer)
+      signal?.removeEventListener('abort', onAbort)
+      if (error) {
+        reject(error)
+      } else {
+        resolve()
+      }
+    }
+    signal?.addEventListener('abort', onAbort, { once: true })
+  })
 }
 
 function defaultGhExecTimeoutMs(env: NodeJS.ProcessEnv = process.env): number {
@@ -1611,7 +1772,8 @@ export async function ghExecFileAsync(
         maxBuffer: options.maxBuffer,
         // Why: bound gh so one stuck child fails visibly instead of wedging the IPC lane.
         timeout: options.timeout ?? defaultGhExecTimeoutMs(options.env),
-        env: nonInteractiveGhEnv(options.env)
+        env: nonInteractiveGhEnv(options.env),
+        signal: options.signal
       })
       return { stdout: stdout as string, stderr: stderr as string }
     } catch (err) {
@@ -1653,7 +1815,7 @@ export async function ghExecFileAsync(
           retryAfterMs !== null
             ? Math.min(retryAfterMs, GH_RETRY_AFTER_MAX_MS)
             : GH_RETRY_DELAYS_MS[attempt]
-        await sleep(delayMs)
+        await sleep(delayMs, options.signal)
         continue
       }
       throw err
diff --git a/src/main/git/status-conflict-overlap.bench.test.ts b/src/main/git/status-conflict-overlap.bench.test.ts
new file mode 100644
index 00000000000..5c92a23e10c
--- /dev/null
+++ b/src/main/git/status-conflict-overlap.bench.test.ts
@@ -0,0 +1,250 @@
+import { performance } from 'node:perf_hooks'
+import { join } from 'node:path'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFsPromises from 'node:fs/promises'
+import type * as GitRunner from './runner'
+import type { GitExec } from '../../relay/git-handler-ops'
+import type { RelayGitStreamExec } from '../../relay/git-stdout-stream'
+
+const { gitStreamStdoutMock, readFileMock } = vi.hoisted(() => ({
+  gitStreamStdoutMock: vi.fn(),
+  readFileMock: vi.fn()
+}))
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeFsPromises>()
+  return { ...actual, readFile: readFileMock }
+})
+
+vi.mock('./runner', async (importOriginal) => {
+  const actual = await importOriginal<typeof GitRunner>()
+  return { ...actual, gitStreamStdout: gitStreamStdoutMock }
+})
+
+import { getStatus } from './status'
+import { getStatusOp } from '../../relay/git-handler-status-ops'
+
+const BENCH_DELAY_MS = 25
+const BENCH_SAMPLES = 31
+const BENCH_WARMUPS = 5
+const describeBench = process.env.ORCA_GIT_STATUS_OVERLAP_BENCH === '1' ? describe : describe.skip
+
+type Deferred<T> = {
+  promise: Promise<T>
+  resolve: (value: T) => void
+}
+
+type BenchmarkResult = {
+  path: string
+  medianMs: number
+  p95Ms: number
+  minMs: number
+  maxMs: number
+}
+
+function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((innerResolve) => {
+    resolve = innerResolve
+  })
+  return { promise, resolve }
+}
+
+function wait(delayMs: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, delayMs))
+}
+
+function percentile(samples: number[], fraction: number): number {
+  const sorted = [...samples].sort((a, b) => a - b)
+  return sorted[Math.ceil(sorted.length * fraction) - 1]!
+}
+
+describe('git status conflict-read overlap', () => {
+  const relayGit: GitExec = async () => ({ stdout: '', stderr: '' })
+
+  beforeEach(() => {
+    readFileMock.mockReset()
+    gitStreamStdoutMock.mockReset()
+    readFileMock.mockResolvedValue('gitdir: /repo/.git/worktrees/feature\n')
+    gitStreamStdoutMock.mockResolvedValue({ stoppedEarly: false })
+  })
+
+  it('starts native status before conflict-marker I/O settles', async () => {
+    const markerRead = deferred<string>()
+    const statusStarted = deferred<void>()
+    readFileMock.mockReturnValue(markerRead.promise)
+    gitStreamStdoutMock.mockImplementation(async () => {
+      statusStarted.resolve()
+      return { stoppedEarly: false }
+    })
+
+    const resultPromise = getStatus('/repo')
+    await statusStarted.promise
+    expect(readFileMock).toHaveBeenCalledWith(join('/repo', '.git'), 'utf-8')
+
+    markerRead.resolve('gitdir: /repo/.git/worktrees/feature\n')
+    await expect(resultPromise).resolves.toMatchObject({
+      entries: [],
+      conflictOperation: 'unknown'
+    })
+  })
+
+  it('starts relay status before conflict-marker I/O settles', async () => {
+    const markerRead = deferred<string>()
+    const statusStarted = deferred<void>()
+    readFileMock.mockReturnValue(markerRead.promise)
+    const relayStreamGit: RelayGitStreamExec = async () => {
+      statusStarted.resolve()
+      return { stoppedEarly: false }
+    }
+
+    const resultPromise = getStatusOp(relayGit, relayStreamGit, { worktreePath: '/repo' })
+    await statusStarted.promise
+    expect(readFileMock).toHaveBeenCalledWith(join('/repo', '.git'), 'utf-8')
+
+    markerRead.resolve('gitdir: /repo/.git/worktrees/feature\n')
+    await expect(resultPromise).resolves.toMatchObject({
+      entries: [],
+      conflictOperation: 'unknown'
+    })
+  })
+
+  it('observes an early native status rejection while marker I/O remains pending', async () => {
+    const markerRead = deferred<string>()
+    readFileMock.mockReturnValue(markerRead.promise)
+    gitStreamStdoutMock.mockRejectedValue(new Error('status failed first'))
+    let settled = false
+
+    const resultPromise = getStatus('/repo').finally(() => {
+      settled = true
+    })
+    await Promise.resolve()
+    await Promise.resolve()
+    expect(settled).toBe(false)
+
+    markerRead.resolve('gitdir: /repo/.git/worktrees/feature\n')
+    await expect(resultPromise).resolves.toMatchObject({
+      entries: [],
+      conflictOperation: 'unknown'
+    })
+  })
+
+  it('keeps a synchronous native status failure fail-soft', async () => {
+    const statusError = new Error('status threw')
+    gitStreamStdoutMock.mockImplementation(() => {
+      throw statusError
+    })
+
+    await expect(getStatus('/repo')).resolves.toMatchObject({
+      entries: [],
+      conflictOperation: 'unknown'
+    })
+  })
+
+  it.each(['throw', 'reject'] as const)('keeps relay %s failures fail-soft', async (mode) => {
+    const statusError = new Error(`status ${mode}`)
+    const relayStreamGit = (() => {
+      if (mode === 'throw') {
+        throw statusError
+      }
+      return Promise.reject(statusError)
+    }) as RelayGitStreamExec
+
+    await expect(
+      getStatusOp(relayGit, relayStreamGit, { worktreePath: '/repo' })
+    ).resolves.toMatchObject({ entries: [], conflictOperation: 'unknown' })
+  })
+
+  it('rethrows the original relay status failure after cancellation', async () => {
+    const controller = new AbortController()
+    const statusError = new Error('cancelled status')
+    const relayStreamGit: RelayGitStreamExec = async () => {
+      controller.abort(statusError)
+      throw statusError
+    }
+
+    await expect(
+      getStatusOp(
+        relayGit,
+        relayStreamGit,
+        { worktreePath: '/repo' },
+        { signal: controller.signal }
+      )
+    ).rejects.toBe(statusError)
+  })
+
+  it('surfaces detector errors without waiting for a hung status read', async () => {
+    const statusStarted = deferred<void>()
+    const relayStreamGit: RelayGitStreamExec = () => {
+      statusStarted.resolve()
+      return new Promise(() => {})
+    }
+    const invalidPath = { toString: () => '/repo' }
+
+    const resultPromise = getStatusOp(relayGit, relayStreamGit, {
+      worktreePath: invalidPath
+    })
+    const rejection = expect(resultPromise).rejects.toThrow(TypeError)
+    await statusStarted.promise
+    await rejection
+  })
+
+  it('keeps detector errors ahead of concurrent status failures', async () => {
+    const statusError = new Error('status failed too')
+    const relayStreamGit = (() => {
+      throw statusError
+    }) as RelayGitStreamExec
+    const invalidPath = { toString: () => '/repo' }
+
+    const result = getStatusOp(relayGit, relayStreamGit, { worktreePath: invalidPath })
+    await expect(result).rejects.toBeInstanceOf(TypeError)
+  })
+})
+
+describeBench('git status conflict-read overlap benchmark', () => {
+  it('measures native and relay orchestration with matched independent latency', async () => {
+    readFileMock.mockImplementation(async () => {
+      await wait(BENCH_DELAY_MS)
+      return 'gitdir: /repo/.git/worktrees/feature\n'
+    })
+    gitStreamStdoutMock.mockImplementation(async () => {
+      await wait(BENCH_DELAY_MS)
+      return { stoppedEarly: false }
+    })
+    const relayGit: GitExec = async () => ({ stdout: '', stderr: '' })
+    const relayStreamGit: RelayGitStreamExec = async () => {
+      await wait(BENCH_DELAY_MS)
+      return { stoppedEarly: false }
+    }
+    const cases = [
+      { name: 'native', run: () => getStatus('/repo') },
+      {
+        name: 'relay',
+        run: () => getStatusOp(relayGit, relayStreamGit, { worktreePath: '/repo' })
+      }
+    ]
+
+    const results: BenchmarkResult[] = []
+    for (const benchmarkCase of cases) {
+      for (let index = 0; index < BENCH_WARMUPS; index += 1) {
+        await benchmarkCase.run()
+      }
+      const samples: number[] = []
+      for (let index = 0; index < BENCH_SAMPLES; index += 1) {
+        const startedAt = performance.now()
+        await benchmarkCase.run()
+        samples.push(performance.now() - startedAt)
+      }
+      results.push({
+        path: benchmarkCase.name,
+        medianMs: Number(percentile(samples, 0.5).toFixed(3)),
+        p95Ms: Number(percentile(samples, 0.95).toFixed(3)),
+        minMs: Number(Math.min(...samples).toFixed(3)),
+        maxMs: Number(Math.max(...samples).toFixed(3))
+      })
+    }
+
+    console.table(results)
+    expect(results).toHaveLength(2)
+  }, 10_000)
+})
diff --git a/src/main/git/status.ts b/src/main/git/status.ts
index 07bf124d31c..a51d1784ddf 100644
--- a/src/main/git/status.ts
+++ b/src/main/git/status.ts
@@ -315,22 +315,32 @@ async function runGetStatus(
   // Why: stream + parse and stop at `limit` so a huge un-ignored folder can't buffer enough to crash the process.
   const parser = new StatusPorcelainParser()
   let didHitLimit = false
+  // Why: attach rejection ownership before awaiting marker I/O, so a fast Git failure cannot become unhandled.
+  const statusSettlementPromise = Promise.allSettled([
+    (async () => {
+      const result = await gitStreamStdout(statusArgs, {
+        cwd: worktreePath,
+        wslDistro: options.wslDistro,
+        preferWslDirectGit: true,
+        // Why: status polling is read-like; disable optional locks to avoid racing terminal Git on index.lock.
+        env: gitOptionalLocksDisabledEnv(),
+        signal: options.signal,
+        onStdout: (chunk) => parser.update(chunk, limit)
+      })
+      if (!result.stoppedEarly) {
+        parser.finish()
+      }
+      return result
+    })()
+  ])
   const conflictOperation = await conflictPromise
 
   try {
-    const { stoppedEarly } = await gitStreamStdout(statusArgs, {
-      cwd: worktreePath,
-      wslDistro: options.wslDistro,
-      preferWslDirectGit: true,
-      // Why: status polling is read-like; disable optional locks to avoid racing terminal Git on index.lock.
-      env: gitOptionalLocksDisabledEnv(),
-      signal: options.signal,
-      onStdout: (chunk) => parser.update(chunk, limit)
-    })
-    if (!stoppedEarly) {
-      parser.finish()
+    const [statusResult] = await statusSettlementPromise
+    if (statusResult.status === 'rejected') {
+      throw statusResult.reason
     }
-    didHitLimit = stoppedEarly
+    didHitLimit = statusResult.value.stoppedEarly
     statusSucceeded = true
   } catch (error) {
     // Why: an aborted scan must reject, not resolve as an empty result.
diff --git a/src/main/git/worktree.ts b/src/main/git/worktree.ts
index 064eb0887fd..9ee8eb2e188 100644
--- a/src/main/git/worktree.ts
+++ b/src/main/git/worktree.ts
@@ -30,7 +30,7 @@ import {
   isUnsupportedRevParsePathFormatError,
   isUnsupportedWorktreeListZError
 } from '../../shared/git-worktree-command-capabilities'
-import { getLocalGitCapabilityCache } from './git-capability-state'
+import { withLocalGitCapabilityCacheForExecution } from './git-capability-state'
 import { gitExecFileAsync, translateWslOutputPaths } from './runner'
 import { resolveGitDir, runWithGitReadCacheInvalidation } from './status'
 import { hasWorktreeBaseCommitRef } from './worktree-base-ref-probe'
@@ -410,32 +410,32 @@ async function readRepoLocation(
   resolveBasePath: string,
   options: GitWorktreeExecOptions = {}
 ): Promise<RepoLocation | undefined> {
-  const capabilities = getLocalGitCapabilityCache({
-    cwd: repoPath,
-    wslDistro: options.wslDistro
-  })
   try {
-    return await capabilities.runWithFallback(
-      'rev-parse-path-format',
-      async () => {
-        const { stdout } = await gitExecFileAsync(
-          ['rev-parse', '--path-format=absolute', '--show-toplevel', '--git-common-dir'],
-          gitExecOptions(repoPath, options)
+    return await withLocalGitCapabilityCacheForExecution(
+      { cwd: repoPath, wslDistro: options.wslDistro, signal: options.signal },
+      (capabilities) =>
+        capabilities.runWithFallback(
+          'rev-parse-path-format',
+          async () => {
+            const { stdout } = await gitExecFileAsync(
+              ['rev-parse', '--path-format=absolute', '--show-toplevel', '--git-common-dir'],
+              gitExecOptions(repoPath, options)
+            )
+            if (hasUnsupportedRevParsePathFormatEcho(stdout)) {
+              // Why: some old Git echoes the unknown option and exits zero; remember that compat signal even though parsing recovers.
+              capabilities.rememberUnsupported('rev-parse-path-format')
+            }
+            return parseRepoLocation(resolveBasePath, stdout)
+          },
+          async () => {
+            const { stdout } = await gitExecFileAsync(
+              ['rev-parse', '--show-toplevel', '--git-common-dir'],
+              gitExecOptions(repoPath, options)
+            )
+            return parseRepoLocation(resolveBasePath, stdout)
+          },
+          isUnsupportedRevParsePathFormatError
         )
-        if (hasUnsupportedRevParsePathFormatEcho(stdout)) {
-          // Why: some old Git echoes the unknown option and exits zero; remember that compat signal even though parsing recovers.
-          capabilities.rememberUnsupported('rev-parse-path-format')
-        }
-        return parseRepoLocation(resolveBasePath, stdout)
-      },
-      async () => {
-        const { stdout } = await gitExecFileAsync(
-          ['rev-parse', '--show-toplevel', '--git-common-dir'],
-          gitExecOptions(repoPath, options)
-        )
-        return parseRepoLocation(resolveBasePath, stdout)
-      },
-      isUnsupportedRevParsePathFormatError
     )
   } catch {
     return undefined
@@ -578,41 +578,44 @@ async function readWorktreeList(
   repoPath: string,
   options: GitWorktreeExecOptions = {}
 ): Promise<GitWorktreeInfo[]> {
-  const capabilities = getLocalGitCapabilityCache({
-    cwd: repoPath,
-    wslDistro: options.wslDistro
-  })
   const execOptions = {
     cwd: repoPath,
     ...options,
     timeout: options.timeout ?? WORKTREE_LIST_TIMEOUT_MS
   }
-  return capabilities.runWithFallback(
-    'worktree-list-z',
-    async () => {
-      const { stdout } = await gitExecFileAsync(
-        ['worktree', 'list', '--porcelain', '-z'],
-        execOptions
+  return withLocalGitCapabilityCacheForExecution(
+    { cwd: repoPath, wslDistro: options.wslDistro, signal: options.signal },
+    (capabilities) =>
+      capabilities.runWithFallback(
+        'worktree-list-z',
+        async () => {
+          const { stdout } = await gitExecFileAsync(
+            ['worktree', 'list', '--porcelain', '-z'],
+            execOptions
+          )
+          return normalizeMainWorktreePath(
+            repoPath,
+            parseWorktreeList(stdout, { nulDelimited: true }),
+            options
+          )
+        },
+        async () => {
+          // Why: `-z` preserves worktree paths with newlines but Git <2.36 rejects it; fall back to the line parser.
+          const { stdout } = await gitExecFileAsync(
+            ['worktree', 'list', '--porcelain'],
+            execOptions
+          )
+          const normalized = await normalizeMainWorktreePath(
+            repoPath,
+            parseWorktreeList(stdout),
+            options
+          )
+          // Why: Git <2.31 emits no `prunable`, so probe each linked path for existence instead of trusting
+          // stale registrations; a harmless backstop on 2.31–2.35 where parseWorktreeList already set it (#8389).
+          return annotatePrunableByExistence(normalized, repoPath, options)
+        },
+        isUnsupportedWorktreeListZError
       )
-      return normalizeMainWorktreePath(
-        repoPath,
-        parseWorktreeList(stdout, { nulDelimited: true }),
-        options
-      )
-    },
-    async () => {
-      // Why: `-z` preserves worktree paths with newlines but Git <2.36 rejects it; fall back to the line parser.
-      const { stdout } = await gitExecFileAsync(['worktree', 'list', '--porcelain'], execOptions)
-      const normalized = await normalizeMainWorktreePath(
-        repoPath,
-        parseWorktreeList(stdout),
-        options
-      )
-      // Why: Git <2.31 emits no `prunable`, so probe each linked path for existence instead of trusting
-      // stale registrations; a harmless backstop on 2.31–2.35 where parseWorktreeList already set it (#8389).
-      return annotatePrunableByExistence(normalized, repoPath, options)
-    },
-    isUnsupportedWorktreeListZError
   )
 }
 
@@ -1355,14 +1358,12 @@ async function deleteAlreadyMergedBranchAfterSafeDeleteFailure(
     })
   const targetRefs = await getBranchCleanupTargetRefs(runGit, branchName)
   // Why: squash merges rewrite commit IDs, so `branch -d` rejects already-merged branches; delete only when Git proves no unmerged tree changes.
-  if (
-    !(await branchHasNoUnmergedChangesWithLazyTargetRefresh(
-      runGit,
-      branchName,
-      targetRefs,
-      getLocalGitCapabilityCache({ cwd: repoPath, wslDistro: options.wslDistro })
-    ))
-  ) {
+  const hasNoUnmergedChanges = await withLocalGitCapabilityCacheForExecution(
+    { cwd: repoPath, wslDistro: options.wslDistro, signal: options.signal },
+    (capabilities) =>
+      branchHasNoUnmergedChangesWithLazyTargetRefresh(runGit, branchName, targetRefs, capabilities)
+  )
+  if (!hasNoUnmergedChanges) {
     return false
   }
   await forceDeleteLocalBranch(repoPath, branchName, branchHead, (args, cwd) =>
diff --git a/src/main/git/wsl-git-read-environment.ts b/src/main/git/wsl-git-read-environment.ts
index f67d696a37b..7df86a44a94 100644
--- a/src/main/git/wsl-git-read-environment.ts
+++ b/src/main/git/wsl-git-read-environment.ts
@@ -26,7 +26,7 @@ function parseProbe(stdout: string): WslGitReadEnvironment | null {
   const gitPath = fields[markerIndex + 2] ?? ''
   const home = fields[markerIndex + 3] ?? ''
   if (
-    markerIndex < 0 ||
+    markerIndex === -1 ||
     !path.includes('/') ||
     path.length > 32_768 ||
     !gitPath.startsWith('/') ||
diff --git a/src/main/git/wsl-linked-worktree-git-routing.test.ts b/src/main/git/wsl-linked-worktree-git-routing.test.ts
new file mode 100644
index 00000000000..9ab07309b1f
--- /dev/null
+++ b/src/main/git/wsl-linked-worktree-git-routing.test.ts
@@ -0,0 +1,600 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  parseWindowsLinkedGitdir,
+  prepareWslLinkedWorktreeGitRouting,
+  resetWslLinkedWorktreeGitRoutingForTests,
+  seedWslLinkedWorktreeGitRoutingForTests,
+  usesHostGitForWslLinkedWorktree,
+  WSL_LINKED_WORKTREE_ROUTE_CACHE_PRUNE_THRESHOLD,
+  WSL_LINKED_WORKTREE_ROUTE_MAX_PROBES_PER_CWD,
+  WSL_LINKED_WORKTREE_ROUTE_MAX_PROBES_TOTAL,
+  WSL_LINKED_WORKTREE_ROUTE_PROBE_TIMEOUT_MS,
+  WSL_LINKED_WORKTREE_ROUTE_RETRY_BASE_MS,
+  WSL_LINKED_WORKTREE_ROUTE_TTL_MS,
+  type WslLinkedWorktreeRoutingFileSystem
+} from './wsl-linked-worktree-git-routing'
+
+afterEach(() => resetWslLinkedWorktreeGitRoutingForTests())
+
+const fileMarker = { isDirectory: () => false, isFile: () => true }
+const directoryMarker = { isDirectory: () => true, isFile: () => false }
+
+function missingMarker(): NodeJS.ErrnoException {
+  return Object.assign(new Error('missing'), { code: 'ENOENT' })
+}
+
+describe('parseWindowsLinkedGitdir', () => {
+  it.each([
+    ['gitdir: C:/repo/.git/worktrees/linked\n', 'C:/repo/.git/worktrees/linked'],
+    [String.raw`gitdir: D:\repo\.git\worktrees\linked`, String.raw`D:\repo\.git\worktrees\linked`]
+  ])('accepts a Windows drive-qualified gitdir', (content, expected) => {
+    expect(parseWindowsLinkedGitdir(content)).toBe(expected)
+  })
+
+  it.each([
+    'gitdir: ../main/.git/worktrees/linked',
+    'gitdir: /home/dev/repo/.git/worktrees/linked',
+    'gitdir: C:repo/.git/worktrees/linked',
+    'not a gitdir'
+  ])('rejects the non-Windows-linked marker %s', (content) => {
+    expect(parseWindowsLinkedGitdir(content)).toBeNull()
+  })
+})
+
+describe('usesHostGitForWslLinkedWorktree', () => {
+  it('scopes a cached route to the exact primed folder workspace', () => {
+    seedWslLinkedWorktreeGitRoutingForTests(String.raw`C:\repo\linked\packages\app`)
+
+    expect(
+      usesHostGitForWslLinkedWorktree(String.raw`C:\repo\linked\packages\app`, 'Ubuntu', 'win32')
+    ).toBe(true)
+    expect(usesHostGitForWslLinkedWorktree('C:/repo/linked/packages/app/', 'Ubuntu', 'win32')).toBe(
+      true
+    )
+    expect(usesHostGitForWslLinkedWorktree(String.raw`C:\repo\main`, 'Ubuntu', 'win32')).toBe(false)
+  })
+
+  it('does not affect native Windows, WSL-native, or non-Windows execution', () => {
+    seedWslLinkedWorktreeGitRoutingForTests(String.raw`C:\repo\linked`)
+
+    expect(usesHostGitForWslLinkedWorktree(String.raw`C:\repo\linked`, undefined, 'win32')).toBe(
+      false
+    )
+    expect(
+      usesHostGitForWslLinkedWorktree(
+        '\\\\wsl.localhost\\Ubuntu\\home\\dev\\repo',
+        'Ubuntu',
+        'win32'
+      )
+    ).toBe(false)
+    expect(usesHostGitForWslLinkedWorktree(String.raw`C:\repo\linked`, 'Ubuntu', 'linux')).toBe(
+      false
+    )
+  })
+})
+
+describe('prepareWslLinkedWorktreeGitRouting', () => {
+  it('discovers parent markers independently for sibling folder workspaces', async () => {
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(async (path) => {
+        if (path === String.raw`C:\repo\.git`) {
+          return fileMarker
+        }
+        throw missingMarker()
+      }),
+      readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+    }
+
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo\packages\app`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(true)
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo\packages\other`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(true)
+    expect(fileSystem.stat).toHaveBeenCalledTimes(6)
+    expect(fileSystem.readFile).toHaveBeenCalledTimes(2)
+  })
+
+  it('caches an ordinary repository marker without reading it', async () => {
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(async () => directoryMarker),
+      readFile: vi.fn(async () => '')
+    }
+
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(false)
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(false)
+    expect(fileSystem.stat).toHaveBeenCalledTimes(1)
+    expect(fileSystem.readFile).not.toHaveBeenCalled()
+  })
+
+  it('fails closed without caching a marker read error', async () => {
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(async () => fileMarker),
+      readFile: vi
+        .fn<WslLinkedWorktreeRoutingFileSystem['readFile']>()
+        .mockRejectedValueOnce(Object.assign(new Error('access denied'), { code: 'EACCES' }))
+        .mockResolvedValueOnce('gitdir: C:/main/.git/worktrees/linked\n')
+    }
+
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(false)
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(true)
+    expect(fileSystem.stat).toHaveBeenCalledTimes(2)
+    expect(fileSystem.readFile).toHaveBeenCalledTimes(2)
+  })
+
+  it('backs off repeated marker stat errors after one immediate retry', async () => {
+    let currentTime = 1_000
+    const now = (): number => currentTime
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(async () => {
+        throw Object.assign(new Error('device unavailable'), { code: 'EIO' })
+      }),
+      readFile: vi.fn(async () => '')
+    }
+    const prepare = (): Promise<boolean> =>
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem,
+        now
+      })
+
+    await expect(prepare()).resolves.toBe(false)
+    await expect(prepare()).resolves.toBe(false)
+    await expect(prepare()).resolves.toBe(false)
+    currentTime += WSL_LINKED_WORKTREE_ROUTE_RETRY_BASE_MS - 1
+    await expect(prepare()).resolves.toBe(false)
+    expect(fileSystem.stat).toHaveBeenCalledTimes(2)
+
+    currentTime += 1
+    await expect(prepare()).resolves.toBe(false)
+    expect(fileSystem.stat).toHaveBeenCalledTimes(3)
+  })
+
+  it('does not inherit a linked-parent route across a nested repository boundary', async () => {
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(async (path) =>
+        path === String.raw`C:\repo\linked\nested\.git` ? directoryMarker : fileMarker
+      ),
+      readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+    }
+
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo\linked`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(true)
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo\linked\nested`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(false)
+    expect(
+      usesHostGitForWslLinkedWorktree(String.raw`C:\repo\linked\nested`, 'Ubuntu', 'win32')
+    ).toBe(false)
+  })
+
+  it('does not conflate case-distinct directories on case-sensitive Windows storage', async () => {
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(async (path) =>
+        path === String.raw`C:\Repo\.git` ? fileMarker : directoryMarker
+      ),
+      readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+    }
+
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\Repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(true)
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(false)
+  })
+
+  it('revalidates a linked route that becomes an ordinary repository', async () => {
+    let linked = true
+    let currentTime = 1_000
+    const now = (): number => currentTime
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(async () => (linked ? fileMarker : directoryMarker)),
+      readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+    }
+
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem,
+        now
+      })
+    ).resolves.toBe(true)
+    linked = false
+    currentTime += WSL_LINKED_WORKTREE_ROUTE_TTL_MS - 1
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem,
+        now
+      })
+    ).resolves.toBe(true)
+    expect(fileSystem.stat).toHaveBeenCalledTimes(1)
+
+    currentTime += 1
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem,
+        now
+      })
+    ).resolves.toBe(false)
+    expect(usesHostGitForWslLinkedWorktree(String.raw`C:\repo`, 'Ubuntu', 'win32', now)).toBe(false)
+    expect(fileSystem.stat).toHaveBeenCalledTimes(2)
+    expect(fileSystem.readFile).toHaveBeenCalledTimes(1)
+  })
+
+  it('revalidates an ordinary repository that becomes a linked worktree', async () => {
+    let linked = false
+    let currentTime = 1_000
+    const now = (): number => currentTime
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(async () => (linked ? fileMarker : directoryMarker)),
+      readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+    }
+
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem,
+        now
+      })
+    ).resolves.toBe(false)
+    linked = true
+    currentTime += WSL_LINKED_WORKTREE_ROUTE_TTL_MS - 1
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem,
+        now
+      })
+    ).resolves.toBe(false)
+    expect(fileSystem.stat).toHaveBeenCalledTimes(1)
+
+    currentTime += 1
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem,
+        now
+      })
+    ).resolves.toBe(true)
+    expect(usesHostGitForWslLinkedWorktree(String.raw`C:\repo`, 'Ubuntu', 'win32', now)).toBe(true)
+    expect(fileSystem.stat).toHaveBeenCalledTimes(2)
+    expect(fileSystem.readFile).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not let a sibling route supersede an unexpired nested-repository miss', async () => {
+    let linked = false
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(async (path) => {
+        if (path === String.raw`C:\repo\.git`) {
+          return linked ? fileMarker : directoryMarker
+        }
+        throw missingMarker()
+      }),
+      readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+    }
+
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo\packages\app`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(false)
+    linked = true
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo\packages\other`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(true)
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo\packages\app`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(false)
+    expect(fileSystem.stat).toHaveBeenCalledTimes(6)
+  })
+
+  it('does not evict fresh routes while pruning under working-directory churn', async () => {
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(async () => fileMarker),
+      readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+    }
+
+    for (let index = 0; index <= WSL_LINKED_WORKTREE_ROUTE_CACHE_PRUNE_THRESHOLD; index += 1) {
+      await prepareWslLinkedWorktreeGitRouting(`C:\\repo-${index}`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    }
+
+    expect(usesHostGitForWslLinkedWorktree(String.raw`C:\repo-0`, 'Ubuntu', 'win32')).toBe(true)
+    expect(
+      usesHostGitForWslLinkedWorktree(
+        `C:\\repo-${WSL_LINKED_WORKTREE_ROUTE_CACHE_PRUNE_THRESHOLD}`,
+        'Ubuntu',
+        'win32'
+      )
+    ).toBe(true)
+  })
+
+  it('coalesces delayed discovery without blocking an event-loop turn', async () => {
+    let releaseStat: ((marker: typeof fileMarker) => void) | undefined
+    const delayedStat = new Promise<typeof fileMarker>((resolve) => {
+      releaseStat = resolve
+    })
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(() => delayedStat),
+      readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+    }
+    let settled = false
+
+    const first = prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+      platform: 'win32',
+      fileSystem
+    }).finally(() => {
+      settled = true
+    })
+    const second = prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+      platform: 'win32',
+      fileSystem
+    })
+    await new Promise<void>((resolve) => setImmediate(resolve))
+
+    expect(settled).toBe(false)
+    expect(fileSystem.stat).toHaveBeenCalledTimes(1)
+    releaseStat?.(fileMarker)
+    await expect(Promise.all([first, second])).resolves.toEqual([true, true])
+    expect(fileSystem.readFile).toHaveBeenCalledTimes(1)
+  })
+
+  it('cancels a waiter without canceling or duplicating shared discovery', async () => {
+    let releaseStat: ((marker: typeof fileMarker) => void) | undefined
+    const delayedStat = new Promise<typeof fileMarker>((resolve) => {
+      releaseStat = resolve
+    })
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(() => delayedStat),
+      readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+    }
+    const controller = new AbortController()
+
+    const cancelled = prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+      platform: 'win32',
+      fileSystem,
+      signal: controller.signal
+    })
+    controller.abort()
+
+    await expect(cancelled).rejects.toMatchObject({ name: 'AbortError' })
+    expect(fileSystem.stat).toHaveBeenCalledTimes(1)
+    releaseStat?.(fileMarker)
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+    ).resolves.toBe(true)
+    expect(fileSystem.stat).toHaveBeenCalledTimes(1)
+  })
+
+  it('ignores an old probe that settles after reset and a new same-path probe starts', async () => {
+    let releaseOld: ((marker: typeof fileMarker) => void) | undefined
+    const oldMarker = new Promise<typeof fileMarker>((resolve) => {
+      releaseOld = resolve
+    })
+    const oldFileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(() => oldMarker),
+      readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+    }
+    const oldRoute = prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+      platform: 'win32',
+      fileSystem: oldFileSystem
+    })
+
+    resetWslLinkedWorktreeGitRoutingForTests()
+    let releaseCurrent: ((marker: typeof directoryMarker) => void) | undefined
+    const currentMarker = new Promise<typeof directoryMarker>((resolve) => {
+      releaseCurrent = resolve
+    })
+    const currentFileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi.fn(() => currentMarker),
+      readFile: vi.fn(async () => '')
+    }
+    const currentRoute = prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+      platform: 'win32',
+      fileSystem: currentFileSystem
+    })
+
+    releaseOld?.(fileMarker)
+    await expect(oldRoute).resolves.toBe(false)
+    expect(usesHostGitForWslLinkedWorktree(String.raw`C:\repo`, 'Ubuntu', 'win32')).toBe(false)
+    const currentJoiner = prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+      platform: 'win32',
+      fileSystem: currentFileSystem
+    })
+    expect(currentFileSystem.stat).toHaveBeenCalledTimes(1)
+
+    releaseCurrent?.(directoryMarker)
+    await expect(Promise.all([currentRoute, currentJoiner])).resolves.toEqual([false, false])
+    expect(currentFileSystem.stat).toHaveBeenCalledTimes(1)
+  })
+
+  it('fails closed and retries after a stalled discovery deadline', async () => {
+    vi.useFakeTimers()
+    try {
+      const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+        stat: vi
+          .fn<WslLinkedWorktreeRoutingFileSystem['stat']>()
+          .mockImplementationOnce(() => new Promise<typeof fileMarker>(() => {}))
+          .mockResolvedValueOnce(fileMarker),
+        readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+      }
+
+      const first = prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+      const second = prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem
+      })
+      await vi.advanceTimersByTimeAsync(WSL_LINKED_WORKTREE_ROUTE_PROBE_TIMEOUT_MS)
+
+      await expect(Promise.all([first, second])).resolves.toEqual([false, false])
+      expect(fileSystem.stat).toHaveBeenCalledTimes(1)
+      await expect(
+        prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+          platform: 'win32',
+          fileSystem
+        })
+      ).resolves.toBe(true)
+      expect(fileSystem.stat).toHaveBeenCalledTimes(2)
+      expect(fileSystem.readFile).toHaveBeenCalledTimes(1)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('caps outstanding probes for one working directory after repeated deadlines', async () => {
+    vi.useFakeTimers()
+    try {
+      const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+        stat: vi.fn(() => new Promise<typeof fileMarker>(() => {})),
+        readFile: vi.fn(async () => '')
+      }
+      const prepare = (): Promise<boolean> =>
+        prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+          platform: 'win32',
+          fileSystem
+        })
+
+      for (let index = 0; index < WSL_LINKED_WORKTREE_ROUTE_MAX_PROBES_PER_CWD; index += 1) {
+        const route = prepare()
+        await vi.advanceTimersByTimeAsync(WSL_LINKED_WORKTREE_ROUTE_PROBE_TIMEOUT_MS)
+        await expect(route).resolves.toBe(false)
+      }
+      await vi.advanceTimersByTimeAsync(WSL_LINKED_WORKTREE_ROUTE_RETRY_BASE_MS)
+      await expect(prepare()).resolves.toBe(false)
+      expect(fileSystem.stat).toHaveBeenCalledTimes(WSL_LINKED_WORKTREE_ROUTE_MAX_PROBES_PER_CWD)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('caps outstanding probes across working directories', async () => {
+    vi.useFakeTimers()
+    try {
+      const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+        stat: vi.fn(() => new Promise<typeof fileMarker>(() => {})),
+        readFile: vi.fn(async () => '')
+      }
+      const pending = Array.from(
+        { length: WSL_LINKED_WORKTREE_ROUTE_MAX_PROBES_TOTAL },
+        (_, index) =>
+          prepareWslLinkedWorktreeGitRouting(`C:\\repo-${index}`, 'Ubuntu', {
+            platform: 'win32',
+            fileSystem
+          })
+      )
+
+      await expect(
+        prepareWslLinkedWorktreeGitRouting(String.raw`C:\blocked`, 'Ubuntu', {
+          platform: 'win32',
+          fileSystem
+        })
+      ).resolves.toBe(false)
+      expect(fileSystem.stat).toHaveBeenCalledTimes(WSL_LINKED_WORKTREE_ROUTE_MAX_PROBES_TOTAL)
+      await vi.advanceTimersByTimeAsync(WSL_LINKED_WORKTREE_ROUTE_PROBE_TIMEOUT_MS)
+      await expect(Promise.all(pending)).resolves.toEqual(
+        Array.from({ length: WSL_LINKED_WORKTREE_ROUTE_MAX_PROBES_TOTAL }, () => false)
+      )
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('coalesces concurrent revalidation after a cached route expires', async () => {
+    let currentTime = 1_000
+    const now = (): number => currentTime
+    let releaseStat: ((marker: typeof fileMarker) => void) | undefined
+    const delayedStat = new Promise<typeof fileMarker>((resolve) => {
+      releaseStat = resolve
+    })
+    const fileSystem: WslLinkedWorktreeRoutingFileSystem = {
+      stat: vi
+        .fn<WslLinkedWorktreeRoutingFileSystem['stat']>()
+        .mockResolvedValueOnce(directoryMarker)
+        .mockReturnValueOnce(delayedStat),
+      readFile: vi.fn(async () => 'gitdir: C:/main/.git/worktrees/linked\n')
+    }
+
+    await expect(
+      prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+        platform: 'win32',
+        fileSystem,
+        now
+      })
+    ).resolves.toBe(false)
+    currentTime += WSL_LINKED_WORKTREE_ROUTE_TTL_MS
+
+    const first = prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+      platform: 'win32',
+      fileSystem,
+      now
+    })
+    const second = prepareWslLinkedWorktreeGitRouting(String.raw`C:\repo`, 'Ubuntu', {
+      platform: 'win32',
+      fileSystem,
+      now
+    })
+
+    expect(fileSystem.stat).toHaveBeenCalledTimes(2)
+    releaseStat?.(fileMarker)
+    await expect(Promise.all([first, second])).resolves.toEqual([true, true])
+    expect(fileSystem.stat).toHaveBeenCalledTimes(2)
+    expect(fileSystem.readFile).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/git/wsl-linked-worktree-git-routing.ts b/src/main/git/wsl-linked-worktree-git-routing.ts
new file mode 100644
index 00000000000..440307fd5f0
--- /dev/null
+++ b/src/main/git/wsl-linked-worktree-git-routing.ts
@@ -0,0 +1,306 @@
+import * as fsPromises from 'node:fs/promises'
+import { win32 } from 'node:path'
+import type { Stats } from 'node:fs'
+
+type CachedRoute = { usesHostGit: boolean; expiresAt: number }
+type TransientRouteFailure = { count: number; retryAfter: number }
+
+// Bounds stale routing after delete/recreate while amortizing async parent walks on slow storage.
+export const WSL_LINKED_WORKTREE_ROUTE_TTL_MS = 30_000
+export const WSL_LINKED_WORKTREE_ROUTE_CACHE_PRUNE_THRESHOLD = 512
+export const WSL_LINKED_WORKTREE_ROUTE_PROBE_TIMEOUT_MS = 5_000
+export const WSL_LINKED_WORKTREE_ROUTE_MAX_PROBES_PER_CWD = 2
+export const WSL_LINKED_WORKTREE_ROUTE_MAX_PROBES_TOTAL = 32
+export const WSL_LINKED_WORKTREE_ROUTE_RETRY_BASE_MS = 1_000
+const WSL_LINKED_WORKTREE_ROUTE_RETRY_MAX_MS = 30_000
+
+const routeByCwd = new Map<string, CachedRoute>()
+const pendingRoutes = new Map<string, Promise<boolean>>()
+const transientFailuresByCwd = new Map<string, TransientRouteFailure>()
+const activeProbeCountByCwd = new Map<string, number>()
+let activeProbeCount = 0
+let routeProbeGeneration = 0
+let nextRoutePruneAt = 0
+
+export function isWslLinkedWorktreeGitRoutingCandidate(
+  cwd: string,
+  wslDistro: string | undefined,
+  platform: NodeJS.Platform = process.platform
+): boolean {
+  return platform === 'win32' && Boolean(wslDistro) && /^[A-Za-z]:[/\\]/.test(cwd)
+}
+
+function normalize(path: string): string {
+  return win32.resolve(path)
+}
+
+function cachedRoute(cwd: string, now: number): boolean | undefined {
+  const exact = routeByCwd.get(cwd)
+  if (!exact) {
+    return undefined
+  }
+  if (exact.expiresAt <= now) {
+    routeByCwd.delete(cwd)
+    return undefined
+  }
+  return exact.usesHostGit
+}
+
+export function parseWindowsLinkedGitdir(content: string): string | null {
+  const firstLine = content.split(/\r?\n/, 1)[0] ?? ''
+  return firstLine.match(/^gitdir:\s*([A-Za-z]:[/\\].*?)\s*$/i)?.[1] ?? null
+}
+
+export type WslLinkedWorktreeRoutingFileSystem = {
+  stat(path: string): Promise<Pick<Stats, 'isDirectory' | 'isFile'>>
+  readFile(path: string): Promise<string>
+}
+
+export type WslLinkedWorktreeRoutingOptions = {
+  platform?: NodeJS.Platform
+  fileSystem?: WslLinkedWorktreeRoutingFileSystem
+  now?: () => number
+  signal?: AbortSignal
+}
+
+const defaultFileSystem: WslLinkedWorktreeRoutingFileSystem = {
+  stat: (path) => fsPromises.stat(path),
+  readFile: (path) => fsPromises.readFile(path, 'utf8')
+}
+
+async function shouldUseHostGit(
+  cwd: string,
+  fileSystem: WslLinkedWorktreeRoutingFileSystem
+): Promise<boolean> {
+  let candidate = cwd
+  const driveRoot = win32.parse(candidate).root
+  while (true) {
+    const markerPath = win32.join(candidate, '.git')
+    try {
+      const marker = await fileSystem.stat(markerPath)
+      if (marker.isDirectory()) {
+        return false
+      }
+      if (marker.isFile()) {
+        return parseWindowsLinkedGitdir(await fileSystem.readFile(markerPath)) !== null
+      }
+      return false
+    } catch (error) {
+      const code = error && typeof error === 'object' ? (error as NodeJS.ErrnoException).code : null
+      if (code !== 'ENOENT' && code !== 'ENOTDIR') {
+        throw error
+      }
+    }
+    if (candidate === driveRoot) {
+      return false
+    }
+    candidate = win32.dirname(candidate)
+  }
+}
+
+function rememberRoute(cwd: string, usesHostGit: boolean, now: number): boolean {
+  const expiresAt = now + WSL_LINKED_WORKTREE_ROUTE_TTL_MS
+  if (
+    routeByCwd.size >= WSL_LINKED_WORKTREE_ROUTE_CACHE_PRUNE_THRESHOLD &&
+    now >= nextRoutePruneAt
+  ) {
+    for (const [cachedCwd, route] of routeByCwd) {
+      if (route.expiresAt <= now) {
+        routeByCwd.delete(cachedCwd)
+      }
+    }
+    nextRoutePruneAt = now + WSL_LINKED_WORKTREE_ROUTE_TTL_MS
+  }
+  routeByCwd.set(cwd, { usesHostGit, expiresAt })
+  return usesHostGit
+}
+
+function routingAbortError(): Error {
+  return Object.assign(new Error('The operation was aborted.'), { name: 'AbortError' })
+}
+
+function rememberTransientFailure(cwd: string, now: number): void {
+  const count = (transientFailuresByCwd.get(cwd)?.count ?? 0) + 1
+  const retryDelay =
+    count === 1
+      ? 0
+      : Math.min(
+          WSL_LINKED_WORKTREE_ROUTE_RETRY_BASE_MS * 2 ** Math.min(count - 2, 10),
+          WSL_LINKED_WORKTREE_ROUTE_RETRY_MAX_MS
+        )
+  if (
+    !transientFailuresByCwd.has(cwd) &&
+    transientFailuresByCwd.size >= WSL_LINKED_WORKTREE_ROUTE_CACHE_PRUNE_THRESHOLD
+  ) {
+    const oldest = transientFailuresByCwd.keys().next().value
+    if (oldest !== undefined) {
+      transientFailuresByCwd.delete(oldest)
+    }
+  }
+  transientFailuresByCwd.delete(cwd)
+  transientFailuresByCwd.set(cwd, { count, retryAfter: now + retryDelay })
+}
+
+function canStartRouteProbe(cwd: string, now: number): boolean {
+  const failure = transientFailuresByCwd.get(cwd)
+  return Boolean(
+    (!failure || failure.retryAfter <= now) &&
+    (activeProbeCountByCwd.get(cwd) ?? 0) < WSL_LINKED_WORKTREE_ROUTE_MAX_PROBES_PER_CWD &&
+    activeProbeCount < WSL_LINKED_WORKTREE_ROUTE_MAX_PROBES_TOTAL
+  )
+}
+
+function trackRouteProbe(cwd: string): () => void {
+  const generation = routeProbeGeneration
+  activeProbeCount += 1
+  activeProbeCountByCwd.set(cwd, (activeProbeCountByCwd.get(cwd) ?? 0) + 1)
+  return () => {
+    if (generation !== routeProbeGeneration) {
+      return
+    }
+    activeProbeCount -= 1
+    const remaining = (activeProbeCountByCwd.get(cwd) ?? 1) - 1
+    if (remaining === 0) {
+      activeProbeCountByCwd.delete(cwd)
+    } else {
+      activeProbeCountByCwd.set(cwd, remaining)
+    }
+  }
+}
+
+function waitForRouteUnlessAborted(
+  route: Promise<boolean>,
+  signal?: AbortSignal
+): Promise<boolean> {
+  if (!signal) {
+    return route
+  }
+  if (signal.aborted) {
+    return Promise.reject(routingAbortError())
+  }
+  return new Promise((resolve, reject) => {
+    const onAbort = (): void => {
+      signal.removeEventListener('abort', onAbort)
+      reject(routingAbortError())
+    }
+    signal.addEventListener('abort', onAbort, { once: true })
+    route.then(
+      (result) => {
+        signal.removeEventListener('abort', onAbort)
+        resolve(result)
+      },
+      (error) => {
+        signal.removeEventListener('abort', onAbort)
+        reject(error)
+      }
+    )
+  })
+}
+
+function discoverRoute(
+  cwd: string,
+  fileSystem: WslLinkedWorktreeRoutingFileSystem,
+  now: () => number
+): Promise<boolean> {
+  return new Promise((resolve) => {
+    const generation = routeProbeGeneration
+    let settled = false
+    const finish = (usesHostGit: boolean, cacheable: boolean): void => {
+      if (settled) {
+        return
+      }
+      settled = true
+      clearTimeout(timer)
+      if (generation !== routeProbeGeneration) {
+        resolve(false)
+        return
+      }
+      if (cacheable) {
+        transientFailuresByCwd.delete(cwd)
+        resolve(rememberRoute(cwd, usesHostGit, now()))
+      } else {
+        rememberTransientFailure(cwd, now())
+        resolve(usesHostGit)
+      }
+    }
+    const timer = setTimeout(() => finish(false, false), WSL_LINKED_WORKTREE_ROUTE_PROBE_TIMEOUT_MS)
+    timer.unref()
+    const releaseProbe = trackRouteProbe(cwd)
+    void shouldUseHostGit(cwd, fileSystem).then(
+      (usesHostGit) => {
+        releaseProbe()
+        finish(usesHostGit, true)
+      },
+      () => {
+        releaseProbe()
+        finish(false, false)
+      }
+    )
+  })
+}
+
+export async function prepareWslLinkedWorktreeGitRouting(
+  cwd: string,
+  wslDistro: string | undefined,
+  options: WslLinkedWorktreeRoutingOptions = {}
+): Promise<boolean> {
+  const platform = options.platform ?? process.platform
+  const fileSystem = options.fileSystem ?? defaultFileSystem
+  const now = options.now ?? Date.now
+  if (!isWslLinkedWorktreeGitRoutingCandidate(cwd, wslDistro, platform)) {
+    return false
+  }
+  if (options.signal?.aborted) {
+    throw routingAbortError()
+  }
+  const normalizedCwd = normalize(cwd)
+  const cached = cachedRoute(normalizedCwd, now())
+  if (cached !== undefined) {
+    return cached
+  }
+  const pending = pendingRoutes.get(normalizedCwd)
+  if (pending) {
+    return waitForRouteUnlessAborted(pending, options.signal)
+  }
+  if (!canStartRouteProbe(normalizedCwd, now())) {
+    return false
+  }
+  const discovery = discoverRoute(normalizedCwd, fileSystem, now)
+  const route = discovery.finally(() => {
+    if (pendingRoutes.get(normalizedCwd) === route) {
+      pendingRoutes.delete(normalizedCwd)
+    }
+  })
+  pendingRoutes.set(normalizedCwd, route)
+  return waitForRouteUnlessAborted(route, options.signal)
+}
+
+export function usesHostGitForWslLinkedWorktree(
+  cwd: string,
+  wslDistro: string | undefined,
+  platform: NodeJS.Platform = process.platform,
+  now: () => number = Date.now
+): boolean {
+  return (
+    isWslLinkedWorktreeGitRoutingCandidate(cwd, wslDistro, platform) &&
+    cachedRoute(normalize(cwd), now()) === true
+  )
+}
+
+export function resetWslLinkedWorktreeGitRoutingForTests(): void {
+  routeByCwd.clear()
+  pendingRoutes.clear()
+  transientFailuresByCwd.clear()
+  activeProbeCountByCwd.clear()
+  activeProbeCount = 0
+  routeProbeGeneration += 1
+  nextRoutePruneAt = 0
+}
+
+export function seedWslLinkedWorktreeGitRoutingForTests(root: string): void {
+  const normalizedRoot = normalize(root)
+  routeByCwd.set(normalizedRoot, {
+    usesHostGit: true,
+    expiresAt: Number.POSITIVE_INFINITY
+  })
+}
diff --git a/src/main/github/client-pr-check-details.test.ts b/src/main/github/client-pr-check-details.test.ts
index b092b01eb94..4bb2fcbae76 100644
--- a/src/main/github/client-pr-check-details.test.ts
+++ b/src/main/github/client-pr-check-details.test.ts
@@ -148,20 +148,86 @@ describe('getPRCheckDetails', () => {
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
       1,
       ['api', 'repos/acme/widgets/check-runs/88'],
-      { cwd: '/repo-root', host: 'github.com' }
+      expect.objectContaining({
+        cwd: '/repo-root',
+        host: 'github.com',
+        signal: expect.any(AbortSignal)
+      })
     )
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
       2,
       ['api', 'repos/acme/widgets/check-runs/88/annotations?per_page=20'],
-      { cwd: '/repo-root', host: 'github.com' }
+      expect.objectContaining({
+        cwd: '/repo-root',
+        host: 'github.com',
+        signal: expect.any(AbortSignal)
+      })
     )
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
       3,
       ['api', 'repos/acme/widgets/actions/runs/77/jobs?per_page=100'],
-      { cwd: '/repo-root', host: 'github.com' }
+      expect.objectContaining({
+        cwd: '/repo-root',
+        host: 'github.com',
+        signal: expect.any(AbortSignal)
+      })
     )
   })
 
+  it('rejects provider failures so callers can distinguish them from unavailable details', async () => {
+    getOwnerRepoMock.mockResolvedValueOnce({ owner: 'acme', repo: 'widgets' })
+    ghExecFileAsyncMock.mockRejectedValueOnce(new Error('authentication failed'))
+
+    await expect(getPRCheckDetails('/repo-root', { checkRunId: 88 })).rejects.toThrow(
+      'authentication failed'
+    )
+  })
+
+  it('aborts host work at the cumulative check-details deadline', async () => {
+    vi.useFakeTimers()
+    try {
+      getOwnerRepoMock.mockResolvedValueOnce({ owner: 'acme', repo: 'widgets' })
+      ghExecFileAsyncMock.mockImplementation(
+        (_args: string[], options: { signal?: AbortSignal }) =>
+          new Promise((_resolve, reject) => {
+            options.signal?.addEventListener(
+              'abort',
+              () => {
+                const error = new Error('aborted')
+                error.name = 'AbortError'
+                reject(error)
+              },
+              { once: true }
+            )
+          })
+      )
+      const request = getPRCheckDetails('/repo-root', { checkRunId: 88 })
+      const rejection = expect(request).rejects.toThrow('Timed out loading check details.')
+
+      await vi.advanceTimersByTimeAsync(25_000)
+
+      await rejection
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('stops waiting for shared repository resolution at the host deadline', async () => {
+    vi.useFakeTimers()
+    try {
+      getOwnerRepoMock.mockImplementationOnce(() => new Promise(() => {}))
+      const request = getPRCheckDetails('/repo-root', { checkRunId: 88 })
+      const rejection = expect(request).rejects.toThrow('Timed out loading check details.')
+
+      await vi.advanceTimersByTimeAsync(25_000)
+
+      await rejection
+      expect(ghExecFileAsyncMock).not.toHaveBeenCalled()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('fetches sliced log tails for failed workflow jobs only', async () => {
     getOwnerRepoMock.mockResolvedValueOnce({ owner: 'acme', repo: 'widgets' })
     const actionUrl = 'https://github.com/acme/widgets/actions/runs/77/job/88'
@@ -225,7 +291,11 @@ describe('getPRCheckDetails', () => {
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
       4,
       ['api', 'repos/acme/widgets/actions/jobs/8801/logs'],
-      { cwd: '/repo-root', host: 'github.com' }
+      expect.objectContaining({
+        cwd: '/repo-root',
+        host: 'github.com',
+        signal: expect.any(AbortSignal)
+      })
     )
     expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(4)
   })
diff --git a/src/main/github/client-pr-local-runtime.test.ts b/src/main/github/client-pr-local-runtime.test.ts
index 0e7d4013d2e..543d6f239f2 100644
--- a/src/main/github/client-pr-local-runtime.test.ts
+++ b/src/main/github/client-pr-local-runtime.test.ts
@@ -234,6 +234,15 @@ describe('GitHub PR local runtime routing', () => {
           stdout: JSON.stringify({ id: 13, node_id: 'PRRC_inline_13', user: null, body: 'Inline' })
         }
       }
+      if (args.length === 2 && endpoint === 'repos/acme/orca/pulls/7') {
+        return {
+          stdout: JSON.stringify({
+            number: 7,
+            head: { ref: 'feature', sha: 'head-oid' },
+            base: { ref: 'main', sha: 'base-oid' }
+          })
+        }
+      }
       return { stdout: '', stderr: '' }
     })
 
@@ -467,6 +476,15 @@ describe('GitHub PR local runtime routing', () => {
       if (endpoint.endsWith('/check-runs/88/annotations?per_page=20')) {
         return { stdout: '[]' }
       }
+      if (args.length === 2 && endpoint === 'repos/team/orca/pulls/7') {
+        return {
+          stdout: JSON.stringify({
+            number: 7,
+            head: { ref: 'feature', sha: 'head-sha' },
+            base: { ref: 'main', sha: 'base-sha' }
+          })
+        }
+      }
       if (query) {
         return { stdout: JSON.stringify({ data: { repository: {} } }) }
       }
diff --git a/src/main/github/client.test.ts b/src/main/github/client.test.ts
index a33b9b38d20..d139c345b59 100644
--- a/src/main/github/client.test.ts
+++ b/src/main/github/client.test.ts
@@ -1,6 +1,7 @@
 /* oxlint-disable max-lines -- Why: GitHub client fixtures cover local and SSH repo identity paths in one suite so mocked CLI behavior stays consistent. */
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as GithubApiRepositoryModule from './github-api-repository'
+import type * as GitHubEnterpriseRepositoryModule from './github-enterprise-repository'
 
 type RateLimitGuardResult =
   | { blocked: false }
@@ -91,7 +92,8 @@ vi.mock('./gh-utils', () => ({
 }))
 
 vi.mock('../git/runner', () => ({
-  gitExecFileAsync: gitExecFileAsyncMock
+  gitExecFileAsync: gitExecFileAsyncMock,
+  ghExecFileAsync: ghExecFileAsyncMock
 }))
 
 vi.mock('../providers/ssh-git-dispatch', () => ({
@@ -102,6 +104,11 @@ vi.mock('./local-git-config-signature', () => ({
   readLocalGitConfigSignature: readLocalGitConfigSignatureMock
 }))
 
+vi.mock('./github-enterprise-repository', async (importOriginal) => ({
+  ...(await importOriginal<typeof GitHubEnterpriseRepositoryModule>()),
+  isGitHubHostAuthenticated: vi.fn().mockResolvedValue(true)
+}))
+
 vi.mock('./rate-limit', () => ({
   getRateLimit: getRateLimitMock,
   rateLimitGuard: rateLimitGuardMock,
@@ -186,6 +193,7 @@ import {
   _getTrackedUpstreamBranchCacheSizesForTests,
   _resetOwnerRepoCache,
   _resetMergeQueueCacheForTests,
+  _resetPRStackSummaryCacheForTests,
   __resetTrackedUpstreamBranchCacheForTests
 } from './client'
 import { __resetPRConflictSummaryCachesForTests } from './conflict-summary'
@@ -193,6 +201,7 @@ import { resetMergedPRCommitMembershipCacheForTest } from './merged-pr-commit-me
 import { __resetRepoDefaultBranchCacheForTests } from '../source-control/repo-default-branch'
 
 import { _resetOriginGitHubApiRepositoryCache } from './github-api-repository'
+import { _resetGitHubPRStackCacheForTests } from './github-pr-stack'
 
 // The origin-repository cache is module-level state; reset it so slugs
 // resolved by one test cannot leak into the next.
@@ -273,6 +282,8 @@ describe('getPRForBranch', () => {
     acquireMock.mockResolvedValue(undefined)
     _resetOwnerRepoCache()
     _resetMergeQueueCacheForTests()
+    _resetPRStackSummaryCacheForTests()
+    _resetGitHubPRStackCacheForTests()
     __resetTrackedUpstreamBranchCacheForTests()
     __resetPRConflictSummaryCachesForTests()
     resetMergedPRCommitMembershipCacheForTest()
@@ -431,7 +442,7 @@ describe('getPRForBranch', () => {
 
     const pr = await getPRForBranch('/repo-root', 'feature/local-worktree', 99)
 
-    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(1)
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(2)
     expect(gitExecFileAsyncMock).not.toHaveBeenCalled()
     expect(ghExecFileAsyncMock).toHaveBeenCalledWith(
       [
@@ -453,6 +464,81 @@ describe('getPRForBranch', () => {
     })
   })
 
+  it('caches exact REST stack probes across linked PR refreshes', async () => {
+    getOwnerRepoMock.mockResolvedValue({ owner: 'acme', repo: 'widgets' })
+    ghExecFileAsyncMock.mockImplementation(async (args: string[]) => {
+      if (args[0] === 'pr') {
+        return {
+          stdout: JSON.stringify({
+            number: 99,
+            title: 'Linked PR',
+            state: 'OPEN',
+            url: 'https://github.com/acme/widgets/pull/99',
+            statusCheckRollup: [],
+            updatedAt: '2026-03-28T00:00:00Z',
+            isDraft: false,
+            mergeable: 'MERGEABLE',
+            baseRefName: 'main',
+            headRefName: 'feature',
+            headRefOid: 'head-oid'
+          })
+        }
+      }
+      return {
+        stdout: JSON.stringify({
+          number: 99,
+          title: 'Linked PR',
+          state: 'open',
+          stack: null
+        })
+      }
+    })
+
+    await getPRForBranch('/repo-root', 'feature', 99)
+    await getPRForBranch('/repo-root', 'feature', 99)
+    await getPRForBranch('/repo-root', 'feature', 99, 'ssh-1')
+
+    expect(
+      ghExecFileAsyncMock.mock.calls.filter(
+        ([args]) => args[0] === 'api' && args[1]?.includes('/99')
+      )
+    ).toHaveLength(2)
+    expect(ghExecFileAsyncMock.mock.calls.filter(([args]) => args[0] === 'pr')).toHaveLength(3)
+  })
+
+  it('caches failed REST stack probes across linked PR refreshes', async () => {
+    getOwnerRepoMock.mockResolvedValue({ owner: 'acme', repo: 'widgets' })
+    ghExecFileAsyncMock.mockImplementation(async (args: string[]) => {
+      if (args[0] === 'pr') {
+        return {
+          stdout: JSON.stringify({
+            number: 99,
+            title: 'Linked PR',
+            state: 'OPEN',
+            url: 'https://github.com/acme/widgets/pull/99',
+            statusCheckRollup: [],
+            updatedAt: '2026-03-28T00:00:00Z',
+            isDraft: false,
+            mergeable: 'MERGEABLE',
+            baseRefName: 'main',
+            headRefName: 'feature',
+            headRefOid: 'head-oid'
+          })
+        }
+      }
+      throw new Error('GitHub is temporarily unavailable')
+    })
+
+    await getPRForBranch('/repo-root', 'feature', 99)
+    await getPRForBranch('/repo-root', 'feature', 99)
+
+    expect(
+      ghExecFileAsyncMock.mock.calls.filter(
+        ([args]) => args[0] === 'api' && args[1]?.includes('/99')
+      )
+    ).toHaveLength(1)
+  })
+
   it('hydrates repository merge method settings for exact PR lookups', async () => {
     getOwnerRepoMock.mockResolvedValueOnce({ owner: 'acme', repo: 'widgets' })
     ghExecFileAsyncMock
@@ -518,6 +604,54 @@ describe('getPRForBranch', () => {
     )
   })
 
+  it('isolates viewer-dependent merge metadata across SSH connections', async () => {
+    getOwnerRepoMock.mockResolvedValue({ owner: 'acme', repo: 'widgets' })
+    let metadataProbe = 0
+    ghExecFileAsyncMock.mockImplementation(async (args: string[]) => {
+      if (args.includes('graphql')) {
+        metadataProbe += 1
+        return {
+          stdout: JSON.stringify({
+            data: {
+              repository: {
+                autoMergeAllowed: metadataProbe === 1,
+                mergeQueue: null
+              }
+            }
+          })
+        }
+      }
+      if (args[0] === 'pr') {
+        return {
+          stdout: JSON.stringify({
+            number: 99,
+            title: 'Linked PR',
+            state: 'OPEN',
+            url: 'https://github.com/acme/widgets/pull/99',
+            statusCheckRollup: [],
+            updatedAt: '2026-03-28T00:00:00Z',
+            isDraft: false,
+            mergeable: 'MERGEABLE',
+            reviewDecision: 'APPROVED',
+            mergeStateStatus: 'CLEAN',
+            autoMergeRequest: null,
+            baseRefName: 'main',
+            headRefName: 'feature',
+            headRefOid: 'head-oid'
+          })
+        }
+      }
+      return { stdout: JSON.stringify({ number: 99, state: 'open', stack: null }) }
+    })
+
+    const firstAccount = await getPRForBranch('/repo-root', 'feature', 99, 'ssh-account-1')
+    const secondAccount = await getPRForBranch('/repo-root', 'feature', 99, 'ssh-account-2')
+
+    expect(firstAccount?.autoMergeAllowed).toBe(true)
+    expect(secondAccount?.autoMergeAllowed).toBe(false)
+    expect(metadataProbe).toBe(2)
+  })
+
   it('treats linked PR metadata as authoritative even when the branch head differs', async () => {
     getOwnerRepoMock.mockResolvedValueOnce({ owner: 'acme', repo: 'widgets' })
     gitExecFileAsyncMock.mockResolvedValueOnce({ stdout: 'current-worktree-head\n', stderr: '' })
@@ -559,7 +693,7 @@ describe('getPRForBranch', () => {
 
     const pr = await getPRForBranch('/repo-root', 'feature/test', 99)
 
-    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(1)
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(2)
     expect(pr?.number).toBe(99)
   })
 
@@ -1181,7 +1315,7 @@ describe('getPRForBranch', () => {
     expect(outcome.kind === 'found' ? outcome.pr.headDivergedFromMergedPRAtOid : undefined).toBe(
       undefined
     )
-    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(1)
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(2)
   })
 
   it('leaves linked merged divergence unset when the membership probe throws', async () => {
@@ -1223,7 +1357,7 @@ describe('getPRForBranch', () => {
     expect(outcome.kind === 'found' ? outcome.pr.headDivergedFromMergedPRAtOid : undefined).toBe(
       undefined
     )
-    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(1)
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(2)
   })
 
   it('prefers branch lookup over a fallback PR number', async () => {
@@ -2866,7 +3000,7 @@ describe('getPRForBranch', () => {
 
     const pr = await getPRForBranch('/repo-root', 'refs/heads/local-created-from-pr', 77)
 
-    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(1)
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(2)
     expect(ghExecFileAsyncMock).toHaveBeenCalledWith(
       [
         'pr',
@@ -4015,6 +4149,8 @@ describe('GitHub GraphQL rate-limit guard', () => {
     __resetPRConflictSummaryCachesForTests()
   })
 
+  afterEach(() => vi.restoreAllMocks())
+
   it('skips PR review-thread GraphQL fetch while preserving REST comments', async () => {
     rateLimitGuardMock.mockImplementation(((bucket: string) =>
       bucket === 'graphql'
@@ -4244,8 +4380,667 @@ describe('GitHub GraphQL rate-limit guard', () => {
     expect(noteRateLimitSpendMock).toHaveBeenCalledTimes(2)
   })
 
+  it('hydrates GitHub-registered stack metadata for exact linked PRs', async () => {
+    getOwnerRepoMock.mockResolvedValue({ owner: 'stablyai', repo: 'orca', host: 'github.com' })
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          number: 202,
+          title: 'Stack API',
+          state: 'OPEN',
+          url: 'https://github.com/stablyai/orca/pull/202',
+          statusCheckRollup: [],
+          updatedAt: '2026-08-10T00:00:00Z',
+          isDraft: false,
+          mergeable: 'MERGEABLE',
+          baseRefName: 'stack/models',
+          headRefName: 'stack/api',
+          headRefOid: 'api-sha'
+        })
+      })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          number: 202,
+          title: 'Stack API',
+          state: 'open',
+          html_url: 'https://github.com/stablyai/orca/pull/202',
+          head: { ref: 'stack/api', sha: 'api-sha' },
+          base: { ref: 'stack/models', sha: 'models-sha' },
+          stack: {
+            number: 51,
+            position: 2,
+            size: 2,
+            base: { ref: 'main', sha: 'main-sha' }
+          }
+        })
+      })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          data: {
+            repository: {
+              pullRequest: {
+                stack: {
+                  number: 51,
+                  size: 2,
+                  baseRefName: 'main',
+                  entries: {
+                    nodes: [
+                      {
+                        position: 1,
+                        pullRequest: {
+                          number: 201,
+                          title: 'Stack models',
+                          url: 'https://github.com/stablyai/orca/pull/201',
+                          state: 'OPEN',
+                          isDraft: false,
+                          mergeable: 'MERGEABLE',
+                          statusCheckRollup: { state: 'SUCCESS' }
+                        }
+                      },
+                      {
+                        position: 2,
+                        pullRequest: {
+                          number: 202,
+                          title: 'Stack API',
+                          url: 'https://github.com/stablyai/orca/pull/202',
+                          state: 'OPEN',
+                          isDraft: false,
+                          mergeable: 'MERGEABLE',
+                          statusCheckRollup: { state: 'SUCCESS' }
+                        }
+                      }
+                    ]
+                  }
+                }
+              }
+            }
+          }
+        })
+      })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          data: {
+            repository: {
+              mergeQueue: null,
+              ref: { rules: { nodes: [{ type: 'MERGE_QUEUE' }] } }
+            }
+          }
+        })
+      })
+
+    const pr = await getPRForBranch('/repo-root', 'stack/api', 202)
+
+    expect(pr?.stack).toMatchObject({
+      number: 51,
+      position: 2,
+      size: 2,
+      baseRefName: 'main',
+      entries: [
+        { number: 201, position: 1 },
+        { number: 202, position: 2 }
+      ]
+    })
+    expect(pr?.mergeQueueRequired).toBe(true)
+    const mergeQueueMetadataCall = ghExecFileAsyncMock.mock.calls.find(
+      ([args]) => args.includes('graphql') && args.includes('branch=main')
+    )
+    expect(mergeQueueMetadataCall?.[0]).toEqual(expect.arrayContaining(['-f', 'branch=main']))
+  })
+
+  const validStackHeadSha = 'a'.repeat(40)
+  const validStackBaseSha = 'b'.repeat(40)
+  const validSha256HeadSha = 'c'.repeat(64)
+
+  it.each([
+    {
+      objectFormat: 'SHA-1 with a base SHA',
+      headSha: validStackHeadSha,
+      baseSha: validStackBaseSha
+    },
+    {
+      objectFormat: 'SHA-256 without a base SHA',
+      headSha: validSha256HeadSha,
+      baseSha: undefined
+    }
+  ])('uses async merge only for GitHub-registered stacks using $objectFormat', async (scenario) => {
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          number: 202,
+          title: 'Stack API',
+          state: 'open',
+          head: { ref: 'stack/api', sha: scenario.headSha },
+          base: { ref: 'stack/models', sha: 'models-sha' },
+          stack: {
+            number: 51,
+            position: 2,
+            size: 2,
+            base: {
+              ref: 'main',
+              ...(scenario.baseSha ? { sha: scenario.baseSha } : {})
+            }
+          }
+        })
+      })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({ data: { repository: { mergeQueue: { id: 'MQ_kw' } } } })
+      })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({ status: 'enqueued', details: { message: 'Queued' } })
+      })
+
+    await expect(
+      mergePR('/repo-root', 202, 'squash', undefined, {
+        owner: 'stablyai',
+        repo: 'orca',
+        host: 'github.com'
+      })
+    ).resolves.toEqual({ ok: true })
+
+    const mergeCall = ghExecFileAsyncMock.mock.calls.find(([args]) =>
+      args.includes('repos/stablyai/orca/pulls/202/merge-async')
+    )
+    expect(mergeCall?.[0]).toEqual(
+      expect.arrayContaining([
+        'PUT',
+        'repos/stablyai/orca/pulls/202/merge-async',
+        'merge_action=merge_queue',
+        `sha=${scenario.headSha}`
+      ])
+    )
+    expect(mergeCall?.[0]).not.toContain('merge_method=squash')
+    expect(acquireMock).toHaveBeenCalledTimes(2)
+    expect(releaseMock).toHaveBeenCalledTimes(2)
+    expect(
+      ghExecFileAsyncMock.mock.calls.some(([args]) => args[0] === 'pr' && args[1] === 'merge')
+    ).toBe(false)
+  })
+
+  it('never falls back to legacy merge after an async stack merge transport failure', async () => {
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          number: 202,
+          state: 'open',
+          head: { ref: 'stack/api', sha: validStackHeadSha },
+          base: { ref: 'stack/models', sha: 'models-sha' },
+          stack: {
+            number: 51,
+            position: 2,
+            size: 2,
+            base: { ref: 'main', sha: validStackBaseSha }
+          }
+        })
+      })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({ data: { repository: { mergeQueue: null } } })
+      })
+      .mockRejectedValueOnce(new Error('socket closed after request submission'))
+
+    await expect(
+      mergePR('/repo-root', 202, 'squash', undefined, {
+        owner: 'stablyai',
+        repo: 'orca',
+        host: 'github.com'
+      })
+    ).resolves.toEqual({ ok: false, error: 'socket closed after request submission' })
+    expect(
+      ghExecFileAsyncMock.mock.calls.some(([args]) => args[0] === 'pr' && args[1] === 'merge')
+    ).toBe(false)
+  })
+
+  const stackMetadataUnavailableError =
+    'Could not verify GitHub pull request stack metadata. Refresh and try again.'
+
+  it.each([
+    {
+      failure: 'local transport failure',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: new Error('stack metadata unavailable'),
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'stack metadata unavailable',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'GitHub Enterprise transport failure',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: new Error('enterprise stack metadata unavailable'),
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'enterprise stack metadata unavailable',
+      expectedOptions: { cwd: '/repo-root', host: 'github.enterprise.test' }
+    },
+    {
+      failure: 'unparsable probe response over SSH',
+      repoPath: '/remote/repo-root',
+      connectionId: 'ssh-1',
+      probeResponse: { stdout: '' },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'invalid JSON response',
+      expectedOptions: { host: 'github.com' }
+    },
+    {
+      failure: 'valid JSON with a non-object payload',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: { stdout: 'null' },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'invalid response shape',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'valid JSON with an array payload',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: { stdout: '[]' },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'invalid response shape',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'present primitive stack metadata',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: {
+        stdout: JSON.stringify({
+          number: 202,
+          head: { sha: validStackHeadSha },
+          stack: true
+        })
+      },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'malformed stack',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'malformed stack response',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: {
+        stdout: JSON.stringify({
+          number: 202,
+          head: { sha: validStackHeadSha },
+          stack: {
+            number: 51,
+            position: 2,
+            size: '2',
+            base: { ref: 'main', sha: validStackBaseSha }
+          }
+        })
+      },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'malformed stack',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'incoherent stack position',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: {
+        stdout: JSON.stringify({
+          number: 202,
+          head: { sha: validStackHeadSha },
+          stack: {
+            number: 51,
+            position: 3,
+            size: 2,
+            base: { ref: 'main', sha: validStackBaseSha }
+          }
+        })
+      },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'malformed stack',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'non-positive stack number',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: {
+        stdout: JSON.stringify({
+          number: 202,
+          head: { sha: validStackHeadSha },
+          stack: {
+            number: 0,
+            position: 1,
+            size: 2,
+            base: { ref: 'main', sha: validStackBaseSha }
+          }
+        })
+      },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'malformed stack',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'fractional stack size',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: {
+        stdout: JSON.stringify({
+          number: 202,
+          head: { sha: validStackHeadSha },
+          stack: {
+            number: 51,
+            position: 1,
+            size: 1.5,
+            base: { ref: 'main', sha: validStackBaseSha }
+          }
+        })
+      },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'malformed stack',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'unsafe stack number',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: {
+        stdout: JSON.stringify({
+          number: 202,
+          head: { sha: validStackHeadSha },
+          stack: {
+            number: Number.MAX_SAFE_INTEGER + 1,
+            position: 1,
+            size: 2,
+            base: { ref: 'main', sha: validStackBaseSha }
+          }
+        })
+      },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'malformed stack',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'blank stack base ref',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: {
+        stdout: JSON.stringify({
+          number: 202,
+          head: { sha: validStackHeadSha },
+          stack: {
+            number: 51,
+            position: 2,
+            size: 2,
+            base: { ref: '  ', sha: validStackBaseSha }
+          }
+        })
+      },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'malformed stack',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'invalid stack base SHA',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: {
+        stdout: JSON.stringify({
+          number: 202,
+          head: { sha: validStackHeadSha },
+          stack: {
+            number: 51,
+            position: 2,
+            size: 2,
+            base: { ref: 'main', sha: 123 }
+          }
+        })
+      },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'malformed stack',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'invalid string stack base SHA',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: {
+        stdout: JSON.stringify({
+          number: 202,
+          head: { sha: validStackHeadSha },
+          stack: {
+            number: 51,
+            position: 2,
+            size: 2,
+            base: { ref: 'main', sha: 'not-a-git-object-id' }
+          }
+        })
+      },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'malformed stack',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'registered stack response without a head SHA',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: {
+        stdout: JSON.stringify({
+          number: 202,
+          head: { ref: 'stack/api' },
+          stack: {
+            number: 51,
+            position: 2,
+            size: 2,
+            base: { ref: 'main', sha: validStackBaseSha }
+          }
+        })
+      },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'missing head SHA',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'registered stack response with an invalid head SHA',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: {
+        stdout: JSON.stringify({
+          number: 202,
+          head: { ref: 'stack/api', sha: {} },
+          stack: {
+            number: 51,
+            position: 2,
+            size: 2,
+            base: { ref: 'main', sha: validStackBaseSha }
+          }
+        })
+      },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'missing head SHA',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    },
+    {
+      failure: 'registered stack response with an invalid string head SHA',
+      repoPath: '/repo-root',
+      connectionId: undefined,
+      probeResponse: {
+        stdout: JSON.stringify({
+          number: 202,
+          head: { ref: 'stack/api', sha: 'not-a-git-object-id' },
+          stack: {
+            number: 51,
+            position: 2,
+            size: 2,
+            base: { ref: 'main', sha: validStackBaseSha }
+          }
+        })
+      },
+      expectedError: stackMetadataUnavailableError,
+      expectedDiagnostic: 'missing head SHA',
+      expectedOptions: { cwd: '/repo-root', host: 'github.com' }
+    }
+  ])('fails closed on $failure', async (scenario) => {
+    const consoleWarnSpy = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    if (scenario.probeResponse instanceof Error) {
+      ghExecFileAsyncMock.mockRejectedValueOnce(scenario.probeResponse)
+    } else {
+      ghExecFileAsyncMock.mockResolvedValueOnce(scenario.probeResponse)
+    }
+    // Why: disabling the guard must expose the legacy merge fallthrough, not fail on an unstubbed call.
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          number: 202,
+          title: 'Stack API',
+          state: 'OPEN',
+          url: 'https://github.com/stablyai/orca/pull/202',
+          statusCheckRollup: [],
+          updatedAt: '2026-08-10T00:00:00Z',
+          isDraft: false,
+          mergeable: 'MERGEABLE',
+          baseRefName: 'stack/models',
+          headRefName: 'stack/api',
+          headRefOid: 'api-sha'
+        })
+      })
+      .mockResolvedValueOnce({ stdout: '', stderr: '' })
+
+    const result = await mergePR(scenario.repoPath, 202, 'squash', scenario.connectionId, {
+      owner: 'stablyai',
+      repo: 'orca',
+      host: scenario.expectedOptions.host
+    })
+
+    expect.soft(result).toEqual({ ok: false, error: scenario.expectedError })
+    expect
+      .soft(ghExecFileAsyncMock.mock.calls.map(([args]) => args))
+      .toEqual([['api', 'repos/stablyai/orca/pulls/202']])
+    expect.soft(ghExecFileAsyncMock.mock.calls[0]?.[1]).toEqual(scenario.expectedOptions)
+    expect
+      .soft(
+        ghExecFileAsyncMock.mock.calls.some(([args]) =>
+          args.includes('repos/stablyai/orca/pulls/202/merge-async')
+        )
+      )
+      .toBe(false)
+    expect
+      .soft(
+        ghExecFileAsyncMock.mock.calls.some(([args]) => args[0] === 'pr' && args[1] === 'merge')
+      )
+      .toBe(false)
+    expect.soft(acquireMock).toHaveBeenCalledTimes(1)
+    expect.soft(releaseMock).toHaveBeenCalledTimes(1)
+    expect
+      .soft(consoleWarnSpy)
+      .toHaveBeenCalledWith(
+        'mergePR stack metadata probe failed for stablyai/orca#202:',
+        scenario.expectedDiagnostic
+      )
+    expect.soft(consoleWarnSpy).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([
+    { stackShape: 'omits stack', stackField: {} },
+    { stackShape: 'sets stack to null', stackField: { stack: null } }
+  ])('keeps legacy merge when an ordinary GitHub response $stackShape', async (scenario) => {
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          number: 13866,
+          title: 'Fail closed on unavailable stack metadata',
+          state: 'open',
+          head: {
+            ref: 'sta-3924-stack-merge-fail-closed',
+            sha: validStackHeadSha
+          },
+          base: { ref: 'main', sha: validStackBaseSha },
+          ...scenario.stackField
+        })
+      })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          number: 13866,
+          title: 'Fail closed on unavailable stack metadata',
+          state: 'OPEN',
+          url: 'https://github.com/stablyai/orca/pull/13866',
+          statusCheckRollup: [],
+          updatedAt: '2026-08-11T00:00:00Z',
+          isDraft: false,
+          mergeable: 'MERGEABLE',
+          baseRefName: 'main',
+          baseRefOid: validStackBaseSha,
+          headRefName: 'sta-3924-stack-merge-fail-closed',
+          headRefOid: validStackHeadSha
+        })
+      })
+      .mockResolvedValueOnce({ stdout: '', stderr: '' })
+
+    await expect(
+      mergePR('/repo-root', 13866, 'squash', undefined, {
+        owner: 'stablyai',
+        repo: 'orca',
+        host: 'github.com'
+      })
+    ).resolves.toEqual({ ok: true })
+
+    expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
+      3,
+      ['pr', 'merge', '13866', '--squash', '--repo', 'stablyai/orca'],
+      expect.objectContaining({ env: expect.objectContaining({ GH_PROMPT_DISABLED: '1' }) })
+    )
+    expect(acquireMock).toHaveBeenCalledTimes(1)
+    expect(releaseMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps legacy merge for unregistered dependent PR chains', async () => {
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          number: 202,
+          title: 'Dependent API',
+          state: 'open',
+          head: { ref: 'feature/api', sha: 'api-sha' },
+          base: { ref: 'feature/models', sha: 'models-sha' },
+          stack: null
+        })
+      })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          number: 202,
+          title: 'Dependent API',
+          state: 'OPEN',
+          url: 'https://github.com/stablyai/orca/pull/202',
+          statusCheckRollup: [],
+          updatedAt: '2026-08-10T00:00:00Z',
+          isDraft: false,
+          mergeable: 'MERGEABLE',
+          baseRefName: 'feature/models',
+          headRefOid: 'api-sha'
+        })
+      })
+      .mockResolvedValueOnce({ stdout: '', stderr: '' })
+
+    await expect(
+      mergePR('/repo-root', 202, 'squash', undefined, {
+        owner: 'stablyai',
+        repo: 'orca',
+        host: 'github.com'
+      })
+    ).resolves.toEqual({ ok: true })
+
+    expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
+      3,
+      ['pr', 'merge', '202', '--squash', '--repo', 'stablyai/orca'],
+      expect.objectContaining({ env: expect.objectContaining({ GH_PROMPT_DISABLED: '1' }) })
+    )
+  })
+
   it('uses explicit PR repo for merge and title mutations', async () => {
     ghExecFileAsyncMock
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          number: 7,
+          title: 'PR',
+          state: 'open',
+          head: { ref: 'feature', sha: 'head-oid' },
+          base: { ref: 'main', sha: 'base-oid' },
+          stack: null
+        })
+      })
       .mockResolvedValueOnce({
         stdout: JSON.stringify({
           number: 7,
@@ -4279,8 +5074,12 @@ describe('GitHub GraphQL rate-limit guard', () => {
     ).resolves.toBe(true)
 
     expect(getOwnerRepoMock).not.toHaveBeenCalled()
+    expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(1, ['api', 'repos/stablyai/orca/pulls/7'], {
+      cwd: '/repo-root',
+      host: 'github.com'
+    })
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
-      1,
+      2,
       [
         'pr',
         'view',
@@ -4293,7 +5092,7 @@ describe('GitHub GraphQL rate-limit guard', () => {
       { cwd: '/repo-root', host: 'github.com' }
     )
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
-      2,
+      3,
       ['pr', 'merge', '7', '--squash', '--repo', 'stablyai/orca'],
       expect.objectContaining({
         cwd: '/repo-root',
@@ -4302,7 +5101,7 @@ describe('GitHub GraphQL rate-limit guard', () => {
       })
     )
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
-      3,
+      4,
       ['pr', 'edit', '7', '--title', 'New title', '--repo', 'stablyai/orca'],
       { cwd: '/repo-root', host: 'github.com' }
     )
@@ -4310,6 +5109,7 @@ describe('GitHub GraphQL rate-limit guard', () => {
 
   it('sets and disables PR auto-merge with explicit PR repos and SSH context', async () => {
     ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify({ stack: null }) })
       .mockResolvedValueOnce({
         stdout: JSON.stringify({ id: 'PR_kwDO123', headRefOid: 'head-oid' })
       })
@@ -4330,13 +5130,16 @@ describe('GitHub GraphQL rate-limit guard', () => {
       })
     ).resolves.toEqual({ ok: true })
 
+    expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(1, ['api', 'repos/stablyai/orca/pulls/7'], {
+      host: 'github.com'
+    })
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
-      1,
+      2,
       ['pr', 'view', '7', '--json', 'id,headRefOid,baseRefName', '--repo', 'stablyai/orca'],
       { host: 'github.com' }
     )
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
-      2,
+      3,
       expect.arrayContaining([
         'api',
         'graphql',
@@ -4353,7 +5156,7 @@ describe('GitHub GraphQL rate-limit guard', () => {
       })
     )
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
-      3,
+      4,
       ['pr', 'merge', '7', '--disable-auto', '--repo', 'stablyai/orca'],
       expect.objectContaining({
         env: expect.objectContaining({ GH_PROMPT_DISABLED: '1' }),
@@ -4365,6 +5168,7 @@ describe('GitHub GraphQL rate-limit guard', () => {
 
   it('enables auto-merge without invoking the direct merge command', async () => {
     ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify({ stack: null }) })
       .mockResolvedValueOnce({
         stdout: JSON.stringify({ id: 'PR_kwDO123', headRefOid: 'head-oid' })
       })
@@ -4391,8 +5195,39 @@ describe('GitHub GraphQL rate-limit guard', () => {
     ).toBe(false)
   })
 
+  it('rejects auto-merge for GitHub-registered stacks', async () => {
+    ghExecFileAsyncMock.mockResolvedValueOnce({
+      stdout: JSON.stringify({
+        number: 202,
+        title: 'Stack API',
+        state: 'open',
+        head: { ref: 'stack/api', sha: 'head-oid' },
+        base: { ref: 'stack/models', sha: 'models-sha' },
+        stack: {
+          number: 51,
+          position: 2,
+          size: 2,
+          base: { ref: 'main', sha: 'main-sha' }
+        }
+      })
+    })
+
+    await expect(
+      setPRAutoMerge('/repo-root', 202, true, 'squash', undefined, {
+        owner: 'stablyai',
+        repo: 'orca',
+        host: 'github.com'
+      })
+    ).resolves.toEqual({
+      ok: false,
+      error: 'GitHub does not support auto-merge for stacked pull requests.'
+    })
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(1)
+  })
+
   it('translates the GitHub clean-status rejection into an actionable message', async () => {
     ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify({ stack: null }) })
       .mockResolvedValueOnce({
         stdout: JSON.stringify({ id: 'PR_kwDO123', headRefOid: 'head-oid' })
       })
@@ -4412,6 +5247,7 @@ describe('GitHub GraphQL rate-limit guard', () => {
 
   it('uses the queue-aware gh merge path when the base branch has a merge queue', async () => {
     ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify({ stack: null }) })
       .mockResolvedValueOnce({
         stdout: JSON.stringify({ id: 'PR_kwDO123', headRefOid: 'head-oid', baseRefName: 'main' })
       })
@@ -4429,12 +5265,12 @@ describe('GitHub GraphQL rate-limit guard', () => {
     ).resolves.toEqual({ ok: true })
 
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
-      2,
+      3,
       expect.arrayContaining(['api', 'graphql', '-f', 'branch=main']),
       { cwd: '/repo-root', host: 'github.com' }
     )
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
-      3,
+      4,
       ['pr', 'merge', '7', '--auto', '--squash', '--repo', 'stablyai/orca'],
       expect.objectContaining({
         cwd: '/repo-root',
@@ -4450,24 +5286,26 @@ describe('GitHub GraphQL rate-limit guard', () => {
   })
 
   it('blocks direct merge when GitHub reports required approval', async () => {
-    ghExecFileAsyncMock.mockResolvedValueOnce({
-      stdout: JSON.stringify({
-        number: 7,
-        title: 'PR',
-        state: 'OPEN',
-        url: 'https://github.com/stablyai/orca/pull/7',
-        statusCheckRollup: [],
-        updatedAt: '2026-04-01T00:00:00Z',
-        isDraft: false,
-        mergeable: 'MERGEABLE',
-        reviewDecision: 'REVIEW_REQUIRED',
-        mergeStateStatus: 'CLEAN',
-        autoMergeRequest: null,
-        baseRefName: 'main',
-        baseRefOid: 'base-oid',
-        headRefOid: 'head-oid'
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify({ stack: null }) })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          number: 7,
+          title: 'PR',
+          state: 'OPEN',
+          url: 'https://github.com/stablyai/orca/pull/7',
+          statusCheckRollup: [],
+          updatedAt: '2026-04-01T00:00:00Z',
+          isDraft: false,
+          mergeable: 'MERGEABLE',
+          reviewDecision: 'REVIEW_REQUIRED',
+          mergeStateStatus: 'CLEAN',
+          autoMergeRequest: null,
+          baseRefName: 'main',
+          baseRefOid: 'base-oid',
+          headRefOid: 'head-oid'
+        })
       })
-    })
 
     await expect(
       mergePR('/repo-root', 7, 'squash', undefined, {
@@ -4480,8 +5318,8 @@ describe('GitHub GraphQL rate-limit guard', () => {
       error: 'This pull request requires review approval before it can be merged.'
     })
 
-    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(2)
-    expect(ghExecFileAsyncMock.mock.calls[1]?.[0]).toContain('graphql')
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(3)
+    expect(ghExecFileAsyncMock.mock.calls[2]?.[0]).toContain('graphql')
   })
 
   it('detects merge queues once per base branch and blocks direct merges', async () => {
@@ -4502,10 +5340,12 @@ describe('GitHub GraphQL rate-limit guard', () => {
       headRefOid: 'head-oid'
     }
     ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify({ stack: null }) })
       .mockResolvedValueOnce({ stdout: JSON.stringify(prView) })
       .mockResolvedValueOnce({
         stdout: JSON.stringify({ data: { repository: { mergeQueue: { id: 'MQ_kw' } } } })
       })
+      .mockResolvedValueOnce({ stdout: JSON.stringify({ stack: null }) })
       .mockResolvedValueOnce({ stdout: JSON.stringify(prView) })
 
     await expect(
@@ -4526,10 +5366,10 @@ describe('GitHub GraphQL rate-limit guard', () => {
     expect(
       ghExecFileAsyncMock.mock.calls.filter((call) => call[0].includes('graphql'))
     ).toHaveLength(1)
-    expect(ghExecFileAsyncMock.mock.calls[1]?.[0]).toEqual(
+    expect(ghExecFileAsyncMock.mock.calls[2]?.[0]).toEqual(
       expect.arrayContaining(['-f', 'owner=stablyai', '-f', 'repo=orca', '-f', 'branch=true'])
     )
-    expect(ghExecFileAsyncMock.mock.calls[1]?.[0]).not.toContain('-F')
+    expect(ghExecFileAsyncMock.mock.calls[2]?.[0]).not.toContain('-F')
   })
 
   it('caches unknown merge queue probes after GraphQL failures', async () => {
@@ -4553,7 +5393,9 @@ describe('GitHub GraphQL rate-limit guard', () => {
     ghExecFileAsyncMock
       .mockResolvedValueOnce({ stdout: JSON.stringify(prView) })
       .mockRejectedValueOnce(new Error('network is down'))
+      .mockResolvedValueOnce({ stdout: '{}' })
       .mockResolvedValueOnce({ stdout: JSON.stringify(prView) })
+      .mockResolvedValueOnce({ stdout: '{}' })
 
     await expect(getPRForBranch('/repo-root', 'feature/test', 7)).resolves.toMatchObject({
       mergeQueueRequired: null
@@ -4679,21 +5521,23 @@ describe('GitHub GraphQL rate-limit guard', () => {
   })
 
   it('returns conflicting file details instead of running gh merge when PR is dirty', async () => {
-    ghExecFileAsyncMock.mockResolvedValueOnce({
-      stdout: JSON.stringify({
-        number: 7,
-        title: 'PR',
-        state: 'OPEN',
-        url: 'https://github.com/stablyai/orca/pull/7',
-        statusCheckRollup: [],
-        updatedAt: '2026-04-01T00:00:00Z',
-        isDraft: false,
-        mergeable: 'CONFLICTING',
-        baseRefName: 'main',
-        baseRefOid: 'base-oid',
-        headRefOid: 'head-oid'
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify({ stack: null }) })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({
+          number: 7,
+          title: 'PR',
+          state: 'OPEN',
+          url: 'https://github.com/stablyai/orca/pull/7',
+          statusCheckRollup: [],
+          updatedAt: '2026-04-01T00:00:00Z',
+          isDraft: false,
+          mergeable: 'CONFLICTING',
+          baseRefName: 'main',
+          baseRefOid: 'base-oid',
+          headRefOid: 'head-oid'
+        })
       })
-    })
     gitExecFileAsyncMock
       .mockResolvedValueOnce({ stdout: '' })
       .mockResolvedValueOnce({ stdout: 'latest-base-oid\n' })
@@ -4716,11 +5560,12 @@ describe('GitHub GraphQL rate-limit guard', () => {
         '- src/conflict.ts'
     })
 
-    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(1)
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(2)
   })
 
   it('does not run merge conflict preflight for SSH-backed repos', async () => {
     ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify({ stack: null }) })
       .mockResolvedValueOnce({
         stdout: JSON.stringify({
           number: 7,
@@ -4746,9 +5591,9 @@ describe('GitHub GraphQL rate-limit guard', () => {
       })
     ).resolves.toEqual({ ok: true })
 
-    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(2)
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(3)
     expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
-      2,
+      3,
       ['pr', 'merge', '7', '--squash', '--repo', 'stablyai/orca'],
       expect.objectContaining({
         env: expect.objectContaining({ GH_PROMPT_DISABLED: '1' })
diff --git a/src/main/github/client.ts b/src/main/github/client.ts
index 4f95432fcfd..068d3ccc419 100644
--- a/src/main/github/client.ts
+++ b/src/main/github/client.ts
@@ -20,7 +20,8 @@ import type {
   GitHubPullRequestStateUpdate,
   GitHubRerunPRChecksResult,
   GitHubPRMergeMethod,
-  GitHubPRMergeMethodSettings
+  GitHubPRMergeMethodSettings,
+  GitHubPRStack
 } from '../../shared/types'
 import type { CreateHostedReviewInput, CreateHostedReviewResult } from '../../shared/hosted-review'
 import {
@@ -123,8 +124,13 @@ import {
   spendsSharedGitHubComQuota,
   type RateLimitBucketKind
 } from './rate-limit'
+import {
+  GITHUB_CHECK_DETAILS_HOST_TIMEOUT_MS,
+  GITHUB_CHECK_DETAILS_TIMEOUT_MESSAGE
+} from '../../shared/github-check-details-deadline'
+import { hydrateGitHubPRStack, mergeGitHubPRStack } from './github-pr-stack'
 
-type GhExecOptions = GitHubRepoExecOptions
+type GhExecOptions = GitHubRepoExecOptions & { signal?: AbortSignal }
 type HostedReviewLocalGitOptions = ReturnType<typeof getHostedReviewLocalGitOptions>
 
 const ORCA_REPO = 'stablyai/orca'
@@ -149,6 +155,30 @@ function setPrCheckLogTailCache(cacheKey: string, logTail: string | null): void
     prCheckLogTailCache.delete(oldestKey)
   }
 }
+
+function rethrowCheckDetailsAbort(signal: AbortSignal | undefined, error: unknown): void {
+  if (signal?.aborted) {
+    throw error
+  }
+}
+
+function waitForCheckDetailsResolution<T>(operation: Promise<T>, signal: AbortSignal): Promise<T> {
+  if (signal.aborted) {
+    return Promise.reject(signal.reason)
+  }
+  return new Promise((resolve, reject) => {
+    const finish = (settle: () => void): void => {
+      signal.removeEventListener('abort', onAbort)
+      settle()
+    }
+    const onAbort = (): void => finish(() => reject(signal.reason))
+    signal.addEventListener('abort', onAbort, { once: true })
+    void operation.then(
+      (value) => finish(() => resolve(value)),
+      (error) => finish(() => reject(error))
+    )
+  })
+}
 const MERGE_QUEUE_CACHE_TTL_MS = 10 * 60 * 1000
 const MERGE_QUEUE_UNKNOWN_CACHE_TTL_MS = 60 * 1000
 const MERGE_QUEUE_CACHE_MAX_ENTRIES = 256
@@ -161,11 +191,32 @@ const repositoryMergeMetadataCache = new Map<
   string,
   { value: GitHubRepositoryMergeMetadata; expiresAt: number }
 >()
+const PR_STACK_SUMMARY_CACHE_TTL_MS = 60_000
+const PR_STACK_SUMMARY_CACHE_MAX_ENTRIES = 512
+const STACK_METADATA_UNAVAILABLE_ERROR =
+  'Could not verify GitHub pull request stack metadata. Refresh and try again.'
+const prStackSummaryCache = new Map<
+  string,
+  { value: GitHubPRStack | undefined; expiresAt: number }
+>()
+const prStackSummaryInFlight = new Map<string, Promise<GitHubPRStack | undefined>>()
+
+function githubPRStackExecutionScope(
+  connectionId?: string | null,
+  localGitOptions: LocalGitExecOptions = {}
+): string {
+  return connectionId ? `ssh:${connectionId}` : `local:${localGitOptions.wslDistro ?? 'host'}`
+}
 
 export function _resetMergeQueueCacheForTests(): void {
   repositoryMergeMetadataCache.clear()
 }
 
+export function _resetPRStackSummaryCacheForTests(): void {
+  prStackSummaryCache.clear()
+  prStackSummaryInFlight.clear()
+}
+
 export function _getMergeQueueCacheSizeForTests(): number {
   return repositoryMergeMetadataCache.size
 }
@@ -2162,6 +2213,8 @@ type PullRequestLookupData = {
   headRefName?: string
   baseRefOid?: string
   headRefOid?: string
+  stack?: GitHubPRStack
+  stackMetadataChecked?: boolean
 }
 
 type RestPullRequest = {
@@ -2177,6 +2230,12 @@ type RestPullRequest = {
   mergeable_state?: string | null
   base?: { ref?: string; sha?: string }
   head?: { ref?: string; sha?: string }
+  stack?: {
+    number?: number
+    position?: number
+    size?: number
+    base?: { ref?: string; sha?: string }
+  } | null
 }
 
 const PR_LOOKUP_JSON_FIELDS =
@@ -2216,6 +2275,19 @@ function derivePullRequestMergeable(data: PullRequestLookupData): PRMergeableSta
 }
 
 function mapRestPullRequest(pr: RestPullRequest): PullRequestLookupData {
+  const stack =
+    typeof pr.stack?.number === 'number' &&
+    typeof pr.stack.position === 'number' &&
+    typeof pr.stack.size === 'number' &&
+    typeof pr.stack.base?.ref === 'string'
+      ? {
+          number: pr.stack.number,
+          position: pr.stack.position,
+          size: pr.stack.size,
+          baseRefName: pr.stack.base.ref,
+          ...(typeof pr.stack.base.sha === 'string' ? { baseSha: pr.stack.base.sha } : {})
+        }
+      : undefined
   return {
     number: pr.number,
     title: pr.title,
@@ -2228,7 +2300,9 @@ function mapRestPullRequest(pr: RestPullRequest): PullRequestLookupData {
     baseRefName: pr.base?.ref,
     headRefName: pr.head?.ref,
     baseRefOid: pr.base?.sha,
-    headRefOid: pr.head?.sha
+    headRefOid: pr.head?.sha,
+    stackMetadataChecked: true,
+    ...(stack ? { stack } : {})
   }
 }
 
@@ -2298,9 +2372,10 @@ function cacheRepositoryMergeMetadata(
 async function detectRepositoryMergeMetadata(
   ownerRepo: GitHubApiRepository,
   branchName: string | undefined,
-  ghOptions: GhExecOptions
+  ghOptions: GhExecOptions,
+  executionScope = 'default'
 ): Promise<GitHubRepositoryMergeMetadata> {
-  const cacheKey = `${githubRepoIdentityKey(ownerRepo)}:${branchName ?? '__repo__'}`
+  const cacheKey = `${executionScope}\0${githubRepoIdentityKey(ownerRepo)}:${branchName ?? '__repo__'}`
   pruneRepositoryMergeMetadataCache()
   const cached = repositoryMergeMetadataCache.get(cacheKey)
   if (cached) {
@@ -2311,7 +2386,7 @@ async function detectRepositoryMergeMetadata(
     return { mergeQueueRequired: null, autoMergeAllowed: null }
   }
   const query = branchName
-    ? `query($owner: String!, $repo: String!, $branch: String!) {
+    ? `query($owner: String!, $repo: String!, $branch: String!, $qualified: String!) {
     repository(owner: $owner, name: $repo) {
       viewerDefaultMergeMethod
       mergeCommitAllowed
@@ -2319,6 +2394,9 @@ async function detectRepositoryMergeMetadata(
       squashMergeAllowed
       autoMergeAllowed
       mergeQueue(branch: $branch) { id }
+      ref(qualifiedName: $qualified) {
+        rules(first: 50) { nodes { type } }
+      }
     }
   }`
     : `query($owner: String!, $repo: String!) {
@@ -2344,6 +2422,7 @@ async function detectRepositoryMergeMetadata(
     ]
     if (branchName) {
       args.push('-f', `branch=${branchName}`)
+      args.push('-f', `qualified=refs/heads/${branchName}`)
     }
     const { stdout } = await ghExecFileAsync(args, {
       ...ghOptions,
@@ -2358,6 +2437,7 @@ async function detectRepositoryMergeMetadata(
           squashMergeAllowed?: unknown
           autoMergeAllowed?: unknown
           mergeQueue?: { id?: unknown } | null
+          ref?: { rules?: { nodes?: ({ type?: unknown } | null)[] | null } | null } | null
         } | null
       }
     }
@@ -2371,7 +2451,10 @@ async function detectRepositoryMergeMetadata(
         })
       : undefined
     const value: GitHubRepositoryMergeMetadata = {
-      mergeQueueRequired: branchName ? Boolean(repository?.mergeQueue) : null,
+      mergeQueueRequired: branchName
+        ? Boolean(repository?.mergeQueue) ||
+          Boolean(repository?.ref?.rules?.nodes?.some((rule) => rule?.type === 'MERGE_QUEUE'))
+        : null,
       autoMergeAllowed:
         typeof repository?.autoMergeAllowed === 'boolean' ? repository.autoMergeAllowed : null,
       ...(mergeMethodSettings ? { mergeMethodSettings } : {})
@@ -2392,13 +2475,19 @@ async function detectRepositoryMergeMetadata(
 async function hydratePullRequestLookupData(
   ownerRepo: OwnerRepo,
   data: PullRequestLookupData,
-  ghOptions: GhExecOptions
+  ghOptions: GhExecOptions,
+  executionScope: string
 ): Promise<PullRequestLookupData> {
   const normalized = normalizePullRequestLookupData(data)
   const hasRichMergeFields =
     'reviewDecision' in data || 'mergeStateStatus' in data || 'autoMergeRequest' in data
   const mergeMetadata = hasRichMergeFields
-    ? await detectRepositoryMergeMetadata(ownerRepo, normalized.baseRefName, ghOptions)
+    ? await detectRepositoryMergeMetadata(
+        ownerRepo,
+        normalized.stack?.baseRefName ?? normalized.baseRefName,
+        ghOptions,
+        executionScope
+      )
     : undefined
   return {
     ...normalized,
@@ -2413,13 +2502,17 @@ async function hydratePullRequestLookupData(
 async function hydrateBranchLookupWithExactPR(
   ownerRepo: OwnerRepo,
   branchData: PullRequestLookupData | null,
-  ghOptions: GhExecOptions
+  ghOptions: GhExecOptions,
+  executionScope: string
 ): Promise<PullRequestLookupData | null> {
   if (!branchData) {
     return null
   }
   try {
-    return (await getPRByNumber(ownerRepo, branchData.number, ghOptions)) ?? branchData
+    return (
+      (await getPRByNumber(ownerRepo, branchData.number, ghOptions, executionScope, branchData)) ??
+      branchData
+    )
   } catch {
     return branchData
   }
@@ -2772,6 +2865,7 @@ async function lookupPRByBranchName(args: {
   headRepo: OwnerRepo | null
   branchName: string
   ghOptions: GhExecOptions
+  executionScope: string
 }): Promise<{
   data: PullRequestLookupData | null
   dataRepo: OwnerRepo | null
@@ -2791,7 +2885,12 @@ async function lookupPRByBranchName(args: {
             )
           : await getFallbackPRListForBranch(candidate, args.branchName, args.ghOptions)
         // Why: REST/list branch lookup identifies the PR cheaply; exact `gh pr view` carries review, merge-queue, and auto-merge state.
-        const data = await hydrateBranchLookupWithExactPR(candidate, branchData, args.ghOptions)
+        const data = await hydrateBranchLookupWithExactPR(
+          candidate,
+          branchData,
+          args.ghOptions,
+          args.executionScope
+        )
         if (data) {
           return { data, dataRepo: candidate }
         }
@@ -2810,7 +2909,12 @@ async function lookupPRByBranchName(args: {
             args.branchName,
             args.ghOptions
           )
-          const data = await hydrateBranchLookupWithExactPR(candidate, branchData, args.ghOptions)
+          const data = await hydrateBranchLookupWithExactPR(
+            candidate,
+            branchData,
+            args.ghOptions,
+            args.executionScope
+          )
           if (data) {
             return { data, dataRepo: candidate }
           }
@@ -2845,22 +2949,136 @@ async function lookupPRByBranchName(args: {
   }
 }
 
+function isPositiveSafeInteger(value: unknown): value is number {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value > 0
+}
+
+function isGitObjectId(value: unknown): value is string {
+  return typeof value === 'string' && /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(value)
+}
+
+function isUsableRestStackMetadata(value: unknown): boolean {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return false
+  }
+  const stack = value as {
+    number?: unknown
+    position?: unknown
+    size?: unknown
+    base?: unknown
+  }
+  if (!stack.base || typeof stack.base !== 'object' || Array.isArray(stack.base)) {
+    return false
+  }
+  const base = stack.base as { ref?: unknown; sha?: unknown }
+  return (
+    isPositiveSafeInteger(stack.number) &&
+    isPositiveSafeInteger(stack.position) &&
+    isPositiveSafeInteger(stack.size) &&
+    stack.position <= stack.size &&
+    typeof base.ref === 'string' &&
+    base.ref.trim().length > 0 &&
+    (base.sha === undefined || isGitObjectId(base.sha))
+  )
+}
+
 async function getRestPRByNumber(
   ownerRepo: GitHubApiRepository,
   number: number,
-  ghOptions: ReturnType<typeof ghRepoExecOptions>
-): Promise<PullRequestLookupData | null> {
+  ghOptions: ReturnType<typeof ghRepoExecOptions>,
+  options: { requireUsableStackMetadata?: boolean } = {}
+): Promise<PullRequestLookupData> {
   const { stdout } = await ghExecFileAsync(
     ['api', `repos/${ownerRepo.owner}/${ownerRepo.repo}/pulls/${number}`],
     { ...ghOptions, ...githubHostExecOptions(ownerRepo) }
   )
-  return mapRestPullRequest(JSON.parse(stdout) as RestPullRequest)
+  const parsed = JSON.parse(stdout) as unknown
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    throw new Error('invalid response shape')
+  }
+  const restData = parsed as RestPullRequest
+  const mapped = mapRestPullRequest(restData)
+  if (
+    options.requireUsableStackMetadata &&
+    restData.stack !== undefined &&
+    restData.stack !== null
+  ) {
+    // Why: GitHub omits stack for ordinary PRs; only unusable non-null metadata is unsafe.
+    if (!isUsableRestStackMetadata(restData.stack) || !mapped.stack) {
+      throw new Error('malformed stack')
+    }
+    if (!isGitObjectId(restData.head?.sha)) {
+      throw new Error('missing head SHA')
+    }
+  }
+  return mapped
+}
+
+function prunePRStackSummaryCache(now = Date.now()): void {
+  for (const [key, cached] of prStackSummaryCache) {
+    if (cached.expiresAt <= now) {
+      prStackSummaryCache.delete(key)
+    }
+  }
+  while (prStackSummaryCache.size > PR_STACK_SUMMARY_CACHE_MAX_ENTRIES) {
+    const oldestKey = prStackSummaryCache.keys().next().value
+    if (oldestKey === undefined) {
+      return
+    }
+    prStackSummaryCache.delete(oldestKey)
+  }
+}
+
+async function getCachedGitHubPRStackSummary(
+  ownerRepo: GitHubApiRepository,
+  number: number,
+  ghOptions: ReturnType<typeof ghRepoExecOptions>,
+  executionScope: string
+): Promise<GitHubPRStack | undefined> {
+  const key = `${executionScope}\0${githubRepoIdentityKey(ownerRepo)}#${number}`
+  const now = Date.now()
+  prunePRStackSummaryCache(now)
+  const cached = prStackSummaryCache.get(key)
+  if (cached && cached.expiresAt > now) {
+    return cached.value
+  }
+  const existing = prStackSummaryInFlight.get(key)
+  if (existing) {
+    return existing
+  }
+  const request = getRestPRByNumber(ownerRepo, number, ghOptions).then((pr) => pr.stack)
+  prStackSummaryInFlight.set(key, request)
+  try {
+    const value = await request
+    prStackSummaryCache.delete(key)
+    prStackSummaryCache.set(key, {
+      value,
+      expiresAt: Date.now() + PR_STACK_SUMMARY_CACHE_TTL_MS
+    })
+    prunePRStackSummaryCache()
+    return value
+  } catch (err) {
+    // Why: avoid repeating a failed REST probe on every review poll.
+    prStackSummaryCache.delete(key)
+    prStackSummaryCache.set(key, {
+      value: undefined,
+      expiresAt: Date.now() + PR_STACK_SUMMARY_CACHE_TTL_MS
+    })
+    prunePRStackSummaryCache()
+    throw err
+  } finally {
+    if (prStackSummaryInFlight.get(key) === request) {
+      prStackSummaryInFlight.delete(key)
+    }
+  }
 }
 
 async function getPRByNumber(
   ownerRepo: GitHubApiRepository,
   number: number,
-  ghOptions: ReturnType<typeof ghRepoExecOptions>
+  ghOptions: ReturnType<typeof ghRepoExecOptions>,
+  executionScope: string,
+  knownPullRequestData?: PullRequestLookupData | null
 ): Promise<PullRequestLookupData | null> {
   try {
     const { stdout } = await ghExecFileAsync(
@@ -2875,10 +3093,16 @@ async function getPRByNumber(
       ],
       { ...ghOptions, ...githubHostExecOptions(ownerRepo) }
     )
+    const exactData = JSON.parse(stdout) as PullRequestLookupData
     return hydratePullRequestLookupData(
       ownerRepo,
-      JSON.parse(stdout) as PullRequestLookupData,
-      ghOptions
+      {
+        ...knownPullRequestData,
+        ...exactData,
+        ...(knownPullRequestData?.stack ? { stack: knownPullRequestData.stack } : {})
+      },
+      ghOptions,
+      executionScope
     )
   } catch (err) {
     // Why: deleted/edited linked PR metadata falls back to branch discovery; quota/auth/network failures get one cheaper REST exact lookup.
@@ -2886,8 +3110,13 @@ async function getPRByNumber(
       return null
     }
     try {
-      const restData = await getRestPRByNumber(ownerRepo, number, ghOptions)
-      return restData ? hydratePullRequestLookupData(ownerRepo, restData, ghOptions) : null
+      const restData =
+        knownPullRequestData === undefined
+          ? await getRestPRByNumber(ownerRepo, number, ghOptions)
+          : knownPullRequestData
+      return restData
+        ? hydratePullRequestLookupData(ownerRepo, restData, ghOptions, executionScope)
+        : null
     } catch (restErr) {
       if (isNotFoundGhError(restErr)) {
         return null
@@ -2904,10 +3133,16 @@ async function lookupPRByNumber(args: {
   candidates: OwnerRepo[]
   number: number
   ghOptions: ReturnType<typeof ghRepoExecOptions>
+  executionScope: string
 }): Promise<{ data: PullRequestLookupData | null; dataRepo: OwnerRepo | null }> {
   for (const candidate of args.candidates) {
     try {
-      const linkedData = await getPRByNumber(candidate, args.number, args.ghOptions)
+      const linkedData = await getPRByNumber(
+        candidate,
+        args.number,
+        args.ghOptions,
+        args.executionScope
+      )
       if (!linkedData) {
         continue
       }
@@ -3006,6 +3241,7 @@ export async function getPRForBranchOutcome(
   const localGitOptions = localGitArgs[0] ?? {}
   const context = githubRepoContext(repoPath, connectionId, localGitOptions)
   const ghOptions = ghRepoExecOptions(context)
+  const executionScope = githubPRStackExecutionScope(connectionId, localGitOptions)
 
   await acquire()
   try {
@@ -3032,6 +3268,7 @@ export async function getPRForBranchOutcome(
     let pendingBranchLookupError: unknown
     let hasPendingBranchLookupError = false
     let currentHeadOidForMergedImplicit: string | null | undefined
+    let usedExactNumberLookup = false
 
     const explicitCurrentHeadOid =
       typeof options.currentHeadOid === 'string' && options.currentHeadOid.trim().length > 0
@@ -3104,10 +3341,12 @@ export async function getPRForBranchOutcome(
     }
 
     if (typeof linkedPRNumber === 'number') {
+      usedExactNumberLookup = true
       const exactLookup = await lookupPRByNumber({
         candidates,
         number: linkedPRNumber,
-        ghOptions
+        ghOptions,
+        executionScope
       })
       data = exactLookup.data
       dataRepo = exactLookup.dataRepo
@@ -3117,7 +3356,8 @@ export async function getPRForBranchOutcome(
         candidates,
         headRepo,
         branchName,
-        ghOptions
+        ghOptions,
+        executionScope
       })
       data = branchLookup.data
       dataRepo = branchLookup.dataRepo
@@ -3149,7 +3389,8 @@ export async function getPRForBranchOutcome(
               candidates,
               headRepo: upstreamHeadRepo,
               branchName: upstreamBranch.branchName,
-              ghOptions
+              ghOptions,
+              executionScope
             })
             data = upstreamLookup.data
             dataRepo = upstreamLookup.dataRepo
@@ -3172,10 +3413,12 @@ export async function getPRForBranchOutcome(
       dataHeadRepo = headRepo
     }
     if (!data && typeof linkedPRNumber !== 'number' && typeof fallbackPRNumber === 'number') {
+      usedExactNumberLookup = true
       const fallbackLookup = await lookupPRByNumber({
         candidates,
         number: fallbackPRNumber,
-        ghOptions
+        ghOptions,
+        executionScope
       })
       data = fallbackLookup.data
       dataRepo = fallbackLookup.dataRepo
@@ -3221,7 +3464,42 @@ export async function getPRForBranchOutcome(
       return { kind: 'no-pr', fetchedAt: Date.now() }
     }
 
+    if (!data.stackMetadataChecked && dataRepo && usedExactNumberLookup) {
+      try {
+        data.stack = await getCachedGitHubPRStackSummary(
+          dataRepo,
+          data.number,
+          ghOptions,
+          executionScope
+        )
+        data.stackMetadataChecked = true
+      } catch {
+        // Stack metadata is additive; exact PR lookup remains usable without it.
+      }
+    }
     const mergeable = derivePullRequestMergeable(data)
+    const stack =
+      data.stack && dataRepo
+        ? await hydrateGitHubPRStack(
+            dataRepo,
+            data.number,
+            data.stack,
+            ghOptions,
+            data.updatedAt,
+            executionScope
+          )
+        : data.stack
+    const stackMergeQueueRequired =
+      stack && dataRepo
+        ? (
+            await detectRepositoryMergeMetadata(
+              dataRepo,
+              stack.baseRefName,
+              ghOptions,
+              executionScope
+            )
+          ).mergeQueueRequired
+        : undefined
     const conflictSummary =
       !connectionId &&
       mergeable === 'CONFLICTING' &&
@@ -3251,13 +3529,19 @@ export async function getPRForBranchOutcome(
         ...(data.reviewDecision !== undefined ? { reviewDecision: data.reviewDecision } : {}),
         ...(data.autoMergeEnabled !== undefined ? { autoMergeEnabled: data.autoMergeEnabled } : {}),
         ...(data.autoMergeAllowed !== undefined ? { autoMergeAllowed: data.autoMergeAllowed } : {}),
-        ...(data.mergeQueueRequired !== undefined
-          ? { mergeQueueRequired: data.mergeQueueRequired }
+        ...(stackMergeQueueRequired !== undefined || data.mergeQueueRequired !== undefined
+          ? {
+              mergeQueueRequired:
+                stackMergeQueueRequired !== undefined
+                  ? stackMergeQueueRequired
+                  : data.mergeQueueRequired
+            }
           : {}),
         ...(data.mergeMethodSettings !== undefined
           ? { mergeMethodSettings: data.mergeMethodSettings }
           : {}),
         ...(data.mergeStateStatus !== undefined ? { mergeStateStatus: data.mergeStateStatus } : {}),
+        ...(stack ? { stack } : {}),
         headSha: data.headRefOid,
         ...(confirmedContainedHeadOid ? { confirmedContainedHeadOid } : {}),
         ...(headDivergedFromMergedPRAtOid ? { headDivergedFromMergedPRAtOid } : {}),
@@ -3893,6 +4177,7 @@ async function attachFailedJobLogTails(
       )
       job.logTail = sliceCheckLogTail(stdout)
     } catch (err) {
+      rethrowCheckDetailsAbort(ghOptions.signal, err)
       console.warn('getPRCheckDetails workflow job log fetch failed:', err)
       job.logTail = null
     }
@@ -3925,20 +4210,34 @@ export async function getPRCheckDetails(
     prRepo?: GitHubApiRepository | null
   },
   connectionId?: string | null,
-  localGitOptions: LocalGitExecOptions = {}
+  localGitOptions: LocalGitExecOptions = {},
+  callerSignal?: AbortSignal
 ): Promise<PRCheckRunDetails | null> {
-  const { ownerRepo, ghOptions } = await resolveGitHubRepoExecution(
-    repoPath,
-    args.prRepo,
-    connectionId,
-    localGitOptions
-  )
-  if (!ownerRepo) {
-    return null
+  const controller = new AbortController()
+  let hostDeadlineExpired = false
+  const forwardCallerAbort = (): void => controller.abort(callerSignal?.reason)
+  if (callerSignal?.aborted) {
+    forwardCallerAbort()
+  } else {
+    callerSignal?.addEventListener('abort', forwardCallerAbort, { once: true })
   }
-
-  await acquire()
+  const hostDeadline = setTimeout(() => {
+    hostDeadlineExpired = true
+    controller.abort(new Error(GITHUB_CHECK_DETAILS_TIMEOUT_MESSAGE))
+  }, GITHUB_CHECK_DETAILS_HOST_TIMEOUT_MS)
+  let acquired = false
   try {
+    const resolved = await waitForCheckDetailsResolution(
+      resolveGitHubRepoExecution(repoPath, args.prRepo, connectionId, localGitOptions),
+      controller.signal
+    )
+    if (!resolved.ownerRepo) {
+      return null
+    }
+    const ownerRepo = resolved.ownerRepo
+    const ghOptions: GhExecOptions = { ...resolved.ghOptions, signal: controller.signal }
+    await acquire(controller.signal)
+    acquired = true
     let checkRun: Record<string, unknown> | null = null
     let annotations: PRCheckRunDetails['annotations'] = []
     if (args.checkRunId) {
@@ -3957,6 +4256,7 @@ export async function getPRCheckDetails(
         )
         annotations = mapCheckAnnotations(JSON.parse(annotationsResult.stdout))
       } catch (err) {
+        rethrowCheckDetailsAbort(controller.signal, err)
         console.warn('getPRCheckDetails annotations fetch failed:', err)
       }
     }
@@ -3975,6 +4275,7 @@ export async function getPRCheckDetails(
         jobs = mapWorkflowJobs(JSON.parse(stdout), args.checkName)
         await attachFailedJobLogTails(jobs, ownerRepo, ghOptions)
       } catch (err) {
+        rethrowCheckDetailsAbort(controller.signal, err)
         console.warn('getPRCheckDetails workflow jobs fetch failed:', err)
       }
     }
@@ -3999,9 +4300,16 @@ export async function getPRCheckDetails(
     }
   } catch (err) {
     console.warn('getPRCheckDetails failed:', err)
-    return null
+    if (hostDeadlineExpired && !callerSignal?.aborted) {
+      throw new Error(GITHUB_CHECK_DETAILS_TIMEOUT_MESSAGE)
+    }
+    throw err
   } finally {
-    release()
+    clearTimeout(hostDeadline)
+    callerSignal?.removeEventListener('abort', forwardCallerAbort)
+    if (acquired) {
+      release()
+    }
   }
 }
 
@@ -4760,7 +5068,44 @@ export async function mergePR(
     return { ok: false, error: 'Could not resolve GitHub owner/repo for this repository' }
   }
   await acquire()
+  let concurrencySlotHeld = true
   try {
+    let restData: PullRequestLookupData
+    try {
+      restData = await getRestPRByNumber(ownerRepo, prNumber, ghOptions, {
+        requireUsableStackMetadata: true
+      })
+    } catch (err) {
+      const diagnostic =
+        err instanceof SyntaxError
+          ? 'invalid JSON response'
+          : err instanceof Error
+            ? err.message
+            : String(err)
+      console.warn(
+        `mergePR stack metadata probe failed for ${ownerRepo.owner}/${ownerRepo.repo}#${String(prNumber)}:`,
+        diagnostic
+      )
+      return { ok: false, error: STACK_METADATA_UNAVAILABLE_ERROR }
+    }
+    if (restData.stack) {
+      const mergeMetadata = await detectRepositoryMergeMetadata(
+        ownerRepo,
+        restData.stack.baseRefName,
+        ghOptions,
+        githubPRStackExecutionScope(connectionId, localGitOptions)
+      )
+      release()
+      concurrencySlotHeld = false
+      return await mergeGitHubPRStack({
+        repository: ownerRepo,
+        prNumber,
+        method,
+        mergeAction: mergeMetadata.mergeQueueRequired === true ? 'merge_queue' : 'direct_merge',
+        headSha: restData.headRefOid,
+        ghOptions
+      })
+    }
     const mergeBlocker = await getPRMergeBlocker(
       repoPath,
       prNumber,
@@ -4788,7 +5133,9 @@ export async function mergePR(
       err instanceof Error ? err.message : typeof err === 'string' ? err : 'Unknown error'
     return { ok: false, error: message }
   } finally {
-    release()
+    if (concurrencySlotHeld) {
+      release()
+    }
   }
 }
 
@@ -4899,11 +5246,25 @@ async function enablePRAutoMerge(
   ownerRepo: GitHubApiRepository | null,
   ghOptions: GhExecOptions
 ): Promise<{ ok: true } | { ok: false; error: string }> {
+  if (ownerRepo) {
+    try {
+      const restData = await getRestPRByNumber(ownerRepo, prNumber, ghOptions)
+      if (restData.stack) {
+        return {
+          ok: false,
+          error: 'GitHub does not support auto-merge for stacked pull requests.'
+        }
+      }
+    } catch {
+      // GitHub remains authoritative when stack metadata cannot be read.
+    }
+  }
   const pr = await getPRAutoMergeIdentity(prNumber, ownerRepo, ghOptions)
   if (!pr?.id) {
     return { ok: false, error: 'Could not resolve GitHub pull request ID' }
   }
-  if (await shouldUseMergeQueueAutoMerge(pr, ownerRepo, ghOptions)) {
+  const useMergeQueue = await shouldUseMergeQueueAutoMerge(pr, ownerRepo, ghOptions)
+  if (useMergeQueue) {
     await runPRAutoMergeCommand(prNumber, method, ownerRepo, ghOptions)
     return { ok: true }
   }
@@ -4950,7 +5311,12 @@ async function getPRMergeBlocker(
   }
 
   try {
-    const pr = await getPRByNumber(ownerRepo, prNumber, ghOptions)
+    const pr = await getPRByNumber(
+      ownerRepo,
+      prNumber,
+      ghOptions,
+      githubPRStackExecutionScope(connectionId, localGitOptions)
+    )
     if (!pr) {
       return null
     }
diff --git a/src/main/github/conflict-summary.ts b/src/main/github/conflict-summary.ts
index 73ec657977c..a8c52c46085 100644
--- a/src/main/github/conflict-summary.ts
+++ b/src/main/github/conflict-summary.ts
@@ -6,7 +6,7 @@ import {
 import { gitExecFileAsync } from '../git/runner'
 import {
   clearGitCapabilityStateForTests,
-  getLocalGitCapabilityCache
+  withLocalGitCapabilityCacheForExecution
 } from '../git/git-capability-state'
 import {
   __resetPRConflictSummaryDerivationCachesForTests,
@@ -219,10 +219,6 @@ async function loadConflictingFiles(
   baseOid: string,
   localGitOptions: LocalGitExecOptions
 ): Promise<string[]> {
-  const capabilities = getLocalGitCapabilityCache({
-    cwd: repoPath,
-    wslDistro: localGitOptions.wslDistro
-  })
   const modernArgs = [
     'merge-tree',
     '--write-tree',
@@ -244,40 +240,44 @@ async function loadConflictingFiles(
     baseOid
   ]
 
-  return capabilities.runWithFallback(
-    'merge-tree-write-tree',
-    () =>
+  return withLocalGitCapabilityCacheForExecution(
+    { cwd: repoPath, wslDistro: localGitOptions.wslDistro },
+    (capabilities) =>
       capabilities.runWithFallback(
-        'merge-tree-merge-base',
+        'merge-tree-write-tree',
+        () =>
+          capabilities.runWithFallback(
+            'merge-tree-merge-base',
+            async () => {
+              try {
+                const result = await gitExecFileAsync(modernArgs, {
+                  cwd: repoPath,
+                  ...(localGitOptions.wslDistro ? { wslDistro: localGitOptions.wslDistro } : {})
+                })
+                return parseMergeTreeNameOnlyOutput(result.stdout)
+              } catch (error) {
+                if (isUnsupportedMergeTreeWriteTreeError(error)) {
+                  throw error
+                }
+                // Why: `git merge-tree --write-tree` exits 1 for conflicts but still
+                // writes the useful file list; only option rejection reaches fallback.
+                const stdoutFromError = getGitErrorOutput(error, 'stdout')
+                if (stdoutFromError) {
+                  return parseMergeTreeNameOnlyOutput(stdoutFromError)
+                }
+                throw error
+              }
+            },
+            () => loadConflictingFilesWithLegacyMergeTree(repoPath, legacyArgs, localGitOptions),
+            isUnsupportedMergeTreeMergeBaseError
+          ),
         async () => {
-          try {
-            const result = await gitExecFileAsync(modernArgs, {
-              cwd: repoPath,
-              ...(localGitOptions.wslDistro ? { wslDistro: localGitOptions.wslDistro } : {})
-            })
-            return parseMergeTreeNameOnlyOutput(result.stdout)
-          } catch (error) {
-            if (isUnsupportedMergeTreeWriteTreeError(error)) {
-              throw error
-            }
-            // Why: `git merge-tree --write-tree` exits 1 for conflicts but still
-            // writes the useful file list; only option rejection reaches fallback.
-            const stdoutFromError = getGitErrorOutput(error, 'stdout')
-            if (stdoutFromError) {
-              return parseMergeTreeNameOnlyOutput(stdoutFromError)
-            }
-            throw error
-          }
+          // Why: Git before 2.38 cannot derive a reliable real-merge conflict list;
+          // fail closed without respawning the same rejected command every refresh.
+          throw new Error('Git merge-tree --write-tree is unavailable on this execution host.')
         },
-        () => loadConflictingFilesWithLegacyMergeTree(repoPath, legacyArgs, localGitOptions),
-        isUnsupportedMergeTreeMergeBaseError
-      ),
-    async () => {
-      // Why: Git before 2.38 cannot derive a reliable real-merge conflict list;
-      // fail closed without respawning the same rejected command every refresh.
-      throw new Error('Git merge-tree --write-tree is unavailable on this execution host.')
-    },
-    isUnsupportedMergeTreeWriteTreeError
+        isUnsupportedMergeTreeWriteTreeError
+      )
   )
 }
 
diff --git a/src/main/github/gh-utils-concurrency.test.ts b/src/main/github/gh-utils-concurrency.test.ts
new file mode 100644
index 00000000000..de6389d260a
--- /dev/null
+++ b/src/main/github/gh-utils-concurrency.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest'
+import { acquire, release } from './gh-utils'
+
+describe('GitHub concurrency', () => {
+  it('removes aborted waiters without consuming a permit', async () => {
+    await Promise.all([acquire(), acquire(), acquire(), acquire()])
+    const controller = new AbortController()
+    const queued = acquire(controller.signal)
+
+    controller.abort()
+
+    await expect(queued).rejects.toMatchObject({ name: 'AbortError' })
+    release()
+    await expect(acquire()).resolves.toBeUndefined()
+
+    release()
+    release()
+    release()
+    release()
+  })
+})
diff --git a/src/main/github/gh-utils.ts b/src/main/github/gh-utils.ts
index d6770189924..ffeb2ca22c7 100644
--- a/src/main/github/gh-utils.ts
+++ b/src/main/github/gh-utils.ts
@@ -40,25 +40,52 @@ export type { PRRepositoryCandidates, ResolvedIssueSource } from './github-owner
 
 const MAX_CONCURRENT = 4
 let running = 0
-const queue: (() => void)[] = []
+type QueueEntry = {
+  signal?: AbortSignal
+  start: () => void
+  reject: (error: Error) => void
+}
+const queue: QueueEntry[] = []
 
-export function acquire(): Promise<void> {
+function githubOperationAbortError(): Error {
+  const error = new Error('GitHub operation aborted')
+  error.name = 'AbortError'
+  return error
+}
+
+export function acquire(signal?: AbortSignal): Promise<void> {
+  if (signal?.aborted) {
+    return Promise.reject(githubOperationAbortError())
+  }
   if (running < MAX_CONCURRENT) {
     running += 1
     return Promise.resolve()
   }
-  return new Promise((resolve) =>
-    queue.push(() => {
-      running += 1
-      resolve()
-    })
-  )
+  return new Promise((resolve, reject) => {
+    const entry: QueueEntry = {
+      signal,
+      reject,
+      start: () => {
+        signal?.removeEventListener('abort', onAbort)
+        running += 1
+        resolve()
+      }
+    }
+    const onAbort = (): void => {
+      const index = queue.indexOf(entry)
+      if (index === -1) {
+        return
+      }
+      queue.splice(index, 1)
+      reject(githubOperationAbortError())
+    }
+    signal?.addEventListener('abort', onAbort, { once: true })
+    queue.push(entry)
+  })
 }
 
 export function release(): void {
   running -= 1
   const next = queue.shift()
-  if (next) {
-    next()
-  }
+  next?.start()
 }
diff --git a/src/main/github/github-pr-stack-async-merge.ts b/src/main/github/github-pr-stack-async-merge.ts
new file mode 100644
index 00000000000..1b3909af035
--- /dev/null
+++ b/src/main/github/github-pr-stack-async-merge.ts
@@ -0,0 +1,145 @@
+import type { GitHubPRMergeMethod } from '../../shared/types'
+import { ghExecFileAsync } from '../git/runner'
+import { acquire, release } from './gh-utils'
+import {
+  githubHostExecOptions,
+  type GitHubApiRepository,
+  type GitHubRepoExecOptions
+} from './github-api-repository'
+
+const POLL_INTERVAL_MS = 1_000
+const MAX_POLLS = 180
+
+type AsyncMergeResponse = {
+  status?: unknown
+  details?: {
+    message?: unknown
+    uuid?: unknown
+  }
+}
+
+type AsyncMergeResult =
+  | { kind: 'pending'; uuid: string }
+  | { kind: 'success' }
+  | { kind: 'failure'; message: string }
+
+export type GitHubPRStackMergeAction = 'direct_merge' | 'merge_queue'
+
+function parseResponse(value: string): AsyncMergeResponse | null {
+  try {
+    return JSON.parse(value) as AsyncMergeResponse
+  } catch {
+    return null
+  }
+}
+
+function errorResponseBody(error: unknown): AsyncMergeResponse | null {
+  if (!error || typeof error !== 'object' || !('stdout' in error)) {
+    return null
+  }
+  const stdout = (error as { stdout?: unknown }).stdout
+  return parseResponse(Buffer.isBuffer(stdout) ? stdout.toString('utf8') : String(stdout))
+}
+
+function classifyResult(response: AsyncMergeResponse): AsyncMergeResult {
+  if (response.status === 'merged' || response.status === 'enqueued') {
+    return { kind: 'success' }
+  }
+  if (response.status === 'pending' && typeof response.details?.uuid === 'string') {
+    return { kind: 'pending', uuid: response.details.uuid }
+  }
+  const message =
+    typeof response.details?.message === 'string'
+      ? response.details.message
+      : 'GitHub could not merge this stack.'
+  return { kind: 'failure', message }
+}
+
+function waitForNextPoll(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS))
+}
+
+async function runStackMergeCommand(
+  command: string[],
+  options: NonNullable<Parameters<typeof ghExecFileAsync>[1]>
+) {
+  await acquire()
+  try {
+    return await ghExecFileAsync(command, options)
+  } finally {
+    release()
+  }
+}
+
+export async function mergeGitHubPRStack(args: {
+  repository: GitHubApiRepository
+  prNumber: number
+  method: GitHubPRMergeMethod
+  mergeAction: GitHubPRStackMergeAction
+  headSha?: string
+  ghOptions: GitHubRepoExecOptions
+}): Promise<{ ok: true } | { ok: false; error: string }> {
+  const endpoint = `repos/${args.repository.owner}/${args.repository.repo}/pulls/${args.prNumber}/merge-async`
+  const command = ['api', '-X', 'PUT', endpoint, '-f', `merge_action=${args.mergeAction}`]
+  if (args.mergeAction === 'direct_merge') {
+    command.push('-f', `merge_method=${args.method}`)
+  }
+  if (args.headSha) {
+    command.push('-f', `sha=${args.headSha}`)
+  }
+
+  let submitted: AsyncMergeResponse | null
+  try {
+    const { stdout } = await runStackMergeCommand(command, {
+      ...args.ghOptions,
+      ...githubHostExecOptions(args.repository),
+      env: { ...process.env, GH_PROMPT_DISABLED: '1' }
+    })
+    submitted = parseResponse(stdout)
+  } catch (error) {
+    submitted = errorResponseBody(error)
+    if (!submitted) {
+      throw error
+    }
+  }
+  if (!submitted) {
+    return { ok: false, error: 'GitHub returned an invalid stack merge response.' }
+  }
+  let result = classifyResult(submitted)
+  if (result.kind === 'success') {
+    return { ok: true }
+  }
+  if (result.kind === 'failure') {
+    return { ok: false, error: result.message }
+  }
+
+  const uuid = encodeURIComponent(result.uuid)
+  for (let poll = 0; poll < MAX_POLLS; poll++) {
+    await waitForNextPoll()
+    let response: AsyncMergeResponse | null
+    try {
+      const { stdout } = await runStackMergeCommand(['api', `${endpoint}/${uuid}`], {
+        ...args.ghOptions,
+        ...githubHostExecOptions(args.repository)
+      })
+      response = parseResponse(stdout)
+    } catch (error) {
+      // Why: the merge was submitted; a transient poll failure cannot make it fail.
+      response = errorResponseBody(error)
+      if (!response) {
+        continue
+      }
+    }
+    if (!response) {
+      return { ok: false, error: 'GitHub returned an invalid stack merge response.' }
+    }
+    result = classifyResult(response)
+    if (result.kind === 'success') {
+      return { ok: true }
+    }
+    if (result.kind === 'failure') {
+      return { ok: false, error: result.message }
+    }
+  }
+  return { ok: false, error: 'GitHub is still merging this stack. Refresh to check its status.' }
+}
diff --git a/src/main/github/github-pr-stack.test.ts b/src/main/github/github-pr-stack.test.ts
new file mode 100644
index 00000000000..17cd6475941
--- /dev/null
+++ b/src/main/github/github-pr-stack.test.ts
@@ -0,0 +1,331 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { GitHubPRStack } from '../../shared/types'
+
+const { ghExecFileAsyncMock, rateLimitGuardMock, noteRateLimitSpendMock } = vi.hoisted(() => ({
+  ghExecFileAsyncMock: vi.fn(),
+  rateLimitGuardMock: vi.fn(() => ({ blocked: false })),
+  noteRateLimitSpendMock: vi.fn()
+}))
+
+vi.mock('../git/runner', () => ({ ghExecFileAsync: ghExecFileAsyncMock }))
+vi.mock('./rate-limit', () => ({
+  repositoryRateLimitGuard: rateLimitGuardMock,
+  noteRepositoryRateLimitSpend: noteRateLimitSpendMock
+}))
+
+import {
+  _resetGitHubPRStackCacheForTests,
+  hydrateGitHubPRStack,
+  mergeGitHubPRStack
+} from './github-pr-stack'
+
+const repository = { owner: 'stablyai', repo: 'orca', host: 'github.com' }
+const summary: GitHubPRStack = {
+  number: 51,
+  position: 2,
+  size: 3,
+  baseRefName: 'main',
+  baseSha: 'base-sha'
+}
+
+beforeEach(() => {
+  vi.useRealTimers()
+  ghExecFileAsyncMock.mockReset()
+  rateLimitGuardMock.mockReset()
+  rateLimitGuardMock.mockReturnValue({ blocked: false })
+  noteRateLimitSpendMock.mockReset()
+  _resetGitHubPRStackCacheForTests()
+})
+
+describe('hydrateGitHubPRStack', () => {
+  it('maps and caches every entry in one GraphQL request', async () => {
+    ghExecFileAsyncMock.mockResolvedValue({
+      stdout: JSON.stringify({
+        data: {
+          repository: {
+            pullRequest: {
+              stack: {
+                number: 51,
+                size: 3,
+                baseRefName: 'main',
+                entries: {
+                  nodes: [
+                    {
+                      position: 2,
+                      pullRequest: {
+                        number: 202,
+                        title: 'API',
+                        url: 'https://github.com/stablyai/orca/pull/202',
+                        updatedAt: '2026-08-10T00:00:00Z',
+                        state: 'OPEN',
+                        isDraft: false,
+                        headRefName: 'stack/api',
+                        headRefOid: 'api-sha',
+                        mergeable: 'MERGEABLE',
+                        reviewDecision: 'APPROVED',
+                        mergeStateStatus: 'CLEAN',
+                        statusCheckRollup: { state: 'SUCCESS' }
+                      }
+                    },
+                    {
+                      position: 1,
+                      pullRequest: {
+                        number: 201,
+                        title: 'Models',
+                        url: 'https://github.com/stablyai/orca/pull/201',
+                        updatedAt: '2026-08-10T00:00:00Z',
+                        state: 'OPEN',
+                        isDraft: false,
+                        mergeable: 'UNKNOWN',
+                        statusCheckRollup: { state: 'PENDING' }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      })
+    })
+
+    const first = await hydrateGitHubPRStack(repository, 202, summary, { cwd: '/repo' })
+    const sibling = await hydrateGitHubPRStack(
+      repository,
+      201,
+      { ...summary, position: 1 },
+      { cwd: '/other-worktree' }
+    )
+
+    expect(first).toMatchObject({
+      number: 51,
+      position: 2,
+      baseSha: 'base-sha',
+      entries: [
+        { number: 201, position: 1, checksStatus: 'pending' },
+        {
+          number: 202,
+          position: 2,
+          checksStatus: 'success',
+          reviewDecision: 'APPROVED'
+        }
+      ]
+    })
+    expect(sibling.position).toBe(1)
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(1)
+    expect(noteRateLimitSpendMock).toHaveBeenCalledWith(
+      repository,
+      'graphql',
+      1,
+      expect.any(Object)
+    )
+  })
+
+  it('refreshes cached stack details when the current PR changed', async () => {
+    const response = (updatedAt: string, isDraft: boolean) => ({
+      stdout: JSON.stringify({
+        data: {
+          repository: {
+            pullRequest: {
+              stack: {
+                number: 51,
+                size: 3,
+                baseRefName: 'main',
+                entries: {
+                  nodes: [
+                    {
+                      position: 2,
+                      pullRequest: {
+                        number: 202,
+                        title: 'API',
+                        url: 'https://github.com/stablyai/orca/pull/202',
+                        updatedAt,
+                        state: 'OPEN',
+                        isDraft,
+                        mergeable: 'MERGEABLE'
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      })
+    })
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce(response('2026-08-10T00:00:00Z', true))
+      .mockResolvedValueOnce(response('2026-08-10T00:01:00Z', false))
+
+    const draft = await hydrateGitHubPRStack(
+      repository,
+      202,
+      summary,
+      { cwd: '/repo' },
+      '2026-08-10T00:00:00Z'
+    )
+    const ready = await hydrateGitHubPRStack(
+      repository,
+      202,
+      summary,
+      { cwd: '/repo' },
+      '2026-08-10T00:01:00Z'
+    )
+
+    expect(draft.entries?.[0]?.state).toBe('draft')
+    expect(ready.entries?.[0]?.state).toBe('open')
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('keeps the REST summary when GraphQL is unavailable', async () => {
+    ghExecFileAsyncMock.mockRejectedValue(new Error('field is unavailable'))
+
+    await expect(hydrateGitHubPRStack(repository, 202, summary, { cwd: '/repo' })).resolves.toEqual(
+      summary
+    )
+  })
+
+  it('isolates cached details across execution scopes', async () => {
+    ghExecFileAsyncMock.mockResolvedValue({
+      stdout: JSON.stringify({
+        data: {
+          repository: {
+            pullRequest: {
+              stack: { number: 51, size: 3, baseRefName: 'main', entries: { nodes: [] } }
+            }
+          }
+        }
+      })
+    })
+
+    await hydrateGitHubPRStack(repository, 202, summary, { cwd: '/repo' }, undefined, 'local:host')
+    await hydrateGitHubPRStack(repository, 202, summary, {}, undefined, 'ssh:ssh-1')
+
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(2)
+  })
+})
+
+describe('mergeGitHubPRStack', () => {
+  it('submits the expected head and polls pending merges to completion', async () => {
+    vi.useFakeTimers()
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({ status: 'pending', details: { uuid: 'merge-uuid' } })
+      })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({ status: 'merged', details: { message: 'Merged' } })
+      })
+
+    const result = mergeGitHubPRStack({
+      repository,
+      prNumber: 202,
+      method: 'squash',
+      mergeAction: 'direct_merge',
+      headSha: 'api-sha',
+      ghOptions: { cwd: '/repo' }
+    })
+    await vi.advanceTimersByTimeAsync(1_000)
+
+    await expect(result).resolves.toEqual({ ok: true })
+    expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
+      1,
+      expect.arrayContaining([
+        'PUT',
+        'repos/stablyai/orca/pulls/202/merge-async',
+        'merge_method=squash',
+        'merge_action=direct_merge',
+        'sha=api-sha'
+      ]),
+      expect.objectContaining({ cwd: '/repo', host: 'github.com' })
+    )
+    expect(ghExecFileAsyncMock).toHaveBeenNthCalledWith(
+      2,
+      ['api', 'repos/stablyai/orca/pulls/202/merge-async/merge-uuid'],
+      expect.objectContaining({ cwd: '/repo', host: 'github.com' })
+    )
+  })
+
+  it('returns GitHub atomic failure details', async () => {
+    ghExecFileAsyncMock.mockResolvedValue({
+      stdout: JSON.stringify({
+        status: 'failed',
+        details: { message: 'A pull request has merge conflicts.' }
+      })
+    })
+
+    await expect(
+      mergeGitHubPRStack({
+        repository,
+        prNumber: 202,
+        method: 'rebase',
+        mergeAction: 'direct_merge',
+        ghOptions: { cwd: '/repo' }
+      })
+    ).resolves.toEqual({ ok: false, error: 'A pull request has merge conflicts.' })
+  })
+
+  it('omits the unsupported merge method when queueing a stack', async () => {
+    ghExecFileAsyncMock.mockResolvedValue({
+      stdout: JSON.stringify({ status: 'enqueued', details: { message: 'Queued' } })
+    })
+
+    await expect(
+      mergeGitHubPRStack({
+        repository,
+        prNumber: 202,
+        method: 'squash',
+        mergeAction: 'merge_queue',
+        ghOptions: { cwd: '/repo' }
+      })
+    ).resolves.toEqual({ ok: true })
+
+    const command = ghExecFileAsyncMock.mock.calls[0]?.[0]
+    expect(command).toContain('merge_action=merge_queue')
+    expect(command).not.toContain('merge_method=squash')
+  })
+
+  it('continues polling after a transient transport failure', async () => {
+    vi.useFakeTimers()
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify({ status: 'pending', details: { uuid: 'merge-uuid' } })
+      })
+      .mockRejectedValueOnce(new Error('temporary gateway failure'))
+      .mockResolvedValueOnce({ stdout: JSON.stringify({ status: 'merged' }) })
+
+    const result = mergeGitHubPRStack({
+      repository,
+      prNumber: 202,
+      method: 'squash',
+      mergeAction: 'direct_merge',
+      ghOptions: { cwd: '/repo' }
+    })
+    await vi.advanceTimersByTimeAsync(1_000)
+    await vi.advanceTimersByTimeAsync(1_000)
+
+    await expect(result).resolves.toEqual({ ok: true })
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(3)
+  })
+
+  it('reports an in-progress merge after polling is exhausted', async () => {
+    vi.useFakeTimers()
+    ghExecFileAsyncMock.mockResolvedValue({
+      stdout: JSON.stringify({ status: 'pending', details: { uuid: 'merge-uuid' } })
+    })
+
+    const result = mergeGitHubPRStack({
+      repository,
+      prNumber: 202,
+      method: 'squash',
+      mergeAction: 'direct_merge',
+      ghOptions: { cwd: '/repo' }
+    })
+    await vi.advanceTimersByTimeAsync(180_000)
+
+    await expect(result).resolves.toEqual({
+      ok: false,
+      error: 'GitHub is still merging this stack. Refresh to check its status.'
+    })
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(181)
+  })
+})
diff --git a/src/main/github/github-pr-stack.ts b/src/main/github/github-pr-stack.ts
new file mode 100644
index 00000000000..24d0773a91c
--- /dev/null
+++ b/src/main/github/github-pr-stack.ts
@@ -0,0 +1,282 @@
+import type {
+  CheckStatus,
+  GitHubPRStack,
+  GitHubPRStackEntry,
+  PRMergeableState,
+  PRReviewDecision,
+  PRState
+} from '../../shared/types'
+import { githubRepoIdentityKey } from '../../shared/github-repository-identity-key'
+import { ghExecFileAsync } from '../git/runner'
+import {
+  githubHostExecOptions,
+  type GitHubApiRepository,
+  type GitHubRepoExecOptions
+} from './github-api-repository'
+import { noteRepositoryRateLimitSpend, repositoryRateLimitGuard } from './rate-limit'
+
+const STACK_CACHE_TTL_MS = 30_000
+const STACK_CACHE_MAX_ENTRIES = 256
+
+type CachedStackDetails = {
+  value: Omit<GitHubPRStack, 'position'> | null
+  expiresAt: number
+}
+
+type GraphQLStackEntry = {
+  position?: unknown
+  pullRequest?: {
+    number?: unknown
+    title?: unknown
+    url?: unknown
+    updatedAt?: unknown
+    state?: unknown
+    isDraft?: unknown
+    headRefName?: unknown
+    headRefOid?: unknown
+    mergeable?: unknown
+    reviewDecision?: unknown
+    mergeStateStatus?: unknown
+    statusCheckRollup?: { state?: unknown } | null
+  } | null
+}
+
+type GraphQLStackResponse = {
+  data?: {
+    repository?: {
+      pullRequest?: {
+        stack?: {
+          number?: unknown
+          size?: unknown
+          baseRefName?: unknown
+          entries?: { nodes?: (GraphQLStackEntry | null)[] | null } | null
+        } | null
+      } | null
+    } | null
+  }
+}
+
+const stackDetailsCache = new Map<string, CachedStackDetails>()
+const stackDetailsInFlight = new Map<string, Promise<Omit<GitHubPRStack, 'position'> | null>>()
+
+export function _resetGitHubPRStackCacheForTests(): void {
+  stackDetailsCache.clear()
+  stackDetailsInFlight.clear()
+}
+
+function stackCacheKey(
+  repository: GitHubApiRepository,
+  stackNumber: number,
+  executionScope: string
+): string {
+  return `${executionScope}\0${githubRepoIdentityKey(repository)}:${stackNumber}`
+}
+
+function pruneStackCache(now = Date.now()): void {
+  for (const [key, cached] of stackDetailsCache) {
+    if (cached.expiresAt <= now) {
+      stackDetailsCache.delete(key)
+    }
+  }
+  while (stackDetailsCache.size > STACK_CACHE_MAX_ENTRIES) {
+    const oldestKey = stackDetailsCache.keys().next().value
+    if (oldestKey === undefined) {
+      return
+    }
+    stackDetailsCache.delete(oldestKey)
+  }
+}
+
+function mapStackPRState(value: unknown, isDraft: unknown): PRState {
+  if (value === 'MERGED') {
+    return 'merged'
+  }
+  if (value === 'CLOSED') {
+    return 'closed'
+  }
+  return isDraft === true ? 'draft' : 'open'
+}
+
+function mapStackCheckStatus(value: unknown): CheckStatus {
+  if (value === 'SUCCESS') {
+    return 'success'
+  }
+  if (value === 'FAILURE' || value === 'ERROR') {
+    return 'failure'
+  }
+  if (value === 'PENDING' || value === 'EXPECTED') {
+    return 'pending'
+  }
+  return 'neutral'
+}
+
+function mapStackMergeable(value: unknown): PRMergeableState {
+  return value === 'MERGEABLE' || value === 'CONFLICTING' ? value : 'UNKNOWN'
+}
+
+function mapReviewDecision(value: unknown): PRReviewDecision | null | undefined {
+  if (value === null) {
+    return null
+  }
+  if (value === 'APPROVED' || value === 'CHANGES_REQUESTED' || value === 'REVIEW_REQUIRED') {
+    return value
+  }
+  return undefined
+}
+
+function mapStackEntry(entry: GraphQLStackEntry): GitHubPRStackEntry | null {
+  const pr = entry.pullRequest
+  if (
+    typeof entry.position !== 'number' ||
+    typeof pr?.number !== 'number' ||
+    typeof pr.title !== 'string' ||
+    typeof pr.url !== 'string'
+  ) {
+    return null
+  }
+  const reviewDecision = mapReviewDecision(pr.reviewDecision)
+  return {
+    position: entry.position,
+    number: pr.number,
+    title: pr.title,
+    url: pr.url,
+    ...(typeof pr.updatedAt === 'string' ? { updatedAt: pr.updatedAt } : {}),
+    state: mapStackPRState(pr.state, pr.isDraft),
+    checksStatus: mapStackCheckStatus(pr.statusCheckRollup?.state),
+    mergeable: mapStackMergeable(pr.mergeable),
+    ...(reviewDecision !== undefined ? { reviewDecision } : {}),
+    ...(typeof pr.mergeStateStatus === 'string' ? { mergeStateStatus: pr.mergeStateStatus } : {}),
+    ...(typeof pr.headRefName === 'string' ? { headRefName: pr.headRefName } : {}),
+    ...(typeof pr.headRefOid === 'string' ? { headSha: pr.headRefOid } : {})
+  }
+}
+
+function parseStackDetails(
+  response: GraphQLStackResponse,
+  expectedStackNumber: number,
+  fallbackBaseRefName: string,
+  fallbackSize: number
+): Omit<GitHubPRStack, 'position'> | null {
+  const stack = response.data?.repository?.pullRequest?.stack
+  if (!stack || stack.number !== expectedStackNumber) {
+    return null
+  }
+  const entries = (stack.entries?.nodes ?? [])
+    .flatMap((entry) => (entry ? [mapStackEntry(entry)] : []))
+    .filter((entry): entry is GitHubPRStackEntry => entry !== null)
+    .sort((a, b) => a.position - b.position)
+  return {
+    number: expectedStackNumber,
+    size: typeof stack.size === 'number' ? stack.size : fallbackSize,
+    baseRefName: typeof stack.baseRefName === 'string' ? stack.baseRefName : fallbackBaseRefName,
+    ...(entries.length > 0 ? { entries } : {})
+  }
+}
+
+const STACK_DETAILS_QUERY = `
+query($owner: String!, $repo: String!, $pr: Int!) {
+  repository(owner: $owner, name: $repo) {
+    pullRequest(number: $pr) {
+      stack {
+        number
+        size
+        baseRefName
+        entries(first: 100) {
+          nodes {
+            position
+            pullRequest {
+              number
+              title
+              url
+              updatedAt
+              state
+              isDraft
+              headRefName
+              headRefOid
+              mergeable
+              reviewDecision
+              mergeStateStatus
+              statusCheckRollup { state }
+            }
+          }
+        }
+      }
+    }
+  }
+}`
+
+async function fetchStackDetails(
+  repository: GitHubApiRepository,
+  prNumber: number,
+  summary: GitHubPRStack,
+  ghOptions: GitHubRepoExecOptions
+): Promise<Omit<GitHubPRStack, 'position'> | null> {
+  if (repositoryRateLimitGuard(repository, 'graphql', ghOptions).blocked) {
+    return null
+  }
+  noteRepositoryRateLimitSpend(repository, 'graphql', 1, ghOptions)
+  const { stdout } = await ghExecFileAsync(
+    [
+      'api',
+      'graphql',
+      '-f',
+      `query=${STACK_DETAILS_QUERY}`,
+      '-f',
+      `owner=${repository.owner}`,
+      '-f',
+      `repo=${repository.repo}`,
+      '-F',
+      `pr=${prNumber}`
+    ],
+    { ...ghOptions, ...githubHostExecOptions(repository) }
+  )
+  return parseStackDetails(
+    JSON.parse(stdout) as GraphQLStackResponse,
+    summary.number,
+    summary.baseRefName,
+    summary.size
+  )
+}
+
+export async function hydrateGitHubPRStack(
+  repository: GitHubApiRepository,
+  prNumber: number,
+  summary: GitHubPRStack,
+  ghOptions: GitHubRepoExecOptions,
+  prUpdatedAt?: string,
+  executionScope = 'local:host'
+): Promise<GitHubPRStack> {
+  const key = stackCacheKey(repository, summary.number, executionScope)
+  const now = Date.now()
+  pruneStackCache(now)
+  const cached = stackDetailsCache.get(key)
+  const cachedPRUpdatedAt = cached?.value?.entries?.find(
+    (entry) => entry.number === prNumber
+  )?.updatedAt
+  const cachedMatchesPR = !prUpdatedAt || !cachedPRUpdatedAt || cachedPRUpdatedAt === prUpdatedAt
+  if (cached && cached.expiresAt > now && cachedMatchesPR) {
+    return cached.value
+      ? { ...cached.value, position: summary.position, baseSha: summary.baseSha }
+      : summary
+  }
+  const existing = stackDetailsInFlight.get(key)
+  if (existing) {
+    const value = await existing
+    return value ? { ...value, position: summary.position, baseSha: summary.baseSha } : summary
+  }
+  const request = fetchStackDetails(repository, prNumber, summary, ghOptions).catch(() => null)
+  stackDetailsInFlight.set(key, request)
+  try {
+    const value = await request
+    stackDetailsCache.delete(key)
+    stackDetailsCache.set(key, { value, expiresAt: Date.now() + STACK_CACHE_TTL_MS })
+    pruneStackCache()
+    return value ? { ...value, position: summary.position, baseSha: summary.baseSha } : summary
+  } finally {
+    if (stackDetailsInFlight.get(key) === request) {
+      stackDetailsInFlight.delete(key)
+    }
+  }
+}
+
+export { mergeGitHubPRStack } from './github-pr-stack-async-merge'
diff --git a/src/main/github/github-stack-api-responses.ts b/src/main/github/github-stack-api-responses.ts
new file mode 100644
index 00000000000..727d72331ef
--- /dev/null
+++ b/src/main/github/github-stack-api-responses.ts
@@ -0,0 +1,52 @@
+import type { HostedReviewSummary } from '../../shared/hosted-review'
+
+export type NumberedHostedReviewSummary = Omit<HostedReviewSummary, 'number'> & { number: number }
+
+export type GitHubStackPullRequest = NumberedHostedReviewSummary & {
+  headRefName: string
+  baseRefName: string
+}
+
+export type GitHubStack = {
+  number: number
+  open: boolean
+  pull_requests: { number: number }[]
+}
+
+export function parseGitHubStackPullRequests(stdout: string): GitHubStackPullRequest[] {
+  const pullRequests = JSON.parse(stdout) as {
+    number?: unknown
+    html_url?: unknown
+    head?: { ref?: unknown }
+    base?: { ref?: unknown }
+  }[]
+  return pullRequests.flatMap((pullRequest) => {
+    const number = Number(pullRequest.number)
+    const url = typeof pullRequest.html_url === 'string' ? pullRequest.html_url : ''
+    const headRefName = typeof pullRequest.head?.ref === 'string' ? pullRequest.head.ref : ''
+    const baseRefName = typeof pullRequest.base?.ref === 'string' ? pullRequest.base.ref : ''
+    return Number.isInteger(number) && number > 0 && url && headRefName && baseRefName
+      ? [{ number, url, headRefName, baseRefName }]
+      : []
+  })
+}
+
+export function parseGitHubStacks(stdout: string): GitHubStack[] {
+  const stacks = JSON.parse(stdout) as {
+    number?: unknown
+    open?: unknown
+    pull_requests?: { number?: unknown }[]
+  }[]
+  return stacks.flatMap((stack) => {
+    const number = Number(stack.number)
+    const pullRequests = (stack.pull_requests ?? []).flatMap((pullRequest) => {
+      const pullRequestNumber = Number(pullRequest.number)
+      return Number.isInteger(pullRequestNumber) && pullRequestNumber > 0
+        ? [{ number: pullRequestNumber }]
+        : []
+    })
+    return Number.isInteger(number) && number > 0
+      ? [{ number, open: stack.open === true, pull_requests: pullRequests }]
+      : []
+  })
+}
diff --git a/src/main/github/stacked-pr-creation.test.ts b/src/main/github/stacked-pr-creation.test.ts
new file mode 100644
index 00000000000..e97ea14f2a4
--- /dev/null
+++ b/src/main/github/stacked-pr-creation.test.ts
@@ -0,0 +1,273 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { ghExecFileAsyncMock, repositoryMock } = vi.hoisted(() => ({
+  ghExecFileAsyncMock: vi.fn(),
+  repositoryMock: vi.fn()
+}))
+
+vi.mock('./gh-utils', () => ({
+  acquire: vi.fn(),
+  release: vi.fn(),
+  ghExecFileAsync: ghExecFileAsyncMock,
+  ghRepoExecOptions: (context: { repoPath: string; connectionId?: string | null }) =>
+    context.connectionId ? {} : { cwd: context.repoPath },
+  githubRepoContext: (
+    repoPath: string,
+    connectionId?: string | null,
+    localGitOptions?: Record<string, unknown>
+  ) => ({ repoPath, connectionId, localGitOptions })
+}))
+
+vi.mock('./github-api-repository', () => ({
+  getOriginGitHubApiRepository: repositoryMock,
+  githubHostExecOptions: (repository: { host?: string }) => ({ host: repository.host })
+}))
+
+import {
+  prepareGitHubStackedPullRequest,
+  registerGitHubStackedPullRequest
+} from './stacked-pr-creation'
+
+const repository = { owner: 'acme', repo: 'orca', host: 'github.com' }
+const parentReview = { number: 41, url: 'https://github.com/acme/orca/pull/41' }
+const currentReview = { number: 42, url: 'https://github.com/acme/orca/pull/42' }
+
+function pullRequest(number: number, head: string, base: string) {
+  return {
+    number,
+    html_url: `https://github.com/acme/orca/pull/${number}`,
+    head: { ref: head },
+    base: { ref: base }
+  }
+}
+
+function stack(number: number, pullRequests: number[]) {
+  return {
+    number,
+    open: true,
+    pull_requests: pullRequests.map((pullRequestNumber) => ({ number: pullRequestNumber }))
+  }
+}
+
+beforeEach(() => {
+  ghExecFileAsyncMock.mockReset()
+  repositoryMock.mockReset()
+  repositoryMock.mockResolvedValue(repository)
+})
+
+describe('prepareGitHubStackedPullRequest', () => {
+  it('resolves an open parent PR and an existing current PR', async () => {
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify([pullRequest(41, 'stack/parent', 'main')]) })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify([pullRequest(42, 'stack/child', 'stack/parent')])
+      })
+      .mockResolvedValueOnce({ stdout: JSON.stringify([stack(50, [40, 41])]) })
+      .mockResolvedValueOnce({ stdout: '[]' })
+
+    const result = await prepareGitHubStackedPullRequest('/repo', {
+      provider: 'github',
+      base: 'origin/stack/parent',
+      head: 'refs/heads/stack/child',
+      title: 'Child'
+    })
+
+    expect(result).toMatchObject({
+      ok: true,
+      parentReview: { number: 41 },
+      currentReview: { number: 42 }
+    })
+    expect(ghExecFileAsyncMock.mock.calls[0][0]).toEqual([
+      'api',
+      'repos/acme/orca/pulls?head=acme%3Astack%2Fparent&state=open&per_page=2'
+    ])
+    expect(ghExecFileAsyncMock.mock.calls[1][0]).toEqual([
+      'api',
+      'repos/acme/orca/pulls?head=acme%3Astack%2Fchild&base=stack%2Fparent&state=open&per_page=2'
+    ])
+  })
+
+  it('allows an idempotent retry after the child was already registered', async () => {
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify([pullRequest(41, 'stack/parent', 'main')]) })
+      .mockResolvedValueOnce({
+        stdout: JSON.stringify([pullRequest(42, 'stack/child', 'stack/parent')])
+      })
+      .mockResolvedValueOnce({ stdout: JSON.stringify([stack(50, [41, 42])]) })
+      .mockResolvedValueOnce({ stdout: JSON.stringify([stack(50, [41, 42])]) })
+
+    const result = await prepareGitHubStackedPullRequest('/repo', {
+      provider: 'github',
+      base: 'stack/parent',
+      head: 'stack/child',
+      title: 'Child'
+    })
+
+    expect(result).toMatchObject({ ok: true, currentReview: { number: 42 } })
+  })
+
+  it('requires an open PR for the selected parent branch', async () => {
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: '[]' })
+      .mockResolvedValueOnce({ stdout: '[]' })
+
+    const result = await prepareGitHubStackedPullRequest('/repo', {
+      provider: 'github',
+      base: 'feature/parent',
+      head: 'feature/child',
+      title: 'Child'
+    })
+
+    expect(result).toMatchObject({ ok: false, code: 'validation' })
+    if (!result.ok) {
+      expect(result.error).toContain('does not have an open pull request')
+    }
+  })
+
+  it('rejects a parent that is not the top of its stack', async () => {
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify([pullRequest(41, 'stack/parent', 'main')]) })
+      .mockResolvedValueOnce({ stdout: '[]' })
+      .mockResolvedValueOnce({ stdout: JSON.stringify([stack(50, [41, 45])]) })
+
+    const result = await prepareGitHubStackedPullRequest('/repo', {
+      provider: 'github',
+      base: 'stack/parent',
+      head: 'stack/child',
+      title: 'Child'
+    })
+
+    expect(result).toMatchObject({ ok: false, code: 'validation' })
+    if (!result.ok) {
+      expect(result.error).toContain('top pull request')
+    }
+  })
+
+  it('does not offer stacks on GitHub Enterprise Server', async () => {
+    repositoryMock.mockResolvedValue({
+      owner: 'acme',
+      repo: 'orca',
+      host: 'github.acme.test'
+    })
+
+    const result = await prepareGitHubStackedPullRequest('/repo', {
+      provider: 'github',
+      base: 'stack/parent',
+      head: 'stack/child',
+      title: 'Child'
+    })
+
+    expect(result).toMatchObject({ ok: false, code: 'validation' })
+    expect(ghExecFileAsyncMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('registerGitHubStackedPullRequest', () => {
+  it('creates a new stack with the parent and current PR', async () => {
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: '[]' })
+      .mockResolvedValueOnce({ stdout: '[]' })
+      .mockResolvedValueOnce({ stdout: JSON.stringify({ number: 50 }) })
+
+    const result = await registerGitHubStackedPullRequest({
+      repoPath: '/repo',
+      repository,
+      parentReview,
+      currentReview
+    })
+
+    expect(result).toMatchObject({ ok: true, number: 42, stackNumber: 50 })
+    expect(ghExecFileAsyncMock.mock.calls[2][0]).toEqual([
+      'api',
+      '-X',
+      'POST',
+      'repos/acme/orca/stacks',
+      '-F',
+      'pull_requests[]=41',
+      '-F',
+      'pull_requests[]=42'
+    ])
+  })
+
+  it('appends the current PR when the parent is the existing top', async () => {
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify([stack(50, [40, 41])]) })
+      .mockResolvedValueOnce({ stdout: '[]' })
+      .mockResolvedValueOnce({ stdout: JSON.stringify({ number: 50 }) })
+
+    const result = await registerGitHubStackedPullRequest({
+      repoPath: '/repo',
+      repository,
+      parentReview,
+      currentReview,
+      connectionId: 'ssh-1'
+    })
+
+    expect(result).toMatchObject({ ok: true, stackNumber: 50 })
+    expect(ghExecFileAsyncMock.mock.calls[2][0]).toEqual([
+      'api',
+      '-X',
+      'POST',
+      'repos/acme/orca/stacks/50/add',
+      '-F',
+      'pull_requests[]=42'
+    ])
+    expect(ghExecFileAsyncMock.mock.calls[2][1]).not.toHaveProperty('cwd')
+  })
+
+  it('treats an already registered parent-child pair as success', async () => {
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify([stack(50, [41, 42])]) })
+      .mockResolvedValueOnce({ stdout: JSON.stringify([stack(50, [41, 42])]) })
+
+    const result = await registerGitHubStackedPullRequest({
+      repoPath: '/repo',
+      repository,
+      parentReview,
+      currentReview
+    })
+
+    expect(result).toMatchObject({ ok: true, stackNumber: 50 })
+    expect(ghExecFileAsyncMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not claim registration when the stack no longer holds the parent', async () => {
+    // A concurrent stack edit can drop the parent while the child sits at index 0.
+    // Reading index 0 off a findIndex miss would report that pair as registered.
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: JSON.stringify([stack(50, [42])]) })
+      .mockResolvedValueOnce({ stdout: JSON.stringify([stack(50, [42])]) })
+
+    const result = await registerGitHubStackedPullRequest({
+      repoPath: '/repo',
+      repository,
+      parentReview,
+      currentReview
+    })
+
+    expect(result).toMatchObject({
+      ok: false,
+      error: 'The pull request already belongs to a different GitHub stack.',
+      createdReview: currentReview
+    })
+  })
+
+  it('preserves the created PR when registration fails', async () => {
+    ghExecFileAsyncMock
+      .mockResolvedValueOnce({ stdout: '[]' })
+      .mockResolvedValueOnce({ stdout: '[]' })
+      .mockRejectedValueOnce(new Error('HTTP 422'))
+
+    const result = await registerGitHubStackedPullRequest({
+      repoPath: '/repo',
+      repository,
+      parentReview,
+      currentReview
+    })
+
+    expect(result).toMatchObject({
+      ok: false,
+      createdReview: currentReview
+    })
+  })
+})
diff --git a/src/main/github/stacked-pr-creation.ts b/src/main/github/stacked-pr-creation.ts
new file mode 100644
index 00000000000..e34752df6d9
--- /dev/null
+++ b/src/main/github/stacked-pr-creation.ts
@@ -0,0 +1,310 @@
+import type {
+  CreateStackedHostedReviewInput,
+  CreateStackedHostedReviewResult
+} from '../../shared/hosted-review'
+import { isDefaultGitHubHost } from '../../shared/github-repository-identity-key'
+import {
+  normalizeHostedReviewBaseRef,
+  normalizeHostedReviewHeadRef
+} from '../../shared/hosted-review-refs'
+import { acquire, ghExecFileAsync, ghRepoExecOptions, githubRepoContext, release } from './gh-utils'
+import {
+  getOriginGitHubApiRepository,
+  githubHostExecOptions,
+  type GitHubApiRepository
+} from './github-api-repository'
+import {
+  getHostedReviewLocalGitOptions,
+  type HostedReviewExecutionOptions
+} from '../source-control/hosted-review-git-options'
+import {
+  parseGitHubStackPullRequests,
+  parseGitHubStacks,
+  type GitHubStack,
+  type GitHubStackPullRequest,
+  type NumberedHostedReviewSummary
+} from './github-stack-api-responses'
+
+type StackedPullRequestPlan =
+  | {
+      ok: true
+      repository: GitHubApiRepository
+      parentReview: GitHubStackPullRequest
+      currentReview: GitHubStackPullRequest | null
+    }
+  | Extract<CreateStackedHostedReviewResult, { ok: false }>
+
+function creationError(error: string): Extract<CreateStackedHostedReviewResult, { ok: false }> {
+  return { ok: false, code: 'validation', error }
+}
+
+function isStacksUnavailableError(error: unknown): boolean {
+  const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase()
+  return message.includes('http 404') || message.includes('feature not supported')
+}
+
+function ghOptions(
+  repoPath: string,
+  repository: GitHubApiRepository,
+  connectionId?: string | null,
+  options: HostedReviewExecutionOptions = {}
+) {
+  return {
+    ...ghRepoExecOptions(
+      githubRepoContext(repoPath, connectionId, getHostedReviewLocalGitOptions(options))
+    ),
+    ...githubHostExecOptions(repository),
+    timeout: 60_000
+  }
+}
+
+async function findOpenPullRequestsForBranch(
+  repoPath: string,
+  repository: GitHubApiRepository,
+  branch: string,
+  connectionId?: string | null,
+  options: HostedReviewExecutionOptions = {},
+  base?: string
+): Promise<GitHubStackPullRequest[]> {
+  const head = encodeURIComponent(`${repository.owner}:${branch}`)
+  const baseQuery = base ? `&base=${encodeURIComponent(base)}` : ''
+  const endpoint = `repos/${repository.owner}/${repository.repo}/pulls?head=${head}${baseQuery}&state=open&per_page=2`
+  const { stdout } = await ghExecFileAsync(
+    ['api', endpoint],
+    ghOptions(repoPath, repository, connectionId, options)
+  )
+  return parseGitHubStackPullRequests(stdout)
+}
+
+async function getStacksForPullRequest(
+  repoPath: string,
+  repository: GitHubApiRepository,
+  pullRequestNumber: number,
+  connectionId?: string | null,
+  options: HostedReviewExecutionOptions = {}
+): Promise<GitHubStack[]> {
+  const endpoint = `repos/${repository.owner}/${repository.repo}/stacks?pull_request=${pullRequestNumber}`
+  const { stdout } = await ghExecFileAsync(
+    ['api', endpoint],
+    ghOptions(repoPath, repository, connectionId, options)
+  )
+  return parseGitHubStacks(stdout)
+}
+
+function validateParentStack(
+  parentReview: NumberedHostedReviewSummary,
+  stacks: GitHubStack[]
+): Extract<CreateStackedHostedReviewResult, { ok: false }> | null {
+  if (stacks.length > 1) {
+    return creationError('The selected parent pull request belongs to multiple stacks.')
+  }
+  const stack = stacks[0]
+  if (!stack) {
+    return null
+  }
+  if (!stack.open) {
+    return creationError('The selected parent belongs to a closed stack.')
+  }
+  if (stack.pull_requests.at(-1)?.number !== parentReview.number) {
+    return creationError(
+      'Choose the top pull request in the stack as the base branch before adding another layer.'
+    )
+  }
+  return null
+}
+
+export async function prepareGitHubStackedPullRequest(
+  repoPath: string,
+  input: CreateStackedHostedReviewInput,
+  connectionId?: string | null,
+  options: HostedReviewExecutionOptions = {}
+): Promise<StackedPullRequestPlan> {
+  if (input.provider !== 'github') {
+    return creationError('Stacked pull request creation is available only for GitHub repositories.')
+  }
+  const repository = await getOriginGitHubApiRepository(
+    repoPath,
+    connectionId,
+    getHostedReviewLocalGitOptions(options)
+  )
+  if (!repository || !isDefaultGitHubHost(repository.host)) {
+    return creationError('GitHub stacked pull requests are available only on GitHub.com.')
+  }
+  const base = normalizeHostedReviewBaseRef(input.base).trim()
+  const head = input.head ? normalizeHostedReviewHeadRef(input.head).trim() : ''
+  if (!base || !head || base.toLowerCase() === head.toLowerCase()) {
+    return creationError('Choose a different parent branch before creating a stacked pull request.')
+  }
+
+  await acquire()
+  try {
+    const [parentPullRequests, currentPullRequests] = await Promise.all([
+      findOpenPullRequestsForBranch(repoPath, repository, base, connectionId, options),
+      findOpenPullRequestsForBranch(repoPath, repository, head, connectionId, options, base)
+    ])
+    if (parentPullRequests.length === 0) {
+      return creationError(
+        `The parent branch ${base} does not have an open pull request. Create that pull request first.`
+      )
+    }
+    if (parentPullRequests.length !== 1) {
+      return creationError(`Orca found multiple open pull requests for the parent branch ${base}.`)
+    }
+    if (currentPullRequests.length > 1) {
+      return creationError(`Orca found multiple open pull requests for the current branch ${head}.`)
+    }
+    const parentReview = parentPullRequests[0]
+    const currentReview = currentPullRequests[0] ?? null
+    const [parentStacks, currentStacks] = await Promise.all([
+      getStacksForPullRequest(repoPath, repository, parentReview.number, connectionId, options),
+      currentReview
+        ? getStacksForPullRequest(repoPath, repository, currentReview.number, connectionId, options)
+        : Promise.resolve([])
+    ])
+    if (
+      currentReview &&
+      registeredStackNumber(parentReview, currentReview, parentStacks, currentStacks)
+    ) {
+      return { ok: true, repository, parentReview, currentReview }
+    }
+    if (currentStacks.length > 0) {
+      return creationError('The pull request already belongs to a different GitHub stack.')
+    }
+    const parentError = validateParentStack(parentReview, parentStacks)
+    return (
+      parentError ?? {
+        ok: true,
+        repository,
+        parentReview,
+        currentReview
+      }
+    )
+  } catch (error) {
+    console.warn('GitHub stack creation preflight failed:', error)
+    return {
+      ok: false,
+      code: isStacksUnavailableError(error) ? 'validation' : 'unknown',
+      error: isStacksUnavailableError(error)
+        ? 'GitHub stacked pull requests are not available for this repository.'
+        : 'Orca could not verify the parent pull request. Retry in a moment.'
+    }
+  } finally {
+    release()
+  }
+}
+
+function registeredStackNumber(
+  parentReview: NumberedHostedReviewSummary,
+  currentReview: NumberedHostedReviewSummary,
+  parentStacks: GitHubStack[],
+  currentStacks: GitHubStack[]
+): number | null {
+  const parentStack = parentStacks[0]
+  const currentStack = currentStacks[0]
+  if (!parentStack || !currentStack || parentStack.number !== currentStack.number) {
+    return null
+  }
+  const parentPosition = parentStack.pull_requests.findIndex(
+    (pullRequest) => pullRequest.number === parentReview.number
+  )
+  // Why: a miss is -1, and -1 + 1 reads the first entry — which reports "already
+  // registered" whenever the current PR heads a stack the parent has left.
+  if (parentPosition === -1) {
+    return null
+  }
+  return parentStack.pull_requests[parentPosition + 1]?.number === currentReview.number
+    ? parentStack.number
+    : null
+}
+
+export async function registerGitHubStackedPullRequest(args: {
+  repoPath: string
+  repository: GitHubApiRepository
+  parentReview: NumberedHostedReviewSummary
+  currentReview: NumberedHostedReviewSummary
+  connectionId?: string | null
+  options?: HostedReviewExecutionOptions
+}): Promise<CreateStackedHostedReviewResult> {
+  const options = args.options ?? {}
+  await acquire()
+  try {
+    const [parentStacks, currentStacks] = await Promise.all([
+      getStacksForPullRequest(
+        args.repoPath,
+        args.repository,
+        args.parentReview.number,
+        args.connectionId,
+        options
+      ),
+      getStacksForPullRequest(
+        args.repoPath,
+        args.repository,
+        args.currentReview.number,
+        args.connectionId,
+        options
+      )
+    ])
+    const existingStackNumber = registeredStackNumber(
+      args.parentReview,
+      args.currentReview,
+      parentStacks,
+      currentStacks
+    )
+    if (existingStackNumber) {
+      return {
+        ok: true,
+        ...args.currentReview,
+        stackNumber: existingStackNumber,
+        parentReview: args.parentReview
+      }
+    }
+    if (currentStacks.length > 0) {
+      return {
+        ...creationError('The pull request already belongs to a different GitHub stack.'),
+        createdReview: args.currentReview
+      }
+    }
+    const parentError = validateParentStack(args.parentReview, parentStacks)
+    if (parentError) {
+      return { ...parentError, createdReview: args.currentReview }
+    }
+
+    const parentStack = parentStacks[0]
+    const endpoint = parentStack
+      ? `repos/${args.repository.owner}/${args.repository.repo}/stacks/${parentStack.number}/add`
+      : `repos/${args.repository.owner}/${args.repository.repo}/stacks`
+    const pullRequests = parentStack
+      ? [args.currentReview.number]
+      : [args.parentReview.number, args.currentReview.number]
+    const command = ['api', '-X', 'POST', endpoint]
+    for (const pullRequest of pullRequests) {
+      command.push('-F', `pull_requests[]=${pullRequest}`)
+    }
+    const { stdout } = await ghExecFileAsync(command, {
+      ...ghOptions(args.repoPath, args.repository, args.connectionId, options),
+      idempotent: false
+    })
+    const stackNumber = Number((JSON.parse(stdout) as { number?: unknown }).number)
+    if (!Number.isInteger(stackNumber) || stackNumber <= 0) {
+      throw new Error('GitHub returned an invalid stack response.')
+    }
+    return {
+      ok: true,
+      ...args.currentReview,
+      stackNumber,
+      parentReview: args.parentReview
+    }
+  } catch (error) {
+    console.warn('GitHub stack registration failed:', error)
+    return {
+      ok: false,
+      code: isStacksUnavailableError(error) ? 'validation' : 'unknown',
+      error: isStacksUnavailableError(error)
+        ? 'The pull request was created, but GitHub stacks are not available for this repository.'
+        : 'The pull request was created, but GitHub could not add it to the stack. Retry to finish stack registration.',
+      createdReview: args.currentReview
+    }
+  } finally {
+    release()
+  }
+}
diff --git a/src/main/global-fetch-call-site-audit.test.ts b/src/main/global-fetch-call-site-audit.test.ts
index 625d9fa2b04..b46c1b793be 100644
--- a/src/main/global-fetch-call-site-audit.test.ts
+++ b/src/main/global-fetch-call-site-audit.test.ts
@@ -18,6 +18,7 @@ const AUDITED_GLOBAL_FETCH_LINES = new Map<string, number>([
   ['main/artifacts/artifact-cloud-request.ts', 1],
   ['main/azure-devops/azure-devops-api-request.ts', 1],
   ['main/bitbucket/client.ts', 1],
+  ['main/bitbucket/user-request.ts', 1],
   ['main/gitea/client.ts', 1],
   ['main/orca-profiles/profile-cloud-client.ts', 1],
   ['main/orca-profiles/profile-cloud-org-members-client.ts', 1],
diff --git a/src/main/grok/hook-service.ts b/src/main/grok/hook-service.ts
index 51a6150eab6..1b6e8bba165 100644
--- a/src/main/grok/hook-service.ts
+++ b/src/main/grok/hook-service.ts
@@ -14,6 +14,7 @@ import {
   writeManagedScript,
   type HookDefinition
 } from '../agent-hooks/installer-utils'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
 import {
   readHooksJsonRemote,
   writeHooksJsonRemote,
@@ -182,6 +183,10 @@ function buildInstalledConfig(
 }
 
 export class GrokHookService {
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(getManagedScriptPath(), getManagedScript())
+  }
+
   getStatus(): AgentHookInstallStatus {
     const configPath = getConfigPath()
     const scriptPath = getManagedScriptPath()
diff --git a/src/main/index.ts b/src/main/index.ts
index 0a4be2562c8..f91a531ce7b 100644
--- a/src/main/index.ts
+++ b/src/main/index.ts
@@ -39,7 +39,10 @@ import {
   shutdownDaemon
 } from './daemon/daemon-init'
 import {
-  hasRecordedLegacySharedCodexPane,
+  type CodexPaneHomeRoute,
+  getCodexPaneAccount,
+  hasRecordedManagedHostCodexPane,
+  isCodexPaneHomeRouteProvenAwayFromSharedHome,
   reconcileCodexPaneAccountsWithLivePtys
 } from './codex/codex-pane-account-registry'
 import { closeAllWatchers } from './ipc/filesystem-watcher'
@@ -116,6 +119,7 @@ import {
   configureElectronNetworkCompatibility,
   configureDevUserDataPath,
   configureOrcaUserDataPathEnv,
+  disableUnsupportedChromiumFeatures,
   enableMainProcessGpuFeatures,
   installDevParentDisconnectQuit,
   installDevParentSignalQuit,
@@ -160,6 +164,10 @@ import { createWslCliReconciliationStartupBarrier } from './startup/wsl-cli-reco
 import { getDevInstanceIdentity } from './startup/dev-instance-identity'
 import { hydrateShellPath, mergePathSegments } from './startup/hydrate-shell-path'
 import { createWindowsShellPathHydration } from './startup/windows-shell-path-hydration'
+import {
+  startWindowsDesktopBeforeShellPathReady,
+  type WindowsDesktopStartupServices
+} from './startup/windows-desktop-shell-path-startup'
 import {
   acquireSingleInstanceLock,
   logSingleInstanceLockBypass,
@@ -216,6 +224,7 @@ import {
 } from './codex-accounts/runtime-selection'
 import { normalizeClaudeRuntimeSelection } from './claude-accounts/runtime-selection'
 import { codexHookService, setSystemCodexHomeHookSweepSuppressed } from './codex/hook-service'
+import { reconcileRetainedCodexHookHomes } from './codex/retained-codex-hook-state'
 import {
   ensureRealHomeCodexHookState,
   isRealHomeCodexHookLaneUsable
@@ -253,7 +262,10 @@ import { maybeAutoRenameBranchOnFirstWork } from './agent-hooks/first-work-branc
 import { rememberBranchRenameFailureOutput } from './agent-hooks/branch-rename-failure-output'
 import { renameWorktreeFolderOnFirstWork } from './agent-hooks/first-work-folder-rename'
 import { moveWorktree } from './git/worktree'
-import { setDefaultWslDistroOverride } from './git/runner'
+import {
+  configureWindowsHostGitEnvironmentReadiness,
+  setDefaultWslDistroOverride
+} from './git/runner'
 import { getRepoIdFromWorktreeId } from '../shared/worktree-id'
 import { parseWorkspaceKey } from '../shared/workspace-scope'
 import { setMigrationUnsupportedPtyListener } from './agent-hooks/migration-unsupported-pty-state'
@@ -400,10 +412,23 @@ function handleCodexHomePtySpawned(args: {
   id: string
   codexHomePath: string | null
   reattached?: boolean
+  reattachedHomeRoute?: CodexPaneHomeRoute | null
   launchEnv?: NodeJS.ProcessEnv
   startedAt?: Date
   startedSequence?: number
 }): void {
+  // Why: only shared or ambiguous retained shells can create rollout logs that still need publication.
+  if (args.reattached && args.startedSequence !== undefined) {
+    const paneAccount = getCodexPaneAccount(args.id)
+    const homeRoute =
+      args.reattachedHomeRoute !== undefined
+        ? (args.reattachedHomeRoute ?? undefined)
+        : paneAccount?.homeRoute
+    if (codexSessionMigration && isCodexPaneHomeRouteProvenAwayFromSharedHome(homeRoute)) {
+      codexSessionMigration.ignoreLaunch(args.id, args.startedSequence)
+      return
+    }
+  }
   const fullScanRequired =
     codexRuntimeHome?.beginHostSystemDefaultSessionMigrationLaunch(args.codexHomePath, {
       reattached: args.reattached,
@@ -822,6 +847,7 @@ if (hasSingleInstanceLock) {
     platform: process.platform,
     ...getMainProcessLifecycleIdentity()
   })
+  disableUnsupportedChromiumFeatures()
   configureElectronNetworkCompatibility()
   enableRendererHeapHeadroom()
   maybeApplyGpuFallbackForThisLaunch()
@@ -906,7 +932,7 @@ async function reapRestoredSubagentsWithoutLiveAgent(): Promise<void> {
   })
 }
 
-function startTerminalRuntimeStartupServices(): Promise<void> {
+function startTerminalRuntimeStartupServices(): WindowsDesktopStartupServices {
   logStartupMilestone('first-window-startup-services-start')
   const startupServices = startFirstWindowStartupServices({
     // Why: both desktop and headless serve must adopt the same persistent provider before creating terminals or a renderer.
@@ -917,10 +943,19 @@ function startTerminalRuntimeStartupServices(): Promise<void> {
       await initDaemonPtyProvider(signal, {
         macosLoginSessionWatch: process.platform === 'darwin' && !isServeMode
       })
-      if (codexRuntimeHome?.isHostSystemDefaultRealHome() && hasRecordedLegacySharedCodexPane()) {
+      // Why: a retained shell keeps its launch-time Codex home even when the current routing lane changes.
+      if (codexRuntimeHome && hasRecordedManagedHostCodexPane()) {
         const livePtyIds = await listLiveDaemonPtyIds()
         if (livePtyIds) {
           reconcileCodexPaneAccountsWithLivePtys(livePtyIds)
+          const settings = store?.getSettings()
+          reconcileRetainedCodexHookHomes({
+            hookService: codexHookService,
+            hooksEnabled:
+              isAgentStatusHooksEnabled(settings) &&
+              settings?.disabledTuiAgents.includes('codex') !== true,
+            runtimeHomePaths: codexRuntimeHome.getRetainedHostCodexHookHomePaths(livePtyIds)
+          })
         }
       }
       // Why: retained shells can invoke Codex immediately after the startup gate.
@@ -954,19 +989,24 @@ function startTerminalRuntimeStartupServices(): Promise<void> {
       console.error('[agent-hooks] Failed to start local hook server:', error)
     }
   })
-  firstWindowStartupServicesReady = startupServices.firstWindowReady
-  localPtyStartupReady = startupServices.localPtyReady
-  localPtyProviderStartupReady = startupServices.localPtyProviderReady
-  void firstWindowStartupServicesReady.then(() => {
+  void startupServices.firstWindowReady.then(() => {
     logStartupMilestone('first-window-startup-services-ready')
   })
-  void localPtyStartupReady.then(() => {
+  void startupServices.localPtyReady.then(() => {
     logStartupMilestone('local-pty-startup-ready')
     void reapRestoredSubagentsWithoutLiveAgent().catch((error) => {
       console.warn('[agent-hooks] restored-subagent liveness probe failed:', error)
     })
   })
-  return firstWindowStartupServicesReady
+  return startupServices
+}
+
+function bindTerminalRuntimeStartupServices(
+  services: Promise<WindowsDesktopStartupServices>
+): void {
+  firstWindowStartupServicesReady = services.then((value) => value.firstWindowReady)
+  localPtyStartupReady = services.then((value) => value.localPtyReady)
+  localPtyProviderStartupReady = services.then((value) => value.localPtyProviderReady)
 }
 
 function prepareCodexRuntimeHomeForLaunch(
@@ -1222,7 +1262,7 @@ function syncMacMenuBarIcon(showMenuBarIcon: boolean): Tray | null {
   return options ? setMacMenuBarIconVisible(showMenuBarIcon, options) : null
 }
 
-function openMainWindow(): BrowserWindow {
+function openMainWindow(options: { revealOnDidFinishLoad?: boolean } = {}): BrowserWindow {
   logStartupMilestone('open-main-window-start')
   if (!store) {
     throw new Error('Store must be initialized before opening the main window')
@@ -1311,6 +1351,7 @@ function openMainWindow(): BrowserWindow {
       void presentRendererRecoveryPrompt(recentRecoveryCount)
     },
     deferLoad: true,
+    ...(options.revealOnDidFinishLoad === true ? { revealOnDidFinishLoad: true } : {}),
     title: devInstanceIdentity.name,
     getKeybindings: () => keybindings?.getOverrides(),
     onBeforeReload: ({ ignoreCache, webContentsId }) => {
@@ -1350,6 +1391,9 @@ function openMainWindow(): BrowserWindow {
     logStartupMilestone('ready-to-show')
     setImmediate(createSystemTrayDeferred)
   })
+  window.once('show', () => {
+    logStartupMilestone('window-shown')
+  })
   const trayCreateFallback = setTimeout(createSystemTrayDeferred, TRAY_CREATE_FALLBACK_MS)
   trayCreateFallback.unref?.()
 
@@ -2127,6 +2171,9 @@ void app.whenReady().then(async () => {
   const activeOrcaProfile = ensureActiveOrcaProfile()
   store = new Store({ dataFile: activeOrcaProfile.dataFile })
   const windowsShellPathHydration = createWindowsShellPathHydration()
+  configureWindowsHostGitEnvironmentReadiness(
+    process.platform === 'win32' ? windowsShellPathHydration.whenReady : null
+  )
   if (process.platform === 'win32') {
     const settings = store.getSettings()
     if (app.isPackaged) {
@@ -2954,9 +3001,20 @@ void app.whenReady().then(async () => {
     }
   })
 
-  // Why: Git hooks inherit process.env, so Source Control must not open before profile PATH settles.
-  await windowsShellPathHydration.whenReady()
-  startTerminalRuntimeStartupServices()
+  const shellPathReady = windowsShellPathHydration.whenReady()
+  let desktopWindow: BrowserWindow | null = null
+  if (process.platform === 'win32' && app.isPackaged && !serveOptions) {
+    const desktopStartup = startWindowsDesktopBeforeShellPathReady({
+      openWindow: () => openMainWindow({ revealOnDidFinishLoad: true }),
+      shellPathReady,
+      startServices: startTerminalRuntimeStartupServices
+    })
+    desktopWindow = desktopStartup.window
+    bindTerminalRuntimeStartupServices(desktopStartup.services)
+  } else {
+    await shellPathReady
+    bindTerminalRuntimeStartupServices(Promise.resolve(startTerminalRuntimeStartupServices()))
+  }
   app.on('activate', handleMacAppActivation)
 
   if (serveOptions) {
@@ -3040,15 +3098,21 @@ void app.whenReady().then(async () => {
   }
 
   // Why: window and RPC startup run in parallel; registerPtyHandlers gates PTY spawns so RPC binds without racing the daemon provider swap.
+  const desktopRuntimeRpc = runtimeRpc
+  if (!desktopRuntimeRpc) {
+    throw new Error('runtime_rpc_unavailable')
+  }
   const [win, runtimeRpcStartResult] = await Promise.all([
-    Promise.resolve(openMainWindow()),
-    runtimeRpc.start().then(
-      () => ({ ok: true as const }),
-      (error: unknown) => {
-        recordRuntimeRpcStartFailure(error)
-        return { ok: false as const, error }
-      }
-    )
+    Promise.resolve(desktopWindow ?? openMainWindow()),
+    shellPathReady
+      .then(() => desktopRuntimeRpc.start())
+      .then(
+        () => ({ ok: true as const }),
+        (error: unknown) => {
+          recordRuntimeRpcStartFailure(error)
+          return { ok: false as const, error }
+        }
+      )
   ])
   if (!runtimeRpcStartResult.ok) {
     void showRuntimeRpcStartupFailureDialog(win, runtimeRpcStartResult.error)
diff --git a/src/main/integration-credential-file.ts b/src/main/integration-credential-file.ts
index 2ad90492f1b..96823a77a65 100644
--- a/src/main/integration-credential-file.ts
+++ b/src/main/integration-credential-file.ts
@@ -1,4 +1,13 @@
-import { statSync } from 'node:fs'
+import {
+  chmodSync,
+  closeSync,
+  fsyncSync,
+  openSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeSync
+} from 'node:fs'
 import { safeStorage } from 'electron'
 import {
   credentialDecryptionMessage,
@@ -15,6 +24,75 @@ export function credentialFileHasContent(path: string): boolean {
   }
 }
 
+// Falls back to 0600 plaintext when the OS keyring is unavailable, matching the
+// Linear/Jira token writers so a keyring-less box still connects.
+export function writeEncryptedCredential(
+  service: IntegrationCredentialService,
+  path: string,
+  value: string
+): void {
+  if (safeStorage.isEncryptionAvailable()) {
+    writeCredentialFileAtomic(path, safeStorage.encryptString(value))
+    return
+  }
+  console.warn(
+    `[${service.toLowerCase()}] safeStorage encryption unavailable — storing credential in plaintext`
+  )
+  writeCredentialFileAtomic(path, Buffer.from(value, 'utf-8'))
+}
+
+// Why (STA-3941): a direct write can truncate the previous credential if it
+// fails or the app dies mid-write, leaving nothing to authenticate with. Write
+// a sibling temp file, fsync it, then rename — readers only ever observe the
+// old bytes or the complete new ones.
+export function writeCredentialFileAtomic(path: string, data: Buffer): void {
+  const tempPath = `${path}.tmp`
+  let handle: number | null = null
+  try {
+    handle = openSync(tempPath, 'w', 0o600)
+    // Why: write(2) is allowed to return a short count, so a single writeSync
+    // could publish a truncated credential — the very corruption this avoids.
+    let written = 0
+    while (written < data.length) {
+      const bytes = writeSync(handle, data, written, data.length - written)
+      if (bytes <= 0) {
+        throw new Error(`Credential write stalled at ${written}/${data.length} bytes`)
+      }
+      written += bytes
+    }
+    fsyncSync(handle)
+    closeSync(handle)
+    handle = null
+    renameSync(tempPath, path)
+    restrictCredentialFileToOwner(path)
+  } catch (error) {
+    if (handle !== null) {
+      try {
+        closeSync(handle)
+      } catch {
+        // Already closed or invalid; the unlink below is what matters.
+      }
+    }
+    try {
+      unlinkSync(tempPath)
+    } catch {
+      // Nothing to clean up.
+    }
+    throw error
+  }
+}
+
+// Why: writeFileSync's `mode` only applies when it creates the file, so
+// rewriting an existing credential would silently keep looser permissions.
+// Best-effort: Windows has no POSIX modes, so chmod is a documented no-op there.
+export function restrictCredentialFileToOwner(path: string): void {
+  try {
+    chmodSync(path, 0o600)
+  } catch {
+    // Best-effort hardening; the write itself already succeeded.
+  }
+}
+
 export class CredentialDecryptionError extends Error {
   constructor(service: IntegrationCredentialService) {
     super(credentialDecryptionMessage(service))
diff --git a/src/main/ipc/ai-vault-delete.ts b/src/main/ipc/ai-vault-delete.ts
index a221cc28ceb..110786d11d7 100644
--- a/src/main/ipc/ai-vault-delete.ts
+++ b/src/main/ipc/ai-vault-delete.ts
@@ -5,6 +5,7 @@ import {
 } from '../ai-vault/cached-session-list'
 import { deleteAiVaultSessionFile } from '../ai-vault/session-delete'
 import { invalidateSessionParseCacheEntry } from '../ai-vault/session-scanner-parse-cache'
+import { invalidateAiVaultBackgroundCache } from '../ai-vault/session-scanner-background'
 import type { AiVaultAgent } from '../../shared/ai-vault-types'
 import type {
   AiVaultDeleteSessionArgs,
@@ -15,6 +16,7 @@ import type {
 // invalidation is injected rather than reached into from here.
 type AiVaultDeleteDeps = {
   invalidateMultiHostListCache: () => void
+  invalidateBackgroundCache?: (paths: string[]) => Promise<void>
 }
 
 // Binds the delete orchestration to the caller's cache-invalidation seam.
@@ -52,6 +54,11 @@ export async function deleteAiVaultSession(
     // what the renderer echoes back as filePath), so invalidate with that exact
     // key — resolve() could normalise it away from the stored key and miss.
     invalidateSessionParseCacheEntry(args?.filePath ?? '')
+    await (deps.invalidateBackgroundCache ?? invalidateAiVaultBackgroundCache)([
+      args?.filePath ?? ''
+    ]).catch((error) => {
+      console.warn('[ai-vault] background cache invalidation failed:', error)
+    })
   }
 
   return result
diff --git a/src/main/ipc/ai-vault-scan-coalescing.test.ts b/src/main/ipc/ai-vault-scan-coalescing.test.ts
index aaf4bb67cd6..a7ba5835611 100644
--- a/src/main/ipc/ai-vault-scan-coalescing.test.ts
+++ b/src/main/ipc/ai-vault-scan-coalescing.test.ts
@@ -169,14 +169,22 @@ describe('Agent Session History scan coalescing', () => {
     expect(result).not.toHaveProperty('cancelled')
   })
 
-  it('still rejects the handler when a scan fails for a non-cancellation reason', async () => {
+  it('reports a failed local scan as a host issue rather than rejecting', async () => {
     mocks.scanAiVaultSessionsInWorker.mockRejectedValue(new Error('transcript root is unreadable'))
     registerAiVaultHandlers()
     const list = ipcHandler('aiVault:listSessions')
 
-    await expect(
-      list({ sender: { id: 1 } }, { executionHostScope: 'local', requestToken: 'scan' })
-    ).rejects.toThrow('transcript root is unreadable')
+    // The local leg degrades like the SSH legs above: a rejection reaches the
+    // renderer as a raw string painted over the list instead of an issue row.
+    const result = await list(
+      { sender: { id: 1 } },
+      { executionHostScope: 'local', requestToken: 'scan' }
+    )
+    expect(result).toMatchObject({
+      sessions: [],
+      issues: [expect.objectContaining({ message: 'transcript root is unreadable', kind: 'host' })]
+    })
+    expect(result).not.toHaveProperty('cancelled')
   })
 
   it('re-joins a preempted same-scope caller onto the forced refresh', async () => {
diff --git a/src/main/ipc/ai-vault-subagent-list.ts b/src/main/ipc/ai-vault-subagent-list.ts
index 49f609577c7..64a579c1550 100644
--- a/src/main/ipc/ai-vault-subagent-list.ts
+++ b/src/main/ipc/ai-vault-subagent-list.ts
@@ -1,7 +1,6 @@
 import { resolve } from 'node:path'
 import { getAiVaultWslHomeDirs } from '../ai-vault/cached-session-list'
-import { listClaudeSubagentSessions } from '../ai-vault/session-scanner-claude-subagents'
-import { listOmpSubagentSessions } from '../ai-vault/session-scanner-omp-subagent-listing'
+import { listAiVaultSubagentSessionsInBackground } from '../ai-vault/session-scanner-background'
 import { claudeProjectsRootDirs, ompSessionsRootDirs } from '../ai-vault/session-scanner-roots'
 import { isPathInsideOrEqual } from '../../shared/cross-platform-path'
 import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
@@ -45,7 +44,5 @@ export async function listAiVaultSubagentSessions(
   if (!roots.some((root) => isPathInsideOrEqual(resolve(root), parentFilePath))) {
     return { sessions: [], issues: [] }
   }
-  return args.agent === 'claude'
-    ? listClaudeSubagentSessions({ parentFilePath })
-    : listOmpSubagentSessions({ parentFilePath })
+  return listAiVaultSubagentSessionsInBackground({ agent: args.agent, parentFilePath })
 }
diff --git a/src/main/ipc/ai-vault.test.ts b/src/main/ipc/ai-vault.test.ts
index 9af91f92a33..13b2bc51926 100644
--- a/src/main/ipc/ai-vault.test.ts
+++ b/src/main/ipc/ai-vault.test.ts
@@ -93,6 +93,7 @@ vi.mock('./ssh', () => ({
 
 const { OMP_SESSIONS_DIR } = await import('../ai-vault/session-scanner-roots')
 const { _internals, registerAiVaultHandlers } = await import('./ai-vault')
+const { deleteAiVaultSession: deleteAiVaultSessionWithDeps } = await import('./ai-vault-delete')
 
 const provider = {} as IFilesystemProvider
 
@@ -789,9 +790,14 @@ describe('deleteAiVaultSession', () => {
   }
 
   it('invalidates every AI Vault cache after a real delete', async () => {
+    const invalidateMultiHostListCache = vi.fn()
+    const invalidateBackgroundCache = vi.fn().mockResolvedValue(undefined)
     mocks.deleteAiVaultSessionFile.mockResolvedValue({ outcome: 'deleted' })
 
-    const result = await _internals.deleteAiVaultSession(args)
+    const result = await deleteAiVaultSessionWithDeps(args, {
+      invalidateMultiHostListCache,
+      invalidateBackgroundCache
+    })
 
     expect(result).toEqual({ outcome: 'deleted' })
     expect(mocks.deleteAiVaultSessionFile).toHaveBeenCalledWith(
@@ -802,8 +808,10 @@ describe('deleteAiVaultSession', () => {
         executionHostId: 'local'
       })
     )
+    expect(invalidateMultiHostListCache).toHaveBeenCalledTimes(1)
     expect(mocks.invalidateAiVaultSessionListCache).toHaveBeenCalledTimes(1)
     expect(mocks.invalidateSessionParseCacheEntry).toHaveBeenCalledWith(args.filePath)
+    expect(invalidateBackgroundCache).toHaveBeenCalledWith([args.filePath])
   })
 
   it('does not invalidate any cache when the executor rejects (e.g. non-local host)', async () => {
diff --git a/src/main/ipc/ai-vault.ts b/src/main/ipc/ai-vault.ts
index c2f5be216c7..8f4b411cb6f 100644
--- a/src/main/ipc/ai-vault.ts
+++ b/src/main/ipc/ai-vault.ts
@@ -24,7 +24,7 @@ import {
   type AiVaultSubagentListArgs,
   type AiVaultSubagentListResult
 } from '../../shared/ai-vault-types'
-import { handleAiVaultGetFirstUserPrompt } from '../ai-vault/session-first-user-prompt-read'
+import { handleAiVaultGetFirstUserPrompt } from '../ai-vault/session-first-user-prompt-handler'
 import { registerAiVaultResumeHandler, type AiVaultResumeHandlerOptions } from './ai-vault-resume'
 import {
   LOCAL_EXECUTION_HOST_ID,
@@ -139,7 +139,7 @@ async function scanAiVaultSessionsByHostScope(
   const depth = requestedAiVaultSessionDepth(args)
   const scopePaths = args?.scopePaths ?? []
   if (executionHostScope === LOCAL_EXECUTION_HOST_ID) {
-    return scanLocalAiVaultSessions(args, signal)
+    return scanLocalAiVaultSessionsAsIssue(args, signal)
   }
   if (executionHostScope === 'all') {
     const runtimeHosts = getActiveRuntimeAiVaultHostInfosResult()
@@ -149,7 +149,7 @@ async function scanAiVaultSessionsByHostScope(
       ...(sshHosts.issue ? [sshHosts.issue] : [])
     ]
     const scannedResults = await Promise.all([
-      scanLocalAiVaultSessionsForAllScope(args, signal),
+      scanLocalAiVaultSessionsAsIssue(args, signal),
       ...sshHosts.hostInfos.map((hostInfo) =>
         scanHostLegWithCache({
           cacheKey: `${cacheKey}|${toSshExecutionHostId(hostInfo.targetId)}`,
@@ -226,8 +226,10 @@ function getActiveSshAiVaultHostInfosResult(): AiVaultHostDiscoveryResult<{ targ
 
 // Why: the SSH legs already degrade to an issue row so one bad host can't take
 // the shared Promise.all down; the local leg can throw too (parse-cache load,
-// WSL home resolution) and would otherwise discard every host's sessions.
-async function scanLocalAiVaultSessionsForAllScope(
+// WSL home resolution, scanner service supervision) and would otherwise discard
+// every host's sessions under 'all', or replace the list with a raw error string
+// under single-host scope.
+async function scanLocalAiVaultSessionsAsIssue(
   args: AiVaultListArgs | undefined,
   signal: AbortSignal | undefined
 ): Promise<AiVaultListResult> {
diff --git a/src/main/ipc/bitbucket.ts b/src/main/ipc/bitbucket.ts
new file mode 100644
index 00000000000..2b9b030c691
--- /dev/null
+++ b/src/main/ipc/bitbucket.ts
@@ -0,0 +1,59 @@
+import { ipcMain } from 'electron'
+import {
+  connectBitbucket,
+  disconnectBitbucket,
+  getBitbucketConnectionStatus,
+  type BitbucketConnectArgs,
+  type BitbucketConnectResult,
+  type BitbucketConnectionStatus
+} from '../bitbucket/credential-connection'
+import { _resetPreflightCache } from './preflight'
+
+function optionalString(value: unknown): string | null {
+  return typeof value === 'string' ? value : null
+}
+
+function normalizeConnectInput(value: unknown): BitbucketConnectArgs | null {
+  if (!value || typeof value !== 'object') {
+    return null
+  }
+  const raw = value as Record<string, unknown>
+  if (raw.authMode !== 'token' && raw.authMode !== 'basic') {
+    return null
+  }
+  return {
+    authMode: raw.authMode,
+    accessToken: optionalString(raw.accessToken),
+    email: optionalString(raw.email),
+    apiToken: optionalString(raw.apiToken),
+    baseUrl: optionalString(raw.baseUrl)
+  }
+}
+
+export function registerBitbucketHandlers(): void {
+  ipcMain.handle(
+    'bitbucket:connect',
+    async (_event, args: unknown): Promise<BitbucketConnectResult> => {
+      const input = normalizeConnectInput(args)
+      if (!input) {
+        return { ok: false, error: 'Invalid Bitbucket credentials' }
+      }
+      const result = await connectBitbucket(input)
+      if (result.ok) {
+        // Preflight caches source-control status per session; reset so the card
+        // reflects the new connection without a relaunch.
+        _resetPreflightCache()
+      }
+      return result
+    }
+  )
+
+  ipcMain.handle('bitbucket:disconnect', async (): Promise<void> => {
+    disconnectBitbucket()
+    _resetPreflightCache()
+  })
+
+  ipcMain.handle('bitbucket:status', async (): Promise<BitbucketConnectionStatus> => {
+    return getBitbucketConnectionStatus()
+  })
+}
diff --git a/src/main/ipc/claude-usage.ts b/src/main/ipc/claude-usage.ts
deleted file mode 100644
index 3496706e8e3..00000000000
--- a/src/main/ipc/claude-usage.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-import { ipcMain } from 'electron'
-import type { ClaudeUsageStore } from '../claude-usage/store'
-import type {
-  ClaudeUsageBreakdownKind,
-  ClaudeUsageRange,
-  ClaudeUsageScope
-} from '../../shared/claude-usage-types'
-
-export function registerClaudeUsageHandlers(claudeUsage: ClaudeUsageStore): void {
-  ipcMain.handle('claudeUsage:getScanState', () => claudeUsage.getScanState())
-  ipcMain.handle('claudeUsage:setEnabled', (_event, args: { enabled: boolean }) =>
-    claudeUsage.setEnabled(args.enabled)
-  )
-  ipcMain.handle('claudeUsage:refresh', (_event, args?: { force?: boolean }) =>
-    claudeUsage.refresh(args?.force ?? false)
-  )
-  ipcMain.handle(
-    'claudeUsage:getSnapshot',
-    (_event, args: { scope: ClaudeUsageScope; range: ClaudeUsageRange; limit?: number }) =>
-      claudeUsage.getSnapshot(args.scope, args.range, args.limit)
-  )
-  ipcMain.handle(
-    'claudeUsage:getSummary',
-    (_event, args: { scope: ClaudeUsageScope; range: ClaudeUsageRange }) =>
-      claudeUsage.getSummary(args.scope, args.range)
-  )
-  ipcMain.handle(
-    'claudeUsage:getDaily',
-    (_event, args: { scope: ClaudeUsageScope; range: ClaudeUsageRange }) =>
-      claudeUsage.getDaily(args.scope, args.range)
-  )
-  ipcMain.handle(
-    'claudeUsage:getBreakdown',
-    (
-      _event,
-      args: { scope: ClaudeUsageScope; range: ClaudeUsageRange; kind: ClaudeUsageBreakdownKind }
-    ) => claudeUsage.getBreakdown(args.scope, args.range, args.kind)
-  )
-  ipcMain.handle(
-    'claudeUsage:getRecentSessions',
-    (_event, args: { scope: ClaudeUsageScope; range: ClaudeUsageRange; limit?: number }) =>
-      claudeUsage.getRecentSessions(args.scope, args.range, args.limit)
-  )
-}
diff --git a/src/main/ipc/codex-usage.ts b/src/main/ipc/codex-usage.ts
deleted file mode 100644
index 3db15a92076..00000000000
--- a/src/main/ipc/codex-usage.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-import { ipcMain } from 'electron'
-import type { CodexUsageStore } from '../codex-usage/store'
-import type {
-  CodexUsageBreakdownKind,
-  CodexUsageRange,
-  CodexUsageScope
-} from '../../shared/codex-usage-types'
-
-export function registerCodexUsageHandlers(codexUsage: CodexUsageStore): void {
-  ipcMain.handle('codexUsage:getScanState', () => codexUsage.getScanState())
-  ipcMain.handle('codexUsage:setEnabled', (_event, args: { enabled: boolean }) =>
-    codexUsage.setEnabled(args.enabled)
-  )
-  ipcMain.handle('codexUsage:refresh', (_event, args?: { force?: boolean }) =>
-    codexUsage.refresh(args?.force ?? false)
-  )
-  ipcMain.handle(
-    'codexUsage:getSnapshot',
-    (_event, args: { scope: CodexUsageScope; range: CodexUsageRange; limit?: number }) =>
-      codexUsage.getSnapshot(args.scope, args.range, args.limit)
-  )
-  ipcMain.handle(
-    'codexUsage:getSummary',
-    (_event, args: { scope: CodexUsageScope; range: CodexUsageRange }) =>
-      codexUsage.getSummary(args.scope, args.range)
-  )
-  ipcMain.handle(
-    'codexUsage:getDaily',
-    (_event, args: { scope: CodexUsageScope; range: CodexUsageRange }) =>
-      codexUsage.getDaily(args.scope, args.range)
-  )
-  ipcMain.handle(
-    'codexUsage:getBreakdown',
-    (
-      _event,
-      args: { scope: CodexUsageScope; range: CodexUsageRange; kind: CodexUsageBreakdownKind }
-    ) => codexUsage.getBreakdown(args.scope, args.range, args.kind)
-  )
-  ipcMain.handle(
-    'codexUsage:getRecentSessions',
-    (_event, args: { scope: CodexUsageScope; range: CodexUsageRange; limit?: number }) =>
-      codexUsage.getRecentSessions(args.scope, args.range, args.limit)
-  )
-}
diff --git a/src/main/ipc/ephemeral-vm.test.ts b/src/main/ipc/ephemeral-vm.test.ts
index 8df189a4abb..bbccfb41e93 100644
--- a/src/main/ipc/ephemeral-vm.test.ts
+++ b/src/main/ipc/ephemeral-vm.test.ts
@@ -6,7 +6,7 @@ import { encodePairingOffer, PAIRING_OFFER_VERSION } from '../../shared/pairing'
 import { listEnvironments } from '../../shared/runtime-environment-store'
 import { upsertEphemeralVmRuntime } from '../../shared/ephemeral-vm-runtime-store'
 
-const handlers = new Map<string, (_event: unknown, args: never) => Promise<unknown> | unknown>()
+const handlers = new Map<string, (_event: unknown, args: never) => unknown>()
 const {
   handleMock,
   removeHandlerMock,
diff --git a/src/main/ipc/filesystem-import.test.ts b/src/main/ipc/filesystem-import.test.ts
index fcd004dcd06..bb143987c96 100644
--- a/src/main/ipc/filesystem-import.test.ts
+++ b/src/main/ipc/filesystem-import.test.ts
@@ -645,7 +645,7 @@ describe('fs:importExternalPaths', () => {
     )
     const mib = 1024 * 1024
     const regularSize = 25 * mib
-    const overflowSize = 1 * mib
+    const overflowSize = Number(mib)
     const readFileMock = vi.fn().mockResolvedValue(Buffer.from('chunk'))
 
     lstatMock.mockImplementation(async (p: string) => {
@@ -683,7 +683,7 @@ describe('fs:importExternalPaths', () => {
     )
     openMock.mockImplementation(async (p: string) => {
       const fileIndex = filePaths.indexOf(p)
-      if (fileIndex >= 0 && fileIndex < filePaths.length - 1) {
+      if (fileIndex !== -1 && fileIndex < filePaths.length - 1) {
         return {
           stat: vi.fn().mockResolvedValue({
             size: regularSize,
diff --git a/src/main/ipc/filesystem-list-files-git-directory-expansion.test.ts b/src/main/ipc/filesystem-list-files-git-directory-expansion.test.ts
index 5d5cf163746..5d7507a5615 100644
--- a/src/main/ipc/filesystem-list-files-git-directory-expansion.test.ts
+++ b/src/main/ipc/filesystem-list-files-git-directory-expansion.test.ts
@@ -10,7 +10,7 @@ const { gitSpawnMock } = vi.hoisted(() => ({
 }))
 
 vi.mock('../git/runner', () => ({
-  gitSpawn: gitSpawnMock
+  gitSpawnAfterWindowsEnvironmentReady: gitSpawnMock
 }))
 
 import { listFilesWithGit } from './filesystem-list-files-git-fallback'
@@ -56,11 +56,13 @@ describe('main Quick Open git directory expansion', () => {
     const primary = createMockProcess()
     const ignored = createMockProcess()
     gitSpawnMock
-      .mockReturnValueOnce(revParse)
-      .mockReturnValueOnce(primary)
-      .mockReturnValueOnce(ignored)
+      .mockResolvedValueOnce(revParse)
+      .mockResolvedValueOnce(primary)
+      .mockResolvedValueOnce(ignored)
 
     const promise = listFilesWithGit(root, [], {})
+    await vi.waitFor(() => expect(gitSpawnMock).toHaveBeenCalledTimes(1))
+    await vi.waitFor(() => expect(revParse.listenerCount('close')).toBeGreaterThan(0))
     revParse.emit('close', 0, null)
     await vi.waitFor(() => expect(gitSpawnMock).toHaveBeenCalledTimes(3))
     ;(primary.stdout as unknown as EventEmitter).emit(
@@ -86,12 +88,14 @@ describe('main Quick Open git directory expansion', () => {
     const primary = createMockProcess()
     const ignored = createMockProcess()
     gitSpawnMock
-      .mockReturnValueOnce(revParse)
-      .mockReturnValueOnce(primary)
-      .mockReturnValueOnce(ignored)
+      .mockResolvedValueOnce(revParse)
+      .mockResolvedValueOnce(primary)
+      .mockResolvedValueOnce(ignored)
 
     const controller = new AbortController()
     const promise = listFilesWithGit(root, [], {}, controller.signal)
+    await vi.waitFor(() => expect(gitSpawnMock).toHaveBeenCalledTimes(1))
+    await vi.waitFor(() => expect(revParse.listenerCount('close')).toBeGreaterThan(0))
     revParse.emit('close', 0, null)
     await vi.waitFor(() => expect(gitSpawnMock).toHaveBeenCalledTimes(3))
     controller.abort()
@@ -100,4 +104,92 @@ describe('main Quick Open git directory expansion', () => {
     expect(primary.kill).toHaveBeenCalled()
     expect(ignored.kill).toHaveBeenCalled()
   })
+
+  it('kills a repository probe returned after cancellation', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-main-git-probe-race-'))
+    tempDirs.push(root)
+    const revParse = createMockProcess()
+    let resolveRevParse!: (child: ChildProcess) => void
+    gitSpawnMock.mockReturnValueOnce(
+      new Promise<ChildProcess>((resolve) => {
+        resolveRevParse = resolve
+      })
+    )
+
+    const controller = new AbortController()
+    const promise = listFilesWithGit(root, [], {}, controller.signal)
+    await vi.waitFor(() => expect(gitSpawnMock).toHaveBeenCalledOnce())
+    controller.abort()
+    resolveRevParse(revParse)
+
+    await expect(promise).rejects.toSatisfy(isFileListingCancellation)
+    expect(revParse.kill).toHaveBeenCalled()
+    expect(revParse.listenerCount('close')).toBe(0)
+  })
+
+  it('kills file scans returned after cancellation', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-main-git-scan-race-'))
+    tempDirs.push(root)
+    const revParse = createMockProcess()
+    const primary = createMockProcess()
+    const ignored = createMockProcess()
+    let resolvePrimary!: (child: ChildProcess) => void
+    let resolveIgnored!: (child: ChildProcess) => void
+    gitSpawnMock
+      .mockResolvedValueOnce(revParse)
+      .mockReturnValueOnce(
+        new Promise<ChildProcess>((resolve) => {
+          resolvePrimary = resolve
+        })
+      )
+      .mockReturnValueOnce(
+        new Promise<ChildProcess>((resolve) => {
+          resolveIgnored = resolve
+        })
+      )
+
+    const controller = new AbortController()
+    const promise = listFilesWithGit(root, [], {}, controller.signal)
+    await vi.waitFor(() => expect(revParse.listenerCount('close')).toBeGreaterThan(0))
+    revParse.emit('close', 0, null)
+    await vi.waitFor(() => expect(gitSpawnMock).toHaveBeenCalledTimes(3))
+    controller.abort()
+    resolvePrimary(primary)
+    resolveIgnored(ignored)
+
+    await expect(promise).rejects.toSatisfy(isFileListingCancellation)
+    expect(primary.kill).toHaveBeenCalled()
+    expect(ignored.kill).toHaveBeenCalled()
+  })
+
+  it('cancels a pending sibling spawn when the primary scan fails', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-main-git-sibling-failure-'))
+    tempDirs.push(root)
+    const revParse = createMockProcess()
+    const primary = createMockProcess()
+    let pendingSignal: AbortSignal | undefined
+    gitSpawnMock
+      .mockResolvedValueOnce(revParse)
+      .mockResolvedValueOnce(primary)
+      .mockImplementationOnce(
+        (_args: string[], options: { signal?: AbortSignal }) =>
+          new Promise<ChildProcess>((_resolve, reject) => {
+            pendingSignal = options.signal
+            options.signal?.addEventListener(
+              'abort',
+              () => reject(Object.assign(new Error('aborted'), { name: 'AbortError' })),
+              { once: true }
+            )
+          })
+      )
+
+    const promise = listFilesWithGit(root, [], {})
+    await vi.waitFor(() => expect(revParse.listenerCount('close')).toBeGreaterThan(0))
+    revParse.emit('close', 0, null)
+    await vi.waitFor(() => expect(gitSpawnMock).toHaveBeenCalledTimes(3))
+    primary.emit('error', new Error('primary failed'))
+
+    await expect(promise).rejects.toThrow('primary failed')
+    expect(pendingSignal?.aborted).toBe(true)
+  })
 })
diff --git a/src/main/ipc/filesystem-list-files-git-fallback-real.test.ts b/src/main/ipc/filesystem-list-files-git-fallback-real.test.ts
index 0cf672fa30f..69dde7afaf3 100644
--- a/src/main/ipc/filesystem-list-files-git-fallback-real.test.ts
+++ b/src/main/ipc/filesystem-list-files-git-fallback-real.test.ts
@@ -1,17 +1,19 @@
-import { execFile as execFileCallback } from 'node:child_process'
+import { execFile as execFileCallback, spawn, type SpawnOptions } from 'node:child_process'
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { promisify } from 'node:util'
-import { afterEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { Store } from '../persistence'
+import type * as GitRunner from '../git/runner'
 
-const { checkRgAvailableMock } = vi.hoisted(() => ({
-  checkRgAvailableMock: vi.fn()
+const { wslAwareSpawnMock } = vi.hoisted(() => ({
+  wslAwareSpawnMock: vi.fn()
 }))
 
-vi.mock('./rg-availability', () => ({
-  checkRgAvailable: checkRgAvailableMock
+vi.mock('../git/runner', async (importOriginal) => ({
+  ...(await importOriginal<typeof GitRunner>()),
+  wslAwareSpawn: wslAwareSpawnMock
 }))
 
 import { listQuickOpenFiles } from './filesystem-list-files'
@@ -50,6 +52,16 @@ async function initRepo(repoPath: string): Promise<void> {
 describe('filesystem-list-files real git fallback', () => {
   let tempDir: string | null = null
 
+  beforeEach(() => {
+    wslAwareSpawnMock.mockImplementation(
+      (_command: string, _args: string[], options: SpawnOptions & { cwd?: string }) =>
+        spawn('orca-definitely-missing-rg', [], {
+          cwd: options.cwd,
+          stdio: options.stdio
+        })
+    )
+  })
+
   afterEach(async () => {
     if (tempDir) {
       await rm(tempDir, { recursive: true, force: true })
@@ -59,7 +71,6 @@ describe('filesystem-list-files real git fallback', () => {
   })
 
   it('returns real paths for UTF-8 filenames from the git fallback', async () => {
-    checkRgAvailableMock.mockResolvedValue(false)
     tempDir = await mkdtemp(join(tmpdir(), 'orca-quick-open-git-fallback-'))
     const repoPath = join(tempDir, 'repo')
     await execFile('git', ['init', '-q', repoPath])
@@ -71,7 +82,6 @@ describe('filesystem-list-files real git fallback', () => {
   })
 
   it('fills nested git repos from gitlink and untracked embedded-repo entries', async () => {
-    checkRgAvailableMock.mockResolvedValue(false)
     tempDir = await mkdtemp(join(tmpdir(), 'orca-quick-open-monorepo-'))
     const repoPath = join(tempDir, 'parent')
     const appPath = join(repoPath, 'packages', 'app')
@@ -117,7 +127,6 @@ describe('filesystem-list-files real git fallback', () => {
   })
 
   it('walks a non-git root instead of returning an empty git fallback result', async () => {
-    checkRgAvailableMock.mockResolvedValue(false)
     tempDir = await mkdtemp(join(tmpdir(), 'orca-quick-open-non-git-'))
     await writeRel(tempDir, 'folder/file.ts')
 
@@ -127,7 +136,6 @@ describe('filesystem-list-files real git fallback', () => {
   })
 
   it('bounds a non-git readdir fallback without treating the limit as an error', async () => {
-    checkRgAvailableMock.mockResolvedValue(false)
     tempDir = await mkdtemp(join(tmpdir(), 'orca-quick-open-bounded-non-git-'))
     await writeRel(tempDir, 'a.ts')
     await writeRel(tempDir, 'b.ts')
@@ -139,7 +147,6 @@ describe('filesystem-list-files real git fallback', () => {
   })
 
   it('rejects abnormal git ls-files failures instead of resolving an empty list', async () => {
-    checkRgAvailableMock.mockResolvedValue(false)
     tempDir = await mkdtemp(join(tmpdir(), 'orca-quick-open-bad-index-'))
     const repoPath = join(tempDir, 'repo')
     await initRepo(repoPath)
@@ -151,7 +158,6 @@ describe('filesystem-list-files real git fallback', () => {
   })
 
   it('resolves an empty repo as an empty list', async () => {
-    checkRgAvailableMock.mockResolvedValue(false)
     tempDir = await mkdtemp(join(tmpdir(), 'orca-quick-open-empty-repo-'))
     const repoPath = join(tempDir, 'repo')
     await initRepo(repoPath)
diff --git a/src/main/ipc/filesystem-list-files-git-fallback.ts b/src/main/ipc/filesystem-list-files-git-fallback.ts
index ff390d13caf..bebab27808d 100644
--- a/src/main/ipc/filesystem-list-files-git-fallback.ts
+++ b/src/main/ipc/filesystem-list-files-git-fallback.ts
@@ -1,5 +1,9 @@
 import type { ChildProcess } from 'node:child_process'
-import { gitSpawn } from '../git/runner'
+import { gitSpawnAfterWindowsEnvironmentReady } from '../git/runner'
+import {
+  isWslLinkedWorktreeGitRoutingCandidate,
+  prepareWslLinkedWorktreeGitRouting
+} from '../git/wsl-linked-worktree-git-routing'
 import {
   buildGitLsFilesArgsForQuickOpen,
   shouldExcludeQuickOpenRelPath,
@@ -28,12 +32,26 @@ async function isInsideGitWorkTree(
   if (signal?.aborted) {
     throw fileListingCancellationError(signal)
   }
+  if (isWslLinkedWorktreeGitRoutingCandidate(rootPath, localGitOptions.wslDistro)) {
+    try {
+      await prepareWslLinkedWorktreeGitRouting(rootPath, localGitOptions.wslDistro, { signal })
+    } catch (error) {
+      if (signal?.aborted) {
+        throw fileListingCancellationError(signal)
+      }
+      throw error
+    }
+  }
+  if (signal?.aborted) {
+    throw fileListingCancellationError(signal)
+  }
+  const child = await gitSpawnAfterWindowsEnvironmentReady(['rev-parse', '--is-inside-work-tree'], {
+    cwd: rootPath,
+    ...(localGitOptions.wslDistro ? { wslDistro: localGitOptions.wslDistro } : {}),
+    ...(signal ? { signal } : {}),
+    stdio: ['ignore', 'ignore', 'ignore']
+  })
   return new Promise((resolve, reject) => {
-    const child = gitSpawn(['rev-parse', '--is-inside-work-tree'], {
-      cwd: rootPath,
-      ...(localGitOptions.wslDistro ? { wslDistro: localGitOptions.wslDistro } : {}),
-      stdio: ['ignore', 'ignore', 'ignore']
-    })
     let done = false
     let timer: ReturnType<typeof setTimeout>
     const cleanup = (): void => {
@@ -71,6 +89,9 @@ async function isInsideGitWorkTree(
       child.kill()
       finish(false)
     }, 10_000)
+    if (signal?.aborted) {
+      cancel()
+    }
   })
 }
 
@@ -104,8 +125,17 @@ export async function listFilesWithGit(
     reject: (error: Error) => void
     resolve: () => void
   }[] = []
+  const scanController = new AbortController()
 
-  const runGitLsFiles = (args: string[]): Promise<void> => {
+  const runGitLsFiles = async (args: string[]): Promise<void> => {
+    // Why: git ls-files outputs paths relative to cwd, so we set cwd to
+    // rootPath and use the output directly — no prefix stripping needed.
+    const child = await gitSpawnAfterWindowsEnvironmentReady(['ls-files', ...args], {
+      cwd: rootPath,
+      ...(localGitOptions.wslDistro ? { wslDistro: localGitOptions.wslDistro } : {}),
+      signal: scanController.signal,
+      stdio: ['ignore', 'pipe', 'pipe']
+    })
     return new Promise((resolve, reject) => {
       let buf = ''
       let done = false
@@ -138,13 +168,6 @@ export async function listFilesWithGit(
         return maxResults !== undefined && directFileCandidates.size >= maxResults
       }
 
-      // Why: git ls-files outputs paths relative to cwd, so we set cwd to
-      // rootPath and use the output directly — no prefix stripping needed.
-      const child = gitSpawn(['ls-files', ...args], {
-        cwd: rootPath,
-        ...(localGitOptions.wslDistro ? { wslDistro: localGitOptions.wslDistro } : {}),
-        stdio: ['ignore', 'pipe', 'pipe']
-      })
       let timer: ReturnType<typeof setTimeout>
       const cleanup = (): void => {
         clearTimeout(timer)
@@ -229,6 +252,10 @@ export async function listFilesWithGit(
         child.kill()
         rejectPass(new Error('git ls-files timed out'))
       }, 10000)
+      if (scanController.signal.aborted) {
+        child.kill()
+        rejectPass(fileListingCancellationError(scanController.signal))
+      }
     })
   }
 
@@ -258,14 +285,17 @@ export async function listFilesWithGit(
     }
   }
 
-  const onAbort = (): void => killSurvivors('git ls-files cancelled')
+  const onAbort = (): void => {
+    scanController.abort(signal?.reason)
+    killSurvivors('git ls-files cancelled')
+  }
   signal?.addEventListener('abort', onAbort, { once: true })
   try {
     const runIgnoredPass = () =>
       // Why: ignored files are supplementary — a failed or timed-out ignored
       // pass must not discard the primary listing the user actually needs.
       runGitLsFiles(ignoredPass).catch((err: Error) => {
-        if (!signal?.aborted) {
+        if (!scanController.signal.aborted) {
           console.warn('[quick-open] git ignored-file pass failed; keeping primary results:', err)
         }
       })
@@ -280,6 +310,7 @@ export async function listFilesWithGit(
       }
     }
   } catch (err) {
+    scanController.abort(err)
     killSurvivors()
     if (signal?.aborted) {
       throw fileListingCancellationError(signal)
diff --git a/src/main/ipc/filesystem-list-files-install-rg.test.ts b/src/main/ipc/filesystem-list-files-install-rg.test.ts
index 7f4c34f5eda..f0221d8e24e 100644
--- a/src/main/ipc/filesystem-list-files-install-rg.test.ts
+++ b/src/main/ipc/filesystem-list-files-install-rg.test.ts
@@ -1,16 +1,21 @@
+import { spawn, type ChildProcess, type SpawnOptions } from 'node:child_process'
+import { EventEmitter } from 'node:events'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { Store } from '../persistence'
+import type * as GitRunner from '../git/runner'
 
 const {
   listFilesWithGitMock,
   resolveAuthorizedPathMock,
   checkRgAvailableMock,
-  getLocalGitOptionsForRegisteredWorktreeMock
+  getLocalGitOptionsForRegisteredWorktreeMock,
+  wslAwareSpawnMock
 } = vi.hoisted(() => ({
   listFilesWithGitMock: vi.fn(),
   resolveAuthorizedPathMock: vi.fn(),
   checkRgAvailableMock: vi.fn(),
-  getLocalGitOptionsForRegisteredWorktreeMock: vi.fn()
+  getLocalGitOptionsForRegisteredWorktreeMock: vi.fn(),
+  wslAwareSpawnMock: vi.fn()
 }))
 
 vi.mock('./filesystem-list-files-git-fallback', () => ({
@@ -29,14 +34,39 @@ vi.mock('./local-worktree-runtime-options', () => ({
   getLocalGitOptionsForRegisteredWorktree: getLocalGitOptionsForRegisteredWorktreeMock
 }))
 
+vi.mock('../git/runner', async (importOriginal) => ({
+  ...(await importOriginal<typeof GitRunner>()),
+  wslAwareSpawn: wslAwareSpawnMock
+}))
+
 import { listQuickOpenFiles } from './filesystem-list-files'
 
+function createStartedRipgrepProcess(): ChildProcess {
+  const child = new EventEmitter() as ChildProcess
+  ;(child as unknown as Record<string, unknown>).stdout = new EventEmitter()
+  ;(
+    (child as unknown as Record<string, unknown>).stdout as EventEmitter & {
+      setEncoding: () => void
+    }
+  ).setEncoding = vi.fn()
+  ;(child as unknown as Record<string, unknown>).stderr = new EventEmitter()
+  ;(child as unknown as Record<string, unknown>).kill = vi.fn()
+  ;(child as unknown as Record<string, unknown>).exitCode = null
+  ;(child as unknown as Record<string, unknown>).signalCode = null
+  Object.defineProperty(child, 'pid', { value: 1 })
+  return child
+}
+
 describe('filesystem-list-files ripgrep guidance', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resolveAuthorizedPathMock.mockImplementation(async (path) => path)
-    checkRgAvailableMock.mockResolvedValue(false)
+    checkRgAvailableMock.mockResolvedValue(true)
     getLocalGitOptionsForRegisteredWorktreeMock.mockReturnValue({})
+    wslAwareSpawnMock.mockImplementation(
+      (_command: string, _args: string[], options: SpawnOptions & { cwd?: string }) =>
+        spawn('orca-definitely-missing-rg', [], { stdio: options.stdio })
+    )
   })
 
   it('turns only a readdir budget failure into install guidance', async () => {
@@ -51,6 +81,31 @@ describe('filesystem-list-files ripgrep guidance', () => {
     )
   })
 
+  it('keeps the WSL preflight and falls back before starting real rg', async () => {
+    getLocalGitOptionsForRegisteredWorktreeMock.mockReturnValue({ wslDistro: 'Ubuntu' })
+    checkRgAvailableMock.mockResolvedValue(false)
+    listFilesWithGitMock.mockResolvedValue(['src/index.ts'])
+
+    await expect(listQuickOpenFiles('C:\\repo', {} as Store)).resolves.toEqual(['src/index.ts'])
+    expect(checkRgAvailableMock).toHaveBeenCalledWith('C:\\repo', 'Ubuntu')
+    expect(wslAwareSpawnMock).not.toHaveBeenCalled()
+  })
+
+  it("falls back when a native launcher exits outside ripgrep's contract", async () => {
+    const primary = createStartedRipgrepProcess()
+    const ignored = createStartedRipgrepProcess()
+    let callIndex = 0
+    wslAwareSpawnMock.mockImplementation(() => (++callIndex === 1 ? primary : ignored))
+    listFilesWithGitMock.mockResolvedValue(['src/index.ts'])
+
+    const listing = listQuickOpenFiles('/workspace', {} as Store)
+    await Promise.resolve()
+    primary.emit('close', 127, null)
+
+    await expect(listing).resolves.toEqual(['src/index.ts'])
+    expect(listFilesWithGitMock).toHaveBeenCalledTimes(1)
+  })
+
   it('keeps cancellation and Git errors unchanged', async () => {
     const cancellation = new Error('File listing cancelled')
     listFilesWithGitMock.mockRejectedValueOnce(cancellation)
diff --git a/src/main/ipc/filesystem-list-files.test.ts b/src/main/ipc/filesystem-list-files.test.ts
index 946f8653dd6..7debd516760 100644
--- a/src/main/ipc/filesystem-list-files.test.ts
+++ b/src/main/ipc/filesystem-list-files.test.ts
@@ -36,6 +36,7 @@ import { listQuickOpenFiles } from './filesystem-list-files'
 import { EventEmitter } from 'node:events'
 import type { Store } from '../persistence'
 import type { ChildProcess } from 'node:child_process'
+import { FileListingCancelledError } from '../../shared/file-listing-cancellation'
 
 const SHA1 = '0123456789abcdef0123456789abcdef01234567'
 
@@ -55,10 +56,24 @@ function createMockProcess(): ChildProcess {
   ;(p as unknown as Record<string, unknown>).kill = vi.fn()
   ;(p as unknown as Record<string, unknown>).exitCode = null
   ;(p as unknown as Record<string, unknown>).signalCode = null
+  Object.defineProperty(p, 'pid', { configurable: true, value: 1 })
 
   return p
 }
 
+function createMissingRipgrepProcess(): ChildProcess {
+  const child = createMockProcess()
+  Object.defineProperty(child, 'pid', { value: undefined })
+  void Promise.resolve().then(() => child.emit('close', -2, null))
+  return child
+}
+
+async function flushMicrotasks(): Promise<void> {
+  for (let index = 0; index < 12; index++) {
+    await Promise.resolve()
+  }
+}
+
 function isIgnoredRgPass(args: string[]): boolean {
   return args.includes('--no-ignore-vcs')
 }
@@ -93,6 +108,8 @@ describe('filesystem-list-files', () => {
     expect(p1.kill).toHaveBeenCalled()
     expect(p2.kill).not.toHaveBeenCalled()
     expect(spawnMock).toHaveBeenCalledTimes(1)
+    expect(checkRgAvailableMock).not.toHaveBeenCalled()
+    expect(spawnMock.mock.calls[0]?.[1]).not.toContain('--version')
   })
 
   it('merges normal files and ignored files and filters correctly', async () => {
@@ -108,6 +125,8 @@ describe('filesystem-list-files', () => {
 
     const storeMock = {} as unknown as Store
     const promise = listQuickOpenFiles('/mock/root', storeMock)
+    await flushMicrotasks()
+    expect(spawnMock).toHaveBeenCalledTimes(2)
 
     // Simulate stdout output for normal files
     setTimeout(() => {
@@ -192,6 +211,24 @@ describe('filesystem-list-files', () => {
     await expect(promise).resolves.toEqual(['src/index.ts'])
   })
 
+  it('does not mistake a WSL-routed executable exit 127 for missing rg', async () => {
+    const p1 = createMockProcess()
+    const p2 = createMockProcess()
+    Object.defineProperty(p1, 'pid', { value: 1 })
+    Object.defineProperty(p2, 'pid', { value: 2 })
+    getLocalGitOptionsForRegisteredWorktreeMock.mockReturnValue({ wslDistro: 'Ubuntu' })
+    spawnMock.mockImplementation((_cmd, args: string[]) => (isIgnoredRgPass(args) ? p2 : p1))
+
+    const promise = listQuickOpenFiles('C:\\repo', {} as unknown as Store)
+    setTimeout(() => {
+      p1.emit('close', 127, null)
+      p2.emit('close', 0, null)
+    }, 0)
+
+    await expect(promise).rejects.toThrow('rg exited with code 127')
+    expect(spawnMock.mock.calls.some((call) => call[0] === 'git')).toBe(false)
+  })
+
   it('rejects rg failures instead of resolving a false-empty list', async () => {
     const p1 = createMockProcess()
     const p2 = createMockProcess()
@@ -330,16 +367,90 @@ describe('filesystem-list-files', () => {
     expect(result).toEqual(['valid.ts'])
   })
 
-  describe('git ls-files fallback', () => {
-    it('falls back to git ls-files when rg is not available', async () => {
-      checkRgAvailableMock.mockResolvedValue(false)
+  it('lets cancellation win a native-unavailable race before Git starts', async () => {
+    const first = createMockProcess()
+    Object.defineProperty(first, 'pid', { value: undefined })
+    spawnMock.mockReturnValue(first)
+    const controller = new AbortController()
+    const cancellation = new FileListingCancelledError('superseded')
 
+    const promise = listQuickOpenFiles(
+      '/mock/root',
+      {} as unknown as Store,
+      undefined,
+      controller.signal
+    )
+    await flushMicrotasks()
+    controller.abort(cancellation)
+    first.emit('close', -2, null)
+
+    await expect(promise).rejects.toBe(cancellation)
+    expect(spawnMock).toHaveBeenCalledTimes(1)
+    expect(spawnMock.mock.calls.some((call) => call[0] === 'git')).toBe(false)
+    const error = Object.assign(new Error('spawn rg ENOENT'), { code: 'ENOENT' })
+    expect(() => first.emit('error', error)).not.toThrow()
+    expect(first.listenerCount('error')).toBe(0)
+  })
+
+  describe('git ls-files fallback', () => {
+    it('kills only the admitted pass when ignored rg fails before spawn', async () => {
+      const primary = createMockProcess()
+      const missingIgnored = createMockProcess()
+      const revParse = createMockProcess()
+      const gitPrimary = createMockProcess()
+      const gitIgnored = createMockProcess()
+      Object.defineProperty(missingIgnored, 'pid', { value: undefined })
+      let gitPassIndex = 0
+      spawnMock.mockImplementation((cmd: string, args: string[]) => {
+        if (cmd === 'rg') {
+          return isIgnoredRgPass(args) ? missingIgnored : primary
+        }
+        if (args.includes('rev-parse')) {
+          return revParse
+        }
+        if (args.includes('ls-files')) {
+          return gitPassIndex++ === 0 ? gitPrimary : gitIgnored
+        }
+        return createMockProcess()
+      })
+
+      const promise = listQuickOpenFiles('/mock/root', {} as unknown as Store)
+      await flushMicrotasks()
+      expect(spawnMock.mock.calls.filter((call) => call[0] === 'rg')).toHaveLength(2)
+      missingIgnored.emit('close', -2, null)
+
+      await vi.waitFor(() => expect(primary.kill).toHaveBeenCalled())
+      expect(missingIgnored.kill).not.toHaveBeenCalled()
+      const error = Object.assign(new Error('spawn rg ENOENT'), { code: 'ENOENT' })
+      expect(() => missingIgnored.emit('error', error)).not.toThrow()
+      await vi.waitFor(() =>
+        expect(
+          spawnMock.mock.calls.some((call) => (call[1] as string[]).includes('rev-parse'))
+        ).toBe(true)
+      )
+      revParse.emit('close', 0, null)
+      await vi.waitFor(() =>
+        expect(
+          spawnMock.mock.calls.filter((call) => (call[1] as string[]).includes('ls-files'))
+        ).toHaveLength(2)
+      )
+      gitPrimary.emit('close', 0, null)
+      gitIgnored.emit('close', 0, null)
+
+      await expect(promise).resolves.toEqual([])
+      expect(missingIgnored.listenerCount('error')).toBe(0)
+    })
+
+    it('falls back to git ls-files when rg is not available', async () => {
       let callIndex = 0
       const revParseProc = createMockProcess()
       const gitP1 = createMockProcess()
       const gitP2 = createMockProcess()
 
       spawnMock.mockImplementation((cmd: string, args: string[]) => {
+        if (cmd === 'rg') {
+          return createMissingRipgrepProcess()
+        }
         if (cmd === 'git' && args.includes('rev-parse')) {
           return revParseProc
         }
@@ -378,9 +489,10 @@ describe('filesystem-list-files', () => {
 
       const result = await promise
 
-      // Verify rg was never called
+      // The primary real command doubles as the availability check.
       const rgCalls = spawnMock.mock.calls.filter((call) => call[0] === 'rg')
-      expect(rgCalls.length).toBe(0)
+      expect(rgCalls.length).toBe(1)
+      expect(rgCalls.every((call) => !(call[1] as string[]).includes('--version'))).toBe(true)
 
       // Verify git ls-files was called
       const gitCalls = spawnMock.mock.calls.filter(
@@ -402,13 +514,15 @@ describe('filesystem-list-files', () => {
     })
 
     it('stops after primary Git files fill the result budget', async () => {
-      checkRgAvailableMock.mockResolvedValue(false)
       const revParseProc = createMockProcess()
       const gitP1 = createMockProcess()
       const gitP2 = createMockProcess()
       let callIndex = 0
 
       spawnMock.mockImplementation((cmd: string, args: string[]) => {
+        if (cmd === 'rg') {
+          return createMissingRipgrepProcess()
+        }
         if (cmd === 'git' && args.includes('rev-parse')) {
           return revParseProc
         }
@@ -439,10 +553,12 @@ describe('filesystem-list-files', () => {
     })
 
     it('does not let a discarded Git directory placeholder consume the result budget', async () => {
-      checkRgAvailableMock.mockResolvedValue(false)
       const revParseProc = createMockProcess()
       const primary = createMockProcess()
       spawnMock.mockImplementation((cmd: string, args: string[]) => {
+        if (cmd === 'rg') {
+          return createMissingRipgrepProcess()
+        }
         if (cmd === 'git' && args.includes('rev-parse')) {
           return revParseProc
         }
@@ -469,14 +585,15 @@ describe('filesystem-list-files', () => {
     })
 
     it('git fallback applies hidden dir blocklist', async () => {
-      checkRgAvailableMock.mockResolvedValue(false)
-
       const revParseProc = createMockProcess()
       const gitP1 = createMockProcess()
       const gitP2 = createMockProcess()
       let callIndex = 0
 
       spawnMock.mockImplementation((cmd: string, args: string[]) => {
+        if (cmd === 'rg') {
+          return createMissingRipgrepProcess()
+        }
         if (cmd === 'git' && args.includes('rev-parse')) {
           return revParseProc
         }
@@ -518,7 +635,6 @@ describe('filesystem-list-files', () => {
     })
 
     it('settles and detaches git fallback scans that ignore timeout kills', async () => {
-      checkRgAvailableMock.mockResolvedValue(false)
       vi.useFakeTimers()
 
       try {
@@ -528,6 +644,9 @@ describe('filesystem-list-files', () => {
         let callIndex = 0
 
         spawnMock.mockImplementation((cmd: string, args: string[]) => {
+          if (cmd === 'rg') {
+            return createMissingRipgrepProcess()
+          }
           if (cmd === 'git' && args.includes('rev-parse')) {
             return revParseProc
           }
@@ -541,13 +660,9 @@ describe('filesystem-list-files', () => {
         const storeMock = {} as unknown as Store
         const promise = listQuickOpenFiles('/mock/root', storeMock)
 
-        await Promise.resolve()
-        await Promise.resolve()
-        await Promise.resolve()
+        await flushMicrotasks()
         revParseProc.emit('close', 0, null)
-        await Promise.resolve()
-        await Promise.resolve()
-        await Promise.resolve()
+        await flushMicrotasks()
 
         ;(gitP1.stdout as unknown as EventEmitter).emit('data', 'src/index.ts\0partial')
 
@@ -567,7 +682,6 @@ describe('filesystem-list-files', () => {
     })
 
     it('keeps primary results when only the ignored pass times out', async () => {
-      checkRgAvailableMock.mockResolvedValue(false)
       const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
       vi.useFakeTimers()
 
@@ -578,6 +692,9 @@ describe('filesystem-list-files', () => {
         let callIndex = 0
 
         spawnMock.mockImplementation((cmd: string, args: string[]) => {
+          if (cmd === 'rg') {
+            return createMissingRipgrepProcess()
+          }
           if (cmd === 'git' && args.includes('rev-parse')) {
             return revParseProc
           }
@@ -591,13 +708,9 @@ describe('filesystem-list-files', () => {
         const storeMock = {} as unknown as Store
         const promise = listQuickOpenFiles('/mock/root', storeMock)
 
-        await Promise.resolve()
-        await Promise.resolve()
-        await Promise.resolve()
+        await flushMicrotasks()
         revParseProc.emit('close', 0, null)
-        await Promise.resolve()
-        await Promise.resolve()
-        await Promise.resolve()
+        await flushMicrotasks()
 
         ;(gitP1.stdout as unknown as EventEmitter).emit(
           'data',
diff --git a/src/main/ipc/filesystem-list-files.ts b/src/main/ipc/filesystem-list-files.ts
index 7edb688de72..c1666234cd0 100644
--- a/src/main/ipc/filesystem-list-files.ts
+++ b/src/main/ipc/filesystem-list-files.ts
@@ -17,6 +17,12 @@ import {
 import { isQuickOpenReaddirBudgetError } from '../../shared/quick-open-readdir-walk'
 import { buildInstallRgMessage } from '../../shared/quick-open-install-rg'
 import { listFilesWithGit } from './filesystem-list-files-git-fallback'
+import {
+  absorbPendingRipgrepSpawnError,
+  isRipgrepUnavailableExit,
+  killSpawnedRipgrepProcess,
+  RipgrepUnavailableError
+} from '../../shared/ripgrep-process-availability'
 
 export async function listQuickOpenFiles(
   rootPath: string,
@@ -37,13 +43,9 @@ export async function listQuickOpenFiles(
   // every worktree instead of just the active one. The shared helper
   // normalizes, validates, and root-relativizes every input.
   const excludePathPrefixes = buildExcludePathPrefixes(authorizedRootPath, excludePaths)
+  const wslDistroForOutput = parseWslPath(authorizedRootPath)?.distro ?? localGitOptions.wslDistro
 
-  // Why: checking rg availability upfront avoids a race condition where
-  // spawn('rg') emits 'close' before 'error' on some platforms, causing
-  // the handler to resolve with empty results before the git fallback
-  // can run.
-  const rgAvailable = await checkRgAvailable(authorizedRootPath, localGitOptions.wslDistro)
-  if (!rgAvailable) {
+  const listWithoutRipgrep = async (): Promise<string[]> => {
     try {
       return await listFilesWithGit(
         authorizedRootPath,
@@ -59,6 +61,12 @@ export async function listQuickOpenFiles(
       throw new Error(await buildInstallRgMessage(err))
     }
   }
+  if (
+    wslDistroForOutput &&
+    !(await checkRgAvailable(authorizedRootPath, localGitOptions.wslDistro))
+  ) {
+    return listWithoutRipgrep()
+  }
 
   const files = new Set<string>()
   const children: {
@@ -68,8 +76,6 @@ export async function listQuickOpenFiles(
   }[] = []
   // Why: WSL-routed rg can emit Linux-native absolute paths. UNC repos carry
   // their distro in the path; Windows-path repos carry it in project runtime.
-  const wslDistroForOutput = parseWslPath(authorizedRootPath)?.distro ?? localGitOptions.wslDistro
-
   const { primary, ignoredPass } = buildRgArgsForQuickOpen({
     // Why: rg evaluates root-relative exclude globs against cwd only when the
     // search target is cwd-relative. With an absolute target, `!packages/app`
@@ -86,6 +92,8 @@ export async function listQuickOpenFiles(
       let buf = ''
       let done = false
       let parseablePathCount = 0
+      let processErrorObserved = false
+      let unavailableExitObserved = false
 
       const processLine = (rawLine: string): boolean => {
         const translated =
@@ -138,12 +146,27 @@ export async function listQuickOpenFiles(
         /* drain */
       }
       const handleError = (): void => {
+        processErrorObserved = true
         // Why: treat spawn errors like an abnormal exit — discard residual
         // buffer so a truncated final byte sequence cannot leak as a path.
         buf = ''
+        if (isRipgrepUnavailableExit(child, null, null)) {
+          finish(new RipgrepUnavailableError())
+          return
+        }
         finish(new Error('rg failed to start'))
       }
       const handleClose = (code: number | null, signal: NodeJS.Signals | null): void => {
+        if (
+          isRipgrepUnavailableExit(child, code, signal, {
+            classifyNativeLauncherExit: !wslDistroForOutput
+          })
+        ) {
+          unavailableExitObserved = true
+          buf = ''
+          finish(new RipgrepUnavailableError())
+          return
+        }
         if (signal) {
           // Why: a signal exit means timeout/OOM/external kill. Returning the
           // already-streamed prefix would recreate the false-empty bug this
@@ -179,6 +202,10 @@ export async function listQuickOpenFiles(
         child.stderr!.off('data', handleStderrData)
         child.off('error', handleError)
         child.off('close', handleClose)
+        absorbPendingRipgrepSpawnError(child, {
+          errorObserved: processErrorObserved,
+          unavailableExitObserved
+        })
         if (err) {
           reject(err)
         } else {
@@ -197,7 +224,7 @@ export async function listQuickOpenFiles(
         // Why: on timeout, the buffer is likely truncated mid-path. Discard
         // it so Quick Open never displays a malformed entry.
         buf = ''
-        child.kill()
+        killSpawnedRipgrepProcess(child)
         finish(new Error('rg list timed out'))
       }, 10000)
     })
@@ -213,7 +240,7 @@ export async function listQuickOpenFiles(
       }
       entry.finish()
       if (entry.child.exitCode === null && entry.child.signalCode === null) {
-        entry.child.kill()
+        killSpawnedRipgrepProcess(entry.child)
       }
     }
   }
@@ -225,24 +252,30 @@ export async function listQuickOpenFiles(
       }
       entry.finish()
       if (entry.child.exitCode === null && entry.child.signalCode === null) {
-        entry.child.kill()
+        killSpawnedRipgrepProcess(entry.child)
       }
     }
   }
-
   try {
+    const primaryRun = runRg(primary)
     if (maxResults === undefined) {
-      await Promise.all([runRg(primary), runRg(ignoredPass)])
+      // Why: a pid-less primary proves launch failure; avoid doubling the failed spawn.
+      await (children[0]?.child.pid === undefined
+        ? primaryRun
+        : Promise.all([primaryRun, runRg(ignoredPass)]))
     } else {
       // Why: ignored-file output can be much larger and faster than the primary
       // pass; let source files claim the bounded autocomplete budget first.
-      await runRg(primary)
+      await primaryRun
       if (files.size < maxResults) {
         await runRg(ignoredPass)
       }
     }
   } catch (err) {
     killSurvivors()
+    if (err instanceof RipgrepUnavailableError) {
+      return listWithoutRipgrep()
+    }
     throw err
   }
   return Array.from(files).slice(0, maxResults)
diff --git a/src/main/ipc/filesystem-search-git.test.ts b/src/main/ipc/filesystem-search-git.test.ts
index e6d29acb3cd..ae73b0aa2e2 100644
--- a/src/main/ipc/filesystem-search-git.test.ts
+++ b/src/main/ipc/filesystem-search-git.test.ts
@@ -184,6 +184,9 @@ describe('filesystem-search-git', () => {
 
       const promise = searchWithGitGrep('/mock/root', { query: 'ok', rootPath: '/mock/root' }, 100)
 
+      await vi.waitFor(() =>
+        expect((proc.stdout as unknown as EventEmitter).listenerCount('data')).toBeGreaterThan(0)
+      )
       ;(proc.stdout as unknown as EventEmitter).emit('data', 'valid.ts\x001\x00ok\npartial')
 
       await vi.runOnlyPendingTimersAsync()
diff --git a/src/main/ipc/filesystem-search-git.ts b/src/main/ipc/filesystem-search-git.ts
index 065dbd11dad..e997ddd2e02 100644
--- a/src/main/ipc/filesystem-search-git.ts
+++ b/src/main/ipc/filesystem-search-git.ts
@@ -7,7 +7,11 @@ import {
   ingestGitGrepLine,
   SEARCH_TIMEOUT_MS
 } from '../../shared/text-search'
-import { gitSpawn } from '../git/runner'
+import { gitSpawnAfterWindowsEnvironmentReady } from '../git/runner'
+import {
+  isWslLinkedWorktreeGitRoutingCandidate,
+  prepareWslLinkedWorktreeGitRouting
+} from '../git/wsl-linked-worktree-git-routing'
 
 /**
  * Fallback text search using git grep. Used when rg is not available.
@@ -16,24 +20,27 @@ import { gitSpawn } from '../git/runner'
  * is launched from a desktop entry (which inherits a minimal system PATH).
  * git grep is always available since this is a git-focused app.
  */
-export function searchWithGitGrep(
+export async function searchWithGitGrep(
   rootPath: string,
   args: SearchOptions,
   maxResults: number,
   localGitOptions: { wslDistro?: string } = {}
 ): Promise<SearchResult> {
+  if (isWslLinkedWorktreeGitRoutingCandidate(rootPath, localGitOptions.wslDistro)) {
+    await prepareWslLinkedWorktreeGitRouting(rootPath, localGitOptions.wslDistro)
+  }
+  const gitArgs = buildGitGrepArgs(args.query, args)
+  const child = await gitSpawnAfterWindowsEnvironmentReady(gitArgs, {
+    cwd: rootPath,
+    ...(localGitOptions.wslDistro ? { wslDistro: localGitOptions.wslDistro } : {}),
+    stdio: ['ignore', 'pipe', 'pipe']
+  })
   return new Promise((resolve) => {
-    const gitArgs = buildGitGrepArgs(args.query, args)
     const matchRegex = buildSubmatchRegex(args.query, args)
     const acc = createAccumulator()
     let stdoutBuffer = ''
     let done = false
 
-    const child = gitSpawn(gitArgs, {
-      cwd: rootPath,
-      ...(localGitOptions.wslDistro ? { wslDistro: localGitOptions.wslDistro } : {}),
-      stdio: ['ignore', 'pipe', 'pipe']
-    })
     let killTimeout: ReturnType<typeof setTimeout>
 
     function resolveOnce(): void {
diff --git a/src/main/ipc/filesystem-search-rg-timeout.test.ts b/src/main/ipc/filesystem-search-rg-timeout.test.ts
index 8d9881b2261..6c677c73d6d 100644
--- a/src/main/ipc/filesystem-search-rg-timeout.test.ts
+++ b/src/main/ipc/filesystem-search-rg-timeout.test.ts
@@ -7,6 +7,7 @@ const {
   resolveAuthorizedPathMock,
   checkRgAvailableMock,
   getLocalGitOptionsForRegisteredWorktreeMock,
+  searchWithGitGrepMock,
   wslAwareSpawnMock,
   toWindowsWslPathMock
 } = vi.hoisted(() => ({
@@ -14,11 +15,12 @@ const {
   resolveAuthorizedPathMock: vi.fn(),
   checkRgAvailableMock: vi.fn(),
   getLocalGitOptionsForRegisteredWorktreeMock: vi.fn(),
+  searchWithGitGrepMock: vi.fn(),
   wslAwareSpawnMock: vi.fn(),
   toWindowsWslPathMock: vi.fn((value: string) => value)
 }))
 
-const handlers = new Map<string, (event: unknown, args: unknown) => Promise<unknown> | unknown>()
+const handlers = new Map<string, (event: unknown, args: unknown) => unknown>()
 
 vi.mock('electron', () => ({
   ipcMain: {
@@ -56,7 +58,7 @@ vi.mock('./filesystem-mutations', () => ({
 }))
 
 vi.mock('./filesystem-search-git', () => ({
-  searchWithGitGrep: vi.fn()
+  searchWithGitGrep: searchWithGitGrepMock
 }))
 
 vi.mock('./local-worktree-runtime-options', () => ({
@@ -87,6 +89,12 @@ function createMockProcess(): ChildProcess {
   return p
 }
 
+async function flushMicrotasks(): Promise<void> {
+  for (let index = 0; index < 8; index++) {
+    await Promise.resolve()
+  }
+}
+
 describe('filesystem rg search timeout', () => {
   beforeEach(() => {
     handlers.clear()
@@ -120,6 +128,7 @@ describe('filesystem rg search timeout', () => {
 
       const result = await promise
       expect(result.truncated).toBe(true)
+      expect(checkRgAvailableMock).not.toHaveBeenCalled()
       expect(child.kill).toHaveBeenCalled()
       expect((child.stdout as unknown as EventEmitter).listenerCount('data')).toBe(0)
       expect((child.stderr as unknown as EventEmitter).listenerCount('data')).toBe(0)
@@ -130,8 +139,77 @@ describe('filesystem rg search timeout', () => {
     }
   })
 
+  it.each(['error-first', 'close-first'] as const)(
+    'falls back once when a native launch failure is %s',
+    async (order) => {
+      const child = createMockProcess()
+      Object.defineProperty(child, 'pid', { value: undefined })
+      wslAwareSpawnMock.mockReturnValue(child)
+      const fallback = { files: [], totalMatches: 0, truncated: false }
+      searchWithGitGrepMock.mockResolvedValue(fallback)
+      registerFilesystemHandlers({} as never)
+
+      const promise = handlers.get('fs:search')!(
+        { sender: { id: 7 } },
+        { rootPath: '/repo', query: 'ok' }
+      ) as Promise<unknown>
+      await flushMicrotasks()
+      const error = Object.assign(new Error('spawn rg ENOENT'), { code: 'ENOENT' })
+      if (order === 'error-first') {
+        expect(() => child.emit('error', error)).not.toThrow()
+        child.emit('close', -2, null)
+      } else {
+        child.emit('close', -2, null)
+        expect(() => child.emit('error', error)).not.toThrow()
+      }
+
+      await expect(promise).resolves.toBe(fallback)
+      expect(searchWithGitGrepMock).toHaveBeenCalledTimes(1)
+      expect(checkRgAvailableMock).not.toHaveBeenCalled()
+      expect(child.listenerCount('error')).toBe(0)
+      expect(child.listenerCount('close')).toBe(0)
+    }
+  )
+
+  it('keeps post-spawn errors on the existing empty-result path', async () => {
+    const child = createMockProcess()
+    Object.defineProperty(child, 'pid', { value: 1 })
+    wslAwareSpawnMock.mockReturnValue(child)
+    registerFilesystemHandlers({} as never)
+
+    const promise = handlers.get('fs:search')!(
+      { sender: { id: 7 } },
+      { rootPath: '/repo', query: 'ok' }
+    ) as Promise<{ files: unknown[] }>
+    await flushMicrotasks()
+    child.emit('error', new Error('post-spawn failure'))
+
+    await expect(promise).resolves.toMatchObject({ files: [] })
+    expect(searchWithGitGrepMock).not.toHaveBeenCalled()
+  })
+
+  it("falls back when a native launcher exits outside ripgrep's contract", async () => {
+    const child = createMockProcess()
+    Object.defineProperty(child, 'pid', { value: 1 })
+    wslAwareSpawnMock.mockReturnValue(child)
+    const fallback = { files: [], totalMatches: 0, truncated: false }
+    searchWithGitGrepMock.mockResolvedValue(fallback)
+    registerFilesystemHandlers({} as never)
+
+    const promise = handlers.get('fs:search')!(
+      { sender: { id: 7 } },
+      { rootPath: '/repo', query: 'ok' }
+    ) as Promise<unknown>
+    await flushMicrotasks()
+    child.emit('close', 127, null)
+
+    await expect(promise).resolves.toBe(fallback)
+    expect(searchWithGitGrepMock).toHaveBeenCalledTimes(1)
+  })
+
   it('routes rg through the registered WSL project runtime for Windows-path worktrees', async () => {
     const child = createMockProcess()
+    Object.defineProperty(child, 'pid', { value: 1 })
     wslAwareSpawnMock.mockReturnValue(child)
     getLocalGitOptionsForRegisteredWorktreeMock.mockReturnValue({ wslDistro: 'Ubuntu' })
     registerFilesystemHandlers({} as never)
@@ -142,12 +220,13 @@ describe('filesystem rg search timeout', () => {
     ) as Promise<unknown>
 
     setTimeout(() => {
-      child.emit('close')
+      child.emit('close', 127, null)
     }, 10)
 
     await promise
 
     expect(checkRgAvailableMock).toHaveBeenCalledWith('C:\\repo', 'Ubuntu')
+    expect(searchWithGitGrepMock).not.toHaveBeenCalled()
     expect(wslAwareSpawnMock).toHaveBeenCalledWith(
       'rg',
       expect.any(Array),
@@ -158,6 +237,23 @@ describe('filesystem rg search timeout', () => {
     )
   })
 
+  it('keeps the WSL search preflight and falls back before starting real rg', async () => {
+    const fallback = { files: [], totalMatches: 0, truncated: false }
+    getLocalGitOptionsForRegisteredWorktreeMock.mockReturnValue({ wslDistro: 'Ubuntu' })
+    checkRgAvailableMock.mockResolvedValue(false)
+    searchWithGitGrepMock.mockResolvedValue(fallback)
+    registerFilesystemHandlers({} as never)
+
+    const promise = handlers.get('fs:search')!(
+      { sender: { id: 7 } },
+      { rootPath: 'C:\\repo', query: 'ok' }
+    ) as Promise<unknown>
+
+    await expect(promise).resolves.toBe(fallback)
+    expect(checkRgAvailableMock).toHaveBeenCalledWith('C:\\repo', 'Ubuntu')
+    expect(wslAwareSpawnMock).not.toHaveBeenCalled()
+  })
+
   it('translates WSL rg output for Windows-path project search results', async () => {
     const child = createMockProcess()
     wslAwareSpawnMock.mockReturnValue(child)
diff --git a/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts b/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts
index f557ebca379..7d27d4ca780 100644
--- a/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts
+++ b/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts
@@ -22,7 +22,7 @@ vi.mock('../providers/ssh-filesystem-dispatch', () => ({
 
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 const WORKTREE_PATH = '/home/me/repo'
 const ARGS = { worktreePath: WORKTREE_PATH, connectionId: 'conn-1' }
diff --git a/src/main/ipc/filesystem-watcher-large-batch.test.ts b/src/main/ipc/filesystem-watcher-large-batch.test.ts
index 80d45c90e43..e605cd6167c 100644
--- a/src/main/ipc/filesystem-watcher-large-batch.test.ts
+++ b/src/main/ipc/filesystem-watcher-large-batch.test.ts
@@ -38,7 +38,7 @@ import {
   WATCH_BATCH_TRAILING_MS
 } from '../../shared/filesystem-watch-batch-window'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 describe('local filesystem watcher large batches', () => {
   const handlers: HandlerMap = {}
diff --git a/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts b/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts
index 0e15ad43fc7..eb161c1ba30 100644
--- a/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts
+++ b/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts
@@ -47,7 +47,7 @@ import { subscribe as subscribeParcelWatcher } from '@parcel/watcher'
 import { subscribeViaWatcherProcess } from './parcel-watcher-process'
 import { WatcherProcessFailure } from './parcel-watcher-process-failure'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 describe('local filesystem watcher unsubscribe cleanup', () => {
   const handlers: HandlerMap = {}
diff --git a/src/main/ipc/filesystem-watcher-native-capacity.test.ts b/src/main/ipc/filesystem-watcher-native-capacity.test.ts
index 41db2d35e52..670b7eb2af3 100644
--- a/src/main/ipc/filesystem-watcher-native-capacity.test.ts
+++ b/src/main/ipc/filesystem-watcher-native-capacity.test.ts
@@ -28,7 +28,7 @@ import {
   WatcherChildCapacityError
 } from './parcel-watcher-child-registry'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 function fillWatcherChildCapacity(): (() => void)[] {
   return Array.from({ length: MAX_PHYSICAL_WATCHER_CHILDREN }, () => {
diff --git a/src/main/ipc/filesystem-watcher-real.test.ts b/src/main/ipc/filesystem-watcher-real.test.ts
index 34f2bcc91e1..a813be69e28 100644
--- a/src/main/ipc/filesystem-watcher-real.test.ts
+++ b/src/main/ipc/filesystem-watcher-real.test.ts
@@ -26,7 +26,7 @@ vi.mock('electron', () => ({
 
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 type FsChangedCall = { worktreePath: string; events: { kind: string; absolutePath: string }[] }
 
diff --git a/src/main/ipc/filesystem-watcher-remote-batch.test.ts b/src/main/ipc/filesystem-watcher-remote-batch.test.ts
index 6d964c2b2d4..8666a40c906 100644
--- a/src/main/ipc/filesystem-watcher-remote-batch.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-batch.test.ts
@@ -23,7 +23,7 @@ vi.mock('../providers/ssh-filesystem-dispatch', () => ({
 
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 type WatchCallback = (events: FsChangeEvent[]) => void
 
 const WORKTREE_PATH = '/home/me/repo'
diff --git a/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts b/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts
index 6a67f3a8fb7..60e25db9040 100644
--- a/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts
@@ -19,7 +19,7 @@ vi.mock('../providers/ssh-filesystem-dispatch', () => ({
 
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 describe('remote filesystem watcher cancellation', () => {
   const handlers: HandlerMap = {}
diff --git a/src/main/ipc/filesystem-watcher-remote-rearm.test.ts b/src/main/ipc/filesystem-watcher-remote-rearm.test.ts
index 869c8bebf45..0eecfbd82e9 100644
--- a/src/main/ipc/filesystem-watcher-remote-rearm.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-rearm.test.ts
@@ -29,7 +29,7 @@ vi.mock('../providers/ssh-filesystem-dispatch', () => ({
 
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 describe('remote filesystem watcher re-arm', () => {
   const handlers: HandlerMap = {}
diff --git a/src/main/ipc/filesystem-watcher-removal-deadline.test.ts b/src/main/ipc/filesystem-watcher-removal-deadline.test.ts
index 52a48e9a06d..9eabdb8964e 100644
--- a/src/main/ipc/filesystem-watcher-removal-deadline.test.ts
+++ b/src/main/ipc/filesystem-watcher-removal-deadline.test.ts
@@ -52,7 +52,7 @@ import { stat } from 'node:fs/promises'
 import { subscribe as subscribeParcelWatcher } from '@parcel/watcher'
 import { subscribeViaWatcherProcess } from './parcel-watcher-process'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 describe('local filesystem watcher removal deadline', () => {
   const handlers: HandlerMap = {}
diff --git a/src/main/ipc/filesystem-watcher-terminal-resync.test.ts b/src/main/ipc/filesystem-watcher-terminal-resync.test.ts
index 8a08c5f07d5..31e87d7a4c9 100644
--- a/src/main/ipc/filesystem-watcher-terminal-resync.test.ts
+++ b/src/main/ipc/filesystem-watcher-terminal-resync.test.ts
@@ -28,7 +28,7 @@ import {
   restoreRemoteWatcherAfterFailedRemoval
 } from './filesystem-watcher'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 type TerminalErrorHandler = (error: Error) => void
 
 const WORKTREE_PATH = '/home/me/repo'
diff --git a/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts b/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts
index d629d74dc02..3473caa8a73 100644
--- a/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts
+++ b/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts
@@ -30,7 +30,7 @@ vi.mock('../providers/ssh-filesystem-dispatch', () => ({
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 import { stat } from 'node:fs/promises'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 describe('filesystem watcher unwatchable root cache', () => {
   const handlers: HandlerMap = {}
diff --git a/src/main/ipc/filesystem-watcher.test.ts b/src/main/ipc/filesystem-watcher.test.ts
index 1e9e3cf509a..6fff613e0d9 100644
--- a/src/main/ipc/filesystem-watcher.test.ts
+++ b/src/main/ipc/filesystem-watcher.test.ts
@@ -60,7 +60,7 @@ import {
 import { acquireWatcherRemovalGate } from './watcher-removal-gate'
 import { WATCH_BATCH_TRAILING_MS } from '../../shared/filesystem-watch-batch-window'
 
-type HandlerMap = Record<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>
+type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
 /** Remote fs:changed rides the shared debounce window, so drain it before asserting sends. */
 const emitRemote = async (onEvents: (e: unknown[]) => void, events: unknown[]) => {
diff --git a/src/main/ipc/filesystem.test.ts b/src/main/ipc/filesystem.test.ts
index ad68010cbb7..f96667751d2 100644
--- a/src/main/ipc/filesystem.test.ts
+++ b/src/main/ipc/filesystem.test.ts
@@ -3,7 +3,7 @@ import path from 'node:path'
 import { EventEmitter } from 'node:events'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const handlers = new Map<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>()
+const handlers = new Map<string, (_event: unknown, args: unknown) => unknown>()
 const {
   handleMock,
   showSaveDialogMock,
@@ -3098,6 +3098,42 @@ describe('registerFilesystemHandlers', () => {
     )
   })
 
+  it('forwards the pinned head through SSH branch diff queries', async () => {
+    const result = {
+      kind: 'text',
+      originalContent: 'left',
+      modifiedContent: 'right',
+      originalIsBinary: false,
+      modifiedIsBinary: false
+    }
+    const getBranchDiff = vi.fn().mockResolvedValue([result])
+    getSshGitProviderMock.mockReturnValue({ getBranchDiff })
+
+    registerFilesystemHandlers(store as never)
+
+    await expect(
+      handlers.get('git:branchDiff')!(null, {
+        worktreePath: '/home/user/project',
+        compare: {
+          baseRef: 'origin/main',
+          baseOid: 'base-oid',
+          headOid: 'head-oid',
+          mergeBase: 'merge-base-oid'
+        },
+        filePath: 'src/file.ts',
+        oldPath: 'src/old-file.ts',
+        connectionId: 'conn-1'
+      })
+    ).resolves.toEqual(result)
+
+    expect(getBranchDiff).toHaveBeenCalledWith('/home/user/project', 'merge-base-oid', {
+      includePatch: true,
+      headOid: 'head-oid',
+      filePath: 'src/file.ts',
+      oldPath: 'src/old-file.ts'
+    })
+  })
+
   // Why: the original SSH Quick Open bug had two halves — relay-side policy
   // drift AND the main dispatcher silently dropping excludePaths before the
   // provider saw them. This test guards the second half: regardless of
diff --git a/src/main/ipc/filesystem.ts b/src/main/ipc/filesystem.ts
index 4ca9547b77c..40701203e06 100644
--- a/src/main/ipc/filesystem.ts
+++ b/src/main/ipc/filesystem.ts
@@ -5,7 +5,7 @@ import type { FileHandle } from 'node:fs/promises'
 import { randomUUID } from 'node:crypto'
 import { dirname, extname, join, resolve } from 'node:path'
 import type { ChildProcess } from 'node:child_process'
-import { gitExecFileAsync, wslAwareSpawn } from '../git/runner'
+import { awaitWindowsHostGitEnvironmentReady, gitExecFileAsync, wslAwareSpawn } from '../git/runner'
 import { parseWslPath, toWindowsWslPath } from '../wsl'
 import { tryDeleteWslUncPath } from '../wsl-unc-delete'
 import type { Store } from '../persistence'
@@ -112,6 +112,11 @@ import {
 } from './source-control-ai-linked-issue'
 import { listMarkdownDocuments, markdownDocumentsFromRelativePaths } from './markdown-documents'
 import { checkRgAvailable } from './rg-availability'
+import {
+  absorbPendingRipgrepSpawnError,
+  isRipgrepUnavailableExit,
+  killSpawnedRipgrepProcess
+} from '../../shared/ripgrep-process-availability'
 import {
   getSshFilesystemProvider,
   requireSshFilesystemProvider
@@ -980,32 +985,35 @@ export function registerFilesystemHandlers(
         Math.min(args.maxResults ?? DEFAULT_SEARCH_MAX_RESULTS, DEFAULT_SEARCH_MAX_RESULTS)
       )
       const searchKey = `${event.sender.id}:${rootPath}`
+      // Why: WSL's bash exit 127 is ambiguous with a real executable returning 127.
+      const wslDistroForOutput = parseWslPath(rootPath)?.distro ?? localGitOptions.wslDistro
 
-      // Why: probe rg upfront; on some platforms spawn emits 'close' before 'error', resolving empty before the git-grep fallback runs.
-      const rgAvailable = await checkRgAvailable(rootPath, localGitOptions.wslDistro)
-      if (!rgAvailable) {
+      if (wslDistroForOutput && !(await checkRgAvailable(rootPath, localGitOptions.wslDistro))) {
         return searchWithGitGrep(rootPath, args, maxResults, localGitOptions)
       }
 
-      return new Promise((resolvePromise) => {
+      return new Promise<SearchResult>((resolvePromise) => {
         const rgArgs = buildRgArgs(args.query, rootPath, args)
 
         // Why: kill the prior rg so it stops parsing thousands of matches on the main thread (the large-repo freeze) after the UI moved on.
-        activeTextSearches.get(searchKey)?.kill()
+        const previousChild = activeTextSearches.get(searchKey)
+        if (previousChild) {
+          killSpawnedRipgrepProcess(previousChild)
+        }
 
         const acc = createAccumulator()
         let stdoutBuffer = ''
         let resolved = false
+        let processErrorObserved = false
+        let unavailableExitObserved = false
         let child: ChildProcess | null = null
         let killTimeout: ReturnType<typeof setTimeout>
 
-        // Why: WSL-routed rg emits Linux paths; UNC repos carry the distro in the path, Windows-path repos in project runtime.
-        const wslDistroForOutput = parseWslPath(rootPath)?.distro ?? localGitOptions.wslDistro
         const transformAbsPath = wslDistroForOutput
           ? (p: string): string => (p.startsWith('/') ? toWindowsWslPath(p, wslDistroForOutput) : p)
           : undefined
 
-        const resolveOnce = (): void => {
+        const finish = (result: SearchResult | PromiseLike<SearchResult>): void => {
           if (resolved) {
             return
           }
@@ -1019,13 +1027,22 @@ export function registerFilesystemHandlers(
           child?.stderr?.off('data', handleStderrData)
           child?.off('error', handleError)
           child?.off('close', handleClose)
-          resolvePromise(finalize(acc))
+          if (child) {
+            absorbPendingRipgrepSpawnError(child, {
+              errorObserved: processErrorObserved,
+              unavailableExitObserved
+            })
+          }
+          resolvePromise(result)
         }
+        const resolveOnce = (): void => finish(finalize(acc))
+        const resolveWithoutRipgrep = (): void =>
+          finish(searchWithGitGrep(rootPath, args, maxResults, localGitOptions))
 
         const processLine = (line: string): void => {
           const verdict = ingestRgJsonLine(line, rootPath, acc, maxResults, transformAbsPath)
-          if (verdict === 'stop') {
-            child?.kill()
+          if (verdict === 'stop' && child) {
+            killSpawnedRipgrepProcess(child)
           }
         }
 
@@ -1049,9 +1066,24 @@ export function registerFilesystemHandlers(
           // Drain stderr so rg cannot block on a full pipe.
         }
         const handleError = (): void => {
+          processErrorObserved = true
+          if (child && isRipgrepUnavailableExit(child, null, null)) {
+            resolveWithoutRipgrep()
+            return
+          }
           resolveOnce()
         }
-        const handleClose = (): void => {
+        const handleClose = (code: number | null, signal: NodeJS.Signals | null): void => {
+          if (
+            child &&
+            isRipgrepUnavailableExit(child, code, signal, {
+              classifyNativeLauncherExit: !wslDistroForOutput
+            })
+          ) {
+            unavailableExitObserved = true
+            resolveWithoutRipgrep()
+            return
+          }
           if (stdoutBuffer) {
             processLine(stdoutBuffer)
           }
@@ -1067,7 +1099,9 @@ export function registerFilesystemHandlers(
         // Why: timeout kills the child mid-scan; mark truncated so the UI shows incomplete results.
         killTimeout = setTimeout(() => {
           acc.truncated = true
-          child?.kill()
+          if (child) {
+            killSpawnedRipgrepProcess(child)
+          }
           resolveOnce()
         }, SEARCH_TIMEOUT_MS)
       })
@@ -2042,6 +2076,7 @@ export function registerFilesystemHandlers(
         }
         const results = await provider.getBranchDiff(args.worktreePath, args.compare.mergeBase, {
           includePatch: true,
+          headOid: args.compare.headOid,
           filePath: args.filePath,
           oldPath: args.oldPath
         })
@@ -2287,6 +2322,7 @@ export function registerFilesystemHandlers(
         return provider.getRemoteFileUrl(args.worktreePath, args.relativePath, args.line)
       }
       const worktreePath = await resolveRegisteredWorktreePath(args.worktreePath, store)
+      await awaitWindowsHostGitEnvironmentReady({ cwd: worktreePath })
       return getRemoteFileUrl(worktreePath, args.relativePath, args.line)
     }
   )
@@ -2307,6 +2343,7 @@ export function registerFilesystemHandlers(
         return provider.getRemoteCommitUrl(args.worktreePath, sha)
       }
       const worktreePath = await resolveRegisteredWorktreePath(args.worktreePath, store)
+      await awaitWindowsHostGitEnvironmentReady({ cwd: worktreePath })
       return getRemoteCommitUrl(worktreePath, sha)
     }
   )
diff --git a/src/main/ipc/hosted-review.test.ts b/src/main/ipc/hosted-review.test.ts
index cef5d7f1d66..0399446e462 100644
--- a/src/main/ipc/hosted-review.test.ts
+++ b/src/main/ipc/hosted-review.test.ts
@@ -13,6 +13,7 @@ function setPlatform(platform: NodeJS.Platform): void {
 const {
   handleMock,
   createHostedReviewMock,
+  createStackedHostedReviewMock,
   getHostedReviewCreationEligibilityMock,
   getHostedReviewForBranchMock,
   resolveRegisteredWorktreePathMock,
@@ -20,6 +21,7 @@ const {
 } = vi.hoisted(() => ({
   handleMock: vi.fn(),
   createHostedReviewMock: vi.fn(),
+  createStackedHostedReviewMock: vi.fn(),
   getHostedReviewCreationEligibilityMock: vi.fn(),
   getHostedReviewForBranchMock: vi.fn(),
   resolveRegisteredWorktreePathMock: vi.fn(),
@@ -37,6 +39,10 @@ vi.mock('../source-control/hosted-review-creation', () => ({
   getHostedReviewCreationEligibility: getHostedReviewCreationEligibilityMock
 }))
 
+vi.mock('../source-control/stacked-hosted-review-creation', () => ({
+  createStackedHostedReview: createStackedHostedReviewMock
+}))
+
 vi.mock('../source-control/hosted-review', () => ({
   getHostedReviewForBranch: getHostedReviewForBranchMock
 }))
@@ -87,6 +93,7 @@ describe('registerHostedReviewHandlers', () => {
     setPlatform(ORIGINAL_PLATFORM)
     handleMock.mockReset()
     createHostedReviewMock.mockReset()
+    createStackedHostedReviewMock.mockReset()
     getHostedReviewCreationEligibilityMock.mockReset()
     getHostedReviewForBranchMock.mockReset()
     resolveRegisteredWorktreePathMock.mockReset()
@@ -384,6 +391,35 @@ describe('registerHostedReviewHandlers', () => {
     )
   })
 
+  it('routes stacked creation through its dedicated SSH-safe handler', async () => {
+    createStackedHostedReviewMock.mockResolvedValueOnce({
+      ok: true,
+      number: 43,
+      url: 'https://github.com/acme/orca/pull/43',
+      stackNumber: 50,
+      parentReview: { number: 42, url: 'https://github.com/acme/orca/pull/42' }
+    })
+    registerHostedReviewHandlers(store as never, stats as never)
+
+    await handlers['hostedReview:createStacked'](null, {
+      repoPath,
+      repoId: repo.id,
+      worktreePath,
+      provider: 'github',
+      base: 'stack/parent',
+      head: 'stack/child',
+      title: 'Child'
+    })
+
+    expect(createStackedHostedReviewMock).toHaveBeenCalledWith(
+      worktreePath,
+      expect.objectContaining({ base: 'stack/parent', head: 'stack/child' }),
+      'ssh-1',
+      {}
+    )
+    expect(createHostedReviewMock).not.toHaveBeenCalled()
+  })
+
   it('rejects creation when repoId and repoPath point at different registered repos', async () => {
     store.getRepo.mockImplementation((repoId: string) =>
       repoId === repo.id ? { ...repo, path: '/other/repo' } : null
diff --git a/src/main/ipc/hosted-review.ts b/src/main/ipc/hosted-review.ts
index 670064d3e54..736668e1f0d 100644
--- a/src/main/ipc/hosted-review.ts
+++ b/src/main/ipc/hosted-review.ts
@@ -2,6 +2,7 @@ import { ipcMain } from 'electron'
 import { posix, resolve } from 'node:path'
 import type {
   CreateHostedReviewArgs,
+  CreateStackedHostedReviewArgs,
   HostedReviewCreationEligibilityArgs,
   HostedReviewForBranchArgs
 } from '../../shared/hosted-review'
@@ -12,6 +13,7 @@ import {
   createHostedReview,
   getHostedReviewCreationEligibility
 } from '../source-control/hosted-review-creation'
+import { createStackedHostedReview } from '../source-control/stacked-hosted-review-creation'
 import { getHostedReviewForBranch } from '../source-control/hosted-review'
 import { resolveRegisteredWorktreePath } from './filesystem-auth'
 import { listRepoWorktrees } from '../repo-worktrees'
@@ -160,4 +162,44 @@ export function registerHostedReviewHandlers(store: Store, stats: StatsCollector
     }
     return result
   })
+
+  ipcMain.handle(
+    'hostedReview:createStacked',
+    async (_event, args: CreateStackedHostedReviewArgs) => {
+      const repo = assertRegisteredRepo(args.repoPath, store, args.repoId)
+      const worktreePath = await resolveHostedReviewWorktreePath(repo, store, args.worktreePath)
+      const localGitOptions = getLocalProjectWorktreeGitOptions(store, repo)
+      const sharedLinkPaths = repo.connectionId ? [] : getWorktreeSharedLinkPaths(repo)
+      const executionOptions = {
+        ...(Object.keys(localGitOptions).length > 0
+          ? { localGitExecOptions: localGitOptions }
+          : {}),
+        ...(sharedLinkPaths.length > 0 ? { sharedLinkPaths } : {})
+      }
+      const input = {
+        provider: args.provider,
+        base: args.base,
+        head: args.head,
+        title: args.title,
+        body: args.body,
+        draft: args.draft,
+        ...(args.useTemplate !== undefined ? { useTemplate: args.useTemplate } : {})
+      }
+      const result = await createStackedHostedReview(
+        worktreePath,
+        input,
+        repo.connectionId ?? null,
+        executionOptions
+      )
+      if (result.ok && !stats.hasCountedPR(result.url)) {
+        stats.record({
+          type: 'pr_created',
+          at: Date.now(),
+          repoId: repo.id,
+          meta: { prNumber: result.number, prUrl: result.url }
+        })
+      }
+      return result
+    }
+  )
 }
diff --git a/src/main/ipc/notebook.test.ts b/src/main/ipc/notebook.test.ts
index d68668038bd..cdffcb8b913 100644
--- a/src/main/ipc/notebook.test.ts
+++ b/src/main/ipc/notebook.test.ts
@@ -2,7 +2,7 @@ import { EventEmitter } from 'node:events'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { ChildProcessWithoutNullStreams } from 'node:child_process'
 
-const handlers = new Map<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>()
+const handlers = new Map<string, (_event: unknown, args: unknown) => unknown>()
 const { spawnMock, handleMock, resolveAuthorizedPathMock } = vi.hoisted(() => ({
   spawnMock: vi.fn(),
   handleMock: vi.fn((channel: string, handler: (event: unknown, args: unknown) => unknown) => {
diff --git a/src/main/ipc/notifications.test.ts b/src/main/ipc/notifications.test.ts
index d7930066ad7..b7cb9dd5a7b 100644
--- a/src/main/ipc/notifications.test.ts
+++ b/src/main/ipc/notifications.test.ts
@@ -15,6 +15,7 @@ const {
   notificationCtorMock,
   notificationIsSupportedMock,
   getAllWindowsMock,
+  getTrustedUIRendererWindowMock,
   shellOpenExternalMock
 } = vi.hoisted(() => {
   const removeHandlerMock = vi.fn()
@@ -35,6 +36,7 @@ const {
   })
   const notificationIsSupportedMock = vi.fn(() => true)
   const getAllWindowsMock = vi.fn(() => [])
+  const getTrustedUIRendererWindowMock = vi.fn()
   const shellOpenExternalMock = vi.fn()
   return {
     removeHandlerMock,
@@ -47,6 +49,7 @@ const {
     notificationCtorMock,
     notificationIsSupportedMock,
     getAllWindowsMock,
+    getTrustedUIRendererWindowMock,
     shellOpenExternalMock
   }
 })
@@ -81,6 +84,10 @@ vi.mock('./notification-authorization-status', () => ({
   readNotificationAuthorizationStatus: readAuthorizationStatusMock
 }))
 
+vi.mock('./ui', () => ({
+  getTrustedUIRendererWindow: getTrustedUIRendererWindowMock
+}))
+
 // Why: notifications.ts pulls in the tray module (for the minimized attention
 // dot), which transitively loads app-icon/electron-toolkit; stub it so this
 // suite stays focused on notification dispatch and avoids that import chain.
@@ -121,6 +128,8 @@ describe('registerNotificationHandlers', () => {
     readAuthorizationStatusMock.mockResolvedValue(null)
     getAllWindowsMock.mockReset()
     getAllWindowsMock.mockReturnValue([])
+    getTrustedUIRendererWindowMock.mockReset()
+    getTrustedUIRendererWindowMock.mockReturnValue(null)
     shellOpenExternalMock.mockClear()
     setTrayAttentionMock.mockClear()
   })
@@ -452,20 +461,32 @@ describe('registerNotificationHandlers', () => {
     }
   })
 
-  it('focuses the originating terminal pane when a notification with paneKey is clicked', async () => {
+  it('focuses the originating terminal pane in the main window when a dashboard popout is open', async () => {
+    const popoutSend = vi.fn()
+    const popoutFocus = vi.fn()
     const webContentsSend = vi.fn()
     const restore = vi.fn()
+    const show = vi.fn()
     const focus = vi.fn()
-    getAllWindowsMock.mockReturnValue([
-      {
-        isDestroyed: () => false,
-        isFocused: () => false,
-        isMinimized: () => true,
-        restore,
-        focus,
-        webContents: { send: webContentsSend }
-      } as never
-    ])
+    const popoutWindow = {
+      isDestroyed: () => false,
+      isFocused: () => true,
+      isMinimized: () => false,
+      restore: vi.fn(),
+      focus: popoutFocus,
+      webContents: { send: popoutSend }
+    }
+    const mainWindow = {
+      isDestroyed: () => false,
+      isFocused: () => false,
+      isMinimized: () => true,
+      restore,
+      show,
+      focus,
+      webContents: { send: webContentsSend }
+    }
+    getAllWindowsMock.mockReturnValue([popoutWindow, mainWindow] as never)
+    getTrustedUIRendererWindowMock.mockReturnValue(mainWindow)
     registerNotificationHandlers({
       getSettings: () => ({
         notifications: {
@@ -486,8 +507,12 @@ describe('registerNotificationHandlers', () => {
 
     getNotificationEventHandler('click')()
 
+    expect(getTrustedUIRendererWindowMock).toHaveBeenCalledTimes(1)
     expect(restore).toHaveBeenCalledTimes(1)
+    expect(show).toHaveBeenCalledTimes(1)
     expect(focus).toHaveBeenCalledTimes(1)
+    expect(popoutFocus).not.toHaveBeenCalled()
+    expect(popoutSend).not.toHaveBeenCalled()
     expect(vi.getTimerCount()).toBe(0)
     expect(notificationRemoveListenerMock).toHaveBeenCalledWith('click', expect.any(Function))
     expect(webContentsSend).toHaveBeenCalledWith('ui:activateWorktree', {
diff --git a/src/main/ipc/notifications.ts b/src/main/ipc/notifications.ts
index 95e9e3e3a47..7418396a199 100644
--- a/src/main/ipc/notifications.ts
+++ b/src/main/ipc/notifications.ts
@@ -28,6 +28,7 @@ import { readNotificationAuthorizationStatus } from './notification-authorizatio
 import { parsePaneKey } from '../../shared/stable-pane-id'
 import { setTrayAttention } from '../tray/system-tray'
 import { isMainWindowVisible } from '../window/main-window-visibility'
+import { getTrustedUIRendererWindow } from './ui'
 
 const NOTIFICATION_COOLDOWN_MS = 5000
 const MAX_RECENT_NOTIFICATION_KEYS = 50
@@ -512,8 +513,8 @@ export function registerNotificationHandlers(store: Store, runtime?: OrcaRuntime
           const repoId = getRepoIdFromWorktreeId(args.worktreeId)
           clickHandler = () => {
             release()
-            const win = BrowserWindow.getAllWindows().find((w) => !w.isDestroyed())
-            if (!win) {
+            const win = getTrustedUIRendererWindow()
+            if (!win || win.isDestroyed()) {
               return
             }
             if (process.platform === 'darwin') {
@@ -522,6 +523,7 @@ export function registerNotificationHandlers(store: Store, runtime?: OrcaRuntime
             if (win.isMinimized()) {
               win.restore()
             }
+            win.show()
             win.focus()
             win.webContents.send('ui:activateWorktree', {
               repoId,
diff --git a/src/main/ipc/opencode-usage.ts b/src/main/ipc/opencode-usage.ts
deleted file mode 100644
index 47b3c95dea7..00000000000
--- a/src/main/ipc/opencode-usage.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import { ipcMain } from 'electron'
-import type { OpenCodeUsageStore } from '../opencode-usage/store'
-import type {
-  OpenCodeUsageBreakdownKind,
-  OpenCodeUsageRange,
-  OpenCodeUsageScope
-} from '../../shared/opencode-usage-types'
-
-export function registerOpenCodeUsageHandlers(openCodeUsage: OpenCodeUsageStore): void {
-  ipcMain.handle('openCodeUsage:getScanState', () => openCodeUsage.getScanState())
-  ipcMain.handle('openCodeUsage:setEnabled', (_event, args: { enabled: boolean }) =>
-    openCodeUsage.setEnabled(args.enabled)
-  )
-  ipcMain.handle('openCodeUsage:refresh', (_event, args?: { force?: boolean }) =>
-    openCodeUsage.refresh(args?.force ?? false)
-  )
-  ipcMain.handle(
-    'openCodeUsage:getSnapshot',
-    (_event, args: { scope: OpenCodeUsageScope; range: OpenCodeUsageRange; limit?: number }) =>
-      openCodeUsage.getSnapshot(args.scope, args.range, args.limit)
-  )
-  ipcMain.handle(
-    'openCodeUsage:getSummary',
-    (_event, args: { scope: OpenCodeUsageScope; range: OpenCodeUsageRange }) =>
-      openCodeUsage.getSummary(args.scope, args.range)
-  )
-  ipcMain.handle(
-    'openCodeUsage:getDaily',
-    (_event, args: { scope: OpenCodeUsageScope; range: OpenCodeUsageRange }) =>
-      openCodeUsage.getDaily(args.scope, args.range)
-  )
-  ipcMain.handle(
-    'openCodeUsage:getBreakdown',
-    (
-      _event,
-      args: {
-        scope: OpenCodeUsageScope
-        range: OpenCodeUsageRange
-        kind: OpenCodeUsageBreakdownKind
-      }
-    ) => openCodeUsage.getBreakdown(args.scope, args.range, args.kind)
-  )
-  ipcMain.handle(
-    'openCodeUsage:getRecentSessions',
-    (_event, args: { scope: OpenCodeUsageScope; range: OpenCodeUsageRange; limit?: number }) =>
-      openCodeUsage.getRecentSessions(args.scope, args.range, args.limit)
-  )
-}
diff --git a/src/main/ipc/preflight-windows-path-refresh.repro.test.ts b/src/main/ipc/preflight-windows-path-refresh.repro.test.ts
index 38e135d4558..916ab35ab63 100644
--- a/src/main/ipc/preflight-windows-path-refresh.repro.test.ts
+++ b/src/main/ipc/preflight-windows-path-refresh.repro.test.ts
@@ -3,45 +3,11 @@ import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 
-const { registryQueryAsyncMock, registryQuerySyncMock } = vi.hoisted(() => ({
-  registryQueryAsyncMock: vi.fn(),
-  registryQuerySyncMock: vi.fn()
-}))
-
-vi.mock('node:child_process', async (importOriginal) => {
-  const original = await importOriginal<Record<string, unknown>>()
-  const originalExecFile = original.execFile as (
-    command: string,
-    commandArgs: string[],
-    commandOptions: unknown,
-    commandCallback: (error: Error | null, stdout: string, stderr: string) => void
-  ) => unknown
-  const registryAwareExecFile = (
-    file: string,
-    args: string[],
-    options: unknown,
-    callback: (error: Error | null, stdout: string, stderr: string) => void
-  ): unknown => {
-    if (file.toLowerCase().endsWith('\\reg.exe')) {
-      return registryQueryAsyncMock(file, args, options, callback)
-    }
-    return originalExecFile(file, args, options, callback)
-  }
-  const customPromisify = Symbol.for('nodejs.util.promisify.custom')
-  Object.defineProperty(registryAwareExecFile, customPromisify, {
-    value: (originalExecFile as unknown as Record<symbol, unknown>)[customPromisify]
-  })
-  return {
-    ...original,
-    execFile: registryAwareExecFile,
-    execFileSync: registryQuerySyncMock
-  }
-})
-
 import {
   __resetPersistedWindowsPathCacheForTests,
   mergePersistedWindowsPathAsync
 } from '../pty/windows-environment-path'
+import { __setWindowsPathRegistryLoaderForTests } from '../pty/windows-path-registry-reader'
 import { execLocalPreflightCommand } from './preflight-command-exec'
 
 describe.runIf(process.platform === 'win32')('Windows preflight Path refresh reproduction', () => {
@@ -50,8 +16,7 @@ describe.runIf(process.platform === 'win32')('Windows preflight Path refresh rep
 
   afterEach(() => {
     process.env.Path = originalPath
-    registryQueryAsyncMock.mockReset()
-    registryQuerySyncMock.mockReset()
+    __setWindowsPathRegistryLoaderForTests()
     __resetPersistedWindowsPathCacheForTests()
     for (const directory of fixtureDirs.splice(0)) {
       rmSync(directory, { recursive: true, force: true })
@@ -68,22 +33,13 @@ describe.runIf(process.platform === 'win32')('Windows preflight Path refresh rep
     )
 
     let persistedUserPath = ''
-    registryQuerySyncMock.mockImplementation((_file, args: string[]) => {
-      const value = String(args[1]).startsWith('HKCU') ? persistedUserPath : ''
-      return `    Path    REG_SZ    ${value}\r\n`
-    })
-    registryQueryAsyncMock.mockImplementation(
-      (
-        _file: string,
-        args: string[],
-        _options: unknown,
-        callback: (error: Error | null, stdout: string, stderr: string) => void
-      ) => {
-        const value = String(args[1]).startsWith('HKCU') ? persistedUserPath : ''
-        callback(null, `    Path    REG_SZ    ${value}\r\n`, '')
-        return {} as never
-      }
-    )
+    const getRegistryKey = vi.fn((root: number) => ({
+      Path: { type: 1, value: root === 2 ? persistedUserPath : '' }
+    }))
+    __setWindowsPathRegistryLoaderForTests(() => ({
+      HK: { LM: 1, CU: 2 },
+      getRegistryKey
+    }))
     __resetPersistedWindowsPathCacheForTests()
 
     await expect(execLocalPreflightCommand(command, ['/?'])).rejects.toMatchObject({
@@ -97,7 +53,6 @@ describe.runIf(process.platform === 'win32')('Windows preflight Path refresh rep
     await expect(execLocalPreflightCommand(command, ['/?'])).resolves.toMatchObject({
       stdout: expect.any(String)
     })
-    expect(registryQuerySyncMock).toHaveBeenCalledTimes(2)
-    expect(registryQueryAsyncMock).toHaveBeenCalledTimes(2)
+    expect(getRegistryKey).toHaveBeenCalledTimes(4)
   })
 })
diff --git a/src/main/ipc/pty-hidden-delivery-gate.ts b/src/main/ipc/pty-hidden-delivery-gate.ts
index b1f089e385e..43fa8567b88 100644
--- a/src/main/ipc/pty-hidden-delivery-gate.ts
+++ b/src/main/ipc/pty-hidden-delivery-gate.ts
@@ -18,8 +18,7 @@ export type HiddenPtyDeliveryGateSettings = Pick<
 
 const hiddenRendererPtys = new Set<string>()
 // Why: sidecar consumers (paste-draft pacing, background agent launches,
-// automation observers, and the kill-switch-off parked 2031 responder) need
-// live bytes even while no visible view exists. Any
+// automation observers) need live bytes even while no visible view exists. Any
 // registered interest suppresses the gate for that PTY.
 const deliveryInterestRendererPtys = new Set<string>()
 // Why: reveal must restore from the model only when bytes were actually
diff --git a/src/main/ipc/pty.test.ts b/src/main/ipc/pty.test.ts
index d3ec26f91a6..f3474a14b4c 100644
--- a/src/main/ipc/pty.test.ts
+++ b/src/main/ipc/pty.test.ts
@@ -56,7 +56,6 @@ const {
   clearAgentHookPaneStateMock,
   registerPaneKeyAliasMock,
   piBuildPtyEnvMock,
-  piBuildStatusOnlyPtyEnvMock,
   piClearPtyMock,
   isPwshAvailableMock,
   wslUncDirectoryExistsAsyncMock,
@@ -70,6 +69,7 @@ const {
   clearPaneKeyAliasesForPtyMock,
   recordCodexPaneAccountMock,
   forgetCodexPaneAccountMock,
+  getCodexPaneAccountMock,
   ensureCodexBackfillRecoveryMock
 } = vi.hoisted(() => ({
   handleMock: vi.fn(),
@@ -95,7 +95,6 @@ const {
   clearAgentHookPaneStateMock: vi.fn(),
   registerPaneKeyAliasMock: vi.fn(),
   piBuildPtyEnvMock: vi.fn(),
-  piBuildStatusOnlyPtyEnvMock: vi.fn(),
   piClearPtyMock: vi.fn(),
   trackMock: vi.fn(),
   classifyErrorMock: vi.fn(),
@@ -107,6 +106,7 @@ const {
   clearPaneKeyAliasesForPtyMock: vi.fn(),
   recordCodexPaneAccountMock: vi.fn(),
   forgetCodexPaneAccountMock: vi.fn(),
+  getCodexPaneAccountMock: vi.fn(),
   ensureCodexBackfillRecoveryMock: vi.fn(() => Promise.resolve())
 }))
 
@@ -180,7 +180,6 @@ vi.mock('../agent-hooks/server', () => ({
 vi.mock('../pi/titlebar-extension-service', () => ({
   piTitlebarExtensionService: {
     buildPtyEnv: piBuildPtyEnvMock,
-    buildStatusOnlyPtyEnv: piBuildStatusOnlyPtyEnvMock,
     clearPty: piClearPtyMock
   }
 }))
@@ -221,7 +220,8 @@ vi.mock('../agent-hooks/migration-unsupported-pty-state', () => ({
 
 vi.mock('../codex/codex-pane-account-registry', () => ({
   recordCodexPaneAccount: recordCodexPaneAccountMock,
-  forgetCodexPaneAccount: forgetCodexPaneAccountMock
+  forgetCodexPaneAccount: forgetCodexPaneAccountMock,
+  getCodexPaneAccount: getCodexPaneAccountMock
 }))
 
 vi.mock('../codex/codex-state-db-backfill-recovery', () => ({
@@ -235,6 +235,7 @@ import { makePaneKey } from '../../shared/stable-pane-id'
 import { SETUP_AGENT_SEQUENCE_STARTUP_COMMAND_ENV } from '../../shared/setup-agent-sequencing'
 import {
   registerPtyHandlers,
+  buildPtyHostEnv,
   registerSshPtyProvider,
   clearPtyOwnershipForConnection,
   clearProviderPtyState,
@@ -254,6 +255,8 @@ import {
   restorePtyIncarnation,
   type PrepareCodexSessionResume
 } from './pty'
+import { __resetPersistedWindowsPathCacheForTests } from '../pty/windows-environment-path'
+import { __setWindowsPathRegistryLoaderForTests } from '../pty/windows-path-registry-reader'
 import { resetMacosLoginShellPreflightForTests } from '../providers/macos-tcc-login-shell'
 import {
   _resetHiddenRendererPtyDeliveryGateForTest,
@@ -395,7 +398,6 @@ describe('registerPtyHandlers', () => {
     clearAgentHookPaneStateMock.mockReset()
     registerPaneKeyAliasMock.mockReset()
     piBuildPtyEnvMock.mockReset()
-    piBuildStatusOnlyPtyEnvMock.mockReset()
     piClearPtyMock.mockReset()
     isPwshAvailableMock.mockReset()
     wslUncDirectoryExistsAsyncMock.mockReset()
@@ -410,6 +412,7 @@ describe('registerPtyHandlers', () => {
     clearPaneKeyAliasesForPtyMock.mockReset()
     recordCodexPaneAccountMock.mockReset()
     forgetCodexPaneAccountMock.mockReset()
+    getCodexPaneAccountMock.mockReset()
     ensureCodexBackfillRecoveryMock.mockReset()
     ensureCodexBackfillRecoveryMock.mockResolvedValue(undefined)
     mainWindow.webContents.on.mockReset()
@@ -497,10 +500,6 @@ describe('registerPtyHandlers', () => {
         }
       }
     )
-    piBuildStatusOnlyPtyEnvMock.mockReturnValue({
-      ORCA_PRIME_AGENT_STATUS_EXTENSION:
-        'C:\\Users\\test\\AppData\\Roaming\\Orca\\prime-agent-managed-status-extension\\orca-agent-status.ts'
-    })
     isPwshAvailableMock.mockReturnValue(false)
     spawnMock.mockReturnValue({
       onData: vi.fn(() => makeDisposable()),
@@ -1948,6 +1947,65 @@ describe('registerPtyHandlers', () => {
   }
 
   describe('spawn environment', () => {
+    it('refreshes the outer Windows PATH for a WSL spawn without forwarding it', async () => {
+      const originalPlatform = process.platform
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+      __setWindowsPathRegistryLoaderForTests(() => ({
+        HK: { LM: 1, CU: 2 },
+        getRegistryKey: (root) => ({
+          Path: {
+            type: 1,
+            value:
+              root === 1
+                ? 'C:\\Windows\\System32'
+                : 'C:\\Python314;C:\\Users\\me\\AppData\\Local\\Microsoft\\WindowsApps'
+          }
+        })
+      }))
+      __resetPersistedWindowsPathCacheForTests()
+
+      try {
+        const provider = new LocalPtyProvider({
+          buildSpawnEnv: (id, baseEnv, context) =>
+            buildPtyHostEnv(id, baseEnv, {
+              isPackaged: true,
+              userDataPath: '/tmp/orca-user-data',
+              selectedCodexHomePath: null,
+              githubAttributionEnabled: false,
+              agentStatusHooksEnabled: false,
+              isWsl: context?.isWsl,
+              wslDistro: context?.wslDistro
+            })
+        })
+        await provider.spawn({
+          cols: 80,
+          rows: 24,
+          cwd: '\\\\wsl.localhost\\Ubuntu\\home\\me\\repo',
+          shellOverride: 'wsl.exe',
+          terminalWindowsWslDistro: 'Ubuntu',
+          env: {
+            PATH: 'C:\\Orca\\bin;C:\\Users\\me\\AppData\\Local\\Microsoft\\WindowsApps',
+            WSLENV: 'ORCA_TERMINAL_HANDLE/u'
+          }
+        })
+        const [file, , options] = spawnMock.mock.calls.at(-1)!
+
+        expect(file).toBe('wsl.exe')
+        expect(options.env.PATH).toBe(
+          'C:\\Orca\\bin;C:\\Windows\\System32;C:\\Python314;C:\\Users\\me\\AppData\\Local\\Microsoft\\WindowsApps'
+        )
+        const forwardedKeys = options.env.WSLENV.split(':').map((entry) =>
+          entry.split('/')[0]!.toLowerCase()
+        )
+        expect(options.env.WSLENV).toContain('ORCA_TERMINAL_HANDLE/u')
+        expect(forwardedKeys).not.toContain('path')
+      } finally {
+        __resetPersistedWindowsPathCacheForTests()
+        __setWindowsPathRegistryLoaderForTests()
+        Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+      }
+    })
+
     it('publishes a lifecycle signal after a successful renderer spawn', async () => {
       await spawnAndGetEnv()
 
@@ -4221,10 +4279,13 @@ describe('registerPtyHandlers', () => {
         })
       })
 
-      it('bridges a host-managed Prime status extension into WSL without redirecting Prime home', async () => {
+      it('does not install or inject a Prime extension for an explicit WSL launch', async () => {
         await withWin32Platform(async () => {
           const env = await daemonSpawnAndGetEnv(
-            { PRIME_AGENT_CODING_AGENT_DIR: 'C:\\Users\\test\\.prime\\agent' },
+            {
+              PRIME_AGENT_CODING_AGENT_DIR: 'C:\\Users\\test\\.prime\\agent',
+              ORCA_PRIME_AGENT_STATUS_EXTENSION: 'C:\\stale\\orca-agent-status.ts'
+            },
             undefined,
             undefined,
             undefined,
@@ -4232,26 +4293,23 @@ describe('registerPtyHandlers', () => {
           )
 
           expect(piBuildPtyEnvMock).not.toHaveBeenCalled()
-          expect(piBuildStatusOnlyPtyEnvMock).toHaveBeenCalledWith('prime-agent')
           expect(env.ORCA_PRIME_AGENT_SOURCE_AGENT_DIR).toBeUndefined()
-          expect(env.ORCA_PRIME_AGENT_STATUS_EXTENSION).toBe(
-            'C:\\Users\\test\\AppData\\Roaming\\Orca\\prime-agent-managed-status-extension\\orca-agent-status.ts'
-          )
-          expect(env.ORCA_WSL_HOOK_INSTANCE).toBe('port5678')
+          expect(env.ORCA_PRIME_AGENT_STATUS_EXTENSION).toBeUndefined()
+          expect(env.ORCA_WSL_HOOK_INSTANCE).toBeUndefined()
           expect(env.PRIME_AGENT_CODING_AGENT_DIR).toBe('C:\\Users\\test\\.prime\\agent')
         })
       })
 
-      it('prepares the Prime bridge for a typed launch in a bare WSL shell', async () => {
+      it('does not prepare a Prime extension for a typed launch in a bare WSL shell', async () => {
         await withWin32Platform(async () => {
           const env = await daemonSpawnAndGetEnv({}, undefined, undefined, undefined, {
             shellOverride: 'wsl.exe'
           })
 
-          expect(piBuildStatusOnlyPtyEnvMock).toHaveBeenCalledWith('prime-agent')
-          expect(env.ORCA_PRIME_AGENT_STATUS_EXTENSION).toContain(
-            'prime-agent-managed-status-extension'
+          expect(piBuildPtyEnvMock.mock.calls.some(([, , kind]) => kind === 'prime-agent')).toBe(
+            false
           )
+          expect(env.ORCA_PRIME_AGENT_STATUS_EXTENSION).toBeUndefined()
           expect(env.PRIME_AGENT_CODING_AGENT_DIR).toBeUndefined()
         })
       })
@@ -8592,6 +8650,86 @@ describe('registerPtyHandlers', () => {
     })
   })
 
+  it('shuts down a split PTY when its expected source binding was retired', async () => {
+    type RuntimeSpawnController = {
+      spawn(args: {
+        cols: number
+        rows: number
+        worktreeId: string
+        tabId: string
+        leafId: string
+        persistHostSessionBinding: boolean
+        expectedSourceBinding: {
+          worktreeId: string
+          tabId: string
+          leafId: string
+          ptyId: string
+        }
+      }): Promise<{ id: string }>
+    }
+    const proc = {
+      onData: vi.fn(),
+      onExit: vi.fn(),
+      write: vi.fn(),
+      resize: vi.fn(),
+      kill: vi.fn(),
+      process: 'zsh',
+      pid: 12345
+    }
+    spawnMock.mockReturnValue(proc)
+    const store = { persistPtyBinding: vi.fn(() => false) }
+    let controller: RuntimeSpawnController | null = null
+    const runtime = {
+      setPtyController: vi.fn((value) => {
+        controller = value
+      }),
+      preAllocateHandleForPty: vi.fn(() => 'term_expected'),
+      registerPreAllocatedHandleForPty: vi.fn(),
+      registerPty: vi.fn(),
+      noteTerminalSpawnCommand: vi.fn(),
+      onPtySpawned: vi.fn(),
+      onPtyExit: vi.fn(),
+      onPtyData: vi.fn()
+    }
+    const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+    registerPtyHandlers(
+      mainWindow as never,
+      runtime as never,
+      undefined,
+      undefined,
+      undefined,
+      store as never
+    )
+    const leafId = '22222222-2222-4222-8222-222222222222'
+    const expectedSourceBinding = {
+      worktreeId: 'wt-1',
+      tabId: 'tab-headless',
+      leafId: '11111111-1111-4111-8111-111111111111',
+      ptyId: 'pty-source'
+    }
+
+    try {
+      await expect(
+        (controller as unknown as RuntimeSpawnController).spawn({
+          cols: 80,
+          rows: 24,
+          worktreeId: 'wt-1',
+          tabId: 'tab-headless',
+          leafId,
+          persistHostSessionBinding: true,
+          expectedSourceBinding
+        })
+      ).rejects.toThrow('terminal_split_source_not_found')
+    } finally {
+      error.mockRestore()
+    }
+
+    expect(store.persistPtyBinding).toHaveBeenCalledWith(
+      expect.objectContaining({ expectedSourceBinding })
+    )
+    expect(proc.kill).toHaveBeenCalledOnce()
+  })
+
   it('reports lower-owner commit before rejecting an early-exited runtime incarnation', async () => {
     const persistPtyBinding = vi.fn()
     const onPtySpawnCommitted = vi.fn()
@@ -9092,16 +9230,20 @@ describe('registerPtyHandlers', () => {
     {
       label: 'git worktree',
       worktreeId: 'repo-1::/tmp/live-owner',
-      cwd: '/tmp/live-owner'
+      cwd: '/tmp/live-owner',
+      paneAccountAtStart: { homeRoute: 'shared-home' },
+      expectedHomeRouteAtStart: 'shared-home'
     },
     {
       label: 'folder workspace',
       worktreeId: 'folder:live-owner',
-      cwd: '/tmp'
+      cwd: '/tmp',
+      paneAccountAtStart: null,
+      expectedHomeRouteAtStart: null
     }
   ])(
     'adopts a completed runtime-owned pane before replacement launch preflight ($label)',
-    async ({ worktreeId, cwd }) => {
+    async ({ worktreeId, cwd, paneAccountAtStart, expectedHomeRouteAtStart }) => {
       type StableAdoption = {
         result: { id: string; incarnationId?: string; isReattach?: boolean }
         owner: { handle?: string; tabId: string; leafId: string; ptyId: string }
@@ -9253,13 +9395,26 @@ describe('registerPtyHandlers', () => {
       store.persistPtyBinding.mockClear()
       mainWindow.webContents.send.mockClear()
 
+      wslUncDirectoryExistsAsyncMock.mockClear()
       const mountArgs = {
         cols: 120,
         rows: 40,
-        cwd,
+        cwd: '/a',
+        cwdFallback: 'worktree',
         command: 'claude --resume provider-session',
         launchAgent: 'claude',
         worktreeId,
+        projectRuntime: {
+          status: 'resolved',
+          runtime: {
+            kind: 'wsl',
+            hostPlatform: 'wsl',
+            projectId: 'repo-1',
+            distro: 'Ubuntu-24.04',
+            reason: 'project-override',
+            cacheKey: 'repo-1:wsl'
+          }
+        },
         tabId,
         leafId,
         env: {
@@ -9292,6 +9447,7 @@ describe('registerPtyHandlers', () => {
         sessionId: 'pty-live-owner'
       })
       expect(providerSpawn.mock.calls[1]?.[0].command).toBeUndefined()
+      expect(wslUncDirectoryExistsAsyncMock).not.toHaveBeenCalled()
       expect(runtime.createPreAllocatedTerminalHandle).not.toHaveBeenCalled()
       expect(prepareClaudeAuth).not.toHaveBeenCalled()
       expect(runtime.registerPreAllocatedHandleForPty).not.toHaveBeenCalled()
@@ -9308,8 +9464,10 @@ describe('registerPtyHandlers', () => {
       runtime.beginPtyRegistration.mockImplementation(() => {
         runtimeSecondAdoption ??= spawnController.adoptStablePane(adoptionArgs)
       })
+      getCodexPaneAccountMock.mockReturnValue(paneAccountAtStart)
       const rendererFirstMount = handlers.get('pty:spawn')!(null, mountArgs)
       await vi.waitFor(() => expect(providerSpawn).toHaveBeenCalledTimes(3))
+      getCodexPaneAccountMock.mockReturnValue({ homeRoute: 'real-home' })
       releaseAttach()
       await vi.waitFor(() => expect(runtimeSecondAdoption).not.toBeNull())
       const pendingRuntimeAdoption = runtimeSecondAdoption
@@ -9354,6 +9512,7 @@ describe('registerPtyHandlers', () => {
         id: 'pty-live-owner',
         codexHomePath: null,
         reattached: true,
+        reattachedHomeRoute: expectedHomeRouteAtStart,
         startedAt: expect.any(Date),
         startedSequence: expect.any(Number)
       })
@@ -12169,51 +12328,60 @@ describe('registerPtyHandlers', () => {
     expect(result.startupCwdFallback).toEqual({ kind: 'worktree', cwd: worktreePath })
   })
 
-  it('keeps an existing POSIX startup cwd for the selected WSL runtime', async () => {
-    const originalPlatform = process.platform
-    const providerSpawn = vi.fn().mockResolvedValue({ id: 'pty-wsl-cwd' })
-    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
-    wslUncDirectoryExistsAsyncMock.mockResolvedValue(true)
-    statSyncMock.mockImplementation((target: string) => {
-      if (target === '/home/alice/repo') {
-        throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' })
-      }
-      return { isDirectory: () => true, mode: 0o755 }
-    })
-
-    try {
-      installDaemonTestProvider({ spawn: providerSpawn })
-      registerPtyHandlers(mainWindow as never)
-      await handlers.get('pty:spawn')!(null, {
-        cols: 80,
-        rows: 24,
-        cwd: '/home/alice/repo',
-        cwdFallback: 'worktree',
-        worktreeId: 'repo-1::C:\\Users\\alice\\repo',
-        projectRuntime: {
-          status: 'resolved',
-          runtime: {
-            kind: 'wsl',
-            hostPlatform: 'wsl',
-            projectId: 'repo-1',
-            distro: 'Ubuntu-24.04',
-            reason: 'project-override',
-            cacheKey: 'repo-1:wsl'
-          }
+  it.each(['/home/alice/repo', '/a', '/c'])(
+    'keeps an existing POSIX startup cwd for the selected WSL runtime (%s)',
+    async (startupCwd) => {
+      const originalPlatform = process.platform
+      const providerSpawn = vi.fn().mockResolvedValue({ id: 'pty-wsl-cwd' })
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+      wslUncDirectoryExistsAsyncMock.mockResolvedValue(true)
+      statSyncMock.mockImplementation((target: string) => {
+        if (target === startupCwd) {
+          throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' })
         }
+        return { isDirectory: () => true, mode: 0o755 }
       })
 
-      expect(statSyncMock).not.toHaveBeenCalledWith('/home/alice/repo')
-      expect(wslUncDirectoryExistsAsyncMock).toHaveBeenCalledWith(
-        '\\\\wsl.localhost\\Ubuntu-24.04\\home\\alice\\repo'
-      )
-      expect(providerSpawn).toHaveBeenCalledWith(
-        expect.objectContaining({ cwd: '/home/alice/repo', shellOverride: 'wsl.exe' })
-      )
-    } finally {
-      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+      try {
+        installDaemonTestProvider({ spawn: providerSpawn })
+        registerPtyHandlers(mainWindow as never)
+        await handlers.get('pty:spawn')!(null, {
+          cols: 80,
+          rows: 24,
+          cwd: startupCwd,
+          cwdFallback: 'worktree',
+          worktreeId: 'repo-1::C:\\Users\\alice\\repo',
+          projectRuntime: {
+            status: 'resolved',
+            runtime: {
+              kind: 'wsl',
+              hostPlatform: 'wsl',
+              projectId: 'repo-1',
+              distro: 'Ubuntu-24.04',
+              reason: 'project-override',
+              cacheKey: 'repo-1:wsl'
+            }
+          }
+        })
+
+        const expectedValidationCwd = `\\\\wsl.localhost\\Ubuntu-24.04${startupCwd.replaceAll('/', '\\')}`
+        expect(statSyncMock).not.toHaveBeenCalledWith(startupCwd)
+        expect(wslUncDirectoryExistsAsyncMock).toHaveBeenCalledTimes(1)
+        expect(wslUncDirectoryExistsAsyncMock).toHaveBeenCalledWith(expectedValidationCwd)
+        expect(providerSpawn).toHaveBeenCalledWith(
+          expect.objectContaining({
+            cwd: startupCwd,
+            shellOverride: 'wsl.exe'
+          })
+        )
+        expect(providerSpawn).toHaveBeenCalledWith(
+          expect.not.objectContaining({ prevalidatedCwd: expect.anything() })
+        )
+      } finally {
+        Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+      }
     }
-  })
+  )
 
   it('falls back when the selected WSL runtime reports a POSIX cwd missing', async () => {
     const originalPlatform = process.platform
@@ -12228,7 +12396,7 @@ describe('registerPtyHandlers', () => {
       const result = (await handlers.get('pty:spawn')!(null, {
         cols: 80,
         rows: 24,
-        cwd: '/home/alice/deleted',
+        cwd: '/a',
         cwdFallback: 'worktree',
         worktreeId: `repo-1::${worktreePath}`,
         projectRuntime: {
@@ -12244,13 +12412,71 @@ describe('registerPtyHandlers', () => {
         }
       })) as { startupCwdFallback?: { kind: string; cwd: string } }
 
+      expect(wslUncDirectoryExistsAsyncMock).toHaveBeenCalledTimes(1)
       expect(providerSpawn).toHaveBeenCalledWith(expect.objectContaining({ cwd: worktreePath }))
+      expect(providerSpawn).toHaveBeenCalledWith(
+        expect.not.objectContaining({ prevalidatedCwd: expect.anything() })
+      )
       expect(result.startupCwdFallback).toEqual({ kind: 'worktree', cwd: worktreePath })
     } finally {
       Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
     }
   })
 
+  it('does not probe or forward local WSL cwd evidence for SSH fallback spawns', async () => {
+    const sshSpawn = vi.fn(async () => ({ id: 'ssh-wsl-looking-cwd' }))
+    registerSshPtyProvider('ssh-1', {
+      spawn: sshSpawn,
+      write: vi.fn(),
+      resize: vi.fn(),
+      shutdown: vi.fn(),
+      sendSignal: vi.fn(),
+      getCwd: vi.fn(),
+      getInitialCwd: vi.fn(),
+      clearBuffer: vi.fn(),
+      acknowledgeDataEvent: vi.fn(),
+      hasChildProcesses: vi.fn(),
+      getForegroundProcess: vi.fn(),
+      serialize: vi.fn(),
+      revive: vi.fn(),
+      onData: vi.fn(() => () => {}),
+      onReplay: vi.fn(() => () => {}),
+      onExit: vi.fn(() => () => {}),
+      listProcesses: vi.fn(async () => []),
+      attach: vi.fn(),
+      getDefaultShell: vi.fn(),
+      getProfiles: vi.fn()
+    } as never)
+    registerPtyHandlers(mainWindow as never)
+
+    await handlers.get('pty:spawn')!(null, {
+      cols: 80,
+      rows: 24,
+      cwd: '/a',
+      cwdFallback: 'worktree',
+      connectionId: 'ssh-1',
+      worktreeId: 'repo-1::C:\\Users\\alice\\repo',
+      shellOverride: 'wsl.exe',
+      projectRuntime: {
+        status: 'resolved',
+        runtime: {
+          kind: 'wsl',
+          hostPlatform: 'wsl',
+          projectId: 'repo-1',
+          distro: 'Ubuntu-24.04',
+          reason: 'project-override',
+          cacheKey: 'repo-1:wsl'
+        }
+      }
+    })
+
+    expect(wslUncDirectoryExistsAsyncMock).not.toHaveBeenCalled()
+    expect(sshSpawn).toHaveBeenCalledWith(expect.objectContaining({ cwd: '/a' }))
+    expect(sshSpawn).toHaveBeenCalledWith(
+      expect.not.objectContaining({ prevalidatedCwd: expect.anything() })
+    )
+  })
+
   it('preserves a POSIX WSL cwd when the distro probe is inconclusive', async () => {
     const originalPlatform = process.platform
     const providerSpawn = vi.fn().mockResolvedValue({ id: 'pty-wsl-inconclusive-cwd' })
@@ -12263,15 +12489,13 @@ describe('registerPtyHandlers', () => {
       const result = (await handlers.get('pty:spawn')!(null, {
         cols: 80,
         rows: 24,
-        cwd: '/home/alice/repo',
+        cwd: '/a',
         cwdFallback: 'worktree',
         worktreeId: 'repo-1::C:/Users/alice/repo',
         shellOverride: 'wsl.exe'
       })) as { startupCwdFallback?: unknown }
 
-      expect(providerSpawn).toHaveBeenCalledWith(
-        expect.objectContaining({ cwd: '/home/alice/repo' })
-      )
+      expect(providerSpawn).toHaveBeenCalledWith(expect.objectContaining({ cwd: '/a' }))
       expect(result.startupCwdFallback).toBeUndefined()
     } finally {
       Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
@@ -12290,17 +12514,15 @@ describe('registerPtyHandlers', () => {
       const result = (await handlers.get('pty:spawn')!(null, {
         cols: 80,
         rows: 24,
-        cwd: '/home/alice/repo',
+        cwd: '/c',
         cwdFallback: 'worktree',
         worktreeId: 'repo-1::C:/Users/alice/repo',
         shellOverride: 'wsl.exe'
       })) as { startupCwdFallback?: unknown }
 
-      expect(statSyncMock).not.toHaveBeenCalledWith('/home/alice/repo')
+      expect(statSyncMock).not.toHaveBeenCalledWith('/c')
       expect(wslUncDirectoryExistsAsyncMock).not.toHaveBeenCalled()
-      expect(providerSpawn).toHaveBeenCalledWith(
-        expect.objectContaining({ cwd: '/home/alice/repo' })
-      )
+      expect(providerSpawn).toHaveBeenCalledWith(expect.objectContaining({ cwd: '/c' }))
       expect(result.startupCwdFallback).toBeUndefined()
     } finally {
       Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
@@ -12308,7 +12530,11 @@ describe('registerPtyHandlers', () => {
   })
 
   it.each([
-    { exists: true, expectedCwd: '/home/alice/repo', expectedFallback: undefined },
+    {
+      exists: true,
+      expectedCwd: '/home/alice/repo',
+      expectedFallback: undefined
+    },
     {
       exists: false,
       expectedCwd: '\\\\wsl.localhost\\Ubuntu\\home\\alice',
@@ -12337,9 +12563,13 @@ describe('registerPtyHandlers', () => {
         worktreeId: 'repo-1::\\\\wsl.localhost\\Ubuntu\\home\\alice'
       })) as { startupCwdFallback?: { kind: string; cwd: string } }
 
+      expect(wslUncDirectoryExistsAsyncMock).toHaveBeenCalledTimes(testCase.exists ? 1 : 2)
       expect(providerSpawn).toHaveBeenCalledWith(
         expect.objectContaining({ cwd: testCase.expectedCwd })
       )
+      expect(providerSpawn).toHaveBeenCalledWith(
+        expect.not.objectContaining({ prevalidatedCwd: expect.anything() })
+      )
       expect(result.startupCwdFallback).toEqual(testCase.expectedFallback)
     } finally {
       Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
@@ -12358,15 +12588,16 @@ describe('registerPtyHandlers', () => {
       const result = (await handlers.get('pty:spawn')!(null, {
         cols: 80,
         rows: 24,
-        cwd: '/home/alice/deleted',
+        cwd: '/c',
         cwdFallback: 'worktree',
         worktreeId: 'repo-1::\\\\wsl.localhost\\Ubuntu\\home\\alice'
       })) as { startupCwdFallback?: unknown }
 
       expect(wslUncDirectoryExistsAsyncMock).toHaveBeenCalledTimes(2)
       expect(providerSpawn).toHaveBeenCalledWith(
-        expect.objectContaining({ cwd: '/home/alice/deleted' })
+        expect.not.objectContaining({ prevalidatedCwd: expect.anything() })
       )
+      expect(providerSpawn).toHaveBeenCalledWith(expect.objectContaining({ cwd: '/c' }))
       expect(result.startupCwdFallback).toBeUndefined()
     } finally {
       Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
@@ -12429,12 +12660,46 @@ describe('registerPtyHandlers', () => {
       expect(providerSpawn).toHaveBeenCalledWith(
         expect.objectContaining({ cwd: worktreePath, shellOverride: 'wsl.exe' })
       )
+      expect(wslUncDirectoryExistsAsyncMock).not.toHaveBeenCalled()
       expect(result.startupCwdFallback).toEqual({ kind: 'worktree', cwd: worktreePath })
     } finally {
       Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
     }
   })
 
+  it('probes Git Bash /c as its existing native drive root without falling back', async () => {
+    const originalPlatform = process.platform
+    const providerSpawn = vi.fn().mockResolvedValue({ id: 'pty-git-bash-cwd' })
+    const worktreePath = 'C:/Users/alice/repo'
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+
+    try {
+      installDaemonTestProvider({ spawn: providerSpawn })
+      registerPtyHandlers(mainWindow as never)
+      const result = (await handlers.get('pty:spawn')!(null, {
+        cols: 80,
+        rows: 24,
+        cwd: '/c',
+        cwdFallback: 'worktree',
+        worktreeId: `repo-1::${worktreePath}`,
+        shellOverride: 'C:\\Program Files\\Git\\bin\\bash.exe'
+      })) as { startupCwdFallback?: { kind: string; cwd: string } }
+
+      expect(wslUncDirectoryExistsAsyncMock).not.toHaveBeenCalled()
+      expect(statSyncMock).toHaveBeenCalledWith('C:\\')
+      expect(statSyncMock).not.toHaveBeenCalledWith('/c')
+      expect(providerSpawn).toHaveBeenCalledWith(
+        expect.objectContaining({
+          cwd: '/c',
+          shellOverride: expect.stringContaining('bash')
+        })
+      )
+      expect(result.startupCwdFallback).toBeUndefined()
+    } finally {
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+    }
+  })
+
   it('keeps a missing cwd unchanged without the fallback flag', async () => {
     registerPtyHandlers(mainWindow as never)
     existsSyncMock.mockImplementation((target: string) => target !== '/repo/app/deleted-folder')
@@ -17477,6 +17742,87 @@ describe('registerPtyHandlers', () => {
     )
   })
 
+  it('pairs the daemon kitty flags with the reconciled boundary when no bytes crossed mid-spawn', async () => {
+    setLocalPtyProvider({
+      spawn: vi.fn(async () => ({
+        id: 'pty-restored',
+        isReattach: true,
+        providerSequence: { value: 900, generation: 'continued' as const },
+        snapshotKittyKeyboardFlags: 8
+      })),
+      write: vi.fn(),
+      resize: vi.fn(),
+      kill: vi.fn(),
+      shutdown: vi.fn(),
+      onData: vi.fn(() => vi.fn()),
+      onExit: vi.fn(() => vi.fn()),
+      listProcesses: vi.fn(async () => []),
+      getForegroundProcess: vi.fn(async () => null)
+    } as never)
+    const runtime = {
+      setPtyController: vi.fn(),
+      noteTerminalSpawnCommand: vi.fn(),
+      getPtyOutputSequence: vi.fn().mockReturnValue(7),
+      synchronizePtyOutputSequenceFromProvider: vi.fn().mockReturnValue(920),
+      onPtySpawned: vi.fn(),
+      onPtyData: vi.fn(),
+      onPtyExit: vi.fn(),
+      createPreAllocatedTerminalHandle: vi.fn(() => null),
+      preAllocateHandleForPty: vi.fn()
+    }
+    registerPtyHandlers(mainWindow as never, runtime as never)
+
+    const reply = (await handlers.get('pty:spawn')!(null, { cols: 80, rows: 24 })) as {
+      snapshotSeq?: number
+      snapshotKittyKeyboardFlags?: number
+    }
+
+    expect(reply.snapshotKittyKeyboardFlags).toBe(8)
+    expect(reply.snapshotSeq).toBe(920)
+  })
+
+  it('drops the daemon kitty flags claim when bytes crossed the data socket mid-spawn', async () => {
+    setLocalPtyProvider({
+      spawn: vi.fn(async () => ({
+        id: 'pty-restored',
+        isReattach: true,
+        providerSequence: { value: 900, generation: 'continued' as const },
+        snapshotKittyKeyboardFlags: 8
+      })),
+      write: vi.fn(),
+      resize: vi.fn(),
+      kill: vi.fn(),
+      shutdown: vi.fn(),
+      onData: vi.fn(() => vi.fn()),
+      onExit: vi.fn(() => vi.fn()),
+      listProcesses: vi.fn(async () => []),
+      getForegroundProcess: vi.fn(async () => null)
+    } as never)
+    const runtime = {
+      setPtyController: vi.fn(),
+      noteTerminalSpawnCommand: vi.fn(),
+      // 7 at spawn start, 20 at reconcile: bytes arrived during the spawn RPC.
+      getPtyOutputSequence: vi.fn().mockReturnValueOnce(7).mockReturnValue(20),
+      synchronizePtyOutputSequenceFromProvider: vi.fn().mockReturnValue(920),
+      onPtySpawned: vi.fn(),
+      onPtyData: vi.fn(),
+      onPtyExit: vi.fn(),
+      createPreAllocatedTerminalHandle: vi.fn(() => null),
+      preAllocateHandleForPty: vi.fn()
+    }
+    registerPtyHandlers(mainWindow as never, runtime as never)
+
+    const reply = (await handlers.get('pty:spawn')!(null, { cols: 80, rows: 24 })) as {
+      snapshotSeq?: number
+      snapshotKittyKeyboardFlags?: number
+    }
+
+    // The reconciled boundary covers bytes the daemon's flags were proven
+    // BEFORE — publishing both would erase a negotiation the pane scanned live.
+    expect(reply.snapshotKittyKeyboardFlags).toBeUndefined()
+    expect(reply.snapshotSeq).toBeUndefined()
+  })
+
   it('records the launch Codex account for a fresh spawn but not for a reattach', async () => {
     const spawn = vi
       .fn()
diff --git a/src/main/ipc/pty.ts b/src/main/ipc/pty.ts
index 1ca019f6f0f..5702bfc9e8f 100644
--- a/src/main/ipc/pty.ts
+++ b/src/main/ipc/pty.ts
@@ -13,7 +13,7 @@ import {
 } from 'electron'
 export { getBashShellReadyRcfileContent } from '../providers/local-pty-shell-ready'
 import type { OrcaRuntimeService } from '../runtime/orca-runtime'
-import type { Store } from '../persistence'
+import type { PtyBindingSourceExpectation, Store } from '../persistence'
 import { retireTerminalSurfaceFromPersistence } from '../runtime/mobile-session-terminal-persistence-retirement'
 import type { GlobalSettings, TuiAgent } from '../../shared/types'
 import { toSshExecutionHostId } from '../../shared/execution-host'
@@ -70,6 +70,7 @@ import {
 } from '../../shared/pi-agent-kind'
 import { isPwshAvailableAsync } from '../pwsh'
 import { LocalPtyProvider } from '../providers/local-pty-provider'
+import { normalizeWindowsTerminalCwd } from '../providers/windows-shell-args'
 import type { IPtyProvider, PtySpawnOptions, PtySpawnResult } from '../providers/types'
 import { isPtyWriteUnavailableError } from '../providers/pty-write-unavailable-error'
 import {
@@ -96,7 +97,11 @@ import {
 import { resolveWslSessionContext } from '../daemon/wsl-session-context'
 import { addNodePtyRecoveryHint } from '../daemon/node-pty-error-hints'
 import { recordDaemonStreamBacklogEvent } from '../daemon/daemon-stream-backlog-probe'
-import { TerminalSessionOwnerUnverifiedError } from '../daemon/daemon-errors'
+import {
+  isDaemonEndpointGoneError,
+  TerminalHostGoneError,
+  TerminalSessionOwnerUnverifiedError
+} from '../daemon/daemon-errors'
 import type { ClaudeRuntimeAuthPreparation } from '../claude-accounts/runtime-auth-service'
 import type { ClaudeAccountSelectionTarget } from '../claude-accounts/runtime-selection'
 import { CLAUDE_AUTH_ENV_VARS, hasClaudeAuthEnvConflict } from '../claude-accounts/environment'
@@ -127,7 +132,7 @@ import {
 import { isRemoteAgentHooksEnabled } from '../../shared/agent-hook-relay'
 import { createTerminalSessionStateSaveFailureMessage } from '../../shared/terminal-session-state-save-failure'
 import { RendererTerminalSerializerReadiness } from './renderer-terminal-serializer-readiness'
-import { readShellStartupEnvVar } from '../pty/shell-startup-env'
+import { readSessionShellStartupEnvVar } from '../pty/shell-startup-env'
 import {
   isTerminalLeafId,
   makePaneKey,
@@ -135,6 +140,7 @@ import {
   parsePaneKey
 } from '../../shared/stable-pane-id'
 import { isValidTerminalTabId } from '../../shared/terminal-tab-id'
+import { parseTerminalKittyKeyboardFlags } from '../../shared/terminal-kitty-keyboard-flags'
 import {
   resolveTerminalStartupCwdForWorkspace,
   type TerminalStartupCwdMissingDirFallback
@@ -198,7 +204,9 @@ import {
 } from '../codex-accounts/managed-codex-auth-readiness'
 import {
   forgetCodexPaneAccount,
-  recordCodexPaneAccount
+  getCodexPaneAccount,
+  recordCodexPaneAccount,
+  type CodexPaneHomeRoute
 } from '../codex/codex-pane-account-registry'
 import { resolveCodexPaneLaunchAccount } from '../codex/codex-pane-launch-account'
 import { getSystemCodexHomePath } from '../codex/codex-home-paths'
@@ -846,6 +854,10 @@ async function attachStablePaneOwner(
     if (error instanceof TerminalSessionOwnerUnverifiedError) {
       throw new Error('terminal_pane_owner_unverified')
     }
+    // Why: translate before paired-runtime RPC strips the socket error's code and syscall.
+    if (isDaemonEndpointGoneError(error)) {
+      throw new TerminalHostGoneError()
+    }
     if (!isPtyAlreadyGoneError(error)) {
       throw error
     }
@@ -1238,6 +1250,7 @@ export type CodexHomePtySpawnedLifecycleArgs = {
   id: string
   codexHomePath: string | null
   reattached?: boolean
+  reattachedHomeRoute?: CodexPaneHomeRoute | null
   launchEnv?: NodeJS.ProcessEnv
   startedAt?: Date
   startedSequence?: number
@@ -1449,6 +1462,30 @@ function recordCodexPaneAccountForSpawn(args: {
   recordCodexPaneAccount(args.ptyId, record)
 }
 
+function snapshotCodexPaneHomeRoutes(
+  ptyIds: readonly (string | null | undefined)[]
+): ReadonlyMap<string, CodexPaneHomeRoute | null> {
+  const routes = new Map<string, CodexPaneHomeRoute | null>()
+  for (const ptyId of ptyIds) {
+    if (!ptyId || routes.has(ptyId)) {
+      continue
+    }
+    routes.set(ptyId, getCodexPaneAccount(ptyId)?.homeRoute ?? null)
+  }
+  return routes
+}
+
+function codexReattachedHomeRouteField(
+  routes: ReadonlyMap<string, CodexPaneHomeRoute | null>,
+  ptyId: string,
+  reattached: boolean
+): { reattachedHomeRoute?: CodexPaneHomeRoute | null } {
+  if (!reattached || !routes.has(ptyId)) {
+    return {}
+  }
+  return { reattachedHomeRoute: routes.get(ptyId) ?? null }
+}
+
 function readEnvWithProcessFallback(
   baseEnv: Record<string, string>,
   key: string
@@ -1471,11 +1508,7 @@ function resolvePiAgentSourceDir(
   if (kind === 'prime-agent') {
     return (
       readEnvWithProcessFallback(baseEnv, primaryKey) ??
-      readShellStartupEnvVar(
-        primaryKey,
-        baseEnv.HOME ?? process.env.HOME,
-        baseEnv.SHELL ?? process.env.SHELL
-      )
+      readSessionShellStartupEnvVar(primaryKey, baseEnv)
     )
   }
 
@@ -1490,11 +1523,7 @@ function resolvePiAgentSourceDir(
     return publicDir
   }
 
-  return readShellStartupEnvVar(
-    primaryKey,
-    baseEnv.HOME ?? process.env.HOME,
-    baseEnv.SHELL ?? process.env.SHELL
-  )
+  return readSessionShellStartupEnvVar(primaryKey, baseEnv)
 }
 
 function resolveScopedPiAgentSourceDir(
@@ -1545,11 +1574,6 @@ function exposePiManagedExtensionEnv(
     } else {
       delete baseEnv.ORCA_PRIME_AGENT_SOURCE_AGENT_DIR
     }
-    if (managedEnv.ORCA_PRIME_AGENT_STATUS_EXTENSION) {
-      baseEnv.ORCA_PRIME_AGENT_STATUS_EXTENSION = managedEnv.ORCA_PRIME_AGENT_STATUS_EXTENSION
-    } else {
-      delete baseEnv.ORCA_PRIME_AGENT_STATUS_EXTENSION
-    }
     return
   }
   delete baseEnv.ORCA_PI_CODING_AGENT_DIR
@@ -1648,14 +1672,7 @@ function resolveOpenCodeSourceConfigDir(baseEnv: Record<string, string>): string
     return undefined
   }
 
-  return (
-    configDir ??
-    readShellStartupEnvVar(
-      'OPENCODE_CONFIG_DIR',
-      baseEnv.HOME ?? process.env.HOME,
-      baseEnv.SHELL ?? process.env.SHELL
-    )
-  )
+  return configDir ?? readSessionShellStartupEnvVar('OPENCODE_CONFIG_DIR', baseEnv)
 }
 
 /**
@@ -1692,8 +1709,6 @@ export function buildPtyHostEnv(
   })
 
   const shouldPrepareOmpShadow = piAgentKind === 'omp' || !hasLaunchCommand
-  const shouldPreparePrimeStatus =
-    piAgentKind === 'prime-agent' || (opts.isWsl && !hasLaunchCommand)
   // Why: source shadows are agent-scoped; trusting the other kind's source reintroduces Pi/OMP extension-state shadowing.
   const preexistingPiAgentDir = resolvePiAgentSourceDir(baseEnv, 'pi')
   const preexistingOmpAgentDir =
@@ -1752,12 +1767,6 @@ export function buildPtyHostEnv(
     if (opts.isWsl === true) {
       // Why: hook POSTs to 127.0.0.1 die inside WSL's NAT namespace; use the guest-resident relay's endpoint instead of the Windows one.
       const distro = opts.wslDistro ?? null
-      const hookInstance = wslHookRelayManager.getInstanceKey()
-      if (hookInstance) {
-        baseEnv.ORCA_WSL_HOOK_INSTANCE = hookInstance
-      } else {
-        delete baseEnv.ORCA_WSL_HOOK_INSTANCE
-      }
       wslHookRelayManager.ensureForDistro(distro)
       const guestEndpoint = wslHookRelayManager.getGuestEndpointFilePath(distro)
       if (guestEndpoint) {
@@ -1804,14 +1813,13 @@ export function buildPtyHostEnv(
       exposePiManagedExtensionEnv(baseEnv, 'omp', ompEnv)
     }
 
-    if (shouldPreparePrimeStatus) {
-      // Why: the Windows host cannot safely resolve or write Prime's guest
-      // config root; WSL loads the host-managed status file explicitly.
-      const primeEnv = opts.isWsl
-        ? piTitlebarExtensionService.buildStatusOnlyPtyEnv('prime-agent')
-        : piTitlebarExtensionService.buildPtyEnv(id, preexistingPrimeAgentDir, 'prime-agent', {
-            materializeDefaultHome: explicitPiAgentKind === 'prime-agent'
-          })
+    if (piAgentKind === 'prime-agent' && !opts.isWsl) {
+      const primeEnv = piTitlebarExtensionService.buildPtyEnv(
+        id,
+        preexistingPrimeAgentDir,
+        'prime-agent',
+        { materializeDefaultHome: explicitPiAgentKind === 'prime-agent' }
+      )
       Object.assign(baseEnv, primeEnv)
       exposePiManagedExtensionEnv(baseEnv, 'prime-agent', primeEnv)
     }
@@ -4027,6 +4035,7 @@ export function registerPtyHandlers(
     rows: number
     seq?: number
     lastTitle?: string
+    kittyKeyboardFlags?: number
   } | null
   const pendingSerializeRequests = new Map<
     string,
@@ -4055,6 +4064,7 @@ export function registerPtyHandlers(
           rows?: unknown
           seq?: unknown
           lastTitle?: unknown
+          kittyKeyboardFlags?: unknown
         } | null
       }
     ) => {
@@ -4074,6 +4084,7 @@ export function registerPtyHandlers(
           rows: number
           seq?: number
           lastTitle?: string
+          kittyKeyboardFlags?: number
         } = {
           data: snapshot.data,
           cols: snapshot.cols,
@@ -4085,6 +4096,12 @@ export function registerPtyHandlers(
         if (typeof snapshot.lastTitle === 'string' && snapshot.lastTitle.length > 0) {
           result.lastTitle = snapshot.lastTitle
         }
+        // Why gated on seq: without a boundary the flags cannot be reconciled
+        // against live bytes, so they prove nothing.
+        const kittyKeyboardFlags = parseTerminalKittyKeyboardFlags(snapshot.kittyKeyboardFlags)
+        if (result.seq !== undefined && kittyKeyboardFlags !== undefined) {
+          result.kittyKeyboardFlags = kittyKeyboardFlags
+        }
         settleSerializeRequest(args.requestId, result)
       } else {
         settleSerializeRequest(args.requestId, null)
@@ -4407,6 +4424,12 @@ export function registerPtyHandlers(
       const codexHomeLaunchStartedAt = !args.connectionId ? new Date() : undefined
       const codexHomeLaunchStartedSequence = !args.connectionId ? ++ptyLifecycleSequence : undefined
       const preAdoptedStablePane = args.adoptedStablePane ?? null
+      const reattachedCodexHomeRoutes = !args.connectionId
+        ? snapshotCodexPaneHomeRoutes([
+            preAdoptedStablePane?.result.id,
+            args.sessionId ? getAppPtyId(args.connectionId, args.sessionId) : undefined
+          ])
+        : new Map<string, CodexPaneHomeRoute | null>()
       const startupPromise = getLocalPtyStartupPromise(args.connectionId)
       if (startupPromise) {
         await startupPromise
@@ -4440,7 +4463,8 @@ export function registerPtyHandlers(
             codexHomePath: null,
             reattached: true,
             startedAt: codexHomeLaunchStartedAt,
-            startedSequence: codexHomeLaunchStartedSequence
+            startedSequence: codexHomeLaunchStartedSequence,
+            ...codexReattachedHomeRouteField(reattachedCodexHomeRoutes, result.id, true)
           })
         }
         return result
@@ -4544,6 +4568,7 @@ export function registerPtyHandlers(
         worktreeId: string
         tabId: string
         leafId: string
+        expectedSourceBinding?: PtyBindingSourceExpectation
       } | null = null
       if (shouldPersistHostSessionBinding) {
         if (
@@ -4562,7 +4587,10 @@ export function registerPtyHandlers(
           store,
           worktreeId: args.worktreeId,
           tabId: args.tabId,
-          leafId: args.leafId
+          leafId: args.leafId,
+          ...(args.expectedSourceBinding
+            ? { expectedSourceBinding: args.expectedSourceBinding }
+            : {})
         }
       }
       const sshScopedEnv = stripRemotePaneEnvWhenHooksDisabled(args.connectionId, args.env)
@@ -4857,6 +4885,15 @@ export function registerPtyHandlers(
       let stablePaneBindingPersisted = false
       let rejectedRegistrationCandidate: PtySpawnResult | null = null
       let pendingRegistrationPtyId: string | null = null
+      // Why hoisted to the reply scope: main reconciles the provider sequence
+      // deep inside the spawn path, but the pane needs that renderer-domain
+      // boundary beside the daemon snapshot's kitty flags.
+      let reconciledSnapshotSeq: number | null = null
+      // False when bytes crossed the data socket during the spawn RPC: the
+      // reconciled boundary covers them, but the daemon proved its kitty flags
+      // before they existed, so the claim must not erase what the pane may
+      // have scanned from those bytes live.
+      let snapshotKittyFlagsCoverReconciledSeq = true
       let preparedProvisionalExecutionContext = false
       let releaseWorktreeSpawn: (() => void) | undefined
       try {
@@ -5007,11 +5044,19 @@ export function registerPtyHandlers(
           // Why: admission precedes sequence/context state and every durable publication below.
           runtime?.assertPtyRegistrationAllowed?.(result.id, result.incarnationId)
           if (result.providerSequence) {
-            runtime?.synchronizePtyOutputSequenceFromProvider?.(
-              result.id,
-              result.providerSequence,
-              sequenceBeforeProviderSpawn
-            )
+            const runtimeSequenceBeforeReconcile = runtime?.getPtyOutputSequence?.(result.id) ?? 0
+            // Why kept: this is the reattach boundary in the RENDERER's sequence
+            // domain, and the daemon snapshot's kitty flags mean nothing without
+            // the boundary they were proven at.
+            reconciledSnapshotSeq =
+              runtime?.synchronizePtyOutputSequenceFromProvider?.(
+                result.id,
+                result.providerSequence,
+                sequenceBeforeProviderSpawn
+              ) ?? null
+            if (runtimeSequenceBeforeReconcile > sequenceBeforeProviderSpawn) {
+              snapshotKittyFlagsCoverReconciledSeq = false
+            }
           }
           ensureWslHookRelayForReattach(result, args.connectionId)
           runtime?.preparePtyExecutionContext?.(
@@ -5115,6 +5160,7 @@ export function registerPtyHandlers(
               reattached: true,
               startedAt: codexHomeLaunchStartedAt,
               startedSequence: codexHomeLaunchStartedSequence,
+              ...codexReattachedHomeRouteField(reattachedCodexHomeRoutes, result.id, true),
               ...(env ? { launchEnv: env } : {})
             })
           }
@@ -5181,15 +5227,19 @@ export function registerPtyHandlers(
               leafId: hostSessionBinding.leafId,
               ptyId: result.id,
               ...(result.incarnationId ? { incarnationId: result.incarnationId } : {}),
-              ...(cwd ? { startupCwd: cwd } : {})
+              ...(cwd ? { startupCwd: cwd } : {}),
+              ...(hostSessionBinding.expectedSourceBinding
+                ? { expectedSourceBinding: hostSessionBinding.expectedSourceBinding }
+                : {})
             }
-            if (args.connectionId) {
-              hostSessionBinding.store.persistPtyBinding(
-                binding,
-                toSshExecutionHostId(args.connectionId)
-              )
-            } else {
-              hostSessionBinding.store.persistPtyBinding(binding)
+            const persisted = args.connectionId
+              ? hostSessionBinding.store.persistPtyBinding(
+                  binding,
+                  toSshExecutionHostId(args.connectionId)
+                )
+              : hostSessionBinding.store.persistPtyBinding(binding)
+            if (persisted === false) {
+              throw new Error('terminal_split_source_not_found')
             }
           } catch (err) {
             console.error('[pty] failed to persist runtime PTY binding after spawn:', err)
@@ -5202,6 +5252,9 @@ export function registerPtyHandlers(
               }
               clearProviderPtyState(result.id)
             }
+            if (err instanceof Error && err.message === 'terminal_split_source_not_found') {
+              throw err
+            }
             throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage()), {
               agentSessionOperationOutcome: 'unknown' as const
             })
@@ -5288,6 +5341,11 @@ export function registerPtyHandlers(
             codexHomePath: selectedCodexHomePath,
             startedAt: codexHomeLaunchStartedAt,
             startedSequence: codexHomeLaunchStartedSequence,
+            ...codexReattachedHomeRouteField(
+              reattachedCodexHomeRoutes,
+              result.id,
+              result.isReattach === true
+            ),
             ...(result.isReattach === true ? { reattached: true } : env ? { launchEnv: env } : {})
           })
         }
@@ -5307,6 +5365,11 @@ export function registerPtyHandlers(
         }
         resolvePaneSpawnReservation(paneSpawnReservationKey, paneSpawnReservation, {
           ...result,
+          ...(typeof result.snapshotKittyKeyboardFlags === 'number' &&
+          reconciledSnapshotSeq !== null &&
+          snapshotKittyFlagsCoverReconciledSeq
+            ? { snapshotSeq: reconciledSnapshotSeq }
+            : { snapshotKittyKeyboardFlags: undefined }),
           isReattach: true
         })
         return response
@@ -5672,6 +5735,7 @@ export function registerPtyHandlers(
       args: { id?: unknown; opts?: { scrollbackRows?: unknown } }
     ): Promise<{
       data: string
+      frameRestoreAnsi?: string
       cols: number
       rows: number
       cwd?: string | null
@@ -5682,6 +5746,7 @@ export function registerPtyHandlers(
       alternateScreen?: boolean
       scrollbackAnsi?: string
       pendingEscapeTailAnsi?: string
+      kittyKeyboardFlags?: number
     } | null> => {
       if (!runtime || typeof args?.id !== 'string' || args.id.length === 0) {
         return null
@@ -5785,88 +5850,45 @@ export function registerPtyHandlers(
     ) => {
       const codexHomeLaunchStartedAt = !args.connectionId ? new Date() : undefined
       const codexHomeLaunchStartedSequence = !args.connectionId ? ++ptyLifecycleSequence : undefined
+      const initialLeafId =
+        typeof args.leafId === 'string' && isTerminalLeafId(args.leafId) ? args.leafId : null
+      const initialPaneKey =
+        typeof args.worktreeId === 'string' &&
+        typeof args.tabId === 'string' &&
+        isValidTerminalTabId(args.tabId) &&
+        args.tabId.length <= 512 &&
+        initialLeafId
+          ? makePaneKey(args.tabId, initialLeafId)
+          : null
+      const initialStablePanePtyId = (() => {
+        try {
+          return !args.connectionId && initialPaneKey
+            ? resolveStablePaneOwner(
+                runtime,
+                store,
+                initialPaneKey,
+                args.worktreeId,
+                args.connectionId
+              )?.ptyId
+            : undefined
+        } catch {
+          return undefined
+        }
+      })()
+      const reattachedCodexHomeRoutes = !args.connectionId
+        ? snapshotCodexPaneHomeRoutes([
+            initialStablePanePtyId,
+            args.sessionId ? getAppPtyId(args.connectionId, args.sessionId) : undefined
+          ])
+        : new Map<string, CodexPaneHomeRoute | null>()
       const spawnTiming = createPtySpawnTiming()
       const startupPromise = getLocalPtyStartupPromise(args.connectionId)
       if (startupPromise) {
         await startupPromise
       }
-      // Why: honor the fallback only for fresh local spawns — reattach needs exact cwd and SSH can't probe the local filesystem.
-      const requestedMissingCwdFallback =
-        !args.connectionId && !args.sessionId && args.cwdFallback === 'worktree'
-      const isWslOwnedPosixCwd =
-        args.cwd?.startsWith('/') === true && !/^\/[A-Za-z](?:\/|$)/.test(args.cwd)
-      const startupWorkspaceCwd =
-        requestedMissingCwdFallback && isWslOwnedPosixCwd
-          ? resolvePtySpawnStartupCwd(args.worktreeId, '.')
-          : undefined
-      const initiallyResolvedStartupCwd =
-        requestedMissingCwdFallback && isWslOwnedPosixCwd
-          ? resolvePtySpawnStartupCwd(args.worktreeId, args.cwd)
-          : undefined
-      const startupTerminalRuntimeOptions =
-        requestedMissingCwdFallback && process.platform === 'win32'
-          ? resolveLocalWindowsTerminalRuntimeOptions({
-              requestedShellOverride: args.shellOverride,
-              settings: getSettings?.(),
-              projectRuntime: args.projectRuntime,
-              fallbackHostShell: process.env.COMSPEC || 'powershell.exe'
-            })
-          : undefined
-      const wslRuntimeOwnsStartupCwd =
-        requestedMissingCwdFallback &&
-        isWslOwnedPosixCwd &&
-        (isWslShellName(startupTerminalRuntimeOptions?.shellOverride) ||
-          isWslUncPath(startupWorkspaceCwd ?? ''))
-      const startupWslContext = wslRuntimeOwnsStartupCwd
-        ? resolveWslSessionContext({
-            cwd: startupWorkspaceCwd,
-            shellOverride: startupTerminalRuntimeOptions?.shellOverride,
-            terminalWindowsWslDistro: startupTerminalRuntimeOptions?.terminalWindowsWslDistro
-          })
-        : undefined
-      let wslStartupCwdExists: boolean | null = null
-      let wslWorkspaceCwdExists: boolean | null = null
-      if (startupWslContext && initiallyResolvedStartupCwd) {
-        const validationCwd = toWindowsWslPath(
-          initiallyResolvedStartupCwd,
-          startupWslContext.distro
-        )
-        wslStartupCwdExists = isWslUncPath(validationCwd)
-          ? await wslUncDirectoryExistsAsync(validationCwd)
-          : localStartupCwdDirectoryExists(validationCwd)
-        if (wslStartupCwdExists === false && startupWorkspaceCwd) {
-          wslWorkspaceCwdExists = isWslUncPath(startupWorkspaceCwd)
-            ? await wslUncDirectoryExistsAsync(startupWorkspaceCwd)
-            : localStartupCwdDirectoryExists(startupWorkspaceCwd)
-        }
-      }
-      const allowMissingCwdFallback =
-        requestedMissingCwdFallback &&
-        (!wslRuntimeOwnsStartupCwd ||
-          (wslStartupCwdExists === false && wslWorkspaceCwdExists === true))
-      let didFallbackToWorkspaceRootCwd = false
-      const cwd = resolvePtySpawnStartupCwd(
-        args.worktreeId,
-        args.cwd,
-        allowMissingCwdFallback
-          ? {
-              directoryExists: (path) =>
-                startupWslContext &&
-                wslStartupCwdExists === false &&
-                path === initiallyResolvedStartupCwd
-                  ? false
-                  : startupWslContext && path === startupWorkspaceCwd
-                    ? wslWorkspaceCwdExists === true
-                    : localStartupCwdDirectoryExists(path),
-              onFallbackToWorkspaceRoot: () => {
-                didFallbackToWorkspaceRootCwd = true
-              }
-            }
-          : undefined
-      )
-      const startupCwdFallback =
-        didFallbackToWorkspaceRootCwd && cwd ? ({ kind: 'worktree', cwd } as const) : undefined
-      spawnTiming.mark('preflight')
+      let cwd = resolvePtySpawnStartupCwd(args.worktreeId, args.cwd)
+      let prevalidatedCwd: string | undefined
+      let startupCwdFallback: { kind: 'worktree'; cwd: string } | undefined
       const earlyLeafId =
         typeof args.leafId === 'string' && isTerminalLeafId(args.leafId) ? args.leafId : null
       const earlyPaneKey =
@@ -5910,6 +5932,15 @@ export function registerPtyHandlers(
       let stablePaneBindingPersisted = false
       let rejectedRegistrationCandidate: PtySpawnResult | null = null
       let pendingRegistrationPtyId: string | null = null
+      // Why hoisted to the reply scope: main reconciles the provider sequence
+      // deep inside the spawn path, but the pane needs that renderer-domain
+      // boundary beside the daemon snapshot's kitty flags.
+      let reconciledSnapshotSeq: number | null = null
+      // False when bytes crossed the data socket during the spawn RPC: the
+      // reconciled boundary covers them, but the daemon proved its kitty flags
+      // before they existed, so the claim must not erase what the pane may
+      // have scanned from those bytes live.
+      let snapshotKittyFlagsCoverReconciledSeq = true
       let preparedProvisionalExecutionContext = false
       let releaseWorktreeSpawn: (() => void) | undefined
       try {
@@ -5917,6 +5948,7 @@ export function registerPtyHandlers(
           await assertFolderWorkspacePtyPathUsable(args.worktreeId)
         }
         const provider = getProvider(args.connectionId)
+        spawnTiming.mark('stable_adoption_setup')
         const preAdoptedStablePane =
           earlyStablePaneOwner && earlyWorktreeId
             ? await adoptStablePane({
@@ -5930,9 +5962,97 @@ export function registerPtyHandlers(
                 ownsPaneSpawnReservation: true
               })
             : null
+        spawnTiming.mark('stable_adoption')
         if (earlyStablePaneOwner && !preAdoptedStablePane) {
           await assertFolderWorkspacePtyPathUsable(args.worktreeId)
         }
+        if (!preAdoptedStablePane) {
+          // Why: reattach needs exact cwd, SSH cannot probe locally, and successful stable-pane adoption needs no launch preflight.
+          const requestedMissingCwdFallback =
+            !args.connectionId && !args.sessionId && args.cwdFallback === 'worktree'
+          const isPosixStartupCwd = args.cwd?.startsWith('/') === true
+          const startupWorkspaceCwd =
+            requestedMissingCwdFallback && isPosixStartupCwd
+              ? resolvePtySpawnStartupCwd(args.worktreeId, '.')
+              : undefined
+          const initiallyResolvedStartupCwd =
+            requestedMissingCwdFallback && isPosixStartupCwd ? cwd : undefined
+          const startupTerminalRuntimeOptions =
+            requestedMissingCwdFallback && process.platform === 'win32'
+              ? resolveLocalWindowsTerminalRuntimeOptions({
+                  requestedShellOverride: args.shellOverride,
+                  settings: getSettings?.(),
+                  projectRuntime: args.projectRuntime,
+                  fallbackHostShell: process.env.COMSPEC || 'powershell.exe'
+                })
+              : undefined
+          const wslRuntimeOwnsStartupCwd =
+            requestedMissingCwdFallback &&
+            isPosixStartupCwd &&
+            (isWslShellName(startupTerminalRuntimeOptions?.shellOverride) ||
+              isWslUncPath(startupWorkspaceCwd ?? ''))
+          const startupWslContext = wslRuntimeOwnsStartupCwd
+            ? resolveWslSessionContext({
+                cwd: startupWorkspaceCwd,
+                shellOverride: startupTerminalRuntimeOptions?.shellOverride,
+                terminalWindowsWslDistro: startupTerminalRuntimeOptions?.terminalWindowsWslDistro
+              })
+            : undefined
+          let wslStartupCwdExists: boolean | null = null
+          let wslWorkspaceCwdExists: boolean | null = null
+          if (startupWslContext && initiallyResolvedStartupCwd) {
+            const validationCwd = toWindowsWslPath(
+              initiallyResolvedStartupCwd,
+              startupWslContext.distro
+            )
+            wslStartupCwdExists = isWslUncPath(validationCwd)
+              ? await wslUncDirectoryExistsAsync(validationCwd)
+              : localStartupCwdDirectoryExists(validationCwd)
+            if (wslStartupCwdExists === true) {
+              prevalidatedCwd = validationCwd
+            }
+            if (wslStartupCwdExists === false && startupWorkspaceCwd) {
+              wslWorkspaceCwdExists = isWslUncPath(startupWorkspaceCwd)
+                ? await wslUncDirectoryExistsAsync(startupWorkspaceCwd)
+                : localStartupCwdDirectoryExists(startupWorkspaceCwd)
+              if (wslWorkspaceCwdExists === true) {
+                prevalidatedCwd = startupWorkspaceCwd
+              }
+            }
+          }
+          const allowMissingCwdFallback =
+            requestedMissingCwdFallback &&
+            (!wslRuntimeOwnsStartupCwd ||
+              (wslStartupCwdExists === false && wslWorkspaceCwdExists === true))
+          let didFallbackToWorkspaceRootCwd = false
+          cwd = resolvePtySpawnStartupCwd(
+            args.worktreeId,
+            args.cwd,
+            allowMissingCwdFallback
+              ? {
+                  directoryExists: (path) =>
+                    startupWslContext &&
+                    wslStartupCwdExists === false &&
+                    path === initiallyResolvedStartupCwd
+                      ? false
+                      : startupWslContext && path === startupWorkspaceCwd
+                        ? wslWorkspaceCwdExists === true
+                        : localStartupCwdDirectoryExists(
+                            process.platform === 'win32' ? normalizeWindowsTerminalCwd(path) : path
+                          ),
+                  onFallbackToWorkspaceRoot: () => {
+                    didFallbackToWorkspaceRootCwd = true
+                  }
+                }
+              : undefined
+          )
+          if (didFallbackToWorkspaceRootCwd && wslWorkspaceCwdExists === true && cwd) {
+            prevalidatedCwd = cwd
+          }
+          startupCwdFallback =
+            didFallbackToWorkspaceRootCwd && cwd ? { kind: 'worktree', cwd } : undefined
+        }
+        spawnTiming.mark('preflight')
         const freshSpawnRecovery = preAdoptedStablePane
           ? undefined
           : recoverFreshSpawnProviderRouting(provider, args.connectionId, args.sessionId)
@@ -6271,6 +6391,7 @@ export function registerPtyHandlers(
           cols: args.cols,
           rows: args.rows,
           cwd,
+          ...(prevalidatedCwd && !isDaemonHostSpawn ? { prevalidatedCwd } : {}),
           env: spawnEnv,
           ...(isMintedSessionId ? { isNewSession: true } : {})
         }
@@ -6440,11 +6561,19 @@ export function registerPtyHandlers(
           assertSpawnReplyWasLive(result)
           runtime?.assertPtyRegistrationAllowed?.(result.id, result.incarnationId)
           if (result.providerSequence) {
-            runtime?.synchronizePtyOutputSequenceFromProvider?.(
-              result.id,
-              result.providerSequence,
-              sequenceBeforeProviderSpawn
-            )
+            const runtimeSequenceBeforeReconcile = runtime?.getPtyOutputSequence?.(result.id) ?? 0
+            // Why kept: this is the reattach boundary in the RENDERER's sequence
+            // domain, and the daemon snapshot's kitty flags mean nothing without
+            // the boundary they were proven at.
+            reconciledSnapshotSeq =
+              runtime?.synchronizePtyOutputSequenceFromProvider?.(
+                result.id,
+                result.providerSequence,
+                sequenceBeforeProviderSpawn
+              ) ?? null
+            if (runtimeSequenceBeforeReconcile > sequenceBeforeProviderSpawn) {
+              snapshotKittyFlagsCoverReconciledSeq = false
+            }
           }
           ensureWslHookRelayForReattach(result, args.connectionId)
           runtime?.preparePtyExecutionContext?.(
@@ -6820,6 +6949,13 @@ export function registerPtyHandlers(
         }
         const response = {
           ...result,
+          // Why both or neither: a pane can only adopt proven kitty flags together
+          // with the sequence boundary they describe.
+          ...(typeof result.snapshotKittyKeyboardFlags === 'number' &&
+          reconciledSnapshotSeq !== null &&
+          snapshotKittyFlagsCoverReconciledSeq
+            ? { snapshotSeq: reconciledSnapshotSeq }
+            : { snapshotKittyKeyboardFlags: undefined }),
           ...(!result.isReattach && effectiveLaunchConfig
             ? { launchConfig: effectiveLaunchConfig }
             : {}),
@@ -6839,6 +6975,11 @@ export function registerPtyHandlers(
             codexHomePath: selectedCodexHomePath,
             startedAt: codexHomeLaunchStartedAt,
             startedSequence: codexHomeLaunchStartedSequence,
+            ...codexReattachedHomeRouteField(
+              reattachedCodexHomeRoutes,
+              result.id,
+              result.isReattach === true
+            ),
             ...(result.isReattach === true
               ? { reattached: true }
               : baseEnv
diff --git a/src/main/ipc/register-core-handlers.test.ts b/src/main/ipc/register-core-handlers.test.ts
index 55043e2b526..9bee285bff4 100644
--- a/src/main/ipc/register-core-handlers.test.ts
+++ b/src/main/ipc/register-core-handlers.test.ts
@@ -6,9 +6,7 @@ const {
   callRuntimeEnvironmentMock,
   registerCliHandlersMock,
   registerPreflightHandlersMock,
-  registerClaudeUsageHandlersMock,
-  registerCodexUsageHandlersMock,
-  registerOpenCodeUsageHandlersMock,
+  registerUsageProviderHandlersMock,
   registerGitHubHandlersMock,
   registerFeedbackHandlersMock,
   registerStatsHandlersMock,
@@ -50,6 +48,7 @@ const {
   registerAppHandlersMock,
   registerLinearHandlersMock,
   registerJiraHandlersMock,
+  registerBitbucketHandlersMock,
   registerGitLabHandlersMock,
   registerHostedReviewHandlersMock,
   registerExportHandlersMock,
@@ -72,9 +71,7 @@ const {
   callRuntimeEnvironmentMock: vi.fn(),
   registerCliHandlersMock: vi.fn(),
   registerPreflightHandlersMock: vi.fn(),
-  registerClaudeUsageHandlersMock: vi.fn(),
-  registerCodexUsageHandlersMock: vi.fn(),
-  registerOpenCodeUsageHandlersMock: vi.fn(),
+  registerUsageProviderHandlersMock: vi.fn(),
   registerGitHubHandlersMock: vi.fn(),
   registerFeedbackHandlersMock: vi.fn(),
   registerStatsHandlersMock: vi.fn(),
@@ -116,6 +113,7 @@ const {
   registerAppHandlersMock: vi.fn(),
   registerLinearHandlersMock: vi.fn(),
   registerJiraHandlersMock: vi.fn(),
+  registerBitbucketHandlersMock: vi.fn(),
   registerGitLabHandlersMock: vi.fn(),
   registerHostedReviewHandlersMock: vi.fn(),
   registerExportHandlersMock: vi.fn(),
@@ -180,16 +178,8 @@ vi.mock('./preflight', () => ({
   registerPreflightHandlers: registerPreflightHandlersMock
 }))
 
-vi.mock('./claude-usage', () => ({
-  registerClaudeUsageHandlers: registerClaudeUsageHandlersMock
-}))
-
-vi.mock('./codex-usage', () => ({
-  registerCodexUsageHandlers: registerCodexUsageHandlersMock
-}))
-
-vi.mock('./opencode-usage', () => ({
-  registerOpenCodeUsageHandlers: registerOpenCodeUsageHandlersMock
+vi.mock('./usage-provider-handlers', () => ({
+  registerUsageProviderHandlers: registerUsageProviderHandlersMock
 }))
 
 vi.mock('./github', () => ({
@@ -372,6 +362,10 @@ vi.mock('./jira', () => ({
   registerJiraHandlers: registerJiraHandlersMock
 }))
 
+vi.mock('./bitbucket', () => ({
+  registerBitbucketHandlers: registerBitbucketHandlersMock
+}))
+
 vi.mock('./gitlab', () => ({
   registerGitLabHandlers: registerGitLabHandlersMock
 }))
@@ -395,9 +389,7 @@ describe('registerCoreHandlers', () => {
     callRuntimeEnvironmentMock.mockReset()
     registerCliHandlersMock.mockReset()
     registerPreflightHandlersMock.mockReset()
-    registerClaudeUsageHandlersMock.mockReset()
-    registerCodexUsageHandlersMock.mockReset()
-    registerOpenCodeUsageHandlersMock.mockReset()
+    registerUsageProviderHandlersMock.mockReset()
     registerGitHubHandlersMock.mockReset()
     registerFeedbackHandlersMock.mockReset()
     registerStatsHandlersMock.mockReset()
@@ -438,6 +430,7 @@ describe('registerCoreHandlers', () => {
     registerAppHandlersMock.mockReset()
     registerLinearHandlersMock.mockReset()
     registerJiraHandlersMock.mockReset()
+    registerBitbucketHandlersMock.mockReset()
     registerGitLabHandlersMock.mockReset()
     registerHostedReviewHandlersMock.mockReset()
     registerExportHandlersMock.mockReset()
@@ -494,9 +487,11 @@ describe('registerCoreHandlers', () => {
       result: { sessions: 'bad-shape' }
     })
 
-    expect(registerClaudeUsageHandlersMock).toHaveBeenCalledWith(claudeUsage)
-    expect(registerCodexUsageHandlersMock).toHaveBeenCalledWith(codexUsage)
-    expect(registerOpenCodeUsageHandlersMock).toHaveBeenCalledWith(openCodeUsage)
+    expect(registerUsageProviderHandlersMock).toHaveBeenCalledWith({
+      claudeUsage,
+      codexUsage,
+      openCodeUsage
+    })
     expect(registerAppHandlersMock).toHaveBeenCalledWith(store, { onBeforeRelaunch })
     expect(registerCodexAccountHandlersMock).toHaveBeenCalledWith(
       codexAccounts,
@@ -516,6 +511,7 @@ describe('registerCoreHandlers', () => {
     expect(registerGitHubHandlersMock).toHaveBeenCalledWith(store, stats)
     expect(registerLinearHandlersMock).toHaveBeenCalled()
     expect(registerJiraHandlersMock).toHaveBeenCalled()
+    expect(registerBitbucketHandlersMock).toHaveBeenCalled()
     expect(registerGitLabHandlersMock).toHaveBeenCalledWith(store)
     expect(registerHostedReviewHandlersMock).toHaveBeenCalledWith(store, stats)
     expect(registerFeedbackHandlersMock).toHaveBeenCalled()
diff --git a/src/main/ipc/register-core-handlers.ts b/src/main/ipc/register-core-handlers.ts
index 607aa08ce3e..7825e73c57e 100644
--- a/src/main/ipc/register-core-handlers.ts
+++ b/src/main/ipc/register-core-handlers.ts
@@ -8,14 +8,13 @@ import type { StatsCollector } from '../stats/collector'
 import { registerFilesystemHandlers } from './filesystem'
 import type { CommitMessageAgentEnvironmentResolvers } from '../text-generation/commit-message-agent-environment'
 import { registerFilesystemWatcherHandlers } from './filesystem-watcher'
-import { registerClaudeUsageHandlers } from './claude-usage'
-import { registerCodexUsageHandlers } from './codex-usage'
-import { registerOpenCodeUsageHandlers } from './opencode-usage'
+import { registerUsageProviderHandlers } from './usage-provider-handlers'
 import { registerGitHubHandlers } from './github'
 import { registerGitLabHandlers } from './gitlab'
 import { registerHostedReviewHandlers } from './hosted-review'
 import { registerLinearHandlers } from './linear'
 import { registerJiraHandlers } from './jira'
+import { registerBitbucketHandlers } from './bitbucket'
 import { registerFeedbackHandlers } from './feedback'
 import { registerCrashReportingHandlers } from './crash-reporting'
 import { registerExportHandlers } from './export'
@@ -143,9 +142,7 @@ export function registerCoreHandlers(
   registerAppHandlers(store, { onBeforeRelaunch: lifecycleOptions.onBeforeRelaunch })
   registerCliHandlers()
   registerPreflightHandlers()
-  registerClaudeUsageHandlers(claudeUsage)
-  registerCodexUsageHandlers(codexUsage)
-  registerOpenCodeUsageHandlers(openCodeUsage)
+  registerUsageProviderHandlers({ claudeUsage, codexUsage, openCodeUsage })
   registerCodexAccountHandlers(codexAccounts, () => store.getSettings())
   registerAgentHookHandlers(runtime, { getPtyIdForPaneKey })
   registerCodexConfigSyncHandlers(codexAccounts.runtimeHomeService)
@@ -159,6 +156,7 @@ export function registerCoreHandlers(
   registerHostedReviewHandlers(store, stats)
   registerLinearHandlers()
   registerJiraHandlers()
+  registerBitbucketHandlers()
   registerFeedbackHandlers()
   if (crashReports) {
     registerCrashReportingHandlers(crashReports)
diff --git a/src/main/ipc/repos-remote.test.ts b/src/main/ipc/repos-remote.test.ts
index b6ec0118a61..d3440ed4579 100644
--- a/src/main/ipc/repos-remote.test.ts
+++ b/src/main/ipc/repos-remote.test.ts
@@ -18,6 +18,7 @@ const {
   mockFilesystemProvider,
   mockMultiplexer,
   gitExecFileAsyncMock,
+  gitSpawnAfterWindowsEnvironmentReadyMock,
   gitSpawnMock,
   listWorktreeGraphMock,
   invalidateAuthorizedRootsCacheMock,
@@ -69,6 +70,7 @@ const {
     notify: vi.fn()
   },
   gitSpawnMock: vi.fn(),
+  gitSpawnAfterWindowsEnvironmentReadyMock: vi.fn(),
   gitExecFileAsyncMock: vi.fn(),
   listWorktreeGraphMock: vi.fn(),
   invalidateAuthorizedRootsCacheMock: vi.fn(),
@@ -104,7 +106,8 @@ vi.mock('../git/runner', async () => ({
   gitExecFileAsync: gitExecFileAsyncMock,
   gitExecFileAsyncBuffer: vi.fn(),
   gitStreamStdout: vi.fn(),
-  gitSpawn: gitSpawnMock
+  gitSpawn: gitSpawnMock,
+  gitSpawnAfterWindowsEnvironmentReady: gitSpawnAfterWindowsEnvironmentReadyMock
 }))
 
 vi.mock('../git/worktree', () => ({
@@ -1149,7 +1152,7 @@ describe('repos:addRemote', () => {
     gitSpawnMock.mockImplementation(() => {
       const proc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
       proc.stderr = new EventEmitter()
-      queueMicrotask(() => proc.emit('close', 0, null))
+      setImmediate(() => proc.emit('close', 0, null))
       return proc
     })
     mockWindow.webContents.send.mockReset()
@@ -1849,11 +1852,14 @@ describe('repos:add + repos:clone', () => {
     mockStore.updateProjectHostSetup.mockReset()
     mockWindow.webContents.send.mockReset()
     gitSpawnMock.mockReset()
+    gitSpawnAfterWindowsEnvironmentReadyMock
+      .mockReset()
+      .mockImplementation(async (...args) => gitSpawnMock(...args))
     invalidateAuthorizedRootsCacheMock.mockReset()
     prepareLocalWorktreeRootForRepoMock.mockReset().mockResolvedValue(undefined)
     gitSpawnMock.mockImplementation(() => {
       const proc = createMockCloneProcess()
-      queueMicrotask(() => proc.emit('close', 0, null))
+      setImmediate(() => proc.emit('close', 0, null))
       return proc
     })
 
@@ -2243,7 +2249,7 @@ describe('repos:add + repos:clone', () => {
     )
     gitSpawnMock.mockImplementationOnce(() => {
       const proc = createMockCloneProcess()
-      queueMicrotask(() => {
+      setImmediate(() => {
         cloned = true
         proc.emit('close', 0, null)
       })
@@ -2390,6 +2396,84 @@ describe('repos:add + repos:clone', () => {
     await expect(handlers.get('repos:cloneAbort')!(null, undefined)).resolves.toBeUndefined()
   })
 
+  it('cancels a local clone before Git starts when environment readiness is pending', async () => {
+    const destination = await createTempRoot()
+    const clonePath = join(destination, 'orca')
+    gitSpawnAfterWindowsEnvironmentReadyMock.mockImplementation(
+      (_args: string[], options: { signal?: AbortSignal }) =>
+        new Promise((_resolve, reject) => {
+          const abort = (): void => {
+            reject(Object.assign(new Error('The operation was aborted'), { name: 'AbortError' }))
+          }
+          if (options.signal?.aborted) {
+            abort()
+          } else {
+            options.signal?.addEventListener('abort', abort, { once: true })
+          }
+        })
+    )
+
+    const clonePromise = Promise.resolve(
+      handlers.get('repos:clone')!(null, {
+        url: 'https://example.com/orca.git',
+        destination
+      })
+    )
+    const rejection = expect(clonePromise).rejects.toThrow('Clone failed')
+    await waitForAssertion(() =>
+      expect(gitSpawnAfterWindowsEnvironmentReadyMock).toHaveBeenCalledOnce()
+    )
+    expect(gitSpawnMock).not.toHaveBeenCalled()
+
+    await handlers.get('repos:cloneAbort')!(null, undefined)
+    await rejection
+    expect(gitSpawnMock).not.toHaveBeenCalled()
+    expect(existsSync(clonePath)).toBe(false)
+  })
+
+  it('cancels every concurrent local clone waiting for environment readiness', async () => {
+    const firstDestination = await createTempRoot()
+    const secondDestination = await createTempRoot()
+    gitSpawnAfterWindowsEnvironmentReadyMock.mockImplementation(
+      (_args: string[], options: { signal?: AbortSignal }) =>
+        new Promise((_resolve, reject) => {
+          const abort = (): void => {
+            reject(Object.assign(new Error('The operation was aborted'), { name: 'AbortError' }))
+          }
+          if (options.signal?.aborted) {
+            abort()
+          } else {
+            options.signal?.addEventListener('abort', abort, { once: true })
+          }
+        })
+    )
+
+    const firstClone = Promise.resolve(
+      handlers.get('repos:clone')!(null, {
+        url: 'https://example.com/first.git',
+        destination: firstDestination
+      })
+    )
+    const secondClone = Promise.resolve(
+      handlers.get('repos:clone')!(null, {
+        url: 'https://example.com/second.git',
+        destination: secondDestination
+      })
+    )
+    const firstRejection = expect(firstClone).rejects.toThrow('Clone failed')
+    const secondRejection = expect(secondClone).rejects.toThrow('Clone failed')
+    await waitForAssertion(() =>
+      expect(gitSpawnAfterWindowsEnvironmentReadyMock).toHaveBeenCalledTimes(2)
+    )
+
+    await handlers.get('repos:cloneAbort')!(null, undefined)
+
+    await Promise.all([firstRejection, secondRejection])
+    expect(gitSpawnMock).not.toHaveBeenCalled()
+    expect(existsSync(join(firstDestination, 'first'))).toBe(false)
+    expect(existsSync(join(secondDestination, 'second'))).toBe(false)
+  })
+
   it('does not remove an existing target directory when aborting a pending clone', async () => {
     const destination = await createTempRoot()
     const clonePath = join(destination, 'orca')
diff --git a/src/main/ipc/repos.ts b/src/main/ipc/repos.ts
index bb1d8e6ff69..9fe387805d3 100644
--- a/src/main/ipc/repos.ts
+++ b/src/main/ipc/repos.ts
@@ -41,10 +41,16 @@ import { isTuiAgent } from '../../shared/tui-agent-config'
 import { TaskSourceContextSchema } from '../../shared/task-source-context-schema'
 import { WorkspaceLinkedItemSchema } from '../../shared/workspace-linked-item-schema'
 import { isWorkspaceLinkedItemSourceContextMatch } from '../../shared/workspace-linked-item-source-context'
+import { DiffCommentSchema } from '../../shared/diff-comment-schema'
 import { invalidateAuthorizedRootsCache } from './filesystem-auth'
 import type { ChildProcess } from 'node:child_process'
 import { access, mkdir, readdir, rm } from 'node:fs/promises'
-import { gitExecFileAsync, gitSpawn, nonInteractiveGitEnv } from '../git/runner'
+import {
+  awaitWindowsHostGitEnvironmentReady,
+  gitExecFileAsync,
+  gitSpawnAfterWindowsEnvironmentReady,
+  nonInteractiveGitEnv
+} from '../git/runner'
 import { isAbsolute, join, posix } from 'node:path'
 import {
   cleanupClaimedCloneTarget,
@@ -283,6 +289,9 @@ async function addLocalRepoFromPath(
   kind: 'git' | 'folder' = 'git'
 ): Promise<{ repo: Repo; alreadyExisted: boolean } | { error: string }> {
   const repoKind = kind === 'folder' ? 'folder' : 'git'
+  if (repoKind === 'git') {
+    await awaitWindowsHostGitEnvironmentReady({ cwd: path })
+  }
   if (repoKind === 'git' && !isGitRepo(path)) {
     return { error: `Not a valid git repository: ${path}` }
   }
@@ -762,6 +771,7 @@ export function setRepoRemoteClientNotifier(notifier: RepoRemoteClientNotifier):
 
 // Why: module-scoped so the abort handle survives macOS window re-creation, when registerRepoHandlers re-runs.
 let activeClone: ActiveCloneMetadata | null = null
+const pendingLocalCloneControllers = new Set<AbortController>()
 let activeRemoteClone: ActiveRemoteCloneMetadata | null = null
 let nextCloneGeneration = 1
 const latestCloneGenerationByPath = new Map<string, number>()
@@ -942,7 +952,8 @@ const FolderWorkspaceUpdateArgs = z.object({
       createdWithAgent: z.string().refine(isTuiAgent).optional(),
       pendingFirstAgentMessageRename: z.boolean().optional(),
       firstAgentMessageRenameError: z.string().nullable().optional(),
-      lastActivityAt: z.number().finite().optional()
+      lastActivityAt: z.number().finite().optional(),
+      diffComments: z.array(DiffCommentSchema).optional()
     })
     .superRefine(assertFolderWorkspaceLinkedSourceContextMatch)
 })
@@ -1169,6 +1180,10 @@ async function scanNestedReposForIpc(args: {
 }): Promise<NestedRepoScanResult> {
   validateNestedRepoScanRoot(args.path, args.connectionId)
   if (!args.connectionId) {
+    await awaitWindowsHostGitEnvironmentReady({
+      cwd: args.path,
+      ...(args.signal ? { signal: args.signal } : {})
+    })
     return scanNestedRepos({
       path: args.path,
       options: args.options,
@@ -1507,7 +1522,10 @@ export function registerRepoHandlers(mainWindow: BrowserWindow, store: Store): v
         { getSshFilesystemProvider }
       )
       assertFolderWorkspacePathUsable(status)
-      const workspace = store.createFolderWorkspace(args)
+      const workspace = store.createFolderWorkspace({
+        ...args,
+        creatorProvenance: { kind: 'host' }
+      })
       notifyReposChanged(mainWindow)
       return workspace
     }
@@ -1699,10 +1717,16 @@ export function registerRepoHandlers(mainWindow: BrowserWindow, store: Store): v
               continue
             }
             importRepoPath = await importTargetResolver.resolveSsh(repoPath, gitProvider)
-          } else if (!isGitRepo(repoPath)) {
-            results.push({ path: repoPath, status: 'failed', error: 'Not a valid git repository' })
-            continue
           } else {
+            await awaitWindowsHostGitEnvironmentReady({ cwd: repoPath })
+            if (!isGitRepo(repoPath)) {
+              results.push({
+                path: repoPath,
+                status: 'failed',
+                error: 'Not a valid git repository'
+              })
+              continue
+            }
             importRepoPath = await importTargetResolver.resolveLocal(repoPath)
           }
           const normalizedImportRepoPath = normalizeRuntimePathForComparison(importRepoPath)
@@ -2322,6 +2346,10 @@ export function registerRepoHandlers(mainWindow: BrowserWindow, store: Store): v
   })
 
   ipcMain.handle('repos:cloneAbort', async () => {
+    for (const controller of pendingLocalCloneControllers) {
+      controller.abort()
+    }
+    pendingLocalCloneControllers.clear()
     if (activeClone) {
       const clone = activeClone
       clone.abortRequested = true
@@ -2358,24 +2386,30 @@ export function registerRepoHandlers(mainWindow: BrowserWindow, store: Store): v
         // Why: spawn (not execFile) avoids the maxBuffer limit — clone progress on stderr can exceed Node's 1 MB default.
         // Why: --progress forces git to emit progress even when stderr isn't a TTY.
         const cloneMetadataRef: { current: ActiveCloneMetadata | null } = { current: null }
-        await new Promise<void>((resolve, reject) => {
+        let proc: Awaited<ReturnType<typeof gitSpawnAfterWindowsEnvironmentReady>>
+        const pendingController = new AbortController()
+        pendingLocalCloneControllers.add(pendingController)
+        try {
           // Why: use the parent destination as cwd so the runner detects a WSL path and routes through wsl.exe.
           // Why: '--' isolates the URL so a malicious URL can't be read as git flags (command injection).
-          let proc: ReturnType<typeof gitSpawn>
-          try {
-            proc = gitSpawn(['clone', '--progress', '--', args.url, clonePath], {
+          proc = await gitSpawnAfterWindowsEnvironmentReady(
+            ['clone', '--progress', '--', args.url, clonePath],
+            {
               cwd: args.destination,
               // Why: without this, an auth-needing clone pops Git Credential Manager's OAuth window on Windows, unclosable in a restricted env (issue #7652).
               env: nonInteractiveGitEnv(),
+              signal: pendingController.signal,
               stdio: ['ignore', 'ignore', 'pipe']
-            })
-          } catch (err) {
-            void cleanupClaimedCloneTarget(clonePath, claimedTarget).finally(() => {
-              const message = err instanceof Error ? err.message : String(err)
-              reject(new Error(`Clone failed: ${message}`))
-            })
-            return
-          }
+            }
+          )
+        } catch (err) {
+          await cleanupClaimedCloneTarget(clonePath, claimedTarget)
+          const message = err instanceof Error ? err.message : String(err)
+          throw new Error(`Clone failed: ${message}`)
+        } finally {
+          pendingLocalCloneControllers.delete(pendingController)
+        }
+        await new Promise<void>((resolve, reject) => {
           const generation = nextCloneGeneration++
           latestCloneGenerationByPath.set(clonePathKey, generation)
           const metadata: ActiveCloneMetadata = {
diff --git a/src/main/ipc/runtime-environment-federated-read-routing.test.ts b/src/main/ipc/runtime-environment-federated-read-routing.test.ts
new file mode 100644
index 00000000000..09e649e73f5
--- /dev/null
+++ b/src/main/ipc/runtime-environment-federated-read-routing.test.ts
@@ -0,0 +1,173 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { encodePairingOffer } from '../../shared/pairing'
+import { REMOTE_RUNTIME_SHARED_CONTROL_CAPABILITY } from '../../shared/protocol-version'
+import { addEnvironmentFromPairingCode } from '../../shared/runtime-environment-store'
+
+const { sendRemoteRuntimeRequestMock, sendRemoteRuntimeSharedControlRequestMock } = vi.hoisted(
+  () => ({
+    sendRemoteRuntimeRequestMock: vi.fn(),
+    sendRemoteRuntimeSharedControlRequestMock: vi.fn()
+  })
+)
+
+vi.mock('../../shared/remote-runtime-client', () => ({
+  sendRemoteRuntimeRequest: sendRemoteRuntimeRequestMock
+}))
+
+vi.mock('./runtime-environment-request-connections', () => ({
+  sendRemoteRuntimeConnectionRequest: vi.fn(),
+  sendRemoteRuntimeSharedControlRequest: sendRemoteRuntimeSharedControlRequestMock,
+  reconnectRemoteRuntimeSharedControlConnection: vi.fn()
+}))
+
+import {
+  callRuntimeEnvironment,
+  resetSharedControlSupport
+} from './runtime-environment-transport-routing'
+
+describe('federated read RPC transport routing', () => {
+  let userDataPath: string
+  let environmentId: string
+
+  beforeEach(() => {
+    userDataPath = mkdtempSync(join(tmpdir(), 'orca-federated-read-routing-'))
+    environmentId = addEnvironmentFromPairingCode(userDataPath, {
+      name: 'worker',
+      pairingCode: encodePairingOffer({
+        v: 2,
+        endpoint: 'ws://127.0.0.1:6768',
+        deviceToken: 'device-token',
+        publicKeyB64: Buffer.from(new Uint8Array(32).fill(1)).toString('base64')
+      })
+    }).id
+    resetSharedControlSupport()
+    sendRemoteRuntimeRequestMock.mockReset()
+    sendRemoteRuntimeSharedControlRequestMock.mockReset()
+  })
+
+  afterEach(() => {
+    rmSync(userDataPath, { recursive: true, force: true })
+  })
+
+  it('routes an enveloped federation read over shared control with its authority intact', async () => {
+    const envelope = {
+      orchestrationCapability: 'capability',
+      orchestrationContractVersion: 1,
+      orchestrationRequestId: 'request-1',
+      compatibilityInvocationId: 'compatibility-1',
+      orchestrationCompatibilityEvidence: {
+        terminalHandle: 'term-1',
+        paneKey: 'pane-1',
+        launchToken: 'launch-1'
+      }
+    }
+    sendRemoteRuntimeRequestMock.mockResolvedValue({
+      id: 'status',
+      ok: true,
+      result: { capabilities: [REMOTE_RUNTIME_SHARED_CONTROL_CAPABILITY] },
+      _meta: { runtimeId: 'runtime-worker' }
+    })
+    sendRemoteRuntimeSharedControlRequestMock.mockResolvedValue({
+      id: 'pull',
+      ok: true,
+      result: { runtimeEpoch: 'runtime-worker', items: [] },
+      _meta: { runtimeId: 'runtime-worker' }
+    })
+
+    await expect(
+      callRuntimeEnvironment(
+        userDataPath,
+        environmentId,
+        'orchestration.federationPull',
+        { dispatchId: 'dispatch-1', afterSequence: 0, limit: 50 },
+        15_000,
+        undefined,
+        envelope
+      )
+    ).resolves.toMatchObject({ ok: true })
+
+    expect(sendRemoteRuntimeRequestMock.mock.calls.map((call) => call[1])).toEqual(['status.get'])
+    expect(sendRemoteRuntimeSharedControlRequestMock).toHaveBeenCalledWith(
+      environmentId,
+      expect.any(Object),
+      'orchestration.federationPull',
+      { dispatchId: 'dispatch-1', afterSequence: 0, limit: 50 },
+      15_000,
+      envelope
+    )
+  })
+
+  it('keeps enveloped federation mutations on the one-shot transport', async () => {
+    const envelope = { orchestrationContractVersion: 1, orchestrationRequestId: 'ack-1' }
+    sendRemoteRuntimeRequestMock.mockResolvedValue({
+      id: 'ack',
+      ok: true,
+      result: { acknowledgedThrough: 4 },
+      _meta: { runtimeId: 'runtime-worker' }
+    })
+
+    await callRuntimeEnvironment(
+      userDataPath,
+      environmentId,
+      'orchestration.federationAck',
+      { dispatchId: 'dispatch-1', throughSequence: 4 },
+      15_000,
+      undefined,
+      envelope
+    )
+
+    expect(sendRemoteRuntimeRequestMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      'orchestration.federationAck',
+      { dispatchId: 'dispatch-1', throughSequence: 4 },
+      15_000,
+      envelope
+    )
+    expect(sendRemoteRuntimeSharedControlRequestMock).not.toHaveBeenCalled()
+  })
+
+  it('falls back to one-shot with the envelope when shared control is unavailable', async () => {
+    const envelope = { orchestrationContractVersion: 1 }
+    sendRemoteRuntimeRequestMock.mockImplementation(async (_pairing, method) =>
+      method === 'status.get'
+        ? {
+            id: 'status',
+            ok: true,
+            result: { capabilities: [] },
+            _meta: { runtimeId: 'runtime-worker' }
+          }
+        : {
+            id: 'pull',
+            ok: true,
+            result: { runtimeEpoch: 'runtime-worker', items: [] },
+            _meta: { runtimeId: 'runtime-worker' }
+          }
+    )
+
+    await callRuntimeEnvironment(
+      userDataPath,
+      environmentId,
+      'orchestration.federationPull',
+      { dispatchId: 'dispatch-1', afterSequence: 0, limit: 50 },
+      15_000,
+      undefined,
+      envelope
+    )
+
+    expect(sendRemoteRuntimeRequestMock.mock.calls.map((call) => call[1])).toEqual([
+      'status.get',
+      'orchestration.federationPull'
+    ])
+    expect(sendRemoteRuntimeRequestMock).toHaveBeenLastCalledWith(
+      expect.any(Object),
+      'orchestration.federationPull',
+      { dispatchId: 'dispatch-1', afterSequence: 0, limit: 50 },
+      15_000,
+      envelope
+    )
+    expect(sendRemoteRuntimeSharedControlRequestMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ipc/runtime-environment-federated-read-transport.bench.test.ts b/src/main/ipc/runtime-environment-federated-read-transport.bench.test.ts
new file mode 100644
index 00000000000..2e6893ba4ea
--- /dev/null
+++ b/src/main/ipc/runtime-environment-federated-read-transport.bench.test.ts
@@ -0,0 +1,207 @@
+import { readFileSync } from 'node:fs'
+import { performance } from 'node:perf_hooks'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { sendRemoteRuntimeRequest } from '../../shared/remote-runtime-client'
+import { RemoteRuntimeSharedControlConnection } from '../../shared/remote-runtime-shared-control-connection'
+import { RuntimeEnvironmentStoreSchema } from '../../shared/runtime-environments'
+
+const runLiveBenchmark = isFederatedReadBenchmarkEnabled(process.env.ORCA_FEDERATED_READ_BENCH)
+
+it('interpolates even-sized benchmark samples', () => expect(percentile([1, 3], 0.5)).toBe(2))
+
+it.each([
+  ['1', true],
+  ['true', false],
+  [undefined, false]
+])('enables the live benchmark only for %s', (value, enabled) => {
+  expect(isFederatedReadBenchmarkEnabled(value)).toBe(enabled)
+})
+
+it('closes the retained connection after a measured request rejects', async () => {
+  let requestCount = 0
+  const fixture = createSharedControlFixture(async () => {
+    requestCount += 1
+    if (requestCount === 4) {
+      throw new Error('injected measured request failure')
+    }
+    return { ok: true }
+  })
+
+  await expect(measureSharedControlRequests(fixture.connection, {}, 1)).rejects.toThrow(
+    'injected measured request failure'
+  )
+
+  expect(requestCount).toBe(4)
+  expect.soft(fixture.close).toHaveBeenCalledOnce()
+  expect.soft(fixture.socketClose).toHaveBeenCalledOnce()
+  expect(fixture.retainedHandleCount()).toBe(0)
+})
+
+it('closes the retained connection after successful measurements', async () => {
+  const fixture = createSharedControlFixture(async () => ({ ok: true }))
+
+  await expect(measureSharedControlRequests(fixture.connection, {}, 1)).resolves.toMatchObject({
+    sharedControl: { count: 1 },
+    diagnostics: { state: 'ready', pendingRequestCount: 0 }
+  })
+
+  expect(fixture.close).toHaveBeenCalledOnce()
+  expect(fixture.socketClose).toHaveBeenCalledOnce()
+  expect(fixture.retainedHandleCount()).toBe(0)
+})
+
+describe.runIf(runLiveBenchmark)('federated read RPC transport benchmark', () => {
+  it('compares one-shot and shared-control latency on one saved runtime', async () => {
+    const userDataPath = process.env.ORCA_RUNTIME_USER_DATA_PATH
+    const environmentName = process.env.ORCA_RUNTIME_ENVIRONMENT
+    if (!userDataPath || !environmentName) {
+      throw new Error('Set ORCA_RUNTIME_USER_DATA_PATH and ORCA_RUNTIME_ENVIRONMENT.')
+    }
+    const store = RuntimeEnvironmentStoreSchema.parse(
+      JSON.parse(readFileSync(join(userDataPath, 'orca-environments.json'), 'utf8'))
+    )
+    const environment = store.environments.find((entry) => entry.name === environmentName)
+    if (!environment) {
+      throw new Error(`Unknown runtime environment: ${environmentName}`)
+    }
+    const endpoint =
+      environment.endpoints.find((entry) => entry.id === environment.preferredEndpointId) ??
+      environment.endpoints[0]
+    if (!endpoint) {
+      throw new Error(`Runtime environment ${environmentName} has no endpoint.`)
+    }
+    const pairing = {
+      v: 2 as const,
+      endpoint: endpoint.endpoint,
+      deviceToken: endpoint.deviceToken,
+      publicKeyB64: endpoint.publicKeyB64
+    }
+    const params = {
+      dispatchId: 'sta3880_benchmark_missing',
+      afterSequence: 0,
+      limit: 50
+    }
+    const oneShot = await measureRequests(() =>
+      sendRemoteRuntimeRequest(pairing, 'orchestration.federationPull', params, 15_000, {
+        orchestrationContractVersion: 1
+      })
+    )
+    const shared = new RemoteRuntimeSharedControlConnection(pairing, {
+      environmentId: environment.id
+    })
+    const { sharedControl, diagnostics } = await measureSharedControlRequests(shared, params)
+
+    expect(diagnostics).toMatchObject({ state: 'ready', pendingRequestCount: 0 })
+    process.stdout.write(`${JSON.stringify({ oneShot, sharedControl }, null, 2)}\n`)
+  }, 120_000)
+})
+
+async function measureSharedControlRequests(
+  shared: RemoteRuntimeSharedControlConnection,
+  params: unknown,
+  count = 30
+): Promise<{
+  sharedControl: Awaited<ReturnType<typeof measureRequests>>
+  diagnostics: ReturnType<RemoteRuntimeSharedControlConnection['getDiagnostics']>
+}> {
+  try {
+    const sharedControl = await measureRequests(
+      () =>
+        shared.request('orchestration.federationPull', params, 15_000, {
+          orchestrationContractVersion: 1
+        }),
+      count
+    )
+    const diagnostics = shared.getDiagnostics()
+    return { sharedControl, diagnostics }
+  } finally {
+    shared.close()
+  }
+}
+
+async function measureRequests(
+  request: () => Promise<{ ok: boolean; error?: { code: string } }>,
+  count = 30
+): Promise<{
+  count: number
+  meanMs: number
+  medianMs: number
+  p95Ms: number
+  minMs: number
+  maxMs: number
+  responseCodes: string[]
+}> {
+  for (let index = 0; index < 3; index++) {
+    await request()
+  }
+  const durations: number[] = []
+  const responseCodes = new Set<string>()
+  for (let index = 0; index < count; index++) {
+    const startedAt = performance.now()
+    const response = await request()
+    durations.push(performance.now() - startedAt)
+    if (!response.ok && response.error) {
+      responseCodes.add(response.error.code)
+    }
+  }
+  durations.sort((left, right) => left - right)
+  return {
+    count,
+    meanMs: round(durations.reduce((sum, value) => sum + value, 0) / count),
+    medianMs: round(percentile(durations, 0.5)),
+    p95Ms: round(percentile(durations, 0.95)),
+    minMs: round(durations[0] ?? 0),
+    maxMs: round(durations.at(-1) ?? 0),
+    responseCodes: [...responseCodes]
+  }
+}
+
+function percentile(sorted: number[], fraction: number): number {
+  if (sorted.length === 0) {
+    return 0
+  }
+  const rank = (sorted.length - 1) * fraction
+  const lowerIndex = Math.floor(rank)
+  const upperIndex = Math.ceil(rank)
+  const lower = sorted[lowerIndex] ?? 0
+  const upper = sorted[upperIndex] ?? lower
+  return lower + (upper - lower) * (rank - lowerIndex)
+}
+
+function round(value: number): number {
+  return Math.round(value * 100) / 100
+}
+
+function isFederatedReadBenchmarkEnabled(value: string | undefined): boolean {
+  return value === '1'
+}
+
+function createSharedControlFixture(
+  request: () => Promise<{ ok: boolean; error?: { code: string } }>
+): {
+  connection: RemoteRuntimeSharedControlConnection
+  close: ReturnType<typeof vi.fn>
+  socketClose: ReturnType<typeof vi.fn>
+  retainedHandleCount: () => number
+} {
+  const connection = new RemoteRuntimeSharedControlConnection({
+    v: 2,
+    endpoint: 'ws://127.0.0.1:1',
+    deviceToken: 'token',
+    publicKeyB64: Buffer.from(new Uint8Array(32).fill(1)).toString('base64')
+  })
+  const socketClose = vi.fn()
+  const unsafe = connection as unknown as {
+    state: string
+    ws: { readyState: number; close: () => void } | null
+    sharedKey: Uint8Array | null
+    request: typeof request
+  }
+  unsafe.state = 'ready'
+  unsafe.ws = { readyState: 1, close: socketClose }
+  unsafe.sharedKey = new Uint8Array(32).fill(2)
+  unsafe.request = vi.fn(request)
+  const close = vi.spyOn(connection, 'close')
+  return { connection, close, socketClose, retainedHandleCount: () => (unsafe.ws ? 1 : 0) }
+}
diff --git a/src/main/ipc/runtime-environment-request-connections.ts b/src/main/ipc/runtime-environment-request-connections.ts
index 946a0d30cf8..58fb95dd6e1 100644
--- a/src/main/ipc/runtime-environment-request-connections.ts
+++ b/src/main/ipc/runtime-environment-request-connections.ts
@@ -1,5 +1,8 @@
 import type { PairingOffer } from '../../shared/pairing'
-import type { RuntimeRpcResponse } from '../../shared/runtime-rpc-envelope'
+import type {
+  RuntimeOrchestrationEnvelope,
+  RuntimeRpcResponse
+} from '../../shared/runtime-rpc-envelope'
 import { RemoteRuntimeRequestConnection } from '../../shared/remote-runtime-request-connection'
 import { RemoteRuntimeSharedControlConnection } from '../../shared/remote-runtime-shared-control-connection'
 import type {
@@ -52,9 +55,15 @@ export function sendRemoteRuntimeSharedControlRequest<TResult>(
   pairing: PairingOffer,
   method: string,
   params: unknown,
-  timeoutMs: number
+  timeoutMs: number,
+  envelope?: RuntimeOrchestrationEnvelope
 ): Promise<RuntimeRpcResponse<TResult>> {
-  return getSharedControlConnection(environmentId, pairing).request(method, params, timeoutMs)
+  return getSharedControlConnection(environmentId, pairing).request(
+    method,
+    params,
+    timeoutMs,
+    envelope
+  )
 }
 
 export function subscribeRemoteRuntimeSharedControlRequest<TResult>(
diff --git a/src/main/ipc/runtime-environment-transport-routing.ts b/src/main/ipc/runtime-environment-transport-routing.ts
index 852b97273c5..884b0b2874a 100644
--- a/src/main/ipc/runtime-environment-transport-routing.ts
+++ b/src/main/ipc/runtime-environment-transport-routing.ts
@@ -1,5 +1,6 @@
 import { getPreferredPairingOffer } from '../../shared/runtime-environments'
 import { resolveEnvironment, markEnvironmentUsed } from '../../shared/runtime-environment-store'
+import { isOrchestrationMutation } from '../../shared/orchestration-rpc-contract'
 import type {
   RuntimeOrchestrationEnvelope,
   RuntimeRpcResponse
@@ -66,7 +67,10 @@ export async function getRuntimeEnvironmentStatus(
     )
   }
   if (response.ok === true) {
-    markEnvironmentUsed(userDataPath, environment.id, { runtimeId: response._meta.runtimeId })
+    markEnvironmentUsed(userDataPath, environment.id, {
+      runtimeId: response._meta.runtimeId,
+      pairedDeviceId: response.result.pairedDeviceId
+    })
     reconnectRemoteRuntimeSharedControlConnection(environment.id)
   }
   return attachRemoteControlDiagnostics(
@@ -105,7 +109,8 @@ export async function callRuntimeEnvironment(
       const pairing = getPreferredPairingOffer(currentEnvironment)
       endpoint = pairing.endpoint
       const effectiveTimeoutMs = timeoutMs ?? DEFAULT_REMOTE_RUNTIME_TIMEOUT_MS
-      if (envelope) {
+      const sharedControlEnvelope = shouldUseSharedControlEnvelope(method, params, envelope)
+      if (envelope && !sharedControlEnvelope) {
         const response = await sendRemoteRuntimeRequest(
           pairing,
           method,
@@ -132,19 +137,36 @@ export async function callRuntimeEnvironment(
         !shouldUseOneShotRequest(method) &&
         (await supportsSharedControl(userDataPath, currentEnvironment, pairing, effectiveTimeoutMs))
       ) {
-        const response = await sendRemoteRuntimeSharedControlRequest(
-          currentEnvironment.id,
-          pairing,
-          method,
-          params,
-          effectiveTimeoutMs
-        )
+        const response = sharedControlEnvelope
+          ? await sendRemoteRuntimeSharedControlRequest(
+              currentEnvironment.id,
+              pairing,
+              method,
+              params,
+              effectiveTimeoutMs,
+              sharedControlEnvelope
+            )
+          : await sendRemoteRuntimeSharedControlRequest(
+              currentEnvironment.id,
+              pairing,
+              method,
+              params,
+              effectiveTimeoutMs
+            )
         markEnvironmentUsedFromResponse(userDataPath, currentEnvironment.id, response)
         return response
       }
       // Why: startup/control-plane RPCs use the proven one-shot path so repo
       // hydration cannot be coupled to a stale terminal-control connection.
-      const response = await sendRemoteRuntimeRequest(pairing, method, params, effectiveTimeoutMs)
+      const response = sharedControlEnvelope
+        ? await sendRemoteRuntimeRequest(
+            pairing,
+            method,
+            params,
+            effectiveTimeoutMs,
+            sharedControlEnvelope
+          )
+        : await sendRemoteRuntimeRequest(pairing, method, params, effectiveTimeoutMs)
       markEnvironmentUsedFromResponse(userDataPath, currentEnvironment.id, response)
       return response
     })
@@ -250,6 +272,16 @@ function shouldUseCachedRequestConnection(method: string): boolean {
   return method === 'terminal.send' || method === 'terminal.updateViewport'
 }
 
+function shouldUseSharedControlEnvelope(
+  method: string,
+  params: unknown,
+  envelope: RuntimeOrchestrationEnvelope | undefined
+): RuntimeOrchestrationEnvelope | undefined {
+  return envelope && method.startsWith('orchestration.') && !isOrchestrationMutation(method, params)
+    ? envelope
+    : undefined
+}
+
 function shouldUseOneShotRequest(method: string): boolean {
   // Why: snapshot recovery must remain available while a retained shared-control stream is reconnecting after a HUB restart.
   return method === 'session.tabs.list' || method === 'session.tabs.listAll'
diff --git a/src/main/ipc/runtime-watcher-quarantine-queue.ts b/src/main/ipc/runtime-watcher-quarantine-queue.ts
index e326b299943..bc2b4cf5fd4 100644
--- a/src/main/ipc/runtime-watcher-quarantine-queue.ts
+++ b/src/main/ipc/runtime-watcher-quarantine-queue.ts
@@ -33,7 +33,7 @@ export class RuntimeWatcherQuarantineQueue<T> {
         }
         settled = true
         const index = this.waiters.indexOf(waiter)
-        if (index >= 0) {
+        if (index !== -1) {
           this.waiters.splice(index, 1)
         }
         callback()
diff --git a/src/main/ipc/ssh-pty-legacy-projection-record.ts b/src/main/ipc/ssh-pty-legacy-projection-record.ts
index 45c666dc09a..6d9843d888c 100644
--- a/src/main/ipc/ssh-pty-legacy-projection-record.ts
+++ b/src/main/ipc/ssh-pty-legacy-projection-record.ts
@@ -117,7 +117,7 @@ export function reclaimProjectionRecord(
     return
   }
   const index = ids.indexOf(id)
-  if (index >= 0) {
+  if (index !== -1) {
     ids.splice(index, 1)
   }
   if (ids.length === 0) {
diff --git a/src/main/ipc/ssh.ts b/src/main/ipc/ssh.ts
index 59ffcfbc9a9..0c504c5f0a0 100644
--- a/src/main/ipc/ssh.ts
+++ b/src/main/ipc/ssh.ts
@@ -177,7 +177,7 @@ export async function requestActiveSshAiVaultSessionList(
   targetId: string,
   params: SshAiVaultRelayListParams,
   options: { signal?: AbortSignal; timeoutMs?: number } = {}
-): Promise<unknown | null> {
+): Promise<unknown> {
   if (isRuntimeOwnedSshTargetId(targetId)) {
     return null
   }
@@ -192,7 +192,7 @@ export async function requestActiveSshAiVaultSessionTitles(
   targetId: string,
   params: SshAiVaultRelayTitleParams,
   options: { signal?: AbortSignal; timeoutMs?: number } = {}
-): Promise<unknown | null> {
+): Promise<unknown> {
   if (isRuntimeOwnedSshTargetId(targetId)) {
     return null
   }
diff --git a/src/main/ipc/terminal-preview-output-stream.test.ts b/src/main/ipc/terminal-preview-output-stream.test.ts
new file mode 100644
index 00000000000..4f293015178
--- /dev/null
+++ b/src/main/ipc/terminal-preview-output-stream.test.ts
@@ -0,0 +1,60 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { WebContents } from 'electron'
+import { TerminalPreviewOutputStream } from './terminal-preview-output-stream'
+
+function makeStream(): TerminalPreviewOutputStream {
+  const contents = {
+    id: 1,
+    isDestroyed: () => false,
+    send: vi.fn()
+  } as unknown as WebContents
+  return new TerminalPreviewOutputStream(
+    contents,
+    'p1',
+    () => undefined,
+    () => undefined
+  )
+}
+
+// The renderer needs each buffered chunk's mode, not just its bytes.
+// Returning a bare string[] made a proven post-snapshot `CSI > u` look like
+// historical redelivery, so the TUI's single pop later landed on a stale frame.
+describe('TerminalPreviewOutputStream.completeSnapshot', () => {
+  it('drops chunks the snapshot already covers', () => {
+    const stream = makeStream()
+    stream.append('abc', { seq: 5, rawLength: 3 })
+    expect(stream.completeSnapshot(5)).toEqual([])
+  })
+
+  it('gives a strictly newer sequenced chunk live mode', () => {
+    const stream = makeStream()
+    stream.append('abc', { seq: 9, rawLength: 3 })
+    expect(stream.completeSnapshot(6)).toEqual([{ data: 'abc', mode: 'live' }])
+  })
+
+  it('slices a partially covered chunk and keeps the suffix live', () => {
+    const stream = makeStream()
+    stream.append('abc', { seq: 7, rawLength: 3 })
+    expect(stream.completeSnapshot(6)).toEqual([{ data: 'c', mode: 'live' }])
+  })
+
+  it('falls back to replay mode for an unsliceable transformed overlap', () => {
+    const stream = makeStream()
+    // Renderer-side transforms make raw offsets unmappable, so the covered head
+    // cannot be removed and the whole chunk stays uncertain redelivery.
+    stream.append('abc', { seq: 7, rawLength: 3, transformed: true })
+    expect(stream.completeSnapshot(6)).toEqual([{ data: 'abc', mode: 'replay' }])
+  })
+
+  it('falls back to replay mode when the chunk carries no sequence metadata', () => {
+    const stream = makeStream()
+    stream.append('abc')
+    expect(stream.completeSnapshot(6)).toEqual([{ data: 'abc', mode: 'replay' }])
+  })
+
+  it('falls back to replay mode when the snapshot itself is unsequenced', () => {
+    const stream = makeStream()
+    stream.append('abc', { seq: 9, rawLength: 3 })
+    expect(stream.completeSnapshot(undefined)).toEqual([{ data: 'abc', mode: 'replay' }])
+  })
+})
diff --git a/src/main/ipc/terminal-preview-output-stream.ts b/src/main/ipc/terminal-preview-output-stream.ts
index af14424cbe2..16cb1613565 100644
--- a/src/main/ipc/terminal-preview-output-stream.ts
+++ b/src/main/ipc/terminal-preview-output-stream.ts
@@ -1,6 +1,9 @@
 import type { WebContents } from 'electron'
 import { iterateTerminalInputChunks } from '../../shared/terminal-input'
-import type { TerminalPreviewDataPayload } from '../../shared/terminal-preview'
+import type {
+  TerminalPreviewDataPayload,
+  TerminalPreviewReplayChunk
+} from '../../shared/terminal-preview'
 
 const OUTPUT_BATCH_MS = 5
 export const TERMINAL_PREVIEW_OUTPUT_BATCH_MAX_BYTES = 64 * 1024
@@ -16,22 +19,37 @@ export type TerminalPreviewOutputMeta = {
 
 type PendingOutput = { data: string; bytes: number; meta?: TerminalPreviewOutputMeta }
 
-function outputAfterSnapshotSeq(output: PendingOutput, snapshotSeq?: number): string | null {
+/**
+ * Split one buffered chunk against the snapshot boundary, keeping WHY it
+ * survived. Only a chunk whose sequence metadata proves it is the suffix after
+ * that boundary may advance kitty state with live stack semantics; an overlap
+ * that cannot be sliced is redelivery, and a redelivered `CSI > u` applied as a
+ * push would leave the TUI's single pop landing on a stale frame.
+ */
+function outputAfterSnapshotSeq(
+  output: PendingOutput,
+  snapshotSeq?: number
+): TerminalPreviewReplayChunk | null {
   if (
     typeof snapshotSeq !== 'number' ||
     typeof output.meta?.seq !== 'number' ||
     typeof output.meta.rawLength !== 'number'
   ) {
-    return output.data
+    return { data: output.data, mode: 'replay' }
   }
   if (output.meta.seq <= snapshotSeq) {
     return null
   }
   const startSeq = output.meta.seq - output.meta.rawLength
-  if (startSeq >= snapshotSeq || output.meta.transformed === true) {
-    return output.data
+  if (startSeq >= snapshotSeq) {
+    return { data: output.data, mode: 'live' }
   }
-  return output.data.slice(snapshotSeq - startSeq)
+  if (output.meta.transformed === true) {
+    // Transformed payloads make raw offsets unmappable, so the covered head
+    // cannot be sliced off and the whole chunk stays uncertain redelivery.
+    return { data: output.data, mode: 'replay' }
+  }
+  return { data: output.data.slice(snapshotSeq - startSeq), mode: 'live' }
 }
 
 /** Owns one preview's bounded snapshot/live output queue and acknowledgements. */
@@ -101,10 +119,10 @@ export class TerminalPreviewOutputStream {
     return true
   }
 
-  completeSnapshot(snapshotSeq?: number): string[] {
+  completeSnapshot(snapshotSeq?: number): TerminalPreviewReplayChunk[] {
     const replay = this.initialPending.flatMap((output) => {
       const uncovered = outputAfterSnapshotSeq(output, snapshotSeq)
-      return uncovered ? [uncovered] : []
+      return uncovered && uncovered.data.length > 0 ? [uncovered] : []
     })
     this.initialPending = []
     this.initialPendingBytes = 0
diff --git a/src/main/ipc/terminal-preview.test.ts b/src/main/ipc/terminal-preview.test.ts
index a01fd7c70eb..b8460554b73 100644
--- a/src/main/ipc/terminal-preview.test.ts
+++ b/src/main/ipc/terminal-preview.test.ts
@@ -122,7 +122,9 @@ describe('registerTerminalPreviewHandlers', () => {
 
     await expect(resultPromise).resolves.toEqual({
       snapshot: { data: 'screen', cols: 80, rows: 20, seq: 6 },
-      replay: ['c']
+      // A sliced suffix is proven post-snapshot output, so it applies with live
+      // kitty semantics rather than as redelivery.
+      replay: [{ data: 'c', mode: 'live' }]
     })
     expect(runtime.registerRawTerminalViewSubscriber).toHaveBeenCalledWith('p1')
   })
@@ -239,6 +241,64 @@ describe('registerTerminalPreviewHandlers', () => {
     expect(sender.send).not.toHaveBeenCalled()
   })
 
+  // Flags and image must come from ONE capture. Publishing flags from
+  // a separate "current state" read would describe a different stream position,
+  // so replaying the intervening bytes could duplicate or reorder transitions.
+  it('returns the kitty flags of the capture that produced the returned image', async () => {
+    const runtime = makeRuntime()
+    const snapshotResolvers: ((snapshot: {
+      data: string
+      cols: number
+      rows: number
+      seq: number
+      kittyKeyboardFlags?: number
+    }) => void)[] = []
+    runtime.serializeTerminalBuffer.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          snapshotResolvers.push(resolve)
+        })
+    )
+    registerTerminalPreviewHandlers(runtime as never)
+    const sender = makeSender()
+
+    const resultPromise = handlers.get('terminalPreview:connect')!(eventFor(sender), {
+      ptyId: 'p1'
+    }) as Promise<unknown>
+    const chunk = 'x'.repeat(64 * 1024)
+    for (let index = 0; index < 5; index++) {
+      runtime.listeners[0]!(chunk)
+    }
+    // The first capture overflowed; its flags must not survive onto the second image.
+    snapshotResolvers[0]!({
+      data: 'first',
+      cols: 80,
+      rows: 20,
+      seq: 1,
+      kittyKeyboardFlags: 0
+    })
+    await vi.waitFor(() => expect(snapshotResolvers).toHaveLength(2))
+    snapshotResolvers[1]!({
+      data: 'second',
+      cols: 80,
+      rows: 20,
+      seq: 2,
+      kittyKeyboardFlags: 8
+    })
+
+    await expect(resultPromise).resolves.toEqual({
+      snapshot: {
+        data: 'second',
+        cols: 80,
+        rows: 20,
+        seq: 2,
+        kittyKeyboardFlags: 8
+      },
+      replay: []
+    })
+    expect(runtime.serializeTerminalBuffer).toHaveBeenCalledTimes(2)
+  })
+
   it('releases output and raw-view presence on unsubscribe and sender destruction', async () => {
     const runtime = makeRuntime()
     registerTerminalPreviewHandlers(runtime as never)
diff --git a/src/main/ipc/usage-provider-handlers.test.ts b/src/main/ipc/usage-provider-handlers.test.ts
new file mode 100644
index 00000000000..54733b87c26
--- /dev/null
+++ b/src/main/ipc/usage-provider-handlers.test.ts
@@ -0,0 +1,65 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const { handle } = vi.hoisted(() => ({ handle: vi.fn() }))
+
+vi.mock('electron', () => ({ ipcMain: { handle } }))
+
+import { registerUsageProviderHandlers } from './usage-provider-handlers'
+
+describe('usage provider IPC handlers', () => {
+  it('registers every provider route and forwards query arguments', () => {
+    const createUsage = () => ({
+      getScanState: vi.fn(),
+      setEnabled: vi.fn(),
+      refresh: vi.fn(),
+      getSnapshot: vi.fn(),
+      getSummary: vi.fn(),
+      getDaily: vi.fn(),
+      getBreakdown: vi.fn(),
+      getRecentSessions: vi.fn()
+    })
+    const claudeUsage = createUsage()
+    const codexUsage = createUsage()
+    const openCodeUsage = createUsage()
+    registerUsageProviderHandlers({
+      claudeUsage: claudeUsage as never,
+      codexUsage: codexUsage as never,
+      openCodeUsage: openCodeUsage as never
+    })
+
+    const prefixes = ['claudeUsage', 'codexUsage', 'openCodeUsage']
+    const suffixes = Object.keys(claudeUsage)
+    expect(handle.mock.calls.map(([channel]) => channel)).toEqual(
+      prefixes.flatMap((prefix) => suffixes.map((suffix) => `${prefix}:${suffix}`))
+    )
+
+    const call = (prefix: string, suffix: string, args?: unknown): unknown => {
+      const handler = handle.mock.calls.find(
+        ([channel]) => channel === `${prefix}:${suffix}`
+      )?.[1] as ((event: unknown, args?: unknown) => unknown) | undefined
+      return handler?.({}, args)
+    }
+    call('claudeUsage', 'getScanState')
+    call('codexUsage', 'getScanState')
+    call('openCodeUsage', 'getScanState')
+    call('claudeUsage', 'setEnabled', { enabled: true })
+    call('claudeUsage', 'refresh')
+    call('claudeUsage', 'refresh', { force: true })
+    call('claudeUsage', 'getSnapshot', { scope: 'orca', range: '30d', limit: 7 })
+    call('claudeUsage', 'getSummary', { scope: 'all', range: '7d' })
+    call('claudeUsage', 'getDaily', { scope: 'orca', range: '90d' })
+    call('claudeUsage', 'getBreakdown', { scope: 'all', range: 'all', kind: 'model' })
+    call('claudeUsage', 'getRecentSessions', { scope: 'orca', range: '30d', limit: 4 })
+
+    expect(claudeUsage.getScanState).toHaveBeenCalledWith()
+    expect(codexUsage.getScanState).toHaveBeenCalledWith()
+    expect(openCodeUsage.getScanState).toHaveBeenCalledWith()
+    expect(claudeUsage.setEnabled).toHaveBeenCalledWith(true)
+    expect(claudeUsage.refresh.mock.calls).toEqual([[false], [true]])
+    expect(claudeUsage.getSnapshot).toHaveBeenCalledWith('orca', '30d', 7)
+    expect(claudeUsage.getSummary).toHaveBeenCalledWith('all', '7d')
+    expect(claudeUsage.getDaily).toHaveBeenCalledWith('orca', '90d')
+    expect(claudeUsage.getBreakdown).toHaveBeenCalledWith('all', 'all', 'model')
+    expect(claudeUsage.getRecentSessions).toHaveBeenCalledWith('orca', '30d', 4)
+  })
+})
diff --git a/src/main/ipc/usage-provider-handlers.ts b/src/main/ipc/usage-provider-handlers.ts
new file mode 100644
index 00000000000..58496f1c8ad
--- /dev/null
+++ b/src/main/ipc/usage-provider-handlers.ts
@@ -0,0 +1,68 @@
+import { ipcMain } from 'electron'
+import type { ClaudeUsageStore } from '../claude-usage/store'
+import type { CodexUsageStore } from '../codex-usage/store'
+import type { OpenCodeUsageStore } from '../opencode-usage/store'
+
+type UsageProviderStores = {
+  claudeUsage: ClaudeUsageStore
+  codexUsage: CodexUsageStore
+  openCodeUsage: OpenCodeUsageStore
+}
+
+type UsageProviderChannelPrefix = keyof UsageProviderStores
+
+type UsageProviderHandlerStore<Scope, Range, BreakdownKind> = {
+  getScanState: () => unknown
+  setEnabled: (enabled: boolean) => unknown
+  refresh: (force?: boolean) => unknown
+  getSnapshot: (scope: Scope, range: Range, limit?: number) => unknown
+  getSummary: (scope: Scope, range: Range) => unknown
+  getDaily: (scope: Scope, range: Range) => unknown
+  getBreakdown: (scope: Scope, range: Range, kind: BreakdownKind) => unknown
+  getRecentSessions: (scope: Scope, range: Range, limit?: number) => unknown
+}
+
+type UsageRangeArgs<Scope, Range> = {
+  scope: Scope
+  range: Range
+}
+
+function registerProviderHandlers<Scope, Range, BreakdownKind>(
+  prefix: UsageProviderChannelPrefix,
+  usage: UsageProviderHandlerStore<Scope, Range, BreakdownKind>
+): void {
+  ipcMain.handle(`${prefix}:getScanState`, () => usage.getScanState())
+  ipcMain.handle(`${prefix}:setEnabled`, (_event, args: { enabled: boolean }) =>
+    usage.setEnabled(args.enabled)
+  )
+  ipcMain.handle(`${prefix}:refresh`, (_event, args?: { force?: boolean }) =>
+    usage.refresh(args?.force ?? false)
+  )
+  ipcMain.handle(
+    `${prefix}:getSnapshot`,
+    (_event, args: UsageRangeArgs<Scope, Range> & { limit?: number }) =>
+      usage.getSnapshot(args.scope, args.range, args.limit)
+  )
+  ipcMain.handle(`${prefix}:getSummary`, (_event, args: UsageRangeArgs<Scope, Range>) =>
+    usage.getSummary(args.scope, args.range)
+  )
+  ipcMain.handle(`${prefix}:getDaily`, (_event, args: UsageRangeArgs<Scope, Range>) =>
+    usage.getDaily(args.scope, args.range)
+  )
+  ipcMain.handle(
+    `${prefix}:getBreakdown`,
+    (_event, args: UsageRangeArgs<Scope, Range> & { kind: BreakdownKind }) =>
+      usage.getBreakdown(args.scope, args.range, args.kind)
+  )
+  ipcMain.handle(
+    `${prefix}:getRecentSessions`,
+    (_event, args: UsageRangeArgs<Scope, Range> & { limit?: number }) =>
+      usage.getRecentSessions(args.scope, args.range, args.limit)
+  )
+}
+
+export function registerUsageProviderHandlers(stores: UsageProviderStores): void {
+  registerProviderHandlers('claudeUsage', stores.claudeUsage)
+  registerProviderHandlers('codexUsage', stores.codexUsage)
+  registerProviderHandlers('openCodeUsage', stores.openCodeUsage)
+}
diff --git a/src/main/ipc/workspace-ports.test.ts b/src/main/ipc/workspace-ports.test.ts
index f5afe03628b..9c847b14ad8 100644
--- a/src/main/ipc/workspace-ports.test.ts
+++ b/src/main/ipc/workspace-ports.test.ts
@@ -1,7 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { WorkspacePort, WorkspacePortScanResult } from '../../shared/workspace-ports'
 
-const handlers = new Map<string, (_event: unknown, args: unknown) => Promise<unknown> | unknown>()
+const handlers = new Map<string, (_event: unknown, args: unknown) => unknown>()
 const { handleMock, removeHandlerMock, scanWorkspacePortsMock, processKillMock } = vi.hoisted(
   () => ({
     handleMock: vi.fn(),
diff --git a/src/main/ipc/worktree-base-directory-poller.test.ts b/src/main/ipc/worktree-base-directory-poller.test.ts
index e28823adbc8..101d48e22cb 100644
--- a/src/main/ipc/worktree-base-directory-poller.test.ts
+++ b/src/main/ipc/worktree-base-directory-poller.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { writeFileSync } from 'node:fs'
+import { mkdirSync, writeFileSync } from 'node:fs'
 import { mkdtemp, mkdir, realpath, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -265,6 +265,44 @@ describe('worktree base directory poller', () => {
     ).toHaveLength(2)
   })
 
+  it('rescans on the next tick when a write races an in-flight full scan', async () => {
+    const root = await makeRoot()
+    const worktree = join(root, 'raced')
+    const received: WorktreeBasePollEvent[][] = []
+    const target = makeTarget('base', root)
+    const snapshotTicks: number[] = []
+    let raced = false
+    const poller = await startWorktreeBaseDirectoryPoller(
+      target,
+      () => target.repos,
+      (events) => received.push(events),
+      {
+        pollIntervalMs: 0,
+        onSnapshotTaken: (tick) => {
+          snapshotTicks.push(tick)
+          if (raced) {
+            return
+          }
+          raced = true
+          mkdirSync(worktree)
+          writeFileSync(join(worktree, '.git'), 'gitdir: elsewhere')
+        }
+      }
+    )
+    cleanups.push(() => poller.unsubscribe())
+
+    await waitForEvents(received, (flat) =>
+      flat.some((event) => event.type === 'create' && event.path === join(worktree, '.git'))
+    )
+
+    // A write landing after a scan's listings must leave the gate stale, so the
+    // next tick rescans instead of deferring the create to the backstop.
+    expect(snapshotTicks.slice(0, 2)).toEqual([
+      WORKTREE_BASE_BACKSTOP_TICKS,
+      WORKTREE_BASE_BACKSTOP_TICKS + 1
+    ])
+  })
+
   it('parks base scans while hidden and losslessly detects changes on resume', async () => {
     const root = await makeRoot()
     const visibility = createVisibilityHarness()
diff --git a/src/main/ipc/worktree-base-directory-poller.ts b/src/main/ipc/worktree-base-directory-poller.ts
index b5076c2ed7f..42ee184b811 100644
--- a/src/main/ipc/worktree-base-directory-poller.ts
+++ b/src/main/ipc/worktree-base-directory-poller.ts
@@ -65,6 +65,8 @@ export type WorktreeBasePollerOptions = {
   onFullScan?: () => void
   /** Test hook: called before a pending `.git` marker stat. */
   onPendingMarkerProbe?: (path: string) => void
+  /** Test hook: awaited with the tick after a full scan's listings, to land a racing write. */
+  onSnapshotTaken?: (tick: number) => void | Promise<void>
   /** Test hook: overrides the fast-probe window. */
   pendingMarkerMaxTicks?: number
 }
@@ -117,6 +119,8 @@ type BaseSnapshot = {
   // dirs whose listing determines the candidate set: the root plus any
   // nested repo containers. Their stat signatures gate the next full scan.
   gateDirs: string[]
+  // index-aligned with gateDirs, each sampled *before* that dir's listing
+  gateSignatures: string[]
 }
 
 // Depth-1 worktree dirs (flat layout), plus depth-2 dirs under each nested
@@ -128,6 +132,10 @@ async function snapshotBase(
 ): Promise<BaseSnapshot> {
   const markers = new Map<string, boolean>()
   const gateDirs = [rootPath]
+  // Why: sampling the signature before the listing makes a write that races the
+  // scan look stale next tick (one redundant rescan) instead of invisible until
+  // the backstop, which is up to 15 ticks of missed creates/deletes.
+  const gateSignatures = [await dirSignature(rootPath)]
   const configs = [...repos.values()]
   const includeFlat = configs.some((config) => !config.nestWorkspaces)
   const nestedRepoNames = new Set(
@@ -142,7 +150,7 @@ async function snapshotBase(
   } catch {
     // Root vanished: an empty snapshot diffs into delete events for every
     // previously-known worktree dir, matching the old watcher's error path.
-    return { markers, gateDirs }
+    return { markers, gateDirs, gateSignatures }
   }
 
   const candidates: string[] = []
@@ -156,6 +164,7 @@ async function snapshotBase(
     }
     if (nestedRepoNames.has(normalizeRuntimePathForComparison(entry.name))) {
       gateDirs.push(entryPath)
+      gateSignatures.push(await dirSignature(entryPath))
       let subEntries
       try {
         subEntries = await readdir(entryPath, { withFileTypes: true })
@@ -173,7 +182,7 @@ async function snapshotBase(
   for (const dir of candidates) {
     markers.set(dir, await hasGitMarker(dir))
   }
-  return { markers, gateDirs }
+  return { markers, gateDirs, gateSignatures }
 }
 
 function diffBase(prev: BaseSnapshot, next: BaseSnapshot): WorktreeBasePollEvent[] {
@@ -203,7 +212,6 @@ async function startBasePoller(
   let ticking = false
   let tickCount = 0
   let snapshot = await snapshotBase(target.path, getRepos())
-  let gateSignatures = await Promise.all(snapshot.gateDirs.map(dirSignature))
   let timer: ReturnType<typeof setTimeout> | null = null
   let parkedWhileHidden = false
   const pendingMarkerMaxTicks = options.pendingMarkerMaxTicks ?? PENDING_MARKER_MAX_TICKS
@@ -218,7 +226,7 @@ async function startBasePoller(
   const fullScan = async (): Promise<void> => {
     options.onFullScan?.()
     const next = await snapshotBase(target.path, getRepos())
-    const nextSignatures = await Promise.all(next.gateDirs.map(dirSignature))
+    await options.onSnapshotTaken?.(tickCount)
     if (disposed) {
       return
     }
@@ -236,7 +244,6 @@ async function startBasePoller(
       }
     }
     snapshot = next
-    gateSignatures = nextSignatures
     if (events.length > 0) {
       onEvents(events)
     }
@@ -274,8 +281,8 @@ async function startBasePoller(
     // are untouched, skip the readdir + per-candidate stat fan-out entirely.
     const signatures = await Promise.all(snapshot.gateDirs.map(dirSignature))
     const gateChanged =
-      signatures.length !== gateSignatures.length ||
-      signatures.some((sig, index) => sig !== gateSignatures[index])
+      signatures.length !== snapshot.gateSignatures.length ||
+      signatures.some((sig, index) => sig !== snapshot.gateSignatures[index])
     if (gateChanged) {
       await fullScan()
       return
diff --git a/src/main/ipc/worktree-common-git-directory.ts b/src/main/ipc/worktree-common-git-directory.ts
index a2ec6b0e990..7fb464f3c94 100644
--- a/src/main/ipc/worktree-common-git-directory.ts
+++ b/src/main/ipc/worktree-common-git-directory.ts
@@ -26,7 +26,7 @@ function isFileStat(value: GitDirectoryStat): boolean {
 function runtimeDirname(pathValue: string): string {
   const normalized = normalizeRuntimePathSeparators(pathValue).replace(/\/+$/, '')
   const index = normalized.lastIndexOf('/')
-  if (index < 0) {
+  if (index === -1) {
     return '.'
   }
   if (index === 0) {
diff --git a/src/main/ipc/worktree-git-common-polling.ts b/src/main/ipc/worktree-git-common-polling.ts
index dae122943a3..86cc06e1420 100644
--- a/src/main/ipc/worktree-git-common-polling.ts
+++ b/src/main/ipc/worktree-git-common-polling.ts
@@ -74,7 +74,7 @@ async function snapshotGitCommon(
   previous?: GitCommonSnapshot,
   includePrimary = true,
   forceFullScan = false,
-  statusRefPaths: Set<string> = new Set()
+  statusRefPaths = new Set<string>()
 ): Promise<GitCommonSnapshot> {
   const worktreesDir = join(commonDirPath, 'worktrees')
   const [worktreesDirSignature, primarySignatures, statusRefSignatures] = await Promise.all([
diff --git a/src/main/ipc/worktree-metadata-merge.ts b/src/main/ipc/worktree-metadata-merge.ts
index 8c4aa0efead..6b7542d18d4 100644
--- a/src/main/ipc/worktree-metadata-merge.ts
+++ b/src/main/ipc/worktree-metadata-merge.ts
@@ -2,6 +2,7 @@ import { basename } from 'node:path'
 import type { GitWorktreeInfo, Worktree, WorktreeMeta } from '../../shared/types'
 import { DEFAULT_WORKSPACE_STATUS_ID } from '../../shared/workspace-statuses'
 import { getLinkedWorkItemMetadata } from './worktree-linked-work-item-metadata'
+import { normalizeWorkspaceCreatorProvenance } from '../../shared/workspace-creator-provenance'
 
 /**
  * Merge raw git worktree info with persisted user metadata into a full Worktree.
@@ -13,6 +14,7 @@ export function mergeWorktree(
   defaultDisplayName?: string
 ): Worktree {
   const branchShort = git.branch.replace(/^refs\/heads\//, '')
+  const creatorProvenance = normalizeWorkspaceCreatorProvenance(meta?.creatorProvenance)
   return {
     id: `${repoId}::${git.path}`,
     ...(meta?.instanceId !== undefined ? { instanceId: meta.instanceId } : {}),
@@ -22,6 +24,7 @@ export function mergeWorktree(
     ...(meta?.projectHostSetupId !== undefined
       ? { projectHostSetupId: meta.projectHostSetupId }
       : {}),
+    ...(creatorProvenance ? { creatorProvenance } : {}),
     path: git.path,
     head: git.head,
     branch: git.branch,
diff --git a/src/main/ipc/worktree-remote.ts b/src/main/ipc/worktree-remote.ts
index b09b4e71c93..f83c5035976 100644
--- a/src/main/ipc/worktree-remote.ts
+++ b/src/main/ipc/worktree-remote.ts
@@ -1784,6 +1784,7 @@ export async function createRemoteWorktree(
     createdAt: now,
     orcaCreatedAt: now,
     orcaCreationSource: 'ssh',
+    creatorProvenance: { kind: 'host' },
     orcaCreationWorkspaceLayout: getWorktreeCreationLayout(repo, settings),
     ...(args.automationProvenance ? { automationProvenance: args.automationProvenance } : {}),
     ...(args.cliProvenance ? { cliProvenance: args.cliProvenance } : {}),
@@ -2392,6 +2393,7 @@ export async function createLocalWorktree(
     createdAt: now,
     orcaCreatedAt: now,
     orcaCreationSource: 'desktop',
+    creatorProvenance: { kind: 'host' },
     orcaCreationWorkspaceLayout: getWorktreeCreationLayout(repo, settings),
     ...(args.automationProvenance ? { automationProvenance: args.automationProvenance } : {}),
     ...(args.cliProvenance ? { cliProvenance: args.cliProvenance } : {}),
diff --git a/src/main/ipc/worktrees.test.ts b/src/main/ipc/worktrees.test.ts
index 84e9e1fbaae..02f23bc094a 100644
--- a/src/main/ipc/worktrees.test.ts
+++ b/src/main/ipc/worktrees.test.ts
@@ -603,6 +603,18 @@ describe('registerWorktreeHandlers', () => {
     expect(orderedTargets).not.toContain(staleId)
   })
 
+  it('persistSortOrder skips ranks that already represent the requested order', () => {
+    const firstId = 'repo-1::/workspace/first'
+    const secondId = 'repo-1::/workspace/second'
+    store.getWorktreeMeta.mockImplementation((id: string) => ({
+      sortOrder: id === firstId ? 200 : 100
+    }))
+
+    handlers['worktrees:persistSortOrder'](null, { orderedIds: [firstId, secondId] })
+
+    expect(store.setWorktreeMeta).not.toHaveBeenCalled()
+  })
+
   it('prefetches the local default create base through the runtime refresh cache', async () => {
     const repo = {
       id: 'repo-1',
diff --git a/src/main/ipc/worktrees.ts b/src/main/ipc/worktrees.ts
index 87bd0ded95c..ab299057169 100644
--- a/src/main/ipc/worktrees.ts
+++ b/src/main/ipc/worktrees.ts
@@ -8,6 +8,7 @@ import { isFolderRepo } from '../../shared/repo-kind'
 import { readBranchRenameFailureOutputForDisplay } from '../agent-hooks/branch-rename-failure-output'
 import { parseWorkspaceKey } from '../../shared/workspace-scope'
 import { inspectSetupScriptImportCandidates } from '../../shared/setup-script-imports'
+import { planWorktreeSortOrderUpdates } from '../../shared/worktree-sort-order-update'
 import { getProjectHostSetupWorktreeMeta } from '../../shared/project-host-setup-projection'
 import { TaskSourceContextSchema } from '../../shared/task-source-context-schema'
 import { WorkspaceLinkedItemSchema } from '../../shared/workspace-linked-item-schema'
@@ -141,6 +142,7 @@ import {
   registerSshProviderRequestAbort
 } from '../ssh/ssh-provider-authority'
 import { createSenderScopedRequestCancellations } from './sender-scoped-request-cancellation'
+import { preservedBranchCleanupScopeKey } from '../../shared/preserved-branch-cleanup'
 
 type CreateWorktreeArgsWithSystemProvenance = CreateWorktreeArgs & {
   automationProvenance?: AutomationWorkspaceProvenance
@@ -521,15 +523,18 @@ type WorktreeRemovalInFlight = {
 }
 
 type PreservedBranchCleanupTarget = {
+  worktreeId: string
+  hostId: ExecutionHostId
   branchName: string
   head: string
   pushTarget?: GitPushTarget
 }
 
-const preservedBranchCleanupByWorktreeId = new Map<string, PreservedBranchCleanupTarget>()
+const preservedBranchCleanupByScope = new Map<string, PreservedBranchCleanupTarget>()
 
 function rememberPreservedBranchCleanupTarget(
   worktreeId: string,
+  hostId: ExecutionHostId,
   result: RemoveWorktreeResult | undefined,
   fallbackHead: string | undefined,
   pushTarget: GitPushTarget | undefined
@@ -541,14 +546,16 @@ function rememberPreservedBranchCleanupTarget(
         `Cannot safely offer force-delete for preserved branch "${result.preservedBranch.branchName}" without its saved commit.`
       )
     }
-    preservedBranchCleanupByWorktreeId.set(worktreeId, {
+    preservedBranchCleanupByScope.set(preservedBranchCleanupScopeKey({ worktreeId, hostId }), {
+      worktreeId,
+      hostId,
       branchName: result.preservedBranch.branchName,
       head,
       ...(pushTarget ? { pushTarget } : {})
     })
     return
   }
-  preservedBranchCleanupByWorktreeId.delete(worktreeId)
+  preservedBranchCleanupByScope.delete(preservedBranchCleanupScopeKey({ worktreeId, hostId }))
 }
 
 function preserveBranchHeadFallback(
@@ -570,9 +577,21 @@ function preserveBranchHeadFallback(
 function getPreservedBranchCleanupTarget(
   worktreeId: string,
   branchName: string,
-  expectedHead: string
+  expectedHead: string,
+  hostId?: ExecutionHostId
 ): PreservedBranchCleanupTarget {
-  const target = preservedBranchCleanupByWorktreeId.get(worktreeId)
+  const exactTarget = hostId
+    ? preservedBranchCleanupByScope.get(preservedBranchCleanupScopeKey({ worktreeId, hostId }))
+    : undefined
+  const legacyMatches = hostId
+    ? []
+    : [...preservedBranchCleanupByScope.values()].filter(
+        (target) =>
+          target.worktreeId === worktreeId &&
+          target.branchName === branchName &&
+          target.head === expectedHead
+      )
+  const target = exactTarget ?? (legacyMatches.length === 1 ? legacyMatches[0] : undefined)
   if (!target || target.branchName !== branchName || target.head !== expectedHead) {
     throw new Error(`No preserved branch cleanup is pending for "${branchName}".`)
   }
@@ -1026,6 +1045,7 @@ function createFolderWorkspace(
     createdAt: now,
     orcaCreatedAt: now,
     orcaCreationSource: 'desktop',
+    creatorProvenance: { kind: 'host' },
     ...(args.automationProvenance ? { automationProvenance: args.automationProvenance } : {}),
     ...(args.cliProvenance ? { cliProvenance: args.cliProvenance } : {}),
     ...(args.createdWithAgent ? { createdWithAgent: args.createdWithAgent } : {}),
@@ -2399,7 +2419,9 @@ export function registerWorktreeHandlers(
             await withWorktreeRemoveStageSpan('metadata_purge', 'folder', async () => {
               removeWorktreeMetadataAndTransientState(store, args.worktreeId, removalHostId)
             })
-            preservedBranchCleanupByWorktreeId.delete(args.worktreeId)
+            preservedBranchCleanupByScope.delete(
+              preservedBranchCleanupScopeKey({ worktreeId: args.worktreeId, hostId: removalHostId })
+            )
             notifyWorktreesChanged(mainWindow, repoId)
             return {}
           }
@@ -2508,7 +2530,12 @@ export function registerWorktreeHandlers(
               }
               runtime.clearOptimisticReconcileToken(args.worktreeId)
               removeWorktreeMetadataAndTransientState(store, args.worktreeId, removalHostId)
-              preservedBranchCleanupByWorktreeId.delete(args.worktreeId)
+              preservedBranchCleanupByScope.delete(
+                preservedBranchCleanupScopeKey({
+                  worktreeId: args.worktreeId,
+                  hostId: removalHostId
+                })
+              )
               notifyWorktreesChanged(mainWindow, repoId)
               return {}
             }
@@ -2553,7 +2580,12 @@ export function registerWorktreeHandlers(
                 )
                 runtime.clearOptimisticReconcileToken(args.worktreeId)
                 removeWorktreeMetadataAndTransientState(store, args.worktreeId, removalHostId)
-                preservedBranchCleanupByWorktreeId.delete(args.worktreeId)
+                preservedBranchCleanupByScope.delete(
+                  preservedBranchCleanupScopeKey({
+                    worktreeId: args.worktreeId,
+                    hostId: removalHostId
+                  })
+                )
                 invalidateAuthorizedRootsCache()
                 notifyWorktreesChanged(mainWindow, repoId)
                 return {}
@@ -2585,7 +2617,12 @@ export function registerWorktreeHandlers(
               }
               runtime.clearOptimisticReconcileToken(args.worktreeId)
               removeWorktreeMetadataAndTransientState(store, args.worktreeId, removalHostId)
-              preservedBranchCleanupByWorktreeId.delete(args.worktreeId)
+              preservedBranchCleanupByScope.delete(
+                preservedBranchCleanupScopeKey({
+                  worktreeId: args.worktreeId,
+                  hostId: removalHostId
+                })
+              )
               notifyWorktreesChanged(mainWindow, repoId)
               return {}
             }
@@ -2633,6 +2670,7 @@ export function registerWorktreeHandlers(
             )
             rememberPreservedBranchCleanupTarget(
               args.worktreeId,
+              removalHostId,
               removalResult,
               registeredWorktree.head,
               removedPushTarget
@@ -2730,6 +2768,7 @@ export function registerWorktreeHandlers(
             )
             rememberPreservedBranchCleanupTarget(
               args.worktreeId,
+              removalHostId,
               removalResult,
               registeredWorktree.head,
               removedPushTarget
@@ -2883,7 +2922,12 @@ export function registerWorktreeHandlers(
                 )
                 runtime.clearOptimisticReconcileToken(args.worktreeId)
                 removeWorktreeMetadataAndTransientState(store, args.worktreeId, removalHostId)
-                preservedBranchCleanupByWorktreeId.delete(args.worktreeId)
+                preservedBranchCleanupByScope.delete(
+                  preservedBranchCleanupScopeKey({
+                    worktreeId: args.worktreeId,
+                    hostId: removalHostId
+                  })
+                )
                 invalidateAuthorizedRootsCache()
                 notifyWorktreesChanged(mainWindow, repoId)
                 removalCompleted = true
@@ -2907,6 +2951,7 @@ export function registerWorktreeHandlers(
           )
           rememberPreservedBranchCleanupTarget(
             args.worktreeId,
+            removalHostId,
             removalResult,
             refreshedRegisteredWorktree.head,
             removedPushTarget
@@ -3010,7 +3055,17 @@ export function registerWorktreeHandlers(
         removeWorktreeMetadataAndTransientState(store, args.worktreeId, ownerHost?.id)
         // Why: cached roots outlive the forgotten workspace, so an ownerless path stays filesystem-authorized until a rebuild.
         invalidateAuthorizedRootsCache()
-        preservedBranchCleanupByWorktreeId.delete(args.worktreeId)
+        if (ownerHost?.id) {
+          preservedBranchCleanupByScope.delete(
+            preservedBranchCleanupScopeKey({ worktreeId: args.worktreeId, hostId: ownerHost.id })
+          )
+        } else {
+          for (const [key, target] of preservedBranchCleanupByScope) {
+            if (target.worktreeId === args.worktreeId) {
+              preservedBranchCleanupByScope.delete(key)
+            }
+          }
+        }
         notifyWorktreesChanged(mainWindow, repoId)
         return {}
       })()
@@ -3029,15 +3084,21 @@ export function registerWorktreeHandlers(
     'worktrees:forceDeletePreservedBranch',
     async (
       _event,
-      args: { worktreeId: string; branchName: string; expectedHead: string }
+      args: {
+        worktreeId: string
+        branchName: string
+        expectedHead: string
+        hostId?: ExecutionHostId
+      }
     ): Promise<ForceDeleteWorktreeBranchResult> => {
       const { repoId } = parseWorktreeId(args.worktreeId)
       const cleanupTarget = getPreservedBranchCleanupTarget(
         args.worktreeId,
         args.branchName,
-        args.expectedHead
+        args.expectedHead,
+        args.hostId
       )
-      const repo = store.getRepo(repoId)
+      const repo = getRepoForWorktreeRemoval(store, repoId, cleanupTarget.hostId)
       if (!repo) {
         throw new Error(`Repo not found: ${repoId}`)
       }
@@ -3080,7 +3141,12 @@ export function registerWorktreeHandlers(
         )
       }
 
-      preservedBranchCleanupByWorktreeId.delete(args.worktreeId)
+      preservedBranchCleanupByScope.delete(
+        preservedBranchCleanupScopeKey({
+          worktreeId: args.worktreeId,
+          hostId: cleanupTarget.hostId
+        })
+      )
       return { deleted: true }
     }
   )
@@ -3142,18 +3208,13 @@ export function registerWorktreeHandlers(
     if (!Array.isArray(args?.orderedIds) || args.orderedIds.length === 0) {
       return
     }
-    const now = Date.now()
-    for (let i = 0; i < args.orderedIds.length; i++) {
-      // Why: a sidebar-order snapshot must only reorder worktrees that already
-      // exist — it must never create one. Without this guard a stale id the
-      // renderer still lists (e.g. a removed repo's `${repoId}::${path}`) gets a
-      // fresh worktreeMeta entry minted here, resurrecting an orphan/duplicate
-      // workspace on the next launch. setWorktreeMeta has no repo-existence check.
-      if (!store.getWorktreeMeta(args.orderedIds[i])) {
-        continue
-      }
-      // Descending timestamps: first item gets highest sortOrder so b - a sorts first-wins on cold start.
-      store.setWorktreeMeta(args.orderedIds[i], { sortOrder: now - i * 1000 })
+    const updates = planWorktreeSortOrderUpdates(
+      args.orderedIds,
+      (worktreeId) => store.getWorktreeMeta(worktreeId),
+      Date.now()
+    )
+    for (const update of updates) {
+      store.setWorktreeMeta(update.worktreeId, { sortOrder: update.sortOrder })
     }
   })
 
diff --git a/src/main/jira/attachment-images.ts b/src/main/jira/attachment-images.ts
index ce2e682b872..d1cfb2ab079 100644
--- a/src/main/jira/attachment-images.ts
+++ b/src/main/jira/attachment-images.ts
@@ -191,7 +191,7 @@ export function createMediaMarkdownResolver(
     }
     const index = queue.findIndex((entry) => entry.id === image.id)
     // Why: already-consumed images must not re-emit; fall through to positional pairing.
-    if (index < 0) {
+    if (index === -1) {
       return null
     }
     queue.splice(index, 1)
diff --git a/src/main/jira/client.ts b/src/main/jira/client.ts
index 70f45628461..cd3497fb2be 100644
--- a/src/main/jira/client.ts
+++ b/src/main/jira/client.ts
@@ -61,7 +61,7 @@ export function acquire(signal?: AbortSignal): Promise<void> {
       signal,
       onAbort: () => {
         const index = queue.indexOf(entry)
-        if (index < 0) {
+        if (index === -1) {
           return
         }
         queue.splice(index, 1)
diff --git a/src/main/keybindings/keybinding-file.ts b/src/main/keybindings/keybinding-file.ts
index 4d41a42ba87..7a357010406 100644
--- a/src/main/keybindings/keybinding-file.ts
+++ b/src/main/keybindings/keybinding-file.ts
@@ -221,7 +221,7 @@ function removeConflictingOverrides(
 
     for (const conflict of conflicts) {
       for (const actionId of conflict.actionIds) {
-        if (Object.prototype.hasOwnProperty.call(next, actionId)) {
+        if (Object.hasOwn(next, actionId)) {
           conflictingOverrides.add(actionId)
         }
       }
@@ -346,8 +346,8 @@ export function seedLegacyTabSwitchBindings(
   // common + active-platform sections directly so the seed never replaces it.
   const toSeed = actionIds.filter(
     (actionId) =>
-      !Object.prototype.hasOwnProperty.call(current.commonOverrides, actionId) &&
-      !Object.prototype.hasOwnProperty.call(activePlatformOverrides, actionId)
+      !Object.hasOwn(current.commonOverrides, actionId) &&
+      !Object.hasOwn(activePlatformOverrides, actionId)
   )
   if (toSeed.length === 0) {
     return { seeded: false, snapshot: current }
diff --git a/src/main/kimi/hook-service.ts b/src/main/kimi/hook-service.ts
index 94f5d11ea3e..a7b954f01cb 100644
--- a/src/main/kimi/hook-service.ts
+++ b/src/main/kimi/hook-service.ts
@@ -18,6 +18,7 @@ import {
   wrapPosixHookCommand,
   writeManagedScript
 } from '../agent-hooks/installer-utils'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
 import {
   readTextFileRemote,
   writeManagedScriptRemote,
@@ -57,10 +58,12 @@ function getManagedCommand(scriptPath: string): string {
   return wrapPosixHookCommand(posixPath)
 }
 
-function getManagedScript(): string {
-  return [
-    '#!/bin/sh',
-    ...buildPosixHookPayloadCapture(),
+function getManagedScript(target: 'local' | 'posix' = 'local'): string {
+  // Why (#11549 class): on Windows this .sh runs under Git Bash but the caller is a
+  // Windows process that can abandon the pipe, so the missing-env guard must run before
+  // the capture owns stdin. POSIX callers close stdin (#8110), so posix keeps capture-first.
+  const windowsLocal = target === 'local' && process.platform === 'win32'
+  const endpointRefreshAndGuard = [
     // Why: refresh PORT/TOKEN/ENV/VERSION from the current Orca install so a PTY
     // that survived an Orca restart still reaches the live listener. See
     // claude/hook-service.ts for the full rationale.
@@ -69,7 +72,13 @@ function getManagedScript(): string {
     'fi',
     'if [ -z "$ORCA_AGENT_HOOK_PORT" ] || [ -z "$ORCA_AGENT_HOOK_TOKEN" ] || [ -z "$ORCA_PANE_KEY" ]; then',
     '  exit 0',
-    'fi',
+    'fi'
+  ]
+  return [
+    '#!/bin/sh',
+    ...(windowsLocal
+      ? [...endpointRefreshAndGuard, ...buildPosixHookPayloadCapture()]
+      : [...buildPosixHookPayloadCapture(), ...endpointRefreshAndGuard]),
     // Why: worktreeId embeds a filesystem path, so hand-building JSON in POSIX
     // shell is not safe once a path contains quotes or newlines. Post the raw
     // hook payload plus metadata as form fields and let the receiver parse it.
@@ -155,6 +164,10 @@ function buildStatus(present: Set<string>, configPath: string): AgentHookInstall
 }
 
 export class KimiHookService {
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(getManagedScriptPath(), getManagedScript())
+  }
+
   getStatus(): AgentHookInstallStatus {
     const configPath = getConfigPath()
     const text = readConfigToml(configPath)
@@ -207,7 +220,7 @@ export class KimiHookService {
       const text = (await readTextFileRemote(sftp, remoteConfigPath)) ?? ''
       const command = wrapPosixHookCommand(remoteScriptPath)
       // Write the script first so config.toml never points at a missing script.
-      await writeManagedScriptRemote(sftp, remoteScriptPath, getManagedScript())
+      await writeManagedScriptRemote(sftp, remoteScriptPath, getManagedScript('posix'))
       await writeTextFileRemoteAtomic(sftp, remoteConfigPath, applyManagedKimiHooks(text, command))
       return {
         agent: 'kimi',
diff --git a/src/main/line-editor-ready-output-scanner.test.ts b/src/main/line-editor-ready-output-scanner.test.ts
new file mode 100644
index 00000000000..332f1d65f04
--- /dev/null
+++ b/src/main/line-editor-ready-output-scanner.test.ts
@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest'
+import {
+  createLineEditorReadyOutputScanState,
+  scanForLineEditorReadyOutput
+} from './line-editor-ready-output-scanner'
+
+describe('line editor ready output scanner', () => {
+  it.each(['\x1b[?2004h', '\x1b[?1034h'])('detects %j across chunks', (sequence) => {
+    const state = createLineEditorReadyOutputScanState()
+    expect(scanForLineEditorReadyOutput(state, `prompt${sequence.slice(0, 4)}`)).toBe(false)
+    expect(scanForLineEditorReadyOutput(state, sequence.slice(4))).toBe(true)
+  })
+
+  it('ignores ordinary prompt output', () => {
+    expect(
+      scanForLineEditorReadyOutput(createLineEditorReadyOutputScanState(), 'user@host % ')
+    ).toBe(false)
+  })
+})
diff --git a/src/main/line-editor-ready-output-scanner.ts b/src/main/line-editor-ready-output-scanner.ts
new file mode 100644
index 00000000000..03467887a9a
--- /dev/null
+++ b/src/main/line-editor-ready-output-scanner.ts
@@ -0,0 +1,19 @@
+const LINE_EDITOR_READY_SEQUENCES = ['\x1b[?2004h', '\x1b[?1034h'] as const
+const MAX_SEQUENCE_LENGTH = Math.max(...LINE_EDITOR_READY_SEQUENCES.map((value) => value.length))
+
+export type LineEditorReadyOutputScanState = {
+  tail: string
+}
+
+export function createLineEditorReadyOutputScanState(): LineEditorReadyOutputScanState {
+  return { tail: '' }
+}
+
+export function scanForLineEditorReadyOutput(
+  state: LineEditorReadyOutputScanState,
+  data: string
+): boolean {
+  const combined = state.tail + data
+  state.tail = combined.slice(-(MAX_SEQUENCE_LENGTH - 1))
+  return LINE_EDITOR_READY_SEQUENCES.some((sequence) => combined.includes(sequence))
+}
diff --git a/src/main/linear/issue-context-client.ts b/src/main/linear/issue-context-client.ts
index 1f4863d235a..c9e5085f3bb 100644
--- a/src/main/linear/issue-context-client.ts
+++ b/src/main/linear/issue-context-client.ts
@@ -43,7 +43,7 @@ export type ResolvedIssue = {
 export async function searchLinearIssuesForAgents(args: {
   query: string
   limit?: number
-  workspaceId?: string | 'all'
+  workspaceId?: (string & {}) | 'all'
 }): Promise<LinearSearchResult> {
   const limit = clampLinearSearchLimit(args.limit)
   const workspaceId = resolveSearchWorkspaceId(args.workspaceId)
@@ -144,14 +144,18 @@ function getExplicitClientEntries(workspaceId?: string): {
   }
 }
 
-function resolveSearchWorkspaceId(workspaceId?: string | 'all'): string | 'all' | undefined {
+function resolveSearchWorkspaceId(
+  workspaceId?: (string & {}) | 'all'
+): (string & {}) | 'all' | undefined {
   if (!workspaceId || workspaceId === 'all') {
     return workspaceId
   }
   return resolveWorkspaceSelector({ workspaceId }, getConnectedWorkspaces())?.id ?? workspaceId
 }
 
-function throwIfExplicitWorkspaceHasConnectedAlternatives(workspaceId?: string | 'all'): void {
+function throwIfExplicitWorkspaceHasConnectedAlternatives(
+  workspaceId?: (string & {}) | 'all'
+): void {
   if (!workspaceId || workspaceId === 'all') {
     return
   }
@@ -169,7 +173,7 @@ function throwIfExplicitWorkspaceHasConnectedAlternatives(workspaceId?: string |
 export async function withLinearRead<T>(
   entry: LinearClientForWorkspace,
   read: () => Promise<T>,
-  selection?: string | 'all'
+  selection?: (string & {}) | 'all'
 ): Promise<T> {
   void selection
   await acquire()
@@ -206,7 +210,7 @@ async function readIssueWorkspace(
 async function readIssueWorkspaces(
   entries: LinearClientForWorkspace[],
   identifier: string,
-  selection: string | 'all',
+  selection: (string & {}) | 'all',
   initialFailures: WorkspaceReadFailure[] = []
 ): Promise<ResolvedIssue[]> {
   if (selection !== 'all') {
@@ -243,7 +247,7 @@ async function readSearchWorkspace(
   entry: LinearClientForWorkspace,
   query: string,
   limit: number,
-  workspaceId?: string | 'all'
+  workspaceId?: (string & {}) | 'all'
 ): Promise<LinearSearchIssueSummary[]> {
   const response = await withLinearRead(
     entry,
@@ -269,7 +273,7 @@ async function readSearchWorkspaces(
   entries: LinearClientForWorkspace[],
   query: string,
   limit: number,
-  workspaceId?: string | 'all',
+  workspaceId?: (string & {}) | 'all',
   initialFailures: WorkspaceReadFailure[] = []
 ): Promise<{ results: LinearSearchIssueSummary[][]; failures: WorkspaceReadFailure[] }> {
   if (workspaceId && workspaceId !== 'all') {
diff --git a/src/main/linear/mcp-issue-list.ts b/src/main/linear/mcp-issue-list.ts
index 3906442879e..09c5fff3336 100644
--- a/src/main/linear/mcp-issue-list.ts
+++ b/src/main/linear/mcp-issue-list.ts
@@ -106,7 +106,7 @@ export async function listMcpIssues(
   }
 }
 
-function getIssueListEntries(workspaceId?: string | 'all'): {
+function getIssueListEntries(workspaceId?: (string & {}) | 'all'): {
   entries: LinearClientForWorkspace[]
   failures: WorkspaceReadFailure[]
 } {
diff --git a/src/main/memory/windows-process-resource-collector.ts b/src/main/memory/windows-process-resource-collector.ts
index d73ae95b8c9..527c4678fc9 100644
--- a/src/main/memory/windows-process-resource-collector.ts
+++ b/src/main/memory/windows-process-resource-collector.ts
@@ -286,7 +286,7 @@ export function parseTypeperfProcessOutput(stdout: string): WindowsProcessResour
 function parseTypeperfCounterPath(path: string): { instance: string; counter: string } | null {
   const processStart = path.lastIndexOf('\\Process(')
   const counterStart = path.lastIndexOf(')\\')
-  if (processStart < 0 || counterStart <= processStart + 9) {
+  if (processStart === -1 || counterStart <= processStart + 9) {
     return null
   }
   return {
diff --git a/src/main/minimax/minimax-cookie-store.ts b/src/main/minimax/minimax-cookie-store.ts
index 3864f892bfb..1b98a1a81c6 100644
--- a/src/main/minimax/minimax-cookie-store.ts
+++ b/src/main/minimax/minimax-cookie-store.ts
@@ -33,7 +33,7 @@ function decodeCookieEnvelope(raw: Buffer): MiniMaxCookieEnvelope | null {
   }
   const rest = text.slice(COOKIE_ENVELOPE_PREFIX.length)
   const separator = rest.indexOf(':')
-  if (separator < 0) {
+  if (separator === -1) {
     throw new Error('MiniMax session cookie could not be decrypted')
   }
   const kind = rest.slice(0, separator)
diff --git a/src/main/native-chat/host-readable-transcript-path-fs-gate.test.ts b/src/main/native-chat/host-readable-transcript-path-fs-gate.test.ts
index 30bd3716d3e..5043bd14f6c 100644
--- a/src/main/native-chat/host-readable-transcript-path-fs-gate.test.ts
+++ b/src/main/native-chat/host-readable-transcript-path-fs-gate.test.ts
@@ -20,6 +20,7 @@ import {
   resetHostReadableTranscriptPathCacheForTests,
   toHostReadableTranscriptPath
 } from './host-readable-transcript-path'
+import { WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS } from './wsl-transcript-fs-gate'
 
 type AccessControl = {
   resolve: () => void
@@ -97,4 +98,27 @@ describe('WSL transcript filesystem gate', () => {
     releaseWsl?.()
     await expect(wslProbe).resolves.toBe(firstUncPath)
   })
+
+  // Last on purpose: the never-settling Ubuntu probe leaves its gate permit
+  // stuck for the rest of this module's lifetime.
+  it('falls through to the next distro when a probe exceeds the gate deadline', async () => {
+    vi.useFakeTimers()
+    const DEBIAN_HOME = '\\\\wsl.localhost\\Debian\\home\\ada'
+    const debianUncPath = '\\\\wsl.localhost\\Debian\\home\\ada\\.codex\\sessions\\first.jsonl'
+    try {
+      fsMocks.access.mockImplementation((path) =>
+        path === firstUncPath ? new Promise<void>(() => {}) : Promise.resolve()
+      )
+      const resolved = toHostReadableTranscriptPath(firstGuestPath, {
+        platform: 'win32',
+        listWslHomeDirs: async () => [UBUNTU_HOME, DEBIAN_HOME]
+      })
+
+      await vi.waitFor(() => expect(fsMocks.access).toHaveBeenCalledWith(firstUncPath))
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS)
+      await expect(resolved).resolves.toBe(debianUncPath)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
 })
diff --git a/src/main/native-chat/host-readable-transcript-path.test.ts b/src/main/native-chat/host-readable-transcript-path.test.ts
index 043c77ee4c0..4d19b3fa8e8 100644
--- a/src/main/native-chat/host-readable-transcript-path.test.ts
+++ b/src/main/native-chat/host-readable-transcript-path.test.ts
@@ -7,6 +7,7 @@ import {
   toHostReadableTranscriptPath,
   wslCodexSessionsDirs
 } from './host-readable-transcript-path'
+import { WslTranscriptFsError } from './wsl-transcript-fs-gate'
 
 const UBUNTU_HOME = '\\\\wsl.localhost\\Ubuntu\\home\\ada'
 const DEBIAN_HOME = '\\\\wsl.localhost\\Debian\\home\\other'
@@ -109,6 +110,38 @@ describe('toHostReadableTranscriptPath', () => {
     ).resolves.toBeNull()
   })
 
+  it('prefers a later distro hit over an earlier gate refusal', async () => {
+    // Guest path under Debian's $HOME so the refusing Debian probe ranks first.
+    await expect(
+      toHostReadableTranscriptPath('/home/other/x.jsonl', {
+        platform: 'win32',
+        pathExists: async (candidate) => {
+          if (candidate.includes('Debian')) {
+            throw new WslTranscriptFsError('timeout', 'slow share')
+          }
+          return candidate.includes('Ubuntu')
+        },
+        listWslHomeDirs: async () => [DEBIAN_HOME, UBUNTU_HOME]
+      })
+    ).resolves.toBe('\\\\wsl.localhost\\Ubuntu\\home\\other\\x.jsonl')
+  })
+
+  it('reports unavailability, not a miss, when a refused distro was never probed', async () => {
+    const refusal = new WslTranscriptFsError('timeout', 'slow share')
+    await expect(
+      toHostReadableTranscriptPath('/home/other/x.jsonl', {
+        platform: 'win32',
+        pathExists: async (candidate) => {
+          if (candidate.includes('Debian')) {
+            throw refusal
+          }
+          return false
+        },
+        listWslHomeDirs: async () => [DEBIAN_HOME, UBUNTU_HOME]
+      })
+    ).rejects.toBe(refusal)
+  })
+
   it('does not translate guest paths off Windows', async () => {
     await expect(
       toHostReadableTranscriptPath('/home/ada/rollout.jsonl', {
diff --git a/src/main/native-chat/host-readable-transcript-path.ts b/src/main/native-chat/host-readable-transcript-path.ts
index 2672040e38b..4d919099536 100644
--- a/src/main/native-chat/host-readable-transcript-path.ts
+++ b/src/main/native-chat/host-readable-transcript-path.ts
@@ -4,7 +4,11 @@ import { isAbsolute } from 'node:path'
 import { isWslUncPath, parseWslUncPath, toWindowsWslPath } from '../../shared/wsl-paths'
 import { WSL_CODEX_RUNTIME_HOME_SEGMENTS } from '../pty/codex-home-wsl-env'
 import { getWslHomeAsync, listWslDistrosAsync } from '../wsl'
-import { runWslTranscriptFsTask } from './wsl-transcript-fs-gate'
+import {
+  runWslTranscriptFsTask,
+  wslTranscriptFsRefusal,
+  type WslTranscriptFsError
+} from './wsl-transcript-fs-gate'
 
 /**
  * True for guest-absolute Linux paths that Win32 cannot open as-is.
@@ -136,12 +140,22 @@ export async function toHostReadableTranscriptPath(
   const homeDirs = await wslHomeDirs(deps.listWslHomeDirs ?? defaultListWslHomeDirs)
   // Sequential on purpose: the ranked order picks the owning distro, and probing
   // every distro at once would fan out 9P calls to ones the user left stopped.
+  let unavailable: WslTranscriptFsError | undefined
   for (const distro of rankDistrosForGuestPath(homeDirs, path)) {
     const uncPath = toWindowsWslPath(path, distro)
-    if (await pathExists(uncPath)) {
-      return uncPath
+    try {
+      if (await pathExists(uncPath)) {
+        return uncPath
+      }
+    } catch (error) {
+      // Why: one stalled distro must not hide another distro's hit.
+      unavailable = wslTranscriptFsRefusal(error)
     }
   }
+  // No hit and at least one distro never probed: "couldn't look", not "absent".
+  if (unavailable) {
+    throw unavailable
+  }
   return null
 }
 
diff --git a/src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts b/src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts
index 07ccc107d65..af14882b371 100644
--- a/src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts
+++ b/src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts
@@ -1,10 +1,12 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as WslTranscriptFsGateModule from './wsl-transcript-fs-gate'
 
 const WSL_SESSIONS_DIR = '\\\\wsl.localhost\\Ubuntu\\home\\ada\\.codex\\sessions'
+const DEBIAN_SESSIONS_DIR = '\\\\wsl.localhost\\Debian\\home\\ada\\.codex\\sessions'
 const LOCAL_SESSIONS_DIR = 'C:\\Users\\ada\\.codex\\sessions'
 
 const mocks = vi.hoisted(() => ({
-  gate: vi.fn(async () => []),
+  gate: vi.fn(async (_options: { path: string }) => []),
   walk: vi.fn(
     async (
       dir: string,
@@ -18,7 +20,8 @@ const mocks = vi.hoisted(() => ({
   )
 }))
 
-vi.mock('./wsl-transcript-fs-gate', () => ({
+vi.mock('./wsl-transcript-fs-gate', async (importOriginal) => ({
+  ...(await importOriginal<typeof WslTranscriptFsGateModule>()),
   runWslTranscriptFsTask: mocks.gate
 }))
 vi.mock('../ai-vault/session-scanner-discovery', () => ({
@@ -26,6 +29,7 @@ vi.mock('../ai-vault/session-scanner-discovery', () => ({
 }))
 
 import { resolveSessionFilePath } from './session-file-resolver'
+import { WslTranscriptFsError } from './wsl-transcript-fs-gate'
 
 beforeEach(() => {
   mocks.gate.mockClear()
@@ -53,4 +57,77 @@ describe('Codex WSL scan gate', () => {
     expect(mocks.gate).not.toHaveBeenCalled()
     expect(mocks.walk).toHaveBeenCalledTimes(1)
   })
+
+  it("still surfaces a later root's hit when an earlier root is gate-refused", async () => {
+    const hit = `${DEBIAN_SESSIONS_DIR}\\2026\\rollout-1-session-id.jsonl`
+    mocks.gate.mockImplementation(async (options) => {
+      if (options.path.includes('Ubuntu')) {
+        throw new WslTranscriptFsError('timeout', 'slow share')
+      }
+      return []
+    })
+    mocks.walk.mockImplementation(async (dir, _agent, _issues, options) => {
+      await options.readDirectory?.(dir)
+      return dir === DEBIAN_SESSIONS_DIR ? [hit] : []
+    })
+
+    await expect(
+      resolveSessionFilePath('codex', 'session-id', {
+        codexSessionsDirs: [WSL_SESSIONS_DIR, DEBIAN_SESSIONS_DIR]
+      })
+    ).resolves.toBe(hit)
+  })
+
+  it('reports unavailability, not a miss, when every scanned root is gate-refused', async () => {
+    const refusal = new WslTranscriptFsError('unavailable', 'stuck permits')
+    mocks.gate.mockRejectedValue(refusal)
+
+    await expect(
+      resolveSessionFilePath('codex', 'session-id', {
+        codexSessionsDirs: [WSL_SESSIONS_DIR]
+      })
+    ).rejects.toBe(refusal)
+  })
+
+  it('falls through a gate-refused hook path to an id-based hit', async () => {
+    const hit = `${DEBIAN_SESSIONS_DIR}\\2026\\rollout-1-session-id.jsonl`
+    mocks.gate.mockImplementation(async (options: { operation?: string; path: string }) => {
+      if (options.operation === 'access') {
+        throw new WslTranscriptFsError('timeout', 'slow share')
+      }
+      return []
+    })
+    mocks.walk.mockImplementation(async (dir, _agent, _issues, options) => {
+      await options.readDirectory?.(dir)
+      return dir === DEBIAN_SESSIONS_DIR ? [hit] : []
+    })
+
+    await expect(
+      resolveSessionFilePath('codex', 'session-id', {
+        transcriptPath: `${WSL_SESSIONS_DIR}\\2026\\rollout-1-session-id.jsonl`,
+        codexSessionsDirs: [DEBIAN_SESSIONS_DIR]
+      })
+    ).resolves.toBe(hit)
+  })
+
+  it('surfaces the hook-path refusal when the id search also misses', async () => {
+    const refusal = new WslTranscriptFsError('unavailable', 'stuck permits')
+    mocks.gate.mockImplementation(async (options: { operation?: string; path: string }) => {
+      if (options.operation === 'access') {
+        throw refusal
+      }
+      return []
+    })
+    mocks.walk.mockImplementation(async (dir, _agent, _issues, options) => {
+      await options.readDirectory?.(dir)
+      return []
+    })
+
+    await expect(
+      resolveSessionFilePath('codex', 'session-id', {
+        transcriptPath: `${WSL_SESSIONS_DIR}\\2026\\rollout-1-session-id.jsonl`,
+        codexSessionsDirs: [LOCAL_SESSIONS_DIR]
+      })
+    ).rejects.toBe(refusal)
+  })
 })
diff --git a/src/main/native-chat/session-file-resolver.ts b/src/main/native-chat/session-file-resolver.ts
index f597529d933..f0376e01f02 100644
--- a/src/main/native-chat/session-file-resolver.ts
+++ b/src/main/native-chat/session-file-resolver.ts
@@ -1,7 +1,10 @@
 import { homedir } from 'node:os'
 import { basename, extname, join } from 'node:path'
 import type { AgentType } from '../../shared/native-chat-types'
-import { resolveNativeChatTranscriptAgent } from '../../shared/native-chat-agent-support'
+import {
+  resolveNativeChatTranscriptAgent,
+  type NativeChatTranscriptAgent
+} from '../../shared/native-chat-agent-support'
 import { isWslUncPath } from '../../shared/wsl-paths'
 import { walkSessionFiles } from '../ai-vault/session-scanner-discovery'
 import { OMP_SESSION_ARTIFACT_DIR_PATTERN } from '../ai-vault/session-scanner-omp-subagent-transcripts'
@@ -13,6 +16,7 @@ import {
 } from '../../shared/grok-session-paths'
 import { toHostReadableTranscriptPath, wslCodexSessionsDirs } from './host-readable-transcript-path'
 import { findWslCodexSessionPath } from './wsl-codex-session-path-scan'
+import { wslTranscriptFsRefusal, type WslTranscriptFsError } from './wsl-transcript-fs-gate'
 
 // Why: these mirror the path constants in ai-vault/session-scanner.ts. Reads
 // run in the main process against the runtime's own home directory; over SSH
@@ -95,14 +99,34 @@ export async function resolveSessionFilePath(
   // beats reconstructing a path from the session id. Route it through the host
   // readability check so a WSL guest path becomes an openable UNC on Windows;
   // stale/missing paths fall through to the id-based search.
+  let unavailable: WslTranscriptFsError | undefined
   const hookPath = options.transcriptPath?.trim()
   if (hookPath && extname(hookPath) === '.jsonl') {
-    const hostReadable = await toHostReadableTranscriptPath(hookPath, { signal })
-    if (hostReadable) {
-      return hostReadable
+    try {
+      const hostReadable = await toHostReadableTranscriptPath(hookPath, { signal })
+      if (hostReadable) {
+        return hostReadable
+      }
+    } catch (error) {
+      // Why: the id-based search may still hit; surface the refusal only when
+      // it does not, so a stalled distro reads as unavailable, never "missing".
+      unavailable = wslTranscriptFsRefusal(error)
     }
   }
 
+  const resolved = await resolveSessionFileById(transcriptAgent, sessionId, options, signal)
+  if (!resolved && unavailable) {
+    throw unavailable
+  }
+  return resolved
+}
+
+async function resolveSessionFileById(
+  transcriptAgent: NativeChatTranscriptAgent,
+  sessionId: string,
+  options: ResolveSessionFileOptions,
+  signal?: AbortSignal
+): Promise<string | null> {
   const trimmedId = sessionId.trim()
   if (!trimmedId) {
     return null
@@ -132,6 +156,10 @@ export async function resolveSessionFilePath(
   if (transcriptAgent === 'omp') {
     return resolveOmpSessionFile(trimmedId, options.ompSessionsDir ?? ompSessionsDir(), signal)
   }
+  // Why: a new transcript agent must pick its own resolver. Falling through to
+  // OMP's scan would search the wrong root with a foreign session id, so fail
+  // the build here instead of resolving silently wrong at runtime.
+  transcriptAgent satisfies never
   return null
 }
 
@@ -178,6 +206,7 @@ async function findCodexRolloutInDirs(
   sessionsDirs: string[],
   signal?: AbortSignal
 ): Promise<string | null> {
+  let unavailable: WslTranscriptFsError | undefined
   for (const sessionsDir of sessionsDirs) {
     // Why: no existence pre-check — walkSessionFiles already yields [] for a
     // missing/unreadable root, and a sync probe would block the main thread on a
@@ -190,18 +219,27 @@ async function findCodexRolloutInDirs(
       }
     }
     const isWslRoot = isWslUncPath(sessionsDir)
-    const files = isWslRoot
-      ? await findWslCodexSessionPath(sessionsDir, sessionId, signal)
-      : (
-          await walkSessionFiles(sessionsDir, 'codex', [], {
-            ...scanOptions,
-            signal
-          })
-        )[0]
-    if (files) {
-      return files
+    try {
+      const files = isWslRoot
+        ? await findWslCodexSessionPath(sessionsDir, sessionId, signal)
+        : (
+            await walkSessionFiles(sessionsDir, 'codex', [], {
+              ...scanOptions,
+              signal
+            })
+          )[0]
+      if (files) {
+        return files
+      }
+    } catch (error) {
+      // Why: one stalled distro must not hide another root's hit.
+      unavailable = wslTranscriptFsRefusal(error)
     }
   }
+  // No hit and at least one root never scanned: "couldn't look", not "missing".
+  if (unavailable) {
+    throw unavailable
+  }
   return null
 }
 
diff --git a/src/main/native-chat/transcript-read-cache.ts b/src/main/native-chat/transcript-read-cache.ts
index 8943c223dd2..d2a4b4d3de2 100644
--- a/src/main/native-chat/transcript-read-cache.ts
+++ b/src/main/native-chat/transcript-read-cache.ts
@@ -2,6 +2,7 @@ import { stat } from 'node:fs/promises'
 import type { AgentType } from '../../shared/native-chat-types'
 import { resolveSessionFilePath } from './session-file-resolver'
 import { readNativeChatTranscript, type ReadTranscriptResult } from './transcript-reader'
+import { wslTranscriptFsRefusal } from './wsl-transcript-fs-gate'
 
 // Why: both the desktop IPC handler and the runtime RPC handler read the same
 // host-filesystem transcript, so a single process-global cache keyed by the
@@ -89,7 +90,14 @@ export async function readNativeChatTranscriptCached(
   /** Hook-reported authoritative transcript path, preferred over the id glob. */
   transcriptPath?: string
 ): Promise<ReadTranscriptResult> {
-  const filePath = await resolveSessionFilePath(agent, sessionId, { transcriptPath })
+  let filePath: string | null
+  try {
+    filePath = await resolveSessionFilePath(agent, sessionId, { transcriptPath })
+  } catch (err) {
+    // Why: gate refusal is transient unavailability — report it without caching
+    // or `notFound` so the next call re-resolves.
+    return { error: wslTranscriptFsRefusal(err).message }
+  }
   if (!filePath) {
     // Not cached (see below): a not-yet-flushed transcript should be re-checked
     // on the next call, not pinned as a settled miss (#8401).
diff --git a/src/main/native-chat/transcript-reader.ts b/src/main/native-chat/transcript-reader.ts
index 8cb57fdb91d..a8e14e0e180 100644
--- a/src/main/native-chat/transcript-reader.ts
+++ b/src/main/native-chat/transcript-reader.ts
@@ -7,6 +7,7 @@ import type {
 import { resolveNativeChatTranscriptAgent } from '../../shared/native-chat-agent-support'
 import { errorMessage } from '../ai-vault/session-scanner-values'
 import { resolveSessionFilePath, type ResolveSessionFileOptions } from './session-file-resolver'
+import { wslTranscriptFsRefusal } from './wsl-transcript-fs-gate'
 import {
   decodeClaudeTranscriptLine,
   decodeCodexTranscriptLine,
@@ -41,7 +42,14 @@ export async function readNativeChatTranscript(
   sessionId: string,
   options: ReadTranscriptOptions = {}
 ): Promise<ReadTranscriptResult> {
-  const filePath = options.filePath ?? (await resolveSessionFilePath(agent, sessionId, options))
+  let filePath: string | null
+  try {
+    filePath = options.filePath ?? (await resolveSessionFilePath(agent, sessionId, options))
+  } catch (err) {
+    // Why: gate refusal is transient unavailability with retry guidance —
+    // `notFound` would settle callers into a false "missing" state.
+    return { error: wslTranscriptFsRefusal(err).message }
+  }
   if (!filePath) {
     return { error: `No transcript found for ${agent} session ${sessionId}`, notFound: true }
   }
diff --git a/src/main/native-chat/transcript-tail-reader-cancellation.test.ts b/src/main/native-chat/transcript-tail-reader-cancellation.test.ts
index cf3eaf47e7f..d211805337f 100644
--- a/src/main/native-chat/transcript-tail-reader-cancellation.test.ts
+++ b/src/main/native-chat/transcript-tail-reader-cancellation.test.ts
@@ -1,5 +1,5 @@
 import type * as NodeFsPromisesModule from 'node:fs/promises'
-import { describe, expect, it, vi } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const fsMocks = vi.hoisted(() => ({
   open: vi.fn(),
@@ -15,19 +15,33 @@ vi.mock('node:fs/promises', async (importOriginal) => ({
 import { readNativeChatTranscriptTail } from './transcript-tail-reader'
 
 describe('native chat transcript tail cancellation', () => {
-  it('rejects after pending tail I/O closes when the request is canceled', async () => {
-    let finishRead: (() => void) | undefined
+  beforeEach(() => {
+    fsMocks.open.mockReset()
+    fsMocks.stat.mockReset()
+  })
+
+  it('closes after a pending tail read without reading another chunk when canceled', async () => {
+    let finishTailRead: (() => void) | undefined
+    let readCount = 0
     const close = vi.fn(async () => {})
-    const read = vi.fn(
-      (buffer: Buffer) =>
-        new Promise<{ bytesRead: number; buffer: Buffer }>((resolve) => {
-          finishRead = () => {
-            buffer[0] = 0x0a
-            resolve({ bytesRead: 1, buffer })
-          }
-        })
-    )
-    fsMocks.stat.mockResolvedValue({ size: 1 })
+    const read = vi.fn((buffer: Buffer) => {
+      readCount++
+      if (readCount === 1) {
+        buffer[0] = 0x0a
+        return Promise.resolve({ bytesRead: 1, buffer })
+      }
+      if (readCount > 2) {
+        buffer.fill(0x0a)
+        return Promise.resolve({ bytesRead: buffer.length, buffer })
+      }
+      return new Promise<{ bytesRead: number; buffer: Buffer }>((resolve) => {
+        finishTailRead = () => {
+          buffer.fill(0x0a)
+          resolve({ bytesRead: buffer.length, buffer })
+        }
+      })
+    })
+    fsMocks.stat.mockResolvedValue({ size: 8 * 64 * 1024 + 1 })
     fsMocks.open.mockResolvedValue({ close, read })
     const controller = new AbortController()
     const canceled = new Error('request canceled')
@@ -41,12 +55,46 @@ describe('native chat transcript tail cancellation', () => {
       controller.signal
     )
     const rejection = expect(pending).rejects.toBe(canceled)
-    await vi.waitFor(() => expect(read).toHaveBeenCalledOnce())
+    await vi.waitFor(() => expect(read).toHaveBeenCalledTimes(2))
 
     controller.abort(canceled)
-    finishRead?.()
+    finishTailRead?.()
 
     await rejection
+    expect(read).toHaveBeenCalledTimes(2)
+    expect(close).toHaveBeenCalledOnce()
+  })
+
+  it('closes a handle opened after cancellation without starting a read', async () => {
+    let finishOpen: (() => void) | undefined
+    const close = vi.fn(async () => {})
+    const read = vi.fn()
+    fsMocks.stat.mockResolvedValue({ size: 1 })
+    fsMocks.open.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          finishOpen = () => resolve({ close, read })
+        })
+    )
+    const controller = new AbortController()
+    const canceled = new Error('request canceled while opening')
+    const pending = readNativeChatTranscriptTail(
+      {
+        agent: 'claude',
+        sessionId: 'session-id',
+        filePath: 'transcript.jsonl',
+        limit: 40
+      },
+      controller.signal
+    )
+    const rejection = expect(pending).rejects.toBe(canceled)
+    await vi.waitFor(() => expect(fsMocks.open).toHaveBeenCalledOnce())
+
+    controller.abort(canceled)
+    finishOpen?.()
+
+    await rejection
+    expect(read).not.toHaveBeenCalled()
     expect(close).toHaveBeenCalledOnce()
   })
 })
diff --git a/src/main/native-chat/transcript-tail-reader-wsl-gate.test.ts b/src/main/native-chat/transcript-tail-reader-wsl-gate.test.ts
new file mode 100644
index 00000000000..ff5194668cd
--- /dev/null
+++ b/src/main/native-chat/transcript-tail-reader-wsl-gate.test.ts
@@ -0,0 +1,34 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  resolve: vi.fn<() => Promise<string | null>>()
+}))
+
+vi.mock('./session-file-resolver', () => ({
+  resolveSessionFilePath: mocks.resolve
+}))
+
+import { readNativeChatTranscriptTail } from './transcript-tail-reader'
+import { WslTranscriptFsError } from './wsl-transcript-fs-gate'
+
+describe('native chat transcript tail under WSL gate refusals', () => {
+  beforeEach(() => {
+    mocks.resolve.mockReset()
+  })
+
+  it('reports a gate refusal as a retryable error, not a missing transcript', async () => {
+    mocks.resolve.mockRejectedValueOnce(new WslTranscriptFsError('timeout', 'slow share'))
+
+    await expect(
+      readNativeChatTranscriptTail({ agent: 'codex', sessionId: 'session-id', limit: 10 })
+    ).resolves.toEqual({ error: 'slow share' })
+  })
+
+  it('rethrows non-gate resolver failures', async () => {
+    mocks.resolve.mockRejectedValueOnce(new Error('resolver crashed'))
+
+    await expect(
+      readNativeChatTranscriptTail({ agent: 'codex', sessionId: 'session-id', limit: 10 })
+    ).rejects.toThrow('resolver crashed')
+  })
+})
diff --git a/src/main/native-chat/transcript-tail-reader.ts b/src/main/native-chat/transcript-tail-reader.ts
index f5cbed8efdd..1264c2e3d98 100644
--- a/src/main/native-chat/transcript-tail-reader.ts
+++ b/src/main/native-chat/transcript-tail-reader.ts
@@ -17,6 +17,7 @@ import {
   nativeChatTurnLifecycleDecoderForAgent,
   type NativeChatTurnLifecycleDecoder
 } from './transcript-turn-lifecycle'
+import { wslTranscriptFsRefusal } from './wsl-transcript-fs-gate'
 
 export const MAX_NATIVE_CHAT_TRANSCRIPT_RECORD_BYTES = 2 * 1024 * 1024
 const TAIL_CHUNK_BYTES = 64 * 1024
@@ -46,7 +47,8 @@ export async function readNativeChatTranscriptTailFile(
   decode: NativeChatLineDecoder,
   includeTrailingLine = false,
   endOffset?: number,
-  decodeLifecycle?: NativeChatTurnLifecycleDecoder | null
+  decodeLifecycle?: NativeChatTurnLifecycleDecoder | null,
+  signal?: AbortSignal
 ): Promise<{
   messages: NativeChatMessage[]
   lifecycle?: NativeChatTurnLifecycle
@@ -56,7 +58,9 @@ export async function readNativeChatTranscriptTailFile(
   malformedRecordCount?: number
   oversizedRecordCount?: number
 }> {
+  signal?.throwIfAborted()
   const end = Math.min((await stat(filePath)).size, endOffset ?? Number.MAX_SAFE_INTEGER)
+  signal?.throwIfAborted()
   if (end === 0) {
     return { messages: [], consumedTo: 0, hasMore: false, beforeOffset: 0 }
   }
@@ -69,19 +73,25 @@ export async function readNativeChatTranscriptTailFile(
   let oversizedRecordCount = 0
   let ignoreNextMalformedRecord = false
   try {
-    const consumedTo = includeTrailingLine ? end : await findLastCompleteLineEnd(handle, end)
+    signal?.throwIfAborted()
+    const consumedTo = includeTrailingLine
+      ? end
+      : await findLastCompleteLineEnd(handle, end, signal)
     if (consumedTo === 0) {
       return { messages: [], consumedTo: 0, hasMore: false, beforeOffset: 0 }
     }
     const newestFirst: { message: NativeChatMessage; offset: number }[] = []
     const finalByte = Buffer.allocUnsafe(1)
     await handle.read(finalByte, 0, 1, consumedTo - 1)
+    signal?.throwIfAborted()
     ignoreNextMalformedRecord = finalByte[0] !== 0x0a
     let cursor = consumedTo - (finalByte[0] === 0x0a ? 1 : 0)
     while (cursor > 0 && newestFirst.length <= limit) {
+      signal?.throwIfAborted()
       const start = Math.max(0, cursor - TAIL_CHUNK_BYTES)
       const buffer = Buffer.allocUnsafe(cursor - start)
       const { bytesRead } = await handle.read(buffer, 0, buffer.length, start)
+      signal?.throwIfAborted()
       let segmentEnd = bytesRead
       for (let index = bytesRead - 1; index >= 0 && newestFirst.length <= limit; index--) {
         if (buffer[index] !== 0x0a) {
@@ -175,20 +185,25 @@ export async function readNativeChatTranscriptTailFile(
 
 async function findLastCompleteLineEnd(
   handle: Awaited<ReturnType<typeof open>>,
-  end: number
+  end: number,
+  signal?: AbortSignal
 ): Promise<number> {
+  signal?.throwIfAborted()
   const lastByte = Buffer.allocUnsafe(1)
   await handle.read(lastByte, 0, 1, end - 1)
+  signal?.throwIfAborted()
   if (lastByte[0] === 0x0a) {
     return end
   }
   let cursor = end
   while (cursor > 0) {
+    signal?.throwIfAborted()
     const start = Math.max(0, cursor - TAIL_CHUNK_BYTES)
     const buffer = Buffer.allocUnsafe(cursor - start)
     const { bytesRead } = await handle.read(buffer, 0, buffer.length, start)
+    signal?.throwIfAborted()
     const newline = buffer.subarray(0, bytesRead).lastIndexOf(0x0a)
-    if (newline >= 0) {
+    if (newline !== -1) {
       return start + newline + 1
     }
     cursor = start
@@ -217,12 +232,20 @@ export async function readNativeChatTranscriptTail(
 > {
   const decode = nativeChatLineDecoderForAgent(args.agent)
   const decodeLifecycle = nativeChatTurnLifecycleDecoderForAgent(args.agent)
-  const filePath =
-    args.filePath ?? (await resolveSessionFilePath(args.agent, args.sessionId, args, signal))
-  signal?.throwIfAborted()
   if (!decode) {
     return { error: 'Transcript unavailable' }
   }
+  let filePath: string | null
+  try {
+    filePath =
+      args.filePath ?? (await resolveSessionFilePath(args.agent, args.sessionId, args, signal))
+  } catch (error) {
+    signal?.throwIfAborted()
+    // Why: gate refusal is transient unavailability with retry guidance —
+    // `notFound` would settle callers into a false "missing" state.
+    return { error: wslTranscriptFsRefusal(error).message }
+  }
+  signal?.throwIfAborted()
   // Why: a new agent session can report its id before the first JSONL flush;
   // callers keep that miss in loading/retry rather than showing a false error.
   if (!filePath) {
@@ -235,7 +258,8 @@ export async function readNativeChatTranscriptTail(
       decode,
       true,
       args.beforeOffset,
-      decodeLifecycle
+      decodeLifecycle,
+      signal
     )
     signal?.throwIfAborted()
     return {
diff --git a/src/main/native-chat/transcript-watch-resolve-poll.test.ts b/src/main/native-chat/transcript-watch-resolve-poll.test.ts
index 70a264b93f2..e5ec941e5e9 100644
--- a/src/main/native-chat/transcript-watch-resolve-poll.test.ts
+++ b/src/main/native-chat/transcript-watch-resolve-poll.test.ts
@@ -20,6 +20,7 @@ vi.mock('./host-readable-transcript-path', async (importOriginal) => ({
 }))
 
 import { subscribeNativeChatTranscript } from './transcript-watch'
+import { WslTranscriptFsError } from './wsl-transcript-fs-gate'
 
 const realPlatform = process.platform
 
@@ -125,6 +126,41 @@ describe('native chat transcript resolve polling', () => {
     subscription.unsubscribe()
   })
 
+  it('degrades a gate-refused initial resolve to the poll fallback instead of failing', async () => {
+    const engine = { unsubscribe: vi.fn(), watching: true }
+    mocks.resolve
+      .mockRejectedValueOnce(new WslTranscriptFsError('unavailable', 'stuck permits'))
+      .mockResolvedValue('/home/ada/found.jsonl')
+    mocks.install.mockImplementation((filePath: string) => (filePath ? engine : null))
+
+    const subscription = await subscribeNativeChatTranscript({
+      agent: 'claude',
+      sessionId: 'session-id',
+      resolvePollIntervalMs: 10,
+      onAppend: () => {}
+    })
+    expect(subscription.watching).toBe(true)
+
+    await vi.advanceTimersByTimeAsync(20)
+    expect(
+      mocks.install.mock.calls.some(([filePath]) => filePath === '/home/ada/found.jsonl')
+    ).toBe(true)
+    subscription.unsubscribe()
+    expect(engine.unsubscribe).toHaveBeenCalled()
+  })
+
+  it('still fails subscribe on non-gate resolver errors', async () => {
+    mocks.resolve.mockRejectedValueOnce(new Error('resolver crashed'))
+
+    await expect(
+      subscribeNativeChatTranscript({
+        agent: 'claude',
+        sessionId: 'session-id',
+        onAppend: () => {}
+      })
+    ).rejects.toThrow('resolver crashed')
+  })
+
   it('cancels queued WSL resolution when the subscription closes', async () => {
     setPlatform('win32')
     let receivedSignal: AbortSignal | undefined
diff --git a/src/main/native-chat/transcript-watch.ts b/src/main/native-chat/transcript-watch.ts
index fff5bc60599..2370d7b6410 100644
--- a/src/main/native-chat/transcript-watch.ts
+++ b/src/main/native-chat/transcript-watch.ts
@@ -11,6 +11,7 @@ import type {
   SubscribeNativeChatTranscriptArgs
 } from './transcript-watch-contract'
 import { nativeChatLineDecoderForAgent } from './transcript-tail-reader'
+import { wslTranscriptFsRefusal } from './wsl-transcript-fs-gate'
 
 export { readNativeChatTranscriptTail } from './transcript-tail-reader'
 export { getActiveNativeChatWatcherCount } from './transcript-watch-engine'
@@ -207,7 +208,16 @@ export async function subscribeNativeChatTranscript(
     return { unsubscribe: () => {}, watching: false }
   }
 
-  const installed = await attemptInstall(args, decode, setupSignal)
+  let installed: NativeChatTranscriptSubscription | null
+  try {
+    installed = await attemptInstall(args, decode, setupSignal)
+  } catch (error) {
+    setupSignal?.throwIfAborted()
+    // Why: a gate-refused resolve (stalled WSL distro) must degrade to the
+    // resolve-poll fallback below, not fail the subscribe outright.
+    void wslTranscriptFsRefusal(error) // rethrows anything that is not a gate refusal
+    installed = null
+  }
   if (installed) {
     return installed
   }
diff --git a/src/main/native-chat/wsl-transcript-fs-gate.test.ts b/src/main/native-chat/wsl-transcript-fs-gate.test.ts
index b434d13cc4e..1f82ab25277 100644
--- a/src/main/native-chat/wsl-transcript-fs-gate.test.ts
+++ b/src/main/native-chat/wsl-transcript-fs-gate.test.ts
@@ -1,5 +1,17 @@
-import { describe, expect, it, vi } from 'vitest'
-import { runWslTranscriptFsTask } from './wsl-transcript-fs-gate'
+import { afterEach, beforeEach, describe, expect, it, vi, type MockInstance } from 'vitest'
+import {
+  runWslTranscriptFsTask,
+  WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS,
+  WSL_TRANSCRIPT_FS_MAX_PENDING_TASKS,
+  WSL_TRANSCRIPT_FS_MAX_WAITERS_PER_TASK,
+  WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS,
+  WslTranscriptFsError
+} from './wsl-transcript-fs-gate'
+
+const SLOW_MESSAGE =
+  'WSL transcript files are temporarily unavailable because filesystem access is taking too long. Try again shortly or restart Orca if the issue continues.'
+const CAPACITY_MESSAGE =
+  'WSL transcript discovery is temporarily unavailable because too many filesystem requests are already waiting. Try again shortly or restart Orca if the issue continues.'
 
 function deferred<T>(): {
   promise: Promise<T>
@@ -28,6 +40,16 @@ function run(
 }
 
 describe('WSL transcript filesystem task scheduling', () => {
+  let warnSpy: MockInstance
+
+  beforeEach(() => {
+    warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    warnSpy.mockRestore()
+  })
+
   it('does not block an exact probe behind a running scan on the same route', async () => {
     const stalled = deferred<string>()
     const scanTask = vi.fn(() => stalled.promise)
@@ -97,8 +119,9 @@ describe('WSL transcript filesystem task scheduling', () => {
     const abandonedTask = vi.fn(async () => 'unused')
     const abandoned = run('\\\\wsl.localhost\\Fedora\\a', 'scan', abandonedTask, controller.signal)
 
-    controller.abort(new Error('closed subscription'))
-    await expect(abandoned).rejects.toThrow('closed subscription')
+    const reason = new Error('closed subscription')
+    controller.abort(reason)
+    await expect(abandoned).rejects.toBe(reason)
     ubuntu.resolve('ubuntu')
     debian.resolve('debian')
     await Promise.all([first, second])
@@ -125,8 +148,9 @@ describe('WSL transcript filesystem task scheduling', () => {
     const second = run('\\\\wsl.localhost\\Ubuntu\\shared', 'exact', task, secondController.signal)
     await vi.waitFor(() => expect(task).toHaveBeenCalledOnce())
 
-    firstController.abort(new Error('first closed'))
-    await expect(first).rejects.toThrow('first closed')
+    const reason = new Error('first closed')
+    firstController.abort(reason)
+    await expect(first).rejects.toBe(reason)
     pending.resolve('second')
     await expect(second).resolves.toBe('second')
     expect(task).toHaveBeenCalledOnce()
@@ -175,4 +199,436 @@ describe('WSL transcript filesystem task scheduling', () => {
 
     await expect(Promise.all(tasks)).resolves.toEqual(['0', '1', '2', '3'])
   })
+
+  it.each([
+    ['exact', WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS],
+    ['scan', WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS]
+  ] as const)('rejects a stalled %s waiter at its deadline', async (priority, deadlineMs) => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    try {
+      const task = vi.fn(() => stalled.promise)
+      const pending = run(`\\\\wsl.localhost\\Deadline-${priority}\\a`, priority, task)
+      const rejected = expect(pending).rejects.toMatchObject({
+        name: 'WslTranscriptFsError',
+        code: 'timeout',
+        message: SLOW_MESSAGE
+      })
+      let settled = false
+      void pending.then(
+        () => (settled = true),
+        () => (settled = true)
+      )
+
+      await vi.advanceTimersByTimeAsync(0)
+      expect(task).toHaveBeenCalledOnce()
+      await vi.advanceTimersByTimeAsync(deadlineMs - 1)
+      expect(settled).toBe(false)
+      await vi.advanceTimersByTimeAsync(1)
+      await rejected
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it.each([
+    ['exact', WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS],
+    ['scan', WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS]
+  ] as const)('completes healthy %s work below its deadline', async (priority, deadlineMs) => {
+    vi.useFakeTimers()
+    const work = deferred<string>()
+    try {
+      const pending = run(`\\\\wsl.localhost\\Healthy-${priority}\\a`, priority, () => work.promise)
+
+      await vi.advanceTimersByTimeAsync(deadlineMs - 1)
+      work.resolve('healthy')
+      await expect(pending).resolves.toBe('healthy')
+      expect(vi.getTimerCount()).toBe(0)
+      await vi.advanceTimersByTimeAsync(deadlineMs)
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      work.resolve('healthy')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('does not let one timed-out waiter settle a later shared waiter', async () => {
+    vi.useFakeTimers()
+    const work = deferred<string>()
+    const task = vi.fn(() => work.promise)
+    try {
+      const path = '\\\\wsl.localhost\\Ubuntu\\staggered'
+      const first = run(path, 'exact', task)
+      const firstRejected = expect(first).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(10_000)
+      const second = run(path, 'exact', task)
+
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS - 10_000)
+      await firstRejected
+      work.resolve('shared')
+      await expect(second).resolves.toBe('shared')
+      expect(task).toHaveBeenCalledOnce()
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      work.resolve('shared')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('rejects newest work when the pending queue is full', async () => {
+    vi.useFakeTimers()
+    const ubuntu = deferred<string>()
+    const debian = deferred<string>()
+    const queuedController = new AbortController()
+    try {
+      const ubuntuTask = vi.fn(() => ubuntu.promise)
+      const debianTask = vi.fn(() => debian.promise)
+      const first = run('\\\\wsl.localhost\\Ubuntu\\occupied', 'exact', ubuntuTask)
+      const second = run('\\\\wsl.localhost\\Debian\\occupied', 'exact', debianTask)
+      await vi.advanceTimersByTimeAsync(0)
+
+      const queued = Array.from({ length: WSL_TRANSCRIPT_FS_MAX_PENDING_TASKS }, (_, index) =>
+        run(
+          `\\\\wsl.localhost\\Queued-${index}\\a`,
+          'exact',
+          async () => String(index),
+          index === 0 ? queuedController.signal : undefined
+        )
+      )
+      const overflowTask = vi.fn(async () => 'overflow')
+      await expect(
+        run('\\\\wsl.localhost\\Overflow\\a', 'exact', overflowTask)
+      ).rejects.toMatchObject({ code: 'capacity', message: CAPACITY_MESSAGE })
+      expect(overflowTask).not.toHaveBeenCalled()
+
+      const reason = new Error('queued caller closed')
+      queuedController.abort(reason)
+      await expect(queued[0]).rejects.toBe(reason)
+      const replacement = run('\\\\wsl.localhost\\Replacement\\a', 'exact', async () => 'new')
+
+      ubuntu.resolve('ubuntu')
+      debian.resolve('debian')
+      await expect(
+        Promise.all([first, second, ...queued.slice(1), replacement])
+      ).resolves.toHaveLength(WSL_TRANSCRIPT_FS_MAX_PENDING_TASKS + 2)
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      ubuntu.resolve('ubuntu')
+      debian.resolve('debian')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('caps callers waiting on shared work', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    const task = vi.fn(() => stalled.promise)
+    const firstController = new AbortController()
+    try {
+      const path = '\\\\wsl.localhost\\Ubuntu\\shared-cap'
+      const waiters = Array.from({ length: WSL_TRANSCRIPT_FS_MAX_WAITERS_PER_TASK }, (_, index) =>
+        run(path, 'exact', task, index === 0 ? firstController.signal : undefined)
+      )
+      await vi.advanceTimersByTimeAsync(0)
+
+      await expect(run(path, 'exact', task)).rejects.toMatchObject({
+        code: 'capacity',
+        message: CAPACITY_MESSAGE
+      })
+      const reason = new Error('first waiter closed')
+      firstController.abort(reason)
+      await expect(waiters[0]).rejects.toBe(reason)
+      const replacement = run(path, 'exact', task)
+      stalled.resolve('shared')
+      await expect(Promise.all([...waiters.slice(1), replacement])).resolves.toEqual(
+        Array(WSL_TRANSCRIPT_FS_MAX_WAITERS_PER_TASK).fill('shared')
+      )
+      expect(task).toHaveBeenCalledOnce()
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      stalled.resolve('shared')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('fails new work fast after both running permits stall', async () => {
+    vi.useFakeTimers()
+    const ubuntu = deferred<string>()
+    const debian = deferred<string>()
+    try {
+      const first = run('\\\\wsl.localhost\\Ubuntu\\stalled', 'exact', () => ubuntu.promise)
+      const second = run('\\\\wsl.localhost\\Debian\\stalled', 'exact', () => debian.promise)
+      const firstRejected = expect(first).rejects.toBeInstanceOf(WslTranscriptFsError)
+      const secondRejected = expect(second).rejects.toBeInstanceOf(WslTranscriptFsError)
+
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS)
+      await Promise.all([firstRejected, secondRejected])
+      const laterTask = vi.fn(async () => 'later')
+      await expect(
+        run('\\\\wsl.localhost\\Fedora\\later', 'exact', laterTask)
+      ).rejects.toMatchObject({ code: 'unavailable', message: SLOW_MESSAGE })
+      expect(laterTask).not.toHaveBeenCalled()
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      ubuntu.resolve('ubuntu')
+      debian.resolve('debian')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('fails only work needing a stuck lane fast, keeping the other permit usable', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    try {
+      const stuck = run('\\\\wsl.localhost\\Ubuntu\\lane-stuck', 'exact', () => stalled.promise)
+      const stuckRejected = expect(stuck).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS)
+      await stuckRejected
+
+      const sameLaneTask = vi.fn(async () => 'same-lane')
+      await expect(
+        run('\\\\wsl.localhost\\Ubuntu\\lane-stuck-sibling', 'exact', sameLaneTask)
+      ).rejects.toMatchObject({ code: 'unavailable', message: SLOW_MESSAGE })
+      expect(sameLaneTask).not.toHaveBeenCalled()
+      await expect(
+        run('\\\\wsl.localhost\\Debian\\healthy-lane', 'exact', async () => 'debian')
+      ).resolves.toBe('debian')
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('fails scans and same-route probes fast while a scan is stuck', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    try {
+      const stuckScan = run('\\\\wsl.localhost\\Ubuntu\\stuck-tree', 'scan', () => stalled.promise)
+      const stuckRejected = expect(stuckScan).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS)
+      await stuckRejected
+
+      const otherScanTask = vi.fn(async () => 'other-scan')
+      await expect(
+        run('\\\\wsl.localhost\\Debian\\other-tree', 'scan', otherScanTask)
+      ).rejects.toMatchObject({ code: 'unavailable' })
+      expect(otherScanTask).not.toHaveBeenCalled()
+      // The whole Ubuntu mount is hung — an exact probe there would only burn
+      // the remaining permit on it.
+      await expect(
+        run('\\\\wsl.localhost\\Ubuntu\\live-probe', 'exact', async () => 'exact')
+      ).rejects.toMatchObject({ code: 'unavailable' })
+      await expect(
+        run('\\\\wsl.localhost\\Debian\\live-probe', 'exact', async () => 'exact')
+      ).resolves.toBe('exact')
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('keeps a stuck exact probe from feeding a doomed scan the second permit', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    try {
+      const stuck = run('\\\\wsl.localhost\\Ubuntu\\hung-file', 'exact', () => stalled.promise)
+      const stuckRejected = expect(stuck).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS)
+      await stuckRejected
+
+      const doomedScanTask = vi.fn(async () => 'doomed')
+      await expect(
+        run('\\\\wsl.localhost\\Ubuntu\\tree', 'scan', doomedScanTask)
+      ).rejects.toMatchObject({ code: 'unavailable' })
+      expect(doomedScanTask).not.toHaveBeenCalled()
+      await expect(
+        run('\\\\wsl.localhost\\Debian\\tree', 'scan', async () => 'debian-scan')
+      ).resolves.toBe('debian-scan')
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('admits new work again once stuck work finally settles', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    try {
+      const stuck = run('\\\\wsl.localhost\\Ubuntu\\recovering', 'exact', () => stalled.promise)
+      const stuckRejected = expect(stuck).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS)
+      await stuckRejected
+      await expect(
+        run('\\\\wsl.localhost\\Ubuntu\\recovering-next', 'exact', async () => 'blocked')
+      ).rejects.toMatchObject({ code: 'unavailable' })
+
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      await expect(
+        run('\\\\wsl.localhost\\Ubuntu\\recovering-next', 'exact', async () => 'recovered')
+      ).resolves.toBe('recovered')
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('refuses to join in-flight work already past its own deadline', async () => {
+    vi.useFakeTimers()
+    const work = deferred<string>()
+    const task = vi.fn(() => work.promise)
+    try {
+      const path = '\\\\wsl.localhost\\Ubuntu\\join-stuck'
+      const first = run(path, 'exact', task)
+      const firstRejected = expect(first).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(10_000)
+      const second = run(path, 'exact', task)
+      const secondRejected = expect(second).rejects.toMatchObject({ code: 'timeout' })
+
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS - 10_000)
+      await firstRejected
+      const joinTask = vi.fn(async () => 'join')
+      await expect(run(path, 'exact', joinTask)).rejects.toMatchObject({ code: 'unavailable' })
+      expect(joinTask).not.toHaveBeenCalled()
+      await vi.advanceTimersByTimeAsync(10_000)
+      await secondRejected
+    } finally {
+      work.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('fails joins onto queued work fast when stuck I/O keeps it from running', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    const queuedTask = vi.fn(async () => 'queued')
+    try {
+      const stuck = run('\\\\wsl.localhost\\Ubuntu\\trap-hung', 'exact', () => stalled.promise)
+      const stuckRejected = expect(stuck).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(5_000)
+      // Queued behind the same route before the hang is detected.
+      const queuedPath = '\\\\wsl.localhost\\Ubuntu\\trap-queued'
+      const queued = run(queuedPath, 'exact', queuedTask)
+      const queuedRejected = expect(queued).rejects.toMatchObject({ code: 'timeout' })
+
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS - 5_000)
+      await stuckRejected
+      // Re-requests must not keep the doomed queued task alive with fresh
+      // deadlines — that would defeat the fail-fast for as long as I/O hangs.
+      await expect(run(queuedPath, 'exact', queuedTask)).rejects.toMatchObject({
+        code: 'unavailable'
+      })
+      await vi.advanceTimersByTimeAsync(5_000)
+      await queuedRejected
+      expect(queuedTask).not.toHaveBeenCalled()
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('does not feed a stuck route the other permit from the queue', async () => {
+    vi.useFakeTimers()
+    const scanWork = deferred<string>()
+    const debianWork = deferred<string>()
+    const ubuntuTask = vi.fn(async () => 'ubuntu')
+    try {
+      const scanU = run(
+        '\\\\wsl.localhost\\Ubuntu\\queued-route-tree',
+        'scan',
+        () => scanWork.promise
+      )
+      const exactD = run(
+        '\\\\wsl.localhost\\Debian\\queued-route-d',
+        'exact',
+        () => debianWork.promise
+      )
+      const scanRejected = expect(scanU).rejects.toMatchObject({ code: 'timeout' })
+      const exactDRejected = expect(exactD).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(35_000)
+      await exactDRejected
+
+      // Queued before Ubuntu's hang is detected at the 60s scan deadline.
+      const queuedU = run('\\\\wsl.localhost\\Ubuntu\\queued-route-file', 'exact', ubuntuTask)
+      const queuedURejected = expect(queuedU).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(25_000)
+      await scanRejected
+
+      debianWork.resolve('debian')
+      await vi.advanceTimersByTimeAsync(0)
+      expect(ubuntuTask).not.toHaveBeenCalled()
+      await vi.advanceTimersByTimeAsync(5_000)
+      await queuedURejected
+      expect(ubuntuTask).not.toHaveBeenCalled()
+    } finally {
+      scanWork.resolve('late')
+      debianWork.resolve('debian')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('warns once per task that outlives its deadline while running', async () => {
+    vi.useFakeTimers()
+    const stalled = deferred<string>()
+    try {
+      const stuck = run('\\\\wsl.localhost\\Ubuntu\\logged', 'exact', () => stalled.promise)
+      const stuckRejected = expect(stuck).rejects.toMatchObject({ code: 'timeout' })
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS * 3)
+      await stuckRejected
+      expect(warnSpy).toHaveBeenCalledOnce()
+      expect(warnSpy.mock.calls[0][0]).toContain('exact')
+      expect(warnSpy.mock.calls[0][0]).toContain('logged')
+    } finally {
+      stalled.resolve('late')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
+
+  it('does not mark a scan permit stuck before the scan deadline', async () => {
+    vi.useFakeTimers()
+    const exactWork = deferred<string>()
+    const scanWork = deferred<string>()
+    try {
+      const exact = run(
+        '\\\\wsl.localhost\\Ubuntu\\stalled-exact',
+        'exact',
+        () => exactWork.promise
+      )
+      const scanTask = vi.fn(() => scanWork.promise)
+      const scanPath = '\\\\wsl.localhost\\Debian\\healthy-scan'
+      const scan = run(scanPath, 'scan', scanTask)
+      const exactRejected = expect(exact).rejects.toMatchObject({ code: 'timeout' })
+
+      await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS)
+      await exactRejected
+      const duplicateTask = vi.fn(async () => 'duplicate')
+      const duplicate = run(scanPath, 'scan', duplicateTask)
+
+      scanWork.resolve('scan')
+      await expect(Promise.all([scan, duplicate])).resolves.toEqual(['scan', 'scan'])
+      expect(scanTask).toHaveBeenCalledOnce()
+      expect(duplicateTask).not.toHaveBeenCalled()
+    } finally {
+      exactWork.resolve('late')
+      scanWork.resolve('scan')
+      await vi.advanceTimersByTimeAsync(0)
+      vi.useRealTimers()
+    }
+  })
 })
diff --git a/src/main/native-chat/wsl-transcript-fs-gate.ts b/src/main/native-chat/wsl-transcript-fs-gate.ts
index 03225b1d3de..52b4b22f81b 100644
--- a/src/main/native-chat/wsl-transcript-fs-gate.ts
+++ b/src/main/native-chat/wsl-transcript-fs-gate.ts
@@ -1,6 +1,35 @@
 import { parseWslUncPath } from '../../shared/wsl-paths'
 
 const MAX_CONCURRENT_WSL_TRANSCRIPT_FS_TASKS = 2
+export const WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS = 30_000
+export const WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS = 60_000
+// Burst bounds keep polling fan-out from growing retained tasks or callers indefinitely.
+export const WSL_TRANSCRIPT_FS_MAX_PENDING_TASKS = 64
+export const WSL_TRANSCRIPT_FS_MAX_WAITERS_PER_TASK = 64
+const WSL_TRANSCRIPT_FS_SLOW_MESSAGE =
+  'WSL transcript files are temporarily unavailable because filesystem access is taking too long. Try again shortly or restart Orca if the issue continues.'
+const WSL_TRANSCRIPT_FS_CAPACITY_MESSAGE =
+  'WSL transcript discovery is temporarily unavailable because too many filesystem requests are already waiting. Try again shortly or restart Orca if the issue continues.'
+
+export type WslTranscriptFsFailureCode = 'timeout' | 'capacity' | 'unavailable'
+
+export class WslTranscriptFsError extends Error {
+  constructor(
+    readonly code: WslTranscriptFsFailureCode,
+    message: string
+  ) {
+    super(message)
+    this.name = 'WslTranscriptFsError'
+  }
+}
+
+/** Narrow a caught error to a gate refusal, rethrowing anything else. */
+export function wslTranscriptFsRefusal(error: unknown): WslTranscriptFsError {
+  if (error instanceof WslTranscriptFsError) {
+    return error
+  }
+  throw error
+}
 
 export type WslTranscriptFsTaskPriority = 'exact' | 'scan'
 
@@ -9,30 +38,39 @@ type TaskWaiter<T> = {
   reject: (error: unknown) => void
   signal?: AbortSignal
   onAbort?: () => void
+  timeout?: ReturnType<typeof setTimeout>
 }
 
 type ScheduledTask<T> = {
   key: string
   laneKey: string
+  route: string
   priority: WslTranscriptFsTaskPriority
   operation: (signal: AbortSignal) => Promise<T>
   controller: AbortController
   waiters: Set<TaskWaiter<T>>
   state: 'queued' | 'running' | 'settled'
+  // Set by the deadline timer, sharing the waiters' monotonic clock — wall time
+  // would misjudge stuckness across laptop sleep or NTP steps.
+  stuck: boolean
+  stuckTimer?: ReturnType<typeof setTimeout>
 }
 
 type UnknownScheduledTask = ScheduledTask<unknown>
 
-let activeTaskCount = 0
 let activeScanCount = 0
 const activeLaneKeys = new Set<string>()
 const queuedTasks: UnknownScheduledTask[] = []
 const inFlightTasks = new Map<string, UnknownScheduledTask>()
+const activeTasks = new Set<UnknownScheduledTask>()
 
 function abortReason(signal: AbortSignal): unknown {
   return signal.reason ?? new Error('WSL transcript filesystem task aborted')
 }
 
+// wsl$ and wsl.localhost spellings of one distro stay distinct routes on
+// purpose (provider spelling can change behavior), so a stuck spelling never
+// fast-fails its twin — the twin is bounded by its own waiter deadlines.
 function routeKey(path: string): string {
   const normalized = path.replace(/\\/g, '/')
   const match = normalized.match(/^\/\/(wsl\.localhost|wsl\$)\/([^/]+)/i)
@@ -55,11 +93,11 @@ function clearTask(task: UnknownScheduledTask): void {
   }
 }
 
-function abandonTaskIfUnused(task: UnknownScheduledTask): void {
+function abandonTaskIfUnused(task: UnknownScheduledTask, reason?: unknown): void {
   if (task.waiters.size > 0 || task.state === 'settled') {
     return
   }
-  task.controller.abort()
+  task.controller.abort(reason)
   // Running I/O keeps its permit; new callers need a reusable controller.
   clearTask(task)
   if (task.state === 'queued') {
@@ -69,24 +107,91 @@ function abandonTaskIfUnused(task: UnknownScheduledTask): void {
   }
 }
 
-function attachWaiter<T>(task: ScheduledTask<T>, signal?: AbortSignal): Promise<T> {
-  if (signal?.aborted) {
-    abandonTaskIfUnused(task as UnknownScheduledTask)
-    return Promise.reject(abortReason(signal))
+function removeWaiter<T>(task: ScheduledTask<T>, waiter: TaskWaiter<T>): boolean {
+  if (!task.waiters.delete(waiter)) {
+    return false
+  }
+  if (waiter.signal && waiter.onAbort) {
+    waiter.signal.removeEventListener('abort', waiter.onAbort)
+  }
+  if (waiter.timeout) {
+    clearTimeout(waiter.timeout)
+  }
+  return true
+}
+
+function timeoutMs(priority: WslTranscriptFsTaskPriority): number {
+  return priority === 'exact'
+    ? WSL_TRANSCRIPT_FS_EXACT_TIMEOUT_MS
+    : WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS
+}
+
+function timeoutError(): WslTranscriptFsError {
+  return new WslTranscriptFsError('timeout', WSL_TRANSCRIPT_FS_SLOW_MESSAGE)
+}
+
+function capacityError(): WslTranscriptFsError {
+  return new WslTranscriptFsError('capacity', WSL_TRANSCRIPT_FS_CAPACITY_MESSAGE)
+}
+
+function unavailableError(): WslTranscriptFsError {
+  return new WslTranscriptFsError('unavailable', WSL_TRANSCRIPT_FS_SLOW_MESSAGE)
+}
+
+/**
+ * The stuck running task that would doom a new task's admission: one on the
+ * same route (the whole distro mount is hung, whatever the priority — spending
+ * the other permit on it escalates one bad distro into a global outage), one
+ * holding the single scan slot, or (with every permit stuck) any permit.
+ */
+function stuckBlocker(
+  route: string,
+  priority: WslTranscriptFsTaskPriority
+): UnknownScheduledTask | undefined {
+  const stuck = [...activeTasks].filter((task) => task.stuck)
+  if (stuck.length === MAX_CONCURRENT_WSL_TRANSCRIPT_FS_TASKS) {
+    return stuck[0]
+  }
+  return stuck.find(
+    (task) => task.route === route || (priority === 'scan' && task.priority === 'scan')
+  )
+}
+
+// Caller-abort pre-checks live in runWslTranscriptFsTask; nothing here yields
+// before the waiter is attached, so no aborted-signal recheck is needed.
+function attachWaiter<T>(
+  task: ScheduledTask<T>,
+  priority: WslTranscriptFsTaskPriority,
+  signal?: AbortSignal
+): Promise<T> {
+  if (task.waiters.size >= WSL_TRANSCRIPT_FS_MAX_WAITERS_PER_TASK) {
+    return Promise.reject(capacityError())
   }
   return new Promise<T>((resolve, reject) => {
     const waiter: TaskWaiter<T> = { resolve, reject, signal }
+    task.waiters.add(waiter)
     if (signal) {
       waiter.onAbort = () => {
-        if (!task.waiters.delete(waiter)) {
+        const reason = abortReason(signal)
+        if (!removeWaiter(task, waiter)) {
           return
         }
-        reject(abortReason(signal))
-        abandonTaskIfUnused(task as UnknownScheduledTask)
+        reject(reason)
+        abandonTaskIfUnused(task as UnknownScheduledTask, reason)
       }
       signal.addEventListener('abort', waiter.onAbort, { once: true })
     }
-    task.waiters.add(waiter)
+    // UNC/9P calls cannot be aborted; two blocked calls can retain both slots until settling or
+    // Orca restarts, while caller and queue retention remains bounded.
+    waiter.timeout = setTimeout(() => {
+      const error = timeoutError()
+      if (!removeWaiter(task, waiter)) {
+        return
+      }
+      reject(error)
+      abandonTaskIfUnused(task as UnknownScheduledTask, error)
+    }, timeoutMs(priority))
+    waiter.timeout.unref?.()
   })
 }
 
@@ -95,16 +200,15 @@ function settleTask<T>(task: ScheduledTask<T>, result: { value: T } | { error: u
     return
   }
   task.state = 'settled'
-  activeTaskCount -= 1
   if (task.priority === 'scan') {
     activeScanCount -= 1
   }
   activeLaneKeys.delete(task.laneKey)
+  activeTasks.delete(task as UnknownScheduledTask)
+  clearTimeout(task.stuckTimer)
   clearTask(task as UnknownScheduledTask)
   for (const waiter of task.waiters) {
-    if (waiter.signal && waiter.onAbort) {
-      waiter.signal.removeEventListener('abort', waiter.onAbort)
-    }
+    removeWaiter(task, waiter)
     if ('value' in result) {
       waiter.resolve(result.value)
     } else {
@@ -116,13 +220,21 @@ function settleTask<T>(task: ScheduledTask<T>, result: { value: T } | { error: u
 }
 
 function nextTaskIndex(): number {
+  // Tasks queued before their route hung must not be fed the other permit;
+  // their waiters drain by deadline while healthy routes use the slot.
+  const stuckRoutes = new Set(
+    [...activeTasks].filter((task) => task.stuck).map((task) => task.route)
+  )
   for (const priority of ['exact', 'scan'] as const) {
     // Why: keep one libuv slot available for a live transcript probe.
     if (priority === 'scan' && activeScanCount > 0) {
       continue
     }
     const index = queuedTasks.findIndex(
-      (task) => task.priority === priority && !activeLaneKeys.has(task.laneKey)
+      (task) =>
+        task.priority === priority &&
+        !activeLaneKeys.has(task.laneKey) &&
+        !stuckRoutes.has(task.route)
     )
     if (index !== -1) {
       return index
@@ -132,7 +244,7 @@ function nextTaskIndex(): number {
 }
 
 function pumpTasks(): void {
-  while (activeTaskCount < MAX_CONCURRENT_WSL_TRANSCRIPT_FS_TASKS) {
+  while (activeTasks.size < MAX_CONCURRENT_WSL_TRANSCRIPT_FS_TASKS) {
     const index = nextTaskIndex()
     if (index === -1) {
       return
@@ -142,11 +254,21 @@ function pumpTasks(): void {
       continue
     }
     task.state = 'running'
-    activeTaskCount += 1
     if (task.priority === 'scan') {
       activeScanCount += 1
     }
     activeLaneKeys.add(task.laneKey)
+    activeTasks.add(task)
+    // Anchored at run start: queue wait says nothing about the I/O itself, so
+    // the fail-fast may lag admission by at most one deadline period.
+    task.stuckTimer = setTimeout(() => {
+      task.stuck = true
+      console.warn(
+        `[wsl-transcript-fs-gate] ${task.priority} filesystem task still running after ` +
+          `${timeoutMs(task.priority)}ms and holding a permit: ${task.key}`
+      )
+    }, timeoutMs(task.priority))
+    task.stuckTimer.unref?.()
     void Promise.resolve()
       .then(() => {
         task.controller.signal.throwIfAborted()
@@ -169,28 +291,49 @@ export function runWslTranscriptFsTask<T>(
   },
   task: (signal: AbortSignal) => Promise<T>
 ): Promise<T> {
+  if (options.signal?.aborted) {
+    return Promise.reject(abortReason(options.signal))
+  }
   // Why: route spelling and Linux path case can change provider behavior, so
   // only byte-identical filesystem requests are safe to share.
   const key = JSON.stringify([options.operation, options.path])
   const existing = inFlightTasks.get(key) as ScheduledTask<T> | undefined
   if (existing) {
-    return attachWaiter(existing, options.signal)
+    // A stuck target — or a queued target that stuck I/O keeps from ever
+    // running — dooms every joiner to a slow timeout, and each fresh joiner
+    // would keep the queued task alive past its own abandonment. Fail fast.
+    if (
+      existing.stuck ||
+      (existing.state === 'queued' && stuckBlocker(existing.route, existing.priority))
+    ) {
+      return Promise.reject(unavailableError())
+    }
+    return attachWaiter(existing, options.priority, options.signal)
+  }
+  const route = routeKey(options.path)
+  // Fail fast when the permit, route, or scan slot this task needs is held by
+  // stuck I/O — queueing would only burn the caller's full deadline.
+  if (stuckBlocker(route, options.priority)) {
+    return Promise.reject(unavailableError())
+  }
+  if (queuedTasks.length >= WSL_TRANSCRIPT_FS_MAX_PENDING_TASKS) {
+    return Promise.reject(capacityError())
   }
 
   const scheduled: ScheduledTask<T> = {
     key,
-    laneKey: `${routeKey(options.path)}:${options.priority}`,
+    laneKey: `${route}:${options.priority}`,
+    route,
     priority: options.priority,
     operation: task,
     controller: new AbortController(),
     waiters: new Set(),
-    state: 'queued'
+    state: 'queued',
+    stuck: false
   }
   inFlightTasks.set(key, scheduled as UnknownScheduledTask)
-  const result = attachWaiter(scheduled, options.signal)
-  if (scheduled.state === 'queued' && scheduled.waiters.size > 0) {
-    queuedTasks.push(scheduled as UnknownScheduledTask)
-    queueMicrotask(pumpTasks)
-  }
+  const result = attachWaiter(scheduled, options.priority, options.signal)
+  queuedTasks.push(scheduled as UnknownScheduledTask)
+  queueMicrotask(pumpTasks)
   return result
 }
diff --git a/src/main/network/macos-tailscale-dns-diagnostic.ts b/src/main/network/macos-tailscale-dns-diagnostic.ts
index 5ec5501525e..a4dc948c0bd 100644
--- a/src/main/network/macos-tailscale-dns-diagnostic.ts
+++ b/src/main/network/macos-tailscale-dns-diagnostic.ts
@@ -19,7 +19,7 @@ const NETWORK_LOOKUP_FAILURE_RE =
 
 function globalDnsSection(scutilOutput: string): string {
   const scopedStart = scutilOutput.indexOf('\nDNS configuration (for scoped queries)')
-  return scopedStart >= 0 ? scutilOutput.slice(0, scopedStart) : scutilOutput
+  return scopedStart !== -1 ? scutilOutput.slice(0, scopedStart) : scutilOutput
 }
 
 export function parseMacTailscaleDnsDiagnostic(scutilOutput: string): DnsDiagnostic | null {
diff --git a/src/main/observability/bundle.test.ts b/src/main/observability/bundle.test.ts
index 347e1025893..3c6644a7d43 100644
--- a/src/main/observability/bundle.test.ts
+++ b/src/main/observability/bundle.test.ts
@@ -35,7 +35,7 @@ function makeSpan(overrides: Record<string, unknown> = {}): Record<string, unkno
     kind: 'internal',
     startTimeUnixNano: String(now - 1_000_000_000n),
     endTimeUnixNano: String(now),
-    durationMs: 1.0,
+    durationMs: 1,
     attributes: {},
     events: [],
     exit: { _tag: 'Success' },
diff --git a/src/main/observability/redactor.test.ts b/src/main/observability/redactor.test.ts
index 8de2661515a..0b8ee0f9e61 100644
--- a/src/main/observability/redactor.test.ts
+++ b/src/main/observability/redactor.test.ts
@@ -333,7 +333,7 @@ function makeSpan(overrides: Partial<RedactableSpan>): RedactableSpan {
     kind: 'internal',
     startTimeUnixNano: '1000',
     endTimeUnixNano: '2000',
-    durationMs: 1.0,
+    durationMs: 1,
     attributes: {},
     events: [],
     exit: { _tag: 'Success' },
diff --git a/src/main/observability/redactor.ts b/src/main/observability/redactor.ts
index cd5570f8577..da8feb0a8b0 100644
--- a/src/main/observability/redactor.ts
+++ b/src/main/observability/redactor.ts
@@ -123,7 +123,7 @@ export function redactString(input: string): string {
 export function redactValue(
   value: unknown,
   mode: RedactorMode = 'client',
-  seen: WeakSet<object> = new WeakSet()
+  seen = new WeakSet<object>()
 ): unknown {
   if (value === null || value === undefined) {
     return value
diff --git a/src/main/opencode-usage/store.test.ts b/src/main/opencode-usage/store.test.ts
index 6f3759efa7f..d565327fd18 100644
--- a/src/main/opencode-usage/store.test.ts
+++ b/src/main/opencode-usage/store.test.ts
@@ -1,24 +1,15 @@
-import { mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
-import type * as FsPromises from 'node:fs/promises'
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type {
   OpenCodeUsageDailyAggregate,
-  OpenCodeUsagePersistedDatabase,
   OpenCodeUsagePersistedState,
   OpenCodeUsageSession
 } from './types'
 
-const { getPathMock, writeOpens, writeGate } = vi.hoisted(() => ({
-  getPathMock: vi.fn(() => '/tmp/orca-test-userdata'),
-  // Why only mode 'w': the durable write also opens the directory read-only to fsync it, so counting
-  // every open would hide a regression back to multiple full-cache rewrites per scan.
-  writeOpens: { value: 0, inFlight: 0, maxConcurrent: 0 },
-  writeGate: {
-    blocked: false,
-    waiters: [] as (() => void)[]
-  }
+const { getPathMock } = vi.hoisted(() => ({
+  getPathMock: vi.fn(() => '/tmp/orca-test-userdata')
 }))
 
 vi.mock('electron', () => ({
@@ -27,29 +18,6 @@ vi.mock('electron', () => ({
   }
 }))
 
-vi.mock('node:fs/promises', async () => {
-  const actual = await vi.importActual<typeof FsPromises>('node:fs/promises')
-  return {
-    ...actual,
-    open: (async (...args: Parameters<typeof actual.open>) => {
-      if (args[1] !== 'w') {
-        return actual.open(...args)
-      }
-      writeOpens.value += 1
-      writeOpens.inFlight += 1
-      writeOpens.maxConcurrent = Math.max(writeOpens.maxConcurrent, writeOpens.inFlight)
-      try {
-        if (writeGate.blocked) {
-          await new Promise<void>((resolve) => writeGate.waiters.push(resolve))
-        }
-        return await actual.open(...args)
-      } finally {
-        writeOpens.inFlight -= 1
-      }
-    }) as typeof actual.open
-  }
-})
-
 vi.mock('./scanner', () => ({
   scanOpenCodeUsageDatabases: vi.fn()
 }))
@@ -57,24 +25,7 @@ vi.mock('./scanner', () => ({
 import { OpenCodeUsageStore, initOpenCodeUsagePath, normalizePersistedState } from './store'
 import { scanOpenCodeUsageDatabases } from './scanner'
 
-type ScanResult = {
-  processedDatabases: OpenCodeUsagePersistedDatabase[]
-  sessions: OpenCodeUsageSession[]
-  dailyAggregates: OpenCodeUsageDailyAggregate[]
-}
-
-function createDeferred<T>(): {
-  promise: Promise<T>
-  resolve: (value: T) => void
-} {
-  let resolve!: (value: T) => void
-  const promise = new Promise<T>((promiseResolve) => {
-    resolve = promiseResolve
-  })
-  return { promise, resolve }
-}
-
-function createEmptyScanResult(): ScanResult {
+function createEmptyScanResult() {
   return {
     processedDatabases: [],
     sessions: [],
@@ -101,9 +52,8 @@ function getDefaultState(): OpenCodeUsagePersistedState {
 function createStoreWithState(state: Partial<OpenCodeUsagePersistedState>): OpenCodeUsageStore {
   const store = new OpenCodeUsageStore({
     getRepos: () => [],
-    getAllWorktreeMeta: () => ({}),
-    getWorktreeMeta: () => undefined
-  } as never)
+    getAllWorktreeMeta: () => ({})
+  })
 
   ;(store as unknown as { state: OpenCodeUsagePersistedState }).state = {
     ...getDefaultState(),
@@ -212,11 +162,6 @@ describe('OpenCodeUsageStore', () => {
     tempUserData = mkdtempSync(join(tmpdir(), 'orca-opencode-usage-store-'))
     getPathMock.mockReturnValue(tempUserData)
     initOpenCodeUsagePath()
-    writeOpens.value = 0
-    writeOpens.inFlight = 0
-    writeOpens.maxConcurrent = 0
-    writeGate.blocked = false
-    writeGate.waiters = []
     vi.mocked(scanOpenCodeUsageDatabases).mockReset()
     vi.mocked(scanOpenCodeUsageDatabases).mockResolvedValue(createEmptyScanResult())
     vi.useFakeTimers()
@@ -228,7 +173,7 @@ describe('OpenCodeUsageStore', () => {
     rmSync(tempUserData, { recursive: true, force: true })
   })
 
-  it('persists a successful refresh with one full-cache write', async () => {
+  it('adapts OpenCode scans to pretty-printed cache persistence', async () => {
     const store = createStoreWithState({
       scanState: {
         enabled: true,
@@ -240,89 +185,9 @@ describe('OpenCodeUsageStore', () => {
 
     await store.refresh(true)
 
-    // Why exactly one: a refresh that rewrites the whole multi-MB cache twice is the regression this guards.
-    expect(writeOpens.value).toBe(1)
-    expect(readdirSync(tempUserData).filter((f) => f.endsWith('.tmp'))).toHaveLength(0)
     const persistedJson = readFileSync(join(tempUserData, 'orca-opencode-usage.json'), 'utf-8')
+    expect(scanOpenCodeUsageDatabases).toHaveBeenCalledWith([], [])
     expect(persistedJson).toContain('\n')
-    expect(JSON.parse(persistedJson).scanState).toMatchObject({
-      enabled: true,
-      lastScanStartedAt: new Date('2026-04-10T12:00:00.000-04:00').getTime(),
-      lastScanCompletedAt: new Date('2026-04-10T12:00:00.000-04:00').getTime(),
-      lastScanError: null
-    })
-  })
-
-  it('keeps scan start visible in memory while scan-start persistence is skipped', async () => {
-    const pendingScan = createDeferred<ScanResult>()
-    vi.mocked(scanOpenCodeUsageDatabases).mockReturnValueOnce(pendingScan.promise)
-    const store = createStoreWithState({
-      scanState: {
-        enabled: true,
-        lastScanStartedAt: null,
-        lastScanCompletedAt: null,
-        lastScanError: 'previous failure'
-      }
-    })
-
-    const refreshPromise = store.refresh(true)
-    await Promise.resolve()
-
-    expect(store.getScanState()).toMatchObject({
-      isScanning: true,
-      lastScanStartedAt: new Date('2026-04-10T12:00:00.000-04:00').getTime(),
-      lastScanError: null
-    })
-    expect(writeOpens.value).toBe(0)
-
-    pendingScan.resolve(createEmptyScanResult())
-    await refreshPromise
-
-    expect(store.getScanState().isScanning).toBe(false)
-    expect(writeOpens.value).toBe(1)
-  })
-
-  it('vetoes a stale concurrent async write so the newer snapshot wins without leaking tmp files', async () => {
-    const store = createStoreWithState({
-      scanState: {
-        enabled: true,
-        lastScanStartedAt: null,
-        lastScanCompletedAt: null,
-        lastScanError: null
-      }
-    })
-    const internals = store as unknown as {
-      writeToDisk: () => Promise<void>
-      state: OpenCodeUsagePersistedState
-    }
-
-    writeGate.blocked = true
-    const first = internals.writeToDisk()
-    await vi.waitFor(() => expect(writeGate.waiters.length).toBe(1))
-
-    internals.state.scanState.enabled = false
-    writeGate.blocked = false
-    const second = internals.writeToDisk()
-    writeGate.waiters.splice(0).forEach((resolve) => resolve())
-    await Promise.all([first, second])
-
-    expect(
-      JSON.parse(readFileSync(join(tempUserData, 'orca-opencode-usage.json'), 'utf-8')).scanState
-        .enabled
-    ).toBe(false)
-    expect(readdirSync(tempUserData).filter((f) => f.endsWith('.tmp'))).toHaveLength(0)
-    // Serialized, so the superseded write can be skipped safely rather than racing the newer one.
-    expect(writeOpens.maxConcurrent).toBe(1)
-  })
-
-  it('sweeps a usage temp file orphaned by a crash between write and rename', async () => {
-    const orphan = join(tempUserData, 'orca-opencode-usage.json.999.1.abc.tmp')
-    writeFileSync(orphan, '{}')
-
-    createStoreWithState({})
-    await vi.waitFor(() =>
-      expect(readdirSync(tempUserData).filter((f) => f.endsWith('.tmp'))).toHaveLength(0)
-    )
   })
 
   it('reports no data for Orca scope when only non-Orca OpenCode usage exists', async () => {
diff --git a/src/main/opencode-usage/store.ts b/src/main/opencode-usage/store.ts
index c85fa519ba5..b87357f9b0a 100644
--- a/src/main/opencode-usage/store.ts
+++ b/src/main/opencode-usage/store.ts
@@ -1,27 +1,23 @@
-/* eslint-disable max-lines -- Why: this store owns OpenCode analytics persistence, scan policy, and renderer query semantics. Keeping range/scope queries next to scan persistence prevents UI totals from drifting from the SQLite projection. */
+/* eslint-disable max-lines -- Why: OpenCode cost normalization and range, scope, and breakdown policies remain one cohesive store. */
 import { app } from 'electron'
 import { join } from 'node:path'
-import { existsSync, readFileSync } from 'node:fs'
-import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
 import type {
   OpenCodeUsageBreakdownKind,
   OpenCodeUsageBreakdownRow,
   OpenCodeUsageDailyPoint,
   OpenCodeUsageRange,
-  OpenCodeUsageScanState,
   OpenCodeUsageScope,
   OpenCodeUsageSessionRow,
   OpenCodeUsageSnapshot,
   OpenCodeUsageSummary
 } from '../../shared/opencode-usage-types'
 import type { Store } from '../persistence'
-import { loadKnownUsageWorktreesByRepo, type UsageWorktreeRef } from '../usage-worktree-metadata'
 import type { OpenCodeUsageDailyAggregate, OpenCodeUsagePersistedState } from './types'
-import { createWorktreeRefs } from '../usage/usage-worktree-refs'
 import { OPENCODE_USAGE_SCHEMA_VERSION, openCodeUsageProvider } from './opencode-usage-provider'
+import { getLocalUsageDay, getUsageRangeCutoff } from '../usage/usage-calendar-range'
+import { UsageProviderStoreLifecycle } from '../usage/usage-provider-store-lifecycle'
 
 const SCHEMA_VERSION = OPENCODE_USAGE_SCHEMA_VERSION
-const STALE_MS = 5 * 60_000
 
 let _openCodeUsageFile: string | null = null
 
@@ -70,47 +66,6 @@ function getOpenCodeUsageFile(): string {
   return _openCodeUsageFile
 }
 
-function getRangeCutoff(range: OpenCodeUsageRange): string | null {
-  if (range === 'all') {
-    return null
-  }
-  const days = range === '7d' ? 7 : range === '30d' ? 30 : 90
-  const now = new Date()
-  now.setHours(0, 0, 0, 0)
-  now.setDate(now.getDate() - (days - 1))
-  const year = now.getFullYear()
-  const month = String(now.getMonth() + 1).padStart(2, '0')
-  const day = String(now.getDate()).padStart(2, '0')
-  return `${year}-${month}-${day}`
-}
-
-function getLocalDay(timestamp: string): string | null {
-  const parsed = new Date(timestamp)
-  if (Number.isNaN(parsed.getTime())) {
-    return null
-  }
-  const year = parsed.getFullYear()
-  const month = String(parsed.getMonth() + 1).padStart(2, '0')
-  const day = String(parsed.getDate()).padStart(2, '0')
-  return `${year}-${month}-${day}`
-}
-
-function getWorktreeFingerprint(worktreesByRepo: Map<string, UsageWorktreeRef[]>): string {
-  const rows = [...worktreesByRepo.entries()]
-    .flatMap(([repoId, worktrees]) =>
-      worktrees.map((worktree) =>
-        JSON.stringify({
-          repoId,
-          worktreeId: worktree.worktreeId,
-          path: worktree.path,
-          displayName: worktree.displayName
-        })
-      )
-    )
-    .sort()
-  return JSON.stringify(rows)
-}
-
 function addCost(left: number | null, right: number | null): number | null {
   if (left === null && right === null) {
     return null
@@ -148,62 +103,22 @@ function normalizeSessionCost(
   }
 }
 
-export class OpenCodeUsageStore {
-  private state: OpenCodeUsagePersistedState
-  private readonly store: Store
-  private scanPromise: Promise<void> | null = null
-  // Why: the multi-MB usage JSON must not block the Electron main thread; the writer serializes
-  // writes and vetoes superseded renames.
-  private readonly writer = new UsageCacheSnapshotWriter('[opencode-usage]', getOpenCodeUsageFile)
-
-  constructor(store: Store) {
-    this.store = store
-    this.state = this.load()
-  }
-
-  private load(): OpenCodeUsagePersistedState {
-    try {
-      const usageFile = getOpenCodeUsageFile()
-      if (!existsSync(usageFile)) {
-        return getDefaultState()
-      }
-      const parsed = JSON.parse(readFileSync(usageFile, 'utf-8')) as OpenCodeUsagePersistedState
-      return normalizePersistedState({
-        ...getDefaultState(),
-        ...parsed,
-        scanState: {
-          ...getDefaultState().scanState,
-          ...parsed.scanState
-        }
-      })
-    } catch (error) {
-      console.error('[opencode-usage] Failed to load persisted state, starting fresh:', error)
-      return getDefaultState()
-    }
-  }
-
-  private writeToDisk(): Promise<void> {
-    // Pretty-print preserved: humans inspect this analytics cache on disk.
-    return this.writer.write(() => JSON.stringify(this.state, null, 2))
-  }
-
-  /** Await queued cache writes so quit does not drop the final snapshot. */
-  flush(): Promise<void> {
-    return this.writer.flush()
-  }
-
-  async setEnabled(enabled: boolean): Promise<OpenCodeUsageScanState> {
-    this.state.scanState.enabled = enabled
-    await this.writeToDisk()
-    return this.getScanState()
-  }
-
-  getScanState(): OpenCodeUsageScanState {
-    return {
-      ...this.state.scanState,
-      isScanning: this.scanPromise !== null,
-      hasAnyOpenCodeData: this.state.sessions.length > 0 || this.state.dailyAggregates.length > 0
-    }
+export class OpenCodeUsageStore extends UsageProviderStoreLifecycle<
+  'processedDatabases',
+  OpenCodeUsagePersistedState,
+  'hasAnyOpenCodeData'
+> {
+  constructor(store: Pick<Store, 'getRepos' | 'getAllWorktreeMeta'>) {
+    super(store, {
+      logTag: '[opencode-usage]',
+      resolveCacheFile: getOpenCodeUsageFile,
+      createDefaultState: getDefaultState,
+      normalizeState: normalizePersistedState,
+      sourceKey: 'processedDatabases',
+      dataPresenceKey: 'hasAnyOpenCodeData',
+      jsonIndent: 2,
+      scan: openCodeUsageProvider.scan
+    })
   }
 
   getSnapshot(
@@ -221,63 +136,6 @@ export class OpenCodeUsageStore {
     }
   }
 
-  async refresh(force = false): Promise<OpenCodeUsageScanState> {
-    if (!this.state.scanState.enabled) {
-      return this.getScanState()
-    }
-    const currentWorktreeFingerprint = await this.getCurrentWorktreeFingerprint()
-    if (!force && this.state.scanState.lastScanCompletedAt) {
-      const ageMs = Date.now() - this.state.scanState.lastScanCompletedAt
-      if (ageMs < STALE_MS && this.state.worktreeFingerprint === currentWorktreeFingerprint) {
-        return this.getScanState()
-      }
-    }
-    await this.runScan()
-    return this.getScanState()
-  }
-
-  private async runScan(): Promise<void> {
-    if (this.scanPromise) {
-      await this.scanPromise
-      return
-    }
-
-    this.state.scanState.lastScanStartedAt = Date.now()
-    this.state.scanState.lastScanError = null
-    // Why no write here: persisting scan-start would rewrite the whole cache before a single result
-    // changed. The completion/failure write below persists the same fields.
-
-    this.scanPromise = (async () => {
-      try {
-        const repos = this.store.getRepos()
-        const worktreesByRepo = loadKnownUsageWorktreesByRepo(this.store, repos)
-        const worktreeFingerprint = getWorktreeFingerprint(worktreesByRepo)
-        const result = await openCodeUsageProvider.scan(
-          createWorktreeRefs(repos, worktreesByRepo),
-          this.state.worktreeFingerprint === worktreeFingerprint
-            ? this.state.processedDatabases
-            : []
-        )
-        this.state.processedDatabases = result.processedDatabases
-        this.state.sessions = result.sessions
-        this.state.dailyAggregates = result.dailyAggregates
-        this.state.worktreeFingerprint = worktreeFingerprint
-        this.state.scanState.lastScanCompletedAt = Date.now()
-        this.state.scanState.lastScanError = null
-        // Why swallow: persistence is a cache concern. A disk failure must not turn a good scan into
-        // a scan error and reject refresh() for every query caller; writeToDisk already logs it.
-        await this.writeToDisk().catch(() => {})
-      } catch (error) {
-        this.state.scanState.lastScanError = error instanceof Error ? error.message : String(error)
-        await this.writeToDisk().catch(() => {})
-      } finally {
-        this.scanPromise = null
-      }
-    })()
-
-    await this.scanPromise
-  }
-
   async getSummary(
     scope: OpenCodeUsageScope,
     range: OpenCodeUsageRange
@@ -479,7 +337,7 @@ export class OpenCodeUsageStore {
     scope: OpenCodeUsageScope,
     range: OpenCodeUsageRange
   ): OpenCodeUsageDailyAggregate[] {
-    const cutoff = getRangeCutoff(range)
+    const cutoff = getUsageRangeCutoff(range)
     return this.state.dailyAggregates.filter((row) => {
       if (scope === 'orca' && !row.worktreeId) {
         return false
@@ -492,13 +350,13 @@ export class OpenCodeUsageStore {
   }
 
   private getFilteredSessions(scope: OpenCodeUsageScope, range: OpenCodeUsageRange) {
-    const cutoff = getRangeCutoff(range)
+    const cutoff = getUsageRangeCutoff(range)
     return this.state.sessions.filter((session) => {
       if (scope === 'orca' && !session.primaryWorktreeId) {
         return false
       }
       if (cutoff) {
-        const day = getLocalDay(session.lastTimestamp)
+        const day = getLocalUsageDay(session.lastTimestamp)
         if (!day || day < cutoff) {
           return false
         }
@@ -506,9 +364,4 @@ export class OpenCodeUsageStore {
       return true
     })
   }
-
-  private async getCurrentWorktreeFingerprint(): Promise<string> {
-    const repos = this.store.getRepos()
-    return getWorktreeFingerprint(loadKnownUsageWorktreesByRepo(this.store, repos))
-  }
 }
diff --git a/src/main/orca-profiles/profile-artifact-cloud-cleanup.test.ts b/src/main/orca-profiles/profile-artifact-cloud-cleanup.test.ts
new file mode 100644
index 00000000000..0624124c385
--- /dev/null
+++ b/src/main/orca-profiles/profile-artifact-cloud-cleanup.test.ts
@@ -0,0 +1,244 @@
+import { mkdirSync } from 'node:fs'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { OrcaProfileCloudSummary } from '../../shared/orca-profiles'
+import type * as ArtifactCreateIntentStore from '../artifacts/artifact-create-intent-store'
+import type * as ProfileArtifactCloudCleanup from './profile-artifact-cloud-cleanup'
+import type * as ProfileIndexStore from './profile-index-store'
+
+vi.mock('../artifacts/artifact-create-intent-store', async () => {
+  const actual = await vi.importActual<typeof ArtifactCreateIntentStore>(
+    '../artifacts/artifact-create-intent-store'
+  )
+  return { ...actual, clearArtifactCreateIntents: vi.fn(actual.clearArtifactCreateIntents) }
+})
+
+vi.mock('./profile-index-store', async () => {
+  const actual = await vi.importActual<typeof ProfileIndexStore>('./profile-index-store')
+  return { ...actual, writeProfileIndex: vi.fn(actual.writeProfileIndex) }
+})
+
+vi.mock('./profile-artifact-cloud-cleanup', async () => {
+  const actual = await vi.importActual<typeof ProfileArtifactCloudCleanup>(
+    './profile-artifact-cloud-cleanup'
+  )
+  return {
+    ...actual,
+    commitArtifactCloudCleanup: vi.fn(actual.commitArtifactCloudCleanup)
+  }
+})
+
+import {
+  clearArtifactCreateIntents,
+  getArtifactCreateIntent,
+  getOrCreateArtifactCreateIntent
+} from '../artifacts/artifact-create-intent-store'
+import type { ArtifactShareScope } from '../artifacts/artifact-share-record-store'
+import {
+  artifactCloudCleanupNeedsCommit,
+  commitArtifactCloudCleanup,
+  prepareArtifactCloudCleanup,
+  prepareArtifactCloudUse
+} from './profile-artifact-cloud-cleanup'
+import { linkOrcaProfileToCloud, unlinkOrcaProfileFromCloud } from './profile-cloud-index'
+import {
+  getOrcaProfileIndexPath,
+  getOrcaProfileDirectory,
+  loadOrCreateProfileIndex,
+  readProfileIndex,
+  writeProfileIndex
+} from './profile-index-store'
+
+const createdPaths: string[] = []
+const profileId = 'local-default'
+
+afterEach(async () => {
+  vi.clearAllMocks()
+  await Promise.all(
+    createdPaths.splice(0).map((path) => rm(path, { recursive: true, force: true }))
+  )
+})
+
+describe('profile artifact cloud cleanup', () => {
+  it('preserves recovery state when the profile write fails', async () => {
+    const userDataPath = await createLinkedProfile(cloud('org-a'))
+    const scope = shareScope('org-a')
+    createIntent(userDataPath, scope)
+    vi.mocked(writeProfileIndex).mockImplementationOnce(() => {
+      throw new Error('profile write failed')
+    })
+
+    expect(() => linkOrcaProfileToCloud(profileId, cloud('org-b'), userDataPath)).toThrow(
+      'profile write failed'
+    )
+    expect(getArtifactCreateIntent(profileId, userDataPath, '/report.md', scope)).not.toBeNull()
+
+    linkOrcaProfileToCloud(profileId, cloud('org-b'), userDataPath)
+    expect(getArtifactCreateIntent(profileId, userDataPath, '/report.md', scope)).toBeNull()
+  })
+
+  it('retries cleanup after the profile transition commits', async () => {
+    const userDataPath = await createLinkedProfile(cloud('org-a'))
+    const scope = shareScope('org-a')
+    createIntent(userDataPath, scope)
+    vi.mocked(clearArtifactCreateIntents).mockImplementationOnce(() => {
+      throw new Error('cleanup failed')
+    })
+
+    expect(() => linkOrcaProfileToCloud(profileId, cloud('org-b'), userDataPath)).toThrow(
+      'cleanup failed'
+    )
+    expect(currentCloud(userDataPath)?.activeOrgId).toBe('org-b')
+    expect(getArtifactCreateIntent(profileId, userDataPath, '/report.md', scope)).not.toBeNull()
+
+    linkOrcaProfileToCloud(profileId, cloud('org-b'), userDataPath)
+    expect(getArtifactCreateIntent(profileId, userDataPath, '/report.md', scope)).toBeNull()
+  })
+
+  it('reconciles an interrupted transition before linking again', async () => {
+    const userDataPath = await createLinkedProfile(cloud('org-a'))
+    const scope = shareScope('org-a')
+    createIntent(userDataPath, scope)
+    interruptNextCleanupCommit()
+
+    expect(() => linkOrcaProfileToCloud(profileId, cloud('org-b'), userDataPath)).toThrow(
+      'cleanup commit interrupted'
+    )
+    expect(currentCloud(userDataPath)?.activeOrgId).toBe('org-b')
+    vi.mocked(writeProfileIndex).mockClear()
+    vi.mocked(clearArtifactCreateIntents).mockImplementationOnce(() => {
+      throw new Error('cleanup failed')
+    })
+
+    expect(() => linkOrcaProfileToCloud(profileId, cloud('org-c'), userDataPath)).toThrow(
+      'cleanup failed'
+    )
+    expect(writeProfileIndex).not.toHaveBeenCalled()
+    expect(currentCloud(userDataPath)?.activeOrgId).toBe('org-b')
+    expect(getArtifactCreateIntent(profileId, userDataPath, '/report.md', scope)).not.toBeNull()
+
+    linkOrcaProfileToCloud(profileId, cloud('org-c'), userDataPath)
+    expect(currentCloud(userDataPath)?.activeOrgId).toBe('org-c')
+    expect(getArtifactCreateIntent(profileId, userDataPath, '/report.md', scope)).toBeNull()
+  })
+
+  it('reconciles an interrupted transition before unlinking', async () => {
+    const userDataPath = await createLinkedProfile(cloud('org-a'))
+    const scope = shareScope('org-a')
+    createIntent(userDataPath, scope)
+    interruptNextCleanupCommit()
+
+    expect(() => linkOrcaProfileToCloud(profileId, cloud('org-b'), userDataPath)).toThrow(
+      'cleanup commit interrupted'
+    )
+    expect(currentCloud(userDataPath)?.activeOrgId).toBe('org-b')
+    vi.mocked(writeProfileIndex).mockClear()
+    vi.mocked(clearArtifactCreateIntents).mockImplementationOnce(() => {
+      throw new Error('cleanup failed')
+    })
+
+    expect(() => unlinkOrcaProfileFromCloud(profileId, userDataPath)).toThrow('cleanup failed')
+    expect(writeProfileIndex).not.toHaveBeenCalled()
+    expect(currentCloud(userDataPath)?.activeOrgId).toBe('org-b')
+    expect(getArtifactCreateIntent(profileId, userDataPath, '/report.md', scope)).not.toBeNull()
+
+    unlinkOrcaProfileFromCloud(profileId, userDataPath)
+    expect(currentCloud(userDataPath)).toBeUndefined()
+    expect(getArtifactCreateIntent(profileId, userDataPath, '/report.md', scope)).toBeNull()
+  })
+
+  it('preserves an orphaned local marker for an unknown profile', async () => {
+    const userDataPath = await createLinkedProfile(cloud('org-a'))
+    const orphanProfileId = 'missing-profile'
+    const scope = shareScope('org-a')
+    mkdirSync(getOrcaProfileDirectory(orphanProfileId, userDataPath), { recursive: true })
+    createIntent(userDataPath, scope, orphanProfileId)
+    prepareArtifactCloudCleanup(orphanProfileId, userDataPath, undefined)
+
+    const transitions = [
+      () => linkOrcaProfileToCloud(orphanProfileId, cloud('org-b'), userDataPath),
+      () => unlinkOrcaProfileFromCloud(orphanProfileId, userDataPath)
+    ]
+    for (const transition of transitions) {
+      expect(transition).toThrow('unknown_orca_profile')
+      expect(artifactCloudCleanupNeedsCommit(orphanProfileId, userDataPath, undefined)).toBe(true)
+      expect(
+        getArtifactCreateIntent(orphanProfileId, userDataPath, '/report.md', scope)
+      ).not.toBeNull()
+    }
+  })
+
+  it('cleans old recovery state when the active organization changes', async () => {
+    const userDataPath = await createLinkedProfile(cloud('org-a'))
+    const scope = shareScope('org-a')
+    createIntent(userDataPath, scope)
+
+    linkOrcaProfileToCloud(profileId, cloud('org-b'), userDataPath)
+
+    expect(getArtifactCreateIntent(profileId, userDataPath, '/report.md', scope)).toBeNull()
+  })
+
+  it('blocks artifact use until a visible transition is durably committed', async () => {
+    const cloudSummary = cloud('org-a')
+    const userDataPath = await createLinkedProfile(cloudSummary)
+    prepareArtifactCloudCleanup(profileId, userDataPath, cloudSummary)
+
+    expect(() =>
+      prepareArtifactCloudUse({ id: profileId, cloud: cloudSummary }, userDataPath)
+    ).toThrow(/transition must be retried/)
+  })
+})
+
+function cloud(activeOrgId: string): OrcaProfileCloudSummary {
+  return {
+    cloudProfileId: 'cloud-profile-a',
+    userId: 'user-a',
+    email: 'user@example.com',
+    activeOrgId,
+    linkedAt: 1
+  }
+}
+
+function shareScope(cloudOrganizationId: string): ArtifactShareScope {
+  return {
+    cloudUserId: 'user-a',
+    cloudProfileId: 'cloud-profile-a',
+    cloudOrganizationId,
+    apiOrigin: 'https://share.onorca.dev'
+  }
+}
+
+async function createLinkedProfile(cloudSummary: OrcaProfileCloudSummary): Promise<string> {
+  const userDataPath = await mkdtemp(join(tmpdir(), 'orca-profile-artifact-cleanup-'))
+  createdPaths.push(userDataPath)
+  loadOrCreateProfileIndex(userDataPath)
+  linkOrcaProfileToCloud(profileId, cloudSummary, userDataPath)
+  vi.clearAllMocks()
+  return userDataPath
+}
+
+function createIntent(
+  userDataPath: string,
+  scope: ArtifactShareScope,
+  targetProfileId = profileId
+): void {
+  getOrCreateArtifactCreateIntent(targetProfileId, userDataPath, '/report.md', scope, 'key-a', {
+    content: '# report',
+    contentType: 'text/markdown',
+    fileName: 'report.md'
+  })
+}
+
+function currentCloud(userDataPath: string): OrcaProfileCloudSummary | undefined {
+  return readProfileIndex(getOrcaProfileIndexPath(userDataPath))?.profiles.find(
+    (profile) => profile.id === profileId
+  )?.cloud
+}
+
+function interruptNextCleanupCommit(): void {
+  vi.mocked(commitArtifactCloudCleanup).mockImplementationOnce(() => {
+    throw new Error('cleanup commit interrupted')
+  })
+}
diff --git a/src/main/orca-profiles/profile-artifact-cloud-cleanup.ts b/src/main/orca-profiles/profile-artifact-cloud-cleanup.ts
new file mode 100644
index 00000000000..88e90471914
--- /dev/null
+++ b/src/main/orca-profiles/profile-artifact-cloud-cleanup.ts
@@ -0,0 +1,131 @@
+import { existsSync, readFileSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
+import type { OrcaProfileCloudSummary, OrcaProfileSummary } from '../../shared/orca-profiles'
+import { bestEffortFsyncDirectorySync, writeDurableSecureJsonFile } from '../../shared/secure-file'
+import { clearArtifactCreateIntents } from '../artifacts/artifact-create-intent-store'
+import { clearArtifactShareRecords } from '../artifacts/artifact-share-record-store'
+import { getOrcaProfileDirectory } from './profile-storage-paths'
+
+type ArtifactCloudCleanupMarker = {
+  version: 1
+  phase: 'prepared' | 'committed'
+  targetIdentity: string
+}
+
+function cleanupMarkerPath(profileId: string, userDataPath: string): string {
+  return join(getOrcaProfileDirectory(profileId, userDataPath), 'artifact-cloud-cleanup.json')
+}
+
+export function artifactCloudIdentity(cloud: OrcaProfileCloudSummary | undefined): string {
+  return cloud
+    ? JSON.stringify([cloud.userId, cloud.cloudProfileId, cloud.activeOrgId ?? ''])
+    : 'local'
+}
+
+export function prepareArtifactCloudCleanup(
+  profileId: string,
+  userDataPath: string,
+  targetCloud: OrcaProfileCloudSummary | undefined
+): void {
+  writeDurableSecureJsonFile(cleanupMarkerPath(profileId, userDataPath), {
+    version: 1,
+    phase: 'prepared',
+    targetIdentity: artifactCloudIdentity(targetCloud)
+  } satisfies ArtifactCloudCleanupMarker)
+}
+
+function readCleanupMarker(
+  profileId: string,
+  userDataPath: string
+): ArtifactCloudCleanupMarker | null {
+  const path = cleanupMarkerPath(profileId, userDataPath)
+  if (!existsSync(path)) {
+    return null
+  }
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(readFileSync(path, 'utf8'))
+  } catch (error) {
+    throw new Error('Artifact cloud cleanup marker could not be read safely.', { cause: error })
+  }
+  if (
+    !parsed ||
+    typeof parsed !== 'object' ||
+    (parsed as Partial<ArtifactCloudCleanupMarker>).version !== 1 ||
+    !['prepared', 'committed'].includes(
+      (parsed as Partial<ArtifactCloudCleanupMarker>).phase ?? ''
+    ) ||
+    typeof (parsed as Partial<ArtifactCloudCleanupMarker>).targetIdentity !== 'string'
+  ) {
+    throw new Error('Artifact cloud cleanup marker has an unsupported format.')
+  }
+  return parsed as ArtifactCloudCleanupMarker
+}
+
+export function artifactCloudCleanupNeedsCommit(
+  profileId: string,
+  userDataPath: string,
+  targetCloud: OrcaProfileCloudSummary | undefined
+): boolean {
+  const marker = readCleanupMarker(profileId, userDataPath)
+  return (
+    marker?.phase === 'prepared' && marker.targetIdentity === artifactCloudIdentity(targetCloud)
+  )
+}
+
+export function commitArtifactCloudCleanup(
+  profileId: string,
+  userDataPath: string,
+  targetCloud: OrcaProfileCloudSummary | undefined
+): void {
+  const targetIdentity = artifactCloudIdentity(targetCloud)
+  const marker = readCleanupMarker(profileId, userDataPath)
+  if (marker?.phase !== 'prepared' || marker.targetIdentity !== targetIdentity) {
+    throw new Error('Artifact cloud cleanup marker does not match the profile transition.')
+  }
+  writeDurableSecureJsonFile(cleanupMarkerPath(profileId, userDataPath), {
+    version: 1,
+    phase: 'committed',
+    targetIdentity
+  } satisfies ArtifactCloudCleanupMarker)
+}
+
+export function completeArtifactCloudCleanupIfCommitted(
+  profileId: string,
+  userDataPath: string,
+  currentCloud: OrcaProfileCloudSummary | undefined
+): void {
+  const marker = readCleanupMarker(profileId, userDataPath)
+  if (
+    marker?.phase !== 'committed' ||
+    marker.targetIdentity !== artifactCloudIdentity(currentCloud)
+  ) {
+    return
+  }
+  clearArtifactCreateIntents(profileId, userDataPath)
+  clearArtifactShareRecords(profileId, userDataPath)
+  rmSync(cleanupMarkerPath(profileId, userDataPath), { force: true })
+  bestEffortFsyncDirectorySync(getOrcaProfileDirectory(profileId, userDataPath))
+}
+
+function assertArtifactCloudCleanupReady(
+  profileId: string,
+  userDataPath: string,
+  currentCloud: OrcaProfileCloudSummary | undefined
+): void {
+  const marker = readCleanupMarker(profileId, userDataPath)
+  if (
+    marker?.phase === 'prepared' &&
+    marker.targetIdentity === artifactCloudIdentity(currentCloud)
+  ) {
+    throw new Error('The Orca profile transition must be retried before publishing artifacts.')
+  }
+}
+
+export function prepareArtifactCloudUse(
+  profile: Pick<OrcaProfileSummary, 'id' | 'cloud'>,
+  userDataPath: string
+): void {
+  completeArtifactCloudCleanupIfCommitted(profile.id, userDataPath, profile.cloud)
+  assertArtifactCloudCleanupReady(profile.id, userDataPath, profile.cloud)
+}
diff --git a/src/main/orca-profiles/profile-cloud-index.ts b/src/main/orca-profiles/profile-cloud-index.ts
index 7186ddd2a63..ccf7e70adb9 100644
--- a/src/main/orca-profiles/profile-cloud-index.ts
+++ b/src/main/orca-profiles/profile-cloud-index.ts
@@ -11,7 +11,12 @@ import {
   loadOrCreateProfileIndex,
   writeProfileIndex
 } from './profile-index-store'
-import { clearArtifactShareRecords } from '../artifacts/artifact-share-record-store'
+import {
+  artifactCloudCleanupNeedsCommit,
+  commitArtifactCloudCleanup,
+  completeArtifactCloudCleanupIfCommitted,
+  prepareArtifactCloudCleanup
+} from './profile-artifact-cloud-cleanup'
 
 export type CreateCloudLinkedOrcaProfileRecordResult = OrcaProfileListState & {
   profile: OrcaProfileSummary
@@ -50,6 +55,19 @@ function toLocalProfile(profile: OrcaProfileSummary, now: number): OrcaProfileSu
   }
 }
 
+function reconcileCurrentArtifactCloudCleanup(
+  profileId: string,
+  userDataPath: string,
+  currentCloud: OrcaProfileCloudSummary | undefined
+): void {
+  completeArtifactCloudCleanupIfCommitted(profileId, userDataPath, currentCloud)
+  if (!artifactCloudCleanupNeedsCommit(profileId, userDataPath, currentCloud)) {
+    return
+  }
+  commitArtifactCloudCleanup(profileId, userDataPath, currentCloud)
+  completeArtifactCloudCleanupIfCommitted(profileId, userDataPath, currentCloud)
+}
+
 export function createCloudLinkedOrcaProfileRecord(
   cloud: OrcaProfileCloudSummary,
   args: { name?: string },
@@ -92,6 +110,12 @@ export function linkOrcaProfileToCloud(
   userDataPath: string
 ): OrcaProfileListState {
   const index = loadOrCreateProfileIndex(userDataPath)
+  const currentProfile = index.profiles.find((profile) => profile.id === profileId)
+  if (!currentProfile) {
+    throw new Error('unknown_orca_profile')
+  }
+  reconcileCurrentArtifactCloudCleanup(profileId, userDataPath, currentProfile.cloud)
+  const cleanupNeedsCommit = artifactCloudCleanupNeedsCommit(profileId, userDataPath, cloud)
   const now = Date.now()
   let found = false
   let cloudIdentityChanged = false
@@ -103,21 +127,26 @@ export function linkOrcaProfileToCloud(
     cloudIdentityChanged = Boolean(
       profile.cloud &&
       (profile.cloud.userId !== cloud.userId ||
-        profile.cloud.cloudProfileId !== cloud.cloudProfileId)
+        profile.cloud.cloudProfileId !== cloud.cloudProfileId ||
+        (profile.cloud.activeOrgId ?? '') !== (cloud.activeOrgId ?? ''))
     )
     return toCloudLinkedProfile(profile, cloud, now)
   })
   if (!found) {
     throw new Error('unknown_orca_profile')
   }
-  if (cloudIdentityChanged) {
-    clearArtifactShareRecords(profileId, userDataPath)
+  if (cloudIdentityChanged || cleanupNeedsCommit) {
+    prepareArtifactCloudCleanup(profileId, userDataPath, cloud)
   }
   const nextIndex = {
     ...index,
     profiles
   }
   writeProfileIndex(getOrcaProfileIndexPath(userDataPath), nextIndex)
+  if (cloudIdentityChanged || cleanupNeedsCommit) {
+    commitArtifactCloudCleanup(profileId, userDataPath, cloud)
+    completeArtifactCloudCleanupIfCommitted(profileId, userDataPath, cloud)
+  }
   return {
     activeProfileId: nextIndex.activeProfileId,
     profiles: nextIndex.profiles
@@ -129,6 +158,11 @@ export function unlinkOrcaProfileFromCloud(
   userDataPath: string
 ): OrcaProfileListState {
   const index = loadOrCreateProfileIndex(userDataPath)
+  const currentProfile = index.profiles.find((profile) => profile.id === profileId)
+  if (!currentProfile) {
+    throw new Error('unknown_orca_profile')
+  }
+  reconcileCurrentArtifactCloudCleanup(profileId, userDataPath, currentProfile.cloud)
   const now = Date.now()
   let found = false
   const profiles = index.profiles.map((profile) => {
@@ -141,12 +175,14 @@ export function unlinkOrcaProfileFromCloud(
   if (!found) {
     throw new Error('unknown_orca_profile')
   }
-  clearArtifactShareRecords(profileId, userDataPath)
+  prepareArtifactCloudCleanup(profileId, userDataPath, undefined)
   const nextIndex = {
     ...index,
     profiles
   }
   writeProfileIndex(getOrcaProfileIndexPath(userDataPath), nextIndex)
+  commitArtifactCloudCleanup(profileId, userDataPath, undefined)
+  completeArtifactCloudCleanupIfCommitted(profileId, userDataPath, undefined)
   return {
     activeProfileId: nextIndex.activeProfileId,
     profiles: nextIndex.profiles
diff --git a/src/main/orca-profiles/profile-index-store.ts b/src/main/orca-profiles/profile-index-store.ts
index 903e7a85ff8..8c1b4490f45 100644
--- a/src/main/orca-profiles/profile-index-store.ts
+++ b/src/main/orca-profiles/profile-index-store.ts
@@ -8,6 +8,7 @@ import {
 } from 'node:fs'
 import { randomUUID } from 'node:crypto'
 import { dirname } from 'node:path'
+import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../shared/secure-file'
 import type { GlobalSettings } from '../../shared/types'
 import {
   createDefaultLocalOrcaProfile,
@@ -130,7 +131,9 @@ export function writeProfileIndex(indexPath: string, index: OrcaProfileIndex): v
   }
   const tmpPath = `${indexPath}.tmp`
   writeFileSync(tmpPath, JSON.stringify(index, null, 2), 'utf-8')
+  fsyncFileSync(tmpPath)
   renameSync(tmpPath, indexPath)
+  bestEffortFsyncDirectorySync(dirname(indexPath))
 }
 
 function copyIfPresent(source: string, target: string): void {
diff --git a/src/main/persistence-feature-interaction-broadcast.benchmark.test.ts b/src/main/persistence-feature-interaction-broadcast.benchmark.test.ts
new file mode 100644
index 00000000000..4c04ab22d01
--- /dev/null
+++ b/src/main/persistence-feature-interaction-broadcast.benchmark.test.ts
@@ -0,0 +1,92 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { normalizeFeatureInteractions } from '../shared/feature-interactions'
+import type { PersistedState } from '../shared/types'
+
+vi.mock('electron', () => ({
+  app: { getPath: () => tmpdir() },
+  safeStorage: {
+    isEncryptionAvailable: () => false,
+    encryptString: (value: string) => Buffer.from(value),
+    decryptString: (value: Buffer) => value.toString('utf8')
+  }
+}))
+
+vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('./telemetry/cohort-classifier', () => ({ getCohortAtEmit: () => ({}) }))
+
+import { Store } from './persistence'
+
+const INTERACTIONS = 200
+const tempDirs: string[] = []
+
+function createStore(name: string): { dataFile: string; store: Store } {
+  const dir = mkdtempSync(join(tmpdir(), `orca-ui-broadcast-${name}-`))
+  tempDirs.push(dir)
+  const dataFile = join(dir, 'orca-data.json')
+  return { dataFile, store: new Store({ dataFile }) }
+}
+
+describe('feature interaction UI broadcast benchmark', () => {
+  afterEach(() => {
+    for (const dir of tempDirs.splice(0)) {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('reduces repeated interaction recording to one material UI broadcast', () => {
+    const { store: legacyStore } = createStore('legacy')
+    const { dataFile, store: optimizedStore } = createStore('optimized')
+    let legacyBroadcasts = 0
+    let optimizedBroadcasts = 0
+    legacyStore.onUIChanged(() => legacyBroadcasts++)
+    optimizedStore.onUIChanged(() => optimizedBroadcasts++)
+
+    const legacyStart = performance.now()
+    for (let index = 0; index < INTERACTIONS; index++) {
+      const featureInteractions = normalizeFeatureInteractions(
+        legacyStore.getUI().featureInteractions
+      )
+      const existing = featureInteractions['agent-orchestration']
+      legacyStore.updateUI({
+        featureInteractions: {
+          ...featureInteractions,
+          'agent-orchestration': {
+            firstInteractedAt: existing?.firstInteractedAt ?? 1,
+            interactionCount: (existing?.interactionCount ?? 0) + 1
+          }
+        }
+      })
+    }
+    const legacyMs = performance.now() - legacyStart
+
+    const optimizedStart = performance.now()
+    for (let index = 0; index < INTERACTIONS; index++) {
+      optimizedStore.recordFeatureInteraction('agent-orchestration')
+    }
+    const optimizedMs = performance.now() - optimizedStart
+
+    expect(legacyBroadcasts).toBe(INTERACTIONS)
+    expect(optimizedBroadcasts).toBe(1)
+    expect(
+      optimizedStore.getUI().featureInteractions?.['agent-orchestration']?.interactionCount
+    ).toBe(INTERACTIONS)
+    optimizedStore.flush()
+    expect(
+      new Store({ dataFile }).getUI().featureInteractions?.['agent-orchestration']?.interactionCount
+    ).toBe(INTERACTIONS)
+    const persisted = JSON.parse(readFileSync(dataFile, 'utf8')) as PersistedState
+    expect(persisted.featureInteractionTelemetryBuckets?.['agent-orchestration']).toBe(
+      'count_200_499'
+    )
+
+    console.log(
+      `[bench] ${INTERACTIONS} orchestration interactions: ` +
+        `full-state broadcasts ${legacyBroadcasts} -> ${optimizedBroadcasts}; ` +
+        `main-thread mutation ${legacyMs.toFixed(2)}ms -> ${optimizedMs.toFixed(2)}ms`
+    )
+  })
+})
diff --git a/src/main/persistence.test.ts b/src/main/persistence.test.ts
index 0e507090c1f..05e6703728d 100644
--- a/src/main/persistence.test.ts
+++ b/src/main/persistence.test.ts
@@ -5044,7 +5044,19 @@ describe('Store', () => {
     const updated = store.updateFolderWorkspace(workspace.id, {
       comment: 'Coordinate api and web',
       isPinned: true,
-      lastActivityAt: 123
+      lastActivityAt: 123,
+      diffComments: [
+        {
+          id: 'note-1',
+          worktreeId: folderWorkspaceKey(workspace.id),
+          filePath: 'README.md',
+          source: 'markdown',
+          lineNumber: 1,
+          body: 'Review this paragraph',
+          createdAt: 100,
+          side: 'modified'
+        }
+      ]
     })
 
     expect(workspace.folderPath).toBe('/workspace/platform')
@@ -5056,9 +5068,16 @@ describe('Store', () => {
       linkedTask,
       comment: 'Coordinate api and web',
       isPinned: true,
-      lastActivityAt: 123
+      lastActivityAt: 123,
+      diffComments: [expect.objectContaining({ id: 'note-1', body: 'Review this paragraph' })]
     })
     expect(store.getFolderWorkspaces()).toHaveLength(1)
+    store.flush()
+
+    const restored = await createStore()
+    expect(restored.getFolderWorkspace(workspace.id)?.diffComments).toEqual([
+      expect.objectContaining({ id: 'note-1', body: 'Review this paragraph' })
+    ])
   })
 
   it('round-trips Jira item and source context for repo-less folder workspaces', async () => {
@@ -5621,6 +5640,42 @@ describe('Store', () => {
     expect(persisted.settings).not.toHaveProperty('terminalScrollbackBytes')
   })
 
+  it('normalizes terminal cursor style before persistence and listener broadcasts', async () => {
+    const store = await createStore()
+    store.updateSettings({ terminalCursorStyle: 'underline' })
+    const listener = vi.fn()
+    store.onSettingsChanged(listener)
+
+    const invalid = store.updateSettings(
+      { terminalCursorStyle: 'beam' as never },
+      { notifyListeners: true }
+    )
+
+    expect(invalid.terminalCursorStyle).toBe('block')
+    expect(invalid.terminalCursorStyleDefaultedToBlock).toBe(true)
+    expect(listener).toHaveBeenCalledWith(
+      {
+        terminalCursorStyle: 'block'
+      },
+      expect.objectContaining({ terminalCursorStyle: 'block' }),
+      undefined
+    )
+
+    const valid = store.updateSettings(
+      { terminalCursorStyle: 'underline' },
+      { notifyListeners: true }
+    )
+    expect(valid.terminalCursorStyle).toBe('underline')
+    expect(listener).toHaveBeenLastCalledWith(
+      { terminalCursorStyle: 'underline' },
+      expect.objectContaining({ terminalCursorStyle: 'underline' }),
+      undefined
+    )
+
+    store.flush()
+    expect((readDataFile() as PersistedState).settings.terminalCursorStyle).toBe('underline')
+  })
+
   it('normalizes disabled TUI agents on load and update', async () => {
     writeFileSync(
       join(testState.dir, 'orca-data.json'),
@@ -7295,6 +7350,22 @@ describe('Store', () => {
     expect(store.getSettings().terminalCursorStyleDefaultedToBlock).toBe(true)
   })
 
+  it('replaces an invalid persisted terminal cursor choice after migration', async () => {
+    writeDataFile({
+      schemaVersion: 1,
+      repos: [],
+      worktreeMeta: {},
+      settings: { terminalCursorStyle: 'beam', terminalCursorStyleDefaultedToBlock: true },
+      ui: {},
+      githubCache: { pr: {}, issue: {} },
+      workspaceSession: {}
+    })
+    const store = await createStore()
+    expect(store.getSettings().terminalCursorStyle).toBe('block')
+    store.flush()
+    expect((readDataFile() as PersistedState).settings.terminalCursorStyle).toBe('block')
+  })
+
   it('preserves explicit "false" terminalMacOptionAsAlt through migration', async () => {
     // 'false' never matched the old default — it was an explicit choice.
     writeDataFile({
@@ -9124,6 +9195,149 @@ describe('Store', () => {
     )
   })
 
+  it('admits a split binding only while the exact source still owns its layout leaf', async () => {
+    for (const hostId of [undefined, 'ssh:ssh-1']) {
+      const store = await createStore()
+      store.setWorkspaceSession(
+        {
+          ...getDefaultWorkspaceSession(),
+          tabsByWorktree: {
+            wt1: [makeTerminalTab({ id: 'tab1', worktreeId: 'wt1', ptyId: 'pty-source' })]
+          },
+          terminalLayoutsByTabId: {
+            tab1: {
+              root: { type: 'leaf', leafId: TEST_LEAF_1 },
+              activeLeafId: TEST_LEAF_1,
+              expandedLeafId: null,
+              ptyIdsByLeafId: { [TEST_LEAF_1]: 'pty-source' }
+            }
+          }
+        },
+        hostId
+      )
+      const staleRendererSession = structuredClone(store.getWorkspaceSession(hostId))
+
+      expect(
+        store.persistPtyBinding(
+          {
+            worktreeId: 'wt1',
+            tabId: 'different-target-tab',
+            leafId: TEST_LEAF_2,
+            ptyId: 'pty-split',
+            expectedSourceBinding: {
+              worktreeId: 'wt1',
+              tabId: 'tab1',
+              leafId: TEST_LEAF_1,
+              ptyId: 'pty-source'
+            }
+          },
+          hostId
+        )
+      ).toBe(false)
+      expect(
+        store
+          .getWorkspaceSession(hostId)
+          .tabsByWorktree.wt1.some((tab) => tab.id === 'different-target-tab')
+      ).toBe(false)
+
+      expect(
+        store.persistPtyBinding(
+          {
+            worktreeId: 'wt-canonical',
+            tabId: 'tab1',
+            leafId: TEST_LEAF_2,
+            ptyId: 'pty-split',
+            expectedSourceBinding: {
+              worktreeId: 'wt1',
+              tabId: 'tab1',
+              leafId: TEST_LEAF_1,
+              ptyId: 'pty-source'
+            }
+          },
+          hostId
+        )
+      ).toBe(true)
+      const admitted = store.getWorkspaceSession(hostId)
+      expect(admitted.terminalTopologyRevisionByRepoId?.wt1).toBe(1)
+      expect(admitted.terminalLayoutsByTabId.tab1.ptyIdsByLeafId).toMatchObject({
+        [TEST_LEAF_1]: 'pty-source',
+        [TEST_LEAF_2]: 'pty-split'
+      })
+
+      store.setWorkspaceSession(staleRendererSession, hostId)
+      expect(
+        store.getWorkspaceSession(hostId).terminalLayoutsByTabId.tab1.ptyIdsByLeafId
+      ).toMatchObject({
+        [TEST_LEAF_1]: 'pty-source',
+        [TEST_LEAF_2]: 'pty-split'
+      })
+
+      expect(
+        store.persistPtyBinding(
+          {
+            worktreeId: 'wt1',
+            tabId: 'rejected-tab',
+            leafId: TEST_LEAF_2,
+            ptyId: 'pty-rejected',
+            expectedSourceBinding: {
+              worktreeId: 'wt1',
+              tabId: 'missing-source-tab',
+              leafId: TEST_LEAF_1,
+              ptyId: 'pty-source'
+            }
+          },
+          hostId
+        )
+      ).toBe(false)
+      expect(
+        store
+          .getWorkspaceSession(hostId)
+          .tabsByWorktree.wt1.some((tab) => tab.id === 'rejected-tab')
+      ).toBe(false)
+      expect(
+        store.getWorkspaceSession(hostId).terminalLayoutsByTabId['rejected-tab']
+      ).toBeUndefined()
+    }
+  })
+
+  it('rejects a split source incarnation mismatch', async () => {
+    const store = await createStore()
+    store.setWorkspaceSession({
+      ...getDefaultWorkspaceSession(),
+      tabsByWorktree: {
+        wt1: [makeTerminalTab({ id: 'tab1', worktreeId: 'wt1', ptyId: 'pty-source' })]
+      },
+      terminalLayoutsByTabId: {
+        tab1: {
+          root: { type: 'leaf', leafId: TEST_LEAF_1 },
+          activeLeafId: TEST_LEAF_1,
+          expandedLeafId: null,
+          ptyIdsByLeafId: { [TEST_LEAF_1]: 'pty-source' }
+        }
+      },
+      terminalPtyIncarnationsByPaneKey: { [`tab1:${TEST_LEAF_1}`]: 'persisted-incarnation' }
+    })
+
+    expect(
+      store.persistPtyBinding({
+        worktreeId: 'wt1',
+        tabId: 'tab1',
+        leafId: TEST_LEAF_2,
+        ptyId: 'pty-split',
+        expectedSourceBinding: {
+          tabId: 'tab1',
+          leafId: TEST_LEAF_1,
+          ptyId: 'pty-source',
+          incarnationId: 'different-incarnation'
+        }
+      })
+    ).toBe(false)
+    expect(store.getWorkspaceSession().terminalLayoutsByTabId.tab1.root).toEqual({
+      type: 'leaf',
+      leafId: TEST_LEAF_1
+    })
+  })
+
   it('rejects competing PTY and incarnation changes during reconciliation', async () => {
     const store = await createStore()
     const paneKey = `tab1:${TEST_LEAF_1}`
diff --git a/src/main/persistence.ts b/src/main/persistence.ts
index c2e36d3ce9d..6d3e4bf04dd 100644
--- a/src/main/persistence.ts
+++ b/src/main/persistence.ts
@@ -673,11 +673,8 @@ function migrateTerminalScrollbackRows(settings: unknown): {
   needsSave: boolean
 } {
   const legacySettings = readLegacyTerminalScrollbackSettings(settings)
-  const hasRows = Object.prototype.hasOwnProperty.call(legacySettings, 'terminalScrollbackRows')
-  const hasLegacyBytes = Object.prototype.hasOwnProperty.call(
-    legacySettings,
-    'terminalScrollbackBytes'
-  )
+  const hasRows = Object.hasOwn(legacySettings, 'terminalScrollbackRows')
+  const hasLegacyBytes = Object.hasOwn(legacySettings, 'terminalScrollbackBytes')
   const rows = hasRows
     ? normalizeDesktopTerminalScrollbackRows(legacySettings.terminalScrollbackRows)
     : legacyTerminalScrollbackBytesToRows(legacySettings.terminalScrollbackBytes)
@@ -1685,7 +1682,7 @@ type LayoutLeafNormalization = {
 
 function collectLayoutLeafCounts(
   node: TerminalPaneLayoutNode,
-  counts: Map<string, number> = new Map()
+  counts = new Map<string, number>()
 ): Map<string, number> {
   if (node.type === 'leaf') {
     counts.set(node.leafId, (counts.get(node.leafId) ?? 0) + 1)
@@ -2783,6 +2780,14 @@ export type StoreOptions = {
   dataFile?: string
 }
 
+export type PtyBindingSourceExpectation = {
+  worktreeId?: string
+  tabId: string
+  leafId: string
+  ptyId: string
+  incarnationId?: string
+}
+
 export class Store {
   private state: PersistedState
   private readonly dataFile: string
@@ -3244,6 +3249,13 @@ export class Store {
           parsed.settings
         )
         const migratedTerminalCursorStyle = normalizeTerminalCursorStyleDefault(parsed.settings)
+        if (
+          parsed.settings?.terminalCursorStyle !==
+            migratedTerminalCursorStyle.terminalCursorStyle ||
+          parsed.settings?.terminalCursorStyleDefaultedToBlock !== true
+        ) {
+          this.loadNeedsSave = true
+        }
         const migratedTerminalLineHeight = normalizeTerminalLineHeight(
           parsed.settings?.terminalLineHeight
         )
@@ -4473,6 +4485,7 @@ export class Store {
     linkedTask?: FolderWorkspace['linkedTask']
     linkedTaskSourceContext?: FolderWorkspace['linkedTaskSourceContext']
     connectionId?: string | null
+    creatorProvenance?: FolderWorkspace['creatorProvenance']
     createdWithAgent?: FolderWorkspace['createdWithAgent']
     pendingFirstAgentMessageRename?: boolean
   }): FolderWorkspace {
@@ -4495,6 +4508,7 @@ export class Store {
       name: normalizeFolderWorkspaceName(input.name, `${group.name} workspace`),
       folderPath,
       connectionId: input.connectionId ?? group.connectionId ?? null,
+      ...(input.creatorProvenance ? { creatorProvenance: input.creatorProvenance } : {}),
       linkedTask,
       linkedTaskSourceContext: isWorkspaceLinkedItemSourceContextMatch(linkedTask, sourceContext)
         ? sourceContext
@@ -4537,6 +4551,7 @@ export class Store {
         | 'pendingFirstAgentMessageRename'
         | 'firstAgentMessageRenameError'
         | 'lastActivityAt'
+        | 'diffComments'
       >
     >
   ): FolderWorkspace | null {
@@ -4610,6 +4625,9 @@ export class Store {
     if (updates.lastActivityAt !== undefined && Number.isFinite(updates.lastActivityAt)) {
       workspace.lastActivityAt = updates.lastActivityAt
     }
+    if (updates.diffComments !== undefined) {
+      workspace.diffComments = updates.diffComments
+    }
     workspace.updatedAt = Date.now()
     this.scheduleSave()
     return workspace
@@ -5778,7 +5796,7 @@ export class Store {
     }
   }
 
-  // Why: UI view-state is written from both desktop and mobile (ui.set RPC), so notify to keep bi-directional sync (desktop hydrates UI only once).
+  // Why: renderer-visible UI state is written from desktop and mobile, so notify to keep bi-directional sync.
   onUIChanged(listener: (ui: PersistedState['ui']) => void): () => void {
     this.uiChangeListeners.add(listener)
     return () => {
@@ -5839,6 +5857,15 @@ export class Store {
         updates.terminalCustomThemes
       )
     }
+    if ('terminalCursorStyle' in updates) {
+      Object.assign(
+        sanitizedUpdates,
+        normalizeTerminalCursorStyleDefault(
+          { terminalCursorStyle: updates.terminalCursorStyle },
+          { preserveExplicitValue: true }
+        )
+      )
+    }
     if ('terminalScrollbackRows' in updates) {
       sanitizedUpdates.terminalScrollbackRows = normalizeDesktopTerminalScrollbackRows(
         updates.terminalScrollbackRows
@@ -6189,7 +6216,8 @@ export class Store {
       (lastEmittedBucket === null ||
         compareFeatureInteractionUsageBuckets(nextBucket, lastEmittedBucket) > 0)
 
-    this.updateUI({
+    this.state.ui = {
+      ...this.state.ui,
       featureInteractions: {
         ...featureInteractions,
         [id]: {
@@ -6197,11 +6225,15 @@ export class Store {
           interactionCount: nextCount
         }
       }
-    })
+    }
     this.state.featureInteractionTelemetryBuckets = shouldEmit
       ? { ...telemetryBuckets, [id]: nextBucket }
       : telemetryBuckets
     this.scheduleSave()
+    // Why: live UI only consumes the seen transition; count-only telemetry must not re-hydrate the renderer.
+    if (!existing) {
+      this.notifyUIChanged()
+    }
 
     if (shouldEmit) {
       track('feature_interaction_usage_bucket_reached', {
@@ -6750,15 +6782,37 @@ export class Store {
       incarnationId?: string
       startupCwd?: string
       expectedBinding?: { ptyId: string; incarnationId?: string }
+      expectedSourceBinding?: PtyBindingSourceExpectation
     },
     hostId?: string | null
   ): boolean {
     const resolvedHostId = this.resolveHostId(hostId)
     const session = this.getWorkspaceSession(resolvedHostId)
     const paneKey = `${args.tabId}:${args.leafId}`
+    const bindingWorktreeId = args.expectedSourceBinding?.worktreeId ?? args.worktreeId
+    if (args.expectedSourceBinding) {
+      const expected = args.expectedSourceBinding
+      if (expected.tabId !== args.tabId) {
+        return false
+      }
+      const sourceTab = session.tabsByWorktree?.[bindingWorktreeId]?.find(
+        (candidate) => candidate.id === expected.tabId && candidate.worktreeId === bindingWorktreeId
+      )
+      const sourceLayout = session.terminalLayoutsByTabId?.[expected.tabId]
+      const sourcePaneKey = `${expected.tabId}:${expected.leafId}`
+      if (
+        !sourceTab ||
+        sourceLayout?.ptyIdsByLeafId?.[expected.leafId] !== expected.ptyId ||
+        !layoutContainsLeafId(sourceLayout.root, expected.leafId) ||
+        (expected.incarnationId !== undefined &&
+          session.terminalPtyIncarnationsByPaneKey?.[sourcePaneKey] !== expected.incarnationId)
+      ) {
+        return false
+      }
+    }
     if (args.expectedBinding) {
-      const tab = session.tabsByWorktree?.[args.worktreeId]?.find(
-        (candidate) => candidate.id === args.tabId && candidate.worktreeId === args.worktreeId
+      const tab = session.tabsByWorktree?.[bindingWorktreeId]?.find(
+        (candidate) => candidate.id === args.tabId && candidate.worktreeId === bindingWorktreeId
       )
       const boundPtyId = session.terminalLayoutsByTabId?.[args.tabId]?.ptyIdsByLeafId?.[args.leafId]
       if (
@@ -6781,9 +6835,13 @@ export class Store {
       args.incarnationId !== args.expectedBinding.incarnationId
     let terminalMembershipChanged = false
     const advanceTopologyFence = (): void => {
-      const repoId = getRepoIdFromWorktreeId(args.worktreeId)
+      const repoId = getRepoIdFromWorktreeId(bindingWorktreeId)
       const currentRevision = session.terminalTopologyRevisionByRepoId?.[repoId] ?? 0
-      if (!reconciledIncarnation && (!terminalMembershipChanged || currentRevision <= 0)) {
+      const establishesSplitAuthority = args.expectedSourceBinding !== undefined
+      if (
+        !reconciledIncarnation &&
+        (!terminalMembershipChanged || (currentRevision <= 0 && !establishesSplitAuthority))
+      ) {
         return
       }
       // Why: host-admitted membership or incarnation changes must outrank a stale renderer replay.
@@ -6814,7 +6872,7 @@ export class Store {
         delete session.terminalSurfaceTombstonesByPaneKey[paneKey]
       }
     }
-    const tabs = session.tabsByWorktree?.[args.worktreeId]
+    const tabs = session.tabsByWorktree?.[bindingWorktreeId]
     const tab = tabs?.find((t) => t.id === args.tabId)
     if (tab) {
       tab.ptyId = args.ptyId
@@ -6825,18 +6883,19 @@ export class Store {
         ...(tabs ?? []),
         createMinimalPersistedTerminalTab({
           ...args,
+          worktreeId: bindingWorktreeId,
           existingTabCount: tabs?.length ?? 0
         })
       ]
       session.tabsByWorktree = {
         ...session.tabsByWorktree,
-        [args.worktreeId]: nextTabs
+        [bindingWorktreeId]: nextTabs
       }
-      session.activeWorktreeId ??= args.worktreeId
+      session.activeWorktreeId ??= bindingWorktreeId
       session.activeTabId ??= args.tabId
       session.activeTabIdByWorktree = {
         ...session.activeTabIdByWorktree,
-        [args.worktreeId]: session.activeTabIdByWorktree?.[args.worktreeId] ?? args.tabId
+        [bindingWorktreeId]: session.activeTabIdByWorktree?.[bindingWorktreeId] ?? args.tabId
       }
     }
     if (!isTerminalLeafId(args.leafId)) {
@@ -7203,14 +7262,14 @@ export class Store {
       (entry) =>
         entry.targetId === normalizedLease.targetId && entry.ptyId === normalizedLease.ptyId
     )
-    const existing = existingIndex >= 0 ? this.state.sshRemotePtyLeases[existingIndex] : undefined
+    const existing = existingIndex !== -1 ? this.state.sshRemotePtyLeases[existingIndex] : undefined
     const next: SshRemotePtyLease = {
       ...existing,
       ...normalizedLease,
       createdAt: existing?.createdAt ?? normalizedLease.createdAt ?? now,
       updatedAt: normalizedLease.updatedAt ?? now
     }
-    if (existingIndex >= 0) {
+    if (existingIndex !== -1) {
       this.state.sshRemotePtyLeases[existingIndex] = next
     } else {
       this.state.sshRemotePtyLeases.push(next)
diff --git a/src/main/pi/legacy-omp-overlay-migration.ts b/src/main/pi/legacy-omp-overlay-migration.ts
index 88baf78ea9f..74d6039fcb5 100644
--- a/src/main/pi/legacy-omp-overlay-migration.ts
+++ b/src/main/pi/legacy-omp-overlay-migration.ts
@@ -146,7 +146,7 @@ function copyMissingLegacyOmpOverlayEntries(
   overlayDir: string,
   sourceAgentDir: string,
   pathSegments: string[] = [],
-  copiedFilePaths: Set<string> = new Set()
+  copiedFilePaths = new Set<string>()
 ): boolean {
   let completed = true
   let entries: Dirent[]
diff --git a/src/main/pi/titlebar-extension-service.test.ts b/src/main/pi/titlebar-extension-service.test.ts
index 485ea71cafa..e197a4a0c3a 100644
--- a/src/main/pi/titlebar-extension-service.test.ts
+++ b/src/main/pi/titlebar-extension-service.test.ts
@@ -94,10 +94,6 @@ describe('PiTitlebarExtensionService', () => {
     rmSync(join(userDataDir, 'pi-agent-overlays'), { recursive: true, force: true })
     rmSync(join(userDataDir, 'omp-agent-overlays'), { recursive: true, force: true })
     rmSync(join(userDataDir, 'omp-managed-status-extension'), { recursive: true, force: true })
-    rmSync(join(userDataDir, 'prime-agent-managed-status-extension'), {
-      recursive: true,
-      force: true
-    })
   })
 
   function expectPiHomeIntact(): void {
@@ -185,21 +181,6 @@ describe('PiTitlebarExtensionService', () => {
     expectPiHomeIntact()
   })
 
-  it('writes a Prime status-only extension outside the guest-owned config dir', () => {
-    const svc = new PiTitlebarExtensionService()
-    const env = svc.buildStatusOnlyPtyEnv('prime-agent')
-    const statusPath = join(
-      userDataDir,
-      'prime-agent-managed-status-extension',
-      'orca-agent-status.ts'
-    )
-
-    expect(env).toEqual({ ORCA_PRIME_AGENT_STATUS_EXTENSION: statusPath })
-    expect(readFileSync(statusPath, 'utf8')).toContain('/hook/prime-agent')
-    expect(readFileSync(statusPath, 'utf8')).not.toContain("return '/hook/omp'")
-    expectPiHomeIntact()
-  })
-
   it('uses the same source dir for multiple PTYs with the same Pi dir', () => {
     const svc = new PiTitlebarExtensionService()
     const firstEnv = svc.buildPtyEnv('pty-shared-1', piHome, 'pi')
diff --git a/src/main/pi/titlebar-extension-service.ts b/src/main/pi/titlebar-extension-service.ts
index 59c0f44797f..5e728fa0274 100644
--- a/src/main/pi/titlebar-extension-service.ts
+++ b/src/main/pi/titlebar-extension-service.ts
@@ -27,10 +27,7 @@ export const isSafeDescendCandidate = sharedIsSafeDescendCandidate
 
 const PI_AGENT_SUBDIR = 'agent'
 const ORCA_MANAGED_EXTENSION_MARKER = '@orca-managed-pi-extension'
-const MANAGED_STATUS_EXTENSION_DIR: Record<'omp' | 'prime-agent', string> = {
-  omp: 'omp-managed-status-extension',
-  'prime-agent': 'prime-agent-managed-status-extension'
-}
+const OMP_MANAGED_STATUS_EXTENSION_DIR = 'omp-managed-status-extension'
 
 type ManagedExtensionWriteResult = 'written' | 'skipped-user-owned' | 'failed'
 
@@ -124,11 +121,8 @@ export class PiTitlebarExtensionService {
     }
   }
 
-  private writeFallbackStatusExtension(
-    source: string,
-    kind: keyof typeof MANAGED_STATUS_EXTENSION_DIR
-  ): string | undefined {
-    const fallbackDir = join(app.getPath('userData'), MANAGED_STATUS_EXTENSION_DIR[kind])
+  private writeOmpFallbackStatusExtension(source: string): string | undefined {
+    const fallbackDir = join(app.getPath('userData'), OMP_MANAGED_STATUS_EXTENSION_DIR)
     try {
       mkdirSync(fallbackDir, { recursive: true })
     } catch {
@@ -171,7 +165,7 @@ export class PiTitlebarExtensionService {
         statusResult === 'written'
           ? statusExtensionPath
           : kind === 'omp'
-            ? this.writeFallbackStatusExtension(statusSource, 'omp')
+            ? this.writeOmpFallbackStatusExtension(statusSource)
             : undefined
     }
   }
@@ -201,7 +195,7 @@ export class PiTitlebarExtensionService {
     if (!existsSync(sourceAgentDir) && !materializeDefaultHome) {
       if (kind === 'omp') {
         const statusSource = withOrcaManagedExtensionMarker(getPiAgentStatusExtensionSource(kind))
-        const statusExtensionPath = this.writeFallbackStatusExtension(statusSource, 'omp')
+        const statusExtensionPath = this.writeOmpFallbackStatusExtension(statusSource)
         return statusExtensionPath ? { ORCA_OMP_STATUS_EXTENSION: statusExtensionPath } : {}
       }
       return {}
@@ -226,12 +220,6 @@ export class PiTitlebarExtensionService {
     return env
   }
 
-  buildStatusOnlyPtyEnv(kind: 'prime-agent'): Record<string, string> {
-    const source = withOrcaManagedExtensionMarker(getPiAgentStatusExtensionSource(kind))
-    const statusExtensionPath = this.writeFallbackStatusExtension(source, kind)
-    return statusExtensionPath ? { ORCA_PRIME_AGENT_STATUS_EXTENSION: statusExtensionPath } : {}
-  }
-
   clearPty(ptyId: string): void {
     // Why: PTY teardown doesn't know which kind was launched (the daemon
     // exit path discards the launch command). Sweep both old PTY-scoped
diff --git a/src/main/plugins/plugin-dev-watcher.ts b/src/main/plugins/plugin-dev-watcher.ts
index c6aefa12699..6e7f6f908f0 100644
--- a/src/main/plugins/plugin-dev-watcher.ts
+++ b/src/main/plugins/plugin-dev-watcher.ts
@@ -98,7 +98,7 @@ export class PluginDevWatcher {
 
   private removeSubscription(subscription: WatcherProcessSubscription): void {
     const index = this.subscriptions.indexOf(subscription)
-    if (index >= 0) {
+    if (index !== -1) {
       this.subscriptions.splice(index, 1)
     }
   }
diff --git a/src/main/plugins/plugin-git-repository.ts b/src/main/plugins/plugin-git-repository.ts
index e8870f9e7fe..ac786273fc1 100644
--- a/src/main/plugins/plugin-git-repository.ts
+++ b/src/main/plugins/plugin-git-repository.ts
@@ -1,26 +1,17 @@
-import { execFile } from 'node:child_process'
-import { promisify } from 'node:util'
 import {
   isAllowedPluginGitUrl,
   PLUGIN_COMMIT_PATTERN
 } from '../../shared/plugins/plugin-install-lockfile'
+import { gitExecFileAsync } from '../git/runner'
 
-const execFileAsync = promisify(execFile)
 const PLUGIN_GIT_TIMEOUT_MS = 120_000
 
 /** Runs system Git with argv-only invocation so credential helpers and SSH
  * remotes work without exposing an executable remote-helper surface. */
 export async function runPluginGit(args: string[], cwd: string): Promise<string> {
-  const { stdout } = await execFileAsync('git', args, {
+  const { stdout } = await gitExecFileAsync(args, {
     cwd,
-    timeout: PLUGIN_GIT_TIMEOUT_MS,
-    windowsHide: true,
-    env: {
-      ...process.env,
-      // Existing non-interactive helpers and SSH agents still work, but a
-      // background marketplace refresh can never hang on a terminal prompt.
-      GIT_TERMINAL_PROMPT: '0'
-    }
+    timeout: PLUGIN_GIT_TIMEOUT_MS
   })
   return stdout.trim()
 }
diff --git a/src/main/plugins/plugin-host-runtime.ts b/src/main/plugins/plugin-host-runtime.ts
index 2a2f5f9fcab..b7f3eb9b8a1 100644
--- a/src/main/plugins/plugin-host-runtime.ts
+++ b/src/main/plugins/plugin-host-runtime.ts
@@ -20,7 +20,7 @@ export type PluginHostCallError = Error & { code?: string }
 export type PluginWorkerOrcaApi = {
   /** Register the handler for a command declared in the manifest. */
   commands: {
-    register(commandId: string, handler: (args: unknown) => unknown | Promise<unknown>): void
+    register(commandId: string, handler: (args: unknown) => unknown): void
   }
   /** Handle an event the manifest subscribed to (`contributes.events`). */
   events: {
@@ -55,7 +55,7 @@ export function createPluginWorkerRuntime(
   const send = options.send
   const importModule = options.importModule ?? ((specifier: string) => import(specifier))
   const exit = options.exit ?? ((code: number) => process.exit(code))
-  const commandHandlers = new Map<string, (args: unknown) => unknown | Promise<unknown>>()
+  const commandHandlers = new Map<string, (args: unknown) => unknown>()
   const eventHandlers = new Map<string, ((payload: unknown) => void | Promise<void>)[]>()
   const pendingHostCalls = new Map<
     number,
@@ -64,7 +64,7 @@ export function createPluginWorkerRuntime(
   let nextHostCallId = 0
   let initialized = false
   let shuttingDown = false
-  let deactivate: (() => unknown | Promise<unknown>) | null = null
+  let deactivate: (() => unknown) | null = null
 
   async function handleInit(input: {
     pluginRoot: string
@@ -88,7 +88,7 @@ export function createPluginWorkerRuntime(
     if (module.deactivate !== undefined && typeof module.deactivate !== 'function') {
       throw new Error(`plugin entry ${input.mainEntry} has a non-function deactivate export`)
     }
-    deactivate = (module.deactivate as (() => unknown | Promise<unknown>) | undefined) ?? null
+    deactivate = (module.deactivate as (() => unknown) | undefined) ?? null
     const orca: PluginWorkerOrcaApi = {
       commands: {
         register(commandId, handler) {
diff --git a/src/main/plugins/plugin-worker-output-buffer.ts b/src/main/plugins/plugin-worker-output-buffer.ts
index dfbe0478c28..836330c8799 100644
--- a/src/main/plugins/plugin-worker-output-buffer.ts
+++ b/src/main/plugins/plugin-worker-output-buffer.ts
@@ -34,7 +34,7 @@ export function pipePluginWorkerOutput(
     while (remaining.length > 0) {
       if (discarding) {
         const newline = remaining.indexOf('\n')
-        if (newline < 0) {
+        if (newline === -1) {
           return
         }
         discarding = false
@@ -42,20 +42,20 @@ export function pipePluginWorkerOutput(
         continue
       }
       const newline = remaining.indexOf('\n')
-      const segment = newline < 0 ? remaining : remaining.slice(0, newline)
+      const segment = newline === -1 ? remaining : remaining.slice(0, newline)
       const available = PLUGIN_WORKER_OUTPUT_LINE_LIMIT - buffered.length
       if (segment.length > available) {
         emit(buffered + segment.slice(0, available), true)
         buffered = ''
-        discarding = newline < 0
+        discarding = newline === -1
       } else {
         buffered += segment
-        if (newline >= 0) {
+        if (newline !== -1) {
           emit(buffered)
           buffered = ''
         }
       }
-      if (newline < 0) {
+      if (newline === -1) {
         return
       }
       remaining = remaining.slice(newline + 1)
diff --git a/src/main/plugins/plugin-worker-slot-pool.ts b/src/main/plugins/plugin-worker-slot-pool.ts
index 5b86acf38d7..7cb6c79d6f1 100644
--- a/src/main/plugins/plugin-worker-slot-pool.ts
+++ b/src/main/plugins/plugin-worker-slot-pool.ts
@@ -49,7 +49,7 @@ export class PluginWorkerSlotPool {
           }
           cancelled = true
           const index = this.waiters.indexOf(waiter)
-          if (index >= 0) {
+          if (index !== -1) {
             this.waiters.splice(index, 1)
           }
           signal.removeEventListener('abort', waiter.onAbort)
diff --git a/src/main/providers/__tests__/shell-ready-framework/shell-script-test.ts b/src/main/providers/__tests__/shell-ready-framework/shell-script-test.ts
index c9217f17994..a1dd3727c54 100644
--- a/src/main/providers/__tests__/shell-ready-framework/shell-script-test.ts
+++ b/src/main/providers/__tests__/shell-ready-framework/shell-script-test.ts
@@ -62,6 +62,8 @@ export async function shellScriptTest(
 
     const env: Record<string, string> = {
       ...config.env,
+      // Why: these examples inspect startup-file discovery, not the PTY-owner protocol stream.
+      ORCA_SHELL_STARTUP_IDENTITY: '0',
       // Why: the framework creates user startup files under testHome after
       // computing the wrapper config; route wrapper discovery to that fixture.
       HOME: testHome,
diff --git a/src/main/providers/git-provider-contract.ts b/src/main/providers/git-provider-contract.ts
index c204b9d9016..d13bf5addf9 100644
--- a/src/main/providers/git-provider-contract.ts
+++ b/src/main/providers/git-provider-contract.ts
@@ -66,7 +66,7 @@ export type IGitProvider = {
   getBranchDiff(
     worktreePath: string,
     baseRef: string,
-    options?: { includePatch?: boolean; filePath?: string; oldPath?: string }
+    options?: { includePatch?: boolean; filePath?: string; oldPath?: string; headOid?: string }
   ): Promise<GitDiffResult[]>
   getCommitDiff(
     worktreePath: string,
diff --git a/src/main/providers/local-pty-provider.test.ts b/src/main/providers/local-pty-provider.test.ts
index a7b675e78da..909ca9b73f1 100644
--- a/src/main/providers/local-pty-provider.test.ts
+++ b/src/main/providers/local-pty-provider.test.ts
@@ -14,7 +14,9 @@ const {
   resolveAgentForegroundProcessMock,
   readWindowsConptyProcessIdsMock,
   killWithDescendantSweepMock,
-  isWslAvailableAsyncMock
+  isWslAvailableAsyncMock,
+  wslUncDirectoryExistsMock,
+  createShellPromptReadinessProbeMock
 } = vi.hoisted(() => ({
   existsSyncMock: vi.fn(),
   statSyncMock: vi.fn(),
@@ -26,7 +28,9 @@ const {
   resolveAgentForegroundProcessMock: vi.fn(),
   readWindowsConptyProcessIdsMock: vi.fn(),
   killWithDescendantSweepMock: vi.fn(),
-  isWslAvailableAsyncMock: vi.fn()
+  isWslAvailableAsyncMock: vi.fn(),
+  wslUncDirectoryExistsMock: vi.fn(),
+  createShellPromptReadinessProbeMock: vi.fn()
 }))
 
 vi.mock('fs', () => ({
@@ -102,7 +106,11 @@ vi.mock('../wsl', () => ({
   isWslAvailableAsync: () => isWslAvailableAsyncMock(),
   // Why: WSL worktree validation now asks the distro; these tests use WSL UNC
   // cwds that are meant to exist, so report them present without spawning wsl.exe.
-  wslUncDirectoryExists: () => true
+  wslUncDirectoryExists: (...args: unknown[]) => wslUncDirectoryExistsMock(...args)
+}))
+
+vi.mock('../shell-prompt-readiness-probe', () => ({
+  createShellPromptReadinessProbe: createShellPromptReadinessProbeMock
 }))
 
 import {
@@ -170,6 +178,9 @@ describe('LocalPtyProvider', () => {
     readWindowsConptyProcessIdsMock.mockResolvedValue(null)
     isWslAvailableAsyncMock.mockReset()
     isWslAvailableAsyncMock.mockResolvedValue(true)
+    wslUncDirectoryExistsMock.mockReset()
+    wslUncDirectoryExistsMock.mockReturnValue(true)
+    createShellPromptReadinessProbeMock.mockReset()
 
     exitCb = undefined
     mockProc = {
@@ -530,6 +541,24 @@ describe('LocalPtyProvider', () => {
       expect(spawnCall[2].env.CUSTOM_VAR).toBe('custom-value')
     })
 
+    it('verifies shell identity against the exact spawn PATH', async () => {
+      provider.configure({
+        buildSpawnEnv: (_id, env) => ({ ...env, PATH: '/post-hook/bin' })
+      })
+
+      await provider.spawn({
+        cols: 80,
+        rows: 24,
+        command: 'printf ready',
+        env: { PATH: '/pre-hook/bin' }
+      })
+
+      expect(spawnMock.mock.calls.at(-1)?.[2].env.PATH).toBe('/post-hook/bin')
+      expect(createShellPromptReadinessProbeMock).toHaveBeenCalledWith(
+        expect.objectContaining({ shellPathEnv: '/post-hook/bin' })
+      )
+    })
+
     it('does not inherit NODE_ENV from the Orca process env', async () => {
       // Why: NODE_ENV in Orca's process is Orca's build mode (electron-vite sets
       // `development` in dev runs); leaking it breaks `next build` and Vitest.
@@ -978,29 +1007,50 @@ describe('LocalPtyProvider', () => {
       expect(spawnCall[2].env.HISTFILE).toContain('terminal-history-wsl/Debian')
     })
 
-    it('translates a POSIX cwd through the preferred WSL distro', async () => {
+    it.each(['/home/jin/repo', '/a', '/c'])(
+      'preserves a POSIX cwd through the preferred WSL distro (%s)',
+      async (cwd) => {
+        Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+
+        await provider.spawn({
+          cols: 80,
+          rows: 24,
+          worktreeId: 'repo-1::C:\\Users\\jin\\repo',
+          cwd,
+          prevalidatedCwd: `\\\\wsl.localhost\\Debian${cwd.replaceAll('/', '\\')}`,
+          shellOverride: 'wsl.exe',
+          terminalWindowsWslDistro: 'Debian'
+        })
+
+        const spawnCall = spawnMock.mock.calls.at(-1)!
+        expect(spawnCall[0]).toBe('wsl.exe')
+        expect(spawnCall[1]).toEqual([
+          '-d',
+          'Debian',
+          '--',
+          'sh',
+          '-c',
+          expect.stringContaining(`cd '${cwd}'`)
+        ])
+        expect(spawnCall[2].cwd).not.toBe(cwd)
+        expect(wslUncDirectoryExistsMock).not.toHaveBeenCalled()
+      }
+    )
+
+    it('revalidates when cwd evidence does not exactly match the resolved WSL path', async () => {
       Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
 
       await provider.spawn({
         cols: 80,
         rows: 24,
         worktreeId: 'repo-1::C:\\Users\\jin\\repo',
-        cwd: '/home/jin/repo',
+        cwd: '/a',
+        prevalidatedCwd: '\\\\wsl.localhost\\Debian\\c',
         shellOverride: 'wsl.exe',
         terminalWindowsWslDistro: 'Debian'
       })
 
-      const spawnCall = spawnMock.mock.calls.at(-1)!
-      expect(spawnCall[0]).toBe('wsl.exe')
-      expect(spawnCall[1]).toEqual([
-        '-d',
-        'Debian',
-        '--',
-        'sh',
-        '-c',
-        expect.stringContaining("cd '/home/jin/repo'")
-      ])
-      expect(spawnCall[2].cwd).not.toBe('/home/jin/repo')
+      expect(wslUncDirectoryExistsMock).toHaveBeenCalledWith('\\\\wsl.localhost\\Debian\\a')
     })
 
     it('resolves and persists the default distro for Windows cwd WSL terminals', async () => {
diff --git a/src/main/providers/local-pty-provider.ts b/src/main/providers/local-pty-provider.ts
index d1ba44e5f2e..a31bf4857b7 100644
--- a/src/main/providers/local-pty-provider.ts
+++ b/src/main/providers/local-pty-provider.ts
@@ -13,6 +13,7 @@ import { existsSync } from 'node:fs'
 import * as pty from 'node-pty'
 import { getDefaultWslDistro, parseWslPath, isWslAvailableAsync } from '../wsl'
 import { splitWorktreeIdForFilesystem } from '../../shared/worktree-id'
+import { isBracketedPasteSafeShell } from '../../shared/startup-command-submission'
 import {
   injectHistoryEnv,
   updateHistFileForFallback,
@@ -74,6 +75,15 @@ import {
   createPtySlaveEchoProbe,
   readPtySlavePath
 } from '../../shared/pty-slave-line-discipline-echo'
+import {
+  createShellStartupIdentityScanState,
+  drainShellStartupIdentityHeldBytes,
+  scanForShellStartupIdentity
+} from '../shell-startup-identity-scanner'
+import {
+  createShellPromptReadinessProbe,
+  type ShellPromptReadinessProbe
+} from '../shell-prompt-readiness-probe'
 import {
   expandWindowsEnvironmentVariables,
   expandWindowsPathEnvironmentVariables
@@ -670,7 +680,9 @@ export class LocalPtyProvider implements IPtyProvider {
     }
 
     ensureNodePtySpawnHelperExecutable()
-    validateWorkingDirectory(validationCwd)
+    if (args.prevalidatedCwd !== validationCwd) {
+      validateWorkingDirectory(validationCwd)
+    }
 
     const spawnEnv: Record<string, string> = {
       ...mergeGitConfigEnvProtocol(stripInheritedBuildModeEnv(process.env), args.env),
@@ -948,6 +960,11 @@ export class LocalPtyProvider implements IPtyProvider {
     // Shell-ready startup command support
     let resolveShellReady: ((signal: ShellReadySignal) => void) | null = null
     let shellReadyTimeout: ReturnType<typeof setTimeout> | null = null
+    let shellStartupPid: number | null = null
+    let shellPromptReadinessProbe: ShellPromptReadinessProbe | null = null
+    let shellStartupIdentityScanState = shellReadyLaunch?.supportsReadyMarker
+      ? createShellStartupIdentityScanState()
+      : null
     const shellReadyScanState = shellReadyLaunch?.supportsReadyMarker
       ? createShellReadyScanState()
       : null
@@ -964,6 +981,8 @@ export class LocalPtyProvider implements IPtyProvider {
         clearTimeout(shellReadyTimeout)
         shellReadyTimeout = null
       }
+      shellPromptReadinessProbe?.dispose()
+      shellPromptReadinessProbe = null
       const resolve = resolveShellReady
       resolveShellReady = null
       resolve(signal)
@@ -972,12 +991,35 @@ export class LocalPtyProvider implements IPtyProvider {
       if (!shellReadyScanState) {
         return
       }
-      const heldBytes = drainShellReadyHeldBytes(shellReadyScanState)
+      let heldBytes = shellStartupIdentityScanState
+        ? drainShellStartupIdentityHeldBytes(shellStartupIdentityScanState)
+        : ''
+      shellStartupIdentityScanState = null
+      if (heldBytes) {
+        heldBytes = scanForShellReady(shellReadyScanState, heldBytes).output
+      }
+      heldBytes += drainShellReadyHeldBytes(shellReadyScanState)
       if (heldBytes.length === 0) {
         return
       }
       startupIngress.accept(heldBytes)
     }
+    if (shellReadyScanState) {
+      shellPromptReadinessProbe = createShellPromptReadinessProbe({
+        slavePath: readPtySlavePath(proc),
+        shellPath,
+        shellCwd: effectiveCwd,
+        shellPathEnv: finalEnv.PATH,
+        getShellPid: () => shellStartupPid,
+        onPromptReady: () => {
+          console.warn(
+            `[pty] ${id}: shell-ready wrapper was replaced before its marker; releasing at the identified shell prompt. OSC 133 integration may be unavailable.`
+          )
+          releaseHeldShellReadyBytes()
+          finishShellReady({ postMarkerBytesObserved: true })
+        }
+      })
+    }
     if (args.command) {
       if (shellReadyLaunch?.supportsReadyMarker) {
         shellReadyTimeout = setTimeout(() => {
@@ -999,20 +1041,33 @@ export class LocalPtyProvider implements IPtyProvider {
         startupCommandCleanup?.()
         startupCommandCleanup = null
         resolveShellReady = null
+        shellPromptReadinessProbe?.dispose()
+        shellPromptReadinessProbe = null
       })
     }
 
     const disposables: { dispose: () => void }[] = []
     const onDataDisposable = proc.onData((rawData) => {
       let data = rawData
+      if (shellStartupIdentityScanState && resolveShellReady) {
+        const scanned = scanForShellStartupIdentity(shellStartupIdentityScanState, data)
+        data = scanned.output
+        if (scanned.shellPid) {
+          shellStartupPid = scanned.shellPid
+          shellStartupIdentityScanState = null
+        }
+      }
       if (shellReadyScanState && resolveShellReady) {
-        const scanned = scanForShellReady(shellReadyScanState, rawData)
+        const scanned = scanForShellReady(shellReadyScanState, data)
         data = scanned.output
         if (scanned.matched) {
           finishShellReady({ postMarkerBytesObserved: scanned.postMarkerBytesObserved })
         }
       }
       startupIngress.accept(data)
+      if (resolveShellReady && data.length > 0) {
+        shellPromptReadinessProbe?.notifyOutput(data)
+      }
     })
     if (onDataDisposable) {
       disposables.push(onDataDisposable)
@@ -1030,6 +1085,8 @@ export class LocalPtyProvider implements IPtyProvider {
         shellReadyTimeout = null
       }
       startupCommandCleanup?.()
+      shellPromptReadinessProbe?.dispose()
+      shellPromptReadinessProbe = null
       clearPtyState(id)
       startupIngress.drainAndClose()
       startupIngressByPty.delete(id)
@@ -1046,10 +1103,14 @@ export class LocalPtyProvider implements IPtyProvider {
     ptyDisposables.set(id, disposables)
 
     if (args.command && !startupCommandDeliveredInShellArgs) {
-      // Why: only POSIX bash/zsh have bracketed-paste armed so multiline startup prompts paste literally; others use raw submit.
+      // Why: shells with bracketed paste armed take a multiline startup prompt literally; others use raw submit.
       const spawnedShellName = getSpawnedShellName(shellPath).toLowerCase()
       const bracketedPasteSafe =
-        process.platform !== 'win32' && (spawnedShellName === 'bash' || spawnedShellName === 'zsh')
+        process.platform !== 'win32' &&
+        isBracketedPasteSafeShell({
+          shellName: spawnedShellName,
+          waitsForShellReady: shellReadyLaunch?.supportsReadyMarker === true
+        })
       writeStartupCommandWhenShellReady(
         shellReadyPromise,
         proc,
diff --git a/src/main/providers/local-pty-shell-ready.test.ts b/src/main/providers/local-pty-shell-ready.test.ts
index d9034a5cc24..a35eae779da 100644
--- a/src/main/providers/local-pty-shell-ready.test.ts
+++ b/src/main/providers/local-pty-shell-ready.test.ts
@@ -485,6 +485,7 @@ describePosix('local PTY shell-ready launch config', () => {
     const zshrc = readFileSync(join(userDataPath, 'shell-ready', 'zsh', '.zshrc'), 'utf8')
     const zlogin = readFileSync(join(userDataPath, 'shell-ready', 'zsh', '.zlogin'), 'utf8')
     expect(zshenv).toContain('_orca_user_zdotdir="${_orca_spawn_orig_zdotdir:-$HOME}"')
+    expect(zshenv).toContain('printf "\\033]777;orca-shell-start:%s\\007" "$$"')
     expect(zshenv).toContain('*/shell-ready/zsh) _orca_user_zdotdir="$HOME" ;;')
     expect(zshenv).toContain('""|*/shell-ready/zsh) export ORCA_ORIG_ZDOTDIR="$HOME" ;;')
     expectZdotdirSourceContext(zprofile, '.zprofile')
@@ -526,8 +527,6 @@ describePosix('local PTY shell-ready launch config', () => {
       '[[ -n "${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="${ORCA_CODEX_HOME}"'
     const agentTeamsPathRestoreLine = '[[ -n "${ORCA_AGENT_TEAMS_SHIM_DIR:-}" ]] || return 0'
     const ompWrapperLine = 'command omp --extension "${ORCA_OMP_STATUS_EXTENSION}" "$@"'
-    const primeWrapperLine =
-      'command prime-agent --extension "${ORCA_PRIME_AGENT_STATUS_EXTENSION}" "$@"'
     expect(zshrc).toContain(restoreLine)
     expect(zlogin).toContain(restoreLine)
     expect(bashRc).toContain(restoreLine)
@@ -549,9 +548,12 @@ describePosix('local PTY shell-ready launch config', () => {
     expect(zshrc).toContain(ompWrapperLine)
     expect(zlogin).toContain(ompWrapperLine)
     expect(bashRc).toContain(ompWrapperLine)
-    expect(zshrc).toContain(primeWrapperLine)
-    expect(zlogin).toContain(primeWrapperLine)
-    expect(bashRc).toContain(primeWrapperLine)
+    for (const wrapperFile of [zshrc, zlogin, bashRc]) {
+      expect(wrapperFile).not.toContain('prime-agent()')
+      expect(wrapperFile).not.toContain('__orca_prime_agent')
+      expect(wrapperFile).not.toContain('ORCA_PRIME_AGENT_STATUS_EXTENSION')
+      expect(wrapperFile).not.toContain('command prime-agent --extension')
+    }
   })
 
   // Why: issue #2422 — without OSC 133 C/D markers, bash sessions kept the worktree spinner "working" ~30min after the agent exited.
diff --git a/src/main/providers/local-pty-shell-ready.ts b/src/main/providers/local-pty-shell-ready.ts
index 63885e23579..28c56b27d1f 100644
--- a/src/main/providers/local-pty-shell-ready.ts
+++ b/src/main/providers/local-pty-shell-ready.ts
@@ -15,13 +15,13 @@ import {
   isPowerShellExecutableName
 } from '../powershell-osc133-bootstrap'
 import { getPosixOmpShellWrapper } from '../pty/omp-shell-wrapper'
-import { getPosixPrimeAgentShellWrapper } from '../pty/prime-agent-shell-wrapper'
 import { buildStartupCommandSubmission } from '../../shared/startup-command-submission'
 import {
   getFishShellReadyInitCommand,
   getZshEnvTemplate,
   getZshFinalZdotdirRestoreBlock,
   getZshShellReadyMarkerRegistrationBlock,
+  SHELL_STARTUP_IDENTITY_MARKER_BLOCK,
   getZshStartupFileSourceBlock
 } from '../shell-templates'
 export {
@@ -93,6 +93,7 @@ function resolveOriginalZshenvSourceDir(): string {
 
 export function getBashShellReadyRcfileContent(): string {
   return `# Orca bash shell-ready wrapper
+${SHELL_STARTUP_IDENTITY_MARKER_BLOCK}
 [[ -f /etc/profile ]] && source /etc/profile
 if [[ -f "$HOME/.bash_profile" ]]; then
   source "$HOME/.bash_profile"
@@ -130,7 +131,6 @@ __orca_restore_agent_teams_path
 [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
 [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
 ${getPosixOmpShellWrapper()}
-${getPosixPrimeAgentShellWrapper()}
 # Why: Codex must keep using Orca's runtime CODEX_HOME after profile scripts.
 [[ -n "\${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="\${ORCA_CODEX_HOME}"
 # Why: emit OSC 133 C/D so terminal-command-lifecycle can drop stale agent
@@ -247,7 +247,6 @@ if [[ ! -o login ]]; then
   [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
 [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
   ${getPosixOmpShellWrapper()}
-  ${getPosixPrimeAgentShellWrapper()}
   # Why: Codex must keep using Orca's runtime CODEX_HOME after rc files.
   [[ -n "\${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="\${ORCA_CODEX_HOME}"
 fi
@@ -308,7 +307,6 @@ __orca_restore_agent_teams_path
 [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
 [[ -n "\${ORCA_MIMOCODE_HOME:-}" ]] && export MIMOCODE_HOME="\${ORCA_MIMOCODE_HOME}"
 ${getPosixOmpShellWrapper()}
-${getPosixPrimeAgentShellWrapper()}
 [[ -n "\${ORCA_CODEX_HOME:-}" ]] && export CODEX_HOME="\${ORCA_CODEX_HOME}"
 ${getZshShellReadyMarkerRegistrationBlock(SHELL_READY_MARKER_ESCAPED)}
 ${getZshFinalZdotdirRestoreBlock()}
@@ -372,7 +370,8 @@ function getWrappedShellLaunchConfig(
         ORCA_ORIG_ZDOTDIR: resolveOriginalZdotdir(),
         ORCA_ZSHENV_SOURCE_DIR: resolveOriginalZshenvSourceDir(),
         ZDOTDIR: `${getShellReadyWrapperRoot()}/zsh`,
-        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0'
+        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0',
+        ORCA_SHELL_STARTUP_IDENTITY: options.emitReadyMarker ? '1' : '0'
       },
       supportsReadyMarker: options.emitReadyMarker
     }
@@ -383,7 +382,8 @@ function getWrappedShellLaunchConfig(
     return {
       args: ['--rcfile', `${getShellReadyWrapperRoot()}/bash/rcfile`],
       env: {
-        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0'
+        ORCA_SHELL_READY_MARKER: options.emitReadyMarker ? '1' : '0',
+        ORCA_SHELL_STARTUP_IDENTITY: options.emitReadyMarker ? '1' : '0'
       },
       supportsReadyMarker: options.emitReadyMarker
     }
@@ -433,7 +433,7 @@ export function writeStartupCommandWhenShellReady(
   proc: pty.IPty,
   startupCommand: string,
   onExit: (cleanup: () => void) => void,
-  // Why: only Orca-wrapped bash/zsh have bracketed-paste active; other shells use the raw path to avoid echoing the ESC[200~ markers.
+  // Why: only shells with bracketed-paste active (see isBracketedPasteSafeShell) accept the wrapper; others use the raw path so ESC[200~ isn't echoed.
   options: { bracketedPasteSafe?: boolean } = {}
 ): void {
   let sent = false
diff --git a/src/main/providers/local-pty-utils-windows-fallback.test.ts b/src/main/providers/local-pty-utils-windows-fallback.test.ts
index 0de16d03f17..a71537ba8b2 100644
--- a/src/main/providers/local-pty-utils-windows-fallback.test.ts
+++ b/src/main/providers/local-pty-utils-windows-fallback.test.ts
@@ -133,18 +133,28 @@ describe('spawnShellWithFallback on Windows', () => {
     const ptySpawn = vi.fn(() => {
       throw new Error(ACCESS_DENIED_5)
     }) as unknown as typeof pty.spawn
+    const previousVersion = process.env.ORCA_APP_VERSION
+    process.env.ORCA_APP_VERSION = '1.4.178-test'
 
-    expect(() =>
-      spawnShellWithFallback({
-        shellPath: PWSH7,
-        shellArgs: attempts[0].shellArgs,
-        cols: 80,
-        rows: 24,
-        cwd: 'C:\\repo',
-        env: {},
-        ptySpawn,
-        windowsFallbackAttempts: attempts
-      })
-    ).toThrow(/Failed to spawn shell/)
+    try {
+      expect(() =>
+        spawnShellWithFallback({
+          shellPath: PWSH7,
+          shellArgs: attempts[0].shellArgs,
+          cols: 80,
+          rows: 24,
+          cwd: 'C:\\repo',
+          env: {},
+          ptySpawn,
+          windowsFallbackAttempts: attempts
+        })
+      ).toThrow(/Failed to spawn shell.*orca: 1\.4\.178-test/)
+    } finally {
+      if (previousVersion === undefined) {
+        delete process.env.ORCA_APP_VERSION
+      } else {
+        process.env.ORCA_APP_VERSION = previousVersion
+      }
+    }
   })
 })
diff --git a/src/main/providers/local-pty-utils.test.ts b/src/main/providers/local-pty-utils.test.ts
index bc812e1a46a..6b4846617ca 100644
--- a/src/main/providers/local-pty-utils.test.ts
+++ b/src/main/providers/local-pty-utils.test.ts
@@ -93,9 +93,21 @@ describe('validateWorkingDirectory', () => {
 
   it('rejects a missing native Windows path', () => {
     existsSyncMock.mockReturnValue(false)
+    const previousVersion = process.env.ORCA_APP_VERSION
+    process.env.ORCA_APP_VERSION = '1.4.178-test'
 
-    expect(() => validateWorkingDirectory(NATIVE_DIR)).toThrow(/does not exist/)
-    expect(wslUncDirectoryExistsMock).not.toHaveBeenCalled()
+    try {
+      expect(() => validateWorkingDirectory(NATIVE_DIR)).toThrow(
+        /does not exist.*orca: 1\.4\.178-test/
+      )
+      expect(wslUncDirectoryExistsMock).not.toHaveBeenCalled()
+    } finally {
+      if (previousVersion === undefined) {
+        delete process.env.ORCA_APP_VERSION
+      } else {
+        process.env.ORCA_APP_VERSION = previousVersion
+      }
+    }
   })
 
   it('rejects a native Windows path that exists but is not a directory', () => {
diff --git a/src/main/providers/local-pty-utils.ts b/src/main/providers/local-pty-utils.ts
index 3e21095d535..cb414d05a8e 100644
--- a/src/main/providers/local-pty-utils.ts
+++ b/src/main/providers/local-pty-utils.ts
@@ -1,5 +1,6 @@
 import { basename, isAbsolute, join } from 'node:path'
 import { existsSync, accessSync, statSync, chmodSync, constants as fsConstants } from 'node:fs'
+import { release } from 'node:os'
 import type * as pty from 'node-pty'
 import { isWslUncPath } from '../../shared/wsl-paths'
 import { wslUncDirectoryExists } from '../wsl'
@@ -99,10 +100,26 @@ export function ensureNodePtySpawnHelperExecutable(): void {
   }
 }
 
+function formatLocalPtyEnvironmentDiag(extra: Record<string, string> = {}): string {
+  const systemVersion =
+    (process as NodeJS.Process & { getSystemVersion?: () => string }).getSystemVersion?.() ||
+    release()
+  const parts = {
+    ...extra,
+    arch: process.arch,
+    platform: `${process.platform} ${systemVersion}`,
+    orca: process.env.ORCA_APP_VERSION?.trim() || '0.0.0-dev'
+  }
+  return Object.entries(parts)
+    .map(([key, value]) => `${key}: ${value}`)
+    .join(', ')
+}
+
 function throwMissingWorkingDirectory(cwd: string): never {
   throw new Error(
     `Working directory "${cwd}" does not exist. ` +
-      `It may have been deleted or is on an unmounted volume.`
+      `It may have been deleted or is on an unmounted volume ` +
+      `(${formatLocalPtyEnvironmentDiag({ cwd })}).`
   )
 }
 
@@ -305,12 +322,7 @@ export function spawnShellWithFallback(params: ShellSpawnParams): ShellSpawnResu
     }
   }
 
-  const diag = [
-    `shell: ${shellPath}`,
-    `cwd: ${cwd}`,
-    `arch: ${process.arch}`,
-    `platform: ${process.platform} ${process.getSystemVersion?.() ?? ''}`
-  ].join(', ')
+  const diag = formatLocalPtyEnvironmentDiag({ shell: shellPath, cwd })
   throw new Error(
     `Failed to spawn shell "${shellPath}": ${primaryError ?? 'unknown error'} (${diag}). ` +
       `If this persists, please file an issue.`
diff --git a/src/main/providers/pty-provider-contract.ts b/src/main/providers/pty-provider-contract.ts
index 02b1d9acf1e..09f3cda62fd 100644
--- a/src/main/providers/pty-provider-contract.ts
+++ b/src/main/providers/pty-provider-contract.ts
@@ -19,6 +19,8 @@ export type {
 
 export type PtyProviderBufferSnapshot = {
   data: string
+  /** Live state that can be restored without an alternate-screen frame. */
+  frameRestoreAnsi?: string
   /** Authoritative normal buffer captured beside an alternate-screen frame. */
   scrollbackAnsi?: string
   cols: number
@@ -30,12 +32,18 @@ export type PtyProviderBufferSnapshot = {
   oscLinks?: TerminalOscLinkRange[]
   alternateScreen?: boolean
   pendingEscapeTailAnsi?: string
+  /** Effective kitty keyboard flags PROVEN at this snapshot's own `seq`
+   *  boundary. Absent means the source could not prove them; readers must not
+   *  rewrite that silence into a known `0`. */
+  kittyKeyboardFlags?: number
 }
 
 export type PtySpawnOptions = {
   cols: number
   rows: number
   cwd?: string
+  /** Exact per-spawn cwd already proven by main; providers validate any other resolved path. */
+  prevalidatedCwd?: string
   env?: Record<string, string>
   envToDelete?: string[]
   /** Main-validated home provenance for an automatic Codex session resume. */
diff --git a/src/main/providers/pty-spawn-result.ts b/src/main/providers/pty-spawn-result.ts
index 235672e05e7..ebed657ee21 100644
--- a/src/main/providers/pty-spawn-result.ts
+++ b/src/main/providers/pty-spawn-result.ts
@@ -32,6 +32,12 @@ export type PtySpawnResult = {
    *  writing the snapshot so ANSI cursor positions land correctly. */
   snapshotCols?: number
   snapshotRows?: number
+  /** Normal-buffer history and mode preamble before an alternate-screen frame. */
+  snapshotPrefixAnsi?: string
+  /** Visual alternate-screen frame, separate so newer clients can omit it safely. */
+  snapshotFrameAnsi?: string
+  /** Live state to append when omitting `snapshotFrameAnsi`. */
+  snapshotFrameRestoreAnsi?: string
   /** Provider sequence at the attach boundary. `reset` starts a new provider
    *  generation; `continued` resumes the existing absolute domain. */
   providerSequence?: {
@@ -43,6 +49,9 @@ export type PtySpawnResult = {
    *  (terminal-query-authority.md §kitty). Never replayed into a renderer
    *  xterm — POST_REPLAY_REATTACH_RESET's kitty reset stays authoritative. */
   snapshotKittyKeyboardFlags?: number
+  /** Renderer-domain sequence main reconciled for the attach boundary those
+   *  flags describe. Set by main, not the provider. */
+  snapshotSeq?: number
   /** True when the spawn reattached to an existing daemon session. */
   isReattach?: boolean
   /** Last OSC title tracked by the daemon session the snapshot came from.
diff --git a/src/main/providers/ssh-git-provider.test.ts b/src/main/providers/ssh-git-provider.test.ts
index c0613f35f2e..20ebd9293a1 100644
--- a/src/main/providers/ssh-git-provider.test.ts
+++ b/src/main/providers/ssh-git-provider.test.ts
@@ -1081,6 +1081,125 @@ describe('SshGitProvider', () => {
     expect(result).toEqual(diffs)
   })
 
+  it('getBranchDiff forwards a pinned head OID without adding it when omitted', async () => {
+    const headOid = 'a'.repeat(40)
+    mux.request.mockResolvedValue([])
+
+    await provider.getBranchDiff('/home/user/repo', 'main', {
+      includePatch: true,
+      filePath: 'src/file.ts',
+      headOid
+    })
+    await provider.getBranchDiff('/home/user/repo', 'main', {
+      includePatch: true,
+      filePath: 'src/other-file.ts',
+      headOid: undefined
+    })
+
+    expect(mux.request).toHaveBeenNthCalledWith(1, 'git.branchDiff', {
+      worktreePath: '/home/user/repo',
+      baseRef: 'main',
+      includePatch: true,
+      filePath: 'src/file.ts',
+      headOid,
+      __streamResponse: true
+    })
+    expect(mux.request).toHaveBeenNthCalledWith(2, 'git.branchDiff', {
+      worktreePath: '/home/user/repo',
+      baseRef: 'main',
+      includePatch: true,
+      filePath: 'src/other-file.ts',
+      __streamResponse: true
+    })
+  })
+
+  // Why: an unpinned compare snapshot reaches getBranchDiff as null despite the type.
+  it('omits a null head OID and shares the absent-head dedupe key', async () => {
+    const diffs = [{ kind: 'text', originalContent: 'old', modifiedContent: 'new' }]
+    const pendingDiff = deferredValue(diffs)
+    const headOid = 'a'.repeat(40)
+    mux.request.mockReturnValue(pendingDiff.promise)
+
+    const reads = [
+      provider.getBranchDiff('/home/user/repo', 'main', {
+        includePatch: true,
+        filePath: 'src/file.ts',
+        headOid: null as unknown as undefined
+      }),
+      provider.getBranchDiff('/home/user/repo', 'main', {
+        includePatch: true,
+        filePath: 'src/file.ts'
+      }),
+      provider.getBranchDiff('/home/user/repo', 'main', {
+        includePatch: true,
+        filePath: 'src/file.ts',
+        headOid
+      })
+    ]
+
+    await waitForRequestCount(mux.request, 2)
+    expect(mux.request).toHaveBeenCalledTimes(2)
+    expect(mux.request).toHaveBeenNthCalledWith(1, 'git.branchDiff', {
+      worktreePath: '/home/user/repo',
+      baseRef: 'main',
+      includePatch: true,
+      filePath: 'src/file.ts',
+      __streamResponse: true
+    })
+    expect(mux.request).toHaveBeenNthCalledWith(2, 'git.branchDiff', {
+      worktreePath: '/home/user/repo',
+      baseRef: 'main',
+      includePatch: true,
+      filePath: 'src/file.ts',
+      headOid,
+      __streamResponse: true
+    })
+
+    pendingDiff.resolve()
+    await expect(Promise.all(reads)).resolves.toEqual(Array.from({ length: 3 }, () => diffs))
+  })
+
+  it('coalesces matching branch diff heads while keeping distinct and absent heads separate', async () => {
+    const diffs = [{ kind: 'text', originalContent: 'old', modifiedContent: 'new' }]
+    const pendingDiff = deferredValue(diffs)
+    const firstHeadOid = 'a'.repeat(40)
+    const secondHeadOid = 'b'.repeat(40)
+    mux.request.mockReturnValue(pendingDiff.promise)
+
+    const reads = [
+      provider.getBranchDiff('/home/user/repo', 'main', {
+        includePatch: true,
+        filePath: 'src/file.ts',
+        headOid: firstHeadOid
+      }),
+      provider.getBranchDiff('/home/user/repo', 'main', {
+        filePath: 'src/file.ts',
+        headOid: firstHeadOid,
+        includePatch: true
+      }),
+      provider.getBranchDiff('/home/user/repo', 'main', {
+        includePatch: true,
+        filePath: 'src/file.ts',
+        headOid: secondHeadOid
+      }),
+      provider.getBranchDiff('/home/user/repo', 'main', {
+        includePatch: true,
+        filePath: 'src/file.ts'
+      }),
+      provider.getBranchDiff('/home/user/repo', 'main', {
+        includePatch: true,
+        filePath: 'src/file.ts',
+        headOid: undefined
+      })
+    ]
+
+    await waitForRequestCount(mux.request, 3)
+    expect(mux.request).toHaveBeenCalledTimes(3)
+
+    pendingDiff.resolve()
+    await expect(Promise.all(reads)).resolves.toEqual(Array.from({ length: 5 }, () => diffs))
+  })
+
   it('coalesces concurrent identical diff RPCs while in flight', async () => {
     const diff = {
       kind: 'text',
diff --git a/src/main/providers/ssh-git-provider.ts b/src/main/providers/ssh-git-provider.ts
index e4c306529ee..51e2b91e1c2 100644
--- a/src/main/providers/ssh-git-provider.ts
+++ b/src/main/providers/ssh-git-provider.ts
@@ -41,6 +41,7 @@ type NonInteractiveExecQueueEntry = {
 }
 
 const NON_INTERACTIVE_TRANSPORT_TIMEOUT_MARGIN_MS = 5_000
+const ABSENT_BRANCH_DIFF_HEAD_OID = { absent: true } as const
 
 function isJsonRpcMethodNotFoundError(error: unknown): boolean {
   if (!error || typeof error !== 'object') {
@@ -658,9 +659,14 @@ export class SshGitProvider implements IGitProvider {
   async getBranchDiff(
     worktreePath: string,
     baseRef: string,
-    options?: { includePatch?: boolean; filePath?: string; oldPath?: string }
+    options?: { includePatch?: boolean; filePath?: string; oldPath?: string; headOid?: string }
   ): Promise<GitDiffResult[]> {
     const keyOptions = options ?? {}
+    const { headOid: rawHeadOid, ...relayOptions } = keyOptions
+    // Why: compare snapshots type headOid as `string | null`, so collapse an
+    // unpinned null to absent instead of putting a field on the wire that a
+    // pinned-OID relay must reject.
+    const headOid = rawHeadOid == null ? undefined : rawHeadOid
     return this.gitDiffReadDedupe.run(
       stableInFlightKey([
         'branchDiff',
@@ -668,13 +674,15 @@ export class SshGitProvider implements IGitProvider {
         baseRef,
         keyOptions.includePatch ?? null,
         keyOptions.filePath ?? null,
-        keyOptions.oldPath ?? null
+        keyOptions.oldPath ?? null,
+        headOid === undefined ? ABSENT_BRANCH_DIFF_HEAD_OID : headOid
       ]),
       async () =>
         (await requestGitStreamable(this.mux, 'git.branchDiff', {
           worktreePath,
           baseRef,
-          ...options
+          ...relayOptions,
+          ...(headOid === undefined ? {} : { headOid })
         })) as GitDiffResult[]
     ) as Promise<GitDiffResult[]>
   }
diff --git a/src/main/providers/windows-foreground-process-rows.ts b/src/main/providers/windows-foreground-process-rows.ts
index 7e4cdd2e48d..d5e8f8185cd 100644
--- a/src/main/providers/windows-foreground-process-rows.ts
+++ b/src/main/providers/windows-foreground-process-rows.ts
@@ -112,7 +112,7 @@ function parseWindowsProcessValueRows(stdout: string): WindowsProcessRow[] {
       continue
     }
     const eq = line.indexOf('=')
-    if (eq < 0) {
+    if (eq === -1) {
       continue
     }
     const key = line.slice(0, eq)
diff --git a/src/main/providers/windows-shell-args.test.ts b/src/main/providers/windows-shell-args.test.ts
index 53a83e6638d..534bfc90085 100644
--- a/src/main/providers/windows-shell-args.test.ts
+++ b/src/main/providers/windows-shell-args.test.ts
@@ -219,7 +219,7 @@ describe('resolveWindowsShellLaunchArgs', () => {
   it('starts Git Bash as an interactive login shell with UTF-8 console setup', () => {
     const result = resolveWindowsShellLaunchArgs(
       'C:\\Program Files\\Git\\bin\\bash.exe',
-      'C:\\Users\\alice\\code',
+      '/c',
       'C:\\Users\\alice'
     )
 
@@ -237,8 +237,8 @@ describe('resolveWindowsShellLaunchArgs', () => {
     // Must stay fail-open: `;` (not `&&`) so a missing chcp.com can't abort the
     // exec and kill the terminal on startup.
     expect(bashCommand).not.toContain('&&')
-    expect(result.effectiveCwd).toBe('C:\\Users\\alice\\code')
-    expect(result.validationCwd).toBe('C:\\Users\\alice\\code')
+    expect(result.effectiveCwd).toBe('C:\\')
+    expect(result.validationCwd).toBe('C:\\')
   })
 
   it('does not apply Git Bash launch args to unrelated bash.exe paths', () => {
@@ -280,16 +280,17 @@ describe('resolveWindowsShellLaunchArgs', () => {
     expect(existsSync(join(userDataPath, 'shell-ready', 'bash', 'rcfile'))).toBe(true)
     expect(existsSync(join(userDataPath, 'shell-ready', 'zsh', '.zshenv'))).toBe(true)
 
-    // Why: typed agents need the host-managed status extension in WSL.
+    // Why: typed OMP keeps its existing shell integration, while typed Prime
+    // commands must reach the user's binary without Orca rewriting argv.
     const bashRcfile = readFileSync(join(userDataPath, 'shell-ready', 'bash', 'rcfile'), 'utf8')
     const zshLogin = readFileSync(join(userDataPath, 'shell-ready', 'zsh', '.zlogin'), 'utf8')
     for (const wrapperFile of [bashRcfile, zshLogin]) {
       expect(wrapperFile).toContain('command omp --extension "${ORCA_OMP_STATUS_EXTENSION}" "$@"')
       expect(wrapperFile).toContain('omp() { __orca_omp "$@"; }')
-      expect(wrapperFile).toContain(
-        'command prime-agent --extension "${ORCA_PRIME_AGENT_STATUS_EXTENSION}" "$@"'
-      )
-      expect(wrapperFile).toContain('prime-agent() { __orca_prime_agent "$@"; }')
+      expect(wrapperFile).not.toContain('prime-agent()')
+      expect(wrapperFile).not.toContain('__orca_prime_agent')
+      expect(wrapperFile).not.toContain('ORCA_PRIME_AGENT_STATUS_EXTENSION')
+      expect(wrapperFile).not.toContain('command prime-agent --extension')
     }
   })
 
@@ -307,17 +308,15 @@ describe('resolveWindowsShellLaunchArgs', () => {
     expect(result.validationCwd).toBe('C:\\Users\\alice\\project')
   })
 
-  it('does not treat MSYS drive cwd as a WSL POSIX cwd', () => {
-    const result = resolveWindowsShellLaunchArgs(
-      'wsl.exe',
-      '/c/Users/alice/project',
-      'C:\\Users\\alice',
-      { distro: 'Ubuntu', treatPosixCwdAsWsl: true }
-    )
+  it.each(['/a', '/c'])('keeps a selected WSL runtime single-letter cwd exact (%s)', (cwd) => {
+    const result = resolveWindowsShellLaunchArgs('wsl.exe', cwd, 'C:\\Users\\alice', {
+      distro: 'Ubuntu',
+      treatPosixCwdAsWsl: true
+    })
 
-    expect(result.shellArgs).toEqual(expectedWslArgs('/mnt/c/Users/alice/project', 'Ubuntu'))
+    expect(result.shellArgs).toEqual(expectedWslArgs(cwd, 'Ubuntu'))
     expect(result.effectiveCwd).toBe('C:\\Users\\alice')
-    expect(result.validationCwd).toBe('C:\\Users\\alice\\project')
+    expect(result.validationCwd).toBe(`\\\\wsl.localhost\\Ubuntu\\${cwd.slice(1)}`)
   })
 
   it('escapes single quotes when translating a WSL cwd', () => {
diff --git a/src/main/providers/windows-shell-args.ts b/src/main/providers/windows-shell-args.ts
index bde8a872efb..772ef8d9f05 100644
--- a/src/main/providers/windows-shell-args.ts
+++ b/src/main/providers/windows-shell-args.ts
@@ -131,7 +131,8 @@ function buildWslShellArgs(linuxCwd: string, distro?: string): string[] {
   return distro ? ['-d', distro, ...shellArgs] : shellArgs
 }
 
-function normalizeMsysDrivePath(cwd: string): string {
+/** Converts an MSYS drive spelling to the native cwd used by Windows terminal processes. */
+export function normalizeWindowsTerminalCwd(cwd: string): string {
   const match = cwd.match(/^\/([A-Za-z])(?:\/(.*))?$/)
   if (!match) {
     return cwd
@@ -161,8 +162,7 @@ export function resolveWindowsShellLaunchArgs(
   startupCommand?: string
 ): WindowsShellLaunchArgs {
   const shellBasename = pathWin32.basename(shellPath).toLowerCase()
-  const nativeCwd = normalizeMsysDrivePath(cwd)
-  const isMsysDriveCwd = nativeCwd !== cwd
+  const nativeCwd = normalizeWindowsTerminalCwd(cwd)
 
   if (shellBasename === 'cmd.exe') {
     const shellArgStartupCommand = getCmdShellArgStartupCommand(startupCommand)
@@ -210,7 +210,7 @@ export function resolveWindowsShellLaunchArgs(
         validationCwd: cwd
       }
     }
-    if (wslContext?.treatPosixCwdAsWsl && cwd.startsWith('/') && !isMsysDriveCwd) {
+    if (wslContext?.treatPosixCwdAsWsl && cwd.startsWith('/')) {
       return {
         shellArgs: buildWslShellArgs(cwd, wslContext.distro),
         effectiveCwd: defaultCwd,
diff --git a/src/main/pty/posix-pty-foreground-group.ts b/src/main/pty/posix-pty-foreground-group.ts
index 124978c269d..8b3e375dbff 100644
--- a/src/main/pty/posix-pty-foreground-group.ts
+++ b/src/main/pty/posix-pty-foreground-group.ts
@@ -103,7 +103,7 @@ export function getPosixPtyForegroundGroup(
 export function signalPosixPtyForegroundGroup(
   rootPid: number,
   ptsName: string | undefined,
-  signal: NodeJS.Signals | string,
+  signal: NodeJS.Signals | (string & {}),
   fallback: () => void,
   deps: PosixPtyForegroundGroupDeps = {}
 ): void {
diff --git a/src/main/pty/prime-agent-shell-wrapper.test.ts b/src/main/pty/prime-agent-shell-wrapper.test.ts
deleted file mode 100644
index 1ad1fe774cb..00000000000
--- a/src/main/pty/prime-agent-shell-wrapper.test.ts
+++ /dev/null
@@ -1,244 +0,0 @@
-import { spawnSync } from 'node:child_process'
-import { chmodSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { dirname, join } from 'node:path'
-import { afterEach, describe, expect, it } from 'vitest'
-import { getPosixPrimeAgentShellWrapper } from './prime-agent-shell-wrapper'
-
-const describePosix = process.platform === 'win32' ? describe.skip : describe
-const hasBash = process.platform !== 'win32' && spawnSync('bash', ['--version']).status === 0
-const itWithBash = hasBash ? it : it.skip
-const tempDirs: string[] = []
-
-function makeFixture(): {
-  root: string
-  extensionPath: string
-  capturePath: string
-  endpointPath: string
-  primeHome: string
-  rcfile: string
-} {
-  const root = mkdtempSync(join(tmpdir(), 'orca-prime-wrapper-'))
-  tempDirs.push(root)
-  const binDir = join(root, 'bin')
-  const primeHome = join(root, 'guest-prime-home')
-  const extensionPath = join(root, 'orca-agent-status.ts')
-  const capturePath = join(root, 'capture')
-  const endpointPath = join(
-    root,
-    '.orca-wsl',
-    'agent-hooks',
-    'instance-testinstance',
-    'endpoint.env'
-  )
-  const rcfile = join(root, 'rcfile')
-  mkdirSync(binDir)
-  mkdirSync(primeHome)
-  mkdirSync(dirname(endpointPath), { recursive: true })
-  writeFileSync(extensionPath, 'export default {}')
-  writeFileSync(endpointPath, 'ORCA_AGENT_HOOK_PORT=4567\nORCA_AGENT_HOOK_TOKEN=current-token\n')
-  writeFileSync(rcfile, getPosixPrimeAgentShellWrapper())
-  writeFileSync(
-    join(binDir, 'prime-agent'),
-    `#!/bin/sh
-{
-  printf 'HOME=%s\n' "$PRIME_AGENT_CODING_AGENT_DIR"
-  printf 'ENDPOINT=%s\n' "$ORCA_AGENT_HOOK_ENDPOINT"
-  i=0
-  for arg in "$@"; do
-    i=$((i + 1))
-    printf 'ARG%s=%s\n' "$i" "$arg"
-  done
-} > "$ORCA_CAPTURE_FILE"
-if [ "\${1:-}" = "config" ]; then
-  printf 'preserved\n' > "$PRIME_AGENT_CODING_AGENT_DIR/config.yml"
-fi
-`,
-    { mode: 0o755 }
-  )
-  chmodSync(join(binDir, 'prime-agent'), 0o755)
-  return { root, extensionPath, capturePath, endpointPath, primeHome, rcfile }
-}
-
-function runPrime(
-  fixture: ReturnType<typeof makeFixture>,
-  command: string,
-  extensionPath = fixture.extensionPath
-): string {
-  const result = spawnSync('bash', ['--noprofile', '--rcfile', fixture.rcfile, '-ic', command], {
-    cwd: fixture.root,
-    env: {
-      ...process.env,
-      HOME: fixture.root,
-      PATH: `${join(fixture.root, 'bin')}:${process.env.PATH ?? ''}`,
-      PRIME_AGENT_CODING_AGENT_DIR: fixture.primeHome,
-      ORCA_PRIME_AGENT_STATUS_EXTENSION: extensionPath,
-      ORCA_WSL_HOOK_INSTANCE: 'testinstance',
-      ORCA_AGENT_HOOK_ENDPOINT: '/mnt/c/current/endpoint.cmd',
-      ORCA_AGENT_HOOK_PORT: '4567',
-      ORCA_AGENT_HOOK_TOKEN: 'current-token',
-      ORCA_CAPTURE_FILE: fixture.capturePath
-    },
-    encoding: 'utf8'
-  })
-  expect(result.status, result.stderr).toBe(0)
-  return readFileSync(fixture.capturePath, 'utf8')
-}
-
-describePosix('Prime Agent shell wrapper', () => {
-  afterEach(() => {
-    for (const dir of tempDirs.splice(0)) {
-      rmSync(dir, { recursive: true, force: true })
-    }
-  })
-
-  itWithBash('injects the managed extension into an interactive launch', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, 'prime-agent ask')
-
-    expect(capture).toContain(`HOME=${fixture.primeHome}`)
-    expect(capture).toContain(`ENDPOINT=${fixture.endpointPath}`)
-    expect(capture).toContain('ARG1=--extension')
-    expect(capture).toContain(`ARG2=${fixture.extensionPath}`)
-    expect(capture).toContain('ARG3=ask')
-  })
-
-  itWithBash('preserves config subcommands and the guest Prime home', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, 'prime-agent config')
-
-    expect(capture).toContain(`HOME=${fixture.primeHome}`)
-    expect(capture).toContain('ARG1=config')
-    expect(capture).not.toContain('ARG1=--extension')
-    expect(readFileSync(join(fixture.primeHome, 'config.yml'), 'utf8')).toBe('preserved\n')
-  })
-
-  itWithBash.each([
-    'agents',
-    'doctor',
-    'help',
-    'list',
-    'model',
-    'package',
-    'rename',
-    'schedule',
-    'send',
-    'session',
-    'shutdown',
-    'status',
-    'stop',
-    'update'
-  ])('preserves the %s subcommand argv', (subcommand) => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, `prime-agent ${subcommand}`)
-
-    expect(capture).toContain(`ARG1=${subcommand}`)
-    expect(capture).not.toContain('ARG1=--extension')
-  })
-
-  itWithBash.each(['stop', 'rename'])(
-    'preserves --daemon-socket before the %s management command',
-    (subcommand) => {
-      const fixture = makeFixture()
-      const capture = runPrime(
-        fixture,
-        `prime-agent --daemon-socket /tmp/prime.sock ${subcommand} agent-123`
-      )
-
-      expect(capture).toContain('ARG1=--daemon-socket')
-      expect(capture).toContain('ARG2=/tmp/prime.sock')
-      expect(capture).toContain(`ARG3=${subcommand}`)
-      expect(capture).not.toContain(fixture.extensionPath)
-    }
-  )
-
-  itWithBash('injects the extension after the attach agent operand', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, 'prime-agent attach agent-123 --follow')
-
-    expect(capture).toContain('ARG1=attach')
-    expect(capture).toContain('ARG2=agent-123')
-    expect(capture).toContain('ARG3=--extension')
-    expect(capture).toContain(`ARG4=${fixture.extensionPath}`)
-    expect(capture).toContain('ARG5=--follow')
-  })
-
-  itWithBash('preserves attach help without inventing an agent operand', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, 'prime-agent attach --help')
-
-    expect(capture).toContain('ARG1=attach')
-    expect(capture).toContain('ARG2=--help')
-    expect(capture).not.toContain(fixture.extensionPath)
-  })
-
-  itWithBash('does not override an explicit user extension', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, 'prime-agent --extension /tmp/user-extension.ts ask')
-
-    expect(capture).toContain('ARG1=--extension')
-    expect(capture).toContain('ARG2=/tmp/user-extension.ts')
-    expect(capture).not.toContain(fixture.extensionPath)
-  })
-
-  itWithBash('does not add a second extension to attach', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(
-      fixture,
-      'prime-agent attach agent-123 --extension /tmp/user-extension.ts'
-    )
-
-    expect(capture).toContain('ARG1=attach')
-    expect(capture).toContain('ARG2=agent-123')
-    expect(capture).toContain('ARG3=--extension')
-    expect(capture).toContain('ARG4=/tmp/user-extension.ts')
-    expect(capture).not.toContain(fixture.extensionPath)
-  })
-
-  itWithBash('degrades to the original argv when the managed extension is unavailable', () => {
-    const fixture = makeFixture()
-    const capture = runPrime(fixture, 'prime-agent ask', join(fixture.root, 'missing.ts'))
-
-    expect(capture).toContain('ARG1=ask')
-    expect(capture).not.toContain('ARG1=--extension')
-  })
-
-  itWithBash('keeps the stable guest endpoint path while its relay refreshes stale data', () => {
-    const fixture = makeFixture()
-    writeFileSync(fixture.endpointPath, 'ORCA_AGENT_HOOK_PORT=4567\nORCA_AGENT_HOOK_TOKEN=stale\n')
-
-    const capture = runPrime(fixture, 'prime-agent ask')
-
-    expect(capture).toContain(`ENDPOINT=${fixture.endpointPath}`)
-    expect(capture).toContain('ARG1=--extension')
-  })
-
-  itWithBash('uses the guest endpoint path when the relay binds a fallback port', () => {
-    const fixture = makeFixture()
-    writeFileSync(
-      fixture.endpointPath,
-      'ORCA_AGENT_HOOK_PORT=9876\nORCA_AGENT_HOOK_TOKEN=current-token\n'
-    )
-
-    const capture = runPrime(fixture, 'prime-agent ask')
-
-    expect(capture).toContain(`ENDPOINT=${fixture.endpointPath}`)
-    expect(capture).toContain('ARG1=--extension')
-  })
-
-  itWithBash('does not define wrapper helpers when the bridge env is absent', () => {
-    const fixture = makeFixture()
-    const result = spawnSync(
-      'bash',
-      ['--noprofile', '--rcfile', fixture.rcfile, '-ic', 'type -t __orca_prime_agent'],
-      {
-        cwd: fixture.root,
-        env: { ...process.env, ORCA_PRIME_AGENT_STATUS_EXTENSION: '' },
-        encoding: 'utf8'
-      }
-    )
-
-    expect(result.status).not.toBe(0)
-    expect(result.stdout.trim()).toBe('')
-  })
-})
diff --git a/src/main/pty/prime-agent-shell-wrapper.ts b/src/main/pty/prime-agent-shell-wrapper.ts
deleted file mode 100644
index 97e723c26f1..00000000000
--- a/src/main/pty/prime-agent-shell-wrapper.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-import { wslHookRelayEndpointFilePath } from '../../shared/wsl-hook-relay-contract'
-
-const PRIME_AGENT_SUBCOMMANDS = [
-  'agents',
-  'config',
-  'doctor',
-  'help',
-  'list',
-  'model',
-  'package',
-  'rename',
-  'schedule',
-  'send',
-  'session',
-  'shutdown',
-  'status',
-  'stop',
-  'update'
-] as const
-
-export function getPosixPrimeAgentShellWrapper(): string {
-  const subcommands = PRIME_AGENT_SUBCOMMANDS.join('|')
-  const guestEndpointPath = wslHookRelayEndpointFilePath('${HOME%/}', '${ORCA_WSL_HOOK_INSTANCE}')
-  return `# Why: WSL cannot install into Prime's guest-owned config root from the
-# Windows host, so pass Orca's status extension only to interactive launches.
-if [[ -n "\${ORCA_PRIME_AGENT_STATUS_EXTENSION:-}" ]]; then
-  __orca_prime_agent_should_skip_extension() {
-    if [[ "\${1:-}" == "--daemon-socket" && ( "\${3:-}" == "stop" || "\${3:-}" == "rename" ) ]]; then
-      return 0
-    fi
-    if [[ "\${1:-}" == --daemon-socket=* && ( "\${2:-}" == "stop" || "\${2:-}" == "rename" ) ]]; then
-      return 0
-    fi
-    case "\${1:-}" in
-      help|--help|-h|--version|-v|--extension|--extension=*) return 0 ;;
-      ${subcommands}) return 0 ;;
-    esac
-    return 1
-  }
-  __orca_prime_agent_has_explicit_extension() {
-    local __orca_arg
-    for __orca_arg in "$@"; do
-      case "$__orca_arg" in
-        --extension|--extension=*) return 0 ;;
-      esac
-    done
-    return 1
-  }
-  __orca_prime_agent() {
-    if [[ "\${1:-}" == "attach" && ( -z "\${2:-}" || "\${2:-}" == -* ) ]]; then
-      command prime-agent "$@"
-      return
-    fi
-    if ! __orca_prime_agent_should_skip_extension "$@" && ! __orca_prime_agent_has_explicit_extension "$@" && [[ -f "\${ORCA_PRIME_AGENT_STATUS_EXTENSION}" ]]; then
-      local __orca_guest_endpoint="${guestEndpointPath}"
-      if [[ -n "\${HOME:-}" && -n "\${ORCA_WSL_HOOK_INSTANCE:-}" ]]; then
-        local ORCA_AGENT_HOOK_ENDPOINT="$__orca_guest_endpoint"
-        export ORCA_AGENT_HOOK_ENDPOINT
-      fi
-      if [[ "\${1:-}" == "attach" && -n "\${2:-}" && "\${2:-}" != -* ]]; then
-        local __orca_attach_agent="$2"
-        shift 2
-        command prime-agent attach "$__orca_attach_agent" --extension "\${ORCA_PRIME_AGENT_STATUS_EXTENSION}" "$@"
-      else
-        command prime-agent --extension "\${ORCA_PRIME_AGENT_STATUS_EXTENSION}" "$@"
-      fi
-    else
-      command prime-agent "$@"
-    fi
-  }
-  prime-agent() { __orca_prime_agent "$@"; }
-fi
-`
-}
diff --git a/src/main/pty/shell-startup-env.test.ts b/src/main/pty/shell-startup-env.test.ts
index 73aabc3b753..eaf8cffeba4 100644
--- a/src/main/pty/shell-startup-env.test.ts
+++ b/src/main/pty/shell-startup-env.test.ts
@@ -1,28 +1,41 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { existsSyncMock, readFileSyncMock } = vi.hoisted(() => ({
+const { existsSyncMock, readFileSyncMock, readdirSyncMock } = vi.hoisted(() => ({
   existsSyncMock: vi.fn(),
-  readFileSyncMock: vi.fn()
+  readFileSyncMock: vi.fn(),
+  readdirSyncMock: vi.fn()
 }))
 
 vi.mock('fs', () => ({
   existsSync: existsSyncMock,
-  readFileSync: readFileSyncMock
+  readFileSync: readFileSyncMock,
+  readdirSync: readdirSyncMock
 }))
 
 import {
   __resetShellStartupEnvCache,
   isShellStartupEnvProbeSupported,
+  readSessionShellStartupEnvVar,
   readShellStartupEnvVar
 } from './shell-startup-env'
 
 describe('readShellStartupEnvVar', () => {
   const originalPlatform = process.platform
   const originalShell = process.env.SHELL
+  // Why pinned: the fish branch defaults configHome to process.env.XDG_CONFIG_HOME, which CI
+  // runners set and dev machines usually do not — leaving it ambient makes these mocked paths
+  // resolve differently per host.
+  const originalXdgConfigHome = process.env.XDG_CONFIG_HOME
 
   beforeEach(() => {
+    delete process.env.XDG_CONFIG_HOME
     existsSyncMock.mockReset()
     readFileSyncMock.mockReset()
+    readdirSyncMock.mockReset()
+    // Why: only the fish branch lists a directory; every other case must see ENOENT.
+    readdirSyncMock.mockImplementation(() => {
+      throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' })
+    })
     Object.defineProperty(process, 'platform', { configurable: true, value: 'darwin' })
     process.env.SHELL = '/bin/zsh'
     __resetShellStartupEnvCache()
@@ -35,6 +48,11 @@ describe('readShellStartupEnvVar', () => {
     } else {
       process.env.SHELL = originalShell
     }
+    if (originalXdgConfigHome === undefined) {
+      delete process.env.XDG_CONFIG_HOME
+    } else {
+      process.env.XDG_CONFIG_HOME = originalXdgConfigHome
+    }
   })
 
   function mockStartupFiles(files: Record<string, string>) {
@@ -326,4 +344,218 @@ describe('readShellStartupEnvVar', () => {
     mockStartupFiles({ '.zshrc': '# export OPENCODE_CONFIG_DIR=/from-comment\n' })
     expect(readShellStartupEnvVar('OPENCODE_CONFIG_DIR', '/home/alice')).toBeUndefined()
   })
+
+  describe('fish', () => {
+    const FISH = '/opt/homebrew/bin/fish'
+
+    function mockFishFiles(files: Record<string, string>, snippets: string[] = []) {
+      readdirSyncMock.mockImplementation((dir: string) => {
+        if (dir === '/home/alice/.config/fish/conf.d' || dir === '/cfg/fish/conf.d') {
+          return snippets
+        }
+        throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' })
+      })
+      mockStartupFiles(files)
+    }
+
+    it('reads an exported set from config.fish', () => {
+      mockFishFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME /home/alice/.codex\n'
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('/home/alice/.codex')
+    })
+
+    it('lets config.fish win over a conf.d snippet, matching fish source order', () => {
+      mockFishFiles(
+        {
+          '/home/alice/.config/fish/conf.d/10-agents.fish': 'set -gx CODEX_HOME /from/confd\n',
+          '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME /from/config\n'
+        },
+        ['10-agents.fish']
+      )
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('/from/config')
+    })
+
+    it('sources conf.d snippets in filename order', () => {
+      mockFishFiles(
+        {
+          '/home/alice/.config/fish/conf.d/aaa.fish': 'set -gx CODEX_HOME /from/aaa\n',
+          '/home/alice/.config/fish/conf.d/zzz.fish': 'set -gx CODEX_HOME /from/zzz\n'
+        },
+        ['zzz.fish', 'aaa.fish', 'notes.txt']
+      )
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('/from/zzz')
+    })
+
+    it('honors XDG_CONFIG_HOME', () => {
+      mockFishFiles({ '/cfg/fish/config.fish': 'set -gx CODEX_HOME /from/xdg\n' })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH, '/cfg')).toBe('/from/xdg')
+    })
+
+    // Why also via the env: the argument defaults to process.env.XDG_CONFIG_HOME, so without
+    // this every other fish case here silently depends on the host not exporting it.
+    it('defaults configHome to XDG_CONFIG_HOME from the environment', () => {
+      process.env.XDG_CONFIG_HOME = '/cfg'
+      __resetShellStartupEnvCache()
+      mockFishFiles({ '/cfg/fish/config.fish': 'set -gx CODEX_HOME /from/env-xdg\n' })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('/from/env-xdg')
+    })
+
+    it('ignores sets that are not exported', () => {
+      mockFishFiles({
+        '/home/alice/.config/fish/config.fish':
+          'set -g CODEX_HOME /global\nset -l CODEX_HOME /local\nset CODEX_HOME /plain\n'
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBeUndefined()
+    })
+
+    it('accepts every fish export spelling', () => {
+      for (const line of [
+        'set -x CODEX_HOME /a',
+        'set -xg CODEX_HOME /a',
+        'set -gx CODEX_HOME /a',
+        'set -Ux CODEX_HOME /a',
+        'set --export --global CODEX_HOME /a'
+      ]) {
+        __resetShellStartupEnvCache()
+        mockFishFiles({ '/home/alice/.config/fish/config.fish': `${line}\n` })
+        expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('/a')
+      }
+    })
+
+    it('expands $HOME in double quotes and keeps single quotes literal', () => {
+      mockFishFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME "$HOME/.codex" # note\n'
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('/home/alice/.codex')
+
+      __resetShellStartupEnvCache()
+      mockFishFiles({
+        '/home/alice/.config/fish/config.fish': "set -gx CODEX_HOME '$HOME/.codex'\n"
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBe('$HOME/.codex')
+    })
+
+    it('does not read zsh or bash startup files for a fish user', () => {
+      mockFishFiles({
+        '/home/alice/.zshrc': 'export CODEX_HOME=/from/zsh\n',
+        '/home/alice/.bash_profile': 'export CODEX_HOME=/from/bash\n'
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBeUndefined()
+    })
+
+    it('ignores a commented assignment', () => {
+      mockFishFiles({
+        '/home/alice/.config/fish/config.fish': '# set -gx CODEX_HOME /from-comment\n'
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBeUndefined()
+    })
+
+    it('does not match a different variable with the same prefix', () => {
+      mockFishFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME_BACKUP /backup\n'
+      })
+      expect(readShellStartupEnvVar('CODEX_HOME', '/home/alice', FISH)).toBeUndefined()
+    })
+  })
+
+  // Why these matter: a caller that plumbs HOME/SHELL but forgets XDG_CONFIG_HOME
+  // reads a different fish config than the shell will, so the same user gets one
+  // answer locally and another over relay.
+  describe('readSessionShellStartupEnvVar', () => {
+    const FISH = '/opt/homebrew/bin/fish'
+    const savedConfigHome = process.env.XDG_CONFIG_HOME
+    const savedHome = process.env.HOME
+
+    afterEach(() => {
+      restoreEnv('XDG_CONFIG_HOME', savedConfigHome)
+      restoreEnv('HOME', savedHome)
+    })
+
+    function restoreEnv(key: string, value: string | undefined) {
+      if (value === undefined) {
+        delete process.env[key]
+      } else {
+        process.env[key] = value
+      }
+    }
+
+    it("prefers the session env's XDG_CONFIG_HOME over the main process's", () => {
+      process.env.XDG_CONFIG_HOME = '/main-process-cfg'
+      mockStartupFiles({
+        '/session-cfg/fish/config.fish': 'set -gx CODEX_HOME /from/session\n',
+        '/main-process-cfg/fish/config.fish': 'set -gx CODEX_HOME /from/main-process\n'
+      })
+
+      expect(
+        readSessionShellStartupEnvVar('CODEX_HOME', {
+          HOME: '/home/alice',
+          SHELL: FISH,
+          XDG_CONFIG_HOME: '/session-cfg'
+        })
+      ).toBe('/from/session')
+    })
+
+    it('falls back to the main process XDG_CONFIG_HOME when the session env lacks one', () => {
+      process.env.XDG_CONFIG_HOME = '/main-process-cfg'
+      mockStartupFiles({
+        '/main-process-cfg/fish/config.fish': 'set -gx CODEX_HOME /from/main-process\n'
+      })
+
+      expect(
+        readSessionShellStartupEnvVar('CODEX_HOME', { HOME: '/home/alice', SHELL: FISH })
+      ).toBe('/from/main-process')
+    })
+
+    it("falls back to fish's own ~/.config default when neither env has one", () => {
+      delete process.env.XDG_CONFIG_HOME
+      mockStartupFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME /from/default\n'
+      })
+
+      expect(
+        readSessionShellStartupEnvVar('CODEX_HOME', { HOME: '/home/alice', SHELL: FISH })
+      ).toBe('/from/default')
+    })
+
+    it('resolves against the session HOME, not the main process HOME', () => {
+      delete process.env.XDG_CONFIG_HOME
+      process.env.HOME = '/home/root-user'
+      mockStartupFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME "$HOME/.codex"\n',
+        '/home/root-user/.config/fish/config.fish': 'set -gx CODEX_HOME /from/wrong-home\n'
+      })
+
+      expect(
+        readSessionShellStartupEnvVar('CODEX_HOME', { HOME: '/home/alice', SHELL: FISH })
+      ).toBe('/home/alice/.codex')
+    })
+
+    it('lets an explicit shell override beat the session SHELL', () => {
+      delete process.env.XDG_CONFIG_HOME
+      mockStartupFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME /from/fish\n',
+        '/home/alice/.zshrc': 'export CODEX_HOME=/from/zsh\n'
+      })
+
+      expect(
+        readSessionShellStartupEnvVar(
+          'CODEX_HOME',
+          { HOME: '/home/alice', SHELL: '/bin/zsh' },
+          FISH
+        )
+      ).toBe('/from/fish')
+    })
+
+    it('falls back to the main process HOME and SHELL with no session env at all', () => {
+      delete process.env.XDG_CONFIG_HOME
+      process.env.HOME = '/home/alice'
+      process.env.SHELL = FISH
+      mockStartupFiles({
+        '/home/alice/.config/fish/config.fish': 'set -gx CODEX_HOME /from/process-env\n'
+      })
+
+      expect(readSessionShellStartupEnvVar('CODEX_HOME', undefined)).toBe('/from/process-env')
+    })
+  })
 })
diff --git a/src/main/pty/shell-startup-env.ts b/src/main/pty/shell-startup-env.ts
index f423ef38f22..ad6392160a9 100644
--- a/src/main/pty/shell-startup-env.ts
+++ b/src/main/pty/shell-startup-env.ts
@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { posix } from 'node:path'
 
 // Why: only files the user's actual shell would source. Mixing zsh and bash
@@ -11,24 +11,45 @@ const ZSH_AFTER_ENV_FILES = ['.zprofile', '.zshrc', '.zlogin']
 // .bash_profile / .bash_login / .profile but intentionally does NOT force
 // .bashrc. Scanning .bashrc would mirror values the live Orca bash never sees.
 const BASH_LOGIN_FILES = ['.bash_profile', '.bash_login', '.profile']
+// Why: fish sources conf.d/*.fish (sorted by name) before config.fish, for
+// login and non-login shells alike — verified against fish 4.7.
+const FISH_SNIPPET_DIR = 'conf.d'
+const FISH_SNIPPET_SUFFIX = '.fish'
+const FISH_CONFIG_FILE = 'config.fish'
+
+/** Assignment grammar of a startup file: `export NAME=value` vs fish `set -gx NAME value`. */
+type StartupFileSyntax = 'export' | 'fish-set'
+
+type ShellStartupFiles = {
+  paths: readonly string[]
+  syntax: StartupFileSyntax
+}
 
 export function isShellStartupEnvProbeSupported(): boolean {
   return process.platform !== 'win32'
 }
 
-function parseExportedValue(content: string, name: string, home: string): string | undefined {
-  const assignment = new RegExp(`^export\\s+${name}=(.+)$`)
+function parseAssignedValue(
+  content: string,
+  name: string,
+  home: string,
+  syntax: StartupFileSyntax
+): string | undefined {
+  const assignment =
+    syntax === 'fish-set'
+      ? new RegExp(`^set\\s+((?:-{1,2}[A-Za-z][\\w-]*\\s+)+)${name}\\s+(.+)$`)
+      : new RegExp(`^export\\s+${name}=()(.+)$`)
   let lastMatch: string | undefined
 
   for (const rawLine of content.split(/\r?\n/)) {
     const line = rawLine.trim()
     const match = assignment.exec(line)
-    if (!match?.[1]) {
+    if (!match?.[2] || (syntax === 'fish-set' && !fishFlagsExport(match[1] ?? ''))) {
       continue
     }
     // Why: strip trailing unquoted `# comment` first so quoted values like
     // `"$HOME/.opencode" # note` survive intact for unquoteShellValue.
-    const decommented = stripTrailingComment(match[1])
+    const decommented = stripTrailingComment(match[2])
     const { text, quoted } = unquoteShellValue(decommented)
     // Why: $HOME / ${HOME} / ~ expansion mimics what the live shell would
     // do for double-quoted and unquoted values; single-quoted is literal.
@@ -41,6 +62,21 @@ function parseExportedValue(content: string, name: string, home: string): string
   return lastMatch
 }
 
+function parseExportedValue(content: string, name: string, home: string): string | undefined {
+  return parseAssignedValue(content, name, home, 'export')
+}
+
+// Why: only `set -x` / `--export` reaches child processes; `set -g`, `set -l`
+// and function-local sets never appear in the PTY's environment.
+function fishFlagsExport(flags: string): boolean {
+  return flags
+    .trim()
+    .split(/\s+/)
+    .some((flag) =>
+      flag.startsWith('--') ? flag === '--export' : /^-[A-Za-z]*x[A-Za-z]*$/.test(flag)
+    )
+}
+
 function readStartupFile(path: string): string | null {
   if (!existsSync(path)) {
     return null
@@ -52,23 +88,55 @@ function readStartupFile(path: string): string | null {
   }
 }
 
-function shellStartupFilePaths(home: string, shell: string | undefined): readonly string[] {
+function shellStartupFiles(
+  home: string,
+  shell: string | undefined,
+  configHome: string | undefined
+): ShellStartupFiles {
   if (!shell) {
     // Why: Orca's POSIX default shell is /bin/zsh when $SHELL is unset.
-    return zshStartupFilePaths(home)
+    return { paths: zshStartupFilePaths(home), syntax: 'export' }
   }
 
   const name = posix.basename(shell).toLowerCase()
   if (name === 'zsh') {
-    return zshStartupFilePaths(home)
+    return { paths: zshStartupFilePaths(home), syntax: 'export' }
   }
   if (name === 'bash') {
-    return BASH_LOGIN_FILES.map((file) => posix.join(home, file))
+    return {
+      paths: BASH_LOGIN_FILES.map((file) => posix.join(home, file)),
+      syntax: 'export'
+    }
   }
-  // Why: unsupported explicit shells (fish, nushell, custom wrappers) do not
-  // use Orca's zsh/bash shell-ready startup files, so scanning those files
+  if (name === 'fish') {
+    return {
+      paths: fishStartupFilePaths(home, configHome),
+      syntax: 'fish-set'
+    }
+  }
+  // Why: unsupported explicit shells (nushell, custom wrappers) do not use
+  // Orca's zsh/bash/fish shell-ready startup files, so scanning those files
   // would mirror values the live PTY shell never sees.
-  return []
+  return { paths: [], syntax: 'export' }
+}
+
+function fishStartupFilePaths(home: string, configHome: string | undefined): readonly string[] {
+  const fishDir = posix.join(configHome?.trim() || posix.join(home, '.config'), 'fish')
+  return [
+    ...fishSnippetPaths(posix.join(fishDir, FISH_SNIPPET_DIR)),
+    posix.join(fishDir, FISH_CONFIG_FILE)
+  ]
+}
+
+function fishSnippetPaths(snippetDir: string): readonly string[] {
+  try {
+    return readdirSync(snippetDir)
+      .filter((entry) => entry.endsWith(FISH_SNIPPET_SUFFIX))
+      .sort()
+      .map((entry) => posix.join(snippetDir, entry))
+  } catch {
+    return []
+  }
 }
 
 function zshStartupFilePaths(home: string): readonly string[] {
@@ -139,21 +207,24 @@ const cache = new Map<string, string | undefined>()
  * Limits (callers should treat the result as a hint, not authoritative):
  * - Conditionals (`[[ ... ]] && export FOO=...`), sourced files, and
  *   `$VAR` substitution beyond `$HOME` / `${HOME}` / `~` are not evaluated.
- * - Bare assignments (no `export` keyword) are ignored because POSIX shells
- *   do not export them to child processes.
+ * - Bare assignments (no `export` keyword, or fish `set` without `-x`) are
+ *   ignored because they never reach child processes.
  * - Files are scanned in shell evaluation order for the user's $SHELL family
- *   only (zsh OR bash, not both); unsupported explicit shells scan nothing.
- *   LAST matching assignment wins.
+ *   only (zsh OR bash OR fish, never mixed); unsupported explicit shells scan
+ *   nothing. LAST matching assignment wins.
+ * - fish universal variables (`set -Ux` stored in fish_variables) are only
+ *   seen when the assignment is also written in a config file.
  * - Windows is unsupported (PowerShell profile parsing is out of scope).
  *
- * Results are memoized per (name, home, shell) for the process lifetime —
- * shell startup files do not change mid-session in any practical scenario,
- * and PTY spawn is on the hot path.
+ * Results are memoized per (name, home, shell, configHome) for the process
+ * lifetime — shell startup files do not change mid-session in any practical
+ * scenario, and PTY spawn is on the hot path.
  */
 export function readShellStartupEnvVar(
   name: string,
   home = process.env.HOME,
-  shell = process.env.SHELL
+  shell = process.env.SHELL,
+  configHome = process.env.XDG_CONFIG_HOME
 ): string | undefined {
   if (!home || !isShellStartupEnvProbeSupported()) {
     return undefined
@@ -164,20 +235,21 @@ export function readShellStartupEnvVar(
     return undefined
   }
 
-  const cacheKey = `${name}\0${home}\0${shell ?? ''}`
+  const cacheKey = `${name}\0${home}\0${shell ?? ''}\0${configHome ?? ''}`
   if (cache.has(cacheKey)) {
     return cache.get(cacheKey)
   }
 
   let lastMatch: string | undefined
 
-  for (const path of shellStartupFilePaths(home, shell)) {
+  const { paths, syntax } = shellStartupFiles(home, shell, configHome)
+  for (const path of paths) {
     const content = readStartupFile(path)
     if (content === null) {
       continue
     }
 
-    const match = parseExportedValue(content, name, home)
+    const match = parseAssignedValue(content, name, home, syntax)
     if (match !== undefined) {
       lastMatch = match
     }
@@ -187,6 +259,34 @@ export function readShellStartupEnvVar(
   return lastMatch
 }
 
+/** The env keys that decide which startup files a shell would actually source. */
+export type ShellStartupEnvSource = {
+  HOME?: string | undefined
+  SHELL?: string | undefined
+  XDG_CONFIG_HOME?: string | undefined
+}
+
+/**
+ * Same probe, resolved against a session/PTY env with process.env as fallback.
+ *
+ * Why this exists rather than three inline `??` chains per call site: dropping
+ * XDG_CONFIG_HOME silently scans a *different* fish config than the shell will,
+ * so local launches and relay launches disagree about the same user's
+ * `set -gx` — a divergence with no visible symptom until it is wrong.
+ */
+export function readSessionShellStartupEnvVar(
+  name: string,
+  sessionEnv: ShellStartupEnvSource | undefined,
+  shellOverride?: string
+): string | undefined {
+  return readShellStartupEnvVar(
+    name,
+    sessionEnv?.HOME ?? process.env.HOME,
+    shellOverride ?? sessionEnv?.SHELL ?? process.env.SHELL,
+    sessionEnv?.XDG_CONFIG_HOME ?? process.env.XDG_CONFIG_HOME
+  )
+}
+
 /**
  * Test-only helper to reset the per-process cache between cases.
  * Why: production callers never invalidate (rc files don't change at
diff --git a/src/main/pty/windows-environment-path-main-loop.test.ts b/src/main/pty/windows-environment-path-main-loop.test.ts
new file mode 100644
index 00000000000..fbe185479cc
--- /dev/null
+++ b/src/main/pty/windows-environment-path-main-loop.test.ts
@@ -0,0 +1,80 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  __resetPersistedWindowsPathCacheForTests,
+  readPersistedWindowsPathSegments
+} from './windows-environment-path'
+import { __setWindowsPathRegistryLoaderForTests } from './windows-path-registry-reader'
+
+const CREATE_PROCESS_DELAY_MS = 160
+const delayedExecFileSync = vi.hoisted(() =>
+  vi.fn(() => {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, CREATE_PROCESS_DELAY_MS)
+    return '    Path    REG_EXPAND_SZ    C:\\Delayed'
+  })
+)
+
+vi.mock('node:child_process', () => ({
+  execFile: vi.fn(),
+  execFileSync: delayedExecFileSync
+}))
+
+describe('persisted Windows PATH process creation', () => {
+  afterEach(() => {
+    __resetPersistedWindowsPathCacheForTests()
+    __setWindowsPathRegistryLoaderForTests()
+    delayedExecFileSync.mockClear()
+  })
+
+  async function measureMainLoopGap<T>(run: () => T): Promise<{
+    callMs: number
+    maxGapMs: number
+    result: T
+  }> {
+    let lastTick = performance.now()
+    let maxGapMs = 0
+    const timer = setInterval(() => {
+      const now = performance.now()
+      maxGapMs = Math.max(maxGapMs, now - lastTick - 5)
+      lastTick = now
+    }, 5)
+    await new Promise((resolve) => setTimeout(resolve, 20))
+
+    const startedAt = performance.now()
+    const result = run()
+    const callMs = performance.now() - startedAt
+    await new Promise((resolve) => setTimeout(resolve, 20))
+    clearInterval(timer)
+    return { callMs, maxGapMs, result }
+  }
+
+  it('proves delayed process creation blocks while native registry reads create no process', async () => {
+    const legacy = await measureMainLoopGap(() =>
+      readPersistedWindowsPathSegments({
+        platform: 'win32',
+        env: { SystemRoot: 'C:\\Windows' },
+        execFileSync: delayedExecFileSync as never
+      })
+    )
+
+    expect(legacy.result).toEqual(['C:\\Delayed', 'C:\\Delayed'])
+    expect(delayedExecFileSync).toHaveBeenCalledTimes(2)
+    expect(legacy.callMs).toBeGreaterThanOrEqual(CREATE_PROCESS_DELAY_MS * 2)
+    expect(legacy.maxGapMs).toBeGreaterThanOrEqual(CREATE_PROCESS_DELAY_MS)
+
+    __resetPersistedWindowsPathCacheForTests()
+    delayedExecFileSync.mockClear()
+    __setWindowsPathRegistryLoaderForTests(() => ({
+      HK: { LM: 1, CU: 2 },
+      getRegistryKey: (root) => ({
+        Path: { type: 1, value: root === 1 ? 'C:\\Machine' : 'C:\\User' }
+      })
+    }))
+    const native = readPersistedWindowsPathSegments({
+      platform: 'win32',
+      env: { SystemRoot: 'C:\\Windows' }
+    })
+
+    expect(native).toEqual(['C:\\Machine', 'C:\\User'])
+    expect(delayedExecFileSync).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/pty/windows-environment-path.test.ts b/src/main/pty/windows-environment-path.test.ts
index d639ee604ce..4aaa7f91bdd 100644
--- a/src/main/pty/windows-environment-path.test.ts
+++ b/src/main/pty/windows-environment-path.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { defaultExecFileMock, defaultExecFileSyncMock } = vi.hoisted(() => ({
   defaultExecFileMock: vi.fn(),
@@ -12,14 +12,33 @@ vi.mock('node:child_process', () => ({
 
 import {
   __resetPersistedWindowsPathCacheForTests,
+  invalidatePersistedWindowsPathCache,
   mergePersistedWindowsPath,
   mergePersistedWindowsPathAsync,
   readPersistedWindowsPathSegments,
   readPersistedWindowsPathSegmentsAsync,
   resolvePathEnvKey
 } from './windows-environment-path'
+import { __setWindowsPathRegistryLoaderForTests } from './windows-path-registry-reader'
 
-type ExecCallback = (error: Error | null, stdout: string, stderr: string) => void
+const registryGetKeyMock = vi.fn()
+
+function registryPath(value: string): Record<string, unknown> {
+  return { Path: { type: 1, value } }
+}
+
+beforeEach(() => {
+  registryGetKeyMock.mockReset()
+  __setWindowsPathRegistryLoaderForTests(() => ({
+    HK: { LM: 1, CU: 2 },
+    getRegistryKey: registryGetKeyMock
+  }))
+})
+
+afterEach(() => {
+  __resetPersistedWindowsPathCacheForTests()
+  __setWindowsPathRegistryLoaderForTests()
+})
 
 describe('readPersistedWindowsPathSegments', () => {
   it('reads machine and user Path values from the Windows registry', () => {
@@ -67,18 +86,17 @@ describe('readPersistedWindowsPathSegments', () => {
   it('caches production registry reads briefly', () => {
     const originalPlatform = process.platform
     Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
-    defaultExecFileSyncMock
-      .mockReturnValueOnce('    Path    REG_SZ    C:\\Machine\r\n')
-      .mockReturnValueOnce('    Path    REG_SZ    C:\\User\r\n')
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\Machine'))
+      .mockReturnValueOnce(registryPath('C:\\User'))
     __resetPersistedWindowsPathCacheForTests()
 
     try {
       expect(readPersistedWindowsPathSegments()).toEqual(['C:\\Machine', 'C:\\User'])
       expect(readPersistedWindowsPathSegments()).toEqual(['C:\\Machine', 'C:\\User'])
-      expect(defaultExecFileSyncMock).toHaveBeenCalledTimes(2)
+      expect(registryGetKeyMock).toHaveBeenCalledTimes(2)
     } finally {
       __resetPersistedWindowsPathCacheForTests()
-      defaultExecFileSyncMock.mockReset()
       Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
     }
   })
@@ -86,27 +104,185 @@ describe('readPersistedWindowsPathSegments', () => {
   it('force-refreshes the production registry cache', () => {
     const originalPlatform = process.platform
     Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
-    defaultExecFileSyncMock
-      .mockReturnValueOnce('    Path    REG_SZ    C:\\Machine\r\n')
-      .mockReturnValueOnce('    Path    REG_SZ    C:\\User\r\n')
-      .mockReturnValueOnce('    Path    REG_SZ    C:\\Machine\r\n')
-      .mockReturnValueOnce('    Path    REG_SZ    C:\\User;C:\\Program Files\\GitHub CLI\r\n')
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\Machine'))
+      .mockReturnValueOnce(registryPath('C:\\User'))
+      .mockReturnValueOnce(registryPath('C:\\Machine'))
+      .mockReturnValueOnce(registryPath('C:\\User;C:\\Program Files\\GitHub CLI'))
     __resetPersistedWindowsPathCacheForTests()
 
     try {
       expect(readPersistedWindowsPathSegments()).toEqual(['C:\\Machine', 'C:\\User'])
       expect(readPersistedWindowsPathSegments()).toEqual(['C:\\Machine', 'C:\\User'])
-      expect(defaultExecFileSyncMock).toHaveBeenCalledTimes(2)
+      expect(registryGetKeyMock).toHaveBeenCalledTimes(2)
 
       expect(readPersistedWindowsPathSegments({ forceRefresh: true })).toEqual([
         'C:\\Machine',
         'C:\\User',
         'C:\\Program Files\\GitHub CLI'
       ])
-      expect(defaultExecFileSyncMock).toHaveBeenCalledTimes(4)
+      expect(registryGetKeyMock).toHaveBeenCalledTimes(4)
+    } finally {
+      __resetPersistedWindowsPathCacheForTests()
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+    }
+  })
+
+  it('invalidates the cache after Windows reports an environment change', () => {
+    const originalPlatform = process.platform
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\OldMachine'))
+      .mockReturnValueOnce(registryPath('C:\\OldUser'))
+      .mockReturnValueOnce(registryPath('C:\\NewMachine'))
+      .mockReturnValueOnce(registryPath('C:\\NewUser'))
+    __resetPersistedWindowsPathCacheForTests()
+
+    try {
+      expect(readPersistedWindowsPathSegments()).toEqual(['C:\\OldMachine', 'C:\\OldUser'])
+      expect(readPersistedWindowsPathSegments()).toEqual(['C:\\OldMachine', 'C:\\OldUser'])
+
+      invalidatePersistedWindowsPathCache()
+
+      expect(readPersistedWindowsPathSegments()).toEqual(['C:\\NewMachine', 'C:\\NewUser'])
+      expect(registryGetKeyMock).toHaveBeenCalledTimes(4)
+    } finally {
+      __resetPersistedWindowsPathCacheForTests()
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+    }
+  })
+
+  it('combines a fresh hive with the other hive last known good after invalidation', () => {
+    const originalPlatform = process.platform
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\OldMachine'))
+      .mockReturnValueOnce(registryPath('C:\\OldUser'))
+      .mockReturnValueOnce(registryPath('C:\\NewMachine'))
+      .mockImplementationOnce(() => {
+        throw new Error('user registry unavailable')
+      })
+    __resetPersistedWindowsPathCacheForTests()
+
+    try {
+      expect(readPersistedWindowsPathSegments()).toEqual(['C:\\OldMachine', 'C:\\OldUser'])
+      invalidatePersistedWindowsPathCache()
+
+      expect(readPersistedWindowsPathSegments()).toEqual(['C:\\NewMachine', 'C:\\OldUser'])
+      expect(registryGetKeyMock).toHaveBeenCalledTimes(4)
+    } finally {
+      __resetPersistedWindowsPathCacheForTests()
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+    }
+  })
+
+  it('combines a fresh user hive with the machine hive last known good', () => {
+    const originalPlatform = process.platform
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\OldMachine'))
+      .mockReturnValueOnce(registryPath('C:\\OldUser'))
+      .mockImplementationOnce(() => {
+        throw new Error('machine registry unavailable')
+      })
+      .mockReturnValueOnce(registryPath('C:\\NewUser'))
+    __resetPersistedWindowsPathCacheForTests()
+
+    try {
+      expect(readPersistedWindowsPathSegments()).toEqual(['C:\\OldMachine', 'C:\\OldUser'])
+      invalidatePersistedWindowsPathCache()
+
+      expect(readPersistedWindowsPathSegments()).toEqual(['C:\\OldMachine', 'C:\\NewUser'])
+    } finally {
+      __resetPersistedWindowsPathCacheForTests()
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+    }
+  })
+
+  it('withholds a partial first registry snapshot instead of changing PATH precedence', () => {
+    const originalPlatform = process.platform
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\Machine'))
+      .mockImplementationOnce(() => {
+        throw new Error('user registry unavailable')
+      })
+    __resetPersistedWindowsPathCacheForTests()
+
+    try {
+      const env = { Path: 'C:\\UserAlias;C:\\Existing' }
+
+      mergePersistedWindowsPath(env)
+
+      expect(env.Path).toBe('C:\\UserAlias;C:\\Existing')
+      expect(readPersistedWindowsPathSegments()).toEqual([])
+      expect(registryGetKeyMock).toHaveBeenCalledTimes(2)
+    } finally {
+      __resetPersistedWindowsPathCacheForTests()
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+    }
+  })
+
+  it('withholds the reverse partial first snapshot', () => {
+    const originalPlatform = process.platform
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    registryGetKeyMock
+      .mockImplementationOnce(() => {
+        throw new Error('machine registry unavailable')
+      })
+      .mockReturnValueOnce(registryPath('C:\\User'))
+    __resetPersistedWindowsPathCacheForTests()
+
+    try {
+      expect(readPersistedWindowsPathSegments()).toEqual([])
+    } finally {
+      __resetPersistedWindowsPathCacheForTests()
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+    }
+  })
+
+  it('does not duplicate an unresolved asynchronous refresh for a synchronous caller', async () => {
+    const originalPlatform = process.platform
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\Machine'))
+      .mockImplementationOnce(() => {
+        throw new Error('user registry unavailable')
+      })
+    __resetPersistedWindowsPathCacheForTests()
+
+    try {
+      const refresh = readPersistedWindowsPathSegmentsAsync()
+
+      expect(readPersistedWindowsPathSegments()).toEqual([])
+      await expect(refresh).resolves.toEqual([])
+      expect(registryGetKeyMock).toHaveBeenCalledTimes(2)
+    } finally {
+      __resetPersistedWindowsPathCacheForTests()
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+    }
+  })
+
+  it('does not let injected test reads populate production fallback state', () => {
+    const originalPlatform = process.platform
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    const execFileSync = vi
+      .fn()
+      .mockReturnValueOnce('    Path    REG_SZ    C:\\InjectedMachine\r\n')
+      .mockReturnValueOnce('    Path    REG_SZ    C:\\InjectedUser\r\n')
+    registryGetKeyMock.mockImplementation(() => {
+      throw new Error('registry unavailable')
+    })
+    __resetPersistedWindowsPathCacheForTests()
+
+    try {
+      expect(readPersistedWindowsPathSegments({ platform: 'win32', execFileSync })).toEqual([
+        'C:\\InjectedMachine',
+        'C:\\InjectedUser'
+      ])
+      expect(readPersistedWindowsPathSegments()).toEqual([])
     } finally {
       __resetPersistedWindowsPathCacheForTests()
-      defaultExecFileSyncMock.mockReset()
       Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
     }
   })
@@ -114,9 +290,9 @@ describe('readPersistedWindowsPathSegments', () => {
   it('keeps the last good segments when a forced read hits a blocked registry', () => {
     const originalPlatform = process.platform
     Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
-    defaultExecFileSyncMock
-      .mockReturnValueOnce('    Path    REG_SZ    C:\\Machine\r\n')
-      .mockReturnValueOnce('    Path    REG_SZ    C:\\User\r\n')
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\Machine'))
+      .mockReturnValueOnce(registryPath('C:\\User'))
       .mockImplementation(() => {
         throw new Error('ERROR: Access is denied.')
       })
@@ -131,7 +307,6 @@ describe('readPersistedWindowsPathSegments', () => {
       expect(readPersistedWindowsPathSegments()).toEqual(['C:\\Machine', 'C:\\User'])
     } finally {
       __resetPersistedWindowsPathCacheForTests()
-      defaultExecFileSyncMock.mockReset()
       Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
     }
   })
@@ -139,10 +314,10 @@ describe('readPersistedWindowsPathSegments', () => {
   it('still clears the cache when the registry reports an empty Path', () => {
     const originalPlatform = process.platform
     Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
-    defaultExecFileSyncMock
-      .mockReturnValueOnce('    Path    REG_SZ    C:\\Machine\r\n')
-      .mockReturnValueOnce('    Path    REG_SZ    C:\\User\r\n')
-      .mockReturnValue('    Path    REG_SZ    \r\n')
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\Machine'))
+      .mockReturnValueOnce(registryPath('C:\\User'))
+      .mockReturnValue(registryPath(''))
     __resetPersistedWindowsPathCacheForTests()
 
     try {
@@ -154,7 +329,33 @@ describe('readPersistedWindowsPathSegments', () => {
       expect(readPersistedWindowsPathSegments()).toEqual([])
     } finally {
       __resetPersistedWindowsPathCacheForTests()
-      defaultExecFileSyncMock.mockReset()
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+    }
+  })
+
+  it('does not resurrect a successfully emptied hive when the other hive fails', () => {
+    const originalPlatform = process.platform
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\Machine'))
+      .mockReturnValueOnce(registryPath('C:\\User'))
+      .mockImplementationOnce(() => {
+        throw new Error('machine registry unavailable')
+      })
+      .mockReturnValueOnce(registryPath(''))
+      .mockImplementation(() => {
+        throw new Error('registry unavailable')
+      })
+    __resetPersistedWindowsPathCacheForTests()
+
+    try {
+      expect(readPersistedWindowsPathSegments()).toEqual(['C:\\Machine', 'C:\\User'])
+      invalidatePersistedWindowsPathCache()
+      expect(readPersistedWindowsPathSegments()).toEqual(['C:\\Machine'])
+      invalidatePersistedWindowsPathCache()
+      expect(readPersistedWindowsPathSegments()).toEqual(['C:\\Machine'])
+    } finally {
+      __resetPersistedWindowsPathCacheForTests()
       Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
     }
   })
@@ -162,13 +363,9 @@ describe('readPersistedWindowsPathSegments', () => {
   it('deduplicates concurrent forced asynchronous refreshes and merges each environment', async () => {
     const originalPlatform = process.platform
     Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
-    const callbacks: ExecCallback[] = []
-    defaultExecFileMock.mockImplementation(
-      (_file: string, _args: string[], _options: unknown, callback: ExecCallback) => {
-        callbacks.push(callback)
-        return {} as never
-      }
-    )
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\Machine'))
+      .mockReturnValueOnce(registryPath('C:\\User'))
     __resetPersistedWindowsPathCacheForTests()
 
     try {
@@ -177,41 +374,25 @@ describe('readPersistedWindowsPathSegments', () => {
       const first = mergePersistedWindowsPathAsync(firstEnv, { forceRefresh: true })
       const second = mergePersistedWindowsPathAsync(secondEnv, { forceRefresh: true })
 
-      expect(defaultExecFileMock).toHaveBeenCalledTimes(2)
-      callbacks[0]?.(null, '    Path    REG_SZ    C:\\Machine\r\n', '')
-      callbacks[1]?.(null, '    Path    REG_SZ    C:\\User\r\n', '')
       await Promise.all([first, second])
       expect(firstEnv.Path).toBe('C:\\First;C:\\Machine;C:\\User')
       expect(secondEnv.Path).toBe('C:\\Second;C:\\Machine;C:\\User')
+      expect(registryGetKeyMock).toHaveBeenCalledTimes(2)
     } finally {
       __resetPersistedWindowsPathCacheForTests()
-      defaultExecFileMock.mockReset()
       Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
     }
   })
 
-  it('keeps the last good cache when bounded asynchronous reads time out', async () => {
+  it('keeps the last good cache when native registry reads fail', async () => {
     const originalPlatform = process.platform
     Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
-    defaultExecFileMock
-      .mockImplementationOnce(
-        (_file: string, _args: string[], _options: unknown, callback: ExecCallback) => {
-          callback(null, '    Path    REG_SZ    C:\\Machine\r\n', '')
-          return {} as never
-        }
-      )
-      .mockImplementationOnce(
-        (_file: string, _args: string[], _options: unknown, callback: ExecCallback) => {
-          callback(null, '    Path    REG_SZ    C:\\User\r\n', '')
-          return {} as never
-        }
-      )
-      .mockImplementation(
-        (_file: string, _args: string[], _options: unknown, callback: ExecCallback) => {
-          callback(Object.assign(new Error('timed out'), { code: 'ETIMEDOUT' }), '', '')
-          return {} as never
-        }
-      )
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\Machine'))
+      .mockReturnValueOnce(registryPath('C:\\User'))
+      .mockImplementation(() => {
+        throw new Error('registry unavailable')
+      })
     __resetPersistedWindowsPathCacheForTests()
 
     try {
@@ -223,7 +404,7 @@ describe('readPersistedWindowsPathSegments', () => {
         'C:\\Machine',
         'C:\\User'
       ])
-      expect(defaultExecFileMock).toHaveBeenCalledTimes(2)
+      expect(registryGetKeyMock).toHaveBeenCalledTimes(2)
       await expect(readPersistedWindowsPathSegmentsAsync({ forceRefresh: true })).resolves.toEqual([
         'C:\\Machine',
         'C:\\User'
@@ -232,11 +413,74 @@ describe('readPersistedWindowsPathSegments', () => {
         'C:\\Machine',
         'C:\\User'
       ])
-      expect(defaultExecFileMock).toHaveBeenCalledTimes(4)
-      expect(defaultExecFileMock.mock.calls[2]?.[2]).toMatchObject({ timeout: 5_000 })
+      expect(registryGetKeyMock).toHaveBeenCalledTimes(4)
+    } finally {
+      __resetPersistedWindowsPathCacheForTests()
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+    }
+  })
+
+  it('does not let an older async read replace a newer synchronous refresh', async () => {
+    const originalPlatform = process.platform
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\OldMachine'))
+      .mockReturnValueOnce(registryPath('C:\\OldUser'))
+      .mockReturnValueOnce(registryPath('C:\\NewMachine'))
+      .mockReturnValueOnce(registryPath('C:\\NewUser'))
+    __resetPersistedWindowsPathCacheForTests()
+
+    try {
+      const olderRead = readPersistedWindowsPathSegmentsAsync({ forceRefresh: true })
+      expect(readPersistedWindowsPathSegments({ forceRefresh: true })).toEqual([
+        'C:\\NewMachine',
+        'C:\\NewUser'
+      ])
+
+      await expect(olderRead).resolves.toEqual(['C:\\NewMachine', 'C:\\NewUser'])
+      await expect(readPersistedWindowsPathSegmentsAsync()).resolves.toEqual([
+        'C:\\NewMachine',
+        'C:\\NewUser'
+      ])
+    } finally {
+      __resetPersistedWindowsPathCacheForTests()
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+    }
+  })
+
+  it('uses a current-generation refresh before merging an invalidated read', async () => {
+    const originalPlatform = process.platform
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    registryGetKeyMock
+      .mockReturnValueOnce(registryPath('C:\\OldMachine'))
+      .mockImplementationOnce(() => {
+        queueMicrotask(invalidatePersistedWindowsPathCache)
+        return registryPath('C:\\OldUser')
+      })
+      .mockReturnValueOnce(registryPath('C:\\NewMachine'))
+      .mockReturnValueOnce(registryPath('C:\\NewUser'))
+      .mockImplementation(() => {
+        throw new Error('registry unavailable')
+      })
+    __resetPersistedWindowsPathCacheForTests()
+
+    try {
+      const env = { Path: 'C:\\Injected' }
+      await mergePersistedWindowsPathAsync(env)
+
+      expect(env.Path).toBe('C:\\Injected;C:\\NewMachine;C:\\NewUser')
+      await expect(readPersistedWindowsPathSegmentsAsync()).resolves.toEqual([
+        'C:\\NewMachine',
+        'C:\\NewUser'
+      ])
+      invalidatePersistedWindowsPathCache()
+      await expect(readPersistedWindowsPathSegmentsAsync()).resolves.toEqual([
+        'C:\\NewMachine',
+        'C:\\NewUser'
+      ])
+      expect(registryGetKeyMock).toHaveBeenCalledTimes(6)
     } finally {
       __resetPersistedWindowsPathCacheForTests()
-      defaultExecFileMock.mockReset()
       Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
     }
   })
@@ -255,7 +499,7 @@ describe('mergePersistedWindowsPath', () => {
     expect(env.Path).toBe('C:\\Users\\orca\\AppData\\Local\\agy\\bin;C:\\Windows')
   })
 
-  it('appends missing persisted segments without reordering the inherited PATH', () => {
+  it('adopts persisted machine and user PATH ordering', () => {
     const execFileSync = vi
       .fn()
       .mockReturnValueOnce(
@@ -279,7 +523,7 @@ describe('mergePersistedWindowsPath', () => {
     mergePersistedWindowsPath(env, { platform: 'win32', execFileSync })
 
     expect(env.Path).toBe(
-      'C:\\Existing;C:\\Windows\\System32;C:\\Users\\me\\AppData\\Local\\Orca\\bin'
+      'C:\\Windows\\System32;C:\\Existing;C:\\Users\\me\\AppData\\Local\\Orca\\bin'
     )
   })
 
@@ -326,6 +570,73 @@ describe('mergePersistedWindowsPath', () => {
 
     expect(env).toEqual({ Path: 'C:\\Root\\Live;C:\\Machine;C:\\User' })
   })
+
+  it('stops an inherited WindowsApps alias from shadowing a newly installed Python', () => {
+    const python = 'C:\\Users\\me\\AppData\\Local\\Programs\\Python\\Python314\\'
+    const scripts = `${python}Scripts\\`
+    const windowsApps = 'C:\\Users\\me\\AppData\\Local\\Microsoft\\WindowsApps'
+    const execFileSync = vi
+      .fn()
+      .mockReturnValueOnce('    Path    REG_EXPAND_SZ    C:\\Windows\\system32;C:\\Windows\r\n')
+      .mockReturnValueOnce(`    Path    REG_EXPAND_SZ    ${python};${scripts};${windowsApps}\r\n`)
+    const env = { Path: `C:\\Windows\\system32;C:\\Windows;${windowsApps}` }
+
+    mergePersistedWindowsPath(env, { platform: 'win32', execFileSync })
+
+    const segments = env.Path.split(';')
+    expect(segments.indexOf(python)).toBeLessThan(segments.indexOf(windowsApps))
+    expect(env.Path).toBe(`C:\\Windows\\system32;C:\\Windows;${python};${scripts};${windowsApps}`)
+  })
+
+  it('keeps injected entries ahead of the persisted PATH', () => {
+    const injected = 'C:\\Users\\me\\AppData\\Local\\Orca\\resources\\bin'
+    const python = 'C:\\Users\\me\\AppData\\Local\\Programs\\Python\\Python314\\'
+    const windowsApps = 'C:\\Users\\me\\AppData\\Local\\Microsoft\\WindowsApps'
+    const execFileSync = vi
+      .fn()
+      .mockReturnValueOnce('    Path    REG_EXPAND_SZ    C:\\Windows\\system32\r\n')
+      .mockReturnValueOnce(`    Path    REG_EXPAND_SZ    ${python};${windowsApps}\r\n`)
+    const env = { Path: `${injected};C:\\Windows\\system32;${windowsApps}` }
+
+    mergePersistedWindowsPath(env, { platform: 'win32', execFileSync })
+
+    expect(env.Path).toBe(`${injected};C:\\Windows\\system32;${python};${windowsApps}`)
+  })
+
+  it('leaves the inherited PATH untouched when both registry reads are blocked', () => {
+    const execFileSync = vi.fn().mockImplementation(() => {
+      throw new Error('ERROR: Access is denied.')
+    })
+    const env = { Path: 'C:\\Windows\\system32;C:\\Existing' }
+
+    mergePersistedWindowsPath(env, { platform: 'win32', execFileSync })
+
+    expect(env.Path).toBe('C:\\Windows\\system32;C:\\Existing')
+  })
+
+  it('deduplicates segments that differ only by trailing separators', () => {
+    const execFileSync = vi
+      .fn()
+      .mockReturnValueOnce('    Path    REG_SZ    C:\\Tools\r\n')
+      .mockReturnValueOnce('    Path    REG_SZ    \r\n')
+    const env = { Path: 'C:\\Tools\\' }
+
+    mergePersistedWindowsPath(env, { platform: 'win32', execFileSync })
+
+    expect(env.Path.split(';')).toEqual(['C:\\Tools'])
+  })
+
+  it('canonicalizes drive-root slash style and repetition for comparison', () => {
+    const execFileSync = vi
+      .fn()
+      .mockReturnValueOnce('    Path    REG_SZ    C:\\\\\r\n')
+      .mockReturnValueOnce('    Path    REG_SZ    \r\n')
+    const env = { Path: 'C:/' }
+
+    mergePersistedWindowsPath(env, { platform: 'win32', execFileSync })
+
+    expect(env.Path.split(';')).toEqual(['C:\\\\'])
+  })
 })
 
 describe('resolvePathEnvKey', () => {
diff --git a/src/main/pty/windows-environment-path.ts b/src/main/pty/windows-environment-path.ts
index 36032da9aec..554e8768612 100644
--- a/src/main/pty/windows-environment-path.ts
+++ b/src/main/pty/windows-environment-path.ts
@@ -1,9 +1,14 @@
-import { execFile, execFileSync } from 'node:child_process'
-import {
-  expandWindowsEnvironmentVariables,
-  expandWindowsPathEnvironmentVariables
-} from '../../shared/windows-environment-expansion'
+import type { execFile, execFileSync } from 'node:child_process'
+import { expandWindowsEnvironmentVariables } from '../../shared/windows-environment-expansion'
 import { getRegExePath } from '../win32-utils'
+import { mergeWindowsPathSegments } from './windows-path-segment-merge'
+import {
+  WindowsPathRegistryFallback,
+  type RegistryPathRead
+} from './windows-path-registry-fallback'
+import { readWindowsPathRegistry } from './windows-path-registry-reader'
+
+export { resolvePathEnvKey } from './windows-path-segment-merge'
 
 type ExecFile = typeof execFile
 type ExecFileSync = typeof execFileSync
@@ -16,11 +21,6 @@ type ReadWindowsPathOptions = {
   platform?: NodeJS.Platform
 }
 
-type RegistryPathRead = {
-  failed: boolean
-  segments: string[]
-}
-
 const WINDOWS_PATH_REGISTRY_KEYS = [
   ['HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment', 'Path'],
   ['HKCU\\Environment', 'Path']
@@ -28,6 +28,9 @@ const WINDOWS_PATH_REGISTRY_KEYS = [
 
 const PERSISTED_WINDOWS_PATH_CACHE_TTL_MS = 30_000
 const PERSISTED_WINDOWS_PATH_QUERY_TIMEOUT_MS = 5_000
+const windowsPathRegistryFallback = new WindowsPathRegistryFallback(
+  WINDOWS_PATH_REGISTRY_KEYS.length
+)
 
 let persistedWindowsPathCache:
   | {
@@ -36,6 +39,9 @@ let persistedWindowsPathCache:
     }
   | undefined
 let pendingPersistedWindowsPathRefresh: Promise<string[]> | undefined
+let persistedWindowsPathCacheGeneration = 0
+let persistedWindowsPathReadSequence = 0
+let persistedWindowsPathCommittedSequence = 0
 
 function parseRegistryPathValue(output: string, valueName: string): string | null {
   const valuePattern = new RegExp(`^\\s*${valueName}\\s+REG_\\w+\\s+(.*)$`, 'i')
@@ -71,19 +77,33 @@ function registryOutputSegments(
     : []
 }
 
-function keepLastGoodSegments(segments: string[], failedReads: number): string[] {
-  if (failedReads === WINDOWS_PATH_REGISTRY_KEYS.length && persistedWindowsPathCache) {
-    return [...persistedWindowsPathCache.segments]
-  }
-  return segments
+function readNativeRegistryPaths(
+  env: NodeJS.ProcessEnv,
+  pathDelimiter: string
+): RegistryPathRead[] {
+  return readWindowsPathRegistry().map((read) => ({
+    failed: read.failed,
+    segments:
+      read.value === null
+        ? []
+        : splitPathSegments(expandWindowsEnvironmentVariables(read.value, env), pathDelimiter)
+  }))
 }
 
-function cachePersistedWindowsPathSegments(segments: string[], failedReads: number): string[] {
-  // Why: timeouts or policy blocks must not replace a usable cache, while successful empty
-  // registry values still need to remove stale entries.
-  const kept = keepLastGoodSegments(segments, failedReads)
-  persistedWindowsPathCache = { readAt: Date.now(), segments: [...kept] }
-  return [...kept]
+function cachePersistedWindowsPathReads(reads: RegistryPathRead[], readSequence: number): string[] {
+  if (readSequence < persistedWindowsPathCommittedSequence) {
+    // Why: a slower async read must not replace a newer synchronous refresh.
+    return persistedWindowsPathCache ? [...persistedWindowsPathCache.segments] : []
+  }
+  persistedWindowsPathCommittedSequence = readSequence
+  const segments = windowsPathRegistryFallback.commitReads(reads)
+  if (!segments) {
+    // Why: unresolved hives preserve ordering, but still need negative caching on the PTY hot path.
+    persistedWindowsPathCache = { readAt: Date.now(), segments: [] }
+    return []
+  }
+  persistedWindowsPathCache = { readAt: Date.now(), segments: [...segments] }
+  return [...segments]
 }
 
 function readRegistryPathAsync(
@@ -134,46 +154,45 @@ export function readPersistedWindowsPathSegments(options: ReadWindowsPathOptions
     return [...persistedWindowsPathCache.segments]
   }
 
-  if (
-    !options.forceRefresh &&
-    useProductionCache &&
-    pendingPersistedWindowsPathRefresh &&
-    persistedWindowsPathCache
-  ) {
+  if (!options.forceRefresh && useProductionCache && pendingPersistedWindowsPathRefresh) {
     // Why: synchronous PTY construction cannot await the active refresh; its stale cache is
     // safer than duplicating the registry read on Electron's main thread.
-    return [...persistedWindowsPathCache.segments]
+    return persistedWindowsPathCache ? [...persistedWindowsPathCache.segments] : []
   }
 
-  const run = options.execFileSync ?? execFileSync
   const env = options.env ?? process.env
   const pathDelimiter = getPathDelimiter(platform)
-  const segments: string[] = []
-  let failedReads = 0
-
-  for (const [key, valueName] of WINDOWS_PATH_REGISTRY_KEYS) {
-    try {
-      const output = run(getRegExePath(env), ['query', key, '/v', valueName], {
-        encoding: 'utf8',
-        timeout: PERSISTED_WINDOWS_PATH_QUERY_TIMEOUT_MS,
-        windowsHide: true
+  const readSequence = useProductionCache ? ++persistedWindowsPathReadSequence : 0
+  const reads = options.execFileSync
+    ? WINDOWS_PATH_REGISTRY_KEYS.map(([key, valueName]) => {
+        try {
+          const output = options.execFileSync!(
+            getRegExePath(env),
+            ['query', key, '/v', valueName],
+            {
+              encoding: 'utf8',
+              timeout: PERSISTED_WINDOWS_PATH_QUERY_TIMEOUT_MS,
+              windowsHide: true
+            }
+          )
+          return {
+            failed: false,
+            segments: registryOutputSegments(output, valueName, env, pathDelimiter)
+          }
+        } catch {
+          return { failed: true, segments: [] }
+        }
       })
-      segments.push(...registryOutputSegments(output, valueName, env, pathDelimiter))
-    } catch {
-      // Registry access can fail in stripped test containers or remote-like
-      // Windows contexts. Existing PATH remains the fallback in those cases.
-      failedReads += 1
-    }
-  }
-
+    : readNativeRegistryPaths(env, pathDelimiter)
+  const segments = reads.flatMap((read) => read.segments)
   if (!useProductionCache) {
     return segments
   }
 
-  // Why: local PTY spawn is a hot path on Windows, and each uncached read
-  // runs two synchronous `reg.exe query` subprocesses. A short TTL keeps
-  // terminal bursts cheap while still picking up newly installed CLIs soon.
-  return cachePersistedWindowsPathSegments(segments, failedReads)
+  // Why: local PTY spawn is a hot path on Windows, and each uncached refresh performs two
+  // synchronous native registry reads. A short TTL keeps terminal bursts cheap while still
+  // picking up newly installed CLIs soon.
+  return cachePersistedWindowsPathReads(reads, readSequence)
 }
 
 export async function readPersistedWindowsPathSegmentsAsync(
@@ -202,20 +221,34 @@ export async function readPersistedWindowsPathSegmentsAsync(
     return [...(await pendingPersistedWindowsPathRefresh)]
   }
 
-  const run = options.execFile ?? execFile
   const env = options.env ?? process.env
   const pathDelimiter = getPathDelimiter(platform)
-  const executable = getRegExePath(env)
-  const refresh = Promise.all(
-    WINDOWS_PATH_REGISTRY_KEYS.map((registryValue) =>
-      readRegistryPathAsync(run, executable, registryValue, env, pathDelimiter)
-    )
+  const cacheGeneration = persistedWindowsPathCacheGeneration
+  const readSequence = useProductionCache ? ++persistedWindowsPathReadSequence : 0
+  const refresh = (
+    options.execFile
+      ? Promise.all(
+          WINDOWS_PATH_REGISTRY_KEYS.map((registryValue) =>
+            readRegistryPathAsync(
+              options.execFile!,
+              getRegExePath(env),
+              registryValue,
+              env,
+              pathDelimiter
+            )
+          )
+        )
+      : Promise.resolve(readNativeRegistryPaths(env, pathDelimiter))
   ).then((reads) => {
     const segments = reads.flatMap((read) => read.segments)
     if (!useProductionCache) {
       return segments
     }
-    return cachePersistedWindowsPathSegments(segments, reads.filter((read) => read.failed).length)
+    if (cacheGeneration !== persistedWindowsPathCacheGeneration) {
+      // Why: callers must not merge or inspect a snapshot invalidated while its queries ran.
+      return readPersistedWindowsPathSegmentsAsync()
+    }
+    return cachePersistedWindowsPathReads(reads, readSequence)
   })
 
   if (!useProductionCache) {
@@ -232,63 +265,18 @@ export async function readPersistedWindowsPathSegmentsAsync(
 }
 
 export function __resetPersistedWindowsPathCacheForTests(): void {
+  invalidatePersistedWindowsPathCache()
+  windowsPathRegistryFallback.reset()
+  persistedWindowsPathReadSequence = 0
+  persistedWindowsPathCommittedSequence = 0
+}
+
+export function invalidatePersistedWindowsPathCache(): void {
+  persistedWindowsPathCacheGeneration += 1
   persistedWindowsPathCache = undefined
   pendingPersistedWindowsPathRefresh = undefined
 }
 
-/** Resolves the first PATH key a Windows child reads from an env block. */
-export function resolvePathEnvKey(
-  env: NodeJS.ProcessEnv | Record<string, string | undefined>,
-  platform: NodeJS.Platform,
-  hostEnv: NodeJS.ProcessEnv = process.env
-): string {
-  if (platform !== 'win32') {
-    return 'PATH'
-  }
-  // Why: the daemon receives a sparse env patch and re-merges its own block underneath it;
-  // matching the block's spelling stops that merge from resurrecting the other one.
-  return firstWindowsPathEnvKey(env) ?? firstWindowsPathEnvKey(hostEnv) ?? 'Path'
-}
-
-// Why: Win32 resolves the first case-insensitive key, and object order preserves block order.
-function firstWindowsPathEnvKey(
-  env: NodeJS.ProcessEnv | Record<string, string | undefined>
-): string | undefined {
-  for (const key of Object.keys(env)) {
-    if (key.toLowerCase() === 'path' && env[key] !== undefined) {
-      return key
-    }
-  }
-  return undefined
-}
-
-function mergeWindowsPathSegments(
-  env: NodeJS.ProcessEnv,
-  persistedSegments: string[],
-  platform: NodeJS.Platform,
-  sourceEnv: NodeJS.ProcessEnv
-): void {
-  expandWindowsPathEnvironmentVariables(env, platform)
-  const pathKey = resolvePathEnvKey(env, platform, sourceEnv)
-  const pathDelimiter = getPathDelimiter(platform)
-  const currentPath =
-    env[pathKey] ?? expandWindowsEnvironmentVariables(sourceEnv[pathKey] ?? '', sourceEnv)
-  const currentSegments = splitPathSegments(currentPath, pathDelimiter)
-  const existing = new Set(currentSegments.map((segment) => segment.toLowerCase()))
-  const missing = persistedSegments.filter((segment) => {
-    const normalized = segment.toLowerCase()
-    if (existing.has(normalized)) {
-      return false
-    }
-    existing.add(normalized)
-    return true
-  })
-
-  if (missing.length > 0) {
-    env[pathKey] = [...currentSegments, ...missing].join(pathDelimiter)
-  }
-}
-
 export function mergePersistedWindowsPath(
   env: NodeJS.ProcessEnv,
   options: ReadWindowsPathOptions = {}
@@ -299,9 +287,7 @@ export function mergePersistedWindowsPath(
   }
 
   const sourceEnv = options.env ?? process.env
-  // Why: Windows broadcasts PATH changes to future processes, but a running
-  // Electron app keeps its old environment. Append the persisted additions so
-  // newly installed CLIs resolve without unexpectedly reordering existing PATH.
+  // Why: append-only merging lets stale entries shadow newly installed executables.
   mergeWindowsPathSegments(env, readPersistedWindowsPathSegments(options), platform, sourceEnv)
 }
 
diff --git a/src/main/pty/windows-path-registry-change.test.ts b/src/main/pty/windows-path-registry-change.test.ts
new file mode 100644
index 00000000000..e6baee2cadf
--- /dev/null
+++ b/src/main/pty/windows-path-registry-change.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  installWindowsPathRegistryChangeListener,
+  WINDOWS_SETTING_CHANGE_MESSAGE
+} from './windows-path-registry-change'
+
+describe('installWindowsPathRegistryChangeListener', () => {
+  it('invalidates the persisted PATH cache on a Windows settings change', () => {
+    const hooks = new Map<number, (wParam: Buffer, lParam: Buffer) => void>()
+    const invalidate = vi.fn()
+    installWindowsPathRegistryChangeListener(
+      {
+        hookWindowMessage: (message, callback) => {
+          hooks.set(message, callback)
+        }
+      },
+      { invalidate, platform: 'win32' }
+    )
+
+    hooks.get(WINDOWS_SETTING_CHANGE_MESSAGE)?.(Buffer.alloc(0), Buffer.alloc(0))
+
+    expect(invalidate).toHaveBeenCalledOnce()
+  })
+
+  it('does not hook native messages outside Windows', () => {
+    const hookWindowMessage = vi.fn()
+
+    installWindowsPathRegistryChangeListener({ hookWindowMessage }, { platform: 'linux' })
+
+    expect(hookWindowMessage).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/pty/windows-path-registry-change.ts b/src/main/pty/windows-path-registry-change.ts
new file mode 100644
index 00000000000..604d06de713
--- /dev/null
+++ b/src/main/pty/windows-path-registry-change.ts
@@ -0,0 +1,19 @@
+import type { BrowserWindow } from 'electron'
+import { invalidatePersistedWindowsPathCache } from './windows-environment-path'
+
+export const WINDOWS_SETTING_CHANGE_MESSAGE = 0x001a
+
+type WindowsMessageWindow = Pick<BrowserWindow, 'hookWindowMessage'>
+
+export function installWindowsPathRegistryChangeListener(
+  window: Partial<WindowsMessageWindow>,
+  options: { invalidate?: () => void; platform?: NodeJS.Platform } = {}
+): void {
+  if ((options.platform ?? process.platform) !== 'win32' || !window.hookWindowMessage) {
+    return
+  }
+  window.hookWindowMessage(
+    WINDOWS_SETTING_CHANGE_MESSAGE,
+    options.invalidate ?? invalidatePersistedWindowsPathCache
+  )
+}
diff --git a/src/main/pty/windows-path-registry-fallback.test.ts b/src/main/pty/windows-path-registry-fallback.test.ts
new file mode 100644
index 00000000000..a7db74af310
--- /dev/null
+++ b/src/main/pty/windows-path-registry-fallback.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it } from 'vitest'
+import { WindowsPathRegistryFallback } from './windows-path-registry-fallback'
+
+const success = (segments: string[]) => ({ failed: false, segments })
+const failure = () => ({ failed: true, segments: [] })
+
+describe('WindowsPathRegistryFallback', () => {
+  it('withholds an incomplete snapshot until every source has succeeded', () => {
+    const fallback = new WindowsPathRegistryFallback(2)
+
+    expect(fallback.commitReads([success(['C:\\Machine']), failure()])).toBeUndefined()
+    expect(fallback.commitReads([failure(), success(['C:\\User'])])).toEqual([
+      'C:\\Machine',
+      'C:\\User'
+    ])
+  })
+
+  it('uses each source independently when a later read fails', () => {
+    const fallback = new WindowsPathRegistryFallback(2)
+    fallback.commitReads([success(['C:\\OldMachine']), success(['C:\\OldUser'])])
+
+    expect(fallback.commitReads([success(['C:\\NewMachine']), failure()])).toEqual([
+      'C:\\NewMachine',
+      'C:\\OldUser'
+    ])
+  })
+
+  it('treats a successful empty source as authoritative', () => {
+    const fallback = new WindowsPathRegistryFallback(2)
+    fallback.commitReads([success(['C:\\Machine']), success(['C:\\User'])])
+
+    expect(fallback.commitReads([failure(), success([])])).toEqual(['C:\\Machine'])
+    expect(fallback.commitReads([failure(), failure()])).toEqual(['C:\\Machine'])
+  })
+
+  it('clears retained sources on reset', () => {
+    const fallback = new WindowsPathRegistryFallback(2)
+    fallback.commitReads([success(['C:\\Machine']), success(['C:\\User'])])
+
+    fallback.reset()
+
+    expect(fallback.commitReads([failure(), failure()])).toBeUndefined()
+  })
+
+  it('does not expose retained arrays to callers', () => {
+    const fallback = new WindowsPathRegistryFallback(2)
+    const machine = ['C:\\Machine']
+    const first = fallback.commitReads([success(machine), success(['C:\\User'])])!
+
+    machine[0] = 'C:\\MutatedInput'
+    first[0] = 'C:\\MutatedOutput'
+
+    expect(fallback.commitReads([failure(), failure()])).toEqual(['C:\\Machine', 'C:\\User'])
+  })
+})
diff --git a/src/main/pty/windows-path-registry-fallback.ts b/src/main/pty/windows-path-registry-fallback.ts
new file mode 100644
index 00000000000..c551144119c
--- /dev/null
+++ b/src/main/pty/windows-path-registry-fallback.ts
@@ -0,0 +1,33 @@
+export type RegistryPathRead = { failed: boolean; segments: string[] }
+
+export class WindowsPathRegistryFallback {
+  private readonly lastGoodBySource: (string[] | undefined)[]
+
+  constructor(sourceCount: number) {
+    this.lastGoodBySource = Array.from({ length: sourceCount })
+  }
+
+  commitReads(reads: RegistryPathRead[]): string[] | undefined {
+    if (reads.length !== this.lastGoodBySource.length) {
+      return undefined
+    }
+
+    const resolved = reads.map((read, index) => {
+      if (!read.failed) {
+        const segments = [...read.segments]
+        this.lastGoodBySource[index] = segments
+        return segments
+      }
+      const lastGood = this.lastGoodBySource[index]
+      return lastGood ? [...lastGood] : undefined
+    })
+
+    return resolved.some((segments) => segments === undefined)
+      ? undefined
+      : resolved.flatMap((segments) => segments ?? [])
+  }
+
+  reset(): void {
+    this.lastGoodBySource.fill(undefined)
+  }
+}
diff --git a/src/main/pty/windows-path-registry-reader.test.ts b/src/main/pty/windows-path-registry-reader.test.ts
new file mode 100644
index 00000000000..387e4238b8e
--- /dev/null
+++ b/src/main/pty/windows-path-registry-reader.test.ts
@@ -0,0 +1,82 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  __setWindowsPathRegistryLoaderForTests,
+  readWindowsPathRegistry
+} from './windows-path-registry-reader'
+
+describe('readWindowsPathRegistry', () => {
+  afterEach(() => __setWindowsPathRegistryLoaderForTests())
+
+  it('reads machine and user PATH values without creating a process', () => {
+    const getRegistryKey = vi
+      .fn()
+      .mockReturnValueOnce({ PATH: { type: 2, value: '%SystemRoot%\\System32' } })
+      .mockReturnValueOnce({ Path: { type: 1, value: 'C:\\Users\\me\\bin' } })
+    __setWindowsPathRegistryLoaderForTests(() => ({
+      HK: { LM: 1, CU: 2 },
+      getRegistryKey
+    }))
+
+    expect(readWindowsPathRegistry()).toEqual([
+      { failed: false, value: '%SystemRoot%\\System32' },
+      { failed: false, value: 'C:\\Users\\me\\bin' }
+    ])
+    expect(getRegistryKey).toHaveBeenNthCalledWith(
+      1,
+      1,
+      'SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment'
+    )
+    expect(getRegistryKey).toHaveBeenNthCalledWith(2, 2, 'Environment')
+  })
+
+  it('distinguishes an empty PATH from a failed registry read', () => {
+    const getRegistryKey = vi
+      .fn()
+      .mockReturnValueOnce({ Path: { type: 1, value: '' } })
+      .mockReturnValueOnce({ Path: { type: 4, value: 1 } })
+    __setWindowsPathRegistryLoaderForTests(() => ({
+      HK: { LM: 1, CU: 2 },
+      getRegistryKey
+    }))
+
+    expect(readWindowsPathRegistry()).toEqual([
+      { failed: false, value: '' },
+      { failed: true, value: null }
+    ])
+  })
+
+  it('treats a missing PATH value in a readable hive as empty', () => {
+    __setWindowsPathRegistryLoaderForTests(() => ({
+      HK: { LM: 1, CU: 2 },
+      getRegistryKey: vi.fn(() => ({}))
+    }))
+
+    expect(readWindowsPathRegistry()).toEqual([
+      { failed: false, value: '' },
+      { failed: false, value: '' }
+    ])
+  })
+
+  it('treats a present but unreadable PATH entry as a failed read', () => {
+    __setWindowsPathRegistryLoaderForTests(() => ({
+      HK: { LM: 1, CU: 2 },
+      getRegistryKey: vi.fn(() => ({ Path: undefined }))
+    }))
+
+    expect(readWindowsPathRegistry()).toEqual([
+      { failed: true, value: null },
+      { failed: true, value: null }
+    ])
+  })
+
+  it('fails closed when the optional native module is unavailable', () => {
+    __setWindowsPathRegistryLoaderForTests(() => {
+      throw new Error('native module unavailable')
+    })
+
+    expect(readWindowsPathRegistry()).toEqual([
+      { failed: true, value: null },
+      { failed: true, value: null }
+    ])
+  })
+})
diff --git a/src/main/pty/windows-path-registry-reader.ts b/src/main/pty/windows-path-registry-reader.ts
new file mode 100644
index 00000000000..cff14c6ff3e
--- /dev/null
+++ b/src/main/pty/windows-path-registry-reader.ts
@@ -0,0 +1,69 @@
+import {
+  loadWindowsNativeRegistry,
+  WINDOWS_REG_EXPAND_SZ,
+  WINDOWS_REG_SZ,
+  type WindowsNativeRegistryModule
+} from '../windows-native-registry'
+
+export type WindowsPathRegistryRead = {
+  failed: boolean
+  value: string | null
+}
+
+const MACHINE_ENVIRONMENT_KEY = 'SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment'
+const USER_ENVIRONMENT_KEY = 'Environment'
+const PATH_VALUE = 'Path'
+
+let windowsRegistryLoader = loadWindowsNativeRegistry
+
+function readRegistryPath(
+  registry: WindowsNativeRegistryModule,
+  root: number,
+  key: string
+): WindowsPathRegistryRead {
+  try {
+    const values = registry.getRegistryKey(root, key)
+    if (!values || typeof values !== 'object') {
+      return { failed: true, value: null }
+    }
+    const matchingEntry = Object.entries(values).find(
+      ([name]) => name.toLowerCase() === PATH_VALUE.toLowerCase()
+    )
+    if (!matchingEntry) {
+      return { failed: false, value: '' }
+    }
+    const entry = matchingEntry[1]
+    if (
+      !entry ||
+      (entry.type !== WINDOWS_REG_SZ && entry.type !== WINDOWS_REG_EXPAND_SZ) ||
+      typeof entry.value !== 'string'
+    ) {
+      return { failed: true, value: null }
+    }
+    return { failed: false, value: entry.value }
+  } catch {
+    return { failed: true, value: null }
+  }
+}
+
+export function readWindowsPathRegistry(): WindowsPathRegistryRead[] {
+  let registry: WindowsNativeRegistryModule
+  try {
+    registry = windowsRegistryLoader()
+  } catch {
+    return [
+      { failed: true, value: null },
+      { failed: true, value: null }
+    ]
+  }
+  return [
+    readRegistryPath(registry, registry.HK.LM, MACHINE_ENVIRONMENT_KEY),
+    readRegistryPath(registry, registry.HK.CU, USER_ENVIRONMENT_KEY)
+  ]
+}
+
+export function __setWindowsPathRegistryLoaderForTests(
+  loader?: () => WindowsNativeRegistryModule
+): void {
+  windowsRegistryLoader = loader ?? loadWindowsNativeRegistry
+}
diff --git a/src/main/pty/windows-path-segment-merge.ts b/src/main/pty/windows-path-segment-merge.ts
new file mode 100644
index 00000000000..790a6cd06c9
--- /dev/null
+++ b/src/main/pty/windows-path-segment-merge.ts
@@ -0,0 +1,83 @@
+import {
+  expandWindowsEnvironmentVariables,
+  expandWindowsPathEnvironmentVariables
+} from '../../shared/windows-environment-expansion'
+
+export function resolvePathEnvKey(
+  env: NodeJS.ProcessEnv | Record<string, string | undefined>,
+  platform: NodeJS.Platform,
+  hostEnv: NodeJS.ProcessEnv = process.env
+): string {
+  if (platform !== 'win32') {
+    return 'PATH'
+  }
+  // Why: match the daemon's env-block spelling so its merge cannot resurrect another PATH key.
+  return firstWindowsPathEnvKey(env) ?? firstWindowsPathEnvKey(hostEnv) ?? 'Path'
+}
+
+// Why: Win32 uses the first case-insensitive key, and object order preserves block order.
+function firstWindowsPathEnvKey(
+  env: NodeJS.ProcessEnv | Record<string, string | undefined>
+): string | undefined {
+  for (const key of Object.keys(env)) {
+    if (key.toLowerCase() === 'path' && env[key] !== undefined) {
+      return key
+    }
+  }
+  return undefined
+}
+
+function normalizeSegmentKey(segment: string): string {
+  const trimmed = segment.replace(/[\\/]+$/, '')
+  // Why: roots keep one separator because `C:\` and drive-relative `C:` differ.
+  return (/^[a-z]:$/i.test(trimmed) && trimmed !== segment ? `${trimmed}\\` : trimmed).toLowerCase()
+}
+
+function dedupeSegments(segments: string[]): string[] {
+  const seen = new Set<string>()
+  return segments.filter((segment) => {
+    const key = normalizeSegmentKey(segment)
+    if (seen.has(key)) {
+      return false
+    }
+    seen.add(key)
+    return true
+  })
+}
+
+function splitPathSegments(pathValue: string, pathDelimiter: string): string[] {
+  return pathValue
+    .split(pathDelimiter)
+    .map((segment) => segment.trim())
+    .filter(Boolean)
+}
+
+export function mergeWindowsPathSegments(
+  env: NodeJS.ProcessEnv,
+  persistedSegments: string[],
+  platform: NodeJS.Platform,
+  sourceEnv: NodeJS.ProcessEnv
+): void {
+  expandWindowsPathEnvironmentVariables(env, platform)
+  const pathKey = resolvePathEnvKey(env, platform, sourceEnv)
+  const pathDelimiter = platform === 'win32' ? ';' : ':'
+  const currentPath =
+    env[pathKey] ?? expandWindowsEnvironmentVariables(sourceEnv[pathKey] ?? '', sourceEnv)
+  const currentSegments = splitPathSegments(currentPath, pathDelimiter)
+
+  if (persistedSegments.length === 0) {
+    return
+  }
+
+  const persisted = dedupeSegments(persistedSegments)
+  const persistedKeys = new Set(persisted.map(normalizeSegmentKey))
+  // Why: keep launch-time and Orca-injected entries that have no persisted position.
+  const injected = dedupeSegments(
+    currentSegments.filter((segment) => !persistedKeys.has(normalizeSegmentKey(segment)))
+  )
+  const merged = [...injected, ...persisted].join(pathDelimiter)
+
+  if (merged !== currentPath) {
+    env[pathKey] = merged
+  }
+}
diff --git a/src/main/pty/wsl-orca-env.test.ts b/src/main/pty/wsl-orca-env.test.ts
index c27655ba7e4..21a3f69d1cd 100644
--- a/src/main/pty/wsl-orca-env.test.ts
+++ b/src/main/pty/wsl-orca-env.test.ts
@@ -48,8 +48,7 @@ describe('addOrcaWslInteropEnv', () => {
       ORCA_USER_DATA_PATH: 'C:\\Users\\jin\\AppData\\Roaming\\Orca',
       ORCA_CLI_COMMAND: 'orca-ide',
       ORCA_OMP_STATUS_EXTENSION: 'C:\\Users\\jin\\.omp\\agent\\extensions\\orca-agent-status.ts',
-      ORCA_PRIME_AGENT_STATUS_EXTENSION:
-        'C:\\Users\\jin\\AppData\\Roaming\\Orca\\prime-agent-managed-status-extension\\orca-agent-status.ts',
+      ORCA_PRIME_AGENT_STATUS_EXTENSION: 'C:\\stale\\orca-agent-status.ts',
       ORCA_PANE_KEY: 'tab-1:leaf-1',
       ORCA_TAB_ID: 'tab-1',
       ORCA_WORKTREE_ID: 'repo::\\\\wsl.localhost\\Ubuntu\\home\\jin\\repo',
@@ -70,7 +69,7 @@ describe('addOrcaWslInteropEnv', () => {
     expect(env.WSLENV).toContain('ORCA_USER_DATA_PATH/p')
     expect(env.WSLENV).toContain('ORCA_CLI_COMMAND/u')
     expect(env.WSLENV).toContain('ORCA_OMP_STATUS_EXTENSION/p')
-    expect(env.WSLENV).toContain('ORCA_PRIME_AGENT_STATUS_EXTENSION/p')
+    expect(env.WSLENV).not.toContain('ORCA_PRIME_AGENT_STATUS_EXTENSION')
     expect(env.WSLENV).toContain('ORCA_PANE_KEY/u')
     expect(env.WSLENV).toContain('ORCA_TAB_ID/u')
     expect(env.WSLENV).toContain('ORCA_WORKTREE_ID/u')
diff --git a/src/main/pty/wsl-orca-env.ts b/src/main/pty/wsl-orca-env.ts
index 5e90eaa6b4a..40f3b957249 100644
--- a/src/main/pty/wsl-orca-env.ts
+++ b/src/main/pty/wsl-orca-env.ts
@@ -96,7 +96,6 @@ export function addOrcaWslInteropEnv(env: Record<string, string>): void {
     'ORCA_WSL_HOOK_INSTANCE/u',
     'ORCA_OMP_SOURCE_AGENT_DIR/p',
     'ORCA_OMP_STATUS_EXTENSION/p',
-    'ORCA_PRIME_AGENT_STATUS_EXTENSION/p',
     ...worktreeSetupWslenvEntries(env)
   ]
   applyWslenvPassthrough(env, passthroughEntries)
diff --git a/src/main/rate-limits/minimax-request-context.ts b/src/main/rate-limits/minimax-request-context.ts
index 34dcd47130b..ecda8329a2e 100644
--- a/src/main/rate-limits/minimax-request-context.ts
+++ b/src/main/rate-limits/minimax-request-context.ts
@@ -45,7 +45,7 @@ function parseCookiePairs(cookie: string): { name: string; value: string }[] {
     .map((part) => {
       const normalizedPart = part.replace(/^Cookie:\s*/i, '')
       const eq = normalizedPart.indexOf('=')
-      if (eq < 0) {
+      if (eq === -1) {
         return null
       }
       return {
diff --git a/src/main/rate-limits/opencode-go-usage-fetcher.ts b/src/main/rate-limits/opencode-go-usage-fetcher.ts
index 934d1e72b42..f2ea68b7588 100644
--- a/src/main/rate-limits/opencode-go-usage-fetcher.ts
+++ b/src/main/rate-limits/opencode-go-usage-fetcher.ts
@@ -47,7 +47,7 @@ function parseAuthCookies(raw: string): { name: string; value: string }[] {
     .map((p) => p.trim())
     .map((pair) => {
       const eq = pair.indexOf('=')
-      if (eq < 0) {
+      if (eq === -1) {
         return null
       }
       const name = pair.slice(0, eq).trim()
diff --git a/src/main/runtime/device-registry.ts b/src/main/runtime/device-registry.ts
index 88818b3cb1d..b5f0c7a6c8d 100644
--- a/src/main/runtime/device-registry.ts
+++ b/src/main/runtime/device-registry.ts
@@ -162,7 +162,7 @@ export class DeviceRegistry {
 
   setRelayBinding(deviceId: string, binding: RelayDeviceBinding): boolean {
     const index = this.devices.findIndex((candidate) => candidate.deviceId === deviceId)
-    if (index < 0 || binding.relayDeviceId !== deviceId) {
+    if (index === -1 || binding.relayDeviceId !== deviceId) {
       return false
     }
     const nextDevices = this.devices.map((device, candidateIndex) =>
@@ -175,7 +175,7 @@ export class DeviceRegistry {
 
   setMobilePairingConnectionMode(deviceId: string, mode: MobilePairingConnectionMode): boolean {
     const index = this.devices.findIndex((candidate) => candidate.deviceId === deviceId)
-    if (index < 0 || this.devices[index]?.scope !== 'mobile') {
+    if (index === -1 || this.devices[index]?.scope !== 'mobile') {
       return false
     }
     // Why: persist before swapping memory so a failed write does not leave a
@@ -208,7 +208,7 @@ export class DeviceRegistry {
 
   updateLastSeen(deviceId: string): void {
     const index = this.devices.findIndex((d) => d.deviceId === deviceId)
-    if (index < 0) {
+    if (index === -1) {
       return
     }
     // Why: persist before memory swap so a failed write cannot leave a scanned
@@ -230,7 +230,7 @@ export class DeviceRegistry {
    */
   updateLastSeenDeferred(deviceId: string): void {
     const index = this.devices.findIndex((d) => d.deviceId === deviceId)
-    if (index < 0) {
+    if (index === -1) {
       return
     }
     if (this.devices[index]!.lastSeenAt === 0) {
diff --git a/src/main/runtime/fetch-remote-cache.test.ts b/src/main/runtime/fetch-remote-cache.test.ts
index 14c18115636..fc2d761c059 100644
--- a/src/main/runtime/fetch-remote-cache.test.ts
+++ b/src/main/runtime/fetch-remote-cache.test.ts
@@ -66,7 +66,7 @@ function fullRemoteFetchOptions(cwd: string): { cwd: string; timeout: number } {
   return { cwd, timeout: 60_000 }
 }
 
-function mockFetchResults(results: (Promise<unknown> | unknown)[]): void {
+function mockFetchResults(results: unknown[]): void {
   let fetchIndex = 0
   gitExecFileAsyncMock.mockImplementation((argv: string[]) => {
     if (argv[0] === 'rev-parse') {
diff --git a/src/main/runtime/folder-workspace-pty-identity.test.ts b/src/main/runtime/folder-workspace-pty-identity.test.ts
index 71c18b9412a..d986fa54938 100644
--- a/src/main/runtime/folder-workspace-pty-identity.test.ts
+++ b/src/main/runtime/folder-workspace-pty-identity.test.ts
@@ -134,6 +134,126 @@ describe('folder workspaces sharing one directory', () => {
     expect([...(inventory?.livePtyIds ?? [])]).toEqual([PTY_B])
   })
 
+  it('keeps the first resolved worktree when normalized identities collide', async () => {
+    const firstId = `${ROOT_ID}/duplicate/`
+    const equivalentId = `${ROOT_ID}/duplicate`
+    const laterId = `${ROOT_ID}/later`
+    const internals = createRuntimeInternals({
+      sessions: [
+        { id: 'later-owner-pty', worktreeId: laterId, cwd: FOLDER_PATH, title: 'shell' },
+        { id: 'duplicate-owner-pty', worktreeId: equivalentId, cwd: FOLDER_PATH, title: 'shell' }
+      ]
+    })
+    const resolvedWorktrees = [firstId, equivalentId, laterId].map((id) =>
+      internals.buildResolvedWorktreeFromId(id)
+    )
+
+    await internals.refreshPtyWorktreeRecordsWithControllerInventory(resolvedWorktrees)
+
+    expect(internals.ptysById.get('duplicate-owner-pty')?.worktreeId).toBe(firstId)
+  })
+
+  it('stops indexing after a sparse owner match', async () => {
+    const ownerId = `${ROOT_ID}/first`
+    const internals = createRuntimeInternals({
+      sessions: [{ id: 'sparse-owner-pty', worktreeId: ownerId, cwd: FOLDER_PATH, title: 'shell' }]
+    })
+    let identityReads = 0
+    const resolvedWorktrees = [ownerId, `${ROOT_ID}/unused-a`, `${ROOT_ID}/unused-b`].map((id) => {
+      const worktree = internals.buildResolvedWorktreeFromId(id)
+      if (!worktree || typeof worktree !== 'object') {
+        throw new Error(`Failed to resolve ${id}`)
+      }
+      return Object.defineProperty(worktree, 'id', {
+        configurable: true,
+        enumerable: true,
+        get: () => {
+          identityReads += 1
+          return id
+        }
+      })
+    })
+
+    await internals.refreshPtyWorktreeRecordsWithControllerInventory(resolvedWorktrees)
+
+    expect(internals.ptysById.get('sparse-owner-pty')?.worktreeId).toBe(ownerId)
+    expect(identityReads).toBe(2)
+  })
+
+  it('keeps parsed and raw identity domains distinct', async () => {
+    const parsedId = `${ROOT_ID}/collision`
+    const rawId = `${REPO_ID}\0${FOLDER_PATH}/collision`
+    const internals = createRuntimeInternals({
+      sessions: [{ id: 'raw-owner-pty', worktreeId: rawId, cwd: FOLDER_PATH, title: 'shell' }]
+    })
+    const parsedWorktree = internals.buildResolvedWorktreeFromId(parsedId)
+    if (!parsedWorktree || typeof parsedWorktree !== 'object') {
+      throw new Error(`Failed to resolve ${parsedId}`)
+    }
+    const rawWorktree = { ...parsedWorktree, id: rawId }
+
+    await internals.refreshPtyWorktreeRecordsWithControllerInventory([parsedWorktree, rawWorktree])
+
+    expect(internals.ptysById.get('raw-owner-pty')?.worktreeId).toBe(rawId)
+  })
+
+  it('bounds provider and persisted worktree resolution to linear identity reads', async () => {
+    const worktreeCount = 128
+    const worktreeIds = Array.from(
+      { length: worktreeCount },
+      (_, index) => `${ROOT_ID}/worktree-${index}`
+    )
+    const persistedSession: WorkspaceSessionState = {
+      ...getDefaultWorkspaceSession(),
+      tabsByWorktree: Object.fromEntries(
+        worktreeIds.map((worktreeId, index) => [
+          worktreeId,
+          [
+            {
+              id: `indexed-tab-${index}`,
+              ptyId: `indexed-pty-${index}`,
+              worktreeId,
+              title: 'shell'
+            }
+          ]
+        ])
+      ) as never
+    }
+    const internals = createRuntimeInternals({
+      session: persistedSession,
+      sessions: worktreeIds.map((worktreeId, index) => ({
+        id: `indexed-pty-${index}`,
+        worktreeId,
+        cwd: `${FOLDER_PATH}/worktree-${index}`,
+        title: 'shell'
+      }))
+    })
+    let identityReads = 0
+    const resolvedWorktrees = worktreeIds.map((id) => {
+      const worktree = internals.buildResolvedWorktreeFromId(id)
+      if (!worktree || typeof worktree !== 'object') {
+        throw new Error(`Failed to resolve ${id}`)
+      }
+      return Object.defineProperty(worktree, 'id', {
+        configurable: true,
+        enumerable: true,
+        get: () => {
+          identityReads += 1
+          return id
+        }
+      })
+    })
+
+    await internals.refreshPtyWorktreeRecordsWithControllerInventory(resolvedWorktrees)
+
+    expect(internals.ptysById.size).toBe(worktreeCount)
+    expect(internals.ptysById.get('indexed-pty-0')?.worktreeId).toBe(worktreeIds[0])
+    expect(internals.ptysById.get(`indexed-pty-${worktreeCount - 1}`)?.worktreeId).toBe(
+      worktreeIds[worktreeCount - 1]
+    )
+    expect(identityReads).toBe(worktreeCount * 2)
+  })
+
   it('reports live PTYs per workspace instance and for the folder root separately', () => {
     const internals = createRuntimeInternals()
     internals.recordPtyWorktree(PTY_A, WORKSPACE_A, { connected: true })
diff --git a/src/main/runtime/headless-terminal-split-layout.test.ts b/src/main/runtime/headless-terminal-split-layout.test.ts
index 000434ee3d7..0fa0d33b1c0 100644
--- a/src/main/runtime/headless-terminal-split-layout.test.ts
+++ b/src/main/runtime/headless-terminal-split-layout.test.ts
@@ -2,9 +2,27 @@ import { describe, expect, it } from 'vitest'
 import type { TerminalLayoutSnapshot } from '../../shared/types'
 import {
   buildHeadlessTerminalSplitLayout,
-  countTerminalLayoutLeaves
+  countTerminalLayoutLeaves,
+  terminalLayoutContainsLeaf
 } from './headless-terminal-split-layout'
 
+describe('terminalLayoutContainsLeaf', () => {
+  it('requires the leaf in the layout tree', () => {
+    expect(
+      terminalLayoutContainsLeaf(
+        {
+          type: 'split',
+          direction: 'vertical',
+          first: { type: 'leaf', leafId: 'leaf-a' },
+          second: { type: 'leaf', leafId: 'leaf-b' }
+        },
+        'leaf-b'
+      )
+    ).toBe(true)
+    expect(terminalLayoutContainsLeaf({ type: 'leaf', leafId: 'leaf-a' }, 'leaf-b')).toBe(false)
+  })
+})
+
 describe('buildHeadlessTerminalSplitLayout (headless split persistence)', () => {
   it('splits a single-leaf tab into a 2-leaf split tree', () => {
     const existing: TerminalLayoutSnapshot = {
@@ -84,6 +102,64 @@ describe('buildHeadlessTerminalSplitLayout (headless split persistence)', () =>
     })
   })
 
+  it('replaces the provisional admission leaf with the requested split direction', () => {
+    const next = buildHeadlessTerminalSplitLayout(
+      {
+        root: {
+          type: 'split',
+          direction: 'vertical',
+          first: { type: 'leaf', leafId: 'leaf-a' },
+          second: { type: 'leaf', leafId: 'leaf-c' }
+        },
+        activeLeafId: 'leaf-c',
+        expandedLeafId: null,
+        ptyIdsByLeafId: { 'leaf-a': 'pty-a', 'leaf-c': 'provisional-pty' }
+      },
+      { leafId: 'leaf-c', ptyId: 'pty-c', splitFromLeafId: 'leaf-a', direction: 'horizontal' }
+    )
+
+    expect(next.root).toEqual({
+      type: 'split',
+      direction: 'horizontal',
+      first: { type: 'leaf', leafId: 'leaf-a' },
+      second: { type: 'leaf', leafId: 'leaf-c' }
+    })
+    expect(next.ptyIdsByLeafId).toEqual({ 'leaf-a': 'pty-a', 'leaf-c': 'pty-c' })
+  })
+
+  it('preserves a sibling committed by a concurrent split', () => {
+    const next = buildHeadlessTerminalSplitLayout(
+      {
+        root: {
+          type: 'split',
+          direction: 'vertical',
+          first: {
+            type: 'split',
+            direction: 'horizontal',
+            first: { type: 'leaf', leafId: 'leaf-a' },
+            second: { type: 'leaf', leafId: 'leaf-b' }
+          },
+          second: { type: 'leaf', leafId: 'leaf-c' }
+        },
+        activeLeafId: 'leaf-c',
+        expandedLeafId: null,
+        ptyIdsByLeafId: {
+          'leaf-a': 'pty-a',
+          'leaf-b': 'pty-b',
+          'leaf-c': 'provisional-pty'
+        }
+      },
+      { leafId: 'leaf-c', ptyId: 'pty-c', splitFromLeafId: 'leaf-a', direction: 'vertical' }
+    )
+
+    expect(countTerminalLayoutLeaves(next.root)).toBe(3)
+    expect(next.ptyIdsByLeafId).toEqual({
+      'leaf-a': 'pty-a',
+      'leaf-b': 'pty-b',
+      'leaf-c': 'pty-c'
+    })
+  })
+
   it('does not collapse — the persisted layout keeps both leaves (regression guard)', () => {
     // Why: the reported bug was the split collapsing back to one pane. After a
     // split, a rebuild reads this persisted layout, so it MUST stay multi-leaf.
diff --git a/src/main/runtime/headless-terminal-split-layout.ts b/src/main/runtime/headless-terminal-split-layout.ts
index c3947334f77..834625f9ef3 100644
--- a/src/main/runtime/headless-terminal-split-layout.ts
+++ b/src/main/runtime/headless-terminal-split-layout.ts
@@ -1,5 +1,18 @@
 import type { TerminalLayoutSnapshot, TerminalPaneLayoutNode } from '../../shared/types'
 
+export function terminalLayoutContainsLeaf(
+  node: TerminalPaneLayoutNode | null | undefined,
+  leafId: string
+): boolean {
+  if (!node) {
+    return false
+  }
+  return node.type === 'leaf'
+    ? node.leafId === leafId
+    : terminalLayoutContainsLeaf(node.first, leafId) ||
+        terminalLayoutContainsLeaf(node.second, leafId)
+}
+
 /**
  * Insert a newly split-off leaf into a terminal tab's persisted layout tree.
  *
@@ -17,7 +30,23 @@ export function buildHeadlessTerminalSplitLayout(
     direction: 'horizontal' | 'vertical'
   }
 ): TerminalLayoutSnapshot {
-  const existingRoot: TerminalPaneLayoutNode = existing?.root ?? {
+  const removeProvisionalLeaf = (node: TerminalPaneLayoutNode): TerminalPaneLayoutNode | null => {
+    if (node.type === 'leaf') {
+      return node.leafId === args.leafId ? null : node
+    }
+    const first = removeProvisionalLeaf(node.first)
+    const second = removeProvisionalLeaf(node.second)
+    if (!first) {
+      return second
+    }
+    if (!second) {
+      return first
+    }
+    return { ...node, first, second }
+  }
+  // Why: PTY admission durably appends a fallback vertical leaf before this exact-direction commit.
+  const currentRoot = existing?.root ? removeProvisionalLeaf(existing.root) : null
+  const existingRoot: TerminalPaneLayoutNode = currentRoot ?? {
     type: 'leaf',
     leafId: args.splitFromLeafId
   }
@@ -35,13 +64,15 @@ export function buildHeadlessTerminalSplitLayout(
     }
     return { ...node, first: insertSplit(node.first), second: insertSplit(node.second) }
   }
+  const ptyIdsByLeafId = { ...existing?.ptyIdsByLeafId }
+  delete ptyIdsByLeafId[args.leafId]
   return {
     ...existing,
     root: insertSplit(existingRoot),
     activeLeafId: args.leafId,
     expandedLeafId: existing?.expandedLeafId ?? null,
     ptyIdsByLeafId: {
-      ...existing?.ptyIdsByLeafId,
+      ...ptyIdsByLeafId,
       [args.leafId]: args.ptyId
     }
   }
diff --git a/src/main/runtime/linear-save-issue.test.ts b/src/main/runtime/linear-save-issue.test.ts
index add8a54d1ab..eb8ed4093d2 100644
--- a/src/main/runtime/linear-save-issue.test.ts
+++ b/src/main/runtime/linear-save-issue.test.ts
@@ -23,7 +23,7 @@ const issue = {
 
 type SaveIssueInternals = {
   resolveLinearAssignee(input: string, teamId: string, workspaceId: string): Promise<string>
-  resolveLinearAgentState(input: string, states: unknown[]): unknown | null
+  resolveLinearAgentState(input: string, states: unknown[]): unknown
   buildLinearSaveUpdate(
     params: { labels?: string[] },
     current: typeof issue,
diff --git a/src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts b/src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts
new file mode 100644
index 00000000000..582837826ac
--- /dev/null
+++ b/src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts
@@ -0,0 +1,192 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  createMobileSessionTabsAgentStatusHeartbeat,
+  SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS,
+  SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS
+} from './mobile-session-tabs-agent-status-heartbeat'
+
+describe('mobile session-tabs agent-status heartbeat', () => {
+  const worktreesByPtyId = new Map<string, string[]>()
+
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(0)
+    worktreesByPtyId.clear()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('refreshes continuously active PTYs through one globally capped FIFO', () => {
+    const emitted: { worktreeId: string; at: number }[] = []
+    const heartbeat = createMobileSessionTabsAgentStatusHeartbeat(
+      (ptyId) => worktreesByPtyId.get(ptyId) ?? [],
+      (worktreeId) => emitted.push({ worktreeId, at: Date.now() })
+    )
+    const ptyIds = Array.from({ length: 24 }, (_, index) => `pty-${index}`)
+    for (const ptyId of ptyIds) {
+      worktreesByPtyId.set(ptyId, [ptyId.replace('pty', 'worktree')])
+      heartbeat.observeSemanticTitle(ptyId)
+    }
+
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS - 1)
+    for (const ptyId of ptyIds) {
+      heartbeat.scheduleDecorativeHeartbeat(ptyId)
+    }
+    vi.runOnlyPendingTimers()
+    expect(emitted).toEqual([])
+
+    vi.advanceTimersByTime(1)
+    for (const ptyId of ptyIds) {
+      heartbeat.scheduleDecorativeHeartbeat(ptyId)
+    }
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS * (ptyIds.length - 1))
+
+    expect(emitted.map(({ worktreeId }) => worktreeId)).toEqual(
+      ptyIds.map((ptyId) => ptyId.replace('pty', 'worktree'))
+    )
+    for (let index = 1; index < emitted.length; index += 1) {
+      expect(emitted[index]!.at - emitted[index - 1]!.at).toBeGreaterThanOrEqual(
+        SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS
+      )
+    }
+    for (const ptyId of ptyIds) {
+      heartbeat.scheduleDecorativeHeartbeat(ptyId)
+    }
+    vi.runOnlyPendingTimers()
+    expect(emitted).toHaveLength(ptyIds.length)
+    heartbeat.dispose()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('lets semantic transitions bypass and cancel queued heartbeats', () => {
+    const emitted: string[] = []
+    worktreesByPtyId.set('pty-1', ['worktree-1'])
+    worktreesByPtyId.set('pty-2', ['worktree-2'])
+    const heartbeat = createMobileSessionTabsAgentStatusHeartbeat(
+      (ptyId) => worktreesByPtyId.get(ptyId) ?? [],
+      (worktreeId) => emitted.push(worktreeId)
+    )
+    heartbeat.observeSemanticTitle('pty-1')
+    heartbeat.observeSemanticTitle('pty-2')
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS)
+
+    heartbeat.scheduleDecorativeHeartbeat('pty-1')
+    heartbeat.scheduleDecorativeHeartbeat('pty-2')
+    heartbeat.observeSemanticTitle('pty-2')
+    vi.runAllTimers()
+
+    expect(emitted).toEqual(['worktree-1'])
+    heartbeat.removePty('pty-1')
+    heartbeat.removePty('pty-2')
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('deduplicates sibling PTYs because one snapshot refreshes their worktree', () => {
+    const emitted: string[] = []
+    worktreesByPtyId.set('pty-1', ['worktree-1'])
+    worktreesByPtyId.set('pty-2', ['worktree-1'])
+    const heartbeat = createMobileSessionTabsAgentStatusHeartbeat(
+      (ptyId) => worktreesByPtyId.get(ptyId) ?? [],
+      (worktreeId) => emitted.push(worktreeId)
+    )
+    heartbeat.observeSemanticTitle('pty-1')
+    heartbeat.observeSemanticTitle('pty-2')
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS)
+
+    heartbeat.scheduleDecorativeHeartbeat('pty-1')
+    heartbeat.scheduleDecorativeHeartbeat('pty-2')
+    heartbeat.removePty('pty-1')
+    vi.runAllTimers()
+
+    expect(emitted).toEqual(['worktree-1'])
+  })
+
+  it('does not slip spacing-delayed worktrees to the next stale boundary', () => {
+    const emitted: { worktreeId: string; at: number }[] = []
+    worktreesByPtyId.set('pty-1', ['worktree-1'])
+    worktreesByPtyId.set('pty-2', ['worktree-2'])
+    const heartbeat = createMobileSessionTabsAgentStatusHeartbeat(
+      (ptyId) => worktreesByPtyId.get(ptyId) ?? [],
+      (worktreeId) => emitted.push({ worktreeId, at: Date.now() })
+    )
+    heartbeat.observeSemanticTitle('pty-1')
+    heartbeat.observeSemanticTitle('pty-2')
+
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS)
+    heartbeat.scheduleDecorativeHeartbeat('pty-1')
+    heartbeat.scheduleDecorativeHeartbeat('pty-2')
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS)
+    expect(emitted).toEqual([
+      { worktreeId: 'worktree-1', at: SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS },
+      {
+        worktreeId: 'worktree-2',
+        at:
+          SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS +
+          SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS
+      }
+    ])
+
+    vi.advanceTimersByTime(
+      SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS -
+        SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS
+    )
+    heartbeat.scheduleDecorativeHeartbeat('pty-1')
+    heartbeat.scheduleDecorativeHeartbeat('pty-2')
+    vi.runOnlyPendingTimers()
+    expect(emitted.at(-1)).toEqual({
+      worktreeId: 'worktree-1',
+      at: SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS * 2
+    })
+
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS - 1)
+    heartbeat.scheduleDecorativeHeartbeat('pty-2')
+    vi.runOnlyPendingTimers()
+    expect(emitted).toHaveLength(3)
+
+    vi.advanceTimersByTime(1)
+    heartbeat.scheduleDecorativeHeartbeat('pty-2')
+    vi.runOnlyPendingTimers()
+    expect(emitted.at(-1)).toEqual({
+      worktreeId: 'worktree-2',
+      at:
+        SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS * 2 +
+        SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS
+    })
+  })
+
+  it('drops removed worktrees and pending work during teardown', () => {
+    const emitted: string[] = []
+    worktreesByPtyId.set('pty-1', ['worktree-1'])
+    worktreesByPtyId.set('pty-2', ['worktree-2'])
+    const heartbeat = createMobileSessionTabsAgentStatusHeartbeat(
+      (ptyId) => worktreesByPtyId.get(ptyId) ?? [],
+      (worktreeId) => emitted.push(worktreeId)
+    )
+    heartbeat.observeSemanticTitle('pty-1')
+    heartbeat.observeSemanticTitle('pty-2')
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS)
+    heartbeat.scheduleDecorativeHeartbeat('pty-1')
+    expect(vi.getTimerCount()).toBe(1)
+    heartbeat.removePty('pty-1')
+    vi.runAllTimers()
+    expect(emitted).toEqual([])
+    expect(vi.getTimerCount()).toBe(0)
+
+    heartbeat.scheduleDecorativeHeartbeat('pty-2')
+    expect(vi.getTimerCount()).toBe(1)
+    heartbeat.removeWorktree('worktree-2')
+    expect(vi.getTimerCount()).toBe(0)
+
+    heartbeat.scheduleDecorativeHeartbeat('pty-1')
+    expect(vi.getTimerCount()).toBe(1)
+    heartbeat.cancelPending()
+    expect(vi.getTimerCount()).toBe(0)
+    heartbeat.scheduleDecorativeHeartbeat('pty-1')
+    heartbeat.dispose()
+    vi.runAllTimers()
+    expect(emitted).toEqual([])
+    expect(vi.getTimerCount()).toBe(0)
+  })
+})
diff --git a/src/main/runtime/mobile-session-tabs-agent-status-heartbeat.ts b/src/main/runtime/mobile-session-tabs-agent-status-heartbeat.ts
new file mode 100644
index 00000000000..6c80cf4a35d
--- /dev/null
+++ b/src/main/runtime/mobile-session-tabs-agent-status-heartbeat.ts
@@ -0,0 +1,133 @@
+import { AGENT_STATUS_STALE_AFTER_MS } from '../../shared/agent-status-types'
+
+// Refresh halfway through the stale lease so a bounded global queue has ample drain time.
+export const SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS = AGENT_STATUS_STALE_AFTER_MS / 2
+export const SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS = 50
+
+export type MobileSessionTabsAgentStatusHeartbeat = {
+  observeSemanticTitle: (ptyId: string) => void
+  scheduleDecorativeHeartbeat: (ptyId: string) => void
+  removePty: (ptyId: string) => void
+  removeWorktree: (worktreeId: string) => void
+  cancelPending: () => void
+  dispose: () => void
+}
+
+export function createMobileSessionTabsAgentStatusHeartbeat(
+  resolveWorktreeIds: (ptyId: string) => Iterable<string>,
+  emit: (worktreeId: string) => void
+): MobileSessionTabsAgentStatusHeartbeat {
+  const lastEligibilityCheckAtByPtyId = new Map<string, number>()
+  const lastRefreshAtByWorktreeId = new Map<string, number>()
+  const pendingPtyIdsByWorktreeId = new Map<string, Set<string>>()
+  let lastGlobalHeartbeatAt: number | null = null
+  let timer: ReturnType<typeof setTimeout> | null = null
+
+  const clearTimer = (): void => {
+    if (timer !== null) {
+      clearTimeout(timer)
+      timer = null
+    }
+  }
+
+  const arm = (): void => {
+    if (timer !== null || pendingPtyIdsByWorktreeId.size === 0) {
+      return
+    }
+    const now = Date.now()
+    const delay =
+      lastGlobalHeartbeatAt === null
+        ? 0
+        : Math.max(
+            0,
+            SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS - (now - lastGlobalHeartbeatAt)
+          )
+    timer = setTimeout(() => {
+      timer = null
+      const worktreeId = pendingPtyIdsByWorktreeId.keys().next().value
+      if (typeof worktreeId !== 'string') {
+        return
+      }
+      const pendingPtyIds = pendingPtyIdsByWorktreeId.get(worktreeId)
+      pendingPtyIdsByWorktreeId.delete(worktreeId)
+      const emittedAt = Date.now()
+      lastRefreshAtByWorktreeId.set(worktreeId, emittedAt)
+      for (const ptyId of pendingPtyIds ?? []) {
+        lastEligibilityCheckAtByPtyId.set(ptyId, emittedAt)
+      }
+      lastGlobalHeartbeatAt = emittedAt
+      emit(worktreeId)
+      arm()
+    }, delay)
+    if (typeof timer.unref === 'function') {
+      timer.unref()
+    }
+  }
+
+  return {
+    observeSemanticTitle(ptyId: string): void {
+      const observedAt = Date.now()
+      lastEligibilityCheckAtByPtyId.set(ptyId, observedAt)
+      for (const worktreeId of resolveWorktreeIds(ptyId)) {
+        lastRefreshAtByWorktreeId.set(worktreeId, observedAt)
+        pendingPtyIdsByWorktreeId.delete(worktreeId)
+      }
+      if (pendingPtyIdsByWorktreeId.size === 0) {
+        clearTimer()
+      }
+    },
+    scheduleDecorativeHeartbeat(ptyId: string): void {
+      const now = Date.now()
+      const lastEligibilityCheckAt = lastEligibilityCheckAtByPtyId.get(ptyId)
+      if (
+        lastEligibilityCheckAt !== undefined &&
+        now - lastEligibilityCheckAt < SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS
+      ) {
+        return
+      }
+      lastEligibilityCheckAtByPtyId.set(ptyId, now)
+      for (const worktreeId of resolveWorktreeIds(ptyId)) {
+        const lastRefreshAt = lastRefreshAtByWorktreeId.get(worktreeId)
+        if (
+          lastRefreshAt === undefined ||
+          now - lastRefreshAt >= SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS
+        ) {
+          const pendingPtyIds = pendingPtyIdsByWorktreeId.get(worktreeId) ?? new Set<string>()
+          pendingPtyIds.add(ptyId)
+          pendingPtyIdsByWorktreeId.set(worktreeId, pendingPtyIds)
+        }
+      }
+      arm()
+    },
+    removePty(ptyId: string): void {
+      lastEligibilityCheckAtByPtyId.delete(ptyId)
+      for (const [worktreeId, pendingPtyIds] of pendingPtyIdsByWorktreeId) {
+        pendingPtyIds.delete(ptyId)
+        if (pendingPtyIds.size === 0) {
+          pendingPtyIdsByWorktreeId.delete(worktreeId)
+        }
+      }
+      if (pendingPtyIdsByWorktreeId.size === 0) {
+        clearTimer()
+      }
+    },
+    removeWorktree(worktreeId: string): void {
+      lastRefreshAtByWorktreeId.delete(worktreeId)
+      pendingPtyIdsByWorktreeId.delete(worktreeId)
+      if (pendingPtyIdsByWorktreeId.size === 0) {
+        clearTimer()
+      }
+    },
+    cancelPending(): void {
+      clearTimer()
+      pendingPtyIdsByWorktreeId.clear()
+    },
+    dispose(): void {
+      clearTimer()
+      pendingPtyIdsByWorktreeId.clear()
+      lastEligibilityCheckAtByPtyId.clear()
+      lastRefreshAtByWorktreeId.clear()
+      lastGlobalHeartbeatAt = null
+    }
+  }
+}
diff --git a/src/main/runtime/multi-client-navigation-isolation.integration.test.ts b/src/main/runtime/multi-client-navigation-isolation.integration.test.ts
index 1c641334016..50fd09a4639 100644
--- a/src/main/runtime/multi-client-navigation-isolation.integration.test.ts
+++ b/src/main/runtime/multi-client-navigation-isolation.integration.test.ts
@@ -304,6 +304,8 @@ describe('paired runtime navigation isolation', () => {
     const clientB = await authenticate(offerB.pairingUrl)
     sessions.push(clientB)
     expect(offerA.deviceId).not.toBe(offerB.deviceId)
+    expect(parsePairingCode(offerA.pairingUrl)?.pairedDeviceId).toBe(offerA.deviceId)
+    expect(parsePairingCode(offerB.pairingUrl)?.pairedDeviceId).toBe(offerB.deviceId)
     expect(parsePairingCode(offerA.pairingUrl)?.deviceToken).not.toBe(
       parsePairingCode(offerB.pairingUrl)?.deviceToken
     )
@@ -318,12 +320,92 @@ describe('paired runtime navigation isolation', () => {
       focusTerminal,
       clientA,
       clientB,
+      deviceIdA: offerA.deviceId,
+      deviceIdB: offerB.deviceId,
       pairingUrlA: offerA.pairingUrl,
       readerA,
       readerB
     }
   }
 
+  it('attributes workspace creation to each authenticated device across reconnect', async () => {
+    const harness = await startHarness()
+    const createManagedWorktree = vi
+      .spyOn(harness.runtime, 'createManagedWorktree')
+      .mockImplementation(async (args) => {
+        const creatorProvenance = (args as unknown as Record<string, unknown>).creatorProvenance
+        return {
+          worktree: {
+            id: worktreeId(args.name),
+            creatorProvenance
+          }
+        } as never
+      })
+
+    send(harness.clientA, {
+      id: 'status-a',
+      method: 'status.get'
+    })
+    send(harness.clientB, {
+      id: 'status-b',
+      method: 'status.get'
+    })
+    const [statusA, statusB] = await Promise.all([
+      harness.readerA.next('status-a'),
+      harness.readerB.next('status-b')
+    ])
+    expect(statusA).toMatchObject({
+      ok: true,
+      result: { pairedDeviceId: harness.deviceIdA }
+    })
+    expect(statusB).toMatchObject({
+      ok: true,
+      result: { pairedDeviceId: harness.deviceIdB }
+    })
+
+    send(harness.clientA, {
+      id: 'create-a',
+      method: 'worktree.create',
+      params: {
+        repo: REPO_ID,
+        name: 'created-a',
+        creatorProvenance: { kind: 'paired-device', deviceId: harness.deviceIdB }
+      }
+    })
+    send(harness.clientB, {
+      id: 'create-b',
+      method: 'worktree.create',
+      params: { repo: REPO_ID, name: 'created-b' }
+    })
+    await Promise.all([harness.readerA.next('create-a'), harness.readerB.next('create-b')])
+    expect(createManagedWorktree).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'created-a',
+        creatorProvenance: { kind: 'paired-device', deviceId: harness.deviceIdA }
+      })
+    )
+    expect(createManagedWorktree).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'created-b',
+        creatorProvenance: { kind: 'paired-device', deviceId: harness.deviceIdB }
+      })
+    )
+
+    await new Promise<void>((resolve) => {
+      harness.clientA.ws.once('close', () => resolve())
+      harness.clientA.ws.close()
+    })
+    const reconnectedA = await authenticate(harness.pairingUrlA)
+    sessions.push(reconnectedA)
+    const reconnectedReaderA = createReader(reconnectedA)
+    readers.push(reconnectedReaderA)
+    send(reconnectedA, { id: 'status-a2', method: 'status.get' })
+    await expect(reconnectedReaderA.next('status-a2')).resolves.toMatchObject({
+      ok: true,
+      result: { pairedDeviceId: harness.deviceIdA }
+    })
+  })
+
   it('keeps worktree navigation local to each paired runtime client by default', async () => {
     const harness = await startHarness()
     const clientSelections = {
diff --git a/src/main/runtime/orca-runtime-emulator-folder-workspace.test.ts b/src/main/runtime/orca-runtime-emulator-folder-workspace.test.ts
new file mode 100644
index 00000000000..23f7adc4df8
--- /dev/null
+++ b/src/main/runtime/orca-runtime-emulator-folder-workspace.test.ts
@@ -0,0 +1,161 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { EmulatorSessionInfo } from '../emulator/emulator-types'
+import type { FolderWorkspace } from '../../shared/types'
+import { OrcaRuntimeService } from './orca-runtime'
+
+const FOLDER_WORKSPACE_ID = 'folder-workspace-1'
+const FOLDER_WORKSPACE_KEY = `folder:${FOLDER_WORKSPACE_ID}`
+const EMULATOR_INFO: EmulatorSessionInfo = {
+  deviceUdid: 'emulator-5554',
+  streamUrl: 'scrcpy://emulator-5554',
+  wsUrl: '',
+  streamCodec: 'h264',
+  backend: 'android'
+}
+
+function makeFolderWorkspace(): FolderWorkspace {
+  return {
+    id: FOLDER_WORKSPACE_ID,
+    projectGroupId: 'project-group-1',
+    name: 'Mobile app',
+    folderPath: '/tmp/mobile-app',
+    linkedTask: null,
+    comment: '',
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 1,
+    createdAt: 1,
+    updatedAt: 1
+  }
+}
+
+describe('RuntimeEmulatorCommands folder workspace routing', () => {
+  it.each([FOLDER_WORKSPACE_KEY, `id:${FOLDER_WORKSPACE_KEY}`])(
+    'registers and publishes an attached device for selector %s',
+    async (selector) => {
+      const bridge = {
+        acquireHelperForDevice: vi.fn(async () => ({
+          info: EMULATOR_INFO,
+          release: vi.fn(async () => {})
+        })),
+        getReusableActiveForWorktree: vi.fn(async () => null),
+        registerActiveEmulator: vi.fn(),
+        stopActiveForSwitch: vi.fn(async () => null)
+      }
+      const send = vi.fn()
+      const runtime = new OrcaRuntimeService({
+        getFolderWorkspaces: () => [makeFolderWorkspace()],
+        getAllWorktreeMeta: () => new Map(),
+        getRepo: () => null,
+        getRepos: () => [],
+        getSettings: () => ({
+          mobileEmulatorEnabled: true,
+          mobileEmulatorDefaultDeviceUdid: null,
+          androidSdkPath: null
+        })
+      } as never)
+      runtime.setEmulatorBridge(bridge as never)
+      Object.assign(runtime, {
+        getAuthoritativeWindow: () => ({ webContents: { send } })
+      })
+
+      await expect(
+        runtime.emulatorAttach({
+          device: 'emulator-5554',
+          worktree: selector,
+          focus: true
+        })
+      ).resolves.toEqual({ attached: true, info: EMULATOR_INFO })
+
+      expect(bridge.acquireHelperForDevice).toHaveBeenCalledOnce()
+      expect(bridge.registerActiveEmulator).toHaveBeenCalledWith(
+        FOLDER_WORKSPACE_KEY,
+        EMULATOR_INFO,
+        { managed: true }
+      )
+      expect(send.mock.calls).toEqual([
+        ['ui:emulatorAutoAttach', { worktreeId: FOLDER_WORKSPACE_KEY, info: EMULATOR_INFO }],
+        ['emulator:pane-focus', { worktreeId: FOLDER_WORKSPACE_KEY }]
+      ])
+    }
+  )
+
+  it.each([FOLDER_WORKSPACE_KEY, `id:${FOLDER_WORKSPACE_KEY}`])(
+    'cleans up an active emulator after selector %s is deleted',
+    async (selector) => {
+      let folderWorkspaces = [makeFolderWorkspace()]
+      const shutdownActiveManagedForWorktree = vi.fn(async () => EMULATOR_INFO.deviceUdid)
+      const runtime = new OrcaRuntimeService({
+        getFolderWorkspaces: () => folderWorkspaces,
+        getAllWorktreeMeta: () => new Map(),
+        getRepo: () => null,
+        getRepos: () => [],
+        getSettings: () => ({ androidSdkPath: null })
+      } as never)
+      runtime.setEmulatorBridge({ shutdownActiveManagedForWorktree } as never)
+
+      folderWorkspaces = []
+
+      await expect(
+        runtime.emulatorShutdown({ worktree: selector, managedOnly: true })
+      ).resolves.toEqual({ ok: true, deviceUdid: EMULATOR_INFO.deviceUdid })
+      expect(shutdownActiveManagedForWorktree).toHaveBeenCalledWith(FOLDER_WORKSPACE_KEY)
+    }
+  )
+
+  it('cleans up an attach that finishes after its folder workspace is deleted', async () => {
+    let folderWorkspaces = [makeFolderWorkspace()]
+    const release = vi.fn(async () => {})
+    let finishHelperStart:
+      | ((lease: { info: EmulatorSessionInfo; release: typeof release }) => void)
+      | undefined
+    const bridge = {
+      acquireHelperForDevice: vi.fn(
+        () =>
+          new Promise<{ info: EmulatorSessionInfo; release: typeof release }>((resolve) => {
+            finishHelperStart = resolve
+          })
+      ),
+      getReusableActiveForWorktree: vi.fn(async () => null),
+      registerActiveEmulator: vi.fn(),
+      shutdownActiveManagedForWorktree: vi.fn(async () => null),
+      stopActiveForSwitch: vi.fn(async () => null)
+    }
+    const runtime = new OrcaRuntimeService({
+      getFolderWorkspaces: () => folderWorkspaces,
+      getAllWorktreeMeta: () => new Map(),
+      getRepo: () => null,
+      getRepos: () => [],
+      getSettings: () => ({
+        mobileEmulatorEnabled: true,
+        mobileEmulatorDefaultDeviceUdid: null,
+        androidSdkPath: null
+      })
+    } as never)
+    runtime.setEmulatorBridge(bridge as never)
+    Object.assign(runtime, {
+      getAuthoritativeWindow: () => ({ webContents: { send: vi.fn() } })
+    })
+
+    const attach = runtime.emulatorAttach({
+      device: EMULATOR_INFO.deviceUdid,
+      worktree: FOLDER_WORKSPACE_KEY
+    })
+    await vi.waitFor(() => expect(bridge.acquireHelperForDevice).toHaveBeenCalledOnce())
+    folderWorkspaces = []
+    await expect(
+      runtime.emulatorShutdown({ worktree: FOLDER_WORKSPACE_KEY, managedOnly: true })
+    ).resolves.toEqual({ ok: true, deviceUdid: undefined })
+    finishHelperStart?.({ info: EMULATOR_INFO, release })
+    await expect(attach).rejects.toMatchObject({
+      code: 'emulator_no_active',
+      message: 'The workspace changed while the emulator was starting. Reattach the emulator.'
+    })
+
+    expect(bridge.registerActiveEmulator).not.toHaveBeenCalled()
+    expect(bridge.shutdownActiveManagedForWorktree).toHaveBeenCalledWith(FOLDER_WORKSPACE_KEY)
+    expect(release).toHaveBeenCalledWith({ cleanupIfUnused: true })
+  })
+})
diff --git a/src/main/runtime/orca-runtime-emulator.ts b/src/main/runtime/orca-runtime-emulator.ts
index ac67464a533..7c82980c2a3 100644
--- a/src/main/runtime/orca-runtime-emulator.ts
+++ b/src/main/runtime/orca-runtime-emulator.ts
@@ -22,7 +22,8 @@ type EmulatorHostSettings = Pick<
 // Why: dedicated file for "one surface" separation (emulator), parallel to orca-runtime-browser.ts. Keeps OrcaRuntimeService focused; emulator routing easy to scan. No max-lines disable (split further if grows; per AGENTS + plan Phase 3).
 export type RuntimeEmulatorCommandHost = {
   getEmulatorBridge(): EmulatorBridge | null
-  resolveWorktreeSelector(selector: string): Promise<{ id: string }>
+  resolveEmulatorWorkspaceId(selector: string): Promise<string>
+  resolveEmulatorCleanupWorkspaceId(selector: string): Promise<string>
   getAuthoritativeWindow(): BrowserWindow
   getSettings(): EmulatorHostSettings
 }
@@ -157,13 +158,36 @@ export class RuntimeEmulatorCommands {
       // slow-to-boot Android emulator alive for instant switch-back.
       await bridge.stopActiveForSwitch(worktreeId)
     }
-    const info = await bridge.startHelperForDevice(device)
+    const lease = await bridge.acquireHelperForDevice(device)
+    const { info } = lease
     if (worktreeId) {
+      try {
+        const currentWorktreeId = await this.resolveWorktreeId(params.worktree)
+        if (currentWorktreeId !== worktreeId) {
+          throw new EmulatorError(
+            'emulator_no_active',
+            'The workspace changed while the emulator was starting. Reattach the emulator.'
+          )
+        }
+      } catch (error) {
+        // Why: the workspace can disappear while a slow Android device boots.
+        await lease.release({ cleanupIfUnused: true }).catch(() => {})
+        if (error instanceof Error && error.message === 'selector_not_found') {
+          throw new EmulatorError(
+            'emulator_no_active',
+            'The workspace changed while the emulator was starting. Reattach the emulator.'
+          )
+        }
+        throw error
+      }
       bridge.registerActiveEmulator(worktreeId, info, { managed: true })
+      await lease.release()
       this.notifyRendererEmulatorAutoAttach(worktreeId, info)
       if (params.focus) {
         this.notifyRendererEmulatorPaneFocus(worktreeId)
       }
+    } else {
+      await lease.release()
     }
     // Default: no auto steal (mirror browser tab create/switch). --focus sends emulator:pane-focus only when requested.
     return { attached: true, info }
@@ -176,7 +200,7 @@ export class RuntimeEmulatorCommands {
 
   async emulatorUnregisterActive(params: { worktree?: string }): Promise<{ ok: true }> {
     const bridge = this.requireEmulatorBridge()
-    const worktreeId = await this.resolveWorktreeId(params.worktree)
+    const worktreeId = await this.resolveCleanupWorktreeId(params.worktree)
     if (worktreeId) {
       bridge.unregisterActiveEmulator(worktreeId)
     }
@@ -203,7 +227,11 @@ export class RuntimeEmulatorCommands {
   }
 
   private async resolveWorktreeId(worktree?: string): Promise<string | undefined> {
-    return worktree ? (await this.host.resolveWorktreeSelector(worktree)).id : undefined
+    return worktree ? await this.host.resolveEmulatorWorkspaceId(worktree) : undefined
+  }
+
+  private async resolveCleanupWorktreeId(worktree?: string): Promise<string | undefined> {
+    return worktree ? await this.host.resolveEmulatorCleanupWorkspaceId(worktree) : undefined
   }
 
   async emulatorInstall(
@@ -272,7 +300,7 @@ export class RuntimeEmulatorCommands {
     worktree?: string
   }): Promise<{ ok: true; deviceUdid: string }> {
     const bridge = this.requireEmulatorBridge()
-    const worktreeId = await this.resolveWorktreeId(params.worktree)
+    const worktreeId = await this.resolveCleanupWorktreeId(params.worktree)
     const killedUdid = await bridge.kill(params.device ?? params.emulator, worktreeId)
     return { ok: true, deviceUdid: killedUdid }
   }
@@ -284,7 +312,7 @@ export class RuntimeEmulatorCommands {
     managedOnly?: boolean
   }): Promise<{ ok: true; deviceUdid?: string }> {
     const bridge = this.requireEmulatorBridge()
-    const worktreeId = await this.resolveWorktreeId(params.worktree)
+    const worktreeId = await this.resolveCleanupWorktreeId(params.worktree)
     if (params.managedOnly && worktreeId && !params.device && !params.emulator) {
       const shutdownUdid = await bridge.shutdownActiveManagedForWorktree(worktreeId)
       return { ok: true, deviceUdid: shutdownUdid ?? undefined }
diff --git a/src/main/runtime/orca-runtime-files.test.ts b/src/main/runtime/orca-runtime-files.test.ts
index e5c8a18479e..ce96eddb5e0 100644
--- a/src/main/runtime/orca-runtime-files.test.ts
+++ b/src/main/runtime/orca-runtime-files.test.ts
@@ -22,6 +22,7 @@ const {
   closeWatcherInWatcherProcessMock,
   checkRgAvailableMock,
   getLocalGitOptionsForRegisteredWorktreeMock,
+  searchWithGitGrepMock,
   wslAwareSpawnMock,
   watchMock
 } = vi.hoisted(() => ({
@@ -35,6 +36,7 @@ const {
   statMock: vi.fn(),
   watchInWatcherProcessMock: vi.fn(),
   closeWatcherInWatcherProcessMock: vi.fn(),
+  searchWithGitGrepMock: vi.fn(),
   wslAwareSpawnMock: vi.fn(),
   watchMock: vi.fn()
 }))
@@ -91,6 +93,10 @@ vi.mock('../ipc/local-worktree-runtime-options', () => ({
   getLocalGitOptionsForRegisteredWorktree: getLocalGitOptionsForRegisteredWorktreeMock
 }))
 
+vi.mock('../ipc/filesystem-search-git', () => ({
+  searchWithGitGrep: searchWithGitGrepMock
+}))
+
 vi.mock('../providers/ssh-filesystem-dispatch', () => ({
   getSshFilesystemProvider: vi.fn(),
   onSshFilesystemProviderRegistered: () => () => undefined,
@@ -202,6 +208,12 @@ function createRuntimeSearchChild(): MockRuntimeSearchChild {
   return child
 }
 
+async function flushRuntimeSearchMicrotasks(): Promise<void> {
+  for (let index = 0; index < 8; index++) {
+    await Promise.resolve()
+  }
+}
+
 describe('RuntimeFileCommands', () => {
   const originalPlatform = process.platform
 
@@ -217,6 +229,7 @@ describe('RuntimeFileCommands', () => {
     closeWatcherInWatcherProcessMock.mockReset()
     watchMock.mockReset()
     checkRgAvailableMock.mockReset()
+    searchWithGitGrepMock.mockReset()
     vi.mocked(getSshFilesystemProvider).mockReset()
     resetSshConnectionGenerations()
     getLocalGitOptionsForRegisteredWorktreeMock.mockReset()
@@ -754,6 +767,68 @@ describe('RuntimeFileCommands', () => {
     expect(child.stderr.listenerCount('data')).toBe(0)
     expect(child.listenerCount('error')).toBe(0)
     expect(child.listenerCount('close')).toBe(0)
+    expect(checkRgAvailableMock).not.toHaveBeenCalled()
+  })
+
+  it.each(['error-first', 'close-first'] as const)(
+    'falls back once when runtime rg native launch failure is %s',
+    async (order) => {
+      const resolveRuntimeFileTarget = vi.fn(async () => ({
+        worktree: { id: 'wt-1', repoId: 'repo-1', path: '/repo' },
+        connectionId: null
+      }))
+      const { commands } = createRuntimeFileCommands({ resolveRuntimeFileTarget })
+      const child = createRuntimeSearchChild()
+      Object.defineProperty(child, 'pid', { value: undefined })
+      resolveAuthorizedPathMock.mockResolvedValue('/repo')
+      wslAwareSpawnMock.mockReturnValue(child)
+      const fallback = { files: [], totalMatches: 0, truncated: false }
+      searchWithGitGrepMock.mockResolvedValue(fallback)
+
+      const resultPromise = commands.searchRuntimeFiles('id:wt-1', {
+        query: 'needle',
+        maxResults: 10
+      })
+      await flushRuntimeSearchMicrotasks()
+      const error = Object.assign(new Error('spawn rg ENOENT'), { code: 'ENOENT' })
+      if (order === 'error-first') {
+        expect(() => child.emit('error', error)).not.toThrow()
+        child.emit('close', -2, null)
+      } else {
+        child.emit('close', -2, null)
+        expect(() => child.emit('error', error)).not.toThrow()
+      }
+
+      await expect(resultPromise).resolves.toBe(fallback)
+      expect(searchWithGitGrepMock).toHaveBeenCalledTimes(1)
+      expect(checkRgAvailableMock).not.toHaveBeenCalled()
+      expect(child.listenerCount('error')).toBe(0)
+      expect(child.listenerCount('close')).toBe(0)
+    }
+  )
+
+  it("falls back when a runtime native launcher exits outside ripgrep's contract", async () => {
+    const resolveRuntimeFileTarget = vi.fn(async () => ({
+      worktree: { id: 'wt-1', repoId: 'repo-1', path: '/repo' },
+      connectionId: null
+    }))
+    const { commands } = createRuntimeFileCommands({ resolveRuntimeFileTarget })
+    const child = createRuntimeSearchChild()
+    Object.defineProperty(child, 'pid', { value: 1 })
+    resolveAuthorizedPathMock.mockResolvedValue('/repo')
+    wslAwareSpawnMock.mockReturnValue(child)
+    const fallback = { files: [], totalMatches: 0, truncated: false }
+    searchWithGitGrepMock.mockResolvedValue(fallback)
+
+    const resultPromise = commands.searchRuntimeFiles('id:wt-1', {
+      query: 'needle',
+      maxResults: 10
+    })
+    await flushRuntimeSearchMicrotasks()
+    child.emit('close', 127, null)
+
+    await expect(resultPromise).resolves.toBe(fallback)
+    expect(searchWithGitGrepMock).toHaveBeenCalledTimes(1)
   })
 
   it('routes runtime rg searches through the registered WSL project runtime', async () => {
@@ -767,6 +842,7 @@ describe('RuntimeFileCommands', () => {
     }))
     const { commands, store } = createRuntimeFileCommands({ resolveRuntimeFileTarget })
     const child = createRuntimeSearchChild()
+    Object.defineProperty(child, 'pid', { value: 1 })
     resolveAuthorizedPathMock.mockResolvedValue('C:\\repo')
     checkRgAvailableMock.mockResolvedValue(true)
     getLocalGitOptionsForRegisteredWorktreeMock.mockReturnValue({ wslDistro: 'Ubuntu' })
@@ -779,7 +855,7 @@ describe('RuntimeFileCommands', () => {
     await Promise.resolve()
     await Promise.resolve()
     await Promise.resolve()
-    child.emit('close')
+    child.emit('close', 127, null)
 
     await expect(resultPromise).resolves.toMatchObject({ files: [] })
     expect(getLocalGitOptionsForRegisteredWorktreeMock).toHaveBeenCalledWith(
@@ -788,6 +864,7 @@ describe('RuntimeFileCommands', () => {
       'C:\\repo'
     )
     expect(checkRgAvailableMock).toHaveBeenCalledWith('C:\\repo', 'Ubuntu')
+    expect(searchWithGitGrepMock).not.toHaveBeenCalled()
     expect(wslAwareSpawnMock).toHaveBeenCalledWith(
       'rg',
       expect.any(Array),
@@ -798,6 +875,25 @@ describe('RuntimeFileCommands', () => {
     )
   })
 
+  it('keeps the runtime WSL preflight and falls back before starting real rg', async () => {
+    const resolveRuntimeFileTarget = vi.fn(async () => ({
+      worktree: { id: 'wt-1', repoId: 'repo-1', path: 'C:\\repo' },
+      connectionId: null
+    }))
+    const { commands } = createRuntimeFileCommands({ resolveRuntimeFileTarget })
+    const fallback = { files: [], totalMatches: 0, truncated: false }
+    resolveAuthorizedPathMock.mockResolvedValue('C:\\repo')
+    getLocalGitOptionsForRegisteredWorktreeMock.mockReturnValue({ wslDistro: 'Ubuntu' })
+    checkRgAvailableMock.mockResolvedValue(false)
+    searchWithGitGrepMock.mockResolvedValue(fallback)
+
+    await expect(
+      commands.searchRuntimeFiles('id:wt-1', { query: 'needle', maxResults: 10 })
+    ).resolves.toBe(fallback)
+    expect(checkRgAvailableMock).toHaveBeenCalledWith('C:\\repo', 'Ubuntu')
+    expect(wslAwareSpawnMock).not.toHaveBeenCalled()
+  })
+
   describe('resolveTerminalPath', () => {
     let tempDirs: string[] = []
 
diff --git a/src/main/runtime/orca-runtime-files.ts b/src/main/runtime/orca-runtime-files.ts
index 68000f1b297..f85bff8abde 100644
--- a/src/main/runtime/orca-runtime-files.ts
+++ b/src/main/runtime/orca-runtime-files.ts
@@ -58,6 +58,11 @@ import { listQuickOpenFiles } from '../ipc/filesystem-list-files'
 import { searchWithGitGrep } from '../ipc/filesystem-search-git'
 import { getLocalGitOptionsForRegisteredWorktree } from '../ipc/local-worktree-runtime-options'
 import { checkRgAvailable } from '../ipc/rg-availability'
+import {
+  absorbPendingRipgrepSpawnError,
+  isRipgrepUnavailableExit,
+  killSpawnedRipgrepProcess
+} from '../../shared/ripgrep-process-availability'
 import {
   listMarkdownDocuments,
   markdownDocumentsFromRelativePaths
@@ -1920,26 +1925,33 @@ export class RuntimeFileCommands {
       1,
       Math.min(options.maxResults ?? DEFAULT_SEARCH_MAX_RESULTS, DEFAULT_SEARCH_MAX_RESULTS)
     )
-    const rgAvailable = await checkRgAvailable(authorizedRootPath, localGitOptions.wslDistro)
-    if (!rgAvailable) {
+    const wslInfo = parseWslPath(authorizedRootPath)
+    if (
+      (wslInfo || localGitOptions.wslDistro) &&
+      !(await checkRgAvailable(authorizedRootPath, localGitOptions.wslDistro))
+    ) {
       return searchWithGitGrep(authorizedRootPath, options, maxResults, localGitOptions)
     }
 
-    return new Promise((resolvePromise) => {
+    return new Promise<SearchResult>((resolvePromise) => {
       const searchKey = `${this.host.getRuntimeId()}:${authorizedRootPath}`
       const rgArgs = buildRgArgs(options.query, authorizedRootPath, options)
-      this.activeRuntimeTextSearches.get(searchKey)?.kill()
+      const previousChild = this.activeRuntimeTextSearches.get(searchKey)
+      if (previousChild) {
+        killSpawnedRipgrepProcess(previousChild)
+      }
 
       const acc = createAccumulator()
       let stdoutBuffer = ''
       let resolved = false
+      let processErrorObserved = false
+      let unavailableExitObserved = false
       let child: ChildProcess | null = null
-      const wslInfo = parseWslPath(authorizedRootPath)
       const transformAbsPath = wslInfo
         ? (p: string): string => toWindowsWslPath(p, wslInfo.distro)
         : undefined
 
-      const resolveOnce = (): void => {
+      const finish = (result: SearchResult | PromiseLike<SearchResult>): void => {
         if (resolved) {
           return
         }
@@ -1948,8 +1960,11 @@ export class RuntimeFileCommands {
           this.activeRuntimeTextSearches.delete(searchKey)
         }
         cleanupListeners()
-        resolvePromise(finalize(acc))
+        resolvePromise(result)
       }
+      const resolveOnce = (): void => finish(finalize(acc))
+      const resolveWithoutRipgrep = (): void =>
+        finish(searchWithGitGrep(authorizedRootPath, options, maxResults, localGitOptions))
 
       let killTimeout: ReturnType<typeof setTimeout> | null = null
       const cleanupListeners = (): void => {
@@ -1961,6 +1976,12 @@ export class RuntimeFileCommands {
         child?.stderr?.off('data', onStderrData)
         child?.off('error', onError)
         child?.off('close', onClose)
+        if (child) {
+          absorbPendingRipgrepSpawnError(child, {
+            errorObserved: processErrorObserved,
+            unavailableExitObserved
+          })
+        }
       }
 
       const processLine = (line: string): void => {
@@ -1971,8 +1992,8 @@ export class RuntimeFileCommands {
           maxResults,
           transformAbsPath
         )
-        if (verdict === 'stop') {
-          child?.kill()
+        if (verdict === 'stop' && child) {
+          killSpawnedRipgrepProcess(child)
         }
       }
 
@@ -1996,8 +2017,25 @@ export class RuntimeFileCommands {
       const onStderrData = (): void => {
         // Drain stderr so rg cannot block on a full pipe.
       }
-      const onError = (): void => resolveOnce()
-      const onClose = (): void => {
+      const onError = (): void => {
+        processErrorObserved = true
+        if (child && isRipgrepUnavailableExit(child, null, null)) {
+          resolveWithoutRipgrep()
+          return
+        }
+        resolveOnce()
+      }
+      const onClose = (code: number | null, signal: NodeJS.Signals | null): void => {
+        if (
+          child &&
+          isRipgrepUnavailableExit(child, code, signal, {
+            classifyNativeLauncherExit: !(wslInfo || localGitOptions.wslDistro)
+          })
+        ) {
+          unavailableExitObserved = true
+          resolveWithoutRipgrep()
+          return
+        }
         if (stdoutBuffer) {
           processLine(stdoutBuffer)
         }
@@ -2011,7 +2049,9 @@ export class RuntimeFileCommands {
 
       killTimeout = setTimeout(() => {
         acc.truncated = true
-        child?.kill()
+        if (child) {
+          killSpawnedRipgrepProcess(child)
+        }
         resolveOnce()
       }, SEARCH_TIMEOUT_MS)
     })
diff --git a/src/main/runtime/orca-runtime-git-branch-diff.test.ts b/src/main/runtime/orca-runtime-git-branch-diff.test.ts
new file mode 100644
index 00000000000..4c469758760
--- /dev/null
+++ b/src/main/runtime/orca-runtime-git-branch-diff.test.ts
@@ -0,0 +1,69 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { GlobalSettings } from '../../shared/types'
+import { RuntimeGitCommands, type ResolvedRuntimeGitWorktree } from './orca-runtime-git'
+
+const getSshGitProviderMock = vi.hoisted(() => vi.fn())
+
+vi.mock('../providers/ssh-git-dispatch', () => ({
+  getSshGitProvider: getSshGitProviderMock
+}))
+
+function makeWorktree(path: string): ResolvedRuntimeGitWorktree {
+  const worktree = {
+    id: 'wt-1',
+    repoId: 'repo-1',
+    path,
+    linkedIssue: null,
+    git: {
+      path,
+      branch: 'main',
+      isBare: false,
+      isMainWorktree: false,
+      head: 'a'.repeat(40)
+    }
+  } satisfies Partial<ResolvedRuntimeGitWorktree>
+  return worktree as unknown as ResolvedRuntimeGitWorktree
+}
+
+describe('RuntimeGitCommands branch diff', () => {
+  beforeEach(() => {
+    getSshGitProviderMock.mockReset()
+  })
+
+  it('forwards the pinned head through normalized nested SSH paths', async () => {
+    const mergeBase = 'a'.repeat(40)
+    const headOid = 'b'.repeat(40)
+    const result = {
+      kind: 'text',
+      originalContent: 'left',
+      modifiedContent: 'right',
+      originalIsBinary: false,
+      modifiedIsBinary: false
+    }
+    const provider = { getBranchDiff: vi.fn().mockResolvedValue([result]) }
+    getSshGitProviderMock.mockReturnValue(provider)
+    const commands = new RuntimeGitCommands({
+      resolveRuntimeGitTarget: async () => ({
+        worktree: makeWorktree('/remote/repo'),
+        connectionId: 'conn-1'
+      }),
+      getRuntimeSettings: () => ({}) as GlobalSettings
+    })
+
+    await expect(
+      commands.getRuntimeGitBranchDiff(
+        'id:wt-1',
+        { mergeBase, headOid },
+        'src\\file.ts',
+        'src\\old-file.ts'
+      )
+    ).resolves.toEqual(result)
+
+    expect(provider.getBranchDiff).toHaveBeenCalledWith('/remote/repo', mergeBase, {
+      includePatch: true,
+      headOid,
+      filePath: 'src/file.ts',
+      oldPath: 'src/old-file.ts'
+    })
+  })
+})
diff --git a/src/main/runtime/orca-runtime-git.ts b/src/main/runtime/orca-runtime-git.ts
index 88fb102f7e9..022b53ac948 100644
--- a/src/main/runtime/orca-runtime-git.ts
+++ b/src/main/runtime/orca-runtime-git.ts
@@ -79,7 +79,7 @@ import type {
 import { prepareLocalCommitMessageAgentEnv } from '../text-generation/commit-message-agent-environment'
 import { getPullRequestDraftContext } from '../text-generation/pull-request-context'
 import { normalizeRuntimeRelativePath } from './runtime-relative-paths'
-import { gitExecFileAsync } from '../git/runner'
+import { awaitWindowsHostGitEnvironmentReady, gitExecFileAsync } from '../git/runner'
 import type { GitRuntimeOptions } from '../git/git-runtime-options'
 import { resolveHostedReviewBodyForGeneration } from '../source-control/pull-request-template'
 import {
@@ -538,6 +538,7 @@ export class RuntimeGitCommands {
       }
       const results = await provider.getBranchDiff(target.worktree.path, compare.mergeBase, {
         includePatch: true,
+        headOid: compare.headOid,
         filePath: relativePath,
         oldPath: oldRelativePath
       })
@@ -985,6 +986,7 @@ export class RuntimeGitCommands {
       }
       return provider.getRemoteFileUrl(target.worktree.path, normalizedRelativePath, line)
     }
+    await awaitWindowsHostGitEnvironmentReady({ cwd: target.worktree.path })
     return getRemoteFileUrl(target.worktree.path, normalizedRelativePath, line)
   }
 
@@ -1000,6 +1002,7 @@ export class RuntimeGitCommands {
       }
       return provider.getRemoteCommitUrl(target.worktree.path, sha)
     }
+    await awaitWindowsHostGitEnvironmentReady({ cwd: target.worktree.path })
     return getRemoteCommitUrl(target.worktree.path, sha)
   }
 }
diff --git a/src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts b/src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts
index 47715ea7c5d..7981366cadb 100644
--- a/src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts
+++ b/src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts
@@ -230,6 +230,65 @@ describe('headless hook agent-status projection (#11761)', () => {
     )
   })
 
+  it('does not carry a shell-obscured question into the next working interval', async () => {
+    const rows = [hookRow()]
+    const runtime = await createRuntimeWithHookRows(rows)
+    const questionAt = rows[0]!.receivedAt
+    const dateNow = vi.spyOn(Date, 'now').mockReturnValue(questionAt + 1)
+    try {
+      const initial = await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
+      const initialTab = initial.tabs[0]
+      if (initialTab?.type !== 'terminal' || !initialTab.terminal) {
+        throw new Error('expected a live terminal handle')
+      }
+      await runtime.renameTerminal(initialTab.terminal, 'bash')
+      observePaneTitle(runtime, 'bash')
+      let result = await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
+      let tab = result.tabs[0]
+      expect(tab?.type === 'terminal' && tab.agentStatus).toEqual(
+        expect.objectContaining({ state: 'waiting', interactivePrompt: ASK_PROMPT })
+      )
+
+      dateNow.mockReturnValue(questionAt + 2)
+      observePaneTitle(runtime, '⠋ Claude')
+      result = await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
+      tab = result.tabs[0]
+      expect(tab?.type === 'terminal' && tab.agentStatus).toEqual(
+        expect.objectContaining({ state: 'working', prompt: '' })
+      )
+      expect(tab?.type === 'terminal' && tab.agentStatus).not.toHaveProperty('interactivePrompt')
+    } finally {
+      dateNow.mockRestore()
+    }
+  })
+
+  it('does not carry a hook question across a provider generation reset', async () => {
+    const runtime = await createRuntimeWithHookRows([hookRow()])
+    const internals = runtime as unknown as {
+      ptysById: Map<string, { title: string | null }>
+      resetTrackedTerminalStateForProviderGeneration: (ptyId: string) => void
+    }
+    internals.ptysById.get(PTY_ID)!.title = 'bash'
+    internals.resetTrackedTerminalStateForProviderGeneration(PTY_ID)
+
+    const result = await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
+    const tab = result.tabs[0]
+    expect(tab?.type === 'terminal' && tab.agentStatus).not.toHaveProperty('interactivePrompt')
+  })
+
+  it('does not carry a hook question across an identity-only owner title', async () => {
+    const runtime = await createRuntimeWithHookRows([hookRow()])
+    const internals = runtime as unknown as {
+      ptysById: Map<string, { title: string | null }>
+    }
+    internals.ptysById.get(PTY_ID)!.title = 'bash'
+    observePaneTitle(runtime, 'Cursor Agent')
+
+    const result = await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
+    const tab = result.tabs[0]
+    expect(tab?.type === 'terminal' && tab.agentStatus).not.toHaveProperty('interactivePrompt')
+  })
+
   // The title path is refreshed live; an older hook `done` must not erase it.
   it('keeps the title-derived working state when the hook row predates the title', async () => {
     const now = Date.now()
diff --git a/src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts b/src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts
new file mode 100644
index 00000000000..06a5f1cfcd0
--- /dev/null
+++ b/src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts
@@ -0,0 +1,89 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { PtyProcessInfo } from '../providers/pty-process-info'
+import { OrcaRuntimeService } from './orca-runtime'
+
+const SSH_SCOPE = JSON.stringify({ kind: 'ssh', targetId: 'ssh-1' })
+const PROCESS_INCARNATION = 'remote:ssh-1:pty-1:inc-1'
+
+function runtimeWithInventory(
+  listProcesses: (connectionId?: string | null) => Promise<PtyProcessInfo[]>
+): OrcaRuntimeService {
+  const runtime = new OrcaRuntimeService()
+  runtime.setPtyController({
+    write: () => true,
+    kill: () => true,
+    getForegroundProcess: async () => null,
+    listProcesses
+  })
+  return runtime
+}
+
+describe('terminal process incarnation liveness', () => {
+  it('classifies only an exact incarnation as live on its owning provider', async () => {
+    const listProcesses = vi.fn().mockResolvedValue([
+      {
+        id: 'remote:ssh-1:pty-1',
+        incarnationId: 'inc-1',
+        cwd: '',
+        title: 'worker'
+      }
+    ])
+    const runtime = runtimeWithInventory(listProcesses)
+
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness(PROCESS_INCARNATION, SSH_SCOPE)
+    ).resolves.toBe('live')
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness('remote:ssh-1:pty-1:inc-old', SSH_SCOPE)
+    ).resolves.toBe('dead')
+    expect(listProcesses).toHaveBeenNthCalledWith(1, 'ssh-1')
+    expect(listProcesses).toHaveBeenNthCalledWith(2, 'ssh-1')
+  })
+
+  it('keeps missing or malformed identity and unavailable inventory unknown', async () => {
+    const listProcesses = vi
+      .fn()
+      .mockResolvedValueOnce([{ id: 'remote:ssh-1:pty-1', cwd: '', title: 'worker' }])
+      .mockResolvedValueOnce([
+        { id: 'remote:ssh-1:pty-1', incarnationId: ' inc-1 ', cwd: '', title: 'worker' }
+      ])
+      .mockRejectedValueOnce(new Error('provider unavailable'))
+    const runtime = runtimeWithInventory(listProcesses)
+
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness(PROCESS_INCARNATION, SSH_SCOPE)
+    ).resolves.toBe('unknown')
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness(PROCESS_INCARNATION, SSH_SCOPE)
+    ).resolves.toBe('unknown')
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness(PROCESS_INCARNATION, SSH_SCOPE)
+    ).resolves.toBe('unknown')
+  })
+
+  it('does not inspect an unproven host scope', async () => {
+    const listProcesses = vi.fn().mockResolvedValue([])
+    const runtime = runtimeWithInventory(listProcesses)
+
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness(PROCESS_INCARNATION, null)
+    ).resolves.toBe('unknown')
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness(PROCESS_INCARNATION, '{"kind":"ssh"}')
+    ).resolves.toBe('unknown')
+    expect(listProcesses).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    [{ kind: 'local', hostId: 'local' }, null],
+    [{ kind: 'wsl', hostId: 'local', distro: 'Ubuntu' }, null]
+  ] as const)('uses the local provider inventory for %s scope', async (scope, connectionId) => {
+    const listProcesses = vi.fn().mockResolvedValue([])
+    const runtime = runtimeWithInventory(listProcesses)
+
+    await expect(
+      runtime.inspectTerminalProcessIncarnationLiveness('local-pty:inc-1', JSON.stringify(scope))
+    ).resolves.toBe('dead')
+    expect(listProcesses).toHaveBeenCalledWith(connectionId)
+  })
+})
diff --git a/src/main/runtime/orca-runtime-terminal-split-authority.test.ts b/src/main/runtime/orca-runtime-terminal-split-authority.test.ts
new file mode 100644
index 00000000000..c13f8825380
--- /dev/null
+++ b/src/main/runtime/orca-runtime-terminal-split-authority.test.ts
@@ -0,0 +1,188 @@
+import { describe, expect, it, vi } from 'vitest'
+import { getDefaultWorkspaceSession } from '../../shared/constants'
+import type { RuntimeMobileSessionTabsSnapshot } from '../../shared/runtime-types'
+import type { TerminalLayoutSnapshot, WorkspaceSessionState } from '../../shared/types'
+import { makePaneKey } from '../../shared/stable-pane-id'
+import { OrcaRuntimeService } from './orca-runtime'
+
+const REPO_ID = 'repo-1'
+const WORKTREE_ID = `${REPO_ID}::/workspace`
+const TAB_ID = 'tab-remote'
+const SOURCE_LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const SOURCE_PTY_ID = 'pty-source'
+const SPLIT_PTY_ID = 'pty-split'
+
+function sourceLayout(): TerminalLayoutSnapshot {
+  return {
+    root: { type: 'leaf', leafId: SOURCE_LEAF_ID },
+    activeLeafId: SOURCE_LEAF_ID,
+    expandedLeafId: null,
+    ptyIdsByLeafId: { [SOURCE_LEAF_ID]: SOURCE_PTY_ID }
+  }
+}
+
+function persistedSession(includeSource = true): WorkspaceSessionState {
+  return {
+    ...getDefaultWorkspaceSession(),
+    tabsByWorktree: includeSource
+      ? {
+          [WORKTREE_ID]: [
+            {
+              id: TAB_ID,
+              ptyId: SOURCE_PTY_ID,
+              worktreeId: WORKTREE_ID,
+              title: 'Remote terminal',
+              customTitle: null,
+              color: null,
+              sortOrder: 0,
+              createdAt: 1
+            }
+          ]
+        }
+      : {},
+    terminalLayoutsByTabId: includeSource ? { [TAB_ID]: sourceLayout() } : {}
+  }
+}
+
+function remoteSnapshot(): RuntimeMobileSessionTabsSnapshot {
+  const layout = sourceLayout()
+  return {
+    worktree: WORKTREE_ID,
+    publicationEpoch: 'remote-viewer',
+    snapshotVersion: 1,
+    activeGroupId: 'group-1',
+    activeTabId: `${TAB_ID}::${SOURCE_LEAF_ID}`,
+    activeTabType: 'terminal',
+    tabGroups: [{ id: 'group-1', activeTabId: TAB_ID, tabOrder: [TAB_ID] }],
+    tabs: [
+      {
+        type: 'terminal',
+        id: `${TAB_ID}::${SOURCE_LEAF_ID}`,
+        parentTabId: TAB_ID,
+        leafId: SOURCE_LEAF_ID,
+        ptyId: SOURCE_PTY_ID,
+        title: 'Remote terminal',
+        parentLayout: layout,
+        isActive: true
+      }
+    ]
+  }
+}
+
+function createHarness(includeSource = true) {
+  let session = persistedSession(includeSource)
+  const repo = {
+    id: REPO_ID,
+    path: '/workspace',
+    displayName: 'repo',
+    badgeColor: 'blue',
+    addedAt: 1
+  }
+  const store = {
+    getRepos: () => [repo],
+    getRepo: (id: string) => (id === REPO_ID ? repo : undefined),
+    getWorkspaceSession: () => session,
+    setWorkspaceSession: (next: WorkspaceSessionState) => {
+      session = next
+    },
+    persistPtyBinding: () => true
+  }
+  const spawn = vi.fn(async () => ({ id: SPLIT_PTY_ID }))
+  const kill = vi.fn(() => true)
+  const revealTerminalSession = vi
+    .fn()
+    .mockRejectedValue(new Error(`Terminal tab ${TAB_ID} not found`))
+  const runtime = new OrcaRuntimeService(store as never)
+  Object.assign(runtime, {
+    resolveTerminalWorkspaceLaunchScope: vi.fn(async () => ({
+      id: WORKTREE_ID,
+      path: '/workspace',
+      connectionId: null,
+      repo,
+      folderWorkspace: null
+    }))
+  })
+  runtime.setPtyController({
+    spawn,
+    write: () => true,
+    kill,
+    getForegroundProcess: async () => null
+  })
+  runtime.setNotifier({ revealTerminalSession } as never)
+  runtime.syncWindowGraph(1, {
+    tabs: [],
+    leaves: [],
+    mobileSessionTabs: includeSource ? [remoteSnapshot()] : []
+  })
+  runtime.registerPty(SOURCE_PTY_ID, WORKTREE_ID, null, {
+    tabId: TAB_ID,
+    leafId: SOURCE_LEAF_ID
+  })
+  const internals = runtime as unknown as {
+    getTerminalHandleForPaneKey: (paneKey: string) => string | null
+    issuePtyHandle: (pty: unknown) => string
+    mobileSessionTabsByWorktree: Map<string, RuntimeMobileSessionTabsSnapshot>
+    ptysById: Map<string, unknown>
+  }
+  const handle =
+    internals.getTerminalHandleForPaneKey(makePaneKey(TAB_ID, SOURCE_LEAF_ID)) ??
+    internals.issuePtyHandle(internals.ptysById.get(SOURCE_PTY_ID))
+  return {
+    runtime,
+    handle,
+    spawn,
+    kill,
+    revealTerminalSession,
+    getSession: () => session,
+    getSnapshot: () => internals.mobileSessionTabsByWorktree.get(WORKTREE_ID)
+  }
+}
+
+describe('remote runtime terminal split authority', () => {
+  it('splits a persisted tab without consulting an unmounted host renderer', async () => {
+    const harness = createHarness()
+
+    const outcome = await harness.runtime
+      .splitTerminal(harness.handle, { direction: 'vertical' })
+      .then((split) => ({ ok: true as const, split }))
+      .catch((error: unknown) => ({ ok: false as const, error }))
+
+    expect.soft(outcome).toMatchObject({
+      ok: true,
+      split: { tabId: TAB_ID, handle: expect.stringMatching(/^term_/) }
+    })
+    expect.soft(harness.spawn).toHaveBeenCalledTimes(1)
+    expect.soft(harness.kill).not.toHaveBeenCalled()
+    expect.soft(harness.revealTerminalSession).not.toHaveBeenCalled()
+    const persistedLayout = harness.getSession().terminalLayoutsByTabId[TAB_ID]
+    expect(persistedLayout).toMatchObject({
+      root: { type: 'split', direction: 'vertical' },
+      ptyIdsByLeafId: {
+        [SOURCE_LEAF_ID]: SOURCE_PTY_ID
+      }
+    })
+    expect(Object.values(persistedLayout!.ptyIdsByLeafId!)).toContain(SPLIT_PTY_ID)
+    const siblingSurfaces = harness
+      .getSnapshot()!
+      .tabs.filter(
+        (tab): tab is Extract<typeof tab, { type: 'terminal' }> =>
+          tab.type === 'terminal' && tab.parentTabId === TAB_ID
+      )
+    expect(siblingSurfaces).toHaveLength(2)
+    expect(siblingSurfaces.every((tab) => tab.parentLayout?.root?.type === 'split')).toBe(true)
+  })
+
+  it('rejects an unowned split source before spawning a PTY', async () => {
+    const harness = createHarness(false)
+
+    const outcome = await harness.runtime
+      .splitTerminal(harness.handle, { direction: 'vertical' })
+      .then(() => 'resolved')
+      .catch((error: unknown) => (error instanceof Error ? error.message : String(error)))
+
+    expect.soft(outcome).toBe('terminal_split_source_not_found')
+    expect.soft(harness.spawn).not.toHaveBeenCalled()
+    expect.soft(harness.kill).not.toHaveBeenCalled()
+    expect.soft(harness.revealTerminalSession).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/orca-runtime.test.ts b/src/main/runtime/orca-runtime.test.ts
index 90a40f9da06..ec4d930ad79 100644
--- a/src/main/runtime/orca-runtime.test.ts
+++ b/src/main/runtime/orca-runtime.test.ts
@@ -234,6 +234,7 @@ const {
   invalidateAuthorizedRootsCacheMock,
   prepareLocalWorktreeRootForRepoMock,
   createHostedReviewMock,
+  createStackedHostedReviewMock,
   getHostedReviewCreationEligibilityMock,
   getHostedReviewForBranchMock,
   getPRForBranchMock,
@@ -341,6 +342,7 @@ const {
     invalidateAuthorizedRootsCacheMock: vi.fn(),
     prepareLocalWorktreeRootForRepoMock: vi.fn(),
     createHostedReviewMock: vi.fn(),
+    createStackedHostedReviewMock: vi.fn(),
     getHostedReviewCreationEligibilityMock: vi.fn(),
     getHostedReviewForBranchMock: vi.fn(),
     getPRForBranchMock: vi.fn().mockResolvedValue(null),
@@ -513,6 +515,10 @@ vi.mock('../source-control/hosted-review-creation', () => ({
   getHostedReviewCreationEligibility: getHostedReviewCreationEligibilityMock
 }))
 
+vi.mock('../source-control/stacked-hosted-review-creation', () => ({
+  createStackedHostedReview: createStackedHostedReviewMock
+}))
+
 vi.mock('../source-control/hosted-review', () => ({
   getHostedReviewForBranch: getHostedReviewForBranchMock
 }))
@@ -732,6 +738,14 @@ function resetRuntimeTestMocks(): void {
     number: 1,
     url: 'https://example.com/pull/1'
   })
+  createStackedHostedReviewMock.mockReset()
+  createStackedHostedReviewMock.mockResolvedValue({
+    ok: true,
+    number: 2,
+    url: 'https://example.com/pull/2',
+    stackNumber: 10,
+    parentReview: { number: 1, url: 'https://example.com/pull/1' }
+  })
   getHostedReviewCreationEligibilityMock.mockReset()
   getHostedReviewCreationEligibilityMock.mockResolvedValue({
     provider: 'github',
@@ -1511,6 +1525,7 @@ function makeRuntimeStoreWithWorkspaceSession(
             }
           }
         }
+        return true
       }
     )
   }
@@ -3310,6 +3325,37 @@ describe('OrcaRuntimeService', () => {
     expect(split.tabs.filter((tab) => tab.type === 'terminal')).toHaveLength(2)
   })
 
+  it('resolves projected split authority from the parent layout PTY binding', () => {
+    const runtime = createRuntime()
+    const tabId = 'projected-parent-tab'
+    const leafId = 'projected-leaf'
+    const ptyId = 'projected-pty'
+    const internals = runtime as unknown as {
+      mobileSessionTabsByWorktree: Map<string, unknown>
+      resolveTerminalSplitSourceAuthority: (
+        worktreeId: string,
+        tabId: string,
+        leafId: string,
+        ptyId: string
+      ) => { persisted: boolean; rendererMounted: boolean } | null
+    }
+    internals.mobileSessionTabsByWorktree.set(TEST_WORKTREE_ID, {
+      tabs: [
+        {
+          type: 'terminal',
+          parentTabId: tabId,
+          leafId,
+          ptyId: null,
+          parentLayout: { ptyIdsByLeafId: { [leafId]: ptyId } }
+        }
+      ]
+    })
+
+    expect(
+      internals.resolveTerminalSplitSourceAuthority(TEST_WORKTREE_ID, tabId, leafId, ptyId)
+    ).toMatchObject({ persisted: false, rendererMounted: false })
+  })
+
   it('keeps targeted terminal lists from adopting controller PTYs for other worktrees', async () => {
     vi.mocked(listWorktrees).mockResolvedValue([
       ...MOCK_GIT_WORKTREES,
@@ -6636,6 +6682,24 @@ describe('OrcaRuntimeService', () => {
     )
   })
 
+  it('forwards check-details cancellation without local Git overrides', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    const signal = new AbortController().signal
+
+    await runtime.getRepoPRCheckDetails('id:repo-1', { checkRunId: 9 }, signal)
+
+    expect(getGitHubPRCheckDetailsMock).toHaveBeenCalledWith(
+      TEST_REPO_PATH,
+      {
+        checkRunId: 9,
+        prRepo: null
+      },
+      null,
+      {},
+      signal
+    )
+  })
+
   it('routes runtime GitHub PR details and actions through the selected WSL project runtime', async () => {
     setPlatform('win32')
     const runtimeStore = {
@@ -6659,6 +6723,7 @@ describe('OrcaRuntimeService', () => {
     const runtime = new OrcaRuntimeService(runtimeStore as never)
     const localGitOptions = { wslDistro: 'Ubuntu' }
     const prRepo = { owner: 'acme', repo: 'orca', host: 'github.acme.test' }
+    const checkDetailsSignal = new AbortController().signal
 
     await runtime.getRepoPRForBranch('id:repo-1', 'feature/wsl', 42, 43)
     await runtime.getRepoWorkItem('id:repo-1', 42, 'pr')
@@ -6670,13 +6735,17 @@ describe('OrcaRuntimeService', () => {
       failedOnly: true,
       prRepo
     })
-    await runtime.getRepoPRCheckDetails('id:repo-1', {
-      checkRunId: 9,
-      workflowRunId: 8,
-      checkName: 'lint',
-      url: 'https://example.com/check',
-      prRepo
-    })
+    await runtime.getRepoPRCheckDetails(
+      'id:repo-1',
+      {
+        checkRunId: 9,
+        workflowRunId: 8,
+        checkName: 'lint',
+        url: 'https://example.com/check',
+        prRepo
+      },
+      checkDetailsSignal
+    )
     await runtime.getRepoPRComments('id:repo-1', 42, prRepo, { noCache: true })
     await runtime.getRepoPRFileContents('id:repo-1', {
       prNumber: 42,
@@ -6778,7 +6847,8 @@ describe('OrcaRuntimeService', () => {
         prRepo
       },
       null,
-      localGitOptions
+      localGitOptions,
+      checkDetailsSignal
     )
     expect(getGitHubPRCommentsMock).toHaveBeenCalledWith(
       TEST_REPO_PATH,
@@ -6981,6 +7051,15 @@ describe('OrcaRuntimeService', () => {
       body: '',
       draft: false
     })
+    await runtime.createStackedHostedReview({
+      repoSelector: `id:${TEST_REPO_ID}`,
+      provider: 'github',
+      base: 'stack/parent',
+      head: 'feature/ssh',
+      title: 'Feature SSH',
+      body: '',
+      draft: false
+    })
 
     expect(getHostedReviewCreationEligibilityMock).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -6998,6 +7077,16 @@ describe('OrcaRuntimeService', () => {
       }),
       'ssh-1'
     )
+    expect(createStackedHostedReviewMock).toHaveBeenCalledWith(
+      '/remote/repo',
+      expect.objectContaining({
+        provider: 'github',
+        base: 'stack/parent',
+        head: 'feature/ssh'
+      }),
+      'ssh-1',
+      {}
+    )
   })
 
   it('routes local WSL project hosted review flows through runtime git options', async () => {
@@ -7060,6 +7149,15 @@ describe('OrcaRuntimeService', () => {
       body: '',
       draft: false
     })
+    await runtime.createStackedHostedReview({
+      repoSelector: `id:${TEST_REPO_ID}`,
+      provider: 'github',
+      base: 'stack/parent',
+      head: 'feature/wsl',
+      title: 'Feature WSL',
+      body: '',
+      draft: false
+    })
 
     expect(getHostedReviewCreationEligibilityMock).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -7088,6 +7186,16 @@ describe('OrcaRuntimeService', () => {
       null,
       { localGitExecOptions: { wslDistro: 'Ubuntu' } }
     )
+    expect(createStackedHostedReviewMock).toHaveBeenCalledWith(
+      TEST_REPO_PATH,
+      expect.objectContaining({
+        provider: 'github',
+        base: 'stack/parent',
+        head: 'feature/wsl'
+      }),
+      null,
+      { localGitExecOptions: { wslDistro: 'Ubuntu' } }
+    )
   })
 
   it('treats SSH worktree drift as unknown without local git probes', async () => {
@@ -7737,7 +7845,7 @@ describe('OrcaRuntimeService', () => {
   it('keeps project clone setup on the cloned host-qualified repo', async () => {
     const destination = await mkdtemp(join(tmpdir(), 'orca-runtime-project-clone-'))
     const clonePath = join(destination, 'orca')
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn')
+    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
     const repos: Record<string, unknown>[] = []
     getRepoUpstreamMock.mockResolvedValue({ owner: 'stablyai', repo: 'orca' })
     const runtimeStore = {
@@ -7762,7 +7870,7 @@ describe('OrcaRuntimeService', () => {
     spawnSpy.mockImplementation(() => {
       const proc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
       proc.stderr = new EventEmitter()
-      queueMicrotask(() => {
+      setImmediate(() => {
         mkdirSync(clonePath, { recursive: true })
         execFileSync('git', ['init'], { cwd: clonePath, stdio: 'ignore' })
         proc.emit('close', 0, null)
@@ -7804,14 +7912,16 @@ describe('OrcaRuntimeService', () => {
     const existingFolder = join(destination, 'orca')
     mkdirSync(existingFolder, { recursive: true })
     execFileSync('git', ['init'], { cwd: existingFolder, stdio: 'ignore' })
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn').mockImplementation(() => {
-      // Why: unreachable while the guard holds; stubbed so a regression records the call
-      // instead of shelling out to a real network clone.
-      const proc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
-      proc.stderr = new EventEmitter()
-      queueMicrotask(() => proc.emit('close', 1, null))
-      return proc as never
-    })
+    const spawnSpy = vi
+      .spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
+      .mockImplementation(() => {
+        // Why: unreachable while the guard holds; stubbed so a regression records the call
+        // instead of shelling out to a real network clone.
+        const proc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
+        proc.stderr = new EventEmitter()
+        setImmediate(() => proc.emit('close', 1, null))
+        return proc as never
+      })
     const repos: Record<string, unknown>[] = []
     const runtimeStore = {
       ...store,
@@ -7860,7 +7970,7 @@ describe('OrcaRuntimeService', () => {
   it('adopts public clone repos into host-qualified project setup', async () => {
     const destination = await mkdtemp(join(tmpdir(), 'orca-runtime-project-clone-'))
     const clonePath = join(destination, 'orca')
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn')
+    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
     const repos: Record<string, unknown>[] = []
     getRepoUpstreamMock.mockResolvedValue({ owner: 'stablyai', repo: 'orca' })
     const runtimeStore = {
@@ -7885,7 +7995,7 @@ describe('OrcaRuntimeService', () => {
     spawnSpy.mockImplementation(() => {
       const proc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
       proc.stderr = new EventEmitter()
-      queueMicrotask(() => {
+      setImmediate(() => {
         mkdirSync(clonePath, { recursive: true })
         execFileSync('git', ['init'], { cwd: clonePath, stdio: 'ignore' })
         proc.emit('close', 0, null)
@@ -7930,7 +8040,7 @@ describe('OrcaRuntimeService', () => {
   it('keeps project clone repos split by runtime host on the same clone path', async () => {
     const destination = await mkdtemp(join(tmpdir(), 'orca-runtime-project-clone-'))
     const clonePath = join(destination, 'orca')
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn')
+    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
     const repos: Record<string, unknown>[] = [
       {
         id: 'repo-host-a',
@@ -7965,7 +8075,7 @@ describe('OrcaRuntimeService', () => {
     spawnSpy.mockImplementation(() => {
       const proc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
       proc.stderr = new EventEmitter()
-      queueMicrotask(() => {
+      setImmediate(() => {
         mkdirSync(clonePath, { recursive: true })
         execFileSync('git', ['init'], { cwd: clonePath, stdio: 'ignore' })
         proc.emit('close', 0, null)
@@ -8102,7 +8212,7 @@ describe('OrcaRuntimeService', () => {
   })
 
   it('defaults runtime cloneRepo badgeColor to DEFAULT_REPO_BADGE_COLOR', async () => {
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn')
+    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
     const added: Record<string, unknown>[] = []
     const colorStore = {
       ...store,
@@ -8115,7 +8225,7 @@ describe('OrcaRuntimeService', () => {
     spawnSpy.mockImplementation(() => {
       const proc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
       proc.stderr = new EventEmitter()
-      queueMicrotask(() => proc.emit('close', 0, null))
+      setImmediate(() => proc.emit('close', 0, null))
       return proc as never
     })
     const runtime = new OrcaRuntimeService(colorStore as never)
@@ -8138,7 +8248,7 @@ describe('OrcaRuntimeService', () => {
   })
 
   it('drops a same-path negative submodule cache before runtime cloneRepo', async () => {
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn')
+    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
     const destination = await mkdtemp(join(tmpdir(), 'orca-runtime-reclone-'))
     const clonePath = join(destination, 'reclone')
     const added: Record<string, unknown>[] = []
@@ -8151,7 +8261,7 @@ describe('OrcaRuntimeService', () => {
     spawnSpy.mockImplementation(() => {
       const proc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
       proc.stderr = new EventEmitter()
-      queueMicrotask(() => {
+      setImmediate(() => {
         void mkdir(clonePath, { recursive: true })
           .then(() =>
             writeFile(join(clonePath, '.gitmodules'), '[submodule "lib"]\n\tpath = vendor/lib\n')
@@ -8175,11 +8285,11 @@ describe('OrcaRuntimeService', () => {
   })
 
   it('preserves existing badgeColor on runtime cloneRepo folder->git dedupe upgrade', async () => {
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn')
+    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
     spawnSpy.mockImplementation(() => {
       const proc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
       proc.stderr = new EventEmitter()
-      queueMicrotask(() => proc.emit('close', 0, null))
+      setImmediate(() => proc.emit('close', 0, null))
       return proc as never
     })
     const existing = {
@@ -8273,7 +8383,7 @@ describe('OrcaRuntimeService', () => {
   })
 
   it('rejects runtime cloneRepo dot-segment URLs before spawning git', async () => {
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn')
+    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
     const runtime = createRuntime()
     const tempRoot = await mkdtemp(join(tmpdir(), 'orca-runtime-clone-'))
     const destination = join(tempRoot, 'destination')
@@ -8290,7 +8400,7 @@ describe('OrcaRuntimeService', () => {
   })
 
   it('rejects runtime cloneRepo parent-segment URLs before spawning git', async () => {
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn')
+    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
     const runtime = createRuntime()
     const tempRoot = await mkdtemp(join(tmpdir(), 'orca-runtime-clone-'))
     const destination = join(tempRoot, 'destination')
@@ -8307,10 +8417,10 @@ describe('OrcaRuntimeService', () => {
   })
 
   it('removes an owned runtime clone target when git exits unsuccessfully', async () => {
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn')
+    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
     const proc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
     proc.stderr = new EventEmitter()
-    spawnSpy.mockReturnValue(proc as never)
+    spawnSpy.mockResolvedValue(proc as never)
     const runtime = createRuntime()
     const destination = await mkdtemp(join(tmpdir(), 'orca-runtime-clone-'))
     const clonePath = join(destination, 'repo-badge-color')
@@ -8334,10 +8444,10 @@ describe('OrcaRuntimeService', () => {
   })
 
   it('preserves an existing runtime clone target when git exits unsuccessfully', async () => {
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn')
+    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
     const proc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
     proc.stderr = new EventEmitter()
-    spawnSpy.mockReturnValue(proc as never)
+    spawnSpy.mockResolvedValue(proc as never)
     const runtime = createRuntime()
     const destination = await mkdtemp(join(tmpdir(), 'orca-runtime-clone-'))
     const clonePath = join(destination, 'repo-badge-color')
@@ -8361,10 +8471,10 @@ describe('OrcaRuntimeService', () => {
   })
 
   it('skips runtime clone failure cleanup when the owned target is replaced', async () => {
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn')
+    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
     const proc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
     proc.stderr = new EventEmitter()
-    spawnSpy.mockReturnValue(proc as never)
+    spawnSpy.mockResolvedValue(proc as never)
     const runtime = createRuntime()
     const destination = await mkdtemp(join(tmpdir(), 'orca-runtime-clone-'))
     const clonePath = join(destination, 'repo-badge-color')
@@ -8390,10 +8500,10 @@ describe('OrcaRuntimeService', () => {
   })
 
   it('serializes concurrent runtime clones for the same target', async () => {
-    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawn')
+    const spawnSpy = vi.spyOn(gitRunner, 'gitSpawnAfterWindowsEnvironmentReady')
     const firstProc = new EventEmitter() as EventEmitter & { stderr: EventEmitter }
     firstProc.stderr = new EventEmitter()
-    spawnSpy.mockReturnValueOnce(firstProc as never)
+    spawnSpy.mockResolvedValueOnce(firstProc as never)
     const added: Record<string, unknown>[] = []
     const colorStore = {
       ...store,
@@ -11043,6 +11153,19 @@ describe('OrcaRuntimeService', () => {
     expect(snapshot?.cwd).toBe('/home/me/repo/src')
   })
 
+  it('projects frame-independent live state through main buffer snapshots', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    runtime.registerPty('pty-frame-state', TEST_WORKTREE_ID)
+    runtime.onPtyData('pty-frame-state', '\x1b[?1049h\x1b[?1004h\x1b[?25lSTATIC-FRAME', 123)
+
+    const snapshot = await runtime.serializeMainTerminalBuffer('pty-frame-state')
+
+    expect(snapshot?.frameRestoreAnsi).toContain('\x1b[?1004h')
+    expect(snapshot?.frameRestoreAnsi).toContain('\x1b[?25l')
+    expect(snapshot?.frameRestoreAnsi).not.toContain('STATIC-FRAME')
+    expect(snapshot?.data).toContain('STATIC-FRAME')
+  })
+
   it('keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX', () => {
     setPlatform('darwin')
     const runtime = new OrcaRuntimeService(store)
@@ -11309,6 +11432,57 @@ describe('OrcaRuntimeService', () => {
     })
   })
 
+  it('keeps blocked prompt text authoritative over an OpenCode marker', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn: vi.fn().mockResolvedValue({ id: 'pty-1' }),
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => 'opencode'
+    })
+    const leafId = '11111111-1111-4111-8111-111111111111'
+    runtime.attachWindow(1)
+    runtime.syncWindowGraph(1, {
+      tabs: [
+        {
+          tabId: 'tab-1',
+          worktreeId: TEST_WORKTREE_ID,
+          title: 'OC | Native session',
+          activeLeafId: leafId,
+          layout: null
+        }
+      ],
+      leaves: [
+        {
+          tabId: 'tab-1',
+          worktreeId: TEST_WORKTREE_ID,
+          leafId,
+          paneRuntimeId: 1,
+          ptyId: 'pty-1',
+          paneTitle: 'OC | Native session'
+        }
+      ]
+    })
+    runtime.onPtyData(
+      'pty-1',
+      'Permission required\nThis command requires permission\nAllow once\nAllow always\nReject\n',
+      123
+    )
+    const [terminal] = (await runtime.listTerminals()).terminals
+
+    await expect(runtime.getTerminalAgentStatus(terminal.handle)).resolves.toEqual({
+      handle: terminal.handle,
+      isRunningAgent: true,
+      status: 'permission'
+    })
+    await expect(
+      runtime.waitForTerminal(terminal.handle, { condition: 'tui-idle', timeoutMs: 1_000 })
+    ).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'codex-interactive-prompt'
+    })
+  })
+
   it('reports permission from blocked wait text over title-only working state', async () => {
     const runtime = new OrcaRuntimeService(store)
     runtime.setPtyController({
@@ -14666,6 +14840,205 @@ describe('OrcaRuntimeService', () => {
     }
   })
 
+  it('keeps a persisted split when mounted renderer adoption rejects', async () => {
+    const tabId = 'persisted-mounted-tab'
+    const ptyId = 'persisted-mounted-pty'
+    const splitPtyId = 'persisted-mounted-split-pty'
+    const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(
+      makeWorkspaceSessionWithHeadlessTerminal({
+        tabsByWorktree: {
+          [TEST_WORKTREE_ID]: [
+            {
+              id: tabId,
+              ptyId,
+              worktreeId: TEST_WORKTREE_ID,
+              title: 'Persisted terminal',
+              customTitle: null,
+              color: null,
+              sortOrder: 0,
+              createdAt: 1
+            }
+          ]
+        },
+        terminalLayoutsByTabId: {
+          [tabId]: makeHeadlessTerminalLayout({ [HEADLESS_LEAF_ID]: ptyId })
+        }
+      })
+    )
+    const revealTerminalSession = vi.fn().mockRejectedValue(new Error('renderer rejected'))
+    const kill = vi.fn(() => true)
+    let resolveSpawn!: (result: { id: string }) => void
+    const spawn = vi.fn(
+      (_args: unknown) =>
+        new Promise<{ id: string }>((resolve) => {
+          resolveSpawn = resolve
+        })
+    )
+    const runtime = new OrcaRuntimeService(runtimeStore as never)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill,
+      getForegroundProcess: async () => null
+    })
+    runtime.setNotifier({ revealTerminalSession } as never)
+    runtime.syncWindowGraph(1, { tabs: [], leaves: [] })
+    runtime.registerPty(ptyId, TEST_WORKTREE_ID, null, {
+      tabId,
+      leafId: HEADLESS_LEAF_ID,
+      incarnationId: 'live-source-incarnation'
+    })
+    const internals = runtime as unknown as {
+      issuePtyHandle: (pty: unknown) => string
+      ptysById: Map<string, unknown>
+    }
+    const handle = internals.issuePtyHandle(internals.ptysById.get(ptyId))
+    const split = runtime.splitTerminal(handle, { direction: 'horizontal' })
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
+    const splitSpawn = spawn.mock.calls[0]?.[0] as
+      | { expectedSourceBinding?: { incarnationId?: string } }
+      | undefined
+    expect(splitSpawn?.expectedSourceBinding).not.toHaveProperty('incarnationId')
+
+    runtime.syncWindowGraph(1, {
+      tabs: [
+        {
+          tabId,
+          worktreeId: TEST_WORKTREE_ID,
+          title: 'Persisted terminal',
+          activeLeafId: HEADLESS_LEAF_ID,
+          layout: { type: 'leaf', leafId: HEADLESS_LEAF_ID }
+        }
+      ],
+      leaves: [
+        {
+          tabId,
+          worktreeId: TEST_WORKTREE_ID,
+          leafId: HEADLESS_LEAF_ID,
+          paneRuntimeId: 1,
+          ptyId
+        }
+      ]
+    })
+    resolveSpawn({ id: splitPtyId })
+
+    await expect(split).resolves.toMatchObject({
+      tabId,
+      handle: expect.stringMatching(/^term_/)
+    })
+
+    expect(revealTerminalSession).toHaveBeenCalledOnce()
+    expect(kill).not.toHaveBeenCalled()
+    expect(getSession().terminalLayoutsByTabId[tabId]?.root).toMatchObject({
+      type: 'split',
+      direction: 'horizontal'
+    })
+  })
+
+  it('rejects a persisted split closed during spawn without recreating its tab', async () => {
+    const tabId = 'closing-persisted-tab'
+    const ptyId = 'closing-persisted-pty'
+    const { runtimeStore, getSession, setSession } = makeRuntimeStoreWithWorkspaceSession(
+      makeWorkspaceSessionWithHeadlessTerminal({
+        tabsByWorktree: {
+          [TEST_WORKTREE_ID]: [
+            {
+              id: tabId,
+              ptyId,
+              worktreeId: TEST_WORKTREE_ID,
+              title: 'Closing terminal',
+              customTitle: null,
+              color: null,
+              sortOrder: 0,
+              createdAt: 1
+            }
+          ]
+        },
+        terminalLayoutsByTabId: {
+          [tabId]: makeHeadlessTerminalLayout({ [HEADLESS_LEAF_ID]: ptyId })
+        }
+      })
+    )
+    let resolveSpawn!: (result: { id: string }) => void
+    const spawn = vi.fn(
+      (_args: unknown) =>
+        new Promise<{ id: string }>((resolve) => {
+          resolveSpawn = resolve
+        })
+    )
+    const kill = vi.fn(() => false)
+    const runtime = new OrcaRuntimeService(runtimeStore as never)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill,
+      getForegroundProcess: async () => null
+    })
+    runtime.syncWindowGraph(1, { tabs: [], leaves: [] })
+    runtime.registerPty(ptyId, TEST_WORKTREE_ID, null, {
+      tabId,
+      leafId: HEADLESS_LEAF_ID
+    })
+    const internals = runtime as unknown as {
+      issuePtyHandle: (pty: unknown) => string
+      ptysById: Map<string, unknown>
+    }
+    const handle = internals.issuePtyHandle(internals.ptysById.get(ptyId))
+    const split = runtime.splitTerminal(handle, { direction: 'vertical' })
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
+
+    setSession(getDefaultWorkspaceSession())
+    runtimeStore.persistPtyBinding.mockReturnValue(false)
+    resolveSpawn({ id: 'rejected-split-pty' })
+
+    await expect(split).rejects.toThrow('terminal_split_source_not_found')
+    expect(spawn.mock.calls[0]?.[0]).toMatchObject({
+      persistHostSessionBinding: true,
+      expectedSourceBinding: {
+        worktreeId: TEST_WORKTREE_ID,
+        tabId,
+        leafId: HEADLESS_LEAF_ID,
+        ptyId
+      }
+    })
+    expect(kill).toHaveBeenCalledWith('rejected-split-pty')
+    expect(getSession().tabsByWorktree[TEST_WORKTREE_ID]).toBeUndefined()
+    expect(getSession().terminalLayoutsByTabId[tabId]).toBeUndefined()
+  })
+
+  it('rejects a projected split retired during spawn before publishing the new pane', async () => {
+    let resolveSplitSpawn!: (result: { id: string }) => void
+    const spawn = vi
+      .fn()
+      .mockResolvedValueOnce({ id: 'projected-source-pty' })
+      .mockImplementationOnce(
+        () =>
+          new Promise<{ id: string }>((resolve) => {
+            resolveSplitSpawn = resolve
+          })
+      )
+    const kill = vi.fn(() => true)
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill,
+      getForegroundProcess: async () => null
+    })
+    runtime.syncWindowGraph(1, { tabs: [], leaves: [] })
+
+    const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
+    const split = runtime.splitTerminal(handle, { direction: 'vertical' })
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledTimes(2))
+
+    runtime['mobileSessionTabsByWorktree'].delete(TEST_WORKTREE_ID)
+    resolveSplitSpawn({ id: 'retired-projected-split-pty' })
+
+    await expect(split).rejects.toThrow('terminal_split_source_not_found')
+    expect(kill).toHaveBeenCalledWith('retired-projected-split-pty')
+    expect(runtime['mobileSessionTabsByWorktree'].has(TEST_WORKTREE_ID)).toBe(false)
+  })
+
   it('splits folder workspace pty-backed terminal sessions with folder cwd and env', async () => {
     const folderPath = await mkdtemp(join(tmpdir(), 'orca-runtime-folder-split-'))
     const spawn = vi
@@ -14744,6 +15117,80 @@ describe('OrcaRuntimeService', () => {
     })
   })
 
+  it('atomically admits persisted SSH splits in the SSH host partition', async () => {
+    const tabId = 'ssh-split-tab'
+    const sourcePtyId = 'ssh:ssh-1@@source-pty'
+    const splitPtyId = 'ssh:ssh-1@@split-pty'
+    const remoteRepo = { ...store.getRepo(TEST_REPO_ID)!, connectionId: 'ssh-1' }
+    const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(
+      makeWorkspaceSessionWithHeadlessTerminal({
+        tabsByWorktree: {
+          [TEST_WORKTREE_ID]: [
+            {
+              id: tabId,
+              ptyId: sourcePtyId,
+              worktreeId: TEST_WORKTREE_ID,
+              title: 'SSH terminal',
+              customTitle: null,
+              color: null,
+              sortOrder: 0,
+              createdAt: 1
+            }
+          ]
+        },
+        terminalLayoutsByTabId: {
+          [tabId]: makeHeadlessTerminalLayout({ [HEADLESS_LEAF_ID]: sourcePtyId })
+        }
+      }),
+      'ssh:ssh-1'
+    )
+    const spawn = vi.fn().mockResolvedValue({ id: splitPtyId })
+    const runtime = new OrcaRuntimeService({
+      ...runtimeStore,
+      getRepos: () => [remoteRepo],
+      getRepo: (id: string) => (id === TEST_REPO_ID ? remoteRepo : undefined)
+    } as never)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+    runtime.syncWindowGraph(1, { tabs: [], leaves: [] })
+    runtime.registerPty(sourcePtyId, TEST_WORKTREE_ID, 'ssh-1', {
+      tabId,
+      leafId: HEADLESS_LEAF_ID
+    })
+    const internals = runtime as unknown as {
+      issuePtyHandle: (pty: unknown) => string
+      ptysById: Map<string, unknown>
+    }
+    const handle = internals.issuePtyHandle(internals.ptysById.get(sourcePtyId))
+
+    await expect(runtime.splitTerminal(handle, { direction: 'vertical' })).resolves.toMatchObject({
+      tabId,
+      handle: expect.stringMatching(/^term_/)
+    })
+
+    expect(spawn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        connectionId: 'ssh-1',
+        worktreeId: TEST_WORKTREE_ID,
+        persistHostSessionBinding: true,
+        expectedSourceBinding: expect.objectContaining({
+          worktreeId: TEST_WORKTREE_ID,
+          tabId,
+          leafId: HEADLESS_LEAF_ID,
+          ptyId: sourcePtyId
+        })
+      })
+    )
+    expect(getSession().terminalLayoutsByTabId[tabId]?.root).toMatchObject({
+      type: 'split',
+      direction: 'vertical'
+    })
+  })
+
   it('returns an actionable discoverability warning when default adoption fails after spawn', async () => {
     const spawn = vi.fn().mockResolvedValue({ id: 'pty-bg' })
     const revealTerminalSession = vi.fn().mockRejectedValue(new Error('Renderer timed out'))
@@ -15218,6 +15665,28 @@ describe('OrcaRuntimeService', () => {
     })
   })
 
+  it('resolves live-leaf tui-idle from an OpenCode native title', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+    syncSinglePty(runtime, 'remote:pty-1', {
+      tabTitle: 'repo terminal',
+      paneTitle: 'ssh build-host | OC | Native session'
+    })
+    const [terminal] = (await runtime.listTerminals()).terminals
+
+    await expect(
+      runtime.waitForTerminal(terminal.handle, { condition: 'tui-idle', timeoutMs: 1_000 })
+    ).resolves.toMatchObject({
+      handle: terminal.handle,
+      condition: 'tui-idle',
+      status: 'running'
+    })
+  })
+
   it('does not treat a Codex launch title as tui-idle readiness', async () => {
     vi.useFakeTimers()
     try {
@@ -19079,6 +19548,71 @@ describe('OrcaRuntimeService', () => {
     ).rejects.toThrow('terminal_orphan_competing_owner')
   })
 
+  it('preserves concurrent workspace-session changes when async orphan persistence fails', async () => {
+    const session = {
+      ...getDefaultWorkspaceSession(),
+      activeRepoId: TEST_REPO_ID,
+      activeWorktreeId: TEST_WORKTREE_ID,
+      tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
+    }
+    const { runtimeStore, getSession, setSession } = makeRuntimeStoreWithWorkspaceSession(session)
+    const durableWrite = deferred<void>()
+    const durableWriteStarted = deferred<void>()
+    const runtime = new OrcaRuntimeService({
+      ...runtimeStore,
+      flushPendingOrThrowAsync: vi.fn(() => {
+        durableWriteStarted.resolve()
+        return durableWrite.promise
+      })
+    } as never)
+    runtime.setPtyController({
+      write: vi.fn(() => true),
+      kill: vi.fn(() => true),
+      getForegroundProcess: async () => null,
+      listProcesses: async () => [
+        {
+          id: 'pty-async-rollback',
+          incarnationId: 'inc-async-rollback',
+          terminalHandle: 'term_async_rollback',
+          title: 'Async rollback',
+          cwd: TEST_WORKTREE_PATH,
+          worktreeId: TEST_WORKTREE_ID,
+          wslDistro: null
+        }
+      ]
+    })
+    const before = await runtime.listTerminals(`id:${TEST_WORKTREE_ID}`)
+
+    const adoption = runtime.adoptTerminalOrphans({
+      worktree: `id:${TEST_WORKTREE_ID}`,
+      expectedTopologyRevision: before.topologyRevisions?.[TEST_WORKTREE_ID] ?? 0,
+      claims: [
+        {
+          terminal: 'term_async_rollback',
+          ptyId: 'pty-async-rollback',
+          incarnationId: 'inc-async-rollback',
+          tabId: 'tab-async-rollback',
+          leafId: HEADLESS_LEAF_ID
+        }
+      ]
+    })
+    await durableWriteStarted.promise
+    setSession({
+      ...getSession(),
+      activeTabIdByWorktree: {
+        ...getSession().activeTabIdByWorktree,
+        'concurrent-worktree': 'concurrent-tab'
+      }
+    })
+    durableWrite.reject(new Error('disk unavailable'))
+
+    await expect(adoption).rejects.toThrow('disk unavailable')
+    expect(getSession().tabsByWorktree[TEST_WORKTREE_ID]).toEqual([])
+    expect(getSession().terminalLayoutsByTabId['tab-async-rollback']).toBeUndefined()
+    expect(getSession().activeTabIdByWorktree?.['concurrent-worktree']).toBe('concurrent-tab')
+    expect(getSession().terminalTopologyRevisionByRepoId?.[TEST_REPO_ID] ?? 0).toBe(0)
+  })
+
   function publishLegacyWorkerReveal(
     runtime: OrcaRuntimeService,
     identity: { worktreeId: string; tabId: string; leafId: string; ptyId: string },
@@ -19845,17 +20379,23 @@ describe('OrcaRuntimeService', () => {
         }
       }
     }
-    const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
+    const { runtimeStore, getSession, setSession } = makeRuntimeStoreWithWorkspaceSession(session)
+    const durableWrite = deferred<void>()
+    const durableWriteStarted = deferred<void>()
     let flushCount = 0
-    const flushOrThrow = vi.fn(() => {
+    const flushPendingOrThrowAsync = vi.fn(() => {
       flushCount += 1
-      if (flushCount === 1 || flushCount === 3) {
-        throw new Error('disk unavailable')
+      if (flushCount === 1) {
+        return Promise.resolve()
       }
+      durableWriteStarted.resolve()
+      return durableWrite.promise
     })
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow } as never, undefined, {
-      canRecoverPersistentLocalPtys: () => true
-    })
+    const runtime = new OrcaRuntimeService(
+      { ...runtimeStore, flushPendingOrThrowAsync } as never,
+      undefined,
+      { canRecoverPersistentLocalPtys: () => true }
+    )
     runtime.setOrchestrationDb({
       listLegacyWorkerTerminalRecoveryRows: () => [
         {
@@ -19904,18 +20444,35 @@ describe('OrcaRuntimeService', () => {
     } as never)
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
 
-    await expect(
-      runtime.reconcileLegacyWorkerTerminals({ materializeRenderer: true })
-    ).resolves.toMatchObject({
+    const recovery = runtime.reconcileLegacyWorkerTerminals({ materializeRenderer: true })
+    await durableWriteStarted.promise
+    const concurrentPaneKey = `concurrent:${HEADLESS_SECOND_LEAF_ID}`
+    setSession({
+      ...getSession(),
+      sleepingAgentSessionsByPaneKey: {
+        ...getSession().sleepingAgentSessionsByPaneKey,
+        [concurrentPaneKey]: {
+          ...session.sleepingAgentSessionsByPaneKey![workerPaneKey]!,
+          paneKey: concurrentPaneKey,
+          tabId: 'concurrent-tab'
+        }
+      }
+    })
+    durableWrite.reject(new Error('disk unavailable'))
+
+    await expect(recovery).resolves.toMatchObject({
       adoptedDispatchIds: [],
       exitedDispatchIds: [],
       deferredDispatchIds: ['dispatch-persistence-failure']
     })
-    expect(flushOrThrow).toHaveBeenCalledTimes(3)
+    expect(flushPendingOrThrowAsync).toHaveBeenCalledTimes(2)
     expect(revealTerminalSession).toHaveBeenCalledOnce()
     expect(
       getSession().sleepingAgentSessionsByPaneKey?.[workerPaneKey]?.automaticResumeBlockedBy
     ).toBe('legacy-orchestration-worker')
+    expect(getSession().sleepingAgentSessionsByPaneKey?.[concurrentPaneKey]?.tabId).toBe(
+      'concurrent-tab'
+    )
     expect(resolveLegacyWorkerTerminalRecovery).not.toHaveBeenCalled()
     warn.mockRestore()
   })
@@ -19942,8 +20499,17 @@ describe('OrcaRuntimeService', () => {
       }
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
+    const durableWrite = deferred<void>()
+    const durableWriteStarted = deferred<void>()
+    const flushPendingOrThrowAsync = vi.fn(() => {
+      durableWriteStarted.resolve()
+      return durableWrite.promise
+    })
+    const flushOrThrow = vi.fn(() => {
+      throw new Error('synchronous persistence must not run')
+    })
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushOrThrow: vi.fn() } as never,
+      { ...runtimeStore, flushOrThrow, flushPendingOrThrowAsync } as never,
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -19975,12 +20541,24 @@ describe('OrcaRuntimeService', () => {
       const resolveLegacyWorkerTerminalRecovery = vi.fn()
       runtime.setNotifier({ resolveLegacyWorkerTerminalRecovery } as never)
 
-      await expect(runtime.reconcileLegacyWorkerTerminals()).resolves.toMatchObject({
+      const recovery = runtime.reconcileLegacyWorkerTerminals()
+      await durableWriteStarted.promise
+
+      expect(resolveLegacyWorkerTerminalRecovery).not.toHaveBeenCalled()
+      expect(db.getDispatchContextById(started.dispatch.id)?.status).toBe('dispatched')
+      durableWrite.resolve()
+
+      await expect(recovery).resolves.toMatchObject({
         adoptedDispatchIds: [],
         exitedDispatchIds: [started.dispatch.id],
         deferredDispatchIds: []
       })
 
+      expect(flushPendingOrThrowAsync).toHaveBeenCalledOnce()
+      expect(flushPendingOrThrowAsync).toHaveBeenCalledWith({
+        drainToStableGeneration: false
+      })
+      expect(flushOrThrow).not.toHaveBeenCalled()
       expect(db.getDispatchContextById(started.dispatch.id)).toMatchObject({
         status: 'failed',
         failure_count: 1
@@ -19999,7 +20577,7 @@ describe('OrcaRuntimeService', () => {
     }
   })
 
-  it('retries missing-worker recovery when clearing its persisted resume fence fails', async () => {
+  it('waits for durability before retry settles a resolution already present in memory', async () => {
     const workerPaneKey = `legacy-missing-retry:${HEADLESS_LEAF_ID}`
     const incarnationId = '34343434-3434-4434-8434-343434343434'
     const session: WorkspaceSessionState = {
@@ -20020,17 +20598,26 @@ describe('OrcaRuntimeService', () => {
         }
       }
     }
-    const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
-    const flushOrThrow = vi
-      .fn()
-      .mockImplementationOnce(() => undefined)
-      .mockImplementationOnce(() => {
-        throw new Error('disk unavailable')
-      })
-      .mockImplementation(() => undefined)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow } as never, undefined, {
-      canRecoverPersistentLocalPtys: () => true
+    const { runtimeStore, getSession, setSession } = makeRuntimeStoreWithWorkspaceSession(session)
+    const firstDurableWrite = deferred<void>()
+    const firstDurableWriteStarted = deferred<void>()
+    const retryDurableWrite = deferred<void>()
+    const retryDurableWriteStarted = deferred<void>()
+    let flushCount = 0
+    const flushPendingOrThrowAsync = vi.fn(() => {
+      flushCount += 1
+      if (flushCount === 1) {
+        firstDurableWriteStarted.resolve()
+        return firstDurableWrite.promise
+      }
+      retryDurableWriteStarted.resolve()
+      return retryDurableWrite.promise
     })
+    const runtime = new OrcaRuntimeService(
+      { ...runtimeStore, flushPendingOrThrowAsync } as never,
+      undefined,
+      { canRecoverPersistentLocalPtys: () => true }
+    )
     const db = new OrchestrationDb(':memory:')
     try {
       const task = db.createTask({ spec: 'retry missing worker recovery' })
@@ -20060,20 +20647,30 @@ describe('OrcaRuntimeService', () => {
       runtime.setNotifier({ resolveLegacyWorkerTerminalRecovery } as never)
       const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
 
-      await expect(runtime.reconcileLegacyWorkerTerminals()).resolves.toMatchObject({
+      const firstRecovery = runtime.reconcileLegacyWorkerTerminals()
+      await firstDurableWriteStarted.promise
+      setSession({ ...getSession(), sleepingAgentSessionsByPaneKey: undefined })
+      firstDurableWrite.reject(new Error('disk unavailable'))
+
+      await expect(firstRecovery).resolves.toMatchObject({
         exitedDispatchIds: [],
         deferredDispatchIds: [started.dispatch.id]
       })
       expect(db.getDispatchContextById(started.dispatch.id)?.status).toBe('dispatched')
       expect(db.getWorkerDispatch(started.dispatch.id)?.state).toBe('ready')
-      expect(
-        getSession().sleepingAgentSessionsByPaneKey?.[workerPaneKey]?.automaticResumeBlockedBy
-      ).toBe('legacy-orchestration-worker')
+      expect(getSession().sleepingAgentSessionsByPaneKey).toBeUndefined()
 
-      await expect(runtime.reconcileLegacyWorkerTerminals()).resolves.toMatchObject({
+      const retry = runtime.reconcileLegacyWorkerTerminals()
+      await retryDurableWriteStarted.promise
+      expect(db.getDispatchContextById(started.dispatch.id)?.status).toBe('dispatched')
+      expect(db.getWorkerDispatch(started.dispatch.id)?.state).toBe('ready')
+      retryDurableWrite.resolve()
+
+      await expect(retry).resolves.toMatchObject({
         exitedDispatchIds: [started.dispatch.id],
         deferredDispatchIds: []
       })
+      expect(flushPendingOrThrowAsync).toHaveBeenCalledTimes(2)
       expect(db.getWorkerDispatch(started.dispatch.id)?.state).toBe('abandoned')
       expect(getSession().sleepingAgentSessionsByPaneKey?.[workerPaneKey]).toBeUndefined()
       expect(resolveLegacyWorkerTerminalRecovery).toHaveBeenCalledWith(
@@ -22275,6 +22872,65 @@ describe('OrcaRuntimeService', () => {
     })
   })
 
+  it('does not authorize an OpenCode marker left on a shell pane', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => 'zsh'
+    })
+    syncSinglePty(runtime, 'pty-1', { paneTitle: 'OC | zsh' })
+    const [terminal] = (await runtime.listTerminals()).terminals
+
+    await expect(runtime.isTerminalRunningAgent(terminal.handle)).resolves.toBe(false)
+    await expect(runtime.getTerminalAgentStatus(terminal.handle)).resolves.toEqual({
+      handle: terminal.handle,
+      isRunningAgent: false,
+      status: null
+    })
+  })
+
+  it('authorizes a hookless OpenCode marker with an OpenCode foreground process', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => 'opencode'
+    })
+    syncSinglePty(runtime, 'pty-1', { paneTitle: 'OC | Native session' })
+    const [terminal] = (await runtime.listTerminals()).terminals
+
+    await expect(runtime.isTerminalRunningAgent(terminal.handle)).resolves.toBe(true)
+    await expect(runtime.getTerminalAgentStatus(terminal.handle)).resolves.toEqual({
+      handle: terminal.handle,
+      isRunningAgent: true,
+      status: 'idle'
+    })
+  })
+
+  it('does not authorize an OpenCode marker left on a runtime PTY shell', async () => {
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn: vi.fn().mockResolvedValue({ id: 'pty-bg' }),
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => 'zsh'
+    })
+    runtime.attachWindow(1)
+    runtime.syncWindowGraph(1, { tabs: [], leaves: [] })
+    const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`, {
+      command: 'bash',
+      title: 'OC | zsh'
+    })
+
+    await expect(runtime.isTerminalRunningAgent(handle)).resolves.toBe(false)
+    await expect(runtime.getTerminalAgentStatus(handle)).resolves.toEqual({
+      handle,
+      isRunningAgent: false,
+      status: null
+    })
+  })
+
   // Why: a leaf with no PTY is the same no-evidence case as an unreadable foreground —
   // nothing was even asked, so the bare title is all that is left. The corroborating
   // foreground here is deliberately unreachable: no ptyId means no read.
@@ -24549,7 +25205,7 @@ describe('OrcaRuntimeService', () => {
     unsubscribe()
   })
 
-  it('keeps same-status Pi-compatible title changes queued behind the foreground owner probe', async () => {
+  it('keeps decorative Pi frames queued behind the foreground owner probe', async () => {
     const foregroundProcess = deferred<string | null>()
     const spawn = vi.fn().mockResolvedValue({ id: 'pty-typed-omp' })
     const getForegroundProcess = vi.fn(() => foregroundProcess.promise)
@@ -24568,9 +25224,9 @@ describe('OrcaRuntimeService', () => {
     const events: RuntimeMobileSessionTabsResult[] = []
     const unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => events.push(snapshot))
 
-    runtime.onPtyData('pty-typed-omp', '\x1b]0;Pi ready\x07', 123)
+    runtime.onPtyData('pty-typed-omp', '\x1b]0;⠋ Pi\x07', 123)
     await new Promise<void>((resolve) => setImmediate(resolve))
-    runtime.onPtyData('pty-typed-omp', '\x1b]0;Pi idle\x07', 124)
+    runtime.onPtyData('pty-typed-omp', '\x1b]0;⠙ Pi\x07', 124)
     await new Promise<void>((resolve) => setImmediate(resolve))
 
     expect(getForegroundProcess).toHaveBeenCalledTimes(1)
@@ -24585,18 +25241,22 @@ describe('OrcaRuntimeService', () => {
         tabs: [
           expect.objectContaining({
             type: 'terminal',
-            title: 'OMP ready',
+            title: '⠋ OMP',
             agentStatus: expect.objectContaining({
-              state: 'done',
+              state: 'working',
               agentType: 'omp',
               terminalHandle: terminal.handle,
-              terminalTitle: 'OMP ready'
+              terminalTitle: '⠋ OMP'
             })
           })
         ]
       })
     ])
 
+    runtime.onPtyData('pty-typed-omp', '\x1b]0;⠹ Pi\x07', 125)
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    expect(events).toHaveLength(1)
+
     unsubscribe()
   })
 
@@ -39320,6 +39980,35 @@ describe('OrcaRuntimeService', () => {
     expect(reposChanged).not.toHaveBeenCalled()
   })
 
+  it('persists changed worktree order once and emits targeted invalidations', () => {
+    const firstId = `${TEST_REPO_ID}::/tmp/first`
+    const secondId = `${TEST_REPO_ID}::/tmp/second`
+    const metaById: Record<string, Partial<WorktreeMeta>> = {
+      [firstId]: { sortOrder: 200 },
+      [secondId]: { sortOrder: 100 }
+    }
+    const setWorktreeMeta = vi.fn((id: string, updates: Partial<WorktreeMeta>) => {
+      metaById[id] = { ...metaById[id], ...updates }
+    })
+    const runtime = new OrcaRuntimeService({
+      ...store,
+      getWorktreeMeta: (id: string) => metaById[id],
+      setWorktreeMeta
+    } as never)
+    const events: { type: string; repoId?: string }[] = []
+    const unsubscribe = runtime.onClientEvent((event) => events.push(event))
+
+    expect(runtime.persistManagedWorktreeSortOrder([firstId, secondId])).toEqual({ updated: 0 })
+    expect(setWorktreeMeta).not.toHaveBeenCalled()
+    expect(events).toEqual([])
+
+    expect(runtime.persistManagedWorktreeSortOrder([secondId, firstId])).toEqual({ updated: 2 })
+    unsubscribe()
+
+    expect(setWorktreeMeta).toHaveBeenCalledTimes(2)
+    expect(events).toEqual([{ type: 'worktreesChanged', repoId: TEST_REPO_ID }])
+  })
+
   it('worktree scan cache: folder metadata invalidation preserves raw scans', async () => {
     vi.mocked(listWorktrees).mockClear()
     const runtime = createRuntime()
diff --git a/src/main/runtime/orca-runtime.ts b/src/main/runtime/orca-runtime.ts
index 10e143df938..bcf6840448d 100644
--- a/src/main/runtime/orca-runtime.ts
+++ b/src/main/runtime/orca-runtime.ts
@@ -6,10 +6,13 @@ import {
   isClaudeManagementTitle,
   isCursorAgentTitle,
   isCursorNativeAgentTitle,
+  isOpenCodeNativeTitle,
+  isQuarterCircleSpinnerOnlyAgentTitle,
   isShellProcess,
   normalizeTerminalTitle
 } from '../../shared/agent-detection'
 import { extractOscTitleScanTail } from '../../shared/osc-title-scan-tail'
+import { planWorktreeSortOrderUpdates } from '../../shared/worktree-sort-order-update'
 import { isArtifactSharingEnabled } from '../../shared/artifact-sharing-gate'
 import { sortDirEntries } from '../../shared/file-name-sort'
 import { isServerDriveListRequest, listWindowsDrives } from './windows-drive-listing'
@@ -27,10 +30,10 @@ import type {
 } from './remote-terminal-source-range-consumer'
 import {
   createTerminalTitleTracker,
-  stripBrailleSpinnerGlyphs,
   type TerminalTitleFactMeta,
   type TerminalTitleTracker
 } from '../../shared/terminal-output-side-effects'
+import { getDecorativeAgentTitleSignature } from '../../shared/agent-decorative-title-signature'
 import { createCommandCodeOutputStatusDetector } from '../../shared/command-code-output-status'
 import type {
   TerminalSideEffectBatch,
@@ -38,6 +41,7 @@ import type {
 } from '../../shared/terminal-side-effect-facts'
 import type { TerminalGitHubPRLink } from '../../shared/terminal-github-pr-link-detector'
 import { TerminalKittyKeyboardModeTracker } from '../../shared/terminal-kitty-keyboard-mode-tracker'
+import { parseTerminalKittyKeyboardFlags } from '../../shared/terminal-kitty-keyboard-flags'
 import {
   AGENT_STATUS_STALE_AFTER_MS,
   isFreshNonDoneAgentStatus,
@@ -93,7 +97,12 @@ import {
   AGENT_PROMPT_SUBMIT_DELAY_MS,
   buildAgentPromptPasteBytes
 } from '../../shared/agent-prompt-injection'
-import { gitExecFileAsync, gitSpawn, nonInteractiveGitEnv } from '../git/runner'
+import {
+  awaitWindowsHostGitEnvironmentReady,
+  gitExecFileAsync,
+  gitSpawnAfterWindowsEnvironmentReady,
+  nonInteractiveGitEnv
+} from '../git/runner'
 import { runWithGitReadCacheInvalidation } from '../git/status'
 import {
   cleanupClaimedCloneTarget,
@@ -111,6 +120,12 @@ import { resolveWorktreeCreateBase } from '../worktree-create-base'
 import { resolveWorktreeAddBaseRef } from '../../shared/worktree-base-ref'
 import { OrchestrationDb } from './orchestration/db'
 import { reconcileRequestedWorkerTerminalReleases } from './orchestration/worker-terminal-release-reconciliation'
+import {
+  classifyWorkerTerminalProcessIncarnation,
+  parseWorkerTerminalHostScope,
+  type WorkerTerminalHostScope
+} from './orchestration/worker-terminal-process-liveness'
+import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from './workspace-session-failed-write-rollback'
 import { OrchestrationError } from './orchestration/orchestration-error'
 import {
   planLegacyWorkerTerminalRecovery,
@@ -147,6 +162,7 @@ import type {
   OrchestrationEnvironmentTransport,
   OrchestrationWorkerServer
 } from './orchestration/environment-transport'
+import { clearFederationAckCheckpoints } from './orchestration/federation-ack-checkpoints'
 import { syncFederatedDispatch } from './orchestration/federation-sync'
 import { formatMessagePointer } from './orchestration/formatter'
 import { selectExactWorkerProviderSession } from './orchestration/worker-provider-session'
@@ -248,6 +264,7 @@ import {
   toSshExecutionHostId,
   type ExecutionHostId
 } from '../../shared/execution-host'
+import { preservedBranchCleanupScopeKey } from '../../shared/preserved-branch-cleanup'
 import { getRegisteredSshState } from '../ipc/ssh'
 import type {
   AgentProviderSessionMetadata,
@@ -518,7 +535,8 @@ import { RemoteRuntimeTerminalCreateIdempotency } from './remote-runtime-termina
 import { deriveRemoteRuntimeTerminalCreateHandle } from './remote-runtime-terminal-create-identity'
 import {
   buildHeadlessTerminalSplitLayout,
-  countTerminalLayoutLeaves
+  countTerminalLayoutLeaves,
+  terminalLayoutContainsLeaf
 } from './headless-terminal-split-layout'
 import { RECENT_PTY_OUTPUT_LIMIT, RecentPtyOutputBuffer } from './recent-pty-output-buffer'
 import {
@@ -667,6 +685,8 @@ import { inspectSetupScriptImportCandidates } from '../../shared/setup-script-im
 import type {
   CreateHostedReviewInput,
   CreateHostedReviewResult,
+  CreateStackedHostedReviewInput,
+  CreateStackedHostedReviewResult,
   HostedReviewCreationEligibility,
   HostedReviewCreationEligibilityArgs,
   HostedReviewInfo
@@ -676,6 +696,7 @@ import {
   createHostedReview as createHostedReviewFromRepo,
   getHostedReviewCreationEligibility as getHostedReviewCreationEligibilityFromRepo
 } from '../source-control/hosted-review-creation'
+import { createStackedHostedReview as createStackedHostedReviewFromRepo } from '../source-control/stacked-hosted-review-creation'
 import {
   getLocalProjectGitExecOptions,
   getLocalProjectWorktreeGitOptions,
@@ -910,7 +931,7 @@ import {
   WORKTREE_CREATE_MAX_SUFFIX_ATTEMPTS
 } from '../worktree-create-candidates'
 import { normalizeSparseDirectories } from '../ipc/sparse-checkout-directories'
-import type { Store } from '../persistence'
+import type { PtyBindingSourceExpectation, Store } from '../persistence'
 import type { StatsCollector } from '../stats/collector'
 import { AgentDetector } from '../stats/agent-detector'
 import {
@@ -981,6 +1002,10 @@ import {
   createMobileSessionTabsNotifyCoalescer,
   type MobileSessionTabsNotifyCoalescer
 } from './mobile-session-tabs-notify-coalescer'
+import {
+  createMobileSessionTabsAgentStatusHeartbeat,
+  type MobileSessionTabsAgentStatusHeartbeat
+} from './mobile-session-tabs-agent-status-heartbeat'
 import { TerminalFocusNavigationCoalescer } from './terminal-focus-navigation-coalescer'
 import {
   appendRecentPtyPathCandidates,
@@ -1116,6 +1141,7 @@ type RuntimeStore = {
   getWorkspaceSessionHostIds?: Store['getWorkspaceSessionHostIds']
   setWorkspaceSession?: Store['setWorkspaceSession']
   flushOrThrow?: Store['flushOrThrow']
+  flushPendingOrThrowAsync?: Store['flushPendingOrThrowAsync']
   persistPtyBinding?: Store['persistPtyBinding']
   getSshRemotePtyLeases?: Store['getSshRemotePtyLeases']
   getUI?: Store['getUI']
@@ -1292,6 +1318,8 @@ type RuntimePtyWorktreeRecord = {
   paneKey: string | null
   launchConfig: SleepingAgentLaunchConfig | null
   launchToken: string | null
+  // Why: provider PTY IDs can be reused; launch identity belongs only to the process that received the token.
+  launchIncarnationId: PtyIncarnationId | null
   launchAgent: TuiAgent | null
   foregroundAgent: TuiAgent | null
   connected: boolean
@@ -1300,6 +1328,9 @@ type RuntimePtyWorktreeRecord = {
   lastAgentStatus: AgentStatus | null
   /** False until a live OSC frame sets the status; restore seeds never set it. */
   lastAgentStatusObservedLive: boolean
+  lastAgentStatusStartedAtEpochMs: number | null
+  // A later semantic title interval cannot inherit rich fields from an earlier task.
+  lastAgentStatusRichInvalidatedAtEpochMs: number | null
   lastOscTitle: string | null
   lastOscTitleAt: number | null
   // Why a second stamp: `lastOscTitleAt` is a title-observation sequence number,
@@ -1509,12 +1540,8 @@ type RuntimePtyTitleTrackerEntry = {
   tracker: TerminalTitleTracker
   // Why: onPtyData batches the mobile session-tab touch to once per chunk;
   // the stale-working-title timer fires between chunks and must touch
-  // immediately. These flags route the tracker callback to the right mode.
+  // immediately. This flag routes the tracker callback to the right mode.
   applyingChunk: boolean
-  // Why: synthetic spinner ticks arrive ~12.5x/sec per working pane; the
-  // synthetic path gates mobile snapshot fan-out on a non-decorative title
-  // change (spinner glyph + status comparison key kept below).
-  applyingSyntheticFrame: boolean
   lastMobileTitleGateKey: string | null
   chunkTouchedSessionTabs: boolean
   // Why: facts observed while applying a chunk are batched into one
@@ -1589,6 +1616,8 @@ type ProviderBufferAcquisition = {
 
 type RuntimeTerminalBufferSnapshot = {
   data: string
+  /** Live state that can be restored without an alternate-screen frame. */
+  frameRestoreAnsi?: string
   cols: number
   rows: number
   seq?: number
@@ -1599,6 +1628,9 @@ type RuntimeTerminalBufferSnapshot = {
   alternateScreen?: boolean
   scrollbackAnsi?: string
   pendingEscapeTailAnsi?: string
+  /** Effective kitty flags proven at this snapshot's own `seq`. Absent means
+   *  the winning source could not prove them. */
+  kittyKeyboardFlags?: number
 }
 
 type HeadlessSeedMetadata = {
@@ -1659,6 +1691,7 @@ type RuntimePtyController = {
     sessionId?: string
     isNewSession?: boolean
     persistHostSessionBinding?: boolean
+    expectedSourceBinding?: PtyBindingSourceExpectation
     terminalColorQueryReplies?: { foreground?: string; background?: string }
     agentSessionEnsure?: {
       claim: AgentSessionExecutionClaim
@@ -1711,7 +1744,14 @@ type RuntimePtyController = {
   serializeBuffer?(
     ptyId: string,
     opts?: { scrollbackRows?: number; altScreenForcesZeroRows?: boolean }
-  ): Promise<{ data: string; cols: number; rows: number; seq?: number; lastTitle?: string } | null>
+  ): Promise<{
+    data: string
+    cols: number
+    rows: number
+    seq?: number
+    lastTitle?: string
+    kittyKeyboardFlags?: number
+  } | null>
   /** Authoritative provider-owned snapshot for restored PTYs with no mounted renderer. */
   serializeProviderBuffer?(
     ptyId: string,
@@ -1965,10 +2005,7 @@ export type OrchestrationCompatibilityTerminalAuthority = {
   processIncarnation: string | null
   paneKey: string | null
   launchTokenHash: string | null
-  hostScope:
-    | { kind: 'local'; hostId: 'local' }
-    | { kind: 'wsl'; hostId: 'local'; distro: string }
-    | { kind: 'ssh'; targetId: string }
+  hostScope: WorkerTerminalHostScope
 }
 
 export type LegacyWorkerTerminalRecoveryResult = {
@@ -1978,6 +2015,11 @@ export type LegacyWorkerTerminalRecoveryResult = {
   deferredDispatchIds: string[]
 }
 
+type LegacyWorkerTerminalRecoveryResolution = {
+  candidate: LegacyWorkerTerminalRecoveryPlan['candidates'][number]
+  resolution: 'adopted' | 'exited'
+}
+
 export type OrchestrationCompatibilityCallerAuthority = Readonly<{
   hostScope: OrchestrationCompatibilityTerminalAuthority['hostScope']
   paneKey: string
@@ -2108,6 +2150,8 @@ type RuntimeWorktreeRemovalInFlight = {
 }
 
 type PreservedBranchCleanupTarget = {
+  worktreeId: string
+  hostId?: ExecutionHostId
   branchName: string
   head: string
   pushTarget?: GitPushTarget
@@ -2658,7 +2702,10 @@ export class OrcaRuntimeService {
   private managedHookReconciliationTail: Promise<void> = Promise.resolve()
   private readonly orchestrationEnvironmentTransport: OrchestrationEnvironmentTransport | null
   private readonly orchestrationFederationTimers = new Map<string, ReturnType<typeof setInterval>>()
-  private readonly orchestrationFederationSyncs = new Map<string, Promise<void>>()
+  private readonly orchestrationFederationSyncs = new Map<
+    string,
+    { db: OrchestrationDb; promise: Promise<void> }
+  >()
   private readonly orchestrationFederationWarnings = new Set<string>()
   private rendererGraphEpoch = 0
   private graphStatus: RuntimeGraphStatus = 'unavailable'
@@ -2746,6 +2793,11 @@ export class OrcaRuntimeService {
     createMobileSessionTabsNotifyCoalescer((worktreeId) =>
       this.notifyMobileSessionTabsChangedNow(worktreeId)
     )
+  private readonly mobileSessionTabsAgentStatusHeartbeat: MobileSessionTabsAgentStatusHeartbeat =
+    createMobileSessionTabsAgentStatusHeartbeat(
+      (ptyId) => this.getMobileSessionWorktreeIdsForPty(ptyId),
+      (worktreeId) => this.touchMobileSessionTabsForWorktree(worktreeId)
+    )
   // Why: concurrent host terminal.focus storms (CLI switch fan-out / bulk open)
   // each await a full host reveal; only one terminal can be focused, so latest-wins
   // single-flight bounds host work. Does not replace cheaper activation or
@@ -3166,7 +3218,7 @@ export class OrcaRuntimeService {
   private canonicalFetchKeyCache = new Map<string, string>()
   private optimisticReconcileTokens = new Map<string, string>()
   private removeManagedWorktreeInFlight = new Map<string, RuntimeWorktreeRemovalInFlight>()
-  private preservedBranchCleanupByWorktreeId = new Map<string, PreservedBranchCleanupTarget>()
+  private preservedBranchCleanupByScope = new Map<string, PreservedBranchCleanupTarget>()
   private readonly getLocalProviderFn: (() => IPtyProvider) | null
   private readonly getSshProviderFn: ((connectionId: string) => IPtyProvider | undefined) | null
   private readonly onPtyStopped: ((ptyId: string) => void) | null
@@ -3786,6 +3838,9 @@ export class OrcaRuntimeService {
   }
 
   setOrchestrationDb(db: OrchestrationDb): void {
+    clearFederationAckCheckpoints(this)
+    this.orchestrationFederationSyncs.clear()
+    this.orchestrationFederationWarnings.clear()
     this._orchestrationDb = db
   }
 
@@ -3803,7 +3858,11 @@ export class OrcaRuntimeService {
   prepareLegacyWorkerTerminalRecovery(): LegacyWorkerTerminalRecoveryPlan {
     const plan = this.getLegacyWorkerTerminalRecoveryPlan()
     const store = this.store
-    if (!store?.getWorkspaceSession || !store.setWorkspaceSession || !store.flushOrThrow) {
+    if (
+      !store?.getWorkspaceSession ||
+      !store.setWorkspaceSession ||
+      (!store.flushPendingOrThrowAsync && !store.flushOrThrow)
+    ) {
       return plan
     }
     const sessions = new Map<
@@ -3858,13 +3917,25 @@ export class OrcaRuntimeService {
       for (const [hostId, state] of changed) {
         store.setWorkspaceSession(state.next, hostId)
       }
-      store.flushOrThrow()
     } catch (error) {
-      console.warn('[orchestration] failed to persist legacy worker resume fence', error)
+      console.warn('[orchestration] failed to stage legacy worker resume fence', error)
     }
     return plan
   }
 
+  private async flushWorkspaceSessionOrThrowAsync(): Promise<void> {
+    const store = this.store
+    if (store?.flushPendingOrThrowAsync) {
+      await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      return
+    }
+    if (store?.flushOrThrow) {
+      store.flushOrThrow()
+      return
+    }
+    throw new Error('workspace_session_persistence_unavailable')
+  }
+
   async reconcileLegacyWorkerTerminals(
     options: { connectionId?: string; materializeRenderer?: boolean } = {}
   ): Promise<LegacyWorkerTerminalRecoveryResult> {
@@ -3964,33 +4035,71 @@ export class OrcaRuntimeService {
     )
   }
 
-  private persistLegacyWorkerTerminalRecoveryResolution(
-    candidate: LegacyWorkerTerminalRecoveryPlan['candidates'][number],
-    resolution: 'adopted' | 'exited'
-  ): boolean {
+  private async persistLegacyWorkerTerminalRecoveryBatch(
+    resolutions: readonly LegacyWorkerTerminalRecoveryResolution[]
+  ): Promise<ReadonlySet<string>> {
     const store = this.store
-    const session = this.getWorkspaceSessionForWorktree(candidate.worktreeId)
-    if (!store?.setWorkspaceSession || !store.flushOrThrow || !session) {
-      return false
+    if (
+      !store?.getWorkspaceSession ||
+      !store.setWorkspaceSession ||
+      (!store.flushPendingOrThrowAsync && !store.flushOrThrow)
+    ) {
+      return new Set()
     }
-    const record = session.sleepingAgentSessionsByPaneKey?.[candidate.paneKey]
-    if (!record || !runtimeWorktreeIdsEqual(record.worktreeId, candidate.worktreeId)) {
-      return true
-    }
-    const next = structuredClone(session)
-    delete next.sleepingAgentSessionsByPaneKey?.[candidate.paneKey]
+    const originalSessions = new Map<ExecutionHostId, WorkspaceSessionState>()
+    const stagedSessions = new Map<ExecutionHostId, WorkspaceSessionState>()
+    const stagedDispatchIds = new Set<string>()
     try {
-      this.setWorkspaceSessionForWorktree(candidate.worktreeId, next)
-      store.flushOrThrow()
-      return true
+      for (const { candidate, resolution } of resolutions) {
+        const hostId = this.tryGetWorkspaceSessionHostIdForWorktree(candidate.worktreeId)
+        const session = hostId ? store.getWorkspaceSession(hostId) : null
+        if (!hostId || !session) {
+          continue
+        }
+        originalSessions.set(hostId, originalSessions.get(hostId) ?? session)
+        let next =
+          resolution === 'exited'
+            ? retireTerminalSurfaceFromPersistence(session, {
+                worktreeId: candidate.worktreeId,
+                parentTabId: candidate.tabId,
+                leafId: candidate.leafId,
+                ptyId: candidate.ptyId,
+                incarnationId: candidate.incarnationId
+              })
+            : session
+        const record = next.sleepingAgentSessionsByPaneKey?.[candidate.paneKey]
+        if (record && runtimeWorktreeIdsEqual(record.worktreeId, candidate.worktreeId)) {
+          const sleepingAgentSessionsByPaneKey = { ...next.sleepingAgentSessionsByPaneKey }
+          delete sleepingAgentSessionsByPaneKey[candidate.paneKey]
+          next = { ...next, sleepingAgentSessionsByPaneKey }
+        }
+        if (next !== session) {
+          store.setWorkspaceSession(next, hostId)
+        }
+        stagedSessions.set(hostId, store.getWorkspaceSession(hostId))
+        stagedDispatchIds.add(candidate.dispatchId)
+      }
+      if (stagedDispatchIds.size > 0) {
+        await this.flushWorkspaceSessionOrThrowAsync()
+      }
+      return stagedDispatchIds
     } catch (error) {
-      this.setWorkspaceSessionForWorktree(candidate.worktreeId, session)
-      console.warn('[orchestration] failed to persist legacy worker recovery resolution', {
-        dispatchId: candidate.dispatchId,
-        resolution,
+      for (const [hostId, original] of originalSessions) {
+        const staged = stagedSessions.get(hostId)
+        const current = store.getWorkspaceSession(hostId)
+        if (!staged || !current) {
+          continue
+        }
+        const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(original, staged, current)
+        if (rolledBack !== current) {
+          store.setWorkspaceSession(rolledBack, hostId)
+        }
+      }
+      console.warn('[orchestration] failed to persist legacy worker recovery batch', {
+        dispatchIds: [...stagedDispatchIds],
         error
       })
-      return false
+      return new Set()
     }
   }
 
@@ -4015,48 +4124,9 @@ export class OrcaRuntimeService {
     }
   }
 
-  private resolveExitedLegacyWorkerTerminal(
-    candidate: LegacyWorkerTerminalRecoveryPlan['candidates'][number]
-  ): boolean {
-    if (
-      !this.rollbackLegacyWorkerTerminalSurface(candidate) ||
-      !this.persistLegacyWorkerTerminalRecoveryResolution(candidate, 'exited') ||
-      !this.reconcileMissingLegacyWorkerTerminal(candidate)
-    ) {
-      return false
-    }
-    this.notifier?.resolveLegacyWorkerTerminalRecovery?.(candidate.paneKey, 'exited')
-    return true
-  }
-
   private rollbackLegacyWorkerTerminalSurface(
     candidate: LegacyWorkerTerminalRecoveryPlan['candidates'][number]
-  ): boolean {
-    const store = this.store
-    const session = this.getWorkspaceSessionForWorktree(candidate.worktreeId)
-    if (store?.setWorkspaceSession && store.flushOrThrow && session) {
-      const retired = retireTerminalSurfaceFromPersistence(session, {
-        worktreeId: candidate.worktreeId,
-        parentTabId: candidate.tabId,
-        leafId: candidate.leafId,
-        ptyId: candidate.ptyId,
-        incarnationId: candidate.incarnationId
-      })
-      if (retired !== session) {
-        try {
-          this.setWorkspaceSessionForWorktree(candidate.worktreeId, retired)
-          store.flushOrThrow()
-        } catch (error) {
-          this.setWorkspaceSessionForWorktree(candidate.worktreeId, session)
-          console.warn('[orchestration] failed to persist legacy worker surface rollback', {
-            dispatchId: candidate.dispatchId,
-            error
-          })
-          return false
-        }
-      }
-    }
-
+  ): void {
     const snapshot = this.mobileSessionTabsByWorktree.get(candidate.worktreeId)
     if (snapshot) {
       const retired = retireTerminalSurfacesFromSnapshot({
@@ -4104,13 +4174,6 @@ export class OrcaRuntimeService {
       'rolled_back',
       candidate.ptyId
     )
-    return true
-  }
-
-  private resolveReplacedLegacyWorkerTerminal(
-    candidate: LegacyWorkerTerminalRecoveryPlan['candidates'][number]
-  ): boolean {
-    return this.resolveExitedLegacyWorkerTerminal(candidate)
   }
 
   private updateLegacyWorkerTerminalRecoveryRetry(
@@ -4190,6 +4253,7 @@ export class OrcaRuntimeService {
     const adoptedDispatchIds: string[] = []
     const exitedDispatchIds: string[] = []
     const deferredDispatchIds = new Set(plan.ambiguousDispatchIds)
+    const pendingResolutions: LegacyWorkerTerminalRecoveryResolution[] = []
     const recoveryCandidatesByProvider = new Map<
       string,
       {
@@ -4256,11 +4320,7 @@ export class OrcaRuntimeService {
       }
       for (const { candidate, workspace } of provider.entries) {
         if (!inventory.livePtyIds.has(candidate.ptyId)) {
-          if (this.resolveExitedLegacyWorkerTerminal(candidate)) {
-            exitedDispatchIds.push(candidate.dispatchId)
-          } else {
-            deferredDispatchIds.add(candidate.dispatchId)
-          }
+          pendingResolutions.push({ candidate, resolution: 'exited' })
           continue
         }
         const controllerIdentity = inventory.terminalIdentityByPtyId.get(candidate.ptyId)
@@ -4272,11 +4332,7 @@ export class OrcaRuntimeService {
           controllerIdentity.handle !== candidate.terminalHandle ||
           controllerIdentity.incarnationId !== candidate.incarnationId
         ) {
-          if (this.resolveReplacedLegacyWorkerTerminal(candidate)) {
-            exitedDispatchIds.push(candidate.dispatchId)
-          } else {
-            deferredDispatchIds.add(candidate.dispatchId)
-          }
+          pendingResolutions.push({ candidate, resolution: 'exited' })
           continue
         }
         const preAdoptionInventory = await this.refreshPtyWorktreeRecordsWithControllerInventory(
@@ -4290,11 +4346,7 @@ export class OrcaRuntimeService {
           continue
         }
         if (!preAdoptionInventory.livePtyIds.has(candidate.ptyId)) {
-          if (this.resolveExitedLegacyWorkerTerminal(candidate)) {
-            exitedDispatchIds.push(candidate.dispatchId)
-          } else {
-            deferredDispatchIds.add(candidate.dispatchId)
-          }
+          pendingResolutions.push({ candidate, resolution: 'exited' })
           continue
         }
         const preAdoptionIdentity = preAdoptionInventory.terminalIdentityByPtyId.get(
@@ -4308,11 +4360,7 @@ export class OrcaRuntimeService {
           preAdoptionIdentity.handle !== candidate.terminalHandle ||
           preAdoptionIdentity.incarnationId !== candidate.incarnationId
         ) {
-          if (this.resolveReplacedLegacyWorkerTerminal(candidate)) {
-            exitedDispatchIds.push(candidate.dispatchId)
-          } else {
-            deferredDispatchIds.add(candidate.dispatchId)
-          }
+          pendingResolutions.push({ candidate, resolution: 'exited' })
           continue
         }
         const session = this.getWorkspaceSessionForWorktree(candidate.worktreeId)
@@ -4443,11 +4491,7 @@ export class OrcaRuntimeService {
         if (!finalInventory.livePtyIds.has(candidate.ptyId)) {
           this.legacyWorkerTerminalReceiptEpochByPane.delete(candidate.paneKey)
           this.onPtyExit(candidate.ptyId, 0, candidate.incarnationId)
-          if (this.resolveExitedLegacyWorkerTerminal(candidate)) {
-            exitedDispatchIds.push(candidate.dispatchId)
-          } else {
-            deferredDispatchIds.add(candidate.dispatchId)
-          }
+          pendingResolutions.push({ candidate, resolution: 'exited' })
           continue
         }
         const finalIdentity = finalInventory.terminalIdentityByPtyId.get(candidate.ptyId)
@@ -4461,21 +4505,32 @@ export class OrcaRuntimeService {
           finalIdentity.incarnationId !== candidate.incarnationId
         ) {
           this.legacyWorkerTerminalReceiptEpochByPane.delete(candidate.paneKey)
-          if (this.resolveReplacedLegacyWorkerTerminal(candidate)) {
-            exitedDispatchIds.push(candidate.dispatchId)
-          } else {
-            deferredDispatchIds.add(candidate.dispatchId)
-          }
-          continue
-        }
-        if (!this.persistLegacyWorkerTerminalRecoveryResolution(candidate, 'adopted')) {
-          deferredDispatchIds.add(candidate.dispatchId)
+          pendingResolutions.push({ candidate, resolution: 'exited' })
           continue
         }
+        pendingResolutions.push({ candidate, resolution: 'adopted' })
+      }
+    }
+    const persistedDispatchIds =
+      await this.persistLegacyWorkerTerminalRecoveryBatch(pendingResolutions)
+    for (const { candidate, resolution } of pendingResolutions) {
+      if (!persistedDispatchIds.has(candidate.dispatchId)) {
+        deferredDispatchIds.add(candidate.dispatchId)
+        continue
+      }
+      if (resolution === 'adopted') {
         this.legacyWorkerRecoveredPtys.add(candidate.ptyId)
         this.notifier?.resolveLegacyWorkerTerminalRecovery?.(candidate.paneKey, 'adopted')
         adoptedDispatchIds.push(candidate.dispatchId)
+        continue
       }
+      this.rollbackLegacyWorkerTerminalSurface(candidate)
+      if (!this.reconcileMissingLegacyWorkerTerminal(candidate)) {
+        deferredDispatchIds.add(candidate.dispatchId)
+        continue
+      }
+      this.notifier?.resolveLegacyWorkerTerminalRecovery?.(candidate.paneKey, 'exited')
+      exitedDispatchIds.push(candidate.dispatchId)
     }
     const result = {
       blockedPaneCount: plan.blockedPanes.length,
@@ -4616,29 +4671,46 @@ export class OrcaRuntimeService {
     )
   }
 
-  private syncOrchestrationFederatedDispatch(dispatchId: string): Promise<void> {
+  syncOrchestrationFederatedDispatch(dispatchId: string): Promise<void> {
+    const db = this.getOrchestrationDb()
     const current = this.orchestrationFederationSyncs.get(dispatchId)
-    if (current) {
-      return current
+    if (current?.db === db) {
+      return current.promise
     }
     const sync = syncFederatedDispatch(this, dispatchId)
       .then(() => {
-        this.orchestrationFederationWarnings.delete(dispatchId)
+        if (this.orchestrationFederationSyncs.get(dispatchId)?.promise === sync) {
+          this.orchestrationFederationWarnings.delete(dispatchId)
+        }
       })
       .catch((error: unknown) => {
-        if (!this.orchestrationFederationWarnings.has(dispatchId)) {
+        if (
+          this.orchestrationFederationSyncs.get(dispatchId)?.promise === sync &&
+          !this.orchestrationFederationWarnings.has(dispatchId)
+        ) {
           console.warn(`[orchestration] Federation sync failed for ${dispatchId}:`, error)
           this.orchestrationFederationWarnings.add(dispatchId)
         }
         throw error
       })
       .finally(() => {
-        this.orchestrationFederationSyncs.delete(dispatchId)
+        if (this.orchestrationFederationSyncs.get(dispatchId)?.promise === sync) {
+          this.orchestrationFederationSyncs.delete(dispatchId)
+        }
       })
-    this.orchestrationFederationSyncs.set(dispatchId, sync)
+    this.orchestrationFederationSyncs.set(dispatchId, { db, promise: sync })
     return sync
   }
 
+  async syncOrchestrationFederatedDispatchAfterCurrent(dispatchId: string): Promise<void> {
+    const db = this.getOrchestrationDb()
+    const current = this.orchestrationFederationSyncs.get(dispatchId)
+    if (current?.db === db) {
+      await current.promise.catch(() => undefined)
+    }
+    await this.syncOrchestrationFederatedDispatch(dispatchId)
+  }
+
   ensureOrchestrationFederationRelay(runId?: string): void {
     if (!this.orchestrationEnvironmentTransport) {
       return
@@ -4673,6 +4745,8 @@ export class OrcaRuntimeService {
     }
     this.orchestrationFederationTimers.clear()
     this.orchestrationFederationWarnings.clear()
+    this.orchestrationFederationSyncs.clear()
+    clearFederationAckCheckpoints(this)
   }
 
   getStartedAt(): number {
@@ -6534,6 +6608,21 @@ export class OrcaRuntimeService {
     }
   }
 
+  private getMobileSessionWorktreeIdsForPty(ptyId: string): string[] {
+    const worktreeIds: string[] = []
+    for (const [worktreeId, snapshot] of this.mobileSessionTabsByWorktree) {
+      const hasPtyBackedTab = snapshot.tabs.some(
+        (tab) =>
+          tab.type === 'terminal' &&
+          (tab.ptyId === ptyId || tab.parentLayout?.ptyIdsByLeafId?.[tab.leafId] === ptyId)
+      )
+      if (hasPtyBackedTab) {
+        worktreeIds.push(worktreeId)
+      }
+    }
+    return worktreeIds
+  }
+
   /** Bump the snapshot version and emit, coalesced unless `immediate`.
    *  Why the bump: clients gate mirrored snapshots on a strictly increasing
    *  `snapshotVersion`, so a re-emit at the same version is silently dropped. */
@@ -7592,10 +7681,10 @@ export class OrcaRuntimeService {
     ptyId: string
     splitFromLeafId: string
     direction: 'horizontal' | 'vertical'
-  }): void {
+  }): boolean {
     const session = this.getWorkspaceSessionForWorktree(args.worktreeId)
     if (!session || !this.store?.setWorkspaceSession) {
-      return
+      return false
     }
     const existing = session.terminalLayoutsByTabId?.[args.tabId]
     const nextLayout = buildHeadlessTerminalSplitLayout(
@@ -7609,6 +7698,7 @@ export class OrcaRuntimeService {
         [args.tabId]: nextLayout
       }
     })
+    return true
   }
 
   private persistHeadlessTerminalActiveLeaf(
@@ -9081,6 +9171,9 @@ export class OrcaRuntimeService {
       // subscriber closing mid-window still receives the latest settled state.
       this.mobileSessionTabsNotifyCoalescer.flushAll()
       this.mobileSessionTabListeners.delete(subscription)
+      if (this.mobileSessionTabListeners.size === 0) {
+        this.mobileSessionTabsAgentStatusHeartbeat.cancelPending()
+      }
     }
   }
 
@@ -9303,6 +9396,7 @@ export class OrcaRuntimeService {
       isTuiAgent(agentLaunchAuthority.launchAgent)
     ) {
       pty.launchToken = agentLaunchAuthority.launchToken
+      pty.launchIncarnationId = binding.incarnationId
       pty.launchAgent = agentLaunchAuthority.launchAgent
     }
     const pendingIncarnation = this.pendingPtyRegistrationIncarnations.get(ptyId)
@@ -9867,13 +9961,11 @@ export class OrcaRuntimeService {
   ingestSyntheticTitleFrame(ptyId: string, data: string): void {
     const entry = this.getOrCreatePtyTitleTrackerEntry(ptyId)
     entry.applyingChunk = true
-    entry.applyingSyntheticFrame = true
     entry.chunkTouchedSessionTabs = false
     try {
       entry.tracker.applySyntheticTitleFrame(data)
     } finally {
       entry.applyingChunk = false
-      entry.applyingSyntheticFrame = false
       this.flushPendingTerminalSideEffectFacts(ptyId, entry)
     }
     if (entry.chunkTouchedSessionTabs) {
@@ -10111,13 +10203,13 @@ export class OrcaRuntimeService {
     return { ...snapshot, lastTitle: tracked }
   }
 
-  /** Decorative comparison key: spinner frame glyphs stripped, derived agent
-   *  status kept so a working→idle flip with an otherwise-equal label still
-   *  counts as a change. */
+  /** Decorative comparison key: only recognized agent titles fold leading spinner frames. */
   private makeDecorativeTitleGateKey(rawTitle: string, normalizedTitle: string): string {
-    return `${detectAgentStatusFromTitle(rawTitle) ?? ''}\u0000${stripBrailleSpinnerGlyphs(
-      normalizedTitle
-    )}`
+    // Stable Pi/Gemini/Grok display normalization also defines their semantic gate.
+    const normalizedSignature =
+      rawTitle === normalizedTitle ? null : getDecorativeAgentTitleSignature(normalizedTitle)
+    const signature = normalizedSignature ?? getDecorativeAgentTitleSignature(rawTitle)
+    return signature === null ? `literal\u0000${normalizedTitle}` : `agent\u0000${signature}`
   }
 
   private getOrCreatePtyTitleTrackerEntry(ptyId: string): RuntimePtyTitleTrackerEntry {
@@ -10148,28 +10240,42 @@ export class OrcaRuntimeService {
             ...(meta?.staleWorkingTitleClear ? { staleWorkingTitleClear: true } : {})
           })
           const changed = this.applyTrackedPtyTitle(ptyId, rawTitle, normalizedTitle, meta)
-          // Why: an identity-only cursor title records nothing, so on a fresh pane `changed` is
-          // false — but the tracker title is that pane's only Cursor identity and still has to
-          // fan out to the sidebar and mobile (#10258).
-          if (!changed && !this.isLiveCursorNativeTitle(rawTitle, meta)) {
-            return
-          }
+          const identityOnlyTitle = this.isLiveCursorNativeTitle(rawTitle, meta)
           const live = this.ptyTitleTrackersByPtyId.get(ptyId)
           const gateKey = this.makeDecorativeTitleGateKey(rawTitle, normalizedTitle)
           const decorativeOnly = live?.lastMobileTitleGateKey === gateKey
           if (live) {
             live.lastMobileTitleGateKey = gateKey
           }
+          const tracksReplicatedStatus =
+            live?.applyingChunk === true && this.mobileSessionTabListeners.size > 0
+          const titleStatus = tracksReplicatedStatus ? detectAgentStatusFromTitle(rawTitle) : null
+          if (
+            tracksReplicatedStatus &&
+            decorativeOnly &&
+            !this.ptyDelayedForegroundSnapshotTitleObservations.has(ptyId) &&
+            (titleStatus === 'working' || titleStatus === 'permission')
+          ) {
+            // Normalized Pi/Gemini/Grok frames still renew the replicated status lease.
+            this.mobileSessionTabsAgentStatusHeartbeat.scheduleDecorativeHeartbeat(ptyId)
+          }
+          // Why: an identity-only cursor title records nothing, but the tracker
+          // title is that pane's only Cursor identity and must still fan out (#10258).
+          if (!changed && !identityOnlyTitle) {
+            return
+          }
           if (live?.applyingChunk) {
             // Why: synthetic spinner ticks change only the braille glyph
             // ~12.5x/sec; fanning out full mobile session snapshots per frame
             // is pure churn. Raw lastOscTitle updates above stay cheap.
-            if (!(live.applyingSyntheticFrame && decorativeOnly)) {
+            if (!decorativeOnly) {
+              this.mobileSessionTabsAgentStatusHeartbeat.observeSemanticTitle(ptyId)
               live.chunkTouchedSessionTabs = true
             }
           } else {
             // Stale-working-title timer path — fires between chunks, so the
             // per-chunk batching in onPtyData cannot pick it up.
+            this.mobileSessionTabsAgentStatusHeartbeat.observeSemanticTitle(ptyId)
             this.touchMobileSessionSnapshotsForPty(ptyId)
           }
         },
@@ -10213,7 +10319,6 @@ export class OrcaRuntimeService {
     const entry: RuntimePtyTitleTrackerEntry = {
       tracker,
       applyingChunk: false,
-      applyingSyntheticFrame: false,
       lastMobileTitleGateKey: null,
       chunkTouchedSessionTabs: false,
       pendingFacts: [],
@@ -10255,11 +10360,22 @@ export class OrcaRuntimeService {
       const prevStatus = pty.lastAgentStatus
       const prevTitle = pty.lastOscTitle
       const observedAt = this.nextTitleObservationSequence()
+      const observedAtEpochMs = identityOnlyTitle ? null : Date.now()
       pty.lastOscTitle = recordedTitle
       pty.lastOscTitleAt = identityOnlyTitle ? null : observedAt
-      pty.lastOscTitleEpochMs = identityOnlyTitle ? null : Date.now()
+      pty.lastOscTitleEpochMs = observedAtEpochMs
       pty.lastAgentStatus = agentStatus
       pty.lastAgentStatusObservedLive = true
+      if (prevStatus !== agentStatus) {
+        pty.lastAgentStatusStartedAtEpochMs = observedAtEpochMs
+      }
+      if (
+        identityOnlyTitle ||
+        terminalTitleBlocksExplicitAgentStatus(recordedTitle) ||
+        (prevStatus !== null && agentStatus !== null && prevStatus !== agentStatus)
+      ) {
+        pty.lastAgentStatusRichInvalidatedAtEpochMs = observedAtEpochMs ?? Date.now()
+      }
       if (identityOnlyTitle) {
         pty.managementTitle = null
         pty.managementTitleAt = null
@@ -10339,6 +10455,8 @@ export class OrcaRuntimeService {
   private disposePtyTitleTracker(ptyId: string): void {
     this.ptyTitleTrackersByPtyId.get(ptyId)?.tracker.dispose()
     this.ptyTitleTrackersByPtyId.delete(ptyId)
+    this.ptyDelayedForegroundSnapshotTitleObservations.delete(ptyId)
+    this.mobileSessionTabsAgentStatusHeartbeat.removePty(ptyId)
     for (const titleGateKeys of this.terminalSideEffectTitleGateKeysByClientEventListener.values()) {
       titleGateKeys.delete(ptyId)
     }
@@ -10360,6 +10478,8 @@ export class OrcaRuntimeService {
       // Why: the prior process's live frames say nothing about the replacement,
       // so the seed a same-id restore applies must not inherit its authority.
       pty.lastAgentStatusObservedLive = false
+      pty.lastAgentStatusStartedAtEpochMs = null
+      pty.lastAgentStatusRichInvalidatedAtEpochMs = Date.now()
       pty.managementTitle = null
       pty.managementTitleAt = null
     }
@@ -11020,6 +11140,7 @@ export class OrcaRuntimeService {
     opts: { scrollbackRows?: number } = {}
   ): Promise<{
     data: string
+    frameRestoreAnsi?: string
     cols: number
     rows: number
     seq?: number
@@ -11038,6 +11159,7 @@ export class OrcaRuntimeService {
     opts: { scrollbackRows?: number } = {}
   ): Promise<{
     data: string
+    frameRestoreAnsi?: string
     cols: number
     rows: number
     cwd?: string | null
@@ -11488,6 +11610,7 @@ export class OrcaRuntimeService {
     opts: { scrollbackRows?: number } = {}
   ): Promise<{
     data: string
+    frameRestoreAnsi?: string
     cols: number
     rows: number
     cwd?: string | null
@@ -11497,6 +11620,7 @@ export class OrcaRuntimeService {
     oscLinks?: TerminalOscLinkRange[]
     alternateScreen?: boolean
     pendingEscapeTailAnsi?: string
+    kittyKeyboardFlags?: number
   } | null> {
     if (this.providerSnapshotPreferredPtys.has(ptyId)) {
       // Why: pre-attach stream bytes only form a suffix of restored state. A
@@ -11538,6 +11662,7 @@ export class OrcaRuntimeService {
     opts: { scrollbackRows?: number } = {}
   ): Promise<{
     data: string
+    frameRestoreAnsi?: string
     cols: number
     rows: number
     seq?: number
@@ -11545,6 +11670,7 @@ export class OrcaRuntimeService {
     lastTitle?: string
     source?: 'renderer'
     oscLinks?: TerminalOscLinkRange[]
+    kittyKeyboardFlags?: number
   } | null> {
     if (this.ptyController?.hasRendererSerializer?.(ptyId) === false) {
       return null
@@ -11557,6 +11683,7 @@ export class OrcaRuntimeService {
       cwd?: string | null
       lastTitle?: string
       oscLinks?: TerminalOscLinkRange[]
+      kittyKeyboardFlags?: number
     } | null = null
     try {
       // Why: recovery/read fallback wants visible alt-screen content (e.g. an
@@ -11939,6 +12066,7 @@ export class OrcaRuntimeService {
     oscLinks?: TerminalOscLinkRange[]
     alternateScreen?: boolean
     scrollbackAnsi?: string
+    kittyKeyboardFlags?: number
     // Why: dangling mid-escape tail the restorer must write LAST, after any
     // reset, so the next live chunk completes it instead of rendering it
     // literally (Bug E / #7329).
@@ -11958,6 +12086,7 @@ export class OrcaRuntimeService {
     return data.length > 0 || opts.includeEmpty === true
       ? this.preferTrackedLastTitle(ptyId, {
           data,
+          frameRestoreAnsi: snapshot.frameRestoreAnsi,
           cols: snapshot.cols,
           rows: snapshot.rows,
           cwd: snapshot.cwd ?? this.terminalCwdByPtyId.get(ptyId),
@@ -11966,6 +12095,12 @@ export class OrcaRuntimeService {
           source: 'headless' as const,
           oscLinks: snapshot.oscLinks,
           scrollbackAnsi: snapshot.scrollbackAnsi,
+          // Why beside outputSequence and never re-read later: the flags must
+          // describe the same stream position as the image, or replay would
+          // apply push/pop transitions twice or out of order.
+          ...(parseTerminalKittyKeyboardFlags(snapshot.modes?.kittyKeyboardFlags) !== undefined
+            ? { kittyKeyboardFlags: snapshot.modes.kittyKeyboardFlags }
+            : {}),
           ...(snapshot.pendingEscapeTailAnsi
             ? { pendingEscapeTailAnsi: snapshot.pendingEscapeTailAnsi }
             : {}),
@@ -12271,6 +12406,7 @@ export class OrcaRuntimeService {
     }
     this.restoredOrchestrationAuthorityByPtyId.delete(ptyId)
     pty.launchToken = null
+    pty.launchIncarnationId = null
     const paneKeys = new Set<string>()
     if (pty.paneKey && parsePaneKey(pty.paneKey)) {
       paneKeys.add(pty.paneKey)
@@ -15408,6 +15544,24 @@ export class OrcaRuntimeService {
     }
   }
 
+  async inspectTerminalProcessIncarnationLiveness(
+    processIncarnation: string,
+    serializedHostScope: string | null
+  ): Promise<'live' | 'dead' | 'unknown'> {
+    const hostScope = parseWorkerTerminalHostScope(serializedHostScope)
+    if (!hostScope || !this.ptyController?.listProcesses) {
+      return 'unknown'
+    }
+    const listed = await withTimeoutResult(
+      this.ptyController.listProcesses(hostScope.kind === 'ssh' ? hostScope.targetId : null),
+      PTY_CONTROLLER_LIST_TIMEOUT_MS
+    )
+    if (!listed.ok) {
+      return 'unknown'
+    }
+    return classifyWorkerTerminalProcessIncarnation(processIncarnation, listed.value)
+  }
+
   private getTerminalTopologyRevision(worktreeId: string): number {
     const repoId = getRepoIdFromWorktreeId(worktreeId)
     return (
@@ -15447,7 +15601,11 @@ export class OrcaRuntimeService {
     const { livePtyIds, terminalIdentityByPtyId } = inventory
     const store = this.store
     const session = this.getWorkspaceSessionForWorktree(workspace.id)
-    if (!store?.setWorkspaceSession || !store.flushOrThrow || !session) {
+    if (
+      !store?.setWorkspaceSession ||
+      (!store.flushPendingOrThrowAsync && !store.flushOrThrow) ||
+      !session
+    ) {
       throw new Error('workspace_session_unavailable')
     }
     const sessionWorktreeId = resolveTerminalSessionWorktreeId(session, workspace.id)
@@ -15867,11 +16025,19 @@ export class OrcaRuntimeService {
       [workspace.id]: activeGroup.id
     }
     const persisted = advanceTerminalTopologyRevision(next, workspace.id)
+    let staged: WorkspaceSessionState | null = null
     try {
       this.setWorkspaceSessionForWorktree(workspace.id, persisted)
-      store.flushOrThrow()
+      staged = this.getWorkspaceSessionForWorktree(workspace.id)
+      await this.flushWorkspaceSessionOrThrowAsync()
     } catch (error) {
-      this.setWorkspaceSessionForWorktree(workspace.id, session)
+      const current = this.getWorkspaceSessionForWorktree(workspace.id)
+      if (staged && current) {
+        const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(session, staged, current)
+        if (rolledBack !== current) {
+          this.setWorkspaceSessionForWorktree(workspace.id, rolledBack)
+        }
+      }
       throw error
     }
     for (const { claim, pty, paneKey } of validated) {
@@ -16606,7 +16772,8 @@ export class OrcaRuntimeService {
     const liveTitleClearsBlockedText =
       terminal.titleStatusIsLive &&
       terminal.titleStatus !== null &&
-      terminal.titleStatus !== 'permission'
+      terminal.titleStatus !== 'permission' &&
+      !isOpenCodeNativeTitle(terminal.title)
     if (terminal.titleStatus === 'permission' && terminal.titleStatusIsLive) {
       return { handle, isRunningAgent: true, status: 'permission' }
     }
@@ -16633,6 +16800,20 @@ export class OrcaRuntimeService {
       }
     }
     if (terminal.titleStatus) {
+      // Why: an OpenCode marker and a lone quarter-circle spinner (STA-4028) are activity,
+      // not identity, so resolve both through the identity/foreground evidence path.
+      if (
+        isOpenCodeNativeTitle(terminal.title) ||
+        isQuarterCircleSpinnerOnlyAgentTitle(terminal.title)
+      ) {
+        const isRunningAgent = await this.isTerminalRunningAgent(handle)
+        this.assertTerminalAgentStatusPtyBinding(handle, ptyId)
+        return {
+          handle,
+          isRunningAgent,
+          status: isRunningAgent ? terminal.titleStatus : null
+        }
+      }
       return { handle, isRunningAgent: true, status: terminal.titleStatus }
     }
 
@@ -16916,6 +17097,9 @@ export class OrcaRuntimeService {
         return
       }
       this.ptyDelayedForegroundSnapshotTitleObservations.delete(ptyId)
+      if (this.mobileSessionTabListeners.size > 0) {
+        this.mobileSessionTabsAgentStatusHeartbeat.observeSemanticTitle(ptyId)
+      }
       if (!foregroundAgentChanged) {
         this.touchMobileSessionSnapshotsForPty(ptyId)
       }
@@ -17527,6 +17711,7 @@ export class OrcaRuntimeService {
         ...(meta?.manualOrder !== undefined ? { manualOrder: meta.manualOrder } : {}),
         lastActivityAt: worktree.lastActivityAt,
         ...(worktree.createdAt !== undefined ? { createdAt: worktree.createdAt } : {}),
+        ...(worktree.creatorProvenance ? { creatorProvenance: worktree.creatorProvenance } : {}),
         linkedIssue: worktree.linkedIssue,
         linkedPR,
         linkedLinearIssue: meta?.linkedLinearIssue ?? null,
@@ -17575,6 +17760,7 @@ export class OrcaRuntimeService {
         ...(worktree.manualOrder !== undefined ? { manualOrder: worktree.manualOrder } : {}),
         lastActivityAt: worktree.lastActivityAt,
         ...(worktree.createdAt !== undefined ? { createdAt: worktree.createdAt } : {}),
+        ...(worktree.creatorProvenance ? { creatorProvenance: worktree.creatorProvenance } : {}),
         linkedIssue: worktree.linkedIssue ?? null,
         linkedPR: null,
         linkedLinearIssue: worktree.linkedLinearIssue ?? null,
@@ -18249,6 +18435,7 @@ export class OrcaRuntimeService {
     name?: string
     folderPath?: string | null
     connectionId?: string | null
+    creatorProvenance?: FolderWorkspace['creatorProvenance']
     linkedTask?: FolderWorkspace['linkedTask']
     linkedTaskSourceContext?: FolderWorkspace['linkedTaskSourceContext']
     createdWithAgent?: FolderWorkspace['createdWithAgent']
@@ -18277,7 +18464,10 @@ export class OrcaRuntimeService {
       { getSshFilesystemProvider }
     )
     assertFolderWorkspacePathUsable(status)
-    const workspace = this.store.createFolderWorkspace(input)
+    const workspace = this.store.createFolderWorkspace({
+      ...input,
+      creatorProvenance: input.creatorProvenance ?? { kind: 'host' }
+    })
     this.notifyReposChanged()
     return workspace
   }
@@ -18311,6 +18501,7 @@ export class OrcaRuntimeService {
         | 'pendingFirstAgentMessageRename'
         | 'firstAgentMessageRenameError'
         | 'lastActivityAt'
+        | 'diffComments'
       >
     >
   ): Promise<FolderWorkspace | null> {
@@ -18362,6 +18553,7 @@ export class OrcaRuntimeService {
     if (!isAbsolute(path)) {
       throw new Error('Project path must be an absolute path')
     }
+    await awaitWindowsHostGitEnvironmentReady({ cwd: path })
     return scanNestedRepos({ path, options: { timeoutMs: 15_000 } })
   }
 
@@ -18410,6 +18602,7 @@ export class OrcaRuntimeService {
     projectPaths: string[]
     mode: ProjectGroupImportMode
   }): Promise<ProjectGroupImportResult> {
+    await awaitWindowsHostGitEnvironmentReady({ cwd: args.parentPath })
     if (!this.store?.createProjectGroup || !this.store?.moveProjectToGroup) {
       throw new Error('runtime_unavailable')
     }
@@ -18437,6 +18630,7 @@ export class OrcaRuntimeService {
     const importTargetResolver = createNestedRepoImportTargetResolver()
     for (const [projectGroupOrder, repoPath] of selection.selectedPaths.entries()) {
       try {
+        await awaitWindowsHostGitEnvironmentReady({ cwd: repoPath })
         if (!isGitRepo(repoPath)) {
           results.push({ path: repoPath, status: 'failed', error: 'Not a valid git repository' })
           continue
@@ -18564,6 +18758,9 @@ export class OrcaRuntimeService {
       // server-side repo paths to be explicit so `orca serve` cwd is irrelevant.
       throw new Error('Project path must be an absolute path')
     }
+    if (kind === 'git') {
+      await awaitWindowsHostGitEnvironmentReady({ cwd: path })
+    }
     if (kind === 'git' && !isGitRepo(path)) {
       throw new Error(`Not a valid git repository: ${path}`)
     }
@@ -18810,10 +19007,11 @@ export class OrcaRuntimeService {
 
     await mkdir(trimmedDestination, { recursive: true })
     const claimedTarget = await claimCloneTarget(clonePath)
-    await new Promise<void>((resolve, reject) => {
-      let proc: ReturnType<typeof gitSpawn>
-      try {
-        proc = gitSpawn(['clone', '--progress', '--', trimmedUrl, clonePath], {
+    let proc: Awaited<ReturnType<typeof gitSpawnAfterWindowsEnvironmentReady>>
+    try {
+      proc = await gitSpawnAfterWindowsEnvironmentReady(
+        ['clone', '--progress', '--', trimmedUrl, clonePath],
+        {
           cwd: trimmedDestination,
           // Why: without the non-interactive guard, a clone that needs GitHub
           // auth makes Git Credential Manager pop its "Connect to GitHub" OAuth
@@ -18822,14 +19020,14 @@ export class OrcaRuntimeService {
           // (issue #7652). Fail fast with a clear error instead.
           env: nonInteractiveGitEnv(),
           stdio: ['ignore', 'ignore', 'pipe']
-        })
-      } catch (err) {
-        void cleanupClaimedCloneTarget(clonePath, claimedTarget).finally(() => {
-          const message = err instanceof Error ? err.message : String(err)
-          reject(new Error(`Clone failed: ${message}`))
-        })
-        return
-      }
+        }
+      )
+    } catch (err) {
+      await cleanupClaimedCloneTarget(clonePath, claimedTarget)
+      const message = err instanceof Error ? err.message : String(err)
+      throw new Error(`Clone failed: ${message}`)
+    }
+    await new Promise<void>((resolve, reject) => {
       let stderrTail = ''
       let settled = false
       proc.stderr?.on('data', (chunk: Buffer) => {
@@ -19559,6 +19757,36 @@ export class OrcaRuntimeService {
     return result
   }
 
+  async createStackedHostedReview(
+    args: CreateStackedHostedReviewInput & { repoSelector: string; worktreeSelector?: string }
+  ): Promise<CreateStackedHostedReviewResult> {
+    const { repo, repoPath } = await this.resolveHostedReviewTarget(args)
+    const executionOptions = this.getHostedReviewExecutionOptions(repo)
+    const result = await createStackedHostedReviewFromRepo(
+      repoPath,
+      {
+        provider: args.provider,
+        base: args.base,
+        head: args.head,
+        title: args.title,
+        body: args.body,
+        draft: args.draft,
+        ...(args.useTemplate !== undefined ? { useTemplate: args.useTemplate } : {})
+      },
+      repo.connectionId ?? null,
+      executionOptions ?? {}
+    )
+    if (result.ok && this.stats && !this.stats.hasCountedPR(result.url)) {
+      this.stats.record({
+        type: 'pr_created',
+        at: Date.now(),
+        repoId: repo.id,
+        meta: { prNumber: result.number, prUrl: result.url }
+      })
+    }
+    return result
+  }
+
   async listGitLabRepoWorkItems(
     repoSelector: string,
     state?: MRListState,
@@ -19998,14 +20226,17 @@ export class OrcaRuntimeService {
       checkName?: string
       url?: string | null
       prRepo?: GitHubOwnerRepo | null
-    }
+    },
+    signal?: AbortSignal
   ): Promise<Awaited<ReturnType<typeof getPRCheckDetails>>> {
     const repo = await this.resolveRepoSelector(repoSelector)
+    const localGitOptions = this.getLocalGitExecutionOptionArgs(repo)[0] ?? {}
     return getPRCheckDetails(
       repo.path,
       { ...args, prRepo: args.prRepo ?? null },
       repo.connectionId ?? null,
-      ...this.getLocalGitExecutionOptionArgs(repo)
+      localGitOptions,
+      signal
     )
   }
 
@@ -21597,6 +21828,7 @@ export class OrcaRuntimeService {
     pendingFirstAgentMessageRename?: boolean
     automationProvenance?: AutomationWorkspaceProvenance
     cliProvenance?: CliWorkspaceProvenance
+    creatorProvenance?: Worktree['creatorProvenance']
     startup?: WorktreeStartupLaunch
     startupDraft?: string
     startupDraftPaste?: WorktreeStartupDraftPaste
@@ -21663,6 +21895,7 @@ export class OrcaRuntimeService {
         },
         ...(args.automationProvenance ? { automationProvenance: args.automationProvenance } : {}),
         ...(args.cliProvenance ? { cliProvenance: args.cliProvenance } : {}),
+        creatorProvenance: args.creatorProvenance ?? { kind: 'host' },
         ...(args.linkedIssue !== undefined ? { linkedIssue: args.linkedIssue } : {}),
         ...(args.linkedPR !== undefined ? { linkedPR: args.linkedPR } : {}),
         ...(args.linkedLinearIssue !== undefined
@@ -22291,6 +22524,7 @@ export class OrcaRuntimeService {
         : {}),
       ...(args.automationProvenance ? { automationProvenance: args.automationProvenance } : {}),
       ...(args.cliProvenance ? { cliProvenance: args.cliProvenance } : {}),
+      creatorProvenance: args.creatorProvenance ?? { kind: 'host' },
       ...(args.comment !== undefined ? { comment: args.comment } : {}),
       ...(args.manualOrder !== undefined ? { manualOrder: args.manualOrder } : {}),
       ...(args.workspaceStatus !== undefined ? { workspaceStatus: args.workspaceStatus } : {})
@@ -23496,8 +23730,7 @@ export class OrcaRuntimeService {
       this.invalidateWorktreeScanCacheForRepo(worktree.repoId)
     }
     const shouldClearPushTarget =
-      Object.prototype.hasOwnProperty.call(metaUpdates, 'pushTarget') &&
-      metaUpdates.pushTarget === null
+      Object.hasOwn(metaUpdates, 'pushTarget') && metaUpdates.pushTarget === null
     const normalizedMetaUpdates: Partial<WorktreeMeta> = shouldClearPushTarget
       ? { ...metaUpdates, pushTarget: undefined }
       : (metaUpdates as Partial<WorktreeMeta>)
@@ -23566,21 +23799,29 @@ export class OrcaRuntimeService {
     if (!this.store) {
       throw new Error('runtime_unavailable')
     }
-    const now = Date.now()
-    let updated = 0
-    for (let i = 0; i < orderedIds.length; i++) {
-      // Why: a sort-order snapshot must only reorder existing worktrees, never
-      // mint new meta — a stale id would otherwise resurrect an orphan workspace
-      // (setWorktreeMeta has no repo-existence check).
-      if (!this.store.getWorktreeMeta(orderedIds[i])) {
-        continue
-      }
-      this.store.setWorktreeMeta(orderedIds[i], { sortOrder: now - i * 1000 })
-      updated++
+    const store = this.store
+    const updates = planWorktreeSortOrderUpdates(
+      orderedIds,
+      (worktreeId) => store.getWorktreeMeta(worktreeId),
+      Date.now()
+    )
+    for (const update of updates) {
+      store.setWorktreeMeta(update.worktreeId, { sortOrder: update.sortOrder })
+    }
+    if (updates.length === 0) {
+      return { updated: 0 }
     }
     this.invalidateResolvedWorktreeCache()
-    this.notifyReposChanged()
-    return { updated }
+    const changedRepoIds = new Set(
+      updates.flatMap((update) => {
+        const parsed = splitWorktreeId(update.worktreeId)
+        return parsed ? [parsed.repoId] : []
+      })
+    )
+    for (const repoId of changedRepoIds) {
+      this.notifyWorktreesChanged(repoId)
+    }
+    return { updated: updates.length }
   }
 
   async resolveManagedPrBase(args: {
@@ -23975,6 +24216,7 @@ export class OrcaRuntimeService {
       store.removeWorktreeMeta(worktreeId)
     }
     this.mobileSessionTabsByWorktree.delete(worktreeId)
+    this.mobileSessionTabsAgentStatusHeartbeat.removeWorktree(worktreeId)
     this.acceptedRendererMobileSnapshotByWorktree.delete(worktreeId)
     advertisedUrlWatcher.forgetWorktree(worktreeId)
     deleteWorktreeHistoryDir(worktreeId)
@@ -23995,6 +24237,7 @@ export class OrcaRuntimeService {
 
   private rememberPreservedBranchCleanupTarget(
     worktreeId: string,
+    hostId: ExecutionHostId | undefined,
     result: RemoveWorktreeResult | undefined,
     fallbackHead: string | undefined,
     pushTarget: GitPushTarget | undefined
@@ -24006,14 +24249,21 @@ export class OrcaRuntimeService {
           `Cannot safely offer force-delete for preserved branch "${result.preservedBranch.branchName}" without its saved commit.`
         )
       }
-      this.preservedBranchCleanupByWorktreeId.set(worktreeId, {
-        branchName: result.preservedBranch.branchName,
-        head,
-        ...(pushTarget ? { pushTarget } : {})
-      })
+      this.preservedBranchCleanupByScope.set(
+        preservedBranchCleanupScopeKey({ worktreeId, hostId }),
+        {
+          worktreeId,
+          ...(hostId ? { hostId } : {}),
+          branchName: result.preservedBranch.branchName,
+          head,
+          ...(pushTarget ? { pushTarget } : {})
+        }
+      )
       return
     }
-    this.preservedBranchCleanupByWorktreeId.delete(worktreeId)
+    this.preservedBranchCleanupByScope.delete(
+      preservedBranchCleanupScopeKey({ worktreeId, hostId })
+    )
   }
 
   private preserveBranchHeadFallback(
@@ -24035,15 +24285,29 @@ export class OrcaRuntimeService {
   async forceDeletePreservedBranch(
     worktreeSelector: string,
     branchName: string,
-    expectedHead: string
+    expectedHead: string,
+    hostId?: string
   ): Promise<ForceDeleteWorktreeBranchResult> {
     if (!this.store) {
       throw new Error('runtime_unavailable')
     }
     const removalTarget = parseExactWorktreeIdSelector(worktreeSelector)
-    const cleanupTarget = removalTarget
-      ? this.preservedBranchCleanupByWorktreeId.get(removalTarget.id)
+    const normalizedHostId = parseExecutionHostId(hostId)?.id
+    const exactTarget = removalTarget
+      ? this.preservedBranchCleanupByScope.get(
+          preservedBranchCleanupScopeKey({ worktreeId: removalTarget.id, hostId: normalizedHostId })
+        )
       : undefined
+    const legacyMatches =
+      removalTarget && !hostId
+        ? [...this.preservedBranchCleanupByScope.values()].filter(
+            (target) =>
+              target.worktreeId === removalTarget.id &&
+              target.branchName === branchName &&
+              target.head === expectedHead
+          )
+        : []
+    const cleanupTarget = exactTarget ?? (legacyMatches.length === 1 ? legacyMatches[0] : undefined)
     if (
       !removalTarget ||
       !cleanupTarget ||
@@ -24097,7 +24361,12 @@ export class OrcaRuntimeService {
       )
     }
 
-    this.preservedBranchCleanupByWorktreeId.delete(removalTarget.id)
+    this.preservedBranchCleanupByScope.delete(
+      preservedBranchCleanupScopeKey({
+        worktreeId: removalTarget.id,
+        hostId: cleanupTarget.hostId
+      })
+    )
     return { deleted: true }
   }
 
@@ -24107,13 +24376,19 @@ export class OrcaRuntimeService {
     runHooks = false,
     // Why (#11960): only an explicit Force Delete waives PTY-stop proof; `force`
     // alone is already set by the ordinary delete confirmation.
-    allowUnverifiedPtyStop = false
+    allowUnverifiedPtyStop = false,
+    hostId?: string
   ): Promise<RemoveWorktreeResult & { warning?: string }> {
     if (!this.store) {
       throw new Error('runtime_unavailable')
     }
     const store = this.store
+    const cleanupHostId = parseExecutionHostId(hostId)?.id
     const removalTarget = await this.resolveWorktreeRemovalTarget(worktreeSelector)
+    const cleanupScopeKey = preservedBranchCleanupScopeKey({
+      worktreeId: removalTarget.id,
+      hostId: cleanupHostId
+    })
     const optionsKey = getRuntimeWorktreeRemovalOptionsKey(force, runHooks, allowUnverifiedPtyStop)
     const inFlightRemoval = this.removeManagedWorktreeInFlight.get(removalTarget.id)
     if (inFlightRemoval) {
@@ -24177,7 +24452,7 @@ export class OrcaRuntimeService {
           }
           this.clearOptimisticReconcileToken(removalTarget.id)
           this.removeWorktreeMetadataAndHistory(store, removalTarget.id)
-          this.preservedBranchCleanupByWorktreeId.delete(removalTarget.id)
+          this.preservedBranchCleanupByScope.delete(cleanupScopeKey)
           this.invalidateResolvedWorktreeCache()
           this.invalidateWorktreeScanCacheForRepo(removalTarget.repoId)
           invalidateAuthorizedRootsCache()
@@ -24220,7 +24495,7 @@ export class OrcaRuntimeService {
             })
           }
           this.removeWorktreeMetadataAndHistory(store, removalTarget.id)
-          this.preservedBranchCleanupByWorktreeId.delete(removalTarget.id)
+          this.preservedBranchCleanupByScope.delete(cleanupScopeKey)
           this.invalidateResolvedWorktreeCache()
           this.notifyWorktreesChanged(repo.id)
           return {}
@@ -24325,7 +24600,7 @@ export class OrcaRuntimeService {
             }
             this.clearOptimisticReconcileToken(removalTarget.id)
             this.removeWorktreeMetadataAndHistory(store, removalTarget.id)
-            this.preservedBranchCleanupByWorktreeId.delete(removalTarget.id)
+            this.preservedBranchCleanupByScope.delete(cleanupScopeKey)
             this.invalidateResolvedWorktreeCache()
             this.invalidateWorktreeScanCacheForRepo(removalTarget.repoId)
             invalidateAuthorizedRootsCache()
@@ -24374,7 +24649,7 @@ export class OrcaRuntimeService {
               )
               this.clearOptimisticReconcileToken(removalTarget.id)
               this.removeWorktreeMetadataAndHistory(store, removalTarget.id)
-              this.preservedBranchCleanupByWorktreeId.delete(removalTarget.id)
+              this.preservedBranchCleanupByScope.delete(cleanupScopeKey)
               this.invalidateResolvedWorktreeCache()
               this.invalidateWorktreeScanCacheForRepo(removalTarget.repoId)
               invalidateAuthorizedRootsCache()
@@ -24410,7 +24685,7 @@ export class OrcaRuntimeService {
                 ))
             this.clearOptimisticReconcileToken(removalTarget.id)
             this.removeWorktreeMetadataAndHistory(store, removalTarget.id)
-            this.preservedBranchCleanupByWorktreeId.delete(removalTarget.id)
+            this.preservedBranchCleanupByScope.delete(cleanupScopeKey)
             this.invalidateResolvedWorktreeCache()
             this.invalidateWorktreeScanCacheForRepo(removalTarget.repoId)
             invalidateAuthorizedRootsCache()
@@ -24457,6 +24732,7 @@ export class OrcaRuntimeService {
           )
           this.rememberPreservedBranchCleanupTarget(
             removalTarget.id,
+            cleanupHostId,
             removalResult,
             registeredWorktree.head,
             removedPushTarget
@@ -24502,6 +24778,7 @@ export class OrcaRuntimeService {
           )
           this.rememberPreservedBranchCleanupTarget(
             removalTarget.id,
+            cleanupHostId,
             removalResult,
             registeredWorktree.head,
             removedPushTarget
@@ -24664,7 +24941,7 @@ export class OrcaRuntimeService {
               )
               this.clearOptimisticReconcileToken(removalTarget.id)
               this.removeWorktreeMetadataAndHistory(store, removalTarget.id)
-              this.preservedBranchCleanupByWorktreeId.delete(removalTarget.id)
+              this.preservedBranchCleanupByScope.delete(cleanupScopeKey)
               this.invalidateResolvedWorktreeCache()
               this.invalidateWorktreeScanCacheForRepo(removalTarget.repoId)
               invalidateAuthorizedRootsCache()
@@ -24691,6 +24968,7 @@ export class OrcaRuntimeService {
         )
         this.rememberPreservedBranchCleanupTarget(
           removalTarget.id,
+          cleanupHostId,
           removalResult,
           refreshedRegisteredWorktree.head,
           removedPushTarget
@@ -25508,6 +25786,7 @@ export class OrcaRuntimeService {
               ? copySleepingAgentLaunchConfig(effectiveLaunchConfig)
               : null
             pty.launchToken = launchToken ?? null
+            pty.launchIncarnationId = launchToken ? pty.incarnationId : null
             pty.launchAgent = launchOpts.launchAgent ?? null
           }
           pty.tabId = tabId
@@ -27073,6 +27352,15 @@ export class OrcaRuntimeService {
     }
     const direction = opts.direction ?? 'horizontal'
     const workspace = await this.resolveTerminalWorkspaceLaunchScope(`id:${pty.worktreeId}`)
+    const sourceAuthority = this.resolveTerminalSplitSourceAuthority(
+      workspace.id,
+      parentTabId,
+      parsedPaneKey.leafId,
+      pty.ptyId
+    )
+    if (!sourceAuthority) {
+      throw new Error('terminal_split_source_not_found')
+    }
     const leafId = randomUUID()
     const preAllocatedHandle = this.createPreAllocatedTerminalHandle()
     const paneKey = makePaneKey(parentTabId, leafId)
@@ -27089,7 +27377,22 @@ export class OrcaRuntimeService {
       preAllocatedHandle,
       tabId: parentTabId,
       leafId,
-      persistHostSessionBinding: true
+      persistHostSessionBinding: true,
+      ...(sourceAuthority.persisted
+        ? {
+            expectedSourceBinding: {
+              ...(sourceAuthority.persistedWorktreeId
+                ? { worktreeId: sourceAuthority.persistedWorktreeId }
+                : {}),
+              tabId: parentTabId,
+              leafId: parsedPaneKey.leafId,
+              ptyId: pty.ptyId,
+              ...(sourceAuthority.persistedIncarnationId
+                ? { incarnationId: sourceAuthority.persistedIncarnationId }
+                : {})
+            }
+          }
+        : {})
     })
     this.registerPreAllocatedHandleForPty(result.id, preAllocatedHandle)
     if (result.wslDistro) {
@@ -27107,7 +27410,7 @@ export class OrcaRuntimeService {
       )
     }
 
-    try {
+    const revealSplit = async (): Promise<void> => {
       await this.notifier?.revealTerminalSession?.(workspace.id, {
         ptyId: result.id,
         title: null,
@@ -27119,33 +27422,136 @@ export class OrcaRuntimeService {
         splitDirection: direction,
         splitTelemetrySource: opts.telemetrySource
       })
+    }
+
+    try {
+      const revalidatedAuthority = this.resolveTerminalSplitSourceAuthority(
+        workspace.id,
+        parentTabId,
+        parsedPaneKey.leafId,
+        pty.ptyId
+      )
+      if (!revalidatedAuthority || (sourceAuthority.persisted && !revalidatedAuthority.persisted)) {
+        throw new Error('terminal_split_source_not_found')
+      }
+      if (!sourceAuthority.persisted) {
+        await revealSplit()
+      }
+      if (createdPty) {
+        const persisted = this.persistHeadlessTerminalSplit({
+          worktreeId: workspace.id,
+          tabId: parentTabId,
+          leafId,
+          ptyId: createdPty.ptyId,
+          splitFromLeafId: parsedPaneKey.leafId,
+          direction
+        })
+        if (sourceAuthority.persisted && !persisted) {
+          throw new Error('workspace_session_unavailable')
+        }
+        this.publishPtyBackedMobileSessionTerminal(workspace.id, createdPty, {
+          tabId: parentTabId,
+          leafId,
+          title: null,
+          activate: opts.activate !== false,
+          split: { splitFromLeafId: parsedPaneKey.leafId, direction }
+        })
+      }
     } catch (error) {
       this.setPairedRendererSessionOwnership(result.id, false)
       this.ptyController.kill?.(result.id)
       throw error
     }
-    if (createdPty) {
-      this.publishPtyBackedMobileSessionTerminal(workspace.id, createdPty, {
-        tabId: parentTabId,
-        leafId,
-        title: null,
-        activate: opts.activate !== false,
-        split: { splitFromLeafId: parsedPaneKey.leafId, direction }
-      })
-      // Why: persist the split so a later snapshot rebuild keeps it instead of collapsing to a single pane.
-      this.persistHeadlessTerminalSplit({
-        worktreeId: workspace.id,
-        tabId: parentTabId,
-        leafId,
-        ptyId: createdPty.ptyId,
-        splitFromLeafId: parsedPaneKey.leafId,
-        direction
-      })
+    const committedSourceAuthority = sourceAuthority.persisted
+      ? this.resolveTerminalSplitSourceAuthority(
+          workspace.id,
+          parentTabId,
+          parsedPaneKey.leafId,
+          pty.ptyId
+        )
+      : null
+    if (sourceAuthority.persisted && committedSourceAuthority?.rendererMounted) {
+      // Why: renderer adoption is a projection after the durable main commit; rejection cannot undo it.
+      void revealSplit().catch(() => undefined)
     }
 
     return { handle: this.issuePtyHandle(createdPty ?? pty), tabId: parentTabId, paneRuntimeId: -1 }
   }
 
+  private resolveTerminalSplitSourceAuthority(
+    worktreeId: string,
+    tabId: string,
+    leafId: string,
+    ptyId: string
+  ): {
+    persisted: boolean
+    rendererMounted: boolean
+    persistedWorktreeId: string | null
+    persistedIncarnationId: string | null
+  } | null {
+    const session = this.getWorkspaceSessionForWorktree(worktreeId)
+    const sessionWorktreeId = session ? resolveTerminalSessionWorktreeId(session, worktreeId) : null
+    const persistedTab = sessionWorktreeId
+      ? session?.tabsByWorktree[sessionWorktreeId]?.find(
+          (tab) => tab.id === tabId && runtimeWorktreeIdsEqual(tab.worktreeId, worktreeId)
+        )
+      : undefined
+    const persistedLayout = session?.terminalLayoutsByTabId?.[tabId]
+    const persistedIncarnationId =
+      session?.terminalPtyIncarnationsByPaneKey?.[makePaneKey(tabId, leafId)] ?? null
+    const liveIncarnationId = this.ptysById.get(ptyId)?.incarnationId ?? null
+    if (
+      persistedIncarnationId &&
+      liveIncarnationId &&
+      persistedIncarnationId !== liveIncarnationId
+    ) {
+      return null
+    }
+    const persisted = Boolean(
+      persistedTab &&
+      persistedLayout?.ptyIdsByLeafId?.[leafId] === ptyId &&
+      terminalLayoutContainsLeaf(persistedLayout.root, leafId)
+    )
+    const rendererTab = this.tabs.get(tabId)
+    const rendererLeaf = this.leaves.get(this.getLeafKey(tabId, leafId))
+    const rendererMounted = Boolean(
+      rendererTab &&
+      rendererLeaf &&
+      runtimeWorktreeIdsEqual(rendererTab.worktreeId, worktreeId) &&
+      runtimeWorktreeIdsEqual(rendererLeaf.worktreeId, worktreeId) &&
+      rendererLeaf.ptyId === ptyId
+    )
+    if (persisted && persistedLayout) {
+      return {
+        persisted: true,
+        rendererMounted,
+        persistedWorktreeId: sessionWorktreeId,
+        persistedIncarnationId
+      }
+    }
+    // Why: renderer adoption can precede graph sync; this path still requires reveal success before commit.
+    const projected = [...this.mobileSessionTabsByWorktree.entries()].some(
+      ([candidateWorktreeId, snapshot]) =>
+        runtimeWorktreeIdsEqual(candidateWorktreeId, worktreeId) &&
+        snapshot.tabs.some(
+          (tab) =>
+            tab.type === 'terminal' &&
+            tab.parentTabId === tabId &&
+            tab.leafId === leafId &&
+            (tab.ptyId === ptyId || tab.parentLayout?.ptyIdsByLeafId?.[leafId] === ptyId)
+        )
+    )
+    if (!rendererMounted && !projected) {
+      return null
+    }
+    return {
+      persisted: false,
+      rendererMounted,
+      persistedWorktreeId: null,
+      persistedIncarnationId: null
+    }
+  }
+
   async handleAgentTeamsTmuxCompat(
     request: AgentTeamsTmuxCompatRequest
   ): Promise<AgentTeamsTmuxCompatResponse> {
@@ -27575,7 +27981,7 @@ export class OrcaRuntimeService {
           committedPtyIds,
           terminalHandlesByPtyId
         })
-        if (failedStopIndex >= 0) {
+        if (failedStopIndex !== -1) {
           const failedStop = stopResults[failedStopIndex]
           throw Object.assign(new Error('terminal_worktree_sleep_failed'), {
             ptyId: orderedLivePtyIds[failedStopIndex],
@@ -27602,7 +28008,7 @@ export class OrcaRuntimeService {
         committedPtyIds,
         terminalHandlesByPtyId
       })
-      if (failedStopIndex >= 0 && remainingLivePtyIds.size > 0) {
+      if (failedStopIndex !== -1 && remainingLivePtyIds.size > 0) {
         const failedStop = stopResults[failedStopIndex]
         console.error('[runtime] worktree terminal sleep physical stop failed', {
           worktreeId: worktree.id,
@@ -27961,16 +28367,9 @@ export class OrcaRuntimeService {
   private async resolveFolderWorkspaceLaunchScope(
     selector: string
   ): Promise<TerminalWorkspaceLaunchScope | null> {
-    const workspaceSelector = selector.startsWith('id:') ? selector.slice(3) : selector
-    const parsed = parseWorkspaceKey(workspaceSelector)
-    if (parsed?.type !== 'folder') {
-      return null
-    }
-    const workspace = this.store
-      ?.getFolderWorkspaces?.()
-      .find((entry) => entry.id === parsed.folderWorkspaceId)
+    const workspace = this.resolveFolderWorkspaceSelector(selector)
     if (!workspace) {
-      throw new Error('selector_not_found')
+      return null
     }
     if (!this.store) {
       throw new Error('runtime_unavailable')
@@ -27990,6 +28389,36 @@ export class OrcaRuntimeService {
     }
   }
 
+  private resolveFolderWorkspaceSelector(selector: string): FolderWorkspace | null {
+    const workspaceSelector = selector.startsWith('id:') ? selector.slice(3) : selector
+    const parsed = parseWorkspaceKey(workspaceSelector)
+    if (parsed?.type !== 'folder') {
+      return null
+    }
+    const workspace = this.store
+      ?.getFolderWorkspaces?.()
+      .find((entry) => entry.id === parsed.folderWorkspaceId)
+    if (!workspace) {
+      throw new Error('selector_not_found')
+    }
+    return workspace
+  }
+
+  private async resolveEmulatorWorkspaceId(selector: string): Promise<string> {
+    const folderWorkspace = this.resolveFolderWorkspaceSelector(selector)
+    return folderWorkspace
+      ? folderWorkspaceKey(folderWorkspace.id)
+      : (await this.resolveWorktreeSelector(selector)).id
+  }
+
+  private async resolveEmulatorCleanupWorkspaceId(selector: string): Promise<string> {
+    const workspaceSelector = selector.startsWith('id:') ? selector.slice(3) : selector
+    const parsed = parseWorkspaceKey(workspaceSelector)
+    return parsed?.type === 'folder'
+      ? folderWorkspaceKey(parsed.folderWorkspaceId)
+      : this.resolveEmulatorWorkspaceId(selector)
+  }
+
   private folderWorkspaceToResolvedWorktree(folderWorkspace: FolderWorkspace): ResolvedWorktree {
     const worktree = folderWorkspaceToWorktree(folderWorkspace)
     return {
@@ -29005,6 +29434,7 @@ export class OrcaRuntimeService {
         paneKey: state.paneKey ?? null,
         launchConfig: null,
         launchToken: null,
+        launchIncarnationId: null,
         launchAgent: null,
         foregroundAgent: null,
         connected: state.connected ?? true,
@@ -29012,6 +29442,8 @@ export class OrcaRuntimeService {
         lastExitCode: null,
         lastAgentStatus: null,
         lastAgentStatusObservedLive: false,
+        lastAgentStatusStartedAtEpochMs: null,
+        lastAgentStatusRichInvalidatedAtEpochMs: null,
         lastOscTitle: null,
         lastOscTitleAt: null,
         lastOscTitleEpochMs: null,
@@ -29215,6 +29647,7 @@ export class OrcaRuntimeService {
     for (const ptyId of ambiguousControllerPtyIds) {
       controllerIdentityByPtyId.delete(ptyId)
     }
+    const findResolvedWorktree = createIncrementalResolvedWorktreeLookup(resolvedWorktrees)
     const persistedIndexesByHostId = new Map<
       ExecutionHostId,
       {
@@ -29246,14 +29679,12 @@ export class OrcaRuntimeService {
       )
       const controllerIdentity = controllerIdentityByPtyId.get(session.id)
       const persistedWorktreeId = persistedIndexes.worktreeIdByPtyId.get(session.id)
-      const providerWorktree = resolvedWorktrees.find(
-        (worktree) => session.worktreeId && runtimeWorktreeIdsEqual(worktree.id, session.worktreeId)
-      )
+      const providerWorktree = session.worktreeId
+        ? findResolvedWorktree(session.worktreeId)
+        : undefined
       const inferredWorktreeId = inferWorktreeIdFromPtyId(session.id)
       const persistedWorktree = persistedWorktreeId
-        ? resolvedWorktrees.find((worktree) =>
-            runtimeWorktreeIdsEqual(worktree.id, persistedWorktreeId)
-          )
+        ? findResolvedWorktree(persistedWorktreeId)
         : undefined
       const hasMigrationEvidence =
         Boolean(session.worktreeId) &&
@@ -29620,7 +30051,7 @@ export class OrcaRuntimeService {
   private syncMobileSessionTabs(
     snapshots: RuntimeMobileSessionTabsSnapshot[] | undefined,
     unchangedWorktreeIds?: string[],
-    resyncWorktreeIds: Set<string> = new Set()
+    resyncWorktreeIds = new Set<string>()
   ): Set<string> {
     const changedWorktreeIds = new Set<string>()
     if (snapshots === undefined) {
@@ -29763,6 +30194,7 @@ export class OrcaRuntimeService {
           nextWorktrees.add(worktreeId)
         } else {
           this.mobileSessionTabsByWorktree.delete(worktreeId)
+          this.mobileSessionTabsAgentStatusHeartbeat.removeWorktree(worktreeId)
           this.acceptedRendererMobileSnapshotByWorktree.delete(worktreeId)
           // Why: drop any pending coalesced notify so a stale snapshot can't land after the removed frame.
           this.mobileSessionTabsNotifyCoalescer.cancel(worktreeId)
@@ -30299,16 +30731,21 @@ export class OrcaRuntimeService {
           (hookAgentStatus.providerSessionReceivedAt ?? -1) >= tab.agentStatus.updatedAt)
           ? hookAgentStatus.providerSession
           : tab.agentStatus?.providerSession
-      const normalizedTabAgentStatus = tab.agentStatus
-        ? normalizeCompatibleAgentStatusEntryForOwner(
-            {
-              ...tab.agentStatus,
-              ...(hookProviderSession ? { providerSession: hookProviderSession } : {})
-            },
-            ownerAgent
-          )
-        : null
-      // Why: keep rich hook status on a live prompt/tool (authoritative even under a non-agent title), else interactivePrompt is lost.
+      const statusPty = liveLeafPty ?? mobileStatusPty
+      const normalizedTabAgentStatus = this.renewMobileAgentStatusFromPtyTitle(
+        tab.agentStatus
+          ? normalizeCompatibleAgentStatusEntryForOwner(
+              {
+                ...tab.agentStatus,
+                ...(hookProviderSession ? { providerSession: hookProviderSession } : {})
+              },
+              ownerAgent
+            )
+          : null,
+        statusPty,
+        { preserveQuestionUnderShellTitle: true }
+      )
+      // Why: keep rich status on a live prompt/tool, or interactivePrompt is lost under a non-agent title.
       const hasLiveAgentSignal =
         normalizedTabAgentStatus?.interactivePrompt != null ||
         normalizedTabAgentStatus?.toolName != null
@@ -30328,8 +30765,10 @@ export class OrcaRuntimeService {
               agentStatus: {
                 state: 'done' as const,
                 prompt: '',
-                updatedAt: normalizedTabAgentStatus.updatedAt,
-                stateStartedAt: normalizedTabAgentStatus.stateStartedAt,
+                updatedAt: statusPty?.lastOscTitleEpochMs ?? normalizedTabAgentStatus.updatedAt,
+                stateStartedAt:
+                  statusPty?.lastAgentStatusStartedAtEpochMs ??
+                  normalizedTabAgentStatus.stateStartedAt,
                 paneKey: normalizedTabAgentStatus.paneKey,
                 stateHistory: [],
                 agentType: normalizedTabAgentStatus.agentType,
@@ -30422,6 +30861,91 @@ export class OrcaRuntimeService {
     }
   }
 
+  private renewMobileAgentStatusFromPtyTitle(
+    status: AgentStatusEntry | null,
+    pty: RuntimePtyWorktreeRecord | null,
+    options: { preserveQuestionUnderShellTitle?: boolean } = {}
+  ): AgentStatusEntry | null {
+    if (!status || !pty) {
+      return status
+    }
+    if (
+      options.preserveQuestionUnderShellTitle &&
+      status.interactivePrompt != null &&
+      terminalTitleBlocksExplicitAgentStatus(pty.lastOscTitle)
+    ) {
+      return status
+    }
+    const richStatusCanOwnTitleInterval =
+      pty.lastAgentStatusRichInvalidatedAtEpochMs === null ||
+      status.updatedAt > pty.lastAgentStatusRichInvalidatedAtEpochMs
+    const titleEvidenceAt = pty.lastOscTitleEpochMs
+    if (titleEvidenceAt === null) {
+      return richStatusCanOwnTitleInterval ? status : null
+    }
+    const buildTitleOnlyStatus = (
+      state: AgentStatusEntry['state'],
+      updatedAt: number,
+      stateStartedAt: number
+    ): AgentStatusEntry => ({
+      state,
+      prompt: '',
+      updatedAt,
+      stateStartedAt,
+      paneKey: status.paneKey,
+      stateHistory: [],
+      ...(status.agentType ? { agentType: status.agentType } : {}),
+      ...(status.terminalHandle ? { terminalHandle: status.terminalHandle } : {}),
+      ...(status.worktreeId ? { worktreeId: status.worktreeId } : {}),
+      ...(status.tabId ? { tabId: status.tabId } : {}),
+      ...(status.terminalTitle ? { terminalTitle: status.terminalTitle } : {}),
+      ...(status.providerSession ? { providerSession: status.providerSession } : {})
+    })
+    const titleConfirmsState =
+      (pty.lastAgentStatus === 'working' && status.state === 'working') ||
+      (pty.lastAgentStatus === 'permission' &&
+        (status.state === 'blocked' || status.state === 'waiting'))
+    if (!titleConfirmsState) {
+      if (richStatusCanOwnTitleInterval && status.updatedAt >= titleEvidenceAt) {
+        return status
+      }
+      if (
+        pty.lastAgentStatus === null &&
+        !terminalTitleBlocksExplicitAgentStatus(pty.lastOscTitle)
+      ) {
+        return status
+      }
+      const titleState =
+        pty.lastAgentStatus === 'working'
+          ? 'working'
+          : pty.lastAgentStatus === 'permission'
+            ? 'blocked'
+            : 'done'
+      return buildTitleOnlyStatus(
+        titleState,
+        titleEvidenceAt,
+        pty.lastAgentStatusStartedAtEpochMs ?? titleEvidenceAt
+      )
+    }
+    const richStatusIsFresh = Date.now() - status.updatedAt <= AGENT_STATUS_STALE_AFTER_MS
+    const richStatusOwnsCurrentState = richStatusIsFresh && richStatusCanOwnTitleInterval
+    // Fresh explicit evidence from this title interval owns acknowledgement identity.
+    const stateStartedAt = richStatusOwnsCurrentState
+      ? status.stateStartedAt
+      : (pty.lastAgentStatusStartedAtEpochMs ?? status.stateStartedAt)
+    if (richStatusOwnsCurrentState) {
+      pty.lastAgentStatusStartedAtEpochMs = stateStartedAt
+    }
+    const updatedAt = Math.max(status.updatedAt, titleEvidenceAt)
+    if (!richStatusOwnsCurrentState) {
+      return buildTitleOnlyStatus(status.state, updatedAt, stateStartedAt)
+    }
+    if (updatedAt === status.updatedAt && stateStartedAt === status.stateStartedAt) {
+      return status
+    }
+    return { ...status, updatedAt, stateStartedAt }
+  }
+
   /** Mobile-friendly status entry for a PTY, aligning agentType and titles with the active owner. */
   private buildPtyMobileAgentStatus(
     pty: RuntimePtyWorktreeRecord | null,
@@ -30496,24 +31020,29 @@ export class OrcaRuntimeService {
     // Why: OSC 9999 hook payload carries real state/prompt/agent; without preferring it, hook-only transitions never surfaced (#7970).
     const liveRow = retained ?? this.resolveHookLiveAgentRow(hookRow.live, pty, nonAgentTitle)
     if (liveRow) {
-      return {
-        agentStatus: normalizeCompatibleAgentStatusEntryForOwner(
-          {
-            ...liveRow.payload,
-            paneKey,
-            updatedAt: liveRow.updatedAt,
-            stateStartedAt: liveRow.stateStartedAt,
-            stateHistory: [],
-            ...(terminalHandle ? { terminalHandle } : {}),
-            ...((pty?.worktreeId ?? liveRow.worktreeId)
-              ? { worktreeId: pty?.worktreeId ?? liveRow.worktreeId }
-              : {}),
-            tabId: tab.parentTabId,
-            terminalTitle,
-            ...providerSession
-          },
-          ownerAgent
-        )
+      const liveStatus = normalizeCompatibleAgentStatusEntryForOwner(
+        {
+          ...liveRow.payload,
+          paneKey,
+          updatedAt: liveRow.updatedAt,
+          stateStartedAt: liveRow.stateStartedAt,
+          stateHistory: [],
+          ...(terminalHandle ? { terminalHandle } : {}),
+          ...((pty?.worktreeId ?? liveRow.worktreeId)
+            ? { worktreeId: pty?.worktreeId ?? liveRow.worktreeId }
+            : {}),
+          tabId: tab.parentTabId,
+          terminalTitle,
+          ...providerSession
+        },
+        ownerAgent
+      )
+      // A live question outranks only the shell title that currently obscures it.
+      const renewedStatus = this.renewMobileAgentStatusFromPtyTitle(liveStatus, pty, {
+        preserveQuestionUnderShellTitle: true
+      })
+      if (renewedStatus) {
+        return { agentStatus: renewedStatus }
       }
     }
     // Last resort: the pane's hook evidence is identity only (resume rows, stale
@@ -30534,7 +31063,7 @@ export class OrcaRuntimeService {
               : 'done',
         prompt: '',
         updatedAt: evidenceAt,
-        stateStartedAt: evidenceAt,
+        stateStartedAt: pty?.lastAgentStatusStartedAtEpochMs ?? evidenceAt,
         paneKey,
         ...(terminalHandle ? { terminalHandle } : {}),
         ...(agentType ? { agentType } : {}),
@@ -31047,19 +31576,29 @@ export class OrcaRuntimeService {
         return await this.isPtyRunningAgent(pty.pty, leaf)
       }
       const { leaf } = this.getLiveLeafForHandle(handle)
+      const trackedPty = leaf.ptyId ? this.ptysById.get(leaf.ptyId) : null
       // Why: check the leaf pane title and the tab title, which already carries OSC-enriched agent indicators (e.g. ✳ prefix).
       const paneTitle = getLatestLeafTitle(leaf, null)
       const paneTitleClassification = classifyAgentTitle(paneTitle)
-      if (paneTitleClassification === 'agent') {
+      if (
+        trackedPty
+          ? ptyTitleProvesAgentPresence(trackedPty, paneTitle, paneTitleClassification)
+          : agentTitleProvesAgentPresence(paneTitle, paneTitleClassification)
+      ) {
         return true
       }
       const tabTitle = this.tabs.get(leaf.tabId)?.title?.trim() || null
       const tabTitleClassification = paneTitle === null ? classifyAgentTitle(tabTitle) : 'neutral'
-      if (tabTitleClassification === 'agent') {
+      if (
+        trackedPty
+          ? ptyTitleProvesAgentPresence(trackedPty, tabTitle, tabTitleClassification)
+          : agentTitleProvesAgentPresence(tabTitle, tabTitleClassification)
+      ) {
         return true
       }
+      const openCodeMarkerTitle = paneTitle ?? tabTitle
       const waitText = buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
-      if (isKnownReadyPromptPreview(waitText)) {
+      if (!isOpenCodeNativeTitle(openCodeMarkerTitle) && isKnownReadyPromptPreview(waitText)) {
         return true
       }
       const hasCurrentTitleEvidence = paneTitle !== null || tabTitle !== null
@@ -31103,7 +31642,7 @@ export class OrcaRuntimeService {
         )
       : null
     const leafTitleClassification = classifyAgentTitle(leafTitle)
-    if (leafTitleClassification === 'agent') {
+    if (ptyTitleProvesAgentPresence(pty, leafTitle, leafTitleClassification)) {
       return true
     }
     const ptyTitle = getLatestAgentCandidateTitle(
@@ -31111,15 +31650,19 @@ export class OrcaRuntimeService {
       { title: pty.lastOscTitle, updatedAt: pty.lastOscTitleAt }
     )
     const ptyTitleClassification = classifyAgentTitle(ptyTitle)
-    if (leafTitle === null && ptyTitleClassification === 'agent') {
+    if (leafTitle === null && ptyTitleProvesAgentPresence(pty, ptyTitle, ptyTitleClassification)) {
       return true
     }
     const managementTitleClassification = classifyLatestAgentTitle({
       title: pty.managementTitle,
       updatedAt: pty.managementTitleAt
     })
+    const openCodeMarkerTitle = leafTitle ?? ptyTitle
+    if (isOpenCodeNativeTitle(openCodeMarkerTitle) && pty.launchAgent === 'opencode') {
+      return true
+    }
     const waitText = buildTerminalWaitText(pty.tailBuffer, pty.tailPartialLine, pty.preview)
-    if (isKnownReadyPromptPreview(waitText)) {
+    if (!isOpenCodeNativeTitle(openCodeMarkerTitle) && isKnownReadyPromptPreview(waitText)) {
       return true
     }
     // Why: stale status is a fallback only when no current title evidence exists; neutral titles (shells) clear it.
@@ -32182,7 +32725,7 @@ export class OrcaRuntimeService {
   linearSearchForAgents(args: {
     query: string
     limit?: number
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
   }): ReturnType<typeof searchLinearIssuesForAgents> {
     return searchLinearIssuesForAgents(args)
   }
@@ -32192,7 +32735,7 @@ export class OrcaRuntimeService {
   }
 
   async linearTeamListForAgents(params: {
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
   }): Promise<LinearTeamListResult> {
     try {
       const result = await listLinearTeamsForAgent(params.workspaceId)
@@ -32271,7 +32814,7 @@ export class OrcaRuntimeService {
   async linearProjectListForAgents(params: {
     query?: string
     limit?: number
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
   }): Promise<LinearProjectListResult> {
     const limit = clampLinearSearchLimit(params.limit)
     try {
@@ -32310,7 +32853,7 @@ export class OrcaRuntimeService {
     filter?: LinearIssueListFilter
     teamInput?: string
     limit?: number
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
   }): Promise<LinearIssueListResult> {
     const filter = params.filter ?? 'assigned'
     const limit = clampLinearIssueListLimit(params.limit)
@@ -33993,7 +34536,7 @@ export class OrcaRuntimeService {
 
   private async resolveLinearTeamInput(
     teamInput: string,
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
   ): Promise<{
     id: string
     key: string
@@ -34556,7 +35099,9 @@ export class OrcaRuntimeService {
 
   private readonly emulatorCommands = new RuntimeEmulatorCommands({
     getEmulatorBridge: () => this.emulatorBridge,
-    resolveWorktreeSelector: (selector) => this.resolveWorktreeSelector(selector),
+    resolveEmulatorWorkspaceId: (selector) => this.resolveEmulatorWorkspaceId(selector),
+    resolveEmulatorCleanupWorkspaceId: (selector) =>
+      this.resolveEmulatorCleanupWorkspaceId(selector),
     getAuthoritativeWindow: () => this.getAuthoritativeWindow(),
     getSettings: () => this.requireStore().getSettings()
   })
@@ -35901,12 +36446,12 @@ function applyTerminalLineControls(line: string): {
   hadControl: boolean
 } {
   const carriageIndex = line.lastIndexOf('\r')
-  const latestRedraw = carriageIndex >= 0 ? line.slice(carriageIndex + 1) : line
+  const latestRedraw = carriageIndex !== -1 ? line.slice(carriageIndex + 1) : line
   if (!latestRedraw.includes('\u0008') && !latestRedraw.includes('\u001b')) {
     return {
       text: latestRedraw,
       cursorColumn: latestRedraw.length,
-      hadControl: carriageIndex >= 0
+      hadControl: carriageIndex !== -1
     }
   }
 
@@ -36363,6 +36908,8 @@ function detectExplicitIdleStatusFromTitle(title: string): AgentStatus | null {
   // Why: launch titles like "Codex YOLO" contain an agent name but aren't readiness signals; terminal.wait needs explicit idle evidence.
   if (
     EXPLICIT_IDLE_TITLE_RE.test(title) ||
+    // Why: unblock hookless remote waits; guarded writes corroborate this marker.
+    isOpenCodeNativeTitle(title) ||
     title.startsWith(CLAUDE_IDLE_PREFIX) ||
     title.startsWith('* ') ||
     title.includes(GEMINI_IDLE_PREFIX) ||
@@ -36500,7 +37047,7 @@ function isTerminalWaitWhitespace(value: string, index: number): boolean {
 }
 
 const TERMINAL_WAIT_BLOCKED_SENTINEL_RE =
-  /update available|choose working directory to|codex just got an upgrade|hooks need review|do you trust|trust this|trusted workspace|press enter to (?:confirm|continue|view|insert)|press t to trust/i
+  /update available|choose working directory to|codex just got an upgrade|hooks need review|do you trust|trust this|trusted workspace|press enter to (?:confirm|continue|view|insert)|press t to trust|permission required|requires permission|allow once|allow always/i
 
 function findTerminalWaitBlockedSignal(
   normalized: string
@@ -36570,6 +37117,20 @@ function findTerminalWaitBlockedSignal(
       candidates.push({ reason: 'codex-interactive-prompt', index: interactivePromptIndex })
     }
   }
+  const permissionPromptIndex = Math.max(
+    normalized.lastIndexOf('permission required'),
+    normalized.lastIndexOf('requires permission')
+  )
+  if (permissionPromptIndex !== -1) {
+    const permissionSegment = normalized.slice(permissionPromptIndex, permissionPromptIndex + 1_500)
+    const decisionCount = ['allow once', 'allow always', 'reject', 'deny'].filter((choice) =>
+      permissionSegment.includes(choice)
+    ).length
+    if (decisionCount >= 2) {
+      // Why: preserve the existing remote receipt value for mixed-version clients.
+      candidates.push({ reason: 'codex-interactive-prompt', index: permissionPromptIndex })
+    }
+  }
   return candidates.length > 0
     ? candidates.reduce((latest, candidate) =>
         candidate.index > latest.index ? candidate : latest
@@ -36677,6 +37238,42 @@ function runtimeWorktreeIdentityKey(worktreeId: string): string {
     : worktreeId
 }
 
+function runtimeWorktreeLookupKey(worktreeId: string): string {
+  const parsed = splitWorktreeId(worktreeId)
+  return JSON.stringify(
+    parsed
+      ? ['parsed', parsed.repoId, normalizeRuntimePathForComparison(parsed.worktreePath)]
+      : ['raw', worktreeId]
+  )
+}
+
+function createIncrementalResolvedWorktreeLookup(
+  resolvedWorktrees: ResolvedWorktree[]
+): (worktreeId: string) => ResolvedWorktree | undefined {
+  const worktreeByIdentity = new Map<string, ResolvedWorktree>()
+  let indexedCount = 0
+  return (worktreeId) => {
+    const lookupKey = runtimeWorktreeLookupKey(worktreeId)
+    const indexed = worktreeByIdentity.get(lookupKey)
+    if (indexed) {
+      return indexed
+    }
+    while (indexedCount < resolvedWorktrees.length) {
+      const worktree = resolvedWorktrees[indexedCount]
+      indexedCount += 1
+      const key = runtimeWorktreeLookupKey(worktree.id)
+      // Why: preserve Array.find's first match when normalized identities collide.
+      if (!worktreeByIdentity.has(key)) {
+        worktreeByIdentity.set(key, worktree)
+      }
+      if (key === lookupKey) {
+        return worktreeByIdentity.get(key)
+      }
+    }
+    return undefined
+  }
+}
+
 function resolveTerminalSessionWorktreeId(
   session: WorkspaceSessionState,
   targetWorktreeId: string
@@ -37015,6 +37612,33 @@ function getLatestLeafTitle(leaf: RuntimeLeafRecord, tabTitle: string | null): s
   )
 }
 
+// Why: an 'agent' title only proves an agent owns the pane when something other than a
+// quarter-circle spinner carries it — those glyphs are generic progress frames (STA-4028).
+function agentTitleProvesAgentPresence(
+  title: string | null,
+  classification: 'agent' | 'management' | 'neutral'
+): boolean {
+  return (
+    classification === 'agent' &&
+    !isOpenCodeNativeTitle(title) &&
+    !isQuarterCircleSpinnerOnlyAgentTitle(title)
+  )
+}
+
+function ptyTitleProvesAgentPresence(
+  pty: RuntimePtyWorktreeRecord,
+  title: string | null,
+  classification: 'agent' | 'management' | 'neutral'
+): boolean {
+  return (
+    agentTitleProvesAgentPresence(title, classification) ||
+    (isQuarterCircleSpinnerOnlyAgentTitle(title) &&
+      pty.launchAgent === 'claude' &&
+      pty.launchToken !== null &&
+      pty.launchIncarnationId === pty.incarnationId)
+  )
+}
+
 function classifyAgentTitle(title: string | null): 'agent' | 'management' | 'neutral' {
   if (!title) {
     return 'neutral'
diff --git a/src/main/runtime/orchestration/db.ts b/src/main/runtime/orchestration/db.ts
index 7049d59469d..ec279aef763 100644
--- a/src/main/runtime/orchestration/db.ts
+++ b/src/main/runtime/orchestration/db.ts
@@ -44,6 +44,7 @@ import { OrchestrationError } from './orchestration-error'
 import { resolveOrchestrationMigrationStartVersion } from './orchestration-schema-version-skew'
 import {
   deriveWorkerTerminalListState,
+  WORKER_SETTLED_STATES,
   type WorkerTerminalResourceRow,
   type WorkerTerminalArchiveRow,
   type WorkerTerminalArchiveStatus,
@@ -57,6 +58,10 @@ import {
   releaseContextOnlyDispatch,
   type ContextOnlyDispatchReleaseResult
 } from './context-only-dispatch-release'
+import {
+  ensureMutationReceiptCapacity,
+  migrateMutationReceiptCapacity
+} from './mutation-receipt-capacity'
 
 // Why: leaf UUID is the remint-stable pane identity (tab half changes on break-out); exact match covers legacy/unparseable keys.
 function isEquivalentPaneKey(a: string, b: string): boolean {
@@ -68,6 +73,17 @@ function isEquivalentPaneKey(a: string, b: string): boolean {
   return Boolean(aLeaf && bLeaf && aLeaf === bLeaf)
 }
 
+function parseWorkerTerminalPriorOwnerIds(value: string): string[] | null {
+  try {
+    const parsed: unknown = JSON.parse(value)
+    return Array.isArray(parsed) && parsed.every((entry) => typeof entry === 'string')
+      ? parsed
+      : null
+  } catch {
+    return null
+  }
+}
+
 // Why: indexable pre-filter for isEquivalentPaneKey — equal strings and equal leaves both share the
 // text after the first ':', so this narrows candidates without deciding equivalence itself.
 const RUN_PANE_KEY_MATCH_SUFFIX_SQL =
@@ -77,7 +93,7 @@ const DISPATCH_PANE_KEY_MATCH_SUFFIX_SQL =
 
 function paneKeyMatchSuffix(paneKey: string): string {
   const colon = paneKey.indexOf(':')
-  return colon < 0 ? paneKey : paneKey.slice(colon + 1)
+  return colon === -1 ? paneKey : paneKey.slice(colon + 1)
 }
 
 export type {
@@ -261,9 +277,6 @@ export const LEGACY_RUN_ID = ORCHESTRATION_LEGACY_RUN_ID
 export const LEGACY_CONTRACT_VERSION = 0
 export const CURRENT_CONTRACT_VERSION = ORCHESTRATION_CONTRACT_VERSION
 
-const MUTATION_RECEIPT_MAX_ROWS = 10_000
-const MUTATION_RECEIPT_MAX_AGE_DAYS = 30
-
 export type RunListPage = {
   runs: RunRow[]
   nextCursor: string | null
@@ -281,10 +294,10 @@ type RunListCursor = {
   id: string
 }
 
-// Schema versions: v2 'heartbeat'+last_heartbeat_at, v3 delivered_at, v4 task-creator terminal, v5 task_title/display_name, v6 pane identity, v7 lightweight Runs, v8 crash-safe Run deliveries, v9 durable question threads, v10 Dispatch capabilities, v11 durable mutation receipts, v12 composed worker state, v18 post-v6 version-skew repair, v19 adopted legacy Runs and compatibility receipts, v20 legacy question backfill, v21 legacy scheduler-loss provenance, v22 dispatch assignee lookup, v23 worker terminal resource ownership, v24 creator-incarnation authority, v25 active Dispatch handle lookup.
-const SCHEMA_VERSION = 25
+// Schema versions: v2 'heartbeat'+last_heartbeat_at, v3 delivered_at, v4 task-creator terminal, v5 task_title/display_name, v6 pane identity, v7 lightweight Runs, v8 crash-safe Run deliveries, v9 durable question threads, v10 Dispatch capabilities, v11 durable mutation receipts, v12 composed worker state, v18 post-v6 version-skew repair, v19 adopted legacy Runs and compatibility receipts, v20 legacy question backfill, v21 legacy scheduler-loss provenance, v22 dispatch assignee lookup, v23 worker terminal resource ownership, v24 creator-incarnation authority, v25 active Dispatch handle lookup, v26 indexed mutation receipt capacity.
+const SCHEMA_VERSION = 26
 
-function hardenOrchestrationDatabaseFiles(dbPath: string | ':memory:'): void {
+function hardenOrchestrationDatabaseFiles(dbPath: (string & {}) | ':memory:'): void {
   if (dbPath === ':memory:' || process.platform === 'win32') {
     // Why: Windows protects these files through Orca's current-user-only userData DACL; POSIX mode bits are inert there.
     return
@@ -307,7 +320,7 @@ export class OrchestrationDb {
   // per-terminal fan-out. Only createDispatchContext flips this false→true.
   private hasAnyDispatchContextsCache: boolean | undefined
 
-  constructor(dbPath: string | ':memory:') {
+  constructor(dbPath: (string & {}) | ':memory:') {
     this.db = new Database(dbPath)
     this.db.pragma('journal_mode = WAL')
     this.db.pragma('synchronous = NORMAL')
@@ -983,6 +996,9 @@ export class OrchestrationDb {
             WHERE assignee_handle IS NOT NULL AND status IN ('pending', 'dispatched');
         `)
       }
+      if (current < 26) {
+        migrateMutationReceiptCapacity(this.db)
+      }
       this.db.exec(`
         CREATE INDEX IF NOT EXISTS idx_dispatch_assignee_pane_leaf
           ON dispatch_contexts(${DISPATCH_PANE_KEY_MATCH_SUFFIX_SQL})
@@ -1398,44 +1414,6 @@ export class OrchestrationDb {
 
   // ── Durable mutation receipts ──
 
-  private ensureMutationReceiptCapacity(): void {
-    this.db
-      .prepare(
-        `DELETE FROM mutation_receipts
-         WHERE state = 'completed'
-           AND updated_at < datetime('now', ?)`
-      )
-      .run(`-${MUTATION_RECEIPT_MAX_AGE_DAYS} days`)
-
-    const row = this.db.prepare('SELECT COUNT(*) AS count FROM mutation_receipts').get() as {
-      count: number
-    }
-    const completedToRemove = row.count - MUTATION_RECEIPT_MAX_ROWS + 1
-    if (completedToRemove > 0) {
-      this.db
-        .prepare(
-          `DELETE FROM mutation_receipts
-           WHERE rowid IN (
-             SELECT rowid FROM mutation_receipts
-             WHERE state = 'completed'
-             ORDER BY updated_at ASC, rowid ASC
-             LIMIT ?
-           )`
-        )
-        .run(completedToRemove)
-    }
-
-    const retained = this.db.prepare('SELECT COUNT(*) AS count FROM mutation_receipts').get() as {
-      count: number
-    }
-    if (retained.count >= MUTATION_RECEIPT_MAX_ROWS) {
-      throw new OrchestrationError(
-        'mutation_ledger_full',
-        'The durable mutation ledger is full of unresolved operations. Resolve or inspect them before starting another mutation.'
-      )
-    }
-  }
-
   beginMutationReceipt(params: {
     callerFingerprint: string
     requestId: string
@@ -1458,7 +1436,7 @@ export class OrchestrationDb {
         this.db.exec('COMMIT')
         return { disposition: existing.state, row: existing }
       }
-      this.ensureMutationReceiptCapacity()
+      ensureMutationReceiptCapacity(this.db)
       this.db
         .prepare(
           `INSERT INTO mutation_receipts (
@@ -3885,7 +3863,7 @@ export class OrchestrationDb {
     return this.db.prepare('SELECT * FROM tasks ORDER BY created_at').all() as TaskRow[]
   }
 
-  // Why: LEFT JOIN keeps non-dispatched tasks (NULL assignee); the MAX(rowid) subquery matches getDispatchContext's most-recent-active-dispatch semantics.
+  // Why: the correlated indexed lookup avoids materializing every retained Dispatch before filtering Tasks.
   listTasksWithDispatch(filter?: {
     status?: TaskStatus
     ready?: boolean
@@ -3913,16 +3891,14 @@ export class OrchestrationDb {
         d.assignee_handle AS assignee_handle,
         d.id              AS dispatch_id
       FROM tasks t
-      LEFT JOIN (
-        SELECT dc.*
-        FROM dispatch_contexts dc
-        INNER JOIN (
-          SELECT task_id, MAX(rowid) AS max_rowid
-          FROM dispatch_contexts
-          WHERE status IN ('pending', 'dispatched')
-          GROUP BY task_id
-        ) latest ON latest.task_id = dc.task_id AND latest.max_rowid = dc.rowid
-      ) d ON d.task_id = t.id
+      LEFT JOIN dispatch_contexts d ON d.rowid = (
+        SELECT candidate.rowid
+        FROM dispatch_contexts candidate
+        WHERE candidate.task_id = t.id
+          AND candidate.status IN ('pending', 'dispatched')
+        ORDER BY candidate.rowid DESC
+        LIMIT 1
+      )
       ${where}
       ORDER BY t.created_at
     `
@@ -4009,7 +3985,7 @@ export class OrchestrationDb {
             `Mutation ${receipt.requestId} already has a durable acceptance record.`
           )
         }
-        this.ensureMutationReceiptCapacity()
+        ensureMutationReceiptCapacity(this.db)
         this.db
           .prepare(
             `INSERT INTO mutation_receipts (
@@ -4642,7 +4618,7 @@ export class OrchestrationDb {
           `Remote attachment request ${params.mutationReceipt.requestId} already exists.`
         )
       }
-      this.ensureMutationReceiptCapacity()
+      ensureMutationReceiptCapacity(this.db)
       this.db
         .prepare(
           `INSERT INTO mutation_receipts (
@@ -5130,13 +5106,44 @@ export class OrchestrationDb {
     dispatchId: string
     direction: FederationRelayDirection
     throughSequence: number
+    settleRemoteReport?: { sequence: number; outcome: WorkerReportOutcome }
   }): void {
-    this.db
-      .prepare(
-        `UPDATE federation_relay_items SET acked_at = COALESCE(acked_at, datetime('now'))
-         WHERE dispatch_id = ? AND direction = ? AND sequence <= ?`
-      )
-      .run(params.dispatchId, params.direction, params.throughSequence)
+    this.db.exec('BEGIN IMMEDIATE')
+    try {
+      if (params.settleRemoteReport) {
+        const report = this.getFederationRelayItem(
+          params.dispatchId,
+          params.direction,
+          params.settleRemoteReport.sequence
+        )
+        if (
+          params.direction !== 'to_home' ||
+          params.settleRemoteReport.sequence > params.throughSequence ||
+          report?.kind !== 'worker_done' ||
+          parseFederatedWorkerReportOutcome(report.payload) !== params.settleRemoteReport.outcome
+        ) {
+          throw new OrchestrationError(
+            'request_mismatch',
+            `Federation acknowledgment for ${params.dispatchId} does not match its queued worker_done.`
+          )
+        }
+        this.settleRemoteAttachmentInRelayTransaction(
+          params.dispatchId,
+          params.settleRemoteReport.outcome,
+          'worker_report_settled'
+        )
+      }
+      this.db
+        .prepare(
+          `UPDATE federation_relay_items SET acked_at = COALESCE(acked_at, datetime('now'))
+           WHERE dispatch_id = ? AND direction = ? AND sequence <= ?`
+        )
+        .run(params.dispatchId, params.direction, params.throughSequence)
+      this.db.exec('COMMIT')
+    } catch (error) {
+      this.db.exec('ROLLBACK')
+      throw error
+    }
   }
 
   setFederatedHomeImportSequence(dispatchId: string, sequence: number): void {
@@ -5174,7 +5181,11 @@ export class OrchestrationDb {
           result: string
         }
       | { kind: 'rejected'; code: string; reason: string }
-  }): { message: MessageRow; duplicate: boolean } {
+  }): {
+    message: MessageRow
+    duplicate: boolean
+    lifecycle?: WorkerReportSettlement | { action: 'rejected'; code: string; reason: string }
+  } {
     this.db.exec('BEGIN IMMEDIATE')
     try {
       const federated = this.getFederatedDispatch(params.dispatchId)
@@ -5184,18 +5195,14 @@ export class OrchestrationDb {
           `Federated Dispatch ${params.dispatchId} was not found.`
         )
       }
-      if (params.sequence <= federated.to_home_imported_sequence) {
-        const existing = this.getMessageById(params.message.id)
-        if (!existing) {
-          throw new OrchestrationError(
-            'operation_unknown',
-            `Federated relay sequence ${params.sequence} was committed without its message.`
-          )
-        }
-        this.db.exec('COMMIT')
-        return { message: existing, duplicate: true }
+      const duplicate = params.sequence <= federated.to_home_imported_sequence
+      if (duplicate && !this.getMessageById(params.message.id)) {
+        throw new OrchestrationError(
+          'operation_unknown',
+          `Federated relay sequence ${params.sequence} was committed without its message.`
+        )
       }
-      if (params.sequence !== federated.to_home_imported_sequence + 1) {
+      if (!duplicate && params.sequence !== federated.to_home_imported_sequence + 1) {
         throw new OrchestrationError(
           'operation_unknown',
           `Federated relay for ${params.dispatchId} is not contiguous after sequence ${federated.to_home_imported_sequence}.`
@@ -5222,32 +5229,45 @@ export class OrchestrationDb {
           dispatchId: params.dispatchId
         })
       }
-      if (params.lifecycle.kind === 'heartbeat') {
+      let lifecycle:
+        | WorkerReportSettlement
+        | { action: 'rejected'; code: string; reason: string }
+        | undefined
+      if (params.lifecycle.kind === 'heartbeat' && !duplicate) {
         this.recordHeartbeat(params.dispatchId, params.lifecycle.at)
       } else if (params.lifecycle.kind === 'worker_report') {
-        const settlement = this.settleWorkerReportInTransaction({
+        lifecycle = this.settleWorkerReportInTransaction({
           taskId: params.lifecycle.taskId,
           dispatchId: params.dispatchId,
           outcome: params.lifecycle.outcome,
           result: params.lifecycle.result
         })
-        if (settlement.action === 'rejected') {
+        if (lifecycle.action === 'rejected' && !duplicate) {
           message = this.convertLifecycleMessageToRejection(
             message.id,
-            settlement.code,
-            settlement.reason
+            lifecycle.code,
+            lifecycle.reason
           ) as MessageRow
         }
       } else if (params.lifecycle.kind === 'rejected') {
-        message = this.convertLifecycleMessageToRejection(
-          message.id,
-          params.lifecycle.code,
-          params.lifecycle.reason
-        ) as MessageRow
+        lifecycle = {
+          action: 'rejected',
+          code: params.lifecycle.code,
+          reason: params.lifecycle.reason
+        }
+        if (!duplicate) {
+          message = this.convertLifecycleMessageToRejection(
+            message.id,
+            params.lifecycle.code,
+            params.lifecycle.reason
+          ) as MessageRow
+        }
+      }
+      if (!duplicate) {
+        this.setFederatedHomeImportSequence(params.dispatchId, params.sequence)
       }
-      this.setFederatedHomeImportSequence(params.dispatchId, params.sequence)
       this.db.exec('COMMIT')
-      return { message, duplicate: false }
+      return { message, duplicate, ...(lifecycle ? { lifecycle } : {}) }
     } catch (error) {
       this.db.exec('ROLLBACK')
       throw error
@@ -5348,19 +5368,37 @@ export class OrchestrationDb {
 
   private settleRemoteAttachmentInRelayTransaction(
     dispatchId: string,
-    outcome: WorkerReportOutcome | undefined
+    outcome: WorkerReportOutcome | undefined,
+    stage = 'worker_report_queued'
   ): void {
     if (!outcome) {
       return
     }
+    const attachment = this.getRemoteDispatchAttachment(dispatchId)
+    const state = outcome === 'succeeded' ? 'succeeded' : 'failed'
+    if (!attachment) {
+      throw new OrchestrationError(
+        'dispatch_not_found',
+        `Remote Dispatch ${dispatchId} was not found.`
+      )
+    }
+    if (attachment.state === state) {
+      return
+    }
+    if (attachment.state !== 'ready') {
+      throw new OrchestrationError(
+        'request_mismatch',
+        `Remote Dispatch ${dispatchId} cannot settle as ${state} from ${attachment.state}.`
+      )
+    }
     this.db
       .prepare(
         `UPDATE remote_dispatch_attachments
-         SET state = ?, stage = 'worker_report_queued', capability_hash = NULL,
+         SET state = ?, stage = ?, capability_hash = NULL,
              updated_at = datetime('now')
          WHERE dispatch_id = ? AND state = 'ready'`
       )
-      .run(outcome === 'succeeded' ? 'succeeded' : 'failed', dispatchId)
+      .run(state, stage, dispatchId)
   }
 
   isDispatchProcessCurrent(params: {
@@ -5852,12 +5890,12 @@ export class OrchestrationDb {
       if (!worker) {
         throw new OrchestrationError('dispatch_not_found', `Dispatch ${dispatchId} was not found.`)
       }
-      if (!['succeeded', 'failed'].includes(worker.state)) {
+      if (!WORKER_SETTLED_STATES.includes(worker.state)) {
         // Why: release is post-completion cleanup only; recording intent for an unsettled or
         // uncertain worker would let recovery close a terminal the coordinator never reviewed.
         throw new OrchestrationError(
           'dispatch_inactive',
-          `Dispatch ${dispatchId} is ${worker.state}; only a succeeded or failed worker can release. Use worker-stop to cancel an active worker.`
+          `Dispatch ${dispatchId} is ${worker.state}; only a settled worker can release. Use worker-stop to cancel an active worker.`
         )
       }
       const resource = this.getWorkerTerminalResourceByOwner(dispatchId)
@@ -5872,6 +5910,10 @@ export class OrchestrationDb {
         this.db.exec('COMMIT')
         return { disposition: 'already_released', resource }
       }
+      if (worker.state === 'stopped' || worker.state === 'abandoned') {
+        this.db.exec('COMMIT')
+        return { disposition: 'retained', resource, reason: 'identity_unproven' }
+      }
       if (resource.ownership_state === 'external') {
         this.db.exec('COMMIT')
         return {
@@ -5920,6 +5962,66 @@ export class OrchestrationDb {
     }
   }
 
+  settleDeadWorkerTerminalRelease(params: {
+    requestingDispatchId: string
+    resourceId: string
+    processIncarnation: string
+  }):
+    | { disposition: 'released'; resource: WorkerTerminalResourceRow }
+    | { disposition: 'retained'; resource: WorkerTerminalResourceRow } {
+    this.db.exec('BEGIN IMMEDIATE')
+    try {
+      const resource = this.getWorkerTerminalResource(params.resourceId)
+      if (!resource) {
+        throw new OrchestrationError(
+          'dispatch_not_found',
+          `Worker terminal resource ${params.resourceId} was not found.`
+        )
+      }
+      const priorOwners = parseWorkerTerminalPriorOwnerIds(resource.prior_owner_dispatch_ids)
+      const requesterRelated =
+        resource.owner_dispatch_id === params.requestingDispatchId ||
+        priorOwners?.includes(params.requestingDispatchId) === true
+      const requester = this.getWorkerDispatch(params.requestingDispatchId)
+      const owner = this.getWorkerDispatch(resource.owner_dispatch_id)
+      const requesterSettled = Boolean(requester && WORKER_SETTLED_STATES.includes(requester.state))
+      const ownerSettled = Boolean(owner && WORKER_SETTLED_STATES.includes(owner.state))
+      if (
+        !priorOwners ||
+        !requesterRelated ||
+        !requesterSettled ||
+        !ownerSettled ||
+        resource.process_incarnation !== params.processIncarnation ||
+        resource.ownership_state === 'released' ||
+        !['not_requested', 'retained', 'unknown'].includes(resource.release_state)
+      ) {
+        this.db.exec('COMMIT')
+        return { disposition: 'retained', resource }
+      }
+      this.db
+        .prepare(
+          `UPDATE worker_terminal_resources
+           SET release_state = 'released', ownership_state = 'released', retained_reason = NULL,
+               release_requested_at = COALESCE(release_requested_at, datetime('now')),
+               release_completed_at = datetime('now'), release_error = NULL,
+               updated_at = datetime('now')
+           WHERE id = ? AND process_incarnation = ? AND ownership_state != 'released'
+             AND release_state IN ('not_requested', 'retained', 'unknown')`
+        )
+        .run(params.resourceId, params.processIncarnation)
+      const released = this.getWorkerTerminalResource(
+        params.resourceId
+      ) as WorkerTerminalResourceRow
+      this.db.exec('COMMIT')
+      return released.release_state === 'released'
+        ? { disposition: 'released', resource: released }
+        : { disposition: 'retained', resource: released }
+    } catch (error) {
+      this.db.exec('ROLLBACK')
+      throw error
+    }
+  }
+
   storeWorkerTerminalArchive(params: {
     dispatchId: string
     resourceId: string
@@ -6838,3 +6940,18 @@ export class OrchestrationDb {
     this.db.close()
   }
 }
+
+function parseFederatedWorkerReportOutcome(payload: string): WorkerReportOutcome | undefined {
+  try {
+    const message = JSON.parse(payload) as { payload?: unknown }
+    if (typeof message.payload !== 'string') {
+      return undefined
+    }
+    const report = JSON.parse(message.payload) as { outcome?: unknown }
+    return report.outcome === 'succeeded' || report.outcome === 'failed'
+      ? report.outcome
+      : undefined
+  } catch {
+    return undefined
+  }
+}
diff --git a/src/main/runtime/orchestration/federation-ack-checkpoints.ts b/src/main/runtime/orchestration/federation-ack-checkpoints.ts
new file mode 100644
index 00000000000..2b488c1b7a5
--- /dev/null
+++ b/src/main/runtime/orchestration/federation-ack-checkpoints.ts
@@ -0,0 +1,71 @@
+import type { OrcaRuntimeService } from '../orca-runtime'
+
+export type FederationAckIdentity = {
+  environmentId: string
+  peerFingerprint: string
+  remoteRuntimeEpoch: string
+}
+
+type FederationAckCheckpoint = FederationAckIdentity & { throughSequence: number }
+type FederationAckDispatchState = { checkpoint: FederationAckCheckpoint | null }
+type FederationAckRuntimeState = { byDispatch: Map<string, FederationAckDispatchState> }
+
+export type FederationAckLease = {
+  runtimeState: FederationAckRuntimeState
+  dispatchState: FederationAckDispatchState
+}
+
+const federationAckStates = new WeakMap<OrcaRuntimeService, FederationAckRuntimeState>()
+
+export function clearFederationAckCheckpoints(runtime: OrcaRuntimeService): void {
+  federationAckStates.delete(runtime)
+}
+
+export function acquireFederationAckLease(
+  runtime: OrcaRuntimeService,
+  dispatchId: string
+): FederationAckLease {
+  let runtimeState = federationAckStates.get(runtime)
+  if (!runtimeState) {
+    runtimeState = { byDispatch: new Map() }
+    federationAckStates.set(runtime, runtimeState)
+  }
+  let dispatchState = runtimeState.byDispatch.get(dispatchId)
+  if (!dispatchState) {
+    dispatchState = { checkpoint: null }
+    runtimeState.byDispatch.set(dispatchId, dispatchState)
+  }
+  return { runtimeState, dispatchState }
+}
+
+export function getFederationAckedThrough(
+  lease: FederationAckLease,
+  identity: FederationAckIdentity
+): number {
+  const checkpoint = lease.dispatchState.checkpoint
+  return checkpoint?.environmentId === identity.environmentId &&
+    checkpoint.peerFingerprint === identity.peerFingerprint &&
+    checkpoint.remoteRuntimeEpoch === identity.remoteRuntimeEpoch
+    ? checkpoint.throughSequence
+    : 0
+}
+
+export function recordFederationAckCheckpoint(
+  runtime: OrcaRuntimeService,
+  lease: FederationAckLease,
+  checkpoint: FederationAckCheckpoint
+): void {
+  if (federationAckStates.get(runtime) !== lease.runtimeState) {
+    return
+  }
+  const current = lease.dispatchState.checkpoint
+  if (
+    current?.environmentId === checkpoint.environmentId &&
+    current.peerFingerprint === checkpoint.peerFingerprint &&
+    current.remoteRuntimeEpoch === checkpoint.remoteRuntimeEpoch &&
+    current.throughSequence >= checkpoint.throughSequence
+  ) {
+    return
+  }
+  lease.dispatchState.checkpoint = checkpoint
+}
diff --git a/src/main/runtime/orchestration/federation-lifecycle-settlement.ts b/src/main/runtime/orchestration/federation-lifecycle-settlement.ts
new file mode 100644
index 00000000000..921db91b728
--- /dev/null
+++ b/src/main/runtime/orchestration/federation-lifecycle-settlement.ts
@@ -0,0 +1,70 @@
+import type { OrcaRuntimeService } from '../orca-runtime'
+
+export type FederatedLifecycleSettlement =
+  | { action: 'completed' | 'failed'; authority: 'run_home' }
+  | { action: 'rejected'; code: string; reason: string; authority: 'run_home' }
+
+type Waiter = (settlement: FederatedLifecycleSettlement) => void
+
+const waitersByRuntime = new WeakMap<OrcaRuntimeService, Map<string, Set<Waiter>>>()
+
+export function publishFederatedLifecycleSettlement(
+  runtime: OrcaRuntimeService,
+  dispatchId: string,
+  sequence: number,
+  settlement: FederatedLifecycleSettlement
+): void {
+  const waiters = waitersByRuntime.get(runtime)?.get(settlementKey(dispatchId, sequence))
+  for (const waiter of waiters ?? []) {
+    waiter(settlement)
+  }
+}
+
+export function waitForFederatedLifecycleSettlement(
+  runtime: OrcaRuntimeService,
+  dispatchId: string,
+  sequence: number,
+  options: { timeoutMs: number; signal?: AbortSignal }
+): Promise<FederatedLifecycleSettlement | undefined> {
+  return new Promise((resolve) => {
+    if (options.signal?.aborted) {
+      resolve(undefined)
+      return
+    }
+    const runtimeWaiters = getRuntimeWaiters(runtime)
+    const key = settlementKey(dispatchId, sequence)
+    const waiters = runtimeWaiters.get(key) ?? new Set<Waiter>()
+    runtimeWaiters.set(key, waiters)
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const finish = (settlement?: FederatedLifecycleSettlement) => {
+      if (timer) {
+        clearTimeout(timer)
+      }
+      options.signal?.removeEventListener('abort', onAbort)
+      waiters.delete(onSettlement)
+      if (waiters.size === 0) {
+        runtimeWaiters.delete(key)
+      }
+      resolve(settlement)
+    }
+    const onSettlement: Waiter = (settlement) => finish(settlement)
+    const onAbort = () => finish()
+    waiters.add(onSettlement)
+    options.signal?.addEventListener('abort', onAbort, { once: true })
+    timer = setTimeout(() => finish(), options.timeoutMs)
+  })
+}
+
+function getRuntimeWaiters(runtime: OrcaRuntimeService): Map<string, Set<Waiter>> {
+  const existing = waitersByRuntime.get(runtime)
+  if (existing) {
+    return existing
+  }
+  const created = new Map<string, Set<Waiter>>()
+  waitersByRuntime.set(runtime, created)
+  return created
+}
+
+function settlementKey(dispatchId: string, sequence: number): string {
+  return `${dispatchId}:${sequence}`
+}
diff --git a/src/main/runtime/orchestration/federation-sync.test.ts b/src/main/runtime/orchestration/federation-sync.test.ts
index 339b1a55f27..5470fe6416d 100644
--- a/src/main/runtime/orchestration/federation-sync.test.ts
+++ b/src/main/runtime/orchestration/federation-sync.test.ts
@@ -1,6 +1,92 @@
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from '../orca-runtime'
+import {
+  acquireFederationAckLease,
+  clearFederationAckCheckpoints,
+  getFederationAckedThrough,
+  recordFederationAckCheckpoint,
+  type FederationAckIdentity
+} from './federation-ack-checkpoints'
 import { parseRelayedMessage } from './federation-sync'
 
+function createIdleSyncHarness() {
+  let remoteRuntimeEpoch = 'remote_epoch_1'
+  let blockedAck: { reached: () => void; released: Promise<void> } | null = null
+  let blockedPull: { reached: () => void; released: Promise<void> } | null = null
+  const federated = {
+    environment_id: 'environment_windows',
+    environment_name: 'windows',
+    peer_fingerprint: 'windows_peer_fingerprint',
+    to_home_imported_sequence: 2
+  }
+  const createDb = () =>
+    ({
+      getFederatedDispatch: () => federated,
+      getDispatchContextById: () => ({ run_id: 'run_home', task_id: 'task_home' }),
+      getWorkerDispatch: () => ({ state: 'ready' }),
+      listPendingFederationRelay: () => []
+    }) as never
+  const runtime = new OrcaRuntimeService()
+  runtime.setOrchestrationDb(createDb())
+  vi.spyOn(runtime, 'resolveOrchestrationWorkerServer').mockReturnValue({
+    peerFingerprint: federated.peer_fingerprint
+  } as never)
+  const remoteCall = vi
+    .spyOn(runtime, 'callOrchestrationWorkerServer')
+    .mockImplementation(async (_environmentId, method) => {
+      if (method === 'orchestration.federationPull') {
+        const gate = blockedPull
+        if (gate) {
+          gate.reached()
+          await gate.released
+          if (blockedPull === gate) {
+            blockedPull = null
+          }
+        }
+        return { runtimeEpoch: remoteRuntimeEpoch, items: [] }
+      }
+      if (method === 'orchestration.federationAck') {
+        const gate = blockedAck
+        if (gate) {
+          gate.reached()
+          await gate.released
+          if (blockedAck === gate) {
+            blockedAck = null
+          }
+        }
+        return { acknowledgedThrough: federated.to_home_imported_sequence }
+      }
+      throw new Error(`Unexpected method ${method}`)
+    })
+  return {
+    runtime,
+    remoteCall,
+    advanceCursor: () => {
+      federated.to_home_imported_sequence += 1
+    },
+    restartRemote: () => {
+      remoteRuntimeEpoch = 'remote_epoch_2'
+    },
+    replaceDb: () => runtime.setOrchestrationDb(createDb()),
+    blockAck: () => {
+      let noteReached!: () => void
+      let release!: () => void
+      const reached = new Promise<void>((resolve) => (noteReached = resolve))
+      const released = new Promise<void>((resolve) => (release = resolve))
+      blockedAck = { reached: noteReached, released }
+      return { reached, release }
+    },
+    blockPull: () => {
+      let noteReached!: () => void
+      let release!: () => void
+      const reached = new Promise<void>((resolve) => (noteReached = resolve))
+      const released = new Promise<void>((resolve) => (release = resolve))
+      blockedPull = { reached: noteReached, released }
+      return { reached, release }
+    }
+  }
+}
+
 describe('federation relay parsing', () => {
   it('accepts a supported message type', () => {
     expect(
@@ -16,3 +102,160 @@ describe('federation relay parsing', () => {
     ).toThrowError('Federated relay message type invented is not supported.')
   })
 })
+
+describe('federation relay acknowledgments', () => {
+  it('acknowledges only new progress until remote runtime identity changes', async () => {
+    const { runtime, remoteCall, advanceCursor, restartRemote } = createIdleSyncHarness()
+    const ackCalls = () =>
+      remoteCall.mock.calls.filter(([, method]) => method === 'orchestration.federationAck')
+
+    await runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+    await runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+    expect(ackCalls()).toHaveLength(1)
+
+    advanceCursor()
+    await runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+    expect(ackCalls()).toHaveLength(2)
+
+    restartRemote()
+    await runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+    expect(ackCalls().map(([, , params]) => params)).toEqual([
+      { dispatchId: 'dispatch_remote', throughSequence: 2 },
+      { dispatchId: 'dispatch_remote', throughSequence: 3 },
+      { dispatchId: 'dispatch_remote', throughSequence: 3 }
+    ])
+  })
+
+  it('coalesces overlapping syncs while an acknowledgment is in flight', async () => {
+    const { runtime, remoteCall, blockAck } = createIdleSyncHarness()
+    const gate = blockAck()
+
+    const first = runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+    await gate.reached
+    const second = runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+    expect(second).toBe(first)
+    gate.release()
+    await Promise.all([first, second])
+
+    expect(
+      remoteCall.mock.calls.filter(([, method]) => method === 'orchestration.federationAck')
+    ).toHaveLength(1)
+  })
+
+  it('pulls again after a sync that predates a terminal observation', async () => {
+    const { runtime, remoteCall, blockPull } = createIdleSyncHarness()
+    const gate = blockPull()
+
+    const oldSync = runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+    await gate.reached
+    const freshSync = runtime.syncOrchestrationFederatedDispatchAfterCurrent('dispatch_remote')
+    expect(
+      remoteCall.mock.calls.filter(([, method]) => method === 'orchestration.federationPull')
+    ).toHaveLength(1)
+    gate.release()
+    await Promise.all([oldSync, freshSync])
+
+    expect(
+      remoteCall.mock.calls.filter(([, method]) => method === 'orchestration.federationPull')
+    ).toHaveLength(2)
+    expect(
+      remoteCall.mock.calls.filter(([, method]) => method === 'orchestration.federationAck')
+    ).toHaveLength(1)
+  })
+
+  it('starts a new sync when the orchestration database changes in flight', async () => {
+    const { runtime, remoteCall, blockAck, replaceDb } = createIdleSyncHarness()
+    const gate = blockAck()
+
+    const oldSync = runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+    await gate.reached
+    replaceDb()
+    const newSync = runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+    expect(newSync).not.toBe(oldSync)
+    await vi.waitFor(() =>
+      expect(
+        remoteCall.mock.calls.filter(([, method]) => method === 'orchestration.federationAck')
+      ).toHaveLength(2)
+    )
+    gate.release()
+    await Promise.all([oldSync, newSync])
+    await runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+
+    expect(
+      remoteCall.mock.calls.filter(([, method]) => method === 'orchestration.federationAck')
+    ).toHaveLength(2)
+  })
+
+  it('starts a new sync when relay state resets in flight', async () => {
+    const { runtime, remoteCall, blockAck } = createIdleSyncHarness()
+    const gate = blockAck()
+
+    const oldSync = runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+    await gate.reached
+    runtime.stopOrchestrationFederationRelay()
+    const newSync = runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+    expect(newSync).not.toBe(oldSync)
+    await vi.waitFor(() =>
+      expect(
+        remoteCall.mock.calls.filter(([, method]) => method === 'orchestration.federationAck')
+      ).toHaveLength(2)
+    )
+    gate.release()
+    await Promise.all([oldSync, newSync])
+    await runtime.syncOrchestrationFederatedDispatch('dispatch_remote')
+
+    expect(
+      remoteCall.mock.calls.filter(([, method]) => method === 'orchestration.federationAck')
+    ).toHaveLength(2)
+  })
+
+  it('matches checkpoints only to their exact remote identity and never moves backward', () => {
+    const runtime = {} as OrcaRuntimeService
+    const identity: FederationAckIdentity = {
+      environmentId: 'environment_windows',
+      peerFingerprint: 'windows_peer_fingerprint',
+      remoteRuntimeEpoch: 'remote_epoch_1'
+    }
+    const lease = acquireFederationAckLease(runtime, 'dispatch_remote')
+    recordFederationAckCheckpoint(runtime, lease, {
+      ...identity,
+      throughSequence: 2
+    })
+
+    recordFederationAckCheckpoint(runtime, lease, {
+      ...identity,
+      throughSequence: 3
+    })
+    recordFederationAckCheckpoint(runtime, lease, {
+      ...identity,
+      throughSequence: 2
+    })
+
+    expect(getFederationAckedThrough(lease, identity)).toBe(3)
+    expect(
+      getFederationAckedThrough(lease, { ...identity, remoteRuntimeEpoch: 'remote_epoch_2' })
+    ).toBe(0)
+    expect(
+      getFederationAckedThrough(lease, { ...identity, peerFingerprint: 'replacement_peer' })
+    ).toBe(0)
+    expect(getFederationAckedThrough(lease, { ...identity, environmentId: 'replacement' })).toBe(0)
+  })
+
+  it('fences delayed writes after runtime reset', () => {
+    const runtime = {} as OrcaRuntimeService
+    const identity: FederationAckIdentity = {
+      environmentId: 'environment_windows',
+      peerFingerprint: 'windows_peer_fingerprint',
+      remoteRuntimeEpoch: 'remote_epoch_1'
+    }
+    const staleRuntimeLease = acquireFederationAckLease(runtime, 'dispatch_remote')
+    clearFederationAckCheckpoints(runtime)
+    recordFederationAckCheckpoint(runtime, staleRuntimeLease, {
+      ...identity,
+      throughSequence: 2
+    })
+    expect(
+      getFederationAckedThrough(acquireFederationAckLease(runtime, 'dispatch_remote'), identity)
+    ).toBe(0)
+  })
+})
diff --git a/src/main/runtime/orchestration/federation-sync.ts b/src/main/runtime/orchestration/federation-sync.ts
index 85856883aa9..13ec9dce561 100644
--- a/src/main/runtime/orchestration/federation-sync.ts
+++ b/src/main/runtime/orchestration/federation-sync.ts
@@ -5,7 +5,14 @@ import {
   type WorkerReportOutcome
 } from './types'
 import type { OrcaRuntimeService } from '../orca-runtime'
+import type { FederatedLifecycleSettlement } from './federation-lifecycle-settlement'
+import { ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION } from '../../../shared/protocol-version'
 import { OrchestrationError } from './orchestration-error'
+import {
+  acquireFederationAckLease,
+  getFederationAckedThrough,
+  recordFederationAckCheckpoint
+} from './federation-ack-checkpoints'
 
 const MESSAGE_TYPE_SET = new Set<MessageType>(MESSAGE_TYPES)
 
@@ -52,6 +59,9 @@ export async function syncFederatedDispatch(
       `Saved environment ${federated.environment_name} now identifies a different Orca server.`
     )
   }
+  const ackLease = acquireFederationAckLease(runtime, dispatchId)
+  const supportsLifecycleSettlement =
+    federated.protocol_version >= ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION
 
   const pulled = (await runtime.callOrchestrationWorkerServer(
     federated.environment_id,
@@ -59,12 +69,17 @@ export async function syncFederatedDispatch(
     {
       dispatchId,
       afterSequence: federated.to_home_imported_sequence,
+      ...(supportsLifecycleSettlement ? { replayUnacknowledged: true } : {}),
       limit: 50
     },
     15_000
   )) as { runtimeEpoch: string; items: PulledRelayItem[] }
-  let cursor = federated.to_home_imported_sequence
+  let cursor =
+    supportsLifecycleSettlement && pulled.items.length > 0
+      ? pulled.items[0].sequence - 1
+      : federated.to_home_imported_sequence
   let imported = 0
+  const settlements: { sequence: number; lifecycle: FederatedLifecycleSettlement }[] = []
   for (const item of pulled.items) {
     if (item.dispatch_id !== dispatchId || item.sequence !== cursor + 1) {
       throw new OrchestrationError(
@@ -90,19 +105,44 @@ export async function syncFederatedDispatch(
       },
       lifecycle: parseFederatedLifecycle(message, item.message_id, dispatchId, dispatch.task_id)
     })
+    if (stored.lifecycle && supportsLifecycleSettlement) {
+      settlements.push({
+        sequence: item.sequence,
+        lifecycle:
+          stored.lifecycle.action === 'settled'
+            ? {
+                action: stored.lifecycle.outcome === 'succeeded' ? 'completed' : 'failed',
+                authority: 'run_home'
+              }
+            : { ...stored.lifecycle, authority: 'run_home' }
+      })
+    }
     cursor = item.sequence
     runtime.notifyMessageArrived(stored.message.to_handle, stored.message.type)
     imported += stored.duplicate ? 0 : 1
   }
 
-  if (cursor > 0) {
+  const ackIdentity = {
+    environmentId: federated.environment_id,
+    peerFingerprint: federated.peer_fingerprint,
+    remoteRuntimeEpoch: pulled.runtimeEpoch
+  }
+  if (cursor > getFederationAckedThrough(ackLease, ackIdentity)) {
     await runtime.callOrchestrationWorkerServer(
       federated.environment_id,
       'orchestration.federationAck',
-      { dispatchId, throughSequence: cursor },
+      {
+        dispatchId,
+        throughSequence: cursor,
+        ...(settlements.length > 0 ? { settlements } : {})
+      },
       15_000,
       { orchestrationRequestId: `relay_ack_${dispatchId}_${cursor}` }
     )
+    recordFederationAckCheckpoint(runtime, ackLease, {
+      ...ackIdentity,
+      throughSequence: cursor
+    })
   }
   const toWorker =
     db.getWorkerDispatch(dispatchId)?.state === 'ready'
diff --git a/src/main/runtime/orchestration/mutation-receipt-capacity.test.ts b/src/main/runtime/orchestration/mutation-receipt-capacity.test.ts
new file mode 100644
index 00000000000..6907d73ba81
--- /dev/null
+++ b/src/main/runtime/orchestration/mutation-receipt-capacity.test.ts
@@ -0,0 +1,171 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import { OrchestrationDb } from './db'
+import { MUTATION_RECEIPT_MAX_ROWS } from './mutation-receipt-capacity'
+
+function sqliteFor(db: OrchestrationDb): Database.Database {
+  return (db as unknown as { db: Database.Database }).db
+}
+
+function insertReceipts(
+  sqlite: Database.Database,
+  count: number,
+  state: 'pending' | 'completed'
+): void {
+  sqlite
+    .prepare(
+      `WITH RECURSIVE receipt_numbers(value) AS (
+         VALUES (1)
+         UNION ALL
+         SELECT value + 1 FROM receipt_numbers WHERE value < ?
+       )
+       INSERT INTO mutation_receipts (
+         caller_fingerprint, request_id, method, payload_hash, state
+       )
+       SELECT 'caller', printf('request_%05d', value), 'orchestration.send',
+              printf('hash_%05d', value), ?
+       FROM receipt_numbers`
+    )
+    .run(count, state)
+}
+
+function beginReceipt(db: OrchestrationDb, requestId: string): void {
+  db.beginMutationReceipt({
+    callerFingerprint: 'new-caller',
+    requestId,
+    method: 'orchestration.send',
+    payloadHash: `hash-${requestId}`
+  })
+}
+
+describe('mutation receipt capacity schema', () => {
+  let db: OrchestrationDb | undefined
+  let secondDb: OrchestrationDb | undefined
+  let tempDir: string | undefined
+
+  afterEach(() => {
+    secondDb?.close()
+    db?.close()
+    if (tempDir) {
+      rmSync(tempDir, { recursive: true, force: true })
+    }
+  })
+
+  it('uses the completed receipt index for age and capacity pruning', () => {
+    db = new OrchestrationDb(':memory:')
+    const sqlite = sqliteFor(db)
+    insertReceipts(sqlite, 10, 'completed')
+
+    const agePlan = sqlite
+      .prepare(
+        `EXPLAIN QUERY PLAN
+         DELETE FROM mutation_receipts
+         WHERE state = 'completed'
+           AND updated_at < datetime('now', ?)`
+      )
+      .all('-30 days') as { detail: string }[]
+    const capacityPlan = sqlite
+      .prepare(
+        `EXPLAIN QUERY PLAN
+         SELECT rowid FROM mutation_receipts
+         WHERE state = 'completed'
+         ORDER BY updated_at ASC, rowid ASC
+         LIMIT ?`
+      )
+      .all(64) as { detail: string }[]
+    const details = [...agePlan, ...capacityPlan].map((row) => row.detail).join('\n')
+
+    expect(details).toContain('idx_mutation_receipts_completed_updated')
+    expect(details).not.toContain('USE TEMP B-TREE')
+    expect(details).not.toMatch(/SCAN mutation_receipts(?:\n|$)/)
+  })
+
+  it('migrates a populated v25 database and tracks writes from older connections', () => {
+    tempDir = mkdtempSync(join(tmpdir(), 'orca-mutation-receipt-migration-'))
+    const dbPath = join(tempDir, 'orchestration.db')
+    db = new OrchestrationDb(dbPath)
+    insertReceipts(sqliteFor(db), 20, 'completed')
+    db.close()
+    db = undefined
+
+    const oldDb = new Database(dbPath)
+    oldDb.exec(`
+      DROP TRIGGER mutation_receipts_count_insert;
+      DROP TRIGGER mutation_receipts_count_delete;
+      DROP TABLE mutation_receipt_ledger;
+      DROP INDEX idx_mutation_receipts_completed_updated;
+    `)
+    oldDb.pragma('user_version = 25')
+    oldDb.close()
+
+    db = new OrchestrationDb(dbPath)
+    const sqlite = sqliteFor(db)
+    expect(sqlite.pragma('user_version', { simple: true })).toBe(26)
+    expect(sqlite.prepare('SELECT receipt_count FROM mutation_receipt_ledger').get()).toEqual({
+      receipt_count: 20
+    })
+
+    const olderConnection = new Database(dbPath)
+    olderConnection.exec(`
+      INSERT INTO mutation_receipts (
+        caller_fingerprint, request_id, method, payload_hash, state
+      ) VALUES ('old-client', 'inserted', 'orchestration.send', 'hash', 'pending');
+      DELETE FROM mutation_receipts
+      WHERE caller_fingerprint = 'old-client' AND request_id = 'inserted';
+    `)
+    olderConnection.close()
+
+    expect(sqlite.prepare('SELECT receipt_count FROM mutation_receipt_ledger').get()).toEqual({
+      receipt_count: 20
+    })
+  })
+
+  it('amortizes capacity pruning while retaining the newest replay records', () => {
+    db = new OrchestrationDb(':memory:')
+    const sqlite = sqliteFor(db)
+    insertReceipts(sqlite, MUTATION_RECEIPT_MAX_ROWS, 'completed')
+
+    beginReceipt(db, 'first')
+    const afterFirst = sqlite
+      .prepare('SELECT receipt_count FROM mutation_receipt_ledger')
+      .get() as { receipt_count: number }
+    beginReceipt(db, 'second')
+    const afterSecond = sqlite
+      .prepare('SELECT receipt_count FROM mutation_receipt_ledger')
+      .get() as { receipt_count: number }
+
+    expect(afterFirst.receipt_count).toBe(MUTATION_RECEIPT_MAX_ROWS - 63)
+    expect(afterSecond.receipt_count).toBe(afterFirst.receipt_count + 1)
+    expect(db.getMutationReceipt('caller', 'request_00064')).toBeUndefined()
+    expect(db.getMutationReceipt('caller', 'request_00065')).toMatchObject({ state: 'completed' })
+    expect(db.getMutationReceipt('caller', 'request_10000')).toMatchObject({ state: 'completed' })
+  })
+
+  it('keeps the row limit exact across independent database connections', () => {
+    tempDir = mkdtempSync(join(tmpdir(), 'orca-mutation-receipt-concurrency-'))
+    const dbPath = join(tempDir, 'orchestration.db')
+    db = new OrchestrationDb(dbPath)
+    secondDb = new OrchestrationDb(dbPath)
+    const sqlite = sqliteFor(db)
+    insertReceipts(sqlite, MUTATION_RECEIPT_MAX_ROWS - 1, 'pending')
+    sqlite.exec(`
+      INSERT INTO mutation_receipts (
+        caller_fingerprint, request_id, method, payload_hash, state
+      ) VALUES ('caller', 'completed-slot', 'orchestration.send', 'hash', 'completed')
+    `)
+
+    beginReceipt(db, 'first-connection')
+    expect(() => beginReceipt(secondDb!, 'second-connection')).toThrowError(
+      expect.objectContaining({ code: 'mutation_ledger_full' })
+    )
+    db.discardPendingMutationReceipt('new-caller', 'first-connection')
+    beginReceipt(secondDb, 'second-connection')
+
+    expect(sqlite.prepare('SELECT receipt_count FROM mutation_receipt_ledger').get()).toEqual({
+      receipt_count: MUTATION_RECEIPT_MAX_ROWS
+    })
+  })
+})
diff --git a/src/main/runtime/orchestration/mutation-receipt-capacity.ts b/src/main/runtime/orchestration/mutation-receipt-capacity.ts
new file mode 100644
index 00000000000..2ba735adad0
--- /dev/null
+++ b/src/main/runtime/orchestration/mutation-receipt-capacity.ts
@@ -0,0 +1,79 @@
+import type Database from '../../sqlite/sync-database'
+import { OrchestrationError } from './orchestration-error'
+
+export const MUTATION_RECEIPT_MAX_ROWS = 10_000
+const MUTATION_RECEIPT_MAX_AGE_DAYS = 30
+const MUTATION_RECEIPT_PRUNE_BATCH_SIZE = 64
+
+export function migrateMutationReceiptCapacity(db: Database.Database): void {
+  // Why: database triggers keep the count exact for concurrent connections and older binaries.
+  db.exec(`
+    CREATE INDEX IF NOT EXISTS idx_mutation_receipts_completed_updated
+      ON mutation_receipts(updated_at) WHERE state = 'completed';
+
+    CREATE TABLE IF NOT EXISTS mutation_receipt_ledger (
+      singleton     INTEGER PRIMARY KEY CHECK(singleton = 1),
+      receipt_count INTEGER NOT NULL CHECK(receipt_count >= 0)
+    );
+
+    INSERT INTO mutation_receipt_ledger (singleton, receipt_count)
+    SELECT 1, COUNT(*) FROM mutation_receipts
+    -- SQLite needs a WHERE to disambiguate SELECT UPSERT syntax.
+    WHERE true
+    ON CONFLICT(singleton) DO UPDATE SET receipt_count = excluded.receipt_count;
+
+    CREATE TRIGGER IF NOT EXISTS mutation_receipts_count_insert
+    AFTER INSERT ON mutation_receipts
+    BEGIN
+      UPDATE mutation_receipt_ledger
+      SET receipt_count = receipt_count + 1
+      WHERE singleton = 1;
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS mutation_receipts_count_delete
+    AFTER DELETE ON mutation_receipts
+    BEGIN
+      UPDATE mutation_receipt_ledger
+      SET receipt_count = receipt_count - 1
+      WHERE singleton = 1;
+    END;
+  `)
+}
+
+function receiptCount(db: Database.Database): number {
+  const row = db
+    .prepare('SELECT receipt_count FROM mutation_receipt_ledger WHERE singleton = 1')
+    .get() as { receipt_count: number } | undefined
+  if (!row) {
+    throw new Error('Mutation receipt ledger metadata is missing.')
+  }
+  return row.receipt_count
+}
+
+export function ensureMutationReceiptCapacity(db: Database.Database): void {
+  db.prepare(
+    `DELETE FROM mutation_receipts
+     WHERE state = 'completed'
+       AND updated_at < datetime('now', ?)`
+  ).run(`-${MUTATION_RECEIPT_MAX_AGE_DAYS} days`)
+
+  const count = receiptCount(db)
+  if (count >= MUTATION_RECEIPT_MAX_ROWS) {
+    db.prepare(
+      `DELETE FROM mutation_receipts
+       WHERE rowid IN (
+         SELECT rowid FROM mutation_receipts
+         WHERE state = 'completed'
+         ORDER BY updated_at ASC, rowid ASC
+         LIMIT ?
+       )`
+    ).run(count - MUTATION_RECEIPT_MAX_ROWS + MUTATION_RECEIPT_PRUNE_BATCH_SIZE)
+  }
+
+  if (receiptCount(db) >= MUTATION_RECEIPT_MAX_ROWS) {
+    throw new OrchestrationError(
+      'mutation_ledger_full',
+      'The durable mutation ledger is full of unresolved operations. Resolve or inspect them before starting another mutation.'
+    )
+  }
+}
diff --git a/src/main/runtime/orchestration/orchestration-db-retention-pagination.test.ts b/src/main/runtime/orchestration/orchestration-db-retention-pagination.test.ts
index 8cb0547ee27..0b9c5ad7097 100644
--- a/src/main/runtime/orchestration/orchestration-db-retention-pagination.test.ts
+++ b/src/main/runtime/orchestration/orchestration-db-retention-pagination.test.ts
@@ -74,7 +74,7 @@ describe('OrchestrationDb bounded mutation receipts', () => {
     const count = sqliteFor(db)
       .prepare('SELECT COUNT(*) AS count FROM mutation_receipts')
       .get() as { count: number }
-    expect(count.count).toBe(MUTATION_RECEIPT_MAX_ROWS)
+    expect(count.count).toBeLessThanOrEqual(MUTATION_RECEIPT_MAX_ROWS)
     expect(db.getMutationReceipt('caller', 'request_00001')).toBeUndefined()
     expect(db.getMutationReceipt('caller', 'request_10000')).toMatchObject({ state: 'completed' })
     expect(db.getMutationReceipt('caller', 'new')).toMatchObject({ state: 'pending' })
@@ -117,7 +117,7 @@ describe('OrchestrationDb bounded mutation receipts', () => {
     const count = sqliteFor(db)
       .prepare('SELECT COUNT(*) AS count FROM mutation_receipts')
       .get() as { count: number }
-    expect(count.count).toBe(MUTATION_RECEIPT_MAX_ROWS)
+    expect(count.count).toBeLessThanOrEqual(MUTATION_RECEIPT_MAX_ROWS)
     expect(db.getMutationReceipt('caller', 'request_00001')).toBeUndefined()
     expect(db.getMutationReceipt('caller', 'remote_pruned')).toMatchObject({ state: 'pending' })
     expect(db.getRemoteDispatchAttachment('ctx_remote_pruned')).toBeDefined()
@@ -240,7 +240,7 @@ describe('OrchestrationDb dispatch assignee index migration', () => {
 
     db = new OrchestrationDb(dbPath)
     const sqlite = sqliteFor(db)
-    expect(sqlite.pragma('user_version', { simple: true })).toBe(25)
+    expect(sqlite.pragma('user_version', { simple: true })).toBe(26)
     expect(db.getDispatchContextById(dispatch.id)).toMatchObject({ assignee_handle: 'term_worker' })
     expect(db.getTask(task.id)).toMatchObject({
       created_by_pane_key: null,
@@ -277,7 +277,7 @@ describe('OrchestrationDb dispatch assignee index migration', () => {
 
     db.close()
     db = new OrchestrationDb(dbPath)
-    expect(sqliteFor(db).pragma('user_version', { simple: true })).toBe(25)
+    expect(sqliteFor(db).pragma('user_version', { simple: true })).toBe(26)
     expect(db.getDispatchContextById(dispatch.id)).toBeDefined()
   })
 
@@ -309,7 +309,7 @@ describe('OrchestrationDb dispatch assignee index migration', () => {
 
     db = new OrchestrationDb(dbPath)
     const sqlite = sqliteFor(db)
-    expect(sqlite.pragma('user_version', { simple: true })).toBe(25)
+    expect(sqlite.pragma('user_version', { simple: true })).toBe(26)
     expect(db.getTask(task.id)).toMatchObject({
       created_by_pane_key: 'tab_creator:leaf_creator',
       created_by_process_incarnation: 'pty_creator:incarnation-a',
@@ -328,7 +328,7 @@ describe('OrchestrationDb dispatch assignee index migration', () => {
 
     db.close()
     db = new OrchestrationDb(dbPath)
-    expect(sqliteFor(db).pragma('user_version', { simple: true })).toBe(25)
+    expect(sqliteFor(db).pragma('user_version', { simple: true })).toBe(26)
     expect(db.getTask(task.id)?.created_by_process_incarnation).toBe('pty_creator:incarnation-a')
   })
 })
diff --git a/src/main/runtime/orchestration/setup-completion-signal.ts b/src/main/runtime/orchestration/setup-completion-signal.ts
index 23e22008387..15c74d2294e 100644
--- a/src/main/runtime/orchestration/setup-completion-signal.ts
+++ b/src/main/runtime/orchestration/setup-completion-signal.ts
@@ -61,7 +61,7 @@ export function createSetupCompletionScanner(
       }
       const combined = `${carry}${data}`
       const markerIndex = combined.lastIndexOf(expectedPrefix)
-      if (markerIndex >= 0) {
+      if (markerIndex !== -1) {
         const suffix = combined.slice(markerIndex + expectedPrefix.length)
         const match = suffix.match(/^(-?\d+)\r?\n/)
         if (match) {
diff --git a/src/main/runtime/orchestration/worker-terminal-process-liveness.ts b/src/main/runtime/orchestration/worker-terminal-process-liveness.ts
new file mode 100644
index 00000000000..5a6e92c7878
--- /dev/null
+++ b/src/main/runtime/orchestration/worker-terminal-process-liveness.ts
@@ -0,0 +1,62 @@
+import type { PtyProcessInfo } from '../../providers/pty-process-info'
+
+export type WorkerTerminalHostScope =
+  | { kind: 'local'; hostId: 'local' }
+  | { kind: 'wsl'; hostId: 'local'; distro: string }
+  | { kind: 'ssh'; targetId: string }
+
+export function parseWorkerTerminalHostScope(value: string | null): WorkerTerminalHostScope | null {
+  if (!value) {
+    return null
+  }
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(value)
+  } catch {
+    return null
+  }
+  if (!parsed || typeof parsed !== 'object') {
+    return null
+  }
+  const scope = parsed as Record<string, unknown>
+  if (scope.kind === 'local' && scope.hostId === 'local') {
+    return { kind: 'local', hostId: 'local' }
+  }
+  if (
+    scope.kind === 'wsl' &&
+    scope.hostId === 'local' &&
+    typeof scope.distro === 'string' &&
+    scope.distro.length > 0
+  ) {
+    return { kind: 'wsl', hostId: 'local', distro: scope.distro }
+  }
+  if (scope.kind === 'ssh' && typeof scope.targetId === 'string' && scope.targetId.length > 0) {
+    return { kind: 'ssh', targetId: scope.targetId }
+  }
+  return null
+}
+
+export function classifyWorkerTerminalProcessIncarnation(
+  processIncarnation: string,
+  sessions: readonly PtyProcessInfo[]
+): 'live' | 'dead' | 'unknown' {
+  const possibleMatches = sessions.filter((session) =>
+    processIncarnation.startsWith(`${session.id}:`)
+  )
+  if (
+    possibleMatches.some((session) => {
+      const incarnationId = session.incarnationId
+      if (!incarnationId || incarnationId !== incarnationId.trim()) {
+        return false
+      }
+      return `${session.id}:${incarnationId}` === processIncarnation
+    })
+  ) {
+    return 'live'
+  }
+  return possibleMatches.some(
+    (session) => !session.incarnationId || session.incarnationId !== session.incarnationId.trim()
+  )
+    ? 'unknown'
+    : 'dead'
+}
diff --git a/src/main/runtime/quarter-circle-title-send-authorization.test.ts b/src/main/runtime/quarter-circle-title-send-authorization.test.ts
new file mode 100644
index 00000000000..d8e58073cb0
--- /dev/null
+++ b/src/main/runtime/quarter-circle-title-send-authorization.test.ts
@@ -0,0 +1,212 @@
+// STA-4028 (regression from #13925): quarter circles are ordinary progress glyphs —
+// ora, installers, any TUI animates them — so a title carrying nothing else must not
+// authorize a guarded send, which auto-submits with Enter into whatever owns the pane.
+import { describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from './orca-runtime'
+import { assertTerminalAgentSendable } from './rpc/terminal-agent-send-guard'
+import { detectAgentStatusFromTitle } from '../../shared/agent-detection'
+
+vi.mock('electron', () => ({
+  BrowserWindow: { fromId: vi.fn(() => null) },
+  webContents: { fromId: vi.fn(() => null) },
+  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
+  app: { getPath: vi.fn(() => '/tmp') }
+}))
+
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const TAB_ID = 'tab-1'
+const WORKTREE_ID = 'wt-1'
+const PTY_ID = 'pty-1'
+
+// Captured from Claude Code 2.1.228 while it read this repository's package.json.
+const SPINNER_ONLY_TITLE = '◑ Check package version in package.json'
+const SPINNER_WITH_IDENTITY_TITLE = '◐ Claude Code'
+const BRAILLE_SPINNER_ONLY_TITLE = '⠂ Deploying release 4.2'
+
+async function createRuntimeWithTitle(
+  paneTitle: string,
+  foregroundProcess: string | null,
+  launchAgent?: 'claude',
+  verifiedLaunch = true
+): Promise<{
+  runtime: OrcaRuntimeService
+  handle: string
+  getForegroundProcess: ReturnType<typeof vi.fn>
+}> {
+  const runtime = new OrcaRuntimeService(null)
+  const internals = runtime as unknown as {
+    resolveTerminalWorkspaceLaunchScope: (selector: string) => Promise<unknown>
+  }
+  vi.spyOn(internals, 'resolveTerminalWorkspaceLaunchScope').mockResolvedValue({
+    id: WORKTREE_ID,
+    path: '/repo/app',
+    connectionId: null,
+    repo: null,
+    folderWorkspace: null
+  })
+  const getForegroundProcess = vi.fn(async () => foregroundProcess)
+  runtime.setPtyController({
+    spawn: vi.fn().mockResolvedValue({ id: PTY_ID, incarnationId: 'initial-incarnation' }),
+    write: () => true,
+    kill: () => true,
+    getForegroundProcess
+  })
+  const terminal = await runtime.createTerminal(`id:${WORKTREE_ID}`, {
+    tabId: TAB_ID,
+    leafId: LEAF_ID,
+    title: 'Terminal',
+    ...(launchAgent
+      ? {
+          launchAgent,
+          ...(verifiedLaunch
+            ? { launchConfig: { agentCommand: 'claude', agentArgs: '', agentEnv: {} } }
+            : {})
+        }
+      : {})
+  })
+  runtime.attachWindow(1)
+  runtime.syncWindowGraph(1, {
+    tabs: [
+      {
+        tabId: TAB_ID,
+        worktreeId: WORKTREE_ID,
+        title: 'Terminal',
+        activeLeafId: LEAF_ID,
+        layout: null
+      }
+    ],
+    leaves: [
+      {
+        tabId: TAB_ID,
+        worktreeId: WORKTREE_ID,
+        leafId: LEAF_ID,
+        paneRuntimeId: 1,
+        ptyId: PTY_ID,
+        paneTitle
+      }
+    ]
+  })
+  return { runtime, handle: terminal.handle, getForegroundProcess }
+}
+
+const AUTHORIZED = 'authorized'
+
+async function guardedSendResult(runtime: OrcaRuntimeService, handle: string): Promise<string> {
+  try {
+    await assertTerminalAgentSendable({ runtime, handle, assertWritable: () => {} })
+    return AUTHORIZED
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error)
+  }
+}
+
+describe('quarter-circle title send authorization (STA-4028)', () => {
+  it('refuses a guarded send when a quarter-circle spinner is the only agent evidence', async () => {
+    const { runtime, handle } = await createRuntimeWithTitle(SPINNER_ONLY_TITLE, 'node')
+
+    await expect(runtime.getTerminalAgentStatus(handle)).resolves.toMatchObject({
+      isRunningAgent: false
+    })
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe('terminal_guard_no_agent')
+  })
+
+  it('refuses a guarded send when the foreground process cannot be read at all', async () => {
+    // Why: SSH and folder-workspace panes can fail the foreground read; no evidence
+    // stays a refusal rather than falling back to the glyph.
+    const { runtime, handle } = await createRuntimeWithTitle(SPINNER_ONLY_TITLE, null)
+
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe('terminal_guard_no_agent')
+  })
+
+  it('authorizes a guarded send when the foreground process is a recognized agent', async () => {
+    const { runtime, handle } = await createRuntimeWithTitle(SPINNER_ONLY_TITLE, 'claude')
+
+    await expect(runtime.getTerminalAgentStatus(handle)).resolves.toMatchObject({
+      isRunningAgent: true,
+      status: 'working'
+    })
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe(AUTHORIZED)
+  })
+
+  it('authorizes a managed Claude launch when the foreground process is unavailable', async () => {
+    const { runtime, handle, getForegroundProcess } = await createRuntimeWithTitle(
+      SPINNER_ONLY_TITLE,
+      null,
+      'claude'
+    )
+    expect(
+      (
+        runtime as unknown as {
+          ptysById: Map<string, { launchAgent: string | null; launchToken: string | null }>
+        }
+      ).ptysById.get(PTY_ID)
+    ).toMatchObject({ launchAgent: 'claude', launchToken: expect.any(String) })
+
+    await expect(runtime.getTerminalAgentStatus(handle)).resolves.toMatchObject({
+      isRunningAgent: true,
+      status: 'working'
+    })
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe(AUTHORIZED)
+    expect(getForegroundProcess).not.toHaveBeenCalled()
+  })
+
+  it('does not trust an unverified Claude launch hint', async () => {
+    const { runtime, handle } = await createRuntimeWithTitle(
+      SPINNER_ONLY_TITLE,
+      null,
+      'claude',
+      false
+    )
+
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe('terminal_guard_no_agent')
+  })
+
+  it('does not carry managed Claude identity into a replacement PTY incarnation', async () => {
+    const { runtime, handle } = await createRuntimeWithTitle(SPINNER_ONLY_TITLE, null, 'claude')
+    const pty = (
+      runtime as unknown as {
+        ptysById: Map<
+          string,
+          { incarnationId: string | null; launchIncarnationId: string | null; launchToken: string }
+        >
+      }
+    ).ptysById.get(PTY_ID)
+    expect(pty).toMatchObject({
+      incarnationId: 'initial-incarnation',
+      launchIncarnationId: 'initial-incarnation'
+    })
+
+    runtime.onPtySpawned(PTY_ID, 'replacement-incarnation', { awaitsRegistration: false })
+
+    expect(pty).toMatchObject({
+      incarnationId: 'replacement-incarnation',
+      launchIncarnationId: 'initial-incarnation',
+      launchToken: expect.any(String)
+    })
+    await expect(runtime.getTerminalAgentStatus(handle)).resolves.toMatchObject({
+      isRunningAgent: false
+    })
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe('terminal_guard_no_agent')
+  })
+
+  it('authorizes a guarded send when the busy title itself names the agent', async () => {
+    const { runtime, handle } = await createRuntimeWithTitle(SPINNER_WITH_IDENTITY_TITLE, null)
+
+    await expect(runtime.getTerminalAgentStatus(handle)).resolves.toMatchObject({
+      isRunningAgent: true,
+      status: 'working'
+    })
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe(AUTHORIZED)
+  })
+
+  it('leaves braille-spinner authorization unchanged', async () => {
+    const { runtime, handle } = await createRuntimeWithTitle(BRAILLE_SPINNER_ONLY_TITLE, null)
+
+    await expect(guardedSendResult(runtime, handle)).resolves.toBe(AUTHORIZED)
+  })
+
+  it('keeps the quarter-circle glyph a working activity signal (#13889)', async () => {
+    expect(detectAgentStatusFromTitle(SPINNER_ONLY_TITLE)).toBe('working')
+    expect(detectAgentStatusFromTitle(SPINNER_WITH_IDENTITY_TITLE)).toBe('working')
+  })
+})
diff --git a/src/main/runtime/rpc/core.ts b/src/main/runtime/rpc/core.ts
index 8e09e942a08..b415ddd0e71 100644
--- a/src/main/runtime/rpc/core.ts
+++ b/src/main/runtime/rpc/core.ts
@@ -107,13 +107,13 @@ export type RpcContext = {
   ) => () => void
 }
 
-export type RpcHandler<TParams> = (params: TParams, ctx: RpcContext) => Promise<unknown> | unknown
+export type RpcHandler<TParams> = (params: TParams, ctx: RpcContext) => unknown
 
 // Why: RpcMethod erases the param type; centralizing the cast in defineMethod sidesteps RpcHandler's contravariance.
 export type RpcMethod = {
   readonly name: string
   readonly params: ZodType | null
-  readonly handler: (params: unknown, ctx: RpcContext) => Promise<unknown> | unknown
+  readonly handler: (params: unknown, ctx: RpcContext) => unknown
 }
 
 type DefineMethodSpec<TSchema extends ZodType | null> = {
diff --git a/src/main/runtime/rpc/methods/client-ui-schemas.ts b/src/main/runtime/rpc/methods/client-ui-schemas.ts
index d1d692dab41..b52a52f24a7 100644
--- a/src/main/runtime/rpc/methods/client-ui-schemas.ts
+++ b/src/main/runtime/rpc/methods/client-ui-schemas.ts
@@ -19,6 +19,7 @@ import {
 } from '../../../../shared/worktree-card-properties'
 import { isPluginPanelTabKey } from '../../../../shared/plugins/plugin-manifest'
 import type { TaskProvider } from '../../../../shared/types'
+import { ClientUiWorkspaceFilterFields } from './client-ui-workspace-filter-fields'
 import { TaskResumeState } from './task-resume-state-schema'
 import { omitUndefinedValues, tolerateUnknownValues } from './ui-update-value-tolerance'
 
@@ -214,15 +215,10 @@ const UiUpdateFields = z
     manualRepoOrder: z
       .array(z.object({ hostId: z.string(), repoId: z.string() }).strict())
       .optional(),
-    hideDefaultBranchWorkspace: z.boolean().optional(),
-    hideAutomationGeneratedWorkspaces: z.boolean().optional(),
+    ...ClientUiWorkspaceFilterFields,
     // Why: rides App.tsx's debounced writer, so omitting it rejected that entire
     // payload (sidebar widths, filters, agent acks) for every paired client.
     showDotfilesByWorktree: z.record(z.string(), z.boolean()).optional(),
-    hideCliCreatedWorkspaces: z.boolean().optional(),
-    hideDetachedHeadWorkspaces: z.boolean().optional(),
-    alwaysShowDefaultBranchWorkspace: z.boolean().optional(),
-    filterRepoIds: StringArray.optional(),
     collapsedGroups: StringArray.optional(),
     uiZoomLevel: z.number().finite().optional(),
     editorFontZoomLevel: z.number().finite().optional(),
diff --git a/src/main/runtime/rpc/methods/client-ui-workspace-filter-fields.ts b/src/main/runtime/rpc/methods/client-ui-workspace-filter-fields.ts
new file mode 100644
index 00000000000..d0239b03ec3
--- /dev/null
+++ b/src/main/runtime/rpc/methods/client-ui-workspace-filter-fields.ts
@@ -0,0 +1,11 @@
+import { z } from 'zod'
+
+export const ClientUiWorkspaceFilterFields = {
+  hideDefaultBranchWorkspace: z.boolean().optional(),
+  hideAutomationGeneratedWorkspaces: z.boolean().optional(),
+  hideCliCreatedWorkspaces: z.boolean().optional(),
+  hideDetachedHeadWorkspaces: z.boolean().optional(),
+  hideWorkspacesFromOtherDevices: z.boolean().optional(),
+  alwaysShowDefaultBranchWorkspace: z.boolean().optional(),
+  filterRepoIds: z.array(z.string()).optional()
+}
diff --git a/src/main/runtime/rpc/methods/client-ui.test.ts b/src/main/runtime/rpc/methods/client-ui.test.ts
index 2a4b17b455e..18c747c242c 100644
--- a/src/main/runtime/rpc/methods/client-ui.test.ts
+++ b/src/main/runtime/rpc/methods/client-ui.test.ts
@@ -422,6 +422,24 @@ describe('client UI RPC methods', () => {
     })
   })
 
+  it('does not let a paired client replace the host workspace origin filter', async () => {
+    const runtime = {
+      getRuntimeId: () => 'test-runtime',
+      updateUIState: vi.fn(() => getDefaultUIState())
+    } as unknown as OrcaRuntimeService
+    const dispatcher = new RpcDispatcher({ runtime, methods: CLIENT_UI_METHODS })
+
+    const response = await dispatcher.dispatch(
+      makeRequest('ui.set', {
+        hideWorkspacesFromOtherDevices: true,
+        sidebarWidth: 280
+      })
+    )
+
+    expect(response).toMatchObject({ ok: true })
+    expect(runtime.updateUIState).toHaveBeenCalledWith({ sidebarWidth: 280 })
+  })
+
   it('accepts persisted literal UI arrays and nested UI state', async () => {
     const updated: PersistedUIState = {
       ...getDefaultUIState(),
diff --git a/src/main/runtime/rpc/methods/client-ui.ts b/src/main/runtime/rpc/methods/client-ui.ts
index a10f1b66708..73326756cd9 100644
--- a/src/main/runtime/rpc/methods/client-ui.ts
+++ b/src/main/runtime/rpc/methods/client-ui.ts
@@ -8,7 +8,7 @@ import {
 } from './client-ui-schemas'
 // Type-only side effect: keeps the schema/PersistedUIState parity assertions in
 // the typecheck graph so drift fails the build instead of a paired client.
-import type {} from './ui-state-schema-parity-checks'
+
 import { TerminalQuickCommandsUpdate } from './terminal-quick-command-rpc-schema'
 
 export const CLIENT_UI_METHODS: RpcMethod[] = [
@@ -55,9 +55,11 @@ export const CLIENT_UI_METHODS: RpcMethod[] = [
   defineMethod({
     name: 'ui.set',
     params: UiUpdate,
-    handler: (params, { runtime }) => ({
-      ui: runtime.updateUIState(params as Partial<PersistedUIState>)
-    })
+    handler: (params, { runtime }) => {
+      const { hideWorkspacesFromOtherDevices: _clientLocalFilter, ...hostUpdates } = params
+      void _clientLocalFilter
+      return { ui: runtime.updateUIState(hostUpdates as Partial<PersistedUIState>) }
+    }
   }),
   defineMethod({
     name: 'ui.recordFeatureInteraction',
diff --git a/src/main/runtime/rpc/methods/folder-workspace.ts b/src/main/runtime/rpc/methods/folder-workspace.ts
index baf03ada5d0..aa39654d9f8 100644
--- a/src/main/runtime/rpc/methods/folder-workspace.ts
+++ b/src/main/runtime/rpc/methods/folder-workspace.ts
@@ -5,6 +5,8 @@ import { isTuiAgent } from '../../../../shared/tui-agent-config'
 import { TaskSourceContextSchema } from '../../../../shared/task-source-context-schema'
 import { WorkspaceLinkedItemSchema } from '../../../../shared/workspace-linked-item-schema'
 import { isWorkspaceLinkedItemSourceContextMatch } from '../../../../shared/workspace-linked-item-source-context'
+import { resolveRpcWorkspaceCreatorProvenance } from '../workspace-creator-context'
+import { DiffCommentSchema } from '../../../../shared/diff-comment-schema'
 
 const FolderWorkspaceLinkedTask = WorkspaceLinkedItemSchema.nullable()
 
@@ -58,7 +60,8 @@ const FolderWorkspaceUpdate = z.object({
       createdWithAgent: z.string().refine(isTuiAgent).optional(),
       pendingFirstAgentMessageRename: z.boolean().optional(),
       firstAgentMessageRenameError: z.string().nullable().optional(),
-      lastActivityAt: OptionalFiniteNumber
+      lastActivityAt: OptionalFiniteNumber,
+      diffComments: z.array(DiffCommentSchema).optional()
     })
     .superRefine(assertLinkedTaskSourceContextMatch)
 })
@@ -94,8 +97,11 @@ export const FOLDER_WORKSPACE_METHODS: RpcMethod[] = [
   defineMethod({
     name: 'folderWorkspace.create',
     params: FolderWorkspaceCreate,
-    handler: async (params, { runtime }) => ({
-      folderWorkspace: await runtime.createFolderWorkspace(params)
+    handler: async (params, context) => ({
+      folderWorkspace: await context.runtime.createFolderWorkspace({
+        ...params,
+        creatorProvenance: resolveRpcWorkspaceCreatorProvenance(context)
+      })
     })
   }),
   defineMethod({
diff --git a/src/main/runtime/rpc/methods/github.test.ts b/src/main/runtime/rpc/methods/github.test.ts
index 0a283b52072..72a4e150077 100644
--- a/src/main/runtime/rpc/methods/github.test.ts
+++ b/src/main/runtime/rpc/methods/github.test.ts
@@ -192,6 +192,32 @@ describe('github RPC methods', () => {
     expect(response).toMatchObject({ ok: true, result: [] })
   })
 
+  it('forwards request cancellation to PR check-details work', async () => {
+    const runtime = {
+      getRuntimeId: () => 'test-runtime',
+      getRepoPRCheckDetails: vi.fn().mockResolvedValue(null)
+    } as unknown as OrcaRuntimeService
+    const dispatcher = new RpcDispatcher({ runtime, methods: GITHUB_METHODS })
+    const controller = new AbortController()
+
+    await dispatcher.dispatch(
+      makeRequest('github.prCheckDetails', { repo: 'repo-1', checkRunId: 9 }),
+      { signal: controller.signal }
+    )
+
+    expect(runtime.getRepoPRCheckDetails).toHaveBeenCalledWith(
+      'repo-1',
+      {
+        checkRunId: 9,
+        workflowRunId: undefined,
+        checkName: undefined,
+        url: undefined,
+        prRepo: null
+      },
+      controller.signal
+    )
+  })
+
   it('fetches PR comments on the runtime server with explicit PR repo', async () => {
     const runtime = {
       getRuntimeId: () => 'test-runtime',
diff --git a/src/main/runtime/rpc/methods/github.ts b/src/main/runtime/rpc/methods/github.ts
index ed715e4e0e8..c9f8935b128 100644
--- a/src/main/runtime/rpc/methods/github.ts
+++ b/src/main/runtime/rpc/methods/github.ts
@@ -439,14 +439,18 @@ export const GITHUB_METHODS: RpcMethod[] = [
   defineMethod({
     name: 'github.prCheckDetails',
     params: PullRequestCheckDetails,
-    handler: async (params, { runtime }) =>
-      runtime.getRepoPRCheckDetails(params.repo, {
-        checkRunId: params.checkRunId,
-        workflowRunId: params.workflowRunId,
-        checkName: params.checkName,
-        url: params.url,
-        prRepo: params.prRepo ?? null
-      })
+    handler: async (params, { runtime, signal }) =>
+      runtime.getRepoPRCheckDetails(
+        params.repo,
+        {
+          checkRunId: params.checkRunId,
+          workflowRunId: params.workflowRunId,
+          checkName: params.checkName,
+          url: params.url,
+          prRepo: params.prRepo ?? null
+        },
+        signal
+      )
   }),
   defineMethod({
     name: 'github.rerunPRChecks',
diff --git a/src/main/runtime/rpc/methods/hosted-review.test.ts b/src/main/runtime/rpc/methods/hosted-review.test.ts
index 3d132e82e41..ba4b05790b7 100644
--- a/src/main/runtime/rpc/methods/hosted-review.test.ts
+++ b/src/main/runtime/rpc/methods/hosted-review.test.ts
@@ -162,4 +162,39 @@ describe('hosted review RPC methods', () => {
       result: { ok: true, number: 51 }
     })
   })
+
+  it('dispatches stacked creation through a distinct runtime method', async () => {
+    const runtime = {
+      getRuntimeId: () => 'test-runtime',
+      createStackedHostedReview: vi.fn().mockResolvedValue({
+        ok: true,
+        number: 52,
+        url: 'https://github.com/acme/orca/pull/52',
+        stackNumber: 60,
+        parentReview: { number: 51, url: 'https://github.com/acme/orca/pull/51' }
+      })
+    } as unknown as OrcaRuntimeService
+    const dispatcher = new RpcDispatcher({ runtime, methods: HOSTED_REVIEW_METHODS })
+
+    const response = await dispatcher.dispatch(
+      makeRequest('hostedReview.createStacked', {
+        repo: 'repo-1',
+        worktree: 'path:/worktrees/child',
+        provider: 'github',
+        base: 'stack/parent',
+        head: 'stack/child',
+        title: 'Child'
+      })
+    )
+
+    expect(runtime.createStackedHostedReview).toHaveBeenCalledWith({
+      repoSelector: 'repo-1',
+      worktreeSelector: 'path:/worktrees/child',
+      provider: 'github',
+      base: 'stack/parent',
+      head: 'stack/child',
+      title: 'Child'
+    })
+    expect(response).toMatchObject({ ok: true, result: { ok: true, stackNumber: 60 } })
+  })
 })
diff --git a/src/main/runtime/rpc/methods/hosted-review.ts b/src/main/runtime/rpc/methods/hosted-review.ts
index b658c4c74cb..0d48b02fb19 100644
--- a/src/main/runtime/rpc/methods/hosted-review.ts
+++ b/src/main/runtime/rpc/methods/hosted-review.ts
@@ -105,5 +105,21 @@ export const HOSTED_REVIEW_METHODS: RpcMethod[] = [
         draft: params.draft,
         useTemplate: params.useTemplate
       })
+  }),
+  defineMethod({
+    name: 'hostedReview.createStacked',
+    params: HostedReviewCreate,
+    handler: async (params, { runtime }) =>
+      runtime.createStackedHostedReview({
+        repoSelector: params.repo,
+        worktreeSelector: params.worktree,
+        provider: params.provider,
+        base: params.base,
+        head: params.head,
+        title: params.title,
+        body: params.body,
+        draft: params.draft,
+        useTemplate: params.useTemplate
+      })
   })
 ]
diff --git a/src/main/runtime/rpc/methods/linear-agent-access.test.ts b/src/main/runtime/rpc/methods/linear-agent-access.test.ts
index 945eadb20b8..56c32168460 100644
--- a/src/main/runtime/rpc/methods/linear-agent-access.test.ts
+++ b/src/main/runtime/rpc/methods/linear-agent-access.test.ts
@@ -355,7 +355,7 @@ type LinearUnconfirmedBuilder = {
     target: unknown,
     extra?: unknown
   ): Error & { data?: { cause?: string; nextSteps?: string[] } }
-  resolveLinearAgentState(input: string, states: unknown[]): unknown | null
+  resolveLinearAgentState(input: string, states: unknown[]): unknown
   linearCreatedIssueMatchesIntent(issue: unknown, intent: unknown): boolean
   linearSavedIssueMatchesIntent(issue: unknown, intent: unknown): boolean
   notifyLinearLinkedIssueUpdated(
@@ -372,13 +372,13 @@ type LinearRetryLookupTester = {
     parentId: string | null,
     workspaceId: string,
     required: boolean
-  ): Promise<unknown | null>
+  ): Promise<unknown>
   getMatchingLinearAttachmentWrite(
     writeId: string,
     issueId: string,
     workspaceId: string,
     required: boolean
-  ): Promise<unknown | null>
+  ): Promise<unknown>
   getMatchingLinearCreatedIssue(
     writeId: string,
     teamId: string,
@@ -386,7 +386,7 @@ type LinearRetryLookupTester = {
     workspaceId: string,
     required: boolean,
     intent?: unknown
-  ): Promise<unknown | null>
+  ): Promise<unknown>
   refetchLinearCommentAfterDuplicate(
     writeId: string,
     issueId: string,
diff --git a/src/main/runtime/rpc/methods/linear-agent-project-access.test.ts b/src/main/runtime/rpc/methods/linear-agent-project-access.test.ts
index cd51e8a0798..9e0f1568050 100644
--- a/src/main/runtime/rpc/methods/linear-agent-project-access.test.ts
+++ b/src/main/runtime/rpc/methods/linear-agent-project-access.test.ts
@@ -10,7 +10,7 @@ type LinearProjectResolverTester = {
     id: string
     name: string
   }>
-  readLinearProjectByIdForCreate(id: string, workspaceId: string): Promise<unknown | null>
+  readLinearProjectByIdForCreate(id: string, workspaceId: string): Promise<unknown>
   readLinearProjectsForCreate(query: string, workspaceId: string): Promise<unknown[]>
   readLinearProjectsByExactNameForCreate(name: string, workspaceId: string): Promise<unknown[]>
 }
diff --git a/src/main/runtime/rpc/methods/native-chat.ts b/src/main/runtime/rpc/methods/native-chat.ts
index 5a15b3a8d8f..3b8d42287de 100644
--- a/src/main/runtime/rpc/methods/native-chat.ts
+++ b/src/main/runtime/rpc/methods/native-chat.ts
@@ -138,7 +138,7 @@ function sanitizeToolInput(
   const result: Record<string, unknown> = {}
   let count = 0
   for (const key in value) {
-    if (!Object.prototype.hasOwnProperty.call(value, key)) {
+    if (!Object.hasOwn(value, key)) {
       continue
     }
     if (count >= MOBILE_TOOL_INPUT_ITEMS_CAP || budget.remaining <= 0) {
@@ -148,7 +148,7 @@ function sanitizeToolInput(
     let boundedKey = key.slice(0, Math.min(key.length, budget.remaining, 128))
     // Why: sibling keys sharing a >=128-char (or budget-truncated) prefix collapse
     // to the same bounded key; suffix collisions so neither field is silently lost.
-    if (Object.prototype.hasOwnProperty.call(result, boundedKey)) {
+    if (Object.hasOwn(result, boundedKey)) {
       boundedKey = `${boundedKey}~${count}`
     }
     budget.remaining -= boundedKey.length
diff --git a/src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts b/src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts
index 23a6dc0928f..561c35603f2 100644
--- a/src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts
@@ -4,6 +4,8 @@ import {
   ORCHESTRATION_CONTRACT_RUNTIME_CAPABILITY,
   ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION,
   ORCHESTRATION_FEDERATION_CONTROL_MAIL_RUNTIME_CAPABILITY,
+  ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION,
+  ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_RUNTIME_CAPABILITY,
   ORCHESTRATION_FEDERATION_RUNTIME_CAPABILITY
 } from '../../../../shared/protocol-version'
 import { orchestrationMigrationData } from '../../../../shared/orchestration-rpc-contract'
@@ -82,11 +84,16 @@ export async function startFederatedWorker(args: {
     capabilities: status.capabilities,
     serverName: server.name
   })
-  const federationProtocolVersion = status.capabilities?.includes(
+  const supportsControlMail = status.capabilities?.includes(
     ORCHESTRATION_FEDERATION_CONTROL_MAIL_RUNTIME_CAPABILITY
   )
-    ? ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION
-    : 1
+  const federationProtocolVersion =
+    supportsControlMail &&
+    status.capabilities?.includes(ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_RUNTIME_CAPABILITY)
+      ? ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION
+      : supportsControlMail
+        ? ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION
+        : 1
 
   const setupDecision = createsWorktree ? (params.setup ?? 'run') : 'not_applicable'
   const started = db.createStartingWorkerDispatch({
diff --git a/src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts b/src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts
new file mode 100644
index 00000000000..894462e5397
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts
@@ -0,0 +1,448 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  ORCHESTRATION_CONTRACT_VERSION,
+  ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_RUNTIME_CAPABILITY
+} from '../../../../shared/protocol-version'
+import type { RuntimeRpcResponse } from '../../../../shared/runtime-rpc-envelope'
+import { OrcaRuntimeService } from '../../orca-runtime'
+import { OrchestrationDb } from '../../orchestration/db'
+import type { OrchestrationEnvironmentTransport } from '../../orchestration/environment-transport'
+import { waitForFederatedLifecycleSettlement } from '../../orchestration/federation-lifecycle-settlement'
+import { RpcDispatcher } from '../dispatcher'
+import { ORCHESTRATION_METHODS } from './orchestration'
+import { createFederationWorkerStartRequest as startRequest } from './orchestration-federation-test-request'
+
+describe('orchestration federation lifecycle settlement', () => {
+  let homeDb: OrchestrationDb
+  let workerDb: OrchestrationDb
+  let homeRuntime: OrcaRuntimeService
+  let workerRuntime: OrcaRuntimeService
+  let homeDispatcher: RpcDispatcher
+  let workerDispatcher: RpcDispatcher
+  let workerCapabilities: string[]
+  let failNextAckBeforeDelivery: boolean
+
+  beforeEach(() => {
+    homeDb = new OrchestrationDb(':memory:')
+    workerDb = new OrchestrationDb(':memory:')
+    workerRuntime = new OrcaRuntimeService()
+    workerRuntime.setOrchestrationDb(workerDb)
+    workerDispatcher = new RpcDispatcher({ runtime: workerRuntime, methods: ORCHESTRATION_METHODS })
+    workerCapabilities = [...(workerRuntime.getStatus().capabilities ?? [])]
+    failNextAckBeforeDelivery = false
+    const transport: OrchestrationEnvironmentTransport = {
+      resolve: () => ({
+        environmentId: 'environment_windows',
+        name: 'windows',
+        peerFingerprint: 'windows_peer_fingerprint'
+      }),
+      call: async (_selector, method, params, _timeoutMs, envelope) => {
+        if (method === 'status.get') {
+          return {
+            id: 'status',
+            ok: true,
+            result: { ...workerRuntime.getStatus(), capabilities: workerCapabilities },
+            _meta: { runtimeId: workerRuntime.getRuntimeId() }
+          }
+        }
+        if (method === 'orchestration.federationAck' && failNextAckBeforeDelivery) {
+          failNextAckBeforeDelivery = false
+          throw new Error('connection lost before acknowledgment')
+        }
+        return (await workerDispatcher.dispatch({
+          id: `remote_${method}`,
+          authToken: 'run-home-device-token',
+          method,
+          params,
+          orchestrationContractVersion: envelope?.orchestrationContractVersion,
+          orchestrationRequestId: envelope?.orchestrationRequestId,
+          orchestrationCapability: envelope?.orchestrationCapability
+        })) as RuntimeRpcResponse<unknown>
+      }
+    }
+    homeRuntime = new OrcaRuntimeService(null, undefined, {
+      orchestrationEnvironmentTransport: transport
+    })
+    homeRuntime.setOrchestrationDb(homeDb)
+    homeDispatcher = new RpcDispatcher({ runtime: homeRuntime, methods: ORCHESTRATION_METHODS })
+    vi.spyOn(homeRuntime, 'getTerminalPaneKey').mockReturnValue(
+      'tab_coord:aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
+    )
+    configureWorkerRuntime()
+  })
+
+  afterEach(() => {
+    homeRuntime.stopOrchestrationFederationRelay()
+    homeDb.close()
+    workerDb.close()
+  })
+
+  function configureWorkerRuntime(): void {
+    vi.spyOn(workerRuntime, 'validateOrchestrationAgentLauncher').mockImplementation(() => {})
+    vi.spyOn(workerRuntime, 'showRepo').mockResolvedValue({
+      id: 'windows-repo',
+      kind: 'git'
+    } as never)
+    vi.spyOn(workerRuntime, 'createManagedWorktree').mockResolvedValue({
+      worktree: { id: 'repo::windows-worktree', repoId: 'repo' },
+      startupTerminal: { spawned: true, handle: 'term_windows_worker' },
+      setupReceipt: {
+        requested: 'run',
+        hookFound: true,
+        startupPolicy: 'start-immediately',
+        state: 'running'
+      }
+    } as never)
+    vi.spyOn(workerRuntime, 'listTerminals').mockResolvedValue({
+      terminals: [{ handle: 'term_windows_worker', title: 'Codex' }],
+      totalCount: 1,
+      truncated: false
+    } as never)
+    vi.spyOn(workerRuntime, 'waitForTerminal').mockResolvedValue({
+      handle: 'term_windows_worker',
+      condition: 'tui-idle',
+      satisfied: true,
+      status: 'running',
+      exitCode: null
+    })
+    vi.spyOn(workerRuntime, 'getTerminalPaneKey').mockReturnValue(
+      'tab_worker:bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
+    )
+    vi.spyOn(workerRuntime, 'getTerminalProcessIncarnation').mockReturnValue(
+      'windows_runtime:pty:1'
+    )
+    vi.spyOn(workerRuntime, 'getTerminalOrchestrationCliCommand').mockReturnValue('orca')
+    vi.spyOn(workerRuntime, 'sendTerminalAgentPrompt').mockResolvedValue({
+      handle: 'term_windows_worker',
+      accepted: true,
+      bytesWritten: 1
+    })
+  }
+
+  function createHomeTask() {
+    const run = homeDb.createRun({
+      objective: 'Mac to Windows',
+      coordinatorHandle: 'term_coord',
+      coordinatorPaneKey: 'tab_coord:aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
+    })
+    return homeDb.createTask({ spec: 'Audit Windows behavior', runId: run.id })
+  }
+
+  async function sendRemoteCompletion(taskId: string, reportedTaskId: string, sync = true) {
+    await homeDispatcher.dispatch(startRequest(taskId))
+    homeRuntime.stopOrchestrationFederationRelay()
+    const dispatch = homeDb.getDispatchContext(taskId)!
+    const prompt = vi.mocked(workerRuntime.sendTerminalAgentPrompt).mock.calls[0]?.[1] ?? ''
+    const capability = prompt.match(/--dispatch-capability (dcap_[A-Za-z0-9_-]+)/)?.[1]
+    const sent = workerDispatcher.dispatch({
+      id: 'rpc_waiting_worker_done',
+      authToken: 'worker-local-token',
+      orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+      orchestrationRequestId: 'waiting_worker_done_request',
+      orchestrationCapability: capability,
+      method: 'orchestration.send',
+      params: {
+        from: 'term_windows_worker',
+        subject: 'Done',
+        type: 'worker_done',
+        payload: JSON.stringify({
+          taskId: reportedTaskId,
+          dispatchId: dispatch.id,
+          outcome: 'succeeded'
+        })
+      }
+    })
+    await vi.waitFor(() =>
+      expect(workerDb.listPendingFederationRelay(dispatch.id, 'to_home')).toHaveLength(1)
+    )
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)?.state).toBe('ready')
+    if (sync) {
+      await homeRuntime.syncOrchestrationFederation()
+    }
+    return { sent, dispatch }
+  }
+
+  it('waits for Run-home settlement when an older CLI omits the wait hint', async () => {
+    const task = createHomeTask()
+
+    const { sent, dispatch } = await sendRemoteCompletion(task.id, task.id)
+
+    await expect(sent).resolves.toMatchObject({
+      ok: true,
+      result: { lifecycle: { action: 'completed', authority: 'run_home' } }
+    })
+    expect(homeDb.getTask(task.id)?.status).toBe('completed')
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)).toMatchObject({
+      state: 'succeeded',
+      stage: 'worker_report_settled',
+      capability_hash: null
+    })
+  })
+
+  it('returns a Run-home rejection for a mismatched remote task', async () => {
+    const task = createHomeTask()
+
+    const { sent } = await sendRemoteCompletion(task.id, 'task_wrong')
+
+    await expect(sent).resolves.toMatchObject({
+      ok: true,
+      result: {
+        lifecycle: {
+          action: 'rejected',
+          code: 'task_dispatch_mismatch',
+          authority: 'run_home'
+        }
+      }
+    })
+    expect(homeDb.getTask(task.id)?.status).toBe('dispatched')
+  })
+
+  it('rejects before queueing when the negotiated protocol lacks settlement verdicts', async () => {
+    workerCapabilities = workerCapabilities.filter(
+      (capability) =>
+        capability !== ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_RUNTIME_CAPABILITY
+    )
+    const task = createHomeTask()
+
+    await homeDispatcher.dispatch(startRequest(task.id))
+    homeRuntime.stopOrchestrationFederationRelay()
+    const dispatch = homeDb.getDispatchContext(task.id)!
+    const prompt = vi.mocked(workerRuntime.sendTerminalAgentPrompt).mock.calls[0]?.[1] ?? ''
+    const capability = prompt.match(/--dispatch-capability (dcap_[A-Za-z0-9_-]+)/)?.[1]
+
+    await expect(
+      workerDispatcher.dispatch({
+        id: 'rpc_unsupported_worker_done',
+        authToken: 'worker-local-token',
+        orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+        orchestrationRequestId: 'unsupported_worker_done_request',
+        orchestrationCapability: capability,
+        method: 'orchestration.send',
+        params: {
+          from: 'term_windows_worker',
+          subject: 'Done',
+          type: 'worker_done',
+          payload: JSON.stringify({
+            taskId: task.id,
+            dispatchId: dispatch.id,
+            outcome: 'succeeded'
+          })
+        }
+      })
+    ).resolves.toMatchObject({
+      ok: false,
+      error: { code: 'capability_unsupported' }
+    })
+    expect(workerDb.listPendingFederationRelay(dispatch.id, 'to_home')).toEqual([])
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)?.protocol_version).toBe(2)
+  })
+
+  it('does not settle an attachment from a verdict for non-lifecycle mail', async () => {
+    const task = createHomeTask()
+    await homeDispatcher.dispatch(startRequest(task.id))
+    homeRuntime.stopOrchestrationFederationRelay()
+    const dispatch = homeDb.getDispatchContext(task.id)!
+    const relay = workerDb.enqueueFederationRelay({
+      dispatchId: dispatch.id,
+      direction: 'to_home',
+      kind: 'status',
+      payload: '{}'
+    })
+
+    await expect(
+      workerDispatcher.dispatch({
+        id: 'rpc_unrelated_settlement',
+        authToken: 'run-home-device-token',
+        orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+        orchestrationRequestId: 'unrelated_settlement_request',
+        method: 'orchestration.federationAck',
+        params: {
+          dispatchId: dispatch.id,
+          throughSequence: relay.sequence,
+          settlements: [
+            {
+              sequence: relay.sequence,
+              lifecycle: { action: 'completed', authority: 'run_home' }
+            }
+          ]
+        }
+      })
+    ).resolves.toMatchObject({ ok: false, error: { code: 'request_mismatch' } })
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)?.state).toBe('ready')
+    expect(workerDb.listPendingFederationRelay(dispatch.id, 'to_home')).toHaveLength(1)
+  })
+
+  it('does not settle an attachment from a verdict that contradicts the queued outcome', async () => {
+    const task = createHomeTask()
+    await homeDispatcher.dispatch(startRequest(task.id))
+    homeRuntime.stopOrchestrationFederationRelay()
+    const dispatch = homeDb.getDispatchContext(task.id)!
+    const relay = workerDb.enqueueFederationRelay({
+      dispatchId: dispatch.id,
+      direction: 'to_home',
+      kind: 'worker_done',
+      payload: JSON.stringify({
+        payload: JSON.stringify({
+          taskId: task.id,
+          dispatchId: dispatch.id,
+          outcome: 'failed'
+        })
+      })
+    })
+
+    await expect(
+      workerDispatcher.dispatch({
+        id: 'rpc_contradictory_settlement',
+        authToken: 'run-home-device-token',
+        orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+        orchestrationRequestId: 'contradictory_settlement_request',
+        method: 'orchestration.federationAck',
+        params: {
+          dispatchId: dispatch.id,
+          throughSequence: relay.sequence,
+          settlements: [
+            {
+              sequence: relay.sequence,
+              lifecycle: { action: 'completed', authority: 'run_home' }
+            }
+          ]
+        }
+      })
+    ).resolves.toMatchObject({ ok: false, error: { code: 'request_mismatch' } })
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)?.state).toBe('ready')
+    expect(workerDb.listPendingFederationRelay(dispatch.id, 'to_home')).toHaveLength(1)
+  })
+
+  it('returns operation_unknown when Run-home settlement waiting is aborted', async () => {
+    const task = createHomeTask()
+    await homeDispatcher.dispatch(startRequest(task.id))
+    homeRuntime.stopOrchestrationFederationRelay()
+    const dispatch = homeDb.getDispatchContext(task.id)!
+    const prompt = vi.mocked(workerRuntime.sendTerminalAgentPrompt).mock.calls[0]?.[1] ?? ''
+    const capability = prompt.match(/--dispatch-capability (dcap_[A-Za-z0-9_-]+)/)?.[1]
+    const controller = new AbortController()
+    const sent = workerDispatcher.dispatch(
+      {
+        id: 'rpc_aborted_worker_done',
+        authToken: 'worker-local-token',
+        orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+        orchestrationRequestId: 'aborted_worker_done_request',
+        orchestrationCapability: capability,
+        method: 'orchestration.send',
+        params: {
+          from: 'term_windows_worker',
+          subject: 'Done',
+          type: 'worker_done',
+          payload: JSON.stringify({
+            taskId: task.id,
+            dispatchId: dispatch.id,
+            outcome: 'succeeded'
+          })
+        }
+      },
+      { signal: controller.signal }
+    )
+    await vi.waitFor(() =>
+      expect(workerDb.listPendingFederationRelay(dispatch.id, 'to_home')).toHaveLength(1)
+    )
+
+    controller.abort()
+
+    await expect(sent).resolves.toMatchObject({
+      ok: false,
+      error: { code: 'operation_unknown' }
+    })
+  })
+
+  it('does not register a waiter for an already-aborted signal', async () => {
+    const controller = new AbortController()
+    controller.abort()
+    const addEventListener = vi.spyOn(controller.signal, 'addEventListener')
+
+    await expect(
+      waitForFederatedLifecycleSettlement(workerRuntime, 'ctx_aborted', 1, {
+        timeoutMs: 0,
+        signal: controller.signal
+      })
+    ).resolves.toBeUndefined()
+    expect(addEventListener).not.toHaveBeenCalled()
+  })
+
+  it('replays a committed settlement after the first acknowledgment is lost', async () => {
+    const task = createHomeTask()
+    await homeDispatcher.dispatch(startRequest(task.id))
+    homeRuntime.stopOrchestrationFederationRelay()
+    const dispatch = homeDb.getDispatchContext(task.id)!
+    const prompt = vi.mocked(workerRuntime.sendTerminalAgentPrompt).mock.calls[0]?.[1] ?? ''
+    const capability = prompt.match(/--dispatch-capability (dcap_[A-Za-z0-9_-]+)/)?.[1]
+    const sent = workerDispatcher.dispatch({
+      id: 'rpc_replayed_worker_done',
+      authToken: 'worker-local-token',
+      orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+      orchestrationRequestId: 'replayed_worker_done_request',
+      orchestrationCapability: capability,
+      method: 'orchestration.send',
+      params: {
+        from: 'term_windows_worker',
+        subject: 'Done',
+        type: 'worker_done',
+        waitForLifecycleSettlement: true,
+        payload: JSON.stringify({
+          taskId: task.id,
+          dispatchId: dispatch.id,
+          outcome: 'succeeded'
+        })
+      }
+    })
+    await vi.waitFor(() =>
+      expect(workerDb.listPendingFederationRelay(dispatch.id, 'to_home')).toHaveLength(1)
+    )
+    failNextAckBeforeDelivery = true
+
+    await expect(homeRuntime.syncOrchestrationFederatedDispatch(dispatch.id)).rejects.toThrow(
+      'connection lost before acknowledgment'
+    )
+    expect(homeDb.getTask(task.id)?.status).toBe('completed')
+    await homeRuntime.syncOrchestrationFederatedDispatch(dispatch.id)
+
+    await expect(sent).resolves.toMatchObject({
+      ok: true,
+      result: { lifecycle: { action: 'completed', authority: 'run_home' } }
+    })
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)).toMatchObject({
+      state: 'succeeded',
+      stage: 'worker_report_settled',
+      capability_hash: null
+    })
+  })
+
+  it('replays a rejection without mutating its durable message twice', async () => {
+    const task = createHomeTask()
+    const { sent, dispatch } = await sendRemoteCompletion(task.id, 'task_wrong', false)
+    failNextAckBeforeDelivery = true
+
+    await expect(homeRuntime.syncOrchestrationFederatedDispatch(dispatch.id)).rejects.toThrow(
+      'connection lost before acknowledgment'
+    )
+    const [relay] = workerDb.listPendingFederationRelay(dispatch.id, 'to_home')
+    const firstMessage = homeDb.getMessageById(relay.message_id)
+    await homeRuntime.syncOrchestrationFederatedDispatch(dispatch.id)
+
+    await expect(sent).resolves.toMatchObject({
+      ok: true,
+      result: {
+        lifecycle: {
+          action: 'rejected',
+          code: 'task_dispatch_mismatch',
+          authority: 'run_home'
+        }
+      }
+    })
+    expect(homeDb.getMessageById(relay.message_id)).toMatchObject({
+      subject: firstMessage?.subject,
+      body: firstMessage?.body,
+      payload: firstMessage?.payload
+    })
+    expect(workerDb.getRemoteDispatchAttachment(dispatch.id)?.state).toBe('ready')
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration-federation-relay.ts b/src/main/runtime/rpc/methods/orchestration-federation-relay.ts
index fbc3e97fb3b..848b711b851 100644
--- a/src/main/runtime/rpc/methods/orchestration-federation-relay.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federation-relay.ts
@@ -2,18 +2,42 @@ import { z } from 'zod'
 import { ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION } from '../../../../shared/protocol-version'
 import { importFederatedControlMessage } from '../../orchestration/federation-control-message'
 import { OrchestrationError } from '../../orchestration/orchestration-error'
+import {
+  publishFederatedLifecycleSettlement,
+  type FederatedLifecycleSettlement
+} from '../../orchestration/federation-lifecycle-settlement'
 import { defineMethod, type RpcMethod } from '../core'
 import { OptionalFiniteNumber, requiredString } from '../schemas'
 
 const FederationPullParams = z.object({
   dispatchId: requiredString('Missing Dispatch ID'),
   afterSequence: OptionalFiniteNumber,
+  replayUnacknowledged: z.boolean().optional(),
   limit: OptionalFiniteNumber
 })
 
 const FederationAckParams = z.object({
   dispatchId: requiredString('Missing Dispatch ID'),
-  throughSequence: z.number().int().nonnegative()
+  throughSequence: z.number().int().nonnegative(),
+  settlements: z
+    .array(
+      z.object({
+        sequence: z.number().int().positive(),
+        lifecycle: z.discriminatedUnion('action', [
+          z.object({
+            action: z.enum(['completed', 'failed']),
+            authority: z.literal('run_home')
+          }),
+          z.object({
+            action: z.literal('rejected'),
+            code: z.string(),
+            reason: z.string(),
+            authority: z.literal('run_home')
+          })
+        ])
+      })
+    )
+    .optional()
 })
 
 const FederationImportParams = z.object({
@@ -39,12 +63,16 @@ export const ORCHESTRATION_FEDERATION_RELAY_METHODS: RpcMethod[] = [
       return {
         dispatchId: params.dispatchId,
         runtimeEpoch: runtime.getRuntimeId(),
-        items: runtime.getOrchestrationDb().listFederationRelay({
-          dispatchId: params.dispatchId,
-          direction: 'to_home',
-          afterSequence: params.afterSequence ?? 0,
-          limit: params.limit
-        })
+        items: params.replayUnacknowledged
+          ? runtime
+              .getOrchestrationDb()
+              .listPendingFederationRelay(params.dispatchId, 'to_home', params.limit)
+          : runtime.getOrchestrationDb().listFederationRelay({
+              dispatchId: params.dispatchId,
+              direction: 'to_home',
+              afterSequence: params.afterSequence ?? 0,
+              limit: params.limit
+            })
       }
     }
   }),
@@ -53,11 +81,42 @@ export const ORCHESTRATION_FEDERATION_RELAY_METHODS: RpcMethod[] = [
     params: FederationAckParams,
     handler: (params, { runtime, authenticatedCallerFingerprint }) => {
       requireHomeAttachment(runtime, params.dispatchId, authenticatedCallerFingerprint)
+      const settlements = (params.settlements ?? []).filter(
+        (settlement) => settlement.sequence <= params.throughSequence
+      )
+      const terminalSettlements = settlements.filter(
+        (settlement) =>
+          settlement.lifecycle.action === 'completed' || settlement.lifecycle.action === 'failed'
+      )
+      if (terminalSettlements.length > 1) {
+        throw new OrchestrationError(
+          'request_mismatch',
+          `Federation acknowledgment for ${params.dispatchId} contains conflicting settlements.`
+        )
+      }
+      const terminalSettlement = terminalSettlements[0]
       runtime.getOrchestrationDb().acknowledgeFederationRelay({
         dispatchId: params.dispatchId,
         direction: 'to_home',
-        throughSequence: params.throughSequence
+        throughSequence: params.throughSequence,
+        ...(!terminalSettlement
+          ? {}
+          : {
+              settleRemoteReport: {
+                sequence: terminalSettlement.sequence,
+                outcome:
+                  terminalSettlement.lifecycle.action === 'completed' ? 'succeeded' : 'failed'
+              }
+            })
       })
+      for (const settlement of settlements) {
+        publishFederatedLifecycleSettlement(
+          runtime,
+          params.dispatchId,
+          settlement.sequence,
+          settlement.lifecycle as FederatedLifecycleSettlement
+        )
+      }
       return { dispatchId: params.dispatchId, acknowledgedThrough: params.throughSequence }
     }
   }),
diff --git a/src/main/runtime/rpc/methods/orchestration-federation-start-schema.ts b/src/main/runtime/rpc/methods/orchestration-federation-start-schema.ts
index e6bea35c20a..9c03345ef88 100644
--- a/src/main/runtime/rpc/methods/orchestration-federation-start-schema.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federation-start-schema.ts
@@ -6,7 +6,7 @@ export const FederationAttachStartParams = z.object({
   dispatchId: requiredString('Missing Dispatch ID'),
   taskId: requiredString('Missing Task ID'),
   taskSpec: requiredString('Missing Task spec'),
-  protocolVersion: z.union([z.literal(1), z.literal(2)]),
+  protocolVersion: z.union([z.literal(1), z.literal(2), z.literal(3)]),
   worktree: requiredString('Missing remote worktree selector'),
   name: OptionalString,
   repo: OptionalString,
diff --git a/src/main/runtime/rpc/methods/orchestration-federation.test.ts b/src/main/runtime/rpc/methods/orchestration-federation.test.ts
index e797a09c256..ca850587ff0 100644
--- a/src/main/runtime/rpc/methods/orchestration-federation.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federation.test.ts
@@ -194,7 +194,7 @@ describe('orchestration federation', () => {
     const attachment = workerDb.getRemoteDispatchAttachment(dispatch.id)
     expect(attachment).toMatchObject({
       task_id: task.id,
-      protocol_version: 2,
+      protocol_version: 3,
       state: 'ready',
       worktree_id: 'repo::windows-worktree',
       terminal_handle: 'term_windows_worker'
@@ -356,11 +356,8 @@ describe('orchestration federation', () => {
         })
       }
     })
-    expect(sent).toMatchObject({
-      ok: true,
-      result: { relay: { dispatchId: dispatch.id, accepted: true } }
-    })
-    expect(homeDb.getTask(task.id)?.status).toBe('dispatched')
+    expect(sent).toMatchObject({ ok: true, result: { lifecycle: { action: 'completed' } } })
+    expect(homeDb.getTask(task.id)?.status).toBe('completed')
 
     await homeRuntime.syncOrchestrationFederation()
 
@@ -508,7 +505,7 @@ describe('orchestration federation', () => {
   it('retries a lost relay acknowledgment without duplicating the home message', async () => {
     const task = createHomeTask()
     await homeDispatcher.dispatch(startRequest(task.id))
-    const dispatch = homeDb.getDispatchContext(task.id)!
+    homeRuntime.stopOrchestrationFederationRelay()
     const prompt = vi.mocked(workerRuntime.sendTerminalAgentPrompt).mock.calls[0]?.[1] ?? ''
     const capability = prompt.match(/--dispatch-capability (dcap_[A-Za-z0-9_-]+)/)?.[1]
     await workerDispatcher.dispatch({
@@ -526,6 +523,7 @@ describe('orchestration federation', () => {
       }
     })
     loseNextAckResponse = true
+    const remoteCall = vi.spyOn(homeRuntime, 'callOrchestrationWorkerServer')
 
     await expect(homeRuntime.syncOrchestrationFederation()).resolves.toBeUndefined()
     await homeRuntime.syncOrchestrationFederation()
@@ -535,7 +533,10 @@ describe('orchestration federation', () => {
         .getRunMailboxHistory(task.run_id, 10)
         .filter((message) => message.subject === 'Checkpoint')
     ).toHaveLength(1)
-    expect(homeDb.getFederatedDispatch(dispatch.id)?.to_home_imported_sequence).toBe(1)
+    const acknowledgments = remoteCall.mock.calls.filter(
+      ([, method]) => method === 'orchestration.federationAck'
+    )
+    expect(acknowledgments).toHaveLength(2)
   })
 
   it('rejects a reordered relay gap, then converges without loss or duplication', async () => {
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-control.ts b/src/main/runtime/rpc/methods/orchestration-worker-control.ts
index 5798806d899..87133ede7b2 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-control.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-control.ts
@@ -4,7 +4,6 @@ import {
   type OrchestrationWorkerReadResult
 } from '../../../../shared/orchestration-worker-output'
 import { OrchestrationError } from '../../orchestration/orchestration-error'
-import { syncFederatedDispatch } from '../../orchestration/federation-sync'
 import { defineMethod, type RpcMethod } from '../core'
 import { OptionalFiniteNumber, requiredString } from '../schemas'
 import {
@@ -54,7 +53,9 @@ export const ORCHESTRATION_WORKER_CONTROL_METHODS: RpcMethod[] = [
           attachment.state === 'succeeded' ||
           (attachment.state === 'failed' && attachment.stage === 'worker_report_queued')
         ) {
-          await syncFederatedDispatch(runtime, params.dispatch).catch(() => undefined)
+          await runtime
+            .syncOrchestrationFederatedDispatchAfterCurrent(params.dispatch)
+            .catch(() => undefined)
         } else if (
           attachment.state === 'stopped' &&
           ['stopping', 'stop_unknown'].includes(worker.state)
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-release.test.ts b/src/main/runtime/rpc/methods/orchestration-worker-release.test.ts
index 25670dda1e7..d2c17db9ba0 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-release.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-release.test.ts
@@ -21,6 +21,7 @@ describe('orchestration worker release', () => {
   let runtime: OrcaRuntimeService
   let ctx: RpcContext
   let activeRunId: string
+  let inspectProcessLiveness: ReturnType<typeof vi.fn>
 
   const coordinatorPaneKey = 'tab_coord:aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
   const workerPaneKey = 'tab_worker:bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
@@ -30,6 +31,12 @@ describe('orchestration worker release', () => {
     dbOpen = true
     runtime = new OrcaRuntimeService()
     runtime.setOrchestrationDb(db)
+    inspectProcessLiveness = vi.fn().mockResolvedValue('live')
+    ;(
+      runtime as unknown as {
+        inspectTerminalProcessIncarnationLiveness: typeof inspectProcessLiveness
+      }
+    ).inspectTerminalProcessIncarnationLiveness = inspectProcessLiveness
     vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) =>
       handle === 'term_coord'
         ? coordinatorPaneKey
@@ -215,7 +222,7 @@ describe('orchestration worker release', () => {
     setup()
     const { dispatchId } = await startWorker()
     await expect(call('orchestration.workerRelease', { dispatch: dispatchId })).rejects.toThrow(
-      /only a succeeded or failed worker can release/
+      /only a settled worker can release/
     )
     expect(runtime.closeTerminal).not.toHaveBeenCalled()
     expect(db.getWorkerTerminalResourceByOwner(dispatchId)?.release_state).toBe('not_requested')
@@ -232,6 +239,44 @@ describe('orchestration worker release', () => {
     expect(runtime.closeTerminal).not.toHaveBeenCalled()
   })
 
+  it('reconciles a dead external terminal without closing a process', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker('succeeded', { terminal: 'term_worker' })
+    inspectProcessLiveness.mockResolvedValue('dead')
+
+    await expect(
+      call('orchestration.workerRelease', { dispatch: dispatchId })
+    ).resolves.toMatchObject({ state: 'released', processAction: 'none' })
+    expect(inspectProcessLiveness).toHaveBeenCalledWith(
+      'runtime_test:term_worker:1',
+      JSON.stringify({ kind: 'local', hostId: 'local' })
+    )
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released'
+    })
+  })
+
+  it('retains dead inventory evidence when persisted ownership history is invalid', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker('succeeded', { terminal: 'term_worker' })
+    const resource = db.getWorkerTerminalResourceByOwner(dispatchId)
+    const raw = (
+      db as unknown as { db: { prepare: (sql: string) => { run: (...args: unknown[]) => void } } }
+    ).db
+    raw
+      .prepare('UPDATE worker_terminal_resources SET prior_owner_dispatch_ids = ? WHERE id = ?')
+      .run('{invalid', resource?.id)
+    inspectProcessLiveness.mockResolvedValue('dead')
+
+    await expect(
+      call('orchestration.workerRelease', { dispatch: dispatchId })
+    ).resolves.toMatchObject({ state: 'retained', processAction: 'none' })
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)?.release_state).not.toBe('released')
+  })
+
   it('retains a user-taken-over terminal durably', async () => {
     setup()
     const { dispatchId } = await startSettledWorker()
@@ -248,6 +293,50 @@ describe('orchestration worker release', () => {
     expect(db.getWorkerTerminalResourceByOwner(dispatchId)?.ownership_state).toBe('user_owned')
   })
 
+  it('reconciles a dead user-taken-over terminal without closing a process', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    await call('orchestration.workerTerminalUserInput', { paneKey: workerPaneKey })
+    inspectProcessLiveness.mockResolvedValue('dead')
+
+    await expect(
+      call('orchestration.workerRelease', { dispatch: dispatchId })
+    ).resolves.toMatchObject({ state: 'released', processAction: 'none' })
+    expect(inspectProcessLiveness).toHaveBeenCalledWith(
+      'runtime_test:term_worker:1',
+      JSON.stringify({ kind: 'local', hostId: 'local' })
+    )
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released'
+    })
+  })
+
+  it.each(['stopped', 'abandoned'] as const)(
+    'reconciles a dead %s worker without closing a process',
+    async (state) => {
+      setup()
+      const { dispatchId } = await startWorker()
+      if (state === 'stopped') {
+        db.beginWorkerStop(dispatchId)
+        db.settleWorkerStop(dispatchId)
+      } else {
+        db.abandonWorkerDispatch(dispatchId)
+      }
+      inspectProcessLiveness.mockResolvedValue('dead')
+
+      await expect(
+        call('orchestration.workerRelease', { dispatch: dispatchId })
+      ).resolves.toMatchObject({ state: 'released', processAction: 'none' })
+      expect(runtime.closeTerminal).not.toHaveBeenCalled()
+      expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+        ownership_state: 'released',
+        release_state: 'released'
+      })
+    }
+  )
+
   it('lets user takeover cancel a release while output capture is pending', async () => {
     setup()
     const { dispatchId } = await startSettledWorker()
@@ -617,6 +706,7 @@ describe('orchestration worker release', () => {
     expect(transferred?.terminal_handle).toBe('term_reminted')
     expect(db.getWorkerTerminalResourceByOwner(first.dispatchId)).toBeUndefined()
 
+    inspectProcessLiveness.mockResolvedValueOnce('dead')
     const oldRelease = (await call('orchestration.workerRelease', {
       dispatch: first.dispatchId
     })) as { state: string; reason?: string }
@@ -632,6 +722,27 @@ describe('orchestration worker release', () => {
     expect(runtime.closeTerminal).toHaveBeenCalledWith('term_reminted')
   })
 
+  it('reconciles dead transferred ownership after the current owner settles', async () => {
+    setup()
+    const first = await startSettledWorker('succeeded')
+    const second = await startWorker({ terminal: 'term_reminted' })
+    settle(second.taskId, second.dispatchId, 'succeeded')
+    inspectProcessLiveness.mockResolvedValue('dead')
+
+    await expect(
+      call('orchestration.workerRelease', { dispatch: first.dispatchId })
+    ).resolves.toMatchObject({ state: 'released', processAction: 'none' })
+    expect(inspectProcessLiveness).toHaveBeenCalledWith(
+      'runtime_test:term_worker:1',
+      JSON.stringify({ kind: 'local', hostId: 'local' })
+    )
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(second.dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released'
+    })
+  })
+
   it('rejects exact reuse after release intent instead of closing the new worker', async () => {
     setup()
     const first = await startSettledWorker('succeeded')
@@ -744,9 +855,14 @@ describe('orchestration worker release', () => {
     expect(listed.workers).toContainEqual(
       expect.objectContaining({ dispatchId, terminalState: 'retained' })
     )
-    await expect(call('orchestration.workerRelease', { dispatch: dispatchId })).rejects.toThrow(
-      /only a succeeded or failed worker can release/
-    )
+    await expect(
+      call('orchestration.workerRelease', { dispatch: dispatchId })
+    ).resolves.toMatchObject({
+      state: 'retained',
+      reason: 'identity_unproven',
+      processAction: 'none'
+    })
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
   })
 
   it('worker-show exposes the terminal resource', async () => {
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-release.ts b/src/main/runtime/rpc/methods/orchestration-worker-release.ts
index f01cd72de47..446887f581a 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-release.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-release.ts
@@ -54,12 +54,36 @@ export const ORCHESTRATION_WORKER_RELEASE_METHODS: RpcMethod[] = [
         }
       }
       if (requested.disposition === 'retained') {
+        const resource = requested.resource
+        const processIncarnation = resource?.process_incarnation
+        if (
+          processIncarnation &&
+          (await runtime.inspectTerminalProcessIncarnationLiveness(
+            processIncarnation,
+            resource.host_scope
+          )) === 'dead'
+        ) {
+          const reconciled = db.settleDeadWorkerTerminalRelease({
+            requestingDispatchId: params.dispatch,
+            resourceId: resource.id,
+            processIncarnation
+          })
+          if (reconciled.disposition === 'released') {
+            runtime.notifyMessageArrived(`dispatch:${params.dispatch}`, 'status')
+            return {
+              dispatchId: params.dispatch,
+              state: 'released',
+              processAction: 'none',
+              archive: archiveSummary(reconciled.resource)
+            }
+          }
+        }
         return {
           dispatchId: params.dispatch,
           state: 'retained',
           reason: requested.reason,
           processAction: 'none',
-          archive: archiveSummary(requested.resource)
+          archive: archiveSummary(resource)
         }
       }
       return completeWorkerTerminalRelease({
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-stop.ts b/src/main/runtime/rpc/methods/orchestration-worker-stop.ts
index f393e65012a..0802fac3954 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-stop.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-stop.ts
@@ -1,6 +1,5 @@
 import { z } from 'zod'
 import { OrchestrationError } from '../../orchestration/orchestration-error'
-import { syncFederatedDispatch } from '../../orchestration/federation-sync'
 import { defineMethod, type RpcMethod } from '../core'
 import { requiredString } from '../schemas'
 import {
@@ -49,7 +48,9 @@ export const ORCHESTRATION_WORKER_STOP_METHODS: RpcMethod[] = [
           }
           if (remote.state === 'succeeded' || remote.state === 'failed') {
             db.resumeFederatedWorkerForTerminalRelay(params.dispatch)
-            await syncFederatedDispatch(runtime, params.dispatch).catch(() => undefined)
+            await runtime
+              .syncOrchestrationFederatedDispatchAfterCurrent(params.dispatch)
+              .catch(() => undefined)
             return {
               dispatchId: params.dispatch,
               state: db.getWorkerDispatch(params.dispatch)?.state ?? remote.state,
diff --git a/src/main/runtime/rpc/methods/orchestration.test.ts b/src/main/runtime/rpc/methods/orchestration.test.ts
index d9d91237d08..f95b20a8b05 100644
--- a/src/main/runtime/rpc/methods/orchestration.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration.test.ts
@@ -415,7 +415,7 @@ describe('orchestration RPC methods', () => {
       )
       vi.spyOn(runtime, 'deliverPendingMessagesForHandle').mockImplementation(() => {})
 
-      await call('orchestration.send', {
+      const result = await call('orchestration.send', {
         from: 'term_worker',
         to: 'term_coord',
         subject: 'Done',
@@ -429,6 +429,7 @@ describe('orchestration RPC methods', () => {
 
       expect(db.getTask(task.id)?.status).toBe('completed')
       expect(db.getDispatchContextById(dispatch.id)?.status).toBe('completed')
+      expect(result).toMatchObject({ lifecycle: { action: 'completed' } })
     })
 
     it('rejects an identity-less lifecycle send resolved through the coordinator handle', async () => {
@@ -482,7 +483,7 @@ describe('orchestration RPC methods', () => {
       }
 
       expect(db.getTask(task.id)?.status).toBe('completed')
-      expect(result.lifecycle).toBeUndefined()
+      expect(result.lifecycle).toMatchObject({ action: 'completed' })
       expect(result.message).toMatchObject({
         type: 'worker_done',
         subject: 'Done'
@@ -1788,11 +1789,14 @@ describe('orchestration RPC methods', () => {
       })
     })
 
-    it('rejects invalid deps JSON', async () => {
+    it('rejects non-JSON deps', async () => {
       setup()
       await expect(
         call('orchestration.taskCreate', { spec: 'bad', deps: 'not-json' })
       ).rejects.toThrow('Invalid --deps')
+      await expect(
+        call('orchestration.taskCreate', { spec: 'bad', deps: '[task_example]' })
+      ).rejects.toThrow('Invalid --deps')
     })
   })
 
@@ -3075,9 +3079,11 @@ describe('orchestration RPC methods', () => {
     it('resets all state', async () => {
       setup()
       seedResetState()
+      const stopRelay = vi.spyOn(runtime, 'stopOrchestrationFederationRelay')
 
       const result = (await call('orchestration.reset', { all: true })) as { reset: string }
       expect(result.reset).toBe('all')
+      expect(stopRelay).toHaveBeenCalledOnce()
       expect(db.getInbox()).toHaveLength(0)
       expect(db.listTasks()).toHaveLength(0)
     })
@@ -3085,8 +3091,10 @@ describe('orchestration RPC methods', () => {
     it('resets tasks only', async () => {
       setup()
       seedResetState()
+      const stopRelay = vi.spyOn(runtime, 'stopOrchestrationFederationRelay')
 
       await call('orchestration.reset', { tasks: true })
+      expect(stopRelay).toHaveBeenCalledOnce()
       expect(db.getInbox()).toHaveLength(1)
       expect(db.listTasks()).toHaveLength(0)
     })
@@ -3094,8 +3102,10 @@ describe('orchestration RPC methods', () => {
     it('resets messages only', async () => {
       setup()
       seedResetState()
+      const stopRelay = vi.spyOn(runtime, 'stopOrchestrationFederationRelay')
 
       await call('orchestration.reset', { messages: true })
+      expect(stopRelay).not.toHaveBeenCalled()
       expect(db.getInbox()).toHaveLength(0)
       expect(db.listTasks()).toHaveLength(1)
     })
diff --git a/src/main/runtime/rpc/methods/orchestration.ts b/src/main/runtime/rpc/methods/orchestration.ts
index 22518b3717b..f3dee4d2171 100644
--- a/src/main/runtime/rpc/methods/orchestration.ts
+++ b/src/main/runtime/rpc/methods/orchestration.ts
@@ -13,6 +13,7 @@ import { buildDispatchPreamble } from '../../orchestration/preamble'
 import { formatMessageBanner } from '../../orchestration/formatter'
 import { isGroupAddress, resolveGroupAddress } from '../../orchestration/groups'
 import { reconcileLifecycleMessage } from '../../orchestration/lifecycle-reconciliation'
+import { waitForFederatedLifecycleSettlement } from '../../orchestration/federation-lifecycle-settlement'
 import { abbreviateOrchestrationTasks } from '../../../../shared/orchestration-task-summary'
 import {
   ORCHESTRATION_LEGACY_RUN_ID,
@@ -28,7 +29,10 @@ import { OrchestrationError } from '../../orchestration/orchestration-error'
 import type { OrcaRuntimeService } from '../../orca-runtime'
 import type { RunRow } from '../../orchestration/types'
 import { encodeFederatedControlMessage } from '../../orchestration/federation-control-message'
-import { ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION } from '../../../../shared/protocol-version'
+import {
+  ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION,
+  ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION
+} from '../../../../shared/protocol-version'
 
 const TASK_STATUSES: TaskStatus[] = [
   'pending',
@@ -86,6 +90,7 @@ const SendParams = z
     // Why: pane key is the remint-stable identity used to verify worker_done/heartbeat ownership; the from handle stays routing metadata.
     senderPaneKey: OptionalString,
     run: OptionalString,
+    waitForLifecycleSettlement: OptionalBoolean,
     devMode: OptionalBoolean
   })
   .superRefine((params, ctx) => {
@@ -392,7 +397,8 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [
         orchestrationCapability,
         legacyCoordinatorRunId,
         revalidateLegacyCoordinator,
-        orchestrationCompatibilityCallerAuthority
+        orchestrationCompatibilityCallerAuthority,
+        signal
       }
     ) => {
       const db = runtime.getOrchestrationDb()
@@ -445,6 +451,16 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [
             'Remote worker_done requires outcome=succeeded|failed.'
           )
         }
+        if (
+          outcome &&
+          remoteAttachment.protocol_version <
+            ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION
+        ) {
+          throw new OrchestrationError(
+            'capability_unsupported',
+            'The Run-home runtime cannot confirm worker_done settlement. Update it before retrying; no report was queued.'
+          )
+        }
         const relay = db.enqueueFederationRelay({
           dispatchId: remoteAttachment.dispatch_id,
           direction: 'to_home',
@@ -457,9 +473,20 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [
             priority: params.priority ?? 'normal',
             threadId: params.threadId ?? null,
             payload: params.payload ?? null
-          }),
-          settleRemoteOutcome: outcome
+          })
         })
+        const lifecycle = outcome
+          ? await waitForFederatedLifecycleSettlement(runtime, relay.dispatch_id, relay.sequence, {
+              timeoutMs: 30_000,
+              signal
+            })
+          : undefined
+        if (outcome && !lifecycle) {
+          throw new OrchestrationError(
+            'operation_unknown',
+            'worker_done was queued, but the Run-home runtime did not confirm settlement. Verify the Task and Dispatch before retrying.'
+          )
+        }
         return {
           relay: {
             messageId: relay.message_id,
@@ -468,9 +495,7 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [
             destination: 'run_home',
             accepted: true
           },
-          ...(outcome
-            ? { lifecycle: { action: outcome === 'succeeded' ? 'completed' : 'failed' } }
-            : {})
+          ...(lifecycle ? { lifecycle } : {})
         }
       }
       const routing = resolveMessageRun(runtime, {
@@ -628,6 +653,10 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [
             runtime.notifyMessageArrived(to, rejection.type)
             return { message: rejection, lifecycle: reconciled }
           }
+          runtime.notifyMessageArrived(to, msg.type)
+          return msg.type === 'worker_done'
+            ? { message: msg, lifecycle: reconciled }
+            : { message: msg }
         }
         runtime.notifyMessageArrived(to, msg.type)
         return { message: msg }
@@ -1527,10 +1556,12 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [
     handler: (params, { runtime }) => {
       const db = runtime.getOrchestrationDb()
       if (params.all) {
+        runtime.stopOrchestrationFederationRelay()
         db.resetAll()
         return { reset: 'all' }
       }
       if (params.tasks) {
+        runtime.stopOrchestrationFederationRelay()
         db.resetTasks()
         return { reset: 'tasks' }
       }
diff --git a/src/main/runtime/rpc/methods/repo.test.ts b/src/main/runtime/rpc/methods/repo.test.ts
index df5bbff67b8..09991c4103e 100644
--- a/src/main/runtime/rpc/methods/repo.test.ts
+++ b/src/main/runtime/rpc/methods/repo.test.ts
@@ -440,7 +440,8 @@ describe('repo RPC methods', () => {
     expect(runtime.listFolderWorkspaces).toHaveBeenCalled()
     expect(runtime.createFolderWorkspace).toHaveBeenCalledWith({
       projectGroupId: group.id,
-      name: 'Refund fix'
+      name: 'Refund fix',
+      creatorProvenance: { kind: 'host' }
     })
     expect(runtime.updateFolderWorkspace).toHaveBeenCalledWith('folder-workspace-1', {
       comment: 'x'
diff --git a/src/main/runtime/rpc/methods/status.ts b/src/main/runtime/rpc/methods/status.ts
index fe9cb78ce45..03d66f84fb1 100644
--- a/src/main/runtime/rpc/methods/status.ts
+++ b/src/main/runtime/rpc/methods/status.ts
@@ -5,10 +5,11 @@ export const STATUS_METHODS: RpcMethod[] = [
   defineMethod({
     name: 'status.get',
     params: null,
-    handler: (_params, { runtime }) => {
+    handler: (_params, { runtime, pairedDeviceId }) => {
       const snapshot = getRemoteServerUpdaterSnapshot(runtime.getRuntimeId())
       return {
         ...runtime.getStatus(),
+        ...(pairedDeviceId ? { pairedDeviceId } : {}),
         appVersion: snapshot.appVersion,
         remoteUpdateSupport: snapshot.support
       }
diff --git a/src/main/runtime/rpc/methods/terminal.ts b/src/main/runtime/rpc/methods/terminal.ts
index 1cdec021e55..69f4eb72190 100644
--- a/src/main/runtime/rpc/methods/terminal.ts
+++ b/src/main/runtime/rpc/methods/terminal.ts
@@ -99,6 +99,8 @@ type SnapshotFrameOptions = {
   source?: 'headless' | 'renderer'
   oscLinks?: TerminalOscLinkRange[]
   pendingEscapeTailAnsi?: string
+  /** Effective kitty flags proven at this frame's own `seq`. */
+  kittyKeyboardFlags?: number
 }
 
 type SerializedSnapshot = {
@@ -113,6 +115,7 @@ type SerializedSnapshot = {
   scrollbackRows: number
   truncatedByByteBudget: boolean
   pendingEscapeTailAnsi?: string
+  kittyKeyboardFlags?: number
 } | null
 
 type TerminalViewportClient = {
@@ -648,6 +651,15 @@ function sendSnapshotFrames(
         source: options.source,
         oscLinks: options.oscLinks,
         pendingEscapeTailAnsi: options.pendingEscapeTailAnsi,
+        // Why conditional and additive: old clients ignore the unknown field,
+        // and a new client must read absence as unknown rather than zero, so
+        // no opcode or capability negotiation is involved (Rule 1 of
+        // docs/reference/remote-wire-compatibility.md).
+        // Why `seq` is required: the flags are only proven at this frame's own
+        // seq, so without a replay boundary the client cannot order them.
+        ...(typeof options.seq === 'number' && options.kittyKeyboardFlags !== undefined
+          ? { kittyKeyboardFlags: options.kittyKeyboardFlags }
+          : {}),
         truncated: options.truncated === true,
         truncatedByByteBudget: options.truncatedByByteBudget === true
       })
@@ -1840,6 +1852,7 @@ export const TERMINAL_METHODS: RpcAnyMethod[] = [
               reason: 'ack-pending-overflow',
               seq: serialized.seq,
               source: serialized.source,
+              kittyKeyboardFlags: serialized.kittyKeyboardFlags,
               truncatedByByteBudget: serialized.truncatedByByteBudget,
               data: serialized.data
             }
@@ -2327,6 +2340,7 @@ export const TERMINAL_METHODS: RpcAnyMethod[] = [
             seq: serialized?.seq,
             cwd: serialized?.cwd,
             source: serialized?.source,
+            kittyKeyboardFlags: serialized?.kittyKeyboardFlags,
             oscLinks: serialized?.oscLinks,
             pendingEscapeTailAnsi: serialized?.pendingEscapeTailAnsi,
             truncated: false,
@@ -2669,6 +2683,7 @@ export const TERMINAL_METHODS: RpcAnyMethod[] = [
               truncated: initialOutputOverflowed,
               truncatedByByteBudget: serialized?.truncatedByByteBudget,
               source: serialized?.source,
+              kittyKeyboardFlags: serialized?.kittyKeyboardFlags,
               oscLinks: serialized?.oscLinks,
               pendingEscapeTailAnsi: serialized?.pendingEscapeTailAnsi,
               data:
diff --git a/src/main/runtime/rpc/methods/worktree-schemas.test.ts b/src/main/runtime/rpc/methods/worktree-schemas.test.ts
index e1eb22f2c52..5737e2c4c8d 100644
--- a/src/main/runtime/rpc/methods/worktree-schemas.test.ts
+++ b/src/main/runtime/rpc/methods/worktree-schemas.test.ts
@@ -109,14 +109,14 @@ describe('worktree RPC schemas', () => {
     const parsed = WorktreeSet.parse({ worktree: 'id:r1::/repos/wt', displayName: '' })
 
     expect(parsed.displayName).toBe('')
-    expect(Object.prototype.hasOwnProperty.call(parsed, 'displayName')).toBe(true)
+    expect(Object.hasOwn(parsed, 'displayName')).toBe(true)
   })
 
   it('still omits a display name that was never sent', () => {
     const parsed = WorktreeSet.parse({ worktree: 'id:r1::/repos/wt', comment: 'note' })
 
     expect(parsed.displayName).toBeUndefined()
-    expect(Object.prototype.hasOwnProperty.call(parsed, 'displayName')).toBe(false)
+    expect(Object.hasOwn(parsed, 'displayName')).toBe(false)
   })
 
   it('ignores a non-string display name rather than persisting it', () => {
diff --git a/src/main/runtime/rpc/methods/worktree-schemas.ts b/src/main/runtime/rpc/methods/worktree-schemas.ts
index 57b8a9202a5..a3e562e8516 100644
--- a/src/main/runtime/rpc/methods/worktree-schemas.ts
+++ b/src/main/runtime/rpc/methods/worktree-schemas.ts
@@ -275,6 +275,7 @@ export const WorktreeSet = WorktreeSelector.extend({
 })
 
 export const WorktreeRemove = WorktreeSelector.extend({
+  hostId: OptionalString,
   force: OptionalBoolean,
   // Why (#11960): the CLI's --force is an unambiguous force affordance, but the
   // desktop sets `force` for an ordinary confirmed delete too, so the PTY-stop
@@ -284,6 +285,7 @@ export const WorktreeRemove = WorktreeSelector.extend({
 })
 
 export const WorktreeForceDeleteBranch = WorktreeSelector.extend({
+  hostId: OptionalString,
   branchName: z
     .unknown()
     .transform((v) => (typeof v === 'string' ? v : ''))
diff --git a/src/main/runtime/rpc/methods/worktree.test.ts b/src/main/runtime/rpc/methods/worktree.test.ts
index 3fe4b5da15c..0b5be4da384 100644
--- a/src/main/runtime/rpc/methods/worktree.test.ts
+++ b/src/main/runtime/rpc/methods/worktree.test.ts
@@ -155,6 +155,7 @@ describe('worktree RPC methods', () => {
       setupDecision: 'skip',
       createdWithAgent: undefined,
       automationProvenance: undefined,
+      creatorProvenance: { kind: 'host' },
       startup: undefined,
       startupDraft: undefined,
       lineage: {
diff --git a/src/main/runtime/rpc/methods/worktree.ts b/src/main/runtime/rpc/methods/worktree.ts
index 758e6b83891..3d2a05b523f 100644
--- a/src/main/runtime/rpc/methods/worktree.ts
+++ b/src/main/runtime/rpc/methods/worktree.ts
@@ -7,6 +7,7 @@ import { buildCliWorkspaceProvenance } from '../../../../shared/cli-workspace-pr
 import { defineMethod, type RpcMethod } from '../core'
 import { resolveWorktreeCatalogSnapshot } from '../worktree-catalog-snapshot'
 import { resolveRuntimeNavigationTarget } from '../../../../shared/runtime-navigation'
+import { resolveRpcWorkspaceCreatorProvenance } from '../workspace-creator-context'
 import {
   WorktreeCreate,
   WorktreeDetectedListParams,
@@ -96,11 +97,12 @@ export const WORKTREE_METHODS: RpcMethod[] = [
   defineMethod({
     name: 'worktree.create',
     params: WorktreeCreate,
-    handler: async (params, { runtime }) =>
+    handler: async (params, context) =>
       // Why: a mobile create interrupted by a connection migration is retried with
       // the same clientMutationId; dedupe so the host returns the in-flight/created
       // worktree instead of spawning a duplicate. No key (desktop/CLI) runs plainly.
-      runtime.dedupeWorktreeCreate(params.repo, params.clientMutationId, async () => {
+      context.runtime.dedupeWorktreeCreate(params.repo, params.clientMutationId, async () => {
+        const { runtime } = context
         const repo = await runtime.showRepo(params.repo)
         const automationProvenance = resolveAutomationWorkspaceProvenance({
           authority: runtime,
@@ -145,6 +147,7 @@ export const WORKTREE_METHODS: RpcMethod[] = [
               startupAgent: params.startupAgent ?? params.createdWithAgent,
               createdAt: Date.now()
             }),
+            creatorProvenance: resolveRpcWorkspaceCreatorProvenance(context),
             startup: params.startupCommand
               ? {
                   command: params.startupCommand,
@@ -271,12 +274,15 @@ export const WORKTREE_METHODS: RpcMethod[] = [
     name: 'worktree.rm',
     params: WorktreeRemove,
     handler: async (params, { runtime }) => {
-      const result = await runtime.removeManagedWorktree(
+      const removalArgs = [
         params.worktree,
         params.force === true,
         params.runHooks === true,
         params.allowUnverifiedPtyStop === true
-      )
+      ] as const
+      const result = params.hostId
+        ? await runtime.removeManagedWorktree(...removalArgs, params.hostId)
+        : await runtime.removeManagedWorktree(...removalArgs)
       return { removed: true, ...result }
     }
   }),
@@ -284,6 +290,17 @@ export const WORKTREE_METHODS: RpcMethod[] = [
     name: 'worktree.forceDeleteBranch',
     params: WorktreeForceDeleteBranch,
     handler: async (params, { runtime }) =>
-      runtime.forceDeletePreservedBranch(params.worktree, params.branchName, params.expectedHead)
+      params.hostId
+        ? runtime.forceDeletePreservedBranch(
+            params.worktree,
+            params.branchName,
+            params.expectedHead,
+            params.hostId
+          )
+        : runtime.forceDeletePreservedBranch(
+            params.worktree,
+            params.branchName,
+            params.expectedHead
+          )
   })
 ]
diff --git a/src/main/runtime/rpc/orchestration-legacy-compatibility.ts b/src/main/runtime/rpc/orchestration-legacy-compatibility.ts
index 291d35b895f..31d3b5b1952 100644
--- a/src/main/runtime/rpc/orchestration-legacy-compatibility.ts
+++ b/src/main/runtime/rpc/orchestration-legacy-compatibility.ts
@@ -206,7 +206,7 @@ export class OrchestrationLegacyCompatibility {
     request: RpcRequest,
     params: unknown,
     signal?: AbortSignal
-  ): Promise<unknown | undefined> {
+  ): Promise<unknown> {
     if (request.method === 'orchestration.send') {
       return await handleLegacyLifecycleSend({
         runtime: this.runtime,
diff --git a/src/main/runtime/rpc/orchestration-legacy-lifecycle.ts b/src/main/runtime/rpc/orchestration-legacy-lifecycle.ts
index 9ffe17cca6e..7e76128bd19 100644
--- a/src/main/runtime/rpc/orchestration-legacy-lifecycle.ts
+++ b/src/main/runtime/rpc/orchestration-legacy-lifecycle.ts
@@ -17,7 +17,7 @@ export async function handleLegacyLifecycleSend(args: {
   authority: LegacyCompatibilityAuthority
   request: RpcRequest
   params: LegacySendParams
-}): Promise<unknown | undefined> {
+}): Promise<unknown> {
   const { runtime, authority, request, params } = args
   if (!['heartbeat', 'worker_done', 'escalation'].includes(params.type ?? '')) {
     return undefined
diff --git a/src/main/runtime/rpc/orchestration-legacy-mail.ts b/src/main/runtime/rpc/orchestration-legacy-mail.ts
index e41e0c11509..c83d7ffdf2f 100644
--- a/src/main/runtime/rpc/orchestration-legacy-mail.ts
+++ b/src/main/runtime/rpc/orchestration-legacy-mail.ts
@@ -20,7 +20,7 @@ export async function handleLegacyCheck(args: {
   request: RpcRequest
   params: LegacyCheckParams
   signal?: AbortSignal
-}): Promise<unknown | undefined> {
+}): Promise<unknown> {
   const { runtime, authority, request, params, signal } = args
   if (params.run) {
     return undefined
@@ -138,7 +138,7 @@ export async function handleLegacyReply(args: {
   authority: LegacyCompatibilityAuthority
   request: RpcRequest
   params: LegacyReplyParams
-}): Promise<unknown | undefined> {
+}): Promise<unknown> {
   const { runtime, authority, request, params } = args
   const db = runtime.getOrchestrationDb()
   const original = db.getMessageById(params.id)
diff --git a/src/main/runtime/rpc/orchestration-legacy-question.ts b/src/main/runtime/rpc/orchestration-legacy-question.ts
index 69dec720a3a..cd463155619 100644
--- a/src/main/runtime/rpc/orchestration-legacy-question.ts
+++ b/src/main/runtime/rpc/orchestration-legacy-question.ts
@@ -17,7 +17,7 @@ export async function handleLegacyAsk(args: {
   request: RpcRequest
   params: LegacyAskParams
   signal?: AbortSignal
-}): Promise<unknown | undefined> {
+}): Promise<unknown> {
   const { runtime, authority, request, params, signal } = args
   const dispatch = authority.resolveAskDispatch(request, params)
   if (!dispatch || dispatch.contract_version !== LEGACY_CONTRACT_VERSION) {
diff --git a/src/main/runtime/rpc/orchestration-mutation-executor.ts b/src/main/runtime/rpc/orchestration-mutation-executor.ts
index 2334cd709eb..701970eb58c 100644
--- a/src/main/runtime/rpc/orchestration-mutation-executor.ts
+++ b/src/main/runtime/rpc/orchestration-mutation-executor.ts
@@ -22,7 +22,7 @@ export class OrchestrationMutationExecutor {
   async run(
     request: RpcRequest,
     params: unknown,
-    invoke: (mutation?: DurableMutationInvocation) => Promise<unknown> | unknown,
+    invoke: (mutation?: DurableMutationInvocation) => unknown,
     callerFingerprintOverride?: string
   ): Promise<unknown> {
     const requestId = request.orchestrationRequestId
diff --git a/src/main/runtime/rpc/orchestration-mutation-ledger.test.ts b/src/main/runtime/rpc/orchestration-mutation-ledger.test.ts
index 4062dacf9a1..a9cbfbc5ab7 100644
--- a/src/main/runtime/rpc/orchestration-mutation-ledger.test.ts
+++ b/src/main/runtime/rpc/orchestration-mutation-ledger.test.ts
@@ -38,7 +38,7 @@ describe('durable orchestration mutation ledger', () => {
     }
   })
 
-  function createHarness(dbPath: string | ':memory:' = ':memory:') {
+  function createHarness(dbPath: (string & {}) | ':memory:' = ':memory:') {
     const db = new OrchestrationDb(dbPath)
     const runtime = new OrcaRuntimeService()
     runtime.setOrchestrationDb(db)
diff --git a/src/main/runtime/rpc/terminal-opencode-send-guard.integration.test.ts b/src/main/runtime/rpc/terminal-opencode-send-guard.integration.test.ts
new file mode 100644
index 00000000000..2671449b606
--- /dev/null
+++ b/src/main/runtime/rpc/terminal-opencode-send-guard.integration.test.ts
@@ -0,0 +1,71 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from '../orca-runtime'
+import { RpcDispatcher } from './dispatcher'
+import type { RpcRequest } from './core'
+import { TERMINAL_METHODS } from './methods/terminal'
+
+function request(method: string, params: unknown): RpcRequest {
+  return { id: 'request-1', authToken: 'test-token', method, params }
+}
+
+describe('OpenCode guarded terminal send', () => {
+  afterEach(() => vi.useRealTimers())
+
+  it('refuses a marker title left on a shell without writing notes', async () => {
+    vi.useFakeTimers()
+    const write = vi.fn(() => true)
+    const runtime = new OrcaRuntimeService()
+    runtime.setPtyController({
+      write,
+      kill: () => true,
+      getForegroundProcess: async () => 'zsh'
+    })
+    runtime.attachWindow(1)
+    runtime.syncWindowGraph(1, {
+      tabs: [
+        {
+          tabId: 'tab-1',
+          worktreeId: 'repo-1::/tmp/worktree',
+          title: 'OC | zsh',
+          activeLeafId: 'pane-1',
+          layout: null
+        }
+      ],
+      leaves: [
+        {
+          tabId: 'tab-1',
+          worktreeId: 'repo-1::/tmp/worktree',
+          leafId: 'pane-1',
+          paneRuntimeId: 1,
+          ptyId: 'pty-1',
+          paneTitle: 'OC | zsh'
+        }
+      ]
+    })
+    const [terminal] = (await runtime.listTerminals()).terminals
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+
+    await expect(
+      dispatcher.dispatch(request('terminal.agentStatus', { terminal: terminal.handle }))
+    ).resolves.toMatchObject({
+      ok: true,
+      result: { agentStatus: { isRunningAgent: false, status: null } }
+    })
+
+    const send = dispatcher.dispatch(
+      request('terminal.send', {
+        terminal: terminal.handle,
+        text: '$(touch should-not-run)',
+        requireAgentStatus: 'sendable',
+        client: { id: 'desktop-1', type: 'desktop' }
+      })
+    )
+    await vi.advanceTimersByTimeAsync(1_500)
+
+    await expect(send).resolves.toMatchObject({
+      ok: true,
+      result: { send: { accepted: false, bytesWritten: 0, refusedReason: 'no-agent' } }
+    })
+    expect(write).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/rpc/terminal-stream-byte-length.test.ts b/src/main/runtime/rpc/terminal-stream-byte-length.test.ts
index bf07fe38fc8..60c4c86fe44 100644
--- a/src/main/runtime/rpc/terminal-stream-byte-length.test.ts
+++ b/src/main/runtime/rpc/terminal-stream-byte-length.test.ts
@@ -7,9 +7,24 @@ import {
 } from './terminal-stream-byte-length'
 import { TERMINAL_OUTPUT_BATCH_MAX_BYTES } from '../../../shared/terminal-multiplex-flow-control'
 
-// Byte-for-byte copy of the pre-change implementation (shared/clipboard-text.ts
+// Copy of the pre-change implementation (shared/clipboard-text.ts
 // measureClipboardTextByteLength), kept here so equivalence is checked against the
-// ACTUAL old code path rather than a paraphrase of it.
+// ACTUAL old code path rather than a paraphrase of it. The one deliberate deviation is
+// `legacyCodePointAt`: raw `String.prototype.codePointAt` reads one code unit past the end
+// of a sliced string once V8 optimizes its caller, so the naive copy is not a stable
+// reference. See src/shared/utf8-byte-limits.ts (readUtf8CodePointAt).
+function legacyCodePointAt(text: string, index: number): number {
+  const leadUnit = text.charCodeAt(index)
+  if (leadUnit < 0xd800 || leadUnit > 0xdbff || index + 1 >= text.length) {
+    return leadUnit
+  }
+  const trailUnit = text.charCodeAt(index + 1)
+  if (trailUnit < 0xdc00 || trailUnit > 0xdfff) {
+    return leadUnit
+  }
+  return (leadUnit - 0xd800) * 0x400 + (trailUnit - 0xdc00) + 0x10000
+}
+
 function legacyUtf8ByteLengthForCodePoint(codePoint: number): number {
   if (codePoint <= 0x7f) {
     return 1
@@ -30,7 +45,7 @@ function legacyMeasure(
   const stopAfterBytes = options.stopAfterBytes
   let byteLength = 0
   for (let index = 0; index < text.length; index += 1) {
-    const codePoint = text.codePointAt(index) ?? 0
+    const codePoint = legacyCodePointAt(text, index)
     byteLength += legacyUtf8ByteLengthForCodePoint(codePoint)
     if (Number.isFinite(stopAfterBytes) && byteLength > (stopAfterBytes ?? 0)) {
       return { byteLength, exceededLimit: true }
@@ -128,6 +143,39 @@ const EDGE_STRINGS = [
   `${'é'.repeat(500)}\ud800`
 ]
 
+// Regression for the intermittent "measurement diverged at 13 units" failure: the fuzzers
+// build a rope and cut it at a fixed code-unit count, which can split a surrogate pair and
+// leave the low half in the parent just past the slice. Optimized `codePointAt` pairs across
+// that boundary, so the scan measured one byte too many, but only after the enclosing function
+// tiered up, which made the failure look load-dependent. 13 code units is V8's minimum length
+// for a sliced string, which is why the divergence started exactly there.
+describe('measuring a prefix slice that cuts a surrogate pair in half', () => {
+  // Kept first in the file so the scan is still specializing on this shape when it tiers up.
+  it('measures the slice like the encoder does in every JIT tier', () => {
+    const sliced = 'abcdefghijkl\u{1f600}'.slice(0, 13)
+    expect(sliced.length).toBe(13)
+    expect(sliced.charCodeAt(12)).toBe(0xd83d)
+    // 12 ASCII bytes plus U+FFFD for the orphaned high surrogate.
+    expect(Buffer.byteLength(sliced, 'utf8')).toBe(15)
+
+    const observedByteLengths = new Set<number>()
+    const observedExceeded = new Set<boolean>()
+    const observedMeasurements = new Set<string>()
+    for (let iteration = 0; iteration < 200_000; iteration += 1) {
+      observedByteLengths.add(terminalStreamByteLength(sliced))
+      observedExceeded.add(terminalStreamByteLengthExceeds(sliced, 15))
+      observedMeasurements.add(
+        JSON.stringify(measureTerminalStreamByteLength(sliced, { stopAfterBytes: 15 }))
+      )
+    }
+    expect([...observedByteLengths]).toEqual([15])
+    expect([...observedExceeded]).toEqual([false])
+    expect([...observedMeasurements]).toEqual([
+      JSON.stringify({ byteLength: 15, exceededLimit: false })
+    ])
+  })
+})
+
 describe('terminal stream byte length equivalence with the legacy code-point scan', () => {
   it('matches the legacy total byte length on edge strings', () => {
     for (const text of EDGE_STRINGS) {
diff --git a/src/main/runtime/rpc/workspace-creator-context.ts b/src/main/runtime/rpc/workspace-creator-context.ts
new file mode 100644
index 00000000000..de0b27965fd
--- /dev/null
+++ b/src/main/runtime/rpc/workspace-creator-context.ts
@@ -0,0 +1,14 @@
+import type { WorkspaceCreatorProvenance } from '../../../shared/types'
+import type { RpcContext } from './core'
+
+export function resolveRpcWorkspaceCreatorProvenance(
+  context: Pick<RpcContext, 'pairedDeviceId' | 'clientId' | 'clientKind' | 'connectionId'>
+): WorkspaceCreatorProvenance {
+  if (context.pairedDeviceId) {
+    return { kind: 'paired-device', deviceId: context.pairedDeviceId }
+  }
+  if (context.clientId || context.clientKind || context.connectionId) {
+    throw new Error('authenticated_device_identity_missing')
+  }
+  return { kind: 'host' }
+}
diff --git a/src/main/runtime/runtime-folder-workspace.ts b/src/main/runtime/runtime-folder-workspace.ts
index ba17a7e03e1..fcbbacbd51d 100644
--- a/src/main/runtime/runtime-folder-workspace.ts
+++ b/src/main/runtime/runtime-folder-workspace.ts
@@ -1,6 +1,7 @@
 import { DEFAULT_WORKSPACE_STATUS_ID } from '../../shared/workspace-statuses'
 import type { Repo, Worktree, WorktreeMeta } from '../../shared/types'
 import { FOLDER_WORKSPACE_INSTANCE_SEPARATOR } from '../../shared/worktree-id'
+import { normalizeWorkspaceCreatorProvenance } from '../../shared/workspace-creator-provenance'
 
 export function getRuntimeFolderWorkspaceRootId(repo: Repo): string {
   return `${repo.id}::${repo.path}`
@@ -23,6 +24,7 @@ export function mergeRuntimeFolderWorkspace(
   worktreeId: string,
   meta: WorktreeMeta
 ): Worktree {
+  const creatorProvenance = normalizeWorkspaceCreatorProvenance(meta.creatorProvenance)
   return {
     id: worktreeId,
     ...(meta.instanceId !== undefined ? { instanceId: meta.instanceId } : {}),
@@ -32,6 +34,7 @@ export function mergeRuntimeFolderWorkspace(
     ...(meta.projectHostSetupId !== undefined
       ? { projectHostSetupId: meta.projectHostSetupId }
       : {}),
+    ...(creatorProvenance ? { creatorProvenance } : {}),
     path: repo.path,
     head: '',
     branch: '',
diff --git a/src/main/runtime/runtime-rpc.test.ts b/src/main/runtime/runtime-rpc.test.ts
index 2df636da4c0..5ccffe24550 100644
--- a/src/main/runtime/runtime-rpc.test.ts
+++ b/src/main/runtime/runtime-rpc.test.ts
@@ -6026,7 +6026,7 @@ describe('OrcaRuntimeRpcServer WebSocket bind host (STA-2370)', () => {
     const wideStartGate = new Promise<void>((resolve) => {
       releaseWideStart = resolve
     })
-    let wideStopSpy: ReturnType<typeof vi.spyOn> | null = null
+    let wideStopSpy: ReturnType<typeof vi.spyOn> = null
     vi.spyOn(target, 'startWebSocketTransport').mockImplementation(async (opts) => {
       if (opts.host === '0.0.0.0') {
         // Why: hold the widen mid-flight (loopback already stopped) so stop() must race the rebind.
diff --git a/src/main/runtime/runtime-rpc.ts b/src/main/runtime/runtime-rpc.ts
index f4d5006303a..326801c6fa9 100644
--- a/src/main/runtime/runtime-rpc.ts
+++ b/src/main/runtime/runtime-rpc.ts
@@ -316,6 +316,7 @@ const MOBILE_RPC_METHOD_ALLOWLIST = new Set([
   'host.wsl.isAvailable',
   'host.wsl.listDistros',
   'hostedReview.create',
+  'hostedReview.createStacked',
   'hostedReview.forBranch',
   'hostedReview.getCreationEligibility',
   'linear.getCustomView',
@@ -715,6 +716,7 @@ export class OrcaRuntimeRpcServer {
       endpoint,
       deviceToken: device.token,
       publicKeyB64,
+      pairedDeviceId: device.deviceId,
       scope
     })
     return {
@@ -927,6 +929,7 @@ export class OrcaRuntimeRpcServer {
         endpoint: direct.endpoint,
         deviceToken: device.token,
         publicKeyB64,
+        pairedDeviceId: device.deviceId,
         scope: 'mobile',
         relay: relayPairing.relay
       })
@@ -1406,7 +1409,7 @@ export class OrcaRuntimeRpcServer {
     // never orphan a running 0.0.0.0 listener outside activeTransports (and thus outside stop()).
     this.activeTransports[index] = widened.transport
     const metaIndex = this.transports.findIndex((meta) => meta.kind === 'websocket')
-    if (metaIndex >= 0) {
+    if (metaIndex !== -1) {
       this.transports[metaIndex] = { kind: 'websocket', endpoint: widened.endpoint }
     }
     try {
@@ -1448,7 +1451,7 @@ export class OrcaRuntimeRpcServer {
       )
       this.activeTransports.splice(index, 1)
       const metaIndex = this.transports.findIndex((meta) => meta.kind === 'websocket')
-      if (metaIndex >= 0) {
+      if (metaIndex !== -1) {
         this.transports.splice(metaIndex, 1)
       }
       this.wsBoundHost = null
@@ -1463,7 +1466,7 @@ export class OrcaRuntimeRpcServer {
     // orphan a live transport outside activeTransports (and thus outside stop()).
     this.activeTransports[index] = restored.transport
     const metaIndex = this.transports.findIndex((meta) => meta.kind === 'websocket')
-    if (metaIndex >= 0) {
+    if (metaIndex !== -1) {
       this.transports[metaIndex] = { kind: 'websocket', endpoint: restored.endpoint }
     }
     try {
diff --git a/src/main/runtime/windows-firewall-remote-scope.ts b/src/main/runtime/windows-firewall-remote-scope.ts
index 9845413d079..6968435a8aa 100644
--- a/src/main/runtime/windows-firewall-remote-scope.ts
+++ b/src/main/runtime/windows-firewall-remote-scope.ts
@@ -109,7 +109,7 @@ function maskPrefixLength(maskText: string, version: IpVersion): number | null {
 function parseIpRange(scope: string): IpRange | null {
   const trimmed = scope.trim()
   const dashIndex = trimmed.indexOf('-')
-  if (dashIndex >= 0) {
+  if (dashIndex !== -1) {
     if (dashIndex !== trimmed.lastIndexOf('-')) {
       return null
     }
@@ -122,7 +122,7 @@ function parseIpRange(scope: string): IpRange | null {
   }
 
   const slashIndex = trimmed.indexOf('/')
-  if (slashIndex >= 0) {
+  if (slashIndex !== -1) {
     if (slashIndex !== trimmed.lastIndexOf('/')) {
       return null
     }
@@ -195,7 +195,7 @@ function expandEmbeddedIpv4(address: string): string | null {
   }
   const lastColon = address.lastIndexOf(':')
   const ipv4 = parseIpv4(address.slice(lastColon + 1))
-  if (lastColon < 0 || !ipv4) {
+  if (lastColon === -1 || !ipv4) {
     return null
   }
   const high = ((ipv4.value >> 16n) & 0xffffn).toString(16)
diff --git a/src/main/runtime/workspace-session-failed-write-rollback.ts b/src/main/runtime/workspace-session-failed-write-rollback.ts
new file mode 100644
index 00000000000..f770511bb27
--- /dev/null
+++ b/src/main/runtime/workspace-session-failed-write-rollback.ts
@@ -0,0 +1,62 @@
+import { isDeepStrictEqual } from 'node:util'
+import type { WorkspaceSessionState } from '../../shared/types'
+
+const MISSING = Symbol('missing')
+type RollbackValue = unknown
+
+function isRecord(value: RollbackValue): value is Record<string, unknown> {
+  return (
+    value !== MISSING &&
+    typeof value === 'object' &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.getPrototypeOf(value) === Object.prototype
+  )
+}
+
+function rollbackValue(
+  original: RollbackValue,
+  staged: RollbackValue,
+  current: RollbackValue
+): RollbackValue {
+  if (isDeepStrictEqual(original, staged)) {
+    return current
+  }
+  if (isDeepStrictEqual(current, staged)) {
+    return original
+  }
+  if (!isRecord(original) || !isRecord(staged) || !isRecord(current)) {
+    return current
+  }
+  let changed = false
+  const next: Record<string, unknown> = { ...current }
+  for (const key of new Set([
+    ...Object.keys(original),
+    ...Object.keys(staged),
+    ...Object.keys(current)
+  ])) {
+    const value = rollbackValue(
+      Object.hasOwn(original, key) ? original[key] : MISSING,
+      Object.hasOwn(staged, key) ? staged[key] : MISSING,
+      Object.hasOwn(current, key) ? current[key] : MISSING
+    )
+    if (value === MISSING) {
+      if (Object.hasOwn(next, key)) {
+        delete next[key]
+        changed = true
+      }
+    } else if (!Object.hasOwn(current, key) || !isDeepStrictEqual(current[key], value)) {
+      next[key] = value
+      changed = true
+    }
+  }
+  return changed ? next : current
+}
+
+export function rollbackWorkspaceSessionAfterFailedAsyncWrite(
+  original: WorkspaceSessionState,
+  staged: WorkspaceSessionState,
+  current: WorkspaceSessionState
+): WorkspaceSessionState {
+  return rollbackValue(original, staged, current) as WorkspaceSessionState
+}
diff --git a/src/main/shell-prompt-readiness-probe.test.ts b/src/main/shell-prompt-readiness-probe.test.ts
new file mode 100644
index 00000000000..c2c783953ac
--- /dev/null
+++ b/src/main/shell-prompt-readiness-probe.test.ts
@@ -0,0 +1,227 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const lineEditorProbe = vi.hoisted(() => vi.fn())
+const processReadinessProbe = vi.hoisted(() => vi.fn())
+const resolveExecutablePath = vi.hoisted(() => vi.fn((value: string) => Promise.resolve(value)))
+vi.mock('../shared/pty-slave-line-discipline-echo', () => ({
+  createPtySlaveLineEditorProbe: () => lineEditorProbe
+}))
+vi.mock('../shared/shell-process-readiness', () => ({
+  readShellProcessReadiness: processReadinessProbe,
+  resolveShellExecutablePath: resolveExecutablePath
+}))
+
+import { createShellPromptReadinessProbe } from './shell-prompt-readiness-probe'
+
+describe('shell prompt readiness probe', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    lineEditorProbe.mockReset()
+    processReadinessProbe.mockReset()
+    resolveExecutablePath.mockClear()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('accepts only the identified shell pid in line-editor mode and foreground', async () => {
+    lineEditorProbe.mockResolvedValue('line-editor')
+    processReadinessProbe.mockResolvedValue({ executablePath: '/bin/zsh', foreground: true })
+    const onPromptReady = vi.fn()
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady,
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+
+    expect(onPromptReady).toHaveBeenCalledOnce()
+  })
+
+  it('preserves an unset child PATH for executable resolution', async () => {
+    lineEditorProbe.mockResolvedValue('line-editor')
+    processReadinessProbe.mockResolvedValue({ executablePath: '/bin/zsh', foreground: true })
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady: vi.fn(),
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+
+    expect(resolveExecutablePath).toHaveBeenCalledWith('/bin/zsh', process.cwd(), undefined)
+  })
+
+  it.each([
+    ['silent read', 'other', { executablePath: '/bin/zsh', foreground: true }],
+    ['background shell', 'line-editor', { executablePath: '/bin/zsh', foreground: false }],
+    ['different foreground process', 'line-editor', null],
+    [
+      'non-shell replacement image',
+      'line-editor',
+      { executablePath: '/usr/bin/sqlite3', foreground: true }
+    ],
+    [
+      'non-shell image with the shell basename',
+      'line-editor',
+      { executablePath: '/tmp/zsh', foreground: true }
+    ]
+  ])('rejects %s', async (_name, terminalState, rows) => {
+    lineEditorProbe.mockResolvedValue(terminalState)
+    processReadinessProbe.mockResolvedValue(rows)
+    const onPromptReady = vi.fn()
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady,
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+
+    expect(onPromptReady).not.toHaveBeenCalled()
+    if (terminalState === 'other') {
+      expect(processReadinessProbe).not.toHaveBeenCalled()
+    }
+  })
+
+  it('does no external work when the ready marker cancels the settle window', async () => {
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady: vi.fn(),
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    probe?.dispose()
+    await vi.advanceTimersByTimeAsync(10)
+
+    expect(lineEditorProbe).not.toHaveBeenCalled()
+    expect(processReadinessProbe).not.toHaveBeenCalled()
+  })
+
+  it('invalidates an in-flight result when newer output arrives', async () => {
+    const pending: { resolve?: (value: string) => void } = {}
+    lineEditorProbe.mockImplementation(
+      () => new Promise((resolve) => (pending.resolve = resolve as (value: string) => void))
+    )
+    processReadinessProbe.mockResolvedValue({ executablePath: '/bin/zsh', foreground: true })
+    const onPromptReady = vi.fn()
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady,
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+    probe?.notifyOutput('\x1b[?2004h')
+    pending.resolve?.('line-editor')
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(onPromptReady).not.toHaveBeenCalled()
+    expect(processReadinessProbe).not.toHaveBeenCalled()
+  })
+
+  it('does not inspect a process after disposal during a line-editor probe', async () => {
+    const pending: { resolve?: (value: string) => void } = {}
+    lineEditorProbe.mockImplementation(
+      () => new Promise((resolve) => (pending.resolve = resolve as (value: string) => void))
+    )
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady: vi.fn(),
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+    probe?.dispose()
+    pending.resolve?.('line-editor')
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(processReadinessProbe).not.toHaveBeenCalled()
+  })
+
+  it('invalidates process readiness that resolves after disposal', async () => {
+    const pending: { resolve?: (value: { executablePath: string; foreground: boolean }) => void } =
+      {}
+    lineEditorProbe.mockResolvedValue('line-editor')
+    processReadinessProbe.mockImplementation(
+      () => new Promise((resolve) => (pending.resolve = resolve))
+    )
+    const onPromptReady = vi.fn()
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady,
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+    probe?.dispose()
+    pending.resolve?.({ executablePath: '/bin/zsh', foreground: true })
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(onPromptReady).not.toHaveBeenCalled()
+  })
+
+  it('ignores slow startup output until the line editor enables its protocol', async () => {
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady: vi.fn(),
+      settleMs: 10
+    })
+
+    for (let index = 0; index < 20; index += 1) {
+      probe?.notifyOutput(`startup ${index}\n`)
+      await vi.advanceTimersByTimeAsync(20)
+    }
+
+    expect(lineEditorProbe).not.toHaveBeenCalled()
+    expect(processReadinessProbe).not.toHaveBeenCalled()
+  })
+
+  it('bounds rejected line-editor retries', async () => {
+    lineEditorProbe.mockResolvedValue('line-editor')
+    processReadinessProbe.mockResolvedValue({
+      executablePath: '/usr/bin/sqlite3',
+      foreground: true
+    })
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady: vi.fn(),
+      settleMs: 10
+    })
+
+    for (let index = 0; index < 10; index += 1) {
+      probe?.notifyOutput('\x1b[?2004h')
+      await vi.advanceTimersByTimeAsync(10)
+    }
+
+    expect(lineEditorProbe).toHaveBeenCalledTimes(4)
+    expect(processReadinessProbe).toHaveBeenCalledTimes(4)
+  })
+})
diff --git a/src/main/shell-prompt-readiness-probe.ts b/src/main/shell-prompt-readiness-probe.ts
new file mode 100644
index 00000000000..11583fd2de7
--- /dev/null
+++ b/src/main/shell-prompt-readiness-probe.ts
@@ -0,0 +1,107 @@
+import { createPtySlaveLineEditorProbe } from '../shared/pty-slave-line-discipline-echo'
+import {
+  readShellProcessReadiness,
+  resolveShellExecutablePath
+} from '../shared/shell-process-readiness'
+import {
+  createLineEditorReadyOutputScanState,
+  scanForLineEditorReadyOutput
+} from './line-editor-ready-output-scanner'
+import { basename } from 'node:path'
+
+export const SHELL_PROMPT_PROBE_SETTLE_MS = 50
+export const MAX_SHELL_PROMPT_PROBES = 4
+
+export type ShellPromptReadinessProbe = {
+  notifyOutput(data: string): void
+  dispose(): void
+}
+
+export function createShellPromptReadinessProbe(options: {
+  slavePath: string | undefined
+  getShellPid: () => number | null
+  shellPath: string | undefined
+  shellCwd?: string
+  shellPathEnv?: string
+  onPromptReady: () => void
+  settleMs?: number
+}): ShellPromptReadinessProbe | null {
+  const lineEditorProbe = createPtySlaveLineEditorProbe(options.slavePath)
+  if (!lineEditorProbe) {
+    return null
+  }
+  const settleMs = options.settleMs ?? SHELL_PROMPT_PROBE_SETTLE_MS
+  const expectedShellName = options.shellPath ? basename(options.shellPath).toLowerCase() : null
+  const outputScanState = createLineEditorReadyOutputScanState()
+  let disposed = false
+  let timer: ReturnType<typeof setTimeout> | null = null
+  let generation = 0
+  let probesStarted = 0
+
+  const probe = async (scheduledGeneration: number): Promise<void> => {
+    if (disposed || scheduledGeneration !== generation) {
+      return
+    }
+    const shellPid = options.getShellPid()
+    if (!shellPid || (await lineEditorProbe()) !== 'line-editor') {
+      return
+    }
+    if (disposed || scheduledGeneration !== generation) {
+      return
+    }
+    const [shell, expectedPath] = await Promise.all([
+      readShellProcessReadiness(shellPid),
+      options.shellPath
+        ? resolveShellExecutablePath(
+            options.shellPath,
+            options.shellCwd ?? process.cwd(),
+            options.shellPathEnv
+          )
+        : Promise.resolve(null)
+    ])
+    if (disposed || scheduledGeneration !== generation) {
+      return
+    }
+    if (
+      !shell?.foreground ||
+      !expectedShellName ||
+      !expectedPath ||
+      basename(shell.executablePath).toLowerCase() !== expectedShellName ||
+      shell.executablePath !== expectedPath
+    ) {
+      return
+    }
+    disposed = true
+    options.onPromptReady()
+  }
+
+  return {
+    notifyOutput(data: string): void {
+      if (
+        disposed ||
+        probesStarted >= MAX_SHELL_PROMPT_PROBES ||
+        !scanForLineEditorReadyOutput(outputScanState, data)
+      ) {
+        return
+      }
+      generation += 1
+      const scheduledGeneration = generation
+      if (timer) {
+        clearTimeout(timer)
+      }
+      timer = setTimeout(() => {
+        timer = null
+        probesStarted += 1
+        void probe(scheduledGeneration).catch(() => {})
+      }, settleMs)
+    },
+    dispose(): void {
+      disposed = true
+      generation += 1
+      if (timer) {
+        clearTimeout(timer)
+        timer = null
+      }
+    }
+  }
+}
diff --git a/src/main/shell-startup-identity-scanner.test.ts b/src/main/shell-startup-identity-scanner.test.ts
new file mode 100644
index 00000000000..2b1607c23e6
--- /dev/null
+++ b/src/main/shell-startup-identity-scanner.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest'
+import {
+  createShellStartupIdentityScanState,
+  drainShellStartupIdentityHeldBytes,
+  scanForShellStartupIdentity
+} from './shell-startup-identity-scanner'
+
+describe('shell startup identity scanner', () => {
+  it('strips a split identity marker and returns its shell pid', () => {
+    const state = createShellStartupIdentityScanState()
+    expect(scanForShellStartupIdentity(state, 'before\x1b]777;orca-shell-st')).toEqual({
+      output: 'before',
+      shellPid: null
+    })
+    expect(scanForShellStartupIdentity(state, 'art:12345\x07after')).toEqual({
+      output: 'after',
+      shellPid: 12345
+    })
+  })
+
+  it('forwards lookalikes unchanged', () => {
+    const state = createShellStartupIdentityScanState()
+    const input = 'a\x1b]777;orca-shell-start:nope\x07b'
+    expect(scanForShellStartupIdentity(state, input)).toEqual({ output: input, shellPid: null })
+  })
+
+  it('forwards an unrelated OSC ending in digits', () => {
+    const state = createShellStartupIdentityScanState()
+    const input = '\x1b]1337;remote-session:12345'
+    expect(scanForShellStartupIdentity(state, input)).toEqual({ output: input, shellPid: null })
+    expect(state.heldBytes).toBe('')
+  })
+
+  it('releases an incomplete marker on teardown', () => {
+    const state = createShellStartupIdentityScanState()
+    scanForShellStartupIdentity(state, '\x1b]777;orca-shell-start:12')
+    expect(drainShellStartupIdentityHeldBytes(state)).toBe('\x1b]777;orca-shell-start:12')
+  })
+
+  it('does not retain an unbounded digit stream', () => {
+    const state = createShellStartupIdentityScanState()
+    const input = `\x1b]777;orca-shell-start:${'1'.repeat(100)}`
+    expect(scanForShellStartupIdentity(state, input).output).toBe(input)
+    expect(state.heldBytes).toBe('')
+  })
+})
diff --git a/src/main/shell-startup-identity-scanner.ts b/src/main/shell-startup-identity-scanner.ts
new file mode 100644
index 00000000000..234b69e6bbf
--- /dev/null
+++ b/src/main/shell-startup-identity-scanner.ts
@@ -0,0 +1,72 @@
+export const SHELL_STARTUP_IDENTITY_PREFIX = '\x1b]777;orca-shell-start:'
+const POSSIBLE_PID_SUFFIX = /^\d{0,20}$/
+
+export type ShellStartupIdentityScanState = {
+  heldBytes: string
+}
+
+export type ShellStartupIdentityScanResult = {
+  output: string
+  shellPid: number | null
+}
+
+export function createShellStartupIdentityScanState(): ShellStartupIdentityScanState {
+  return { heldBytes: '' }
+}
+
+export function drainShellStartupIdentityHeldBytes(state: ShellStartupIdentityScanState): string {
+  const heldBytes = state.heldBytes
+  state.heldBytes = ''
+  return heldBytes
+}
+
+function isPossibleMarker(candidate: string): boolean {
+  if (candidate.length <= SHELL_STARTUP_IDENTITY_PREFIX.length) {
+    return SHELL_STARTUP_IDENTITY_PREFIX.startsWith(candidate)
+  }
+  if (!candidate.startsWith(SHELL_STARTUP_IDENTITY_PREFIX)) {
+    return false
+  }
+  const suffix = candidate.slice(SHELL_STARTUP_IDENTITY_PREFIX.length)
+  return POSSIBLE_PID_SUFFIX.test(suffix)
+}
+
+export function scanForShellStartupIdentity(
+  state: ShellStartupIdentityScanState,
+  data: string
+): ShellStartupIdentityScanResult {
+  let pending = state.heldBytes + data
+  let output = ''
+  state.heldBytes = ''
+
+  while (pending.length > 0) {
+    const start = pending.indexOf(SHELL_STARTUP_IDENTITY_PREFIX[0] as string)
+    if (start === -1) {
+      output += pending
+      break
+    }
+    output += pending.slice(0, start)
+    const candidate = pending.slice(start)
+    if (isPossibleMarker(candidate)) {
+      state.heldBytes = candidate
+      break
+    }
+    if (candidate.startsWith(SHELL_STARTUP_IDENTITY_PREFIX)) {
+      const suffix = candidate.slice(SHELL_STARTUP_IDENTITY_PREFIX.length)
+      const terminator = suffix.indexOf('\x07')
+      const pidText = terminator === -1 ? '' : suffix.slice(0, terminator)
+      if (/^\d+$/.test(pidText)) {
+        const shellPid = Number(pidText)
+        const markerLength = SHELL_STARTUP_IDENTITY_PREFIX.length + terminator + 1
+        return {
+          output: output + candidate.slice(markerLength),
+          shellPid: Number.isSafeInteger(shellPid) && shellPid > 0 ? shellPid : null
+        }
+      }
+    }
+    output += candidate[0]
+    pending = candidate.slice(1)
+  }
+
+  return { output, shellPid: null }
+}
diff --git a/src/main/shell-templates.ts b/src/main/shell-templates.ts
index e6372979069..5b481217d90 100644
--- a/src/main/shell-templates.ts
+++ b/src/main/shell-templates.ts
@@ -5,11 +5,17 @@ function quotePosixSingle(value: string): string {
   return `'${value.replace(/'/g, `'\\''`)}'`
 }
 
+export const SHELL_STARTUP_IDENTITY_MARKER_BLOCK = `if [[ "\${ORCA_SHELL_STARTUP_IDENTITY:-0}" == "1" ]]; then
+  unset ORCA_SHELL_STARTUP_IDENTITY
+  printf "\\033]777;orca-shell-start:%s\\007" "$$"
+fi`
+
 export function getZshEnvTemplate(zshDir: string, headerPrefix = ''): string {
   const header = headerPrefix
     ? `Orca ${headerPrefix} zsh shell-ready wrapper`
     : 'Orca zsh shell-ready wrapper'
   return `# ${header}
+${SHELL_STARTUP_IDENTITY_MARKER_BLOCK}
 # Why: capture the runtime wrapper dir before it is unset below. On WSL this
 # file is generated with a Windows path but sourced via /mnt/c, so the baked
 # literal is unusable there and ZDOTDIR must be restored from this value.
diff --git a/src/main/source-control/forge-provider.test.ts b/src/main/source-control/forge-provider.test.ts
index ae5e5623a97..c31d84b3c87 100644
--- a/src/main/source-control/forge-provider.test.ts
+++ b/src/main/source-control/forge-provider.test.ts
@@ -1,7 +1,9 @@
+import { supportsHostedReviewCreation } from '../../shared/hosted-review-creation-providers'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
   createGitHubPullRequestMock,
+  createBitbucketPullRequestMock,
   createGitLabMergeRequestMock,
   createAzureDevOpsPullRequestMock,
   createGiteaPullRequestMock,
@@ -16,6 +18,7 @@ const {
   getEnterpriseGitHubRepoSlugMock
 } = vi.hoisted(() => ({
   createGitHubPullRequestMock: vi.fn(),
+  createBitbucketPullRequestMock: vi.fn(),
   createGitLabMergeRequestMock: vi.fn(),
   createAzureDevOpsPullRequestMock: vi.fn(),
   createGiteaPullRequestMock: vi.fn(),
@@ -60,6 +63,10 @@ vi.mock('../bitbucket/client', () => ({
   getBitbucketPullRequest: vi.fn()
 }))
 
+vi.mock('../bitbucket/pull-request-creation', () => ({
+  createBitbucketPullRequest: createBitbucketPullRequestMock
+}))
+
 vi.mock('../azure-devops/client', () => ({
   getAzureDevOpsRepoSlug: getAzureDevOpsRepoSlugMock,
   getAzureDevOpsPullRequestForBranch: vi.fn(),
@@ -99,6 +106,7 @@ describe('forge provider interface', () => {
   beforeEach(() => {
     createGitHubPullRequestMock.mockReset()
     createGitLabMergeRequestMock.mockReset()
+    createBitbucketPullRequestMock.mockReset()
     createAzureDevOpsPullRequestMock.mockReset()
     createGiteaPullRequestMock.mockReset()
     getAzureDevOpsRepoSlugMock.mockReset()
@@ -170,10 +178,16 @@ describe('forge provider interface', () => {
     ).toEqual([
       ['gitlab', true],
       ['github', true],
-      ['bitbucket', false],
+      ['bitbucket', true],
       ['azure-devops', true],
       ['gitea', true]
     ])
+    // Why: the shared list is what the Create blocker and the renderer read.
+    // When it drifted from this one, Bitbucket had a working createReview but
+    // still reported "provider does not support creating a pull request".
+    for (const provider of FORGE_PROVIDERS) {
+      expect(supportsHostedReviewCreation(provider.id)).toBe(provider.supportsReviewCreation)
+    }
     createGitHubPullRequestMock.mockResolvedValue({
       ok: true,
       number: 12,
@@ -201,6 +215,28 @@ describe('forge provider interface', () => {
     })
   })
 
+  it('routes Bitbucket review creation through the shared provider contract', async () => {
+    createBitbucketPullRequestMock.mockResolvedValue({
+      ok: true,
+      number: 23,
+      url: 'https://bitbucket.org/team/orca/pull-requests/23'
+    })
+
+    const provider = getForgeProviderById('bitbucket')
+    const input = {
+      provider: 'bitbucket' as const,
+      base: 'main',
+      head: 'feature/provider-interface',
+      title: 'Add provider interface'
+    }
+    await expect(provider.createReview?.('/repo', input)).resolves.toEqual({
+      ok: true,
+      number: 23,
+      url: 'https://bitbucket.org/team/orca/pull-requests/23'
+    })
+    expect(createBitbucketPullRequestMock).toHaveBeenCalledWith('/repo', input)
+  })
+
   it('routes GitLab review creation through the shared provider contract', async () => {
     createGitLabMergeRequestMock.mockResolvedValue({
       ok: true,
diff --git a/src/main/source-control/forge-provider.ts b/src/main/source-control/forge-provider.ts
index 19526ad71fa..a3aef433110 100644
--- a/src/main/source-control/forge-provider.ts
+++ b/src/main/source-control/forge-provider.ts
@@ -15,6 +15,7 @@ import {
   getBitbucketPullRequestForBranchOrThrow,
   getBitbucketRepoSlug
 } from '../bitbucket/client'
+import { createBitbucketPullRequest } from '../bitbucket/pull-request-creation'
 import {
   getGiteaPullRequest,
   getGiteaPullRequestForBranchOrThrow,
@@ -65,7 +66,7 @@ export type ForgeReviewByNumberInput = ForgeProviderRepositoryContext & {
 export type ForgeProvider = {
   id: ForgeProviderId
   supportsReviewCreation: boolean
-  resolveRepository(context: ForgeProviderRepositoryContext): Promise<unknown | null>
+  resolveRepository(context: ForgeProviderRepositoryContext): Promise<unknown>
   getReviewForBranch(input: ForgeReviewForBranchInput): Promise<HostedReviewInfo | null>
   getReviewByNumber(input: ForgeReviewByNumberInput): Promise<HostedReviewInfo | null>
   createReview?(
@@ -198,7 +199,7 @@ const gitHubForgeProvider = {
 
 const bitbucketForgeProvider = {
   id: 'bitbucket',
-  supportsReviewCreation: false,
+  supportsReviewCreation: true,
   resolveRepository: (context) =>
     getBitbucketRepoSlug(
       context.repoPath,
@@ -225,7 +226,8 @@ const bitbucketForgeProvider = {
       ...hostedReviewExecutionArgs(input)
     )
     return pr ? mapBitbucketReview(pr) : null
-  }
+  },
+  createReview: createBitbucketPullRequest
 } satisfies ForgeProvider
 
 const azureDevOpsForgeProvider = {
diff --git a/src/main/source-control/hosted-review-creation-eligibility.test.ts b/src/main/source-control/hosted-review-creation-eligibility.test.ts
index f2fa711ee54..2cf262e8cca 100644
--- a/src/main/source-control/hosted-review-creation-eligibility.test.ts
+++ b/src/main/source-control/hosted-review-creation-eligibility.test.ts
@@ -472,29 +472,31 @@ describe('getHostedReviewCreationEligibility', () => {
       blockedReason: null,
       nextAction: null,
       defaultBaseRef: 'origin/main',
-      head: 'feature/create-pr'
+      head: 'feature/create-pr',
+      stackedCreationSupported: true
     })
   })
 
   it('detects a GitHub Enterprise Server branch as the GitHub provider (#8312)', async () => {
     mockGitHubEnterpriseProvider()
 
-    await expect(
-      getHostedReviewCreationEligibility({
-        repoPath: '/repo',
-        branch: 'feature/create-pr',
-        base: 'origin/main',
-        hasUncommittedChanges: false,
-        hasUpstream: true,
-        ahead: 0,
-        behind: 0
-      })
-    ).resolves.toMatchObject({
+    const result = await getHostedReviewCreationEligibility({
+      repoPath: '/repo',
+      branch: 'feature/create-pr',
+      base: 'origin/main',
+      hasUncommittedChanges: false,
+      hasUpstream: true,
+      ahead: 0,
+      behind: 0
+    })
+
+    expect(result).toMatchObject({
       provider: 'github',
       canCreate: true,
       blockedReason: null,
       nextAction: null
     })
+    expect(result).not.toHaveProperty('stackedCreationSupported')
 
     // Enterprise auth was already confirmed during detection; the gate must not
     // fire a redundant gh probe.
diff --git a/src/main/source-control/hosted-review-creation.ts b/src/main/source-control/hosted-review-creation.ts
index f28c319f3ea..0fa50ef3a32 100644
--- a/src/main/source-control/hosted-review-creation.ts
+++ b/src/main/source-control/hosted-review-creation.ts
@@ -18,7 +18,10 @@ import {
 } from '../../shared/hosted-review-creation-providers'
 import { isAzureDevOpsReviewCreationAuthenticated } from '../azure-devops/pull-request-creation'
 import { isGiteaReviewCreationAuthenticated } from '../gitea/pull-request-creation'
+import { isBitbucketReviewCreationAuthenticated } from '../bitbucket/pull-request-creation'
 import { getEnterpriseGitHubRepoSlug } from '../github/github-enterprise-repository'
+import { getRepoSlug } from '../github/client'
+import { isDefaultGitHubHost } from '../../shared/github-repository-identity-key'
 import { acquire, ghExecFileAsync, gitExecFileAsync, release } from '../github/gh-utils'
 import { isNoUpstreamError, normalizeGitErrorMessage } from '../../shared/git-remote-error'
 import type { GitUpstreamStatus } from '../../shared/types'
@@ -291,6 +294,14 @@ function reviewCopy(provider: HostedReviewProvider): {
       authInstruction: 'Set ORCA_GITEA_TOKEN'
     }
   }
+  if (provider === 'bitbucket') {
+    return {
+      shortLabel: 'PR',
+      reviewLabel: 'pull request',
+      providerName: 'Bitbucket',
+      authInstruction: 'Connect Bitbucket in Settings > Integrations'
+    }
+  }
   return {
     shortLabel: 'PR',
     reviewLabel: 'pull request',
@@ -314,6 +325,11 @@ async function isProviderAuthenticated(
   if (provider === 'gitea') {
     return isGiteaReviewCreationAuthenticated()
   }
+  if (provider === 'bitbucket') {
+    // Why: falling through to the GitHub check made Create PR unusable for
+    // anyone with Bitbucket connected but no `gh auth login`.
+    return isBitbucketReviewCreationAuthenticated()
+  }
   return isGitHubAuthenticated(repoPath, connectionId, options)
 }
 
@@ -521,12 +537,19 @@ export async function getHostedReviewCreationEligibility(
     : lookupFailed
       ? 'unavailable'
       : 'not_found'
+  const githubRepository =
+    provider === 'github'
+      ? await getRepoSlug(args.repoPath, args.connectionId, args).catch(() => null)
+      : null
   const baseResult = {
     provider,
     review: review ? { number: review.number, url: review.url } : null,
     reviewLookupOutcome,
     defaultBaseRef,
-    head: branch || null
+    head: branch || null,
+    ...(githubRepository && isDefaultGitHubHost(githubRepository.host)
+      ? { stackedCreationSupported: true }
+      : {})
   }
 
   if (!branch || branch === 'HEAD') {
diff --git a/src/main/source-control/stacked-hosted-review-creation.test.ts b/src/main/source-control/stacked-hosted-review-creation.test.ts
new file mode 100644
index 00000000000..7814e66e6c8
--- /dev/null
+++ b/src/main/source-control/stacked-hosted-review-creation.test.ts
@@ -0,0 +1,92 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { prepareMock, registerMock, createMock } = vi.hoisted(() => ({
+  prepareMock: vi.fn(),
+  registerMock: vi.fn(),
+  createMock: vi.fn()
+}))
+
+vi.mock('../github/stacked-pr-creation', () => ({
+  prepareGitHubStackedPullRequest: prepareMock,
+  registerGitHubStackedPullRequest: registerMock
+}))
+
+vi.mock('./hosted-review-creation', () => ({ createHostedReview: createMock }))
+
+import { createStackedHostedReview } from './stacked-hosted-review-creation'
+
+const input = {
+  provider: 'github' as const,
+  base: 'stack/parent',
+  head: 'stack/child',
+  title: 'Child'
+}
+const repository = { owner: 'acme', repo: 'orca', host: 'github.com' }
+const parentReview = { number: 41, url: 'https://github.com/acme/orca/pull/41' }
+const currentReview = { number: 42, url: 'https://github.com/acme/orca/pull/42' }
+
+beforeEach(() => {
+  prepareMock.mockReset()
+  registerMock.mockReset()
+  createMock.mockReset()
+})
+
+describe('createStackedHostedReview', () => {
+  it('creates the current PR before registering the stack', async () => {
+    prepareMock.mockResolvedValue({
+      ok: true,
+      repository,
+      parentReview,
+      currentReview: null
+    })
+    createMock.mockResolvedValue({ ok: true, ...currentReview })
+    registerMock.mockResolvedValue({
+      ok: true,
+      ...currentReview,
+      parentReview,
+      stackNumber: 50
+    })
+
+    const result = await createStackedHostedReview('/repo', input, 'ssh-1')
+
+    expect(result).toMatchObject({ ok: true, stackNumber: 50 })
+    expect(createMock).toHaveBeenCalledWith('/repo', input, 'ssh-1', {})
+    expect(registerMock).toHaveBeenCalledWith(
+      expect.objectContaining({ parentReview, currentReview, connectionId: 'ssh-1' })
+    )
+  })
+
+  it('retries registration without creating a duplicate PR', async () => {
+    prepareMock.mockResolvedValue({
+      ok: true,
+      repository,
+      parentReview,
+      currentReview
+    })
+    registerMock.mockResolvedValue({
+      ok: true,
+      ...currentReview,
+      parentReview,
+      stackNumber: 50
+    })
+
+    await createStackedHostedReview('/repo', input)
+
+    expect(createMock).not.toHaveBeenCalled()
+    expect(registerMock).toHaveBeenCalledOnce()
+  })
+
+  it('does not create a PR when the parent topology is invalid', async () => {
+    prepareMock.mockResolvedValue({
+      ok: false,
+      code: 'validation',
+      error: 'Choose the top pull request.'
+    })
+
+    const result = await createStackedHostedReview('/repo', input)
+
+    expect(result).toMatchObject({ ok: false, code: 'validation' })
+    expect(createMock).not.toHaveBeenCalled()
+    expect(registerMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/source-control/stacked-hosted-review-creation.ts b/src/main/source-control/stacked-hosted-review-creation.ts
new file mode 100644
index 00000000000..53327cbd404
--- /dev/null
+++ b/src/main/source-control/stacked-hosted-review-creation.ts
@@ -0,0 +1,60 @@
+import type {
+  CreateStackedHostedReviewInput,
+  CreateStackedHostedReviewResult,
+  HostedReviewSummary
+} from '../../shared/hosted-review'
+import {
+  prepareGitHubStackedPullRequest,
+  registerGitHubStackedPullRequest
+} from '../github/stacked-pr-creation'
+import { createHostedReview } from './hosted-review-creation'
+import type { HostedReviewExecutionOptions } from './hosted-review-git-options'
+
+export async function createStackedHostedReview(
+  repoPath: string,
+  input: CreateStackedHostedReviewInput,
+  connectionId?: string | null,
+  options: HostedReviewExecutionOptions = {}
+): Promise<CreateStackedHostedReviewResult> {
+  const plan = await prepareGitHubStackedPullRequest(repoPath, input, connectionId, options)
+  if (!plan.ok) {
+    return plan
+  }
+
+  let currentReview: (HostedReviewSummary & { number: number }) | null = plan.currentReview
+  if (!currentReview) {
+    const created = await createHostedReview(repoPath, input, connectionId, options)
+    if (!created.ok) {
+      if (!created.existingReview?.number) {
+        return created
+      }
+      return {
+        ok: false,
+        code: 'validation',
+        error:
+          'An open pull request already exists for this branch but does not target the selected parent branch.',
+        createdReview: {
+          number: created.existingReview.number,
+          url: created.existingReview.url
+        }
+      }
+    }
+    currentReview = { number: created.number, url: created.url }
+  }
+  if (!currentReview) {
+    return {
+      ok: false,
+      code: 'unknown_completion',
+      error: 'Pull request creation may have completed. Retry to finish stack registration.'
+    }
+  }
+
+  return registerGitHubStackedPullRequest({
+    repoPath,
+    repository: plan.repository,
+    parentReview: plan.parentReview,
+    currentReview,
+    connectionId,
+    options
+  })
+}
diff --git a/src/main/sqlite/sync-database.test.ts b/src/main/sqlite/sync-database.test.ts
new file mode 100644
index 00000000000..34677095b26
--- /dev/null
+++ b/src/main/sqlite/sync-database.test.ts
@@ -0,0 +1,153 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import SyncDatabase from './sync-database'
+
+const temporaryDirectories: string[] = []
+const openDatabases: SyncDatabase.Database[] = []
+
+async function createDatabase(): Promise<SyncDatabase.Database> {
+  const directory = await mkdtemp(join(tmpdir(), 'orca-sync-database-'))
+  temporaryDirectories.push(directory)
+  const db = new SyncDatabase(join(directory, 'test.db'))
+  openDatabases.push(db)
+  db.exec(
+    'CREATE TABLE items (id TEXT PRIMARY KEY, label TEXT); ' +
+      "INSERT INTO items (id, label) VALUES ('a', 'alpha'), ('b', 'beta')"
+  )
+  return db
+}
+
+afterEach(async () => {
+  for (const db of openDatabases.splice(0)) {
+    try {
+      db.close()
+    } catch {
+      // already closed by the test
+    }
+  }
+  await Promise.all(
+    temporaryDirectories.splice(0).map((dir) => rm(dir, { recursive: true, force: true }))
+  )
+})
+
+describe('SyncDatabase statement cache', () => {
+  it('reuses the same statement object for identical SQL', async () => {
+    const db = await createDatabase()
+    const sql = 'SELECT label FROM items WHERE id = ?'
+
+    expect(db.prepare(sql)).toBe(db.prepare(sql))
+    expect(db.prepare('SELECT id FROM items WHERE id = ?')).not.toBe(db.prepare(sql))
+  })
+
+  it('returns correct rows when a reused statement is bound to different values', async () => {
+    const db = await createDatabase()
+    const sql = 'SELECT label FROM items WHERE id = ?'
+
+    expect(db.prepare(sql).get('a')).toEqual({ label: 'alpha' })
+    expect(db.prepare(sql).get('b')).toEqual({ label: 'beta' })
+    expect(db.prepare(sql).get('missing')).toBeUndefined()
+    expect(db.prepare(sql).all('a')).toEqual([{ label: 'alpha' }])
+  })
+
+  it('bounds the cache so per-arity SQL cannot grow it without limit', async () => {
+    const db = await createDatabase()
+    const first = 'SELECT 0 AS n'
+    const firstStatement = db.prepare(first)
+    for (let index = 1; index <= 256; index += 1) {
+      db.prepare(`SELECT ${index} AS n`)
+    }
+
+    expect(db.prepare(first)).not.toBe(firstStatement)
+    expect(db.prepare('SELECT 256 AS n')).toBe(db.prepare('SELECT 256 AS n'))
+  })
+
+  it('drops cached statements on close', async () => {
+    const db = await createDatabase()
+    db.prepare('SELECT label FROM items WHERE id = ?')
+    db.close()
+
+    const cache = (db as unknown as { statementCache: Map<string, unknown> }).statementCache
+    expect(cache.size).toBe(0)
+  })
+
+  it('does not serve a stale statement after DDL adds a column', async () => {
+    const db = await createDatabase()
+    expect(db.prepare('SELECT * FROM items WHERE id = ?').all('a')).toEqual([
+      { id: 'a', label: 'alpha' }
+    ])
+
+    db.exec("ALTER TABLE items ADD COLUMN note TEXT; UPDATE items SET note = 'noted'")
+
+    expect(db.prepare('SELECT * FROM items WHERE id = ?').all('a')).toEqual([
+      { id: 'a', label: 'alpha', note: 'noted' }
+    ])
+    expect(db.prepare('SELECT label FROM items WHERE id = ?').all('a')).toEqual([
+      { label: 'alpha' }
+    ])
+  })
+
+  it('keeps a cached statement correct when another connection changes the schema', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-sync-database-'))
+    temporaryDirectories.push(directory)
+    const path = join(directory, 'shared.db')
+    const writer = new SyncDatabase(path)
+    const reader = new SyncDatabase(path)
+    openDatabases.push(writer, reader)
+    writer.exec("CREATE TABLE items (id TEXT PRIMARY KEY); INSERT INTO items VALUES ('a')")
+    const sql = 'SELECT id FROM items ORDER BY id'
+    expect(reader.prepare(sql).all()).toEqual([{ id: 'a' }])
+
+    writer.exec("ALTER TABLE items ADD COLUMN note TEXT; INSERT INTO items VALUES ('b', 'noted')")
+
+    expect(reader.prepare(sql).all()).toEqual([{ id: 'a' }, { id: 'b' }])
+    expect(reader.prepare('SELECT note FROM items WHERE id = ?').all('b')).toEqual([
+      { note: 'noted' }
+    ])
+  })
+
+  it('does not cache wildcard selects or pragma statements', async () => {
+    const db = await createDatabase()
+
+    expect(db.prepare('SELECT * FROM items')).not.toBe(db.prepare('SELECT * FROM items'))
+    expect(db.prepare('PRAGMA table_info(items)')).not.toBe(db.prepare('PRAGMA table_info(items)'))
+    expect(db.prepare('SELECT COUNT(*) AS n FROM items')).toBe(
+      db.prepare('SELECT COUNT(*) AS n FROM items')
+    )
+  })
+
+  it('keeps cached statements across transaction control and other non-DDL exec calls', async () => {
+    const db = await createDatabase()
+    const sql = 'SELECT label FROM items WHERE id = ?'
+    const statement = db.prepare(sql)
+
+    db.exec('BEGIN IMMEDIATE')
+    db.exec("INSERT INTO items (id, label) VALUES ('c', 'gamma')")
+    db.exec('COMMIT')
+
+    expect(db.prepare(sql)).toBe(statement)
+    expect(statement.get('c')).toEqual({ label: 'gamma' })
+  })
+
+  it('preserves pragma and exec behavior', async () => {
+    const db = await createDatabase()
+
+    expect(db.pragma('journal_mode', { simple: true })).toBe('delete')
+    expect(db.pragma('table_info(items)')).toEqual([
+      expect.objectContaining({ name: 'id' }),
+      expect.objectContaining({ name: 'label' })
+    ])
+    expect(db.pragma('table_info(missing_table)')).toEqual([])
+    expect(db.pragma('table_info(missing_table)', { simple: true })).toBeUndefined()
+  })
+
+  it('rejects a missing file when fileMustExist is set', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-sync-database-'))
+    temporaryDirectories.push(directory)
+
+    expect(() => new SyncDatabase(join(directory, 'absent.db'), { fileMustExist: true })).toThrow(
+      /does not exist/
+    )
+  })
+})
diff --git a/src/main/sqlite/sync-database.ts b/src/main/sqlite/sync-database.ts
index 70d8fa1c06a..68faef8b83c 100644
--- a/src/main/sqlite/sync-database.ts
+++ b/src/main/sqlite/sync-database.ts
@@ -15,6 +15,18 @@ type PragmaOptions = {
 
 export type SqliteStatement = StatementSync
 
+// Why: dynamic `IN (?,?,…)` clauses mint a new SQL string per arity, so the cache must stay bounded.
+const STATEMENT_CACHE_LIMIT = 256
+const AGGREGATE_STAR = /\(\s*\*\s*\)/g
+const PRAGMA_STATEMENT = /^\s*PRAGMA\b/i
+const SCHEMA_CHANGING_SQL = /\b(?:ALTER|CREATE|DROP|REINDEX|VACUUM|ATTACH|DETACH)\b/i
+
+// Why: node:sqlite builds the first post-schema-change row from stale column names, so a reused
+// wildcard SELECT can drop a freshly added column; PRAGMAs are one-shot config, never hot-path.
+function isStatementCacheable(sql: string): boolean {
+  return !PRAGMA_STATEMENT.test(sql) && !sql.replace(AGGREGATE_STAR, '').includes('*')
+}
+
 // Why: SSH companions target Node 18 and import this adapter without opening SQLite.
 function loadDatabaseSync(): typeof DatabaseSync {
   if (typeof process.getBuiltinModule !== 'function') {
@@ -26,6 +38,7 @@ function loadDatabaseSync(): typeof DatabaseSync {
 
 class SyncDatabase {
   private readonly db: DatabaseSync
+  private readonly statementCache = new Map<string, StatementSync>()
 
   constructor(path: SqlitePath, options: SyncDatabaseOptions = {}) {
     if (
@@ -44,11 +57,31 @@ class SyncDatabase {
   }
 
   exec(sql: string): void {
+    // Why: drop cached statements before DDL lands so a partially applied batch cannot leave stale ones.
+    if (SCHEMA_CHANGING_SQL.test(sql)) {
+      this.statementCache.clear()
+    }
     this.db.exec(sql)
   }
 
   prepare(sql: string): StatementSync {
-    return this.db.prepare(sql)
+    const cached = this.statementCache.get(sql)
+    if (cached) {
+      this.statementCache.delete(sql)
+      this.statementCache.set(sql, cached)
+      return cached
+    }
+    const statement = this.db.prepare(sql)
+    if (isStatementCacheable(sql)) {
+      if (this.statementCache.size >= STATEMENT_CACHE_LIMIT) {
+        const oldest = this.statementCache.keys().next().value
+        if (oldest !== undefined) {
+          this.statementCache.delete(oldest)
+        }
+      }
+      this.statementCache.set(sql, statement)
+    }
+    return statement
   }
 
   pragma(sql: string, options?: PragmaOptions): unknown {
@@ -64,6 +97,7 @@ class SyncDatabase {
   }
 
   close(): void {
+    this.statementCache.clear()
     this.db.close()
   }
 }
diff --git a/src/main/ssh/sftp-namespace-resolution.test.ts b/src/main/ssh/sftp-namespace-resolution.test.ts
index 98ba2637c7d..5239e834152 100644
--- a/src/main/ssh/sftp-namespace-resolution.test.ts
+++ b/src/main/ssh/sftp-namespace-resolution.test.ts
@@ -35,10 +35,7 @@ const MARKER_STATS = {
   size: 0
 }
 
-function makeSftp(options: {
-  startPath?: string | Error | unknown
-  lstat?: (path: string) => LstatOutcome
-}): {
+function makeSftp(options: { startPath?: unknown; lstat?: (path: string) => LstatOutcome }): {
   sftp: SFTPWrapper
   realpathCalls: string[]
   lstatCalls: string[]
diff --git a/src/main/ssh/ssh-channel-multiplexer.ts b/src/main/ssh/ssh-channel-multiplexer.ts
index 0000f2f353b..d87a7ad8f5b 100644
--- a/src/main/ssh/ssh-channel-multiplexer.ts
+++ b/src/main/ssh/ssh-channel-multiplexer.ts
@@ -39,7 +39,7 @@ export type SshMultiplexerRequestOptions = {
 
 export type NotificationHandler = (method: string, params: Record<string, unknown>) => void
 export type MethodNotificationHandler = (params: Record<string, unknown>) => void
-export type RequestHandler = (params: Record<string, unknown>) => Promise<unknown> | unknown
+export type RequestHandler = (params: Record<string, unknown>) => unknown
 
 export type MultiplexerDisposeReason = 'shutdown' | 'connection_lost'
 
diff --git a/src/main/ssh/ssh-port-scanner.test.ts b/src/main/ssh/ssh-port-scanner.test.ts
index 09be7c1f686..f903d71acf0 100644
--- a/src/main/ssh/ssh-port-scanner.test.ts
+++ b/src/main/ssh/ssh-port-scanner.test.ts
@@ -235,6 +235,40 @@ describe('PortScanner', () => {
     expect(scanner.getDetectedPorts('t1')).toEqual([])
   })
 
+  it('aborts in-flight requests before stopping or replacing a target scan', async () => {
+    const harness = createVisibilityHarness(true)
+    const signals: AbortSignal[] = []
+    const request = vi.fn(
+      (_method: string, _params?: Record<string, unknown>, options?: { signal?: AbortSignal }) =>
+        new Promise<never>((_resolve, reject) => {
+          const signal = options?.signal
+          if (!signal) {
+            reject(new Error('missing request signal'))
+            return
+          }
+          signals.push(signal)
+          signal.addEventListener('abort', () => reject(signal.reason), { once: true })
+        })
+    )
+    const mux = { request } as unknown as SshChannelMultiplexer
+    const scanner = new PortScanner(harness.visibility)
+
+    scanner.startScanning('t1', mux, vi.fn())
+    expect(signals).toHaveLength(1)
+    expect(signals[0].aborted).toBe(false)
+
+    scanner.startScanning('t1', mux, vi.fn())
+    expect(signals).toHaveLength(2)
+    expect(signals[0].aborted).toBe(true)
+    expect(signals[1].aborted).toBe(false)
+
+    scanner.stopScanning('t1')
+    expect(signals[1].aborted).toBe(true)
+    await vi.advanceTimersByTimeAsync(10 * BASE)
+    expect(request).toHaveBeenCalledTimes(2)
+    expect(harness.listenerCount()).toBe(0)
+  })
+
   it('keeps targets independent: stopping one host leaves the other scanning', async () => {
     const harness = createVisibilityHarness(true)
     let nextA = 3000
diff --git a/src/main/ssh/ssh-port-scanner.ts b/src/main/ssh/ssh-port-scanner.ts
index 6404d035f22..2dbabff597a 100644
--- a/src/main/ssh/ssh-port-scanner.ts
+++ b/src/main/ssh/ssh-port-scanner.ts
@@ -19,6 +19,7 @@ export type PortScannerWindowVisibility = {
 
 type ScanHandle = {
   timer: ReturnType<typeof setTimeout> | null
+  requestAbortController: AbortController | null
   intervalMs: number
   // Why: while the window is hidden the scan chain is parked outright — no
   // timer wakeups, no remote requests — and the visibility listener resumes
@@ -48,6 +49,7 @@ export class PortScanner {
 
     const handle: ScanHandle = {
       timer: null,
+      requestAbortController: null,
       intervalMs: SSH_PORT_SCAN_BASE_INTERVAL_MS,
       parkedWhileHidden: false,
       unsubscribeVisibility: () => {},
@@ -65,8 +67,12 @@ export class PortScanner {
         return
       }
       polling = true
+      const requestAbortController = new AbortController()
+      handle.requestAbortController = requestAbortController
       try {
-        const result = (await mux.request('ports.detect')) as {
+        const result = (await mux.request('ports.detect', undefined, {
+          signal: requestAbortController.signal
+        })) as {
           ports: DetectedPort[]
           platform: string
         }
@@ -94,6 +100,9 @@ export class PortScanner {
       } catch {
         // Relay disconnected or request timed out — retry on next interval
       } finally {
+        if (handle.requestAbortController === requestAbortController) {
+          handle.requestAbortController = null
+        }
         polling = false
       }
     }
@@ -142,6 +151,8 @@ export class PortScanner {
     if (handle.timer) {
       clearTimeout(handle.timer)
     }
+    handle.requestAbortController?.abort()
+    handle.requestAbortController = null
     handle.unsubscribeVisibility()
     this.handles.delete(targetId)
   }
diff --git a/src/main/ssh/ssh-relay-session-relay-loss.test.ts b/src/main/ssh/ssh-relay-session-relay-loss.test.ts
index 9e70466ab31..5053426131d 100644
--- a/src/main/ssh/ssh-relay-session-relay-loss.test.ts
+++ b/src/main/ssh/ssh-relay-session-relay-loss.test.ts
@@ -232,6 +232,53 @@ describe('SshRelaySession relay loss during setup', () => {
     expect(unregisterSshFilesystemProvider).toHaveBeenCalledWith('target-1')
   })
 
+  // #13548 follow-up: cancelling the in-flight port scan emits rpc.cancel on the control
+  // lane, which a saturated writer turns into mux.dispose('connection_lost'). That fires
+  // during our own teardown, so it must not be reported as a lost relay.
+  it.each([
+    ['detach', (session: SshRelaySession) => session.beginShutdownDetach()],
+    ['dispose', (session: SshRelaySession) => session.dispose()]
+  ])(
+    'does not report relay loss when the port-scan cancel kills the mux on %s',
+    async (_path, teardown) => {
+      const { session, onRelayLost } = createSession()
+      // Mirrors SshChannelMultiplexer.request: an in-flight request whose signal aborts
+      // emits rpc.cancel, and the mock mux dies on that notify like a saturated writer.
+      muxRequestMock.mockImplementation(
+        async (method: string, _params?: unknown, options?: { signal?: AbortSignal }) => {
+          if (method !== 'ports.detect') {
+            return []
+          }
+          const mux = session.getMux() as unknown as {
+            failNotifyMethod: string | null
+            notify: (method: string, params?: unknown) => void
+          }
+          mux.failNotifyMethod = 'rpc.cancel'
+          return new Promise((_resolve, reject) => {
+            options?.signal?.addEventListener(
+              'abort',
+              () => {
+                mux.notify('rpc.cancel', { id: 1 })
+                reject(new Error('cancelled'))
+              },
+              { once: true }
+            )
+          })
+        }
+      )
+
+      await session.establish({} as SshConnection)
+      expect(session.getState()).toBe('ready')
+      expect(muxRequestMock).toHaveBeenCalledWith('ports.detect', undefined, expect.anything())
+      const mux = session.getMux() as unknown as { notify: ReturnType<typeof vi.fn> }
+
+      teardown(session)
+
+      expect(mux.notify).toHaveBeenCalledWith('rpc.cancel', { id: 1 })
+      expect(onRelayLost).not.toHaveBeenCalled()
+    }
+  )
+
   // #11953: reattachKnownPtys swallows every per-PTY failure, so a mux killed by the
   // reattach burst itself never reaches the catch — the post-reattach gate has to notice.
   it('routes a mux that dies during PTY reattach into relay-loss recovery', async () => {
diff --git a/src/main/ssh/ssh-relay-session.ts b/src/main/ssh/ssh-relay-session.ts
index 8cb6e642812..820eb7e1360 100644
--- a/src/main/ssh/ssh-relay-session.ts
+++ b/src/main/ssh/ssh-relay-session.ts
@@ -438,7 +438,7 @@ export class SshRelaySession {
   async requestAiVaultSessionList(
     params: SshAiVaultRelayListParams,
     options: { signal?: AbortSignal; timeoutMs?: number } = {}
-  ): Promise<unknown | null> {
+  ): Promise<unknown> {
     if (this.aiVaultListMethodSupported === false) {
       return null
     }
@@ -465,7 +465,7 @@ export class SshRelaySession {
   async requestAiVaultSessionTitles(
     params: SshAiVaultRelayTitleParams,
     options: { signal?: AbortSignal; timeoutMs?: number } = {}
-  ): Promise<unknown | null> {
+  ): Promise<unknown> {
     if (this.aiVaultTitleMethodSupported === false) {
       return null
     }
@@ -640,6 +640,7 @@ export class SshRelaySession {
       return
     }
 
+    this.releaseRelayLossWatcher()
     // Cancel any in-flight reconnect
     this.abortController?.abort()
     const abortController = new AbortController()
@@ -835,6 +836,7 @@ export class SshRelaySession {
   private runDisposal(pendingDetach: Promise<void> | null): Promise<void> {
     // Why: the whole in-memory half runs before any await so a concurrent connect can never observe
     // a half-torn session; only the durability barriers below are deferred onto the returned promise.
+    this.releaseRelayLossWatcher()
     this.abortController?.abort()
     this.stopPortScanning()
     this.broadcastEmptyLists()
@@ -908,6 +910,7 @@ export class SshRelaySession {
       return
     }
     detachSshPtyConsumerRecovery(this.targetId, this.ptyConsumerClientInstanceId)
+    this.releaseRelayLossWatcher()
     this.abortController?.abort()
     this.stopPortScanning()
     this.broadcastEmptyLists()
@@ -927,6 +930,7 @@ export class SshRelaySession {
       // step — a fast reconnect must reclaim this identity instead of minting one, even if a
       // teardown call below throws unexpectedly.
       detachSshPtyConsumerRecovery(this.targetId, this.ptyConsumerClientInstanceId)
+      this.releaseRelayLossWatcher()
       this.abortController?.abort()
       this.stopPortScanning()
       this.broadcastEmptyLists()
@@ -947,9 +951,21 @@ export class SshRelaySession {
 
   // ── Private ───────────────────────────────────────────────────────
 
+  // Why: teardown itself can kill the mux — an aborted request emits rpc.cancel, and a saturated
+  // control lane turns that admission failure into mux.dispose('connection_lost'). Every teardown
+  // path must release the watcher before its first mux write, or our own shutdown re-enters
+  // recovery as a spurious relay loss. teardownProviders is not early enough: stopPortScanning
+  // runs ahead of it and is what emits that frame. Call this ahead of abortController.abort()
+  // too — that signal reaches no mux request today, but plumbing it into one would otherwise
+  // reopen the same hole silently.
+  private releaseRelayLossWatcher(): void {
+    this.muxDisposeCleanup?.()
+    this.muxDisposeCleanup = null
+  }
+
   // Why: onStateChange only fires on SSH-level reconnects, so watch for relay-channel loss while SSH stays up and fire onRelayLost.
   private watchMuxForRelayLoss(mux: SshChannelMultiplexer): void {
-    this.muxDisposeCleanup?.()
+    this.releaseRelayLossWatcher()
     this.muxDisposeCleanup = mux.onDispose((reason) => {
       if (reason === 'connection_lost' && this.mux === mux && !this.isDisposed()) {
         console.warn(
@@ -1420,7 +1436,7 @@ export class SshRelaySession {
     })
   }
 
-  // Why: ship plugin/extension source from Orca so agent-event changes don't force a relay redeploy (agent-status-over-ssh.md §4/§8). Best-effort.
+  // Why: ship plugin/extension source from Orca so agent-event changes don't force a relay redeploy — the relay is versioned independently. Best-effort: failure only costs agent status on this host.
   private async installPluginsOnRelay(mux: SshChannelMultiplexer): Promise<void> {
     if (!isRemoteAgentHooksEnabled() || !this.areAgentStatusHooksEnabled()) {
       return
@@ -1497,7 +1513,7 @@ export class SshRelaySession {
       if (typeof envelope.paneKey !== 'string') {
         return
       }
-      // Why: forward env/version verbatim so cross-build warn-once diagnostics fire on remote events too (agent-status-over-ssh.md §3).
+      // Why: forward the agent CLI's env/version verbatim (not the relay's) so warn-once protocol-mismatch diagnostics fire for remote events too.
       agentHookServer.ingestRemote(
         {
           paneKey: envelope.paneKey,
@@ -1560,8 +1576,7 @@ export class SshRelaySession {
     reason: 'shutdown' | 'connection_lost',
     outputGenerationReason: string = reason
   ): void {
-    this.muxDisposeCleanup?.()
-    this.muxDisposeCleanup = null
+    this.releaseRelayLossWatcher()
     this.muxNotificationCleanup?.()
     this.muxNotificationCleanup = null
     for (const cleanup of this.ptyRecoveryNotificationCleanups) {
diff --git a/src/main/ssh/ssh-relay-versioned-install.test.ts b/src/main/ssh/ssh-relay-versioned-install.test.ts
index 23d57757b5b..482b0e8b113 100644
--- a/src/main/ssh/ssh-relay-versioned-install.test.ts
+++ b/src/main/ssh/ssh-relay-versioned-install.test.ts
@@ -134,6 +134,7 @@ describe('isRelayAlreadyInstalled', () => {
     const cmd = mockExec.mock.calls.at(-1)?.[1] ?? ''
     expect(cmd).toContain('relay.js')
     expect(cmd).toContain('relay-watcher.js')
+    expect(cmd).toContain('relay-ai-vault-service.js')
     expect(cmd).toContain('managed-hook-runtime.js')
     expect(cmd).toContain('.install-complete')
   })
diff --git a/src/main/ssh/ssh-remote-commands.test.ts b/src/main/ssh/ssh-remote-commands.test.ts
index 13a1e2e246a..18738a930c6 100644
--- a/src/main/ssh/ssh-remote-commands.test.ts
+++ b/src/main/ssh/ssh-remote-commands.test.ts
@@ -117,6 +117,7 @@ describe('ssh remote command builders', () => {
     const probe = probeRelayInstalledCommand(posix, '/home/me/relay')
     expect(probe).toContain('test -d')
     expect(probe).toContain('managed-hook-runtime.js')
+    expect(probe).toContain('relay-ai-vault-service.js')
   })
 
   it('uses encoded PowerShell for Windows deploy commands', () => {
@@ -127,6 +128,7 @@ describe('ssh remote command builders', () => {
     const probe = probeRelayInstalledCommand(windows, 'C:/Users/me/relay')
     expect(probe).toContain('-EncodedCommand')
     expect(decodePowerShellCommand(probe)).toContain('managed-hook-runtime.js')
+    expect(decodePowerShellCommand(probe)).toContain('relay-ai-vault-service.js')
   })
 
   it('uses a legacy-visible Windows lock directory with an exclusive owner file', () => {
diff --git a/src/main/ssh/ssh-remote-commands.ts b/src/main/ssh/ssh-remote-commands.ts
index 7cec0d027c2..603b6356a1f 100644
--- a/src/main/ssh/ssh-remote-commands.ts
+++ b/src/main/ssh/ssh-remote-commands.ts
@@ -91,6 +91,7 @@ export function probeRelayInstalledCommand(
 ): string {
   const relayJs = joinRemotePath(host, remoteRelayDir, 'relay.js')
   const relayWatcherJs = joinRemotePath(host, remoteRelayDir, 'relay-watcher.js')
+  const relayAiVaultServiceJs = joinRemotePath(host, remoteRelayDir, 'relay-ai-vault-service.js')
   const managedHookRuntimeJs = joinRemotePath(host, remoteRelayDir, 'managed-hook-runtime.js')
   const installComplete = joinRemotePath(host, remoteRelayDir, '.install-complete')
   if (!isWindowsRemoteHost(host)) {
@@ -98,6 +99,7 @@ export function probeRelayInstalledCommand(
       `test -d ${shellEscape(remoteRelayDir)} ` +
       `&& test -f ${shellEscape(relayJs)} ` +
       `&& test -f ${shellEscape(relayWatcherJs)} ` +
+      `&& test -f ${shellEscape(relayAiVaultServiceJs)} ` +
       `&& test -f ${shellEscape(managedHookRuntimeJs)} ` +
       `&& test -f ${shellEscape(installComplete)} ` +
       `&& echo OK || echo MISSING`
@@ -108,9 +110,10 @@ export function probeRelayInstalledCommand(
       `$dir = ${powerShellLiteral(remoteRelayDir)}`,
       `$relay = ${powerShellLiteral(relayJs)}`,
       `$watcher = ${powerShellLiteral(relayWatcherJs)}`,
+      `$aiVaultService = ${powerShellLiteral(relayAiVaultServiceJs)}`,
       `$managedHooks = ${powerShellLiteral(managedHookRuntimeJs)}`,
       `$complete = ${powerShellLiteral(installComplete)}`,
-      "if ((Test-Path -LiteralPath $dir -PathType Container) -and (Test-Path -LiteralPath $relay -PathType Leaf) -and (Test-Path -LiteralPath $watcher -PathType Leaf) -and (Test-Path -LiteralPath $managedHooks -PathType Leaf) -and (Test-Path -LiteralPath $complete -PathType Leaf)) { 'OK' } else { 'MISSING' }"
+      "if ((Test-Path -LiteralPath $dir -PathType Container) -and (Test-Path -LiteralPath $relay -PathType Leaf) -and (Test-Path -LiteralPath $watcher -PathType Leaf) -and (Test-Path -LiteralPath $aiVaultService -PathType Leaf) -and (Test-Path -LiteralPath $managedHooks -PathType Leaf) -and (Test-Path -LiteralPath $complete -PathType Leaf)) { 'OK' } else { 'MISSING' }"
     ].join('; ')
   )
 }
diff --git a/src/main/ssh/ssh-remote-node-toolchain-probe.ts b/src/main/ssh/ssh-remote-node-toolchain-probe.ts
index b1e0b8d544a..d6d7f1d7a06 100644
--- a/src/main/ssh/ssh-remote-node-toolchain-probe.ts
+++ b/src/main/ssh/ssh-remote-node-toolchain-probe.ts
@@ -50,7 +50,7 @@ export function nodeToolchainVersionsMeetRequirements(versionOutput: string): bo
 function markedVersionMajor(output: string, marker: string): number | null {
   const lines = output.split(/\r?\n/)
   const markerIndex = lines.indexOf(marker)
-  if (markerIndex < 0) {
+  if (markerIndex === -1) {
     return null
   }
   for (const line of lines.slice(markerIndex + 1)) {
diff --git a/src/main/ssh/ssh-system-transport.integration.test.ts b/src/main/ssh/ssh-system-transport.integration.test.ts
index be5ed622927..6199dfeef52 100644
--- a/src/main/ssh/ssh-system-transport.integration.test.ts
+++ b/src/main/ssh/ssh-system-transport.integration.test.ts
@@ -55,6 +55,7 @@ exec /bin/sh -c "$cmd"
 
 function writeFakeRelay(dir: string): void {
   writeFileSync(join(dir, 'relay-watcher.js'), '')
+  writeFileSync(join(dir, 'relay-ai-vault-service.js'), '')
   writeFileSync(join(dir, 'managed-hook-runtime.js'), '')
   writeFileSync(
     join(dir, 'relay.js'),
diff --git a/src/main/startup/configure-process.test.ts b/src/main/startup/configure-process.test.ts
index eaf9f42aeec..54ecdc61424 100644
--- a/src/main/startup/configure-process.test.ts
+++ b/src/main/startup/configure-process.test.ts
@@ -396,6 +396,46 @@ describe('configureElectronNetworkCompatibility', () => {
   })
 })
 
+describe('disableUnsupportedChromiumFeatures', () => {
+  it('disables FedCM before Chromium sessions are created', async () => {
+    const { app } = await import('electron')
+    const { disableUnsupportedChromiumFeatures } = await import('./configure-process')
+
+    vi.mocked(app.commandLine.appendSwitch).mockClear()
+    disableUnsupportedChromiumFeatures()
+
+    expect(app.commandLine.appendSwitch).toHaveBeenCalledWith('disable-features', 'FedCm')
+  })
+
+  it('preserves existing disabled Chromium features', async () => {
+    const { app } = await import('electron')
+    const { disableUnsupportedChromiumFeatures } = await import('./configure-process')
+
+    vi.mocked(app.commandLine.getSwitchValue).mockReturnValueOnce('ExistingFeature')
+    vi.mocked(app.commandLine.appendSwitch).mockClear()
+    disableUnsupportedChromiumFeatures()
+
+    expect(app.commandLine.appendSwitch).toHaveBeenCalledWith(
+      'disable-features',
+      'FedCm,ExistingFeature'
+    )
+  })
+
+  it('does not duplicate FedCM when disable-features already includes it', async () => {
+    const { app } = await import('electron')
+    const { disableUnsupportedChromiumFeatures } = await import('./configure-process')
+
+    vi.mocked(app.commandLine.getSwitchValue).mockReturnValueOnce('FedCm,ExistingFeature')
+    vi.mocked(app.commandLine.appendSwitch).mockClear()
+    disableUnsupportedChromiumFeatures()
+
+    expect(app.commandLine.appendSwitch).toHaveBeenCalledWith(
+      'disable-features',
+      'FedCm,ExistingFeature'
+    )
+  })
+})
+
 describe('enableMainProcessGpuFeatures', () => {
   const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')
   const originalE2EUserDataDir = process.env.ORCA_E2E_USER_DATA_DIR
diff --git a/src/main/startup/configure-process.ts b/src/main/startup/configure-process.ts
index e545d89da9c..e39963bc9f2 100644
--- a/src/main/startup/configure-process.ts
+++ b/src/main/startup/configure-process.ts
@@ -66,6 +66,20 @@ export function configureElectronNetworkCompatibility(
   app.commandLine.appendSwitch('disable-http2')
 }
 
+export function disableUnsupportedChromiumFeatures(): void {
+  appendDisabledChromiumFeatures(['FedCm'])
+}
+
+function appendDisabledChromiumFeatures(features: string[]): void {
+  const existingFeatures = app.commandLine
+    .getSwitchValue('disable-features')
+    .split(',')
+    .map((feature) => feature.trim())
+    .filter(Boolean)
+  const disabledFeatures = Array.from(new Set([...features, ...existingFeatures])).join(',')
+  app.commandLine.appendSwitch('disable-features', disabledFeatures)
+}
+
 function getProcessPathDelimiter(): string {
   return process.platform === 'win32' ? ';' : ':'
 }
@@ -300,11 +314,7 @@ export function enableMainProcessGpuFeatures(): void {
     app.commandLine.appendSwitch('enable-features', features)
   }
 
-  const existingDisabledFeatures = app.commandLine.getSwitchValue('disable-features')
   // Why: IntensiveWakeUpThrottling clamps hidden-page timers to 1/min after 5min, delaying agent-done/bell notifications ~60s.
   // This opt-out is skipped under GPU fallback (win32-only today); if throttling ever reaches Windows it must move out of this path.
-  const disabledFeatures = ['IntensiveWakeUpThrottling', existingDisabledFeatures]
-    .filter(Boolean)
-    .join(',')
-  app.commandLine.appendSwitch('disable-features', disabledFeatures)
+  appendDisabledChromiumFeatures(['IntensiveWakeUpThrottling'])
 }
diff --git a/src/main/startup/desktop-startup-ordering.test.ts b/src/main/startup/desktop-startup-ordering.test.ts
index 001bc5252d1..3e40b5e5f57 100644
--- a/src/main/startup/desktop-startup-ordering.test.ts
+++ b/src/main/startup/desktop-startup-ordering.test.ts
@@ -26,15 +26,20 @@ describe('startup ordering', () => {
     expect(attachBlock).toContain(
       'awaitLocalPtyProviderStartup: () => localPtyProviderStartupReady'
     )
-    expect(source).toContain('firstWindowStartupServicesReady = startupServices.firstWindowReady')
-    expect(source).toContain('localPtyStartupReady = startupServices.localPtyReady')
+    expect(source).toContain(
+      'firstWindowStartupServicesReady = services.then((value) => value.firstWindowReady)'
+    )
+    expect(source).toContain('localPtyStartupReady = services.then((value) => value.localPtyReady)')
 
-    const windowIndex = desktopStartup.indexOf('Promise.resolve(openMainWindow())')
+    const windowIndex = desktopStartup.indexOf('Promise.resolve(desktopWindow ?? openMainWindow())')
     const rpcStartIndex = desktopStartup.indexOf('desktopRuntimeRpc.start()')
     const legacyRpcStartIndex = desktopStartup.indexOf('runtimeRpc.start()')
 
     expect(windowIndex).toBeGreaterThanOrEqual(0)
     expect(Math.max(rpcStartIndex, legacyRpcStartIndex)).toBeGreaterThanOrEqual(0)
+    expect(desktopStartup).toMatch(
+      /shellPathReady\s*\.then\(\(\) => (?:desktopRuntimeRpc|runtimeRpc)\.start\(\)\)/
+    )
     expect(desktopStartup).toContain('recordRuntimeRpcStartFailure(')
     // Why: `void`, not `await` — awaiting the dialog would park the rest of startup behind a modal.
     expect(desktopStartup).toMatch(/void showRuntimeRpcStartupFailureDialog\(\s*win,/)
@@ -60,7 +65,7 @@ describe('startup ordering', () => {
   it('bounds WSL reconciliation before serve RPC while leaving desktop startup independent', () => {
     const source = readFileSync(join(process.cwd(), 'src/main/index.ts'), 'utf8')
     const barrierStart = source.indexOf("ipcMain.handle('app:awaitFirstWindowStartupServices'")
-    const barrierEnd = source.indexOf("ipcMain.handle(\n  'app:startupDiagnostic'", barrierStart)
+    const barrierEnd = source.indexOf("'app:startupDiagnostic'", barrierStart)
     const barrier = source.slice(barrierStart, barrierEnd)
     const reconciliationStart = source.indexOf(
       'managedWslCliReconciliationReady = reconcileManagedWslCliRegistrations('
@@ -68,22 +73,40 @@ describe('startup ordering', () => {
     const serveStart = source.indexOf('if (serveOptions) {', reconciliationStart)
     const serveReady = source.indexOf('await printServeReady(serveOptions)', serveStart)
     const serveEnd = source.indexOf('return', serveReady)
-    const desktopWindowStart = source.indexOf('Promise.resolve(openMainWindow())')
+    const desktopWindowStart = source.indexOf(
+      'const desktopStartup = startWindowsDesktopBeforeShellPathReady('
+    )
+    const desktopWindowJoin = source.indexOf(
+      'Promise.resolve(desktopWindow ?? openMainWindow())',
+      serveEnd
+    )
     const serveStartup = source.slice(serveStart, serveEnd)
-    const desktopStartup = source.slice(serveEnd, desktopWindowStart)
+    const desktopStartup = source.slice(reconciliationStart, serveStart)
 
+    expect(barrierStart).toBeGreaterThanOrEqual(0)
+    expect(barrierEnd).toBeGreaterThan(barrierStart)
     expect(reconciliationStart).toBeGreaterThanOrEqual(0)
     expect(serveStart).toBeGreaterThan(reconciliationStart)
     expect(serveEnd).toBeGreaterThan(serveStart)
     // Why: bound against serveEnd, not reconciliationStart — an earlier openMainWindow() call
     // would steal this anchor, collapse desktopStartup to '', and pass the negative check below.
-    expect(desktopWindowStart).toBeGreaterThan(serveEnd)
+    expect(desktopWindowStart).toBeGreaterThan(reconciliationStart)
+    expect(desktopWindowStart).toBeLessThan(serveStart)
+    expect(desktopWindowJoin).toBeGreaterThan(serveEnd)
     expect(serveStartup).toContain('await managedWslCliStartupBarrierReady')
     expect(serveStartup).not.toContain('await managedWslCliReconciliationReady')
     expect(serveStartup.indexOf('await managedWslCliStartupBarrierReady')).toBeLessThan(
       serveStartup.indexOf('await runtimeRpc.start()')
     )
     expect(desktopStartup).not.toContain('await managedWslCliReconciliationReady')
+    expect(desktopStartup).toContain(
+      "process.platform === 'win32' && app.isPackaged && !serveOptions"
+    )
+    expect(desktopStartup).toContain(
+      'openWindow: () => openMainWindow({ revealOnDidFinishLoad: true })'
+    )
+    expect(desktopStartup).toContain('shellPathReady,')
+    expect(desktopStartup).toContain('startServices: startTerminalRuntimeStartupServices')
     expect(barrier).toContain('managedWslCliStartupBarrierReady')
     expect(barrier).not.toContain('managedWslCliReconciliationReady')
     expect(barrier).toContain("ipcMain.handle('app:recoverLegacyWorkerTerminalsForRendererStartup'")
@@ -98,19 +121,29 @@ describe('startup ordering', () => {
   it('reconciles retained Codex homes after authoritative daemon inventory', () => {
     const source = readFileSync(join(process.cwd(), 'src/main/index.ts'), 'utf8')
     const daemonInitIndex = source.indexOf('await initDaemonPtyProvider(signal')
-    const routeGateIndex = source.indexOf(
-      'codexRuntimeHome?.isHostSystemDefaultRealHome()',
+    const retainedPaneGateIndex = source.indexOf(
+      'hasRecordedManagedHostCodexPane()',
       daemonInitIndex
     )
     const inventoryIndex = source.indexOf('await listLiveDaemonPtyIds()', daemonInitIndex)
     const reconciliation = 'codexRuntimeHome?.reconcileLegacySharedHomeForRetainedPanes()'
     const reconciliationIndex = source.indexOf(reconciliation, inventoryIndex)
+    const hookReconciliationIndex = source.indexOf(
+      'reconcileRetainedCodexHookHomes({',
+      inventoryIndex
+    )
     const serveIndex = source.indexOf('if (serveOptions) {', reconciliationIndex)
-    const desktopIndex = source.indexOf('Promise.resolve(openMainWindow())', serveIndex)
+    const desktopIndex = source.indexOf(
+      'Promise.resolve(desktopWindow ?? openMainWindow())',
+      serveIndex
+    )
 
     expect(daemonInitIndex).toBeGreaterThanOrEqual(0)
-    expect(routeGateIndex).toBeGreaterThan(daemonInitIndex)
-    expect(inventoryIndex).toBeGreaterThan(routeGateIndex)
+    expect(retainedPaneGateIndex).toBeGreaterThan(daemonInitIndex)
+    expect(inventoryIndex).toBeGreaterThan(daemonInitIndex)
+    expect(inventoryIndex).toBeGreaterThan(retainedPaneGateIndex)
+    expect(hookReconciliationIndex).toBeGreaterThan(inventoryIndex)
+    expect(hookReconciliationIndex).toBeLessThan(reconciliationIndex)
     expect(reconciliationIndex).toBeGreaterThan(inventoryIndex)
     expect(serveIndex).toBeGreaterThan(reconciliationIndex)
     expect(desktopIndex).toBeGreaterThan(serveIndex)
diff --git a/src/main/startup/hydrate-shell-path.test.ts b/src/main/startup/hydrate-shell-path.test.ts
index 316baad7280..f096dd03ed3 100644
--- a/src/main/startup/hydrate-shell-path.test.ts
+++ b/src/main/startup/hydrate-shell-path.test.ts
@@ -182,6 +182,10 @@ describe('hydrateShellPath', () => {
 describe('mergePathSegments', () => {
   const originalPath = process.env.PATH
 
+  beforeEach(() => {
+    _resetHydrateShellPathCache()
+  })
+
   afterEach(() => {
     if (originalPath === undefined) {
       delete process.env.PATH
diff --git a/src/main/startup/hydrate-shell-path.ts b/src/main/startup/hydrate-shell-path.ts
index 87747399615..38a16816507 100644
--- a/src/main/startup/hydrate-shell-path.ts
+++ b/src/main/startup/hydrate-shell-path.ts
@@ -2,6 +2,7 @@ import { spawn } from 'node:child_process'
 import { delimiter, win32 as pathWin32 } from 'node:path'
 import type { ShellHydrationFailureReason } from '../../shared/types'
 import { resolveWindowsShellStartupFamily } from '../../shared/windows-terminal-shell'
+import { WindowsShellPathOwnership, windowsPathSegmentKey } from './windows-shell-path-ownership'
 
 // Why: GUI-launched Electron can miss PATH entries added by shell profiles.
 // Tools installed into ~/.opencode/bin, ~/.cargo/bin, pyenv/volta/fnm
@@ -35,7 +36,7 @@ let configuredWindowsShell = 'powershell.exe'
 let configuredWindowsGitBashPath: string | null = null
 let configuredWindowsFallbackShell: string | null = null
 let windowsShellConfigurationVersion = 0
-const windowsIntroducedPathKeys = new Set<string>()
+const windowsPathOwnership = new WindowsShellPathOwnership()
 
 /** @internal - tests need a clean hydration cache between cases. */
 export function _resetHydrateShellPathCache(): void {
@@ -45,7 +46,7 @@ export function _resetHydrateShellPathCache(): void {
   configuredWindowsGitBashPath = null
   configuredWindowsFallbackShell = null
   windowsShellConfigurationVersion = 0
-  windowsIntroducedPathKeys.clear()
+  windowsPathOwnership.reset()
 }
 
 function pickShell(): string | null {
@@ -70,11 +71,11 @@ function pickShell(): string | null {
 function parseCapturedPath(stdout: string, pathDelimiter: string = delimiter): string[] {
   const cleaned = stdout.replace(ANSI_RE, '')
   const first = cleaned.indexOf(DELIMITER)
-  if (first < 0) {
+  if (first === -1) {
     return []
   }
   const second = cleaned.indexOf(DELIMITER, first + DELIMITER.length)
-  if (second < 0) {
+  if (second === -1) {
     return []
   }
   const value = cleaned.slice(first + DELIMITER.length, second).trim()
@@ -211,6 +212,9 @@ export function hydrateShellPath(options: HydrateOptions = {}): Promise<Hydratio
   const spawner = options.spawner ?? spawnShellAndReadPath
   const fallbackShell = options.shellOverride === undefined ? configuredWindowsFallbackShell : null
   const probe = probeQueue.then(async () => {
+    if (platform === 'win32') {
+      windowsPathOwnership.restore(process.env)
+    }
     const result = await spawner(shell)
     if (!result.ok && result.failureReason === 'spawn_error' && fallbackShell) {
       return spawner(fallbackShell)
@@ -248,7 +252,7 @@ export function configureWindowsShellPathHydration(
   ) {
     return
   }
-  clearWindowsIntroducedPathSegments()
+  windowsPathOwnership.restore(process.env)
   configuredWindowsShell = next
   configuredWindowsGitBashPath = gitBashPath
   configuredWindowsFallbackShell = fallbackShell
@@ -268,25 +272,6 @@ function uniquePathSegments(segments: string[], pathKey: (segment: string) => st
   })
 }
 
-function windowsPathKey(segment: string): string {
-  const normalized = pathWin32.normalize(segment)
-  const root = pathWin32.parse(normalized).root
-  const withoutTrailingSlash =
-    normalized.length > root.length ? normalized.replace(/[\\/]+$/, '') : normalized
-  return withoutTrailingSlash.toLowerCase()
-}
-
-function clearWindowsIntroducedPathSegments(): void {
-  if (process.platform !== 'win32' || windowsIntroducedPathKeys.size === 0) {
-    return
-  }
-  const currentSegments = (process.env.PATH ?? '').split(pathWin32.delimiter).filter(Boolean)
-  process.env.PATH = currentSegments
-    .filter((segment) => !windowsIntroducedPathKeys.has(windowsPathKey(segment)))
-    .join(pathWin32.delimiter)
-  windowsIntroducedPathKeys.clear()
-}
-
 /**
  * Promote shell-discovered PATH segments to the front of process.env.PATH,
  * preserving shell ordering and avoiding duplicates. Returns the segments that
@@ -296,11 +281,14 @@ export function mergePathSegments(segments: string[]): string[] {
   if (segments.length === 0) {
     return []
   }
-  const current = process.env.PATH ?? ''
+  if (process.platform === 'win32') {
+    windowsPathOwnership.restore(process.env)
+  }
+  const current = process.env.PATH ?? process.env.Path ?? ''
   const pathDelimiter = process.platform === 'win32' ? pathWin32.delimiter : delimiter
   const currentSegments = current.split(pathDelimiter).filter(Boolean)
   const pathKey =
-    process.platform === 'win32' ? windowsPathKey : (segment: string): string => segment
+    process.platform === 'win32' ? windowsPathSegmentKey : (segment: string): string => segment
   const shellSegments = uniquePathSegments(segments, pathKey)
   const shellSegmentSet = new Set(shellSegments.map(pathKey))
   const existing = new Set(currentSegments.map(pathKey))
@@ -316,11 +304,10 @@ export function mergePathSegments(segments: string[]): string[] {
   // Why: shell-provided entries must win over hardcoded packaged-app fallbacks.
   // A seeded fallback can point at a stale CLI while the user's shell resolves
   // a healthy one from the same directory list in a different order.
-  process.env.PATH = next
   if (process.platform === 'win32') {
-    for (const segment of added) {
-      windowsIntroducedPathKeys.add(windowsPathKey(segment))
-    }
+    windowsPathOwnership.apply(process.env, next)
+  } else {
+    process.env.PATH = next
   }
   return added
 }
diff --git a/src/main/startup/serve-desktop-activation-wiring.test.ts b/src/main/startup/serve-desktop-activation-wiring.test.ts
index d1cb5bfd2fb..239a7618567 100644
--- a/src/main/startup/serve-desktop-activation-wiring.test.ts
+++ b/src/main/startup/serve-desktop-activation-wiring.test.ts
@@ -16,7 +16,7 @@ describe('serve desktop activation wiring', () => {
   it('settles the persistent provider before headless PTY registration', () => {
     const appReadyIndex = source.indexOf('app.whenReady().then(async () => {')
     const startupIndex = source.indexOf(
-      '\n  startTerminalRuntimeStartupServices()\n',
+      'bindTerminalRuntimeStartupServices(Promise.resolve(startTerminalRuntimeStartupServices()))',
       appReadyIndex
     )
     const serveIndex = source.indexOf('if (serveOptions) {', appReadyIndex)
diff --git a/src/main/startup/windows-desktop-shell-path-startup.test.ts b/src/main/startup/windows-desktop-shell-path-startup.test.ts
new file mode 100644
index 00000000000..3778e0b2688
--- /dev/null
+++ b/src/main/startup/windows-desktop-shell-path-startup.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it, vi } from 'vitest'
+import { startWindowsDesktopBeforeShellPathReady } from './windows-desktop-shell-path-startup'
+
+function deferred(): { promise: Promise<void>; resolve: () => void } {
+  let resolve!: () => void
+  const promise = new Promise<void>((next) => {
+    resolve = next
+  })
+  return { promise, resolve }
+}
+
+describe('Windows desktop shell PATH startup', () => {
+  it('opens the first window while shell PATH hydration remains unresolved', async () => {
+    const shellPath = deferred()
+    const window = { visible: true }
+    const openWindow = vi.fn(() => window)
+    const startServices = vi.fn(() => ({
+      firstWindowReady: Promise.resolve(),
+      localPtyReady: Promise.resolve(),
+      localPtyProviderReady: Promise.resolve()
+    }))
+
+    const startup = startWindowsDesktopBeforeShellPathReady({
+      openWindow,
+      shellPathReady: shellPath.promise,
+      startServices
+    })
+
+    expect(startup.window).toBe(window)
+    expect(openWindow).toHaveBeenCalledOnce()
+    expect(startServices).not.toHaveBeenCalled()
+
+    shellPath.resolve()
+    await startup.services
+    expect(startServices).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/startup/windows-desktop-shell-path-startup.ts b/src/main/startup/windows-desktop-shell-path-startup.ts
new file mode 100644
index 00000000000..3933a79b64b
--- /dev/null
+++ b/src/main/startup/windows-desktop-shell-path-startup.ts
@@ -0,0 +1,18 @@
+export type WindowsDesktopStartupServices = {
+  firstWindowReady: Promise<void>
+  localPtyReady: Promise<void>
+  localPtyProviderReady: Promise<void>
+}
+
+type WindowsDesktopShellPathStartupOptions<TWindow> = {
+  openWindow: () => TWindow
+  shellPathReady: Promise<void>
+  startServices: () => WindowsDesktopStartupServices
+}
+
+export function startWindowsDesktopBeforeShellPathReady<TWindow>(
+  options: WindowsDesktopShellPathStartupOptions<TWindow>
+): { window: TWindow; services: Promise<WindowsDesktopStartupServices> } {
+  const services = options.shellPathReady.then(options.startServices)
+  return { window: options.openWindow(), services }
+}
diff --git a/src/main/startup/windows-shell-path-ownership.test.ts b/src/main/startup/windows-shell-path-ownership.test.ts
new file mode 100644
index 00000000000..e4e4b128d93
--- /dev/null
+++ b/src/main/startup/windows-shell-path-ownership.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest'
+import { WindowsShellPathOwnership, windowsPathSegmentKey } from './windows-shell-path-ownership'
+
+describe('Windows shell PATH ownership', () => {
+  it.each([
+    ['C:\\', 'c:\\'],
+    ['C:\\Tools\\', 'c:\\tools'],
+    ['c:/TOOLS', 'c:\\tools'],
+    ['\\\\Server\\Share\\', '\\\\server\\share\\'],
+    ['\\\\SERVER\\Share', '\\\\server\\share\\']
+  ])('normalizes %s to %s', (segment, expected) => {
+    expect(windowsPathSegmentKey(segment)).toBe(expected)
+  })
+
+  it.each(['PATH', 'Path'])(
+    'restores the complete %s baseline without changing its casing',
+    (key) => {
+      const env: Record<string, string | undefined> = {
+        [key]: 'C:\\B;c:\\b;C:\\;\\\\Server\\Share\\'
+      }
+      const ownership = new WindowsShellPathOwnership()
+      ownership.apply(env, 'C:\\Profile;C:\\B;C:\\;\\\\Server\\Share\\')
+
+      ownership.restore(env)
+
+      expect(env).toEqual({ [key]: 'C:\\B;c:\\b;C:\\;\\\\Server\\Share\\' })
+    }
+  )
+
+  it('preserves PATH entries appended outside shell hydration', () => {
+    const env = { Path: 'C:\\B;C:\\A' }
+    const ownership = new WindowsShellPathOwnership()
+    ownership.apply(env, 'C:\\Profile;C:\\A;C:\\B')
+    env.Path += ';C:\\NewlyInstalled'
+
+    ownership.restore(env)
+
+    expect(env.Path).toBe('C:\\B;C:\\A;C:\\NewlyInstalled')
+  })
+
+  it('updates the first effective key when both Windows casings exist', () => {
+    const env = { Path: 'C:\\B;C:\\A', PATH: 'C:\\ignored' }
+    const ownership = new WindowsShellPathOwnership()
+    ownership.apply(env, 'C:\\Profile;C:\\A;C:\\B')
+
+    ownership.restore(env)
+
+    expect(env).toEqual({ Path: 'C:\\B;C:\\A', PATH: 'C:\\ignored' })
+  })
+})
diff --git a/src/main/startup/windows-shell-path-ownership.ts b/src/main/startup/windows-shell-path-ownership.ts
new file mode 100644
index 00000000000..8a4d63ef02a
--- /dev/null
+++ b/src/main/startup/windows-shell-path-ownership.ts
@@ -0,0 +1,68 @@
+import { win32 as pathWin32 } from 'node:path'
+
+type PathEnvironment = Record<string, string | undefined>
+
+type AppliedWindowsPath = {
+  appliedValue: string
+  baselineValue: string
+  pathKey: string
+}
+
+function firstPathKey(env: PathEnvironment): string | undefined {
+  return Object.keys(env).find((key) => key.toLowerCase() === 'path' && env[key] !== undefined)
+}
+
+export function windowsPathSegmentKey(segment: string): string {
+  const normalized = pathWin32.normalize(segment)
+  const root = pathWin32.parse(normalized).root
+  const withoutTrailingSlash =
+    normalized.length > root.length ? normalized.replace(/[\\/]+$/, '') : normalized
+  return withoutTrailingSlash.toLowerCase()
+}
+
+function splitPath(pathValue: string): string[] {
+  return pathValue.split(pathWin32.delimiter).filter(Boolean)
+}
+
+function externalAdditions(application: AppliedWindowsPath, currentValue: string): string[] {
+  if (currentValue === application.appliedValue) {
+    return []
+  }
+  // Why: forced Windows preflight appends newly installed registry paths after hydration.
+  const appliedKeys = new Set(splitPath(application.appliedValue).map(windowsPathSegmentKey))
+  return splitPath(currentValue).filter(
+    (segment) => !appliedKeys.has(windowsPathSegmentKey(segment))
+  )
+}
+
+export class WindowsShellPathOwnership {
+  private application: AppliedWindowsPath | null = null
+
+  reset(): void {
+    this.application = null
+  }
+
+  restore(env: PathEnvironment): void {
+    const application = this.application
+    if (!application) {
+      return
+    }
+    const pathKey = firstPathKey(env) ?? application.pathKey
+    const currentValue = env[pathKey] ?? ''
+    const additions = externalAdditions(application, currentValue)
+    env[pathKey] = [application.baselineValue, ...additions]
+      .filter(Boolean)
+      .join(pathWin32.delimiter)
+    this.application = null
+  }
+
+  apply(env: PathEnvironment, value: string): void {
+    const pathKey = firstPathKey(env) ?? 'Path'
+    this.application = {
+      appliedValue: value,
+      baselineValue: env[pathKey] ?? '',
+      pathKey
+    }
+    env[pathKey] = value
+  }
+}
diff --git a/src/main/startup/windows-shell-path-restoration.windows.test.ts b/src/main/startup/windows-shell-path-restoration.windows.test.ts
new file mode 100644
index 00000000000..d612c3726eb
--- /dev/null
+++ b/src/main/startup/windows-shell-path-restoration.windows.test.ts
@@ -0,0 +1,165 @@
+import { spawnSync } from 'node:child_process'
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, win32 as pathWin32 } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  _resetHydrateShellPathCache,
+  configureWindowsShellPathHydration,
+  hydrateShellPath,
+  mergePathSegments,
+  type HydrationResult
+} from './hydrate-shell-path'
+import { createWindowsShellPathHydration } from './windows-shell-path-hydration'
+
+type Deferred<T> = {
+  promise: Promise<T>
+  resolve: (value: T) => void
+}
+
+function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((next) => {
+    resolve = next
+  })
+  return { promise, resolve }
+}
+
+function successfulHydration(segments: string[]): HydrationResult {
+  return { segments, ok: true, failureReason: 'none' }
+}
+
+function resolveProbe(pathValue: string): string {
+  const env: NodeJS.ProcessEnv = { ...process.env, PATH: pathValue, PATHEXT: '.CMD;.EXE' }
+  delete env.Path
+  const result = spawnSync(
+    process.env.ComSpec ?? 'C:\\Windows\\System32\\cmd.exe',
+    ['/d', '/s', '/c', 'orca-path-probe.cmd'],
+    { encoding: 'utf8', env }
+  )
+  expect(result.error).toBeUndefined()
+  expect(result.status).toBe(0)
+  return result.stdout.trim()
+}
+
+describe.runIf(process.platform === 'win32')('Windows shell PATH restoration', () => {
+  const originalPath = process.env.PATH
+  let fixtureRoot = ''
+  let shellADir = ''
+  let shellBDir = ''
+  let shellBProfileDir = ''
+
+  beforeEach(() => {
+    _resetHydrateShellPathCache()
+    fixtureRoot = mkdtempSync(join(tmpdir(), 'orca-shell-path-'))
+    shellADir = join(fixtureRoot, 'shell-a')
+    shellBDir = join(fixtureRoot, 'shell-b')
+    shellBProfileDir = join(fixtureRoot, 'shell-b-profile')
+    mkdirSync(shellADir)
+    mkdirSync(shellBDir)
+    mkdirSync(shellBProfileDir)
+    writeFileSync(join(shellADir, 'orca-path-probe.cmd'), '@echo shell-a\r\n')
+    writeFileSync(join(shellBDir, 'orca-path-probe.cmd'), '@echo shell-b\r\n')
+  })
+
+  afterEach(() => {
+    _resetHydrateShellPathCache()
+    if (originalPath === undefined) {
+      delete process.env.PATH
+    } else {
+      process.env.PATH = originalPath
+    }
+    rmSync(fixtureRoot, { force: true, recursive: true })
+  })
+
+  it('restores the inherited baseline before applying a different shell profile', () => {
+    const baseline = [shellBDir, shellADir]
+    process.env.PATH = baseline.join(pathWin32.delimiter)
+
+    mergePathSegments([shellADir, shellBDir])
+    expect(process.env.PATH?.split(pathWin32.delimiter)).toEqual([shellADir, shellBDir])
+    expect(resolveProbe(process.env.PATH ?? '')).toBe('shell-a')
+
+    configureWindowsShellPathHydration('git-bash', 'C:\\Git\\bin\\bash.exe')
+    const shellBOutput = [shellBProfileDir, ...(process.env.PATH ?? '').split(pathWin32.delimiter)]
+    mergePathSegments(shellBOutput)
+
+    expect({
+      path: process.env.PATH?.split(pathWin32.delimiter),
+      selectedExecutable: resolveProbe(process.env.PATH ?? '')
+    }).toEqual({
+      path: [shellBProfileDir, ...baseline],
+      selectedExecutable: 'shell-b'
+    })
+  })
+
+  it('generation-fences an active shell A probe before shell B inherits the baseline', async () => {
+    const baseline = [shellBDir, shellADir]
+    process.env.PATH = baseline.join(pathWin32.delimiter)
+    const shellAResult = deferred<HydrationResult>()
+    const hydrate = vi.fn<() => Promise<HydrationResult>>()
+    hydrate
+      .mockReturnValueOnce(shellAResult.promise)
+      .mockImplementationOnce(async () =>
+        successfulHydration([
+          shellBProfileDir,
+          ...(process.env.PATH ?? '').split(pathWin32.delimiter)
+        ])
+      )
+    const coordinator = createWindowsShellPathHydration({ hydrate })
+
+    const shellAReady = coordinator.hydrate('powershell.exe')
+    await vi.waitFor(() => expect(hydrate).toHaveBeenCalledOnce())
+    const shellBReady = coordinator.hydrate('git-bash')
+    shellAResult.resolve(successfulHydration([shellADir, shellBDir]))
+    await Promise.all([shellAReady, shellBReady])
+
+    expect(process.env.PATH?.split(pathWin32.delimiter)).toEqual([shellBProfileDir, ...baseline])
+    expect(resolveProbe(process.env.PATH ?? '')).toBe('shell-b')
+  })
+
+  it('preserves a newly installed PATH entry across shell changes', () => {
+    const baseline = [shellBDir, shellADir]
+    const installedDir = join(fixtureRoot, 'newly-installed')
+    process.env.PATH = baseline.join(pathWin32.delimiter)
+    mergePathSegments([shellADir, shellBDir])
+    process.env.PATH += `${pathWin32.delimiter}${installedDir}`
+
+    configureWindowsShellPathHydration('git-bash', 'C:\\Git\\bin\\bash.exe')
+    mergePathSegments([shellBProfileDir, ...(process.env.PATH ?? '').split(pathWin32.delimiter)])
+
+    expect(process.env.PATH?.split(pathWin32.delimiter)).toEqual([
+      shellBProfileDir,
+      ...baseline,
+      installedDir
+    ])
+  })
+
+  it.each(['cmd.exe', 'wsl.exe'])('restores the exact baseline before switching to %s', (shell) => {
+    const baseline = `${shellBDir};${shellBDir.toUpperCase()}\\;C:\\;\\\\Server\\Share\\`
+    process.env.PATH = baseline
+    mergePathSegments([shellADir, shellBDir])
+
+    configureWindowsShellPathHydration(shell)
+
+    expect(process.env.PATH).toBe(baseline)
+  })
+
+  it('restores the baseline before a forced same-shell probe', async () => {
+    const baseline = [shellBDir, shellADir].join(pathWin32.delimiter)
+    process.env.PATH = baseline
+    mergePathSegments([shellADir, shellBDir])
+    let inheritedPath = ''
+
+    await hydrateShellPath({
+      force: true,
+      spawner: async () => {
+        inheritedPath = process.env.PATH ?? ''
+        return { segments: [], ok: false, failureReason: 'empty_path' }
+      }
+    })
+
+    expect(inheritedPath).toBe(baseline)
+    expect(process.env.PATH).toBe(baseline)
+  })
+})
diff --git a/src/main/usage/usage-calendar-range.test.ts b/src/main/usage/usage-calendar-range.test.ts
new file mode 100644
index 00000000000..73645c2ccc1
--- /dev/null
+++ b/src/main/usage/usage-calendar-range.test.ts
@@ -0,0 +1,29 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getLocalUsageDay, getUsageRangeCutoff } from './usage-calendar-range'
+
+describe('usage calendar ranges', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date(2026, 3, 10, 12))
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it.each([
+    ['7d', '2026-04-04'],
+    ['30d', '2026-03-12'],
+    ['90d', '2026-01-11'],
+    ['all', null]
+  ] as const)('uses an inclusive local-calendar cutoff for %s', (range, expected) => {
+    expect(getUsageRangeCutoff(range)).toBe(expected)
+  })
+
+  it('maps timestamps to local calendar days and rejects invalid values', () => {
+    const localTimestamp = new Date(2026, 3, 4, 23, 30).toISOString()
+
+    expect(getLocalUsageDay(localTimestamp)).toBe('2026-04-04')
+    expect(getLocalUsageDay('not-a-date')).toBeNull()
+  })
+})
diff --git a/src/main/usage/usage-calendar-range.ts b/src/main/usage/usage-calendar-range.ts
new file mode 100644
index 00000000000..255ef245be5
--- /dev/null
+++ b/src/main/usage/usage-calendar-range.ts
@@ -0,0 +1,24 @@
+type UsageCalendarRange = '7d' | '30d' | '90d' | 'all'
+
+function formatLocalDay(date: Date): string {
+  const year = date.getFullYear()
+  const month = String(date.getMonth() + 1).padStart(2, '0')
+  const day = String(date.getDate()).padStart(2, '0')
+  return `${year}-${month}-${day}`
+}
+
+export function getUsageRangeCutoff(range: UsageCalendarRange): string | null {
+  if (range === 'all') {
+    return null
+  }
+  const days = range === '7d' ? 7 : range === '30d' ? 30 : 90
+  const cutoff = new Date()
+  cutoff.setHours(0, 0, 0, 0)
+  cutoff.setDate(cutoff.getDate() - (days - 1))
+  return formatLocalDay(cutoff)
+}
+
+export function getLocalUsageDay(timestamp: string): string | null {
+  const parsed = new Date(timestamp)
+  return Number.isNaN(parsed.getTime()) ? null : formatLocalDay(parsed)
+}
diff --git a/src/main/usage/usage-provider-store-lifecycle.test.ts b/src/main/usage/usage-provider-store-lifecycle.test.ts
new file mode 100644
index 00000000000..02a5571363d
--- /dev/null
+++ b/src/main/usage/usage-provider-store-lifecycle.test.ts
@@ -0,0 +1,293 @@
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import type * as FsPromises from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { UsageScanWorktreeRef } from './usage-provider-contract'
+import { UsageProviderStoreLifecycle } from './usage-provider-store-lifecycle'
+
+const { writeProbe } = vi.hoisted(() => ({
+  writeProbe: {
+    opens: 0,
+    renames: 0,
+    blocked: false,
+    waiters: [] as (() => void)[]
+  }
+}))
+
+vi.mock('node:fs/promises', async () => {
+  const actual = await vi.importActual<typeof FsPromises>('node:fs/promises')
+  return {
+    ...actual,
+    open: (async (...args: Parameters<typeof actual.open>) => {
+      if (args[1] === 'w') {
+        writeProbe.opens += 1
+        if (writeProbe.blocked) {
+          await new Promise<void>((resolve) => writeProbe.waiters.push(resolve))
+        }
+      }
+      return actual.open(...args)
+    }) as typeof actual.open,
+    rename: ((...args: Parameters<typeof actual.rename>) => {
+      writeProbe.renames += 1
+      return actual.rename(...args)
+    }) as typeof actual.rename
+  }
+})
+
+type TestSource = { id: string }
+type TestSession = { id: string }
+type TestDailyAggregate = { day: string }
+type TestScanState = {
+  enabled: boolean
+  lastScanStartedAt: number | null
+  lastScanCompletedAt: number | null
+  lastScanError: string | null
+}
+type TestState = {
+  schemaVersion: number
+  worktreeFingerprint: string | null
+  processedSources: TestSource[]
+  sessions: TestSession[]
+  dailyAggregates: TestDailyAggregate[]
+  scanState: TestScanState
+}
+type TestScanResult = Pick<TestState, 'processedSources' | 'sessions' | 'dailyAggregates'>
+type TestScan = (
+  worktrees: UsageScanWorktreeRef[],
+  previous: TestSource[]
+) => Promise<TestScanResult>
+
+const NOW = Date.parse('2026-04-10T16:00:00.000Z')
+const EMPTY_WORKTREE_FINGERPRINT = '[]'
+
+function makeState(
+  overrides: Partial<Omit<TestState, 'scanState'>> & { scanState?: Partial<TestScanState> } = {}
+): TestState {
+  const { scanState, ...stateOverrides } = overrides
+  return {
+    schemaVersion: 1,
+    worktreeFingerprint: null,
+    processedSources: [],
+    sessions: [],
+    dailyAggregates: [],
+    ...stateOverrides,
+    scanState: {
+      enabled: false,
+      lastScanStartedAt: null,
+      lastScanCompletedAt: null,
+      lastScanError: null,
+      ...scanState
+    }
+  }
+}
+
+function emptyScanResult(): TestScanResult {
+  return { processedSources: [], sessions: [], dailyAggregates: [] }
+}
+
+function createDeferred<T>(): { promise: Promise<T>; resolve: (value: T) => void } {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((promiseResolve) => {
+    resolve = promiseResolve
+  })
+  return { promise, resolve }
+}
+
+class TestUsageStore extends UsageProviderStoreLifecycle<
+  'processedSources',
+  TestState,
+  'hasAnyTestData'
+> {
+  constructor(cacheFile: string, scan: TestScan) {
+    super(
+      {
+        getRepos: () => [],
+        getAllWorktreeMeta: () => ({})
+      },
+      {
+        logTag: '[test-usage]',
+        resolveCacheFile: () => cacheFile,
+        createDefaultState: makeState,
+        normalizeState: (state) => state,
+        sourceKey: 'processedSources',
+        dataPresenceKey: 'hasAnyTestData',
+        scan
+      }
+    )
+  }
+
+  replaceState(state: TestState): void {
+    this.state = state
+  }
+
+  getState(): TestState {
+    return this.state
+  }
+}
+
+describe('UsageProviderStoreLifecycle', () => {
+  let tempDirectory: string
+  let stores: TestUsageStore[]
+  let scan: ReturnType<typeof vi.fn<TestScan>>
+
+  function createStore(
+    cacheFile = join(tempDirectory, `usage-${stores.length}.json`)
+  ): TestUsageStore {
+    const store = new TestUsageStore(cacheFile, scan)
+    stores.push(store)
+    return store
+  }
+
+  beforeEach(() => {
+    tempDirectory = mkdtempSync(join(tmpdir(), 'orca-usage-lifecycle-'))
+    stores = []
+    writeProbe.opens = 0
+    writeProbe.renames = 0
+    writeProbe.blocked = false
+    writeProbe.waiters = []
+    scan = vi.fn<TestScan>().mockResolvedValue(emptyScanResult())
+    vi.spyOn(Date, 'now').mockReturnValue(NOW)
+  })
+
+  afterEach(async () => {
+    await Promise.all(stores.map((store) => store.flush()))
+    rmSync(tempDirectory, { recursive: true, force: true })
+    vi.restoreAllMocks()
+  })
+
+  it('skips disabled and fresh matching states', async () => {
+    const store = createStore()
+
+    await store.refresh()
+    expect(scan).not.toHaveBeenCalled()
+
+    store.replaceState(
+      makeState({
+        worktreeFingerprint: EMPTY_WORKTREE_FINGERPRINT,
+        scanState: { enabled: true, lastScanCompletedAt: NOW - 1 }
+      })
+    )
+    await store.refresh()
+
+    expect(scan).not.toHaveBeenCalled()
+  })
+
+  it('invalidates prior sources on fingerprint changes and reuses them for forced scans', async () => {
+    const store = createStore()
+    const refreshedSources = [{ id: 'refreshed' }]
+    scan.mockResolvedValueOnce({
+      processedSources: refreshedSources,
+      sessions: [],
+      dailyAggregates: []
+    })
+    store.replaceState(
+      makeState({
+        worktreeFingerprint: 'outdated',
+        processedSources: [{ id: 'stale' }],
+        scanState: { enabled: true, lastScanCompletedAt: NOW - 1 }
+      })
+    )
+
+    await store.refresh()
+    expect(scan).toHaveBeenLastCalledWith([], [])
+
+    scan.mockClear()
+    await store.refresh(true)
+
+    expect(scan).toHaveBeenCalledWith([], refreshedSources)
+  })
+
+  it('shares one in-flight scan and exposes its live state', async () => {
+    const pendingScan = createDeferred<TestScanResult>()
+    scan.mockReturnValueOnce(pendingScan.promise)
+    const store = createStore()
+    store.replaceState(
+      makeState({ scanState: { enabled: true, lastScanError: 'previous failure' } })
+    )
+
+    const firstRefresh = store.refresh(true)
+    const secondRefresh = store.refresh(true)
+    await vi.waitFor(() => expect(scan).toHaveBeenCalledTimes(1))
+
+    expect(store.getScanState()).toMatchObject({
+      isScanning: true,
+      lastScanStartedAt: NOW,
+      lastScanError: null
+    })
+    expect(writeProbe.opens).toBe(0)
+
+    pendingScan.resolve({
+      processedSources: [{ id: 'source' }],
+      sessions: [{ id: 'session' }],
+      dailyAggregates: []
+    })
+    await Promise.all([firstRefresh, secondRefresh])
+
+    expect(store.getScanState()).toMatchObject({
+      isScanning: false,
+      lastScanCompletedAt: NOW,
+      hasAnyTestData: true
+    })
+    expect(writeProbe.opens).toBe(1)
+    expect(store.getState().processedSources).toEqual([{ id: 'source' }])
+  })
+
+  it('vetoes a superseded generation before rename', async () => {
+    const cacheFile = join(tempDirectory, 'usage-0.json')
+    const store = createStore()
+
+    writeProbe.blocked = true
+    const first = store.setEnabled(true)
+    await vi.waitFor(() => expect(writeProbe.waiters).toHaveLength(1))
+    const second = store.setEnabled(false)
+    writeProbe.blocked = false
+    writeProbe.waiters.splice(0).forEach((resolve) => resolve())
+    await Promise.all([first, second])
+
+    expect(writeProbe.opens).toBe(2)
+    expect(writeProbe.renames).toBe(1)
+    expect(JSON.parse(readFileSync(cacheFile, 'utf-8')).scanState.enabled).toBe(false)
+    expect(readdirSync(tempDirectory).filter((name) => name.endsWith('.tmp'))).toHaveLength(0)
+  })
+
+  it('sweeps a temp file orphaned before rename', async () => {
+    const cacheFile = join(tempDirectory, 'orphaned-usage.json')
+    const orphan = `${cacheFile}.${process.pid + 1}.1.test.tmp`
+    writeFileSync(orphan, '{}')
+
+    createStore(cacheFile)
+
+    await vi.waitFor(() => expect(existsSync(orphan)).toBe(false))
+  })
+
+  it('retains the last successful projection when a scan fails', async () => {
+    const cacheFile = join(tempDirectory, 'usage-0.json')
+    const store = createStore()
+    const previousState = makeState({
+      worktreeFingerprint: EMPTY_WORKTREE_FINGERPRINT,
+      processedSources: [{ id: 'source' }],
+      sessions: [{ id: 'session' }],
+      dailyAggregates: [{ day: '2026-04-09' }],
+      scanState: { enabled: true, lastScanCompletedAt: NOW - 1_000 }
+    })
+    store.replaceState(previousState)
+    scan.mockRejectedValueOnce(new Error('scan exploded'))
+
+    await expect(store.refresh(true)).resolves.toMatchObject({
+      isScanning: false,
+      lastScanCompletedAt: NOW - 1_000,
+      lastScanError: 'scan exploded'
+    })
+
+    expect(store.getState()).toMatchObject({
+      worktreeFingerprint: EMPTY_WORKTREE_FINGERPRINT,
+      processedSources: previousState.processedSources,
+      sessions: previousState.sessions,
+      dailyAggregates: previousState.dailyAggregates
+    })
+    expect(JSON.parse(readFileSync(cacheFile, 'utf-8')).scanState.lastScanError).toBe(
+      'scan exploded'
+    )
+  })
+})
diff --git a/src/main/usage/usage-provider-store-lifecycle.ts b/src/main/usage/usage-provider-store-lifecycle.ts
new file mode 100644
index 00000000000..850d9e61bda
--- /dev/null
+++ b/src/main/usage/usage-provider-store-lifecycle.ts
@@ -0,0 +1,170 @@
+import { existsSync, readFileSync } from 'node:fs'
+import type { Store } from '../persistence'
+import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
+import { loadKnownUsageWorktreesByRepo } from '../usage-worktree-metadata'
+import type { UsageScanWorktreeRef } from './usage-provider-contract'
+import { createWorktreeRefs, getUsageWorktreeFingerprint } from './usage-worktree-refs'
+
+const STALE_MS = 5 * 60_000
+
+type UsageProviderScanState = {
+  enabled: boolean
+  lastScanStartedAt: number | null
+  lastScanCompletedAt: number | null
+  lastScanError: string | null
+}
+
+type UsageProviderStoreState<SourceKey extends string> = {
+  worktreeFingerprint: string | null
+  sessions: unknown[]
+  dailyAggregates: unknown[]
+  scanState: UsageProviderScanState
+} & Record<SourceKey, unknown[]>
+
+type UsageProviderScanProjection<
+  SourceKey extends string,
+  State extends UsageProviderStoreState<SourceKey>
+> = Pick<State, SourceKey | 'sessions' | 'dailyAggregates'>
+
+type UsageProviderStoreLifecycleConfig<
+  SourceKey extends string,
+  State extends UsageProviderStoreState<SourceKey>,
+  DataPresenceKey extends string
+> = {
+  logTag: string
+  resolveCacheFile: () => string
+  createDefaultState: () => State
+  normalizeState: (state: State) => State
+  sourceKey: SourceKey
+  dataPresenceKey: DataPresenceKey
+  jsonIndent?: number
+  scan: (
+    worktrees: UsageScanWorktreeRef[],
+    previous: State[SourceKey]
+  ) => Promise<UsageProviderScanProjection<SourceKey, State>>
+}
+
+type PublicUsageProviderScanState<DataPresenceKey extends string> = UsageProviderScanState & {
+  isScanning: boolean
+} & Record<DataPresenceKey, boolean>
+
+export abstract class UsageProviderStoreLifecycle<
+  SourceKey extends string,
+  State extends UsageProviderStoreState<SourceKey>,
+  DataPresenceKey extends string
+> {
+  protected state: State
+  private scanPromise: Promise<void> | null = null
+  private readonly writer: UsageCacheSnapshotWriter
+
+  constructor(
+    private readonly store: Pick<Store, 'getRepos' | 'getAllWorktreeMeta'>,
+    private readonly config: UsageProviderStoreLifecycleConfig<SourceKey, State, DataPresenceKey>
+  ) {
+    this.writer = new UsageCacheSnapshotWriter(config.logTag, config.resolveCacheFile)
+    this.state = this.load()
+  }
+
+  getScanState(): PublicUsageProviderScanState<DataPresenceKey> {
+    return {
+      ...this.state.scanState,
+      isScanning: this.scanPromise !== null,
+      [this.config.dataPresenceKey]:
+        this.state.sessions.length > 0 || this.state.dailyAggregates.length > 0
+    } as PublicUsageProviderScanState<DataPresenceKey>
+  }
+
+  /** Await queued cache writes so quit does not drop the final snapshot. */
+  flush(): Promise<void> {
+    return this.writer.flush()
+  }
+
+  async setEnabled(enabled: boolean): Promise<PublicUsageProviderScanState<DataPresenceKey>> {
+    this.state.scanState.enabled = enabled
+    await this.writeToDisk()
+    return this.getScanState()
+  }
+
+  async refresh(force = false): Promise<PublicUsageProviderScanState<DataPresenceKey>> {
+    if (!this.state.scanState.enabled) {
+      return this.getScanState()
+    }
+    const currentWorktreeFingerprint = await this.getCurrentWorktreeFingerprint()
+    if (!force && this.state.scanState.lastScanCompletedAt) {
+      const ageMs = Date.now() - this.state.scanState.lastScanCompletedAt
+      if (ageMs < STALE_MS && this.state.worktreeFingerprint === currentWorktreeFingerprint) {
+        return this.getScanState()
+      }
+    }
+    await this.runScan()
+    return this.getScanState()
+  }
+
+  protected writeToDisk(): Promise<void> {
+    return this.writer.write(() => JSON.stringify(this.state, null, this.config.jsonIndent))
+  }
+
+  private load(): State {
+    const defaults = this.config.createDefaultState()
+    try {
+      const cacheFile = this.config.resolveCacheFile()
+      if (!existsSync(cacheFile)) {
+        return defaults
+      }
+      const parsed = JSON.parse(readFileSync(cacheFile, 'utf-8')) as State
+      return this.config.normalizeState({
+        ...defaults,
+        ...parsed,
+        scanState: { ...defaults.scanState, ...parsed.scanState }
+      })
+    } catch (error) {
+      console.error(`${this.config.logTag} Failed to load persisted state, starting fresh:`, error)
+      return defaults
+    }
+  }
+
+  private async runScan(): Promise<void> {
+    if (this.scanPromise) {
+      await this.scanPromise
+      return
+    }
+
+    this.state.scanState.lastScanStartedAt = Date.now()
+    this.state.scanState.lastScanError = null
+
+    // Assign before yielding so concurrent refreshes share one scan.
+    this.scanPromise = (async () => {
+      try {
+        const repos = this.store.getRepos()
+        const worktreesByRepo = loadKnownUsageWorktreesByRepo(this.store, repos)
+        const worktreeFingerprint = getUsageWorktreeFingerprint(worktreesByRepo)
+        const result = await this.config.scan(
+          createWorktreeRefs(repos, worktreesByRepo),
+          this.state.worktreeFingerprint === worktreeFingerprint
+            ? this.state[this.config.sourceKey]
+            : this.config.createDefaultState()[this.config.sourceKey]
+        )
+        this.state[this.config.sourceKey] = result[this.config.sourceKey]
+        this.state.sessions = result.sessions
+        this.state.dailyAggregates = result.dailyAggregates
+        this.state.worktreeFingerprint = worktreeFingerprint
+        this.state.scanState.lastScanCompletedAt = Date.now()
+        this.state.scanState.lastScanError = null
+        // Persistence failures do not turn a successful source scan into a scan failure.
+        await this.writeToDisk().catch(() => {})
+      } catch (error) {
+        this.state.scanState.lastScanError = error instanceof Error ? error.message : String(error)
+        await this.writeToDisk().catch(() => {})
+      } finally {
+        this.scanPromise = null
+      }
+    })()
+
+    await this.scanPromise
+  }
+
+  private async getCurrentWorktreeFingerprint(): Promise<string> {
+    const repos = this.store.getRepos()
+    return getUsageWorktreeFingerprint(loadKnownUsageWorktreesByRepo(this.store, repos))
+  }
+}
diff --git a/src/main/usage/usage-worktree-refs.test.ts b/src/main/usage/usage-worktree-refs.test.ts
new file mode 100644
index 00000000000..56efe7e4fb8
--- /dev/null
+++ b/src/main/usage/usage-worktree-refs.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest'
+import type { UsageWorktreeRef } from '../usage-worktree-metadata'
+import { getUsageWorktreeFingerprint } from './usage-worktree-refs'
+
+function worktree(worktreeId: string, path: string, displayName: string): UsageWorktreeRef {
+  return { worktreeId, path, displayName }
+}
+
+describe('getUsageWorktreeFingerprint', () => {
+  it('is stable across repo and worktree ordering but changes with identity metadata', () => {
+    const first = new Map<string, UsageWorktreeRef[]>([
+      [
+        'repo-b',
+        [
+          worktree('repo-b::/repo/b-two', '/repo/b-two', 'B Two'),
+          worktree('repo-b::/repo/b-one', '/repo/b-one', 'B One')
+        ]
+      ],
+      ['repo-a', [worktree('repo-a::/repo/a', '/repo/a', 'A')]]
+    ])
+    const reordered = new Map<string, UsageWorktreeRef[]>([
+      ['repo-a', [worktree('repo-a::/repo/a', '/repo/a', 'A')]],
+      [
+        'repo-b',
+        [
+          worktree('repo-b::/repo/b-one', '/repo/b-one', 'B One'),
+          worktree('repo-b::/repo/b-two', '/repo/b-two', 'B Two')
+        ]
+      ]
+    ])
+    const renamed = new Map(reordered)
+    renamed.set('repo-a', [worktree('repo-a::/repo/a', '/repo/a', 'Renamed A')])
+
+    expect(getUsageWorktreeFingerprint(first)).toBe(getUsageWorktreeFingerprint(reordered))
+    expect(getUsageWorktreeFingerprint(renamed)).not.toBe(getUsageWorktreeFingerprint(first))
+  })
+})
diff --git a/src/main/usage/usage-worktree-refs.ts b/src/main/usage/usage-worktree-refs.ts
index 0b4347a90a5..f76ed7c0a58 100644
--- a/src/main/usage/usage-worktree-refs.ts
+++ b/src/main/usage/usage-worktree-refs.ts
@@ -1,6 +1,25 @@
 import type { Repo } from '../../shared/types'
+import type { UsageWorktreeRef } from '../usage-worktree-metadata'
 import type { UsageScanWorktreeRef } from './usage-provider-contract'
 
+export function getUsageWorktreeFingerprint(
+  worktreesByRepo: Map<string, UsageWorktreeRef[]>
+): string {
+  const rows = [...worktreesByRepo.entries()]
+    .flatMap(([repoId, worktrees]) =>
+      worktrees.map((worktree) =>
+        JSON.stringify({
+          repoId,
+          worktreeId: worktree.worktreeId,
+          path: worktree.path,
+          displayName: worktree.displayName
+        })
+      )
+    )
+    .sort()
+  return JSON.stringify(rows)
+}
+
 export function createWorktreeRefs(
   repos: Repo[],
   worktreesByRepo: Map<string, { path: string; worktreeId: string; displayName: string }[]>
diff --git a/src/main/warp-themes/discovery.ts b/src/main/warp-themes/discovery.ts
index 6f3f80b51da..fd29419c12c 100644
--- a/src/main/warp-themes/discovery.ts
+++ b/src/main/warp-themes/discovery.ts
@@ -142,7 +142,7 @@ export function getWarpThemeDirectories(): string[] {
 export function warpThemeSourceLabelForDirectory(directoryPath: string): string {
   const parts = directoryPath.split(/[\\/]+/).filter(Boolean)
   const themesIndex = parts.findLastIndex((part) => part.toLowerCase() === 'themes')
-  if (themesIndex < 0) {
+  if (themesIndex === -1) {
     return parts.at(-1) || 'Warp themes'
   }
 
diff --git a/src/main/window/clipboard-dashboard-popout-access.test.ts b/src/main/window/clipboard-dashboard-popout-access.test.ts
index 2fd1ca680e2..df91e29a2ed 100644
--- a/src/main/window/clipboard-dashboard-popout-access.test.ts
+++ b/src/main/window/clipboard-dashboard-popout-access.test.ts
@@ -39,6 +39,7 @@ vi.mock('electron', () => ({
 vi.mock('./dashboard-popout-window', () => ({ isDashboardPopoutRenderer }))
 vi.mock('./clipboard-remote-file-copy', () => ({
   cleanupExpiredRemoteClipboardFiles: vi.fn(async () => undefined),
+  scheduleLegacyRemoteClipboardFileCleanup: vi.fn(),
   writeRemoteFileToClipboard: vi.fn()
 }))
 
diff --git a/src/main/window/clipboard-ipc-handlers.test.ts b/src/main/window/clipboard-ipc-handlers.test.ts
index b1da7e9e226..e12f7d633db 100644
--- a/src/main/window/clipboard-ipc-handlers.test.ts
+++ b/src/main/window/clipboard-ipc-handlers.test.ts
@@ -12,6 +12,8 @@ const {
   spawnMock,
   childStdinEndMock,
   resolveAuthorizedPathMock,
+  fsAccessMock,
+  fsLstatMock,
   fsMkdirMock,
   fsOpendirMock,
   fsRmMock,
@@ -45,6 +47,8 @@ const {
     return child
   }),
   resolveAuthorizedPathMock: vi.fn(),
+  fsAccessMock: vi.fn(),
+  fsLstatMock: vi.fn(),
   fsMkdirMock: vi.fn(),
   fsOpendirMock: vi.fn(),
   fsRmMock: vi.fn(),
@@ -68,11 +72,14 @@ vi.mock('node:child_process', () => ({
 }))
 
 vi.mock('node:fs/promises', () => ({
+  access: fsAccessMock,
+  lstat: fsLstatMock,
   mkdir: fsMkdirMock,
   opendir: fsOpendirMock,
   rm: fsRmMock,
   open: fsOpenMock,
   stat: fsStatMock,
+  writeFile: fsWriteFileMock,
   default: {
     writeFile: fsWriteFileMock
   }
@@ -134,6 +141,11 @@ import {
   setTrustedClipboardRendererWebContentsId
 } from './clipboard-ipc-handlers'
 
+const REMOTE_CLIPBOARD_STAGING_ROOT = join(
+  '/tmp',
+  `orca-clipboard-files${typeof process.getuid === 'function' ? `-${process.getuid()}` : ''}`
+)
+
 function getRegisteredHandlers(): Map<string, (...args: unknown[]) => unknown> {
   const handlers = new Map<string, (...args: unknown[]) => unknown>()
   for (const [channel, handler] of handleMock.mock.calls as [
@@ -187,6 +199,13 @@ describe('registerClipboardHandlers', () => {
     childStdinEndMock.mockClear()
     resolveAuthorizedPathMock.mockReset()
     resolveAuthorizedPathMock.mockImplementation(async (path: string) => path)
+    fsLstatMock.mockReset()
+    fsLstatMock.mockResolvedValue({
+      isDirectory: () => true,
+      isSymbolicLink: () => false,
+      mode: 0o700,
+      uid: typeof process.getuid === 'function' ? process.getuid() : 0
+    })
     fsMkdirMock.mockReset()
     fsMkdirMock.mockResolvedValue(undefined)
     fsOpendirMock.mockReset()
@@ -316,8 +335,8 @@ describe('registerClipboardHandlers', () => {
 
     const handlers = getRegisteredHandlers()
     const tempDir = join(
-      '/tmp',
-      'orca-clipboard-file-1760000000000-00000000-0000-4000-8000-000000000000'
+      REMOTE_CLIPBOARD_STAGING_ROOT,
+      '1760000000000-00000000-0000-4000-8000-000000000000'
     )
     const tempPath = join(tempDir, 'report.pdf')
 
@@ -329,6 +348,10 @@ describe('registerClipboardHandlers', () => {
     ).resolves.toEqual({ ok: true })
 
     expect(provider.stat).toHaveBeenCalledWith('/remote/report.pdf')
+    expect(fsMkdirMock).toHaveBeenCalledWith(REMOTE_CLIPBOARD_STAGING_ROOT, {
+      recursive: true,
+      mode: 0o700
+    })
     expect(fsMkdirMock).toHaveBeenCalledWith(tempDir, { mode: 0o700 })
     expect(provider.downloadFile).toHaveBeenCalledWith('/remote/report.pdf', tempPath)
     expect(fsStatMock).toHaveBeenCalledWith(tempPath)
@@ -353,7 +376,6 @@ describe('registerClipboardHandlers', () => {
     ).resolves.toEqual({ ok: false, reason: 'is-directory' })
 
     expect(provider.downloadFile).not.toHaveBeenCalled()
-    expect(fsMkdirMock).not.toHaveBeenCalled()
     expect(clipboardWriteBufferMock).not.toHaveBeenCalled()
   })
 
@@ -367,8 +389,8 @@ describe('registerClipboardHandlers', () => {
 
     const handlers = getRegisteredHandlers()
     const tempDir = join(
-      '/tmp',
-      'orca-clipboard-file-1760000000000-00000000-0000-4000-8000-000000000000'
+      REMOTE_CLIPBOARD_STAGING_ROOT,
+      '1760000000000-00000000-0000-4000-8000-000000000000'
     )
     const tempPath = join(tempDir, 'report.pdf')
 
@@ -380,7 +402,12 @@ describe('registerClipboardHandlers', () => {
     ).rejects.toThrow('transfer failed')
 
     expect(provider.downloadFile).toHaveBeenCalledWith('/remote/report.pdf', tempPath)
-    expect(fsRmMock).toHaveBeenCalledWith(tempDir, { recursive: true, force: true })
+    expect(fsRmMock).toHaveBeenCalledWith(tempDir, {
+      recursive: true,
+      force: true,
+      maxRetries: 3,
+      retryDelay: 100
+    })
     expect(clipboardWriteBufferMock).not.toHaveBeenCalled()
   })
 
diff --git a/src/main/window/clipboard-ipc-handlers.ts b/src/main/window/clipboard-ipc-handlers.ts
index 275c0e26240..450c6a6e140 100644
--- a/src/main/window/clipboard-ipc-handlers.ts
+++ b/src/main/window/clipboard-ipc-handlers.ts
@@ -31,6 +31,7 @@ import {
 } from './clipboard-file-copy'
 import {
   cleanupExpiredRemoteClipboardFiles,
+  scheduleLegacyRemoteClipboardFileCleanup,
   writeRemoteFileToClipboard
 } from './clipboard-remote-file-copy'
 import { saveClipboardImageBufferInRuntime } from './clipboard-runtime-image-upload'
@@ -85,6 +86,7 @@ export function registerClipboardHandlers(store: Store): void {
   ipcMain.removeHandler('clipboard:saveImageAsTempFile')
 
   void cleanupExpiredRemoteClipboardFiles()
+  scheduleLegacyRemoteClipboardFileCleanup()
 
   ipcMain.handle('clipboard:readText', async (event, options?: ReadClipboardTextOptions) => {
     assertTrustedClipboardTextSender(event)
diff --git a/src/main/window/clipboard-remote-file-cleanup.bench.test.ts b/src/main/window/clipboard-remote-file-cleanup.bench.test.ts
new file mode 100644
index 00000000000..5e671930af3
--- /dev/null
+++ b/src/main/window/clipboard-remote-file-cleanup.bench.test.ts
@@ -0,0 +1,147 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { access, mkdir, mkdtemp, opendir, readdir, rm, utimes, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import {
+  cleanupExpiredRemoteClipboardStaging,
+  createRemoteClipboardTransferDirectory
+} from './clipboard-remote-file-staging'
+
+const BENCH_ENABLED = process.env.ORCA_CLIPBOARD_CLEANUP_BENCH === '1'
+const FOREIGN_ENTRY_COUNT = Number(process.env.ORCA_CLIPBOARD_CLEANUP_BENCH_ENTRIES ?? 100_000)
+const WARMUP_RUNS = 3
+const SAMPLE_RUNS_PER_ARM = 24
+const FIXTURE_PREFIX = 'orca-clipboard-cleanup-bench-'
+const NOW_MS = 1_760_000_000_000
+
+describe.skipIf(!BENCH_ENABLED)('remote clipboard cleanup benchmark', () => {
+  let fixtureRoot = ''
+  let freshTransfer = ''
+
+  beforeAll(async () => {
+    fixtureRoot = await mkdtemp(join(tmpdir(), FIXTURE_PREFIX))
+    await createForeignEntries(fixtureRoot, FOREIGN_ENTRY_COUNT)
+    const expiredTransfer = await createRemoteClipboardTransferDirectory(
+      fixtureRoot,
+      NOW_MS - 2 * 60 * 60 * 1000,
+      '00000000-0000-4000-8000-000000000000'
+    )
+    freshTransfer = await createRemoteClipboardTransferDirectory(
+      fixtureRoot,
+      NOW_MS,
+      '00000000-0000-4000-8000-000000000001'
+    )
+    const expiredAt = new Date(NOW_MS - 2 * 60 * 60 * 1000)
+    await utimes(expiredTransfer, expiredAt, expiredAt)
+    await cleanupExpiredRemoteClipboardStaging(fixtureRoot, NOW_MS)
+
+    await expect(access(expiredTransfer)).rejects.toMatchObject({ code: 'ENOENT' })
+    await expect(access(freshTransfer)).resolves.toBeUndefined()
+    expect(await countForeignEntries(fixtureRoot)).toBe(FOREIGN_ENTRY_COUNT)
+  }, 900_000)
+
+  afterAll(async () => {
+    if (
+      fixtureRoot &&
+      dirname(fixtureRoot) === tmpdir() &&
+      basename(fixtureRoot).startsWith(FIXTURE_PREFIX)
+    ) {
+      await rm(fixtureRoot, {
+        recursive: true,
+        force: true,
+        maxRetries: 3,
+        retryDelay: 100
+      })
+    }
+  }, 900_000)
+
+  it('reports shared-root and owned-parent median and p95', async () => {
+    for (let index = 0; index < WARMUP_RUNS; index += 1) {
+      await scanSharedTempRoot(fixtureRoot)
+      await cleanupExpiredRemoteClipboardStaging(fixtureRoot, NOW_MS)
+    }
+
+    const samples = { ownedParent: [] as number[], sharedRoot: [] as number[] }
+    const launchPositions = {
+      ownedParent: [0, 0],
+      sharedRoot: [0, 0]
+    }
+    for (let index = 0; index < SAMPLE_RUNS_PER_ARM; index += 1) {
+      const order =
+        index % 2 === 0
+          ? (['sharedRoot', 'ownedParent'] as const)
+          : (['ownedParent', 'sharedRoot'] as const)
+      for (const [position, arm] of order.entries()) {
+        launchPositions[arm][position] += 1
+        samples[arm].push(
+          await measure(() =>
+            arm === 'sharedRoot'
+              ? scanSharedTempRoot(fixtureRoot)
+              : cleanupExpiredRemoteClipboardStaging(fixtureRoot, NOW_MS)
+          )
+        )
+      }
+    }
+
+    expect(launchPositions).toEqual({
+      ownedParent: [SAMPLE_RUNS_PER_ARM / 2, SAMPLE_RUNS_PER_ARM / 2],
+      sharedRoot: [SAMPLE_RUNS_PER_ARM / 2, SAMPLE_RUNS_PER_ARM / 2]
+    })
+    expect(samples.ownedParent).toHaveLength(SAMPLE_RUNS_PER_ARM)
+    expect(samples.sharedRoot).toHaveLength(SAMPLE_RUNS_PER_ARM)
+    expect(await countForeignEntries(fixtureRoot)).toBe(FOREIGN_ENTRY_COUNT)
+    await expect(access(freshTransfer)).resolves.toBeUndefined()
+    const sharedRoot = summarize(samples.sharedRoot)
+    const ownedParent = summarize(samples.ownedParent)
+    console.log('correctness=pass')
+    console.log(
+      `sampling=ABBA positions-per-arm=${SAMPLE_RUNS_PER_ARM / 2}/${SAMPLE_RUNS_PER_ARM / 2} p95-order-drift<=1-slot`
+    )
+    console.log(`post12917-shared-root median=${sharedRoot.median}ms p95=${sharedRoot.p95}ms`)
+    console.log(`owned-parent median=${ownedParent.median}ms p95=${ownedParent.p95}ms`)
+  }, 900_000)
+})
+
+async function createForeignEntries(root: string, count: number): Promise<void> {
+  const batchSize = 128
+  for (let start = 0; start < count; start += batchSize) {
+    const tasks: Promise<unknown>[] = []
+    for (let index = start; index < Math.min(start + batchSize, count); index += 1) {
+      const target = join(root, `foreign-${String(index).padStart(8, '0')}`)
+      tasks.push(index % 2 === 0 ? writeFile(target, '') : mkdir(target))
+    }
+    await Promise.all(tasks)
+  }
+}
+
+async function countForeignEntries(root: string): Promise<number> {
+  return (await readdir(root)).filter((name) => name.startsWith('foreign-')).length
+}
+
+async function scanSharedTempRoot(root: string): Promise<void> {
+  const directory = await opendir(root)
+  try {
+    for await (const entry of directory) {
+      if (entry.isDirectory() && entry.name.startsWith('orca-clipboard-file-')) {
+        // Reproduces the remaining shared-root iteration after #12917.
+      }
+    }
+  } finally {
+    await directory.close().catch(() => undefined)
+  }
+}
+
+async function measure(operation: () => Promise<void>): Promise<number> {
+  const startedAt = process.hrtime.bigint()
+  await operation()
+  return Number(process.hrtime.bigint() - startedAt) / 1_000_000
+}
+
+function summarize(samples: number[]): { median: string; p95: string } {
+  const sorted = [...samples].sort((left, right) => left - right)
+  const middle = Math.floor(sorted.length / 2)
+  const median =
+    sorted.length % 2 === 0 ? (sorted[middle - 1] + sorted[middle]) / 2 : sorted[middle]
+  const p95 = sorted[Math.ceil(sorted.length * 0.95) - 1]
+  return { median: median.toFixed(3), p95: p95.toFixed(3) }
+}
diff --git a/src/main/window/clipboard-remote-file-cleanup.test.ts b/src/main/window/clipboard-remote-file-cleanup.test.ts
deleted file mode 100644
index 56700cc025e..00000000000
--- a/src/main/window/clipboard-remote-file-cleanup.test.ts
+++ /dev/null
@@ -1,153 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { join } from 'node:path'
-
-const { opendirMock, rmMock, statMock } = vi.hoisted(() => ({
-  opendirMock: vi.fn(),
-  rmMock: vi.fn(),
-  statMock: vi.fn()
-}))
-
-vi.mock('node:fs/promises', () => ({
-  mkdir: vi.fn(),
-  opendir: opendirMock,
-  rm: rmMock,
-  stat: statMock
-}))
-vi.mock('electron', () => ({ app: { getPath: () => '/tmp' } }))
-vi.mock('../providers/ssh-filesystem-dispatch', () => ({
-  requireSshFilesystemProvider: vi.fn()
-}))
-vi.mock('./clipboard-file-copy', () => ({ writeFileToClipboard: vi.fn() }))
-
-import { cleanupExpiredRemoteClipboardFiles } from './clipboard-remote-file-copy'
-
-const TTL_MS = 60 * 60 * 1000
-const NOW_MS = 1_760_000_000_000
-
-function mockTempRoot(entries: Iterable<{ name: string; isDirectory: () => boolean }>): void {
-  opendirMock.mockResolvedValue({
-    async *[Symbol.asyncIterator]() {
-      yield* entries
-    },
-    close: vi.fn().mockResolvedValue(undefined)
-  })
-}
-
-function* orcaStagingDirs(count: number): Generator<{ name: string; isDirectory: () => boolean }> {
-  for (let index = 0; index < count; index += 1) {
-    yield { name: `orca-clipboard-file-expired-${index}`, isDirectory: () => true }
-  }
-}
-
-function* unrelatedTempEntries(
-  count: number
-): Generator<{ name: string; isDirectory: () => boolean }> {
-  for (let index = 0; index < count; index += 1) {
-    // Mirrors a real temp root: mostly foreign entries, both files and directories.
-    yield { name: `unrelated-${index}`, isDirectory: () => index % 2 === 0 }
-  }
-}
-
-describe('cleanupExpiredRemoteClipboardFiles', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-    rmMock.mockResolvedValue(undefined)
-    statMock.mockResolvedValue({ mtimeMs: NOW_MS - TTL_MS - 1 })
-  })
-
-  it('streams all entries with at most eight cleanups in flight', async () => {
-    mockTempRoot(orcaStagingDirs(257))
-    let active = 0
-    let peak = 0
-    statMock.mockImplementation(async () => {
-      active += 1
-      peak = Math.max(peak, active)
-      await new Promise<void>((resolve) => setImmediate(resolve))
-      active -= 1
-      return { mtimeMs: NOW_MS - TTL_MS - 1 }
-    })
-
-    await cleanupExpiredRemoteClipboardFiles(NOW_MS)
-
-    expect(rmMock).toHaveBeenCalledTimes(257)
-    expect(peak).toBe(8)
-  })
-
-  it('does no per-entry work for foreign temp-root entries', async () => {
-    mockTempRoot(unrelatedTempEntries(200_000))
-
-    await cleanupExpiredRemoteClipboardFiles(NOW_MS)
-
-    expect(statMock).not.toHaveBeenCalled()
-    expect(rmMock).not.toHaveBeenCalled()
-  })
-
-  it('acts on owned directories while the temp root is still being enumerated', async () => {
-    // Regression: the sweep materialized the whole temp root and built one promise
-    // per entry before doing any work, so a %TEMP% with ~1.2M unrelated entries
-    // froze the main process at startup (#12835). Streaming means an owned
-    // directory is swept before enumeration reaches the end.
-    let sweptDuringEnumeration = false
-    function* enumeration(): Generator<{ name: string; isDirectory: () => boolean }> {
-      yield { name: 'orca-clipboard-file-expired', isDirectory: () => true }
-      for (const entry of unrelatedTempEntries(1_000)) {
-        sweptDuringEnumeration ||= rmMock.mock.calls.length > 0
-        yield entry
-      }
-    }
-    mockTempRoot(enumeration())
-
-    await cleanupExpiredRemoteClipboardFiles(NOW_MS)
-
-    expect(sweptDuringEnumeration).toBe(true)
-    expect(rmMock).toHaveBeenCalledTimes(1)
-  })
-
-  it('removes only expired staging directories it owns', async () => {
-    function* interleaved(): Generator<{ name: string; isDirectory: () => boolean }> {
-      yield* unrelatedTempEntries(50_000)
-      yield { name: 'orca-clipboard-file-expired', isDirectory: () => true }
-      yield* unrelatedTempEntries(50_000)
-      yield { name: 'orca-clipboard-file-fresh', isDirectory: () => true }
-      yield { name: 'orca-clipboard-file-plain-file', isDirectory: () => false }
-    }
-    mockTempRoot(interleaved())
-    statMock.mockImplementation(async (targetPath: string) => ({
-      mtimeMs: targetPath.endsWith('expired') ? NOW_MS - TTL_MS - 1 : NOW_MS - 1000
-    }))
-
-    await cleanupExpiredRemoteClipboardFiles(NOW_MS)
-
-    expect(statMock).toHaveBeenCalledTimes(2)
-    expect(rmMock).toHaveBeenCalledTimes(1)
-    expect(rmMock).toHaveBeenCalledWith(join('/tmp', 'orca-clipboard-file-expired'), {
-      recursive: true,
-      force: true
-    })
-  })
-
-  it('closes the temp-root handle and still sweeps when enumeration fails midway', async () => {
-    const close = vi.fn().mockResolvedValue(undefined)
-    opendirMock.mockResolvedValue({
-      async *[Symbol.asyncIterator]() {
-        yield { name: 'orca-clipboard-file-expired', isDirectory: () => true }
-        throw new Error('EIO')
-      },
-      close
-    })
-
-    await expect(cleanupExpiredRemoteClipboardFiles(NOW_MS)).resolves.toBeUndefined()
-
-    expect(rmMock).toHaveBeenCalledTimes(1)
-    expect(close).toHaveBeenCalledTimes(1)
-  })
-
-  it('returns quietly when the temp root cannot be opened', async () => {
-    opendirMock.mockRejectedValue(new Error('EACCES'))
-
-    await expect(cleanupExpiredRemoteClipboardFiles(NOW_MS)).resolves.toBeUndefined()
-
-    expect(statMock).not.toHaveBeenCalled()
-    expect(rmMock).not.toHaveBeenCalled()
-  })
-})
diff --git a/src/main/window/clipboard-remote-file-copy.test.ts b/src/main/window/clipboard-remote-file-copy.test.ts
new file mode 100644
index 00000000000..1f851e1ec09
--- /dev/null
+++ b/src/main/window/clipboard-remote-file-copy.test.ts
@@ -0,0 +1,149 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  cleanupLegacyRemoteClipboardStagingMock,
+  createRemoteClipboardTransferDirectoryMock,
+  downloadFileMock,
+  requireSshFilesystemProviderMock,
+  RemoteClipboardStagingRootUnsafeErrorMock,
+  spanFailMock,
+  startSpanMock
+} = vi.hoisted(() => {
+  class RemoteClipboardStagingRootUnsafeErrorMock extends Error {}
+  const spanFailMock = vi.fn()
+  return {
+    cleanupLegacyRemoteClipboardStagingMock: vi.fn(async () => undefined),
+    createRemoteClipboardTransferDirectoryMock: vi.fn(),
+    downloadFileMock: vi.fn(),
+    requireSshFilesystemProviderMock: vi.fn(),
+    RemoteClipboardStagingRootUnsafeErrorMock,
+    spanFailMock,
+    startSpanMock: vi.fn(() => ({ fail: spanFailMock }))
+  }
+})
+
+vi.mock('electron', () => ({ app: { getPath: () => '/tmp' } }))
+vi.mock('../providers/ssh-filesystem-dispatch', () => ({
+  requireSshFilesystemProvider: requireSshFilesystemProviderMock
+}))
+vi.mock('../observability/tracer', () => ({ startSpan: startSpanMock }))
+vi.mock('./clipboard-file-copy', () => ({ writeFileToClipboard: vi.fn() }))
+vi.mock('./clipboard-remote-file-staging', () => ({
+  cleanupExpiredRemoteClipboardStaging: vi.fn(async () => undefined),
+  cleanupLegacyRemoteClipboardStaging: cleanupLegacyRemoteClipboardStagingMock,
+  createRemoteClipboardTransferDirectory: createRemoteClipboardTransferDirectoryMock,
+  RemoteClipboardStagingRootUnsafeError: RemoteClipboardStagingRootUnsafeErrorMock,
+  removeRemoteClipboardTransferDirectory: vi.fn(),
+  scheduleRemoteClipboardTransferCleanup: vi.fn()
+}))
+
+import {
+  scheduleLegacyRemoteClipboardFileCleanup,
+  writeRemoteFileToClipboard
+} from './clipboard-remote-file-copy'
+import { RemoteClipboardStagingRootUnsafeError } from './clipboard-remote-file-staging'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  requireSshFilesystemProviderMock.mockReturnValue({
+    stat: vi.fn(async () => ({ type: 'file' })),
+    downloadFile: downloadFileMock
+  })
+})
+
+describe('remote clipboard staging failures', () => {
+  it('rejects remote directories before creating staging', async () => {
+    requireSshFilesystemProviderMock.mockReturnValue({
+      stat: vi.fn(async () => ({ type: 'directory' })),
+      downloadFile: downloadFileMock
+    })
+
+    await expect(
+      writeRemoteFileToClipboard({
+        remotePath: '/repo/src',
+        connectionId: 'ssh-1',
+        deps: {
+          platform: 'win32',
+          writeBuffer: vi.fn(),
+          runCommand: vi.fn()
+        }
+      })
+    ).resolves.toEqual({ ok: false, reason: 'is-directory' })
+
+    expect(createRemoteClipboardTransferDirectoryMock).not.toHaveBeenCalled()
+    expect(downloadFileMock).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    {
+      category: 'unsafe-root',
+      error: new RemoteClipboardStagingRootUnsafeError()
+    },
+    {
+      category: 'permissions',
+      error: Object.assign(new Error('access denied'), { code: 'EACCES' })
+    },
+    {
+      category: 'permissions',
+      error: Object.assign(new Error('operation not permitted'), { code: 'EPERM' })
+    },
+    {
+      category: 'path-conflict',
+      error: Object.assign(new Error('path exists'), { code: 'EEXIST' })
+    },
+    {
+      category: 'unavailable',
+      error: new Error('storage offline')
+    }
+  ])(
+    'returns a toast-safe reason and records $category diagnostics',
+    async ({ category, error }) => {
+      createRemoteClipboardTransferDirectoryMock.mockRejectedValueOnce(error)
+
+      await expect(
+        writeRemoteFileToClipboard({
+          remotePath: '/repo/readme.md',
+          connectionId: 'ssh-1',
+          deps: {
+            platform: 'win32',
+            writeBuffer: vi.fn(),
+            runCommand: vi.fn()
+          }
+        })
+      ).resolves.toEqual({ ok: false, reason: 'staging-unavailable' })
+
+      expect(startSpanMock).toHaveBeenCalledWith('clipboard.remote_staging_init', {
+        attributes: {
+          operation: 'create',
+          platform: process.platform,
+          failure_category: category
+        }
+      })
+      expect(spanFailMock).toHaveBeenCalledWith(error)
+      expect(downloadFileMock).not.toHaveBeenCalled()
+    }
+  )
+})
+
+describe('legacy remote clipboard cleanup scheduling', () => {
+  afterEach(() => {
+    vi.useRealTimers()
+    vi.restoreAllMocks()
+  })
+
+  it('runs the shared-root compatibility scan once after the startup delay', async () => {
+    vi.useFakeTimers()
+    vi.spyOn(Date, 'now').mockReturnValue(1_760_000_000_000)
+
+    scheduleLegacyRemoteClipboardFileCleanup()
+    scheduleLegacyRemoteClipboardFileCleanup()
+    await vi.advanceTimersByTimeAsync(29_999)
+
+    expect(cleanupLegacyRemoteClipboardStagingMock).not.toHaveBeenCalled()
+
+    await vi.advanceTimersByTimeAsync(1)
+
+    expect(cleanupLegacyRemoteClipboardStagingMock).toHaveBeenCalledOnce()
+    expect(cleanupLegacyRemoteClipboardStagingMock).toHaveBeenCalledWith('/tmp', 1_760_000_000_000)
+  })
+})
diff --git a/src/main/window/clipboard-remote-file-copy.ts b/src/main/window/clipboard-remote-file-copy.ts
index 2afc60cda30..47bbbc0c5bb 100644
--- a/src/main/window/clipboard-remote-file-copy.ts
+++ b/src/main/window/clipboard-remote-file-copy.ts
@@ -1,25 +1,32 @@
 import { randomUUID } from 'node:crypto'
-import type { Dir } from 'node:fs'
-import { mkdir, opendir, rm, stat } from 'node:fs/promises'
+import { stat } from 'node:fs/promises'
 import { join } from 'node:path'
 
 import { app } from 'electron'
 
 import { getRuntimePathBasename } from '../../shared/cross-platform-path'
+import { startSpan } from '../observability/tracer'
 import { requireSshFilesystemProvider } from '../providers/ssh-filesystem-dispatch'
 import {
   writeFileToClipboard,
   type ClipboardFileDeps,
   type ClipboardFileResult
 } from './clipboard-file-copy'
+import {
+  cleanupExpiredRemoteClipboardStaging,
+  cleanupLegacyRemoteClipboardStaging,
+  createRemoteClipboardTransferDirectory,
+  RemoteClipboardStagingRootUnsafeError,
+  removeRemoteClipboardTransferDirectory,
+  scheduleRemoteClipboardTransferCleanup
+} from './clipboard-remote-file-staging'
 
 type RemoteClipboardFileDeps = Omit<ClipboardFileDeps, 'resolveFilePath'>
 
-const REMOTE_CLIPBOARD_FILE_TTL_MS = 60 * 60 * 1000
-const REMOTE_CLIPBOARD_FILE_PREFIX = 'orca-clipboard-file-'
-const REMOTE_CLIPBOARD_CLEANUP_CONCURRENCY = 8
+const REMOTE_CLIPBOARD_LEGACY_CLEANUP_DELAY_MS = 30 * 1000
 const WINDOWS_RESERVED_LOCAL_BASENAME = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/i
 const LOCAL_FILENAME_REPLACEMENT_CHARS = new Set(['<', '>', ':', '"', '/', '\\', '|', '?', '*'])
+let legacyCleanupScheduled = false
 
 export async function writeRemoteFileToClipboard({
   remotePath,
@@ -39,11 +46,21 @@ export async function writeRemoteFileToClipboard({
     throw new Error('Remote file download is unavailable. Reconnect the SSH target and retry.')
   }
 
-  const tempDir = join(
-    app.getPath('temp'),
-    `${REMOTE_CLIPBOARD_FILE_PREFIX}${Date.now()}-${randomUUID()}`
-  )
-  await mkdir(tempDir, { mode: 0o700 })
+  const tempRoot = app.getPath('temp')
+  let tempDir: string
+  try {
+    tempDir = await createRemoteClipboardTransferDirectory(tempRoot, Date.now(), randomUUID())
+  } catch (error) {
+    const span = startSpan('clipboard.remote_staging_init', {
+      attributes: {
+        operation: 'create',
+        platform: process.platform,
+        failure_category: getStagingFailureCategory(error)
+      }
+    })
+    span.fail(error instanceof Error ? error : String(error))
+    return { ok: false, reason: 'staging-unavailable' }
+  }
   const localPath = join(
     tempDir,
     sanitizeLocalClipboardFilename(getRuntimePathBasename(remotePath))
@@ -70,62 +87,33 @@ export async function writeRemoteFileToClipboard({
       // Why: OS file clipboards keep a path reference, so the staged copy must
       // survive after this IPC call long enough for the user to paste it.
       keepTempFile = true
-      scheduleRemoteClipboardFileCleanup(tempDir)
+      scheduleRemoteClipboardTransferCleanup(tempRoot, tempDir)
     }
     return result
   } finally {
     if (!keepTempFile) {
-      await rm(tempDir, { recursive: true, force: true }).catch(() => undefined)
+      await removeRemoteClipboardTransferDirectory(tempRoot, tempDir)
     }
   }
 }
 
-// Why: the OS temp root is shared with every other program and routinely holds
-// millions of unrelated entries on long-lived machines, so this startup sweep
-// streams it and only ever retains work for entries it actually owns.
 export async function cleanupExpiredRemoteClipboardFiles(nowMs = Date.now()): Promise<void> {
-  const tempRoot = app.getPath('temp')
-  let tempRootDir: Dir
-  try {
-    tempRootDir = await opendir(tempRoot)
-  } catch {
+  await cleanupExpiredRemoteClipboardStaging(app.getPath('temp'), nowMs)
+}
+
+export async function cleanupLegacyRemoteClipboardFiles(nowMs = Date.now()): Promise<void> {
+  await cleanupLegacyRemoteClipboardStaging(app.getPath('temp'), nowMs)
+}
+
+export function scheduleLegacyRemoteClipboardFileCleanup(): void {
+  if (legacyCleanupScheduled) {
     return
   }
-
-  const pending = new Set<Promise<void>>()
-  try {
-    for await (const entry of tempRootDir) {
-      if (!entry.isDirectory() || !entry.name.startsWith(REMOTE_CLIPBOARD_FILE_PREFIX)) {
-        continue
-      }
-      const cleanup = cleanupExpiredRemoteClipboardDirectory(join(tempRoot, entry.name), nowMs)
-      pending.add(cleanup)
-      void cleanup.finally(() => pending.delete(cleanup))
-      if (pending.size >= REMOTE_CLIPBOARD_CLEANUP_CONCURRENCY) {
-        await Promise.race(pending)
-      }
-    }
-  } catch {
-    // Why: a partial best-effort sweep beats failing startup on a temp-root read error.
-  } finally {
-    // Why: exhausting the iterator already closes the handle; closing again is harmless.
-    await tempRootDir.close().catch(() => undefined)
-  }
-  await Promise.all(pending)
-}
-
-async function cleanupExpiredRemoteClipboardDirectory(
-  tempDir: string,
-  nowMs: number
-): Promise<void> {
-  try {
-    const tempStats = await stat(tempDir)
-    if (nowMs - tempStats.mtimeMs >= REMOTE_CLIPBOARD_FILE_TTL_MS) {
-      await rm(tempDir, { recursive: true, force: true })
-    }
-  } catch {
-    // Why: stale staged SSH files should not make startup cleanup noisy.
-  }
+  legacyCleanupScheduled = true
+  const timer = setTimeout(() => {
+    void cleanupLegacyRemoteClipboardFiles().catch(() => undefined)
+  }, REMOTE_CLIPBOARD_LEGACY_CLEANUP_DELAY_MS)
+  unrefTimer(timer)
 }
 
 function sanitizeLocalClipboardFilename(remoteBasename: string): string {
@@ -140,11 +128,22 @@ function sanitizeLocalClipboardFilename(remoteBasename: string): string {
   return sanitized
 }
 
-function scheduleRemoteClipboardFileCleanup(tempDir: string): void {
-  const timer = setTimeout(() => {
-    void rm(tempDir, { recursive: true, force: true }).catch(() => undefined)
-  }, REMOTE_CLIPBOARD_FILE_TTL_MS)
+function unrefTimer(timer: ReturnType<typeof setTimeout>): void {
   if (typeof timer === 'object' && 'unref' in timer) {
     timer.unref()
   }
 }
+
+function getStagingFailureCategory(error: unknown): string {
+  if (error instanceof RemoteClipboardStagingRootUnsafeError) {
+    return 'unsafe-root'
+  }
+  const code = error instanceof Error && 'code' in error ? String(error.code) : undefined
+  if (code === 'EACCES' || code === 'EPERM') {
+    return 'permissions'
+  }
+  if (code === 'EEXIST' || code === 'ENOTDIR') {
+    return 'path-conflict'
+  }
+  return 'unavailable'
+}
diff --git a/src/main/window/clipboard-remote-file-staging-fs.test.ts b/src/main/window/clipboard-remote-file-staging-fs.test.ts
new file mode 100644
index 00000000000..dc464528cb6
--- /dev/null
+++ b/src/main/window/clipboard-remote-file-staging-fs.test.ts
@@ -0,0 +1,80 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { access, lstat, mkdir, mkdtemp, readdir, rm, symlink, utimes } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+
+import {
+  cleanupExpiredRemoteClipboardStaging,
+  createRemoteClipboardTransferDirectory,
+  getRemoteClipboardStagingRoot,
+  RemoteClipboardStagingRootUnsafeError
+} from './clipboard-remote-file-staging'
+
+const FIXTURE_PREFIX = 'orca-clipboard-staging-test-'
+const NOW_MS = 1_760_000_000_000
+const fixtures: string[] = []
+
+afterEach(async () => {
+  await Promise.all(
+    fixtures.splice(0).map(async (fixture) => {
+      expect(dirname(fixture)).toBe(tmpdir())
+      expect(basename(fixture)).toMatch(new RegExp(`^${FIXTURE_PREFIX}`))
+      await rm(fixture, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 })
+    })
+  )
+})
+
+describe('remote clipboard staging filesystem contract', () => {
+  it('removes only expired owned transfers with real filesystem metadata', async () => {
+    const tempRoot = await makeFixture()
+    const foreignDirectory = join(tempRoot, 'foreign-directory')
+    await mkdir(foreignDirectory)
+    const expiredTransfer = await createRemoteClipboardTransferDirectory(
+      tempRoot,
+      NOW_MS - 2 * 60 * 60 * 1000,
+      '00000000-0000-4000-8000-000000000000'
+    )
+    const freshTransfer = await createRemoteClipboardTransferDirectory(
+      tempRoot,
+      NOW_MS,
+      '00000000-0000-4000-8000-000000000001'
+    )
+    const expiredAt = new Date(NOW_MS - 2 * 60 * 60 * 1000)
+    await utimes(expiredTransfer, expiredAt, expiredAt)
+
+    await cleanupExpiredRemoteClipboardStaging(tempRoot, NOW_MS)
+
+    await expect(access(expiredTransfer)).rejects.toMatchObject({ code: 'ENOENT' })
+    await expect(access(freshTransfer)).resolves.toBeUndefined()
+    await expect(access(foreignDirectory)).resolves.toBeUndefined()
+    if (typeof process.getuid === 'function') {
+      const rootStats = await lstat(getRemoteClipboardStagingRoot(tempRoot))
+      expect(rootStats.uid).toBe(process.getuid())
+      expect(rootStats.mode & 0o777).toBe(0o700)
+    }
+  })
+
+  it('rejects a real staging-root symlink without writing through it', async () => {
+    const tempRoot = await makeFixture()
+    const outsideDirectory = join(tempRoot, 'outside')
+    const stagingRoot = getRemoteClipboardStagingRoot(tempRoot)
+    await mkdir(outsideDirectory)
+    await symlink(outsideDirectory, stagingRoot, process.platform === 'win32' ? 'junction' : 'dir')
+
+    await expect(
+      createRemoteClipboardTransferDirectory(
+        tempRoot,
+        NOW_MS,
+        '00000000-0000-4000-8000-000000000000'
+      )
+    ).rejects.toBeInstanceOf(RemoteClipboardStagingRootUnsafeError)
+
+    expect(await readdir(outsideDirectory)).toEqual([])
+  })
+})
+
+async function makeFixture(): Promise<string> {
+  const fixture = await mkdtemp(join(tmpdir(), FIXTURE_PREFIX))
+  fixtures.push(fixture)
+  return fixture
+}
diff --git a/src/main/window/clipboard-remote-file-staging.test.ts b/src/main/window/clipboard-remote-file-staging.test.ts
new file mode 100644
index 00000000000..5ca20e68383
--- /dev/null
+++ b/src/main/window/clipboard-remote-file-staging.test.ts
@@ -0,0 +1,360 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { join, resolve } from 'node:path'
+
+const { accessMock, lstatMock, mkdirMock, opendirMock, rmMock, writeFileMock } = vi.hoisted(() => ({
+  accessMock: vi.fn(),
+  lstatMock: vi.fn(),
+  mkdirMock: vi.fn(),
+  opendirMock: vi.fn(),
+  rmMock: vi.fn(),
+  writeFileMock: vi.fn()
+}))
+
+vi.mock('node:fs/promises', () => ({
+  access: accessMock,
+  lstat: lstatMock,
+  mkdir: mkdirMock,
+  opendir: opendirMock,
+  rm: rmMock,
+  writeFile: writeFileMock
+}))
+
+import {
+  cleanupExpiredRemoteClipboardStaging,
+  cleanupLegacyRemoteClipboardStaging,
+  createRemoteClipboardTransferDirectory,
+  getRemoteClipboardStagingRoot,
+  removeRemoteClipboardTransferDirectory,
+  scheduleRemoteClipboardTransferCleanup
+} from './clipboard-remote-file-staging'
+
+const TTL_MS = 60 * 60 * 1000
+const RETRY_MS = 60 * 1000
+const NOW_MS = 1_760_000_000_000
+const TEMP_ROOT = resolve('fixture-temp')
+const UID_SUFFIX = typeof process.getuid === 'function' ? `-${process.getuid()}` : ''
+const STAGING_ROOT = join(TEMP_ROOT, `orca-clipboard-files${UID_SUFFIX}`)
+const MARKER_PATH = join(STAGING_ROOT, '.legacy-cleanup-complete')
+const UUID_A = '00000000-0000-4000-8000-000000000000'
+const UUID_B = '00000000-0000-4000-8000-000000000001'
+const EXPIRED_TRANSFER = `1759990000000-${UUID_A}`
+const FRESH_TRANSFER = `1760000000000-${UUID_B}`
+const LEGACY_EXPIRED = `orca-clipboard-file-${EXPIRED_TRANSFER}`
+const LEGACY_FRESH = `orca-clipboard-file-${FRESH_TRANSFER}`
+
+type MockDirent = { name: string; isDirectory: () => boolean }
+
+function directoryEntry(name: string, isDirectory = true): MockDirent {
+  return { name, isDirectory: () => isDirectory }
+}
+
+function openedDirectory(entries: Iterable<MockDirent>): {
+  [Symbol.asyncIterator]: () => AsyncGenerator<MockDirent>
+  close: ReturnType<typeof vi.fn>
+} {
+  return {
+    async *[Symbol.asyncIterator]() {
+      yield* entries
+    },
+    close: vi.fn().mockResolvedValue(undefined)
+  }
+}
+
+function safeDirectoryStats(mtimeMs = NOW_MS - TTL_MS - 1) {
+  return {
+    isDirectory: () => true,
+    isSymbolicLink: () => false,
+    mode: 0o700,
+    mtimeMs,
+    uid: typeof process.getuid === 'function' ? process.getuid() : 0
+  }
+}
+
+function missingError(): NodeJS.ErrnoException {
+  return Object.assign(new Error('missing'), { code: 'ENOENT' })
+}
+
+describe('remote clipboard staging ownership', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    accessMock.mockRejectedValue(missingError())
+    lstatMock.mockResolvedValue(safeDirectoryStats())
+    mkdirMock.mockResolvedValue(undefined)
+    opendirMock.mockResolvedValue(openedDirectory([]))
+    rmMock.mockResolvedValue(undefined)
+    writeFileMock.mockResolvedValue(undefined)
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('creates a private owned parent and a per-transfer child', async () => {
+    const result = await createRemoteClipboardTransferDirectory(TEMP_ROOT, NOW_MS, UUID_A)
+
+    expect(result).toBe(join(STAGING_ROOT, `${NOW_MS}-${UUID_A}`))
+    expect(mkdirMock).toHaveBeenNthCalledWith(1, STAGING_ROOT, {
+      recursive: true,
+      mode: 0o700
+    })
+    expect(mkdirMock).toHaveBeenNthCalledWith(2, result, { mode: 0o700 })
+  })
+
+  it('scans only the owned parent during normal crash cleanup', async () => {
+    await cleanupExpiredRemoteClipboardStaging(TEMP_ROOT, NOW_MS)
+
+    expect(opendirMock).toHaveBeenCalledOnce()
+    expect(opendirMock).toHaveBeenCalledWith(STAGING_ROOT)
+    expect(opendirMock).not.toHaveBeenCalledWith(TEMP_ROOT)
+  })
+
+  it('removes expired crash leftovers and preserves fresh or unknown children', async () => {
+    opendirMock.mockResolvedValue(
+      openedDirectory([
+        directoryEntry(EXPIRED_TRANSFER),
+        directoryEntry(FRESH_TRANSFER),
+        directoryEntry('unknown-child'),
+        directoryEntry('.legacy-cleanup-complete', false)
+      ])
+    )
+    lstatMock.mockImplementation(async (targetPath: string) =>
+      safeDirectoryStats(targetPath.endsWith(FRESH_TRANSFER) ? NOW_MS - 1_000 : undefined)
+    )
+
+    await cleanupExpiredRemoteClipboardStaging(TEMP_ROOT, NOW_MS)
+
+    expect(rmMock).toHaveBeenCalledOnce()
+    expect(rmMock).toHaveBeenCalledWith(join(STAGING_ROOT, EXPIRED_TRANSFER), {
+      force: true,
+      maxRetries: 3,
+      recursive: true,
+      retryDelay: 100
+    })
+  })
+
+  it('rejects a symlinked owned parent before opening it', async () => {
+    lstatMock.mockResolvedValue({
+      ...safeDirectoryStats(),
+      isDirectory: () => false,
+      isSymbolicLink: () => true
+    })
+
+    await expect(cleanupExpiredRemoteClipboardStaging(TEMP_ROOT, NOW_MS)).resolves.toBeUndefined()
+
+    expect(opendirMock).not.toHaveBeenCalled()
+    expect(rmMock).not.toHaveBeenCalled()
+  })
+
+  it.skipIf(typeof process.getuid !== 'function')(
+    'rejects wrong-owner and insecure POSIX parents',
+    async () => {
+      lstatMock
+        .mockResolvedValueOnce({ ...safeDirectoryStats(), uid: process.getuid!() + 1 })
+        .mockResolvedValueOnce({ ...safeDirectoryStats(), mode: 0o755 })
+
+      await cleanupExpiredRemoteClipboardStaging(TEMP_ROOT, NOW_MS)
+      await cleanupExpiredRemoteClipboardStaging(TEMP_ROOT, NOW_MS)
+
+      expect(opendirMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it('rejects child symlinks and names outside the owned parent', async () => {
+    opendirMock.mockResolvedValue(
+      openedDirectory([directoryEntry(EXPIRED_TRANSFER), directoryEntry('..')])
+    )
+    lstatMock.mockImplementation(async (targetPath: string) =>
+      targetPath === STAGING_ROOT
+        ? safeDirectoryStats()
+        : {
+            ...safeDirectoryStats(),
+            isDirectory: () => false,
+            isSymbolicLink: () => true
+          }
+    )
+
+    await cleanupExpiredRemoteClipboardStaging(TEMP_ROOT, NOW_MS)
+
+    expect(lstatMock).not.toHaveBeenCalledWith(TEMP_ROOT)
+    expect(rmMock).not.toHaveBeenCalled()
+  })
+
+  it('contains explicit removals to direct owned children', async () => {
+    expect(
+      await removeRemoteClipboardTransferDirectory(TEMP_ROOT, join(STAGING_ROOT, '..', 'victim'))
+    ).toBe(false)
+    expect(await removeRemoteClipboardTransferDirectory(TEMP_ROOT, STAGING_ROOT)).toBe(false)
+
+    expect(rmMock).not.toHaveBeenCalled()
+  })
+
+  it('treats an already-removed transfer as cleanup success', async () => {
+    lstatMock.mockImplementation(async (targetPath: string) => {
+      if (targetPath === STAGING_ROOT) {
+        return safeDirectoryStats()
+      }
+      throw missingError()
+    })
+
+    await expect(
+      removeRemoteClipboardTransferDirectory(TEMP_ROOT, join(STAGING_ROOT, EXPIRED_TRANSFER))
+    ).resolves.toBe(true)
+
+    expect(rmMock).not.toHaveBeenCalled()
+  })
+
+  it('continues past Windows-style lock failures and retries on a later sweep', async () => {
+    opendirMock.mockResolvedValue(
+      openedDirectory([directoryEntry(EXPIRED_TRANSFER), directoryEntry(`1759990000000-${UUID_B}`)])
+    )
+    rmMock.mockImplementation(async (targetPath: string) => {
+      if (targetPath.endsWith(EXPIRED_TRANSFER)) {
+        throw Object.assign(new Error('locked'), { code: 'EPERM' })
+      }
+    })
+
+    await expect(cleanupExpiredRemoteClipboardStaging(TEMP_ROOT, NOW_MS)).resolves.toBeUndefined()
+
+    expect(rmMock).toHaveBeenCalledTimes(2)
+    rmMock.mockResolvedValue(undefined)
+    await cleanupExpiredRemoteClipboardStaging(TEMP_ROOT, NOW_MS)
+    expect(rmMock).toHaveBeenCalledTimes(4)
+  })
+
+  it('bounds locked-file timer retries', async () => {
+    vi.useFakeTimers()
+    rmMock.mockRejectedValue(Object.assign(new Error('locked'), { code: 'EPERM' }))
+
+    scheduleRemoteClipboardTransferCleanup(TEMP_ROOT, join(STAGING_ROOT, EXPIRED_TRANSFER))
+    await vi.advanceTimersByTimeAsync(TTL_MS + 4 * RETRY_MS)
+
+    expect(rmMock).toHaveBeenCalledTimes(4)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('keeps owned-child cleanup concurrency at eight', async () => {
+    const entries = Array.from({ length: 257 }, (_, index) =>
+      directoryEntry(`1759990000000-00000000-0000-4000-8000-${String(index).padStart(12, '0')}`)
+    )
+    opendirMock.mockResolvedValue(openedDirectory(entries))
+    let active = 0
+    let peak = 0
+    lstatMock.mockImplementation(async () => {
+      active += 1
+      peak = Math.max(peak, active)
+      await new Promise<void>((resolveImmediate) => setImmediate(resolveImmediate))
+      active -= 1
+      return safeDirectoryStats()
+    })
+
+    await cleanupExpiredRemoteClipboardStaging(TEMP_ROOT, NOW_MS)
+
+    expect(rmMock).toHaveBeenCalledTimes(257)
+    expect(peak).toBe(8)
+  })
+})
+
+describe('legacy remote clipboard staging compatibility', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    accessMock.mockRejectedValue(missingError())
+    lstatMock.mockResolvedValue(safeDirectoryStats())
+    mkdirMock.mockResolvedValue(undefined)
+    opendirMock.mockResolvedValue(openedDirectory([]))
+    rmMock.mockResolvedValue(undefined)
+    writeFileMock.mockResolvedValue(undefined)
+  })
+
+  it('marks migration complete when a legacy child falls beyond the 4096-entry window', async () => {
+    let visited = 0
+    let reachedLateLegacyChild = false
+    function* foreignEntries(): Generator<MockDirent> {
+      for (let index = 0; index < 200_000; index += 1) {
+        if (index === 4_096) {
+          reachedLateLegacyChild = true
+          yield directoryEntry(LEGACY_EXPIRED)
+        }
+        visited += 1
+        yield directoryEntry(`foreign-${index}`, index % 2 === 0)
+      }
+    }
+    opendirMock.mockResolvedValue(openedDirectory(foreignEntries()))
+
+    await cleanupLegacyRemoteClipboardStaging(TEMP_ROOT, NOW_MS)
+
+    expect(visited).toBe(4_096)
+    expect(reachedLateLegacyChild).toBe(false)
+    expect(lstatMock).toHaveBeenCalledOnce()
+    expect(rmMock).not.toHaveBeenCalled()
+    expect(writeFileMock).toHaveBeenCalledWith(MARKER_PATH, '', {
+      flag: 'wx',
+      mode: 0o600
+    })
+  })
+
+  it('removes only exact expired legacy children encountered inside the bound', async () => {
+    opendirMock.mockResolvedValue(
+      openedDirectory([
+        directoryEntry('orca-clipboard-file-lookalike'),
+        directoryEntry(LEGACY_EXPIRED),
+        directoryEntry(LEGACY_EXPIRED, false)
+      ])
+    )
+
+    await cleanupLegacyRemoteClipboardStaging(TEMP_ROOT, NOW_MS)
+
+    expect(rmMock).toHaveBeenCalledOnce()
+    expect(rmMock).toHaveBeenCalledWith(join(TEMP_ROOT, LEGACY_EXPIRED), {
+      force: true,
+      maxRetries: 3,
+      recursive: true,
+      retryDelay: 100
+    })
+    expect(writeFileMock).toHaveBeenCalledOnce()
+  })
+
+  it('does not mark migration complete while a fresh or locked legacy child remains', async () => {
+    opendirMock.mockResolvedValue(
+      openedDirectory([directoryEntry(LEGACY_FRESH), directoryEntry(LEGACY_EXPIRED)])
+    )
+    lstatMock.mockImplementation(async (targetPath: string) =>
+      safeDirectoryStats(targetPath.endsWith(LEGACY_FRESH) ? NOW_MS - 1_000 : undefined)
+    )
+    rmMock.mockRejectedValue(Object.assign(new Error('locked'), { code: 'EBUSY' }))
+
+    await cleanupLegacyRemoteClipboardStaging(TEMP_ROOT, NOW_MS)
+
+    expect(writeFileMock).not.toHaveBeenCalled()
+  })
+
+  it('never follows legacy symlinks outside the shared temp root', async () => {
+    opendirMock.mockResolvedValue(openedDirectory([directoryEntry(LEGACY_EXPIRED)]))
+    lstatMock.mockImplementation(async (targetPath: string) =>
+      targetPath === STAGING_ROOT
+        ? safeDirectoryStats()
+        : {
+            ...safeDirectoryStats(),
+            isDirectory: () => false,
+            isSymbolicLink: () => true
+          }
+    )
+
+    await cleanupLegacyRemoteClipboardStaging(TEMP_ROOT, NOW_MS)
+
+    expect(rmMock).not.toHaveBeenCalled()
+    expect(writeFileMock).toHaveBeenCalledOnce()
+  })
+
+  it('skips the shared root after the one-time marker exists', async () => {
+    accessMock.mockResolvedValue(undefined)
+
+    await cleanupLegacyRemoteClipboardStaging(TEMP_ROOT, NOW_MS)
+
+    expect(accessMock).toHaveBeenCalledWith(MARKER_PATH)
+    expect(opendirMock).not.toHaveBeenCalled()
+  })
+
+  it('uses a platform-safe owned parent name', () => {
+    expect(getRemoteClipboardStagingRoot(TEMP_ROOT)).toBe(STAGING_ROOT)
+  })
+})
diff --git a/src/main/window/clipboard-remote-file-staging.ts b/src/main/window/clipboard-remote-file-staging.ts
new file mode 100644
index 00000000000..58c1e0f2518
--- /dev/null
+++ b/src/main/window/clipboard-remote-file-staging.ts
@@ -0,0 +1,266 @@
+import type { Dir, Stats } from 'node:fs'
+import { access, lstat, mkdir, opendir, rm, writeFile } from 'node:fs/promises'
+import { basename, dirname, join, resolve } from 'node:path'
+
+const REMOTE_CLIPBOARD_STAGING_ROOT_NAME = 'orca-clipboard-files'
+const REMOTE_CLIPBOARD_LEGACY_PREFIX = 'orca-clipboard-file-'
+const REMOTE_CLIPBOARD_MIGRATION_MARKER = '.legacy-cleanup-complete'
+const REMOTE_CLIPBOARD_FILE_TTL_MS = 60 * 60 * 1000
+const REMOTE_CLIPBOARD_CLEANUP_CONCURRENCY = 8
+const REMOTE_CLIPBOARD_CLEANUP_RETRY_MS = 60 * 1000
+const REMOTE_CLIPBOARD_CLEANUP_RETRY_LIMIT = 3
+// Why: compatibility cleanup must never restore O(shared temp root) work.
+const REMOTE_CLIPBOARD_LEGACY_ENTRY_LIMIT = 4_096
+const UUID_PATTERN = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
+const TRANSFER_DIRECTORY_PATTERN = new RegExp(`^\\d{1,16}-${UUID_PATTERN}$`, 'i')
+const LEGACY_DIRECTORY_PATTERN = new RegExp(
+  `^${REMOTE_CLIPBOARD_LEGACY_PREFIX}\\d{1,16}-${UUID_PATTERN}$`,
+  'i'
+)
+const REMOVE_OPTIONS = {
+  recursive: true,
+  force: true,
+  maxRetries: 3,
+  retryDelay: 100
+} as const
+
+type CleanupResult = 'failed' | 'fresh' | 'ignored' | 'removed'
+
+export class RemoteClipboardStagingRootUnsafeError extends Error {
+  constructor() {
+    super('Remote clipboard staging root is unsafe')
+    this.name = 'RemoteClipboardStagingRootUnsafeError'
+  }
+}
+
+export function getRemoteClipboardStagingRoot(tempRoot: string): string {
+  const uidSuffix = typeof process.getuid === 'function' ? `-${process.getuid()}` : ''
+  return join(tempRoot, `${REMOTE_CLIPBOARD_STAGING_ROOT_NAME}${uidSuffix}`)
+}
+
+export async function createRemoteClipboardTransferDirectory(
+  tempRoot: string,
+  createdAtMs: number,
+  transferId: string
+): Promise<string> {
+  const stagingRoot = await ensureRemoteClipboardStagingRoot(tempRoot)
+  const transferDirectory = join(stagingRoot, `${createdAtMs}-${transferId}`)
+  if (
+    !isTransferDirectoryName(basename(transferDirectory)) ||
+    !isDirectChild(stagingRoot, transferDirectory)
+  ) {
+    throw new Error('Remote clipboard transfer path escapes its staging root')
+  }
+  await mkdir(transferDirectory, { mode: 0o700 })
+  const transferStats = await lstat(transferDirectory)
+  if (!isSafeOwnedDirectory(transferStats)) {
+    throw new Error('Remote clipboard transfer directory is unsafe')
+  }
+  return transferDirectory
+}
+
+export async function cleanupExpiredRemoteClipboardStaging(
+  tempRoot: string,
+  nowMs = Date.now()
+): Promise<void> {
+  let stagingRoot: string
+  try {
+    stagingRoot = await ensureRemoteClipboardStagingRoot(tempRoot)
+  } catch {
+    return
+  }
+  await sweepDirectories(stagingRoot, nowMs, isTransferDirectoryName)
+}
+
+export async function cleanupLegacyRemoteClipboardStaging(
+  tempRoot: string,
+  nowMs = Date.now()
+): Promise<void> {
+  let stagingRoot: string
+  try {
+    stagingRoot = await ensureRemoteClipboardStagingRoot(tempRoot)
+  } catch {
+    return
+  }
+
+  const markerPath = join(stagingRoot, REMOTE_CLIPBOARD_MIGRATION_MARKER)
+  try {
+    await access(markerPath)
+    return
+  } catch (error) {
+    if (!isMissingPathError(error)) {
+      return
+    }
+  }
+
+  const result = await sweepDirectories(
+    tempRoot,
+    nowMs,
+    isLegacyTransferDirectoryName,
+    REMOTE_CLIPBOARD_LEGACY_ENTRY_LIMIT
+  )
+  if (result.complete && !result.hasFreshDirectories && !result.hasFailures) {
+    await writeFile(markerPath, '', { flag: 'wx', mode: 0o600 }).catch(() => undefined)
+  }
+}
+
+export async function removeRemoteClipboardTransferDirectory(
+  tempRoot: string,
+  transferDirectory: string
+): Promise<boolean> {
+  const stagingRoot = getRemoteClipboardStagingRoot(tempRoot)
+  if (
+    !isDirectChild(stagingRoot, transferDirectory) ||
+    !isTransferDirectoryName(basename(resolve(transferDirectory)))
+  ) {
+    return false
+  }
+  try {
+    await ensureRemoteClipboardStagingRoot(tempRoot)
+    const transferStats = await lstat(transferDirectory)
+    if (!isSafeOwnedDirectory(transferStats)) {
+      return false
+    }
+    await rm(transferDirectory, REMOVE_OPTIONS)
+    return true
+  } catch (error) {
+    return isMissingPathError(error)
+  }
+}
+
+export function scheduleRemoteClipboardTransferCleanup(
+  tempRoot: string,
+  transferDirectory: string
+): void {
+  scheduleCleanupAttempt(
+    tempRoot,
+    transferDirectory,
+    REMOTE_CLIPBOARD_FILE_TTL_MS,
+    REMOTE_CLIPBOARD_CLEANUP_RETRY_LIMIT
+  )
+}
+
+function scheduleCleanupAttempt(
+  tempRoot: string,
+  transferDirectory: string,
+  delayMs: number,
+  retriesRemaining: number
+): void {
+  const timer = setTimeout(() => {
+    void removeRemoteClipboardTransferDirectory(tempRoot, transferDirectory).then((removed) => {
+      if (!removed && retriesRemaining > 0) {
+        scheduleCleanupAttempt(
+          tempRoot,
+          transferDirectory,
+          REMOTE_CLIPBOARD_CLEANUP_RETRY_MS,
+          retriesRemaining - 1
+        )
+      }
+    })
+  }, delayMs)
+  if (typeof timer === 'object' && 'unref' in timer) {
+    timer.unref()
+  }
+}
+
+async function ensureRemoteClipboardStagingRoot(tempRoot: string): Promise<string> {
+  const stagingRoot = getRemoteClipboardStagingRoot(tempRoot)
+  await mkdir(stagingRoot, { recursive: true, mode: 0o700 })
+  const rootStats = await lstat(stagingRoot)
+  if (!isSafeOwnedDirectory(rootStats)) {
+    throw new RemoteClipboardStagingRootUnsafeError()
+  }
+  return stagingRoot
+}
+
+async function sweepDirectories(
+  root: string,
+  nowMs: number,
+  ownsEntry: (name: string) => boolean,
+  entryLimit = Number.POSITIVE_INFINITY
+): Promise<{ complete: boolean; hasFailures: boolean; hasFreshDirectories: boolean }> {
+  let rootDir: Dir
+  try {
+    rootDir = await opendir(root)
+  } catch {
+    return { complete: false, hasFailures: false, hasFreshDirectories: false }
+  }
+
+  let complete = true
+  let entriesVisited = 0
+  let hasFailures = false
+  let hasFreshDirectories = false
+  const pending = new Set<Promise<void>>()
+  try {
+    for await (const entry of rootDir) {
+      entriesVisited += 1
+      if (entry.isDirectory() && ownsEntry(entry.name)) {
+        const candidate = join(root, entry.name)
+        if (isDirectChild(root, candidate)) {
+          const cleanup = cleanupDirectory(candidate, nowMs).then((result) => {
+            hasFailures ||= result === 'failed'
+            hasFreshDirectories ||= result === 'fresh'
+          })
+          pending.add(cleanup)
+          void cleanup.finally(() => pending.delete(cleanup))
+          if (pending.size >= REMOTE_CLIPBOARD_CLEANUP_CONCURRENCY) {
+            await Promise.race(pending)
+          }
+        }
+      }
+      if (entriesVisited >= entryLimit) {
+        break
+      }
+    }
+  } catch {
+    complete = false
+  } finally {
+    await rootDir.close().catch(() => undefined)
+  }
+  await Promise.all(pending)
+  return { complete, hasFailures, hasFreshDirectories }
+}
+
+async function cleanupDirectory(directory: string, nowMs: number): Promise<CleanupResult> {
+  try {
+    const directoryStats = await lstat(directory)
+    if (!isSafeOwnedDirectory(directoryStats)) {
+      return 'ignored'
+    }
+    if (nowMs - directoryStats.mtimeMs < REMOTE_CLIPBOARD_FILE_TTL_MS) {
+      return 'fresh'
+    }
+    await rm(directory, REMOVE_OPTIONS)
+    return 'removed'
+  } catch (error) {
+    return isMissingPathError(error) ? 'ignored' : 'failed'
+  }
+}
+
+function isSafeOwnedDirectory(stats: Stats): boolean {
+  if (!stats.isDirectory() || stats.isSymbolicLink()) {
+    return false
+  }
+  if (typeof process.getuid !== 'function') {
+    return true
+  }
+  return stats.uid === process.getuid() && (stats.mode & 0o777) === 0o700
+}
+
+function isDirectChild(parent: string, candidate: string): boolean {
+  return dirname(resolve(candidate)) === resolve(parent)
+}
+
+function isTransferDirectoryName(name: string): boolean {
+  return TRANSFER_DIRECTORY_PATTERN.test(name)
+}
+
+function isLegacyTransferDirectoryName(name: string): boolean {
+  return LEGACY_DIRECTORY_PATTERN.test(name)
+}
+
+function isMissingPathError(error: unknown): boolean {
+  return (
+    error instanceof Error && 'code' in error && (error as NodeJS.ErrnoException).code === 'ENOENT'
+  )
+}
diff --git a/src/main/window/createMainWindow.test.ts b/src/main/window/createMainWindow.test.ts
index b6d1ff70035..3f02ba389d2 100644
--- a/src/main/window/createMainWindow.test.ts
+++ b/src/main/window/createMainWindow.test.ts
@@ -157,6 +157,9 @@ describe('createMainWindow', () => {
       on: vi.fn((event, handler) => {
         windowHandlers[event] = handler
       }),
+      once: vi.fn((event, handler) => {
+        windowHandlers[event] = handler
+      }),
       setZoomLevel: vi.fn(),
       setBackgroundThrottling: vi.fn(),
       invalidate: vi.fn(),
@@ -699,6 +702,9 @@ describe('createMainWindow', () => {
       on: vi.fn((event, handler) => {
         windowHandlers[event] = handler
       }),
+      once: vi.fn((event, handler) => {
+        windowHandlers[event] = handler
+      }),
       setZoomLevel: vi.fn(),
       setBackgroundThrottling: vi.fn(),
       invalidate: vi.fn(),
@@ -3431,6 +3437,9 @@ describe('createMainWindow', () => {
       on: vi.fn((event, handler) => {
         windowHandlers[event] = handler
       }),
+      once: vi.fn((event, handler) => {
+        windowHandlers[event] = handler
+      }),
       setZoomLevel: vi.fn(),
       setBackgroundThrottling: vi.fn(),
       invalidate: vi.fn(),
@@ -3490,6 +3499,21 @@ describe('createMainWindow', () => {
     expect(browserWindowInstance.show).toHaveBeenCalledTimes(1)
   })
 
+  it('can reveal the startup window after renderer load before ready-to-show', () => {
+    const { browserWindowInstance, windowHandlers } = createStartupRevealWindowFixture()
+
+    createMainWindow(null, { revealOnDidFinishLoad: true })
+    const revealAfterLoad = browserWindowInstance.webContents.on.mock.calls.find(
+      ([event]) => event === 'did-finish-load'
+    )?.[1]
+    expect(revealAfterLoad).toBeTypeOf('function')
+    revealAfterLoad?.()
+
+    expect(browserWindowInstance.show).toHaveBeenCalledTimes(1)
+    windowHandlers['ready-to-show']()
+    expect(browserWindowInstance.show).toHaveBeenCalledTimes(1)
+  })
+
   it('reveals the startup window on Windows when ready-to-show never fires', () => {
     vi.useFakeTimers()
     const { browserWindowInstance } = createStartupRevealWindowFixture()
diff --git a/src/main/window/createMainWindow.ts b/src/main/window/createMainWindow.ts
index 17bcd061e81..0661b6c3d06 100644
--- a/src/main/window/createMainWindow.ts
+++ b/src/main/window/createMainWindow.ts
@@ -59,6 +59,7 @@ import { closeDashboardPopout } from './dashboard-popout-window'
 import { installPrivilegedWindowNavigationPolicy } from './privileged-window-navigation'
 import { isMacosTahoeOrNewer } from './macos-tahoe-release'
 import { registerPluginPanelNavigationGuard } from '../plugins/plugin-panel-navigation-guard'
+import { installWindowsPathRegistryChangeListener } from '../pty/windows-path-registry-change'
 
 // Why: show/restore/resume can overlap before the size nudge resets; never capture the temporary width as the next baseline.
 const activeRepaintJiggles = new WeakSet<BrowserWindow>()
@@ -206,6 +207,8 @@ type CreateMainWindowOptions = {
   }) => void
   /** Defer renderer load until IPC handlers are registered, or eager renderer calls race into missing channels. */
   deferLoad?: boolean
+  /** Reveal after load instead of first paint when startup must show the shell before slower renderer work. */
+  revealOnDidFinishLoad?: boolean
   title?: string
   getKeybindings?: () => KeybindingOverrides | undefined
   onBeforeReload?: (options: { ignoreCache: boolean; webContentsId: number }) => void
@@ -302,6 +305,7 @@ export function createMainWindow(
     }
   })
   const rendererWebContentsId = mainWindow.webContents.id
+  installWindowsPathRegistryChangeListener(mainWindow)
   // Why: native paste fallback is privileged IPC; only the top-level renderer may request it.
   setTrustedUIRendererWebContentsId(rendererWebContentsId)
 
@@ -332,7 +336,7 @@ export function createMainWindow(
     mainWindow.webContents.setZoomLevel(level)
     // Why: native traffic lights don't scale with CSS zoom; reposition on startup to stay aligned with the zoomed titlebar.
     if (process.platform === 'darwin') {
-      syncTrafficLightPosition(mainWindow, Math.pow(1.2, level))
+      syncTrafficLightPosition(mainWindow, 1.2 ** level)
     }
   })
 
@@ -377,6 +381,9 @@ export function createMainWindow(
     mainWindow.show()
   }
   mainWindow.on('ready-to-show', revealInitialWindow)
+  if (opts?.revealOnDidFinishLoad === true) {
+    mainWindow.webContents.on('did-finish-load', revealInitialWindow)
+  }
 
   // Why: persist window bounds to restore last position/size; debounce to avoid hammering persistence during resize drags.
   let boundsTimer: ReturnType<typeof setTimeout> | null = null
diff --git a/src/main/windows-native-registry.ts b/src/main/windows-native-registry.ts
new file mode 100644
index 00000000000..e3a2d77889d
--- /dev/null
+++ b/src/main/windows-native-registry.ts
@@ -0,0 +1,25 @@
+import { createRequire } from 'node:module'
+
+export type WindowsNativeRegistryValue = {
+  name?: unknown
+  type?: unknown
+  value?: unknown
+}
+
+export type WindowsNativeRegistryModule = {
+  HK: { CU: number; LM: number }
+  getRegistryKey: (
+    root: number,
+    path: string
+  ) => Record<string, WindowsNativeRegistryValue | undefined> | null | undefined
+}
+
+export const WINDOWS_REG_SZ = 1
+export const WINDOWS_REG_EXPAND_SZ = 2
+
+const requireFromMain = createRequire(__filename)
+
+export function loadWindowsNativeRegistry(): WindowsNativeRegistryModule {
+  // Why: non-Windows installs omit this optional dependency, so never resolve it at module load.
+  return requireFromMain('windows-native-registry') as WindowsNativeRegistryModule
+}
diff --git a/src/main/worktree-removal-safety.ts b/src/main/worktree-removal-safety.ts
index 5aa8d619d92..ef303c18220 100644
--- a/src/main/worktree-removal-safety.ts
+++ b/src/main/worktree-removal-safety.ts
@@ -23,7 +23,8 @@ const ORCA_OWNED_PROVENANCE_META_KEYS = [
   'orcaCreationSource',
   'orcaCreationWorkspaceLayout',
   'automationProvenance',
-  'cliProvenance'
+  'cliProvenance',
+  'creatorProvenance'
 ] as const
 type UnregisteredOrcaCleanupMeta = Pick<
   WorktreeMeta,
diff --git a/src/preload/api-types.ts b/src/preload/api-types.ts
index 1cae8cd2359..65e47128949 100644
--- a/src/preload/api-types.ts
+++ b/src/preload/api-types.ts
@@ -2,12 +2,18 @@
 import type {
   CreateHostedReviewArgs,
   CreateHostedReviewResult,
+  CreateStackedHostedReviewArgs,
+  CreateStackedHostedReviewResult,
   HostedReviewCreationEligibility,
   HostedReviewCreationEligibilityArgs,
   HostedReviewForBranchArgs,
   HostedReviewInfo,
   HostedReviewProvider
 } from '../shared/hosted-review'
+import type {
+  BitbucketConnectArgs,
+  BitbucketConnectionStatus
+} from '../shared/bitbucket-credentials'
 import type { NativeFileDropPayload } from '../shared/native-file-drop'
 import type { ComputerAwakeStatus } from '../shared/computer-awake-mode'
 import type { BrowserFindSource } from '../shared/browser-find-source'
@@ -443,17 +449,7 @@ import type {
   ComputerUsePermissionSetupResult,
   ComputerUsePermissionStatusResult
 } from '../shared/computer-use-permissions-types'
-import type {
-  ClaudeUsageBreakdownKind,
-  ClaudeUsageBreakdownRow,
-  ClaudeUsageDailyPoint,
-  ClaudeUsageRange,
-  ClaudeUsageScanState,
-  ClaudeUsageScope,
-  ClaudeUsageSessionRow,
-  ClaudeUsageSnapshot,
-  ClaudeUsageSummary
-} from '../shared/claude-usage-types'
+import type { ClaudeUsageBreakdownKind, ClaudeUsageSnapshot } from '../shared/claude-usage-types'
 import type {
   CodexRateLimitResetResult,
   GrokAccountStatus,
@@ -479,27 +475,10 @@ import type {
   WorkspacePortScanResult
 } from '../shared/workspace-ports'
 import type { GhAuthDiagnostic } from '../shared/github-auth-types'
-import type {
-  CodexUsageBreakdownKind,
-  CodexUsageBreakdownRow,
-  CodexUsageDailyPoint,
-  CodexUsageRange,
-  CodexUsageScanState,
-  CodexUsageScope,
-  CodexUsageSessionRow,
-  CodexUsageSnapshot,
-  CodexUsageSummary
-} from '../shared/codex-usage-types'
+import type { CodexUsageBreakdownKind, CodexUsageSnapshot } from '../shared/codex-usage-types'
 import type {
   OpenCodeUsageBreakdownKind,
-  OpenCodeUsageBreakdownRow,
-  OpenCodeUsageDailyPoint,
-  OpenCodeUsageRange,
-  OpenCodeUsageScanState,
-  OpenCodeUsageScope,
-  OpenCodeUsageSessionRow,
-  OpenCodeUsageSnapshot,
-  OpenCodeUsageSummary
+  OpenCodeUsageSnapshot
 } from '../shared/opencode-usage-types'
 import type {
   AiVaultDeleteSessionArgs,
@@ -836,92 +815,39 @@ export type MemoryApi = {
   getSnapshot: () => Promise<MemorySnapshot>
 }
 
-export type ClaudeUsageApi = {
-  getScanState: () => Promise<ClaudeUsageScanState>
-  setEnabled: (args: { enabled: boolean }) => Promise<ClaudeUsageScanState>
-  refresh: (args?: { force?: boolean }) => Promise<ClaudeUsageScanState>
-  getSnapshot: (args: {
-    scope: ClaudeUsageScope
-    range: ClaudeUsageRange
-    limit?: number
-  }) => Promise<ClaudeUsageSnapshot>
-  getSummary: (args: {
-    scope: ClaudeUsageScope
-    range: ClaudeUsageRange
-  }) => Promise<ClaudeUsageSummary>
-  getDaily: (args: {
-    scope: ClaudeUsageScope
-    range: ClaudeUsageRange
-  }) => Promise<ClaudeUsageDailyPoint[]>
-  getBreakdown: (args: {
-    scope: ClaudeUsageScope
-    range: ClaudeUsageRange
-    kind: ClaudeUsageBreakdownKind
-  }) => Promise<ClaudeUsageBreakdownRow[]>
-  getRecentSessions: (args: {
-    scope: ClaudeUsageScope
-    range: ClaudeUsageRange
-    limit?: number
-  }) => Promise<ClaudeUsageSessionRow[]>
+type UsageProviderSnapshot = {
+  scanState: unknown
+  summary: { scope: string; range: string }
+  daily: unknown[]
+  modelBreakdown: unknown[]
+  recentSessions: unknown[]
 }
 
-export type CodexUsageApi = {
-  getScanState: () => Promise<CodexUsageScanState>
-  setEnabled: (args: { enabled: boolean }) => Promise<CodexUsageScanState>
-  refresh: (args?: { force?: boolean }) => Promise<CodexUsageScanState>
-  getSnapshot: (args: {
-    scope: CodexUsageScope
-    range: CodexUsageRange
-    limit?: number
-  }) => Promise<CodexUsageSnapshot>
-  getSummary: (args: {
-    scope: CodexUsageScope
-    range: CodexUsageRange
-  }) => Promise<CodexUsageSummary>
-  getDaily: (args: {
-    scope: CodexUsageScope
-    range: CodexUsageRange
-  }) => Promise<CodexUsageDailyPoint[]>
-  getBreakdown: (args: {
-    scope: CodexUsageScope
-    range: CodexUsageRange
-    kind: CodexUsageBreakdownKind
-  }) => Promise<CodexUsageBreakdownRow[]>
-  getRecentSessions: (args: {
-    scope: CodexUsageScope
-    range: CodexUsageRange
-    limit?: number
-  }) => Promise<CodexUsageSessionRow[]>
+type UsageQueryArgs<Snapshot extends UsageProviderSnapshot> = Pick<
+  Snapshot['summary'],
+  'scope' | 'range'
+>
+
+type UsageProviderApi<Snapshot extends UsageProviderSnapshot, BreakdownKind> = {
+  getScanState: () => Promise<Snapshot['scanState']>
+  setEnabled: (args: { enabled: boolean }) => Promise<Snapshot['scanState']>
+  refresh: (args?: { force?: boolean }) => Promise<Snapshot['scanState']>
+  getSnapshot: (args: UsageQueryArgs<Snapshot> & { limit?: number }) => Promise<Snapshot>
+  getSummary: (args: UsageQueryArgs<Snapshot>) => Promise<Snapshot['summary']>
+  getDaily: (args: UsageQueryArgs<Snapshot>) => Promise<Snapshot['daily']>
+  getBreakdown: (
+    args: UsageQueryArgs<Snapshot> & { kind: BreakdownKind }
+  ) => Promise<Snapshot['modelBreakdown']>
+  getRecentSessions: (
+    args: UsageQueryArgs<Snapshot> & { limit?: number }
+  ) => Promise<Snapshot['recentSessions']>
 }
 
-export type OpenCodeUsageApi = {
-  getScanState: () => Promise<OpenCodeUsageScanState>
-  setEnabled: (args: { enabled: boolean }) => Promise<OpenCodeUsageScanState>
-  refresh: (args?: { force?: boolean }) => Promise<OpenCodeUsageScanState>
-  getSnapshot: (args: {
-    scope: OpenCodeUsageScope
-    range: OpenCodeUsageRange
-    limit?: number
-  }) => Promise<OpenCodeUsageSnapshot>
-  getSummary: (args: {
-    scope: OpenCodeUsageScope
-    range: OpenCodeUsageRange
-  }) => Promise<OpenCodeUsageSummary>
-  getDaily: (args: {
-    scope: OpenCodeUsageScope
-    range: OpenCodeUsageRange
-  }) => Promise<OpenCodeUsageDailyPoint[]>
-  getBreakdown: (args: {
-    scope: OpenCodeUsageScope
-    range: OpenCodeUsageRange
-    kind: OpenCodeUsageBreakdownKind
-  }) => Promise<OpenCodeUsageBreakdownRow[]>
-  getRecentSessions: (args: {
-    scope: OpenCodeUsageScope
-    range: OpenCodeUsageRange
-    limit?: number
-  }) => Promise<OpenCodeUsageSessionRow[]>
-}
+export type ClaudeUsageApi = UsageProviderApi<ClaudeUsageSnapshot, ClaudeUsageBreakdownKind>
+
+export type CodexUsageApi = UsageProviderApi<CodexUsageSnapshot, CodexUsageBreakdownKind>
+
+export type OpenCodeUsageApi = UsageProviderApi<OpenCodeUsageSnapshot, OpenCodeUsageBreakdownKind>
 
 export type AiVaultApi = {
   listSessions: (args?: AiVaultListArgs) => Promise<AiVaultListResult>
@@ -1226,6 +1152,9 @@ export type PreloadApi = {
     get: () => {
       platform: NodeJS.Platform
       osRelease: string
+      arch: string
+      /** Login shell or ComSpec when available. */
+      shell: string
       displayServer: 'wayland' | 'x11' | null
     }
   }
@@ -1403,6 +1332,7 @@ export type PreloadApi = {
           | 'pendingFirstAgentMessageRename'
           | 'firstAgentMessageRenameError'
           | 'lastActivityAt'
+          | 'diffComments'
         >
       >
     }) => Promise<FolderWorkspace | null>
@@ -1482,6 +1412,7 @@ export type PreloadApi = {
       worktreeId: string
       branchName: string
       expectedHead: string
+      hostId?: ExecutionHostId
     }) => Promise<ForceDeleteWorktreeBranchResult>
     updateMeta: (args: { worktreeId: string; updates: Partial<WorktreeMeta> }) => Promise<Worktree>
     listLineage: () => Promise<{
@@ -1566,6 +1497,11 @@ export type PreloadApi = {
       snapshot?: string
       snapshotCols?: number
       snapshotRows?: number
+      snapshotPrefixAnsi?: string
+      snapshotFrameAnsi?: string
+      snapshotFrameRestoreAnsi?: string
+      snapshotKittyKeyboardFlags?: number
+      snapshotSeq?: number
       isReattach?: boolean
       isAlternateScreen?: boolean
       replay?: string
@@ -1632,6 +1568,7 @@ export type PreloadApi = {
       opts?: { scrollbackRows?: number }
     ) => Promise<{
       data: string
+      frameRestoreAnsi?: string
       cols: number
       rows: number
       cwd?: string | null
@@ -1647,6 +1584,9 @@ export type PreloadApi = {
       /** Trailing incomplete escape the emulator ingested; the restorer must
        *  write it after its post-replay resets, last before live chunks. */
       pendingEscapeTailAnsi?: string
+      /** Effective kitty flags the snapshot owner proved at `seq`. Absent means
+       *  unknown; consumers must not turn that into a known `0`. */
+      kittyKeyboardFlags?: number
     } | null>
     getRendererDeliveryDebugSnapshot: () => Promise<{
       pendingPtyCount: number
@@ -1717,6 +1657,7 @@ export type PreloadApi = {
         rows: number
         seq?: number
         lastTitle?: string
+        kittyKeyboardFlags?: number
       } | null
     ) => void
     declarePendingPaneSerializer: (paneKey: string) => Promise<number>
@@ -2054,6 +1995,7 @@ export type PreloadApi = {
       args: HostedReviewCreationEligibilityArgs
     ) => Promise<HostedReviewCreationEligibility>
     create: (args: CreateHostedReviewArgs) => Promise<CreateHostedReviewResult>
+    createStacked: (args: CreateStackedHostedReviewArgs) => Promise<CreateStackedHostedReviewResult>
   }
   // ── GitLab — parallel to gh, MR/issue surface only in v1 ────────
   // Shapes mirror gh.* except where GitLab's API differs (MR states, host-qualified project path, `glab api -i` paging).
@@ -2199,6 +2141,13 @@ export type PreloadApi = {
       }
     ) => Promise<Omit<GitLabWorkItem, 'repoId'> | null>
   }
+  bitbucket: {
+    connect: (
+      args: BitbucketConnectArgs
+    ) => Promise<{ ok: true; account: string | null } | { ok: false; error: string }>
+    disconnect: () => Promise<void>
+    status: () => Promise<BitbucketConnectionStatus>
+  }
   linear: {
     connect: (args: {
       apiKey: string
diff --git a/src/preload/index.ts b/src/preload/index.ts
index 179ce5ecc2a..7a1d4030a32 100644
--- a/src/preload/index.ts
+++ b/src/preload/index.ts
@@ -226,6 +226,7 @@ import type {
 } from './api-types'
 import type { AgentKind, LaunchSource, RequestKind } from '../shared/telemetry-events'
 import { createBrowserFindSubscriptions } from './browser-find-subscriptions'
+import { createUsageProviderApi } from './usage-provider-api'
 import type { AppStarSource } from '../shared/gh-star-source'
 import type { ExecutionHostId } from '../shared/execution-host'
 import type {
@@ -568,9 +569,15 @@ const api = {
   platform: {
     get: () => ({
       platform: process.platform,
+      // Why: sandboxed preload cannot require node:os; Electron exposes the OS
+      // version on process.getSystemVersion when available.
       osRelease:
         (process as NodeJS.Process & { getSystemVersion?: () => string }).getSystemVersion?.() ??
         '',
+      arch: process.arch,
+      // Why: these identify the default shell without probing user config files.
+      // process.env is available in the sandboxed preload; node:os is not.
+      shell: process.env.SHELL?.trim() || process.env.ComSpec?.trim() || '',
       displayServer: getLinuxDisplayServer()
     })
   } satisfies PreloadApi['platform'],
@@ -963,6 +970,11 @@ const api = {
       snapshot?: string
       snapshotCols?: number
       snapshotRows?: number
+      snapshotPrefixAnsi?: string
+      snapshotFrameAnsi?: string
+      snapshotFrameRestoreAnsi?: string
+      snapshotKittyKeyboardFlags?: number
+      snapshotSeq?: number
       isReattach?: boolean
       isAlternateScreen?: boolean
       replay?: string
@@ -1073,6 +1085,7 @@ const api = {
       opts?: { scrollbackRows?: number }
     ): Promise<{
       data: string
+      frameRestoreAnsi?: string
       cols: number
       rows: number
       cwd?: string | null
@@ -1082,6 +1095,7 @@ const api = {
       alternateScreen?: boolean
       scrollbackAnsi?: string
       pendingEscapeTailAnsi?: string
+      kittyKeyboardFlags?: number
     } | null> => ipcRenderer.invoke('pty:getMainBufferSnapshot', { id, opts }),
 
     getRendererDeliveryDebugSnapshot: (): Promise<{
@@ -1244,6 +1258,7 @@ const api = {
         rows: number
         seq?: number
         lastTitle?: string
+        kittyKeyboardFlags?: number
       } | null
     ): void => {
       ipcRenderer.send('pty:serializeBuffer:response', { requestId, snapshot })
@@ -1450,7 +1465,7 @@ const api = {
       checkName?: string
       url?: string | null
       prRepo?: GitHubOwnerRepo | null
-    }): Promise<unknown | null> => ipcRenderer.invoke('gh:prCheckDetails', args),
+    }): Promise<unknown> => ipcRenderer.invoke('gh:prCheckDetails', args),
 
     rerunPRChecks: (args: {
       repoPath: string
@@ -1704,12 +1719,29 @@ const api = {
       ipcRenderer.invoke('hostedReview:forBranch', args),
     getCreationEligibility: (args: unknown): Promise<unknown> =>
       ipcRenderer.invoke('hostedReview:getCreationEligibility', args),
-    create: (args: unknown): Promise<unknown> => ipcRenderer.invoke('hostedReview:create', args)
+    create: (args: unknown): Promise<unknown> => ipcRenderer.invoke('hostedReview:create', args),
+    createStacked: (args: unknown): Promise<unknown> =>
+      ipcRenderer.invoke('hostedReview:createStacked', args)
   },
 
   // Why: GitLab bindings live in `./gitlab` so `gl.*` changes don't conflict on every upstream sync of this central file.
   gl: glApi,
 
+  bitbucket: {
+    connect: (args: {
+      authMode: 'token' | 'basic'
+      accessToken?: string | null
+      email?: string | null
+      apiToken?: string | null
+      baseUrl?: string | null
+    }): Promise<{ ok: true; account: string | null } | { ok: false; error: string }> =>
+      ipcRenderer.invoke('bitbucket:connect', args),
+
+    disconnect: (): Promise<void> => ipcRenderer.invoke('bitbucket:disconnect'),
+
+    status: (): Promise<unknown> => ipcRenderer.invoke('bitbucket:status')
+  },
+
   linear: {
     connect: (args: {
       apiKey: string
@@ -4213,59 +4245,9 @@ const api = {
     getSnapshot: (): Promise<MemorySnapshot> => ipcRenderer.invoke('memory:getSnapshot')
   },
 
-  claudeUsage: {
-    getScanState: (): Promise<unknown> => ipcRenderer.invoke('claudeUsage:getScanState'),
-    setEnabled: (args: { enabled: boolean }): Promise<unknown> =>
-      ipcRenderer.invoke('claudeUsage:setEnabled', args),
-    refresh: (args?: { force?: boolean }): Promise<unknown> =>
-      ipcRenderer.invoke('claudeUsage:refresh', args),
-    getSnapshot: (args: { scope: string; range: string; limit?: number }): Promise<unknown> =>
-      ipcRenderer.invoke('claudeUsage:getSnapshot', args),
-    getSummary: (args: { scope: string; range: string }): Promise<unknown> =>
-      ipcRenderer.invoke('claudeUsage:getSummary', args),
-    getDaily: (args: { scope: string; range: string }): Promise<unknown> =>
-      ipcRenderer.invoke('claudeUsage:getDaily', args),
-    getBreakdown: (args: { scope: string; range: string; kind: string }): Promise<unknown> =>
-      ipcRenderer.invoke('claudeUsage:getBreakdown', args),
-    getRecentSessions: (args: { scope: string; range: string; limit?: number }): Promise<unknown> =>
-      ipcRenderer.invoke('claudeUsage:getRecentSessions', args)
-  },
-
-  codexUsage: {
-    getScanState: (): Promise<unknown> => ipcRenderer.invoke('codexUsage:getScanState'),
-    setEnabled: (args: { enabled: boolean }): Promise<unknown> =>
-      ipcRenderer.invoke('codexUsage:setEnabled', args),
-    refresh: (args?: { force?: boolean }): Promise<unknown> =>
-      ipcRenderer.invoke('codexUsage:refresh', args),
-    getSnapshot: (args: { scope: string; range: string; limit?: number }): Promise<unknown> =>
-      ipcRenderer.invoke('codexUsage:getSnapshot', args),
-    getSummary: (args: { scope: string; range: string }): Promise<unknown> =>
-      ipcRenderer.invoke('codexUsage:getSummary', args),
-    getDaily: (args: { scope: string; range: string }): Promise<unknown> =>
-      ipcRenderer.invoke('codexUsage:getDaily', args),
-    getBreakdown: (args: { scope: string; range: string; kind: string }): Promise<unknown> =>
-      ipcRenderer.invoke('codexUsage:getBreakdown', args),
-    getRecentSessions: (args: { scope: string; range: string; limit?: number }): Promise<unknown> =>
-      ipcRenderer.invoke('codexUsage:getRecentSessions', args)
-  },
-
-  openCodeUsage: {
-    getScanState: (): Promise<unknown> => ipcRenderer.invoke('openCodeUsage:getScanState'),
-    setEnabled: (args: { enabled: boolean }): Promise<unknown> =>
-      ipcRenderer.invoke('openCodeUsage:setEnabled', args),
-    refresh: (args?: { force?: boolean }): Promise<unknown> =>
-      ipcRenderer.invoke('openCodeUsage:refresh', args),
-    getSnapshot: (args: { scope: string; range: string; limit?: number }): Promise<unknown> =>
-      ipcRenderer.invoke('openCodeUsage:getSnapshot', args),
-    getSummary: (args: { scope: string; range: string }): Promise<unknown> =>
-      ipcRenderer.invoke('openCodeUsage:getSummary', args),
-    getDaily: (args: { scope: string; range: string }): Promise<unknown> =>
-      ipcRenderer.invoke('openCodeUsage:getDaily', args),
-    getBreakdown: (args: { scope: string; range: string; kind: string }): Promise<unknown> =>
-      ipcRenderer.invoke('openCodeUsage:getBreakdown', args),
-    getRecentSessions: (args: { scope: string; range: string; limit?: number }): Promise<unknown> =>
-      ipcRenderer.invoke('openCodeUsage:getRecentSessions', args)
-  },
+  claudeUsage: createUsageProviderApi(ipcRenderer, 'claudeUsage'),
+  codexUsage: createUsageProviderApi(ipcRenderer, 'codexUsage'),
+  openCodeUsage: createUsageProviderApi(ipcRenderer, 'openCodeUsage'),
 
   aiVault: {
     listSessions: (args?: AiVaultListArgs): Promise<unknown> =>
@@ -4955,8 +4937,7 @@ if (process.contextIsolated) {
     console.error(error)
   }
 } else {
-  // @ts-ignore (define in dts)
   window.electron = electronAPI
-  // @ts-ignore (define in dts)
+  // @ts-expect-error (define in dts)
   window.api = api
 }
diff --git a/src/preload/usage-provider-api.test.ts b/src/preload/usage-provider-api.test.ts
new file mode 100644
index 00000000000..0ce594cbb9f
--- /dev/null
+++ b/src/preload/usage-provider-api.test.ts
@@ -0,0 +1,33 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createUsageProviderApi } from './usage-provider-api'
+
+describe('usage provider preload API', () => {
+  it('keeps every provider on its existing IPC channels', async () => {
+    const invoke = vi.fn().mockResolvedValue(undefined)
+    const query = { scope: 'orca' as const, range: '30d' as const }
+
+    for (const prefix of ['claudeUsage', 'codexUsage', 'openCodeUsage'] as const) {
+      const api = createUsageProviderApi({ invoke } as never, prefix)
+      await api.getScanState()
+      await api.setEnabled({ enabled: true })
+      await api.refresh()
+      await api.getSnapshot({ ...query, limit: 7 })
+      await api.getSummary(query)
+      await api.getDaily(query)
+      await api.getBreakdown({ ...query, kind: 'project' })
+      await api.getRecentSessions({ ...query, limit: 4 })
+
+      expect(invoke.mock.calls).toEqual([
+        [`${prefix}:getScanState`],
+        [`${prefix}:setEnabled`, { enabled: true }],
+        [`${prefix}:refresh`, undefined],
+        [`${prefix}:getSnapshot`, { ...query, limit: 7 }],
+        [`${prefix}:getSummary`, query],
+        [`${prefix}:getDaily`, query],
+        [`${prefix}:getBreakdown`, { ...query, kind: 'project' }],
+        [`${prefix}:getRecentSessions`, { ...query, limit: 4 }]
+      ])
+      invoke.mockClear()
+    }
+  })
+})
diff --git a/src/preload/usage-provider-api.ts b/src/preload/usage-provider-api.ts
new file mode 100644
index 00000000000..b80d72850c0
--- /dev/null
+++ b/src/preload/usage-provider-api.ts
@@ -0,0 +1,29 @@
+import type { IpcRenderer } from 'electron'
+import type { PreloadApi } from './api-types'
+
+type UsageProviderApiKey = 'claudeUsage' | 'codexUsage' | 'openCodeUsage'
+type UsageProviderApi = PreloadApi[UsageProviderApiKey]
+type UsageRangeArgs = { scope: string; range: string }
+
+export function createUsageProviderApi<Key extends UsageProviderApiKey>(
+  ipc: Pick<IpcRenderer, 'invoke'>,
+  prefix: Key
+): PreloadApi[Key]
+export function createUsageProviderApi(
+  ipc: Pick<IpcRenderer, 'invoke'>,
+  prefix: UsageProviderApiKey
+): UsageProviderApi {
+  return {
+    getScanState: () => ipc.invoke(`${prefix}:getScanState`),
+    setEnabled: (args: { enabled: boolean }) => ipc.invoke(`${prefix}:setEnabled`, args),
+    refresh: (args?: { force?: boolean }) => ipc.invoke(`${prefix}:refresh`, args),
+    getSnapshot: (args: UsageRangeArgs & { limit?: number }) =>
+      ipc.invoke(`${prefix}:getSnapshot`, args),
+    getSummary: (args: UsageRangeArgs) => ipc.invoke(`${prefix}:getSummary`, args),
+    getDaily: (args: UsageRangeArgs) => ipc.invoke(`${prefix}:getDaily`, args),
+    getBreakdown: (args: UsageRangeArgs & { kind: string }) =>
+      ipc.invoke(`${prefix}:getBreakdown`, args),
+    getRecentSessions: (args: UsageRangeArgs & { limit?: number }) =>
+      ipc.invoke(`${prefix}:getRecentSessions`, args)
+  }
+}
diff --git a/src/relay/agent-hook-server.ts b/src/relay/agent-hook-server.ts
index 3166c70a2f5..6a281a7ed83 100644
--- a/src/relay/agent-hook-server.ts
+++ b/src/relay/agent-hook-server.ts
@@ -1,8 +1,9 @@
 /* eslint-disable max-lines -- Why: parsing, replay cache, endpoint writing, and retry state are one lifecycle unit; splitting obscures cleanup ordering across reconnects. */
 // Relay-side adapter for the shared agent-hook listener: hosts a loopback HTTP server and
 // forwards each parsed payload via a callback so `relay.ts` re-emits it as an `agent.hook`
-// JSON-RPC notification over the SSH channel. Replay cache is bounded one-entry-per-paneKey —
-// see docs/design/agent-status-over-ssh.md §5 (Path 3, request-driven replay) for the rationale.
+// JSON-RPC notification over the SSH channel. Replay cache is bounded one-entry-per-paneKey: a
+// reattaching Orca only needs each pane's current status, never its history, and the bound keeps a
+// long-lived relay from growing with every event.
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'
 import { randomUUID } from 'node:crypto'
 import { basename, dirname, join } from 'node:path'
@@ -99,10 +100,10 @@ export class RelayAgentHookServer {
   private state: HookListenerState = createHookListenerState()
   // Why: retain envelope metadata so replays match live POSTs.
   // Invariant: keys mirror state.lastStatusByPaneKey, populated/cleared in lockstep.
-  private lastEnvelopeMetaByPaneKey: Map<
+  private lastEnvelopeMetaByPaneKey = new Map<
     string,
     { source: AgentHookSource; env?: string; version?: string }
-  > = new Map()
+  >()
   private assistantMessageRetryTimers = new Map<string, ReturnType<typeof setTimeout>>()
   private codexSubagentPollTimers = new Map<string, ReturnType<typeof setTimeout>>()
   private forward: RelayHookForward
diff --git a/src/relay/ai-vault-handler.test.ts b/src/relay/ai-vault-handler.test.ts
index efc9a207a73..eb90958d0a2 100644
--- a/src/relay/ai-vault-handler.test.ts
+++ b/src/relay/ai-vault-handler.test.ts
@@ -8,8 +8,13 @@ import {
   SSH_AI_VAULT_RESOLVE_SESSION_TITLES_METHOD
 } from '../shared/ssh-ai-vault-relay'
 import { getRemoteHostPlatform } from '../main/ssh/ssh-remote-platform'
+import type { RemoteHostPlatform } from '../main/ssh/ssh-remote-platform'
+import { scanRemoteAiVaultSessions } from '../main/ai-vault/remote-session-scanner'
+import { readAiVaultSessionTitlesFromFiles } from '../main/ai-vault/session-title-file-reader'
 import type { RelayDispatcher, RequestContext } from './dispatcher'
 import { AiVaultHandler } from './ai-vault-handler'
+import { createRelayAiVaultFilesystemProvider } from './ai-vault-service-filesystem'
+import type { RelayAiVaultServiceApi } from './ai-vault-service-client-state'
 
 type RequestHandler = (params: Record<string, unknown>, context: RequestContext) => Promise<unknown>
 
@@ -49,7 +54,7 @@ describe('AiVaultHandler', () => {
     new AiVaultHandler(dispatcher.value, {
       remoteHome,
       hostPlatform: getRemoteHostPlatform('linux-x64'),
-      scanRemoteSessions
+      service: createTestService(remoteHome, getRemoteHostPlatform('linux-x64'), scanRemoteSessions)
     })
 
     await expect(
@@ -99,7 +104,8 @@ describe('AiVaultHandler', () => {
     const dispatcher = createMockDispatcher()
     new AiVaultHandler(dispatcher.value, {
       remoteHome,
-      hostPlatform: getRemoteHostPlatform('linux-x64')
+      hostPlatform: getRemoteHostPlatform('linux-x64'),
+      service: createTestService(remoteHome, getRemoteHostPlatform('linux-x64'))
     })
 
     const result = (await dispatcher.call(SSH_AI_VAULT_LIST_SESSIONS_METHOD, {
@@ -123,7 +129,11 @@ describe('AiVaultHandler', () => {
     new AiVaultHandler(dispatcher.value, {
       remoteHome: '/home/ada',
       hostPlatform: getRemoteHostPlatform('linux-x64'),
-      scanRemoteSessions
+      service: createTestService(
+        '/home/ada',
+        getRemoteHostPlatform('linux-x64'),
+        scanRemoteSessions
+      )
     })
     const scopePaths = Array.from({ length: 80 }, (_, index) => `/repo/${index}`)
 
@@ -156,7 +166,11 @@ describe('AiVaultHandler', () => {
     new AiVaultHandler(dispatcher.value, {
       remoteHome: '/home/ada',
       hostPlatform: getRemoteHostPlatform('linux-x64'),
-      scanRemoteSessions
+      service: createTestService(
+        '/home/ada',
+        getRemoteHostPlatform('linux-x64'),
+        scanRemoteSessions
+      )
     })
 
     await dispatcher.call(SSH_AI_VAULT_LIST_SESSIONS_METHOD, {
@@ -183,7 +197,11 @@ describe('AiVaultHandler', () => {
     new AiVaultHandler(dispatcher.value, {
       remoteHome: '/home/ada',
       hostPlatform: getRemoteHostPlatform('linux-x64'),
-      scanRemoteSessions: scanRemoteSessions as never
+      service: createTestService(
+        '/home/ada',
+        getRemoteHostPlatform('linux-x64'),
+        scanRemoteSessions as never
+      )
     })
     const firstController = new AbortController()
     const first = dispatcher.call(
@@ -219,7 +237,11 @@ describe('AiVaultHandler', () => {
     new AiVaultHandler(dispatcher.value, {
       remoteHome: '/home/ada',
       hostPlatform: getRemoteHostPlatform('linux-x64'),
-      scanRemoteSessions: scanRemoteSessions as never
+      service: createTestService(
+        '/home/ada',
+        getRemoteHostPlatform('linux-x64'),
+        scanRemoteSessions as never
+      )
     })
     const first = dispatcher.call(SSH_AI_VAULT_LIST_SESSIONS_METHOD, { limit: 20 })
     await vi.waitFor(() => expect(signals).toHaveLength(1))
@@ -254,11 +276,31 @@ describe('AiVaultHandler', () => {
     }
   })
 
+  it('soft-disables the method instead of aborting relay startup when the service is missing', () => {
+    const stderr = vi.spyOn(process.stderr, 'write').mockReturnValue(true)
+    try {
+      const dispatcher = createMockDispatcher()
+
+      expect(
+        () =>
+          new AiVaultHandler(dispatcher.value, {
+            remoteHome: '/home/ada',
+            hostPlatform: getRemoteHostPlatform('linux-x64')
+          })
+      ).not.toThrow()
+
+      expect(() => dispatcher.call(SSH_AI_VAULT_LIST_SESSIONS_METHOD, {})).toThrow(/No handler/)
+    } finally {
+      stderr.mockRestore()
+    }
+  })
+
   it('stops a relay-local scan when the owning request is cancelled', async () => {
     const dispatcher = createMockDispatcher()
     new AiVaultHandler(dispatcher.value, {
       remoteHome: '/home/ada',
-      hostPlatform: getRemoteHostPlatform('linux-x64')
+      hostPlatform: getRemoteHostPlatform('linux-x64'),
+      service: createTestService('/home/ada', getRemoteHostPlatform('linux-x64'))
     })
     const controller = new AbortController()
     controller.abort()
@@ -267,6 +309,70 @@ describe('AiVaultHandler', () => {
       dispatcher.call(SSH_AI_VAULT_LIST_SESSIONS_METHOD, {}, controller.signal)
     ).rejects.toMatchObject({ name: 'AbortError' })
   })
+
+  it('returns a host issue when the sidecar is unavailable', async () => {
+    const dispatcher = createMockDispatcher()
+    new AiVaultHandler(dispatcher.value, {
+      remoteHome: '/home/ada',
+      hostPlatform: getRemoteHostPlatform('linux-x64'),
+      service: {
+        listSessions: () => Promise.reject(new Error('sidecar crashed')),
+        resolveSessionTitles: () => Promise.resolve({ titles: [] })
+      }
+    })
+
+    await expect(dispatcher.call(SSH_AI_VAULT_LIST_SESSIONS_METHOD, {})).resolves.toMatchObject({
+      sessions: [],
+      issues: [
+        expect.objectContaining({ kind: 'host', message: expect.stringContaining('sidecar') })
+      ]
+    })
+  })
+
+  it('returns no titles instead of an RPC error when the sidecar is unavailable', async () => {
+    const stderr = vi.spyOn(process.stderr, 'write').mockReturnValue(true)
+    try {
+      const dispatcher = createMockDispatcher()
+      new AiVaultHandler(dispatcher.value, {
+        remoteHome: '/home/ada',
+        hostPlatform: getRemoteHostPlatform('linux-x64'),
+        service: {
+          listSessions: () => Promise.resolve(emptyResult()),
+          resolveSessionTitles: () => Promise.reject(new Error('sidecar crashed'))
+        }
+      })
+
+      await expect(
+        dispatcher.call(SSH_AI_VAULT_RESOLVE_SESSION_TITLES_METHOD, {
+          requests: [
+            { agent: 'codex', sessionId: 'ssh-session', transcriptPath: '/home/ada/s.jsonl' }
+          ]
+        })
+      ).resolves.toEqual({ titles: [] })
+    } finally {
+      stderr.mockRestore()
+    }
+  })
+
+  it('propagates title cancellation instead of degrading it', async () => {
+    const dispatcher = createMockDispatcher()
+    new AiVaultHandler(dispatcher.value, {
+      remoteHome: '/home/ada',
+      hostPlatform: getRemoteHostPlatform('linux-x64'),
+      service: {
+        listSessions: () => Promise.resolve(emptyResult()),
+        resolveSessionTitles: () => {
+          const error = new Error('The operation was aborted.')
+          error.name = 'AbortError'
+          return Promise.reject(error)
+        }
+      }
+    })
+
+    await expect(
+      dispatcher.call(SSH_AI_VAULT_RESOLVE_SESSION_TITLES_METHOD, { requests: [] })
+    ).rejects.toMatchObject({ name: 'AbortError' })
+  })
 })
 
 async function makeTemporaryHome(): Promise<string> {
@@ -279,6 +385,28 @@ function emptyResult(): AiVaultListResult {
   return { sessions: [], issues: [], scannedAt: '2026-07-26T00:00:00.000Z' }
 }
 
+function createTestService(
+  remoteHome: string,
+  hostPlatform: RemoteHostPlatform,
+  scan: typeof scanRemoteAiVaultSessions = scanRemoteAiVaultSessions
+): RelayAiVaultServiceApi {
+  return {
+    listSessions: (params, signal) =>
+      scan({
+        provider: createRelayAiVaultFilesystemProvider(),
+        executionHostId: 'local',
+        remoteHome,
+        hostPlatform,
+        limit: params.limit,
+        unlimited: params.unlimited,
+        scopePaths: params.scopePaths,
+        signal
+      }),
+    resolveSessionTitles: (requests, signal) =>
+      readAiVaultSessionTitlesFromFiles(requests, { signal })
+  }
+}
+
 function createMockDispatcher(): {
   value: RelayDispatcher
   call: (method: string, params: Record<string, unknown>, signal?: AbortSignal) => Promise<unknown>
diff --git a/src/relay/ai-vault-handler.ts b/src/relay/ai-vault-handler.ts
index a5f26fff7eb..d3e83448ce8 100644
--- a/src/relay/ai-vault-handler.ts
+++ b/src/relay/ai-vault-handler.ts
@@ -1,4 +1,3 @@
-import { lstat, readdir } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { AI_VAULT_SCOPE_PATHS_MAX_COUNT, type AiVaultListResult } from '../shared/ai-vault-types'
 import { LOCAL_EXECUTION_HOST_ID } from '../shared/execution-host'
@@ -14,34 +13,25 @@ import {
   SSH_AI_VAULT_SCOPE_PATH_MAX_LENGTH,
   type SshAiVaultRelayListParams
 } from '../shared/ssh-ai-vault-relay'
-import { scanRemoteAiVaultSessions } from '../main/ai-vault/remote-session-scanner'
-import type { RemoteSessionFilesystemProvider } from '../main/ai-vault/remote-session-scanner-types'
 import { getRemoteHostPlatform, type RemoteHostPlatform } from '../main/ssh/ssh-remote-platform'
 import { parseUnameToRelayPlatform } from '../main/ssh/relay-protocol'
-import { readRelayFileContent } from './fs-handler-file-read'
 import { relayLogLine } from './relay-diagnostic-log'
 import type { RelayDispatcher } from './dispatcher'
 import { AiVaultScanCoordinator } from '../main/ai-vault/ai-vault-scan-coordinator'
-import { readAiVaultSessionTitlesFromFiles } from '../main/ai-vault/session-title-file-reader'
-
-type ScanRemoteSessions = typeof scanRemoteAiVaultSessions
+import type { RelayAiVaultServiceApi } from './ai-vault-service-client-state'
 
 type AiVaultHandlerOptions = {
   remoteHome?: string
   hostPlatform?: RemoteHostPlatform
-  scanRemoteSessions?: ScanRemoteSessions
+  service?: RelayAiVaultServiceApi
 }
 
 export class AiVaultHandler {
   private readonly remoteHome: string
-  private readonly scanRemoteSessions: ScanRemoteSessions
-  private readonly provider: RemoteSessionFilesystemProvider
   private readonly scanCoordinator = new AiVaultScanCoordinator()
 
   constructor(dispatcher: RelayDispatcher, options: AiVaultHandlerOptions = {}) {
     this.remoteHome = options.remoteHome ?? homedir()
-    this.scanRemoteSessions = options.scanRemoteSessions ?? scanRemoteAiVaultSessions
-    this.provider = createRelayAiVaultFilesystemProvider()
     const hostPlatform = options.hostPlatform ?? currentRelayHostPlatform()
     // Why: an OS/arch this build has no path flavor for must not abort relay
     // startup — leaving the method unregistered soft-disables the feature and
@@ -52,48 +42,78 @@ export class AiVaultHandler {
       )
       return
     }
+    // Why: same reasoning as an unsupported platform. Throwing here would take
+    // relay startup — and every PTY on the host — down over a Vault wiring bug.
+    const service = options.service
+    if (!service) {
+      relayLogLine('[relay] Agent Session History disabled: service unavailable')
+      return
+    }
     dispatcher.onRequest(SSH_AI_VAULT_LIST_SESSIONS_METHOD, (params, context) =>
-      this.listSessions(hostPlatform, params, context.signal)
+      this.listSessions(service, params, context.signal)
     )
     dispatcher.onRequest(SSH_AI_VAULT_RESOLVE_SESSION_TITLES_METHOD, (params, context) =>
-      this.resolveSessionTitles(params, context.signal)
+      this.resolveSessionTitles(service, params, context.signal)
     )
   }
 
-  private resolveSessionTitles(
+  private async resolveSessionTitles(
+    service: RelayAiVaultServiceApi,
     rawParams: Record<string, unknown>,
     signal?: AbortSignal
   ): Promise<AiVaultSessionTitlesResult> {
-    return readAiVaultSessionTitlesFromFiles(normalizeTitleRequests(rawParams.requests), { signal })
+    try {
+      return await service.resolveSessionTitles(normalizeTitleRequests(rawParams.requests), signal)
+    } catch (error) {
+      if (error instanceof Error && error.name === 'AbortError') {
+        throw error
+      }
+      // Why: titles are decoration. Degrade like an unresolvable title instead of
+      // failing the RPC, which would surface a raw error on every list row.
+      relayLogLine(
+        `[relay-ai-vault-service] title resolution unavailable: ${error instanceof Error ? error.message : String(error)}`
+      )
+      return { titles: [] }
+    }
   }
 
   private async listSessions(
-    hostPlatform: RemoteHostPlatform,
+    service: RelayAiVaultServiceApi,
     rawParams: Record<string, unknown>,
     signal?: AbortSignal
   ): Promise<AiVaultListResult> {
     const params = normalizeSshAiVaultRelayListParams(rawParams)
-    const result = await this.scanCoordinator.run({
-      key: JSON.stringify({
-        limit: params.limit,
-        unlimited: params.unlimited,
-        scopePaths: params.scopePaths,
-        scopePathsTruncated: params.scopePathsTruncated
-      }),
-      force: params.force,
-      signal,
-      start: (scanSignal) =>
-        this.scanRemoteSessions({
-          provider: this.provider,
-          executionHostId: LOCAL_EXECUTION_HOST_ID,
-          remoteHome: this.remoteHome,
-          hostPlatform,
+    let result: AiVaultListResult
+    try {
+      result = await this.scanCoordinator.run({
+        key: JSON.stringify({
           limit: params.limit,
           unlimited: params.unlimited,
           scopePaths: params.scopePaths,
-          signal: scanSignal
-        })
-    })
+          scopePathsTruncated: params.scopePathsTruncated
+        }),
+        force: params.force,
+        signal,
+        start: (scanSignal) => service.listSessions(params, scanSignal)
+      })
+    } catch (error) {
+      if (error instanceof Error && error.name === 'AbortError') {
+        throw error
+      }
+      result = {
+        sessions: [],
+        scannedAt: new Date().toISOString(),
+        issues: [
+          {
+            executionHostId: LOCAL_EXECUTION_HOST_ID,
+            agent: 'codex',
+            kind: 'host',
+            path: this.remoteHome,
+            message: `Agent Session History service unavailable: ${error instanceof Error ? error.message : String(error)}`
+          }
+        ]
+      }
+    }
     if (!params.scopePathsTruncated) {
       return result
     }
@@ -176,29 +196,3 @@ function currentRelayHostPlatform(): RemoteHostPlatform | null {
   const relayPlatform = parseUnameToRelayPlatform(process.platform, process.arch)
   return relayPlatform ? getRemoteHostPlatform(relayPlatform) : null
 }
-
-function createRelayAiVaultFilesystemProvider(): RemoteSessionFilesystemProvider {
-  return {
-    async readDir(dirPath) {
-      const entries = await readdir(dirPath, { withFileTypes: true })
-      return entries.map((entry) => ({
-        name: entry.name,
-        isDirectory: entry.isDirectory(),
-        isSymlink: entry.isSymbolicLink()
-      }))
-    },
-    readFile: readRelayFileContent,
-    async stat(filePath) {
-      const stats = await lstat(filePath)
-      return {
-        size: stats.size,
-        type: stats.isDirectory() ? 'directory' : stats.isSymbolicLink() ? 'symlink' : 'file',
-        mtime: stats.mtimeMs,
-        mtimeMs: stats.mtimeMs,
-        dev: stats.dev,
-        ino: stats.ino,
-        nlink: stats.nlink
-      }
-    }
-  }
-}
diff --git a/src/relay/ai-vault-service-client-state.ts b/src/relay/ai-vault-service-client-state.ts
new file mode 100644
index 00000000000..de623d19b07
--- /dev/null
+++ b/src/relay/ai-vault-service-client-state.ts
@@ -0,0 +1,176 @@
+import type { ChildProcess } from 'node:child_process'
+import type { AiVaultListResult } from '../shared/ai-vault-types'
+import type {
+  AiVaultSessionTitleRequest,
+  AiVaultSessionTitlesResult
+} from '../shared/ai-vault-session-title'
+import type { SshAiVaultRelayListParams } from '../shared/ssh-ai-vault-relay'
+import type { RemoteHostPlatform } from '../main/ssh/ssh-remote-platform'
+import {
+  relayAiVaultServiceLane,
+  type RelayAiVaultServiceLane,
+  type RelayAiVaultServiceRequest
+} from './ai-vault-service-protocol'
+
+export const RELAY_AI_VAULT_READY_TIMEOUT_MS = 5_000
+export const RELAY_AI_VAULT_SCAN_TIMEOUT_MS = 130_000
+export const RELAY_AI_VAULT_TITLE_TIMEOUT_MS = 15_000
+export const RELAY_AI_VAULT_MAX_CALLS = 16
+export const RELAY_AI_VAULT_IDLE_TIMEOUT_MS = 10 * 60_000
+
+export function relayAiVaultAbortError(): Error {
+  const error = new Error('The operation was aborted.')
+  error.name = 'AbortError'
+  return error
+}
+
+export function relayAiVaultError(error: unknown): Error {
+  return error instanceof Error ? error : new Error(String(error))
+}
+
+export function armRelayAiVaultCancellationTimeout(
+  call: RelayAiVaultServiceCall,
+  onExpired: () => void
+): void {
+  call.timer = setTimeout(onExpired, 2_000)
+  call.timer.unref?.()
+}
+
+export function createRelayAiVaultServiceCall(args: {
+  request: RelayAiVaultServiceRequest
+  signal?: AbortSignal
+  resolve: RelayAiVaultServiceCall['resolve']
+  reject: RelayAiVaultServiceCall['reject']
+}): RelayAiVaultServiceCall {
+  return {
+    request: args.request,
+    lane: relayAiVaultServiceLane(args.request.operation),
+    signal: args.signal,
+    forceStart: args.request.operation === 'list' && args.request.params.force === true,
+    resolve: args.resolve,
+    reject: args.reject,
+    timer: null,
+    onAbort: null,
+    settled: false,
+    sent: false,
+    startRetried: false
+  }
+}
+
+/**
+ * A cold start that faults before the request reached the sidecar self-heals on
+ * the scheduled respawn. Requeue once; the caller settles when this returns false.
+ */
+export function requeueRelayAiVaultServiceStart(
+  call: RelayAiVaultServiceCall,
+  queue: RelayAiVaultServiceCall[]
+): boolean {
+  if (call.sent || call.settled || call.startRetried) {
+    return false
+  }
+  call.startRetried = true
+  queue.unshift(call)
+  return true
+}
+
+export function settleRelayAiVaultServiceCall(
+  call: RelayAiVaultServiceCall,
+  value: Error | AiVaultListResult | AiVaultSessionTitlesResult
+): void {
+  // A cancelled call is settled before its cancel watchdog is armed, so the
+  // timer has to be cleared even when the reject/resolve is already done.
+  if (call.timer) {
+    clearTimeout(call.timer)
+    call.timer = null
+  }
+  if (call.settled) {
+    return
+  }
+  call.settled = true
+  if (call.signal && call.onAbort) {
+    call.signal.removeEventListener('abort', call.onAbort)
+  }
+  if (value instanceof Error) {
+    call.reject(value)
+  } else {
+    call.resolve(value)
+  }
+}
+
+export type RelayAiVaultServiceCall = {
+  request: RelayAiVaultServiceRequest
+  lane: RelayAiVaultServiceLane
+  signal?: AbortSignal
+  forceStart: boolean
+  resolve: (value: AiVaultListResult | AiVaultSessionTitlesResult) => void
+  reject: (error: Error) => void
+  timer: NodeJS.Timeout | null
+  onAbort: (() => void) | null
+  settled: boolean
+  /** Whether the sidecar received the request; an unsent call gets no reply. */
+  sent: boolean
+  startRetried: boolean
+}
+
+export type RelayAiVaultServiceApi = {
+  listSessions(params: SshAiVaultRelayListParams, signal?: AbortSignal): Promise<AiVaultListResult>
+  resolveSessionTitles(
+    requests: AiVaultSessionTitleRequest[],
+    signal?: AbortSignal
+  ): Promise<AiVaultSessionTitlesResult>
+}
+
+export type RelayAiVaultServiceClientOptions = {
+  processFactory: () => ChildProcess
+  init: {
+    remoteHome: string
+    hostPlatform: RemoteHostPlatform
+  }
+  now?: () => number
+  idleTimeoutMs?: number
+}
+
+export class RelayAiVaultIdleRetirement {
+  private timer: NodeJS.Timeout | null = null
+
+  clear(): void {
+    if (this.timer) {
+      clearTimeout(this.timer)
+      this.timer = null
+    }
+  }
+
+  schedule(busy: boolean, timeoutMs: number, retire: () => void): void {
+    if (busy || this.timer) {
+      return
+    }
+    this.timer = setTimeout(() => {
+      this.timer = null
+      retire()
+    }, timeoutMs)
+    this.timer.unref?.()
+  }
+}
+
+export function retireRelayAiVaultServiceChild(child: ChildProcess): void {
+  const timer = setTimeout(() => child.kill(), 2_000)
+  timer.unref?.()
+  child.once('exit', () => clearTimeout(timer))
+  child.send({ type: 'shutdown' }, () => undefined)
+}
+
+/** Orderly shutdown that never holds relay teardown past the kill deadline. */
+export function shutdownRelayAiVaultServiceChild(child: ChildProcess): Promise<void> {
+  child.send({ type: 'shutdown' }, () => undefined)
+  return new Promise<void>((resolve) => {
+    const timer = setTimeout(() => {
+      child.kill()
+      resolve()
+    }, 2_000)
+    timer.unref?.()
+    child.once('exit', () => {
+      clearTimeout(timer)
+      resolve()
+    })
+  })
+}
diff --git a/src/relay/ai-vault-service-client.test.ts b/src/relay/ai-vault-service-client.test.ts
new file mode 100644
index 00000000000..10eaeb1a660
--- /dev/null
+++ b/src/relay/ai-vault-service-client.test.ts
@@ -0,0 +1,299 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { getRemoteHostPlatform } from '../main/ssh/ssh-remote-platform'
+import {
+  AiVaultServiceTestChild,
+  readyAiVaultServiceChild
+} from '../main/ai-vault/session-scanner-service-test-child'
+import { RelayAiVaultServiceClient } from './ai-vault-service-client'
+import { RELAY_AI_VAULT_READY_TIMEOUT_MS } from './ai-vault-service-client-state'
+import { relayAiVaultServiceEntryPath } from './ai-vault-service-spawn'
+
+function createClient(
+  children: AiVaultServiceTestChild[],
+  idleTimeoutMs?: number
+): RelayAiVaultServiceClient {
+  return new RelayAiVaultServiceClient({
+    init: {
+      remoteHome: '/home/ada',
+      hostPlatform: getRemoteHostPlatform('linux-x64')
+    },
+    processFactory: () => {
+      const child = new AiVaultServiceTestChild(20_000 + children.length)
+      children.push(child)
+      return child.asChildProcess()
+    },
+    idleTimeoutMs
+  })
+}
+
+function relayRequests(child: AiVaultServiceTestChild, operation: string): { id: number }[] {
+  return child.sent.filter(
+    (message) => (message as { operation?: string }).operation === operation
+  ) as { id: number }[]
+}
+
+function relayRequestCount(child: AiVaultServiceTestChild, operation: string): number {
+  return relayRequests(child, operation).length
+}
+
+function relayRequestId(child: AiVaultServiceTestChild, operation: string): number {
+  const request = relayRequests(child, operation).at(-1)
+  if (!request) {
+    throw new Error(`No ${operation} request was sent.`)
+  }
+  return request.id
+}
+
+afterEach(() => vi.useRealTimers())
+
+describe('RelayAiVaultServiceClient', () => {
+  it('holds list and title calls behind the ready handshake', async () => {
+    const children: AiVaultServiceTestChild[] = []
+    const client = createClient(children)
+    const list = client.listSessions({ limit: 20 })
+    const titles = client.resolveSessionTitles([])
+    const child = children[0]!
+
+    expect(child.sent).toEqual([expect.objectContaining({ type: 'init', protocol: 1 })])
+    readyAiVaultServiceChild(child)
+    await Promise.resolve()
+    const listRequest = child.sent.find(
+      (message) => (message as { operation?: string }).operation === 'list'
+    ) as { id: number }
+    child.emit('message', {
+      type: 'result',
+      id: listRequest.id,
+      operation: 'list',
+      value: { sessions: [], issues: [], scannedAt: '2026-08-09T00:00:00.000Z' }
+    })
+    await expect(list).resolves.toMatchObject({ sessions: [] })
+    const titleRequest = child.sent.find(
+      (message) => (message as { operation?: string }).operation === 'titles'
+    ) as { id: number }
+    child.emit('message', {
+      type: 'result',
+      id: titleRequest.id,
+      operation: 'titles',
+      value: { titles: [] }
+    })
+    await expect(titles).resolves.toEqual({ titles: [] })
+    const disposing = client.dispose()
+    child.emit('exit', 0)
+    await disposing
+  })
+
+  it('resolves titles while a scan still occupies the cache lane', async () => {
+    const children: AiVaultServiceTestChild[] = []
+    const client = createClient(children)
+    const list = client.listSessions({})
+    const child = children[0]!
+    readyAiVaultServiceChild(child)
+    await Promise.resolve()
+
+    const titles = client.resolveSessionTitles([
+      { agent: 'claude', sessionId: 'session-1', transcriptPath: '/home/ada/session-1.jsonl' }
+    ])
+    await Promise.resolve()
+    child.emit('message', {
+      type: 'result',
+      id: relayRequestId(child, 'titles'),
+      operation: 'titles',
+      value: { titles: [] }
+    })
+
+    await expect(titles).resolves.toEqual({ titles: [] })
+    child.emit('message', {
+      type: 'result',
+      id: relayRequestId(child, 'list'),
+      operation: 'list',
+      value: { sessions: [], issues: [], scannedAt: '2026-08-09T00:00:00.000Z' }
+    })
+    await expect(list).resolves.toMatchObject({ sessions: [] })
+    const disposing = client.dispose()
+    child.emit('exit', 0)
+    await disposing
+  })
+
+  it('does not start queued cache work until cancelled work acknowledges', async () => {
+    vi.useFakeTimers()
+    const children: AiVaultServiceTestChild[] = []
+    const client = createClient(children)
+    const controller = new AbortController()
+    const first = client.listSessions({}, controller.signal)
+    const second = client.listSessions({ limit: 5 })
+    const child = children[0]!
+    readyAiVaultServiceChild(child)
+    await Promise.resolve()
+    const firstRequest = relayRequestId(child, 'list')
+
+    controller.abort()
+    await expect(first).rejects.toMatchObject({ name: 'AbortError' })
+    expect(relayRequestCount(child, 'list')).toBe(1)
+    child.emit('message', {
+      type: 'error',
+      id: firstRequest,
+      message: 'aborted'
+    })
+    await Promise.resolve()
+    expect(relayRequestCount(child, 'list')).toBe(2)
+    void second.catch(() => undefined)
+    const disposing = client.dispose()
+    child.emit('exit', 0)
+    await disposing
+  })
+
+  it('drops a call cancelled before the sidecar received it', async () => {
+    vi.useFakeTimers()
+    const children: AiVaultServiceTestChild[] = []
+    const client = createClient(children)
+    const controller = new AbortController()
+    const cancelled = client.listSessions({}, controller.signal)
+    const child = children[0]!
+
+    controller.abort()
+    await expect(cancelled).rejects.toMatchObject({ name: 'AbortError' })
+    expect(child.sent).not.toContainEqual(expect.objectContaining({ type: 'cancel' }))
+
+    readyAiVaultServiceChild(child)
+    const next = client.listSessions({ limit: 5 })
+    await Promise.resolve()
+    child.emit('message', {
+      type: 'result',
+      id: relayRequestId(child, 'list'),
+      operation: 'list',
+      value: { sessions: [], issues: [], scannedAt: '2026-08-09T00:00:00.000Z' }
+    })
+    await expect(next).resolves.toMatchObject({ sessions: [] })
+    vi.advanceTimersByTime(2_000)
+
+    expect(child.killed).toBe(false)
+    const disposing = client.dispose()
+    child.emit('exit', 0)
+    await disposing
+  })
+
+  it('retries a cold-start crash once without faulting the replacement sidecar', async () => {
+    vi.useFakeTimers()
+    const children: AiVaultServiceTestChild[] = []
+    const client = createClient(children)
+    const list = client.listSessions({})
+
+    children[0]!.emit('exit', 1)
+    await Promise.resolve()
+    vi.advanceTimersByTime(250)
+    expect(children).toHaveLength(2)
+    readyAiVaultServiceChild(children[1]!)
+    await Promise.resolve()
+    vi.advanceTimersByTime(RELAY_AI_VAULT_READY_TIMEOUT_MS)
+
+    expect(children[1]!.killed).toBe(false)
+    children[1]!.emit('message', {
+      type: 'result',
+      id: relayRequestId(children[1]!, 'list'),
+      operation: 'list',
+      value: { sessions: [], issues: [], scannedAt: '2026-08-09T00:00:00.000Z' }
+    })
+    await expect(list).resolves.toMatchObject({ sessions: [] })
+    const disposing = client.dispose()
+    children[1]!.emit('exit', 0)
+    await disposing
+  })
+
+  it('keeps the sidecar alive once a cancelled call acknowledges', async () => {
+    vi.useFakeTimers()
+    const children: AiVaultServiceTestChild[] = []
+    const client = createClient(children)
+    const controller = new AbortController()
+    const first = client.listSessions({}, controller.signal)
+    const second = client.resolveSessionTitles([])
+    const child = children[0]!
+    readyAiVaultServiceChild(child)
+    await Promise.resolve()
+    const firstRequest = child.sent.find(
+      (message) => (message as { operation?: string }).operation === 'list'
+    ) as { id: number }
+
+    controller.abort()
+    await expect(first).rejects.toMatchObject({ name: 'AbortError' })
+    child.emit('message', { type: 'error', id: firstRequest.id, message: 'aborted' })
+    await Promise.resolve()
+    vi.advanceTimersByTime(2_000)
+
+    expect(child.killed).toBe(false)
+    const titleRequest = child.sent.find(
+      (message) => (message as { operation?: string }).operation === 'titles'
+    ) as { id: number }
+    child.emit('message', {
+      type: 'result',
+      id: titleRequest.id,
+      operation: 'titles',
+      value: { titles: [] }
+    })
+    await expect(second).resolves.toEqual({ titles: [] })
+    const disposing = client.dispose()
+    child.emit('exit', 0)
+    await disposing
+  })
+
+  it('restarts queued work after a sidecar crash with bounded backoff', async () => {
+    vi.useFakeTimers()
+    const children: AiVaultServiceTestChild[] = []
+    const client = createClient(children)
+    const first = client.listSessions({})
+    const second = client.listSessions({ limit: 5 })
+    readyAiVaultServiceChild(children[0]!)
+    await Promise.resolve()
+
+    children[0]!.emit('exit', 1)
+    await expect(first).rejects.toThrow('exited')
+    expect(children).toHaveLength(1)
+    vi.advanceTimersByTime(250)
+    expect(children).toHaveLength(2)
+    readyAiVaultServiceChild(children[1]!)
+    await Promise.resolve()
+    children[1]!.emit('message', {
+      type: 'result',
+      id: relayRequestId(children[1]!, 'list'),
+      operation: 'list',
+      value: { sessions: [], issues: [], scannedAt: '2026-08-09T00:00:00.000Z' }
+    })
+    await expect(second).resolves.toMatchObject({ sessions: [] })
+    const disposing = client.dispose()
+    children[1]!.emit('exit', 0)
+    await disposing
+  })
+
+  it('retires the sidecar after the idle bound', async () => {
+    vi.useFakeTimers()
+    const children: AiVaultServiceTestChild[] = []
+    const client = createClient(children, 100)
+    const list = client.listSessions({})
+    const child = children[0]!
+    readyAiVaultServiceChild(child)
+    await Promise.resolve()
+    const request = child.sent.find(
+      (message) => (message as { operation?: string }).operation === 'list'
+    ) as { id: number }
+    child.emit('message', {
+      type: 'result',
+      id: request.id,
+      operation: 'list',
+      value: { sessions: [], issues: [], scannedAt: '2026-08-09T00:00:00.000Z' }
+    })
+    await list
+
+    vi.advanceTimersByTime(99)
+    expect(child.sent).not.toContainEqual({ type: 'shutdown' })
+    vi.advanceTimersByTime(1)
+    expect(child.sent).toContainEqual({ type: 'shutdown' })
+    vi.advanceTimersByTime(2_000)
+    expect(child.killed).toBe(true)
+    await client.dispose()
+  })
+
+  it('resolves the sidecar beside each bundled relay', () => {
+    expect(relayAiVaultServiceEntryPath('/opt/orca/relay')).toBe(
+      '/opt/orca/relay/relay-ai-vault-service.js'
+    )
+  })
+})
diff --git a/src/relay/ai-vault-service-client.ts b/src/relay/ai-vault-service-client.ts
new file mode 100644
index 00000000000..c873c380506
--- /dev/null
+++ b/src/relay/ai-vault-service-client.ts
@@ -0,0 +1,314 @@
+import type { ChildProcess } from 'node:child_process'
+import type { AiVaultListResult } from '../shared/ai-vault-types'
+import type {
+  AiVaultSessionTitleRequest,
+  AiVaultSessionTitlesResult
+} from '../shared/ai-vault-session-title'
+import type { SshAiVaultRelayListParams } from '../shared/ssh-ai-vault-relay'
+import {
+  RELAY_AI_VAULT_MAX_CALLS,
+  RELAY_AI_VAULT_IDLE_TIMEOUT_MS,
+  RELAY_AI_VAULT_READY_TIMEOUT_MS,
+  RELAY_AI_VAULT_SCAN_TIMEOUT_MS,
+  RELAY_AI_VAULT_TITLE_TIMEOUT_MS,
+  armRelayAiVaultCancellationTimeout,
+  createRelayAiVaultServiceCall,
+  relayAiVaultAbortError,
+  relayAiVaultError,
+  RelayAiVaultIdleRetirement,
+  requeueRelayAiVaultServiceStart,
+  retireRelayAiVaultServiceChild,
+  settleRelayAiVaultServiceCall,
+  shutdownRelayAiVaultServiceChild,
+  type RelayAiVaultServiceApi,
+  type RelayAiVaultServiceCall,
+  type RelayAiVaultServiceClientOptions
+} from './ai-vault-service-client-state'
+import {
+  RELAY_AI_VAULT_SERVICE_PROTOCOL,
+  isRelayAiVaultServiceChildMessage,
+  type RelayAiVaultServiceChildMessage,
+  type RelayAiVaultServiceInit,
+  type RelayAiVaultServiceLane,
+  type RelayAiVaultServiceRequest
+} from './ai-vault-service-protocol'
+import { RelayAiVaultRestartPolicy } from './ai-vault-service-restart-policy'
+import { relayLogLine } from './relay-diagnostic-log'
+
+export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
+  private child: ChildProcess | null = null
+  private ready: Promise<ChildProcess> | null = null
+  private readyReject: ((error: Error) => void) | null = null
+  private readyTimer: NodeJS.Timeout | null = null
+  private readonly active = new Map<RelayAiVaultServiceLane, RelayAiVaultServiceCall>()
+  private readonly queue: RelayAiVaultServiceCall[] = []
+  private nextId = 1
+  private readonly restartPolicy: RelayAiVaultRestartPolicy
+  private readonly idleRetirement = new RelayAiVaultIdleRetirement()
+  private disposed = false
+
+  constructor(private readonly options: RelayAiVaultServiceClientOptions) {
+    this.restartPolicy = new RelayAiVaultRestartPolicy(options.now)
+  }
+
+  listSessions(
+    params: SshAiVaultRelayListParams,
+    signal?: AbortSignal
+  ): Promise<AiVaultListResult> {
+    return this.request({ type: 'request', id: this.nextId++, operation: 'list', params }, signal)
+  }
+
+  resolveSessionTitles(
+    requests: AiVaultSessionTitleRequest[],
+    signal?: AbortSignal
+  ): Promise<AiVaultSessionTitlesResult> {
+    return this.request(
+      { type: 'request', id: this.nextId++, operation: 'titles', requests },
+      signal
+    )
+  }
+
+  async dispose(): Promise<void> {
+    this.disposed = true
+    this.idleRetirement.clear()
+    this.clearReadyTimer()
+    this.restartPolicy.dispose()
+    const error = new Error('Relay AI Vault service was disposed.')
+    for (const call of [...this.active.values(), ...this.queue.splice(0)]) {
+      settleRelayAiVaultServiceCall(call, error)
+    }
+    this.active.clear()
+    const child = this.detachChild()
+    if (child) {
+      await shutdownRelayAiVaultServiceChild(child)
+    }
+  }
+
+  private request<T extends AiVaultListResult | AiVaultSessionTitlesResult>(
+    request: RelayAiVaultServiceRequest,
+    signal?: AbortSignal
+  ): Promise<T> {
+    if (this.disposed) {
+      return Promise.reject(new Error('Relay AI Vault service was disposed.'))
+    }
+    if (signal?.aborted) {
+      return Promise.reject(relayAiVaultAbortError())
+    }
+    if (this.queue.length + this.active.size >= RELAY_AI_VAULT_MAX_CALLS) {
+      return Promise.reject(new Error('Relay AI Vault service queue is full.'))
+    }
+    return new Promise<T>((resolve, reject) => {
+      const call = createRelayAiVaultServiceCall({
+        request,
+        signal,
+        resolve: resolve as RelayAiVaultServiceCall['resolve'],
+        reject
+      })
+      if (signal) {
+        call.onAbort = () => this.cancel(call)
+        signal.addEventListener('abort', call.onAbort, { once: true })
+      }
+      this.queue.push(call)
+      this.idleRetirement.clear()
+      this.pump()
+    })
+  }
+
+  private pump(): void {
+    if (this.disposed || this.restartPolicy.restartScheduled) {
+      return
+    }
+    for (const lane of ['cache', 'interactive'] as const) {
+      if (this.active.has(lane)) {
+        continue
+      }
+      const index = this.queue.findIndex((call) => call.lane === lane)
+      if (index === -1) {
+        continue
+      }
+      const call = this.queue.splice(index, 1)[0]!
+      this.active.set(lane, call)
+      void this.ensureChild(call.forceStart).then(
+        (child) => this.sendCall(child, call),
+        (error: Error) => {
+          if (this.active.get(lane) !== call) {
+            return
+          }
+          this.active.delete(lane)
+          this.retryStartOrSettle(call, error)
+          this.pump()
+        }
+      )
+    }
+    this.scheduleIdleIfNeeded()
+  }
+
+  private sendCall(child: ChildProcess, call: RelayAiVaultServiceCall): void {
+    if (this.active.get(call.lane) !== call || call.settled) {
+      return
+    }
+    const timeout =
+      call.request.operation === 'list'
+        ? RELAY_AI_VAULT_SCAN_TIMEOUT_MS
+        : RELAY_AI_VAULT_TITLE_TIMEOUT_MS
+    call.timer = setTimeout(
+      () => this.onFault(new Error(`Relay AI Vault service timed out after ${timeout}ms.`)),
+      timeout
+    )
+    call.timer.unref?.()
+    call.sent = true
+    child.send(call.request)
+  }
+
+  private retryStartOrSettle(call: RelayAiVaultServiceCall, error: Error): void {
+    if (this.disposed || !requeueRelayAiVaultServiceStart(call, this.queue)) {
+      settleRelayAiVaultServiceCall(call, error)
+    }
+  }
+
+  private ensureChild(forceStart: boolean): Promise<ChildProcess> {
+    if (this.child && !this.ready) {
+      return Promise.resolve(this.child)
+    }
+    if (this.ready) {
+      return this.ready
+    }
+    const startError = this.restartPolicy.startError(forceStart)
+    if (startError) {
+      return Promise.reject(startError)
+    }
+    let child: ChildProcess
+    try {
+      child = this.options.processFactory()
+    } catch (error) {
+      return Promise.reject(relayAiVaultError(error))
+    }
+    this.child = child
+    this.ready = new Promise<ChildProcess>((resolve, reject) => {
+      this.readyReject = reject
+      // Why: held on the instance so a crash before ready cannot leave the deadline
+      // armed, where it would later fault the healthy replacement sidecar.
+      this.readyTimer = setTimeout(
+        () => this.onFault(new Error('Relay AI Vault service did not become ready.')),
+        RELAY_AI_VAULT_READY_TIMEOUT_MS
+      )
+      this.readyTimer.unref?.()
+      child.on('message', (message) => {
+        if (isRelayAiVaultServiceChildMessage(message) && message.type === 'ready') {
+          this.clearReadyTimer()
+          this.ready = null
+          this.readyReject = null
+          resolve(child)
+          return
+        }
+        this.onMessage(message)
+      })
+    })
+    child.on('error', (error) => this.onFault(error))
+    child.on('disconnect', () => this.onFault(new Error('Relay AI Vault service disconnected.')))
+    child.on('exit', (code) => this.onFault(new Error(`Relay AI Vault service exited (${code}).`)))
+    child.stderr?.on('data', (chunk: Buffer) =>
+      relayLogLine(`[relay-ai-vault-service] ${String(chunk).trimEnd()}`)
+    )
+    child.send({
+      type: 'init',
+      protocol: RELAY_AI_VAULT_SERVICE_PROTOCOL,
+      ...this.options.init
+    } satisfies RelayAiVaultServiceInit)
+    return this.ready
+  }
+
+  private onMessage(raw: unknown): void {
+    if (!isRelayAiVaultServiceChildMessage(raw)) {
+      this.onFault(new Error('Relay AI Vault service sent a malformed message.'))
+      return
+    }
+    const message = raw as RelayAiVaultServiceChildMessage
+    if (message.type === 'ready') {
+      return
+    }
+    const call = [...this.active.values()].find((entry) => entry.request.id === message.id)
+    if (!call) {
+      return
+    }
+    this.active.delete(call.lane)
+    settleRelayAiVaultServiceCall(
+      call,
+      message.type === 'error' ? new Error(message.message) : message.value
+    )
+    this.pump()
+  }
+
+  private cancel(call: RelayAiVaultServiceCall): void {
+    const index = this.queue.indexOf(call)
+    if (index !== -1) {
+      this.queue.splice(index, 1)
+      settleRelayAiVaultServiceCall(call, relayAiVaultAbortError())
+      this.pump()
+      return
+    }
+    if (this.active.get(call.lane) === call) {
+      // Why: a call cancelled before it reached the sidecar gets no acknowledgement,
+      // so waiting on one would kill a healthy sidecar and stall the lane.
+      if (!call.sent) {
+        this.active.delete(call.lane)
+        settleRelayAiVaultServiceCall(call, relayAiVaultAbortError())
+        this.pump()
+        return
+      }
+      this.child?.send({ type: 'cancel', id: call.request.id })
+      settleRelayAiVaultServiceCall(call, relayAiVaultAbortError())
+      armRelayAiVaultCancellationTimeout(call, () =>
+        this.onFault(new Error('Relay AI Vault service did not cancel within 2000ms.'))
+      )
+    }
+  }
+
+  private onFault(error: Error): void {
+    if (!this.child) {
+      return
+    }
+    this.idleRetirement.clear()
+    this.detachChild()?.kill()
+    this.clearReadyTimer()
+    this.readyReject?.(error)
+    this.readyReject = null
+    this.ready = null
+    const active = [...this.active.values()]
+    this.active.clear()
+    for (const call of active) {
+      this.retryStartOrSettle(call, error)
+    }
+    this.restartPolicy.recordFault()
+    if (this.queue.length > 0 && !this.disposed) {
+      this.restartPolicy.scheduleRestart(() => this.pump())
+    }
+  }
+
+  private clearReadyTimer(): void {
+    if (this.readyTimer) {
+      clearTimeout(this.readyTimer)
+      this.readyTimer = null
+    }
+  }
+
+  private detachChild(): ChildProcess | null {
+    const child = this.child
+    this.child = null
+    child?.removeAllListeners()
+    return child
+  }
+
+  private scheduleIdleIfNeeded(): void {
+    this.idleRetirement.schedule(
+      this.active.size > 0 || this.queue.length > 0 || !this.child,
+      this.options.idleTimeoutMs ?? RELAY_AI_VAULT_IDLE_TIMEOUT_MS,
+      () => {
+        const child = this.detachChild()
+        if (child) {
+          retireRelayAiVaultServiceChild(child)
+        }
+      }
+    )
+  }
+}
diff --git a/src/relay/ai-vault-service-entry.ts b/src/relay/ai-vault-service-entry.ts
new file mode 100644
index 00000000000..9bd3ea35786
--- /dev/null
+++ b/src/relay/ai-vault-service-entry.ts
@@ -0,0 +1,122 @@
+import { LOCAL_EXECUTION_HOST_ID } from '../shared/execution-host'
+import { scanRemoteAiVaultSessions } from '../main/ai-vault/remote-session-scanner'
+import { readAiVaultSessionTitlesFromFiles } from '../main/ai-vault/session-title-file-reader'
+import { createRelayAiVaultFilesystemProvider } from './ai-vault-service-filesystem'
+import {
+  RELAY_AI_VAULT_SERVICE_PROTOCOL,
+  isRelayAiVaultServiceRequest,
+  relayAiVaultServiceLane,
+  type RelayAiVaultServiceChildMessage,
+  type RelayAiVaultServiceInit,
+  type RelayAiVaultServiceParentMessage,
+  type RelayAiVaultServiceRequest
+} from './ai-vault-service-protocol'
+
+if (!process.send) {
+  throw new Error('Relay AI Vault service requires a parent IPC channel.')
+}
+
+const controllers = new Map<number, AbortController>()
+const cancelled = new Set<number>()
+const pending = new Set<number>()
+const provider = createRelayAiVaultFilesystemProvider()
+let init: RelayAiVaultServiceInit | null = null
+let cacheLane = Promise.resolve()
+let interactiveLane = Promise.resolve()
+let shuttingDown = false
+
+function send(message: RelayAiVaultServiceChildMessage): void {
+  process.send?.(message)
+}
+
+async function execute(request: RelayAiVaultServiceRequest): Promise<void> {
+  const controller = new AbortController()
+  controllers.set(request.id, controller)
+  if (cancelled.delete(request.id)) {
+    controller.abort()
+  }
+  try {
+    if (!init) {
+      throw new Error('Relay AI Vault service is not initialized.')
+    }
+    if (request.operation === 'titles') {
+      const value = await readAiVaultSessionTitlesFromFiles(request.requests, {
+        signal: controller.signal
+      })
+      send({ type: 'result', id: request.id, operation: 'titles', value })
+      return
+    }
+    const value = await scanRemoteAiVaultSessions({
+      provider,
+      executionHostId: LOCAL_EXECUTION_HOST_ID,
+      remoteHome: init.remoteHome,
+      hostPlatform: init.hostPlatform,
+      limit: request.params.limit,
+      unlimited: request.params.unlimited,
+      scopePaths: request.params.scopePaths,
+      signal: controller.signal
+    })
+    send({ type: 'result', id: request.id, operation: 'list', value })
+  } catch (error) {
+    send({
+      type: 'error',
+      id: request.id,
+      message: error instanceof Error ? error.message : String(error)
+    })
+  } finally {
+    controllers.delete(request.id)
+    cancelled.delete(request.id)
+    pending.delete(request.id)
+  }
+}
+
+async function shutdown(): Promise<void> {
+  if (shuttingDown) {
+    return
+  }
+  shuttingDown = true
+  for (const controller of controllers.values()) {
+    controller.abort()
+  }
+  await Promise.allSettled([cacheLane, interactiveLane])
+  process.disconnect?.()
+}
+
+process.on('message', (raw: RelayAiVaultServiceParentMessage) => {
+  if (raw?.type === 'init') {
+    if (init || raw.protocol !== RELAY_AI_VAULT_SERVICE_PROTOCOL) {
+      void shutdown()
+      return
+    }
+    init = raw
+    send({ type: 'ready', protocol: RELAY_AI_VAULT_SERVICE_PROTOCOL, pid: process.pid })
+    return
+  }
+  if (!init || shuttingDown) {
+    return
+  }
+  if (raw?.type === 'cancel') {
+    cancelled.add(raw.id)
+    controllers.get(raw.id)?.abort()
+    return
+  }
+  if (raw?.type === 'shutdown') {
+    void shutdown()
+    return
+  }
+  if (!isRelayAiVaultServiceRequest(raw)) {
+    return
+  }
+  if (pending.size >= 16) {
+    send({ type: 'error', id: raw.id, message: 'Relay AI Vault service queue is full.' })
+    return
+  }
+  pending.add(raw.id)
+  if (relayAiVaultServiceLane(raw.operation) === 'interactive') {
+    interactiveLane = interactiveLane.then(() => execute(raw))
+    return
+  }
+  cacheLane = cacheLane.then(() => execute(raw))
+})
+
+process.on('disconnect', () => void shutdown())
diff --git a/src/relay/ai-vault-service-factory.ts b/src/relay/ai-vault-service-factory.ts
new file mode 100644
index 00000000000..c6a20640662
--- /dev/null
+++ b/src/relay/ai-vault-service-factory.ts
@@ -0,0 +1,13 @@
+import type { RemoteHostPlatform } from '../main/ssh/ssh-remote-platform'
+import { RelayAiVaultServiceClient } from './ai-vault-service-client'
+import { spawnRelayAiVaultService } from './ai-vault-service-spawn'
+
+export function createRelayAiVaultService(
+  remoteHome: string,
+  hostPlatform: RemoteHostPlatform
+): RelayAiVaultServiceClient {
+  return new RelayAiVaultServiceClient({
+    init: { remoteHome, hostPlatform },
+    processFactory: spawnRelayAiVaultService
+  })
+}
diff --git a/src/relay/ai-vault-service-filesystem.ts b/src/relay/ai-vault-service-filesystem.ts
new file mode 100644
index 00000000000..9315b2e4b2f
--- /dev/null
+++ b/src/relay/ai-vault-service-filesystem.ts
@@ -0,0 +1,29 @@
+import { lstat, readdir } from 'node:fs/promises'
+import type { RemoteSessionFilesystemProvider } from '../main/ai-vault/remote-session-scanner-types'
+import { readRelayFileContent } from './fs-handler-file-read'
+
+export function createRelayAiVaultFilesystemProvider(): RemoteSessionFilesystemProvider {
+  return {
+    async readDir(dirPath) {
+      const entries = await readdir(dirPath, { withFileTypes: true })
+      return entries.map((entry) => ({
+        name: entry.name,
+        isDirectory: entry.isDirectory(),
+        isSymlink: entry.isSymbolicLink()
+      }))
+    },
+    readFile: readRelayFileContent,
+    async stat(filePath) {
+      const stats = await lstat(filePath)
+      return {
+        size: stats.size,
+        type: stats.isDirectory() ? 'directory' : stats.isSymbolicLink() ? 'symlink' : 'file',
+        mtime: stats.mtimeMs,
+        mtimeMs: stats.mtimeMs,
+        dev: stats.dev,
+        ino: stats.ino,
+        nlink: stats.nlink
+      }
+    }
+  }
+}
diff --git a/src/relay/ai-vault-service-protocol.ts b/src/relay/ai-vault-service-protocol.ts
new file mode 100644
index 00000000000..dbbef94f2f9
--- /dev/null
+++ b/src/relay/ai-vault-service-protocol.ts
@@ -0,0 +1,86 @@
+import type { AiVaultListResult } from '../shared/ai-vault-types'
+import type {
+  AiVaultSessionTitleRequest,
+  AiVaultSessionTitlesResult
+} from '../shared/ai-vault-session-title'
+import type { SshAiVaultRelayListParams } from '../shared/ssh-ai-vault-relay'
+import type { RemoteHostPlatform } from '../main/ssh/ssh-remote-platform'
+
+export const RELAY_AI_VAULT_SERVICE_PROTOCOL = 1
+
+export type RelayAiVaultServiceInit = {
+  type: 'init'
+  protocol: typeof RELAY_AI_VAULT_SERVICE_PROTOCOL
+  remoteHome: string
+  hostPlatform: RemoteHostPlatform
+}
+
+export type RelayAiVaultServiceRequest =
+  | {
+      type: 'request'
+      id: number
+      operation: 'list'
+      params: SshAiVaultRelayListParams
+    }
+  | {
+      type: 'request'
+      id: number
+      operation: 'titles'
+      requests: AiVaultSessionTitleRequest[]
+    }
+
+export type RelayAiVaultServiceLane = 'cache' | 'interactive'
+export type RelayAiVaultServiceOperation = RelayAiVaultServiceRequest['operation']
+
+/** Title reads must not queue behind a full scan; they back interactive UI. */
+export function relayAiVaultServiceLane(
+  operation: RelayAiVaultServiceOperation
+): RelayAiVaultServiceLane {
+  return operation === 'titles' ? 'interactive' : 'cache'
+}
+
+export type RelayAiVaultServiceParentMessage =
+  | RelayAiVaultServiceInit
+  | RelayAiVaultServiceRequest
+  | { type: 'cancel'; id: number }
+  | { type: 'shutdown' }
+
+export type RelayAiVaultServiceChildMessage =
+  | {
+      type: 'ready'
+      protocol: typeof RELAY_AI_VAULT_SERVICE_PROTOCOL
+      pid: number
+    }
+  | { type: 'result'; id: number; operation: 'list'; value: AiVaultListResult }
+  | {
+      type: 'result'
+      id: number
+      operation: 'titles'
+      value: AiVaultSessionTitlesResult
+    }
+  | { type: 'error'; id: number; message: string }
+
+export function isRelayAiVaultServiceRequest(value: unknown): value is RelayAiVaultServiceRequest {
+  if (!value || typeof value !== 'object') {
+    return false
+  }
+  const message = value as Record<string, unknown>
+  return (
+    message.type === 'request' &&
+    Number.isSafeInteger(message.id) &&
+    (message.operation === 'list' || message.operation === 'titles')
+  )
+}
+
+export function isRelayAiVaultServiceChildMessage(
+  value: unknown
+): value is RelayAiVaultServiceChildMessage {
+  if (!value || typeof value !== 'object') {
+    return false
+  }
+  const message = value as Record<string, unknown>
+  if (message.type === 'ready') {
+    return message.protocol === RELAY_AI_VAULT_SERVICE_PROTOCOL && Number.isSafeInteger(message.pid)
+  }
+  return (message.type === 'result' || message.type === 'error') && Number.isSafeInteger(message.id)
+}
diff --git a/src/relay/ai-vault-service-restart-policy.test.ts b/src/relay/ai-vault-service-restart-policy.test.ts
new file mode 100644
index 00000000000..8b9608be216
--- /dev/null
+++ b/src/relay/ai-vault-service-restart-policy.test.ts
@@ -0,0 +1,83 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { RelayAiVaultRestartPolicy } from './ai-vault-service-restart-policy'
+
+afterEach(() => vi.useRealTimers())
+
+describe('RelayAiVaultRestartPolicy', () => {
+  it('opens the circuit after three faults inside the window and closes it after', () => {
+    let now = 0
+    const policy = new RelayAiVaultRestartPolicy(() => now)
+
+    expect(policy.startError(false)).toBeNull()
+    for (let index = 0; index < 3; index += 1) {
+      policy.recordFault()
+      now += 1_000
+    }
+
+    expect(policy.startError(false)?.message).toContain('circuit is open')
+    now += 60_000
+    expect(policy.startError(false)).toBeNull()
+  })
+
+  it('keeps the circuit closed when the faults age out of the window', () => {
+    let now = 0
+    const policy = new RelayAiVaultRestartPolicy(() => now)
+
+    for (let index = 0; index < 3; index += 1) {
+      policy.recordFault()
+      now += 30_000
+    }
+
+    expect(policy.startError(false)).toBeNull()
+  })
+
+  it('lets a forced refresh reopen an open circuit', () => {
+    let now = 0
+    const policy = new RelayAiVaultRestartPolicy(() => now)
+
+    for (let index = 0; index < 3; index += 1) {
+      policy.recordFault()
+    }
+    expect(policy.startError(false)?.message).toContain('circuit is open')
+
+    expect(policy.startError(true)).toBeNull()
+    // The forced start clears the circuit outright, so the next background
+    // start is no longer refused either.
+    expect(policy.startError(false)).toBeNull()
+  })
+
+  it('backs off further with each fault and keeps one pending restart', () => {
+    vi.useFakeTimers()
+    const policy = new RelayAiVaultRestartPolicy()
+    const restart = vi.fn()
+
+    policy.recordFault()
+    policy.scheduleRestart(restart)
+    vi.advanceTimersByTime(250)
+    expect(restart).toHaveBeenCalledTimes(1)
+
+    policy.recordFault()
+    policy.scheduleRestart(restart)
+    policy.recordFault()
+    policy.scheduleRestart(restart)
+    vi.advanceTimersByTime(250)
+    expect(restart).toHaveBeenCalledTimes(1)
+
+    vi.advanceTimersByTime(5_000)
+    expect(restart).toHaveBeenCalledTimes(2)
+  })
+
+  it('cancels the pending restart on dispose', () => {
+    vi.useFakeTimers()
+    const policy = new RelayAiVaultRestartPolicy()
+    const restart = vi.fn()
+
+    policy.recordFault()
+    policy.scheduleRestart(restart)
+    policy.dispose()
+    vi.advanceTimersByTime(10_000)
+
+    expect(restart).not.toHaveBeenCalled()
+    expect(policy.restartScheduled).toBe(false)
+  })
+})
diff --git a/src/relay/ai-vault-service-restart-policy.ts b/src/relay/ai-vault-service-restart-policy.ts
new file mode 100644
index 00000000000..e764ea66f6e
--- /dev/null
+++ b/src/relay/ai-vault-service-restart-policy.ts
@@ -0,0 +1,55 @@
+const RELAY_AI_VAULT_FAULT_WINDOW_MS = 60_000
+const RELAY_AI_VAULT_RESTART_DELAYS_MS = [250, 1_000, 5_000] as const
+
+export class RelayAiVaultRestartPolicy {
+  private faults: number[] = []
+  private circuitUntil = 0
+  private timer: NodeJS.Timeout | null = null
+
+  constructor(private readonly now: () => number = Date.now) {}
+
+  get restartScheduled(): boolean {
+    return this.timer !== null
+  }
+
+  /** A forced refresh is a deliberate user action, so it reopens the circuit. */
+  startError(forceStart: boolean): Error | null {
+    if (forceStart) {
+      this.circuitUntil = 0
+      return null
+    }
+    return this.now() < this.circuitUntil
+      ? new Error('Relay AI Vault service restart circuit is open.')
+      : null
+  }
+
+  recordFault(): void {
+    const now = this.now()
+    this.faults = [
+      ...this.faults.filter((time) => now - time < RELAY_AI_VAULT_FAULT_WINDOW_MS),
+      now
+    ]
+    if (this.faults.length >= 3) {
+      this.circuitUntil = now + RELAY_AI_VAULT_FAULT_WINDOW_MS
+    }
+  }
+
+  scheduleRestart(restart: () => void): void {
+    if (this.timer) {
+      clearTimeout(this.timer)
+    }
+    const delay = RELAY_AI_VAULT_RESTART_DELAYS_MS[Math.min(this.faults.length - 1, 2)]
+    this.timer = setTimeout(() => {
+      this.timer = null
+      restart()
+    }, delay)
+    this.timer.unref?.()
+  }
+
+  dispose(): void {
+    if (this.timer) {
+      clearTimeout(this.timer)
+      this.timer = null
+    }
+  }
+}
diff --git a/src/relay/ai-vault-service-spawn.test.ts b/src/relay/ai-vault-service-spawn.test.ts
new file mode 100644
index 00000000000..596c25afc2e
--- /dev/null
+++ b/src/relay/ai-vault-service-spawn.test.ts
@@ -0,0 +1,42 @@
+import type { ChildProcess } from 'node:child_process'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const forkMock = vi.hoisted(() => vi.fn())
+
+vi.mock('node:child_process', () => ({ fork: forkMock }))
+
+const { spawnRelayAiVaultService } = await import('./ai-vault-service-spawn')
+
+function forkOptions(): { env?: NodeJS.ProcessEnv; execArgv?: string[] } {
+  return forkMock.mock.calls.at(-1)?.[2] ?? {}
+}
+
+describe('spawnRelayAiVaultService', () => {
+  beforeEach(() => {
+    forkMock.mockReset()
+    forkMock.mockReturnValue({ pid: undefined, unref: vi.fn() } as unknown as ChildProcess)
+  })
+
+  it('keeps NODE_OPTIONS out of the sidecar so the heap cap and loader stand', () => {
+    vi.stubEnv('NODE_OPTIONS', '--max-old-space-size=8192 --require=/tmp/evil.js')
+    spawnRelayAiVaultService()
+    const options = forkOptions()
+
+    // Asserted first: omitting `env` entirely inherits everything, and would
+    // leave the NODE_OPTIONS assertion below passing for the wrong reason.
+    expect(options.env).toBeDefined()
+    expect(options.env?.NODE_OPTIONS).toBeUndefined()
+    expect(options.execArgv).toEqual(['--max-old-space-size=384'])
+    vi.unstubAllEnvs()
+  })
+
+  it('does not hand the sidecar the rest of the remote login environment', () => {
+    vi.stubEnv('AWS_SECRET_ACCESS_KEY', 'shhh')
+    spawnRelayAiVaultService()
+    const options = forkOptions()
+
+    expect(options.env).toBeDefined()
+    expect(options.env?.AWS_SECRET_ACCESS_KEY).toBeUndefined()
+    vi.unstubAllEnvs()
+  })
+})
diff --git a/src/relay/ai-vault-service-spawn.ts b/src/relay/ai-vault-service-spawn.ts
new file mode 100644
index 00000000000..90c5dbae67a
--- /dev/null
+++ b/src/relay/ai-vault-service-spawn.ts
@@ -0,0 +1,20 @@
+import { fork, type ChildProcess } from 'node:child_process'
+import { join } from 'node:path'
+import { buildRelayAiVaultServiceEnv } from '../main/ai-vault/session-scanner-service-env'
+import { lowerAiVaultServicePriority } from '../main/ai-vault/session-scanner-service-priority'
+
+export function relayAiVaultServiceEntryPath(baseDir = __dirname): string {
+  return join(baseDir, 'relay-ai-vault-service.js')
+}
+
+export function spawnRelayAiVaultService(): ChildProcess {
+  const child = fork(relayAiVaultServiceEntryPath(), [], {
+    stdio: ['ignore', 'ignore', 'pipe', 'ipc'],
+    execArgv: ['--max-old-space-size=384'],
+    env: buildRelayAiVaultServiceEnv(),
+    ...(process.platform === 'win32' ? { windowsHide: true } : {})
+  })
+  lowerAiVaultServicePriority(child.pid)
+  child.unref()
+  return child
+}
diff --git a/src/relay/dispatcher-client-writer.test.ts b/src/relay/dispatcher-client-writer.test.ts
index 13e49b59e8e..83b5e7960b7 100644
--- a/src/relay/dispatcher-client-writer.test.ts
+++ b/src/relay/dispatcher-client-writer.test.ts
@@ -51,7 +51,7 @@ function createWriter(
         sink.drainWaiters.push(callback)
         return () => {
           const index = sink.drainWaiters.indexOf(callback)
-          if (index >= 0) {
+          if (index !== -1) {
             sink.drainWaiters.splice(index, 1)
           }
         }
diff --git a/src/relay/external-automations-handler.ts b/src/relay/external-automations-handler.ts
index baaaa99481e..03bb0b9beba 100644
--- a/src/relay/external-automations-handler.ts
+++ b/src/relay/external-automations-handler.ts
@@ -382,7 +382,7 @@ export class ExternalAutomationsHandler {
       (sessionRun, index) =>
         !usedSessionRunIndexes.has(index) && this.getRunKey(sessionRun) === outputRunKey
     )
-    if (exactMatchIndex >= 0) {
+    if (exactMatchIndex !== -1) {
       return exactMatchIndex
     }
 
@@ -755,7 +755,7 @@ export class ExternalAutomationsHandler {
     }
   }
 
-  private readHermesSessionDbRunById(jobId: string, runId: string): unknown | null {
+  private readHermesSessionDbRunById(jobId: string, runId: string): unknown {
     if (!existsSync(HERMES_STATE_DB)) {
       return null
     }
diff --git a/src/relay/fs-handler-list-files-cancel.test.ts b/src/relay/fs-handler-list-files-cancel.test.ts
index 02cd8da6afc..baf6101600c 100644
--- a/src/relay/fs-handler-list-files-cancel.test.ts
+++ b/src/relay/fs-handler-list-files-cancel.test.ts
@@ -31,6 +31,7 @@ function createMockProcess(): ChildProcess {
   ;(p as unknown as Record<string, unknown>).kill = vi.fn()
   ;(p as unknown as Record<string, unknown>).exitCode = null
   ;(p as unknown as Record<string, unknown>).signalCode = null
+  Object.defineProperty(p, 'pid', { configurable: true, value: 1 })
   return p
 }
 
diff --git a/src/relay/fs-handler-list-files-ignored.test.ts b/src/relay/fs-handler-list-files-ignored.test.ts
index 1ca5c2f5327..b819d3ac85c 100644
--- a/src/relay/fs-handler-list-files-ignored.test.ts
+++ b/src/relay/fs-handler-list-files-ignored.test.ts
@@ -16,6 +16,11 @@ import { tmpdir } from 'node:os'
 import { listFilesWithGit } from './fs-handler-git-fallback'
 import { listFilesWithRg } from './fs-handler-list-files'
 import { searchWithRg } from './fs-handler-utils'
+import { RipgrepUnavailableError } from '../shared/ripgrep-process-availability'
+import {
+  ListFilesScanCoordinator,
+  LIST_FILES_SUPERSEDED_MESSAGE
+} from './fs-list-files-scan-coordinator'
 
 const tempDirs: string[] = []
 const SHA1 = '0123456789abcdef0123456789abcdef01234567'
@@ -36,6 +41,7 @@ function createMockProcess(): ChildProcess {
   ;(p as unknown as Record<string, unknown>).kill = vi.fn()
   ;(p as unknown as Record<string, unknown>).exitCode = null
   ;(p as unknown as Record<string, unknown>).signalCode = null
+  Object.defineProperty(p, 'pid', { configurable: true, value: 1 })
   return p
 }
 
@@ -72,6 +78,7 @@ describe('relay quick open ignored file listing', () => {
     })
 
     const promise = listFilesWithRg('/remote/root', ['packages/other'])
+    expect(spawnMock).toHaveBeenCalledTimes(2)
 
     setTimeout(() => {
       ;(primaryProc.stdout as unknown as EventEmitter).emit('data', 'src/index.ts\n')
@@ -115,6 +122,82 @@ describe('relay quick open ignored file listing', () => {
     expect(callIndex).toBe(1)
   })
 
+  it.each(['error-first', 'close-first'] as const)(
+    'tags a %s pre-spawn listing failure without starting the ignored pass',
+    async (order) => {
+      const root = await makeTempRoot()
+      const missing = createMockProcess()
+      Object.defineProperty(missing, 'pid', { value: undefined })
+      spawnMock.mockReturnValue(missing)
+      const error = Object.assign(new Error('spawn rg ENOENT'), { code: 'ENOENT' })
+
+      const promise = listFilesWithRg(root)
+      if (order === 'error-first') {
+        expect(() => missing.emit('error', error)).not.toThrow()
+      } else {
+        missing.emit('close', -2, null)
+      }
+
+      await expect(promise).rejects.toBeInstanceOf(RipgrepUnavailableError)
+      if (order === 'error-first') {
+        missing.emit('close', -2, null)
+      } else {
+        expect(() => missing.emit('error', error)).not.toThrow()
+      }
+      expect(spawnMock).toHaveBeenCalledTimes(1)
+      expect(missing.listenerCount('error')).toBe(0)
+      expect(missing.listenerCount('close')).toBe(0)
+    }
+  )
+
+  it('kills only the admitted pass when ignored rg fails before spawn', async () => {
+    const root = await makeTempRoot()
+    const primary = createMockProcess()
+    const missingIgnored = createMockProcess()
+    Object.defineProperty(missingIgnored, 'pid', { value: undefined })
+    spawnMock.mockImplementation((_cmd: string, args: string[]) =>
+      args.includes('--no-ignore-vcs') ? missingIgnored : primary
+    )
+
+    const promise = listFilesWithRg(root)
+    expect(spawnMock).toHaveBeenCalledTimes(2)
+    missingIgnored.emit('close', -2, null)
+
+    await expect(promise).rejects.toBeInstanceOf(RipgrepUnavailableError)
+    expect(primary.kill).toHaveBeenCalled()
+    expect(missingIgnored.kill).not.toHaveBeenCalled()
+    const error = Object.assign(new Error('spawn rg ENOENT'), { code: 'ENOENT' })
+    expect(() => missingIgnored.emit('error', error)).not.toThrow()
+    expect(missingIgnored.listenerCount('error')).toBe(0)
+  })
+
+  it('does not signal failed-spawn passes when a same-client scan is superseded', async () => {
+    const root = await makeTempRoot()
+    const firstChild = createMockProcess()
+    Object.defineProperty(firstChild, 'pid', { value: undefined })
+    spawnMock.mockReturnValue(firstChild)
+    const coordinator = new ListFilesScanCoordinator()
+    const first = coordinator.run({
+      clientId: 1,
+      key: 'first',
+      start: (signal) => listFilesWithRg(root, [], { signal })
+    })
+    const firstOutcome = first.catch((error: unknown) => error)
+
+    const second = coordinator.run({
+      clientId: 1,
+      key: 'second',
+      start: async () => ['second.ts']
+    })
+
+    await expect(firstOutcome).resolves.toMatchObject({ message: LIST_FILES_SUPERSEDED_MESSAGE })
+    await expect(second).resolves.toEqual(['second.ts'])
+    expect(firstChild.kill).not.toHaveBeenCalled()
+    expect(spawnMock).toHaveBeenCalledTimes(1)
+    const error = Object.assign(new Error('spawn rg ENOENT'), { code: 'ENOENT' })
+    expect(() => firstChild.emit('error', error)).not.toThrow()
+  })
+
   it('git fallback ignored pass includes ignored non-env files', async () => {
     const root = await makeTempRoot()
     await writeRel(root, 'dist/generated.js')
@@ -430,4 +513,101 @@ describe('relay quick open ignored file listing', () => {
       vi.useRealTimers()
     }
   })
+
+  it.each(['error-first', 'close-first'] as const)(
+    'tags only a %s pre-spawn rg search failure as unavailable',
+    async (order) => {
+      const root = await makeTempRoot()
+      const missing = createMockProcess()
+      Object.defineProperty(missing, 'pid', { value: undefined })
+      spawnMock.mockReturnValueOnce(missing)
+      const unavailable = searchWithRg(root, 'ok', { maxResults: 100 })
+      const error = Object.assign(new Error('spawn rg ENOENT'), { code: 'ENOENT' })
+      if (order === 'error-first') {
+        expect(() => missing.emit('error', error)).not.toThrow()
+        missing.emit('close', -2, null)
+      } else {
+        missing.emit('close', -2, null)
+        expect(() => missing.emit('error', error)).not.toThrow()
+      }
+
+      await expect(unavailable).rejects.toBeInstanceOf(RipgrepUnavailableError)
+      expect(missing.listenerCount('error')).toBe(0)
+      expect(missing.listenerCount('close')).toBe(0)
+    }
+  )
+
+  it('tags unsupported native launcher exits as unavailable', async () => {
+    const root = await makeTempRoot()
+    const child = createMockProcess()
+    Object.defineProperty(child, 'pid', { value: 1 })
+    spawnMock.mockReturnValueOnce(child)
+    const unavailable = searchWithRg(root, 'ok', { maxResults: 100 })
+
+    child.emit('close', 127, null)
+
+    await expect(unavailable).rejects.toBeInstanceOf(RipgrepUnavailableError)
+  })
+
+  it('keeps missing-root launch errors on their prior non-fallback paths', async () => {
+    const missingRoot = await makeTempRoot()
+    await rm(missingRoot, { recursive: true, force: true })
+    const listFirst = createMockProcess()
+    const listProbe = createMockProcess()
+    Object.defineProperty(listFirst, 'pid', { value: undefined })
+    Object.defineProperty(listProbe, 'pid', { value: 1 })
+    let callIndex = 0
+    spawnMock.mockImplementation(() => [listFirst, listProbe][callIndex++])
+    const listError = Object.assign(new Error('spawn rg ENOENT'), { code: 'ENOENT' })
+    const listing = listFilesWithRg(missingRoot)
+    listFirst.emit('error', listError)
+
+    await vi.waitFor(() => expect(spawnMock).toHaveBeenCalledTimes(2))
+    expect(spawnMock.mock.calls[1]).toEqual(['rg', ['--version'], { stdio: 'ignore' }])
+    listProbe.emit('close', 0, null)
+    await expect(listing).rejects.toBe(listError)
+
+    spawnMock.mockReset()
+    const searchChild = createMockProcess()
+    const searchProbe = createMockProcess()
+    Object.defineProperty(searchChild, 'pid', { value: undefined })
+    Object.defineProperty(searchProbe, 'pid', { value: 1 })
+    spawnMock.mockReturnValueOnce(searchChild).mockReturnValueOnce(searchProbe)
+    const search = searchWithRg(missingRoot, 'ok', { maxResults: 100 })
+    searchChild.emit('error', listError)
+
+    await vi.waitFor(() => expect(spawnMock).toHaveBeenCalledTimes(2))
+    searchProbe.emit('close', 0, null)
+    await expect(search).resolves.toMatchObject({ files: [], totalMatches: 0 })
+  })
+
+  it('keeps missing-rg precedence when the root also disappeared', async () => {
+    const missingRoot = await makeTempRoot()
+    await rm(missingRoot, { recursive: true, force: true })
+    const first = createMockProcess()
+    const probe = createMockProcess()
+    for (const child of [first, probe]) {
+      Object.defineProperty(child, 'pid', { value: undefined })
+    }
+    let callIndex = 0
+    spawnMock.mockImplementation(() => [first, probe][callIndex++])
+    const error = Object.assign(new Error('spawn rg ENOENT'), { code: 'ENOENT' })
+    const listing = listFilesWithRg(missingRoot)
+    first.emit('error', error)
+
+    await vi.waitFor(() => expect(spawnMock).toHaveBeenCalledTimes(2))
+    probe.emit('close', -2, null)
+
+    await expect(listing).rejects.toBeInstanceOf(RipgrepUnavailableError)
+    expect(() => probe.emit('error', error)).not.toThrow()
+  })
+
+  it('keeps post-spawn rg search errors on the existing empty-result path', async () => {
+    const started = createMockProcess()
+    Object.defineProperty(started, 'pid', { value: 1 })
+    spawnMock.mockReturnValueOnce(started)
+    const ordinaryFailure = searchWithRg('/remote/root', 'ok', { maxResults: 100 })
+    started.emit('error', new Error('post-spawn failure'))
+    await expect(ordinaryFailure).resolves.toMatchObject({ files: [], totalMatches: 0 })
+  })
 })
diff --git a/src/relay/fs-handler-list-files.ts b/src/relay/fs-handler-list-files.ts
index c63a352786e..3ec7b99026d 100644
--- a/src/relay/fs-handler-list-files.ts
+++ b/src/relay/fs-handler-list-files.ts
@@ -1,7 +1,5 @@
 /**
  * Ripgrep-based file listing for Quick Open.
- * Extracted from fs-handler-utils.ts to keep it under 300 lines (oxlint max-lines).
- *
  * Why a full rewrite vs. the older execFile+maxBuffer version: on a home-dir
  * worktree over SSH, rg descended into every dotfile cache, hit the timeout,
  * and silently resolved with a partial list — Quick Open then showed "No
@@ -23,6 +21,13 @@ import {
   shouldExcludeQuickOpenRelPath,
   shouldIncludeQuickOpenPath
 } from '../shared/quick-open-filter'
+import {
+  absorbPendingRipgrepSpawnError,
+  isRipgrepUnavailableAfterLaunchFailure,
+  isRipgrepUnavailableExit,
+  killSpawnedRipgrepProcess,
+  RipgrepUnavailableError
+} from '../shared/ripgrep-process-availability'
 
 export const LIST_FILES_TIMEOUT_MS = 25_000
 
@@ -78,6 +83,9 @@ export function listFilesWithRg(
         let passBuf = ''
         let passDone = false
         let passFileCount = 0
+        let processErrorObserved = false
+        let unavailableExitObserved = false
+        let launchFailureCheck: Promise<void> | null = null
         // --no-messages: permission-denied noise on the remote (e.g. .ssh,
         // root-owned mounts) would otherwise flood stderr.
         // cwd: rootPath — root-relative exclude globs like `!packages/app/**`
@@ -98,6 +106,10 @@ export function listFilesWithRg(
           child.stderr!.off('data', handleStderrData)
           child.off('error', handleError)
           child.off('close', handleClose)
+          absorbPendingRipgrepSpawnError(child, {
+            errorObserved: processErrorObserved,
+            unavailableExitObserved
+          })
         }
         const rejectPass = (error: Error): void => {
           if (passDone) {
@@ -116,6 +128,16 @@ export function listFilesWithRg(
           cleanup()
           passResolve()
         }
+        const rejectLaunchFailure = (error: Error): void => {
+          if (launchFailureCheck) {
+            return
+          }
+          launchFailureCheck = isRipgrepUnavailableAfterLaunchFailure(rootPath).then(
+            (unavailable) => {
+              rejectPass(unavailable ? new RipgrepUnavailableError() : error)
+            }
+          )
+        }
         children.push({
           child,
           isDone: () => passDone,
@@ -125,7 +147,7 @@ export function listFilesWithRg(
         timer = setTimeout(() => {
           // Discard residual buffer on abnormal exit — a truncated byte
           // sequence could look like a valid path.
-          child.kill()
+          killSpawnedRipgrepProcess(child)
           rejectPass(new Error('rg list timed out'))
         }, LIST_FILES_TIMEOUT_MS)
 
@@ -149,12 +171,28 @@ export function listFilesWithRg(
           /* drain to prevent backpressure stalls */
         }
         function handleError(err: Error): void {
+          processErrorObserved = true
+          if (isRipgrepUnavailableExit(child, null, null)) {
+            passBuf = ''
+            rejectLaunchFailure(err)
+            return
+          }
           rejectPass(err)
         }
         function handleClose(code: number | null, signal: NodeJS.Signals | null): void {
           if (passDone) {
             return
           }
+          if (
+            isRipgrepUnavailableExit(child, code, signal, {
+              classifyNativeLauncherExit: true
+            })
+          ) {
+            unavailableExitObserved = true
+            passBuf = ''
+            rejectLaunchFailure(new Error(`rg exited with code ${code}`))
+            return
+          }
           // Why signal != null is a failure: the only way spawn gets a signal
           // is if the process was killed (timeout, OOM, external SIGKILL).
           // Trusting its stdout could surface a truncated list as a success.
@@ -199,7 +237,7 @@ export function listFilesWithRg(
           continue
         }
         if (entry.child.exitCode === null && entry.child.signalCode === null) {
-          entry.child.kill()
+          killSpawnedRipgrepProcess(entry.child)
         }
         entry.reject(new Error(reason))
       }
@@ -228,12 +266,15 @@ export function listFilesWithRg(
     }
     signal?.addEventListener('abort', onAbort, { once: true })
 
+    const primaryPass = runPass(primary)
     const passes =
       maxResults === undefined
-        ? Promise.all([runPass(primary), runPass(ignoredPass)])
+        ? children[0]?.child.pid === undefined
+          ? primaryPass
+          : Promise.all([primaryPass, runPass(ignoredPass)])
         : // Why: deterministic primary-first budgeting prevents a large ignored
           // tree from starving ordinary source paths on a remote host.
-          runPass(primary).then(() =>
+          primaryPass.then(() =>
             files.size < maxResults ? runPass(ignoredPass) : Promise.resolve()
           )
 
diff --git a/src/relay/fs-handler-rg-availability.test.ts b/src/relay/fs-handler-rg-availability.test.ts
deleted file mode 100644
index 8b14a3d61af..00000000000
--- a/src/relay/fs-handler-rg-availability.test.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-import { EventEmitter } from 'node:events'
-import { describe, expect, it, vi } from 'vitest'
-
-const { execFileMock, spawnMock } = vi.hoisted(() => ({
-  execFileMock: vi.fn(),
-  spawnMock: vi.fn()
-}))
-
-vi.mock('child_process', () => ({
-  execFile: execFileMock,
-  spawn: spawnMock
-}))
-
-import { checkRgAvailable } from './fs-handler-utils'
-
-class FakeChildProcess extends EventEmitter {
-  kill = vi.fn()
-}
-
-describe('relay rg availability', () => {
-  it('removes listeners after a successful probe', async () => {
-    const child = new FakeChildProcess()
-    execFileMock.mockReturnValueOnce(child)
-
-    const result = checkRgAvailable()
-    child.emit('close', 0)
-
-    await expect(result).resolves.toBe(true)
-    expect(child.listenerCount('error')).toBe(0)
-    expect(child.listenerCount('close')).toBe(0)
-  })
-
-  it('settles and detaches when a wedged probe ignores timeout kill', async () => {
-    vi.useFakeTimers()
-    try {
-      const child = new FakeChildProcess()
-      execFileMock.mockReturnValueOnce(child)
-
-      const result = checkRgAvailable()
-      await vi.advanceTimersByTimeAsync(5000)
-
-      await expect(result).resolves.toBe(false)
-      expect(child.kill).toHaveBeenCalledTimes(1)
-      expect(child.listenerCount('error')).toBe(0)
-      expect(child.listenerCount('close')).toBe(0)
-    } finally {
-      vi.useRealTimers()
-    }
-  })
-})
diff --git a/src/relay/fs-handler-ripgrep-fallback.test.ts b/src/relay/fs-handler-ripgrep-fallback.test.ts
new file mode 100644
index 00000000000..93d89fd9008
--- /dev/null
+++ b/src/relay/fs-handler-ripgrep-fallback.test.ts
@@ -0,0 +1,121 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as ChildProcessModule from 'node:child_process'
+import type * as FsHandlerGitFallback from './fs-handler-git-fallback'
+import type * as FsHandlerUtils from './fs-handler-utils'
+
+const {
+  execFileMock,
+  listFilesWithGitMock,
+  listFilesWithRgMock,
+  searchWithGitGrepMock,
+  searchWithRgMock
+} = vi.hoisted(() => ({
+  execFileMock: vi.fn(),
+  listFilesWithGitMock: vi.fn(),
+  listFilesWithRgMock: vi.fn(),
+  searchWithGitGrepMock: vi.fn(),
+  searchWithRgMock: vi.fn()
+}))
+
+vi.mock('node:child_process', async (importOriginal) => ({
+  ...(await importOriginal<typeof ChildProcessModule>()),
+  execFile: execFileMock
+}))
+
+vi.mock('./fs-handler-utils', async (importOriginal) => ({
+  ...(await importOriginal<typeof FsHandlerUtils>()),
+  listFilesWithRg: listFilesWithRgMock,
+  searchWithRg: searchWithRgMock
+}))
+
+vi.mock('./fs-handler-git-fallback', async (importOriginal) => ({
+  ...(await importOriginal<typeof FsHandlerGitFallback>()),
+  listFilesWithGit: listFilesWithGitMock,
+  searchWithGitGrep: searchWithGitGrepMock
+}))
+
+import { FileListingCancelledError } from '../shared/file-listing-cancellation'
+import { RipgrepUnavailableError } from '../shared/ripgrep-process-availability'
+import { RelayContext } from './context'
+import { FsHandler } from './fs-handler'
+
+type FsHandlerInternals = {
+  search(params: Record<string, unknown>): Promise<unknown>
+  runListFilesScan(
+    rootPath: string,
+    excludePathPrefixes: string[],
+    signal: AbortSignal,
+    maxResults?: number
+  ): Promise<string[]>
+}
+
+function createHandler(): FsHandlerInternals {
+  const dispatcher = {
+    onRequest: vi.fn(),
+    onNotification: vi.fn(),
+    onClientDetached: vi.fn(() => () => undefined)
+  }
+  const watcherPool = {
+    dispose: vi.fn(),
+    forgetRoot: vi.fn(),
+    subscribe: vi.fn()
+  }
+  return new FsHandler(dispatcher as never, new RelayContext(), watcherPool as never) as never
+}
+
+describe('relay direct ripgrep admission', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('falls back only for a tagged search launch failure', async () => {
+    const handler = createHandler()
+    const fallback = { files: [], totalMatches: 0, truncated: false }
+    searchWithRgMock.mockRejectedValueOnce(new RipgrepUnavailableError())
+    searchWithGitGrepMock.mockResolvedValueOnce(fallback)
+
+    await expect(handler.search({ rootPath: '/repo', query: 'needle' })).resolves.toBe(fallback)
+    expect(searchWithRgMock).toHaveBeenCalledTimes(1)
+    expect(searchWithGitGrepMock).toHaveBeenCalledTimes(1)
+
+    const ordinaryFailure = new Error('rg failed after spawn')
+    searchWithRgMock.mockRejectedValueOnce(ordinaryFailure)
+    await expect(handler.search({ rootPath: '/repo', query: 'needle' })).rejects.toBe(
+      ordinaryFailure
+    )
+    expect(searchWithGitGrepMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('falls back only for a tagged listing launch failure', async () => {
+    const handler = createHandler()
+    const controller = new AbortController()
+    listFilesWithRgMock.mockRejectedValueOnce(new RipgrepUnavailableError())
+    execFileMock.mockImplementationOnce((_command, _args, _options, callback) => {
+      callback(null)
+      return undefined
+    })
+    listFilesWithGitMock.mockResolvedValueOnce(['src/index.ts'])
+
+    await expect(handler.runListFilesScan('/repo', [], controller.signal)).resolves.toEqual([
+      'src/index.ts'
+    ])
+    expect(listFilesWithRgMock).toHaveBeenCalledTimes(1)
+    expect(listFilesWithGitMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('lets cancellation win an unavailable-listing race before Git starts', async () => {
+    const handler = createHandler()
+    const controller = new AbortController()
+    const cancellation = new FileListingCancelledError('superseded')
+    listFilesWithRgMock.mockImplementationOnce(async () => {
+      controller.abort(cancellation)
+      throw new RipgrepUnavailableError()
+    })
+
+    await expect(handler.runListFilesScan('/repo', [], controller.signal)).rejects.toBe(
+      cancellation
+    )
+    expect(execFileMock).not.toHaveBeenCalled()
+    expect(listFilesWithGitMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/relay/fs-handler-utils.ts b/src/relay/fs-handler-utils.ts
index 3fcf50a6eb2..83726c686bf 100644
--- a/src/relay/fs-handler-utils.ts
+++ b/src/relay/fs-handler-utils.ts
@@ -5,7 +5,7 @@
  * These functions depend only on their arguments (plus `rg` being on PATH),
  * so they are straightforward to test independently.
  */
-import { spawn, execFile } from 'node:child_process'
+import { spawn } from 'node:child_process'
 import { open } from 'node:fs/promises'
 import {
   buildRgArgs,
@@ -16,6 +16,13 @@ import {
 } from '../shared/text-search'
 import { IMAGE_FILE_MIME_TYPES } from '../shared/image-file-extensions'
 import type { SearchResult as SharedSearchResult } from '../shared/types'
+import {
+  absorbPendingRipgrepSpawnError,
+  isRipgrepUnavailableAfterLaunchFailure,
+  isRipgrepUnavailableExit,
+  killSpawnedRipgrepProcess,
+  RipgrepUnavailableError
+} from '../shared/ripgrep-process-availability'
 
 // ─── Constants ───────────────────────────────────────────────────────
 
@@ -89,11 +96,14 @@ export function searchWithRg(
   query: string,
   opts: SearchOptions
 ): Promise<SearchResult> {
-  return new Promise((resolve) => {
+  return new Promise((resolve, reject) => {
     const rgArgs = buildRgArgs(query, rootPath, opts)
     const acc = createAccumulator()
     let buffer = ''
     let resolved = false
+    let processErrorObserved = false
+    let unavailableExitObserved = false
+    let launchFailureCheck: Promise<void> | null = null
 
     // Why: spawn can throw synchronously on invalid options (e.g. bad cwd),
     // which would leak out of the `new Promise` executor and leave the
@@ -124,13 +134,47 @@ export function searchWithRg(
       child.stderr!.off('data', handleStderrData)
       child.off('error', handleError)
       child.off('close', handleClose)
+      absorbPendingRipgrepSpawnError(child, {
+        errorObserved: processErrorObserved,
+        unavailableExitObserved
+      })
       resolve(finalize(acc))
     }
 
+    function rejectUnavailable(): void {
+      if (resolved) {
+        return
+      }
+      resolved = true
+      clearTimeout(killTimeout)
+      child.stdout!.off('data', handleStdoutData)
+      child.stderr!.off('data', handleStderrData)
+      child.off('error', handleError)
+      child.off('close', handleClose)
+      absorbPendingRipgrepSpawnError(child, {
+        errorObserved: processErrorObserved,
+        unavailableExitObserved
+      })
+      reject(new RipgrepUnavailableError())
+    }
+
+    function settleLaunchFailure(): void {
+      if (launchFailureCheck) {
+        return
+      }
+      launchFailureCheck = isRipgrepUnavailableAfterLaunchFailure(rootPath).then((unavailable) => {
+        if (unavailable) {
+          rejectUnavailable()
+        } else {
+          resolveOnce()
+        }
+      })
+    }
+
     function processLine(line: string): void {
       const verdict = ingestRgJsonLine(line, rootPath, acc, opts.maxResults)
       if (verdict === 'stop') {
-        child.kill()
+        killSpawnedRipgrepProcess(child)
       }
     }
 
@@ -148,10 +192,24 @@ export function searchWithRg(
     }
 
     function handleError(): void {
+      processErrorObserved = true
+      if (isRipgrepUnavailableExit(child, null, null)) {
+        settleLaunchFailure()
+        return
+      }
       resolveOnce()
     }
 
-    function handleClose(): void {
+    function handleClose(code: number | null, signal: NodeJS.Signals | null): void {
+      if (
+        isRipgrepUnavailableExit(child, code, signal, {
+          classifyNativeLauncherExit: true
+        })
+      ) {
+        unavailableExitObserved = true
+        settleLaunchFailure()
+        return
+      }
       if (buffer) {
         processLine(buffer)
       }
@@ -166,57 +224,11 @@ export function searchWithRg(
 
     killTimeout = setTimeout(() => {
       acc.truncated = true
-      child.kill()
+      killSpawnedRipgrepProcess(child)
       resolveOnce()
     }, SEARCH_TIMEOUT_MS)
   })
 }
 
-// ─── rg availability check ──────────────────────────────────────────
-
-// Why no cache: `rg --version` is a sub-10ms local spawn, and caching the
-// result caused a footgun — a negative cache persisted across rg installs
-// (forcing a relay restart), while a positive cache could mask an rg that
-// was uninstalled or broken mid-session. The `settled` flag below closes
-// the original race between 'error' and 'close' that the cache was added
-// to paper over, so re-checking per call is both simpler and safer.
-const RG_AVAILABILITY_TIMEOUT_MS = 5000
-
-export function checkRgAvailable(): Promise<boolean> {
-  return new Promise((resolve) => {
-    let settled = false
-    const child = execFile('rg', ['--version'])
-    let timeout: ReturnType<typeof setTimeout> | null = null
-    const cleanup = (): void => {
-      if (timeout) {
-        clearTimeout(timeout)
-        timeout = null
-      }
-      child.off('error', onError)
-      child.off('close', onClose)
-    }
-    const settle = (available: boolean, options?: { kill?: boolean }): void => {
-      if (settled) {
-        return
-      }
-      settled = true
-      cleanup()
-      if (options?.kill) {
-        child.kill()
-      }
-      resolve(available)
-    }
-    const onError = (): void => settle(false)
-    const onClose = (code: number | null): void => settle(code === 0)
-
-    child.once('error', onError)
-    child.once('close', onClose)
-    timeout = setTimeout(() => settle(false, { kill: true }), RG_AVAILABILITY_TIMEOUT_MS)
-    if (typeof timeout.unref === 'function') {
-      timeout.unref()
-    }
-  })
-}
-
 // Moved to fs-handler-list-files.ts to keep this file under 300 lines (oxlint)
 export { listFilesWithRg, LIST_FILES_TIMEOUT_MS } from './fs-handler-list-files'
diff --git a/src/relay/fs-handler.ts b/src/relay/fs-handler.ts
index d07e2bf397f..b7dd2dfa6b5 100644
--- a/src/relay/fs-handler.ts
+++ b/src/relay/fs-handler.ts
@@ -10,12 +10,7 @@ import type { RelayContext } from './context'
 // Why: RelayContext is accepted in the constructor for protocol back-compat
 // (see docs/relay-fs-allowlist-removal.md), but no longer consulted on FS ops.
 import { expandTilde } from './context'
-import {
-  DEFAULT_MAX_RESULTS,
-  searchWithRg,
-  listFilesWithRg,
-  checkRgAvailable
-} from './fs-handler-utils'
+import { DEFAULT_MAX_RESULTS, searchWithRg, listFilesWithRg } from './fs-handler-utils'
 import { listFilesWithGit, searchWithGitGrep } from './fs-handler-git-fallback'
 import { listFilesWithReaddir } from './fs-handler-readdir-fallback'
 import { ListFilesScanCoordinator } from './fs-list-files-scan-coordinator'
@@ -35,6 +30,7 @@ import { RelayStreamRegistry } from './fs-stream-registry'
 import { scanWorkspaceSpaceDirectory } from './workspace-space-scan'
 import { buildRelayCommandEnv } from './relay-command-env'
 import { assertNoClobberRenameDestinationAvailable } from '../shared/filesystem-rename-collision'
+import { RipgrepUnavailableError } from '../shared/ripgrep-process-availability'
 import { RelayFilesystemWatchRegistry } from './relay-filesystem-watch-registry'
 import type { RelayWatcherProcessPool } from './relay-watcher-process-pool'
 
@@ -328,26 +324,22 @@ export class FsHandler {
       DEFAULT_MAX_RESULTS
     )
 
-    const rgAvailable = await checkRgAvailable()
-    if (!rgAvailable) {
-      return searchWithGitGrep(rootPath, query, {
-        caseSensitive,
-        wholeWord,
-        useRegex,
-        includePattern,
-        excludePattern,
-        maxResults
-      })
-    }
-
-    return searchWithRg(rootPath, query, {
+    const options = {
       caseSensitive,
       wholeWord,
       useRegex,
       includePattern,
       excludePattern,
       maxResults
-    })
+    }
+    try {
+      return await searchWithRg(rootPath, query, options)
+    } catch (error) {
+      if (!(error instanceof RipgrepUnavailableError)) {
+        throw error
+      }
+      return searchWithGitGrep(rootPath, query, options)
+    }
   }
 
   private listFiles(params: Record<string, unknown>, context?: RequestContext): Promise<string[]> {
@@ -380,10 +372,14 @@ export class FsHandler {
     signal: AbortSignal,
     maxResults?: number
   ): Promise<string[]> {
-    const rgAvailable = await checkRgAvailable()
     throwIfFileListingCancelled(signal)
-    if (rgAvailable) {
-      return listFilesWithRg(rootPath, excludePathPrefixes, { signal, maxResults })
+    try {
+      return await listFilesWithRg(rootPath, excludePathPrefixes, { signal, maxResults })
+    } catch (error) {
+      throwIfFileListingCancelled(signal)
+      if (!(error instanceof RipgrepUnavailableError)) {
+        throw error
+      }
     }
     // Why: git ls-files only works inside git repos. Use rev-parse to detect
     // git ancestry — unlike checking for a local .git entry, this works from
diff --git a/src/relay/fs-list-files-cancel.integration.test.ts b/src/relay/fs-list-files-cancel.integration.test.ts
index 588ddb5fe51..f54ebaea369 100644
--- a/src/relay/fs-list-files-cancel.integration.test.ts
+++ b/src/relay/fs-list-files-cancel.integration.test.ts
@@ -54,7 +54,6 @@ vi.mock('./fs-handler-utils', async (importOriginal) => {
   const original = (await importOriginal()) as Record<string, unknown>
   return {
     ...original,
-    checkRgAvailable: () => Promise.resolve(true),
     listFilesWithRg: fakeListFiles
   }
 })
diff --git a/src/relay/git-handler-branch-diff-equivalence.test.ts b/src/relay/git-handler-branch-diff-equivalence.test.ts
new file mode 100644
index 00000000000..d33886b4f5a
--- /dev/null
+++ b/src/relay/git-handler-branch-diff-equivalence.test.ts
@@ -0,0 +1,207 @@
+import { execFileSync } from 'node:child_process'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import * as path from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { RelayContext } from './context'
+import { GitHandler } from './git-handler'
+import {
+  createMockDispatcher,
+  gitCommit,
+  gitInit,
+  type MockDispatcher,
+  type RelayDispatcher
+} from './git-handler-test-setup'
+
+// Why this file exists: the pinned route replaced the legacy route's own
+// `diff --name-status -M -C` rediscovery with values the caller already holds.
+// These tests drive the real product contract against real Git and assert the
+// two routes agree entry-for-entry, so "SSH still renders what it used to" is
+// evidence rather than an argument about call sites.
+
+type BranchCompareResult = {
+  summary: { mergeBase: string; headOid: string; status: string; changedFiles: number }
+  entries: { path: string; oldPath?: string; status: string }[]
+}
+
+type DiffEntry = Record<string, unknown>
+
+function git(repoPath: string, args: string[]): string {
+  return execFileSync('git', args, { cwd: repoPath, encoding: 'utf8' })
+}
+
+/**
+ * Builds one repo whose base..head range exercises every shape the review
+ * panel can hand to a single-file branch diff.
+ */
+function buildScenarioRepo(): { repoPath: string; baseOid: string } {
+  const repoPath = mkdtempSync(path.join(tmpdir(), 'relay-branch-diff-equivalence-'))
+  gitInit(repoPath)
+
+  const write = (relativePath: string, contents: string | Buffer): void => {
+    const target = path.join(repoPath, relativePath)
+    mkdirSync(path.dirname(target), { recursive: true })
+    writeFileSync(target, contents)
+  }
+
+  write('modified.txt', 'before\n')
+  write('deleted.txt', 'doomed\n')
+  write('renamed-from.txt', 'stable rename payload\n')
+  write('renamed-and-edited-from.txt', 'rename plus edit, line one\nline two\nline three\n')
+  write('copied-source.txt', 'copy me, line one\nline two\nline three\nline four\n')
+  write('nested/deep/inner.txt', 'nested before\n')
+  write('spaced name.txt', 'spaced before\n')
+  write('ünïcode-ページ.txt', 'unicode before\n')
+  write('binary-modified.bin', Buffer.from([0, 1, 2, 3, 0, 255]))
+  write('binary-deleted.bin', Buffer.from([9, 8, 7, 0]))
+  write('emptied.txt', 'about to be emptied\n')
+  write('crlf.txt', 'crlf before\r\nsecond line\r\n')
+  write('mode-changed.sh', '#!/bin/sh\necho hi\n')
+  gitCommit(repoPath, 'base')
+  const baseOid = git(repoPath, ['rev-parse', 'HEAD']).trim()
+
+  write('modified.txt', 'after\n')
+  rmSync(path.join(repoPath, 'deleted.txt'))
+  rmSync(path.join(repoPath, 'binary-deleted.bin'))
+  git(repoPath, ['mv', 'renamed-from.txt', 'renamed-to.txt'])
+  git(repoPath, ['mv', 'renamed-and-edited-from.txt', 'renamed-and-edited-to.txt'])
+  write('renamed-and-edited-to.txt', 'rename plus edit, line one\nline two CHANGED\nline three\n')
+  write('copied-target.txt', 'copy me, line one\nline two\nline three\nline four\n')
+  write('added.txt', 'brand new\n')
+  write('binary-added.bin', Buffer.from([4, 4, 0, 4]))
+  write('binary-modified.bin', Buffer.from([0, 1, 2, 3, 0, 254]))
+  write('nested/deep/inner.txt', 'nested after\n')
+  write('spaced name.txt', 'spaced after\n')
+  write('ünïcode-ページ.txt', 'unicode after\n')
+  write('emptied.txt', '')
+  write('crlf.txt', 'crlf after\r\nsecond line\r\n')
+  git(repoPath, ['update-index', '--chmod=+x', 'mode-changed.sh'])
+  gitCommit(repoPath, 'head')
+
+  return { repoPath, baseOid }
+}
+
+describe('pinned and legacy branch diff equivalence against real Git', () => {
+  let dispatcher: MockDispatcher
+  let handler: GitHandler
+  let repoPath = ''
+  let baseOid = ''
+
+  beforeEach(() => {
+    dispatcher = createMockDispatcher()
+    handler = new GitHandler(dispatcher as unknown as RelayDispatcher, new RelayContext())
+    const built = buildScenarioRepo()
+    repoPath = built.repoPath
+    baseOid = built.baseOid
+  })
+
+  afterEach(() => {
+    handler.dispose()
+    if (repoPath) {
+      rmSync(repoPath, { recursive: true, force: true })
+    }
+  })
+
+  async function branchCompare(): Promise<BranchCompareResult> {
+    return (await dispatcher.callRequest('git.branchCompare', {
+      worktreePath: repoPath,
+      baseRef: baseOid
+    })) as BranchCompareResult
+  }
+
+  async function branchDiff(params: Record<string, unknown>): Promise<DiffEntry[]> {
+    return (await dispatcher.callRequest('git.branchDiff', {
+      worktreePath: repoPath,
+      baseRef: baseOid,
+      includePatch: true,
+      ...params
+    })) as DiffEntry[]
+  }
+
+  it('produces identical results for every changed file the review panel can open', async () => {
+    const compare = await branchCompare()
+    expect(compare.summary.status).toBe('ready')
+    // Guard the guard: a truncated scenario set would make this test vacuously pass.
+    expect(compare.entries.length).toBeGreaterThanOrEqual(14)
+
+    const divergences: string[] = []
+    for (const entry of compare.entries) {
+      // Exactly what the renderer sends: paths from the compare entry list,
+      // OIDs from the compare summary that produced that same list.
+      const callerShape = { filePath: entry.path, oldPath: entry.oldPath }
+      const legacy = await branchDiff(callerShape)
+      const pinned = await branchDiff({
+        ...callerShape,
+        baseRef: compare.summary.mergeBase,
+        headOid: compare.summary.headOid
+      })
+
+      if (JSON.stringify(legacy) !== JSON.stringify(pinned)) {
+        divergences.push(
+          `${entry.status} ${entry.path}${entry.oldPath ? ` (from ${entry.oldPath})` : ''}\n` +
+            `  legacy: ${JSON.stringify(legacy)}\n  pinned: ${JSON.stringify(pinned)}`
+        )
+      }
+    }
+
+    expect(divergences.join('\n')).toBe('')
+  })
+
+  it('agrees on content for renames, additions, deletions and binaries specifically', async () => {
+    const compare = await branchCompare()
+    const byPath = new Map(compare.entries.map((entry) => [entry.path, entry]))
+
+    // Why assert content and not just equality: two identically-empty results
+    // would satisfy the equivalence test above while rendering nothing.
+    const rename = byPath.get('renamed-and-edited-to.txt')
+    expect(rename?.oldPath).toBe('renamed-and-edited-from.txt')
+    const [renamePinned] = await branchDiff({
+      baseRef: compare.summary.mergeBase,
+      headOid: compare.summary.headOid,
+      filePath: rename!.path,
+      oldPath: rename!.oldPath
+    })
+    expect(renamePinned).toMatchObject({
+      originalContent: 'rename plus edit, line one\nline two\nline three\n',
+      modifiedContent: 'rename plus edit, line one\nline two CHANGED\nline three\n'
+    })
+
+    const [addedPinned] = await branchDiff({
+      baseRef: compare.summary.mergeBase,
+      headOid: compare.summary.headOid,
+      filePath: 'added.txt'
+    })
+    expect(addedPinned).toMatchObject({ originalContent: '', modifiedContent: 'brand new\n' })
+
+    const [deletedPinned] = await branchDiff({
+      baseRef: compare.summary.mergeBase,
+      headOid: compare.summary.headOid,
+      filePath: 'deleted.txt'
+    })
+    expect(deletedPinned).toMatchObject({ originalContent: 'doomed\n', modifiedContent: '' })
+
+    const [binaryPinned] = await branchDiff({
+      baseRef: compare.summary.mergeBase,
+      headOid: compare.summary.headOid,
+      filePath: 'binary-modified.bin'
+    })
+    expect(binaryPinned).toMatchObject({ kind: 'binary' })
+  })
+
+  it('holds the pinned revision when HEAD moves mid-review, where legacy drifts', async () => {
+    const compare = await branchCompare()
+    writeFileSync(path.join(repoPath, 'modified.txt'), 'drifted after the snapshot\n')
+    gitCommit(repoPath, 'drift')
+
+    const pinned = await branchDiff({
+      baseRef: compare.summary.mergeBase,
+      headOid: compare.summary.headOid,
+      filePath: 'modified.txt'
+    })
+    const legacy = await branchDiff({ filePath: 'modified.txt' })
+
+    expect(pinned[0]).toMatchObject({ modifiedContent: 'after\n' })
+    // The divergence is the fix: legacy silently re-resolves live HEAD.
+    expect(legacy[0]).toMatchObject({ modifiedContent: 'drifted after the snapshot\n' })
+  })
+})
diff --git a/src/relay/git-handler-branch-diff-ops.ts b/src/relay/git-handler-branch-diff-ops.ts
new file mode 100644
index 00000000000..1da0de82be8
--- /dev/null
+++ b/src/relay/git-handler-branch-diff-ops.ts
@@ -0,0 +1,57 @@
+import { buildDiffResult } from './git-diff-result'
+import { readBlobAtOid, type GitBufferExec } from './git-handler-ops'
+
+const FULL_GIT_OBJECT_ID_PATTERN = /^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/
+
+function assertFullGitObjectId(value: unknown, label: string): asserts value is string {
+  if (typeof value !== 'string' || !FULL_GIT_OBJECT_ID_PATTERN.test(value)) {
+    throw new Error(`${label} must be a full git object id`)
+  }
+}
+
+export function isFullGitObjectId(value: unknown): value is string {
+  return typeof value === 'string' && FULL_GIT_OBJECT_ID_PATTERN.test(value)
+}
+
+export function parseOptionalBranchDiffHeadOid(
+  params: Record<string, unknown>
+): string | undefined {
+  const { headOid } = params
+  // Why: GitBranchCompareSummary.headOid is `string | null`, so a mixed-version
+  // client can put an explicit null on the wire. Treat it as unpinned rather
+  // than rejecting a request the legacy path would have served.
+  if (headOid == null) {
+    return undefined
+  }
+  assertFullGitObjectId(headOid, 'headOid')
+  return headOid
+}
+
+export async function branchDiffEntryAtPinnedOids(
+  gitBuffer: GitBufferExec,
+  worktreePath: string,
+  baseOid: string,
+  headOid: string,
+  filePath: string,
+  oldPath?: string
+) {
+  assertFullGitObjectId(baseOid, 'baseRef')
+  assertFullGitObjectId(headOid, 'headOid')
+  try {
+    const [left, right] = await Promise.all([
+      readBlobAtOid(gitBuffer, worktreePath, baseOid, oldPath ?? filePath),
+      readBlobAtOid(gitBuffer, worktreePath, headOid, filePath)
+    ])
+    return [buildDiffResult(left.content, right.content, left.isBinary, right.isBinary, filePath)]
+  } catch {
+    return [
+      {
+        kind: 'text' as const,
+        originalContent: '',
+        modifiedContent: '',
+        originalIsBinary: false,
+        modifiedIsBinary: false
+      }
+    ]
+  }
+}
diff --git a/src/relay/git-handler-branch-diff.test.ts b/src/relay/git-handler-branch-diff.test.ts
new file mode 100644
index 00000000000..ce60c8cd439
--- /dev/null
+++ b/src/relay/git-handler-branch-diff.test.ts
@@ -0,0 +1,392 @@
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import * as path from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { RelayContext } from './context'
+import {
+  branchDiffEntryAtPinnedOids,
+  isFullGitObjectId,
+  parseOptionalBranchDiffHeadOid
+} from './git-handler-branch-diff-ops'
+import { GitHandler } from './git-handler'
+import { branchDiffEntries, type GitBufferExec, type GitExec } from './git-handler-ops'
+import {
+  createMockDispatcher,
+  gitCommit,
+  gitInit,
+  type MockDispatcher,
+  type RelayDispatcher
+} from './git-handler-test-setup'
+
+const BASE_OID = 'a'.repeat(40)
+const HEAD_OID = 'b'.repeat(40)
+const OTHER_HEAD_OID = 'c'.repeat(40)
+const MERGE_BASE_OID = 'd'.repeat(40)
+const FILE_PATH = 'src/file.ts'
+
+type GitBufferTarget = {
+  gitBuffer(args: string[], cwd: string): Promise<Buffer>
+}
+
+type GitTarget = {
+  git(args: string[], cwd: string): Promise<{ stdout: string; stderr: string }>
+}
+
+function deferredBuffer(): { promise: Promise<Buffer>; resolve: (content: string) => void } {
+  let resolve!: (value: Buffer) => void
+  const promise = new Promise<Buffer>((innerResolve) => {
+    resolve = innerResolve
+  })
+  return { promise, resolve: (content) => resolve(Buffer.from(content)) }
+}
+
+describe('pinned relay branch diff operation', () => {
+  it.each([
+    {
+      name: 'addition',
+      status: `A\t${FILE_PATH}\n`,
+      left: new Error('missing'),
+      right: Buffer.from('added\n')
+    },
+    {
+      name: 'deletion',
+      status: `D\t${FILE_PATH}\n`,
+      left: Buffer.from('deleted\n'),
+      right: new Error('missing')
+    },
+    {
+      name: 'binary content',
+      status: `M\t${FILE_PATH}\n`,
+      left: Buffer.from([0, 1]),
+      right: Buffer.from([0, 2])
+    },
+    {
+      name: 'blob read failure',
+      status: `M\t${FILE_PATH}\n`,
+      left: new Error('left failed'),
+      right: new Error('right failed')
+    }
+  ])('matches the legacy $name result', async ({ status, left, right }) => {
+    const createGitBuffer = (): GitBufferExec =>
+      vi.fn<GitBufferExec>(async (args) => {
+        const value = args[2].startsWith(`${BASE_OID}:`) ? left : right
+        if (value instanceof Error) {
+          throw value
+        }
+        return value
+      })
+    const git = vi.fn<GitExec>(async (args) => {
+      if (args[0] === 'rev-parse' && args.includes('HEAD')) {
+        return { stdout: `${HEAD_OID}\n`, stderr: '' }
+      }
+      if (args[0] === 'rev-parse' || args[0] === 'merge-base') {
+        return { stdout: `${BASE_OID}\n`, stderr: '' }
+      }
+      return { stdout: status, stderr: '' }
+    })
+
+    const pinned = await branchDiffEntryAtPinnedOids(
+      createGitBuffer(),
+      '/repo',
+      BASE_OID,
+      HEAD_OID,
+      FILE_PATH
+    )
+    const legacy = await branchDiffEntries(git, createGitBuffer(), '/repo', BASE_OID, {
+      includePatch: true,
+      filePath: FILE_PATH
+    })
+
+    expect(pinned).toEqual(legacy)
+  })
+
+  // Why: GitBranchCompareSummary.headOid is `string | null`, so an unpinned
+  // snapshot arrives as an explicit null and must stay servable.
+  it.each([
+    { name: 'absent', params: {} },
+    { name: 'null', params: { headOid: null } },
+    { name: 'undefined', params: { headOid: undefined } }
+  ])('treats a $name head OID as unpinned', ({ params }) => {
+    expect(parseOptionalBranchDiffHeadOid(params)).toBeUndefined()
+  })
+
+  it.each([
+    { name: 'SHA-1', headOid: HEAD_OID },
+    { name: 'SHA-256', headOid: 'b'.repeat(64) }
+  ])('returns a supplied $name head OID', ({ headOid }) => {
+    expect(parseOptionalBranchDiffHeadOid({ headOid })).toBe(headOid)
+  })
+
+  it.each([{ headOid: 'abc123' }, { headOid: '' }, { headOid: 'main' }, { headOid: 123 }])(
+    'rejects the supplied malformed head OID $headOid',
+    ({ headOid }) => {
+      expect(() => parseOptionalBranchDiffHeadOid({ headOid })).toThrow(
+        'headOid must be a full git object id'
+      )
+    }
+  )
+
+  it('recognizes only full object ids', () => {
+    expect(isFullGitObjectId(BASE_OID)).toBe(true)
+    expect(isFullGitObjectId('A'.repeat(64))).toBe(true)
+    for (const value of ['origin/main', 'abc123', '', 'g'.repeat(40), null, undefined, 123, {}]) {
+      expect(isFullGitObjectId(value)).toBe(false)
+    }
+  })
+
+  // Why: the route guards this today, but the export is reachable on its own —
+  // a symbolic ref here would resolve `git show origin/main:<path>` at live HEAD.
+  it('rejects a symbolic ref at the module boundary', async () => {
+    const gitBuffer = vi.fn<GitBufferExec>(async () => Buffer.from(''))
+    await expect(
+      branchDiffEntryAtPinnedOids(gitBuffer, '/repo', 'origin/main', HEAD_OID, FILE_PATH)
+    ).rejects.toThrow('baseRef must be a full git object id')
+    await expect(
+      branchDiffEntryAtPinnedOids(gitBuffer, '/repo', BASE_OID, 'HEAD', FILE_PATH)
+    ).rejects.toThrow('headOid must be a full git object id')
+    expect(gitBuffer).not.toHaveBeenCalled()
+  })
+})
+
+describe('GitHandler pinned branch diff route', () => {
+  let dispatcher: MockDispatcher
+  let handler: GitHandler
+
+  beforeEach(() => {
+    dispatcher = createMockDispatcher()
+    handler = new GitHandler(dispatcher as unknown as RelayDispatcher, new RelayContext())
+  })
+
+  afterEach(() => {
+    handler.dispose()
+    vi.restoreAllMocks()
+  })
+
+  function request(overrides: Record<string, unknown> = {}): Promise<unknown> {
+    return dispatcher.callRequest('git.branchDiff', {
+      worktreePath: '/repo',
+      baseRef: BASE_OID,
+      headOid: HEAD_OID,
+      includePatch: true,
+      filePath: FILE_PATH,
+      ...overrides
+    })
+  }
+
+  function mockLegacyGit(nameStatus = '') {
+    return vi.spyOn(handler as unknown as GitTarget, 'git').mockImplementation(async (args) => {
+      if (args[0] === 'rev-parse' && args.includes('HEAD')) {
+        return { stdout: `${HEAD_OID}\n`, stderr: '' }
+      }
+      if (args[0] === 'rev-parse') {
+        return { stdout: `${BASE_OID}\n`, stderr: '' }
+      }
+      if (args[0] === 'merge-base') {
+        return { stdout: `${MERGE_BASE_OID}\n`, stderr: '' }
+      }
+      return { stdout: nameStatus, stderr: '' }
+    })
+  }
+
+  it('starts exactly two pinned blob reads concurrently without metadata commands', async () => {
+    const left = deferredBuffer()
+    const right = deferredBuffer()
+    const gitBufferSpy = vi
+      .spyOn(handler as unknown as GitBufferTarget, 'gitBuffer')
+      .mockImplementation((args) => {
+        if (args[2] === `${BASE_OID}:${FILE_PATH}`) {
+          return left.promise
+        }
+        if (args[2] === `${HEAD_OID}:${FILE_PATH}`) {
+          return right.promise
+        }
+        throw new Error(`unexpected blob spec: ${args[2]}`)
+      })
+    const gitSpy = vi
+      .spyOn(handler as unknown as GitTarget, 'git')
+      .mockRejectedValue(new Error('metadata command should not run'))
+
+    const resultPromise = request()
+    await vi.waitFor(() => expect(gitBufferSpy).toHaveBeenCalledTimes(2))
+
+    expect(gitSpy).not.toHaveBeenCalled()
+    expect(gitBufferSpy.mock.calls.map(([args]) => args)).toEqual([
+      ['show', '--end-of-options', `${BASE_OID}:${FILE_PATH}`],
+      ['show', '--end-of-options', `${HEAD_OID}:${FILE_PATH}`]
+    ])
+
+    left.resolve('before\n')
+    right.resolve('after\n')
+    await expect(resultPromise).resolves.toEqual([
+      {
+        kind: 'text',
+        originalContent: 'before\n',
+        modifiedContent: 'after\n',
+        originalIsBinary: false,
+        modifiedIsBinary: false
+      }
+    ])
+  })
+
+  it('reads the old path only from the base OID', async () => {
+    const oldPath = 'src/old-file.ts'
+    const gitBufferSpy = vi
+      .spyOn(handler as unknown as GitBufferTarget, 'gitBuffer')
+      .mockImplementation(async (args) => Buffer.from(args[2].startsWith(BASE_OID) ? 'old' : 'new'))
+
+    await request({ oldPath })
+
+    expect(gitBufferSpy.mock.calls.map(([args]) => args[2])).toEqual([
+      `${BASE_OID}:${oldPath}`,
+      `${HEAD_OID}:${FILE_PATH}`
+    ])
+  })
+
+  it('coalesces the same head OID while keeping different heads independent', async () => {
+    const pending = deferredBuffer()
+    const gitBufferSpy = vi
+      .spyOn(handler as unknown as GitBufferTarget, 'gitBuffer')
+      .mockImplementation(() => pending.promise)
+
+    const requests = [request(), request(), request({ headOid: OTHER_HEAD_OID })]
+    await vi.waitFor(() => expect(gitBufferSpy).toHaveBeenCalledTimes(4))
+
+    const specs = gitBufferSpy.mock.calls.map(([args]) => args[2])
+    expect(specs.filter((spec) => spec === `${BASE_OID}:${FILE_PATH}`)).toHaveLength(2)
+    expect(specs.filter((spec) => spec === `${HEAD_OID}:${FILE_PATH}`)).toHaveLength(1)
+    expect(specs.filter((spec) => spec === `${OTHER_HEAD_OID}:${FILE_PATH}`)).toHaveLength(1)
+
+    pending.resolve('content\n')
+    await Promise.all(requests)
+  })
+
+  it('rejects every supplied malformed head OID before running Git', async () => {
+    const gitBufferSpy = vi.spyOn(handler as unknown as GitBufferTarget, 'gitBuffer')
+    const invalidHeadOids = [7, {}, '', 'a'.repeat(39), 'g'.repeat(40)]
+
+    for (const headOid of invalidHeadOids) {
+      await expect(request({ headOid })).rejects.toThrow('headOid must be a full git object id')
+    }
+
+    expect(gitBufferSpy).not.toHaveBeenCalled()
+  })
+
+  it('accepts SHA-256 object IDs', async () => {
+    const baseOid = 'A'.repeat(64)
+    const headOid = 'b'.repeat(64)
+    const gitBufferSpy = vi
+      .spyOn(handler as unknown as GitBufferTarget, 'gitBuffer')
+      .mockResolvedValue(Buffer.from('content\n'))
+
+    await request({ baseRef: baseOid, headOid })
+
+    expect(gitBufferSpy.mock.calls.map(([args]) => args[2])).toEqual([
+      `${baseOid}:${FILE_PATH}`,
+      `${headOid}:${FILE_PATH}`
+    ])
+  })
+
+  // Why: a symbolic base ref used to select the pinned route and then throw.
+  it('selects the pinned route only when the base ref is a full object id', async () => {
+    const gitSpy = mockLegacyGit(`M\t${FILE_PATH}\n`)
+    const gitBufferSpy = vi
+      .spyOn(handler as unknown as GitBufferTarget, 'gitBuffer')
+      .mockResolvedValue(Buffer.from('content\n'))
+
+    await expect(request({ baseRef: 'origin/main' })).resolves.toHaveLength(1)
+
+    expect(gitSpy.mock.calls.map(([args]) => args.join(' '))).toEqual([
+      'rev-parse --verify HEAD',
+      'rev-parse --verify origin/main',
+      `merge-base ${BASE_OID} ${HEAD_OID}`,
+      `-c core.quotePath=false diff --name-status -M -C ${MERGE_BASE_OID} ${HEAD_OID}`
+    ])
+    expect(gitBufferSpy.mock.calls.map(([args]) => args[2])).toEqual([
+      `${MERGE_BASE_OID}:${FILE_PATH}`,
+      `${HEAD_OID}:${FILE_PATH}`
+    ])
+
+    gitSpy.mockClear()
+    gitBufferSpy.mockClear()
+    await request()
+
+    expect(gitSpy).not.toHaveBeenCalled()
+    expect(gitBufferSpy.mock.calls.map(([args]) => args[2])).toEqual([
+      `${BASE_OID}:${FILE_PATH}`,
+      `${HEAD_OID}:${FILE_PATH}`
+    ])
+  })
+
+  it('serves an explicitly null head OID through the legacy path', async () => {
+    const gitSpy = mockLegacyGit(`M\t${FILE_PATH}\n`)
+    const gitBufferSpy = vi.spyOn(handler as unknown as GitBufferTarget, 'gitBuffer')
+
+    await expect(request({ headOid: null, includePatch: false })).resolves.toEqual([
+      {
+        kind: 'text',
+        originalContent: '',
+        modifiedContent: '',
+        originalIsBinary: false,
+        modifiedIsBinary: false
+      }
+    ])
+
+    expect(gitSpy).toHaveBeenCalledTimes(4)
+    expect(gitBufferSpy).not.toHaveBeenCalled()
+  })
+
+  it('uses the legacy path when patch or file-path conditions are not met', async () => {
+    const gitSpy = mockLegacyGit()
+    const gitBufferSpy = vi.spyOn(handler as unknown as GitBufferTarget, 'gitBuffer')
+
+    await Promise.all([
+      request({ baseRef: 'main', includePatch: false }),
+      request({ baseRef: 'main', filePath: '' }),
+      request({ baseRef: 'main', filePath: { malformed: true } })
+    ])
+
+    expect(gitSpy).toHaveBeenCalledTimes(12)
+    expect(gitBufferSpy).not.toHaveBeenCalled()
+  })
+
+  it('keeps the requested head pinned after repository HEAD moves', async () => {
+    const repoPath = mkdtempSync(path.join(tmpdir(), 'relay-pinned-branch-diff-'))
+    try {
+      gitInit(repoPath)
+      writeFileSync(path.join(repoPath, 'file.txt'), 'base\n')
+      gitCommit(repoPath, 'base')
+      const baseOid = execFileSync('git', ['rev-parse', 'HEAD'], {
+        cwd: repoPath,
+        encoding: 'utf8'
+      }).trim()
+
+      writeFileSync(path.join(repoPath, 'file.txt'), 'pinned\n')
+      gitCommit(repoPath, 'pinned')
+      const pinnedHeadOid = execFileSync('git', ['rev-parse', 'HEAD'], {
+        cwd: repoPath,
+        encoding: 'utf8'
+      }).trim()
+
+      writeFileSync(path.join(repoPath, 'file.txt'), 'moved\n')
+      gitCommit(repoPath, 'moved')
+
+      const result = (await request({
+        worktreePath: repoPath,
+        baseRef: baseOid,
+        headOid: pinnedHeadOid,
+        filePath: 'file.txt'
+      })) as { originalContent: string; modifiedContent: string }[]
+
+      expect(result[0]).toMatchObject({
+        originalContent: 'base\n',
+        modifiedContent: 'pinned\n'
+      })
+      expect(
+        execFileSync('git', ['show', 'HEAD:file.txt'], { cwd: repoPath, encoding: 'utf8' })
+      ).toBe('moved\n')
+    } finally {
+      rmSync(repoPath, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/src/relay/git-handler-status-ops.ts b/src/relay/git-handler-status-ops.ts
index 60ea5913139..a9d0b63ea8a 100644
--- a/src/relay/git-handler-status-ops.ts
+++ b/src/relay/git-handler-status-ops.ts
@@ -91,7 +91,36 @@ export async function getStatusOp(
   )
   // Why: reject NaN/negative limits — NaN would silently disable capping, negatives would over-truncate.
   const limit = resolveGitStatusLimit(params.limit)
-  const conflictOperation = await detectConflictOperation(worktreePath)
+  const conflictPromise = detectConflictOperation(worktreePath)
+  // Why: core.quotePath=false keeps non-ASCII filenames as raw UTF-8 instead of octal escapes that render as gibberish.
+  const statusArgs = [
+    '-c',
+    'core.quotePath=false',
+    'status',
+    '--porcelain=v2',
+    '--branch',
+    '--untracked-files=all'
+  ]
+  if (includeIgnored) {
+    statusArgs.push('--ignored=matching')
+  }
+  // Why: attach rejection ownership before awaiting marker I/O, so a fast Git failure cannot become unhandled.
+  const statusSettlementPromise = Promise.allSettled([
+    (async () => {
+      const parser = new StatusPorcelainParser()
+      const result = await streamGit(statusArgs, worktreePath, {
+        // Why: status polling is read-like; avoid racing terminal Git on .git/worktrees/*/index.lock.
+        disableOptionalLocks: true,
+        signal: options.signal,
+        onStdout: (chunk) => parser.update(chunk, limit)
+      })
+      if (!result.stoppedEarly) {
+        parser.finish()
+      }
+      return { parser, stoppedEarly: result.stoppedEarly }
+    })()
+  ])
+  const conflictOperation = await conflictPromise
   const entries: Record<string, unknown>[] = []
   let head: string | undefined
   let branch: string | undefined
@@ -103,28 +132,11 @@ export async function getStatusOp(
   let branchLineTotal: GitBranchLineTotal | undefined
 
   try {
-    // Why: core.quotePath=false keeps non-ASCII filenames as raw UTF-8 instead of octal escapes that render as gibberish.
-    const statusArgs = [
-      '-c',
-      'core.quotePath=false',
-      'status',
-      '--porcelain=v2',
-      '--branch',
-      '--untracked-files=all'
-    ]
-    if (includeIgnored) {
-      statusArgs.push('--ignored=matching')
-    }
-    const parser = new StatusPorcelainParser()
-    const { stoppedEarly } = await streamGit(statusArgs, worktreePath, {
-      // Why: status polling is read-like; avoid racing terminal Git on .git/worktrees/*/index.lock.
-      disableOptionalLocks: true,
-      signal: options.signal,
-      onStdout: (chunk) => parser.update(chunk, limit)
-    })
-    if (!stoppedEarly) {
-      parser.finish()
+    const [statusResult] = await statusSettlementPromise
+    if (statusResult.status === 'rejected') {
+      throw statusResult.reason
     }
+    const { parser, stoppedEarly } = statusResult.value
     head = parser.branch.head
     branch = parser.branch.branch
     ignoredPaths = parser.ignoredPaths
diff --git a/src/relay/git-handler-utils.test.ts b/src/relay/git-handler-utils.test.ts
index e1c18a78d33..43f1d53d5d1 100644
--- a/src/relay/git-handler-utils.test.ts
+++ b/src/relay/git-handler-utils.test.ts
@@ -1,5 +1,4 @@
 import { describe, expect, it } from 'vitest'
-import { parseStatusOutput } from './git-status-output-parser'
 import { isUnsupportedWorktreeListZError, parseWorktreeList } from './git-handler-utils'
 
 describe('parseWorktreeList', () => {
@@ -105,72 +104,3 @@ describe('isUnsupportedWorktreeListZError', () => {
     expect(isUnsupportedWorktreeListZError(error)).toBe(false)
   })
 })
-
-describe('parseStatusOutput', () => {
-  it('parses upstream ahead/behind from porcelain v2 branch headers', () => {
-    const result = parseStatusOutput(
-      [
-        '# branch.oid abcdef1234567890',
-        '# branch.head feature/prompts',
-        '# branch.upstream origin/feature/prompts',
-        '# branch.ab +2 -3',
-        ''
-      ].join('\n')
-    )
-
-    expect(result.upstreamStatus).toEqual({
-      hasUpstream: true,
-      upstreamName: 'origin/feature/prompts',
-      ahead: 2,
-      behind: 3
-    })
-  })
-
-  it('reports no upstream when porcelain v2 omits branch.upstream', () => {
-    const result = parseStatusOutput(
-      ['# branch.oid abcdef1234567890', '# branch.head feature/prompts', ''].join('\n')
-    )
-
-    expect(result.upstreamStatus).toEqual({ hasUpstream: false, ahead: 0, behind: 0 })
-  })
-
-  it('parses ignored porcelain records separately from actionable entries', () => {
-    const result = parseStatusOutput(['! dist/', '! .env', '? scratch.txt', ''].join('\n'))
-
-    expect(result.ignoredPaths).toEqual(['dist/', '.env'])
-    expect(result.entries).toEqual([
-      { path: 'scratch.txt', status: 'untracked', area: 'untracked' }
-    ])
-  })
-
-  it('parses rename records with spaces in the paths', () => {
-    const result = parseStatusOutput(
-      '2 R. N... 100644 100644 100644 aaaa bbbb R100 src/new name.ts\tsrc/old name.ts\n'
-    )
-
-    expect(result.entries).toEqual([
-      { path: 'src/new name.ts', oldPath: 'src/old name.ts', status: 'renamed', area: 'staged' }
-    ])
-  })
-
-  it('parses submodule dirtiness flags from porcelain records', () => {
-    const result = parseStatusOutput(
-      '1 AM S..U 000000 160000 160000 0000000000000000000000000000000000000000 7844cb64e631f17a9ca5b548f3500ef7cecd2f17 nested-repo\n'
-    )
-
-    expect(result.entries).toEqual([
-      {
-        path: 'nested-repo',
-        status: 'added',
-        area: 'staged',
-        submodule: { commitChanged: false, trackedChanges: false, untrackedChanges: true }
-      },
-      {
-        path: 'nested-repo',
-        status: 'modified',
-        area: 'unstaged',
-        submodule: { commitChanged: false, trackedChanges: false, untrackedChanges: true }
-      }
-    ])
-  })
-})
diff --git a/src/relay/git-handler-utils.ts b/src/relay/git-handler-utils.ts
index ab3bb61faba..25885cfe4dc 100644
--- a/src/relay/git-handler-utils.ts
+++ b/src/relay/git-handler-utils.ts
@@ -106,7 +106,7 @@ export function parseUnmergedEntry(
  */
 export function parseBranchDiff(
   stdout: string,
-  statsByPath: Map<string, GitLineStats> = new Map()
+  statsByPath = new Map<string, GitLineStats>()
 ): Record<string, unknown>[] {
   const entries: Record<string, unknown>[] = []
   for (const line of stdout.split(/\r?\n/)) {
diff --git a/src/relay/git-handler.ts b/src/relay/git-handler.ts
index 0abc9f5d5be..3e8a20ea992 100644
--- a/src/relay/git-handler.ts
+++ b/src/relay/git-handler.ts
@@ -18,6 +18,11 @@ import {
   validateGitExecArgs,
   type GitExec
 } from './git-handler-ops'
+import {
+  branchDiffEntryAtPinnedOids,
+  isFullGitObjectId,
+  parseOptionalBranchDiffHeadOid
+} from './git-handler-branch-diff-ops'
 import {
   buildSubmoduleInnerCommitRangeDiff,
   computeSubmodulePointerDiff,
@@ -1148,6 +1153,7 @@ export class GitHandler {
     if (baseRef.startsWith('-')) {
       throw new Error('Base ref must not start with "-"')
     }
+    const headOid = parseOptionalBranchDiffHeadOid(params)
     const options = {
       includePatch: params.includePatch as boolean | undefined,
       filePath: params.filePath as string | undefined,
@@ -1158,18 +1164,36 @@ export class GitHandler {
         'branchDiff',
         worktreePath,
         baseRef,
+        headOid ?? null,
         options.includePatch ?? null,
         options.filePath ?? null,
         options.oldPath ?? null
       ]),
-      () =>
-        branchDiffEntries(
+      () => {
+        if (
+          headOid &&
+          isFullGitObjectId(baseRef) &&
+          options.includePatch === true &&
+          typeof options.filePath === 'string' &&
+          options.filePath.length > 0
+        ) {
+          return branchDiffEntryAtPinnedOids(
+            this.gitBuffer.bind(this),
+            worktreePath,
+            baseRef,
+            headOid,
+            options.filePath,
+            options.oldPath
+          )
+        }
+        return branchDiffEntries(
           this.git.bind(this),
           this.gitBuffer.bind(this),
           worktreePath,
           baseRef,
           options
         )
+      }
     )
     return this.maybeStreamResponse(result, params, context)
   }
diff --git a/src/relay/git-status-output-parser.test.ts b/src/relay/git-status-output-parser.test.ts
deleted file mode 100644
index ec25e9b72ba..00000000000
--- a/src/relay/git-status-output-parser.test.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { parseStatusOutput } from './git-status-output-parser'
-
-describe('parseStatusOutput', () => {
-  it('marks staged S... submodule rows as commit-changed gitlinks', () => {
-    const parsed = parseStatusOutput(
-      '1 M. S... 160000 160000 160000 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb flutter_mine\n'
-    )
-
-    expect(parsed.entries).toEqual([
-      {
-        path: 'flutter_mine',
-        status: 'modified',
-        area: 'staged',
-        submodule: { commitChanged: true, trackedChanges: false, untrackedChanges: false }
-      }
-    ])
-  })
-})
diff --git a/src/relay/git-status-output-parser.ts b/src/relay/git-status-output-parser.ts
deleted file mode 100644
index 9bb1d344073..00000000000
--- a/src/relay/git-status-output-parser.ts
+++ /dev/null
@@ -1,177 +0,0 @@
-export function parseStatusChar(char: string): string {
-  switch (char) {
-    case 'M':
-      return 'modified'
-    case 'A':
-      return 'added'
-    case 'D':
-      return 'deleted'
-    case 'R':
-      return 'renamed'
-    case 'C':
-      return 'copied'
-    default:
-      return 'modified'
-  }
-}
-
-/**
- * Parse `git status --porcelain=v2` output into structured entries.
- * Does NOT handle unmerged entries (those require worktree access).
- */
-export function parseStatusOutput(stdout: string): {
-  entries: Record<string, unknown>[]
-  unmergedLines: string[]
-  ignoredPaths: string[]
-  head?: string
-  branch?: string
-  upstreamStatus: {
-    hasUpstream: boolean
-    upstreamName?: string
-    ahead: number
-    behind: number
-  }
-} {
-  const entries: Record<string, unknown>[] = []
-  const unmergedLines: string[] = []
-  const ignoredPaths: string[] = []
-  let head: string | undefined
-  let branch: string | undefined
-  let upstreamName: string | undefined
-  let upstreamAheadBehind: { ahead: number; behind: number } | null = null
-
-  for (const line of stdout.split(/\r?\n/)) {
-    if (!line) {
-      continue
-    }
-
-    if (line.startsWith('# branch.oid ')) {
-      head = line.slice('# branch.oid '.length).trim()
-      continue
-    }
-
-    if (line.startsWith('# branch.head ')) {
-      const branchHead = line.slice('# branch.head '.length).trim()
-      branch = branchHead && branchHead !== '(detached)' ? `refs/heads/${branchHead}` : ''
-      continue
-    }
-
-    if (line.startsWith('# branch.upstream ')) {
-      upstreamName = line.slice('# branch.upstream '.length).trim() || undefined
-      continue
-    }
-
-    if (line.startsWith('# branch.ab ')) {
-      upstreamAheadBehind = parseBranchAheadBehind(line)
-      continue
-    }
-
-    if (line.startsWith('1 ') || line.startsWith('2 ')) {
-      const parts = line.split(' ')
-      const xy = parts[1]
-      const indexStatus = xy[0]
-      const worktreeStatus = xy[1]
-
-      if (line.startsWith('2 ')) {
-        // Why: porcelain v2 type-2 format is `2 XY sub mH mI mW hH hI Xscore path\torigPath`.
-        // The new path starts after 9 fixed fields and can contain spaces; origPath follows the tab.
-        const tabParts = line.split('\t')
-        const filePath = tabParts[0].split(' ').slice(9).join(' ')
-        const oldPath = tabParts.slice(1).join('\t')
-        if (indexStatus !== '.') {
-          entries.push({
-            path: filePath,
-            status: parseStatusChar(indexStatus),
-            area: 'staged',
-            oldPath,
-            ...submoduleStatusField(parts[2], indexStatus)
-          })
-        }
-        if (worktreeStatus !== '.') {
-          entries.push({
-            path: filePath,
-            status: parseStatusChar(worktreeStatus),
-            area: 'unstaged',
-            oldPath,
-            ...submoduleStatusField(parts[2], worktreeStatus)
-          })
-        }
-      } else {
-        const filePath = parts.slice(8).join(' ')
-        if (indexStatus !== '.') {
-          entries.push({
-            path: filePath,
-            status: parseStatusChar(indexStatus),
-            area: 'staged',
-            ...submoduleStatusField(parts[2], indexStatus)
-          })
-        }
-        if (worktreeStatus !== '.') {
-          entries.push({
-            path: filePath,
-            status: parseStatusChar(worktreeStatus),
-            area: 'unstaged',
-            ...submoduleStatusField(parts[2], worktreeStatus)
-          })
-        }
-      }
-    } else if (line.startsWith('? ')) {
-      entries.push({ path: line.slice(2), status: 'untracked', area: 'untracked' })
-    } else if (line.startsWith('! ')) {
-      ignoredPaths.push(line.slice(2))
-    } else if (line.startsWith('u ')) {
-      unmergedLines.push(line)
-    }
-  }
-
-  return {
-    entries,
-    unmergedLines,
-    ignoredPaths,
-    head,
-    branch,
-    upstreamStatus: upstreamName
-      ? {
-          hasUpstream: true,
-          upstreamName,
-          ahead: upstreamAheadBehind?.ahead ?? 0,
-          behind: upstreamAheadBehind?.behind ?? 0
-        }
-      : { hasUpstream: false, ahead: 0, behind: 0 }
-  }
-}
-
-function parseSubmoduleStatus(
-  submoduleField: string | undefined,
-  statusChar = '.'
-): { commitChanged: boolean; trackedChanges: boolean; untrackedChanges: boolean } | undefined {
-  if (!submoduleField?.startsWith('S')) {
-    return undefined
-  }
-  return {
-    commitChanged: submoduleField[1] === 'C' || (submoduleField === 'S...' && statusChar === 'M'),
-    trackedChanges: submoduleField[2] === 'M',
-    untrackedChanges: submoduleField[3] === 'U'
-  }
-}
-
-function submoduleStatusField(
-  submoduleField: string | undefined,
-  statusChar: string
-):
-  | { submodule: { commitChanged: boolean; trackedChanges: boolean; untrackedChanges: boolean } }
-  | {} {
-  const submodule = parseSubmoduleStatus(submoduleField, statusChar)
-  return submodule ? { submodule } : {}
-}
-
-function parseBranchAheadBehind(line: string): { ahead: number; behind: number } | null {
-  const match = line.match(/^# branch\.ab \+(\d+) -(\d+)$/)
-  if (!match) {
-    return null
-  }
-  return {
-    ahead: Number.parseInt(match[1], 10),
-    behind: Number.parseInt(match[2], 10)
-  }
-}
diff --git a/src/relay/plugin-overlay-env.test.ts b/src/relay/plugin-overlay-env.test.ts
index 78e08918297..7746307cf47 100644
--- a/src/relay/plugin-overlay-env.test.ts
+++ b/src/relay/plugin-overlay-env.test.ts
@@ -104,4 +104,31 @@ describe('plugin overlay env source resolution', () => {
       )
     ).toBe('/remote/original-prime')
   })
+
+  // Why: the session env is the only place a fish user's XDG_CONFIG_HOME shows up
+  // (config.fish exports it, so no GUI-launched process inherits it). Dropping it
+  // here would scan ~/.config and disagree with the same lookup on the main side.
+  it.skipIf(process.platform === 'win32')(
+    'reads fish config under the session XDG_CONFIG_HOME',
+    () => {
+      const configHome = join(homeDir, 'xdg')
+      mkdirSync(join(configHome, 'fish'), { recursive: true })
+      writeFileSync(
+        join(configHome, 'fish', 'config.fish'),
+        'set -gx OPENCODE_CONFIG_DIR "$HOME/company-opencode"\n'
+      )
+      mkdirSync(join(homeDir, '.config', 'fish'), { recursive: true })
+      writeFileSync(
+        join(homeDir, '.config', 'fish', 'config.fish'),
+        'set -gx OPENCODE_CONFIG_DIR /wrong-default-config-home\n'
+      )
+
+      expect(
+        resolveOpenCodeSourceConfigDir(
+          { HOME: homeDir, XDG_CONFIG_HOME: configHome },
+          '/opt/homebrew/bin/fish'
+        )
+      ).toBe(join(homeDir, 'company-opencode'))
+    }
+  )
 })
diff --git a/src/relay/plugin-overlay-env.ts b/src/relay/plugin-overlay-env.ts
index 4b91da8ff62..1db43f4717e 100644
--- a/src/relay/plugin-overlay-env.ts
+++ b/src/relay/plugin-overlay-env.ts
@@ -1,4 +1,4 @@
-import { readShellStartupEnvVar } from '../main/pty/shell-startup-env'
+import { readSessionShellStartupEnvVar } from '../main/pty/shell-startup-env'
 import {
   PRIMARY_AGENT_DIR_ENV_BY_KIND,
   SOURCE_AGENT_DIR_ENV_BY_KIND,
@@ -14,7 +14,9 @@ function readStartupEnv(
   env: Record<string, string>,
   shell: string | undefined
 ): string | undefined {
-  return readShellStartupEnvVar(name, env.HOME ?? process.env.HOME, shell ?? env.SHELL)
+  // Why the session env first: it is closer to the user's shell than the relay
+  // process env, and fish config lives under its XDG_CONFIG_HOME.
+  return readSessionShellStartupEnvVar(name, env, shell)
 }
 
 export function resolveOpenCodeSourceConfigDir(
diff --git a/src/relay/plugin-overlay.ts b/src/relay/plugin-overlay.ts
index 6ff480ef91a..ffb9116beae 100644
--- a/src/relay/plugin-overlay.ts
+++ b/src/relay/plugin-overlay.ts
@@ -4,11 +4,11 @@
 // renderer are meaningless on SSH targets, so the relay performs the remote
 // filesystem work itself.
 //
-// Plugin source strings ship over the JSON-RPC channel at session-ready
-// (commit #7) — they are NOT bundled with the relay binary because the
-// relay is versioned independently from Orca and the plugin source changes
-// frequently as new agent events get added (see docs/design/agent-status-
-// over-ssh.md §4 "Why ship the plugin source over the wire").
+// Plugin source strings ship over the JSON-RPC channel at session-ready —
+// they are NOT bundled with the relay binary because the relay is versioned
+// independently from Orca and the plugin source changes frequently as new
+// agent events get added; bundling would make every such change a relay
+// redeploy, and an old relay would silently serve stale plugin code.
 //
 // We deliberately do not reuse OpenCodeHookService / PiTitlebarExtensionService
 // directly: those modules import `electron` and ride on Orca's userData
diff --git a/src/relay/port-scan-handler.test.ts b/src/relay/port-scan-handler.test.ts
index 9df947b1aad..4ed3bce6ecd 100644
--- a/src/relay/port-scan-handler.test.ts
+++ b/src/relay/port-scan-handler.test.ts
@@ -1,7 +1,155 @@
-import { describe, expect, it, vi } from 'vitest'
-import { parseHexAddress } from './port-scan-handler'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { MethodHandler, RequestContext } from './dispatcher'
+
+const { readFileMock, readdirMock, readlinkMock } = vi.hoisted(() => ({
+  readFileMock: vi.fn(),
+  readdirMock: vi.fn(),
+  readlinkMock: vi.fn()
+}))
+
+vi.mock('node:fs/promises', () => ({
+  readFile: readFileMock,
+  readdir: readdirMock,
+  readlink: readlinkMock
+}))
+
+import { parseHexAddress, PortScanHandler } from './port-scan-handler'
 import { parseWindowsNetstatOutput, parseWindowsPowerShellPortRows } from './windows-port-scan'
 
+const originalPlatformDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
+})
+
+afterEach(() => {
+  if (originalPlatformDescriptor) {
+    Object.defineProperty(process, 'platform', originalPlatformDescriptor)
+  }
+})
+
+function capturePortDetectHandler(): MethodHandler {
+  let handler: MethodHandler | undefined
+  new PortScanHandler({
+    onRequest: (method, nextHandler) => {
+      expect(method).toBe('ports.detect')
+      handler = nextHandler
+    }
+  })
+  if (!handler) {
+    throw new Error('ports.detect handler was not registered')
+  }
+  return handler
+}
+
+function requestContext(signal?: AbortSignal): RequestContext {
+  return { clientId: 1, isStale: () => signal?.aborted ?? false, signal }
+}
+
+function createDeferred<T>(): { promise: Promise<T>; resolve: (value: T) => void } {
+  let resolve = (_value: T): void => {
+    throw new Error('deferred promise was not initialized')
+  }
+  const promise = new Promise<T>((nextResolve) => {
+    resolve = nextResolve
+  })
+  return { promise, resolve }
+}
+
+function mockLinuxProcScan({
+  pidCount,
+  fdCount,
+  firstReadlink
+}: {
+  pidCount: number
+  fdCount: number
+  firstReadlink?: Promise<string>
+}): void {
+  const tcpHeader =
+    'sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode'
+  const tcpRow =
+    '0: 0100007F:0BB8 00000000:0000 0A 00000000:00000000 00:00000000 00000000 1000 0 11111'
+  readFileMock.mockImplementation(async (path: string) => {
+    if (path === '/proc/net/tcp') {
+      return `${tcpHeader}\n${tcpRow}\n`
+    }
+    if (path === '/proc/net/tcp6') {
+      return `${tcpHeader}\n`
+    }
+    if (path.endsWith('/cmdline')) {
+      return '/usr/bin/node\0server.js'
+    }
+    throw new Error(`unexpected readFile: ${path}`)
+  })
+
+  const pids = Array.from({ length: pidCount }, (_, index) => String(1_000 + index))
+  const fds = Array.from({ length: fdCount }, (_, index) => String(index))
+  readdirMock.mockImplementation(async (path: string) => {
+    if (path === '/proc') {
+      return pids
+    }
+    if (path.endsWith('/fd')) {
+      return fds
+    }
+    throw new Error(`unexpected readdir: ${path}`)
+  })
+
+  let first = true
+  readlinkMock.mockImplementation(() => {
+    if (first && firstReadlink) {
+      first = false
+      return firstReadlink
+    }
+    first = false
+    return Promise.resolve('socket:[11111]')
+  })
+}
+
+describe('PortScanHandler Linux cancellation', () => {
+  it('does not touch procfs for an already-cancelled request', async () => {
+    const controller = new AbortController()
+    controller.abort()
+
+    await expect(
+      capturePortDetectHandler()({}, requestContext(controller.signal))
+    ).rejects.toMatchObject({ name: 'AbortError' })
+
+    expect(readFileMock).not.toHaveBeenCalled()
+    expect(readdirMock).not.toHaveBeenCalled()
+    expect(readlinkMock).not.toHaveBeenCalled()
+  })
+
+  it('stops a large pid and fd walk at the filesystem operation already in flight', async () => {
+    const firstReadlink = createDeferred<string>()
+    mockLinuxProcScan({ pidCount: 1_000, fdCount: 100, firstReadlink: firstReadlink.promise })
+    const controller = new AbortController()
+    const scan = capturePortDetectHandler()({}, requestContext(controller.signal))
+
+    await vi.waitFor(() => expect(readlinkMock).toHaveBeenCalledTimes(1))
+    controller.abort()
+    firstReadlink.resolve('socket:[11111]')
+
+    await expect(scan).rejects.toMatchObject({ name: 'AbortError' })
+    expect(readdirMock).toHaveBeenCalledTimes(2)
+    expect(readdirMock).toHaveBeenNthCalledWith(1, '/proc')
+    expect(readdirMock).toHaveBeenNthCalledWith(2, '/proc/1000/fd')
+    expect(readlinkMock).toHaveBeenCalledTimes(1)
+    expect(readlinkMock).toHaveBeenCalledWith('/proc/1000/fd/0')
+  })
+
+  it('preserves detected port results when the request stays live', async () => {
+    mockLinuxProcScan({ pidCount: 1, fdCount: 1 })
+
+    await expect(
+      capturePortDetectHandler()({}, requestContext(new AbortController().signal))
+    ).resolves.toEqual({
+      ports: [{ host: '127.0.0.1', port: 3000, pid: 1_000, processName: 'node' }],
+      platform: 'linux'
+    })
+  })
+})
+
 describe('parseHexAddress', () => {
   it('parses IPv4 localhost (127.0.0.1)', () => {
     // 127.0.0.1 in little-endian hex: 0100007F
diff --git a/src/relay/port-scan-handler.ts b/src/relay/port-scan-handler.ts
index a576d8921fa..40150133a04 100644
--- a/src/relay/port-scan-handler.ts
+++ b/src/relay/port-scan-handler.ts
@@ -16,11 +16,11 @@ const SYSTEM_PORTS_TO_EXCLUDE = new Set([22])
 const MAX_DETECTED_PORTS = 50
 
 export class PortScanHandler {
-  constructor(dispatcher: RelayDispatcher) {
+  constructor(dispatcher: Pick<RelayDispatcher, 'onRequest'>) {
     dispatcher.onRequest('ports.detect', async (_params, context: RequestContext) => {
       if (process.platform === 'linux') {
         return {
-          ports: await this.scanLinuxListeningPorts(),
+          ports: await this.scanLinuxListeningPorts(context.signal),
           platform: process.platform
         }
       }
@@ -37,11 +37,13 @@ export class PortScanHandler {
     })
   }
 
-  private async scanLinuxListeningPorts(): Promise<DetectedPort[]> {
+  private async scanLinuxListeningPorts(signal?: AbortSignal): Promise<DetectedPort[]> {
+    signal?.throwIfAborted()
     const [tcp4, tcp6] = await Promise.all([
-      this.readProcNet('/proc/net/tcp'),
-      this.readProcNet('/proc/net/tcp6')
+      this.readProcNet('/proc/net/tcp', signal),
+      this.readProcNet('/proc/net/tcp6', signal)
     ])
+    signal?.throwIfAborted()
 
     const listeningSockets = [...tcp4, ...tcp6]
     if (listeningSockets.length === 0) {
@@ -49,7 +51,7 @@ export class PortScanHandler {
     }
 
     const inodeSet = new Set(listeningSockets.map((s) => s.inode))
-    const inodeToPid = await this.mapInodesToPids(inodeSet)
+    const inodeToPid = await this.mapInodesToPids(inodeSet, signal)
 
     const seen = new Set<string>()
     const results: DetectedPort[] = []
@@ -57,6 +59,7 @@ export class PortScanHandler {
     const relayParentPid = process.ppid
 
     for (const socket of listeningSockets) {
+      signal?.throwIfAborted()
       const key = `${socket.host}:${socket.port}`
       if (seen.has(key)) {
         continue
@@ -72,7 +75,7 @@ export class PortScanHandler {
         continue
       }
 
-      const processName = pid != null ? await this.getProcessName(pid) : undefined
+      const processName = pid != null ? await this.getProcessName(pid, signal) : undefined
 
       if (processName === 'sshd') {
         continue
@@ -93,14 +96,18 @@ export class PortScanHandler {
   }
 
   private async readProcNet(
-    path: string
+    path: string,
+    signal?: AbortSignal
   ): Promise<{ port: number; host: string; inode: number }[]> {
+    signal?.throwIfAborted()
     let content: string
     try {
       content = await readFile(path, 'utf-8')
     } catch {
+      signal?.throwIfAborted()
       return []
     }
+    signal?.throwIfAborted()
 
     const lines = content.split('\n')
     const results: { port: number; host: string; inode: number }[] = []
@@ -133,7 +140,11 @@ export class PortScanHandler {
     return results
   }
 
-  private async mapInodesToPids(inodes: Set<number>): Promise<Map<number, number>> {
+  private async mapInodesToPids(
+    inodes: Set<number>,
+    signal?: AbortSignal
+  ): Promise<Map<number, number>> {
+    signal?.throwIfAborted()
     const result = new Map<number, number>()
     if (inodes.size === 0) {
       return result
@@ -143,27 +154,35 @@ export class PortScanHandler {
     try {
       pids = (await readdir('/proc')).filter((name) => /^\d+$/.test(name))
     } catch {
+      signal?.throwIfAborted()
       return result
     }
+    signal?.throwIfAborted()
 
     for (const pidStr of pids) {
+      signal?.throwIfAborted()
       const fdDir = `/proc/${pidStr}/fd`
       let fds: string[]
       try {
         fds = await readdir(fdDir)
       } catch {
+        signal?.throwIfAborted()
         continue
       }
+      signal?.throwIfAborted()
 
       const pid = Number.parseInt(pidStr, 10)
 
       for (const fd of fds) {
+        signal?.throwIfAborted()
         let link: string
         try {
           link = await readlink(`${fdDir}/${fd}`)
         } catch {
+          signal?.throwIfAborted()
           continue
         }
+        signal?.throwIfAborted()
 
         const match = link.match(/^socket:\[(\d+)\]$/)
         if (!match) {
@@ -180,9 +199,11 @@ export class PortScanHandler {
     return result
   }
 
-  private async getProcessName(pid: number): Promise<string | undefined> {
+  private async getProcessName(pid: number, signal?: AbortSignal): Promise<string | undefined> {
+    signal?.throwIfAborted()
     try {
       const cmdline = await readFile(`/proc/${pid}/cmdline`, 'utf-8')
+      signal?.throwIfAborted()
       if (!cmdline) {
         return undefined
       }
@@ -195,6 +216,7 @@ export class PortScanHandler {
       const parts = exe.split('/')
       return parts.at(-1)
     } catch {
+      signal?.throwIfAborted()
       return undefined
     }
   }
diff --git a/src/relay/pty-handler.test.ts b/src/relay/pty-handler.test.ts
index 35d11461c53..8ddf1e67a12 100644
--- a/src/relay/pty-handler.test.ts
+++ b/src/relay/pty-handler.test.ts
@@ -12,8 +12,9 @@ import {
 } from '../shared/setup-agent-sequencing'
 import { PTY_STARTUP_INGRESS_VERSION } from '../shared/pty-startup-ingress'
 
-const { mockPtySpawn, mockPtyInstance } = vi.hoisted(() => ({
+const { mockPtySpawn, mockPtyInstance, mockCreateShellPromptReadinessProbe } = vi.hoisted(() => ({
   mockPtySpawn: vi.fn(),
+  mockCreateShellPromptReadinessProbe: vi.fn(),
   mockPtyInstance: {
     // Why: attach now proves the backing pid is alive before replaying, so the
     // default managed PTY must report a live pid. Reuse the test runner's own
@@ -38,6 +39,10 @@ vi.mock('../main/pty/posix-pty-process-groups', () => ({
   forceKillPosixPtyProcessGroups: vi.fn((_pid: number, fallback: () => void) => fallback())
 }))
 
+vi.mock('../main/shell-prompt-readiness-probe', () => ({
+  createShellPromptReadinessProbe: mockCreateShellPromptReadinessProbe
+}))
+
 import {
   IMMEDIATE_PTY_EXIT_TIMEOUT_MS,
   MAX_RELAY_PTY_SESSIONS,
@@ -139,6 +144,11 @@ describe('PtyHandler', () => {
     mockPtyInstance.clear.mockReset()
     mockPtyInstance.pause.mockReset()
     mockPtyInstance.resume.mockReset()
+    mockCreateShellPromptReadinessProbe.mockReset()
+    mockCreateShellPromptReadinessProbe.mockReturnValue({
+      notifyOutput: vi.fn(),
+      dispose: vi.fn()
+    })
     vi.spyOn(ptyShellUtils, 'processHasChildren').mockResolvedValue(false)
 
     mockPtySpawn.mockReturnValue({ ...mockPtyInstance })
@@ -829,6 +839,7 @@ describe('PtyHandler', () => {
     vi.advanceTimersByTime(49)
     const term = mockPtySpawn.mock.results[0]?.value
     expect(handler.retainedStartupCommandCount).toBe(1)
+    expect(handler.retainedStartupCommandBytes).toBe('echo provider-owned'.length)
     expect(term.write).not.toHaveBeenCalled()
 
     vi.advanceTimersByTime(1)
@@ -870,6 +881,9 @@ describe('PtyHandler', () => {
         | { env?: Record<string, string> }
         | undefined
       expect(spawnOptions?.env?.ORCA_SHELL_READY_MARKER).toBe('1')
+      expect(handler.retainedStartupCommandCount).toBe(1)
+      expect(handler.retainedStartupCommandBytes).toBe(0)
+      vi.advanceTimersByTime(15_000)
       expect(handler.retainedStartupCommandCount).toBe(0)
     }
   )
@@ -906,7 +920,7 @@ describe('PtyHandler', () => {
         | { env?: Record<string, string> }
         | undefined
       expect(spawnOptions?.env?.ORCA_SHELL_READY_MARKER).toBe('1')
-      expect(handler.retainedStartupCommandCount).toBe(0)
+      expect(handler.retainedStartupCommandCount).toBe(1)
     }
   )
 
@@ -1043,6 +1057,224 @@ describe('PtyHandler', () => {
     }
   )
 
+  it.skipIf(process.platform === 'win32')(
+    'recovers provider delivery when startup exec replaces the relay wrapper',
+    async () => {
+      let dataCallback: ((data: string) => void) | undefined
+      const term = {
+        ...mockPtyInstance,
+        onData: vi.fn((cb: (data: string) => void) => {
+          dataCallback = cb
+        }),
+        onExit: vi.fn()
+      }
+      mockPtySpawn.mockReturnValue(term)
+      const homeDir = mkdtempSync(join(tmpdir(), 'relay-provider-exec-spawn-'))
+      const oldShell = process.env.SHELL
+      process.env.SHELL = '/bin/bash'
+      try {
+        await dispatcher.callRequest('pty.spawn', {
+          env: { HOME: homeDir },
+          command: 'echo after-exec',
+          commandDelivery: 'provider',
+          startupCommandDelivery: 'shell-ready'
+        })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+        rmSync(homeDir, { recursive: true, force: true })
+      }
+
+      dataCallback?.(`\x1b]777;orca-shell-start:${process.pid}\x07\x1b[?2004hremote $ `)
+      await vi.advanceTimersByTimeAsync(8)
+
+      const promptOptions = mockCreateShellPromptReadinessProbe.mock.calls[0]?.[0] as {
+        onPromptReady: () => void
+      }
+      expect(
+        mockCreateShellPromptReadinessProbe.mock.results[0]?.value.notifyOutput
+      ).toHaveBeenCalledWith('\x1b[?2004hremote $ ')
+      expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', {
+        id: 'pty-1',
+        data: '\x1b[?2004hremote $ '
+      })
+      promptOptions.onPromptReady()
+      await vi.advanceTimersByTimeAsync(50)
+
+      expect(term.write).toHaveBeenCalledWith('echo after-exec\n')
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'signals renderer delivery when startup exec replaces the relay wrapper',
+    async () => {
+      let dataCallback: ((data: string) => void) | undefined
+      const term = {
+        ...mockPtyInstance,
+        onData: vi.fn((cb: (data: string) => void) => {
+          dataCallback = cb
+        }),
+        onExit: vi.fn()
+      }
+      mockPtySpawn.mockReturnValue(term)
+      const homeDir = mkdtempSync(join(tmpdir(), 'relay-renderer-exec-spawn-'))
+      const oldShell = process.env.SHELL
+      process.env.SHELL = '/bin/bash'
+      try {
+        await dispatcher.callRequest('pty.spawn', {
+          env: { HOME: homeDir },
+          command: 'echo after-exec',
+          startupCommandDelivery: 'shell-ready'
+        })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+        rmSync(homeDir, { recursive: true, force: true })
+      }
+
+      dataCallback?.(`\x1b]777;orca-shell-start:${process.pid}\x07\x1b[?2004hremote $ `)
+      await vi.advanceTimersByTimeAsync(8)
+      expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', {
+        id: 'pty-1',
+        data: '\x1b[?2004hremote $ '
+      })
+
+      const promptOptions = mockCreateShellPromptReadinessProbe.mock.calls[0]?.[0] as {
+        onPromptReady: () => void
+      }
+      promptOptions.onPromptReady()
+      await vi.advanceTimersByTimeAsync(8)
+
+      expect(term.write).not.toHaveBeenCalled()
+      expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', {
+        id: 'pty-1',
+        data: '\x1b]777;orca-shell-ready\x07'
+      })
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'forwards the supported ready marker to renderer delivery',
+    async () => {
+      let dataCallback: ((data: string) => void) | undefined
+      const term = {
+        ...mockPtyInstance,
+        onData: vi.fn((cb: (data: string) => void) => {
+          dataCallback = cb
+        }),
+        onExit: vi.fn()
+      }
+      mockPtySpawn.mockReturnValue(term)
+      const homeDir = mkdtempSync(join(tmpdir(), 'relay-renderer-ready-spawn-'))
+      const oldShell = process.env.SHELL
+      process.env.SHELL = '/bin/bash'
+      try {
+        await dispatcher.callRequest('pty.spawn', {
+          env: { HOME: homeDir },
+          command: 'echo after-ready',
+          startupCommandDelivery: 'shell-ready'
+        })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+        rmSync(homeDir, { recursive: true, force: true })
+      }
+
+      dataCallback?.(
+        `\x1b]777;orca-shell-start:${process.pid}\x07\x1b]777;orca-shell-ready\x07remote $ `
+      )
+      await vi.advanceTimersByTimeAsync(8)
+
+      expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', {
+        id: 'pty-1',
+        data: '\x1b]777;orca-shell-ready\x07remote $ '
+      })
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'releases split renderer readiness through one completed path',
+    async () => {
+      let dataCallback: ((data: string) => void) | undefined
+      const term = {
+        ...mockPtyInstance,
+        onData: vi.fn((cb: (data: string) => void) => {
+          dataCallback = cb
+        }),
+        onExit: vi.fn()
+      }
+      mockPtySpawn.mockReturnValue(term)
+      const homeDir = mkdtempSync(join(tmpdir(), 'relay-renderer-split-ready-spawn-'))
+      const oldShell = process.env.SHELL
+      process.env.SHELL = '/bin/bash'
+      try {
+        await dispatcher.callRequest('pty.spawn', {
+          env: { HOME: homeDir },
+          command: 'echo after-ready',
+          startupCommandDelivery: 'shell-ready'
+        })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+        rmSync(homeDir, { recursive: true, force: true })
+      }
+
+      dataCallback?.(`\x1b]777;orca-shell-start:${process.pid}\x07\x1b]777;orca-shell-ready`)
+      dataCallback?.('\x07remote $ ')
+      await vi.advanceTimersByTimeAsync(8)
+
+      const probe = mockCreateShellPromptReadinessProbe.mock.results[0]?.value
+      expect(probe.notifyOutput).not.toHaveBeenCalled()
+      expect(probe.dispose).toHaveBeenCalledOnce()
+      expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', {
+        id: 'pty-1',
+        data: '\x1b]777;orca-shell-ready\x07remote $ '
+      })
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'does not retain renderer readiness state for unsupported shells',
+    async () => {
+      const oldShell = process.env.SHELL
+      process.env.SHELL = '/bin/sh'
+      try {
+        await dispatcher.callRequest('pty.spawn', {
+          command: 'x'.repeat(256 * 1024),
+          startupCommandDelivery: 'shell-ready'
+        })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+      }
+
+      const spawnOptions = mockPtySpawn.mock.calls[0]?.[2] as
+        | { env?: Record<string, string> }
+        | undefined
+      expect(spawnOptions?.env?.ORCA_SHELL_READY_MARKER).toBe('0')
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
   it.skipIf(process.platform === 'win32')(
     'flushes held shell-ready marker bytes when provider delivery falls back',
     async () => {
@@ -1142,6 +1374,50 @@ describe('PtyHandler', () => {
     ).rejects.toThrow('PTY "pty-1" not found')
   })
 
+  it.skipIf(process.platform === 'win32')(
+    'releases renderer readiness state when attach reaps a dead shell',
+    async () => {
+      const oldShell = process.env.SHELL
+      const oldHome = process.env.HOME
+      const homeDir = mkdtempSync(join(tmpdir(), 'relay-dead-shell-ready-spawn-'))
+      process.env.SHELL = '/bin/bash'
+      process.env.HOME = homeDir
+      try {
+        await dispatcher.callRequest('pty.spawn', {
+          env: { HOME: homeDir },
+          command: 'x'.repeat(256 * 1024),
+          startupCommandDelivery: 'shell-ready'
+        })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+        if (oldHome === undefined) {
+          delete process.env.HOME
+        } else {
+          process.env.HOME = oldHome
+        }
+        rmSync(homeDir, { recursive: true, force: true })
+      }
+      expect(handler.retainedStartupCommandCount).toBe(1)
+
+      const aliveSpy = vi.spyOn(ptyShellUtils, 'isProcessAlive').mockReturnValue(false)
+      try {
+        await expect(dispatcher.callRequest('pty.attach', { id: 'pty-1' })).rejects.toThrow(
+          'PTY "pty-1" not found'
+        )
+      } finally {
+        aliveSpy.mockRestore()
+      }
+
+      expect(handler.retainedStartupCommandCount).toBe(0)
+      vi.advanceTimersByTime(15_000)
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
   it('settles concurrent immediate shutdown when attach proves the shell exited', async () => {
     const mockKill = vi.fn()
     mockPtySpawn.mockReturnValue({
@@ -2734,9 +3010,16 @@ describe('PtyHandler', () => {
       ORCA_AGENT_HOOK_TOKEN: 'abc-uuid'
     }))
     const killSpy = vi.spyOn(process, 'kill').mockImplementation(() => true)
+    const oldStartupIdentity = process.env.ORCA_SHELL_STARTUP_IDENTITY
+    process.env.ORCA_SHELL_STARTUP_IDENTITY = '1'
     try {
       await dispatcher.callRequest('pty.revive', { state })
     } finally {
+      if (oldStartupIdentity === undefined) {
+        delete process.env.ORCA_SHELL_STARTUP_IDENTITY
+      } else {
+        process.env.ORCA_SHELL_STARTUP_IDENTITY = oldStartupIdentity
+      }
       killSpy.mockRestore()
     }
 
@@ -2749,6 +3032,8 @@ describe('PtyHandler', () => {
     expect(callArgs.env.ORCA_AGENT_HOOK_TOKEN).toBe('abc-uuid')
     expect(callArgs.env.TERM).toBe('xterm-256color')
     expect(callArgs.env.TERM_PROGRAM).toBe('Orca')
+    expect(callArgs.env.ORCA_SHELL_READY_MARKER).toBe('0')
+    expect(callArgs.env.ORCA_SHELL_STARTUP_IDENTITY).toBe('0')
   })
 
   it('fences both revived worktree identity and cwd with rollback', async () => {
diff --git a/src/relay/pty-handler.ts b/src/relay/pty-handler.ts
index 9471b2a3b9f..6dd3cd8a7fc 100644
--- a/src/relay/pty-handler.ts
+++ b/src/relay/pty-handler.ts
@@ -31,8 +31,19 @@ import {
   createShellReadyScanState,
   drainShellReadyHeldBytes,
   scanForShellReady,
+  SHELL_READY_MARKER_PREFIX,
   type ShellReadyScanState
 } from '../main/shell-ready-marker-scanner'
+import {
+  createShellStartupIdentityScanState,
+  drainShellStartupIdentityHeldBytes,
+  scanForShellStartupIdentity,
+  type ShellStartupIdentityScanState
+} from '../main/shell-startup-identity-scanner'
+import {
+  createShellPromptReadinessProbe,
+  type ShellPromptReadinessProbe
+} from '../main/shell-prompt-readiness-probe'
 import { applyTerminalGitCredentialPromptGuard } from '../shared/terminal-git-credential-guard'
 import {
   gitCredentialPromptGuardEnv,
@@ -147,6 +158,9 @@ type ManagedPty = {
   worktreeId?: string
   terminalHandle?: string
   explicitTerm?: string
+  shellPath?: string
+  shellCwd?: string
+  shellPathEnv?: string
   envToDelete: string[]
   gitCredentialPromptGuarded: boolean
   startupCommand?: ManagedStartupCommand
@@ -178,10 +192,14 @@ type PendingPtyOutput = RelayPtySourceOutput & {
 }
 
 type ManagedStartupCommand = {
-  command: string
+  command: string | null
+  providerDelivery: boolean
   delivered: boolean
   waitForShellReady: boolean
   scanState: ShellReadyScanState | null
+  identityScanState: ShellStartupIdentityScanState | null
+  shellPid: number | null
+  promptProbe: ShellPromptReadinessProbe | null
   timer: ReturnType<typeof setTimeout> | null
 }
 
@@ -245,6 +263,7 @@ const INTERACTIVE_REDRAW_MAX_CHARS = PTY_OUTPUT_FLUSH_CHUNK_CHARS
 const INTERACTIVE_OUTPUT_BUDGET_CHARS = 32 * 1024
 const STARTUP_COMMAND_WRITE_DELAY_MS = 50
 const STARTUP_COMMAND_SHELL_READY_FALLBACK_MS = 1500
+const RENDERER_SHELL_READY_RETENTION_MS = 15_000
 const PTY_FORCE_KILL_RETRY_DELAY_MS = 250
 const PTY_FORCE_KILL_MAX_ATTEMPTS = 2
 const ALLOWED_SIGNALS = new Set([
@@ -557,7 +576,7 @@ export class PtyHandler {
   }
 
   /** Register an env augmenter merged into every spawn env *after* process.env and renderer env.
-   *  Used by the relay-hook server to inject ORCA_AGENT_HOOK_* coords. See docs/design/agent-status-over-ssh.md §3. */
+   *  Used by the relay-hook server to inject ORCA_AGENT_HOOK_* coords: evaluated per spawn (not captured once), so a late or restarted hook-server bind still reaches the next PTY. */
   addEnvAugmenter(augmenter: PtyEnvAugmenter): () => void {
     this.envAugmenters.push(augmenter)
     return () => {
@@ -607,11 +626,7 @@ export class PtyHandler {
     for (const key of envToDelete) {
       delete result[key]
     }
-    if (
-      !envToDelete.includes('TERM') &&
-      rendererEnv &&
-      Object.prototype.hasOwnProperty.call(rendererEnv, 'TERM')
-    ) {
+    if (!envToDelete.includes('TERM') && rendererEnv && Object.hasOwn(rendererEnv, 'TERM')) {
       result.TERM = rendererEnv.TERM
     }
     // Why: node-pty defaults missing/empty TERM per-platform; normalize so POSIX and Windows children agree.
@@ -638,10 +653,26 @@ export class PtyHandler {
 
   private releaseStartupCommand(managed: ManagedPty): void {
     this.clearStartupCommandTimer(managed)
+    managed.startupCommand?.promptProbe?.dispose()
     managed.startupCommand = undefined
   }
 
-  private scheduleStartupCommandDelivery(managed: ManagedPty, delayMs: number): void {
+  private drainStartupScanBytes(startup: ManagedStartupCommand): string {
+    let heldBytes = startup.identityScanState
+      ? drainShellStartupIdentityHeldBytes(startup.identityScanState)
+      : ''
+    startup.identityScanState = null
+    if (startup.scanState && heldBytes) {
+      heldBytes = scanForShellReady(startup.scanState, heldBytes).output
+    }
+    if (startup.scanState) {
+      heldBytes += drainShellReadyHeldBytes(startup.scanState)
+      startup.scanState = null
+    }
+    return heldBytes
+  }
+
+  private scheduleStartupCommandResolution(managed: ManagedPty, delayMs: number): void {
     const startup = managed.startupCommand
     if (!startup || startup.delivered || managed.disposed) {
       return
@@ -649,22 +680,25 @@ export class PtyHandler {
     this.clearStartupCommandTimer(managed)
     startup.timer = setTimeout(() => {
       startup.timer = null
-      this.deliverStartupCommand(managed)
+      if (startup.providerDelivery) {
+        this.deliverStartupCommand(managed)
+      } else {
+        this.signalRendererShellReady(managed)
+      }
     }, delayMs)
   }
 
   private deliverStartupCommand(managed: ManagedPty): void {
     const startup = managed.startupCommand
-    if (!startup || startup.delivered || managed.disposed) {
+    if (!startup?.providerDelivery || !startup.command || startup.delivered || managed.disposed) {
       return
     }
     startup.delivered = true
     this.clearStartupCommandTimer(managed)
-    if (startup.scanState) {
-      const heldBytes = drainShellReadyHeldBytes(startup.scanState)
-      if (heldBytes) {
-        managed.startupIngress?.accept(heldBytes)
-      }
+    startup.promptProbe?.dispose()
+    const heldBytes = this.drainStartupScanBytes(startup)
+    if (heldBytes) {
+      managed.startupIngress?.accept(heldBytes)
     }
     const submit = process.platform === 'win32' ? '\r' : '\n'
     // Why: only the shell-ready wrapper arms bracketed-paste; other shells use raw submit so ESC[200~ markers aren't echoed.
@@ -676,6 +710,19 @@ export class PtyHandler {
     managed.pty.write(payload)
   }
 
+  private signalRendererShellReady(managed: ManagedPty): void {
+    const startup = managed.startupCommand
+    if (!startup || startup.providerDelivery || startup.delivered || managed.disposed) {
+      return
+    }
+    startup.delivered = true
+    this.clearStartupCommandTimer(managed)
+    startup.promptProbe?.dispose()
+    managed.startupIngress?.accept(this.drainStartupScanBytes(startup))
+    managed.startupIngress?.accept(`${SHELL_READY_MARKER_PREFIX}\x07`)
+    managed.startupCommand = undefined
+  }
+
   /** Wire onData/onExit listeners for a managed PTY and store it. */
   private wireAndStore(managed: ManagedPty): void {
     managed.physicalExit = new PhysicalExitTracker()
@@ -701,16 +748,48 @@ export class PtyHandler {
       onEmission: emitIngressData,
       ...(echoProbe ? { echoProbe } : {})
     })
+    const startup = managed.startupCommand
+    if (startup?.waitForShellReady) {
+      startup.promptProbe = createShellPromptReadinessProbe({
+        slavePath: readPtySlavePath(managed.pty),
+        shellPath: managed.shellPath,
+        shellCwd: managed.shellCwd,
+        shellPathEnv: managed.shellPathEnv,
+        getShellPid: () => startup.shellPid,
+        onPromptReady: () => {
+          if (startup.providerDelivery) {
+            this.scheduleStartupCommandResolution(managed, STARTUP_COMMAND_WRITE_DELAY_MS)
+          } else {
+            this.signalRendererShellReady(managed)
+          }
+        }
+      })
+    }
     managed.pty.onData((data: string) => {
       const startup = managed.startupCommand
+      if (startup?.identityScanState && !startup.delivered) {
+        const scanned = scanForShellStartupIdentity(startup.identityScanState, data)
+        data = scanned.output
+        if (scanned.shellPid) {
+          startup.shellPid = scanned.shellPid
+          startup.identityScanState = null
+        }
+      }
       if (startup?.waitForShellReady && startup.scanState && !startup.delivered) {
         const scanned = scanForShellReady(startup.scanState, data)
         data = scanned.output
         if (scanned.matched) {
-          this.scheduleStartupCommandDelivery(managed, STARTUP_COMMAND_WRITE_DELAY_MS)
+          if (startup.providerDelivery) {
+            this.scheduleStartupCommandResolution(managed, STARTUP_COMMAND_WRITE_DELAY_MS)
+          } else {
+            this.signalRendererShellReady(managed)
+          }
         }
       }
       managed.startupIngress?.accept(data)
+      if (startup && !startup.delivered && data.length > 0) {
+        startup.promptProbe?.notifyOutput(data)
+      }
     })
     managed.pty.onExit(({ exitCode }: { exitCode: number }) => {
       managed.physicalExit?.markExited()
@@ -748,11 +827,11 @@ export class PtyHandler {
 
   private releaseRelayIngress(managed: ManagedPty): void {
     const startupCommand = managed.startupCommand
-    const scanState = startupCommand?.scanState
-    if (scanState) {
-      const held = drainShellReadyHeldBytes(scanState)
-      startupCommand.scanState = null
-      managed.startupIngress?.accept(held)
+    if (startupCommand) {
+      this.clearStartupCommandTimer(managed)
+      startupCommand.promptProbe?.dispose()
+      managed.startupIngress?.accept(this.drainStartupScanBytes(startupCommand))
+      managed.startupCommand = undefined
     }
     managed.startupIngress?.drainAndClose()
   }
@@ -1431,7 +1510,7 @@ export class PtyHandler {
     const explicitTerm =
       !envToDelete.includes('TERM') &&
       env &&
-      Object.prototype.hasOwnProperty.call(env, 'TERM') &&
+      Object.hasOwn(env, 'TERM') &&
       typeof env.TERM === 'string' &&
       env.TERM.length > 0
         ? env.TERM
@@ -1475,11 +1554,15 @@ export class PtyHandler {
         startupCommandDelivery:
           params.startupCommandDelivery === 'shell-ready' ? 'shell-ready' : undefined
       })
+    const managedStartupCommand = shouldProviderDeliverCommand ? command : launchCommandHint
     // Why: both renderer- and provider-delivered startup commands use this marker; the delivering side strips it from output.
     const shellLaunch = getRelayShellLaunchConfig(shell, spawnEnv, process.platform, {
       terminalWindowsWslDistro,
-      emitReadyMarker: shouldEmitShellReadyMarker
+      emitReadyMarker: shouldEmitShellReadyMarker,
+      emitStartupIdentity: shouldEmitShellReadyMarker
     })
+    const rendererShellReadySupported =
+      !shouldProviderDeliverCommand && shellLaunch.env.ORCA_SHELL_READY_MARKER === '1'
 
     if (context?.signal?.aborted || context?.isStale()) {
       // Why: cancellation remains side-effect-free until the exact native spawn seam.
@@ -1500,7 +1583,12 @@ export class PtyHandler {
         rows,
         cwd,
         // Why: relay shells inherit process.env; don't let an ambient Orca marker enable shell-ready unless requested.
-        env: { ...spawnEnv, ORCA_SHELL_READY_MARKER: '0', ...shellLaunch.env }
+        env: {
+          ...spawnEnv,
+          ORCA_SHELL_READY_MARKER: '0',
+          ORCA_SHELL_STARTUP_IDENTITY: '0',
+          ...shellLaunch.env
+        }
       })
     } catch (error) {
       // Why: Windows loads conpty.node only on first spawn, so handle that late binding failure here.
@@ -1539,6 +1627,9 @@ export class PtyHandler {
       ...(explicitTerm !== undefined ? { explicitTerm } : {}),
       envToDelete,
       gitCredentialPromptGuarded,
+      shellPath: shell,
+      shellCwd: cwd,
+      shellPathEnv: spawnEnv.PATH,
       ownerBackend: resolvePtyOwnerBackend({
         platform: process.platform,
         shellPath: shell,
@@ -1546,16 +1637,23 @@ export class PtyHandler {
       }),
       ...(startupIngressIntent ? { startupIngressIntent } : {}),
       ...(terminalHandle ? { terminalHandle } : {}),
-      ...(shouldProviderDeliverCommand
+      ...(managedStartupCommand && (shouldProviderDeliverCommand || rendererShellReadySupported)
         ? {
             startupCommand: {
-              command,
+              command: shouldProviderDeliverCommand ? managedStartupCommand : null,
+              providerDelivery: shouldProviderDeliverCommand,
               delivered: false,
               waitForShellReady: shellLaunch.env.ORCA_SHELL_READY_MARKER === '1',
               scanState:
                 shellLaunch.env.ORCA_SHELL_READY_MARKER === '1'
                   ? createShellReadyScanState()
                   : null,
+              identityScanState:
+                shellLaunch.env.ORCA_SHELL_READY_MARKER === '1'
+                  ? createShellStartupIdentityScanState()
+                  : null,
+              shellPid: null,
+              promptProbe: null,
               timer: null
             }
           }
@@ -1572,11 +1670,13 @@ export class PtyHandler {
       this.releaseStartupCommand(managed)
       this.requestGracefulKill(managed, 'terminate stale')
     } else if (managed.startupCommand) {
-      this.scheduleStartupCommandDelivery(
+      this.scheduleStartupCommandResolution(
         managed,
-        managed.startupCommand.waitForShellReady
-          ? STARTUP_COMMAND_SHELL_READY_FALLBACK_MS
-          : STARTUP_COMMAND_WRITE_DELAY_MS
+        managed.startupCommand.providerDelivery
+          ? managed.startupCommand.waitForShellReady
+            ? STARTUP_COMMAND_SHELL_READY_FALLBACK_MS
+            : STARTUP_COMMAND_WRITE_DELAY_MS
+          : RENDERER_SHELL_READY_RETENTION_MS
       )
     }
     return {
@@ -2033,7 +2133,12 @@ export class PtyHandler {
       rows: entry.rows,
       cwd: entry.cwd,
       // Why: no provider-delivered command is waiting for a ready marker.
-      env: { ...spawnEnv, ORCA_SHELL_READY_MARKER: '0', ...shellLaunch.env }
+      env: {
+        ...spawnEnv,
+        ORCA_SHELL_READY_MARKER: '0',
+        ORCA_SHELL_STARTUP_IDENTITY: '0',
+        ...shellLaunch.env
+      }
     })
     this.wireAndStore({
       id: entry.id,
@@ -2212,6 +2317,14 @@ export class PtyHandler {
     return count
   }
 
+  get retainedStartupCommandBytes(): number {
+    let bytes = 0
+    for (const managed of this.ptys.values()) {
+      bytes += managed.startupCommand?.command?.length ?? 0
+    }
+    return bytes
+  }
+
   get graceTimerActive(): boolean {
     return this.graceTimer !== null
   }
diff --git a/src/relay/pty-shell-launch.test.ts b/src/relay/pty-shell-launch.test.ts
index c4c5b5f11ad..04f7a261583 100644
--- a/src/relay/pty-shell-launch.test.ts
+++ b/src/relay/pty-shell-launch.test.ts
@@ -181,6 +181,12 @@ describe('getRelayShellLaunchConfig', () => {
       expect(config.args).toEqual(['-l'])
       expect(config.env.ZDOTDIR).toBe(zshRoot)
       expect(config.env.ORCA_SHELL_READY_MARKER).toBe('1')
+      expect(readFileSync(join(zshRoot, '.zshenv'), 'utf8')).toContain(
+        'printf "\\033]777;orca-shell-start:%s\\007" "$$"'
+      )
+      expect(readFileSync(join(zshRoot, '.zshenv'), 'utf8')).toContain(
+        'unset ORCA_SHELL_STARTUP_IDENTITY'
+      )
       expect(zlogin).toContain('zle -N zle-line-init __orca_prompt_mark')
       expect(zlogin).toContain('printf "\\033]777;orca-shell-ready\\007"')
     }
@@ -195,11 +201,26 @@ describe('getRelayShellLaunchConfig', () => {
       const bashRc = readFileSync(config.args[1] as string, 'utf8')
 
       expect(config.env.ORCA_SHELL_READY_MARKER).toBe('1')
+      expect(bashRc).toContain('printf "\\033]777;orca-shell-start:%s\\007" "$$"')
+      expect(bashRc).toContain('unset ORCA_SHELL_STARTUP_IDENTITY')
       expect(bashRc).toContain('__orca_append_prompt_command "__orca_prompt_mark"')
       expect(bashRc).toContain('printf "\\033]777;orca-shell-ready\\007"')
     }
   )
 
+  it.skipIf(process.platform === 'win32')(
+    'wraps zsh when only startup identity emission is requested',
+    () => {
+      const config = getRelayShellLaunchConfig('/bin/zsh', { HOME: homeDir }, 'linux', {
+        emitStartupIdentity: true
+      })
+
+      expect(config.env.ZDOTDIR).toBe(join(homeDir, '.orca-relay', 'shell-ready', 'zsh'))
+      expect(config.env.ORCA_SHELL_STARTUP_IDENTITY).toBe('1')
+      expect(config.env.ORCA_SHELL_READY_MARKER).toBeUndefined()
+    }
+  )
+
   itWithBash('runs the relay bash wrapper without fake C/D markers before the first prompt', () => {
     const config = getRelayShellLaunchConfig('/bin/bash', { HOME: homeDir })
     const output = runInteractiveBashRcfile(config.args[1] as string, homeDir)
diff --git a/src/relay/pty-shell-launch.ts b/src/relay/pty-shell-launch.ts
index 5f58b89702c..7a6d7d7a097 100644
--- a/src/relay/pty-shell-launch.ts
+++ b/src/relay/pty-shell-launch.ts
@@ -5,6 +5,7 @@ import { getPosixOmpShellWrapper } from '../main/pty/omp-shell-wrapper'
 import {
   getZshFinalZdotdirRestoreBlock,
   getZshShellReadyMarkerRegistrationBlock,
+  SHELL_STARTUP_IDENTITY_MARKER_BLOCK,
   getZshStartupFileSourceBlock
 } from '../main/shell-templates'
 
@@ -84,6 +85,7 @@ function ensureOverlayRestoreWrappers(root: string): void {
   const bashDir = join(root, 'bash')
 
   const zshEnv = `# Orca relay zsh overlay wrapper
+${SHELL_STARTUP_IDENTITY_MARKER_BLOCK}
 export ORCA_ORIG_ZDOTDIR="\${ORCA_ORIG_ZDOTDIR:-$HOME}"
 case "\${ORCA_ORIG_ZDOTDIR%/}" in
   */shell-ready/zsh) export ORCA_ORIG_ZDOTDIR="$HOME" ;;
@@ -133,6 +135,7 @@ ${getZshFinalZdotdirRestoreBlock('"${ORCA_USER_ZDOTDIR:-${ORCA_ORIG_ZDOTDIR:-$HO
 ${getZshShellReadyMarkerRegistrationBlock(SHELL_READY_MARKER_ESCAPED)}
 `
   const bashRc = `# Orca relay bash overlay wrapper
+${SHELL_STARTUP_IDENTITY_MARKER_BLOCK}
 [[ -f /etc/profile ]] && source /etc/profile
 if [[ -f "$HOME/.bash_profile" ]]; then
   source "$HOME/.bash_profile"
@@ -264,10 +267,15 @@ export function getRelayShellLaunchConfig(
   shellPath: string,
   env: Record<string, string>,
   platform: NodeJS.Platform = process.platform,
-  options: { emitReadyMarker?: boolean; terminalWindowsWslDistro?: string | null } = {}
+  options: {
+    emitReadyMarker?: boolean
+    emitStartupIdentity?: boolean
+    terminalWindowsWslDistro?: string | null
+  } = {}
 ): RelayShellLaunchConfig {
   const shellName = shellBasename(shellPath)
   const emitReadyMarker = options.emitReadyMarker === true
+  const emitStartupIdentity = options.emitStartupIdentity === true
   if (platform === 'win32') {
     // Why: pwsh also exists on POSIX remotes; Windows-specific shell args must
     // only apply when the relay itself is running on native Windows.
@@ -283,9 +291,9 @@ export function getRelayShellLaunchConfig(
   if (shellName !== 'zsh' && shellName !== 'bash') {
     return { args: POSIX_LOGIN_ARGS, env: {} }
   }
-  // Why: preserve plain zsh startup fast path; only force wrappers when
-  // shell-ready or overlay env restoration is requested.
-  if (shellName === 'zsh' && !hasOverlayRestoreEnv(env) && !emitReadyMarker) {
+  // Why: preserve plain zsh startup fast path unless markers or overlay restoration are requested.
+  const requiresZshWrapper = hasOverlayRestoreEnv(env) || emitReadyMarker || emitStartupIdentity
+  if (shellName === 'zsh' && !requiresZshWrapper) {
     return { args: POSIX_LOGIN_ARGS, env: {} }
   }
 
@@ -298,13 +306,17 @@ export function getRelayShellLaunchConfig(
       env: {
         ORCA_ORIG_ZDOTDIR: resolveOriginalZdotdir(env),
         ZDOTDIR: join(root, 'zsh'),
-        ...(emitReadyMarker ? { ORCA_SHELL_READY_MARKER: '1' } : {})
+        ...(emitReadyMarker ? { ORCA_SHELL_READY_MARKER: '1' } : {}),
+        ...(emitStartupIdentity ? { ORCA_SHELL_STARTUP_IDENTITY: '1' } : {})
       }
     }
   }
 
   return {
     args: ['--rcfile', join(root, 'bash', 'rcfile')],
-    env: emitReadyMarker ? { ORCA_SHELL_READY_MARKER: '1' } : {}
+    env: {
+      ...(emitReadyMarker ? { ORCA_SHELL_READY_MARKER: '1' } : {}),
+      ...(emitStartupIdentity ? { ORCA_SHELL_STARTUP_IDENTITY: '1' } : {})
+    }
   }
 }
diff --git a/src/relay/pty-source-replay-index.test.ts b/src/relay/pty-source-replay-index.test.ts
deleted file mode 100644
index efbb17451b0..00000000000
--- a/src/relay/pty-source-replay-index.test.ts
+++ /dev/null
@@ -1,96 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import type { PtySourceSpan } from '../shared/pty-source-credit-contract'
-import { PtySourceReplayIndex } from './pty-source-replay-index'
-
-function span(id: string, data: string, sourceStartSu: number): PtySourceSpan {
-  return {
-    id: 'pty-1',
-    providerGeneration: 1,
-    clientGeneration: 1,
-    ownerGeneration: 1,
-    ptyIncarnation: 'incarnation-1',
-    deliveryToken: 'token-1',
-    spanId: id,
-    sourceStartSu,
-    sourceEndSu: sourceStartSu + data.length,
-    displayStart: sourceStartSu,
-    displayEnd: sourceStartSu + data.length,
-    data,
-    splittable: true,
-    transform: { transformed: false, rawLengthSu: data.length, scalarSafe: true }
-  }
-}
-
-describe('PtySourceReplayIndex', () => {
-  it('wraps the existing chunked buffer and preserves exact retained source ranges', () => {
-    const replay = new PtySourceReplayIndex(6)
-    replay.append(span('one', 'abcd', 0))
-    replay.append(span('two', 'efgh', 4))
-
-    expect(replay.readLegacy()).toBe('cdefgh')
-    expect(replay.recoveryFrom(3)).toEqual({
-      ok: true,
-      records: [
-        expect.objectContaining({ sourceStartSu: 3, data: 'd' }),
-        expect.objectContaining({ sourceStartSu: 4, data: 'efgh' })
-      ],
-      liveEndSourceSu: 8
-    })
-    expect(replay.recoveryFrom(1)).toMatchObject({
-      ok: false,
-      reason: 'checkpoint-before-retained-range'
-    })
-  })
-
-  it('does not wall-clock dedupe identical replay payloads', () => {
-    const first = new PtySourceReplayIndex(16)
-    const second = new PtySourceReplayIndex(16)
-    first.append(span('first', 'same', 0))
-    second.append({ ...span('second', 'same', 0), deliveryToken: 'token-2' })
-
-    expect(first.recoveryFrom(0)).toMatchObject({ ok: true })
-    expect(second.recoveryFrom(0)).toMatchObject({ ok: true })
-  })
-
-  it('preserves indivisible-form split metadata during recovery', () => {
-    const replay = new PtySourceReplayIndex(16)
-    replay.append({
-      ...span('range', 'abcd', 0),
-      splittable: undefined,
-      indivisible: false
-    })
-
-    expect(replay.recoveryFrom(2)).toMatchObject({
-      ok: true,
-      records: [expect.objectContaining({ sourceStartSu: 2, data: 'cd' })]
-    })
-  })
-
-  it('rejects replay checkpoints and retained heads inside a scalar', () => {
-    const replay = new PtySourceReplayIndex(4)
-    replay.append(span('range', 'a😀b', 0))
-    expect(replay.recoveryFrom(2)).toMatchObject({
-      ok: false,
-      reason: 'checkpoint-inside-scalar'
-    })
-
-    const trimmed = new PtySourceReplayIndex(1)
-    trimmed.append(span('emoji', '😀', 0))
-    expect(trimmed.recoveryFrom(1)).toMatchObject({
-      ok: false,
-      reason: 'checkpoint-before-retained-range',
-      retainedStartSourceSu: 2
-    })
-  })
-
-  it('rejects a recovery checkpoint beyond the live source range', () => {
-    const replay = new PtySourceReplayIndex(16)
-    replay.append(span('range', 'abcd', 0))
-
-    expect(replay.recoveryFrom(5)).toMatchObject({
-      ok: false,
-      reason: 'checkpoint-after-live-range',
-      liveEndSourceSu: 4
-    })
-  })
-})
diff --git a/src/relay/pty-source-replay-index.ts b/src/relay/pty-source-replay-index.ts
deleted file mode 100644
index 1dfe5596eb1..00000000000
--- a/src/relay/pty-source-replay-index.ts
+++ /dev/null
@@ -1,201 +0,0 @@
-import { RecentPtyOutputBuffer } from '../main/runtime/recent-pty-output-buffer'
-import { ptySourceSpanIsSplittable, type PtySourceSpan } from '../shared/pty-source-credit-contract'
-import {
-  assertNonNegativeSafeInteger,
-  assertPtySourceSpan
-} from '../shared/pty-source-credit-validation'
-
-export type PtySourceReplayRecord = Readonly<
-  Pick<
-    PtySourceSpan,
-    | 'spanId'
-    | 'sourceStartSu'
-    | 'sourceEndSu'
-    | 'displayStart'
-    | 'displayEnd'
-    | 'data'
-    | 'splittable'
-    | 'indivisible'
-    | 'transform'
-  >
->
-
-export type PtySourceReplayResult =
-  | Readonly<{ ok: true; records: readonly PtySourceReplayRecord[]; liveEndSourceSu: number }>
-  | Readonly<{
-      ok: false
-      reason:
-        | 'checkpoint-before-retained-range'
-        | 'checkpoint-after-live-range'
-        | 'checkpoint-inside-indivisible-transform'
-        | 'checkpoint-inside-scalar'
-      retainedStartSourceSu: number
-      liveEndSourceSu: number
-    }>
-
-export class PtySourceReplayIndex {
-  private readonly output: RecentPtyOutputBuffer
-  private readonly records: PtySourceReplayRecord[] = []
-  private displayEnd = 0
-  private retainedStartSourceSu = 0
-  private liveEndSourceSu = 0
-
-  constructor(limit: number) {
-    this.output = new RecentPtyOutputBuffer({ preserveChunkBoundaries: false, limit })
-  }
-
-  append(span: PtySourceSpan): void {
-    assertPtySourceSpan(span)
-    if (
-      span.sourceStartSu !== this.liveEndSourceSu ||
-      span.displayStart !== this.displayEnd ||
-      span.displayEnd - span.displayStart !== span.data.length
-    ) {
-      throw new Error('PTY replay source/display ranges must be contiguous')
-    }
-    this.output.append(span.data)
-    this.records.push(
-      Object.freeze({
-        spanId: span.spanId,
-        sourceStartSu: span.sourceStartSu,
-        sourceEndSu: span.sourceEndSu,
-        displayStart: span.displayStart,
-        displayEnd: span.displayEnd,
-        data: span.data,
-        splittable: span.splittable,
-        indivisible: span.indivisible,
-        transform: span.transform
-      })
-    )
-    this.displayEnd = span.displayEnd
-    this.liveEndSourceSu = span.sourceEndSu
-    this.evictUnmappedPrefix()
-  }
-
-  readLegacy(): string {
-    return this.output.read()
-  }
-
-  recoveryFrom(checkpointSourceEndSu: number): PtySourceReplayResult {
-    assertNonNegativeSafeInteger(checkpointSourceEndSu, 'checkpointSourceEndSu')
-    if (checkpointSourceEndSu < this.retainedStartSourceSu) {
-      return Object.freeze({
-        ok: false,
-        reason: 'checkpoint-before-retained-range',
-        retainedStartSourceSu: this.retainedStartSourceSu,
-        liveEndSourceSu: this.liveEndSourceSu
-      })
-    }
-    if (checkpointSourceEndSu > this.liveEndSourceSu) {
-      return Object.freeze({
-        ok: false,
-        reason: 'checkpoint-after-live-range',
-        retainedStartSourceSu: this.retainedStartSourceSu,
-        liveEndSourceSu: this.liveEndSourceSu
-      })
-    }
-    const containing = this.records.find(
-      (record) =>
-        record.sourceStartSu < checkpointSourceEndSu && checkpointSourceEndSu < record.sourceEndSu
-    )
-    if (
-      containing?.transform.transformed ||
-      (containing && !ptySourceSpanIsSplittable(containing))
-    ) {
-      return Object.freeze({
-        ok: false,
-        reason: 'checkpoint-inside-indivisible-transform',
-        retainedStartSourceSu: this.retainedStartSourceSu,
-        liveEndSourceSu: this.liveEndSourceSu
-      })
-    }
-    if (
-      containing &&
-      splitsSurrogatePair(containing.data, checkpointSourceEndSu - containing.sourceStartSu)
-    ) {
-      return Object.freeze({
-        ok: false,
-        reason: 'checkpoint-inside-scalar',
-        retainedStartSourceSu: this.retainedStartSourceSu,
-        liveEndSourceSu: this.liveEndSourceSu
-      })
-    }
-    const records = this.records
-      .filter((record) => record.sourceEndSu > checkpointSourceEndSu)
-      .map((record) => this.sliceRecord(record, checkpointSourceEndSu))
-    return Object.freeze({
-      ok: true,
-      records: Object.freeze(records),
-      liveEndSourceSu: this.liveEndSourceSu
-    })
-  }
-
-  private evictUnmappedPrefix(): void {
-    const retainedDisplayStart = this.displayEnd - this.output.read().length
-    while (this.records[0]?.displayEnd <= retainedDisplayStart) {
-      const removed = this.records.shift()!
-      this.retainedStartSourceSu = removed.sourceEndSu
-    }
-    const head = this.records[0]
-    if (!head || head.displayStart >= retainedDisplayStart) {
-      return
-    }
-    if (head.transform.transformed || !ptySourceSpanIsSplittable(head)) {
-      this.records.shift()
-      this.retainedStartSourceSu = head.sourceEndSu
-      return
-    }
-    const displayOffset = retainedDisplayStart - head.displayStart
-    if (splitsSurrogatePair(head.data, displayOffset)) {
-      this.records.shift()
-      this.retainedStartSourceSu = head.sourceEndSu
-      return
-    }
-    const sourceStartSu = head.sourceStartSu + displayOffset
-    this.records[0] = Object.freeze({
-      ...head,
-      spanId: `${head.spanId}:retained:${sourceStartSu}`,
-      sourceStartSu,
-      displayStart: retainedDisplayStart,
-      data: head.data.slice(displayOffset),
-      transform: Object.freeze({
-        ...head.transform,
-        rawLengthSu: head.sourceEndSu - sourceStartSu
-      })
-    })
-    this.retainedStartSourceSu = sourceStartSu
-  }
-
-  private sliceRecord(
-    record: PtySourceReplayRecord,
-    checkpointSourceEndSu: number
-  ): PtySourceReplayRecord {
-    if (checkpointSourceEndSu <= record.sourceStartSu) {
-      return record
-    }
-    const offset = checkpointSourceEndSu - record.sourceStartSu
-    return Object.freeze({
-      ...record,
-      spanId: `${record.spanId}:recovery:${checkpointSourceEndSu}`,
-      sourceStartSu: checkpointSourceEndSu,
-      displayStart: record.displayStart + offset,
-      data: record.data.slice(offset),
-      transform: Object.freeze({
-        ...record.transform,
-        rawLengthSu: record.sourceEndSu - checkpointSourceEndSu
-      })
-    })
-  }
-}
-
-function splitsSurrogatePair(data: string, offset: number): boolean {
-  const preceding = data.charCodeAt(offset - 1)
-  const following = data.charCodeAt(offset)
-  return (
-    offset > 0 &&
-    preceding >= 0xd800 &&
-    preceding <= 0xdbff &&
-    following >= 0xdc00 &&
-    following <= 0xdfff
-  )
-}
diff --git a/src/relay/relay-watcher-event-emitter.test.ts b/src/relay/relay-watcher-event-emitter.test.ts
index acf734acd71..0f0991e5c01 100644
--- a/src/relay/relay-watcher-event-emitter.test.ts
+++ b/src/relay/relay-watcher-event-emitter.test.ts
@@ -61,7 +61,7 @@ function createRecordingSink(highWaterMark?: number): {
       drainWaiters.push(callback)
       return () => {
         const index = drainWaiters.indexOf(callback)
-        if (index >= 0) {
+        if (index !== -1) {
           drainWaiters.splice(index, 1)
         }
       }
diff --git a/src/relay/relay.ts b/src/relay/relay.ts
index 18f3935a623..afd7ef9a02b 100644
--- a/src/relay/relay.ts
+++ b/src/relay/relay.ts
@@ -9,6 +9,7 @@
 // reconnects via `relay.js --connect`, bridging the new SSH channel's stdio to the existing relay's socket.
 
 import { createServer, createConnection, type Socket, type Server } from 'node:net'
+import { homedir } from 'node:os'
 import { join } from 'node:path'
 import {
   unlinkSync,
@@ -41,6 +42,9 @@ import { PortScanHandler } from './port-scan-handler'
 import { AgentExecHandler } from './agent-exec-handler'
 import { WorkspaceSessionHandler } from './workspace-session-handler'
 import { AiVaultHandler } from './ai-vault-handler'
+import { createRelayAiVaultService } from './ai-vault-service-factory'
+import { getRemoteHostPlatform } from '../main/ssh/ssh-remote-platform'
+import { parseUnameToRelayPlatform } from '../main/ssh/relay-protocol'
 import { endpointDirForRelaySocket, RelayAgentHookServer } from './agent-hook-server'
 import { PluginOverlayManager } from './plugin-overlay'
 import {
@@ -545,7 +549,7 @@ async function main(): Promise<void> {
     const marker = process.argv.indexOf('--orca-cli')
     await runOrcaCliMode(
       sockPath,
-      marker >= 0 ? process.argv.slice(marker + 1) : [],
+      marker !== -1 ? process.argv.slice(marker + 1) : [],
       endpointCredential
     )
     return
@@ -723,7 +727,17 @@ async function main(): Promise<void> {
   const _workspaceSessionHandler = new WorkspaceSessionHandler(dispatcher)
   void _workspaceSessionHandler
 
-  const _aiVaultHandler = new AiVaultHandler(dispatcher)
+  const aiVaultRelayPlatform = parseUnameToRelayPlatform(process.platform, process.arch)
+  const aiVaultHostPlatform = aiVaultRelayPlatform
+    ? getRemoteHostPlatform(aiVaultRelayPlatform)
+    : undefined
+  const aiVaultService = aiVaultHostPlatform
+    ? createRelayAiVaultService(homedir(), aiVaultHostPlatform)
+    : null
+  const _aiVaultHandler = new AiVaultHandler(dispatcher, {
+    hostPlatform: aiVaultHostPlatform,
+    service: aiVaultService ?? undefined
+  })
   void _aiVaultHandler
 
   // Why: relay-hosted plugin provisioning is a later phase. Register the
@@ -766,7 +780,7 @@ async function main(): Promise<void> {
   )
 
   // ── Agent-hook server ─────────────────────────────────────────────
-  // Why: loopback HTTP receiver so remote-PTY agent CLIs post hook events locally, forwarded to Orca as agent.hook notifications. See docs/design/agent-status-over-ssh.md §2-§5.
+  // Why: loopback HTTP receiver so remote-PTY agent CLIs post hook events to a local port (they can't reach Orca's host); the relay forwards them as agent.hook notifications.
   const hookServer = new RelayAgentHookServer({
     // Why: scope endpoint.env/cmd by socket path so multiple relay daemons on one account can't overwrite each other's hook tokens.
     endpointDir: endpointDir ?? endpointDirForRelaySocket(sockPath),
@@ -856,7 +870,7 @@ async function main(): Promise<void> {
     return env
   })
 
-  // Why: evict pane status cache + overlay dirs on PTY exit so panes don't ghost after reconnect (§5 Path 3) or leak dirs.
+  // Why: evict pane status cache + overlay dirs on PTY exit, else the next reconnect replays a dead pane's last status (ghost row) and overlay dirs leak.
   ptyHandler.setExitListener(({ paneKey, id }) => {
     if (paneKey) {
       hookServer.clearPaneState(paneKey)
@@ -864,7 +878,7 @@ async function main(): Promise<void> {
     pluginOverlay.clearOverlay(paneKey ?? id)
   })
 
-  // Why: forward cached entries as notifications before returning so the response trails all replays, closing a reconnect race. See docs/design/agent-status-over-ssh.md §5 Path 3.
+  // Why: forward cached entries as notifications before returning, so the response trails every replay and Orca can't treat replay as done while frames are still in flight.
   dispatcher.onRequest(AGENT_HOOK_REQUEST_REPLAY_METHOD, async () => {
     const replayed = hookServer.replayCachedPayloadsForPanes()
     return { replayed }
@@ -873,7 +887,7 @@ async function main(): Promise<void> {
   // Why: relay-local installers collapse hundreds of SFTP request/response RTTs to one RPC.
   registerManagedHookInstaller(dispatcher)
 
-  // Why: plugin sources ship over the wire so an Orca update doesn't force a relay redeploy; cache them per spawn. See docs/design/agent-status-over-ssh.md §4.
+  // Why: plugin sources ship over the wire — the relay is versioned independently of Orca, so bundling them would make every agent-event change a relay redeploy.
   // Why: bound per-source size so a buggy/hostile Orca can't OOM the relay by pushing a giant string.
   dispatcher.onRequest(AGENT_HOOK_INSTALL_PLUGINS_METHOD, async (params) => {
     const opencode = params.opencodePluginSource
@@ -1285,7 +1299,12 @@ async function main(): Promise<void> {
     graceBranch = null
     void ptyHandler
       .dispose()
-      .then(() => {
+      .then(async () => {
+        await aiVaultService?.dispose().catch((error) => {
+          relayLogLine(
+            `[relay] AI Vault sidecar shutdown failed: ${error instanceof Error ? error.message : String(error)}`
+          )
+        })
         stopPoolWatch()
         stopPoolActiveWatch()
         dispatcher.dispose()
diff --git a/src/renderer/src/App.tsx b/src/renderer/src/App.tsx
index 7529436ca93..643b6497e5d 100644
--- a/src/renderer/src/App.tsx
+++ b/src/renderer/src/App.tsx
@@ -361,6 +361,9 @@ const AddProjectFromFolderDialog = lazy(
 )
 const ProjectAddedDialog = lazy(() => import('./components/sidebar/ProjectAddedDialog'))
 const DeleteWorktreeDialog = lazy(() => import('./components/sidebar/DeleteWorktreeDialog'))
+const PreservedBranchBatchReviewModal = lazy(
+  () => import('./components/sidebar/PreservedBranchBatchReviewModal')
+)
 const DictationController = lazy(() =>
   import('./components/dictation/DictationController').then((module) => ({
     default: module.DictationController
@@ -687,6 +690,7 @@ function App(): React.JSX.Element {
   const showSleepingWorkspaces = useAppStore((s) => s.showSleepingWorkspaces)
   const hideDefaultBranchWorkspace = useAppStore((s) => s.hideDefaultBranchWorkspace)
   const hideAutomationGeneratedWorkspaces = useAppStore((s) => s.hideAutomationGeneratedWorkspaces)
+  const hideWorkspacesFromOtherDevices = useAppStore((s) => s.hideWorkspacesFromOtherDevices)
   const hideCliCreatedWorkspaces = useAppStore((s) => s.hideCliCreatedWorkspaces)
   const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces)
   const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace)
@@ -742,14 +746,7 @@ function App(): React.JSX.Element {
   const featureTipsSuppressedByOnboardingThisSessionRef = useRef(false)
   const unmountAddRepoDialogTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
   const [featureTipCliInstalled, setFeatureTipCliInstalled] = useState<boolean | null>(null)
-  const [onboardingSettingsDetour, setOnboardingSettingsDetour] = useState(false)
   const shouldRenderOnboarding = onboarding !== null && shouldShowOnboarding(onboarding)
-  const onboardingSettingsDetourActive =
-    onboardingSettingsDetour && activeView === 'settings' && shouldRenderOnboarding
-  if (onboardingSettingsDetour && !onboardingSettingsDetourActive) {
-    // Why: the detour is valid only while Settings is onscreen; clear it during render so onboarding resumes without an extra Effect pass.
-    setOnboardingSettingsDetour(false)
-  }
 
   useEffect(() => {
     if (activeModal === 'add-repo') {
@@ -872,10 +869,6 @@ function App(): React.JSX.Element {
     settings
   ])
 
-  const beginOnboardingSettingsDetour = useCallback(() => {
-    setOnboardingSettingsDetour(true)
-  }, [])
-
   // Why: useLayoutEffect fires before paint, so dispatching SYNC_FIT_PANES_EVENT reflows the terminal in the same frame as the width change — no wrongly-sized transient.
   useLayoutEffect(() => {
     window.dispatchEvent(new CustomEvent(SYNC_FIT_PANES_EVENT))
@@ -970,6 +963,10 @@ function App(): React.JSX.Element {
               // Why: disconnected SSH repos hydrate from local metadata; only runtime-owned repos use placeholders.
               parseExecutionHostId(getRepoExecutionHostId(repo))?.kind !== 'runtime'
           )
+          // Why: worktree refresh can spawn host Git; wait for main's shell-PATH generation fence first.
+          await timeRendererStartupStep('first-window-services-await', () =>
+            window.api.app.awaitFirstWindowStartupServices()
+          )
           await timeRendererStartupStep('fetch-hydration-worktrees', () =>
             mapWithConcurrency(hydrationRepos, WORKTREE_REFRESH_CONCURRENCY, (repo) =>
               actions.fetchWorktrees(repo.id, { executionHostId: getRepoExecutionHostId(repo) })
@@ -1102,10 +1099,7 @@ function App(): React.JSX.Element {
             logRendererStartupDiagnostic('ssh-reconnect-skipped', { connectionIds: 0 })
           }
 
-          // Why: main overlaps daemon/hook startup with hydration, but restored terminals need those services ready before they spawn/reconnect PTYs.
-          await timeRendererStartupStep('first-window-services-await', () =>
-            window.api.app.awaitFirstWindowStartupServices()
-          )
+          // first-window-services-await already fenced worktree hydration; terminal recovery reuses that ready state.
           await timeRendererStartupStep('recover-legacy-worker-terminals-pre-reconnect', () =>
             window.api.app.recoverLegacyWorkerTerminalsForRendererStartup()
           )
@@ -1419,6 +1413,7 @@ function App(): React.JSX.Element {
         hideAutomationGeneratedWorkspaces,
         hideCliCreatedWorkspaces,
         hideDetachedHeadWorkspaces,
+        hideWorkspacesFromOtherDevices,
         alwaysShowDefaultBranchWorkspace,
         showDotfilesByWorktree,
         filterRepoIds,
@@ -1453,6 +1448,7 @@ function App(): React.JSX.Element {
     hideAutomationGeneratedWorkspaces,
     hideCliCreatedWorkspaces,
     hideDetachedHeadWorkspaces,
+    hideWorkspacesFromOtherDevices,
     alwaysShowDefaultBranchWorkspace,
     showDotfilesByWorktree,
     filterRepoIds,
@@ -1480,18 +1476,17 @@ function App(): React.JSX.Element {
     } else if (settings.theme === 'light') {
       applyDocumentTheme('light')
       return undefined
-    } else {
-      // system
-      const mq = window.matchMedia('(prefers-color-scheme: dark)')
-      applyDocumentTheme('system')
-      const handler = (): void => {
-        applyDocumentTheme('system')
-        // System theme changes don't mutate the store, so mobile terminal colors need an explicit graph republish.
-        scheduleRuntimeGraphSync()
-      }
-      mq.addEventListener('change', handler)
-      return () => mq.removeEventListener('change', handler)
     }
+    // system
+    const mq = window.matchMedia('(prefers-color-scheme: dark)')
+    applyDocumentTheme('system')
+    const handler = (): void => {
+      applyDocumentTheme('system')
+      // System theme changes don't mutate the store, so mobile terminal colors need an explicit graph republish.
+      scheduleRuntimeGraphSync()
+    }
+    mq.addEventListener('change', handler)
+    return () => mq.removeEventListener('change', handler)
   }, [settings])
 
   useEffect(() => {
@@ -2347,7 +2342,8 @@ function App(): React.JSX.Element {
                       )
                     ) : null}
                     <div className="flex flex-col flex-1 min-w-0 min-h-0 overflow-hidden">
-                      {stackedSidebarOpen ? (
+                      {/* Why: automations owns its page header; the stacked titlebar would be an empty 36px stripe. */}
+                      {stackedSidebarOpen && activeView !== 'automations' ? (
                         <div className="titlebar">{titlebarMainStrip}</div>
                       ) : null}
                       <div className="relative flex flex-1 min-w-0 min-h-0 overflow-hidden">
@@ -2703,6 +2699,16 @@ function App(): React.JSX.Element {
                   <DeleteWorktreeDialog />
                 </RecoverableRenderErrorBoundary>
               ) : null}
+              {activeModal === 'preserved-branch-review' ? (
+                <RecoverableRenderErrorBoundary
+                  boundaryId="modal.preserved-branch-review"
+                  surface="modal"
+                  resetKey
+                  compact
+                >
+                  <PreservedBranchBatchReviewModal />
+                </RecoverableRenderErrorBoundary>
+              ) : null}
             </Suspense>
             {hasSshCredentialRequest ? (
               <Suspense fallback={null}>
@@ -2738,23 +2744,18 @@ function App(): React.JSX.Element {
             >
               <CrashReportDialog />
             </RecoverableRenderErrorBoundary>
-            {onboarding && shouldRenderOnboarding && !onboardingSettingsDetourActive ? (
+            {onboarding && shouldRenderOnboarding ? (
               <Suspense fallback={null}>
                 <RecoverableRenderErrorBoundary
                   boundaryId="modal.onboarding"
                   surface="modal"
-                  resetKey={onboardingSettingsDetourActive}
                   title={translate('auto.App.f02d37278a', 'Onboarding hit an error.')}
                   description={translate(
                     'auto.App.221a95ba38',
                     'Retry onboarding or close it and continue in the app.'
                   )}
                 >
-                  <OnboardingFlow
-                    onboarding={onboarding}
-                    onOnboardingChange={setOnboarding}
-                    onSettingsDetourStart={beginOnboardingSettingsDetour}
-                  />
+                  <OnboardingFlow onboarding={onboarding} onOnboardingChange={setOnboarding} />
                 </RecoverableRenderErrorBoundary>
               </Suspense>
             ) : null}
diff --git a/src/renderer/src/app-startup-routing.test.ts b/src/renderer/src/app-startup-routing.test.ts
index 80bb0037eac..9a64224f072 100644
--- a/src/renderer/src/app-startup-routing.test.ts
+++ b/src/renderer/src/app-startup-routing.test.ts
@@ -36,6 +36,10 @@ describe('renderer startup runtime routing', () => {
     const hydrationWorktreesIndex = source.indexOf(
       "timeRendererStartupStep('fetch-hydration-worktrees'"
     )
+    const servicesIndex = source.indexOf(
+      "timeRendererStartupStep('first-window-services-await'",
+      sessionIndex
+    )
     const fullWorktreesIndex = source.indexOf('await actions.fetchAllWorktrees()')
     const lineageIndex = startupBlock.indexOf('actions.fetchWorktreeLineage()')
 
@@ -53,7 +57,8 @@ describe('renderer startup runtime routing', () => {
     expect(localReposIndex).toBeLessThan(localGroupsIndex)
     expect(localGroupsIndex).toBeLessThan(localFoldersIndex)
     expect(localReposIndex).toBeLessThan(sessionIndex)
-    expect(sessionIndex).toBeLessThan(hydrationWorktreesIndex)
+    expect(sessionIndex).toBeLessThan(servicesIndex)
+    expect(servicesIndex).toBeLessThan(hydrationWorktreesIndex)
     const hydrationWorktreeBlock = source.slice(
       hydrationWorktreesIndex,
       source.indexOf('await keybindingsPromise')
diff --git a/src/renderer/src/assets/main.css b/src/renderer/src/assets/main.css
index 85d6a2c116a..23f335c3927 100644
--- a/src/renderer/src/assets/main.css
+++ b/src/renderer/src/assets/main.css
@@ -1027,11 +1027,6 @@ html.native-shell .app-layout {
   color: var(--muted-foreground);
 }
 
-.titlebar-profile-switcher {
-  -webkit-app-region: no-drag;
-  flex-shrink: 0;
-}
-
 .editor-header {
   display: flex;
   align-items: center;
@@ -1126,6 +1121,31 @@ html.native-shell .app-layout {
   overflow: hidden;
 }
 
+/* ── Jump palette (Cmd+J) ─────────────────────────────── */
+
+/* Why the data-slot qualifier: CommandItem also sets data-[selected=true]:bg-accent;
+   this selector must beat that utility so light-mode selection is actually visible. */
+[data-slot='command-item'].jump-palette-item[data-selected='true'] {
+  /* Why: flat --accent (#f5f5f5) on the palette surface (#fff) is nearly invisible
+     in light mode — the keyboard cursor has to read as a solid selected row.
+     Mix foreground into background and draw an inset ring; expose the surface
+     as a var so status-pip cutouts can match without hardcoding. */
+  --jump-palette-selection-surface: color-mix(in srgb, var(--foreground) 12%, var(--background));
+  background: var(--jump-palette-selection-surface);
+  border-color: transparent;
+  box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--foreground) 18%, transparent);
+  color: var(--foreground);
+}
+
+.dark [data-slot='command-item'].jump-palette-item[data-selected='true'] {
+  /* Why accent, not the light-mode mix: --accent (#404040) already reads clearly on
+     dark surfaces; a low-%% foreground mix was a visible step down from the old row. */
+  --jump-palette-selection-surface: var(--accent);
+  background: var(--jump-palette-selection-surface);
+  box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--foreground) 16%, transparent);
+  color: var(--accent-foreground);
+}
+
 /* ── Sidebar ─────────────────────────────────────────── */
 
 [data-file-explorer-row][data-selected='true'] {
@@ -2599,106 +2619,6 @@ html.native-shell .app-layout {
   animation: feature-wall-meta-pulse 1100ms ease-out 1;
 }
 
-/* Onboarding step 5: the compact "Take the tour" intro expands into the
-   full tour shell, so animate the browser snapshots to avoid a hard jump. */
-html.onboarding-tour-start-transition::view-transition-old(root),
-html.onboarding-tour-start-transition::view-transition-new(root) {
-  animation-duration: 760ms;
-  animation-timing-function: cubic-bezier(0.22, 1, 0.36, 1);
-  animation-fill-mode: both;
-  mix-blend-mode: normal;
-}
-
-html.onboarding-tour-start-transition::view-transition-old(root) {
-  animation-name: onboarding-tour-start-old;
-}
-
-html.onboarding-tour-start-transition::view-transition-new(root) {
-  animation-name: onboarding-tour-start-new;
-}
-
-@keyframes onboarding-tour-start-old {
-  0% {
-    opacity: 1;
-    transform: translateY(0) scale(1);
-  }
-  28% {
-    opacity: 0.9;
-    transform: translateY(-2px) scale(0.998);
-  }
-  42% {
-    opacity: 0;
-    transform: translateY(-12px) scale(0.99);
-  }
-  100% {
-    opacity: 0;
-    transform: translateY(-12px) scale(0.99);
-  }
-}
-
-@keyframes onboarding-tour-start-new {
-  0% {
-    opacity: 0;
-    transform: translateY(18px) scale(0.992);
-  }
-  34% {
-    opacity: 0;
-    transform: translateY(18px) scale(0.992);
-  }
-  100% {
-    opacity: 1;
-    transform: translateY(0) scale(1);
-  }
-}
-
-/* ── Feature tour nudge: cycling preview ─────────────────────────── */
-
-/* Why: the bottom-right nudge cycles through 4 silhouette frames
-   (Workspace → Orchestration → Tasks → Terminal). Each frame is visible for
-   1/4 of the cycle. Holding fade-out late (24%–25%) gives the user dwell
-   time on the resolved state before swapping. Uses CSS-driven timing rather
-   than React state so we stay cheap when the popup is mounted but idle. */
-:root {
-  --feature-tour-cycle: 16s;
-}
-
-.feature-tour-frame {
-  position: absolute;
-  inset: 0;
-  opacity: 0;
-  animation: feature-tour-frame-fade var(--feature-tour-cycle) linear infinite both;
-}
-.feature-tour-frame[data-frame='1'] {
-  animation-delay: 0s;
-}
-.feature-tour-frame[data-frame='2'] {
-  animation-delay: 4s;
-}
-.feature-tour-frame[data-frame='3'] {
-  animation-delay: 8s;
-}
-.feature-tour-frame[data-frame='4'] {
-  animation-delay: 12s;
-}
-
-@keyframes feature-tour-frame-fade {
-  0% {
-    opacity: 0;
-  }
-  1.5% {
-    opacity: 1;
-  }
-  24% {
-    opacity: 1;
-  }
-  25% {
-    opacity: 0;
-  }
-  100% {
-    opacity: 0;
-  }
-}
-
 .orca-contextual-tour-target-rings {
   border-radius: 9999px;
   pointer-events: none;
@@ -2736,520 +2656,6 @@ html.onboarding-tour-start-transition::view-transition-new(root) {
   }
 }
 
-.feature-tour-copy-slide {
-  position: absolute;
-  inset: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 4px;
-  opacity: 0;
-  animation: feature-tour-frame-fade var(--feature-tour-cycle) linear infinite both;
-}
-.feature-tour-copy-slide[data-frame='1'] {
-  animation-delay: 0s;
-}
-.feature-tour-copy-slide[data-frame='2'] {
-  animation-delay: 4s;
-}
-.feature-tour-copy-slide[data-frame='3'] {
-  animation-delay: 8s;
-}
-.feature-tour-copy-slide[data-frame='4'] {
-  animation-delay: 12s;
-}
-
-.feature-tour-dot {
-  width: 5px;
-  height: 5px;
-  border-radius: 9999px;
-  background: color-mix(in srgb, var(--foreground) 18%, transparent);
-  animation: feature-tour-dot-pulse var(--feature-tour-cycle) linear infinite;
-}
-.feature-tour-dot[data-frame='1'] {
-  animation-delay: 0s;
-}
-.feature-tour-dot[data-frame='2'] {
-  animation-delay: 4s;
-}
-.feature-tour-dot[data-frame='3'] {
-  animation-delay: 8s;
-}
-.feature-tour-dot[data-frame='4'] {
-  animation-delay: 12s;
-}
-@keyframes feature-tour-dot-pulse {
-  0%,
-  24% {
-    background: var(--primary);
-    transform: scale(1.05);
-  }
-  25%,
-  100% {
-    background: color-mix(in srgb, var(--foreground) 18%, transparent);
-    transform: scale(1);
-  }
-}
-
-/* Frame 1 — Workspace: agent-state dot pulses while a "fix login race"
-   workspace shows two agent rows working in parallel. */
-.feature-tour-ws-status {
-  animation: feature-tour-status-pulse 1.6s ease-in-out infinite;
-}
-@keyframes feature-tour-status-pulse {
-  0%,
-  100% {
-    opacity: 0.95;
-    transform: scale(1);
-  }
-  50% {
-    opacity: 0.55;
-    transform: scale(0.85);
-  }
-}
-
-/* Frame 2 — Orchestration: child cards flash as bubbles land along the
-   dashed paths fanning down from the coordinator. */
-/* Why: bubbles use percent-based left/top so they always travel from the
-   root card's right edge (34%) to the child card's left edge (64%),
-   regardless of preview width. The previous offset-path used hardcoded
-   pixels and drifted off the dashed lines once the preview resized. */
-.feature-tour-orch-bubble {
-  position: absolute;
-  left: 34%;
-  top: 50%;
-  width: 12px;
-  height: 12px;
-  margin-left: -6px;
-  margin-top: -6px;
-  border-radius: 3px;
-  background: var(--primary);
-  color: var(--primary-foreground);
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  opacity: 0;
-  z-index: 4;
-}
-.feature-tour-orch-bubble.top {
-  animation: feature-tour-orch-travel-top var(--feature-tour-cycle) cubic-bezier(0.4, 0, 0.2, 1)
-    infinite;
-  animation-delay: 4s;
-}
-.feature-tour-orch-bubble.mid {
-  animation: feature-tour-orch-travel-mid var(--feature-tour-cycle) cubic-bezier(0.4, 0, 0.2, 1)
-    infinite;
-  animation-delay: calc(4s + 0.2s);
-}
-.feature-tour-orch-bubble.bot {
-  animation: feature-tour-orch-travel-bot var(--feature-tour-cycle) cubic-bezier(0.4, 0, 0.2, 1)
-    infinite;
-  animation-delay: calc(4s + 0.4s);
-}
-@keyframes feature-tour-orch-travel-top {
-  0% {
-    left: 34%;
-    top: 50%;
-    opacity: 0;
-  }
-  2% {
-    opacity: 1;
-  }
-  3.5% {
-    left: 49%;
-    top: 50%;
-    opacity: 1;
-  }
-  6.5% {
-    left: 64%;
-    top: 18%;
-    opacity: 1;
-  }
-  7.5% {
-    left: 64%;
-    top: 18%;
-    opacity: 0;
-  }
-  25%,
-  100% {
-    left: 64%;
-    top: 18%;
-    opacity: 0;
-  }
-}
-@keyframes feature-tour-orch-travel-mid {
-  0% {
-    left: 34%;
-    top: 50%;
-    opacity: 0;
-  }
-  2% {
-    opacity: 1;
-  }
-  6.5% {
-    left: 64%;
-    top: 50%;
-    opacity: 1;
-  }
-  7.5% {
-    left: 64%;
-    top: 50%;
-    opacity: 0;
-  }
-  25%,
-  100% {
-    left: 64%;
-    top: 50%;
-    opacity: 0;
-  }
-}
-@keyframes feature-tour-orch-travel-bot {
-  0% {
-    left: 34%;
-    top: 50%;
-    opacity: 0;
-  }
-  2% {
-    opacity: 1;
-  }
-  3.5% {
-    left: 49%;
-    top: 50%;
-    opacity: 1;
-  }
-  6.5% {
-    left: 64%;
-    top: 82%;
-    opacity: 1;
-  }
-  7.5% {
-    left: 64%;
-    top: 82%;
-    opacity: 0;
-  }
-  25%,
-  100% {
-    left: 64%;
-    top: 82%;
-    opacity: 0;
-  }
-}
-
-.feature-tour-orch-child {
-  animation: feature-tour-orch-child-flash var(--feature-tour-cycle) linear infinite;
-}
-.feature-tour-orch-child.top {
-  animation-delay: 4s;
-}
-.feature-tour-orch-child.mid {
-  animation-delay: calc(4s + 0.2s);
-}
-.feature-tour-orch-child.bot {
-  animation-delay: calc(4s + 0.4s);
-}
-@keyframes feature-tour-orch-child-flash {
-  0%,
-  6% {
-    box-shadow: 0 0 0 0 transparent;
-    border-color: var(--border);
-  }
-  7% {
-    box-shadow: 0 0 0 2px color-mix(in srgb, var(--foreground) 12%, transparent);
-    border-color: color-mix(in srgb, var(--foreground) 38%, transparent);
-  }
-  9% {
-    box-shadow: 0 0 0 0 transparent;
-    border-color: var(--border);
-  }
-  25%,
-  100% {
-    box-shadow: 0 0 0 0 transparent;
-    border-color: var(--border);
-  }
-}
-
-/* Frame 3 — Tasks: cursor lands on the second row, the "Open" pill morphs
-   to a dark "Start workspace →" pill, then a workspace card slides in. */
-.feature-tour-tasks-cursor {
-  /* Why: anchored from the row's right edge so the cursor sits just past the
-     pill's right edge (12px row padding + ~6px past pill end) instead of
-     covering the label text. The arrow tip (top-left of the SVG) lands on the
-     dark pill's trailing edge with the body of the cursor extending right. */
-  position: absolute;
-  top: 50%;
-  right: 14px;
-  width: 14px;
-  height: 14px;
-  pointer-events: none;
-  z-index: 8;
-  transform: translate(120px, -30%);
-  opacity: 0;
-  animation: feature-tour-tasks-cursor var(--feature-tour-cycle) cubic-bezier(0.45, 0.05, 0.2, 1)
-    infinite;
-  animation-delay: 8s;
-}
-.feature-tour-tasks-cursor svg {
-  width: 14px;
-  height: 14px;
-  display: block;
-}
-@keyframes feature-tour-tasks-cursor {
-  0% {
-    transform: translate(160px, -10%);
-    opacity: 0;
-  }
-  2% {
-    opacity: 1;
-  }
-  5% {
-    transform: translate(60px, -30%);
-    opacity: 1;
-  }
-  8% {
-    transform: translate(0px, -30%);
-    opacity: 1;
-  }
-  9% {
-    transform: translate(0px, -10%);
-    opacity: 1;
-  }
-  10.5% {
-    transform: translate(0px, -30%);
-    opacity: 1;
-  }
-  23.5% {
-    transform: translate(0px, -30%);
-    opacity: 1;
-  }
-  24.5% {
-    opacity: 0;
-  }
-  25%,
-  100% {
-    transform: translate(0px, -30%);
-    opacity: 0;
-  }
-}
-
-.feature-tour-tasks-row {
-  animation: feature-tour-tasks-row-hover var(--feature-tour-cycle) linear infinite;
-  animation-delay: 8s;
-}
-@keyframes feature-tour-tasks-row-hover {
-  0%,
-  4% {
-    background: transparent;
-    box-shadow: none;
-  }
-  6% {
-    background: color-mix(in srgb, var(--foreground) 5%, transparent);
-    box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--foreground) 6%, transparent);
-  }
-  23.5% {
-    background: color-mix(in srgb, var(--foreground) 5%, transparent);
-    box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--foreground) 6%, transparent);
-  }
-  25%,
-  100% {
-    background: transparent;
-    box-shadow: none;
-  }
-}
-
-.feature-tour-tasks-pill {
-  animation: feature-tour-tasks-pill-morph var(--feature-tour-cycle) linear infinite;
-  animation-delay: 8s;
-}
-@keyframes feature-tour-tasks-pill-morph {
-  0%,
-  6% {
-    width: 28px;
-    background: rgb(34 197 94 / 0.14);
-    border-color: rgb(34 197 94 / 0.3);
-    box-shadow: none;
-  }
-  8% {
-    width: 78px;
-    background: var(--primary);
-    border-color: var(--primary);
-    box-shadow: 0 1px 2px rgb(0 0 0 / 0.18);
-  }
-  23.5% {
-    width: 78px;
-    background: var(--primary);
-    border-color: var(--primary);
-    box-shadow: 0 1px 2px rgb(0 0 0 / 0.18);
-  }
-  25%,
-  100% {
-    width: 28px;
-    background: rgb(34 197 94 / 0.14);
-    border-color: rgb(34 197 94 / 0.3);
-    box-shadow: none;
-  }
-}
-
-.feature-tour-tasks-pill-label {
-  opacity: 0;
-  animation: feature-tour-tasks-pill-label var(--feature-tour-cycle) linear infinite;
-  animation-delay: 8s;
-}
-@keyframes feature-tour-tasks-pill-label {
-  0%,
-  7% {
-    opacity: 0;
-  }
-  9% {
-    opacity: 1;
-  }
-  23.5% {
-    opacity: 1;
-  }
-  24.5% {
-    opacity: 0;
-  }
-  25%,
-  100% {
-    opacity: 0;
-  }
-}
-
-/* Click ring fires when the cursor "clicks" the morphed pill on the tasks
-   row. Positioned to overlay the right-side pill of the second task. */
-.feature-tour-tasks-click-ring {
-  /* Why: ring is centered on the cursor tip (right=28 from row's right edge)
-     so the click feedback lands where the cursor is, on the arrow icon — not
-     centered on the pill, which would visually disconnect from the cursor. */
-  position: absolute;
-  top: 50%;
-  right: 14px;
-  width: 28px;
-  height: 28px;
-  margin-top: -14px;
-  border-radius: 9999px;
-  border: 1.5px solid color-mix(in srgb, var(--foreground) 55%, transparent);
-  opacity: 0;
-  z-index: 7;
-  pointer-events: none;
-  animation: feature-tour-tasks-click-ring var(--feature-tour-cycle) linear infinite;
-  animation-delay: 8s;
-}
-@keyframes feature-tour-tasks-click-ring {
-  0%,
-  7% {
-    opacity: 0;
-    transform: scale(0.4);
-  }
-  8% {
-    opacity: 0.85;
-    transform: scale(0.6);
-  }
-  10% {
-    opacity: 0;
-    transform: scale(1.4);
-  }
-  25%,
-  100% {
-    opacity: 0;
-    transform: scale(1.4);
-  }
-}
-
-/* Newly-created workspace card slides in beneath the task row once the
-   user clicks "Start workspace" — sells the "task → workspace" jump. */
-.feature-tour-tasks-workspace {
-  opacity: 0;
-  transform: translateY(-6px);
-  animation: feature-tour-tasks-workspace var(--feature-tour-cycle) linear infinite;
-  animation-delay: 8s;
-}
-@keyframes feature-tour-tasks-workspace {
-  0%,
-  10% {
-    opacity: 0;
-    transform: translateY(-6px);
-  }
-  12% {
-    opacity: 1;
-    transform: translateY(0);
-  }
-  23.5% {
-    opacity: 1;
-    transform: translateY(0);
-  }
-  25%,
-  100% {
-    opacity: 0;
-    transform: translateY(-6px);
-  }
-}
-
-/* Frame 4 — Terminal: command stays anchored while the split panes stream
-   Playwright and Claude activity. */
-.feature-tour-terminal-line {
-  width: 23ch;
-}
-
-.feature-tour-terminal-output {
-  opacity: 0;
-  transform: translateY(2px);
-  animation: feature-tour-terminal-output var(--feature-tour-cycle) linear infinite;
-  animation-delay: 12s;
-}
-.feature-tour-terminal-output[data-line='1'] {
-  animation-delay: calc(12s + 0.05s);
-}
-.feature-tour-terminal-output[data-line='2'] {
-  animation-delay: calc(12s + 0.25s);
-}
-.feature-tour-terminal-output[data-line='3'] {
-  animation-delay: calc(12s + 0.45s);
-}
-@keyframes feature-tour-terminal-output {
-  0%,
-  10% {
-    opacity: 0;
-    transform: translateY(2px);
-  }
-  12% {
-    opacity: 1;
-    transform: translateY(0);
-  }
-  23.5% {
-    opacity: 1;
-    transform: translateY(0);
-  }
-  25%,
-  100% {
-    opacity: 0;
-    transform: translateY(2px);
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .feature-tour-frame,
-  .feature-tour-copy-slide,
-  .feature-tour-dot,
-  .feature-tour-ws-status,
-  .feature-tour-orch-bubble,
-  .feature-tour-orch-child,
-  .feature-tour-tasks-cursor,
-  .feature-tour-tasks-row,
-  .feature-tour-tasks-pill,
-  .feature-tour-tasks-pill-label,
-  .feature-tour-tasks-click-ring,
-  .feature-tour-tasks-workspace,
-  .feature-tour-terminal-output {
-    animation: none !important;
-  }
-  .feature-tour-frame[data-frame='1'],
-  .feature-tour-copy-slide[data-frame='1'] {
-    opacity: 1;
-  }
-  .feature-tour-dot[data-frame='1'] {
-    background: var(--primary);
-  }
-}
-
 /* ── Diff comment decorations ────────────────────────────────────── */
 
 /* Why: the "+" button is appended into Monaco's editor DOM node by
diff --git a/src/renderer/src/components/AgentWorkingSpinner.test.tsx b/src/renderer/src/components/AgentWorkingSpinner.test.tsx
index 25c04f39783..f887dab132c 100644
--- a/src/renderer/src/components/AgentWorkingSpinner.test.tsx
+++ b/src/renderer/src/components/AgentWorkingSpinner.test.tsx
@@ -50,7 +50,99 @@ describe('AgentWorkingSpinner', () => {
     }
   })
 
-  it('anchors mount and restart animations to the shared document epoch', async () => {
+  // Why: animationstart fires on the first start and on every restart (class
+  // re-add, display:none reveal), so it alone keeps every ring phase-locked.
+  // A negative animation-delay cannot — it is static, so a restart replays the
+  // stale mount-time offset and the rings fan out across steps.
+  it('anchors every animation start to the shared document epoch', async () => {
+    const animation = {
+      animationName: 'agent-spinner-rotate',
+      startTime: 321
+    } as unknown as Animation
+    const getAnimations = vi.fn(() => [animation])
+    const originalGetAnimations = Object.getOwnPropertyDescriptor(
+      HTMLElement.prototype,
+      'getAnimations'
+    )
+    Object.defineProperty(HTMLElement.prototype, 'getAnimations', {
+      configurable: true,
+      value: getAnimations
+    })
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+    const fireAnimationStart = async (): Promise<void> => {
+      const event = new Event('animationstart', { bubbles: true })
+      Object.defineProperty(event, 'animationName', { value: 'agent-spinner-rotate' })
+      await act(async () => {
+        container.querySelector('[data-agent-spinner]')!.dispatchEvent(event)
+      })
+    }
+
+    try {
+      await act(async () => {
+        root.render(<AgentWorkingSpinner />)
+      })
+      // Why: mount must not query animations — that forces a synchronous style
+      // recalc per ring for a phase the first animationstart sets anyway.
+      expect(getAnimations).not.toHaveBeenCalled()
+
+      await fireAnimationStart()
+      expect(animation.startTime).toBe(0)
+
+      animation.startTime = 654
+      await fireAnimationStart()
+      expect(animation.startTime).toBe(0)
+      expect(getAnimations).toHaveBeenCalledTimes(2)
+    } finally {
+      act(() => root.unmount())
+      container.remove()
+      if (originalGetAnimations === undefined) {
+        Reflect.deleteProperty(HTMLElement.prototype, 'getAnimations')
+      } else {
+        Object.defineProperty(HTMLElement.prototype, 'getAnimations', originalGetAnimations)
+      }
+    }
+  })
+
+  // Why: reduced motion resolves the rule to `animation: none`, so no animation
+  // exists to start and none to anchor. Pins that dropping the ref-time anchor
+  // adds no exposure here — both paths were already no-ops.
+  it('anchors nothing when reduced motion leaves no animation to start', async () => {
+    const getAnimations = vi.fn(() => [] as Animation[])
+    const originalGetAnimations = Object.getOwnPropertyDescriptor(
+      HTMLElement.prototype,
+      'getAnimations'
+    )
+    Object.defineProperty(HTMLElement.prototype, 'getAnimations', {
+      configurable: true,
+      value: getAnimations
+    })
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+
+    try {
+      await act(async () => {
+        root.render(<AgentWorkingSpinner />)
+      })
+      const el = container.querySelector('[data-agent-spinner]')
+
+      expect(el).not.toBeNull()
+      expect(getAnimations).not.toHaveBeenCalled()
+      expect(el!.className).toContain('motion-reduce:border-t-yellow-500')
+    } finally {
+      act(() => root.unmount())
+      container.remove()
+      if (originalGetAnimations === undefined) {
+        Reflect.deleteProperty(HTMLElement.prototype, 'getAnimations')
+      } else {
+        Object.defineProperty(HTMLElement.prototype, 'getAnimations', originalGetAnimations)
+      }
+    }
+  })
+
+  it('ignores animation starts from other animations on the same element', async () => {
     const animation = {
       animationName: 'agent-spinner-rotate',
       startTime: 321
@@ -72,16 +164,14 @@ describe('AgentWorkingSpinner', () => {
       await act(async () => {
         root.render(<AgentWorkingSpinner />)
       })
-      expect(animation.startTime).toBe(0)
-
-      animation.startTime = 654
-      const restart = new Event('animationstart', { bubbles: true })
-      Object.defineProperty(restart, 'animationName', { value: 'agent-spinner-rotate' })
+      const unrelated = new Event('animationstart', { bubbles: true })
+      Object.defineProperty(unrelated, 'animationName', { value: 'compact-agent-expansion-reveal' })
       await act(async () => {
-        container.querySelector('[data-agent-spinner]')!.dispatchEvent(restart)
+        container.querySelector('[data-agent-spinner]')!.dispatchEvent(unrelated)
       })
-      expect(animation.startTime).toBe(0)
-      expect(getAnimations).toHaveBeenCalledTimes(2)
+
+      expect(getAnimations).not.toHaveBeenCalled()
+      expect(animation.startTime).toBe(321)
     } finally {
       act(() => root.unmount())
       container.remove()
diff --git a/src/renderer/src/components/AgentWorkingSpinner.tsx b/src/renderer/src/components/AgentWorkingSpinner.tsx
index 9b20a862b09..7d2ab0a0b5a 100644
--- a/src/renderer/src/components/AgentWorkingSpinner.tsx
+++ b/src/renderer/src/components/AgentWorkingSpinner.tsx
@@ -3,8 +3,10 @@ import { cn } from '@/lib/utils'
 
 const SPINNER_ANIMATION_NAME = 'agent-spinner-rotate'
 
-// Why: CSS assigns per-element start times after refs run; anchoring the Web
-// Animation timeline gives late mounts exact phase sync without recurring JS.
+// Why: anchoring the Web Animation timeline gives late mounts exact phase sync
+// without recurring JS. Driven only by animationstart — a ref-time call would
+// force a synchronous style recalc per mount for a phase animationstart fixes
+// one frame later anyway (measured: 24ms of blocking work per 200 mounts).
 function syncSpinnerPhase(el: HTMLSpanElement | null): void {
   if (el === null || typeof el.getAnimations !== 'function') {
     return
@@ -33,7 +35,6 @@ function handleSpinnerAnimationStart(event: React.AnimationEvent<HTMLSpanElement
 export function AgentWorkingSpinner({ className }: { className?: string }): React.JSX.Element {
   return (
     <span
-      ref={syncSpinnerPhase}
       onAnimationStart={handleSpinnerAnimationStart}
       data-agent-spinner=""
       className={cn(
diff --git a/src/renderer/src/components/BrowserCookieImportDisclosure.tsx b/src/renderer/src/components/BrowserCookieImportDisclosure.tsx
new file mode 100644
index 00000000000..9e7c203675d
--- /dev/null
+++ b/src/renderer/src/components/BrowserCookieImportDisclosure.tsx
@@ -0,0 +1,28 @@
+import { Info } from 'lucide-react'
+import { translate } from '@/i18n/i18n'
+import { DropdownMenuLabel, DropdownMenuSeparator } from '@/components/ui/dropdown-menu'
+
+export function BrowserCookieImportDisclosure(): React.JSX.Element {
+  return (
+    <>
+      <DropdownMenuSeparator />
+      <DropdownMenuLabel className="flex max-w-64 items-start gap-2 whitespace-normal py-2 font-normal">
+        <Info aria-hidden className="mt-0.5 size-3.5 shrink-0" />
+        <span className="min-w-0">
+          <span className="block font-medium leading-4 text-foreground">
+            {translate(
+              'auto.components.BrowserCookieImportDisclosure.title',
+              "Google logins aren't imported"
+            )}
+          </span>
+          <span className="block leading-4 text-muted-foreground">
+            {translate(
+              'auto.components.BrowserCookieImportDisclosure.description',
+              'Sign in to Google directly in Orca.'
+            )}
+          </span>
+        </span>
+      </DropdownMenuLabel>
+    </>
+  )
+}
diff --git a/src/renderer/src/components/GitHubItemDialog.tsx b/src/renderer/src/components/GitHubItemDialog.tsx
index 0e50c3bbc50..5f73fb31bea 100644
--- a/src/renderer/src/components/GitHubItemDialog.tsx
+++ b/src/renderer/src/components/GitHubItemDialog.tsx
@@ -93,10 +93,12 @@ import {
 } from '@/components/editor/large-diff-section-content'
 import { CHECK_COLOR, CHECK_ICON } from '@/components/right-sidebar/checks-panel-content'
 import {
+  beginGitHubChecksTabDetails,
   createGitHubChecksTabState,
+  resetGitHubChecksTabForSource,
   resolveGitHubChecksTabState,
+  settleGitHubChecksTabDetails,
   toggleGitHubChecksTabExpandedKey,
-  updateGitHubChecksTabDetails,
   updateGitHubChecksTabLocalChecks,
   type CheckDetailsLoadState
 } from '@/components/github-checks-tab-state'
@@ -113,10 +115,12 @@ import {
 import {
   filterPRCommentsByAudience,
   getPRCommentAudienceCounts,
-  getPRCommentAudienceEmptyLabel,
-  getPrCommentAudienceFilters,
   type PRCommentAudienceFilter
-} from '@/lib/pr-comment-audience'
+} from '../../../shared/pr-comment-audience'
+import {
+  getPRCommentAudienceEmptyLabel,
+  getPrCommentAudienceFilters
+} from '@/lib/pr-comment-audience-labels'
 import { usePRBotAuthorOverrides } from '@/lib/pr-bot-author-overrides'
 import {
   getPRCommentGroupCount,
@@ -124,11 +128,13 @@ import {
   getPRCommentGroupRoot,
   groupPRComments,
   isResolvedPRCommentGroup,
+  type PRCommentGroup
+} from '../../../shared/pr-comment-groups'
+import {
   PR_COMMENT_OPEN_AUTHOR_CLASS,
   PR_COMMENT_RESOLVED_AUTHOR_CLASS,
-  PR_COMMENT_RESOLVED_CONTAINER_CLASS,
-  type PRCommentGroup
-} from '@/lib/pr-comment-groups'
+  PR_COMMENT_RESOLVED_CONTAINER_CLASS
+} from '@/lib/pr-comment-resolution-classes'
 import {
   getCommentReplyTargetCandidates,
   resolveCommentReplyTarget
@@ -141,6 +147,7 @@ import { buildPRCommentConversationReplyBody } from '@/components/right-sidebar/
 import { useAppStore } from '@/store'
 import { useAllWorktrees } from '@/store/selectors'
 import { callRuntimeRpc, getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
+import { withGitHubCheckDetailsTimeout } from '@/runtime/github-check-details-timeout'
 import { useRepoLabels, useRepoAssignees, useImmediateMutation } from '@/hooks/useIssueMetadata'
 import { useRepoLabelsBySlug, useRepoAssigneesBySlug } from '@/hooks/useGitHubSlugMetadata'
 import { GitHubMarkdownComposer } from '@/components/github/GitHubMarkdownComposer'
@@ -1233,7 +1240,7 @@ if (typeof window !== 'undefined' && window.api?.gh?.onWorkItemMutated) {
     invalidateWorkItemDetailsCacheByMatch(payload)
   })
 }
-if (typeof import.meta !== 'undefined' && import.meta.hot) {
+if (import.meta !== undefined && import.meta.hot) {
   import.meta.hot.dispose(() => {
     workItemMutatedUnsub?.()
     workItemDetailsCacheEventUnsub?.()
@@ -3215,19 +3222,46 @@ function ChecksTab({
   variant?: 'compact' | 'page'
   onChecksUpdated: (checks: PRCheckDetail[]) => void
 }): React.JSX.Element {
-  const [refreshing, setRefreshing] = useState(false)
-  const [rerunning, setRerunning] = useState(false)
   const [fixingChecks, setFixingChecks] = useState(false)
-  const [checksState, setChecksState] = useState(() => createGitHubChecksTabState(checks))
   const mountedRef = useMountedRef()
-  const resolvedChecksState = resolveGitHubChecksTabState(checksState, checks)
+  const prRepo = useMemo(() => resolvePullRequestRepo(item), [item])
+  const nextCheckDetailsRequestIdRef = useRef(0)
+  const checkDetailsContextKey = [
+    sourceContext ? getTaskSourceCacheScope(sourceContext) : 'local',
+    repoId ?? item.repoId ?? '',
+    repoPath ?? '',
+    prRepo ? githubRepoIdentityKey(prRepo) : '',
+    item.id,
+    item.number,
+    headSha ?? ''
+  ].join('\0')
+  const [checksState, setChecksState] = useState(() =>
+    createGitHubChecksTabState(checks, checkDetailsContextKey)
+  )
+  const resolvedChecksState = resolveGitHubChecksTabState(
+    checksState,
+    checks,
+    checkDetailsContextKey
+  )
+  const committedChecksContextOwnerRef = useRef(resolvedChecksState.contextOwner)
+  const nextChecksRefreshRequestIdRef = useRef(0)
+  const activeChecksRefreshRequestIdRef = useRef<number | null>(null)
+  const [refreshingOwner, setRefreshingOwner] = useState<{
+    contextOwner: object
+    requestId: number
+  } | null>(null)
+  const refreshing = refreshingOwner?.contextOwner === resolvedChecksState.contextOwner
+  const [rerunningOwner, setRerunningOwner] = useState<object | null>(null)
+  const rerunning = rerunningOwner === resolvedChecksState.contextOwner
+  useLayoutEffect(() => {
+    committedChecksContextOwnerRef.current = resolvedChecksState.contextOwner
+  }, [resolvedChecksState.contextOwner])
   if (resolvedChecksState !== checksState) {
     // Why: a parent check refresh replaces the source list; reset local state before stale rows/details can paint.
     setChecksState(resolvedChecksState)
   }
   const { localChecks, expandedCheckKey, detailsByCheckKey } = resolvedChecksState
   const list = useMemo(() => localChecks ?? checks ?? [], [checks, localChecks])
-  const prRepo = useMemo(() => resolvePullRequestRepo(item), [item])
   const runtimeHost = getGitHubSourceRuntimeHost(sourceContext)
   const canUseChecksRepoContext = canUseGitHubRepoContext(repoPath, sourceContext)
   const sorted = sortChecksBySeverity(list)
@@ -3258,72 +3292,107 @@ function ChecksTab({
             : 'text-muted-foreground'
   const canFixBrokenChecks = Boolean((repoId ?? item.repoId) && failedChecks.length > 0)
 
-  const handleRefresh = useCallback(async (): Promise<PRCheckDetail[] | null> => {
-    if (!canUseChecksRepoContext) {
-      toast.error(
-        translate(
-          'auto.components.GitHubItemDialog.e7007aa1d8',
-          'Unable to refresh checks without a repository path.'
+  const handleRefresh = useCallback(
+    async (expectedContextOwner?: object): Promise<PRCheckDetail[] | null> => {
+      if (!canUseChecksRepoContext) {
+        toast.error(
+          translate(
+            'auto.components.GitHubItemDialog.e7007aa1d8',
+            'Unable to refresh checks without a repository path.'
+          )
         )
-      )
-      return null
-    }
-    setRefreshing(true)
-    try {
-      const nextChecks = (await (runtimeHost
-        ? callRuntimeRpc<PRCheckDetail[]>(
-            { kind: 'environment', environmentId: runtimeHost.environmentId },
-            'github.prChecks',
-            {
-              repo: getGitHubRuntimeRepoId(sourceContext, repoId ?? item.repoId),
+        return null
+      }
+      const refreshContextOwner = expectedContextOwner ?? committedChecksContextOwnerRef.current
+      if (committedChecksContextOwnerRef.current !== refreshContextOwner) {
+        return null
+      }
+      const refreshRequestId = ++nextChecksRefreshRequestIdRef.current
+      activeChecksRefreshRequestIdRef.current = refreshRequestId
+      setRefreshingOwner({ contextOwner: refreshContextOwner, requestId: refreshRequestId })
+      try {
+        const nextChecks = (await (runtimeHost
+          ? callRuntimeRpc<PRCheckDetail[]>(
+              { kind: 'environment', environmentId: runtimeHost.environmentId },
+              'github.prChecks',
+              {
+                repo: getGitHubRuntimeRepoId(sourceContext, repoId ?? item.repoId),
+                prNumber: item.number,
+                headSha,
+                prRepo,
+                noCache: true
+              },
+              { timeoutMs: 30_000 }
+            )
+          : window.api.gh.prChecks({
+              repoPath: repoPath ?? '',
+              repoId: repoId ?? undefined,
+              sourceContext,
               prNumber: item.number,
               headSha,
               prRepo,
               noCache: true
-            },
-            { timeoutMs: 30_000 }
+            }))) as PRCheckDetail[]
+        if (
+          !mountedRef.current ||
+          committedChecksContextOwnerRef.current !== refreshContextOwner ||
+          activeChecksRefreshRequestIdRef.current !== refreshRequestId
+        ) {
+          return null
+        }
+        setChecksState((current) =>
+          current.contextOwner === refreshContextOwner
+            ? updateGitHubChecksTabLocalChecks(resetGitHubChecksTabForSource(current), nextChecks)
+            : current
+        )
+        onChecksUpdated(nextChecks)
+        return nextChecks
+      } catch (err) {
+        if (
+          mountedRef.current &&
+          committedChecksContextOwnerRef.current === refreshContextOwner &&
+          activeChecksRefreshRequestIdRef.current === refreshRequestId
+        ) {
+          toast.error(
+            err instanceof Error
+              ? err.message
+              : translate('auto.components.GitHubItemDialog.0bbdc673c1', 'Failed to refresh checks')
           )
-        : window.api.gh.prChecks({
-            repoPath: repoPath ?? '',
-            repoId: repoId ?? undefined,
-            sourceContext,
-            prNumber: item.number,
-            headSha,
-            prRepo,
-            noCache: true
-          }))) as PRCheckDetail[]
-      setChecksState((current) => updateGitHubChecksTabLocalChecks(current, nextChecks))
-      onChecksUpdated(nextChecks)
-      return nextChecks
-    } catch (err) {
-      toast.error(
-        err instanceof Error
-          ? err.message
-          : translate('auto.components.GitHubItemDialog.0bbdc673c1', 'Failed to refresh checks')
-      )
-      return null
-    } finally {
-      setRefreshing(false)
-    }
-  }, [
-    canUseChecksRepoContext,
-    headSha,
-    item.number,
-    item.repoId,
-    onChecksUpdated,
-    runtimeHost,
-    prRepo,
-    repoId,
-    repoPath,
-    sourceContext
-  ])
+        }
+        return null
+      } finally {
+        if (activeChecksRefreshRequestIdRef.current === refreshRequestId) {
+          activeChecksRefreshRequestIdRef.current = null
+        }
+        if (mountedRef.current) {
+          setRefreshingOwner((current) =>
+            current?.requestId === refreshRequestId ? null : current
+          )
+        }
+      }
+    },
+    [
+      canUseChecksRepoContext,
+      headSha,
+      item.number,
+      item.repoId,
+      mountedRef,
+      onChecksUpdated,
+      runtimeHost,
+      prRepo,
+      repoId,
+      repoPath,
+      sourceContext
+    ]
+  )
 
   const handleRerun = useCallback(
     async (failedOnly: boolean): Promise<void> => {
       if (!canUseChecksRepoContext || rerunning) {
         return
       }
-      setRerunning(true)
+      const rerunContextOwner = committedChecksContextOwnerRef.current
+      setRerunningOwner(rerunContextOwner)
       try {
         const result = runtimeHost
           ? await callRuntimeRpc<Awaited<ReturnType<typeof window.api.gh.rerunPRChecks>>>(
@@ -3347,6 +3416,9 @@ function ChecksTab({
               failedOnly,
               prRepo
             })
+        if (!mountedRef.current || committedChecksContextOwnerRef.current !== rerunContextOwner) {
+          return
+        }
         if (!result.ok) {
           toast.error(result.error)
           return
@@ -3356,15 +3428,19 @@ function ChecksTab({
             ? translate('auto.components.GitHubItemDialog.ddafe851e1', 'Check rerun requested')
             : translate('auto.components.GitHubItemDialog.e463ec935f', 'Check reruns requested')
         )
-        await handleRefresh()
+        await handleRefresh(rerunContextOwner)
       } catch (err) {
-        toast.error(
-          err instanceof Error
-            ? err.message
-            : translate('auto.components.GitHubItemDialog.9e7c221b8d', 'Failed to rerun checks')
-        )
+        if (mountedRef.current && committedChecksContextOwnerRef.current === rerunContextOwner) {
+          toast.error(
+            err instanceof Error
+              ? err.message
+              : translate('auto.components.GitHubItemDialog.9e7c221b8d', 'Failed to rerun checks')
+          )
+        }
       } finally {
-        setRerunning(false)
+        if (mountedRef.current) {
+          setRerunningOwner((current) => (current === rerunContextOwner ? null : current))
+        }
       }
     },
     [
@@ -3373,6 +3449,7 @@ function ChecksTab({
       headSha,
       item.number,
       item.repoId,
+      mountedRef,
       prRepo,
       runtimeHost,
       rerunning,
@@ -3441,77 +3518,74 @@ function ChecksTab({
     }
   }, [failedChecks.length, fixingChecks, item, list, repoId])
 
-  const handleToggleCheckDetails = useCallback(
-    (check: PRCheckDetail): void => {
-      const key = getCheckDetailsKey(check)
-      setChecksState((current) => toggleGitHubChecksTabExpandedKey(current, key))
-      if (
-        !canUseChecksRepoContext ||
-        detailsByCheckKey[key] ||
-        (!check.checkRunId && !check.workflowRunId && !check.url)
-      ) {
+  const requestCheckDetails = useCallback(
+    (check: PRCheckDetail, key: string): void => {
+      if (!canUseChecksRepoContext || (!check.checkRunId && !check.workflowRunId && !check.url)) {
         return
       }
-      setChecksState((current) =>
-        updateGitHubChecksTabDetails(current, key, {
-          loading: true,
-          details: null,
-          error: null
-        })
-      )
-      const detailsRequest = runtimeHost
-        ? callRuntimeRpc<Awaited<ReturnType<typeof window.api.gh.prCheckDetails>>>(
-            { kind: 'environment', environmentId: runtimeHost.environmentId },
-            'github.prCheckDetails',
-            {
-              repo: getGitHubRuntimeRepoId(sourceContext, repoId ?? item.repoId),
+      const requestId = ++nextCheckDetailsRequestIdRef.current
+      const commit = (next: Omit<CheckDetailsLoadState, 'requestId'>): void => {
+        if (!mountedRef.current) {
+          return
+        }
+        setChecksState((current) => settleGitHubChecksTabDetails(current, key, requestId, next))
+      }
+      setChecksState((current) => beginGitHubChecksTabDetails(current, key, requestId))
+      const detailsRequest = withGitHubCheckDetailsTimeout((signal) =>
+        runtimeHost
+          ? callRuntimeRpc<Awaited<ReturnType<typeof window.api.gh.prCheckDetails>>>(
+              { kind: 'environment', environmentId: runtimeHost.environmentId },
+              'github.prCheckDetails',
+              {
+                repo: getGitHubRuntimeRepoId(sourceContext, repoId ?? item.repoId),
+                checkRunId: check.checkRunId,
+                workflowRunId: check.workflowRunId,
+                checkName: check.name,
+                url: check.url,
+                prRepo
+              },
+              { timeoutMs: 30_000, signal }
+            )
+          : window.api.gh.prCheckDetails({
+              repoPath: repoPath ?? '',
+              repoId: repoId ?? undefined,
+              sourceContext,
               checkRunId: check.checkRunId,
               workflowRunId: check.workflowRunId,
               checkName: check.name,
               url: check.url,
               prRepo
-            },
-            { timeoutMs: 30_000 }
-          )
-        : window.api.gh.prCheckDetails({
-            repoPath: repoPath ?? '',
-            repoId: repoId ?? undefined,
-            sourceContext,
-            checkRunId: check.checkRunId,
-            workflowRunId: check.workflowRunId,
-            checkName: check.name,
-            url: check.url,
-            prRepo
-          })
+            })
+      )
       void detailsRequest
         .then((details) => {
-          if (!mountedRef.current) {
-            return
-          }
-          setChecksState((current) =>
-            updateGitHubChecksTabDetails(current, key, {
-              loading: false,
-              details,
-              error: details ? null : 'No inline details are available for this check.'
-            })
-          )
+          commit({
+            loading: false,
+            details,
+            error: details
+              ? null
+              : translate(
+                  'auto.components.GitHubItemDialog.e15a8b77ef',
+                  'No inline details are available for this check.'
+                )
+          })
         })
         .catch((err) => {
-          if (!mountedRef.current) {
-            return
-          }
-          setChecksState((current) =>
-            updateGitHubChecksTabDetails(current, key, {
-              loading: false,
-              details: null,
-              error: err instanceof Error ? err.message : 'Failed to load check details.'
-            })
-          )
+          commit({
+            loading: false,
+            details: null,
+            error:
+              err instanceof Error
+                ? err.message
+                : translate(
+                    'auto.components.GitHubItemDialog.e45324fbed',
+                    'Failed to load check details.'
+                  )
+          })
         })
     },
     [
       canUseChecksRepoContext,
-      detailsByCheckKey,
       item.repoId,
       mountedRef,
       runtimeHost,
@@ -3522,6 +3596,18 @@ function ChecksTab({
     ]
   )
 
+  const handleToggleCheckDetails = useCallback(
+    (check: PRCheckDetail): void => {
+      const key = getCheckDetailsKey(check)
+      setChecksState((current) => toggleGitHubChecksTabExpandedKey(current, key))
+      if (detailsByCheckKey[key]) {
+        return
+      }
+      requestCheckDetails(check, key)
+    },
+    [detailsByCheckKey, requestCheckDetails]
+  )
+
   const refreshAction = (
     <Tooltip>
       <TooltipTrigger asChild>
@@ -3715,7 +3801,7 @@ function ChecksTab({
 
     return (
       <div className="mx-2 mb-2 mt-1 min-w-0 rounded-md border border-border/50 bg-muted/20 px-3 py-2">
-        {state?.loading ? (
+        {state?.loading && !state.error ? (
           <div className="flex items-center gap-2 py-2 text-[12px] text-muted-foreground">
             <LoaderCircle className="size-3.5 animate-spin" />
             {translate('auto.components.GitHubItemDialog.934d87ab96', 'Loading check details…')}
@@ -3746,7 +3832,27 @@ function ChecksTab({
               )}
             </div>
 
-            {state?.error && <div className="text-[12px] text-muted-foreground">{state.error}</div>}
+            {state?.error && (
+              <div role="alert" className="flex min-w-0 items-center justify-between gap-2">
+                <span className="min-w-0 flex-1 break-words text-[12px] text-destructive">
+                  {state.error}
+                </span>
+                <Button
+                  type="button"
+                  variant="outline"
+                  size="xs"
+                  className="shrink-0"
+                  disabled={state.loading}
+                  aria-busy={state.loading}
+                  onClick={() => requestCheckDetails(check, getCheckDetailsKey(check))}
+                >
+                  <RefreshCw className={cn('size-3', state.loading && 'animate-spin')} />
+                  {state.loading
+                    ? translate('githubChecks.retrying', 'Retrying…')
+                    : translate('auto.components.GitHubItemDialog.dcb3c546fe', 'Retry')}
+                </Button>
+              </div>
+            )}
 
             {hasOutput && (
               <div className="min-w-0 rounded-md border border-border/40 bg-background/70 px-2.5 py-2">
diff --git a/src/renderer/src/components/Landing.tsx b/src/renderer/src/components/Landing.tsx
index 2d4b392b71b..bcf5c66ec1f 100644
--- a/src/renderer/src/components/Landing.tsx
+++ b/src/renderer/src/components/Landing.tsx
@@ -149,7 +149,7 @@ function PreflightBanner({
   repos
 }: {
   issues: PreflightIssue[]
-  repos: Repo[]
+  repos: readonly Repo[]
 }): React.JSX.Element | null {
   // Why: keying the seed on the current GitHub project set means adding a new
   // GitHub project (which changes the key) re-evaluates dismissals, so a lapsed
diff --git a/src/renderer/src/components/NewWorkspaceComposerCard.tsx b/src/renderer/src/components/NewWorkspaceComposerCard.tsx
index bc1691f293a..b9683150d17 100644
--- a/src/renderer/src/components/NewWorkspaceComposerCard.tsx
+++ b/src/renderer/src/components/NewWorkspaceComposerCard.tsx
@@ -84,7 +84,7 @@ type NewWorkspaceComposerCardProps = {
   nameInputRef?: React.RefObject<HTMLInputElement | null>
   quickAgent: TuiAgent | null
   onQuickAgentChange: (agent: TuiAgent | null) => void
-  eligibleRepos: RepoOption[]
+  eligibleRepos: readonly RepoOption[]
   repoId: string
   projectOptions?: NewWorkspaceProjectOption[]
   selectedProjectId?: string | null
@@ -98,7 +98,7 @@ type NewWorkspaceComposerCardProps = {
   selectedEphemeralVmRecipeId?: string | null
   onEphemeralVmRecipeChange?: (recipeId: string | null) => void
   ephemeralVmRecipeError?: string | null
-  repoBackedSearchRepos?: RepoOption[]
+  repoBackedSearchRepos?: readonly RepoOption[]
   repoBackedSourcesDisabled?: boolean
   allowSmartNameAddProject?: boolean
   smartNameRepoSwitchTarget?: 'project' | 'task-source'
diff --git a/src/renderer/src/components/PullRequestPage.tsx b/src/renderer/src/components/PullRequestPage.tsx
index 4b46d0148e5..aedc7bdd5e0 100644
--- a/src/renderer/src/components/PullRequestPage.tsx
+++ b/src/renderer/src/components/PullRequestPage.tsx
@@ -89,10 +89,12 @@ import {
 import { CHECK_COLOR, CHECK_ICON } from '@/components/right-sidebar/checks-panel-content'
 import { SourceControlAgentActionDialog } from '@/components/right-sidebar/SourceControlAgentActionDialog'
 import {
+  beginGitHubChecksTabDetails,
   createGitHubChecksTabState,
+  resetGitHubChecksTabForSource,
   resolveGitHubChecksTabState,
+  settleGitHubChecksTabDetails,
   toggleGitHubChecksTabExpandedKey,
-  updateGitHubChecksTabDetails,
   updateGitHubChecksTabLocalChecks,
   type CheckDetailsLoadState
 } from '@/components/github-checks-tab-state'
@@ -109,10 +111,12 @@ import {
 import {
   filterPRCommentsByAudience,
   getPRCommentAudienceCounts,
-  getPRCommentAudienceEmptyLabel,
-  getPrCommentAudienceFilters,
   type PRCommentAudienceFilter
-} from '@/lib/pr-comment-audience'
+} from '../../../shared/pr-comment-audience'
+import {
+  getPRCommentAudienceEmptyLabel,
+  getPrCommentAudienceFilters
+} from '@/lib/pr-comment-audience-labels'
 import { usePRBotAuthorOverrides } from '@/lib/pr-bot-author-overrides'
 import {
   getPRCommentGroupCount,
@@ -120,11 +124,13 @@ import {
   getPRCommentGroupRoot,
   groupPRComments,
   isResolvedPRCommentGroup,
+  type PRCommentGroup
+} from '../../../shared/pr-comment-groups'
+import {
   PR_COMMENT_OPEN_AUTHOR_CLASS,
   PR_COMMENT_RESOLVED_AUTHOR_CLASS,
-  PR_COMMENT_RESOLVED_CONTAINER_CLASS,
-  type PRCommentGroup
-} from '@/lib/pr-comment-groups'
+  PR_COMMENT_RESOLVED_CONTAINER_CLASS
+} from '@/lib/pr-comment-resolution-classes'
 import { resolveCommentReplyTarget } from '@/components/comment-reply-target-state'
 import {
   attachPRReviewReplyParent,
@@ -134,6 +140,7 @@ import { buildPRCommentConversationReplyBody } from '@/components/right-sidebar/
 import { useAppStore } from '@/store'
 import { useAllWorktrees } from '@/store/selectors'
 import { callRuntimeRpc, getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
+import { withGitHubCheckDetailsTimeout } from '@/runtime/github-check-details-timeout'
 import { useRepoLabels, useRepoAssignees, useImmediateMutation } from '@/hooks/useIssueMetadata'
 import { useRepoLabelsBySlug, useRepoAssigneesBySlug } from '@/hooks/useGitHubSlugMetadata'
 import {
@@ -1279,7 +1286,7 @@ if (typeof window !== 'undefined' && window.api?.gh?.onWorkItemMutated) {
     invalidateWorkItemDetailsCacheByMatch(payload)
   })
 }
-if (typeof import.meta !== 'undefined' && import.meta.hot) {
+if (import.meta !== undefined && import.meta.hot) {
   import.meta.hot.dispose(() => {
     workItemMutatedUnsub?.()
     workItemDetailsCacheEventUnsub?.()
@@ -3217,13 +3224,41 @@ function ChecksTab({
   const repo = useAppStore((s) =>
     targetRepoId ? (s.repos.find((candidate) => candidate.id === targetRepoId) ?? null) : null
   )
-  const [refreshing, setRefreshing] = useState(false)
-  const [rerunning, setRerunning] = useState(false)
   const [fixingChecks, setFixingChecks] = useState(false)
   const [fixChecksComposerPrompt, setFixChecksComposerPrompt] = useState<string | null>(null)
-  const [checksState, setChecksState] = useState(() => createGitHubChecksTabState(checks))
   const mountedRef = useMountedRef()
-  const resolvedChecksState = resolveGitHubChecksTabState(checksState, checks)
+  const prRepo = useMemo(() => resolvePullRequestRepo(item), [item])
+  const nextCheckDetailsRequestIdRef = useRef(0)
+  const checkDetailsContextKey = [
+    sourceContext ? getTaskSourceCacheScope(sourceContext) : 'local',
+    repoId ?? item.repoId ?? '',
+    repoPath ?? '',
+    prRepo ? githubRepoIdentityKey(prRepo) : '',
+    item.id,
+    item.number,
+    headSha ?? ''
+  ].join('\0')
+  const [checksState, setChecksState] = useState(() =>
+    createGitHubChecksTabState(checks, checkDetailsContextKey)
+  )
+  const resolvedChecksState = resolveGitHubChecksTabState(
+    checksState,
+    checks,
+    checkDetailsContextKey
+  )
+  const committedChecksContextOwnerRef = useRef(resolvedChecksState.contextOwner)
+  const nextChecksRefreshRequestIdRef = useRef(0)
+  const activeChecksRefreshRequestIdRef = useRef<number | null>(null)
+  const [refreshingOwner, setRefreshingOwner] = useState<{
+    contextOwner: object
+    requestId: number
+  } | null>(null)
+  const refreshing = refreshingOwner?.contextOwner === resolvedChecksState.contextOwner
+  const [rerunningOwner, setRerunningOwner] = useState<object | null>(null)
+  const rerunning = rerunningOwner === resolvedChecksState.contextOwner
+  useLayoutEffect(() => {
+    committedChecksContextOwnerRef.current = resolvedChecksState.contextOwner
+  }, [resolvedChecksState.contextOwner])
   if (resolvedChecksState !== checksState) {
     // Why: reconcile before paint when a parent check refresh replaces the source list, so stale rows/details never show.
     setChecksState(resolvedChecksState)
@@ -3317,7 +3352,6 @@ function ChecksTab({
     },
     [item, targetRepoId]
   )
-  const prRepo = useMemo(() => resolvePullRequestRepo(item), [item])
   const runtimeHost = getGitHubSourceRuntimeHost(sourceContext)
   const canUseChecksRepoContext = canUseGitHubRepoContext(repoPath, sourceContext)
   const sorted = sortChecksBySeverity(list)
@@ -3348,72 +3382,107 @@ function ChecksTab({
             : 'text-muted-foreground'
   const canFixBrokenChecks = Boolean((repoId ?? item.repoId) && failedChecks.length > 0)
 
-  const handleRefresh = useCallback(async (): Promise<PRCheckDetail[] | null> => {
-    if (!canUseChecksRepoContext) {
-      toast.error(
-        translate(
-          'auto.components.PullRequestPage.c057f2fcb0',
-          'Unable to refresh checks without a repository path.'
+  const handleRefresh = useCallback(
+    async (expectedContextOwner?: object): Promise<PRCheckDetail[] | null> => {
+      if (!canUseChecksRepoContext) {
+        toast.error(
+          translate(
+            'auto.components.PullRequestPage.c057f2fcb0',
+            'Unable to refresh checks without a repository path.'
+          )
         )
-      )
-      return null
-    }
-    setRefreshing(true)
-    try {
-      const nextChecks = (await (runtimeHost
-        ? callRuntimeRpc<PRCheckDetail[]>(
-            { kind: 'environment', environmentId: runtimeHost.environmentId },
-            'github.prChecks',
-            {
-              repo: getGitHubRuntimeRepoId(sourceContext, repoId ?? item.repoId),
+        return null
+      }
+      const refreshContextOwner = expectedContextOwner ?? committedChecksContextOwnerRef.current
+      if (committedChecksContextOwnerRef.current !== refreshContextOwner) {
+        return null
+      }
+      const refreshRequestId = ++nextChecksRefreshRequestIdRef.current
+      activeChecksRefreshRequestIdRef.current = refreshRequestId
+      setRefreshingOwner({ contextOwner: refreshContextOwner, requestId: refreshRequestId })
+      try {
+        const nextChecks = (await (runtimeHost
+          ? callRuntimeRpc<PRCheckDetail[]>(
+              { kind: 'environment', environmentId: runtimeHost.environmentId },
+              'github.prChecks',
+              {
+                repo: getGitHubRuntimeRepoId(sourceContext, repoId ?? item.repoId),
+                prNumber: item.number,
+                headSha,
+                prRepo,
+                noCache: true
+              },
+              { timeoutMs: 30_000 }
+            )
+          : window.api.gh.prChecks({
+              repoPath: repoPath ?? '',
+              repoId: repoId ?? undefined,
+              sourceContext,
               prNumber: item.number,
               headSha,
               prRepo,
               noCache: true
-            },
-            { timeoutMs: 30_000 }
+            }))) as PRCheckDetail[]
+        if (
+          !mountedRef.current ||
+          committedChecksContextOwnerRef.current !== refreshContextOwner ||
+          activeChecksRefreshRequestIdRef.current !== refreshRequestId
+        ) {
+          return null
+        }
+        setChecksState((current) =>
+          current.contextOwner === refreshContextOwner
+            ? updateGitHubChecksTabLocalChecks(resetGitHubChecksTabForSource(current), nextChecks)
+            : current
+        )
+        onChecksUpdated(nextChecks)
+        return nextChecks
+      } catch (err) {
+        if (
+          mountedRef.current &&
+          committedChecksContextOwnerRef.current === refreshContextOwner &&
+          activeChecksRefreshRequestIdRef.current === refreshRequestId
+        ) {
+          toast.error(
+            err instanceof Error
+              ? err.message
+              : translate('auto.components.PullRequestPage.246b2c6456', 'Failed to refresh checks')
           )
-        : window.api.gh.prChecks({
-            repoPath: repoPath ?? '',
-            repoId: repoId ?? undefined,
-            sourceContext,
-            prNumber: item.number,
-            headSha,
-            prRepo,
-            noCache: true
-          }))) as PRCheckDetail[]
-      setChecksState((current) => updateGitHubChecksTabLocalChecks(current, nextChecks))
-      onChecksUpdated(nextChecks)
-      return nextChecks
-    } catch (err) {
-      toast.error(
-        err instanceof Error
-          ? err.message
-          : translate('auto.components.PullRequestPage.246b2c6456', 'Failed to refresh checks')
-      )
-      return null
-    } finally {
-      setRefreshing(false)
-    }
-  }, [
-    canUseChecksRepoContext,
-    headSha,
-    item.number,
-    item.repoId,
-    onChecksUpdated,
-    runtimeHost,
-    prRepo,
-    repoId,
-    repoPath,
-    sourceContext
-  ])
+        }
+        return null
+      } finally {
+        if (activeChecksRefreshRequestIdRef.current === refreshRequestId) {
+          activeChecksRefreshRequestIdRef.current = null
+        }
+        if (mountedRef.current) {
+          setRefreshingOwner((current) =>
+            current?.requestId === refreshRequestId ? null : current
+          )
+        }
+      }
+    },
+    [
+      canUseChecksRepoContext,
+      headSha,
+      item.number,
+      item.repoId,
+      mountedRef,
+      onChecksUpdated,
+      runtimeHost,
+      prRepo,
+      repoId,
+      repoPath,
+      sourceContext
+    ]
+  )
 
   const handleRerun = useCallback(
     async (failedOnly: boolean): Promise<void> => {
       if (!canUseChecksRepoContext || rerunning) {
         return
       }
-      setRerunning(true)
+      const rerunContextOwner = committedChecksContextOwnerRef.current
+      setRerunningOwner(rerunContextOwner)
       try {
         const result = runtimeHost
           ? await callRuntimeRpc<Awaited<ReturnType<typeof window.api.gh.rerunPRChecks>>>(
@@ -3437,6 +3506,9 @@ function ChecksTab({
               failedOnly,
               prRepo
             })
+        if (!mountedRef.current || committedChecksContextOwnerRef.current !== rerunContextOwner) {
+          return
+        }
         if (!result.ok) {
           toast.error(result.error)
           return
@@ -3446,15 +3518,19 @@ function ChecksTab({
             ? translate('auto.components.PullRequestPage.5963a6a852', 'Check rerun requested')
             : translate('auto.components.PullRequestPage.18f2af42ac', 'Check reruns requested')
         )
-        await handleRefresh()
+        await handleRefresh(rerunContextOwner)
       } catch (err) {
-        toast.error(
-          err instanceof Error
-            ? err.message
-            : translate('auto.components.PullRequestPage.788a782bb0', 'Failed to rerun checks')
-        )
+        if (mountedRef.current && committedChecksContextOwnerRef.current === rerunContextOwner) {
+          toast.error(
+            err instanceof Error
+              ? err.message
+              : translate('auto.components.PullRequestPage.788a782bb0', 'Failed to rerun checks')
+          )
+        }
       } finally {
-        setRerunning(false)
+        if (mountedRef.current) {
+          setRerunningOwner((current) => (current === rerunContextOwner ? null : current))
+        }
       }
     },
     [
@@ -3463,6 +3539,7 @@ function ChecksTab({
       headSha,
       item.number,
       item.repoId,
+      mountedRef,
       prRepo,
       runtimeHost,
       rerunning,
@@ -3525,77 +3602,74 @@ function ChecksTab({
     }
   }, [failedChecks.length, fixingChecks, item, list, targetRepoId])
 
-  const handleToggleCheckDetails = useCallback(
-    (check: PRCheckDetail): void => {
-      const key = getCheckDetailsKey(check)
-      setChecksState((current) => toggleGitHubChecksTabExpandedKey(current, key))
-      if (
-        !canUseChecksRepoContext ||
-        detailsByCheckKey[key] ||
-        (!check.checkRunId && !check.workflowRunId && !check.url)
-      ) {
+  const requestCheckDetails = useCallback(
+    (check: PRCheckDetail, key: string): void => {
+      if (!canUseChecksRepoContext || (!check.checkRunId && !check.workflowRunId && !check.url)) {
         return
       }
-      setChecksState((current) =>
-        updateGitHubChecksTabDetails(current, key, {
-          loading: true,
-          details: null,
-          error: null
-        })
-      )
-      const detailsRequest = runtimeHost
-        ? callRuntimeRpc<Awaited<ReturnType<typeof window.api.gh.prCheckDetails>>>(
-            { kind: 'environment', environmentId: runtimeHost.environmentId },
-            'github.prCheckDetails',
-            {
-              repo: getGitHubRuntimeRepoId(sourceContext, repoId ?? item.repoId),
+      const requestId = ++nextCheckDetailsRequestIdRef.current
+      const commit = (next: Omit<CheckDetailsLoadState, 'requestId'>): void => {
+        if (!mountedRef.current) {
+          return
+        }
+        setChecksState((current) => settleGitHubChecksTabDetails(current, key, requestId, next))
+      }
+      setChecksState((current) => beginGitHubChecksTabDetails(current, key, requestId))
+      const detailsRequest = withGitHubCheckDetailsTimeout((signal) =>
+        runtimeHost
+          ? callRuntimeRpc<Awaited<ReturnType<typeof window.api.gh.prCheckDetails>>>(
+              { kind: 'environment', environmentId: runtimeHost.environmentId },
+              'github.prCheckDetails',
+              {
+                repo: getGitHubRuntimeRepoId(sourceContext, repoId ?? item.repoId),
+                checkRunId: check.checkRunId,
+                workflowRunId: check.workflowRunId,
+                checkName: check.name,
+                url: check.url,
+                prRepo
+              },
+              { timeoutMs: 30_000, signal }
+            )
+          : window.api.gh.prCheckDetails({
+              repoPath: repoPath ?? '',
+              repoId: repoId ?? undefined,
+              sourceContext,
               checkRunId: check.checkRunId,
               workflowRunId: check.workflowRunId,
               checkName: check.name,
               url: check.url,
               prRepo
-            },
-            { timeoutMs: 30_000 }
-          )
-        : window.api.gh.prCheckDetails({
-            repoPath: repoPath ?? '',
-            repoId: repoId ?? undefined,
-            sourceContext,
-            checkRunId: check.checkRunId,
-            workflowRunId: check.workflowRunId,
-            checkName: check.name,
-            url: check.url,
-            prRepo
-          })
+            })
+      )
       void detailsRequest
         .then((details) => {
-          if (!mountedRef.current) {
-            return
-          }
-          setChecksState((current) =>
-            updateGitHubChecksTabDetails(current, key, {
-              loading: false,
-              details,
-              error: details ? null : 'No inline details are available for this check.'
-            })
-          )
+          commit({
+            loading: false,
+            details,
+            error: details
+              ? null
+              : translate(
+                  'auto.components.PullRequestPage.6b1d5ee3e4',
+                  'No inline details are available for this check.'
+                )
+          })
         })
         .catch((err) => {
-          if (!mountedRef.current) {
-            return
-          }
-          setChecksState((current) =>
-            updateGitHubChecksTabDetails(current, key, {
-              loading: false,
-              details: null,
-              error: err instanceof Error ? err.message : 'Failed to load check details.'
-            })
-          )
+          commit({
+            loading: false,
+            details: null,
+            error:
+              err instanceof Error
+                ? err.message
+                : translate(
+                    'auto.components.PullRequestPage.e04c027d98',
+                    'Failed to load check details.'
+                  )
+          })
         })
     },
     [
       canUseChecksRepoContext,
-      detailsByCheckKey,
       item.repoId,
       mountedRef,
       runtimeHost,
@@ -3606,6 +3680,18 @@ function ChecksTab({
     ]
   )
 
+  const handleToggleCheckDetails = useCallback(
+    (check: PRCheckDetail): void => {
+      const key = getCheckDetailsKey(check)
+      setChecksState((current) => toggleGitHubChecksTabExpandedKey(current, key))
+      if (detailsByCheckKey[key]) {
+        return
+      }
+      requestCheckDetails(check, key)
+    },
+    [detailsByCheckKey, requestCheckDetails]
+  )
+
   const refreshAction = (
     <Tooltip>
       <TooltipTrigger asChild>
@@ -3799,7 +3885,7 @@ function ChecksTab({
 
     return (
       <div className="mx-2 mb-2 mt-1 min-w-0 rounded-md border border-border/50 bg-muted/20 px-3 py-2">
-        {state?.loading ? (
+        {state?.loading && !state.error ? (
           <div className="flex items-center gap-2 py-2 text-[12px] text-muted-foreground">
             <LoaderCircle className="size-3.5 animate-spin" />
             {translate('auto.components.PullRequestPage.d8e82b7f15', 'Loading check details…')}
@@ -3830,7 +3916,27 @@ function ChecksTab({
               )}
             </div>
 
-            {state?.error && <div className="text-[12px] text-muted-foreground">{state.error}</div>}
+            {state?.error && (
+              <div role="alert" className="flex min-w-0 items-start justify-between gap-2">
+                <div className="min-w-0 break-words text-[12px] text-destructive">
+                  {state.error}
+                </div>
+                <Button
+                  type="button"
+                  variant="outline"
+                  size="xs"
+                  className="shrink-0"
+                  disabled={state.loading}
+                  aria-busy={state.loading}
+                  onClick={() => requestCheckDetails(check, getCheckDetailsKey(check))}
+                >
+                  <RefreshCw className={cn('size-3', state.loading && 'animate-spin')} />
+                  {state.loading
+                    ? translate('githubChecks.retrying', 'Retrying…')
+                    : translate('auto.components.PullRequestPage.5df7c41d2a', 'Retry')}
+                </Button>
+              </div>
+            )}
 
             {hasOutput && (
               <div className="min-w-0 rounded-md border border-border/40 bg-background/70 px-2.5 py-2">
diff --git a/src/renderer/src/components/QuickOpen.mount-gating.test.tsx b/src/renderer/src/components/QuickOpen.mount-gating.test.tsx
new file mode 100644
index 00000000000..fa0c57dfcf8
--- /dev/null
+++ b/src/renderer/src/components/QuickOpen.mount-gating.test.tsx
@@ -0,0 +1,143 @@
+// @vitest-environment happy-dom
+
+import { act, type ReactNode } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useAppStore } from '@/store'
+import QuickOpen from './QuickOpen'
+
+const contentProbe = vi.hoisted(() => ({
+  enabled: vi.fn(),
+  renders: vi.fn(),
+  storeNotifications: vi.fn(),
+  subscriptions: vi.fn(),
+  unsubscriptions: vi.fn()
+}))
+
+vi.mock('@/components/quick-open-file-list', async () => {
+  const React = await import('react')
+  return {
+    useRuntimeFileListForWorktree: ({ enabled }: { enabled: boolean }) => {
+      contentProbe.enabled(enabled)
+      contentProbe.renders()
+      React.useEffect(() => {
+        contentProbe.subscriptions()
+        const unsubscribe = useAppStore.subscribe(() => contentProbe.storeNotifications())
+        return () => {
+          contentProbe.unsubscriptions()
+          unsubscribe()
+        }
+      }, [])
+      return { files: [], loading: false, loadError: null }
+    }
+  }
+})
+
+vi.mock('@/hooks/useModalReturnFocus', () => ({
+  useModalReturnFocus: () => ({ captureReturnFocus: vi.fn(), skipReturnFocus: vi.fn() })
+}))
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string) => fallback
+}))
+
+vi.mock('@/components/ui/command', () => {
+  return {
+    CommandDialog: ({ children, open }: { children: ReactNode; open?: boolean }) =>
+      open ? <div data-command-dialog="true">{children}</div> : null,
+    CommandInput: () => <input data-command-input="true" />,
+    CommandList: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+    CommandEmpty: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+    CommandItem: ({ children }: { children: ReactNode }) => <div>{children}</div>
+  }
+})
+
+const initialAppState = useAppStore.getInitialState()
+let testContainer: HTMLDivElement
+let testRoot: Root
+
+async function flushEffects(): Promise<void> {
+  await act(async () => {
+    await Promise.resolve()
+    await Promise.resolve()
+  })
+}
+
+function activeContentSubscriptions(): number {
+  return (
+    contentProbe.subscriptions.mock.calls.length - contentProbe.unsubscriptions.mock.calls.length
+  )
+}
+
+async function churnClosedStore(count: number): Promise<void> {
+  await act(async () => {
+    for (let index = 0; index < count; index += 1) {
+      useAppStore.setState({ activeWorktreeId: `remote-background-${index}` })
+    }
+  })
+}
+
+describe('QuickOpen mount gating', () => {
+  beforeEach(() => {
+    globalThis.IS_REACT_ACT_ENVIRONMENT = true
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    contentProbe.enabled.mockClear()
+    contentProbe.renders.mockClear()
+    contentProbe.storeNotifications.mockClear()
+    contentProbe.subscriptions.mockClear()
+    contentProbe.unsubscriptions.mockClear()
+    useAppStore.setState(initialAppState, true)
+    useAppStore.setState({ activeModal: 'quick-open', activeWorktreeId: null })
+    testContainer = document.createElement('div')
+    document.body.appendChild(testContainer)
+    testRoot = createRoot(testContainer)
+  })
+
+  afterEach(async () => {
+    await act(async () => testRoot.unmount())
+    document.body.replaceChildren()
+    useAppStore.setState(initialAppState, true)
+    vi.clearAllTimers()
+    vi.useRealTimers()
+  })
+
+  it('unmounts subscribed content after the close linger', async () => {
+    await act(async () => testRoot.render(<QuickOpen />))
+    await flushEffects()
+
+    expect(testContainer.querySelector('[data-command-dialog="true"]')).not.toBeNull()
+    expect(activeContentSubscriptions()).toBe(1)
+
+    await act(async () => useAppStore.setState({ activeModal: 'none' }))
+
+    expect(testContainer.querySelector('[data-command-dialog="true"]')).toBeNull()
+    expect(contentProbe.enabled).toHaveBeenLastCalledWith(false)
+    expect(activeContentSubscriptions()).toBe(1)
+
+    await act(async () => vi.advanceTimersByTimeAsync(299))
+    expect(activeContentSubscriptions()).toBe(1)
+
+    await act(async () => vi.advanceTimersByTimeAsync(1))
+    expect(activeContentSubscriptions()).toBe(0)
+
+    const rendersAfterUnmount = contentProbe.renders.mock.calls.length
+    const notificationsAfterUnmount = contentProbe.storeNotifications.mock.calls.length
+    await churnClosedStore(1_000)
+
+    expect(contentProbe.renders).toHaveBeenCalledTimes(rendersAfterUnmount)
+    expect(contentProbe.storeNotifications).toHaveBeenCalledTimes(notificationsAfterUnmount)
+  })
+
+  it('cancels the pending unmount when reopened during the linger', async () => {
+    await act(async () => testRoot.render(<QuickOpen />))
+    await flushEffects()
+
+    await act(async () => useAppStore.setState({ activeModal: 'none' }))
+    await act(async () => vi.advanceTimersByTimeAsync(299))
+    await act(async () => useAppStore.setState({ activeModal: 'quick-open' }))
+    await act(async () => vi.advanceTimersByTimeAsync(1_000))
+
+    expect(testContainer.querySelector('[data-command-dialog="true"]')).not.toBeNull()
+    expect(activeContentSubscriptions()).toBe(1)
+  })
+})
diff --git a/src/renderer/src/components/QuickOpen.tsx b/src/renderer/src/components/QuickOpen.tsx
index 05e2613ce0d..cb7c8847642 100644
--- a/src/renderer/src/components/QuickOpen.tsx
+++ b/src/renderer/src/components/QuickOpen.tsx
@@ -1,4 +1,4 @@
-import React, { useCallback, useDeferredValue, useMemo, useState } from 'react'
+import React, { useCallback, useDeferredValue, useEffect, useMemo, useState } from 'react'
 import { useAppStore } from '@/store'
 import { useActiveWorktree } from '@/store/selectors'
 import { detectLanguage } from '@/lib/language-detect'
@@ -21,6 +21,8 @@ import {
   QuickOpenInstallRgGuidance
 } from '@/components/quick-open-install-rg-guidance'
 
+const QUICK_OPEN_CLOSE_LINGER_MS = 300
+
 function FooterKey({ children }: { children: React.ReactNode }): React.JSX.Element {
   return (
     <span className="rounded-full border border-border/60 bg-muted/35 px-2 py-0.5 text-[10px] font-medium text-foreground/85">
@@ -31,6 +33,24 @@ function FooterKey({ children }: { children: React.ReactNode }): React.JSX.Eleme
 
 export default function QuickOpen(): React.JSX.Element | null {
   const visible = useAppStore((s) => s.activeModal === 'quick-open')
+  const [lingering, setLingering] = useState(visible)
+  useEffect(() => {
+    if (visible) {
+      setLingering(true)
+      return
+    }
+    // Why: keep scan cancellation and the dialog exit animation mounted before releasing remote file state.
+    const timer = window.setTimeout(() => setLingering(false), QUICK_OPEN_CLOSE_LINGER_MS)
+    return () => window.clearTimeout(timer)
+  }, [visible])
+
+  if (!visible && !lingering) {
+    return null
+  }
+  return <QuickOpenContent visible={visible} />
+}
+
+function QuickOpenContent({ visible }: { visible: boolean }): React.JSX.Element {
   const closeModal = useAppStore((s) => s.closeModal)
   const activeWorktreeId = useAppStore((s) => s.activeWorktreeId)
   const openFile = useAppStore((s) => s.openFile)
diff --git a/src/renderer/src/components/TaskPage.tsx b/src/renderer/src/components/TaskPage.tsx
index 520f2debbdd..29bc0bc4587 100644
--- a/src/renderer/src/components/TaskPage.tsx
+++ b/src/renderer/src/components/TaskPage.tsx
@@ -6960,7 +6960,7 @@ export default function TaskPage(): React.JSX.Element {
     const authorityPage = pages.findIndex((page) =>
       page?.some((item) => authorityItemKeys.has(taskPageGitHubItemKey(item.repoId, item.id)))
     )
-    const quietPage = authorityPage >= 0 ? authorityPage : currentPage
+    const quietPage = authorityPage !== -1 ? authorityPage : currentPage
     const visiblePage = currentPage > quietPage ? currentPage : undefined
     const pageItemKeys = (page: number): Set<string> =>
       new Set((pages[page] ?? []).map((item) => taskPageGitHubItemKey(item.repoId, item.id)))
diff --git a/src/renderer/src/components/Terminal.tsx b/src/renderer/src/components/Terminal.tsx
index dc39c3a0644..d555a92d22c 100644
--- a/src/renderer/src/components/Terminal.tsx
+++ b/src/renderer/src/components/Terminal.tsx
@@ -12,6 +12,7 @@ import {
 } from '@/constants/terminal'
 import { useAppStore } from '../store'
 import { folderWorkspaceKey } from '../../../shared/workspace-scope'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
 import { useAllWorktrees } from '../store/selectors'
 import { getConnectionId } from '../lib/connection-context'
 import { basename } from '../lib/path'
@@ -30,19 +31,14 @@ import {
   ORCA_EDITOR_REQUEST_FILE_CLOSE_EVENT,
   ORCA_EDITOR_SAVE_AND_CLOSE_EVENT,
   ORCA_EDITOR_REQUEST_CMD_SAVE_EVENT,
+  type EditorRequestCmdSaveDetail,
   type EditorRequestFileCloseDetail,
   requestEditorSaveQuiesce
 } from './editor/editor-autosave'
 import { isIntentionalAppRestartInProgress } from '@/lib/updater-beforeunload'
 import { preventUnloadAndScheduleShutdownCheckpointReset } from '@/lib/shutdown-checkpoint-guard'
 import EditorAutosaveController from './editor/EditorAutosaveController'
-import type {
-  Tab,
-  TabContentType,
-  TabGroupLayoutNode,
-  TerminalTab,
-  TuiAgent
-} from '../../../shared/types'
+import type { Tab, TabGroupLayoutNode, TerminalTab, TuiAgent } from '../../../shared/types'
 import { hasFeatureInteraction } from '../../../shared/feature-interactions'
 import BrowserPane from './browser-pane/BrowserPane'
 import { RetainedBrowserPaneOverlayLayer } from './browser-pane/BrowserPaneOverlayLayer'
@@ -185,20 +181,19 @@ import {
   combineTerminalWorktreeParkIds,
   useManualTerminalWorktreeParking
 } from './terminal-pane/use-manual-terminal-worktree-parking'
+import { EDITOR_TAB_CONTENT_TYPES, getEditorCmdSaveFileId } from './editor/editor-cmd-save-target'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 const EditorPanel = lazy(() => import('./editor/EditorPanel'))
 
 // Why: gate handler runs after a dialog advances so a stray carry-over click can't act on the next dialog; ~200ms absorbs a physical double-click while staying responsive.
 const CLOSE_DIALOG_DEBOUNCE_MS = 200
-const EDITOR_TAB_CONTENT_TYPES = new Set<TabContentType>([
-  'editor',
-  'diff',
-  'conflict-review',
-  'check-details'
-])
-
 type TerminalStoreSnapshot = ReturnType<typeof useAppStore.getState>
 
+function showClientCreationActionError(error: unknown): void {
+  toast.error(error instanceof Error ? error.message : String(error))
+}
+
 function haveSameIdSet(left: ReadonlySet<string>, right: ReadonlySet<string>): boolean {
   if (left.size !== right.size) {
     return false
@@ -1608,7 +1603,7 @@ function Terminal(): React.JSX.Element | null {
     void openMobileEmulatorTab(activeWorktreeId, {
       placement: 'rightSplit',
       targetGroupId: targetGroupId ?? undefined
-    })
+    }).catch(showClientCreationActionError)
   }, [activeWorktreeId])
 
   const handleNewBrowserTab = useCallback(() => {
@@ -1619,22 +1614,31 @@ function Terminal(): React.JSX.Element | null {
       useAppStore.getState().activeGroupIdByWorktree[activeWorktreeId] ??
       useAppStore.getState().groupsByWorktree[activeWorktreeId]?.[0]?.id
     if (targetGroupId) {
-      void openNewBrowserTabInActiveWorkspace(targetGroupId)
+      void openNewBrowserTabInActiveWorkspace(targetGroupId).catch(showClientCreationActionError)
       return
     }
-    const defaultUrl = useAppStore.getState().browserDefaultUrl ?? 'about:blank'
+    const state = useAppStore.getState()
+    const browserAvailability = getClientCreationActionPolicy(state, activeWorktreeId)[
+      'managed-browser'
+    ]
+    if (browserAvailability.state !== 'enabled') {
+      toast.error(browserAvailability.reason)
+      return
+    }
+    const defaultUrl = state.browserDefaultUrl ?? 'about:blank'
     const runtimeEnvironmentId = getActiveWorktreeRuntimeEnvironmentId(activeWorktreeId)
-    if (isWebRuntimeSessionActive(runtimeEnvironmentId)) {
+    if (browserAvailability.provider === 'paired-runtime' && runtimeEnvironmentId) {
       void createWebRuntimeSessionBrowserTab({
         worktreeId: activeWorktreeId,
         environmentId: runtimeEnvironmentId,
         url: defaultUrl
-      })
+      }).catch(showClientCreationActionError)
       return
     }
     createBrowserTab(activeWorktreeId, defaultUrl, {
       title: translate('auto.components.Terminal.37da0d736f', 'New Browser Tab'),
-      focusAddressBar: true
+      focusAddressBar: true,
+      ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {})
     })
   }, [activeWorktreeId, createBrowserTab, openNewBrowserTabInActiveWorkspace])
 
@@ -1654,8 +1658,16 @@ function Terminal(): React.JSX.Element | null {
         return
       }
       const runtimeEnvironmentId = getActiveWorktreeRuntimeEnvironmentId(activeWorktreeId)
+      const browserAvailability = getClientCreationActionPolicy(state, activeWorktreeId)[
+        'managed-browser'
+      ]
+      if (browserAvailability.state !== 'enabled') {
+        toast.error(browserAvailability.reason)
+        return
+      }
       if (
-        isWebRuntimeSessionActive(runtimeEnvironmentId) &&
+        browserAvailability.provider === 'paired-runtime' &&
+        runtimeEnvironmentId &&
         browserWorkspaceHasRemoteOwner(state, source.id, runtimeEnvironmentId)
       ) {
         void createWebRuntimeSessionBrowserTab({
@@ -1663,12 +1675,17 @@ function Terminal(): React.JSX.Element | null {
           environmentId: runtimeEnvironmentId,
           url: source.url,
           profileId: source.sessionProfileId
-        })
+        }).catch(showClientCreationActionError)
         return
       }
-      createBrowserTab(activeWorktreeId, source.url, {
-        ...buildDuplicatedBrowserTabOptions(source)
-      })
+      try {
+        createBrowserTab(activeWorktreeId, source.url, {
+          ...buildDuplicatedBrowserTabOptions(source),
+          ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {})
+        })
+      } catch (error) {
+        showClientCreationActionError(error)
+      }
     },
     [activeWorktreeId, createBrowserTab]
   )
@@ -2043,7 +2060,11 @@ function Terminal(): React.JSX.Element | null {
       if (!e.repeat && matchShortcut('tab.reopenClosed')) {
         e.preventDefault()
         notifyTerminalCapture('tab.reopenClosed')
-        useAppStore.getState().reopenClosedTab(activeWorktreeId)
+        try {
+          useAppStore.getState().reopenClosedTab(activeWorktreeId)
+        } catch (error) {
+          showClientCreationActionError(error)
+        }
         return
       }
 
@@ -2051,8 +2072,18 @@ function Terminal(): React.JSX.Element | null {
       if (!e.repeat && matchShortcut('tab.newBrowser')) {
         e.preventDefault()
         notifyTerminalCapture('tab.newBrowser')
+        const browserAvailability = getClientCreationActionPolicy(
+          useAppStore.getState(),
+          floatingWorkspaceFocused ? FLOATING_TERMINAL_WORKTREE_ID : activeWorktreeId
+        )['managed-browser']
+        if (browserAvailability.state !== 'enabled') {
+          toast.error(browserAvailability.reason)
+          return
+        }
         if (floatingWorkspaceFocused) {
-          void createFloatingWorkspaceBrowserTab(useAppStore.getState())
+          void createFloatingWorkspaceBrowserTab(useAppStore.getState()).catch(
+            showClientCreationActionError
+          )
           return
         }
         handleNewBrowserTab()
@@ -2063,6 +2094,14 @@ function Terminal(): React.JSX.Element | null {
       if (!e.repeat && mobileEmulatorEnabled && matchShortcut('tab.newSimulator')) {
         e.preventDefault()
         notifyTerminalCapture('tab.newSimulator')
+        const simulatorAvailability = getClientCreationActionPolicy(
+          useAppStore.getState(),
+          activeWorktreeId
+        )['mobile-emulator']
+        if (simulatorAvailability.state !== 'enabled') {
+          toast.error(simulatorAvailability.reason)
+          return
+        }
         if (!floatingWorkspaceFocused) {
           handleNewSimulatorTab()
         }
@@ -2077,10 +2116,17 @@ function Terminal(): React.JSX.Element | null {
           target?.closest('textarea:not(.xterm-helper-textarea), input') !== null
         if (!inEditor) {
           const state = useAppStore.getState()
-          if (state.activeTabType === 'editor' && state.activeFileId) {
+          const floatingPanelOwnsEvent =
+            isEventTargetInsideFloatingWorkspacePanel(e.target) || floatingWorkspaceFocused
+          const requestedFileId = getEditorCmdSaveFileId(state, floatingPanelOwnsEvent)
+          if (requestedFileId) {
             e.preventDefault()
             notifyTerminalCapture('editor.save')
-            window.dispatchEvent(new Event(ORCA_EDITOR_REQUEST_CMD_SAVE_EVENT))
+            window.dispatchEvent(
+              new CustomEvent<EditorRequestCmdSaveDetail>(ORCA_EDITOR_REQUEST_CMD_SAVE_EVENT, {
+                detail: { fileId: requestedFileId }
+              })
+            )
             return
           }
         }
diff --git a/src/renderer/src/components/WorktreeJumpPalette.recent-tabs.test.tsx b/src/renderer/src/components/WorktreeJumpPalette.recent-tabs.test.tsx
index e263a0db926..3e4037d4761 100644
--- a/src/renderer/src/components/WorktreeJumpPalette.recent-tabs.test.tsx
+++ b/src/renderer/src/components/WorktreeJumpPalette.recent-tabs.test.tsx
@@ -315,6 +315,28 @@ describe('WorktreeJumpPalette recent chats & terminals', () => {
     expect(getCommandValue()).toBe('workspace-tab:tab-host')
   })
 
+  // Why: after typing, arrow moves must stick. Dropping onValueChange while cmdk already
+  // advanced its internal cursor made the next ArrowDown a no-op (Object.is short-circuit).
+  it('keeps arrow selection after the typed query ranking has committed', async () => {
+    await renderPalette(makeTypedRelevanceState())
+
+    await act(async () => {
+      setCommandQuery?.('perf')
+    })
+    await flushEffects()
+    expect(getCommandValue()).toBe('workspace-tab:tab-host')
+
+    const rows = getRenderedRowIds().filter((id) => id.length > 0)
+    expect(rows.length).toBeGreaterThan(1)
+
+    await act(async () => {
+      setCommandSelection?.(rows[1])
+    })
+    await flushEffects()
+
+    expect(getCommandValue()).toBe(rows[1])
+  })
+
   it('keeps worktrees ahead of tabs when a worktree holds the stronger match', async () => {
     await renderPalette({
       ...makeTypedRelevanceState(),
diff --git a/src/renderer/src/components/WorktreeJumpPalette.tsx b/src/renderer/src/components/WorktreeJumpPalette.tsx
index b03d7026950..45a31847834 100644
--- a/src/renderer/src/components/WorktreeJumpPalette.tsx
+++ b/src/renderer/src/components/WorktreeJumpPalette.tsx
@@ -54,6 +54,11 @@ import {
   isDefaultBranchWorkspace,
   isSleepingSweepExemptWorkspace
 } from '@/components/sidebar/visible-worktrees'
+import {
+  EMPTY_PAIRED_DEVICE_IDS_BY_ENVIRONMENT,
+  getPairedDeviceIdsByEnvironment,
+  isWorkspaceFromOtherDevice
+} from '@/components/sidebar/workspace-creator-visibility'
 import { getLiveAgentStatusByWorktreeId, isInactiveWorkspace } from '@/lib/worktree-activity-state'
 import { orderEmptyQueryWorktrees } from '@/lib/order-empty-query-worktrees'
 import {
@@ -265,6 +270,9 @@ const CREATE_WORKSPACE_QUICK_ACTION_ITEM_ID = `quick-action:${CREATE_WORKSPACE_Q
 
 // Why: outlast the CommandDialog close animation so its rows do not disappear mid-fade.
 const PALETTE_CLOSE_LINGER_MS = 300
+// Why `jump-palette-item`: selection chrome lives in main.css — flat accent is invisible on light popovers.
+const JUMP_PALETTE_ITEM_CLASSNAME =
+  'jump-palette-item group mx-0.5 flex cursor-pointer items-center gap-3 rounded-lg border border-transparent px-3 text-left outline-none transition-[background-color,box-shadow]'
 
 type OpenTabPaletteItem = BrowserPaletteItem | SimulatorPaletteItem | WorkspaceTabPaletteItem
 
@@ -313,8 +321,8 @@ function shouldIncludeOpenTabInRecentSection({
   worktree: Worktree
   row: RecentWorkspaceTabRow
   paneSources: TabPaneInputSources
-  unreadTerminalTabs: Record<string, true | boolean | undefined>
-  unreadAgentCompletionPanes: Record<string, true | boolean | undefined>
+  unreadTerminalTabs: Record<string, boolean | undefined>
+  unreadAgentCompletionPanes: Record<string, boolean | undefined>
   now: number
 }): boolean {
   if (worktree.isArchived) {
@@ -615,6 +623,7 @@ function WorktreeJumpPaletteContent({
   const hideAutomationGeneratedWorkspaces = useAppStore((s) => s.hideAutomationGeneratedWorkspaces)
   const hideCliCreatedWorkspaces = useAppStore((s) => s.hideCliCreatedWorkspaces)
   const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces)
+  const hideWorkspacesFromOtherDevices = useAppStore((s) => s.hideWorkspacesFromOtherDevices)
   const showSleepingWorkspaces = useAppStore((s) => s.showSleepingWorkspaces)
   const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace)
   const lastVisitedAtByWorktreeId = useAppStore((s) => s.lastVisitedAtByWorktreeId)
@@ -631,7 +640,6 @@ function WorktreeJumpPaletteContent({
   const [query, setQuery] = useState('')
   const deferredQuery = useDeferredValue(query)
   const [selectedItemId, setSelectedItemId] = useState('')
-  const latestQueryRef = useRef('')
   // Why: the id cmdk auto-selected for the last committed list, so a late recent-order snapshot can
   // tell "nobody has moved the highlight yet" from "the user arrowed somewhere deliberately".
   const autoSelectedItemIdRef = useRef<string | null>(null)
@@ -748,6 +756,13 @@ function WorktreeJumpPaletteContent({
       ),
     [agentStatusByPaneKey, tabsByWorktree]
   )
+  const pairedDeviceIdsByEnvironment = useMemo(
+    () =>
+      hideWorkspacesFromOtherDevices
+        ? getPairedDeviceIdsByEnvironment(runtimeEnvironments, runtimeStatusByEnvironmentId)
+        : EMPTY_PAIRED_DEVICE_IDS_BY_ENVIRONMENT,
+    [hideWorkspacesFromOtherDevices, runtimeEnvironments, runtimeStatusByEnvironmentId]
+  )
 
   // Why: empty-query mirrors sidebar filters so Search opens on the same quiet list; typed search widens to global non-archived scope.
   const emptyQueryVisibleWorktrees = useMemo(
@@ -773,6 +788,12 @@ function WorktreeJumpPaletteContent({
         if (hideDetachedHeadWorkspaces && isDetachedHeadWorkspace(worktree)) {
           return false
         }
+        if (
+          hideWorkspacesFromOtherDevices &&
+          isWorkspaceFromOtherDevice(worktree, pairedDeviceIdsByEnvironment)
+        ) {
+          return false
+        }
         if (
           !showSleepingWorkspaces &&
           // Why the exemption here too: Cmd+J re-implements the sidebar's
@@ -799,6 +820,8 @@ function WorktreeJumpPaletteContent({
       hideCliCreatedWorkspaces,
       hideDefaultBranchWorkspace,
       hideDetachedHeadWorkspaces,
+      hideWorkspacesFromOtherDevices,
+      pairedDeviceIdsByEnvironment,
       ptyIdsByTabId,
       showSleepingWorkspaces,
       tabsByWorktree,
@@ -1457,23 +1480,37 @@ function WorktreeJumpPaletteContent({
   // Why: filtering via buildQuickActionContext() inside a memo with stable primitive deps
   // instead of calling it inline every render — a fresh context object as a useMemo dep
   // defeated the middleItems memo (new identity every keystroke).
+  const quickActionAvailabilityInputs = useMemo(
+    () => ({
+      activeView,
+      activeWorktreeId,
+      worktreesByRepo,
+      repos,
+      sshConnectionStates,
+      activeGroupIdByWorktree,
+      groupsByWorktree,
+      isLoading,
+      activeRuntimeEnvironmentId: settings?.activeRuntimeEnvironmentId,
+      runtimeStatusByEnvironmentId
+    }),
+    [
+      activeView,
+      activeWorktreeId,
+      worktreesByRepo,
+      repos,
+      sshConnectionStates,
+      activeGroupIdByWorktree,
+      groupsByWorktree,
+      isLoading,
+      settings?.activeRuntimeEnvironmentId,
+      runtimeStatusByEnvironmentId
+    ]
+  )
   const availableActionResults = useMemo(() => {
+    void quickActionAvailabilityInputs
     const ctx = buildQuickActionContext()
     return actionResults.filter((action) => action.isAvailable(ctx).available)
-  }, [
-    actionResults,
-    buildQuickActionContext,
-    // oxlint-disable-next-line react-hooks/exhaustive-deps -- these are the availability-determining primitives buildQuickActionContext reads from the store; listing them ensures the memo recomputes when availability actually changes, not on every render.
-    activeView,
-    activeWorktreeId,
-    worktreesByRepo,
-    repos,
-    sshConnectionStates,
-    activeGroupIdByWorktree,
-    groupsByWorktree,
-    isLoading,
-    settings?.activeRuntimeEnvironmentId
-  ])
+  }, [actionResults, buildQuickActionContext, quickActionAvailabilityInputs])
 
   const middleItems = useMemo<(SettingsPaletteItem | QuickActionPaletteItem)[]>(
     () =>
@@ -1850,7 +1887,6 @@ function WorktreeJumpPaletteContent({
           ? document.activeElement
           : null
       skipRestoreFocusRef.current = false
-      latestQueryRef.current = ''
       setQuery('')
       setSelectedItemId('')
       // Why: reset on open, not on close — closing races the fade-out, and a
@@ -1887,16 +1923,23 @@ function WorktreeJumpPaletteContent({
     showCreateAction
   })
 
-  const handleCommandSelectionChange = useCallback(
-    (nextItemId: string) => {
-      // Why: cmdk can report the old list head before the deferred query commits its new ranking.
-      if (latestQueryRef.current !== deferredQuery) {
-        return
-      }
-      setSelectedItemId(nextItemId)
-    },
-    [deferredQuery]
-  )
+  // Why: cmdk writes its internal cursor *before* calling onValueChange. Dropping that
+  // callback (e.g. while deferredQuery lags the keystroke) leaves internal state advanced
+  // while the controlled `value` prop stays put — the next ArrowDown/Up then no-ops on
+  // cmdk's Object.is guard, so keyboard navigation dies after typing. Always accept the
+  // report so the cursor stays aligned; the deferred-commit effect below re-auto-selects
+  // the new ranking head once the list the user sees actually changes.
+  const handleCommandSelectionChange = useCallback((nextItemId: string) => {
+    setSelectedItemId(nextItemId)
+  }, [])
+
+  // Why: while query is mid-deferral, cmdk (and mid-lag arrows) can latch a selection
+  // against the previous ranking. When the deferred list commits, snap Enter back to the
+  // new head — matching handleQueryChange's clear, but covering selection that landed
+  // after the keystroke and before this commit.
+  useLayoutEffect(() => {
+    setSelectedItemId('')
+  }, [deferredQuery])
 
   useEffect(() => {
     const isCreateWorkspaceHighlighted =
@@ -1910,7 +1953,6 @@ function WorktreeJumpPaletteContent({
   }, [commandSelectedItemId, prefetchCreateWorkspaceBaseForComposer, visible])
 
   const handleQueryChange = useCallback((nextQuery: string) => {
-    latestQueryRef.current = nextQuery
     setQuery(nextQuery)
     setSelectedItemId('')
     listRef.current?.scrollTo(0, 0)
@@ -2566,7 +2608,7 @@ function WorktreeJumpPaletteContent({
                     key={entry.id}
                     value={CREATE_WORKTREE_ITEM_ID}
                     onSelect={handleCreateWorktree}
-                    className="group mx-0.5 mt-1 flex cursor-pointer items-center gap-3 rounded-lg border border-transparent px-3 py-1.5 text-left outline-none transition-[background-color,border-color,box-shadow] data-[selected=true]:border-border data-[selected=true]:bg-accent data-[selected=true]:text-foreground"
+                    className={cn(JUMP_PALETTE_ITEM_CLASSNAME, 'mt-1 py-1.5')}
                   >
                     <div className="flex h-5 w-5 shrink-0 items-center justify-center rounded-full border border-dashed border-border/60 bg-muted/25 text-muted-foreground/70">
                       <Plus size={13} aria-hidden="true" />
@@ -2610,10 +2652,7 @@ function WorktreeJumpPaletteContent({
                     value={entry.id}
                     onSelect={() => handleSelectItem(entry)}
                     data-current={isCurrentWorktree ? 'true' : undefined}
-                    className={cn(
-                      'group mx-0.5 flex cursor-pointer items-center gap-3 rounded-lg border border-transparent px-3 py-2.5 text-left outline-none transition-[background-color,border-color,box-shadow]',
-                      'data-[selected=true]:border-border data-[selected=true]:bg-accent data-[selected=true]:text-foreground'
-                    )}
+                    className={cn(JUMP_PALETTE_ITEM_CLASSNAME, 'py-2.5')}
                   >
                     <div className="flex h-5 w-4 shrink-0 items-center justify-center self-start">
                       <PaletteWorktreeStatusDot worktree={worktree} />
@@ -2739,10 +2778,7 @@ function WorktreeJumpPaletteContent({
                     key={entry.id}
                     value={entry.id}
                     onSelect={() => handleSelectItem(entry)}
-                    className={cn(
-                      'group mx-0.5 flex cursor-pointer items-center gap-3 rounded-lg border border-transparent px-3 py-2.5 text-left outline-none transition-[background-color,border-color,box-shadow]',
-                      'data-[selected=true]:border-border data-[selected=true]:bg-accent data-[selected=true]:text-foreground'
-                    )}
+                    className={cn(JUMP_PALETTE_ITEM_CLASSNAME, 'py-2.5')}
                   >
                     <div className="flex h-5 w-4 shrink-0 items-center justify-center self-start text-muted-foreground/85">
                       <FolderTree className="size-3.5" aria-hidden="true" />
@@ -2786,10 +2822,7 @@ function WorktreeJumpPaletteContent({
                     key={entry.id}
                     value={entry.id}
                     onSelect={() => handleSelectItem(entry)}
-                    className={cn(
-                      'group mx-0.5 flex cursor-pointer items-center gap-3 rounded-lg border border-transparent px-3 py-2.5 text-left outline-none transition-[background-color,border-color,box-shadow]',
-                      'data-[selected=true]:border-border data-[selected=true]:bg-accent data-[selected=true]:text-foreground'
-                    )}
+                    className={cn(JUMP_PALETTE_ITEM_CLASSNAME, 'py-2.5')}
                   >
                     <div className="flex h-5 w-4 shrink-0 items-center justify-center self-start text-muted-foreground/85">
                       <Icon className="size-3.5" aria-hidden="true" />
@@ -2834,10 +2867,7 @@ function WorktreeJumpPaletteContent({
                     key={entry.id}
                     value={entry.id}
                     onSelect={() => handleSelectItem(entry)}
-                    className={cn(
-                      'group mx-0.5 flex cursor-pointer items-center gap-3 rounded-lg border border-transparent px-3 py-2.5 text-left outline-none transition-[background-color,border-color,box-shadow]',
-                      'data-[selected=true]:border-border data-[selected=true]:bg-accent data-[selected=true]:text-foreground'
-                    )}
+                    className={cn(JUMP_PALETTE_ITEM_CLASSNAME, 'py-2.5')}
                   >
                     <div className="flex h-5 w-4 shrink-0 items-center justify-center self-start text-muted-foreground/85">
                       <PaletteRecentTabStatusDot
@@ -2919,10 +2949,7 @@ function WorktreeJumpPaletteContent({
                     key={entry.id}
                     value={entry.id}
                     onSelect={() => handleSelectItem(entry)}
-                    className={cn(
-                      'group mx-0.5 flex cursor-pointer items-center gap-3 rounded-lg border border-transparent px-3 py-2.5 text-left outline-none transition-[background-color,border-color,box-shadow]',
-                      'data-[selected=true]:border-border data-[selected=true]:bg-accent data-[selected=true]:text-foreground'
-                    )}
+                    className={cn(JUMP_PALETTE_ITEM_CLASSNAME, 'py-2.5')}
                   >
                     <div className="flex h-5 w-4 shrink-0 items-center justify-center self-start text-muted-foreground/85">
                       <Smartphone className="size-3.5" aria-hidden="true" />
@@ -2998,10 +3025,7 @@ function WorktreeJumpPaletteContent({
                   key={entry.id}
                   value={entry.id}
                   onSelect={() => handleSelectItem(entry)}
-                  className={cn(
-                    'group mx-0.5 flex cursor-pointer items-center gap-3 rounded-lg border border-transparent px-3 py-2.5 text-left outline-none transition-[background-color,border-color,box-shadow]',
-                    'data-[selected=true]:border-border data-[selected=true]:bg-accent data-[selected=true]:text-foreground'
-                  )}
+                  className={cn(JUMP_PALETTE_ITEM_CLASSNAME, 'py-2.5')}
                 >
                   <div className="flex h-5 w-4 shrink-0 items-center justify-center self-start text-muted-foreground/85">
                     <Globe className="size-3.5" aria-hidden="true" />
diff --git a/src/renderer/src/components/automations/AutomationEditorDialog.tsx b/src/renderer/src/components/automations/AutomationEditorDialog.tsx
index f595290d2a2..90eb5a9df47 100644
--- a/src/renderer/src/components/automations/AutomationEditorDialog.tsx
+++ b/src/renderer/src/components/automations/AutomationEditorDialog.tsx
@@ -61,7 +61,7 @@ type AutomationEditorDialogProps = {
   isSaving: boolean
   canSave: boolean
   createTarget: AutomationCreateTarget
-  repos: Repo[]
+  repos: readonly Repo[]
   projectHostSetups: ProjectHostSetup[]
   automationYamlHooksByRepoKey: Record<string, OrcaHooks | null>
   getAutomationHooksCacheKey: (repoId: string) => string
diff --git a/src/renderer/src/components/automations/AutomationEditorDialogFooter.tsx b/src/renderer/src/components/automations/AutomationEditorDialogFooter.tsx
index 62a7be7aab7..ff5a67cc41b 100644
--- a/src/renderer/src/components/automations/AutomationEditorDialogFooter.tsx
+++ b/src/renderer/src/components/automations/AutomationEditorDialogFooter.tsx
@@ -31,7 +31,7 @@ type AutomationEditorDialogFooterProps = {
   isHermesCreate: boolean
   isSaving: boolean
   canSave: boolean
-  repos: Repo[]
+  repos: readonly Repo[]
   projectHostSetups: ProjectHostSetup[]
   automationYamlHooksByRepoKey: Record<string, OrcaHooks | null>
   getAutomationHooksCacheKey: (repoId: string) => string
diff --git a/src/renderer/src/components/automations/AutomationListExternalRows.tsx b/src/renderer/src/components/automations/AutomationListExternalRows.tsx
index e036dcef419..25a9f137397 100644
--- a/src/renderer/src/components/automations/AutomationListExternalRows.tsx
+++ b/src/renderer/src/components/automations/AutomationListExternalRows.tsx
@@ -1,5 +1,5 @@
 import React from 'react'
-import { Clock, Pause, Pencil, Play, Trash2 } from 'lucide-react'
+import { MoreHorizontal, Pause, Pencil, Play, Trash2 } from 'lucide-react'
 import {
   ContextMenu,
   ContextMenuContent,
@@ -7,6 +7,14 @@ import {
   ContextMenuSeparator,
   ContextMenuTrigger
 } from '@/components/ui/context-menu'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger
+} from '@/components/ui/dropdown-menu'
+import { Button } from '@/components/ui/button'
 import { cn } from '@/lib/utils'
 import type {
   ExternalAutomationAction,
@@ -22,6 +30,13 @@ import {
 } from './external-automation-display'
 import { getExternalAutomationScheduleDisplay } from './external-automation-schedule-display'
 import { getExternalAutomationActionDisabledMessage } from './external-automation-source-availability'
+import {
+  AUTOMATIONS_TABLE_GRID_CLASS,
+  AUTOMATIONS_TABLE_ROW_CLASS,
+  AUTOMATIONS_TABLE_ROW_SELECTED_CLASS
+} from './automations-table-layout'
+import { isPortaledRowMenuClick, isRowActivationKey } from './automation-list-row-interaction'
+import { AutomationListStatusCell } from './AutomationListStatusCell'
 import { translate } from '@/i18n/i18n'
 
 export function AutomationListExternalRows({
@@ -52,10 +67,8 @@ export function AutomationListExternalRows({
       {entries.map((entry) => {
         const providerLabel = getExternalProviderLabel(entry.manager)
         const targetKindLabel = getExternalTargetKindLabel(entry.manager)
-        const nextRunLabel = entry.job.enabled
-          ? formatExternalDate(entry.job.nextRunAt, relativeNow)
-          : translate('auto.components.automations.AutomationsPage.paused', 'Paused')
-        const entrySshStatus =
+        const isSelected = selectedExternalKey === entry.key
+        const sshStatus =
           entry.manager.target.type === 'ssh'
             ? sshConnectionStates.get(entry.manager.target.connectionId)?.status
             : undefined
@@ -63,66 +76,140 @@ export function AutomationListExternalRows({
           manager: entry.manager,
           providerLabel,
           targetKindLabel,
-          sshStatus: entrySshStatus,
+          sshStatus,
           actionInProgress: externalActionKey !== null
         })
         const actionDisabled = disabledMessage !== null
-        const scheduleDisplay = getExternalAutomationScheduleDisplay(entry.manager, entry.job)
+        const scheduleLabel = getExternalAutomationScheduleDisplay(entry.manager, entry.job).label
+        const projectLabel = `${providerLabel} / ${entry.manager.targetLabel}`
+        const nextRunLabel = entry.job.enabled
+          ? formatExternalDate(entry.job.nextRunAt, relativeNow)
+          : translate('auto.components.automations.AutomationsPage.paused', 'Paused')
+
         return (
           <ContextMenu key={entry.key}>
             <ContextMenuTrigger asChild>
-              <button
-                type="button"
-                onClick={() => onSelect(entry.key)}
+              <div
+                role="button"
+                tabIndex={0}
+                data-current={isSelected ? 'true' : undefined}
+                onClick={(event) => {
+                  // Why: Radix portals menus out of the row DOM, but React still
+                  // bubbles those clicks here — ignore so menu actions don't open detail.
+                  if (isPortaledRowMenuClick(event)) {
+                    return
+                  }
+                  onSelect(entry.key)
+                }}
+                onKeyDown={(event) => {
+                  if (!isRowActivationKey(event)) {
+                    return
+                  }
+                  event.preventDefault()
+                  onSelect(entry.key)
+                }}
                 className={cn(
-                  'mb-1 grid w-full grid-cols-[minmax(0,1fr)_auto] gap-3 rounded-md border px-3 py-2 text-left text-sm transition-colors',
-                  selectedExternalKey === entry.key
-                    ? 'border-foreground/30 bg-muted/70 text-foreground shadow-sm'
-                    : 'border-transparent hover:bg-muted/50'
+                  AUTOMATIONS_TABLE_GRID_CLASS,
+                  AUTOMATIONS_TABLE_ROW_CLASS,
+                  isSelected && AUTOMATIONS_TABLE_ROW_SELECTED_CLASS
                 )}
               >
-                <span className="min-w-0">
-                  <span className="flex min-w-0 items-center gap-2">
-                    <span
-                      className={cn(
-                        'size-2 rounded-full',
-                        entry.job.enabled ? 'bg-foreground' : 'bg-muted-foreground/40'
+                <span className="min-w-0 truncate font-medium">{entry.job.name}</span>
+                <span className="min-w-0 truncate text-muted-foreground" title={scheduleLabel}>
+                  {scheduleLabel}
+                </span>
+                <span className="min-w-0 truncate text-muted-foreground" title={projectLabel}>
+                  {projectLabel}
+                </span>
+                <span className="min-w-0 truncate text-muted-foreground" title={nextRunLabel}>
+                  {nextRunLabel}
+                </span>
+                <AutomationListStatusCell enabled={entry.job.enabled} />
+                <span className="truncate text-center text-xs text-muted-foreground">
+                  {providerLabel}
+                </span>
+                <DropdownMenu>
+                  <DropdownMenuTrigger asChild>
+                    <Button
+                      type="button"
+                      variant="ghost"
+                      size="icon-xs"
+                      className="size-7 text-muted-foreground"
+                      aria-label={translate(
+                        'auto.components.automations.AutomationsPage.rowActions',
+                        'Automation actions'
                       )}
-                    />
-                    <span className="truncate font-medium">{entry.job.name}</span>
-                  </span>
-                  <span className="mt-1 block truncate text-xs font-medium text-foreground/80">
-                    {scheduleDisplay.label}
-                  </span>
-                  <span className="mt-1 flex min-w-0 items-center gap-2 text-xs text-muted-foreground">
-                    <span className="truncate">
-                      {providerLabel} / {entry.manager.targetLabel}
-                    </span>
-                    <span className="shrink-0">·</span>
-                    <span className="truncate">
-                      {entry.manager.provider === 'hermes'
+                      onClick={(event) => event.stopPropagation()}
+                    >
+                      <MoreHorizontal className="size-4" />
+                    </Button>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end" className="w-48">
+                    <DropdownMenuItem
+                      disabled={actionDisabled}
+                      onSelect={() => onRequestAction(entry.manager, entry.job, 'run')}
+                    >
+                      <Play className="size-3.5" />
+                      <span className="min-w-0 truncate">
+                        {disabledMessage ??
+                          translate(
+                            'auto.components.automations.AutomationsPage.2faecab10b',
+                            'Run Now'
+                          )}
+                      </span>
+                    </DropdownMenuItem>
+                    {entry.manager.provider === 'hermes' ? (
+                      <DropdownMenuItem
+                        disabled={!entry.manager.canManage || externalActionKey !== null}
+                        onSelect={() => onEdit(entry.manager, entry.job)}
+                      >
+                        <Pencil className="size-3.5" />
+                        {translate(
+                          'auto.components.automations.AutomationsPage.f4612e3f78',
+                          'Edit'
+                        )}
+                      </DropdownMenuItem>
+                    ) : null}
+                    <DropdownMenuItem
+                      disabled={actionDisabled}
+                      onSelect={() =>
+                        onRequestAction(
+                          entry.manager,
+                          entry.job,
+                          entry.job.enabled ? 'pause' : 'resume'
+                        )
+                      }
+                    >
+                      {entry.job.enabled ? (
+                        <Pause className="size-3.5" />
+                      ) : (
+                        <Play className="size-3.5" />
+                      )}
+                      {entry.job.enabled
                         ? translate(
-                            'auto.components.automations.AutomationsPage.runCount',
-                            '{{count}} runs',
-                            { count: entry.job.runCount }
+                            'auto.components.automations.AutomationsPage.b457436d6a',
+                            'Pause'
                           )
-                        : entry.manager.canManage
-                          ? translate(
-                              'auto.components.automations.AutomationsPage.aecdc3681f',
-                              'Manageable'
-                            )
-                          : translate(
-                              'auto.components.automations.AutomationsPage.e059042585',
-                              'Read-only'
-                            )}
-                    </span>
-                  </span>
-                </span>
-                <span className="flex max-w-28 flex-col items-end gap-1 text-right text-xs text-muted-foreground">
-                  <Clock className="size-3.5" />
-                  <span className="line-clamp-2">{nextRunLabel}</span>
-                </span>
-              </button>
+                        : translate(
+                            'auto.components.automations.AutomationsPage.376631ef2b',
+                            'Resume'
+                          )}
+                    </DropdownMenuItem>
+                    <DropdownMenuSeparator />
+                    <DropdownMenuItem
+                      variant="destructive"
+                      disabled={actionDisabled}
+                      onSelect={() => onRequestAction(entry.manager, entry.job, 'delete')}
+                    >
+                      <Trash2 className="size-3.5" />
+                      {translate(
+                        'auto.components.automations.AutomationsPage.15e0bfb13b',
+                        'Delete'
+                      )}
+                    </DropdownMenuItem>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              </div>
             </ContextMenuTrigger>
             <ContextMenuContent className="w-48">
               <ContextMenuItem
diff --git a/src/renderer/src/components/automations/AutomationListLocalRows.test.tsx b/src/renderer/src/components/automations/AutomationListLocalRows.test.tsx
new file mode 100644
index 00000000000..b6c41db55af
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationListLocalRows.test.tsx
@@ -0,0 +1,209 @@
+// @vitest-environment happy-dom
+
+import React from 'react'
+import { cleanup, render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type {
+  Automation,
+  ExternalAutomationJob,
+  ExternalAutomationManager
+} from '../../../../shared/automations-types'
+import { AutomationListLocalRows } from './AutomationListLocalRows'
+import { AutomationListExternalRows } from './AutomationListExternalRows'
+
+// Why: Tooltip needs a provider in the app; stub so rows render standalone.
+vi.mock('@/components/ui/tooltip', () => ({
+  Tooltip: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  TooltipTrigger: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  TooltipContent: ({ children }: { children: React.ReactNode }) => <>{children}</>
+}))
+
+function makeAutomation(overrides: Partial<Automation> = {}): Automation {
+  return {
+    id: 'automation-1',
+    name: 'test',
+    prompt: 'Run checks',
+    precheck: null,
+    agentId: 'codex',
+    projectId: 'repo-1',
+    executionTargetType: 'local',
+    executionTargetId: 'local',
+    schedulerOwner: 'local_host_service',
+    workspaceMode: 'existing',
+    workspaceId: 'worktree-1',
+    baseBranch: null,
+    reuseSession: false,
+    timezone: 'America/Los_Angeles',
+    rrule: 'FREQ=DAILY',
+    dtstart: 1,
+    enabled: true,
+    nextRunAt: Date.now() + 60_000,
+    missedRunPolicy: 'run_once_within_grace',
+    missedRunGraceMinutes: 720,
+    createdAt: 1,
+    updatedAt: 1,
+    ...overrides
+  }
+}
+
+function makeExternalJob(overrides: Partial<ExternalAutomationJob> = {}): ExternalAutomationJob {
+  return {
+    id: 'job-1',
+    managerId: 'manager-1',
+    provider: 'hermes',
+    name: 'Nightly',
+    schedule: '0 0 * * *',
+    rawSchedule: null,
+    enabled: true,
+    state: 'enabled',
+    prompt: null,
+    promptPreview: '',
+    nextRunAt: new Date(Date.now() + 60_000).toISOString(),
+    lastRunAt: null,
+    lastStatus: null,
+    lastError: null,
+    workdir: null,
+    runCount: 0,
+    runs: [],
+    ...overrides
+  }
+}
+
+function makeExternalManager(): ExternalAutomationManager {
+  return {
+    id: 'manager-1',
+    provider: 'hermes',
+    label: 'Local Hermes',
+    targetLabel: 'Local',
+    target: { type: 'local' },
+    status: 'available',
+    error: null,
+    canManage: true,
+    jobs: []
+  }
+}
+
+function renderLocalRows(handlers: {
+  onSelect: (automationId: string) => void
+  onDelete?: (automation: Automation) => void
+}) {
+  return render(
+    <AutomationListLocalRows
+      automations={[makeAutomation()]}
+      selectedId={null}
+      isSelectedLocal={true}
+      runs={[]}
+      relativeNow={Date.now()}
+      repoMap={new Map()}
+      worktreeMap={new Map()}
+      projectHostSetups={[]}
+      sshConnectionStates={new Map()}
+      runtimeStatusByEnvironmentId={new Map()}
+      automationHostTarget={null}
+      automationSourceHostAvailabilityById={new Map()}
+      hostLabelById={new Map()}
+      onSelect={handlers.onSelect}
+      onRunNow={vi.fn()}
+      onEdit={vi.fn()}
+      onToggle={vi.fn()}
+      onDelete={handlers.onDelete ?? vi.fn()}
+    />
+  )
+}
+
+function renderExternalRows(handlers: {
+  onSelect: (entryKey: string) => void
+  onRequestAction?: (
+    manager: ExternalAutomationManager,
+    job: ExternalAutomationJob,
+    action: 'run' | 'pause' | 'resume' | 'delete'
+  ) => void
+}) {
+  const manager = makeExternalManager()
+  const job = makeExternalJob()
+  return render(
+    <AutomationListExternalRows
+      entries={[{ key: `${manager.id}:${job.id}`, manager, job }]}
+      selectedExternalKey={null}
+      relativeNow={Date.now()}
+      sshConnectionStates={new Map()}
+      externalActionKey={null}
+      onSelect={handlers.onSelect}
+      onRequestAction={handlers.onRequestAction ?? vi.fn()}
+      onEdit={vi.fn()}
+    />
+  )
+}
+
+afterEach(() => {
+  cleanup()
+  vi.clearAllMocks()
+})
+
+describe('Automation list row selection', () => {
+  it('does not open local detail when a quick-action menu item is chosen', async () => {
+    // Radix portals the menu out of the row's DOM, but React bubbles its
+    // clicks back through the component tree. Selecting Delete must not call
+    // onSelect (which opens the detail page behind the confirm dialog).
+    const onSelect = vi.fn()
+    const onDelete = vi.fn()
+    renderLocalRows({ onSelect, onDelete })
+    const user = userEvent.setup()
+
+    await user.click(
+      screen.getByRole('button', {
+        name: 'Automation actions'
+      })
+    )
+    await user.click(await screen.findByRole('menuitem', { name: 'Delete' }))
+
+    expect(onDelete).toHaveBeenCalledTimes(1)
+    expect(onSelect).not.toHaveBeenCalled()
+  })
+
+  it('still selects when the local row itself is clicked', async () => {
+    const onSelect = vi.fn()
+    const { container } = renderLocalRows({ onSelect })
+    const user = userEvent.setup()
+
+    const row = container.querySelector('[data-slot="context-menu-trigger"]')
+    expect(row).not.toBeNull()
+    await user.click(row as Element)
+
+    expect(onSelect).toHaveBeenCalledTimes(1)
+    expect(onSelect).toHaveBeenCalledWith('automation-1')
+  })
+
+  it('opens the actions menu on keyboard activation without selecting the row', async () => {
+    // The row handles Enter/Space for its own activation. Those keys bubble
+    // from the actions trigger too, so an unguarded row handler would
+    // preventDefault the button's native activation and open detail instead.
+    const onSelect = vi.fn()
+    renderLocalRows({ onSelect })
+    const user = userEvent.setup()
+
+    screen.getByRole('button', { name: 'Automation actions' }).focus()
+    await user.keyboard('{Enter}')
+
+    expect(await screen.findByRole('menuitem', { name: 'Delete' })).toBeTruthy()
+    expect(onSelect).not.toHaveBeenCalled()
+  })
+
+  it('does not open external detail when a quick-action menu item is chosen', async () => {
+    const onSelect = vi.fn()
+    const onRequestAction = vi.fn()
+    renderExternalRows({ onSelect, onRequestAction })
+    const user = userEvent.setup()
+
+    await user.click(
+      screen.getByRole('button', {
+        name: 'Automation actions'
+      })
+    )
+    await user.click(await screen.findByRole('menuitem', { name: 'Delete' }))
+
+    expect(onRequestAction).toHaveBeenCalledTimes(1)
+    expect(onSelect).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/automations/AutomationListLocalRows.tsx b/src/renderer/src/components/automations/AutomationListLocalRows.tsx
index 1a5a4994aac..97ec2c7bb5f 100644
--- a/src/renderer/src/components/automations/AutomationListLocalRows.tsx
+++ b/src/renderer/src/components/automations/AutomationListLocalRows.tsx
@@ -1,5 +1,5 @@
 import React from 'react'
-import { Clock, Pause, Pencil, Play, Trash2 } from 'lucide-react'
+import { MoreHorizontal, Pause, Pencil, Play, Trash2 } from 'lucide-react'
 import {
   ContextMenu,
   ContextMenuContent,
@@ -7,24 +7,41 @@ import {
   ContextMenuSeparator,
   ContextMenuTrigger
 } from '@/components/ui/context-menu'
-import RepoBadgeLabel from '@/components/repo/RepoBadgeLabel'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger
+} from '@/components/ui/dropdown-menu'
+import { Button } from '@/components/ui/button'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { AgentIcon } from '@/lib/agent-catalog'
 import { cn } from '@/lib/utils'
 import type { Automation, AutomationRun } from '../../../../shared/automations-types'
 import { getAutomationRunRepoId } from '../../../../shared/automation-run-identity'
 import { formatAutomationSchedule } from '../../../../shared/automation-schedules'
+import {
+  getExecutionHostLabel,
+  getLocalExecutionHostLabel,
+  getRepoExecutionHostId
+} from '../../../../shared/execution-host'
 import type { SshConnectionState } from '../../../../shared/ssh-types'
 import type { ProjectHostSetup, Repo, Worktree } from '../../../../shared/types'
 import type { RuntimeStatus } from '../../../../shared/runtime-types'
 import type { TaskSourceHostAvailability } from '../task-source-context-summary'
 import type { AutomationHostTarget } from './automation-host-client'
 import { formatAutomationDateTimeWithRelative } from './automation-page-parts'
-import {
-  formatAutomationCost,
-  formatAutomationTokens,
-  summarizeAutomationRunUsage
-} from './automation-usage-model'
 import { getAutomationTargetAvailability } from './automation-target-availability'
 import { getAgentLabel } from './automation-draft-model'
+import { formatAutomationCost } from './automation-usage-model'
+import {
+  AUTOMATIONS_TABLE_GRID_CLASS,
+  AUTOMATIONS_TABLE_ROW_CLASS,
+  AUTOMATIONS_TABLE_ROW_SELECTED_CLASS
+} from './automations-table-layout'
+import { isPortaledRowMenuClick, isRowActivationKey } from './automation-list-row-interaction'
+import { AutomationListStatusCell } from './AutomationListStatusCell'
 import { translate } from '@/i18n/i18n'
 
 export function AutomationListLocalRows({
@@ -40,6 +57,7 @@ export function AutomationListLocalRows({
   runtimeStatusByEnvironmentId,
   automationHostTarget,
   automationSourceHostAvailabilityById,
+  hostLabelById,
   onSelect,
   onRunNow,
   onEdit,
@@ -61,6 +79,7 @@ export function AutomationListLocalRows({
   >
   automationHostTarget: AutomationHostTarget | null
   automationSourceHostAvailabilityById: ReadonlyMap<string, TaskSourceHostAvailability[]>
+  hostLabelById: ReadonlyMap<string, string>
   onSelect: (automationId: string) => void
   onRunNow: (automation: Automation) => void
   onEdit: (automation: Automation) => void
@@ -69,18 +88,17 @@ export function AutomationListLocalRows({
 }): React.JSX.Element {
   // Why: one pass over runs instead of a full scan per rendered automation —
   // this list re-renders on the relativeNow timer.
-  const runsByAutomationId = React.useMemo(() => {
-    const grouped = new Map<string, AutomationRun[]>()
+  const lastRunByAutomationId = React.useMemo(() => {
+    const latest = new Map<string, AutomationRun>()
     for (const run of runs) {
-      const existing = grouped.get(run.automationId)
-      if (existing) {
-        existing.push(run)
-      } else {
-        grouped.set(run.automationId, [run])
+      const existing = latest.get(run.automationId)
+      if (!existing || run.createdAt > existing.createdAt) {
+        latest.set(run.automationId, run)
       }
     }
-    return grouped
+    return latest
   }, [runs])
+
   return (
     <>
       {automations.map((automation) => {
@@ -98,148 +116,237 @@ export function AutomationListLocalRows({
           automationHostTarget,
           sourceHostAvailability: automationSourceHostAvailabilityById.get(automation.id)
         })
-        const baseRefLabel =
-          automation.baseBranch ??
-          automationRepo?.worktreeBaseRef ??
-          translate(
-            'auto.components.automations.AutomationsPage.projectDefaultBaseRef',
-            'project default'
-          )
-        const workspaceLabel =
-          automation.workspaceMode === 'new_per_run'
-            ? translate(
-                'auto.components.automations.AutomationsPage.createFromBaseRef',
-                'Create from {{baseRef}}',
-                { baseRef: baseRefLabel }
-              )
-            : (automationWorktree?.displayName ??
-              translate(
-                'auto.components.automations.AutomationsPage.missingWorkspace',
-                'Missing workspace'
-              ))
-        const usageSummary = summarizeAutomationRunUsage(
-          runsByAutomationId.get(automation.id) ?? []
-        )
-        const usageText =
-          usageSummary.knownRuns > 0
-            ? translate(
-                'auto.components.automations.AutomationsPage.runUsageSummary',
-                '{{cost}} est. · {{tokens}} tokens',
-                {
-                  cost: formatAutomationCost(usageSummary.estimatedCostUsd),
-                  tokens: formatAutomationTokens(usageSummary.totalTokens)
-                }
-              )
-            : usageSummary.unavailableRuns > 0
-              ? translate(
-                  'auto.components.automations.AutomationsPage.usageUnavailable',
-                  'Usage unavailable'
-                )
-              : translate(
-                  'auto.components.automations.AutomationsPage.noRunUsageYet',
-                  'No run usage yet'
-                )
+        const projectLabel =
+          automationRepo?.displayName ??
+          translate('auto.components.automations.AutomationsPage.13118faadf', 'Unknown project')
+        const scheduleLabel = formatAutomationSchedule(automation.rrule)
         const nextRunLabel = automation.enabled
           ? formatAutomationDateTimeWithRelative(automation.nextRunAt, relativeNow)
           : translate('auto.components.automations.AutomationsPage.paused', 'Paused')
-        const scheduleLabel = formatAutomationSchedule(automation.rrule)
+        const isSelected = isSelectedLocal && selectedId === automation.id
+        const agentLabel = getAgentLabel(automation.agentId)
+        const hostId =
+          automation.runContext?.hostId ??
+          (automationRepo ? getRepoExecutionHostId(automationRepo) : null)
+        const hostLabel = hostId
+          ? (hostLabelById.get(hostId) ?? getExecutionHostLabel(hostId))
+          : getLocalExecutionHostLabel()
+        const lastRun = lastRunByAutomationId.get(automation.id)
+        const lastRunCost =
+          lastRun?.usage?.status === 'known'
+            ? formatAutomationCost(lastRun.usage.estimatedCostUsd)
+            : formatAutomationCost(null)
+        const agentTooltipLabel = `${agentLabel} · ${hostLabel} · ${lastRunCost}`
+
+        const actionItems = (
+          <>
+            <MenuRunItem
+              disabled={!automationRunAvailability.canRunNow}
+              label={
+                automationRunAvailability.canRunNow
+                  ? translate('auto.components.automations.AutomationsPage.2faecab10b', 'Run Now')
+                  : automationRunAvailability.message
+              }
+              onSelect={() => onRunNow(automation)}
+            />
+            <MenuItem
+              icon={<Pencil className="size-3.5" />}
+              label={translate('auto.components.automations.AutomationsPage.f4612e3f78', 'Edit')}
+              onSelect={() => onEdit(automation)}
+            />
+            <MenuItem
+              icon={
+                automation.enabled ? <Pause className="size-3.5" /> : <Play className="size-3.5" />
+              }
+              label={
+                automation.enabled
+                  ? translate('auto.components.automations.AutomationsPage.b457436d6a', 'Pause')
+                  : translate('auto.components.automations.AutomationsPage.376631ef2b', 'Resume')
+              }
+              onSelect={() => onToggle(automation)}
+            />
+            <MenuSeparator />
+            <MenuItem
+              icon={<Trash2 className="size-3.5" />}
+              label={translate('auto.components.automations.AutomationsPage.15e0bfb13b', 'Delete')}
+              variant="destructive"
+              onSelect={() => onDelete(automation)}
+            />
+          </>
+        )
+
         return (
           <ContextMenu key={automation.id}>
             <ContextMenuTrigger asChild>
-              <button
-                type="button"
-                onClick={() => onSelect(automation.id)}
-                className={cn(
-                  'mb-1 grid w-full grid-cols-[minmax(0,1fr)_auto] gap-3 rounded-md border px-3 py-2 text-left text-sm transition-colors',
-                  isSelectedLocal && selectedId === automation.id
-                    ? 'border-foreground/30 bg-muted/70 text-foreground shadow-sm'
-                    : 'border-transparent hover:bg-muted/50'
-                )}
-              >
-                <span className="min-w-0">
-                  <span className="flex min-w-0 items-center gap-2">
-                    <span
-                      className={cn(
-                        'size-2 rounded-full',
-                        automation.enabled ? 'bg-foreground' : 'bg-muted-foreground/40'
-                      )}
-                    />
-                    <span className="truncate font-medium">{automation.name}</span>
-                  </span>
-                  <span className="mt-1 block truncate text-xs font-medium text-foreground/80">
-                    {scheduleLabel}
-                  </span>
-                  <span className="mt-1 flex min-w-0 items-center gap-1.5 text-xs text-muted-foreground">
-                    {automationRepo ? (
-                      <RepoBadgeLabel
-                        name={automationRepo.displayName}
-                        color={automationRepo.badgeColor}
-                        badgeClassName="size-1.5"
-                      />
-                    ) : (
-                      <span>
-                        {translate(
-                          'auto.components.automations.AutomationsPage.13118faadf',
-                          'Unknown project'
-                        )}
-                      </span>
-                    )}
-                    <span className="shrink-0">/</span>
-                    <span className="truncate">{workspaceLabel}</span>
-                    <span className="shrink-0">·</span>
-                    <span className="truncate">{getAgentLabel(automation.agentId)}</span>
-                  </span>
-                  <span className="mt-1 block truncate text-xs text-muted-foreground">
-                    {usageText}
-                  </span>
-                </span>
-                <span className="flex max-w-28 flex-col items-end gap-1 text-right text-xs text-muted-foreground">
-                  <Clock className="size-3.5" />
-                  <span className="line-clamp-2">{nextRunLabel}</span>
-                </span>
-              </button>
-            </ContextMenuTrigger>
-            <ContextMenuContent className="w-48">
-              <ContextMenuItem
-                disabled={!automationRunAvailability.canRunNow}
-                onSelect={(event) => {
-                  if (!automationRunAvailability.canRunNow) {
-                    event.preventDefault()
+              <div
+                role="button"
+                tabIndex={0}
+                data-current={isSelected ? 'true' : undefined}
+                onClick={(event) => {
+                  // Why: Radix portals menus out of the row DOM, but React still
+                  // bubbles those clicks here — ignore so menu actions don't open detail.
+                  if (isPortaledRowMenuClick(event)) {
                     return
                   }
-                  onRunNow(automation)
+                  onSelect(automation.id)
                 }}
-              >
-                <Play className="size-3.5" />
-                <span className="min-w-0 truncate">
-                  {automationRunAvailability.canRunNow
-                    ? translate('auto.components.automations.AutomationsPage.2faecab10b', 'Run Now')
-                    : automationRunAvailability.message}
-                </span>
-              </ContextMenuItem>
-              <ContextMenuItem onSelect={() => onEdit(automation)}>
-                <Pencil className="size-3.5" />
-                {translate('auto.components.automations.AutomationsPage.f4612e3f78', 'Edit')}
-              </ContextMenuItem>
-              <ContextMenuItem onSelect={() => onToggle(automation)}>
-                {automation.enabled ? (
-                  <Pause className="size-3.5" />
-                ) : (
-                  <Play className="size-3.5" />
+                onKeyDown={(event) => {
+                  if (!isRowActivationKey(event)) {
+                    return
+                  }
+                  event.preventDefault()
+                  onSelect(automation.id)
+                }}
+                className={cn(
+                  AUTOMATIONS_TABLE_GRID_CLASS,
+                  AUTOMATIONS_TABLE_ROW_CLASS,
+                  isSelected && AUTOMATIONS_TABLE_ROW_SELECTED_CLASS
                 )}
-                {automation.enabled
-                  ? translate('auto.components.automations.AutomationsPage.b457436d6a', 'Pause')
-                  : translate('auto.components.automations.AutomationsPage.376631ef2b', 'Resume')}
-              </ContextMenuItem>
-              <ContextMenuSeparator />
-              <ContextMenuItem variant="destructive" onSelect={() => onDelete(automation)}>
-                <Trash2 className="size-3.5" />
-                {translate('auto.components.automations.AutomationsPage.15e0bfb13b', 'Delete')}
-              </ContextMenuItem>
-            </ContextMenuContent>
+              >
+                <span className="min-w-0 truncate font-medium">{automation.name}</span>
+                <span className="min-w-0 truncate text-muted-foreground" title={scheduleLabel}>
+                  {scheduleLabel}
+                </span>
+                <span className="min-w-0 truncate text-muted-foreground" title={projectLabel}>
+                  {projectLabel}
+                </span>
+                <span className="min-w-0 truncate text-muted-foreground" title={nextRunLabel}>
+                  {nextRunLabel}
+                </span>
+                <AutomationListStatusCell enabled={automation.enabled} />
+                <Tooltip>
+                  <TooltipTrigger asChild>
+                    <span
+                      className="flex items-center justify-center text-muted-foreground"
+                      aria-label={agentTooltipLabel}
+                    >
+                      <AgentIcon agent={automation.agentId} size={16} />
+                    </span>
+                  </TooltipTrigger>
+                  <TooltipContent side="top" sideOffset={4}>
+                    {agentTooltipLabel}
+                  </TooltipContent>
+                </Tooltip>
+                <DropdownMenu>
+                  <DropdownMenuTrigger asChild>
+                    <Button
+                      type="button"
+                      variant="ghost"
+                      size="icon-xs"
+                      className="size-7 text-muted-foreground"
+                      aria-label={translate(
+                        'auto.components.automations.AutomationListLocalRows.c92c9463c6',
+                        'Automation actions'
+                      )}
+                      onClick={(event) => event.stopPropagation()}
+                    >
+                      <MoreHorizontal className="size-4" />
+                    </Button>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end" className="w-48">
+                    <DropdownMenuItem
+                      disabled={!automationRunAvailability.canRunNow}
+                      onSelect={() => {
+                        if (automationRunAvailability.canRunNow) {
+                          onRunNow(automation)
+                        }
+                      }}
+                    >
+                      <Play className="size-3.5" />
+                      <span className="min-w-0 truncate">
+                        {automationRunAvailability.canRunNow
+                          ? translate(
+                              'auto.components.automations.AutomationsPage.2faecab10b',
+                              'Run Now'
+                            )
+                          : automationRunAvailability.message}
+                      </span>
+                    </DropdownMenuItem>
+                    <DropdownMenuItem onSelect={() => onEdit(automation)}>
+                      <Pencil className="size-3.5" />
+                      {translate('auto.components.automations.AutomationsPage.f4612e3f78', 'Edit')}
+                    </DropdownMenuItem>
+                    <DropdownMenuItem onSelect={() => onToggle(automation)}>
+                      {automation.enabled ? (
+                        <Pause className="size-3.5" />
+                      ) : (
+                        <Play className="size-3.5" />
+                      )}
+                      {automation.enabled
+                        ? translate(
+                            'auto.components.automations.AutomationsPage.b457436d6a',
+                            'Pause'
+                          )
+                        : translate(
+                            'auto.components.automations.AutomationsPage.376631ef2b',
+                            'Resume'
+                          )}
+                    </DropdownMenuItem>
+                    <DropdownMenuSeparator />
+                    <DropdownMenuItem variant="destructive" onSelect={() => onDelete(automation)}>
+                      <Trash2 className="size-3.5" />
+                      {translate(
+                        'auto.components.automations.AutomationsPage.15e0bfb13b',
+                        'Delete'
+                      )}
+                    </DropdownMenuItem>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              </div>
+            </ContextMenuTrigger>
+            <ContextMenuContent className="w-48">{actionItems}</ContextMenuContent>
           </ContextMenu>
         )
       })}
     </>
   )
 }
+
+function MenuRunItem({
+  disabled,
+  label,
+  onSelect
+}: {
+  disabled: boolean
+  label: string
+  onSelect: () => void
+}): React.JSX.Element {
+  return (
+    <ContextMenuItem
+      disabled={disabled}
+      onSelect={(event) => {
+        if (disabled) {
+          event.preventDefault()
+          return
+        }
+        onSelect()
+      }}
+    >
+      <Play className="size-3.5" />
+      <span className="min-w-0 truncate">{label}</span>
+    </ContextMenuItem>
+  )
+}
+
+function MenuItem({
+  icon,
+  label,
+  onSelect,
+  variant
+}: {
+  icon: React.ReactNode
+  label: string
+  onSelect: () => void
+  variant?: 'destructive'
+}): React.JSX.Element {
+  return (
+    <ContextMenuItem variant={variant} onSelect={onSelect}>
+      {icon}
+      {label}
+    </ContextMenuItem>
+  )
+}
+
+function MenuSeparator(): React.JSX.Element {
+  return <ContextMenuSeparator />
+}
diff --git a/src/renderer/src/components/automations/AutomationListSearchField.tsx b/src/renderer/src/components/automations/AutomationListSearchField.tsx
index d1691a49036..fead100d80e 100644
--- a/src/renderer/src/components/automations/AutomationListSearchField.tsx
+++ b/src/renderer/src/components/automations/AutomationListSearchField.tsx
@@ -34,6 +34,7 @@ export function AutomationListSearchField({
       <Search className="pointer-events-none absolute left-2.5 top-1/2 size-3.5 -translate-y-1/2 text-muted-foreground" />
       <Input
         ref={inputRef}
+        type="text"
         autoFocus
         value={query}
         aria-label={translate(
@@ -42,7 +43,7 @@ export function AutomationListSearchField({
         )}
         placeholder={translate(
           'auto.components.automations.AutomationListSearchField.placeholder',
-          'Search by name, project, or prompt'
+          'Search...'
         )}
         aria-invalid={isTooLarge || undefined}
         aria-describedby={isTooLarge ? 'automations-list-search-too-large' : undefined}
@@ -50,7 +51,8 @@ export function AutomationListSearchField({
         // so the first Escape clears the query without also losing focus.
         data-escape-clears-value={hasText ? 'true' : undefined}
         className={cn(
-          'h-8 border-border/60 bg-background pl-8 text-xs',
+          // Flat list search: no elevation/halo; soft focus border only.
+          'h-8 border-border bg-background pl-8 text-xs shadow-none focus-visible:border-ring/70 focus-visible:ring-0 dark:bg-background',
           hasText && (isTooLarge ? 'pr-20' : 'pr-7')
         )}
         onChange={(event) => onQueryChange(event.target.value)}
diff --git a/src/renderer/src/components/automations/AutomationListStatusCell.tsx b/src/renderer/src/components/automations/AutomationListStatusCell.tsx
new file mode 100644
index 00000000000..b8da08336de
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationListStatusCell.tsx
@@ -0,0 +1,20 @@
+import React from 'react'
+import { X } from 'lucide-react'
+import { translate } from '@/i18n/i18n'
+
+export function AutomationListStatusCell({ enabled }: { enabled: boolean }): React.JSX.Element {
+  if (enabled) {
+    return (
+      <span className="inline-flex min-w-0 items-center gap-1 truncate text-muted-foreground">
+        <span className="size-1.5 shrink-0 rounded-full bg-foreground" />
+        {translate('auto.components.automations.AutomationDetail.eaa02014f8', 'Enabled')}
+      </span>
+    )
+  }
+  return (
+    <span className="inline-flex min-w-0 items-center gap-1 truncate text-muted-foreground">
+      <X className="size-3.5 shrink-0" />
+      {translate('auto.components.automations.AutomationDetail.b09b2384fd', 'Paused')}
+    </span>
+  )
+}
diff --git a/src/renderer/src/components/automations/AutomationProjectCombobox.tsx b/src/renderer/src/components/automations/AutomationProjectCombobox.tsx
index b63bc5821f8..65d0176bf29 100644
--- a/src/renderer/src/components/automations/AutomationProjectCombobox.tsx
+++ b/src/renderer/src/components/automations/AutomationProjectCombobox.tsx
@@ -19,7 +19,7 @@ import {
 } from './automation-project-groups'
 
 type AutomationProjectComboboxProps = {
-  repos: Repo[]
+  repos: readonly Repo[]
   value: string
   onValueChange: (repoId: string) => void
   placeholder?: string
diff --git a/src/renderer/src/components/automations/AutomationSchedulePicker.tsx b/src/renderer/src/components/automations/AutomationSchedulePicker.tsx
index 1f6f6d96ebf..b1dde548163 100644
--- a/src/renderer/src/components/automations/AutomationSchedulePicker.tsx
+++ b/src/renderer/src/components/automations/AutomationSchedulePicker.tsx
@@ -19,6 +19,7 @@ import {
 } from '../../../../shared/automation-schedules'
 import type { AutomationDraft } from './AutomationEditorDialog'
 import { AutomationCustomCronPanel } from './AutomationCustomCronPanel'
+import { AutomationTimeField, parseAutomationTime } from './AutomationTimeField'
 import { Field } from './automation-page-parts'
 import { translate } from '@/i18n/i18n'
 
@@ -49,49 +50,6 @@ const DAY_OPTIONS = [
   ['5', 'Friday'],
   ['6', 'Saturday']
 ] as const
-const HOUR_OPTIONS = Array.from({ length: 12 }, (_, index) => String(index + 1))
-const MINUTE_OPTIONS = Array.from({ length: 60 }, (_, index) => String(index))
-const PERIOD_OPTIONS = ['AM', 'PM'] as const
-
-function parseTime(value: string): { hour: number; minute: number } {
-  const [hour, minute] = value.split(':').map((part) => Number(part))
-  return {
-    hour: Number.isInteger(hour) && hour >= 0 && hour <= 23 ? hour : 9,
-    minute: Number.isInteger(minute) && minute >= 0 && minute <= 59 ? minute : 0
-  }
-}
-
-function formatTimeInput(hour: number, minute: number): string {
-  return `${String(hour).padStart(2, '0')}:${String(minute).padStart(2, '0')}`
-}
-
-function getClockParts(time: string): { hour12: number; minute: number; period: 'AM' | 'PM' } {
-  const { hour, minute } = parseTime(time)
-  return {
-    hour12: hour % 12 === 0 ? 12 : hour % 12,
-    minute,
-    period: hour >= 12 ? 'PM' : 'AM'
-  }
-}
-
-function updateTimePart(
-  time: string,
-  patch: { hour12?: number; minute?: number; period?: 'AM' | 'PM' }
-): string {
-  const current = getClockParts(time)
-  const nextHour12 = patch.hour12 ?? current.hour12
-  const nextPeriod = patch.period ?? current.period
-  const nextMinute = patch.minute ?? current.minute
-  const hour24 =
-    nextPeriod === 'AM'
-      ? nextHour12 === 12
-        ? 0
-        : nextHour12
-      : nextHour12 === 12
-        ? 12
-        : nextHour12 + 12
-  return formatTimeInput(hour24, nextMinute)
-}
 
 function getDraftScheduleLabel(draft: AutomationDraft): string {
   if (draft.preset === 'custom') {
@@ -99,7 +57,7 @@ function getDraftScheduleLabel(draft: AutomationDraft): string {
       ? formatAutomationSchedule(draft.customSchedule)
       : 'Advanced schedule'
   }
-  const { hour, minute } = parseTime(draft.time)
+  const { hour, minute } = parseAutomationTime(draft.time)
   return formatAutomationSchedule(
     buildAutomationRrule({
       preset: draft.preset,
@@ -118,7 +76,7 @@ function buildCustomScheduleSeed(draft: AutomationDraft): string {
   if (draft.preset === 'custom') {
     return ''
   }
-  const { hour, minute } = parseTime(draft.time)
+  const { hour, minute } = parseAutomationTime(draft.time)
   return buildAutomationCronSchedule({
     preset: draft.preset,
     hour,
@@ -151,13 +109,20 @@ export function AutomationSchedulePicker({
 }): React.JSX.Element {
   const [open, setOpen] = React.useState(false)
   const label = getDraftScheduleLabel(draft)
-  const clockParts = getClockParts(draft.time)
   const customSchedule = draft.customSchedule.trim()
   const customScheduleInvalid =
     draft.preset === 'custom' &&
     customSchedule.length > 0 &&
     !validateAdvancedSchedule(customSchedule)
 
+  const setTime = (time: string): void => {
+    onDraftChange((current) => ({
+      ...current,
+      time,
+      scheduleWarning: null
+    }))
+  }
+
   return (
     <Popover open={open} onOpenChange={setOpen}>
       <PopoverTrigger asChild>
@@ -198,7 +163,7 @@ export function AutomationSchedulePicker({
               <SelectTrigger className={cn('w-full min-w-0', FIELD_CONTROL_CLASS)}>
                 <SelectValue />
               </SelectTrigger>
-              <SelectContent>
+              <SelectContent position="popper">
                 {AUTOMATION_SCHEDULE_PRESET_OPTIONS.map(([value, fallbackLabel, labelKey]) => (
                   <SelectItem key={value} value={value}>
                     {getAutomationSchedulePresetLabel([value, fallbackLabel, labelKey])}
@@ -232,7 +197,7 @@ export function AutomationSchedulePicker({
                     <SelectTrigger className={cn('w-full min-w-0', FIELD_CONTROL_CLASS)}>
                       <SelectValue />
                     </SelectTrigger>
-                    <SelectContent>
+                    <SelectContent position="popper">
                       {DAY_OPTIONS.map(([value, dayLabel]) => (
                         <SelectItem key={value} value={value}>
                           {dayLabel}
@@ -249,27 +214,7 @@ export function AutomationSchedulePicker({
                     'Minute'
                   )}
                 >
-                  <Select
-                    value={String(clockParts.minute)}
-                    onValueChange={(minute) =>
-                      onDraftChange((current) => ({
-                        ...current,
-                        time: updateTimePart(current.time, { minute: Number(minute) }),
-                        scheduleWarning: null
-                      }))
-                    }
-                  >
-                    <SelectTrigger className={cn('w-full min-w-0', FIELD_CONTROL_CLASS)}>
-                      <SelectValue />
-                    </SelectTrigger>
-                    <SelectContent>
-                      {MINUTE_OPTIONS.map((minute) => (
-                        <SelectItem key={minute} value={minute}>
-                          :{minute.padStart(2, '0')}
-                        </SelectItem>
-                      ))}
-                    </SelectContent>
-                  </Select>
+                  <AutomationTimeField time={draft.time} mode="minute" onTimeChange={setTime} />
                 </Field>
               ) : (
                 <Field
@@ -278,89 +223,7 @@ export function AutomationSchedulePicker({
                     'Time'
                   )}
                 >
-                  <div className="grid grid-cols-[minmax(0,1fr)_minmax(0,1fr)_minmax(0,0.8fr)] gap-2">
-                    <Select
-                      value={String(clockParts.hour12)}
-                      onValueChange={(hour12) =>
-                        onDraftChange((current) => ({
-                          ...current,
-                          time: updateTimePart(current.time, { hour12: Number(hour12) }),
-                          scheduleWarning: null
-                        }))
-                      }
-                    >
-                      <SelectTrigger
-                        aria-label={translate(
-                          'auto.components.automations.AutomationSchedulePicker.6b802ecc99',
-                          'Hour'
-                        )}
-                        className={cn('w-full min-w-0', FIELD_CONTROL_CLASS)}
-                      >
-                        <SelectValue />
-                      </SelectTrigger>
-                      <SelectContent>
-                        {HOUR_OPTIONS.map((hour) => (
-                          <SelectItem key={hour} value={hour}>
-                            {hour}
-                          </SelectItem>
-                        ))}
-                      </SelectContent>
-                    </Select>
-                    <Select
-                      value={String(clockParts.minute)}
-                      onValueChange={(minute) =>
-                        onDraftChange((current) => ({
-                          ...current,
-                          time: updateTimePart(current.time, { minute: Number(minute) }),
-                          scheduleWarning: null
-                        }))
-                      }
-                    >
-                      <SelectTrigger
-                        aria-label={translate(
-                          'auto.components.automations.AutomationSchedulePicker.9e677335b0',
-                          'Minute'
-                        )}
-                        className={cn('w-full min-w-0', FIELD_CONTROL_CLASS)}
-                      >
-                        <SelectValue />
-                      </SelectTrigger>
-                      <SelectContent>
-                        {MINUTE_OPTIONS.map((minute) => (
-                          <SelectItem key={minute} value={minute}>
-                            {minute.padStart(2, '0')}
-                          </SelectItem>
-                        ))}
-                      </SelectContent>
-                    </Select>
-                    <Select
-                      value={clockParts.period}
-                      onValueChange={(period) =>
-                        onDraftChange((current) => ({
-                          ...current,
-                          time: updateTimePart(current.time, { period: period as 'AM' | 'PM' }),
-                          scheduleWarning: null
-                        }))
-                      }
-                    >
-                      <SelectTrigger
-                        aria-label={translate(
-                          'auto.components.automations.AutomationSchedulePicker.22359b186a',
-                          'AM or PM'
-                        )}
-                        className={cn('w-full min-w-0', FIELD_CONTROL_CLASS)}
-                      >
-                        <SelectValue />
-                      </SelectTrigger>
-                      <SelectContent>
-                        {PERIOD_OPTIONS.map((period) => (
-                          <SelectItem key={period} value={period}>
-                            {period}
-                          </SelectItem>
-                        ))}
-                      </SelectContent>
-                    </Select>
-                  </div>
+                  <AutomationTimeField time={draft.time} mode="time" onTimeChange={setTime} />
                 </Field>
               )}
             </>
diff --git a/src/renderer/src/components/automations/AutomationTimeField.test.tsx b/src/renderer/src/components/automations/AutomationTimeField.test.tsx
new file mode 100644
index 00000000000..d085d41385d
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationTimeField.test.tsx
@@ -0,0 +1,177 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+import React from 'react'
+import { cleanup, render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  AutomationTimeField,
+  formatAutomationTimeFromClockParts,
+  formatAutomationTimeInput,
+  getAutomationClockParts,
+  parseAutomationTime,
+  resolveDigitCommit,
+  resolveDigitStep
+} from './AutomationTimeField'
+
+afterEach(() => {
+  cleanup()
+})
+
+describe('AutomationTimeField helpers', () => {
+  it('parses and formats 24h time values', () => {
+    expect(parseAutomationTime('09:15')).toEqual({ hour: 9, minute: 15 })
+    expect(parseAutomationTime('23:59')).toEqual({ hour: 23, minute: 59 })
+    expect(parseAutomationTime('bad')).toEqual({ hour: 9, minute: 0 })
+    expect(formatAutomationTimeInput(9, 5)).toBe('09:05')
+    expect(formatAutomationTimeInput(0, 0)).toBe('00:00')
+  })
+
+  it('converts between 12h clock parts and 24h storage', () => {
+    expect(getAutomationClockParts('00:05')).toEqual({ hour12: 12, minute: 5, period: 'AM' })
+    expect(getAutomationClockParts('13:30')).toEqual({ hour12: 1, minute: 30, period: 'PM' })
+    expect(getAutomationClockParts('12:00')).toEqual({ hour12: 12, minute: 0, period: 'PM' })
+    expect(formatAutomationTimeFromClockParts({ hour12: 12, minute: 5, period: 'AM' })).toBe(
+      '00:05'
+    )
+    expect(formatAutomationTimeFromClockParts({ hour12: 1, minute: 30, period: 'PM' })).toBe(
+      '13:30'
+    )
+    expect(formatAutomationTimeFromClockParts({ hour12: 12, minute: 0, period: 'PM' })).toBe(
+      '12:00'
+    )
+  })
+
+  it('resolves digit commits with empty → min and range clamp', () => {
+    expect(resolveDigitCommit('', 9, 1, 12)).toBe(1)
+    expect(resolveDigitCommit('', 15, 0, 59)).toBe(0)
+    expect(resolveDigitCommit('9', 1, 1, 12)).toBe(9)
+    expect(resolveDigitCommit('00', 9, 1, 12)).toBe(1)
+    expect(resolveDigitCommit('24', 9, 0, 23)).toBe(23)
+    expect(resolveDigitCommit('99', 15, 0, 59)).toBe(59)
+    expect(resolveDigitCommit('abc', 15, 0, 59)).toBe(15)
+  })
+
+  it('steps from in-progress text rather than only the committed value', () => {
+    expect(resolveDigitStep('1', 9, 1, 12, 1)).toBe(2)
+    // At the min bound, down wraps to max.
+    expect(resolveDigitStep('1', 9, 1, 12, -1)).toBe(12)
+    expect(resolveDigitStep('', 9, 1, 12, 1)).toBe(10)
+    expect(resolveDigitStep('12', 12, 1, 12, 1)).toBe(1)
+    expect(resolveDigitStep('0', 0, 0, 59, -1)).toBe(59)
+  })
+})
+
+function ControlledTimeField({
+  initialTime = '09:15',
+  mode = 'time',
+  onTimeChange
+}: {
+  initialTime?: string
+  mode?: 'time' | 'minute'
+  onTimeChange?: (time: string) => void
+}): React.JSX.Element {
+  const [time, setTime] = React.useState(initialTime)
+  return (
+    <AutomationTimeField
+      time={time}
+      mode={mode}
+      onTimeChange={(next) => {
+        setTime(next)
+        onTimeChange?.(next)
+      }}
+    />
+  )
+}
+
+describe('AutomationTimeField interactions', () => {
+  it('renders a unified 12h field with AM/PM instead of nested selects', () => {
+    render(<ControlledTimeField initialTime="13:15" />)
+
+    expect(screen.getByLabelText('Hour')).toHaveValue('1')
+    expect(screen.getByLabelText('Minute')).toHaveValue('15')
+    expect(screen.getByRole('button', { name: /^AM or PM:/ })).toHaveTextContent('PM')
+    expect(document.querySelector('[data-slot="select"]')).toBeNull()
+  })
+
+  it('names the selected period for assistive technology', async () => {
+    const user = userEvent.setup()
+    render(<ControlledTimeField initialTime="01:15" />)
+
+    const period = screen.getByRole('button', { name: 'AM or PM: AM' })
+    expect(period).toHaveAttribute('aria-pressed', 'false')
+
+    await user.click(period)
+
+    expect(screen.getByRole('button', { name: 'AM or PM: PM' })).toHaveAttribute(
+      'aria-pressed',
+      'true'
+    )
+  })
+
+  it('renders minute-only mode for hourly cadence', () => {
+    render(<ControlledTimeField mode="minute" />)
+
+    expect(screen.getByLabelText('Minute')).toHaveValue('15')
+    expect(screen.queryByLabelText('Hour')).toBeNull()
+    expect(screen.queryByRole('button', { name: /^AM or PM:/ })).toBeNull()
+  })
+
+  it('commits typed hour/minute and toggles AM/PM into 24h storage', async () => {
+    const user = userEvent.setup()
+    const onTimeChange = vi.fn()
+    render(<ControlledTimeField onTimeChange={onTimeChange} />)
+
+    const hour = screen.getByLabelText('Hour')
+    await user.clear(hour)
+    await user.type(hour, '11')
+    expect(onTimeChange).toHaveBeenLastCalledWith('11:15')
+
+    onTimeChange.mockClear()
+    const minute = screen.getByLabelText('Minute')
+    await user.clear(minute)
+    await user.type(minute, '05')
+    expect(onTimeChange).toHaveBeenLastCalledWith('11:05')
+
+    onTimeChange.mockClear()
+    await user.click(screen.getByRole('button', { name: /^AM or PM:/ }))
+    expect(onTimeChange).toHaveBeenLastCalledWith('23:05')
+    expect(screen.getByRole('button', { name: /^AM or PM:/ })).toHaveTextContent('PM')
+  })
+
+  it('treats empty blur as min and does not re-fire after 2-digit auto-commit', async () => {
+    const user = userEvent.setup()
+    const onTimeChange = vi.fn()
+    render(<ControlledTimeField onTimeChange={onTimeChange} />)
+
+    const minute = screen.getByLabelText('Minute')
+    await user.clear(minute)
+    await user.tab()
+    expect(onTimeChange).toHaveBeenLastCalledWith('09:00')
+    expect(minute).toHaveValue('00')
+
+    onTimeChange.mockClear()
+    await user.click(minute)
+    await user.clear(minute)
+    await user.type(minute, '30')
+    // 2-digit entry auto-commits once; blur must not emit a second identical update.
+    const callsAfterType = onTimeChange.mock.calls.length
+    expect(onTimeChange).toHaveBeenLastCalledWith('09:30')
+    await user.tab()
+    expect(onTimeChange.mock.calls.length).toBe(callsAfterType)
+  })
+
+  it('arrow-steps from the in-progress digit, not only the last commit', async () => {
+    const user = userEvent.setup()
+    const onTimeChange = vi.fn()
+    render(<ControlledTimeField onTimeChange={onTimeChange} />)
+
+    const hour = screen.getByLabelText('Hour')
+    await user.clear(hour)
+    await user.type(hour, '1')
+    onTimeChange.mockClear()
+    await user.keyboard('{ArrowUp}')
+    expect(onTimeChange).toHaveBeenLastCalledWith('02:15')
+  })
+})
diff --git a/src/renderer/src/components/automations/AutomationTimeField.tsx b/src/renderer/src/components/automations/AutomationTimeField.tsx
new file mode 100644
index 00000000000..9eb842c170a
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationTimeField.tsx
@@ -0,0 +1,261 @@
+import React from 'react'
+import { Clock } from 'lucide-react'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+
+const TIME_SHELL_CLASS =
+  'flex h-9 w-full items-center gap-2 rounded-md border border-input bg-input/30 px-3 shadow-xs transition-[color,box-shadow] focus-within:border-ring focus-within:ring-[3px] focus-within:ring-ring/50 dark:bg-input/30'
+
+export type AutomationClockParts = {
+  hour12: number
+  minute: number
+  period: 'AM' | 'PM'
+}
+
+export function parseAutomationTime(value: string): { hour: number; minute: number } {
+  const [hour, minute] = value.split(':').map((part) => Number(part))
+  return {
+    hour: Number.isInteger(hour) && hour >= 0 && hour <= 23 ? hour : 9,
+    minute: Number.isInteger(minute) && minute >= 0 && minute <= 59 ? minute : 0
+  }
+}
+
+export function formatAutomationTimeInput(hour: number, minute: number): string {
+  return `${String(hour).padStart(2, '0')}:${String(minute).padStart(2, '0')}`
+}
+
+export function getAutomationClockParts(time: string): AutomationClockParts {
+  const { hour, minute } = parseAutomationTime(time)
+  return {
+    hour12: hour % 12 === 0 ? 12 : hour % 12,
+    minute,
+    period: hour >= 12 ? 'PM' : 'AM'
+  }
+}
+
+export function formatAutomationTimeFromClockParts(parts: AutomationClockParts): string {
+  const hour24 =
+    parts.period === 'AM'
+      ? parts.hour12 === 12
+        ? 0
+        : parts.hour12
+      : parts.hour12 === 12
+        ? 12
+        : parts.hour12 + 12
+  return formatAutomationTimeInput(hour24, parts.minute)
+}
+
+export function clampInt(value: number, min: number, max: number): number {
+  if (!Number.isFinite(value)) {
+    return min
+  }
+  return Math.min(max, Math.max(min, Math.trunc(value)))
+}
+
+/** Resolve typed digits on commit. Empty → min (0 minutes / 1 hour). */
+export function resolveDigitCommit(raw: string, value: number, min: number, max: number): number {
+  const trimmed = raw.trim()
+  if (trimmed === '') {
+    return min
+  }
+  const parsed = Number(trimmed)
+  if (!Number.isFinite(parsed)) {
+    return value
+  }
+  return clampInt(parsed, min, max)
+}
+
+/** Step from in-progress text when present, otherwise the committed value. */
+export function resolveDigitStep(
+  raw: string,
+  value: number,
+  min: number,
+  max: number,
+  delta: 1 | -1
+): number {
+  const trimmed = raw.trim()
+  const parsed = trimmed === '' ? Number.NaN : Number(trimmed)
+  const base = Number.isFinite(parsed) ? clampInt(parsed, min, max) : value
+  if (delta === 1) {
+    return base >= max ? min : base + 1
+  }
+  return base <= min ? max : base - 1
+}
+
+function pad2(value: number): string {
+  return String(value).padStart(2, '0')
+}
+
+function TimeDigitInput({
+  value,
+  min,
+  max,
+  pad = true,
+  ariaLabel,
+  onCommit
+}: {
+  value: number
+  min: number
+  max: number
+  pad?: boolean
+  ariaLabel: string
+  onCommit: (value: number) => void
+}): React.JSX.Element {
+  const [text, setText] = React.useState(pad ? pad2(value) : String(value))
+  const [focused, setFocused] = React.useState(false)
+  // Track last emitted commit so blur after 2-digit auto-commit does not re-fire.
+  const lastCommittedRef = React.useRef(value)
+
+  // Keep the visible digits in sync while the field is not being edited.
+  React.useEffect(() => {
+    lastCommittedRef.current = value
+    if (!focused) {
+      setText(pad ? pad2(value) : String(value))
+    }
+  }, [focused, pad, value])
+
+  const commit = (raw: string): void => {
+    const next = resolveDigitCommit(raw, value, min, max)
+    setText(pad ? pad2(next) : String(next))
+    if (next === lastCommittedRef.current) {
+      return
+    }
+    lastCommittedRef.current = next
+    onCommit(next)
+  }
+
+  return (
+    <input
+      type="text"
+      inputMode="numeric"
+      autoComplete="off"
+      spellCheck={false}
+      aria-label={ariaLabel}
+      value={text}
+      onFocus={(event) => {
+        setFocused(true)
+        event.currentTarget.select()
+      }}
+      onBlur={() => {
+        setFocused(false)
+        commit(text)
+      }}
+      onChange={(event) => {
+        const next = event.target.value.replace(/\D/g, '').slice(0, 2)
+        setText(next)
+        if (next.length === 2) {
+          commit(next)
+        }
+      }}
+      onKeyDown={(event) => {
+        if (event.key === 'ArrowUp' || event.key === 'ArrowDown') {
+          event.preventDefault()
+          const next = resolveDigitStep(text, value, min, max, event.key === 'ArrowUp' ? 1 : -1)
+          setText(pad ? pad2(next) : String(next))
+          if (next !== lastCommittedRef.current) {
+            lastCommittedRef.current = next
+            onCommit(next)
+          }
+          return
+        }
+        if (event.key === 'Enter') {
+          event.currentTarget.blur()
+        }
+      }}
+      className="h-7 w-9 rounded-sm border-0 bg-transparent p-0 text-center text-sm tabular-nums tracking-wide text-foreground outline-none selection:bg-primary/20 focus-visible:bg-accent/50"
+    />
+  )
+}
+
+export function AutomationTimeField({
+  time,
+  mode = 'time',
+  onTimeChange,
+  className
+}: {
+  time: string
+  mode?: 'time' | 'minute'
+  onTimeChange: (time: string) => void
+  className?: string
+}): React.JSX.Element {
+  const clock = getAutomationClockParts(time)
+  // Why: digit commits close over the latest clock parts without stale hour/minute.
+  // Sync in an effect so render stays pure (React Doctor: no ref writes during render).
+  const clockRef = React.useRef(clock)
+  React.useEffect(() => {
+    clockRef.current = getAutomationClockParts(time)
+  }, [time])
+
+  const patchTime = (patch: Partial<AutomationClockParts>): void => {
+    // Why: apply the patch to the ref immediately so a second digit field commit
+    // in the same tick (or before the parent re-renders) cannot clobber the first.
+    const next = { ...clockRef.current, ...patch }
+    clockRef.current = next
+    onTimeChange(formatAutomationTimeFromClockParts(next))
+  }
+
+  return (
+    <div className={cn(TIME_SHELL_CLASS, className)}>
+      <Clock className="size-4 shrink-0 text-muted-foreground" aria-hidden />
+      <div className="flex min-w-0 flex-1 items-center gap-1.5">
+        {mode === 'time' ? (
+          <>
+            <TimeDigitInput
+              value={clock.hour12}
+              min={1}
+              max={12}
+              pad={false}
+              ariaLabel={translate(
+                'auto.components.automations.AutomationTimeField.aa593eb5e2',
+                'Hour'
+              )}
+              onCommit={(hour12) => patchTime({ hour12 })}
+            />
+            <span className="select-none text-sm text-muted-foreground" aria-hidden>
+              :
+            </span>
+            <TimeDigitInput
+              value={clock.minute}
+              min={0}
+              max={59}
+              ariaLabel={translate(
+                'auto.components.automations.AutomationTimeField.32a5e4e35e',
+                'Minute'
+              )}
+              onCommit={(minute) => patchTime({ minute })}
+            />
+            <button
+              type="button"
+              // The label overrides the visible text, so name the current period explicitly.
+              aria-label={`${translate(
+                'auto.components.automations.AutomationTimeField.39ec1383f6',
+                'AM or PM'
+              )}: ${clock.period}`}
+              aria-pressed={clock.period === 'PM'}
+              onClick={() => patchTime({ period: clock.period === 'AM' ? 'PM' : 'AM' })}
+              className="ml-auto h-7 shrink-0 rounded-sm px-2 text-sm font-medium text-muted-foreground outline-none transition-colors hover:bg-accent/60 hover:text-foreground focus-visible:bg-accent/60 focus-visible:text-foreground"
+            >
+              {clock.period}
+            </button>
+          </>
+        ) : (
+          <>
+            <span className="select-none text-sm text-muted-foreground" aria-hidden>
+              :
+            </span>
+            <TimeDigitInput
+              value={clock.minute}
+              min={0}
+              max={59}
+              ariaLabel={translate(
+                'auto.components.automations.AutomationTimeField.32a5e4e35e',
+                'Minute'
+              )}
+              onCommit={(minute) => patchTime({ minute })}
+            />
+          </>
+        )}
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/automations/AutomationsDetailPane.tsx b/src/renderer/src/components/automations/AutomationsDetailPane.tsx
index 1864e085680..48ffceba88f 100644
--- a/src/renderer/src/components/automations/AutomationsDetailPane.tsx
+++ b/src/renderer/src/components/automations/AutomationsDetailPane.tsx
@@ -1,5 +1,5 @@
 import React from 'react'
-import { Eye, RefreshCw } from 'lucide-react'
+import { ArrowLeft, Eye, RefreshCw } from 'lucide-react'
 import { Button } from '@/components/ui/button'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
 import { cn } from '@/lib/utils'
@@ -80,6 +80,7 @@ type AutomationsDetailPaneProps = {
   rerunAutomationRun: (automation: Automation, run: AutomationRun) => void
   openRunWorkspace: (run: AutomationRun) => void
   openAutomationRunPage: (run: AutomationRun) => void
+  onBackToList: () => void
 }
 
 export function AutomationsDetailPane({
@@ -114,12 +115,22 @@ export function AutomationsDetailPane({
   requestDeleteAutomation,
   rerunAutomationRun,
   openRunWorkspace,
-  openAutomationRunPage
+  openAutomationRunPage,
+  onBackToList
 }: AutomationsDetailPaneProps): React.JSX.Element {
   return (
-    <section className="flex min-h-0 flex-col overflow-hidden">
+    <section className="flex min-h-0 flex-1 flex-col overflow-hidden">
       {selectedExternal ? (
-        <div className="scrollbar-sleek min-h-0 overflow-auto p-5">
+        <div className="scrollbar-sleek min-h-0 flex-1 overflow-auto p-5">
+          <div className="mb-3">
+            <Button type="button" variant="ghost" size="sm" onClick={onBackToList}>
+              <ArrowLeft className="size-4" />
+              {translate(
+                'auto.components.automations.AutomationsPage.backToList',
+                'All automations'
+              )}
+            </Button>
+          </div>
           {selectedExternalRunPage ? (
             <AutomationRunPageFrame
               title={selectedExternalRunPage.job.name}
@@ -159,9 +170,21 @@ export function AutomationsDetailPane({
           className="min-h-0 flex-1 gap-0"
         >
           <div
-            className="flex shrink-0 items-center justify-between border-b border-border/50 px-5 py-2"
+            className="flex shrink-0 items-center gap-2 border-b border-border/50 px-5 py-2"
             data-contextual-tour-target="automations-runs"
           >
+            <Button
+              type="button"
+              variant="ghost"
+              size="icon-sm"
+              onClick={onBackToList}
+              aria-label={translate(
+                'auto.components.automations.AutomationsPage.backToList',
+                'All automations'
+              )}
+            >
+              <ArrowLeft className="size-4" />
+            </Button>
             <TabsList variant="line" className="h-8">
               <TabsTrigger value="overview">
                 {translate('auto.components.automations.AutomationsPage.bb1b2cd31e', 'Overview')}
diff --git a/src/renderer/src/components/automations/AutomationsListPanel.tsx b/src/renderer/src/components/automations/AutomationsListPanel.tsx
index 31d9cc9d6d9..e3dd2b3c090 100644
--- a/src/renderer/src/components/automations/AutomationsListPanel.tsx
+++ b/src/renderer/src/components/automations/AutomationsListPanel.tsx
@@ -1,6 +1,8 @@
 import React from 'react'
-import { Plus } from 'lucide-react'
+import { Plus, RefreshCw } from 'lucide-react'
 import { Button } from '@/components/ui/button'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { cn } from '@/lib/utils'
 import type {
   Automation,
   AutomationRun,
@@ -20,6 +22,11 @@ import { getAutomationTemplates, type AutomationTemplate } from './automation-te
 import type { ExternalAutomationListEntry } from './external-automation-list-entries'
 import { AutomationListLocalRows } from './AutomationListLocalRows'
 import { AutomationListExternalRows } from './AutomationListExternalRows'
+import {
+  AUTOMATIONS_TABLE_CONTAINER_CLASS,
+  AUTOMATIONS_TABLE_GRID_CLASS,
+  AUTOMATIONS_TABLE_HEADER_CLASS
+} from './automations-table-layout'
 import { translate } from '@/i18n/i18n'
 
 type AutomationsListPanelProps = {
@@ -31,8 +38,10 @@ type AutomationsListPanelProps = {
   onListSearchQueryChange: (query: string) => void
   filteredAutomations: readonly Automation[]
   filteredExternalAutomationEntries: readonly ExternalAutomationListEntry[]
-  selected: Automation | null
-  selectedExternal: ExternalAutomationListEntry | null
+  // Why: use explicit ids, not resolved detail selection (which falls back to the
+  // first row) — list highlight should only mark a user-chosen row.
+  selectedId: string | null
+  selectedExternalKey: string | null
   runs: readonly AutomationRun[]
   relativeNow: number
   repoMap: ReadonlyMap<string, Repo>
@@ -45,6 +54,7 @@ type AutomationsListPanelProps = {
   >
   automationHostTarget: AutomationHostTarget | null
   automationSourceHostAvailabilityById: ReadonlyMap<string, TaskSourceHostAvailability[]>
+  hostLabelById: ReadonlyMap<string, string>
   externalActionKey: string | null
   selectAutomationId: (automationId: string | null) => void
   selectExternalKey: (externalKey: string | null) => void
@@ -60,6 +70,9 @@ type AutomationsListPanelProps = {
   ) => void
   openEditExternalDialog: (manager: ExternalAutomationManager, job: ExternalAutomationJob) => void
   openCreateDialog: (template?: AutomationTemplate) => void
+  onOpenDetail: () => void
+  onRefresh: () => void
+  isRefreshing: boolean
 }
 
 export function AutomationsListPanel({
@@ -71,8 +84,8 @@ export function AutomationsListPanel({
   onListSearchQueryChange,
   filteredAutomations,
   filteredExternalAutomationEntries,
-  selected,
-  selectedExternal,
+  selectedId,
+  selectedExternalKey,
   runs,
   relativeNow,
   repoMap,
@@ -82,6 +95,7 @@ export function AutomationsListPanel({
   runtimeStatusByEnvironmentId,
   automationHostTarget,
   automationSourceHostAvailabilityById,
+  hostLabelById,
   externalActionKey,
   selectAutomationId,
   selectExternalKey,
@@ -92,81 +106,19 @@ export function AutomationsListPanel({
   requestDeleteAutomation,
   requestExternalAction,
   openEditExternalDialog,
-  openCreateDialog
+  openCreateDialog,
+  onOpenDetail,
+  onRefresh,
+  isRefreshing
 }: AutomationsListPanelProps): React.JSX.Element {
   return (
     <section
-      className="flex min-h-0 flex-col border-r border-border/50 bg-muted/20"
+      className="flex min-h-0 flex-1 flex-col overflow-hidden px-3 pb-4 md:px-5"
       data-contextual-tour-target="automations-list"
     >
-      {hasListItems ? (
-        <div className="shrink-0 border-b border-border/40 px-2 py-2">
-          <AutomationListSearchField
-            query={listSearchQuery}
-            isTooLarge={isListSearchQueryTooLarge}
-            onQueryChange={(query) =>
-              onListSearchQueryChange(clampAutomationListSearchQueryInput(query))
-            }
-            onClear={() => onListSearchQueryChange('')}
-          />
-        </div>
-      ) : null}
-      <div className="scrollbar-sleek min-h-0 flex-1 overflow-auto p-2">
-        {hasFilteredListItems ? (
-          <div className="grid grid-cols-[1fr_auto] gap-2 px-2 pb-2 text-[11px] font-medium uppercase text-muted-foreground">
-            <span>
-              {translate('auto.components.automations.AutomationsPage.761a35834d', 'Automation')}
-            </span>
-            <span>
-              {translate('auto.components.automations.AutomationsPage.587a4b205c', 'Next')}
-            </span>
-          </div>
-        ) : null}
-        <AutomationListLocalRows
-          automations={filteredAutomations}
-          selectedId={selected?.id}
-          isSelectedLocal={selectedExternal === null}
-          runs={runs}
-          relativeNow={relativeNow}
-          repoMap={repoMap}
-          worktreeMap={worktreeMap}
-          projectHostSetups={projectHostSetups}
-          sshConnectionStates={sshConnectionStates}
-          runtimeStatusByEnvironmentId={runtimeStatusByEnvironmentId}
-          automationHostTarget={automationHostTarget}
-          automationSourceHostAvailabilityById={automationSourceHostAvailabilityById}
-          onSelect={(automationId) => {
-            selectExternalKey(null)
-            selectAutomationId(automationId)
-          }}
-          onRunNow={runNow}
-          onEdit={openEditDialog}
-          onToggle={toggleAutomation}
-          onDelete={requestDeleteAutomation}
-        />
-        <AutomationListExternalRows
-          entries={filteredExternalAutomationEntries}
-          selectedExternalKey={selectedExternal?.key}
-          relativeNow={relativeNow}
-          sshConnectionStates={sshConnectionStates}
-          externalActionKey={externalActionKey}
-          onSelect={(entryKey) => {
-            selectExternalKey(entryKey)
-            setActivePaneTab('overview')
-          }}
-          onRequestAction={requestExternalAction}
-          onEdit={openEditExternalDialog}
-        />
-        {hasListItems && isListSearchActive && !hasFilteredListItems ? (
-          <div className="px-3 py-6 text-center text-xs text-muted-foreground">
-            {translate(
-              'auto.components.automations.AutomationsPage.noSearchMatches',
-              'No automations match your search.'
-            )}
-          </div>
-        ) : null}
-        {!hasListItems ? (
-          <div className="grid gap-2 p-2">
+      {!hasListItems ? (
+        <div className="scrollbar-sleek min-h-0 flex-1 overflow-auto">
+          <div className="mx-auto grid max-w-2xl gap-2 p-2 pt-6">
             <div className="px-1 pb-1 text-sm font-medium">
               {translate(
                 'auto.components.automations.AutomationsPage.d207ab4c25',
@@ -199,8 +151,157 @@ export function AutomationsListPanel({
               {translate('auto.components.automations.AutomationsPage.25060635c6', 'Add new')}
             </Button>
           </div>
-        ) : null}
-      </div>
+        </div>
+      ) : (
+        <div className="flex min-h-0 flex-1 flex-col gap-4">
+          <div className="flex shrink-0 items-center justify-between gap-3">
+            <div className="flex min-w-0 items-center gap-2">
+              <AutomationListSearchField
+                query={listSearchQuery}
+                isTooLarge={isListSearchQueryTooLarge}
+                className="w-full max-w-xs"
+                onQueryChange={(query) =>
+                  onListSearchQueryChange(clampAutomationListSearchQueryInput(query))
+                }
+                onClear={() => onListSearchQueryChange('')}
+              />
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <Button
+                    type="button"
+                    variant="ghost"
+                    size="icon-sm"
+                    aria-label={translate(
+                      'auto.components.automations.AutomationsPage.19a6e30eae',
+                      'Refresh automations'
+                    )}
+                    onClick={onRefresh}
+                    disabled={isRefreshing}
+                    className="shrink-0 border border-border bg-background shadow-none hover:bg-muted/50"
+                  >
+                    <RefreshCw className={cn('size-4', isRefreshing && 'animate-spin')} />
+                  </Button>
+                </TooltipTrigger>
+                <TooltipContent side="bottom" sideOffset={6}>
+                  {translate(
+                    'auto.components.automations.AutomationsPage.19a6e30eae',
+                    'Refresh automations'
+                  )}
+                </TooltipContent>
+              </Tooltip>
+            </div>
+            <Button
+              type="button"
+              variant="default"
+              size="sm"
+              className="shrink-0"
+              onClick={() => openCreateDialog()}
+              data-contextual-tour-target="automations-create"
+            >
+              <Plus className="size-4" />
+              {translate(
+                'auto.components.automations.AutomationsPage.newAutomation',
+                'New Automation'
+              )}
+            </Button>
+          </div>
+
+          <div
+            className={cn(
+              'scrollbar-sleek min-h-0 flex-1 overflow-auto',
+              AUTOMATIONS_TABLE_CONTAINER_CLASS
+            )}
+          >
+            {hasFilteredListItems ? (
+              <>
+                <div className={cn(AUTOMATIONS_TABLE_GRID_CLASS, AUTOMATIONS_TABLE_HEADER_CLASS)}>
+                  <span>
+                    {translate('auto.components.automations.AutomationsPage.tableName', 'Name')}
+                  </span>
+                  <span>
+                    {translate(
+                      'auto.components.automations.AutomationDetail.18763ded26',
+                      'Schedule'
+                    )}
+                  </span>
+                  <span>
+                    {translate(
+                      'auto.components.automations.AutomationsPage.tableProject',
+                      'Project'
+                    )}
+                  </span>
+                  <span>
+                    {translate(
+                      'auto.components.automations.AutomationDetail.578ff46987',
+                      'Next run'
+                    )}
+                  </span>
+                  <span>
+                    {translate('auto.components.automations.AutomationsPage.tableStatus', 'Status')}
+                  </span>
+                  <span className="text-center">
+                    {translate('auto.components.automations.AutomationDetail.2df8970cd5', 'Agent')}
+                  </span>
+                  <span className="sr-only">
+                    {translate(
+                      'auto.components.automations.AutomationsPage.tableActions',
+                      'Actions'
+                    )}
+                  </span>
+                </div>
+                <div className="divide-y divide-border/50">
+                  <AutomationListLocalRows
+                    automations={filteredAutomations}
+                    selectedId={selectedId}
+                    isSelectedLocal={selectedExternalKey === null}
+                    runs={runs}
+                    relativeNow={relativeNow}
+                    repoMap={repoMap}
+                    worktreeMap={worktreeMap}
+                    projectHostSetups={projectHostSetups}
+                    sshConnectionStates={sshConnectionStates}
+                    runtimeStatusByEnvironmentId={runtimeStatusByEnvironmentId}
+                    automationHostTarget={automationHostTarget}
+                    automationSourceHostAvailabilityById={automationSourceHostAvailabilityById}
+                    hostLabelById={hostLabelById}
+                    onSelect={(automationId) => {
+                      selectExternalKey(null)
+                      selectAutomationId(automationId)
+                      onOpenDetail()
+                    }}
+                    onRunNow={runNow}
+                    onEdit={openEditDialog}
+                    onToggle={toggleAutomation}
+                    onDelete={requestDeleteAutomation}
+                  />
+                  <AutomationListExternalRows
+                    entries={filteredExternalAutomationEntries}
+                    selectedExternalKey={selectedExternalKey}
+                    relativeNow={relativeNow}
+                    sshConnectionStates={sshConnectionStates}
+                    externalActionKey={externalActionKey}
+                    onSelect={(entryKey) => {
+                      selectAutomationId(null)
+                      selectExternalKey(entryKey)
+                      setActivePaneTab('overview')
+                      onOpenDetail()
+                    }}
+                    onRequestAction={requestExternalAction}
+                    onEdit={openEditExternalDialog}
+                  />
+                </div>
+              </>
+            ) : isListSearchActive ? (
+              <div className="px-3 py-6 text-center text-sm text-muted-foreground">
+                {translate(
+                  'auto.components.automations.AutomationsPage.noSearchMatches',
+                  'No automations match your search.'
+                )}
+              </div>
+            ) : null}
+          </div>
+        </div>
+      )}
     </section>
   )
 }
diff --git a/src/renderer/src/components/automations/AutomationsPage.tsx b/src/renderer/src/components/automations/AutomationsPage.tsx
index 7293b79ad22..c52126ad670 100644
--- a/src/renderer/src/components/automations/AutomationsPage.tsx
+++ b/src/renderer/src/components/automations/AutomationsPage.tsx
@@ -1,16 +1,12 @@
 /* eslint-disable max-lines -- Why: this page owns the automations list/detail
  * orchestration while the form, list, and detail presentation live in sibling files. */
 import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { CalendarClock, Plus, RefreshCw, X } from 'lucide-react'
 import { toast } from 'sonner'
 import { filterEnabledTuiAgents, isTuiAgentEnabled } from '../../../../shared/tui-agent-selection'
-import { Button } from '@/components/ui/button'
 import { installWindowVisibilityInterval } from '@/lib/window-visibility-interval'
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import { useAppStore } from '@/store'
 import { callRuntimeRpc } from '@/runtime/runtime-rpc-client'
 import { getLocalPreflightContext, localPreflightContextKey } from '@/lib/local-preflight-context'
-import { cn } from '@/lib/utils'
 import { getAgentCatalog } from '@/lib/agent-catalog'
 import { useRepoMap, useWorktreeMap } from '@/store/selectors'
 import { activateAndRevealWorktree } from '@/lib/worktree-activation'
@@ -108,10 +104,12 @@ import {
   isMissingExternalRunsApiError
 } from './external-automation-display'
 import { buildExternalAutomationListEntries } from './external-automation-list-entries'
+import { shouldCloseDetailForLostSelection } from './automation-detail-selection'
 import { useAutomationListSearch } from './use-automation-list-search'
 import { AutomationDeleteDialog, ExternalAutomationDeleteDialog } from './AutomationDeleteDialogs'
 import { AutomationsListPanel } from './AutomationsListPanel'
 import { AutomationsDetailPane } from './AutomationsDetailPane'
+import { AutomationsPageSkeleton } from './AutomationsPageSkeleton'
 import { useContextualTour } from '@/components/contextual-tours/use-contextual-tour'
 import { translate } from '@/i18n/i18n'
 
@@ -186,6 +184,17 @@ export default function AutomationsPage(): React.JSX.Element {
   const [selectedExternalKey, setSelectedExternalKey] = useState<string | null>(null)
   const [selectedExternalRunPage, setSelectedExternalRunPage] =
     useState<SelectedExternalRunPage | null>(null)
+  // Why: list is the primary surface; detail is a full-page drill-in, not a side pane.
+  const [isDetailOpen, setIsDetailOpen] = useState(false)
+  const selectedExternalKeyRef = useRef<string | null>(null)
+  const isDetailOpenRef = useRef(false)
+  // Keep async refresh/delete handlers reading the latest selection without render-time mutation.
+  useEffect(() => {
+    selectedExternalKeyRef.current = selectedExternalKey
+  }, [selectedExternalKey])
+  useEffect(() => {
+    isDetailOpenRef.current = isDetailOpen
+  }, [isDetailOpen])
   const runtimePreflightMountedRef = useRef(true)
   const runtimePreflightRequestedHostIdsRef = useRef<Set<TaskSourceContext['hostId']>>(new Set())
   const [runtimePreflightStatusByHostId, setRuntimePreflightStatusByHostId] = useState<
@@ -210,7 +219,7 @@ export default function AutomationsPage(): React.JSX.Element {
   } | null>(null)
   useContextualTour(
     'automations',
-    !createOpen && !deleteTarget && !externalDeleteTarget,
+    !isLoading && !createOpen && !deleteTarget && !externalDeleteTarget,
     'automations_open'
   )
   const [editingExternalTarget, setEditingExternalTarget] = useState<{
@@ -346,7 +355,7 @@ export default function AutomationsPage(): React.JSX.Element {
   const loadAutomationYamlHooksForRepo = useCallback(
     async (repoId: string): Promise<OrcaHooks | null> => {
       const key = getAutomationHooksCacheKey(repoId)
-      if (Object.prototype.hasOwnProperty.call(automationYamlHooksByRepoKey, key)) {
+      if (Object.hasOwn(automationYamlHooksByRepoKey, key)) {
         return automationYamlHooksByRepoKey[key] ?? null
       }
       const existingPromise = automationHookCheckPromisesRef.current.get(key)
@@ -367,7 +376,7 @@ export default function AutomationsPage(): React.JSX.Element {
         return hooks
       }
       setAutomationYamlHooksByRepoKey((current) =>
-        Object.prototype.hasOwnProperty.call(current, key) ? current : { ...current, [key]: hooks }
+        Object.hasOwn(current, key) ? current : { ...current, [key]: hooks }
       )
       return hooks
     },
@@ -429,6 +438,11 @@ export default function AutomationsPage(): React.JSX.Element {
     const pendingAutomation = automations.find(
       (automation) => automation.id === pending.automationId
     )
+    // Why: external selection wins over local in detail resolution; clear it so
+    // pending local navigation cannot open the wrong automation.
+    if (selectedExternalKey !== null) {
+      selectExternalKey(null)
+    }
     if (!pendingAutomation) {
       // Why: stale provenance should not silently select the first automation.
       setSelectedId(pending.automationId)
@@ -444,9 +458,11 @@ export default function AutomationsPage(): React.JSX.Element {
     }
     if (selectedId !== pending.automationId) {
       setSelectedId(pending.automationId)
+      setIsDetailOpen(true)
       return
     }
     if (!pending.runId) {
+      setIsDetailOpen(true)
       setActivePaneTab('overview')
       setSelectedAutomationRunPageId(null)
       setPendingAutomationRunNavigation(null)
@@ -455,6 +471,7 @@ export default function AutomationsPage(): React.JSX.Element {
     if (selectedAutomationRuns.automationId !== pending.automationId) {
       return
     }
+    setIsDetailOpen(true)
     setActivePaneTab('runs')
     const pendingRun = selectedRuns.find((run) => run.id === pending.runId)
     if (pendingRun) {
@@ -475,7 +492,9 @@ export default function AutomationsPage(): React.JSX.Element {
     automationHostTargetKey,
     isLoading,
     pendingAutomationRunNavigation,
+    selectExternalKey,
     selectedAutomationRuns.automationId,
+    selectedExternalKey,
     selectedId,
     selectedRuns,
     setPendingAutomationRunNavigation,
@@ -761,6 +780,21 @@ export default function AutomationsPage(): React.JSX.Element {
       setExternalManagers(nextExternalManagers)
       if (!hasCurrentSelection && !pendingNavigation) {
         selectAutomationId(nextAutomations[0]?.id ?? null)
+        if (
+          shouldCloseDetailForLostSelection({
+            isDetailOpen: isDetailOpenRef.current,
+            hasPendingNavigation: false,
+            isSelectedAutomationInNextList: false,
+            isSelectedExternalInNextList: buildExternalAutomationListEntries(
+              nextExternalManagers
+            ).some((entry) => entry.key === selectedExternalKeyRef.current)
+          })
+        ) {
+          setIsDetailOpen(false)
+          setSelectedAutomationRunPageId(null)
+          setSelectedExternalRunPage(null)
+          setActivePaneTab('overview')
+        }
       }
     } finally {
       setIsLoading(false)
@@ -1468,6 +1502,9 @@ export default function AutomationsPage(): React.JSX.Element {
     await deleteAutomationForTarget(automation, automationHostTarget)
     if (useAppStore.getState().selectedAutomationId === automation.id) {
       selectAutomationId(null)
+      setIsDetailOpen(false)
+      setSelectedAutomationRunPageId(null)
+      setActivePaneTab('overview')
     }
     await refresh()
   }
@@ -1608,6 +1645,16 @@ export default function AutomationsPage(): React.JSX.Element {
         useAppStore.getState().recordFeatureInteraction('automation-run')
       }
       await refresh()
+      // Why: full-page detail keeps selection when the deleted external was open;
+      // without this, detail can fall through to an unrelated local automation.
+      if (action === 'delete') {
+        const deletedKey = getExternalAutomationKey(manager, job)
+        if (selectedExternalKeyRef.current === deletedKey) {
+          selectExternalKey(null)
+          setIsDetailOpen(false)
+          setActivePaneTab('overview')
+        }
+      }
       toast.success(
         action === 'delete'
           ? translate(
@@ -1800,91 +1847,53 @@ export default function AutomationsPage(): React.JSX.Element {
         return
       }
 
+      // Why: detail is a full-page drill-in; step out of nested run views first,
+      // then return to the table before leaving Automations.
+      if (isDetailOpen) {
+        event.preventDefault()
+        if (selectedExternalRunPage) {
+          setSelectedExternalRunPage(null)
+          return
+        }
+        if (selectedAutomationRunPageId) {
+          setSelectedAutomationRunPageId(null)
+          return
+        }
+        setIsDetailOpen(false)
+        setActivePaneTab('overview')
+        return
+      }
+
       event.preventDefault()
       closeAutomationsPage()
     }
 
     window.addEventListener('keydown', onKeyDown, { capture: true })
     return () => window.removeEventListener('keydown', onKeyDown, { capture: true })
-  }, [closeAutomationsPage, createOpen, deleteTarget, externalDeleteTarget])
+  }, [
+    closeAutomationsPage,
+    createOpen,
+    deleteTarget,
+    externalDeleteTarget,
+    isDetailOpen,
+    selectedAutomationRunPageId,
+    selectedExternalRunPage
+  ])
 
   return (
-    <main className="relative flex h-full min-h-0 flex-col bg-background text-foreground">
-      <header className="flex shrink-0 items-center justify-between px-5 pb-3 pt-1.5 md:px-8">
-        <div className="flex items-center gap-2">
-          <Tooltip>
-            <TooltipTrigger asChild>
-              <Button
-                variant="ghost"
-                size="icon"
-                className="size-7 rounded-full"
-                onClick={closeAutomationsPage}
-                aria-label={translate(
-                  'auto.components.automations.AutomationsPage.67c7ff795b',
-                  'Close automations'
-                )}
-              >
-                <X className="size-4" />
-              </Button>
-            </TooltipTrigger>
-            <TooltipContent side="bottom" sideOffset={6}>
-              {translate('auto.components.automations.AutomationsPage.0329f9bef1', 'Close · Esc')}
-            </TooltipContent>
-          </Tooltip>
-          <div className="mx-1 h-5 w-px bg-border/50" aria-hidden />
-          <CalendarClock className="size-4 text-muted-foreground" />
-          <h1 className="text-sm font-semibold">
-            {translate('auto.components.automations.AutomationsPage.77c2778945', 'Automations')}
-          </h1>
-          <Tooltip>
-            <TooltipTrigger asChild>
-              <Button
-                variant="ghost"
-                size="icon-sm"
-                aria-label={translate(
-                  'auto.components.automations.AutomationsPage.8d1afa8269',
-                  'Add automation'
-                )}
-                onClick={() => openCreateDialog()}
-                className="border border-border/50 bg-transparent hover:bg-muted/50"
-                data-contextual-tour-target="automations-create"
-              >
-                <Plus className="size-4" />
-              </Button>
-            </TooltipTrigger>
-            <TooltipContent side="bottom" sideOffset={6}>
-              {translate(
-                'auto.components.automations.AutomationsPage.8d1afa8269',
-                'Add automation'
-              )}
-            </TooltipContent>
-          </Tooltip>
-        </div>
-        <div className="flex items-center gap-2">
-          <Tooltip>
-            <TooltipTrigger asChild>
-              <Button
-                variant="ghost"
-                size="icon-sm"
-                aria-label={translate(
-                  'auto.components.automations.AutomationsPage.19a6e30eae',
-                  'Refresh automations'
-                )}
-                onClick={refresh}
-                disabled={isLoading}
-                className="border border-border/50 bg-transparent hover:bg-muted/50"
-              >
-                <RefreshCw className={cn('size-4', isLoading && 'animate-spin')} />
-              </Button>
-            </TooltipTrigger>
-            <TooltipContent side="bottom" sideOffset={6}>
-              {translate(
-                'auto.components.automations.AutomationsPage.19a6e30eae',
-                'Refresh automations'
-              )}
-            </TooltipContent>
-          </Tooltip>
-        </div>
+    <main className="relative flex h-full min-h-0 flex-col bg-background pt-5 text-foreground md:pt-6">
+      <header
+        className="flex shrink-0 items-center px-3 pb-3 md:px-5"
+        // Why: no stacked center titlebar on this page; keep the title clear of Windows/Linux window controls.
+        style={
+          {
+            paddingRight: 'max(0.75rem, var(--window-controls-width, 0px))'
+          } as React.CSSProperties
+        }
+      >
+        <h1 className="truncate text-base font-semibold leading-8">
+          {translate('auto.components.automations.AutomationsPage.77c2778945', 'Automations')}
+        </h1>
       </header>
 
       <AutomationEditorDialog
@@ -1943,40 +1952,10 @@ export default function AutomationsPage(): React.JSX.Element {
         onConfirm={() => void confirmDeleteExternalAutomation()}
       />
 
-      <div className="grid min-h-0 flex-1 grid-cols-[minmax(280px,360px)_1fr] overflow-hidden border-t border-border/50">
-        <AutomationsListPanel
-          hasListItems={hasListItems}
-          hasFilteredListItems={hasFilteredListItems}
-          isListSearchActive={isListSearchActive}
-          listSearchQuery={listSearchQuery}
-          isListSearchQueryTooLarge={isListSearchQueryTooLarge}
-          onListSearchQueryChange={setListSearchQuery}
-          filteredAutomations={filteredAutomations}
-          filteredExternalAutomationEntries={filteredExternalAutomationEntries}
-          selected={selected}
-          selectedExternal={selectedExternal}
-          runs={runs}
-          relativeNow={relativeNow}
-          repoMap={repoMap}
-          worktreeMap={worktreeMap}
-          projectHostSetups={projectHostSetups}
-          sshConnectionStates={sshConnectionStates}
-          runtimeStatusByEnvironmentId={runtimeStatusByEnvironmentId}
-          automationHostTarget={automationHostTarget}
-          automationSourceHostAvailabilityById={automationSourceHostAvailabilityById}
-          externalActionKey={externalActionKey}
-          selectAutomationId={selectAutomationId}
-          selectExternalKey={selectExternalKey}
-          setActivePaneTab={setActivePaneTab}
-          runNow={(automation) => void runNow(automation)}
-          openEditDialog={(automation) => void openEditDialog(automation)}
-          toggleAutomation={(automation) => void toggleAutomation(automation)}
-          requestDeleteAutomation={requestDeleteAutomation}
-          requestExternalAction={requestExternalAction}
-          openEditExternalDialog={openEditExternalDialog}
-          openCreateDialog={openCreateDialog}
-        />
-
+      {/* Why: empty list flashes templates before data arrives; keep layout stable on first load. */}
+      {isLoading && !hasListItems ? (
+        <AutomationsPageSkeleton />
+      ) : isDetailOpen && (selected || selectedExternal) ? (
         <AutomationsDetailPane
           selected={selected}
           selectedExternal={selectedExternal}
@@ -2024,8 +2003,51 @@ export default function AutomationsPage(): React.JSX.Element {
           rerunAutomationRun={(automation, run) => void rerunAutomationRun(automation, run)}
           openRunWorkspace={openRunWorkspace}
           openAutomationRunPage={openAutomationRunPage}
+          onBackToList={() => {
+            setIsDetailOpen(false)
+            setSelectedAutomationRunPageId(null)
+            setSelectedExternalRunPage(null)
+            setActivePaneTab('overview')
+          }}
         />
-      </div>
+      ) : (
+        <AutomationsListPanel
+          hasListItems={hasListItems}
+          hasFilteredListItems={hasFilteredListItems}
+          isListSearchActive={isListSearchActive}
+          listSearchQuery={listSearchQuery}
+          isListSearchQueryTooLarge={isListSearchQueryTooLarge}
+          onListSearchQueryChange={setListSearchQuery}
+          filteredAutomations={filteredAutomations}
+          filteredExternalAutomationEntries={filteredExternalAutomationEntries}
+          selectedId={selectedId}
+          selectedExternalKey={selectedExternalKey}
+          runs={runs}
+          relativeNow={relativeNow}
+          repoMap={repoMap}
+          worktreeMap={worktreeMap}
+          projectHostSetups={projectHostSetups}
+          sshConnectionStates={sshConnectionStates}
+          runtimeStatusByEnvironmentId={runtimeStatusByEnvironmentId}
+          automationHostTarget={automationHostTarget}
+          automationSourceHostAvailabilityById={automationSourceHostAvailabilityById}
+          hostLabelById={hostLabelById}
+          externalActionKey={externalActionKey}
+          selectAutomationId={selectAutomationId}
+          selectExternalKey={selectExternalKey}
+          setActivePaneTab={setActivePaneTab}
+          runNow={(automation) => void runNow(automation)}
+          openEditDialog={(automation) => void openEditDialog(automation)}
+          toggleAutomation={(automation) => void toggleAutomation(automation)}
+          requestDeleteAutomation={requestDeleteAutomation}
+          requestExternalAction={requestExternalAction}
+          openEditExternalDialog={openEditExternalDialog}
+          openCreateDialog={openCreateDialog}
+          onOpenDetail={() => setIsDetailOpen(true)}
+          onRefresh={() => void refresh()}
+          isRefreshing={isLoading}
+        />
+      )}
     </main>
   )
 }
diff --git a/src/renderer/src/components/automations/AutomationsPageSkeleton.tsx b/src/renderer/src/components/automations/AutomationsPageSkeleton.tsx
new file mode 100644
index 00000000000..b8de919f1cc
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationsPageSkeleton.tsx
@@ -0,0 +1,129 @@
+import React from 'react'
+import { cn } from '@/lib/utils'
+import {
+  AUTOMATIONS_TABLE_CONTAINER_CLASS,
+  AUTOMATIONS_TABLE_GRID_CLASS,
+  AUTOMATIONS_TABLE_HEADER_CLASS
+} from './automations-table-layout'
+import { translate } from '@/i18n/i18n'
+
+function SkeletonBar({ className }: { className?: string }): React.JSX.Element {
+  return <div className={cn('animate-pulse rounded bg-muted/60', className)} />
+}
+
+function TableRowSkeleton({
+  nameWidthClass,
+  scheduleWidthClass,
+  projectWidthClass,
+  nextWidthClass,
+  statusWidthClass
+}: {
+  nameWidthClass: string
+  scheduleWidthClass: string
+  projectWidthClass: string
+  nextWidthClass: string
+  statusWidthClass: string
+}): React.JSX.Element {
+  return (
+    <div className={cn(AUTOMATIONS_TABLE_GRID_CLASS, 'min-h-11 items-center gap-3 px-3 py-3')}>
+      <SkeletonBar className={cn('h-3.5', nameWidthClass)} />
+      <SkeletonBar className={cn('h-3.5', scheduleWidthClass)} />
+      <SkeletonBar className={cn('h-3.5', projectWidthClass)} />
+      <SkeletonBar className={cn('h-3.5', nextWidthClass)} />
+      <SkeletonBar className={cn('h-3.5', statusWidthClass)} />
+      <SkeletonBar className="mx-auto size-4 rounded" />
+      <SkeletonBar className="size-6 rounded-md" />
+    </div>
+  )
+}
+
+const TABLE_ROW_SKELETONS = [
+  {
+    id: 'row-1',
+    nameWidthClass: 'w-28',
+    scheduleWidthClass: 'w-36',
+    projectWidthClass: 'w-28',
+    nextWidthClass: 'w-24',
+    statusWidthClass: 'w-16'
+  },
+  {
+    id: 'row-2',
+    nameWidthClass: 'w-36',
+    scheduleWidthClass: 'w-28',
+    projectWidthClass: 'w-32',
+    nextWidthClass: 'w-20',
+    statusWidthClass: 'w-14'
+  },
+  {
+    id: 'row-3',
+    nameWidthClass: 'w-24',
+    scheduleWidthClass: 'w-40',
+    projectWidthClass: 'w-24',
+    nextWidthClass: 'w-28',
+    statusWidthClass: 'w-16'
+  },
+  {
+    id: 'row-4',
+    nameWidthClass: 'w-32',
+    scheduleWidthClass: 'w-32',
+    projectWidthClass: 'w-36',
+    nextWidthClass: 'w-24',
+    statusWidthClass: 'w-14'
+  },
+  {
+    id: 'row-5',
+    nameWidthClass: 'w-40',
+    scheduleWidthClass: 'w-24',
+    projectWidthClass: 'w-28',
+    nextWidthClass: 'w-20',
+    statusWidthClass: 'w-16'
+  },
+  {
+    id: 'row-6',
+    nameWidthClass: 'w-28',
+    scheduleWidthClass: 'w-36',
+    projectWidthClass: 'w-20',
+    nextWidthClass: 'w-24',
+    statusWidthClass: 'w-14'
+  }
+] as const
+
+export function AutomationsPageSkeleton(): React.JSX.Element {
+  return (
+    <div
+      className="flex min-h-0 flex-1 flex-col gap-4 overflow-hidden px-3 pb-4 md:px-5"
+      aria-busy="true"
+      aria-label={translate(
+        'auto.components.automations.AutomationsPageSkeleton.55527b7bcf',
+        'Loading automations'
+      )}
+    >
+      <div className="flex shrink-0 items-center justify-between gap-3">
+        <div className="flex min-w-0 items-center gap-2">
+          <SkeletonBar className="h-8 w-full max-w-xs rounded-md" />
+          <SkeletonBar className="size-8 shrink-0 rounded-md" />
+        </div>
+        <SkeletonBar className="h-8 w-32 shrink-0 rounded-md" />
+      </div>
+      <div
+        className={cn('min-h-0 flex-1 overflow-hidden', AUTOMATIONS_TABLE_CONTAINER_CLASS)}
+        data-contextual-fix-target="automations-list"
+      >
+        <div className={cn(AUTOMATIONS_TABLE_GRID_CLASS, AUTOMATIONS_TABLE_HEADER_CLASS)}>
+          <SkeletonBar className="h-2.5 w-12" />
+          <SkeletonBar className="h-2.5 w-14" />
+          <SkeletonBar className="h-2.5 w-14" />
+          <SkeletonBar className="h-2.5 w-16" />
+          <SkeletonBar className="h-2.5 w-12" />
+          <SkeletonBar className="mx-auto h-2.5 w-10" />
+          <span />
+        </div>
+        <div className="divide-y divide-border/50">
+          {TABLE_ROW_SKELETONS.map(({ id, ...row }) => (
+            <TableRowSkeleton key={id} {...row} />
+          ))}
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/automations/automation-detail-selection.test.ts b/src/renderer/src/components/automations/automation-detail-selection.test.ts
new file mode 100644
index 00000000000..8dea844ea15
--- /dev/null
+++ b/src/renderer/src/components/automations/automation-detail-selection.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest'
+import { shouldCloseDetailForLostSelection } from './automation-detail-selection'
+
+const base = {
+  isDetailOpen: true,
+  hasPendingNavigation: false,
+  isSelectedAutomationInNextList: false,
+  isSelectedExternalInNextList: false
+}
+
+describe('shouldCloseDetailForLostSelection', () => {
+  it('closes detail when the refreshed list no longer contains the selection', () => {
+    expect(shouldCloseDetailForLostSelection(base)).toBe(true)
+  })
+
+  it('keeps detail open when the selected automation survived the refresh', () => {
+    expect(
+      shouldCloseDetailForLostSelection({ ...base, isSelectedAutomationInNextList: true })
+    ).toBe(false)
+  })
+
+  it('keeps detail open when the selected external automation survived the refresh', () => {
+    expect(shouldCloseDetailForLostSelection({ ...base, isSelectedExternalInNextList: true })).toBe(
+      false
+    )
+  })
+
+  it('keeps detail open when a pending run navigation will re-open it', () => {
+    expect(shouldCloseDetailForLostSelection({ ...base, hasPendingNavigation: true })).toBe(false)
+  })
+
+  it('does nothing when detail is already closed', () => {
+    expect(shouldCloseDetailForLostSelection({ ...base, isDetailOpen: false })).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/automations/automation-detail-selection.ts b/src/renderer/src/components/automations/automation-detail-selection.ts
new file mode 100644
index 00000000000..ce3487ee058
--- /dev/null
+++ b/src/renderer/src/components/automations/automation-detail-selection.ts
@@ -0,0 +1,20 @@
+/**
+ * True when a refresh dropped every selected automation while full-page detail is open —
+ * without closing, detail silently re-renders whichever automation the list now sorts first.
+ */
+export function shouldCloseDetailForLostSelection({
+  isDetailOpen,
+  hasPendingNavigation,
+  isSelectedAutomationInNextList,
+  isSelectedExternalInNextList
+}: {
+  isDetailOpen: boolean
+  hasPendingNavigation: boolean
+  isSelectedAutomationInNextList: boolean
+  isSelectedExternalInNextList: boolean
+}): boolean {
+  if (!isDetailOpen || hasPendingNavigation) {
+    return false
+  }
+  return !isSelectedAutomationInNextList && !isSelectedExternalInNextList
+}
diff --git a/src/renderer/src/components/automations/automation-draft-model.ts b/src/renderer/src/components/automations/automation-draft-model.ts
index 747bc615782..2abf4511388 100644
--- a/src/renderer/src/components/automations/automation-draft-model.ts
+++ b/src/renderer/src/components/automations/automation-draft-model.ts
@@ -17,8 +17,8 @@ export function formatTimeInput(hour: number, minute: number): string {
 export function parseDraftTime(time: string): { hour: number; minute: number } {
   const [rawHour, rawMinute] = time.split(':').map((part) => Number(part))
   return {
-    hour: Number.isFinite(rawHour) ? rawHour : 9,
-    minute: Number.isFinite(rawMinute) ? rawMinute : 0
+    hour: Number.isInteger(rawHour) && rawHour >= 0 && rawHour <= 23 ? rawHour : 9,
+    minute: Number.isInteger(rawMinute) && rawMinute >= 0 && rawMinute <= 59 ? rawMinute : 0
   }
 }
 
diff --git a/src/renderer/src/components/automations/automation-list-row-interaction.test.ts b/src/renderer/src/components/automations/automation-list-row-interaction.test.ts
new file mode 100644
index 00000000000..5e0703c174f
--- /dev/null
+++ b/src/renderer/src/components/automations/automation-list-row-interaction.test.ts
@@ -0,0 +1,54 @@
+// @vitest-environment happy-dom
+
+import { describe, expect, it } from 'vitest'
+import { isPortaledRowMenuClick, isRowActivationKey } from './automation-list-row-interaction'
+
+describe('isPortaledRowMenuClick', () => {
+  it('detects clicks whose target is outside the row DOM', () => {
+    const row = document.createElement('div')
+    const portaledMenuItem = document.createElement('div')
+    document.body.append(row, portaledMenuItem)
+
+    expect(
+      isPortaledRowMenuClick({
+        target: portaledMenuItem,
+        currentTarget: row
+      })
+    ).toBe(true)
+
+    row.remove()
+    portaledMenuItem.remove()
+  })
+
+  it('allows in-row clicks', () => {
+    const row = document.createElement('div')
+    const child = document.createElement('span')
+    row.append(child)
+
+    expect(
+      isPortaledRowMenuClick({
+        target: child,
+        currentTarget: row
+      })
+    ).toBe(false)
+  })
+})
+
+describe('isRowActivationKey', () => {
+  it('accepts Enter and Space on the row itself', () => {
+    const row = document.createElement('div')
+
+    expect(isRowActivationKey({ key: 'Enter', target: row, currentTarget: row })).toBe(true)
+    expect(isRowActivationKey({ key: ' ', target: row, currentTarget: row })).toBe(true)
+    expect(isRowActivationKey({ key: 'a', target: row, currentTarget: row })).toBe(false)
+  })
+
+  it('ignores keys pressed on a nested control', () => {
+    const row = document.createElement('div')
+    const trigger = document.createElement('button')
+    row.append(trigger)
+
+    expect(isRowActivationKey({ key: 'Enter', target: trigger, currentTarget: row })).toBe(false)
+    expect(isRowActivationKey({ key: ' ', target: trigger, currentTarget: row })).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/automations/automation-list-row-interaction.ts b/src/renderer/src/components/automations/automation-list-row-interaction.ts
new file mode 100644
index 00000000000..c09504bc543
--- /dev/null
+++ b/src/renderer/src/components/automations/automation-list-row-interaction.ts
@@ -0,0 +1,26 @@
+/** True when a portaled Radix menu click re-bubbles through a row's React tree. */
+export function isPortaledRowMenuClick(event: {
+  target: EventTarget
+  currentTarget: EventTarget
+}): boolean {
+  const target = event.target
+  return target instanceof Node && event.currentTarget instanceof Node
+    ? !event.currentTarget.contains(target)
+    : false
+}
+
+/**
+ * True when Enter/Space landed on the row itself. Keys pressed on a nested
+ * control (the actions trigger) must stay with that control — preventDefault
+ * here would swallow its native activation.
+ */
+export function isRowActivationKey(event: {
+  key: string
+  target: EventTarget
+  currentTarget: EventTarget
+}): boolean {
+  if (event.target !== event.currentTarget) {
+    return false
+  }
+  return event.key === 'Enter' || event.key === ' '
+}
diff --git a/src/renderer/src/components/automations/automation-run-output-snapshot-equivalence.test.ts b/src/renderer/src/components/automations/automation-run-output-snapshot-equivalence.test.ts
index 6397a3fa90c..b988ad96581 100644
--- a/src/renderer/src/components/automations/automation-run-output-snapshot-equivalence.test.ts
+++ b/src/renderer/src/components/automations/automation-run-output-snapshot-equivalence.test.ts
@@ -103,4 +103,23 @@ describe('automation run output snapshot queue equivalence', () => {
 
     expect(candidate.snapshot()).toEqual(reference.snapshot())
   })
+
+  it('matches the shift reference across oversized and subsequent appends', () => {
+    const retained = `\ude00${'A'.repeat(MAX_OUTPUT_SNAPSHOT_CHARS - 2)}\ud83d`
+    const chunks = [
+      'older output',
+      `discarded\u001b[31m prefix${retained}`,
+      'TAIL',
+      `${'B'.repeat(MAX_OUTPUT_SNAPSHOT_CHARS)}extra`,
+      '\u001b[0mDone\r\n'
+    ]
+    const reference = createShiftReferenceBuffer()
+    const candidate = createAutomationRunOutputSnapshotBuffer()
+
+    for (const chunk of chunks) {
+      reference.append(chunk)
+      candidate.append(chunk)
+      expect(candidate.snapshot()).toEqual(reference.snapshot())
+    }
+  })
 })
diff --git a/src/renderer/src/components/automations/automation-run-output-snapshot.test.ts b/src/renderer/src/components/automations/automation-run-output-snapshot.test.ts
index 6dcc87cfc53..4bf868bf94e 100644
--- a/src/renderer/src/components/automations/automation-run-output-snapshot.test.ts
+++ b/src/renderer/src/components/automations/automation-run-output-snapshot.test.ts
@@ -132,6 +132,22 @@ describe('automation run output snapshot buffer', () => {
     })
   })
 
+  it('owns the exact UTF-16 tail of one oversized chunk', () => {
+    const buffer = createAutomationRunOutputSnapshotBuffer()
+    const retained = `\ude00${'A'.repeat(256 * 1024 - 2)}\ud83d`
+
+    buffer.append('older output')
+    buffer.append(`discarded prefix${retained}`)
+
+    expect(buffer.snapshot()).toMatchObject({ content: retained, truncated: true })
+
+    buffer.append('TAIL')
+    expect(buffer.snapshot()).toMatchObject({
+      content: `${retained.slice(4)}TAIL`,
+      truncated: true
+    })
+  })
+
   it('creates a saved snapshot from agent transcript text', () => {
     expect(createAutomationRunOutputSnapshotFromText('\nFinal summary.\n')).toEqual({
       format: 'plain_text',
diff --git a/src/renderer/src/components/automations/automation-run-output-snapshot.ts b/src/renderer/src/components/automations/automation-run-output-snapshot.ts
index fb493e35cdf..1700b2b6ede 100644
--- a/src/renderer/src/components/automations/automation-run-output-snapshot.ts
+++ b/src/renderer/src/components/automations/automation-run-output-snapshot.ts
@@ -3,6 +3,7 @@ import {
   stripAnsiEscapeSequences,
   TERMINAL_CONTROL_CHARACTER_PATTERN
 } from '../../../../shared/ansi-escape-sequences'
+import { copyUtf16SuffixToOwnedString } from '../../../../shared/owned-utf16-suffix'
 
 const MAX_OUTPUT_SNAPSHOT_CHARS = 256 * 1024
 const OUTPUT_SNAPSHOT_COMPACTION_HEAD_THRESHOLD = 64
@@ -68,7 +69,10 @@ export function createAutomationRunOutputSnapshotBuffer(): AutomationRunOutputSn
           truncated = true
           continue
         }
-        chunks[firstChunkIndex] = firstChunk.slice(overflowChars)
+        chunks[firstChunkIndex] =
+          firstChunk.length > MAX_OUTPUT_SNAPSHOT_CHARS
+            ? copyUtf16SuffixToOwnedString(firstChunk, firstChunk.length - overflowChars)
+            : firstChunk.slice(overflowChars)
         totalChars -= overflowChars
         truncated = true
         overflowChars = 0
diff --git a/src/renderer/src/components/automations/automations-table-layout.ts b/src/renderer/src/components/automations/automations-table-layout.ts
new file mode 100644
index 00000000000..17f3af46681
--- /dev/null
+++ b/src/renderer/src/components/automations/automations-table-layout.ts
@@ -0,0 +1,15 @@
+/** Shared layout classes for the automations list table.
+ * Matches AutomationRunHistory / ExternalAutomationRunTable / Tasks list tables. */
+// Name | Schedule | Project | Next run | Status | Agent | Actions
+export const AUTOMATIONS_TABLE_GRID_CLASS =
+  'grid grid-cols-[minmax(0,1.5fr)_minmax(7rem,10rem)_minmax(5rem,9rem)_minmax(10rem,1.2fr)_minmax(4.5rem,6rem)_2.5rem_2.5rem]'
+
+export const AUTOMATIONS_TABLE_CONTAINER_CLASS = 'rounded-md border border-border/50 bg-muted/20'
+
+export const AUTOMATIONS_TABLE_HEADER_CLASS =
+  'sticky top-0 z-10 h-8 items-center gap-3 border-b border-border/50 bg-muted/25 px-3 text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground'
+
+export const AUTOMATIONS_TABLE_ROW_CLASS =
+  'w-full min-h-11 cursor-pointer items-center gap-3 px-3 py-3 text-left text-sm transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-[3px] focus-visible:ring-ring/50'
+
+export const AUTOMATIONS_TABLE_ROW_SELECTED_CLASS = 'bg-accent text-accent-foreground'
diff --git a/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx b/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx
new file mode 100644
index 00000000000..0d17baed21b
--- /dev/null
+++ b/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx
@@ -0,0 +1,187 @@
+/**
+ * @vitest-environment happy-dom
+ *
+ * STA-3811: imports never touch the Google cookie family, so every import menu must disclose it
+ * at the moment of decision.
+ */
+import { act, type ReactNode } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import en from '@/i18n/locales/en.json'
+
+const DISCLOSURE_TITLE = "Google logins aren't imported"
+const DISCLOSURE_DESCRIPTION = 'Sign in to Google directly in Orca.'
+
+vi.mock('@/components/ui/dropdown-menu', () => dropdownMenuStubs())
+vi.mock('../ui/dropdown-menu', () => dropdownMenuStubs())
+vi.mock('@/components/ui/popover', () => popoverStubs())
+vi.mock('@/store', () => ({ useAppStore: appStoreStub() }))
+vi.mock('../../store', () => ({ useAppStore: appStoreStub() }))
+vi.mock('sonner', () => ({ toast: { success: vi.fn(), error: vi.fn() } }))
+
+import { BrowserCookieImportDisclosure } from './BrowserCookieImportDisclosure'
+import { BrowserImportHintButton } from './browser-pane/BrowserImportHintButton'
+import { BrowserToolbarMenuDropdown } from './browser-pane/browser-toolbar-menu-dropdown'
+import { BrowserProfileRow } from './settings/BrowserProfileRow'
+import { BrowserUseCookieImportStep } from './settings/BrowserUseCookieImportStep'
+
+const DETECTED_BROWSERS = [
+  {
+    family: 'chrome',
+    label: 'Google Chrome',
+    profiles: [{ name: 'Default', directory: 'Default' }],
+    selectedProfile: 'Default'
+  }
+]
+
+describe('cookie-import Google disclosure footer', () => {
+  let container: HTMLDivElement
+  let root: Root
+
+  beforeEach(() => {
+    container = document.createElement('div')
+    document.body.append(container)
+    root = createRoot(container)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
+  })
+
+  it.each([
+    [
+      'browser toolbar overflow',
+      () => (
+        <BrowserToolbarMenuDropdown
+          menuOpen
+          onMenuOpenChange={vi.fn()}
+          allProfiles={[]}
+          effectiveProfileId="default"
+          onSwitchProfile={vi.fn()}
+          onNewProfile={vi.fn()}
+          detectedBrowsers={DETECTED_BROWSERS}
+          onFetchDetectedBrowsers={vi.fn()}
+          browserSessionImportState={null}
+          onImportFromBrowser={vi.fn()}
+          onImportFromFile={vi.fn()}
+          viewportPresetId={null}
+          onApplyViewportPreset={vi.fn()}
+        />
+      )
+    ],
+    ['browser toolbar hint', () => <BrowserImportHintButton profileId="default" />],
+    [
+      'Settings browser-use setup',
+      () => (
+        <BrowserUseCookieImportStep
+          cookiesImported={false}
+          isImportingDefault={false}
+          step3Blocked={false}
+          sourceLabel={null}
+        />
+      )
+    ],
+    [
+      'Settings browser-profile row',
+      () => (
+        <BrowserProfileRow
+          profile={{ id: 'default', name: 'Default', partition: 'persist:default' } as never}
+          detectedBrowsers={DETECTED_BROWSERS}
+          importState={null}
+          isActive
+          onSelect={vi.fn()}
+        />
+      )
+    ]
+  ] satisfies [string, () => ReactNode][])('is shown in the %s menu', (_name, renderSurface) => {
+    act(() => root.render(renderSurface()))
+
+    expect(container.textContent).toContain(DISCLOSURE_TITLE)
+    expect(container.textContent).toContain(DISCLOSURE_DESCRIPTION)
+  })
+
+  it('renders the icon and separator as non-interactive footer chrome', () => {
+    act(() => root.render(<BrowserCookieImportDisclosure />))
+
+    const label = container.querySelector('[data-testid="dropdown-menu-label"]')
+    expect(label?.querySelector('svg')).not.toBeNull()
+    expect(label?.previousElementSibling?.tagName).toBe('HR')
+  })
+
+  it('reads the footer copy from the catalog', () => {
+    expect(catalogEntry('auto.components.BrowserCookieImportDisclosure.title')).toBe(
+      DISCLOSURE_TITLE
+    )
+    expect(catalogEntry('auto.components.BrowserCookieImportDisclosure.description')).toBe(
+      DISCLOSURE_DESCRIPTION
+    )
+  })
+})
+
+function catalogEntry(key: string): unknown {
+  return key
+    .split('.')
+    .reduce<unknown>(
+      (node, part) =>
+        typeof node === 'object' && node !== null
+          ? (node as Record<string, unknown>)[part]
+          : undefined,
+      en
+    )
+}
+
+function dropdownMenuStubs(): Record<string, unknown> {
+  const passthrough = ({ children }: { children?: ReactNode }): ReactNode => children
+  const block = ({ children }: { children?: ReactNode }): ReactNode => <div>{children}</div>
+  return {
+    DropdownMenu: passthrough,
+    DropdownMenuContent: block,
+    DropdownMenuItem: block,
+    DropdownMenuLabel: ({ children }: { children?: ReactNode }): ReactNode => (
+      <div data-testid="dropdown-menu-label">{children}</div>
+    ),
+    DropdownMenuPortal: passthrough,
+    DropdownMenuRadioGroup: passthrough,
+    DropdownMenuRadioItem: block,
+    DropdownMenuSeparator: () => <hr />,
+    DropdownMenuSub: passthrough,
+    DropdownMenuSubContent: block,
+    DropdownMenuSubTrigger: block,
+    DropdownMenuTrigger: passthrough
+  }
+}
+
+function popoverStubs(): Record<string, unknown> {
+  const passthrough = ({ children }: { children?: ReactNode }): ReactNode => children
+  const block = ({ children }: { children?: ReactNode }): ReactNode => <div>{children}</div>
+  return { Popover: passthrough, PopoverContent: block, PopoverTrigger: passthrough }
+}
+
+function appStoreStub(): unknown {
+  const state = {
+    browserImportHintHidden: false,
+    browserSessionImportState: null,
+    detectedBrowsers: [
+      {
+        family: 'chrome',
+        label: 'Google Chrome',
+        profiles: [{ name: 'Default', directory: 'Default' }],
+        selectedProfile: 'Default'
+      }
+    ],
+    detectedBrowsersLoaded: true,
+    fetchDetectedBrowsers: vi.fn(),
+    importCookiesFromBrowser: vi.fn(),
+    importCookiesToProfile: vi.fn(),
+    openSettingsTarget: vi.fn(),
+    openSettingsPage: vi.fn(),
+    persistedUIReady: true,
+    setBrowserImportHintHidden: vi.fn(),
+    settingsSearchQuery: ''
+  }
+  const useAppStore = (selector?: (s: typeof state) => unknown): unknown =>
+    selector ? selector(state) : state
+  useAppStore.getState = (): typeof state => state
+  return useAppStore
+}
diff --git a/src/renderer/src/components/browser-pane/BrowserImportHintButton.tsx b/src/renderer/src/components/browser-pane/BrowserImportHintButton.tsx
index 32af12eeb10..0f318fb8107 100644
--- a/src/renderer/src/components/browser-pane/BrowserImportHintButton.tsx
+++ b/src/renderer/src/components/browser-pane/BrowserImportHintButton.tsx
@@ -3,6 +3,7 @@ import { Import } from 'lucide-react'
 import { toast } from 'sonner'
 import { emitBrowserCookieImportToast } from '@/lib/browser-cookie-import-toast'
 import { Button } from '@/components/ui/button'
+import { BrowserCookieImportDisclosure } from '@/components/BrowserCookieImportDisclosure'
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -100,7 +101,8 @@ export function BrowserImportHintButton({
               value1: browser?.label ?? browserFamily,
               value2: browserProfile ? ` (${browserProfile})` : ''
             }
-          )
+          ),
+          result.executionHostLabel
         )
         return
       }
@@ -120,7 +122,8 @@ export function BrowserImportHintButton({
           'auto.components.browser.pane.BrowserImportHintButton.d40d584769',
           'Imported {{value0}} cookies from file.',
           { value0: result.summary.importedCookies }
-        )
+        ),
+        result.executionHostLabel
       )
       return
     }
@@ -257,6 +260,7 @@ export function BrowserImportHintButton({
                     'From File…'
                   )}
                 </DropdownMenuItem>
+                <BrowserCookieImportDisclosure />
               </DropdownMenuContent>
             </DropdownMenu>
 
diff --git a/src/renderer/src/components/browser-pane/BrowserPane.render-ipc.test.ts b/src/renderer/src/components/browser-pane/BrowserPane.render-ipc.test.ts
new file mode 100644
index 00000000000..8d3253ad460
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/BrowserPane.render-ipc.test.ts
@@ -0,0 +1,19 @@
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+
+describe('BrowserPagePane render IPC boundary', () => {
+  it('derives toolbar URLs without querying the webview', () => {
+    const source = readFileSync(
+      fileURLToPath(new URL('./BrowserPane.tsx', import.meta.url)),
+      'utf8'
+    )
+    const start = source.indexOf('const isBlankTab =', source.indexOf('function BrowserPagePane'))
+    const end = source.indexOf('useEffect(() => {', start)
+    const renderUrlDerivation = source.slice(start, end)
+
+    expect(renderUrlDerivation).toContain('getLiveBrowserUrl(browserTab.id)')
+    expect(renderUrlDerivation).not.toContain('webviewRef')
+    expect(renderUrlDerivation).not.toContain('.getURL(')
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/BrowserPane.tsx b/src/renderer/src/components/browser-pane/BrowserPane.tsx
index 90a7e1fdc2c..825b0ceb3e8 100644
--- a/src/renderer/src/components/browser-pane/BrowserPane.tsx
+++ b/src/renderer/src/components/browser-pane/BrowserPane.tsx
@@ -82,7 +82,7 @@ import {
   browserViewportPresetToOverride,
   getBrowserViewportPreset
 } from '../../../../shared/browser-viewport-presets'
-import { rememberLiveBrowserUrl } from './browser-runtime'
+import { getLiveBrowserUrl, rememberLiveBrowserUrl, seedLiveBrowserUrl } from './browser-runtime'
 import { ensureBrowserPageWebview } from './browser-page-webview'
 import { RemoteBrowserStreamLifecycle } from './remote-browser-stream-lifecycle'
 import { isRemoteBrowserPageMissingError } from './remote-browser-stream-errors'
@@ -135,6 +135,7 @@ import BrowserFind from './BrowserFind'
 import { BrowserMobileDriverOverlay } from './BrowserMobileDriverOverlay'
 import { getShortcutPlatform, useShortcutLabel } from '@/hooks/useShortcutLabel'
 import { getRemoteBrowserFrameStyle } from './remote-browser-frame-style'
+import { useRemoteBrowserStreamActivation } from './use-remote-browser-stream-activation'
 import {
   getRemoteBrowserKeyboardShortcut,
   getRemoteBrowserKeypressKey
@@ -188,6 +189,7 @@ import { shouldPollChromiumErrorPage } from './chromium-error-page-polling'
 import { useContextualTour } from '@/components/contextual-tours/use-contextual-tour'
 import { translate } from '@/i18n/i18n'
 import { isBrowserPagePanePaintable } from './browser-page-paintability'
+import { openWorkspaceBrowserTab } from '@/lib/workspace-browser-tab-open'
 import { useMarkupMode, type MarkupCaptureContext } from './markup/useMarkupMode'
 import { MarkupOverlay } from './markup/MarkupOverlay'
 import { MarkupDrawButton } from './markup/MarkupDrawButton'
@@ -688,35 +690,10 @@ function getRemoteBrowserDeviceScaleFactor(): number {
   return Math.min(2, Math.max(1, Number(scale.toFixed(2))))
 }
 
-function getOpenableExternalUrl(
-  webview: Electron.WebviewTag | null,
-  fallbackUrl: string
-): string | null {
-  let currentUrl = fallbackUrl
-  if (webview) {
-    try {
-      currentUrl = webview.getURL() || fallbackUrl
-    } catch {
-      // Why: querying nav state before dom-ready throws and blanks the whole IDE on launch; fall back to the persisted URL.
-      currentUrl = fallbackUrl
-    }
-  }
+function getOpenableExternalUrl(currentUrl: string): string | null {
   return normalizeExternalBrowserUrl(redactKagiSessionToken(currentUrl))
 }
 
-function getCurrentBrowserUrl(webview: Electron.WebviewTag | null, fallbackUrl: string): string {
-  let currentUrl = fallbackUrl
-  if (webview) {
-    try {
-      currentUrl = webview.getURL() || fallbackUrl
-    } catch {
-      // Why: toolbar actions need a stable URL during early guest attach/restore; fall back to the persisted URL instead of throwing.
-      currentUrl = fallbackUrl
-    }
-  }
-  return toDisplayUrl(currentUrl)
-}
-
 function retryBrowserTabLoad(
   webview: Electron.WebviewTag | null,
   browserTab: BrowserPageState,
@@ -959,7 +936,6 @@ function RemoteBrowserPagePane({
   const remotePageHandle = useAppStore(
     (s) => s.remoteBrowserPageHandlesByPageId[browserTab.id] ?? null
   )
-  const createBrowserTab = useAppStore((s) => s.createBrowserTab)
   const closeBrowserPage = useAppStore((s) => s.closeBrowserPage)
   const closeBrowserTab = useAppStore((s) => s.closeBrowserTab)
   const keybindings = useAppStore((state) => state.keybindings)
@@ -1484,29 +1460,15 @@ function RemoteBrowserPagePane({
     setReopenNonce((nonce) => nonce + 1)
   }, [])
 
-  useEffect(() => {
-    if (!isActive) {
-      return
-    }
-    const closeStream = lifecycle.open()
-    return () => {
-      closeStream()
-      clearPendingRemoteWheel()
-    }
-    // Why: the lifecycle reads tab/environment/worktree live, so it only needs to reopen when the
-    // pane's identity actually changes — not when an unrelated callback identity does.
-    //
-    // browserTab.id is load-bearing because lifecycle.open() reads tab identity through refs.
-    // reopenNonce re-runs the full open path for an explicit reconnect.
-  }, [
+  useRemoteBrowserStreamActivation({
     activeRuntimeEnvironmentId,
-    browserTab.id,
+    browserPageId: browserTab.id,
     clearPendingRemoteWheel,
     isActive,
     lifecycle,
     reopenNonce,
     runtimeWorktree
-  ])
+  })
 
   useEffect(() => {
     if (!isActive) {
@@ -2075,10 +2037,18 @@ function RemoteBrowserPagePane({
                       role="menuitem"
                       className="relative flex w-full cursor-default items-center gap-2 rounded-[7px] px-2 py-0.5 text-[12px] leading-5 font-medium outline-none select-none hover:bg-black/8 dark:hover:bg-white/14"
                       onClick={() => {
-                        createBrowserTab(worktreeId, contextMenu.linkUrl!, {
-                          title: contextMenu.linkUrl!
-                        })
+                        const linkUrl = contextMenu.linkUrl!
                         setContextMenu(null)
+                        void openWorkspaceBrowserTab({
+                          workspaceId: worktreeId,
+                          url: linkUrl,
+                          intent: { kind: 'url' }
+                        }).catch((error) => {
+                          setPaneNotice({
+                            kind: 'direct',
+                            text: error instanceof Error ? error.message : String(error)
+                          })
+                        })
                       }}
                     >
                       {translate(
@@ -2921,7 +2891,7 @@ function BrowserPagePane({
         return
       }
       // Why: convert OS screen cursor coords to renderer CSS pixels — immune to guest/renderer coordinate-space mismatches from zoom/DPI.
-      const zoomFactor = Math.pow(1.2, window.api.ui.getZoomLevel())
+      const zoomFactor = 1.2 ** window.api.ui.getZoomLevel()
       const x = Math.round((event.screenX - window.screenX) / zoomFactor)
       const y = Math.round((event.screenY - window.screenY) / zoomFactor)
       console.debug(
@@ -3430,6 +3400,7 @@ function BrowserPagePane({
     container = ensuredWebview.container
     const webview = ensuredWebview.webview
     const needsInitialNavigation = ensuredWebview.created
+    seedLiveBrowserUrl(browserTab.id, redactKagiSessionToken(browserTabUrlRef.current))
 
     if (!ensuredWebview.created) {
       // pointerEvents already applied inside ensureBrowserPageWebview for the reused-webview path.
@@ -4556,8 +4527,10 @@ function BrowserPagePane({
 
   // Why: a blank tab reads as 'about:blank' or the resolved data: URL, so match both to keep the "New Browser Tab" overlay visible.
   const isBlankTab = browserTab.url === 'about:blank' || browserTab.url === ORCA_BROWSER_BLANK_URL
-  const externalUrl = getOpenableExternalUrl(webviewRef.current, browserTab.url)
-  const currentBrowserUrl = getCurrentBrowserUrl(webviewRef.current, browserTab.url)
+  // Why: synchronous webview URL access blocks render; navigation handlers update this cache before their store writes can re-render the pane.
+  const liveBrowserUrl = getLiveBrowserUrl(browserTab.id) ?? browserTab.url
+  const externalUrl = getOpenableExternalUrl(liveBrowserUrl)
+  const currentBrowserUrl = toDisplayUrl(liveBrowserUrl)
   const shareableArtifactFile =
     workspaceConnectionId === null ? getShareableBrowserArtifactFile(currentBrowserUrl) : null
   const failedNavigationUrl = browserTab.loadError?.validatedUrl ?? currentBrowserUrl
diff --git a/src/renderer/src/components/browser-pane/BrowserToolbarMenu.tsx b/src/renderer/src/components/browser-pane/BrowserToolbarMenu.tsx
index 90afa5aec59..f712d33abd2 100644
--- a/src/renderer/src/components/browser-pane/BrowserToolbarMenu.tsx
+++ b/src/renderer/src/components/browser-pane/BrowserToolbarMenu.tsx
@@ -205,7 +205,8 @@ export function BrowserToolbarMenu({
                 value0: result.summary.importedCookies,
                 value1: browser?.label ?? browserFamily
               }
-            )
+            ),
+        result.executionHostLabel
       )
     } else {
       toast.error(result.reason)
@@ -221,7 +222,8 @@ export function BrowserToolbarMenu({
           'auto.components.browser.pane.BrowserToolbarMenu.53bbe3dab4',
           'Imported {{value0}} cookies from file.',
           { value0: result.summary.importedCookies }
-        )
+        ),
+        result.executionHostLabel
       )
     } else if (result.reason !== 'canceled') {
       toast.error(result.reason)
diff --git a/src/renderer/src/components/browser-pane/browser-address-bar-suggestions.ts b/src/renderer/src/components/browser-pane/browser-address-bar-suggestions.ts
index 5351073140b..6ac0fe12c52 100644
--- a/src/renderer/src/components/browser-pane/browser-address-bar-suggestions.ts
+++ b/src/renderer/src/components/browser-pane/browser-address-bar-suggestions.ts
@@ -127,7 +127,7 @@ export function buildBrowserAddressBarSuggestions({
 
   // Why: the history row gives Enter the same target while showing real page metadata.
   const duplicateIdx = historySuggestions.findIndex((h) => h.url === topAction.url)
-  if (duplicateIdx >= 0) {
+  if (duplicateIdx !== -1) {
     return historySuggestions.slice(0, MAX_BROWSER_ADDRESS_BAR_SUGGESTIONS)
   }
 
diff --git a/src/renderer/src/components/browser-pane/browser-runtime.test.ts b/src/renderer/src/components/browser-pane/browser-runtime.test.ts
index b225d8c3698..846b13f306d 100644
--- a/src/renderer/src/components/browser-pane/browser-runtime.test.ts
+++ b/src/renderer/src/components/browser-pane/browser-runtime.test.ts
@@ -1,9 +1,15 @@
-import { beforeEach, describe, expect, it } from 'vitest'
-import { clearLiveBrowserUrl, getLiveBrowserUrl, rememberLiveBrowserUrl } from './browser-runtime'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  clearLiveBrowserUrl,
+  getLiveBrowserUrl,
+  rememberLiveBrowserUrl,
+  seedLiveBrowserUrl
+} from './browser-runtime'
 
 describe('browser runtime live URL cache', () => {
-  beforeEach(() => {
+  afterEach(() => {
     clearLiveBrowserUrl('page-1')
+    clearLiveBrowserUrl('popup-1')
   })
 
   it('remembers and clears the last live URL for a browser page', () => {
@@ -15,4 +21,30 @@ describe('browser runtime live URL cache', () => {
 
     expect(getLiveBrowserUrl('page-1')).toBeNull()
   })
+
+  it('seeds an initial URL without replacing a committed navigation', () => {
+    seedLiveBrowserUrl('page-1', 'https://initial.example/')
+    rememberLiveBrowserUrl('page-1', 'https://committed.example/')
+    seedLiveBrowserUrl('page-1', 'https://stale-persisted.example/')
+
+    expect(getLiveBrowserUrl('page-1')).toBe('https://committed.example/')
+  })
+
+  it('retains the last committed URL when a later load fails', () => {
+    seedLiveBrowserUrl('page-1', 'https://initial.example/')
+    rememberLiveBrowserUrl('page-1', 'https://committed.example/')
+    // A failure event records its validated URL in loadError, not the live URL cache.
+
+    expect(getLiveBrowserUrl('page-1')).toBe('https://committed.example/')
+  })
+
+  it('keeps popup page URLs independent and clears only the destroyed page', () => {
+    seedLiveBrowserUrl('page-1', 'https://opener.example/')
+    seedLiveBrowserUrl('popup-1', 'https://popup.example/')
+
+    clearLiveBrowserUrl('popup-1')
+
+    expect(getLiveBrowserUrl('page-1')).toBe('https://opener.example/')
+    expect(getLiveBrowserUrl('popup-1')).toBeNull()
+  })
 })
diff --git a/src/renderer/src/components/browser-pane/browser-runtime.ts b/src/renderer/src/components/browser-pane/browser-runtime.ts
index 34ef5098010..029afc41b0f 100644
--- a/src/renderer/src/components/browser-pane/browser-runtime.ts
+++ b/src/renderer/src/components/browser-pane/browser-runtime.ts
@@ -1,5 +1,11 @@
 const liveBrowserUrlByTabId = new Map<string, string>()
 
+export function seedLiveBrowserUrl(browserTabId: string, initialUrl: string): void {
+  if (!liveBrowserUrlByTabId.has(browserTabId)) {
+    liveBrowserUrlByTabId.set(browserTabId, initialUrl)
+  }
+}
+
 export function rememberLiveBrowserUrl(browserTabId: string, url: string): void {
   liveBrowserUrlByTabId.set(browserTabId, url)
 }
diff --git a/src/renderer/src/components/browser-pane/browser-toolbar-menu-dropdown.tsx b/src/renderer/src/components/browser-pane/browser-toolbar-menu-dropdown.tsx
index b34453ba3e3..508eb059ca2 100644
--- a/src/renderer/src/components/browser-pane/browser-toolbar-menu-dropdown.tsx
+++ b/src/renderer/src/components/browser-pane/browser-toolbar-menu-dropdown.tsx
@@ -13,6 +13,7 @@ import {
   DropdownMenuSubTrigger,
   DropdownMenuTrigger
 } from '@/components/ui/dropdown-menu'
+import { BrowserCookieImportDisclosure } from '@/components/BrowserCookieImportDisclosure'
 import { useAppStore } from '@/store'
 import { BROWSER_FAMILY_LABELS } from '../../../../shared/constants'
 import type { BrowserSessionProfile, BrowserViewportPresetId } from '../../../../shared/types'
@@ -170,6 +171,7 @@ export function BrowserToolbarMenuDropdown({
                   'From File…'
                 )}
               </DropdownMenuItem>
+              <BrowserCookieImportDisclosure />
             </DropdownMenuSubContent>
           </DropdownMenuPortal>
         </DropdownMenuSub>
diff --git a/src/renderer/src/components/browser-pane/context-menu-positioning.test.ts b/src/renderer/src/components/browser-pane/context-menu-positioning.test.ts
index 397647b181f..647b6696907 100644
--- a/src/renderer/src/components/browser-pane/context-menu-positioning.test.ts
+++ b/src/renderer/src/components/browser-pane/context-menu-positioning.test.ts
@@ -43,7 +43,7 @@ function computeCorrection(
 
 describe('screen-to-viewport coordinate conversion', () => {
   it('converts screen coords to viewport at zoom 1.0', () => {
-    const result = computeViewportCoords(650, 400, 100, 50, 1.0)
+    const result = computeViewportCoords(650, 400, 100, 50, 1)
     expect(result.x).toBe(550)
     expect(result.y).toBe(350)
   })
@@ -64,7 +64,7 @@ describe('screen-to-viewport coordinate conversion', () => {
   })
 
   it('handles cursor at window origin', () => {
-    const result = computeViewportCoords(100, 50, 100, 50, 1.0)
+    const result = computeViewportCoords(100, 50, 100, 50, 1)
     expect(result.x).toBe(0)
     expect(result.y).toBe(0)
   })
@@ -203,7 +203,7 @@ describe('full pipeline', () => {
       screenCursor.y,
       windowPos.x,
       windowPos.y,
-      1.0
+      1
     )
 
     expect(menuPos.x).toBe(550)
@@ -236,7 +236,7 @@ describe('full pipeline', () => {
       screenCursor.y,
       windowPos.x,
       windowPos.y,
-      1.0
+      1
     )
     const cssOffset = { x: 60, y: 40 }
     const measured = { left: menuPos.x + cssOffset.x, top: menuPos.y + cssOffset.y }
@@ -255,7 +255,7 @@ describe('full pipeline', () => {
       screenCursor.y,
       windowPos.x,
       windowPos.y,
-      1.0
+      1
     )
     const corrected = computeCorrection(menuPos.x, menuPos.y, menuPos.x, menuPos.y)
 
diff --git a/src/renderer/src/components/browser-pane/remote-browser-stream-lifecycle-test-harness.ts b/src/renderer/src/components/browser-pane/remote-browser-stream-lifecycle-test-harness.ts
new file mode 100644
index 00000000000..9bfd2ae2bd5
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/remote-browser-stream-lifecycle-test-harness.ts
@@ -0,0 +1,278 @@
+import { vi } from 'vitest'
+import { RemoteBrowserStreamLifecycle } from './remote-browser-stream-lifecycle'
+import type { RemoteBrowserPageHandle, RemoteBrowserRpcCall } from './remote-browser-page-session'
+import type { RemoteBrowserScreencastSubscribe } from './remote-browser-screencast-subscription'
+import type { RemoteBrowserViewportSize } from './remote-browser-stream-tokens'
+import {
+  canReconnectRemoteBrowserStream,
+  isRemoteBrowserStreamBusy,
+  remoteBrowserStreamNotice,
+  type RemoteBrowserStreamStatus
+} from './remote-browser-stream-status'
+
+export type Gate = {
+  wait: Promise<void>
+  release: () => void
+  fail: (error: unknown) => void
+}
+
+export function createGate(): Gate {
+  let release!: () => void
+  let fail!: (error: unknown) => void
+  const wait = new Promise<void>((resolve, reject) => {
+    release = () => resolve()
+    fail = (error: unknown) => reject(error)
+  })
+  // Why: the gate is released by the test, not by this tick; an unhandled rejection would fail the run.
+  wait.catch(() => {})
+  return { wait, release, fail }
+}
+
+export type FakeScreencastStream = {
+  pageId: string
+  params: unknown
+  viewportWidth: number | undefined
+  unsubscribeCount: number
+  emitReady: () => void
+  emitEnd: () => void
+  emitStreamError: (message: string) => void
+  emitMalformedSuccess: () => void
+  emitResponseFailure: (code: string, message: string) => void
+  emitTransportError: (code: string, message: string) => void
+  emitClose: () => void
+}
+
+export function rpcError(code: string, message: string): Error {
+  return Object.assign(new Error(message), { code })
+}
+
+export function createHarness() {
+  const identity = {
+    mounted: true,
+    active: true,
+    tabId: 'tab-1',
+    environmentId: 'env-1' as string | null,
+    pageExists: true
+  }
+  const statusLog: RemoteBrowserStreamStatus[] = []
+  const appliedTitles: string[] = []
+  const closedPages: (string | null)[] = []
+  const streams: FakeScreencastStream[] = []
+  const rpcLog: string[] = []
+
+  let capabilities: string[] = ['browser.screencast.v1']
+  let storedHandle: RemoteBrowserPageHandle | null = null
+  let viewportSize: RemoteBrowserViewportSize | null = { width: 800, height: 600 }
+  let statusGate: Gate | null = null
+  let viewportGate: Gate | null = null
+  let tabShowGate: Gate | null = null
+  let subscribeGate: Gate | null = null
+  let persistentSubscribeError: unknown = null
+  const subscribeErrorQueue: unknown[] = []
+  let subscribeAttempts = 0
+  let closeBeforeNextSubscribeRejects = false
+
+  const callRpc = (async (_target: unknown, method: string) => {
+    rpcLog.push(method)
+    if (method === 'status.get') {
+      if (statusGate) {
+        const gate = statusGate
+        statusGate = null
+        await gate.wait
+      }
+      return { capabilities }
+    }
+    if (method === 'browser.tabShow') {
+      if (tabShowGate) {
+        const gate = tabShowGate
+        tabShowGate = null
+        await gate.wait
+      }
+      return { tab: { url: 'https://example.test/', title: 'Example' } }
+    }
+    if (method === 'browser.tabCreate') {
+      return { browserPageId: 'page-1' }
+    }
+    return {}
+  }) as unknown as RemoteBrowserRpcCall
+
+  const subscribeScreencast: RemoteBrowserScreencastSubscribe = async (args, callbacks) => {
+    subscribeAttempts += 1
+    if (subscribeGate) {
+      const gate = subscribeGate
+      subscribeGate = null
+      await gate.wait
+    }
+    // Models the host closing the subscription and only then rejecting the request, which is what
+    // src/main/ipc/runtime-environments.ts does on a stale pairing.
+    if (closeBeforeNextSubscribeRejects) {
+      closeBeforeNextSubscribeRejects = false
+      callbacks.onClose?.()
+      throw rpcError(
+        'runtime_unavailable',
+        'Runtime environment pairing changed; refresh and try again'
+      )
+    }
+    const error = subscribeErrorQueue.shift() ?? persistentSubscribeError
+    if (error) {
+      throw error
+    }
+    const params = args.params as {
+      page: string
+      viewportWidth?: number
+    }
+    const respond = (result: unknown): void => {
+      callbacks.onResponse({ id: 'sub-1', ok: true, result, _meta: { runtimeId: 'runtime-1' } })
+    }
+    const stream: FakeScreencastStream = {
+      pageId: params.page,
+      params: args.params,
+      viewportWidth: params.viewportWidth,
+      unsubscribeCount: 0,
+      emitReady: () =>
+        respond({
+          type: 'ready',
+          subscriptionId: 'sub-1',
+          browserPageId: params.page,
+          format: 'jpeg',
+          tab: { url: 'https://example.test/', title: 'Example' }
+        }),
+      emitEnd: () => respond({ type: 'end', subscriptionId: 'sub-1' }),
+      emitStreamError: (message) => respond({ type: 'error', message }),
+      emitMalformedSuccess: () => respond(null),
+      emitResponseFailure: (code, message) =>
+        callbacks.onResponse({
+          id: 'sub-1',
+          ok: false,
+          error: { code, message },
+          _meta: { runtimeId: 'runtime-1' }
+        }),
+      emitTransportError: (code, message) => callbacks.onError?.({ code, message }),
+      emitClose: () => callbacks.onClose?.()
+    }
+    streams.push(stream)
+    return {
+      unsubscribe: () => {
+        stream.unsubscribeCount += 1
+      }
+    }
+  }
+
+  const lifecycle = new RemoteBrowserStreamLifecycle({
+    identity: {
+      isMounted: () => identity.mounted,
+      isActive: () => identity.active,
+      getTabId: () => identity.tabId,
+      getEnvironmentId: () => identity.environmentId,
+      browserPageExists: () => identity.pageExists
+    },
+    callRpc,
+    subscribeScreencast,
+    getWorktreeSelector: () => 'worktree:wt-1',
+    getCurrentUrl: () => 'https://example.test/',
+    readStoredHandle: () => storedHandle,
+    writeStoredHandle: (handle) => {
+      storedHandle = handle
+    },
+    removeStoredHandle: () => {
+      storedHandle = null
+    },
+    applyTabInfo: (tab) => appliedTitles.push(tab.title ?? ''),
+    closeMissingRemotePage: (remotePageId) => closedPages.push(remotePageId),
+    waitForViewportSize: async () => {
+      if (viewportGate) {
+        const gate = viewportGate
+        viewportGate = null
+        await gate.wait
+      }
+      return viewportSize
+    },
+    readViewportSize: () => viewportSize,
+    syncViewport: async () => {},
+    getDeviceScaleFactor: () => 1,
+    setStatus: (status) => statusLog.push(status),
+    clearFrame: () => {},
+    handleFrameBytes: () => {}
+  })
+
+  return {
+    lifecycle,
+    identity,
+    statusLog,
+    appliedTitles,
+    closedPages,
+    streams,
+    rpcLog,
+    get subscribeAttempts(): number {
+      return subscribeAttempts
+    },
+    // Kept as accessors so the assertions written against the old three-variable shape still read
+    // naturally — they now derive from the one status, which is the point of the change.
+    get errorLog(): (string | null)[] {
+      return statusLog.map(remoteBrowserStreamNotice)
+    },
+    get busyLog(): boolean[] {
+      return statusLog.map(isRemoteBrowserStreamBusy)
+    },
+    get reconnectOffered(): boolean {
+      const status = statusLog.at(-1)
+      return status ? canReconnectRemoteBrowserStream(status) : false
+    },
+    get currentStatusKind(): string | null {
+      return statusLog.at(-1)?.kind ?? null
+    },
+    get currentError(): string | null {
+      const status = statusLog.at(-1)
+      return status ? remoteBrowserStreamNotice(status) : null
+    },
+    setCapabilities: (next: string[]) => {
+      capabilities = next
+    },
+    setViewportSize: (next: RemoteBrowserViewportSize | null) => {
+      viewportSize = next
+    },
+    queueSubscribeError: (error: unknown) => {
+      subscribeErrorQueue.push(error)
+    },
+    failEverySubscribe: (error: unknown) => {
+      persistentSubscribeError = error
+    },
+    closeThenRejectNextSubscribe: () => {
+      closeBeforeNextSubscribeRejects = true
+    },
+    holdNextViewportSize: (): Gate => {
+      const gate = createGate()
+      viewportGate = gate
+      return gate
+    },
+    holdNextStatusGet: (): Gate => {
+      const gate = createGate()
+      statusGate = gate
+      return gate
+    },
+    holdNextTabShow: (): Gate => {
+      const gate = createGate()
+      tabShowGate = gate
+      return gate
+    },
+    holdNextSubscribe: (): Gate => {
+      const gate = createGate()
+      subscribeGate = gate
+      return gate
+    }
+  }
+}
+
+export type Harness = ReturnType<typeof createHarness>
+
+export async function settle(): Promise<void> {
+  await vi.advanceTimersByTimeAsync(0)
+}
+
+export async function openStreamAndConfirmReady(harness: Harness): Promise<() => void> {
+  const close = harness.lifecycle.open()
+  await settle()
+  harness.streams[0].emitReady()
+  await settle()
+  return close
+}
diff --git a/src/renderer/src/components/browser-pane/remote-browser-stream-lifecycle.test.ts b/src/renderer/src/components/browser-pane/remote-browser-stream-lifecycle.test.ts
index 3c68bcfe1b7..dd31353db51 100644
--- a/src/renderer/src/components/browser-pane/remote-browser-stream-lifecycle.test.ts
+++ b/src/renderer/src/components/browser-pane/remote-browser-stream-lifecycle.test.ts
@@ -1,283 +1,12 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { RemoteBrowserStreamLifecycle } from './remote-browser-stream-lifecycle'
-import type { RemoteBrowserPageHandle, RemoteBrowserRpcCall } from './remote-browser-page-session'
-import type { RemoteBrowserScreencastSubscribe } from './remote-browser-screencast-subscription'
-import type { RemoteBrowserViewportSize } from './remote-browser-stream-tokens'
 import {
-  canReconnectRemoteBrowserStream,
-  isRemoteBrowserStreamBusy,
-  remoteBrowserStreamNotice,
-  type RemoteBrowserStreamStatus
-} from './remote-browser-stream-status'
+  createHarness,
+  openStreamAndConfirmReady,
+  rpcError,
+  settle
+} from './remote-browser-stream-lifecycle-test-harness'
 import { isBrowserPaneUiRuntimeRpcParams } from '../../../../shared/runtime-rpc-feature-interaction-source'
 
-type Gate = {
-  wait: Promise<void>
-  release: () => void
-  fail: (error: unknown) => void
-}
-
-function createGate(): Gate {
-  let release!: () => void
-  let fail!: (error: unknown) => void
-  const wait = new Promise<void>((resolve, reject) => {
-    release = () => resolve()
-    fail = (error: unknown) => reject(error)
-  })
-  // Why: the gate is released by the test, not by this tick; an unhandled rejection would fail the run.
-  wait.catch(() => {})
-  return { wait, release, fail }
-}
-
-type FakeScreencastStream = {
-  pageId: string
-  params: unknown
-  viewportWidth: number | undefined
-  unsubscribeCount: number
-  emitReady: () => void
-  emitEnd: () => void
-  emitStreamError: (message: string) => void
-  emitMalformedSuccess: () => void
-  emitResponseFailure: (code: string, message: string) => void
-  emitTransportError: (code: string, message: string) => void
-  emitClose: () => void
-}
-
-function rpcError(code: string, message: string): Error {
-  return Object.assign(new Error(message), { code })
-}
-
-function createHarness() {
-  const identity = {
-    mounted: true,
-    active: true,
-    tabId: 'tab-1',
-    environmentId: 'env-1' as string | null,
-    pageExists: true
-  }
-  const statusLog: RemoteBrowserStreamStatus[] = []
-  const appliedTitles: string[] = []
-  const closedPages: (string | null)[] = []
-  const streams: FakeScreencastStream[] = []
-  const rpcLog: string[] = []
-
-  let capabilities: string[] = ['browser.screencast.v1']
-  let storedHandle: RemoteBrowserPageHandle | null = null
-  let viewportSize: RemoteBrowserViewportSize | null = { width: 800, height: 600 }
-  let statusGate: Gate | null = null
-  let viewportGate: Gate | null = null
-  let tabShowGate: Gate | null = null
-  let subscribeGate: Gate | null = null
-  let persistentSubscribeError: unknown = null
-  const subscribeErrorQueue: unknown[] = []
-  let subscribeAttempts = 0
-  let closeBeforeNextSubscribeRejects = false
-
-  const callRpc = (async (_target: unknown, method: string) => {
-    rpcLog.push(method)
-    if (method === 'status.get') {
-      if (statusGate) {
-        const gate = statusGate
-        statusGate = null
-        await gate.wait
-      }
-      return { capabilities }
-    }
-    if (method === 'browser.tabShow') {
-      if (tabShowGate) {
-        const gate = tabShowGate
-        tabShowGate = null
-        await gate.wait
-      }
-      return { tab: { url: 'https://example.test/', title: 'Example' } }
-    }
-    if (method === 'browser.tabCreate') {
-      return { browserPageId: 'page-1' }
-    }
-    return {}
-  }) as unknown as RemoteBrowserRpcCall
-
-  const subscribeScreencast: RemoteBrowserScreencastSubscribe = async (args, callbacks) => {
-    subscribeAttempts += 1
-    if (subscribeGate) {
-      const gate = subscribeGate
-      subscribeGate = null
-      await gate.wait
-    }
-    // Models the host closing the subscription and only then rejecting the request, which is what
-    // src/main/ipc/runtime-environments.ts does on a stale pairing.
-    if (closeBeforeNextSubscribeRejects) {
-      closeBeforeNextSubscribeRejects = false
-      callbacks.onClose?.()
-      throw rpcError(
-        'runtime_unavailable',
-        'Runtime environment pairing changed; refresh and try again'
-      )
-    }
-    const error = subscribeErrorQueue.shift() ?? persistentSubscribeError
-    if (error) {
-      throw error
-    }
-    const params = args.params as {
-      page: string
-      viewportWidth?: number
-    }
-    const respond = (result: unknown): void => {
-      callbacks.onResponse({ id: 'sub-1', ok: true, result, _meta: { runtimeId: 'runtime-1' } })
-    }
-    const stream: FakeScreencastStream = {
-      pageId: params.page,
-      params: args.params,
-      viewportWidth: params.viewportWidth,
-      unsubscribeCount: 0,
-      emitReady: () =>
-        respond({
-          type: 'ready',
-          subscriptionId: 'sub-1',
-          browserPageId: params.page,
-          format: 'jpeg',
-          tab: { url: 'https://example.test/', title: 'Example' }
-        }),
-      emitEnd: () => respond({ type: 'end', subscriptionId: 'sub-1' }),
-      emitStreamError: (message) => respond({ type: 'error', message }),
-      emitMalformedSuccess: () => respond(null),
-      emitResponseFailure: (code, message) =>
-        callbacks.onResponse({
-          id: 'sub-1',
-          ok: false,
-          error: { code, message },
-          _meta: { runtimeId: 'runtime-1' }
-        }),
-      emitTransportError: (code, message) => callbacks.onError?.({ code, message }),
-      emitClose: () => callbacks.onClose?.()
-    }
-    streams.push(stream)
-    return {
-      unsubscribe: () => {
-        stream.unsubscribeCount += 1
-      }
-    }
-  }
-
-  const lifecycle = new RemoteBrowserStreamLifecycle({
-    identity: {
-      isMounted: () => identity.mounted,
-      isActive: () => identity.active,
-      getTabId: () => identity.tabId,
-      getEnvironmentId: () => identity.environmentId,
-      browserPageExists: () => identity.pageExists
-    },
-    callRpc,
-    subscribeScreencast,
-    getWorktreeSelector: () => 'worktree:wt-1',
-    getCurrentUrl: () => 'https://example.test/',
-    readStoredHandle: () => storedHandle,
-    writeStoredHandle: (handle) => {
-      storedHandle = handle
-    },
-    removeStoredHandle: () => {
-      storedHandle = null
-    },
-    applyTabInfo: (tab) => appliedTitles.push(tab.title ?? ''),
-    closeMissingRemotePage: (remotePageId) => closedPages.push(remotePageId),
-    waitForViewportSize: async () => {
-      if (viewportGate) {
-        const gate = viewportGate
-        viewportGate = null
-        await gate.wait
-      }
-      return viewportSize
-    },
-    readViewportSize: () => viewportSize,
-    syncViewport: async () => {},
-    getDeviceScaleFactor: () => 1,
-    setStatus: (status) => statusLog.push(status),
-    clearFrame: () => {},
-    handleFrameBytes: () => {}
-  })
-
-  return {
-    lifecycle,
-    identity,
-    statusLog,
-    appliedTitles,
-    closedPages,
-    streams,
-    rpcLog,
-    get subscribeAttempts(): number {
-      return subscribeAttempts
-    },
-    // Kept as accessors so the assertions written against the old three-variable shape still read
-    // naturally — they now derive from the one status, which is the point of the change.
-    get errorLog(): (string | null)[] {
-      return statusLog.map(remoteBrowserStreamNotice)
-    },
-    get busyLog(): boolean[] {
-      return statusLog.map(isRemoteBrowserStreamBusy)
-    },
-    get reconnectOffered(): boolean {
-      const status = statusLog.at(-1)
-      return status ? canReconnectRemoteBrowserStream(status) : false
-    },
-    get currentStatusKind(): string | null {
-      return statusLog.at(-1)?.kind ?? null
-    },
-    get currentError(): string | null {
-      const status = statusLog.at(-1)
-      return status ? remoteBrowserStreamNotice(status) : null
-    },
-    setCapabilities: (next: string[]) => {
-      capabilities = next
-    },
-    setViewportSize: (next: RemoteBrowserViewportSize | null) => {
-      viewportSize = next
-    },
-    queueSubscribeError: (error: unknown) => {
-      subscribeErrorQueue.push(error)
-    },
-    failEverySubscribe: (error: unknown) => {
-      persistentSubscribeError = error
-    },
-    closeThenRejectNextSubscribe: () => {
-      closeBeforeNextSubscribeRejects = true
-    },
-    holdNextViewportSize: (): Gate => {
-      const gate = createGate()
-      viewportGate = gate
-      return gate
-    },
-    holdNextStatusGet: (): Gate => {
-      const gate = createGate()
-      statusGate = gate
-      return gate
-    },
-    holdNextTabShow: (): Gate => {
-      const gate = createGate()
-      tabShowGate = gate
-      return gate
-    },
-    holdNextSubscribe: (): Gate => {
-      const gate = createGate()
-      subscribeGate = gate
-      return gate
-    }
-  }
-}
-
-type Harness = ReturnType<typeof createHarness>
-
-async function settle(): Promise<void> {
-  await vi.advanceTimersByTimeAsync(0)
-}
-
-async function openStreamAndConfirmReady(harness: Harness): Promise<() => void> {
-  const close = harness.lifecycle.open()
-  await settle()
-  harness.streams[0].emitReady()
-  await settle()
-  return close
-}
-
 describe('RemoteBrowserStreamLifecycle', () => {
   beforeEach(() => {
     vi.useFakeTimers()
@@ -312,6 +41,42 @@ describe('RemoteBrowserStreamLifecycle', () => {
     expect(harness.streams[0].unsubscribeCount).toBe(1)
   })
 
+  it('reopens the existing remote page after its stream is parked', async () => {
+    const harness = createHarness()
+    const close = await openStreamAndConfirmReady(harness)
+
+    close()
+    expect(harness.streams[0].unsubscribeCount).toBe(1)
+    harness.lifecycle.open()
+    await settle()
+    harness.streams[1].emitReady()
+    await settle()
+
+    expect(harness.streams.map((stream) => stream.pageId)).toEqual(['page-1', 'page-1'])
+    expect(harness.rpcLog.filter((method) => method === 'browser.tabCreate')).toHaveLength(1)
+    expect(harness.currentStatusKind).toBe('live')
+  })
+
+  // Closing a tab while its stream is parked runs dispose() with no effect cleanup left to pair
+  // with it, so unmount safety rests entirely on parking having already unsubscribed.
+  it('leaves nothing subscribed when the pane unmounts while its stream is parked', async () => {
+    const harness = createHarness()
+    const closeStream = await openStreamAndConfirmReady(harness)
+
+    closeStream()
+    const statusWritesWhileParked = harness.statusLog.length
+
+    harness.identity.mounted = false
+    harness.lifecycle.dispose()
+    harness.streams[0].emitClose()
+    harness.streams[0].emitStreamError('too late')
+    await vi.advanceTimersByTimeAsync(120_000)
+
+    expect(harness.streams[0].unsubscribeCount).toBe(1)
+    expect(harness.statusLog).toHaveLength(statusWritesWhileParked)
+    expect(harness.subscribeAttempts).toBe(1)
+  })
+
   // STA-3483: the shipped bug was a single 500ms retry that never rescheduled.
   it('keeps retrying a dropped stream with backoff instead of stopping after one attempt', async () => {
     const harness = createHarness()
diff --git a/src/renderer/src/components/browser-pane/use-remote-browser-stream-activation.test.ts b/src/renderer/src/components/browser-pane/use-remote-browser-stream-activation.test.ts
new file mode 100644
index 00000000000..70102d402cf
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/use-remote-browser-stream-activation.test.ts
@@ -0,0 +1,119 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { resetStaleDocumentVisibilityForTesting } from '../terminal-pane/stale-document-visibility'
+import { WINDOW_STREAM_PARK_DELAY_MS } from '@/hooks/use-window-stream-visibility'
+import { useRemoteBrowserStreamActivation } from './use-remote-browser-stream-activation'
+
+function setDocumentVisibility(state: 'visible' | 'hidden'): void {
+  Object.defineProperty(document, 'visibilityState', {
+    configurable: true,
+    get: () => state
+  })
+  document.dispatchEvent(new Event('visibilitychange'))
+}
+
+function renderActivation(isActive = true) {
+  const closeStream = vi.fn()
+  const open = vi.fn(() => closeStream)
+  const lifecycle = { open }
+  const clearPendingRemoteWheel = vi.fn()
+  const hook = renderHook(
+    ({ active }) =>
+      useRemoteBrowserStreamActivation({
+        activeRuntimeEnvironmentId: 'env-1',
+        browserPageId: 'page-1',
+        clearPendingRemoteWheel,
+        isActive: active,
+        lifecycle,
+        reopenNonce: 0,
+        runtimeWorktree: 'worktree:one'
+      }),
+    { initialProps: { active: isActive } }
+  )
+  return { ...hook, clearPendingRemoteWheel, closeStream, open }
+}
+
+describe('useRemoteBrowserStreamActivation', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    setDocumentVisibility('visible')
+  })
+
+  afterEach(() => {
+    cleanup()
+    setDocumentVisibility('visible')
+    resetStaleDocumentVisibilityForTesting()
+    vi.useRealTimers()
+    vi.restoreAllMocks()
+  })
+
+  it('parks after the grace period and reopens when stale visibility is disproven', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const harness = renderActivation()
+    expect(harness.open).toHaveBeenCalledTimes(1)
+
+    await act(async () => setDocumentVisibility('hidden'))
+    await act(async () => vi.advanceTimersByTime(WINDOW_STREAM_PARK_DELAY_MS - 1))
+    expect(harness.closeStream).not.toHaveBeenCalled()
+
+    await act(async () => vi.advanceTimersByTime(1))
+    expect(harness.closeStream).toHaveBeenCalledTimes(1)
+    expect(harness.clearPendingRemoteWheel).toHaveBeenCalledTimes(1)
+
+    await act(async () => {
+      document.dispatchEvent(new KeyboardEvent('keydown', { key: 'a' }))
+    })
+    expect(document.visibilityState).toBe('hidden')
+    expect(harness.open).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not reconnect during a quick hide and show', async () => {
+    const harness = renderActivation()
+
+    await act(async () => setDocumentVisibility('hidden'))
+    await act(async () => vi.advanceTimersByTime(WINDOW_STREAM_PARK_DELAY_MS - 1))
+    await act(async () => setDocumentVisibility('visible'))
+    await act(async () => vi.advanceTimersByTime(WINDOW_STREAM_PARK_DELAY_MS))
+
+    expect(harness.closeStream).not.toHaveBeenCalled()
+    expect(harness.open).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not open while mounted hidden', async () => {
+    setDocumentVisibility('hidden')
+    const harness = renderActivation()
+    expect(harness.open).not.toHaveBeenCalled()
+
+    await act(async () => setDocumentVisibility('visible'))
+    expect(harness.open).toHaveBeenCalledTimes(1)
+  })
+
+  it('parks immediately when its pane becomes inactive', async () => {
+    const harness = renderActivation()
+
+    await act(async () => harness.rerender({ active: false }))
+    expect(harness.closeStream).toHaveBeenCalledTimes(1)
+    expect(harness.clearPendingRemoteWheel).toHaveBeenCalledTimes(1)
+
+    await act(async () => harness.rerender({ active: true }))
+    expect(harness.open).toHaveBeenCalledTimes(2)
+  })
+
+  // Closing a tab while parked leaves no effect cleanup to run, so unmount must not resurrect the
+  // stream when the window comes back — the pane's lifecycle is already disposed by then.
+  it('stays closed when its tab is closed while the stream is parked', async () => {
+    const harness = renderActivation()
+
+    await act(async () => setDocumentVisibility('hidden'))
+    await act(async () => vi.advanceTimersByTime(WINDOW_STREAM_PARK_DELAY_MS))
+    expect(harness.closeStream).toHaveBeenCalledTimes(1)
+
+    await act(async () => harness.unmount())
+    await act(async () => setDocumentVisibility('visible'))
+
+    expect(harness.open).toHaveBeenCalledTimes(1)
+    expect(harness.closeStream).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/use-remote-browser-stream-activation.ts b/src/renderer/src/components/browser-pane/use-remote-browser-stream-activation.ts
new file mode 100644
index 00000000000..3963f8d9554
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/use-remote-browser-stream-activation.ts
@@ -0,0 +1,46 @@
+import { useEffect } from 'react'
+import { useWindowStreamVisible } from '@/hooks/use-window-stream-visibility'
+import type { RemoteBrowserStreamLifecycle } from './remote-browser-stream-lifecycle'
+
+type RemoteBrowserStreamActivationOptions = {
+  activeRuntimeEnvironmentId: string
+  browserPageId: string
+  clearPendingRemoteWheel: () => void
+  isActive: boolean
+  lifecycle: Pick<RemoteBrowserStreamLifecycle, 'open'>
+  reopenNonce: number
+  runtimeWorktree: string
+}
+
+export function useRemoteBrowserStreamActivation({
+  activeRuntimeEnvironmentId,
+  browserPageId,
+  clearPendingRemoteWheel,
+  isActive,
+  lifecycle,
+  reopenNonce,
+  runtimeWorktree
+}: RemoteBrowserStreamActivationOptions): void {
+  const windowVisibleForStream = useWindowStreamVisible()
+
+  useEffect(() => {
+    if (!isActive || !windowVisibleForStream) {
+      return
+    }
+    const closeStream = lifecycle.open()
+    return () => {
+      closeStream()
+      clearPendingRemoteWheel()
+    }
+  }, [
+    // The stable lifecycle reads identity through refs; these values trigger the required reopen.
+    activeRuntimeEnvironmentId,
+    browserPageId,
+    clearPendingRemoteWheel,
+    isActive,
+    lifecycle,
+    reopenNonce,
+    runtimeWorktree,
+    windowVisibleForStream
+  ])
+}
diff --git a/src/renderer/src/components/cmd-j/palette-live-status.test.tsx b/src/renderer/src/components/cmd-j/palette-live-status.test.tsx
index 2fa01fffce5..f19bf3a91d2 100644
--- a/src/renderer/src/components/cmd-j/palette-live-status.test.tsx
+++ b/src/renderer/src/components/cmd-j/palette-live-status.test.tsx
@@ -411,7 +411,11 @@ describe('palette live status', () => {
     expect(pip?.className).toContain('bg-popover')
     expect(pip?.className).toContain('ring-popover')
     expect(pip?.className).not.toContain('bg-background')
-    expect(pip?.className).toContain('group-data-[selected=true]:bg-accent')
-    expect(pip?.className).toContain('group-data-[selected=true]:ring-accent')
+    expect(pip?.className).toContain(
+      'group-data-[selected=true]:bg-[var(--jump-palette-selection-surface)]'
+    )
+    expect(pip?.className).toContain(
+      'group-data-[selected=true]:ring-[var(--jump-palette-selection-surface)]'
+    )
   })
 })
diff --git a/src/renderer/src/components/cmd-j/palette-live-status.tsx b/src/renderer/src/components/cmd-j/palette-live-status.tsx
index 4dcfab7e273..03a2af8928d 100644
--- a/src/renderer/src/components/cmd-j/palette-live-status.tsx
+++ b/src/renderer/src/components/cmd-j/palette-live-status.tsx
@@ -216,10 +216,11 @@ export function PaletteRecentTabStatusDot({
         className={cn(
           // Why popover, not background: the dialog surface is --popover (#171717 in dark), while
           // --background is the app canvas (#0a0a0a) — using it punched a dark halo through every
-          // dark-mode row. Selected rows swap to accent so the cutout stays invisible there too.
+          // dark-mode row. Selected rows use --jump-palette-selection-surface so the cutout tracks
+          // the stronger keyboard highlight from main.css.
           'pointer-events-none absolute -right-0.5 -bottom-0.5 flex items-center justify-center rounded-full',
           'bg-popover ring-2 ring-popover',
-          'group-data-[selected=true]:bg-accent group-data-[selected=true]:ring-accent'
+          'group-data-[selected=true]:bg-[var(--jump-palette-selection-surface)] group-data-[selected=true]:ring-[var(--jump-palette-selection-surface)]'
         )}
         aria-hidden="true"
       >
diff --git a/src/renderer/src/components/cmd-j/quick-action-context.test.ts b/src/renderer/src/components/cmd-j/quick-action-context.test.ts
index 5e753b42372..7ce2e107613 100644
--- a/src/renderer/src/components/cmd-j/quick-action-context.test.ts
+++ b/src/renderer/src/components/cmd-j/quick-action-context.test.ts
@@ -278,6 +278,43 @@ describe('Cmd+J quick action context', () => {
     expect(calls).toEqual([])
   })
 
+  it('omits unsupported paired-web browser execution without affecting terminal or markdown', async () => {
+    const calls: string[] = []
+    const actions = new Map(getCmdJQuickActions().map((action) => [action.id, action]))
+    const context = {
+      ...ctx({}),
+      activeWorktree: null,
+      runtimeMode: 'paired-web' as const,
+      managedBrowserCreationEnabled: false,
+      openNewBrowserTab: async () => {
+        calls.push('browser')
+      },
+      openNewMarkdownFile: async () => {
+        calls.push('markdown')
+      },
+      openNewTerminalTab: async () => {
+        calls.push('terminal')
+      },
+      openCreateWorkspace: () => {},
+      deleteActiveWorkspace: () => {},
+      openAddQuickCommand: () => {}
+    } satisfies CmdJQuickActionContext
+
+    expect(actions.get('new-browser-tab')?.isAvailable(context)).toEqual({
+      available: false,
+      reason: 'client-action-unsupported'
+    })
+    await expect(actions.get('new-browser-tab')?.run(context)).resolves.toEqual({
+      status: 'unavailable',
+      reason: 'client-action-unsupported'
+    })
+    expect(actions.get('new-markdown-file')?.isAvailable(context)).toEqual({ available: true })
+    expect(actions.get('new-terminal-tab')?.isAvailable(context)).toEqual({ available: true })
+    await actions.get('new-markdown-file')?.run(context)
+    await actions.get('new-terminal-tab')?.run(context)
+    expect(calls).toEqual(['markdown', 'terminal'])
+  })
+
   it('runtime re-check invokes the current workspace delete action when available', async () => {
     const calls: string[] = []
     const action = getCmdJQuickActions().find((entry) => entry.id === 'delete-workspace')
diff --git a/src/renderer/src/components/cmd-j/quick-action-context.ts b/src/renderer/src/components/cmd-j/quick-action-context.ts
index bf3e764f5ab..79007eae750 100644
--- a/src/renderer/src/components/cmd-j/quick-action-context.ts
+++ b/src/renderer/src/components/cmd-j/quick-action-context.ts
@@ -2,12 +2,14 @@ import type { AppState } from '@/store/types'
 import { findWorktreeById } from '@/store/slices/worktree-helpers'
 import type { Worktree } from '../../../../shared/types'
 import type { SshConnectionStatus } from '../../../../shared/ssh-types'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 export type CmdJUnavailableReason =
   | 'loading'
   | 'no-active-workspace'
   | 'ssh-disconnected'
   | 'no-active-group'
+  | 'client-action-unsupported'
 
 export type CmdJQuickActionAvailability =
   | { available: true }
@@ -25,6 +27,7 @@ export type CmdJQuickActionContext = {
   isLoading: boolean
   sshStatus: SshConnectionStatus | null
   runtimeMode: 'local-desktop' | 'paired-web'
+  managedBrowserCreationEnabled?: boolean
   activeGroupId: string | null
   openNewBrowserTab: (groupId: string) => Promise<void>
   openNewMarkdownFile: (groupId: string) => Promise<void>
@@ -110,6 +113,15 @@ export function getWorkspaceScopedActionAvailability(
   return { available: true }
 }
 
+export function getBrowserWorkspaceActionAvailability(
+  ctx: CmdJQuickActionContext
+): CmdJQuickActionAvailability {
+  if (ctx.managedBrowserCreationEnabled === false) {
+    return { available: false, reason: 'client-action-unsupported' }
+  }
+  return getWorkspaceScopedActionAvailability(ctx)
+}
+
 export function getCurrentWorkspaceActionAvailability(
   ctx: Pick<CmdJQuickActionContext, 'activeView' | 'activeWorktreeId' | 'isLoading' | 'sshStatus'>
 ): CmdJQuickActionAvailability {
@@ -151,6 +163,9 @@ export function buildCmdJQuickActionContext(args: {
     args.state.settings?.activeRuntimeEnvironmentId?.trim()
       ? 'paired-web'
       : 'local-desktop'
+  const managedBrowserCreationEnabled =
+    getClientCreationActionPolicy(args.state, activeWorktreeId)['managed-browser'].state ===
+    'enabled'
 
   return {
     activeView: args.state.activeView,
@@ -159,6 +174,7 @@ export function buildCmdJQuickActionContext(args: {
     isLoading,
     sshStatus: getActiveWorktreeSshStatus(args.state, activeWorktree),
     runtimeMode,
+    managedBrowserCreationEnabled,
     activeGroupId,
     openNewBrowserTab: args.openNewBrowserTab,
     openNewMarkdownFile: args.openNewMarkdownFile,
@@ -182,5 +198,7 @@ export function getUnavailableQuickActionMessage(
       return `Can't ${actionTitle.toLowerCase()} — workspace is disconnected.`
     case 'no-active-group':
       return `Can't ${actionTitle.toLowerCase()} — no tab group is available.`
+    case 'client-action-unsupported':
+      return `Can't ${actionTitle.toLowerCase()} — this client and runtime do not support it.`
   }
 }
diff --git a/src/renderer/src/components/cmd-j/quick-actions.ts b/src/renderer/src/components/cmd-j/quick-actions.ts
index 8ad3f957a16..70f0e5f6859 100644
--- a/src/renderer/src/components/cmd-j/quick-actions.ts
+++ b/src/renderer/src/components/cmd-j/quick-actions.ts
@@ -3,6 +3,7 @@ import type { LucideIcon } from 'lucide-react'
 import type { CmdJQuickActionAvailability, CmdJQuickActionContext } from './quick-action-context'
 import {
   getCurrentWorkspaceActionAvailability,
+  getBrowserWorkspaceActionAvailability,
   getWorkspaceScopedActionAvailability
 } from './quick-action-context'
 import { translate } from '@/i18n/i18n'
@@ -38,6 +39,12 @@ function currentWorkspaceActionAvailability(
   return getCurrentWorkspaceActionAvailability(ctx)
 }
 
+function browserWorkspaceActionAvailability(
+  ctx: CmdJQuickActionContext
+): CmdJQuickActionAvailability {
+  return getBrowserWorkspaceActionAvailability(ctx)
+}
+
 async function runWorkspaceAction(
   ctx: CmdJQuickActionContext,
   run: (groupId: string) => Promise<void>
@@ -72,8 +79,14 @@ export const getCmdJQuickActions = createLocalizedCatalog((): CmdJQuickAction[]
       translate('auto.components.cmd.j.quick.actions.verbs.openBrowser', 'open browser'),
       translate('auto.components.cmd.j.quick.actions.verbs.browserTab', 'browser tab')
     ],
-    isAvailable: workspaceActionAvailability,
-    run: (ctx) => runWorkspaceAction(ctx, ctx.openNewBrowserTab)
+    isAvailable: browserWorkspaceActionAvailability,
+    run: async (ctx) => {
+      const availability = browserWorkspaceActionAvailability(ctx)
+      if (!availability.available) {
+        return { status: 'unavailable', reason: availability.reason }
+      }
+      return runWorkspaceAction(ctx, ctx.openNewBrowserTab)
+    }
   },
   {
     id: 'new-markdown-file',
diff --git a/src/renderer/src/components/contextual-tours/contextual-tour-gate.ts b/src/renderer/src/components/contextual-tours/contextual-tour-gate.ts
index 07ffc248c28..155f2bfb5a8 100644
--- a/src/renderer/src/components/contextual-tours/contextual-tour-gate.ts
+++ b/src/renderer/src/components/contextual-tours/contextual-tour-gate.ts
@@ -173,7 +173,7 @@ export function getContextualTourStepProgress(args: {
   stepIndex: number
 }): { current: number; total: number } | null {
   const visibleIndex = args.visibleStepIndexes.indexOf(args.stepIndex)
-  if (visibleIndex < 0) {
+  if (visibleIndex === -1) {
     return null
   }
   return { current: visibleIndex + 1, total: args.visibleStepIndexes.length }
diff --git a/src/renderer/src/components/dashboard-popout/AgentMap.test.tsx b/src/renderer/src/components/dashboard-popout/AgentMap.test.tsx
index a100ecaabef..699a698f008 100644
--- a/src/renderer/src/components/dashboard-popout/AgentMap.test.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentMap.test.tsx
@@ -1,137 +1,16 @@
 // @vitest-environment happy-dom
 
 import '@testing-library/jest-dom/vitest'
-import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type {
-  DashboardCard,
-  DashboardSleepWorkspaceArgs,
-  DashboardSpawnAgentArgs
-} from '../../../../shared/dashboard-snapshot'
-import type { TuiAgent } from '../../../../shared/types'
+import { act, cleanup, fireEvent, screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
 import { AgentMap } from './AgentMap'
 import { agentMapAttentionMarkerScale } from './AgentMapWorktreeRingNode'
 import type { AgentMapState } from './agent-map-filter'
 import { AGENT_MAP_AGENT_RADIUS } from './agent-map-layout'
-
-const NOW = 2_000_000_000
-
-function card(overrides: Partial<DashboardCard> = {}): DashboardCard {
-  return {
-    paneKey: 'pane-1',
-    ptyId: 'pty-1',
-    agentType: 'codex',
-    bucket: 'working',
-    dotState: 'working',
-    task: 'Build map',
-    repoId: 'repo-1',
-    worktreeId: 'worktree-1',
-    tabId: 'tab-1',
-    leafId: 'leaf-1',
-    repoName: 'Orca',
-    worktreeName: 'Agent map',
-    conversationName: 'Agent alpha',
-    startedAt: NOW - 10 * 60_000,
-    finishedAt: null,
-    stateChangedAt: NOW - 1_000,
-    unseen: false,
-    hostKind: 'local',
-    workspaceKind: 'worktree',
-    ...overrides
-  }
-}
-
-function renderMap(
-  cards: DashboardCard[],
-  {
-    onOpenTerminal = vi.fn(),
-    selectedPaneKey = null,
-    compact = false,
-    workspaceContextMenusEnabled = false,
-    enabledStates,
-    showOrchestrationLinks,
-    launchableAgentsByWorktreeId,
-    onSpawnAgent,
-    onSleepWorkspace
-  }: {
-    onOpenTerminal?: (card: DashboardCard) => void
-    selectedPaneKey?: string | null
-    compact?: boolean
-    workspaceContextMenusEnabled?: boolean
-    enabledStates?: ReadonlySet<AgentMapState>
-    showOrchestrationLinks?: boolean
-    launchableAgentsByWorktreeId?: Record<string, TuiAgent[]>
-    onSpawnAgent?: (args: DashboardSpawnAgentArgs) => void
-    onSleepWorkspace?: (args: DashboardSleepWorkspaceArgs) => void
-  } = {}
-): ReturnType<typeof render> {
-  return render(
-    <AgentMap
-      cards={cards}
-      now={NOW}
-      onOpenTerminal={onOpenTerminal}
-      selectedPaneKey={selectedPaneKey}
-      compact={compact}
-      workspaceContextMenusEnabled={workspaceContextMenusEnabled}
-      enabledStates={enabledStates}
-      showOrchestrationLinks={showOrchestrationLinks}
-      launchableAgentsByWorktreeId={launchableAgentsByWorktreeId}
-      onSpawnAgent={onSpawnAgent}
-      onSleepWorkspace={onSleepWorkspace}
-    />
-  )
-}
+import { card, installAgentMapEnvironment, NOW, renderMap } from './agent-map-render-test-harness'
 
 describe('AgentMap', () => {
-  const originalUserAgent = navigator.userAgent
-  let boundsSpy: ReturnType<typeof vi.spyOn>
-
-  beforeEach(() => {
-    Object.defineProperty(navigator, 'userAgent', { configurable: true, value: 'Linux' })
-    vi.stubGlobal(
-      'matchMedia',
-      vi.fn(() => ({ matches: true, addEventListener: vi.fn(), removeEventListener: vi.fn() }))
-    )
-    boundsSpy = vi
-      .spyOn(Element.prototype, 'getBoundingClientRect')
-      .mockImplementation(function getBounds(this: Element) {
-        if (this.classList.contains('agent-map-canvas') || this instanceof SVGSVGElement) {
-          return {
-            x: 0,
-            y: 0,
-            left: 0,
-            top: 0,
-            right: 400,
-            bottom: 300,
-            width: 400,
-            height: 300,
-            toJSON: () => ({})
-          }
-        }
-        return {
-          x: 0,
-          y: 0,
-          left: 0,
-          top: 0,
-          right: 0,
-          bottom: 0,
-          width: 0,
-          height: 0,
-          toJSON: () => ({})
-        }
-      })
-  })
-
-  afterEach(() => {
-    cleanup()
-    vi.clearAllMocks()
-    vi.unstubAllGlobals()
-    boundsSpy.mockRestore()
-    Object.defineProperty(navigator, 'userAgent', {
-      configurable: true,
-      value: originalUserAgent
-    })
-  })
+  const environment = installAgentMapEnvironment()
 
   it('renders the amber marker only for unread agents', () => {
     const finished = card({
@@ -164,23 +43,6 @@ describe('AgentMap', () => {
     expect(doneNode).toHaveAccessibleName(/unread/)
   })
 
-  it.each([
-    { bucket: 'working', dotState: 'working', unseen: false, glows: true },
-    { bucket: 'attention', dotState: 'waiting', unseen: false, glows: true },
-    { bucket: 'attention', dotState: 'blocked', unseen: false, glows: true },
-    { bucket: 'done', dotState: 'done', unseen: true, glows: false },
-    { bucket: 'idle', dotState: 'idle', unseen: false, glows: false }
-  ] as const)('applies the expected halo for $dotState agents', (state) => {
-    const { container } = renderMap([card(state)])
-    const glow = container.querySelector('[data-agent-map-agent-status-glow]')
-
-    if (state.glows) {
-      expect(glow).toHaveAttribute('data-agent-active-status', state.dotState)
-      return
-    }
-    expect(glow).not.toBeInTheDocument()
-  })
-
   it('lets attention override working on the worktree glow', () => {
     const done = card({
       paneKey: 'done',
@@ -631,13 +493,13 @@ describe('AgentMap', () => {
       labelGroup?.getAttribute('transform')?.match(/scale\(([^)]+)\)/)?.[1]
     )
 
-    const readsBeforeZoom = boundsSpy.mock.calls.length
+    const readsBeforeZoom = environment.boundsSpy.mock.calls.length
     fireEvent.click(screen.getByRole('button', { name: 'Zoom out' }))
 
     const zoomedScale = Number(
       labelGroup?.getAttribute('transform')?.match(/scale\(([^)]+)\)/)?.[1]
     )
-    expect(boundsSpy).toHaveBeenCalledTimes(readsBeforeZoom)
+    expect(environment.boundsSpy).toHaveBeenCalledTimes(readsBeforeZoom)
     expect(zoomedScale).toBeGreaterThan(initialScale)
   })
 
@@ -656,18 +518,18 @@ describe('AgentMap', () => {
       releasePointerCapture: vi.fn()
     })
 
-    const readsBeforeHover = boundsSpy.mock.calls.length
+    const readsBeforeHover = environment.boundsSpy.mock.calls.length
     fireEvent.pointerMove(svg, { pointerId: 1, clientX: 20, clientY: 20 })
-    expect(boundsSpy).toHaveBeenCalledTimes(readsBeforeHover)
+    expect(environment.boundsSpy).toHaveBeenCalledTimes(readsBeforeHover)
 
     fireEvent.pointerDown(svg, { pointerId: 1, clientX: 20, clientY: 20 })
     expect(svg.setPointerCapture).toHaveBeenCalledWith(1)
-    const readsAfterPointerDown = boundsSpy.mock.calls.length
+    const readsAfterPointerDown = environment.boundsSpy.mock.calls.length
     const initialViewBox = svg.getAttribute('viewBox')
     fireEvent.pointerMove(svg, { pointerId: 1, clientX: 30, clientY: 20 })
     fireEvent.pointerMove(svg, { pointerId: 1, clientX: 40, clientY: 20 })
 
-    expect(boundsSpy).toHaveBeenCalledTimes(readsAfterPointerDown)
+    expect(environment.boundsSpy).toHaveBeenCalledTimes(readsAfterPointerDown)
     expect(requestFrame).toHaveBeenCalledOnce()
     expect(svg).toHaveAttribute('viewBox', initialViewBox)
 
@@ -675,7 +537,7 @@ describe('AgentMap', () => {
     expect(svg.getAttribute('viewBox')).not.toBe(initialViewBox)
 
     requestFrame.mockClear()
-    const readsBeforeWheel = boundsSpy.mock.calls.length
+    const readsBeforeWheel = environment.boundsSpy.mock.calls.length
     const wheel = (): void => {
       const event = new Event('wheel', { bubbles: true, cancelable: true })
       Object.defineProperties(event, {
@@ -688,7 +550,7 @@ describe('AgentMap', () => {
     }
     wheel()
     wheel()
-    expect(boundsSpy).toHaveBeenCalledTimes(readsBeforeWheel + 1)
+    expect(environment.boundsSpy).toHaveBeenCalledTimes(readsBeforeWheel + 1)
     expect(requestFrame).toHaveBeenCalledOnce()
   })
 
diff --git a/src/renderer/src/components/dashboard-popout/AgentMapCanvas.tsx b/src/renderer/src/components/dashboard-popout/AgentMapCanvas.tsx
index b3203ebf701..3b71f0f2006 100644
--- a/src/renderer/src/components/dashboard-popout/AgentMapCanvas.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentMapCanvas.tsx
@@ -28,6 +28,7 @@ import {
 import type { AgentMapViewport } from './agent-map-viewport-transition'
 import { useAgentMapContextMenus } from './useAgentMapContextMenus'
 import { useAgentMapCanvasSize } from './useAgentMapCanvasSize'
+import { useAgentMapPointerHold } from './useAgentMapPointerHold'
 import { useAgentMapMotionLayout } from './useAgentMapMotionLayout'
 import { useAgentMapSelectedFocus } from './useAgentMapSelectedFocus'
 import { useAgentMapViewportTransition } from './useAgentMapViewportTransition'
@@ -86,6 +87,7 @@ export const AgentMapCanvas = forwardRef<AgentMapCanvasHandle, AgentMapCanvasPro
     const pendingViewportRef = useRef<AgentMapViewport | null>(null)
     const interactionBoundsRef = useRef<DOMRect | null>(null)
     const hasShownProjectsRef = useRef(layout.projects.length > 0)
+    const { held, hold, release: releaseHold, clearDrag } = useAgentMapPointerHold(dragRef)
     const clearInteractionBounds = useCallback(() => {
       interactionBoundsRef.current = null
     }, [])
@@ -315,7 +317,7 @@ export const AgentMapCanvas = forwardRef<AgentMapCanvasHandle, AgentMapCanvasPro
               'Nested project, workspace, and agent map'
             )}
             onPointerDown={(event) => {
-              if (event.button !== 0) {
+              if (event.button !== 0 || dragRef.current) {
                 return
               }
               if (
@@ -337,11 +339,16 @@ export const AgentMapCanvas = forwardRef<AgentMapCanvasHandle, AgentMapCanvasPro
                 worldPerPixelX: baseWidth / current.zoom / bounds.width,
                 worldPerPixelY: baseHeight / current.zoom / bounds.height
               }
+              hold(event.target as Element)
               event.currentTarget.setPointerCapture(event.pointerId)
             }}
             onPointerMove={(event) => {
               const drag = dragRef.current
-              if (!drag || drag.pointerId !== event.pointerId) {
+              if (!drag) {
+                releaseHold()
+                return
+              }
+              if (drag.pointerId !== event.pointerId) {
                 return
               }
               scheduleViewport({
@@ -353,14 +360,19 @@ export const AgentMapCanvas = forwardRef<AgentMapCanvasHandle, AgentMapCanvasPro
               })
             }}
             onPointerUp={(event) => {
-              if (dragRef.current?.pointerId === event.pointerId) {
-                dragRef.current = null
+              if (clearDrag(event.pointerId)) {
                 event.currentTarget.releasePointerCapture(event.pointerId)
               }
             }}
             onPointerCancel={(event) => {
-              if (dragRef.current?.pointerId === event.pointerId) {
-                dragRef.current = null
+              clearDrag(event.pointerId)
+            }}
+            onLostPointerCapture={(event) => {
+              clearDrag(event.pointerId)
+            }}
+            onPointerLeave={() => {
+              if (!dragRef.current) {
+                releaseHold()
               }
             }}
           >
@@ -370,6 +382,8 @@ export const AgentMapCanvas = forwardRef<AgentMapCanvasHandle, AgentMapCanvasPro
               zoom={zoom}
               labelScale={labelScale}
               mapScale={mapScale}
+              heldProjectId={held?.projectId ?? null}
+              heldWorktreeId={held?.worktreeId ?? null}
               selectedPaneKey={selectedPaneKey}
               allowAggregation={allowAggregation}
               showOrchestrationLinks={showOrchestrationLinks}
diff --git a/src/renderer/src/components/dashboard-popout/AgentMapProjectLabel.test.tsx b/src/renderer/src/components/dashboard-popout/AgentMapProjectLabel.test.tsx
index 7846e010c78..c900aa01740 100644
--- a/src/renderer/src/components/dashboard-popout/AgentMapProjectLabel.test.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentMapProjectLabel.test.tsx
@@ -39,6 +39,8 @@ describe('AgentMapScene project labels', () => {
           zoom={1}
           labelScale={1}
           mapScale={0.5}
+          heldProjectId={null}
+          heldWorktreeId={null}
           selectedPaneKey={null}
           allowAggregation
           showOrchestrationLinks
diff --git a/src/renderer/src/components/dashboard-popout/AgentMapRingHover.test.tsx b/src/renderer/src/components/dashboard-popout/AgentMapRingHover.test.tsx
new file mode 100644
index 00000000000..ccc3b29e89f
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/AgentMapRingHover.test.tsx
@@ -0,0 +1,124 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+import { fireEvent } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+import { card, installAgentMapEnvironment, renderMap } from './agent-map-render-test-harness'
+
+/** A ring has to stay open for as long as the pointer is working inside it —
+ *  across its own contents, and across a pan drag that takes pointer capture. */
+describe('AgentMap ring hover', () => {
+  installAgentMapEnvironment()
+
+  it('reveals the hovered workspace name and agent count above every other label', () => {
+    const { container } = renderMap([
+      card(),
+      card({ paneKey: 'pane-2', conversationName: 'Agent beta' })
+    ])
+    expect(container.querySelector('[data-agent-map-hover-label]')).not.toBeInTheDocument()
+
+    fireEvent.pointerOver(container.querySelector('.agent-map-worktree-group')!)
+
+    const hovered = container.querySelector('[data-agent-map-hover-label]')!
+    expect(hovered.querySelector('.agent-map-worktree-label')).toHaveTextContent('Agent map')
+    expect(hovered.querySelector('.agent-map-worktree-count')).toHaveTextContent('2 agents')
+    expect(hovered.querySelector('.agent-map-worktree-label-group')).toHaveClass(
+      'is-active',
+      'is-count-visible'
+    )
+    // The hovered name is hoisted, not duplicated, and draws after every ring.
+    const labels = container.querySelectorAll('.agent-map-worktree-label-group')
+    expect(labels).toHaveLength(1)
+    const lastRing = [...container.querySelectorAll('[data-agent-map-worktree]')].at(-1)!
+    expect(lastRing.compareDocumentPosition(labels[0]) & Node.DOCUMENT_POSITION_FOLLOWING).toBe(4)
+  })
+
+  it('hides the hovered workspace label again when the pointer leaves', () => {
+    const { container } = renderMap([card()])
+    const group = container.querySelector('.agent-map-worktree-group')!
+
+    fireEvent.pointerOver(group)
+    expect(container.querySelector('[data-agent-map-hover-label]')).toBeInTheDocument()
+
+    fireEvent.pointerOut(group)
+    expect(container.querySelector('[data-agent-map-hover-label]')).not.toBeInTheDocument()
+  })
+
+  it('keeps the pressed rings lit for the whole pan drag', () => {
+    const { container } = renderMap([card()])
+    const svg = container.querySelector('svg')!
+    const projectRing = container.querySelector('[data-agent-map-project-id]')!
+    const worktreeGroup = container.querySelector('.agent-map-worktree-group')!
+    // Pointer capture retargets :hover to the <svg> mid-gesture, so CSS alone
+    // cannot hold the ring open — the class has to survive the drag.
+    fireEvent.pointerDown(projectRing, { button: 0, pointerId: 1 })
+
+    expect(projectRing).toHaveClass('is-held')
+
+    fireEvent.pointerMove(svg, { pointerId: 1, clientX: 40, clientY: 24 })
+    expect(projectRing).toHaveClass('is-held')
+
+    fireEvent.pointerUp(svg, { pointerId: 1 })
+    expect(projectRing).not.toHaveClass('is-held')
+    expect(worktreeGroup).not.toHaveClass('is-held')
+  })
+
+  it('holds the workspace name up while panning from inside that workspace', () => {
+    const { container } = renderMap([card()])
+    const svg = container.querySelector('svg')!
+    const worktreeGroup = container.querySelector('[data-agent-map-worktree-id]')!
+    // The aggregate bubble sits inside the group but is not the ring, so a press
+    // there pans rather than opening the workspace popover.
+    fireEvent.pointerDown(worktreeGroup, { button: 0, pointerId: 1 })
+    fireEvent.pointerMove(svg, { pointerId: 1, clientX: 40, clientY: 24 })
+
+    expect(worktreeGroup).toHaveClass('is-held')
+    expect(container.querySelector('[data-agent-map-hover-label]')).toBeInTheDocument()
+  })
+
+  it('drops the held rings when the pan is cancelled', () => {
+    const { container } = renderMap([card()])
+    const svg = container.querySelector('svg')!
+    const projectRing = container.querySelector('[data-agent-map-project-id]')!
+
+    fireEvent.pointerDown(projectRing, { button: 0, pointerId: 1 })
+    fireEvent.pointerCancel(svg, { pointerId: 1 })
+
+    expect(projectRing).not.toHaveClass('is-held')
+  })
+
+  it('drops the held rings and drag when pointer capture is lost', () => {
+    const { container } = renderMap([card()])
+    const svg = container.querySelector('svg')!
+    const projectRing = container.querySelector('[data-agent-map-project-id]')!
+
+    fireEvent.pointerDown(projectRing, { button: 0, pointerId: 1 })
+    fireEvent.lostPointerCapture(svg, { pointerId: 1 })
+
+    expect(projectRing).not.toHaveClass('is-held')
+  })
+
+  it('keeps a focused workspace label visible after its pointer leaves', () => {
+    const { container } = renderMap([card()])
+    const group = container.querySelector('.agent-map-worktree-group')!
+    const ring = container.querySelector<SVGCircleElement>('.agent-map-worktree-ring')!
+
+    ring.focus()
+    fireEvent.pointerOver(group)
+    fireEvent.pointerOut(group)
+
+    expect(container.querySelector('[data-agent-map-hover-label]')).toBeInTheDocument()
+  })
+
+  it('keeps a hovered workspace label visible after its focus leaves', () => {
+    const { container } = renderMap([card()])
+    const group = container.querySelector('.agent-map-worktree-group')!
+    const ring = container.querySelector<SVGCircleElement>('.agent-map-worktree-ring')!
+
+    fireEvent.pointerOver(group)
+    ring.focus()
+    ring.blur()
+
+    expect(container.querySelector('[data-agent-map-hover-label]')).toBeInTheDocument()
+  })
+})
diff --git a/src/renderer/src/components/dashboard-popout/AgentMapScene.tsx b/src/renderer/src/components/dashboard-popout/AgentMapScene.tsx
index fdd80ff982e..2181e4c0f2c 100644
--- a/src/renderer/src/components/dashboard-popout/AgentMapScene.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentMapScene.tsx
@@ -22,6 +22,9 @@ type AgentMapSceneProps = {
   zoom: number
   labelScale: number
   mapScale: number
+  /** Rings the pointer was pressed in; they stay lit for the whole pan drag. */
+  heldProjectId: string | null
+  heldWorktreeId: string | null
   selectedPaneKey: string | null
   allowAggregation: boolean
   showOrchestrationLinks: boolean
@@ -63,6 +66,8 @@ export const AgentMapScene = memo(function AgentMapScene({
   zoom,
   labelScale,
   mapScale,
+  heldProjectId,
+  heldWorktreeId,
   selectedPaneKey,
   allowAggregation,
   showOrchestrationLinks,
@@ -74,9 +79,16 @@ export const AgentMapScene = memo(function AgentMapScene({
   onOpenWorkspaceContextMenu,
   onAgentKeyDown
 }: AgentMapSceneProps): React.JSX.Element {
-  const [activeWorktreeId, setActiveWorktreeId] = useState<string | null>(null)
-  const handleLabelActiveChange = useCallback((worktreeId: string, active: boolean): void => {
-    setActiveWorktreeId((current) =>
+  const [hoveredWorktreeId, setHoveredWorktreeId] = useState<string | null>(null)
+  const [focusedWorktreeId, setFocusedWorktreeId] = useState<string | null>(null)
+  const activeWorktreeId = heldWorktreeId ?? hoveredWorktreeId ?? focusedWorktreeId
+  const handleLabelHoverChange = useCallback((worktreeId: string, active: boolean): void => {
+    setHoveredWorktreeId((current) =>
+      active ? worktreeId : current === worktreeId ? null : current
+    )
+  }, [])
+  const handleLabelFocusChange = useCallback((worktreeId: string, active: boolean): void => {
+    setFocusedWorktreeId((current) =>
       active ? worktreeId : current === worktreeId ? null : current
     )
   }, [])
@@ -84,6 +96,19 @@ export const AgentMapScene = memo(function AgentMapScene({
     () => selectVisibleAgentMapLabels(layout, labelScale, mapScale),
     [labelScale, layout, mapScale]
   )
+  const activeWorktree = useMemo(() => {
+    if (!activeWorktreeId) {
+      return null
+    }
+    for (const project of layout.projects) {
+      for (const worktree of project.worktrees) {
+        if (worktree.id === activeWorktreeId) {
+          return worktree
+        }
+      }
+    }
+    return null
+  }, [activeWorktreeId, layout])
   const visibleAgentsByPaneKey = useMemo(() => {
     const agents = new Map<string, VisibleAgentLocation>()
     for (const project of layout.projects) {
@@ -125,7 +150,8 @@ export const AgentMapScene = memo(function AgentMapScene({
         return (
           <g
             key={project.id}
-            className={`agent-map-project-node${project.motionState ? ` is-${project.motionState}` : ''}`}
+            className={`agent-map-project-node${project.motionState ? ` is-${project.motionState}` : ''}${heldProjectId === project.id ? ' is-held' : ''}`}
+            data-agent-map-project-id={project.id}
             aria-hidden={project.motionState === 'exiting' || undefined}
           >
             <circle
@@ -180,6 +206,7 @@ export const AgentMapScene = memo(function AgentMapScene({
                 worktree={worktree}
                 zoom={zoom}
                 mapScale={mapScale}
+                held={heldWorktreeId === worktree.id}
                 selectedPaneKey={selectedPaneKey}
                 allowAggregation={allowAggregation}
                 showOrchestrationLinks={showOrchestrationLinks}
@@ -188,24 +215,24 @@ export const AgentMapScene = memo(function AgentMapScene({
                 onSelectAgent={onSelectAgent}
                 onSpawnAgent={onSpawnAgent}
                 onOpenWorkspaceContextMenu={onOpenWorkspaceContextMenu}
-                onLabelActiveChange={handleLabelActiveChange}
+                onLabelHoverChange={handleLabelHoverChange}
+                onLabelFocusChange={handleLabelFocusChange}
                 onAgentKeyDown={onAgentKeyDown}
               />
             ))}
             <g className="agent-map-worktree-label-layer">
-              {project.worktrees.map((worktree) => (
-                <AgentMapWorktreeLabel
-                  key={worktree.id}
-                  worktree={worktree}
-                  visible={visibleLabels.worktreeIds.has(worktree.id)}
-                  active={
-                    activeWorktreeId === worktree.id &&
-                    visibleLabels.worktreeAgentSafeIds.has(worktree.id)
-                  }
-                  labelScale={labelScale}
-                  mapScale={mapScale}
-                />
-              ))}
+              {project.worktrees.map((worktree) =>
+                worktree.id === activeWorktreeId ? null : (
+                  <AgentMapWorktreeLabel
+                    key={worktree.id}
+                    worktree={worktree}
+                    visible={visibleLabels.worktreeIds.has(worktree.id)}
+                    active={false}
+                    labelScale={labelScale}
+                    mapScale={mapScale}
+                  />
+                )
+              )}
             </g>
             <g
               transform={`translate(${project.x} ${project.y - project.radius}) scale(${labelScale})`}
@@ -237,6 +264,19 @@ export const AgentMapScene = memo(function AgentMapScene({
           </g>
         )
       })}
+      {/* Drawn last so a hovered name clears every other project's rings, and
+       *  outside the declutter pass so it reads at any zoom. */}
+      {activeWorktree ? (
+        <g className="agent-map-worktree-hover-label-layer" data-agent-map-hover-label="">
+          <AgentMapWorktreeLabel
+            worktree={activeWorktree}
+            visible={visibleLabels.worktreeIds.has(activeWorktree.id)}
+            active
+            labelScale={labelScale}
+            mapScale={mapScale}
+          />
+        </g>
+      ) : null}
     </>
   )
 })
diff --git a/src/renderer/src/components/dashboard-popout/AgentMapStatusGlow.test.tsx b/src/renderer/src/components/dashboard-popout/AgentMapStatusGlow.test.tsx
new file mode 100644
index 00000000000..8803b3336a5
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/AgentMapStatusGlow.test.tsx
@@ -0,0 +1,26 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+import { describe, expect, it } from 'vitest'
+import { card, installAgentMapEnvironment, renderMap } from './agent-map-render-test-harness'
+
+describe('AgentMap status glow', () => {
+  installAgentMapEnvironment()
+
+  it.each([
+    { bucket: 'working', dotState: 'working', unseen: false, glows: true },
+    { bucket: 'attention', dotState: 'waiting', unseen: false, glows: true },
+    { bucket: 'attention', dotState: 'blocked', unseen: false, glows: true },
+    { bucket: 'done', dotState: 'done', unseen: true, glows: false },
+    { bucket: 'idle', dotState: 'idle', unseen: false, glows: false }
+  ] as const)('applies the expected halo for $dotState agents', (state) => {
+    const { container } = renderMap([card(state)])
+    const glow = container.querySelector('[data-agent-map-agent-status-glow]')
+
+    if (state.glows) {
+      expect(glow).toHaveAttribute('data-agent-active-status', state.dotState)
+      return
+    }
+    expect(glow).not.toBeInTheDocument()
+  })
+})
diff --git a/src/renderer/src/components/dashboard-popout/AgentMapWorktreeLabel.tsx b/src/renderer/src/components/dashboard-popout/AgentMapWorktreeLabel.tsx
index 455b20df5bd..27a1c455341 100644
--- a/src/renderer/src/components/dashboard-popout/AgentMapWorktreeLabel.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentMapWorktreeLabel.tsx
@@ -17,7 +17,8 @@ export const AgentMapWorktreeLabel = memo(function AgentMapWorktreeLabel({
   labelScale,
   mapScale
 }: AgentMapWorktreeLabelProps): React.JSX.Element {
-  const showCount = visible && (active || worktree.radius * mapScale >= 80)
+  // Hover is an explicit ask for this workspace's detail, so it outranks declutter.
+  const showCount = active || (visible && worktree.radius * mapScale >= 80)
   const agentCountText = translate(
     'dashboardPopout.map.agentCount',
     worktree.agents.length === 1 ? '{{count}} agent' : '{{count}} agents',
diff --git a/src/renderer/src/components/dashboard-popout/AgentMapWorktreeRingNode.tsx b/src/renderer/src/components/dashboard-popout/AgentMapWorktreeRingNode.tsx
index 251fabbb079..ee49a574901 100644
--- a/src/renderer/src/components/dashboard-popout/AgentMapWorktreeRingNode.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentMapWorktreeRingNode.tsx
@@ -22,6 +22,8 @@ type AgentMapWorktreeRingNodeProps = {
   worktree: AgentMapWorktreeRing
   zoom: number
   mapScale: number
+  /** Pressed at the start of a pan drag; keeps the ring lit through the gesture. */
+  held: boolean
   selectedPaneKey: string | null
   allowAggregation: boolean
   showOrchestrationLinks: boolean
@@ -33,7 +35,8 @@ type AgentMapWorktreeRingNodeProps = {
     event: React.MouseEvent<SVGCircleElement>,
     worktree: AgentMapWorktreeRing
   ) => void
-  onLabelActiveChange: (worktreeId: string, active: boolean) => void
+  onLabelHoverChange: (worktreeId: string, active: boolean) => void
+  onLabelFocusChange: (worktreeId: string, active: boolean) => void
   onAgentKeyDown: (event: React.KeyboardEvent<SVGGElement>, agent: AgentMapAgentNode) => void
 }
 
@@ -175,6 +178,7 @@ export const AgentMapWorktreeRingNode = memo(function AgentMapWorktreeRingNode({
   worktree,
   zoom,
   mapScale,
+  held,
   selectedPaneKey,
   allowAggregation,
   showOrchestrationLinks,
@@ -183,7 +187,8 @@ export const AgentMapWorktreeRingNode = memo(function AgentMapWorktreeRingNode({
   onSelectAgent,
   onSpawnAgent,
   onOpenWorkspaceContextMenu,
-  onLabelActiveChange,
+  onLabelHoverChange,
+  onLabelFocusChange,
   onAgentKeyDown
 }: AgentMapWorktreeRingNodeProps): React.JSX.Element {
   const [detailsOpen, setDetailsOpen] = useState(false)
@@ -196,14 +201,15 @@ export const AgentMapWorktreeRingNode = memo(function AgentMapWorktreeRingNode({
   return (
     <Popover open={detailsOpen && !exiting} onOpenChange={setDetailsOpen}>
       <g
-        className={`agent-map-worktree-group${worktree.motionState ? ` is-${worktree.motionState}` : ''}`}
+        className={`agent-map-worktree-group${worktree.motionState ? ` is-${worktree.motionState}` : ''}${held ? ' is-held' : ''}`}
+        data-agent-map-worktree-id={worktree.id}
         aria-hidden={exiting || undefined}
-        onPointerEnter={() => onLabelActiveChange(worktree.id, true)}
-        onPointerLeave={() => onLabelActiveChange(worktree.id, false)}
-        onFocus={() => onLabelActiveChange(worktree.id, true)}
+        onPointerEnter={() => onLabelHoverChange(worktree.id, true)}
+        onPointerLeave={() => onLabelHoverChange(worktree.id, false)}
+        onFocus={() => onLabelFocusChange(worktree.id, true)}
         onBlur={(event) => {
           if (!event.currentTarget.contains(event.relatedTarget as Node | null)) {
-            onLabelActiveChange(worktree.id, false)
+            onLabelFocusChange(worktree.id, false)
           }
         }}
       >
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx
index 2d72b7304f9..cc20e2db048 100644
--- a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx
@@ -44,6 +44,7 @@ const imeHarness = vi.hoisted(() => ({
     claimKeyEvent: ReturnType<typeof vi.fn>
     dispose: ReturnType<typeof vi.fn>
     sendInput: (data: string) => void
+    getKittyKeyboardFlags: () => number
   }[],
   trackers: [] as { dispose: ReturnType<typeof vi.fn> }[],
   claimResult: false
@@ -115,11 +116,17 @@ vi.mock('@/lib/shortcut-platform', () => ({
   getShortcutPlatform: () => platformState.value
 }))
 vi.mock('@/components/terminal-pane/terminal-ime-native-text-forwarder', () => ({
-  installTerminalImeNativeTextForwarder: (args: { sendInput: (data: string) => void }) => {
+  installTerminalImeNativeTextForwarder: (args: {
+    sendInput: (data: string) => void
+    getKittyKeyboardFlags?: () => number
+  }) => {
     const forwarder = {
       claimKeyEvent: vi.fn(() => imeHarness.claimResult),
       dispose: vi.fn(),
-      sendInput: args.sendInput
+      sendInput: args.sendInput,
+      // Why captured: the bridge's whole job is handing the live mirror to the
+      // forwarder, so the test reads what a real commit would read.
+      getKittyKeyboardFlags: args.getKittyKeyboardFlags ?? ((): number => 0)
     }
     imeHarness.forwarders.push(forwarder)
     return forwarder
@@ -270,6 +277,26 @@ describe('AgentTerminalPreview', () => {
     expect(imeHarness.trackers).toHaveLength(0)
   })
 
+  // The bridge omitted this dependency entirely, so every Preview
+  // commit was evaluated at flags 0. Ordering and provenance live in
+  // preview-terminal-snapshot-replay.test.ts; this pins the wiring.
+  it('hands the forwarder the live mirror seeded from the snapshot flags', async () => {
+    platformState.value = 'darwin'
+    connect.mockResolvedValue({
+      snapshot: { data: '', cols: 80, rows: 24, seq: 1, kittyKeyboardFlags: 8 },
+      replay: []
+    })
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await waitFor(() => expect(imeHarness.forwarders).toHaveLength(1))
+    await waitFor(() => expect(imeHarness.forwarders[0]!.getKittyKeyboardFlags()).toBe(8))
+
+    // Live output keeps advancing the same mirror the forwarder reads.
+    act(() => {
+      emitData?.({ type: 'data', ptyId: 'pty-1', data: '\x1b[<u', bytes: 4 })
+    })
+    expect(imeHarness.forwarders[0]!.getKittyKeyboardFlags()).toBe(0)
+  })
+
   it('disposes the IME bridge on unmount', async () => {
     platformState.value = 'darwin'
     const view = render(<AgentTerminalPreview ptyId="pty-1" />)
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx
index d187694b841..340225784f2 100644
--- a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx
@@ -6,6 +6,7 @@ import { subscribeToTerminalUserInput } from '@/components/terminal-pane/termina
 import { composeActiveTerminalTheme } from '@/components/terminal-pane/terminal-appearance'
 import { useSystemPrefersDark } from '@/components/terminal-pane/use-system-prefers-dark'
 import { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
+import { replayPreviewConnectionSnapshot } from './preview-terminal-snapshot-replay'
 import { useEffectiveMacOptionAsAlt } from '@/lib/keyboard-layout/use-effective-mac-option-as-alt'
 import {
   buildPreviewAppearanceOptions,
@@ -210,7 +211,11 @@ export function AgentTerminalPreview({
 
     const installImeNativeTextBridge = (): void => {
       if (terminal) {
-        imeBridge = installPreviewImeBridge(terminal)
+        // Why a live getter: kitty state can change between keydown and commit,
+        // and the tracker outlives every reconnect inside this effect.
+        imeBridge = installPreviewImeBridge(terminal, {
+          getKittyKeyboardFlags: () => kittyKeyboardModes.flags
+        })
       }
     }
 
@@ -304,22 +309,13 @@ export function AgentTerminalPreview({
           clamp(snap.rows ?? FALLBACK_ROWS, 2, 200)
         )
         terminal.reset()
-        // Why: the reset drops xterm's kitty flags, so the mirror must restart
-        // from the incoming snapshot instead of the dead session's state.
-        kittyKeyboardModes.reset()
-      }
-      if (snap.scrollbackAnsi) {
-        writeReplayed(snap.scrollbackAnsi)
-      }
-      if (snap.data) {
-        writeReplayed(snap.data)
-      }
-      if (snap.pendingEscapeTailAnsi) {
-        writeReplayed(snap.pendingEscapeTailAnsi)
-      }
-      for (const data of connection.replay) {
-        writeReplayed(data)
       }
+      replayPreviewConnectionSnapshot({
+        snapshot: snap,
+        replay: connection.replay,
+        kittyKeyboardModes,
+        write: (chunk, live) => writeReplayed(chunk, undefined, live)
+      })
       for (const payload of pendingLivePayloads.splice(0)) {
         writeLive(payload)
       }
diff --git a/src/renderer/src/components/dashboard-popout/agent-map-hover-containment.test.ts b/src/renderer/src/components/dashboard-popout/agent-map-hover-containment.test.ts
new file mode 100644
index 00000000000..ea5bbab362e
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/agent-map-hover-containment.test.ts
@@ -0,0 +1,49 @@
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+const css = readFileSync(
+  resolve(process.cwd(), 'src/renderer/src/components/dashboard-popout/agent-map.css'),
+  'utf8'
+)
+
+const PROJECT_SCALE =
+  /:where\(\s*\.agent-map-project-node:hover,\s*\.agent-map-project-node:focus-within,\s*\.agent-map-project-node\.is-held\s*\)\s*\.agent-map-project-ring\s*\{([^}]*)\}/
+const WORKTREE_SCALE =
+  /:where\(\s*\.agent-map-worktree-group:hover,\s*\.agent-map-worktree-group:focus-within,\s*\.agent-map-worktree-group\.is-held\s*\)\s*\.agent-map-worktree-ring\s*\{([^}]*)\}/
+
+/** A ring that only reacts to :hover on itself pulses shut whenever the pointer
+ *  crosses onto something drawn inside it, and again when a pan drag takes
+ *  pointer capture. Both triggers have to live on the containing group. */
+describe('Agent Map hover containment', () => {
+  it('scales each ring from its containing group, never from the ring element', () => {
+    expect(css).not.toMatch(/\.agent-map-(?:project|worktree)-ring:hover/)
+    expect(css.match(PROJECT_SCALE)?.[1]).toContain('transform: scale')
+    expect(css.match(WORKTREE_SCALE)?.[1]).toContain('transform: scale')
+  })
+
+  it('keeps the group-scoped hover at ring specificity so state rules still win', () => {
+    // `:where()` contributes no specificity, so the workspace state rules keep
+    // overriding hover fill and stroke — but only while they stay below it.
+    const hoverAt = css.search(WORKTREE_SCALE)
+
+    expect(hoverAt).toBeGreaterThan(css.indexOf('.agent-map-worktree-ring {'))
+    for (const state of ['.is-open', '.is-selected', '.is-working', '.is-blocked']) {
+      expect(css.indexOf(`.agent-map-worktree-ring${state}`)).toBeGreaterThan(hoverAt)
+    }
+  })
+
+  it('expands containing rings for keyboard focus as well as pointer hover', () => {
+    expect(css.match(PROJECT_SCALE)?.[0]).toContain('.agent-map-project-node:focus-within')
+    expect(css.match(WORKTREE_SCALE)?.[0]).toContain('.agent-map-worktree-group:focus-within')
+  })
+
+  it('drops both hover triggers under reduced motion', () => {
+    const reducedMotion = css.slice(css.indexOf('@media (prefers-reduced-motion: reduce)'))
+
+    expect(reducedMotion).toContain('.agent-map-project-node.is-held')
+    expect(reducedMotion).toContain('.agent-map-worktree-group.is-held')
+    expect(reducedMotion).toMatch(/\.agent-map-project-node:hover/)
+    expect(reducedMotion).toMatch(/\.agent-map-worktree-group:hover/)
+  })
+})
diff --git a/src/renderer/src/components/dashboard-popout/agent-map-label-declutter.test.ts b/src/renderer/src/components/dashboard-popout/agent-map-label-declutter.test.ts
index 28c71c881a1..ad02fb56243 100644
--- a/src/renderer/src/components/dashboard-popout/agent-map-label-declutter.test.ts
+++ b/src/renderer/src/components/dashboard-popout/agent-map-label-declutter.test.ts
@@ -90,19 +90,6 @@ describe('selectVisibleAgentMapLabels', () => {
     const labels = selectVisibleAgentMapLabels(layoutOf([covered]), 1, 1)
 
     expect(labels.worktreeIds.size).toBe(0)
-    expect(labels.worktreeAgentSafeIds.size).toBe(0)
-  })
-
-  it('keeps a collision-suppressed workspace title safe to reveal away from agents', () => {
-    const layout = layoutOf([
-      worktree({ id: 'busy', x: 0, y: 0, statusCounts: statusCounts({ working: 3 }) }),
-      worktree({ id: 'calm', name: 'beta', x: 0, y: 0, statusCounts: statusCounts({ done: 1 }) })
-    ])
-
-    const labels = selectVisibleAgentMapLabels(layout, 1, 1)
-
-    expect([...labels.worktreeIds]).toEqual(['busy'])
-    expect([...labels.worktreeAgentSafeIds].sort()).toEqual(['busy', 'calm'])
   })
 
   it('lets a blocked workspace outrank a busier neighbour for the surviving label', () => {
diff --git a/src/renderer/src/components/dashboard-popout/agent-map-label-declutter.ts b/src/renderer/src/components/dashboard-popout/agent-map-label-declutter.ts
index 58a1f53c4d6..841197437e6 100644
--- a/src/renderer/src/components/dashboard-popout/agent-map-label-declutter.ts
+++ b/src/renderer/src/components/dashboard-popout/agent-map-label-declutter.ts
@@ -38,8 +38,6 @@ type LabelGrid = Map<number, Map<number, LabelBox[]>>
 export type AgentMapVisibleLabels = {
   /** Worktree ring ids whose name can render without colliding. */
   worktreeIds: Set<string>
-  /** Worktree names that hover/focus may reveal without covering an agent. */
-  worktreeAgentSafeIds: Set<string>
   /** Project ids whose agent/workspace count line still has room. The count is
    *  the first thing dropped: it repeats what the filter rail already says. */
   projectCountIds: Set<string>
@@ -221,7 +219,6 @@ export function selectVisibleAgentMapLabels(
   })
 
   const worktreeIds = new Set<string>()
-  const worktreeAgentSafeIds = new Set<string>()
   for (const worktree of candidates.slice(0, MAX_LABEL_CANDIDATES)) {
     const box = baselineBox(
       worktree.x,
@@ -234,7 +231,6 @@ export function selectVisibleAgentMapLabels(
     if (collides(agentGrid, box)) {
       continue
     }
-    worktreeAgentSafeIds.add(worktree.id)
     if (collides(grid, box)) {
       continue
     }
@@ -261,5 +257,5 @@ export function selectVisibleAgentMapLabels(
     projectCountIds.add(project.id)
   }
 
-  return { worktreeIds, worktreeAgentSafeIds, projectCountIds }
+  return { worktreeIds, projectCountIds }
 }
diff --git a/src/renderer/src/components/dashboard-popout/agent-map-render-test-harness.tsx b/src/renderer/src/components/dashboard-popout/agent-map-render-test-harness.tsx
new file mode 100644
index 00000000000..45c83a33c8e
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/agent-map-render-test-harness.tsx
@@ -0,0 +1,133 @@
+import { cleanup, render } from '@testing-library/react'
+import { afterEach, beforeEach, vi } from 'vitest'
+import type {
+  DashboardCard,
+  DashboardSleepWorkspaceArgs,
+  DashboardSpawnAgentArgs
+} from '../../../../shared/dashboard-snapshot'
+import type { TuiAgent } from '../../../../shared/types'
+import { AgentMap } from './AgentMap'
+import type { AgentMapState } from './agent-map-filter'
+
+export const NOW = 2_000_000_000
+
+export function card(overrides: Partial<DashboardCard> = {}): DashboardCard {
+  return {
+    paneKey: 'pane-1',
+    ptyId: 'pty-1',
+    agentType: 'codex',
+    bucket: 'working',
+    dotState: 'working',
+    task: 'Build map',
+    repoId: 'repo-1',
+    worktreeId: 'worktree-1',
+    tabId: 'tab-1',
+    leafId: 'leaf-1',
+    repoName: 'Orca',
+    worktreeName: 'Agent map',
+    conversationName: 'Agent alpha',
+    startedAt: NOW - 10 * 60_000,
+    finishedAt: null,
+    stateChangedAt: NOW - 1_000,
+    unseen: false,
+    hostKind: 'local',
+    workspaceKind: 'worktree',
+    ...overrides
+  }
+}
+
+export type RenderMapOptions = {
+  onOpenTerminal?: (card: DashboardCard) => void
+  selectedPaneKey?: string | null
+  compact?: boolean
+  workspaceContextMenusEnabled?: boolean
+  enabledStates?: ReadonlySet<AgentMapState>
+  showOrchestrationLinks?: boolean
+  launchableAgentsByWorktreeId?: Record<string, TuiAgent[]>
+  onSpawnAgent?: (args: DashboardSpawnAgentArgs) => void
+  onSleepWorkspace?: (args: DashboardSleepWorkspaceArgs) => void
+}
+
+export function renderMap(
+  cards: DashboardCard[],
+  {
+    onOpenTerminal = vi.fn(),
+    selectedPaneKey = null,
+    compact = false,
+    workspaceContextMenusEnabled = false,
+    enabledStates,
+    showOrchestrationLinks,
+    launchableAgentsByWorktreeId,
+    onSpawnAgent,
+    onSleepWorkspace
+  }: RenderMapOptions = {}
+): ReturnType<typeof render> {
+  return render(
+    <AgentMap
+      cards={cards}
+      now={NOW}
+      onOpenTerminal={onOpenTerminal}
+      selectedPaneKey={selectedPaneKey}
+      compact={compact}
+      workspaceContextMenusEnabled={workspaceContextMenusEnabled}
+      enabledStates={enabledStates}
+      showOrchestrationLinks={showOrchestrationLinks}
+      launchableAgentsByWorktreeId={launchableAgentsByWorktreeId}
+      onSpawnAgent={onSpawnAgent}
+      onSleepWorkspace={onSleepWorkspace}
+    />
+  )
+}
+
+export type AgentMapTestEnvironment = {
+  /** Exposed so tests can assert the canvas does not re-read layout when idle. */
+  boundsSpy: ReturnType<typeof vi.spyOn>
+}
+
+const CANVAS_BOUNDS = {
+  x: 0,
+  y: 0,
+  left: 0,
+  top: 0,
+  right: 400,
+  bottom: 300,
+  width: 400,
+  height: 300,
+  toJSON: () => ({})
+}
+const ZERO_BOUNDS = { ...CANVAS_BOUNDS, right: 0, bottom: 0, width: 0, height: 0 }
+
+/** Gives the map a measurable canvas and a non-Mac platform, the way every map
+ *  suite needs it. Call once per describe block. */
+export function installAgentMapEnvironment(): AgentMapTestEnvironment {
+  const environment = {} as AgentMapTestEnvironment
+  const originalUserAgent = navigator.userAgent
+
+  beforeEach(() => {
+    Object.defineProperty(navigator, 'userAgent', { configurable: true, value: 'Linux' })
+    vi.stubGlobal(
+      'matchMedia',
+      vi.fn(() => ({ matches: true, addEventListener: vi.fn(), removeEventListener: vi.fn() }))
+    )
+    environment.boundsSpy = vi
+      .spyOn(Element.prototype, 'getBoundingClientRect')
+      .mockImplementation(function getBounds(this: Element) {
+        return this.classList.contains('agent-map-canvas') || this instanceof SVGSVGElement
+          ? CANVAS_BOUNDS
+          : ZERO_BOUNDS
+      })
+  })
+
+  afterEach(() => {
+    cleanup()
+    vi.clearAllMocks()
+    vi.unstubAllGlobals()
+    environment.boundsSpy.mockRestore()
+    Object.defineProperty(navigator, 'userAgent', {
+      configurable: true,
+      value: originalUserAgent
+    })
+  })
+
+  return environment
+}
diff --git a/src/renderer/src/components/dashboard-popout/agent-map.css b/src/renderer/src/components/dashboard-popout/agent-map.css
index 6107332ba0d..fb1f392f707 100644
--- a/src/renderer/src/components/dashboard-popout/agent-map.css
+++ b/src/renderer/src/components/dashboard-popout/agent-map.css
@@ -31,7 +31,13 @@
   vector-effect: non-scaling-stroke;
 }
 
-.agent-map-project-ring:hover {
+/* Group hover includes nested contents; held state bridges pointer capture. */
+:where(
+    .agent-map-project-node:hover,
+    .agent-map-project-node:focus-within,
+    .agent-map-project-node.is-held
+  )
+  .agent-map-project-ring {
   fill: color-mix(in srgb, var(--card) 42%, transparent);
   stroke: var(--ring);
   transform: scale(1.018);
@@ -154,7 +160,12 @@
   stroke: color-mix(in srgb, var(--color-yellow-500) 28%, transparent);
 }
 
-.agent-map-worktree-ring:hover {
+:where(
+    .agent-map-worktree-group:hover,
+    .agent-map-worktree-group:focus-within,
+    .agent-map-worktree-group.is-held
+  )
+  .agent-map-worktree-ring {
   fill: color-mix(in srgb, var(--card) 72%, transparent);
   stroke: var(--ring);
   transform: scale(1.035);
@@ -203,6 +214,11 @@
   text-anchor: middle;
 }
 
+.agent-map-worktree-label-layer,
+.agent-map-worktree-hover-label-layer {
+  pointer-events: none;
+}
+
 .agent-map-worktree-label-group {
   opacity: 0;
   pointer-events: none;
@@ -480,8 +496,18 @@
     transition: none;
   }
 
-  .agent-map-project-ring:hover,
-  .agent-map-worktree-ring:hover,
+  :where(
+      .agent-map-project-node:hover,
+      .agent-map-project-node:focus-within,
+      .agent-map-project-node.is-held
+    )
+    .agent-map-project-ring,
+  :where(
+      .agent-map-worktree-group:hover,
+      .agent-map-worktree-group:focus-within,
+      .agent-map-worktree-group.is-held
+    )
+    .agent-map-worktree-ring,
   .agent-map-agent-node:hover .agent-map-agent-visual,
   .agent-map-agent-node:focus-visible .agent-map-agent-visual {
     transform: none;
diff --git a/src/renderer/src/components/dashboard-popout/dashboard-agent-status-patch.ts b/src/renderer/src/components/dashboard-popout/dashboard-agent-status-patch.ts
index f3d32a9b462..816474eb70f 100644
--- a/src/renderer/src/components/dashboard-popout/dashboard-agent-status-patch.ts
+++ b/src/renderer/src/components/dashboard-popout/dashboard-agent-status-patch.ts
@@ -35,7 +35,7 @@ export function patchDashboardSnapshotFromAgentStatus(
     return { matched: true, snapshot }
   }
   const index = snapshot.cards.findIndex((card) => card.paneKey === event.paneKey)
-  if (index < 0) {
+  if (index === -1) {
     return { matched: false, snapshot }
   }
   const card = snapshot.cards[index]
diff --git a/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts b/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts
new file mode 100644
index 00000000000..3e69cd75d3b
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts
@@ -0,0 +1,281 @@
+// @vitest-environment happy-dom
+// The release oracle: exact outbound bytes from the REAL shared
+// forwarder behind installPreviewImeBridge. A wiring-only mock cannot show that
+// a Preview opened on a bit-3 TUI commits CSI-u, nor that exactly one release
+// leaves the forwarder in either macOS event order.
+import { Terminal } from '@xterm/xterm'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { installPreviewImeBridge } from './preview-terminal-ime-bridge'
+
+vi.mock('@/lib/shortcut-platform', () => ({
+  getShortcutPlatform: () => 'darwin'
+}))
+
+const COMMA = { key: ',', code: 'Comma', keyCode: 188 }
+
+type Session = {
+  emitted: string[]
+  flagReads: number
+  setFlags: (flags: number) => void
+  keydown: (init?: { shiftKey?: boolean; repeat?: boolean; key?: string; code?: string }) => void
+  keyup: (init?: { shiftKey?: boolean; key?: string; code?: string }) => void
+  commit: (text: string) => void
+  /** An input event the text system produced without committing text. */
+  swallow: () => void
+  xtermKittyFlags: () => number
+  dispose: () => void
+}
+
+function open(initialFlags: number): Session {
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const terminal = new Terminal()
+  terminal.open(container)
+  const textarea = terminal.textarea!
+  let flags = initialFlags
+  let flagReads = 0
+  const bridge = installPreviewImeBridge(terminal, {
+    getKittyKeyboardFlags: () => {
+      flagReads += 1
+      return flags
+    }
+  })!
+  terminal.attachCustomKeyEventHandler((event) => !bridge.claimKeyEvent(event))
+  const emitted: string[] = []
+  terminal.onData((data) => emitted.push(data))
+
+  const key = (
+    type: string,
+    init: { key?: string; code?: string; shiftKey?: boolean; repeat?: boolean }
+  ): void => {
+    const event = new KeyboardEvent(type, {
+      key: init.key ?? COMMA.key,
+      code: init.code ?? COMMA.code,
+      shiftKey: init.shiftKey === true,
+      repeat: init.repeat === true,
+      bubbles: true,
+      cancelable: true
+    })
+    Object.defineProperty(event, 'keyCode', { value: COMMA.keyCode })
+    textarea.dispatchEvent(event)
+  }
+
+  const input = (data: string | null): void => {
+    for (const type of ['beforeinput', 'input']) {
+      const event = new InputEvent(type, { bubbles: true })
+      Object.defineProperty(event, 'inputType', { value: 'insertText' })
+      Object.defineProperty(event, 'data', { value: data })
+      textarea.dispatchEvent(event)
+    }
+  }
+
+  return {
+    emitted,
+    get flagReads() {
+      return flagReads
+    },
+    setFlags: (next) => {
+      flags = next
+    },
+    keydown: (init = {}) => key('keydown', init),
+    keyup: (init = {}) => key('keyup', init),
+    commit: (text) => input(text),
+    swallow: () => input(null),
+    xtermKittyFlags: () =>
+      (
+        terminal as unknown as {
+          _core?: { coreService?: { kittyKeyboard?: { flags?: number } } }
+        }
+      )._core?.coreService?.kittyKeyboard?.flags ?? 0,
+    dispose: () => {
+      bridge.dispose()
+      terminal.dispose()
+    }
+  }
+}
+
+describe('preview IME bridge outbound bytes', () => {
+  beforeEach(() => {
+    vi.spyOn(HTMLCanvasElement.prototype, 'getContext').mockReturnValue({
+      measureText: () => ({ width: 10 })
+    } as unknown as CanvasRenderingContext2D)
+  })
+  afterEach(() => {
+    vi.restoreAllMocks()
+    document.body.replaceChildren()
+  })
+
+  // The bug: the bridge omitted getKittyKeyboardFlags entirely, so every commit
+  // was evaluated at flags 0 and a bit-3 TUI received the legacy text it declined.
+  it('encodes the commit from the flags proven before any live output', () => {
+    const session = open(8)
+    session.keydown()
+    session.commit('，')
+    session.keyup()
+    expect(session.emitted.join('')).toBe('\x1b[44u')
+    session.dispose()
+  })
+
+  describe.each([
+    ['keydown -> insertText -> keyup', false],
+    // An ordering some macOS input sources use; the earlier design cleared the
+    // claimed press here, so the later commit could never be encoded as CSI-u.
+    ['keydown -> keyup -> insertText', true]
+  ])('in %s order', (_name, keyupFirst) => {
+    const type = (session: Session): void => {
+      session.keydown()
+      if (keyupFirst) {
+        session.keyup()
+        session.commit('，')
+      } else {
+        session.commit('，')
+        session.keyup()
+      }
+    }
+
+    it.each([
+      ['no flags', 0, '，'],
+      ['disambiguate only', 1, '，'],
+      ['event types', 2, '，\x1b[44;1:3u'],
+      ['all keys as escape codes', 8, '\x1b[44u'],
+      ['all keys + event types', 10, '\x1b[44u\x1b[44;1:3u']
+    ])('emits the %s byte shape', (_flagName, flags, expected) => {
+      const session = open(flags)
+      type(session)
+      expect(session.emitted.join('')).toBe(expected)
+      session.dispose()
+    })
+
+    it('owns the release even though xterm holds no kitty state', () => {
+      const session = open(10)
+      // The forwarder must not delegate the keyup: Preview deliberately never
+      // restores kitty flags into xterm, so xterm would emit nothing here.
+      expect(session.xtermKittyFlags()).toBe(0)
+      type(session)
+      expect(session.emitted.join('')).toBe('\x1b[44u\x1b[44;1:3u')
+      session.dispose()
+    })
+
+    it('reads the mutable getter exactly once, at commit time', () => {
+      const session = open(0)
+      session.keydown()
+      expect(session.flagReads).toBe(0)
+      session.setFlags(8)
+      if (keyupFirst) {
+        session.keyup()
+        expect(session.flagReads).toBe(0)
+        session.commit('，')
+      } else {
+        session.commit('，')
+        session.keyup()
+      }
+      expect(session.flagReads).toBe(1)
+      // The commit-time read is what both the press AND its release encode from.
+      expect(session.emitted.join('')).toBe('\x1b[44u')
+      session.dispose()
+    })
+
+    it('emits nothing when the input source swallowed the press', () => {
+      const session = open(10)
+      session.keydown()
+      if (keyupFirst) {
+        session.keyup()
+        session.swallow()
+      } else {
+        session.swallow()
+        session.keyup()
+      }
+      // A release describes a press the app received; none did.
+      expect(session.emitted.join('')).toBe('')
+      session.dispose()
+    })
+  })
+
+  it('encodes the release from the keyup state when Shift is released first', () => {
+    const session = open(10)
+    // `!` on Digit1: the press reports the base key with the Shift modifier.
+    session.keydown({ key: '!', code: 'Digit1', shiftKey: true })
+    session.commit('！')
+    session.keyup({ key: '1', code: 'Digit1', shiftKey: false })
+    // 49 is `1`; the release carries no modifier because none was held at release.
+    expect(session.emitted.join('')).toBe('\x1b[49;2u\x1b[49;1:3u')
+    session.dispose()
+  })
+
+  it('emits one release for a held key across auto-repeat', () => {
+    const session = open(10)
+    session.keydown()
+    session.commit('，')
+    session.keydown({ repeat: true })
+    session.commit('，')
+    session.keyup()
+    // Press, repeat, then exactly one release for the single physical press.
+    expect(session.emitted.join('')).toBe('\x1b[44u\x1b[44;1:2u\x1b[44;1:3u')
+    session.dispose()
+  })
+
+  it('keeps an owed release when a later repeat commits under flags that owe none', () => {
+    const session = open(10)
+    session.keydown()
+    session.commit('，')
+    session.setFlags(8)
+    session.keydown({ repeat: true })
+    session.commit('，')
+    session.setFlags(10)
+    session.keyup()
+    // The repeat requested no event types, but its commit must not erase the
+    // release the delivered first press still owes under the flags it was
+    // sent with.
+    expect(session.emitted.join('')).toBe('\x1b[44u\x1b[44u\x1b[44;1:3u')
+    session.dispose()
+  })
+
+  it('suppresses the owed release when event types are no longer negotiated at keyup', () => {
+    // xterm parity: KittyKeyboard.evaluate drops RELEASE reports the moment
+    // report_event_types is gone, so an app that popped the mode — or the
+    // successor shell of a TUI that quit on this very key — never receives
+    // CSI-u bytes it did not negotiate.
+    const session = open(10)
+    session.keydown()
+    session.commit('，')
+    session.setFlags(0)
+    session.keyup()
+    expect(session.emitted.join('')).toBe('\x1b[44u')
+    session.dispose()
+  })
+
+  it('releases each key of a two-key rollover exactly once', () => {
+    const session = open(10)
+    session.keydown()
+    session.commit('，')
+    session.keydown({ key: '.', code: 'Period' })
+    session.commit('。')
+    session.keyup()
+    session.keyup({ key: '.', code: 'Period' })
+    expect(session.emitted.join('')).toBe('\x1b[44u\x1b[46u\x1b[44;1:3u\x1b[46;1:3u')
+    session.dispose()
+  })
+
+  it('leaves no release behind when a claim is retired without committing', () => {
+    const session = open(10)
+    session.keydown()
+    // The input source ate the first press; the next keydown retires it.
+    session.keydown({ key: '.', code: 'Period' })
+    session.commit('。')
+    session.keyup()
+    session.keyup({ key: '.', code: 'Period' })
+    expect(session.emitted.join('')).toBe('\x1b[46u\x1b[46;1:3u')
+    session.dispose()
+  })
+
+  it('synthesizes nothing on blur or disposal', () => {
+    const session = open(10)
+    session.keydown()
+    session.commit('，')
+    session.emitted.length = 0
+    document.querySelector('.xterm')?.dispatchEvent(new FocusEvent('blur', { bubbles: true }))
+    session.keyup()
+    session.dispose()
+    expect(session.emitted.join('')).toBe('')
+  })
+})
diff --git a/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge.ts b/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge.ts
index 5171a529edb..dcfa851d920 100644
--- a/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge.ts
+++ b/src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge.ts
@@ -9,14 +9,29 @@ export type PreviewImeBridge = {
   dispose: () => void
 }
 
+export type PreviewImeBridgeOptions = {
+  /**
+   * The preview's live kitty mirror, read once per commit. Required, not
+   * optional: omitting it evaluated every commit at flags `0`, so a Preview on
+   * a bit-3 TUI silently sent legacy text the app had declined.
+   */
+  getKittyKeyboardFlags: () => number
+}
+
 /**
  * Native-text bridge for the preview terminal.
  *
  * Why: xterm's kitty encoder can encode+cancel a printable keydown before
  * Chromium commits IME/native text, silently dropping the glyph. Mirrors
  * TerminalPane's forwarder, macOS-only like the pane's install.
+ *
+ * Bit policy stays in terminal-ime-kitty-commit-encoding.ts: the getter is
+ * forwarded unchanged, never masked or reduced to a boolean.
  */
-export function installPreviewImeBridge(terminal: Terminal): PreviewImeBridge | null {
+export function installPreviewImeBridge(
+  terminal: Terminal,
+  options: PreviewImeBridgeOptions
+): PreviewImeBridge | null {
   if (getShortcutPlatform() !== 'darwin') {
     return null
   }
@@ -24,7 +39,8 @@ export function installPreviewImeBridge(terminal: Terminal): PreviewImeBridge |
   const forwarder = installTerminalImeNativeTextForwarder({
     terminalElement: terminal.element,
     isComposing: () => compositionTracker?.isActive() ?? false,
-    sendInput: (data) => terminal.input(data)
+    sendInput: (data) => terminal.input(data),
+    getKittyKeyboardFlags: options.getKittyKeyboardFlags
   })
   return {
     claimKeyEvent: (event) => forwarder?.claimKeyEvent(event) ?? false,
diff --git a/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts b/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts
new file mode 100644
index 00000000000..3e288626259
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts
@@ -0,0 +1,124 @@
+import { describe, expect, it } from 'vitest'
+import { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
+import type {
+  TerminalPreviewReplayChunk,
+  TerminalPreviewSnapshot
+} from '../../../../shared/terminal-preview'
+import { replayPreviewConnectionSnapshot } from './preview-terminal-snapshot-replay'
+
+function apply(
+  snapshot: Partial<TerminalPreviewSnapshot>,
+  replay: TerminalPreviewReplayChunk[] = [],
+  kittyKeyboardModes = new TerminalKittyKeyboardModeTracker()
+): { modes: TerminalKittyKeyboardModeTracker; written: string[] } {
+  const written: string[] = []
+  replayPreviewConnectionSnapshot({
+    snapshot: { data: '', cols: 80, rows: 24, ...snapshot },
+    replay,
+    kittyKeyboardModes,
+    write: (chunk, live) => {
+      written.push(chunk)
+      if (live) {
+        kittyKeyboardModes.scan(chunk)
+      } else {
+        kittyKeyboardModes.scanReplay(chunk)
+      }
+    }
+  })
+  return { modes: kittyKeyboardModes, written }
+}
+
+// The Preview's mirror is the only thing that can tell the IME
+// forwarder what the TUI negotiated, and snapshot ANSI never carries kitty
+// pushes — so the flags have to arrive as metadata and be applied in order.
+describe('replayPreviewConnectionSnapshot', () => {
+  it('adopts flags the snapshot owner proved, before any live output', () => {
+    const { modes } = apply({ kittyKeyboardFlags: 8 })
+    expect(modes.flags).toBe(8)
+    expect(modes.snapshotFlags).toBe(8)
+  })
+
+  it('leaves the mirror unproven and at the raw-text fallback when the field is absent', () => {
+    const { modes } = apply({ data: 'plain output' })
+    expect(modes.flags).toBe(0)
+    expect(modes.snapshotFlags).toBeUndefined()
+
+    // A later explicit negotiation still upgrades it.
+    modes.scan('\x1b[>8u')
+    expect(modes.flags).toBe(8)
+  })
+
+  it('replaces an earlier 8 when a replacement snapshot proves 0', () => {
+    const modes = new TerminalKittyKeyboardModeTracker()
+    apply({ kittyKeyboardFlags: 8 }, [], modes)
+    apply({ kittyKeyboardFlags: 0 }, [], modes)
+    expect(modes.flags).toBe(0)
+    expect(modes.snapshotFlags).toBe(0)
+  })
+
+  it('carries live-proven flags across a resync snapshot that proves nothing', () => {
+    // A grid change or capture overflow against an old host fetches a
+    // replacement snapshot with no kitty metadata; wiping the mirror there
+    // reintroduces the raw-text-into-a-bit-3-TUI bug on every resync.
+    const modes = new TerminalKittyKeyboardModeTracker()
+    apply({ data: 'first frame' }, [], modes)
+    modes.scan('\x1b[>8u')
+    apply({ data: 'second frame' }, [], modes)
+    expect(modes.flags).toBe(8)
+    expect(modes.snapshotFlags).toBe(8)
+  })
+
+  it('carries nothing across a flagless snapshot when the mirror never proved state', () => {
+    // The constructor's known-zero was never proven for the previewed PTY;
+    // carrying it would launder a fresh default into a host-proven inactive.
+    const modes = new TerminalKittyKeyboardModeTracker()
+    apply({ data: 'first frame' }, [], modes)
+    apply({ data: 'second frame' }, [], modes)
+    expect(modes.flags).toBe(0)
+    expect(modes.snapshotFlags).toBeUndefined()
+  })
+
+  it('keeps proven flags across a replacement snapshot whose ANSI carries no kitty bytes', () => {
+    // The resync path used to reset the mirror and then scan kitty-free ANSI,
+    // which is what silently dropped a live TUI's negotiation.
+    const modes = new TerminalKittyKeyboardModeTracker()
+    apply({ data: 'first frame' }, [], modes)
+    apply({ data: 'second frame', cols: 90, rows: 30, kittyKeyboardFlags: 8 }, [], modes)
+    expect(modes.flags).toBe(8)
+  })
+
+  it('restores onto the screen the snapshot scan selected', () => {
+    const { modes } = apply({ data: '\x1b[?1049h', kittyKeyboardFlags: 8 })
+    expect(modes.isAlternateScreen).toBe(true)
+    expect(modes.snapshotFlags).toBe(8)
+    // Leaving the alternate screen returns to the main screen's own slot, which
+    // this snapshot never proved.
+    modes.scan('\x1b[?1049l')
+    expect(modes.snapshotFlags).toBeUndefined()
+  })
+
+  it('advances a proven suffix with live semantics and applies redelivery idempotently', () => {
+    const { modes } = apply({ kittyKeyboardFlags: 0 }, [
+      { data: '\x1b[>8u', mode: 'live' },
+      // A redelivered push applied as a push would leave the app's single pop
+      // landing on a stale frame.
+      { data: '\x1b[>8u', mode: 'replay' }
+    ])
+    expect(modes.flags).toBe(8)
+    modes.scan('\x1b[<u')
+    expect(modes.flags).toBe(0)
+    expect(modes.snapshotFlags).toBe(0)
+  })
+
+  it('writes scrollback, frame, escape tail, then replay, in that order', () => {
+    const { written } = apply(
+      {
+        scrollbackAnsi: 'history',
+        data: 'frame',
+        pendingEscapeTailAnsi: '\x1b['
+      },
+      [{ data: 'tail', mode: 'live' }]
+    )
+    expect(written).toEqual(['history', 'frame', '\x1b[', 'tail'])
+  })
+})
diff --git a/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.ts b/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.ts
new file mode 100644
index 00000000000..43d4333cc17
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.ts
@@ -0,0 +1,41 @@
+import type { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
+import { parseTerminalKittyKeyboardFlags } from '../../../../shared/terminal-kitty-keyboard-flags'
+import type {
+  TerminalPreviewReplayChunk,
+  TerminalPreviewSnapshot
+} from '../../../../shared/terminal-preview'
+
+/**
+ * Apply snapshot + buffered replay, restoring proven kitty flags after the
+ * snapshot scan (snapshot ANSI omits kitty pushes). Synchronous so no browser
+ * event observes the temporary reset.
+ */
+export function replayPreviewConnectionSnapshot(args: {
+  snapshot: TerminalPreviewSnapshot
+  replay: TerminalPreviewReplayChunk[]
+  kittyKeyboardModes: TerminalKittyKeyboardModeTracker
+  /** Scans the chunk into the mirror and queues it for xterm. */
+  write: (chunk: string, live: boolean) => void
+}): void {
+  const { snapshot, kittyKeyboardModes } = args
+  // Why: carry only live-proven flags across a flagless resync; a fresh mirror's zero is ungrounded.
+  const provenFlags =
+    parseTerminalKittyKeyboardFlags(snapshot.kittyKeyboardFlags) ??
+    (kittyKeyboardModes.hasProvenBaseline ? kittyKeyboardModes.snapshotFlags : undefined)
+  kittyKeyboardModes.resetForSnapshot()
+  if (snapshot.scrollbackAnsi) {
+    args.write(snapshot.scrollbackAnsi, false)
+  }
+  if (snapshot.data) {
+    args.write(snapshot.data, false)
+  }
+  if (snapshot.pendingEscapeTailAnsi) {
+    args.write(snapshot.pendingEscapeTailAnsi, false)
+  }
+  if (provenFlags !== undefined) {
+    kittyKeyboardModes.restoreSnapshotFlags(provenFlags)
+  }
+  for (const chunk of args.replay) {
+    args.write(chunk.data, chunk.mode === 'live')
+  }
+}
diff --git a/src/renderer/src/components/dashboard-popout/useAgentMapPointerHold.ts b/src/renderer/src/components/dashboard-popout/useAgentMapPointerHold.ts
new file mode 100644
index 00000000000..924c18d6586
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/useAgentMapPointerHold.ts
@@ -0,0 +1,47 @@
+import { useCallback, useState, type RefObject } from 'react'
+
+export type AgentMapPointerHold = {
+  projectId: string | null
+  worktreeId: string | null
+}
+
+type AgentMapPointerDragRef = RefObject<{ pointerId: number } | null>
+
+function closestId(target: Element, attribute: string): string | null {
+  return target.closest(`[${attribute}]`)?.getAttribute(attribute) ?? null
+}
+
+/**
+ * Remembers which rings a pan drag started in. Pointer capture retargets
+ * `:hover` to the `<svg>` for the whole gesture, so the ring under the pointer
+ * would otherwise collapse until the gesture ends.
+ */
+export function useAgentMapPointerHold(dragRef: AgentMapPointerDragRef): {
+  held: AgentMapPointerHold | null
+  hold: (target: Element) => void
+  release: () => void
+  clearDrag: (pointerId: number) => boolean
+} {
+  const [held, setHeld] = useState<AgentMapPointerHold | null>(null)
+  const hold = useCallback((target: Element): void => {
+    const projectId = closestId(target, 'data-agent-map-project-id')
+    const worktreeId = closestId(target, 'data-agent-map-worktree-id')
+    // A pan off empty canvas holds nothing, so leave the memoized scene alone.
+    setHeld(projectId === null && worktreeId === null ? null : { projectId, worktreeId })
+  }, [])
+  const release = useCallback((): void => {
+    setHeld((current) => (current === null ? current : null))
+  }, [])
+  const clearDrag = useCallback(
+    (pointerId: number): boolean => {
+      if (dragRef.current?.pointerId !== pointerId) {
+        return false
+      }
+      dragRef.current = null
+      release()
+      return true
+    },
+    [dragRef, release]
+  )
+  return { held, hold, release, clearDrag }
+}
diff --git a/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts b/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
index 92df277ef9d..84116333a1c 100644
--- a/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
+++ b/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vitest'
+import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
 import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
 import { lastEnteredDoneAt } from './agent-finished-timestamp'
 
@@ -37,3 +38,17 @@ describe('lastEnteredDoneAt session boundaries (STA-3386)', () => {
     ).toBe(1_000)
   })
 })
+
+describe('lastEnteredDoneAt shares the Smart Sort completion clock', () => {
+  it('times an ordinary completion from stateStartedAt, not updatedAt', () => {
+    const entry = doneEntry({ stateStartedAt: 2_000, updatedAt: 190_000 })
+    expect(lastEnteredDoneAt(row(entry))).toBe(2_000)
+    expect(agentEntryCompletionAt(entry)).toBe(2_000)
+  })
+
+  it('still shows when an interrupted turn stopped, though it never ranks as done', () => {
+    const entry = doneEntry({ interrupted: true, stateStartedAt: 2_000 })
+    expect(lastEnteredDoneAt(row(entry))).toBe(2_000)
+    expect(agentEntryCompletionAt(entry)).toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/dashboard/agent-finished-timestamp.ts b/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
index 6449e570fe1..599a07d118a 100644
--- a/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
+++ b/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
@@ -1,3 +1,4 @@
+import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
 import type { DashboardAgentRow } from './useDashboardData'
 
 /**
@@ -15,9 +16,15 @@ export function lastEnteredDoneAt(
     return null
   }
   const entry = agent.entry
-  // Why: a session-boundary done means the session connected idle (STA-3386) — nothing
-  // finished; fall through to history (which never records session boundaries).
-  if (entry.state === 'done' && entry.sessionBoundary !== true) {
+  // Why: same primitive Smart Sort ranks on, so the displayed age and Done eligibility share a clock.
+  // (Session-boundary `done` means the session connected idle — STA-3386 — so it resolves to the real
+  // completion it displaced, if any.)
+  const completedAt = agentEntryCompletionAt(entry)
+  if (completedAt !== null) {
+    return completedAt
+  }
+  // Why: display is looser than ranking — an interrupted turn still shows when it stopped.
+  if (entry.state === 'done' && entry.interrupted === true && entry.sessionBoundary !== true) {
     return entry.stateStartedAt
   }
   for (let i = (entry.stateHistory?.length ?? 0) - 1; i >= 0; i--) {
diff --git a/src/renderer/src/components/dashboard/dashboard-worktree-launch-options.test.ts b/src/renderer/src/components/dashboard/dashboard-worktree-launch-options.test.ts
index e7c0c04d85c..a0aacdcc504 100644
--- a/src/renderer/src/components/dashboard/dashboard-worktree-launch-options.test.ts
+++ b/src/renderer/src/components/dashboard/dashboard-worktree-launch-options.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { DASHBOARD_MAX_LAUNCH_WORKTREES } from '../../../../shared/dashboard-snapshot'
 import type { DashboardCard, DashboardWorkspace } from '../../../../shared/dashboard-snapshot'
+import type { FolderWorkspace, ProjectGroup } from '../../../../shared/types'
 import { folderWorkspaceKey } from '../../../../shared/workspace-scope'
 import { buildDashboardWorktreeLaunchOptions } from './dashboard-worktree-launch-options'
 
@@ -94,8 +95,22 @@ describe('buildDashboardWorktreeLaunchOptions', () => {
     const options = buildDashboardWorktreeLaunchOptions(
       state({
         repos: [
-          { id: 'repo-ssh', connectionId: 'ssh-1' },
-          { id: 'repo-runtime', executionHostId: 'runtime:hub-1' }
+          {
+            id: 'repo-ssh',
+            path: '/repo-ssh',
+            displayName: 'repo-ssh',
+            badgeColor: 'blue',
+            addedAt: 1,
+            connectionId: 'ssh-1'
+          },
+          {
+            id: 'repo-runtime',
+            path: '/repo-runtime',
+            displayName: 'repo-runtime',
+            badgeColor: 'blue',
+            addedAt: 1,
+            executionHostId: 'runtime:hub-1'
+          }
         ] as LaunchState['repos'],
         worktreesByRepo: {
           'repo-ssh': [{ id: 'ssh-worktree', repoId: 'repo-ssh' }],
@@ -119,9 +134,13 @@ describe('buildDashboardWorktreeLaunchOptions', () => {
     const options = buildDashboardWorktreeLaunchOptions(
       state({
         folderWorkspaces: [
-          { id: 'folder-1', projectGroupId: 'group-1', connectionId: 'ssh-folder' }
-        ] as LaunchState['folderWorkspaces'],
-        projectGroups: [{ id: 'group-1' }] as LaunchState['projectGroups'],
+          {
+            id: 'folder-1',
+            projectGroupId: 'group-1',
+            connectionId: 'ssh-folder'
+          } as FolderWorkspace
+        ],
+        projectGroups: [{ id: 'group-1' } as ProjectGroup],
         remoteDetectedAgentIds: { 'ssh-folder': ['goose'] }
       }),
       [card({ repoId: 'folder-workspace:group-1', worktreeId })]
diff --git a/src/renderer/src/components/dashboard/useRetainedAgents.ts b/src/renderer/src/components/dashboard/useRetainedAgents.ts
index 61cd0f30ce4..6fa1f94fda7 100644
--- a/src/renderer/src/components/dashboard/useRetainedAgents.ts
+++ b/src/renderer/src/components/dashboard/useRetainedAgents.ts
@@ -22,9 +22,9 @@ import { parsePaneKey } from '../../../../shared/stable-pane-id'
 type RetainedAgentSnapshot = Map<string, { row: DashboardAgentRow; worktreeId: string }>
 
 type RetainedAgentsSyncInputs = {
-  repos: Repo[]
+  repos: readonly Repo[]
   worktreesByRepo: Record<string, Worktree[]>
-  folderWorkspaces: FolderWorkspace[]
+  folderWorkspaces: readonly FolderWorkspace[]
   tabsByWorktree: Record<string, TerminalTab[]>
   agentStatusByPaneKey: Record<string, AgentStatusEntry>
 }
@@ -38,9 +38,9 @@ function paneKeyTabId(paneKey: string): string | null {
 }
 
 function buildLiveTabIndex(args: {
-  repos: Repo[]
+  repos: readonly Repo[]
   worktreesByRepo: Record<string, Worktree[]>
-  folderWorkspaces: FolderWorkspace[]
+  folderWorkspaces: readonly FolderWorkspace[]
   tabsByWorktree: Record<string, TerminalTab[]>
 }): {
   existingWorktreeIds: Set<string>
diff --git a/src/renderer/src/components/dictation/dictation-insertion-target.test.ts b/src/renderer/src/components/dictation/dictation-insertion-target.test.ts
index d7b5e670c5f..59c207735be 100644
--- a/src/renderer/src/components/dictation/dictation-insertion-target.test.ts
+++ b/src/renderer/src/components/dictation/dictation-insertion-target.test.ts
@@ -1,12 +1,12 @@
 // @vitest-environment happy-dom
 
 import { afterEach, describe, expect, it, vi } from 'vitest'
+import { getUtf8ByteLength } from '../../../../shared/utf8-byte-limits'
 
 import {
   TEXT_CONTROL_PASTE_CHUNK_MAX_BYTES,
   TEXT_CONTROL_PASTE_DIRECT_MAX_BYTES,
-  TEXT_CONTROL_PASTE_MAX_BYTES,
-  getTextControlPasteByteLength
+  TEXT_CONTROL_PASTE_MAX_BYTES
 } from '@/lib/text-control-paste'
 import { insertText } from './dictation-insertion-target'
 
@@ -98,8 +98,7 @@ describe('dictation insertion target', () => {
     expect(execCommand.mock.calls.length).toBeGreaterThan(1)
     expect(
       execCommand.mock.calls.every(
-        (call) =>
-          getTextControlPasteByteLength(String(call[2] ?? '')) <= TEXT_CONTROL_PASTE_CHUNK_MAX_BYTES
+        (call) => getUtf8ByteLength(String(call[2] ?? '')) <= TEXT_CONTROL_PASTE_CHUNK_MAX_BYTES
       )
     ).toBe(true)
     expect(beforeInputEvents).toHaveLength(execCommand.mock.calls.length)
diff --git a/src/renderer/src/components/dictation/dictation-insertion-target.ts b/src/renderer/src/components/dictation/dictation-insertion-target.ts
index 4f8573be15a..56a997a1803 100644
--- a/src/renderer/src/components/dictation/dictation-insertion-target.ts
+++ b/src/renderer/src/components/dictation/dictation-insertion-target.ts
@@ -1,9 +1,9 @@
 import { yieldToEventLoop } from '../../../../shared/event-loop-yield'
+import { getUtf8ChunkEndIndex } from '../../../../shared/utf8-byte-limits'
 import {
   TEXT_CONTROL_PASTE_CHUNK_MAX_BYTES,
   TEXT_CONTROL_PASTE_DIRECT_MAX_BYTES,
   TEXT_CONTROL_PASTE_MAX_BYTES,
-  getTextControlPasteByteLength,
   measureTextControlPasteByteLength,
   measureTextControlPasteByteLengthWithYield,
   pasteTextIntoTextControl
@@ -108,11 +108,7 @@ async function insertTextIntoContentEditableTarget(
     if (!isContentEditableDictationTargetCurrent(element)) {
       return
     }
-    const nextIndex = getNextDictationChunkBoundary(
-      text,
-      textIndex,
-      TEXT_CONTROL_PASTE_CHUNK_MAX_BYTES
-    )
+    const nextIndex = getUtf8ChunkEndIndex(text, textIndex, TEXT_CONTROL_PASTE_CHUNK_MAX_BYTES)
     if (
       !insertContentEditableDictationChunk(element, editorElement, text.slice(textIndex, nextIndex))
     ) {
@@ -162,22 +158,3 @@ function insertContentEditableDictationChunk(
 function isContentEditableDictationTargetCurrent(element: HTMLElement): boolean {
   return element.isConnected && element.contains(element.ownerDocument.activeElement)
 }
-
-function getNextDictationChunkBoundary(text: string, startIndex: number, maxBytes: number): number {
-  let byteLength = 0
-  let index = startIndex
-
-  while (index < text.length) {
-    const codePoint = text.codePointAt(index) ?? 0
-    const codeUnitLength = codePoint > 0xffff ? 2 : 1
-    const nextByteLength = getTextControlPasteByteLength(text.slice(index, index + codeUnitLength))
-
-    if (byteLength > 0 && byteLength + nextByteLength > maxBytes) {
-      break
-    }
-    byteLength += nextByteLength
-    index += codeUnitLength
-  }
-
-  return index
-}
diff --git a/src/renderer/src/components/editor/CheckRunDetailsPanel.tsx b/src/renderer/src/components/editor/CheckRunDetailsPanel.tsx
index 2a9a8c4ecd5..6003be19e05 100644
--- a/src/renderer/src/components/editor/CheckRunDetailsPanel.tsx
+++ b/src/renderer/src/components/editor/CheckRunDetailsPanel.tsx
@@ -27,8 +27,8 @@ function formatCheckTimestamp(value: string | null | undefined): string | null {
 }
 
 type CheckStatusLike = {
-  status: PRCheckDetail['status'] | string | null | undefined
-  conclusion: PRCheckDetail['conclusion'] | string | null | undefined
+  status: PRCheckDetail['status'] | (string & {}) | null | undefined
+  conclusion: PRCheckDetail['conclusion'] | (string & {}) | null | undefined
 }
 
 function getCheckStatusLabel(check: CheckStatusLike): string {
@@ -247,7 +247,11 @@ export function CheckRunDetailsPanel({
 
       <div className="min-h-0 flex-1 overflow-y-auto px-5 py-4 scrollbar-sleek">
         {loading ? (
-          <div className="flex items-center gap-2 py-4 text-sm text-muted-foreground">
+          <div
+            role="status"
+            aria-live="polite"
+            className="flex items-center gap-2 py-4 text-sm text-muted-foreground"
+          >
             <LoaderCircle className="size-4 animate-spin" />
             {translate(
               'auto.components.editor.CheckRunDetailsPanel.1f2b980522',
@@ -256,7 +260,11 @@ export function CheckRunDetailsPanel({
           </div>
         ) : (
           <div className="grid gap-4">
-            {error && <div className="text-sm text-muted-foreground">{error}</div>}
+            {error && (
+              <div role="alert" className="min-w-0 break-words text-sm text-destructive">
+                {error}
+              </div>
+            )}
 
             {hasOutput && (
               <section className="rounded-md border border-border bg-background">
diff --git a/src/renderer/src/components/editor/CombinedDiffViewer.tsx b/src/renderer/src/components/editor/CombinedDiffViewer.tsx
index f4bf62d3d54..58898e2d2ed 100644
--- a/src/renderer/src/components/editor/CombinedDiffViewer.tsx
+++ b/src/renderer/src/components/editor/CombinedDiffViewer.tsx
@@ -1182,10 +1182,7 @@ export default function CombinedDiffViewer({
       if (!detail || detail.worktreeId !== file.worktreeId) {
         return
       }
-      const hasRuntimeOwnerFilter = Object.prototype.hasOwnProperty.call(
-        detail,
-        'runtimeEnvironmentId'
-      )
+      const hasRuntimeOwnerFilter = Object.hasOwn(detail, 'runtimeEnvironmentId')
       const targetRuntimeOwner = detail.runtimeEnvironmentId?.trim() || null
       const fileRuntimeOwner = file.runtimeEnvironmentId?.trim() || null
       if (hasRuntimeOwnerFilter && targetRuntimeOwner !== fileRuntimeOwner) {
diff --git a/src/renderer/src/components/editor/EditorPanel.tsx b/src/renderer/src/components/editor/EditorPanel.tsx
index 2e07c10efb4..233d8a9e123 100644
--- a/src/renderer/src/components/editor/EditorPanel.tsx
+++ b/src/renderer/src/components/editor/EditorPanel.tsx
@@ -23,16 +23,20 @@ import {
   selectEditorPanelGitStatusEntries
 } from './editor-panel-git-entry-selector'
 import { createEditorPanelDraftSelector } from './editor-panel-draft-selector'
-import { attemptEditorFileSave } from './editor-file-save-attempt'
 import { createCurrentMarkdownArtifactRequest } from './markdown-artifact-upload'
+import { useEditorPanelSave } from './useEditorPanelSave'
 
 function EditorPanelInner({
   activeFileId: activeFileIdProp,
   activeViewStateId: activeViewStateIdProp,
+  isVisible = true,
+  isCmdSaveOwner = isVisible,
   markdownAnnotationsEnabled = true
 }: {
   activeFileId?: string | null
   activeViewStateId?: string | null
+  isVisible?: boolean
+  isCmdSaveOwner?: boolean
   markdownAnnotationsEnabled?: boolean
 } = {}): React.JSX.Element | null {
   const openFiles = useAppStore((s) => s.openFiles)
@@ -114,7 +118,8 @@ function EditorPanelInner({
     isChangesMode: requestedChangesMode,
     openFiles,
     gitStatusEntries,
-    editorViewMode
+    editorViewMode,
+    isVisible
   })
   const isChangesMode =
     requestedChangesMode &&
@@ -172,37 +177,18 @@ function EditorPanelInner({
     [activeFile, markFileDirty]
   )
 
-  const handleSaveForFile = useCallback(
-    async (file: typeof activeFile, content: string): Promise<boolean> => {
-      if (!file) {
-        return false
-      }
-      const saveTargetFile =
-        file.mode === 'markdown-preview'
-          ? (openFiles.find(
-              (openFile) =>
-                openFile.id === file.markdownPreviewSourceFileId && openFile.mode === 'edit'
-            ) ?? null)
-          : file
-      if (!saveTargetFile) {
-        return false
-      }
-      if (saveTargetFile.isUntitled) {
-        requestRenameForFile(saveTargetFile.id)
-        return false
-      }
-      return attemptEditorFileSave({ fileId: saveTargetFile.id, fallbackContent: content })
-    },
-    [openFiles, requestRenameForFile]
-  )
-
-  const handleSave = useCallback(
-    async (content: string): Promise<boolean> => {
-      return handleSaveForFile(activeFile, content)
-    },
-    [activeFile, handleSaveForFile]
-  )
-  useEditorCmdSaveRequest({ activeFile, openFiles, fileContents, handleSave })
+  const { handleSave, handleSaveForFile } = useEditorPanelSave({
+    activeFile,
+    openFiles,
+    requestRenameForFile
+  })
+  useEditorCmdSaveRequest({
+    activeFile,
+    openFiles,
+    fileContents,
+    handleSave,
+    enabled: isCmdSaveOwner
+  })
 
   const handleCopyPath = useCallback(async (): Promise<void> => {
     if (!activeFile) {
diff --git a/src/renderer/src/components/editor/IpynbViewer.tsx b/src/renderer/src/components/editor/IpynbViewer.tsx
index bbf7ded32ed..4aac74ae495 100644
--- a/src/renderer/src/components/editor/IpynbViewer.tsx
+++ b/src/renderer/src/components/editor/IpynbViewer.tsx
@@ -435,7 +435,7 @@ function getCellKey(cell: IpynbCell, index: number): string {
 }
 
 function hasOwnDraft(drafts: Record<string, string>, key: string): boolean {
-  return Object.prototype.hasOwnProperty.call(drafts, key)
+  return Object.hasOwn(drafts, key)
 }
 
 function EditableTextCell({
diff --git a/src/renderer/src/components/editor/check-run-details-tab.ts b/src/renderer/src/components/editor/check-run-details-tab.ts
index bbc8fc1180b..02e833b61b6 100644
--- a/src/renderer/src/components/editor/check-run-details-tab.ts
+++ b/src/renderer/src/components/editor/check-run-details-tab.ts
@@ -1,21 +1,34 @@
 import type { GitLabProjectRef } from '../../../../shared/gitlab-types'
-import type { PRCheckDetail, PRCheckRunDetails } from '../../../../shared/types'
+import type {
+  GitHubRepositoryIdentity,
+  PRCheckDetail,
+  PRCheckRunDetails
+} from '../../../../shared/types'
 
 export type OpenCheckRunDetailsState = {
   contextKey: string
   check: PRCheckDetail
+  requestId?: number
   details: PRCheckRunDetails | null
   loading: boolean
   error: string | null
+  githubRepository?: GitHubRepositoryIdentity | null
   /** Why: fork/cross-project MR jobs live outside the repo's own project, so reloads need the pipeline's project. */
   gitlabProjectRef?: GitLabProjectRef | null
 }
 
 export type CheckRunDetailsTabPatch = Pick<
   OpenCheckRunDetailsState,
-  'details' | 'loading' | 'error' | 'gitlabProjectRef'
+  'requestId' | 'details' | 'loading' | 'error' | 'githubRepository' | 'gitlabProjectRef'
 >
 
+let nextCheckRunDetailsRequestId = 0
+
+export function createCheckRunDetailsRequestId(): number {
+  nextCheckRunDetailsRequestId += 1
+  return nextCheckRunDetailsRequestId
+}
+
 export function isSameGitLabProjectRef(
   a: GitLabProjectRef | null,
   b: GitLabProjectRef | null
@@ -23,6 +36,13 @@ export function isSameGitLabProjectRef(
   return a === b || (a?.host === b?.host && a?.path === b?.path)
 }
 
+export function isSameGitHubRepository(
+  a: GitHubRepositoryIdentity | null,
+  b: GitHubRepositoryIdentity | null
+): boolean {
+  return a === b || (a?.owner === b?.owner && a?.repo === b?.repo && a?.host === b?.host)
+}
+
 export function getCheckRunTabIdentity(check: PRCheckDetail): string {
   if (check.checkRunId) {
     return `check-run:${check.checkRunId}`
diff --git a/src/renderer/src/components/editor/editor-autosave.test.ts b/src/renderer/src/components/editor/editor-autosave.test.ts
index 77f6065153d..67232a58583 100644
--- a/src/renderer/src/components/editor/editor-autosave.test.ts
+++ b/src/renderer/src/components/editor/editor-autosave.test.ts
@@ -258,4 +258,54 @@ describe('getOpenFilesForExternalFileChange', () => {
       }).map((file) => file.id)
     ).toEqual(['runtime-edit', 'runtime-diff'])
   })
+  it('matches restored WSL aliases only for a proven local Windows watcher', () => {
+    vi.stubGlobal('navigator', { userAgent: 'Windows' })
+    const terminalLinkTab = makeOpenFile({
+      id: '//wsl.localhost/Ubuntu/workspace/repo/file.ts',
+      filePath: '//wsl.localhost/Ubuntu/workspace/repo/file.ts',
+      worktreeId: 'wt-wsl'
+    })
+
+    expect(
+      getOpenFilesForExternalFileChange([terminalLinkTab], {
+        worktreeId: 'wt-wsl',
+        worktreePath: '\\\\wsl.localhost\\Ubuntu\\workspace\\repo',
+        relativePath: 'file.ts',
+        runtimeEnvironmentId: null,
+        allowLocalWindowsWslAliases: true
+      }).map((file) => file.id)
+    ).toEqual(['//wsl.localhost/Ubuntu/workspace/repo/file.ts'])
+
+    expect(
+      getOpenFilesForExternalFileChange([terminalLinkTab], {
+        worktreeId: 'wt-wsl',
+        worktreePath: '\\\\wsl.localhost\\Ubuntu\\workspace\\repo',
+        relativePath: 'file.ts',
+        runtimeEnvironmentId: null
+      })
+    ).toEqual([])
+
+    vi.stubGlobal('navigator', { userAgent: 'Linux' })
+    expect(
+      getOpenFilesForExternalFileChange([terminalLinkTab], {
+        worktreeId: 'wt-wsl',
+        worktreePath: '\\\\wsl.localhost\\Ubuntu\\workspace\\repo',
+        relativePath: 'file.ts',
+        runtimeEnvironmentId: null,
+        allowLocalWindowsWslAliases: true
+      })
+    ).toEqual([])
+
+    vi.stubGlobal('navigator', { userAgent: 'Windows' })
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    expect(
+      getOpenFilesForExternalFileChange([terminalLinkTab], {
+        worktreeId: 'wt-wsl',
+        worktreePath: '\\\\wsl.localhost\\Ubuntu\\workspace\\repo',
+        relativePath: 'file.ts',
+        runtimeEnvironmentId: null,
+        allowLocalWindowsWslAliases: true
+      })
+    ).toEqual([])
+  })
 })
diff --git a/src/renderer/src/components/editor/editor-autosave.ts b/src/renderer/src/components/editor/editor-autosave.ts
index efeda658724..c647fbfb779 100644
--- a/src/renderer/src/components/editor/editor-autosave.ts
+++ b/src/renderer/src/components/editor/editor-autosave.ts
@@ -1,5 +1,7 @@
 import { joinPath } from '@/lib/path'
 import type { OpenFile } from '@/store/slices/editor'
+import { areLocalWindowsWslPathAliases } from '../../../../shared/cross-platform-path'
+import { isLocalWindowsDesktopClient } from '@/lib/desktop-window-chrome'
 import {
   DEFAULT_EDITOR_AUTO_SAVE_DELAY_MS,
   MAX_EDITOR_AUTO_SAVE_DELAY_MS,
@@ -20,6 +22,10 @@ export type EditorPathMutationTarget = {
   worktreePath: string
   relativePath: string
   runtimeEnvironmentId?: string | null
+  allowLocalWindowsWslAliases?: true
+  indexedOpenFiles?: {
+    matches: (openFiles: OpenFile[]) => OpenFile[]
+  }
 }
 
 export type EditorSaveQuiesceTarget = { fileId: string } | EditorPathMutationTarget
@@ -49,6 +55,10 @@ export type EditorRequestFileCloseDetail = {
   fileId: string
 }
 
+export type EditorRequestCmdSaveDetail = {
+  fileId: string
+}
+
 export function isExternalReloadableEditorTab(file: OpenFile): boolean {
   return (
     file.mode === 'edit' ||
@@ -120,8 +130,11 @@ export function getOpenFilesForExternalFileChange(
   openFiles: OpenFile[],
   target: EditorPathMutationTarget
 ): OpenFile[] {
+  if (target.indexedOpenFiles) {
+    return target.indexedOpenFiles.matches(openFiles)
+  }
   const absolutePath = joinPath(target.worktreePath, target.relativePath)
-  const hasRuntimeOwnerFilter = Object.prototype.hasOwnProperty.call(target, 'runtimeEnvironmentId')
+  const hasRuntimeOwnerFilter = Object.hasOwn(target, 'runtimeEnvironmentId')
   const targetRuntimeOwner = target.runtimeEnvironmentId?.trim() || null
   return openFiles.filter((file) => {
     if (file.worktreeId !== target.worktreeId) {
@@ -134,7 +147,12 @@ export function getOpenFilesForExternalFileChange(
       return false
     }
     if (file.mode === 'edit' || file.mode === 'markdown-preview') {
-      return file.filePath === absolutePath
+      return (
+        file.filePath === absolutePath ||
+        (target.allowLocalWindowsWslAliases === true &&
+          isLocalWindowsDesktopClient() &&
+          areLocalWindowsWslPathAliases(file.filePath, absolutePath))
+      )
     }
     if (file.mode === 'diff') {
       return (
diff --git a/src/renderer/src/components/editor/editor-cmd-save-target.test.ts b/src/renderer/src/components/editor/editor-cmd-save-target.test.ts
new file mode 100644
index 00000000000..518f8c8b859
--- /dev/null
+++ b/src/renderer/src/components/editor/editor-cmd-save-target.test.ts
@@ -0,0 +1,80 @@
+import { describe, expect, it, vi } from 'vitest'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
+import type { Tab } from '../../../../shared/types'
+import { getEditorCmdSaveFileId } from './editor-cmd-save-target'
+
+function makeTab(contentType: Tab['contentType'], entityId: string): Tab {
+  return {
+    id: `tab-${entityId}`,
+    entityId,
+    contentType,
+    label: entityId,
+    groupId: 'group-1',
+    worktreeId: FLOATING_TERMINAL_WORKTREE_ID,
+    customLabel: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 1
+  }
+}
+
+describe('getEditorCmdSaveFileId', () => {
+  it('targets the main active editor when the floating panel does not own the event', () => {
+    const getActiveTab = vi.fn(() => makeTab('editor', 'floating-file'))
+
+    expect(
+      getEditorCmdSaveFileId(
+        {
+          activeFileId: 'main-file',
+          activeTabType: 'editor',
+          activeView: 'terminal',
+          getActiveTab
+        },
+        false
+      )
+    ).toBe('main-file')
+    expect(getActiveTab).not.toHaveBeenCalled()
+  })
+
+  it('claims nothing on a non-workspace view so the shortcut is not swallowed', () => {
+    const getActiveTab = vi.fn(() => null)
+
+    for (const activeView of ['tasks', 'settings', 'activity'] as const) {
+      expect(
+        getEditorCmdSaveFileId(
+          { activeFileId: 'main-file', activeTabType: 'editor', activeView, getActiveTab },
+          false
+        )
+      ).toBeNull()
+    }
+  })
+
+  it('targets only an active floating editor and never falls through to main', () => {
+    const getActiveTab = vi
+      .fn<(worktreeId: string) => Tab | null>()
+      .mockReturnValueOnce(makeTab('editor', 'floating-file'))
+      .mockReturnValueOnce(makeTab('browser', 'floating-browser'))
+    const state = {
+      activeFileId: 'main-file',
+      activeTabType: 'editor',
+      activeView: 'terminal' as const,
+      getActiveTab
+    }
+
+    expect(getEditorCmdSaveFileId(state, true)).toBe('floating-file')
+    expect(getEditorCmdSaveFileId(state, true)).toBeNull()
+    expect(getActiveTab).toHaveBeenNthCalledWith(1, FLOATING_TERMINAL_WORKTREE_ID)
+    expect(getActiveTab).toHaveBeenNthCalledWith(2, FLOATING_TERMINAL_WORKTREE_ID)
+  })
+
+  it('still targets the floating editor from a non-workspace view', () => {
+    const getActiveTab = vi.fn(() => makeTab('editor', 'floating-file'))
+
+    expect(
+      getEditorCmdSaveFileId(
+        { activeFileId: 'main-file', activeTabType: 'editor', activeView: 'tasks', getActiveTab },
+        true
+      )
+    ).toBe('floating-file')
+  })
+})
diff --git a/src/renderer/src/components/editor/editor-cmd-save-target.ts b/src/renderer/src/components/editor/editor-cmd-save-target.ts
new file mode 100644
index 00000000000..0d021a87790
--- /dev/null
+++ b/src/renderer/src/components/editor/editor-cmd-save-target.ts
@@ -0,0 +1,34 @@
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
+import type { Tab, TabContentType, TopLevelView } from '../../../../shared/types'
+
+export const EDITOR_TAB_CONTENT_TYPES = new Set<TabContentType>([
+  'editor',
+  'diff',
+  'conflict-review',
+  'check-details'
+])
+
+type EditorCmdSaveState = {
+  activeFileId: string | null
+  activeTabType: string | null
+  activeView: TopLevelView
+  getActiveTab: (worktreeId: string) => Tab | null
+}
+
+export function getEditorCmdSaveFileId(
+  state: EditorCmdSaveState,
+  floatingPanelOwnsEvent: boolean
+): string | null {
+  if (!floatingPanelOwnsEvent) {
+    // Why: outside the workspace view no mounted panel claims the request, so
+    // returning an id would swallow Cmd/Ctrl+S on Tasks/Settings without saving.
+    // The floating panel floats above every view and keeps its own ownership.
+    return state.activeView === 'terminal' && state.activeTabType === 'editor'
+      ? state.activeFileId
+      : null
+  }
+  const activeTab = state.getActiveTab(FLOATING_TERMINAL_WORKTREE_ID)
+  return activeTab && EDITOR_TAB_CONTENT_TYPES.has(activeTab.contentType)
+    ? activeTab.entityId
+    : null
+}
diff --git a/src/renderer/src/components/editor/editor-external-watch-path-index.test.ts b/src/renderer/src/components/editor/editor-external-watch-path-index.test.ts
new file mode 100644
index 00000000000..68e33bc6baf
--- /dev/null
+++ b/src/renderer/src/components/editor/editor-external-watch-path-index.test.ts
@@ -0,0 +1,185 @@
+import { describe, expect, it } from 'vitest'
+import type { OpenFile } from '@/store/slices/editor'
+import { indexEditorExternalWatchBatchPaths } from './editor-external-watch-path-index'
+
+const wslScope = {
+  worktreeId: 'wt-wsl',
+  worktreePath: '\\\\wsl.localhost\\Ubuntu\\workspace\\repo',
+  runtimeEnvironmentId: null,
+  allowLocalWindowsWslAliases: true as const
+}
+
+function file(overrides: Partial<OpenFile> & Pick<OpenFile, 'id' | 'filePath'>): OpenFile {
+  return {
+    relativePath: 'file.ts',
+    worktreeId: 'wt-wsl',
+    mode: 'edit',
+    isDirty: false,
+    content: '',
+    language: 'typescript',
+    ...overrides
+  } as OpenFile
+}
+
+describe('editor external watch path batch index', () => {
+  it('matches UNC aliases for updates, deletes, and restored tombstones', () => {
+    const restored = file({
+      id: 'restored',
+      filePath: '//wsl.localhost/Ubuntu/workspace/repo/file.ts',
+      externalMutation: 'deleted'
+    })
+    const index = indexEditorExternalWatchBatchPaths(
+      {
+        worktreePath: wslScope.worktreePath,
+        events: [
+          {
+            kind: 'delete',
+            absolutePath: '\\\\wsl$\\Ubuntu\\workspace\\repo\\file.ts'
+          },
+          {
+            kind: 'create',
+            absolutePath: '\\\\wsl.localhost\\Ubuntu\\workspace\\repo\\file.ts'
+          }
+        ]
+      },
+      [restored],
+      wslScope
+    )
+
+    expect(index.deletedOpenEditors).toEqual([
+      {
+        file: restored,
+        normalizedDeletePath: '//wsl/ubuntu/workspace/repo/file.ts'
+      }
+    ])
+    expect(index.matchesCreateOrUpdate(restored)).toBe(true)
+    expect(index.matchingOpenFiles(index.changes[0])).toEqual([restored])
+  })
+
+  it('matches /mnt drive aliases without folding WSL filesystem case', () => {
+    const mounted = file({
+      id: 'mounted',
+      filePath: '//wsl.localhost/Ubuntu/mnt/c/Repo/File.ts'
+    })
+    const nativeScope = { ...wslScope, worktreePath: 'C:\\Repo' }
+    const matching = indexEditorExternalWatchBatchPaths(
+      {
+        worktreePath: nativeScope.worktreePath,
+        events: [{ kind: 'update', absolutePath: 'c:\\repo\\file.ts' }]
+      },
+      [mounted],
+      nativeScope
+    )
+    const wrongLinuxCase = indexEditorExternalWatchBatchPaths(
+      {
+        worktreePath: nativeScope.worktreePath,
+        events: [{ kind: 'update', absolutePath: 'C:\\Repo\\File.ts' }]
+      },
+      [
+        file({
+          id: 'linux-case',
+          filePath: '//wsl.localhost/Ubuntu/home/Alice/File.ts'
+        })
+      ],
+      nativeScope
+    )
+
+    expect(matching.matchingOpenFiles(matching.changes[0])).toEqual([mounted])
+    expect(wrongLinuxCase.matchingOpenFiles(wrongLinuxCase.changes[0])).toEqual([])
+  })
+
+  it('keeps aliases literal for SSH, runtimes, and POSIX scopes', () => {
+    const restored = file({
+      id: 'restored',
+      filePath: '//wsl.localhost/Ubuntu/workspace/repo/file.ts'
+    })
+    const payload = {
+      worktreePath: wslScope.worktreePath,
+      events: [
+        {
+          kind: 'update' as const,
+          absolutePath: '\\\\wsl.localhost\\Ubuntu\\workspace\\repo\\file.ts'
+        }
+      ]
+    }
+
+    for (const scope of [
+      { ...wslScope, allowLocalWindowsWslAliases: undefined },
+      { ...wslScope, runtimeEnvironmentId: 'env-1', allowLocalWindowsWslAliases: undefined }
+    ]) {
+      const index = indexEditorExternalWatchBatchPaths(payload, [restored], scope)
+      expect(index.matchingOpenFiles(index.changes[0])).toEqual([])
+    }
+
+    const posix = indexEditorExternalWatchBatchPaths(
+      {
+        worktreePath: '/srv/repo',
+        events: [{ kind: 'update', absolutePath: '/srv/repo/file.ts' }]
+      },
+      [restored],
+      {
+        ...wslScope,
+        worktreePath: '/srv/repo',
+        allowLocalWindowsWslAliases: undefined
+      }
+    )
+    expect(posix.matchingOpenFiles(posix.changes[0])).toEqual([])
+  })
+
+  it('filters owners and preserves open-file ordering across edit and diff matches', () => {
+    const edit = file({ id: 'edit', filePath: 'C:\\Repo\\file.ts' })
+    const runtime = file({
+      id: 'runtime',
+      filePath: 'C:\\Repo\\file.ts',
+      runtimeEnvironmentId: 'env-1'
+    })
+    const diff = file({
+      id: 'diff',
+      filePath: 'C:\\Repo\\file.ts',
+      mode: 'diff',
+      diffSource: 'unstaged'
+    })
+    const index = indexEditorExternalWatchBatchPaths(
+      {
+        worktreePath: 'C:\\Repo',
+        events: [{ kind: 'update', absolutePath: 'c:\\repo\\file.ts' }]
+      },
+      [diff, runtime, edit],
+      { ...wslScope, worktreePath: 'C:\\Repo' }
+    )
+
+    expect(index.matchingOpenFiles(index.changes[0]).map(({ id }) => id)).toEqual(['diff', 'edit'])
+  })
+
+  it('deduplicates repeated events and detects only working-tree combined diffs', () => {
+    const index = indexEditorExternalWatchBatchPaths(
+      {
+        worktreePath: 'C:\\Repo',
+        events: [
+          { kind: 'create', absolutePath: 'C:\\Repo\\file.ts' },
+          { kind: 'update', absolutePath: 'C:\\Repo\\file.ts' },
+          { kind: 'update', absolutePath: 'C:\\Repo\\folder', isDirectory: true }
+        ]
+      },
+      [
+        file({
+          id: 'combined',
+          filePath: 'C:\\Repo',
+          mode: 'diff',
+          diffSource: 'combined-uncommitted'
+        }),
+        file({
+          id: 'branch',
+          filePath: 'C:\\Repo',
+          mode: 'diff',
+          diffSource: 'combined-branch'
+        })
+      ],
+      { ...wslScope, worktreePath: 'C:\\Repo' }
+    )
+
+    expect(index.changes.map(({ relativePath }) => relativePath)).toEqual(['file.ts'])
+    expect(index.createOrUpdatePaths.size).toBe(1)
+    expect(index.hasCombinedDiffConsumer).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/editor/editor-external-watch-path-index.ts b/src/renderer/src/components/editor/editor-external-watch-path-index.ts
new file mode 100644
index 00000000000..f1cb7054c67
--- /dev/null
+++ b/src/renderer/src/components/editor/editor-external-watch-path-index.ts
@@ -0,0 +1,256 @@
+import { joinPath } from '@/lib/path'
+import { getExternalFileChangeRelativePath } from '@/components/right-sidebar/useFileExplorerWatch'
+import type { OpenFile } from '@/store/slices/editor'
+import type { FsChangedPayload } from '../../../../shared/types'
+import {
+  getLocalWindowsWslPathIdentity,
+  normalizeRuntimePathForComparison,
+  type LocalWindowsWslPathIdentity
+} from '../../../../shared/cross-platform-path'
+
+type WatchScope = {
+  worktreeId: string
+  worktreePath: string
+  runtimeEnvironmentId: string | null
+  allowLocalWindowsWslAliases?: true
+}
+
+type IndexedPath = {
+  absolutePath: string
+  identity: LocalWindowsWslPathIdentity
+}
+
+type IndexedOpenFile = {
+  file: OpenFile
+  index: number
+  identity: LocalWindowsWslPathIdentity | null
+}
+
+export type IndexedExternalWatchChange = IndexedPath & {
+  relativePath: string
+}
+
+export type EditorExternalWatchBatchPathIndex = {
+  createOrUpdatePaths: ReadonlyMap<string, string>
+  changes: readonly IndexedExternalWatchChange[]
+  deletedOpenEditors: readonly { file: OpenFile; normalizedDeletePath: string }[]
+  hasCombinedDiffConsumer: boolean
+  matchesCreateOrUpdate: (file: OpenFile) => boolean
+  matchingOpenFiles: (
+    change: IndexedExternalWatchChange,
+    currentOpenFiles?: OpenFile[]
+  ) => OpenFile[]
+}
+
+function openFileRuntimeOwner(file: Pick<OpenFile, 'runtimeEnvironmentId'>): string | null {
+  return file.runtimeEnvironmentId?.trim() || null
+}
+
+function addToListMap<T>(map: Map<string, T[]>, key: string, value: T): void {
+  const existing = map.get(key)
+  if (existing) {
+    existing.push(value)
+  } else {
+    map.set(key, [value])
+  }
+}
+
+class IndexedPathLookup<T> {
+  private readonly direct = new Map<string, T>()
+  private readonly aliases = new Map<string, T>()
+  private readonly wslAliases = new Map<string, T>()
+
+  constructor(private readonly allowAliases: boolean) {}
+
+  add(path: IndexedPath, value: T): void {
+    this.direct.set(path.identity.normalizedPath, value)
+    if (!this.allowAliases) {
+      return
+    }
+    this.aliases.set(path.identity.aliasComparisonPath, value)
+    if (path.identity.isWslUnc) {
+      this.wslAliases.set(path.identity.aliasComparisonPath, value)
+    }
+  }
+
+  get(identity: LocalWindowsWslPathIdentity): T | undefined {
+    const direct = this.direct.get(identity.normalizedPath)
+    if (direct !== undefined || !this.allowAliases) {
+      return direct
+    }
+    return identity.isWslUnc
+      ? this.aliases.get(identity.aliasComparisonPath)
+      : this.wslAliases.get(identity.aliasComparisonPath)
+  }
+}
+
+function pathIdentity(value: string, allowAliases: boolean): LocalWindowsWslPathIdentity {
+  if (allowAliases) {
+    return getLocalWindowsWslPathIdentity(value)
+  }
+  const normalizedPath = normalizeRuntimePathForComparison(value)
+  return { normalizedPath, aliasComparisonPath: normalizedPath, isWslUnc: false }
+}
+
+function collectMatchingFiles(
+  direct: readonly IndexedOpenFile[],
+  aliases: readonly IndexedOpenFile[],
+  diffs: readonly IndexedOpenFile[]
+): OpenFile[] {
+  const byIndex = new Map<number, OpenFile>()
+  for (const entry of [...direct, ...aliases, ...diffs]) {
+    byIndex.set(entry.index, entry.file)
+  }
+  return [...byIndex.entries()].sort(([left], [right]) => left - right).map(([, file]) => file)
+}
+
+class IndexedOpenFileLookup {
+  private readonly directEditors = new Map<string, IndexedOpenFile[]>()
+  private readonly aliasEditors = new Map<string, IndexedOpenFile[]>()
+  private readonly wslAliasEditors = new Map<string, IndexedOpenFile[]>()
+  private readonly diffsByRelativePath = new Map<string, IndexedOpenFile[]>()
+  readonly indexedOpenFiles = new Map<string, IndexedOpenFile>()
+  readonly hasCombinedDiffConsumer: boolean
+
+  constructor(
+    openFiles: OpenFile[],
+    scope: WatchScope,
+    private readonly allowAliases: boolean
+  ) {
+    let hasCombinedDiffConsumer = false
+    for (const [index, file] of openFiles.entries()) {
+      if (
+        file.worktreeId !== scope.worktreeId ||
+        openFileRuntimeOwner(file) !== scope.runtimeEnvironmentId
+      ) {
+        continue
+      }
+      if (
+        file.mode === 'diff' &&
+        (file.diffSource === 'combined-uncommitted' || file.diffSource === 'combined-all')
+      ) {
+        hasCombinedDiffConsumer = true
+        continue
+      }
+      if (file.mode === 'diff') {
+        if (file.diffSource === 'unstaged' || file.diffSource === 'staged') {
+          addToListMap(this.diffsByRelativePath, file.relativePath, {
+            file,
+            index,
+            identity: null
+          })
+        }
+        continue
+      }
+      if (file.mode !== 'edit' && file.mode !== 'markdown-preview') {
+        continue
+      }
+      const identity = pathIdentity(file.filePath, allowAliases)
+      const indexedFile = { file, index, identity }
+      this.indexedOpenFiles.set(file.id, indexedFile)
+      addToListMap(this.directEditors, file.filePath, indexedFile)
+      if (allowAliases) {
+        addToListMap(this.aliasEditors, identity.aliasComparisonPath, indexedFile)
+        if (identity.isWslUnc) {
+          addToListMap(this.wslAliasEditors, identity.aliasComparisonPath, indexedFile)
+        }
+      }
+    }
+    this.hasCombinedDiffConsumer = hasCombinedDiffConsumer
+  }
+
+  matchingOpenFiles(change: IndexedExternalWatchChange): OpenFile[] {
+    const aliases = !this.allowAliases
+      ? []
+      : change.identity.isWslUnc
+        ? (this.aliasEditors.get(change.identity.aliasComparisonPath) ?? [])
+        : (this.wslAliasEditors.get(change.identity.aliasComparisonPath) ?? [])
+    return collectMatchingFiles(
+      this.directEditors.get(change.absolutePath) ?? [],
+      aliases,
+      this.diffsByRelativePath.get(change.relativePath) ?? []
+    )
+  }
+}
+
+export function indexEditorExternalWatchBatchPaths(
+  payload: FsChangedPayload,
+  openFiles: OpenFile[],
+  scope: WatchScope
+): EditorExternalWatchBatchPathIndex {
+  const allowAliases = scope.allowLocalWindowsWslAliases === true
+  const createOrUpdateLookup = new IndexedPathLookup<IndexedPath>(allowAliases)
+  const deleteLookup = new IndexedPathLookup<IndexedPath>(allowAliases)
+  const createOrUpdatePaths = new Map<string, string>()
+  const changesByRelativePath = new Map<string, IndexedExternalWatchChange>()
+
+  for (const event of payload.events) {
+    if (event.kind === 'overflow') {
+      continue
+    }
+    const eventPath: IndexedPath = {
+      absolutePath: event.absolutePath,
+      identity: pathIdentity(event.absolutePath, allowAliases)
+    }
+    if (event.kind === 'delete') {
+      deleteLookup.add(eventPath, eventPath)
+      continue
+    }
+    if (event.isDirectory !== true) {
+      createOrUpdatePaths.set(eventPath.identity.normalizedPath, event.absolutePath)
+      createOrUpdateLookup.add(eventPath, eventPath)
+    }
+    const relativePath = getExternalFileChangeRelativePath(
+      scope.worktreePath,
+      event.absolutePath,
+      event.isDirectory
+    )
+    if (relativePath && !changesByRelativePath.has(relativePath)) {
+      const absolutePath = joinPath(scope.worktreePath, relativePath)
+      changesByRelativePath.set(relativePath, {
+        relativePath,
+        absolutePath,
+        identity: eventPath.identity
+      })
+    }
+  }
+
+  const initialOpenFileLookup = new IndexedOpenFileLookup(openFiles, scope, allowAliases)
+  const openFileLookups = new WeakMap<OpenFile[], IndexedOpenFileLookup>()
+  openFileLookups.set(openFiles, initialOpenFileLookup)
+  const getOpenFileLookup = (currentOpenFiles: OpenFile[]): IndexedOpenFileLookup => {
+    const existing = openFileLookups.get(currentOpenFiles)
+    if (existing) {
+      return existing
+    }
+    const indexed = new IndexedOpenFileLookup(currentOpenFiles, scope, allowAliases)
+    openFileLookups.set(currentOpenFiles, indexed)
+    return indexed
+  }
+  const matchesCreateOrUpdate = (file: OpenFile): boolean => {
+    const identity =
+      initialOpenFileLookup.indexedOpenFiles.get(file.id)?.identity ??
+      pathIdentity(file.filePath, allowAliases)
+    return createOrUpdateLookup.get(identity) !== undefined
+  }
+  const deletedOpenEditors: { file: OpenFile; normalizedDeletePath: string }[] = []
+  for (const indexedFile of initialOpenFileLookup.indexedOpenFiles.values()) {
+    const deletedPath = deleteLookup.get(indexedFile.identity!)
+    if (deletedPath) {
+      deletedOpenEditors.push({
+        file: indexedFile.file,
+        normalizedDeletePath: deletedPath.identity.normalizedPath
+      })
+    }
+  }
+
+  return {
+    createOrUpdatePaths,
+    changes: [...changesByRelativePath.values()],
+    deletedOpenEditors,
+    hasCombinedDiffConsumer: initialOpenFileLookup.hasCombinedDiffConsumer,
+    matchesCreateOrUpdate,
+    matchingOpenFiles: (change, currentOpenFiles = openFiles) =>
+      getOpenFileLookup(currentOpenFiles).matchingOpenFiles(change)
+  }
+}
diff --git a/src/renderer/src/components/editor/editor-panel-content-types.ts b/src/renderer/src/components/editor/editor-panel-content-types.ts
index c44df176150..1c137bfb632 100644
--- a/src/renderer/src/components/editor/editor-panel-content-types.ts
+++ b/src/renderer/src/components/editor/editor-panel-content-types.ts
@@ -25,6 +25,11 @@ export type FileContent = {
   mimeType?: string
   fileIdentity?: string
   loadError?: string
+  /** Superseded by an external change; still rendered until the lazy reload lands. */
+  isStale?: boolean
 }
 
-export type DiffContent = GitDiffResult
+export type DiffContent = GitDiffResult & {
+  /** Superseded by an external change; still rendered until the lazy reload lands. */
+  isStale?: boolean
+}
diff --git a/src/renderer/src/components/editor/editor-panel-draft-selector.ts b/src/renderer/src/components/editor/editor-panel-draft-selector.ts
index 8cc7e07fb27..b455af4e56f 100644
--- a/src/renderer/src/components/editor/editor-panel-draft-selector.ts
+++ b/src/renderer/src/components/editor/editor-panel-draft-selector.ts
@@ -43,7 +43,7 @@ export function createEditorPanelDraftSelector(
       const draft = state.editorDrafts[fileId]
       return (
         draft !== previousSelection[fileId] ||
-        (draft === undefined && Object.prototype.hasOwnProperty.call(previousSelection, fileId))
+        (draft === undefined && Object.hasOwn(previousSelection, fileId))
       )
     })
     if (!changed) {
diff --git a/src/renderer/src/components/editor/editor-save-target.ts b/src/renderer/src/components/editor/editor-save-target.ts
new file mode 100644
index 00000000000..d77c157b9fc
--- /dev/null
+++ b/src/renderer/src/components/editor/editor-save-target.ts
@@ -0,0 +1,16 @@
+import type { OpenFile } from '@/store/slices/editor'
+
+export function getEditorSaveTargetFile(
+  activeFile: OpenFile,
+  openFiles: OpenFile[]
+): OpenFile | null {
+  if (activeFile.mode !== 'markdown-preview') {
+    return activeFile
+  }
+  return (
+    openFiles.find(
+      (openFile) =>
+        openFile.id === activeFile.markdownPreviewSourceFileId && openFile.mode === 'edit'
+    ) ?? null
+  )
+}
diff --git a/src/renderer/src/components/editor/monaco-context-menu-paste.ts b/src/renderer/src/components/editor/monaco-context-menu-paste.ts
index 4a33fb68352..9b513f8e426 100644
--- a/src/renderer/src/components/editor/monaco-context-menu-paste.ts
+++ b/src/renderer/src/components/editor/monaco-context-menu-paste.ts
@@ -60,7 +60,7 @@ function resolvePasteMetadata(
   return {
     pasteOnNewLine: emptySelectionClipboard && metadata.isFromEmptySelection === true,
     multicursorText:
-      typeof metadata.multicursorText !== 'undefined' ? (metadata.multicursorText ?? null) : null,
+      metadata.multicursorText !== undefined ? (metadata.multicursorText ?? null) : null,
     mode: metadata.mode ?? null
   }
 }
diff --git a/src/renderer/src/components/editor/monaco-large-text-paste.ts b/src/renderer/src/components/editor/monaco-large-text-paste.ts
index 7cb6ed83c76..a8e8157b78d 100644
--- a/src/renderer/src/components/editor/monaco-large-text-paste.ts
+++ b/src/renderer/src/components/editor/monaco-large-text-paste.ts
@@ -1,5 +1,6 @@
 import type { editor } from 'monaco-editor'
 import { yieldToEventLoop } from '../../../../shared/event-loop-yield'
+import { getUtf8ChunkEndIndex } from '../../../../shared/utf8-byte-limits'
 import {
   measureTextControlPasteByteLength,
   measureTextControlPasteByteLengthWithYield
@@ -73,39 +74,6 @@ function getPlainTextFromPasteEvent(event: ClipboardEvent): string {
   return event.clipboardData?.getData('text/plain') ?? ''
 }
 
-function getCodePointUtf8ByteLength(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
-
-function getNextChunkBoundary(text: string, startIndex: number, maxBytes: number): number {
-  let byteLength = 0
-  let index = startIndex
-
-  while (index < text.length) {
-    const codePoint = text.codePointAt(index) ?? 0
-    const codeUnitLength = codePoint > 0xffff ? 2 : 1
-    const nextByteLength = getCodePointUtf8ByteLength(codePoint)
-
-    if (byteLength > 0 && byteLength + nextByteLength > maxBytes) {
-      break
-    }
-
-    byteLength += nextByteLength
-    index += codeUnitLength
-  }
-
-  return index
-}
-
 function getEndPositionAfterInsert(start: Position, text: string): Position {
   let lineNumber = start.lineNumber
   let column = start.column
@@ -187,7 +155,7 @@ async function insertMonacoTextInChunks(
       return { status: 'cancelled', reason: 'target-unavailable', byteLength, chunksWritten }
     }
 
-    const nextIndex = getNextChunkBoundary(text, textIndex, chunkMaxBytes)
+    const nextIndex = getUtf8ChunkEndIndex(text, textIndex, chunkMaxBytes)
     const chunk = text.slice(textIndex, nextIndex)
     const endPosition = getEndPositionAfterInsert(
       { lineNumber: selection.startLineNumber, column: selection.startColumn },
diff --git a/src/renderer/src/components/editor/monaco-markdown-doc-completions.ts b/src/renderer/src/components/editor/monaco-markdown-doc-completions.ts
index 882b011e9b3..4d33a1f3985 100644
--- a/src/renderer/src/components/editor/monaco-markdown-doc-completions.ts
+++ b/src/renderer/src/components/editor/monaco-markdown-doc-completions.ts
@@ -9,7 +9,7 @@ import {
 type MonacoApi = Parameters<OnMount>[1]
 
 let provider: IDisposable | null = null
-let providerMonaco: MonacoApi | null = null
+let providerMonaco: MonacoApi = null
 const documentsByModel = new Map<string, MarkdownDocument[]>()
 
 export function ensureMarkdownDocCompletionProvider(monaco: MonacoApi): void {
diff --git a/src/renderer/src/components/editor/rich-markdown-html-superscript-link.test.ts b/src/renderer/src/components/editor/rich-markdown-html-superscript-link.test.ts
index a7dfc9a912e..90591cfdb17 100644
--- a/src/renderer/src/components/editor/rich-markdown-html-superscript-link.test.ts
+++ b/src/renderer/src/components/editor/rich-markdown-html-superscript-link.test.ts
@@ -29,6 +29,7 @@ import { handleRichMarkdownCitationKey } from './rich-markdown-citation-keyboard
 import { resolveRichMarkdownWorktreeRoot } from './useRichMarkdownSuperscriptLinkSetup'
 import { folderWorkspaceKey } from '../../../../shared/workspace-scope'
 import type { AppState } from '@/store/types'
+import type { FolderWorkspace } from '../../../../shared/types'
 import {
   inspectRichMarkdownSourceOwningSlice,
   RICH_MARKDOWN_SOURCE_OWNING_PASTE_LIMIT
@@ -309,7 +310,7 @@ describe('rich Markdown HTML superscript links', () => {
 
   it('uses a folder workspace path as the citation source root', () => {
     const state = {
-      folderWorkspaces: [{ id: 'folder-1', folderPath: '/workspace/platform' }],
+      folderWorkspaces: [{ id: 'folder-1', folderPath: '/workspace/platform' } as FolderWorkspace],
       worktreesByRepo: {}
     } as Pick<AppState, 'folderWorkspaces' | 'worktreesByRepo'>
     expect(resolveRichMarkdownWorktreeRoot(state, folderWorkspaceKey('folder-1'))).toBe(
diff --git a/src/renderer/src/components/editor/rich-markdown-large-text-paste.ts b/src/renderer/src/components/editor/rich-markdown-large-text-paste.ts
index b6f87a0b01c..815e4a27ed0 100644
--- a/src/renderer/src/components/editor/rich-markdown-large-text-paste.ts
+++ b/src/renderer/src/components/editor/rich-markdown-large-text-paste.ts
@@ -1,6 +1,10 @@
 import type { Editor } from '@tiptap/react'
 import { toast } from 'sonner'
 import { yieldToEventLoop } from '../../../../shared/event-loop-yield'
+import {
+  getUtf8ChunkEndIndex,
+  isUtf8ByteLengthWithinLimit
+} from '../../../../shared/utf8-byte-limits'
 import {
   measureTextControlPasteByteLength,
   measureTextControlPasteByteLengthWithYield
@@ -33,61 +37,6 @@ export type RichMarkdownLargeTextPasteResult =
       chunksWritten: number
     }
 
-function getCodePointUtf8ByteLength(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
-
-function isTextByteLengthOverLimit(text: string, maxBytes: number): boolean {
-  if (text.length === 0) {
-    return false
-  }
-  if (text.length > maxBytes) {
-    return true
-  }
-
-  let byteLength = 0
-  for (let index = 0; index < text.length; index += 1) {
-    const codePoint = text.codePointAt(index) ?? 0
-    byteLength += getCodePointUtf8ByteLength(codePoint)
-    if (byteLength > maxBytes) {
-      return true
-    }
-    if (codePoint > 0xffff) {
-      index += 1
-    }
-  }
-  return false
-}
-
-function getNextChunkBoundary(text: string, startIndex: number, maxBytes: number): number {
-  let byteLength = 0
-  let index = startIndex
-
-  while (index < text.length) {
-    const codePoint = text.codePointAt(index) ?? 0
-    const codeUnitLength = codePoint > 0xffff ? 2 : 1
-    const nextByteLength = getCodePointUtf8ByteLength(codePoint)
-
-    if (byteLength > 0 && byteLength + nextByteLength > maxBytes) {
-      break
-    }
-
-    byteLength += nextByteLength
-    index += codeUnitLength
-  }
-
-  return index
-}
-
 function isEditorAvailable(
   editor: Editor,
   canContinue: RichMarkdownLargeTextPasteOptions['canContinue']
@@ -126,7 +75,7 @@ function shouldHandleLargeRichMarkdownPaste({
   if (plainTextExceededLimit || plainTextByteLength > maxDirect) {
     return true
   }
-  return isTextByteLengthOverLimit(htmlText, maxDirect)
+  return !isUtf8ByteLengthWithinLimit(htmlText, maxDirect)
 }
 
 async function insertRichMarkdownTextInChunks(
@@ -144,7 +93,7 @@ async function insertRichMarkdownTextInChunks(
       return { status: 'cancelled', reason: 'target-unavailable', byteLength, chunksWritten }
     }
 
-    const nextIndex = getNextChunkBoundary(text, textIndex, chunkMaxBytes)
+    const nextIndex = getUtf8ChunkEndIndex(text, textIndex, chunkMaxBytes)
     const chunk = text.slice(textIndex, nextIndex)
     editor.view.dispatch(editor.state.tr.insertText(chunk))
     textIndex = nextIndex
diff --git a/src/renderer/src/components/editor/rich-markdown-slash-command-catalog.tsx b/src/renderer/src/components/editor/rich-markdown-slash-command-catalog.tsx
index 922e1abe2f1..3cd31be6f6d 100644
--- a/src/renderer/src/components/editor/rich-markdown-slash-command-catalog.tsx
+++ b/src/renderer/src/components/editor/rich-markdown-slash-command-catalog.tsx
@@ -1,4 +1,3 @@
-import type {} from '@tiptap/extension-mathematics'
 import {
   ChevronRight,
   ImageIcon,
diff --git a/src/renderer/src/components/editor/rich-markdown-source-owning-slice.ts b/src/renderer/src/components/editor/rich-markdown-source-owning-slice.ts
index cbaecb4ea64..622d5c0bc8b 100644
--- a/src/renderer/src/components/editor/rich-markdown-source-owning-slice.ts
+++ b/src/renderer/src/components/editor/rich-markdown-source-owning-slice.ts
@@ -1,4 +1,8 @@
 import type { Slice } from '@tiptap/pm/model'
+import {
+  getUtf8ByteLengthForCodePoint,
+  readUtf8CodePointAt
+} from '../../../../shared/utf8-byte-limits'
 import {
   getRichMarkdownLeafVisibleText,
   isRichMarkdownVisibleBlockStart
@@ -89,8 +93,8 @@ function addUtf8BytesWithinLimit(
   }
   let byteLength = current
   for (let index = 0; index < value.length; index += 1) {
-    const codePoint = value.codePointAt(index) ?? 0
-    byteLength += codePoint <= 0x7f ? 1 : codePoint <= 0x7ff ? 2 : codePoint <= 0xffff ? 3 : 4
+    const codePoint = readUtf8CodePointAt(value, index)
+    byteLength += getUtf8ByteLengthForCodePoint(codePoint)
     if (byteLength > limit) {
       return { byteLength, exceeded: true }
     }
diff --git a/src/renderer/src/components/editor/rich-markdown-source-reconcile.ts b/src/renderer/src/components/editor/rich-markdown-source-reconcile.ts
index f04134100d3..27a776ee163 100644
--- a/src/renderer/src/components/editor/rich-markdown-source-reconcile.ts
+++ b/src/renderer/src/components/editor/rich-markdown-source-reconcile.ts
@@ -5,6 +5,10 @@ import {
   makeDiff,
   makePatches
 } from '@sanity/diff-match-patch'
+import {
+  getUtf8ByteLengthForCodePoint,
+  readUtf8CodePointAt
+} from '../../../../shared/utf8-byte-limits'
 
 // Why: cap document size in UTF-16 code units (`.length`) since re-parse cost scales with length — the per-commit throwaway TipTap safety re-parse (~50-67ms here) must stay under the 300ms serialize debounce so it can't stall the main thread on slow/SSH hosts.
 const RECONCILE_SIZE_CAP_CODE_UNITS = 50_000
@@ -146,11 +150,8 @@ function getUtf8OffsetsAtCodeUnitIndices(
   for (const target of targets) {
     const boundedTarget = Math.max(0, Math.min(target, text.length))
     while (codeUnitIndex < boundedTarget) {
-      const codePoint = text.codePointAt(codeUnitIndex)
-      if (codePoint === undefined) {
-        break
-      }
-      byteOffset += utf8CodePointLength(codePoint)
+      const codePoint = readUtf8CodePointAt(text, codeUnitIndex)
+      byteOffset += getUtf8ByteLengthForCodePoint(codePoint)
       codeUnitIndex += codePoint > 0xffff ? 2 : 1
     }
     offsets.set(target, byteOffset)
@@ -158,19 +159,6 @@ function getUtf8OffsetsAtCodeUnitIndices(
   return offsets
 }
 
-function utf8CodePointLength(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
-
 function hasRepeatedHalfMatchSeed(textA: string, textB: string): boolean {
   // Match diff-match-patch's prefix/suffix trimming so a small edit isn't mistaken for a repetitive replacement.
   const minimumLength = Math.min(textA.length, textB.length)
diff --git a/src/renderer/src/components/editor/rich-markdown-terminal-path-paste.ts b/src/renderer/src/components/editor/rich-markdown-terminal-path-paste.ts
index cfdb7f422fd..037004a5303 100644
--- a/src/renderer/src/components/editor/rich-markdown-terminal-path-paste.ts
+++ b/src/renderer/src/components/editor/rich-markdown-terminal-path-paste.ts
@@ -14,7 +14,7 @@ function readClipboardText(event: ClipboardEvent, type: string): string {
 function getWindowsPathBasename(filePath: string): string {
   const normalized = filePath.replaceAll('/', '\\')
   const separatorIndex = normalized.lastIndexOf('\\')
-  return separatorIndex >= 0 ? normalized.slice(separatorIndex + 1) : normalized
+  return separatorIndex !== -1 ? normalized.slice(separatorIndex + 1) : normalized
 }
 
 function extractClipboardAnchors(html: string): ClipboardAnchor[] {
diff --git a/src/renderer/src/components/editor/useEditorCmdSaveRequest.test.tsx b/src/renderer/src/components/editor/useEditorCmdSaveRequest.test.tsx
new file mode 100644
index 00000000000..ca27cf31126
--- /dev/null
+++ b/src/renderer/src/components/editor/useEditorCmdSaveRequest.test.tsx
@@ -0,0 +1,142 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { OpenFile } from '@/store/slices/editor'
+import { ORCA_EDITOR_REQUEST_CMD_SAVE_EVENT } from './editor-autosave'
+import { useEditorCmdSaveRequest } from './useEditorCmdSaveRequest'
+
+const storeState = vi.hoisted(() => ({ editorDrafts: {} as Record<string, string> }))
+const EMPTY_FILE_CONTENTS: Parameters<typeof useEditorCmdSaveRequest>[0]['fileContents'] = {}
+
+vi.mock('@/store', () => ({ useAppStore: { getState: () => storeState } }))
+
+type ProbeProps = {
+  activeFile: OpenFile
+  enabled: boolean
+  fileContents?: Parameters<typeof useEditorCmdSaveRequest>[0]['fileContents']
+  onSave: (content: string) => Promise<boolean>
+  openFiles?: OpenFile[]
+}
+
+function SaveProbe({
+  activeFile,
+  enabled,
+  fileContents = EMPTY_FILE_CONTENTS,
+  onSave,
+  openFiles
+}: ProbeProps): null {
+  useEditorCmdSaveRequest({
+    activeFile,
+    openFiles: openFiles ?? [activeFile],
+    fileContents,
+    handleSave: onSave,
+    enabled
+  })
+  return null
+}
+
+function makeFile(id: string): OpenFile {
+  return {
+    id,
+    filePath: `/repo/${id}.md`,
+    relativePath: `${id}.md`,
+    worktreeId: `worktree-${id}`,
+    language: 'markdown',
+    isDirty: true,
+    mode: 'edit'
+  }
+}
+
+describe('useEditorCmdSaveRequest', () => {
+  let container: HTMLDivElement
+  let root: Root
+
+  beforeEach(() => {
+    globalThis.IS_REACT_ACT_ENVIRONMENT = true
+    storeState.editorDrafts = {}
+    container = document.body.appendChild(document.createElement('div'))
+    root = createRoot(container)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
+  })
+
+  it('saves only the visible panel that owns the requested file', () => {
+    const visibleFile = makeFile('visible')
+    const otherVisibleFile = makeFile('other-visible')
+    const hiddenFile = makeFile('hidden')
+    const visibleSave = vi.fn(async () => true)
+    const mirroredSave = vi.fn(async () => true)
+    const otherVisibleSave = vi.fn(async () => true)
+    const hiddenSave = vi.fn(async () => true)
+    storeState.editorDrafts = {
+      [visibleFile.id]: 'visible draft',
+      [otherVisibleFile.id]: 'other draft',
+      [hiddenFile.id]: 'hidden draft'
+    }
+
+    act(() => {
+      root.render(
+        <>
+          <SaveProbe activeFile={visibleFile} enabled onSave={visibleSave} />
+          <SaveProbe activeFile={visibleFile} enabled={false} onSave={mirroredSave} />
+          <SaveProbe activeFile={otherVisibleFile} enabled onSave={otherVisibleSave} />
+          <SaveProbe activeFile={hiddenFile} enabled={false} onSave={hiddenSave} />
+        </>
+      )
+    })
+    act(() => {
+      window.dispatchEvent(
+        new CustomEvent(ORCA_EDITOR_REQUEST_CMD_SAVE_EVENT, {
+          detail: { fileId: visibleFile.id }
+        })
+      )
+    })
+
+    expect(visibleSave).toHaveBeenCalledExactlyOnceWith('visible draft')
+    expect(mirroredSave).not.toHaveBeenCalled()
+    expect(otherVisibleSave).not.toHaveBeenCalled()
+    expect(hiddenSave).not.toHaveBeenCalled()
+  })
+
+  it('uses the preview tab for ownership and the source file for content', () => {
+    const sourceFile = makeFile('source')
+    const previewFile: OpenFile = {
+      ...sourceFile,
+      id: 'markdown-preview::source',
+      markdownPreviewSourceFileId: sourceFile.id,
+      mode: 'markdown-preview'
+    }
+    const save = vi.fn(async () => true)
+    storeState.editorDrafts = { [sourceFile.id]: 'source draft' }
+
+    act(() => {
+      root.render(
+        <SaveProbe
+          activeFile={previewFile}
+          enabled
+          onSave={save}
+          openFiles={[sourceFile, previewFile]}
+        />
+      )
+    })
+    act(() => {
+      window.dispatchEvent(
+        new CustomEvent(ORCA_EDITOR_REQUEST_CMD_SAVE_EVENT, {
+          detail: { fileId: sourceFile.id }
+        })
+      )
+      window.dispatchEvent(
+        new CustomEvent(ORCA_EDITOR_REQUEST_CMD_SAVE_EVENT, {
+          detail: { fileId: previewFile.id }
+        })
+      )
+    })
+
+    expect(save).toHaveBeenCalledExactlyOnceWith('source draft')
+  })
+})
diff --git a/src/renderer/src/components/editor/useEditorCmdSaveRequest.ts b/src/renderer/src/components/editor/useEditorCmdSaveRequest.ts
index 41df5a64037..13ee33f09f4 100644
--- a/src/renderer/src/components/editor/useEditorCmdSaveRequest.ts
+++ b/src/renderer/src/components/editor/useEditorCmdSaveRequest.ts
@@ -1,11 +1,16 @@
 import { useEffect } from 'react'
 import { useAppStore } from '@/store'
 import type { OpenFile } from '@/store/slices/editor'
-import { ORCA_EDITOR_REQUEST_CMD_SAVE_EVENT } from './editor-autosave'
+import {
+  ORCA_EDITOR_REQUEST_CMD_SAVE_EVENT,
+  type EditorRequestCmdSaveDetail
+} from './editor-autosave'
 import type { FileContent } from './editor-panel-content-types'
+import { getEditorSaveTargetFile } from './editor-save-target'
 
 type UseEditorCmdSaveRequestParams = {
   activeFile: OpenFile | null
+  enabled: boolean
   openFiles: OpenFile[]
   fileContents: Record<string, FileContent>
   handleSave: (content: string) => Promise<boolean>
@@ -13,22 +18,23 @@ type UseEditorCmdSaveRequestParams = {
 
 export function useEditorCmdSaveRequest({
   activeFile,
+  enabled,
   openFiles,
   fileContents,
   handleSave
 }: UseEditorCmdSaveRequestParams): void {
   useEffect(() => {
-    const handler = (): void => {
-      if (!activeFile) {
+    if (!enabled) {
+      return
+    }
+    const handler = (event: Event): void => {
+      if (
+        !activeFile ||
+        (event as CustomEvent<EditorRequestCmdSaveDetail>).detail?.fileId !== activeFile.id
+      ) {
         return
       }
-      const saveTargetFile =
-        activeFile.mode === 'markdown-preview'
-          ? (openFiles.find(
-              (openFile) =>
-                openFile.id === activeFile.markdownPreviewSourceFileId && openFile.mode === 'edit'
-            ) ?? null)
-          : activeFile
+      const saveTargetFile = getEditorSaveTargetFile(activeFile, openFiles)
       if (!saveTargetFile) {
         return
       }
@@ -46,5 +52,5 @@ export function useEditorCmdSaveRequest({
     }
     window.addEventListener(ORCA_EDITOR_REQUEST_CMD_SAVE_EVENT, handler)
     return () => window.removeEventListener(ORCA_EDITOR_REQUEST_CMD_SAVE_EVENT, handler)
-  }, [activeFile, fileContents, handleSave, openFiles])
+  }, [activeFile, enabled, fileContents, handleSave, openFiles])
 }
diff --git a/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx b/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx
index 3a5ed862d8e..e72ff75858e 100644
--- a/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx
+++ b/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx
@@ -426,7 +426,7 @@ describe('useEditorPanelContentState', () => {
         connectionId: 'ssh-1'
       }),
       expect.objectContaining({
-        compare: expect.objectContaining({ mergeBase: 'merge-base' }),
+        compare: expect.objectContaining({ headOid: 'head', mergeBase: 'merge-base' }),
         filePath: 'api/src/file.ts'
       })
     )
diff --git a/src/renderer/src/components/editor/useEditorPanelContentState.ts b/src/renderer/src/components/editor/useEditorPanelContentState.ts
index f9cda5dc753..4b0eb5cffed 100644
--- a/src/renderer/src/components/editor/useEditorPanelContentState.ts
+++ b/src/renderer/src/components/editor/useEditorPanelContentState.ts
@@ -1,7 +1,7 @@
 /* oxlint-disable max-lines -- Why: content loading, retry, and external-change
    subscriptions share in-flight caches and state setters; splitting them would
    make the hook coordination harder to audit. */
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
 import type { OpenFile } from '@/store/slices/editor'
 import { getConnectionIdForFile, isWorktreeConnectionResolved } from '@/lib/connection-context'
 import { joinPath } from '@/lib/path'
@@ -32,6 +32,7 @@ import {
   shouldReloadDiffOnGitStatusChange
 } from './editor-panel-diff-reload'
 import {
+  type EditorPanelContentLoadOptions,
   useEditorPanelExternalContentEvents,
   usePruneClosedEditorContent
 } from './useEditorPanelExternalContentEvents'
@@ -39,14 +40,20 @@ import { useEditorPanelFileLoadRetry } from './useEditorPanelFileLoadRetry'
 import { useLocalLogTail } from './useLocalLogTail'
 import { migrateRestoredEditorFileOwner } from './migrate-restored-editor-file-owner'
 
-const inFlightFileReads = new Map<string, Promise<FileContent>>()
-const inFlightDiffReads = new Map<string, Promise<DiffContent>>()
+type InFlightContentRead<T> = {
+  externalEventGeneration?: number
+  promise: Promise<T>
+}
+
+const inFlightFileReads = new Map<string, InFlightContentRead<FileContent>>()
+const inFlightDiffReads = new Map<string, InFlightContentRead<DiffContent>>()
 
 type GitStatusByWorktree = ReturnType<typeof useAppStore.getState>['gitStatusByWorktree']
 type EditorViewModeByFile = ReturnType<typeof useAppStore.getState>['editorViewMode']
 
 type UseEditorPanelContentStateParams = {
   activeFile: OpenFile | null
+  isVisible?: boolean
   isChangesMode: boolean
   openFiles: OpenFile[]
   gitStatusEntries: GitStatusByWorktree[string] | undefined
@@ -78,6 +85,18 @@ function stampCleanTabDiskBaseline(id: string, result: FileContent): void {
   }
 }
 
+// Why: the newest read for a tab is already on its way, so a re-run of the lazy
+// effect (a worktree flip-flop re-adds `isVisible`) must not fire a second RPC.
+// An invalidation bumps the tab's generation, so a superseded read never counts.
+function hasLiveRead(
+  generationsById: Record<string, number>,
+  outstandingById: Record<string, number>,
+  id: string
+): boolean {
+  const generation = generationsById[id]
+  return generation !== undefined && outstandingById[id] === generation
+}
+
 function inFlightReadKey(connectionId: string | undefined, filePath: string): string {
   return `${connectionId ?? ''}::${filePath}`
 }
@@ -100,6 +119,7 @@ function inFlightDiffKey(
 
 export function useEditorPanelContentState({
   activeFile,
+  isVisible = true,
   isChangesMode,
   openFiles,
   gitStatusEntries,
@@ -108,7 +128,6 @@ export function useEditorPanelContentState({
   const [fileContents, setFileContents] = useState<Record<string, FileContent>>({})
   const [diffContents, setDiffContents] = useState<Record<string, DiffContent>>({})
   const diffContentsRef = useRef(diffContents)
-  diffContentsRef.current = diffContents
   const fileLoadRetryAttemptsRef = useRef<Record<string, number>>({})
   // Why: per-tab read generations let a forced/external reload supersede an
   // older in-flight read so a slower stale promise cannot overwrite fresh state.
@@ -116,14 +135,77 @@ export function useEditorPanelContentState({
   const diffReadGenerationRef = useRef<Record<string, number>>({})
   const fileReadGenerationCounterRef = useRef(0)
   const diffReadGenerationCounterRef = useRef(0)
+  const outstandingFileReadsRef = useRef<Record<string, number>>({})
+  const outstandingDiffReadsRef = useRef<Record<string, number>>({})
   const openFilesRef = useRef(openFiles)
-  openFilesRef.current = openFiles
   const editorViewModeRef = useRef(editorViewMode)
-  editorViewModeRef.current = editorViewMode
+  const isVisibleRef = useRef(isVisible)
   const selectedConflictReviewFile =
     activeFile?.mode === 'conflict-review' && activeFile.conflictReview?.selectedFileId
       ? (openFiles.find((file) => file.id === activeFile.conflictReview?.selectedFileId) ?? null)
       : null
+  const activeContentFileId = selectedConflictReviewFile?.id ?? activeFile?.id ?? null
+  const activeContentFileIdRef = useRef(activeContentFileId)
+
+  useLayoutEffect(() => {
+    // Why: event-driven readers must only observe state from committed renders.
+    diffContentsRef.current = diffContents
+    openFilesRef.current = openFiles
+    editorViewModeRef.current = editorViewMode
+    isVisibleRef.current = isVisible
+    activeContentFileIdRef.current = activeContentFileId
+  }, [activeContentFileId, diffContents, editorViewMode, isVisible, openFiles])
+
+  const invalidateFileContent = useCallback((fileIds: string[]): void => {
+    const uniqueIds = new Set(fileIds)
+    for (const fileId of uniqueIds) {
+      fileReadGenerationRef.current[fileId] = ++fileReadGenerationCounterRef.current
+      delete fileLoadRetryAttemptsRef.current[fileId]
+    }
+    setFileContents((prev) => {
+      const next = { ...prev }
+      let changed = false
+      for (const fileId of uniqueIds) {
+        const existing = next[fileId]
+        // Why: keep the last-known bytes rendered and swap them when the lazy
+        // reload lands — dropping them flashes "Loading…" on every reveal.
+        if (existing && existing.isStale !== true) {
+          next[fileId] = { ...existing, isStale: true }
+          changed = true
+        }
+      }
+      return changed ? next : prev
+    })
+  }, [])
+
+  const invalidateDiffContent = useCallback((fileIds: string[]): void => {
+    const uniqueIds = new Set(fileIds)
+    for (const fileId of uniqueIds) {
+      diffReadGenerationRef.current[fileId] = ++diffReadGenerationCounterRef.current
+    }
+    setDiffContents((prev) => {
+      const next = { ...prev }
+      let changed = false
+      for (const fileId of uniqueIds) {
+        const existing = next[fileId]
+        // Why: keep the last-known diff rendered and swap it when the lazy
+        // reload lands — dropping it flashes "Loading diff…" on every reveal.
+        if (existing && existing.isStale !== true) {
+          next[fileId] = { ...existing, isStale: true }
+          changed = true
+        }
+      }
+      return changed ? next : prev
+    })
+  }, [])
+
+  const invalidateContent = useCallback(
+    (fileIds: string[]): void => {
+      invalidateFileContent(fileIds)
+      invalidateDiffContent(fileIds)
+    },
+    [invalidateDiffContent, invalidateFileContent]
+  )
 
   const loadFileContent = useCallback(
     async (
@@ -131,11 +213,12 @@ export function useEditorPanelContentState({
       id: string,
       worktreeId?: string,
       relativePath?: string,
-      options?: { force?: boolean }
+      options?: EditorPanelContentLoadOptions
     ): Promise<void> => {
       const generation = fileReadGenerationCounterRef.current + 1
       fileReadGenerationCounterRef.current = generation
       fileReadGenerationRef.current[id] = generation
+      outstandingFileReadsRef.current[id] = generation
       try {
         const resolvedConnectionId = getConnectionIdForFile(worktreeId ?? null, filePath)
         const connectionId = resolvedConnectionId ?? undefined
@@ -219,14 +302,19 @@ export function useEditorPanelContentState({
         }
         const readScope = getRuntimeFileReadScope(readSettings, readConnectionId)
         const key = inFlightReadKey(readScope, filePath)
-        if (options?.force) {
+        const registeredRead = inFlightFileReads.get(key)
+        if (
+          options?.force &&
+          (options.externalEventGeneration === undefined ||
+            registeredRead?.externalEventGeneration !== options.externalEventGeneration)
+        ) {
           // Why: forced reloads must not attach to a currently registered read
           // started before the external change landed.
           inFlightFileReads.delete(key)
         }
         let pending = inFlightFileReads.get(key)
         if (!pending) {
-          pending = readRuntimeFileContent({
+          const promise = readRuntimeFileContent({
             settings: readSettings,
             filePath,
             relativePath: readRelativePath,
@@ -235,6 +323,7 @@ export function useEditorPanelContentState({
             expectedExternalSshTargetId: restoredOpenFile?.externalSshTargetId,
             includeLocalLogMetadata: isLiveTailLogTab
           }) as Promise<FileContent>
+          pending = { externalEventGeneration: options?.externalEventGeneration, promise }
           inFlightFileReads.set(key, pending)
           queueMicrotask(() => {
             if (inFlightFileReads.get(key) === pending) {
@@ -242,7 +331,7 @@ export function useEditorPanelContentState({
             }
           })
         }
-        const result = await pending
+        const result = await pending.promise
         if (fileReadGenerationRef.current[id] !== generation) {
           return
         }
@@ -258,19 +347,24 @@ export function useEditorPanelContentState({
           ...prev,
           [id]: { content: '', isBinary: false, loadError: message }
         }))
+      } finally {
+        if (outstandingFileReadsRef.current[id] === generation) {
+          delete outstandingFileReadsRef.current[id]
+        }
       }
     },
     []
   )
 
   const loadDiffContent = useCallback(
-    async (file: OpenFile | null, options?: { force?: boolean }): Promise<void> => {
+    async (file: OpenFile | null, options?: EditorPanelContentLoadOptions): Promise<void> => {
       if (!file || (file.mode === 'edit' && !canUseChangesModeForFile(file))) {
         return
       }
       const generation = diffReadGenerationCounterRef.current + 1
       diffReadGenerationCounterRef.current = generation
       diffReadGenerationRef.current[file.id] = generation
+      outstandingDiffReadsRef.current[file.id] = generation
       try {
         const worktreePath = file.filePath.slice(
           0,
@@ -293,14 +387,19 @@ export function useEditorPanelContentState({
           gitScope ?? undefined,
           compareAgainstHead
         )
-        if (options?.force) {
+        const registeredRead = inFlightDiffReads.get(key)
+        if (
+          options?.force &&
+          (options.externalEventGeneration === undefined ||
+            registeredRead?.externalEventGeneration !== options.externalEventGeneration)
+        ) {
           // Why: forced diff reloads must not attach to a read started before
           // the external change landed.
           inFlightDiffReads.delete(key)
         }
         let pending = inFlightDiffReads.get(key)
         if (!pending) {
-          pending = (
+          const promise = (
             effectiveDiffSource === 'commit'
               ? commitCompare
                 ? getRuntimeGitCommitDiff(
@@ -351,6 +450,7 @@ export function useEditorPanelContentState({
                     }
                   )
           ) as Promise<DiffContent>
+          pending = { externalEventGeneration: options?.externalEventGeneration, promise }
           inFlightDiffReads.set(key, pending)
           queueMicrotask(() => {
             if (inFlightDiffReads.get(key) === pending) {
@@ -358,7 +458,7 @@ export function useEditorPanelContentState({
             }
           })
         }
-        const result = await pending
+        const result = await pending.promise
         if (diffReadGenerationRef.current[file.id] !== generation) {
           return
         }
@@ -377,6 +477,10 @@ export function useEditorPanelContentState({
             modifiedIsBinary: false
           }
         }))
+      } finally {
+        if (outstandingDiffReadsRef.current[file.id] === generation) {
+          delete outstandingDiffReadsRef.current[file.id]
+        }
       }
     },
     []
@@ -417,7 +521,25 @@ export function useEditorPanelContentState({
 
   useLocalLogTail({ openFiles, fileContents, setFileContents, reloadContent })
 
+  const needsFileRead = (fileId: string): boolean => {
+    const cached = fileContents[fileId]
+    return (
+      (!cached || cached.isStale === true) &&
+      !hasLiveRead(fileReadGenerationRef.current, outstandingFileReadsRef.current, fileId)
+    )
+  }
+  const needsDiffRead = (fileId: string): boolean => {
+    const cached = diffContents[fileId]
+    return (
+      (!cached || cached.isStale === true) &&
+      !hasLiveRead(diffReadGenerationRef.current, outstandingDiffReadsRef.current, fileId)
+    )
+  }
+
   useEffect(() => {
+    if (!isVisible) {
+      return
+    }
     if (activeFile?.mode === 'conflict-review' && !selectedConflictReviewFile) {
       const snapshotEntries = activeFile.conflictReview?.entries ?? []
       if (snapshotEntries.length === 0) {
@@ -437,7 +559,7 @@ export function useEditorPanelContentState({
         }
 
         const absolutePath = joinPath(activeFile.filePath, entry.path)
-        if (!fileContents[absolutePath]) {
+        if (needsFileRead(absolutePath)) {
           void loadFileContent(absolutePath, absolutePath, activeFile.worktreeId, entry.path)
         }
       }
@@ -452,7 +574,7 @@ export function useEditorPanelContentState({
       if (fileToLoad.conflict?.kind === 'conflict-placeholder') {
         return
       }
-      if (!fileContents[fileToLoad.id]) {
+      if (needsFileRead(fileToLoad.id)) {
         void loadFileContent(
           fileToLoad.filePath,
           fileToLoad.id,
@@ -460,10 +582,10 @@ export function useEditorPanelContentState({
           fileToLoad.relativePath
         )
       }
-      if (isChangesMode && !diffContents[fileToLoad.id]) {
+      if (isChangesMode && needsDiffRead(fileToLoad.id)) {
         void loadDiffContent(fileToLoad)
       }
-    } else if (isReloadableSingleFileDiffTab(fileToLoad) && !diffContents[fileToLoad.id]) {
+    } else if (isReloadableSingleFileDiffTab(fileToLoad) && needsDiffRead(fileToLoad.id)) {
       void loadDiffContent(fileToLoad)
     }
     // oxlint-disable-next-line react-hooks/exhaustive-deps
@@ -474,11 +596,12 @@ export function useEditorPanelContentState({
     activeFile?.conflictReview?.snapshotTimestamp,
     selectedConflictReviewFile?.id,
     isChangesMode,
+    isVisible,
     gitStatusEntries
   ])
 
   useEditorPanelFileLoadRetry({
-    activeFile,
+    activeFile: isVisible ? activeFile : null,
     fileContents,
     fileLoadRetryAttemptsRef,
     loadFileContent,
@@ -523,9 +646,14 @@ export function useEditorPanelContentState({
     if (!(isChangesMode || activeFileShouldReloadOnGitStatusChange)) {
       return
     }
-    // Why: the lazy-load effect already fetches on first open; forcing here
-    // races a duplicate git-diff RPC for the same tab.
-    if (!diffContentsRef.current[current.id]) {
+    if (!isVisibleRef.current) {
+      invalidateDiffContent([current.id])
+      return
+    }
+    // Why: the lazy-load effect already fetches on first open and on a retained
+    // stale entry; forcing here races a duplicate git-diff RPC for the same tab.
+    const cachedDiff = diffContentsRef.current[current.id]
+    if (!cachedDiff || cachedDiff.isStale === true) {
       return
     }
     void loadDiffContent(current, { force: true })
@@ -534,6 +662,7 @@ export function useEditorPanelContentState({
     activeFileGitStatusSignature,
     isChangesMode,
     activeFile?.id,
+    invalidateDiffContent,
     loadDiffContent
   ])
 
@@ -546,16 +675,12 @@ export function useEditorPanelContentState({
     if (!current || !isReloadableSingleFileDiffTab(current)) {
       return
     }
-    setDiffContents((prev) => {
-      if (!prev[current.id]) {
-        return prev
-      }
-      const next = { ...prev }
-      delete next[current.id]
-      return next
-    })
+    invalidateDiffContent([current.id])
+    if (!isVisibleRef.current) {
+      return
+    }
     void loadDiffContent(current, { force: true })
-  }, [activeFile?.diffContentReloadNonce, activeFile?.id, loadDiffContent])
+  }, [activeFile?.diffContentReloadNonce, activeFile?.id, invalidateDiffContent, loadDiffContent])
 
   useEffect(() => {
     const nonce = activeFile?.fileContentReloadNonce
@@ -570,20 +695,26 @@ export function useEditorPanelContentState({
     ) {
       return
     }
-    setFileContents((prev) => {
-      if (!prev[current.id]) {
-        return prev
-      }
-      const next = { ...prev }
-      delete next[current.id]
-      return next
-    })
+    invalidateFileContent([current.id])
+    if (!isVisibleRef.current) {
+      return
+    }
     void loadFileContent(current.filePath, current.id, current.worktreeId, current.relativePath, {
       force: true
     })
-  }, [activeFile?.fileContentReloadNonce, activeFile?.filePath, activeFile?.id, loadFileContent])
+  }, [
+    activeFile?.fileContentReloadNonce,
+    activeFile?.filePath,
+    activeFile?.id,
+    invalidateFileContent,
+    loadFileContent
+  ])
 
   useEditorPanelExternalContentEvents({
+    activeContentFileIdRef,
+    invalidateContent,
+    invalidateDiffContent,
+    isVisibleRef,
     loadDiffContent,
     loadFileContent,
     openFilesRef,
diff --git a/src/renderer/src/components/editor/useEditorPanelExternalContentEvents.test.tsx b/src/renderer/src/components/editor/useEditorPanelExternalContentEvents.test.tsx
new file mode 100644
index 00000000000..12f5471e54c
--- /dev/null
+++ b/src/renderer/src/components/editor/useEditorPanelExternalContentEvents.test.tsx
@@ -0,0 +1,242 @@
+// @vitest-environment happy-dom
+
+import { act, useLayoutEffect, useRef, useState } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { OpenFile } from '@/store/slices/editor'
+import { ORCA_EDITOR_EXTERNAL_FILE_CHANGE_EVENT } from './editor-autosave'
+import type { DiffContent, FileContent } from './editor-panel-content-types'
+import { useEditorPanelExternalContentEvents } from './useEditorPanelExternalContentEvents'
+
+type ProbeCalls = {
+  invalidate: ReturnType<typeof vi.fn>
+  invalidateDiff: ReturnType<typeof vi.fn>
+  loadDiff: ReturnType<typeof vi.fn>
+  loadFile: ReturnType<typeof vi.fn>
+}
+
+type ProbeProps = {
+  activeFileId: string
+  calls: ProbeCalls
+  isVisible: boolean
+  openFiles: OpenFile[]
+}
+
+function ExternalContentProbe({ activeFileId, calls, isVisible, openFiles }: ProbeProps): null {
+  const activeContentFileIdRef = useRef(activeFileId)
+  const isVisibleRef = useRef(isVisible)
+  const openFilesRef = useRef(openFiles)
+  const editorViewModeRef = useRef({})
+  const [, setFileContents] = useState<Record<string, FileContent>>({})
+  const [, setDiffContents] = useState<Record<string, DiffContent>>({})
+
+  useLayoutEffect(() => {
+    activeContentFileIdRef.current = activeFileId
+    isVisibleRef.current = isVisible
+    openFilesRef.current = openFiles
+  }, [activeFileId, isVisible, openFiles])
+
+  useEditorPanelExternalContentEvents({
+    activeContentFileIdRef,
+    editorViewModeRef,
+    invalidateContent: calls.invalidate,
+    invalidateDiffContent: calls.invalidateDiff,
+    isVisibleRef,
+    loadDiffContent: calls.loadDiff,
+    loadFileContent: calls.loadFile,
+    openFilesRef,
+    setDiffContents,
+    setFileContents
+  } as Parameters<typeof useEditorPanelExternalContentEvents>[0])
+  return null
+}
+
+function makeFile(id: string, overrides: Partial<OpenFile> = {}): OpenFile {
+  return {
+    id,
+    filePath: `/remote/repo/${id}.ts`,
+    relativePath: `${id}.ts`,
+    worktreeId: 'ssh-worktree',
+    language: 'typescript',
+    isDirty: false,
+    mode: 'edit',
+    ...overrides
+  }
+}
+
+function makeCalls(): ProbeCalls {
+  return {
+    invalidate: vi.fn(),
+    invalidateDiff: vi.fn(),
+    loadDiff: vi.fn(async () => undefined),
+    loadFile: vi.fn(async () => undefined)
+  }
+}
+
+function dispatchExternalChange(relativePath: string): void {
+  act(() => {
+    window.dispatchEvent(
+      new CustomEvent(ORCA_EDITOR_EXTERNAL_FILE_CHANGE_EVENT, {
+        detail: {
+          worktreeId: 'ssh-worktree',
+          worktreePath: '/remote/repo',
+          relativePath
+        }
+      })
+    )
+  })
+}
+
+describe('useEditorPanelExternalContentEvents', () => {
+  let container: HTMLDivElement
+  let root: Root
+
+  beforeEach(() => {
+    globalThis.IS_REACT_ACT_ENVIRONMENT = true
+    container = document.body.appendChild(document.createElement('div'))
+    root = createRoot(container)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
+  })
+
+  it('routes one remote change to one visible owner instead of every retained panel', () => {
+    const changedFile = makeFile('changed')
+    const otherFiles = Array.from({ length: 9 }, (_, index) => makeFile(`other-${index}`))
+    const openFiles = [changedFile, ...otherFiles]
+    const ownerCalls = makeCalls()
+    const retainedCalls = otherFiles.map(() => makeCalls())
+
+    act(() => {
+      root.render(
+        <>
+          <ExternalContentProbe
+            activeFileId={changedFile.id}
+            calls={ownerCalls}
+            isVisible
+            openFiles={openFiles}
+          />
+          {otherFiles.map((file, index) => (
+            <ExternalContentProbe
+              key={file.id}
+              activeFileId={file.id}
+              calls={retainedCalls[index]}
+              isVisible={false}
+              openFiles={openFiles}
+            />
+          ))}
+        </>
+      )
+    })
+    dispatchExternalChange(changedFile.relativePath)
+
+    expect(ownerCalls.loadFile).toHaveBeenCalledOnce()
+    expect(retainedCalls.flatMap((calls) => calls.loadFile.mock.calls)).toHaveLength(0)
+    for (const calls of retainedCalls) {
+      expect(calls.invalidate).toHaveBeenCalledExactlyOnceWith([changedFile.id])
+    }
+  })
+
+  it('invalidates a hidden owner without reloading until reveal', () => {
+    const changedFile = makeFile('changed')
+    const calls = makeCalls()
+
+    act(() => {
+      root.render(
+        <ExternalContentProbe
+          activeFileId={changedFile.id}
+          calls={calls}
+          isVisible={false}
+          openFiles={[changedFile]}
+        />
+      )
+    })
+    dispatchExternalChange(changedFile.relativePath)
+
+    expect(calls.loadFile).not.toHaveBeenCalled()
+    expect(calls.invalidate).toHaveBeenCalledExactlyOnceWith([changedFile.id])
+  })
+
+  it('keeps dirty hidden content intact', () => {
+    const changedFile = makeFile('changed', { isDirty: true })
+    const calls = makeCalls()
+
+    act(() => {
+      root.render(
+        <ExternalContentProbe
+          activeFileId={changedFile.id}
+          calls={calls}
+          isVisible={false}
+          openFiles={[changedFile]}
+        />
+      )
+    })
+    dispatchExternalChange(changedFile.relativePath)
+
+    expect(calls.loadFile).not.toHaveBeenCalled()
+    expect(calls.invalidate).not.toHaveBeenCalled()
+  })
+
+  it('invalidates an inactive cached Changes diff after reloading its visible file', () => {
+    const changedFile = makeFile('changed')
+    const calls = makeCalls()
+
+    act(() => {
+      root.render(
+        <ExternalContentProbe
+          activeFileId={changedFile.id}
+          calls={calls}
+          isVisible
+          openFiles={[changedFile]}
+        />
+      )
+    })
+    dispatchExternalChange(changedFile.relativePath)
+
+    expect(calls.loadFile).toHaveBeenCalledOnce()
+    expect(calls.loadDiff).not.toHaveBeenCalled()
+    expect(calls.invalidateDiff).toHaveBeenCalledExactlyOnceWith([changedFile.id])
+  })
+
+  it('uses one event generation for visible source and preview reloads', () => {
+    const source = makeFile('source', {
+      filePath: '/remote/repo/shared.md',
+      relativePath: 'shared.md'
+    })
+    const preview = makeFile('preview', {
+      filePath: '/remote/repo/shared.md',
+      relativePath: 'shared.md',
+      mode: 'markdown-preview',
+      markdownPreviewSourceFileId: source.id
+    })
+    const sourceCalls = makeCalls()
+    const previewCalls = makeCalls()
+
+    act(() => {
+      root.render(
+        <>
+          <ExternalContentProbe
+            activeFileId={source.id}
+            calls={sourceCalls}
+            isVisible
+            openFiles={[source, preview]}
+          />
+          <ExternalContentProbe
+            activeFileId={preview.id}
+            calls={previewCalls}
+            isVisible
+            openFiles={[source, preview]}
+          />
+        </>
+      )
+    })
+    dispatchExternalChange(source.relativePath)
+
+    const sourceOptions = sourceCalls.loadFile.mock.calls[0]?.[4]
+    const previewOptions = previewCalls.loadFile.mock.calls[0]?.[4]
+    expect(sourceOptions?.externalEventGeneration).toBeTypeOf('number')
+    expect(previewOptions?.externalEventGeneration).toBe(sourceOptions?.externalEventGeneration)
+  })
+})
diff --git a/src/renderer/src/components/editor/useEditorPanelExternalContentEvents.ts b/src/renderer/src/components/editor/useEditorPanelExternalContentEvents.ts
index 19650b1cd64..7a5077b59bb 100644
--- a/src/renderer/src/components/editor/useEditorPanelExternalContentEvents.ts
+++ b/src/renderer/src/components/editor/useEditorPanelExternalContentEvents.ts
@@ -13,14 +13,23 @@ import { isReloadableSingleFileDiffTab } from './editor-panel-diff-reload'
 
 type EditorViewModeByFile = ReturnType<typeof useAppStore.getState>['editorViewMode']
 
+export type EditorPanelContentLoadOptions = {
+  force?: boolean
+  externalEventGeneration?: number
+}
+
 type UseEditorPanelExternalContentEventsParams = {
-  loadDiffContent: (file: OpenFile | null, options?: { force?: boolean }) => Promise<void>
+  activeContentFileIdRef: MutableRefObject<string | null>
+  invalidateContent: (fileIds: string[]) => void
+  invalidateDiffContent: (fileIds: string[]) => void
+  isVisibleRef: MutableRefObject<boolean>
+  loadDiffContent: (file: OpenFile | null, options?: EditorPanelContentLoadOptions) => Promise<void>
   loadFileContent: (
     filePath: string,
     id: string,
     worktreeId?: string,
     relativePath?: string,
-    options?: { force?: boolean }
+    options?: EditorPanelContentLoadOptions
   ) => Promise<void>
   openFilesRef: MutableRefObject<OpenFile[]>
   editorViewModeRef: MutableRefObject<EditorViewModeByFile>
@@ -28,7 +37,24 @@ type UseEditorPanelExternalContentEventsParams = {
   setDiffContents: Dispatch<SetStateAction<Record<string, DiffContent>>>
 }
 
+const externalEventGenerations = new WeakMap<Event, number>()
+let externalEventGenerationCounter = 0
+
+function getExternalEventGeneration(event: Event): number {
+  const existing = externalEventGenerations.get(event)
+  if (existing !== undefined) {
+    return existing
+  }
+  const generation = ++externalEventGenerationCounter
+  externalEventGenerations.set(event, generation)
+  return generation
+}
+
 export function useEditorPanelExternalContentEvents({
+  activeContentFileIdRef,
+  invalidateContent,
+  invalidateDiffContent,
+  isVisibleRef,
   loadDiffContent,
   loadFileContent,
   openFilesRef,
@@ -42,6 +68,9 @@ export function useEditorPanelExternalContentEvents({
       if (!detail) {
         return
       }
+      const eventGeneration = getExternalEventGeneration(event)
+      const invalidatedDiffFileIds: string[] = []
+      const invalidatedFileIds: string[] = []
       for (const file of getOpenFilesForExternalFileChange(openFilesRef.current, detail)) {
         // Why: a dirty file keeps its unsaved buffer (issue #7265) — it is
         // marked changed-on-disk upstream and resolves via the editor banner,
@@ -49,24 +78,52 @@ export function useEditorPanelExternalContentEvents({
         if (file.isDirty) {
           continue
         }
+        if (!isVisibleRef.current || file.id !== activeContentFileIdRef.current) {
+          invalidatedFileIds.push(file.id)
+          continue
+        }
         if (file.mode === 'edit' || file.mode === 'markdown-preview') {
           // Why: external writes must replace any in-flight pre-change read so
           // the tab shows the new on-disk content, not a stale dedupe result.
           void loadFileContent(file.filePath, file.id, file.worktreeId, file.relativePath, {
-            force: true
+            force: true,
+            externalEventGeneration: eventGeneration
           })
           if (editorViewModeRef.current[file.id] === 'changes') {
-            void loadDiffContent(file, { force: true })
+            void loadDiffContent(file, {
+              force: true,
+              externalEventGeneration: eventGeneration
+            })
+          } else {
+            invalidatedDiffFileIds.push(file.id)
           }
         } else if (isReloadableSingleFileDiffTab(file)) {
-          void loadDiffContent(file, { force: true })
+          void loadDiffContent(file, {
+            force: true,
+            externalEventGeneration: eventGeneration
+          })
         }
       }
+      if (invalidatedFileIds.length > 0) {
+        invalidateContent(invalidatedFileIds)
+      }
+      if (invalidatedDiffFileIds.length > 0) {
+        invalidateDiffContent(invalidatedDiffFileIds)
+      }
     }
     window.addEventListener(ORCA_EDITOR_EXTERNAL_FILE_CHANGE_EVENT, handler as EventListener)
     return () =>
       window.removeEventListener(ORCA_EDITOR_EXTERNAL_FILE_CHANGE_EVENT, handler as EventListener)
-  }, [editorViewModeRef, loadDiffContent, loadFileContent, openFilesRef])
+  }, [
+    activeContentFileIdRef,
+    editorViewModeRef,
+    invalidateContent,
+    invalidateDiffContent,
+    isVisibleRef,
+    loadDiffContent,
+    loadFileContent,
+    openFilesRef
+  ])
 
   useEffect(() => {
     const handler = (event: Event): void => {
diff --git a/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.test.tsx b/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.test.tsx
index 7709c4f9545..6a29017d654 100644
--- a/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.test.tsx
+++ b/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.test.tsx
@@ -10,6 +10,7 @@ import {
   type FileContent
 } from './editor-panel-content-types'
 import {
+  OWNER_NOT_READY_RETRY_DELAY_MS,
   OWNER_NOT_READY_RETRY_LIMIT,
   shouldRetryFileLoadError,
   useEditorPanelFileLoadRetry
@@ -46,19 +47,21 @@ function Harness({
   file,
   fileContents,
   attemptsRef,
+  isVisible = true,
   loadFileContent,
   setFileContents
 }: {
   file: OpenFile
   fileContents: Record<string, FileContent>
   attemptsRef: { current: Record<string, number> }
+  isVisible?: boolean
   loadFileContent: (filePath: string, id: string) => Promise<void>
   setFileContents: (
     updater: (prev: Record<string, FileContent>) => Record<string, FileContent>
   ) => void
 }): null {
   useEditorPanelFileLoadRetry({
-    activeFile: file,
+    activeFile: isVisible ? file : null,
     fileContents,
     fileLoadRetryAttemptsRef: attemptsRef,
     loadFileContent: loadFileContent as never,
@@ -100,6 +103,67 @@ describe('useEditorPanelFileLoadRetry — owner-not-ready bounding (#6648)', ()
     expect(shouldRetryFileLoadError('Access denied: outside allowed directories')).toBe(false)
   })
 
+  it('does not spend retry budget when hiding cancels a pending retry', () => {
+    setTimeoutSpy.mockRestore()
+    setTimeoutSpy = vi.spyOn(window, 'setTimeout')
+    const file = makeFile()
+    const attemptsRef = { current: {} as Record<string, number> }
+    const fileContents: Record<string, FileContent> = {
+      [file.id]: { content: '', isBinary: false, loadError: WORKTREE_OWNER_NOT_READY_ERROR }
+    }
+    const loadFileContent = vi.fn(async () => undefined)
+    const setFileContents = vi.fn((updater) => updater(fileContents))
+
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <Harness
+          file={file}
+          fileContents={fileContents}
+          attemptsRef={attemptsRef}
+          loadFileContent={loadFileContent}
+          setFileContents={setFileContents as never}
+        />
+      )
+    })
+    expect(loadFileContent).not.toHaveBeenCalled()
+    expect(attemptsRef.current[file.id]).toBeUndefined()
+
+    act(() => {
+      root?.render(
+        <Harness
+          file={file}
+          fileContents={fileContents}
+          attemptsRef={attemptsRef}
+          isVisible={false}
+          loadFileContent={loadFileContent}
+          setFileContents={setFileContents as never}
+        />
+      )
+    })
+    act(() => vi.advanceTimersByTime(OWNER_NOT_READY_RETRY_DELAY_MS))
+    expect(loadFileContent).not.toHaveBeenCalled()
+    expect(attemptsRef.current[file.id]).toBeUndefined()
+
+    act(() => {
+      root?.render(
+        <Harness
+          file={file}
+          fileContents={fileContents}
+          attemptsRef={attemptsRef}
+          loadFileContent={loadFileContent}
+          setFileContents={setFileContents as never}
+        />
+      )
+    })
+    act(() => vi.advanceTimersByTime(OWNER_NOT_READY_RETRY_DELAY_MS))
+    expect(loadFileContent).toHaveBeenCalledOnce()
+    expect(attemptsRef.current[file.id]).toBe(1)
+  })
+
   it('stops after the budget and shows a truthful terminal message, then Retry re-arms', () => {
     const file = makeFile()
     const attemptsRef = { current: {} as Record<string, number> }
diff --git a/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.ts b/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.ts
index d62bc33aa15..9fb96ad80aa 100644
--- a/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.ts
+++ b/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.ts
@@ -98,7 +98,6 @@ export function useEditorPanelFileLoadRetry({
     const delayMs = ownerNotReady
       ? OWNER_NOT_READY_RETRY_DELAY_MS
       : (FILE_LOAD_RETRY_DELAYS_MS[retryCount] ?? FILE_LOAD_RETRY_DELAYS_MS[0])
-    fileLoadRetryAttemptsRef.current[activeFileLoadRetryId] = retryCount + 1
     const timeoutId = window.setTimeout(() => {
       const currentFile = openFilesRef.current.find((file) => file.id === activeFileLoadRetryId)
       if (
@@ -107,6 +106,7 @@ export function useEditorPanelFileLoadRetry({
       ) {
         return
       }
+      fileLoadRetryAttemptsRef.current[activeFileLoadRetryId] = retryCount + 1
       setFileContents((prev) => {
         if (prev[currentFile.id]?.loadError !== activeFileLoadError) {
           return prev
diff --git a/src/renderer/src/components/editor/useEditorPanelSave.ts b/src/renderer/src/components/editor/useEditorPanelSave.ts
new file mode 100644
index 00000000000..968edcf8ab4
--- /dev/null
+++ b/src/renderer/src/components/editor/useEditorPanelSave.ts
@@ -0,0 +1,39 @@
+import { useCallback } from 'react'
+import type { OpenFile } from '@/store/slices/editor'
+import { attemptEditorFileSave } from './editor-file-save-attempt'
+import { getEditorSaveTargetFile } from './editor-save-target'
+
+type UseEditorPanelSaveParams = {
+  activeFile: OpenFile | null
+  openFiles: OpenFile[]
+  requestRenameForFile: (fileId: string) => void
+}
+
+export function useEditorPanelSave({
+  activeFile,
+  openFiles,
+  requestRenameForFile
+}: UseEditorPanelSaveParams) {
+  const handleSaveForFile = useCallback(
+    async (file: OpenFile | null, content: string): Promise<boolean> => {
+      if (!file) {
+        return false
+      }
+      const saveTargetFile = getEditorSaveTargetFile(file, openFiles)
+      if (!saveTargetFile) {
+        return false
+      }
+      if (saveTargetFile.isUntitled) {
+        requestRenameForFile(saveTargetFile.id)
+        return false
+      }
+      return attemptEditorFileSave({ fileId: saveTargetFile.id, fallbackContent: content })
+    },
+    [openFiles, requestRenameForFile]
+  )
+  const handleSave = useCallback(
+    (content: string): Promise<boolean> => handleSaveForFile(activeFile, content),
+    [activeFile, handleSaveForFile]
+  )
+  return { handleSave, handleSaveForFile }
+}
diff --git a/src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx b/src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx
new file mode 100644
index 00000000000..560bc217d86
--- /dev/null
+++ b/src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx
@@ -0,0 +1,477 @@
+// @vitest-environment happy-dom
+
+import { act, useLayoutEffect, useMemo } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { OpenFile } from '@/store/slices/editor'
+import type { GitStatusEntry } from '../../../../shared/types'
+import type { DiffContent, FileContent } from './editor-panel-content-types'
+
+const mocks = vi.hoisted(() => ({
+  getRuntimeGitDiff: vi.fn(),
+  getState: vi.fn(),
+  readRuntimeFileContent: vi.fn()
+}))
+
+vi.mock('@/runtime/runtime-file-client', () => ({
+  getRuntimeFileReadScope: vi.fn(() => null),
+  readRuntimeFileContent: mocks.readRuntimeFileContent,
+  subscribeRuntimeFileChanges: vi.fn()
+}))
+
+vi.mock('@/runtime/runtime-git-client', () => ({
+  getRuntimeGitBranchDiff: vi.fn(),
+  getRuntimeGitCommitDiff: vi.fn(),
+  getRuntimeGitDiff: mocks.getRuntimeGitDiff,
+  getRuntimeGitScope: vi.fn(() => null)
+}))
+
+vi.mock('@/lib/connection-context', () => ({
+  getConnectionId: vi.fn(),
+  getConnectionIdForFile: vi.fn(),
+  isWorktreeConnectionResolved: vi.fn(() => true)
+}))
+
+vi.mock('@/lib/runtime-workspace-file-route', () => ({
+  findWorkspaceFileRoute: vi.fn(() => null)
+}))
+
+vi.mock('@/store', () => ({ useAppStore: { getState: mocks.getState } }))
+
+import { ORCA_EDITOR_EXTERNAL_FILE_CHANGE_EVENT } from './editor-autosave'
+import { useEditorPanelContentState } from './useEditorPanelContentState'
+
+type Deferred<T> = {
+  promise: Promise<T>
+  resolve: (value: T) => void
+}
+
+type ProbeSnapshot = {
+  diffContents: Record<string, DiffContent>
+  fileContents: Record<string, FileContent>
+}
+
+type ProbeProps = {
+  activeFile: OpenFile
+  editorViewMode?: Record<string, 'edit' | 'changes'>
+  gitStatusEntries?: GitStatusEntry[]
+  isChangesMode?: boolean
+  isVisible?: boolean
+  name?: string
+  openFiles?: OpenFile[]
+}
+
+const snapshots = new Map<string, ProbeSnapshot>()
+const EMPTY_EDITOR_VIEW_MODE: Record<string, 'edit' | 'changes'> = {}
+
+function createDeferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((res) => {
+    resolve = res
+  })
+  return { promise, resolve }
+}
+
+function makeFile(id: string, overrides: Partial<OpenFile> = {}): OpenFile {
+  return {
+    id,
+    filePath: `/repo/${id}.ts`,
+    relativePath: `${id}.ts`,
+    worktreeId: 'wt-1',
+    language: 'typescript',
+    isDirty: false,
+    mode: 'edit',
+    ...overrides
+  }
+}
+
+function Probe({
+  activeFile,
+  editorViewMode = EMPTY_EDITOR_VIEW_MODE,
+  gitStatusEntries,
+  isChangesMode = false,
+  isVisible = true,
+  name = 'main',
+  openFiles
+}: ProbeProps): null {
+  const panelOpenFiles = useMemo(() => openFiles ?? [activeFile], [activeFile, openFiles])
+  const state = useEditorPanelContentState({
+    activeFile,
+    editorViewMode,
+    gitStatusEntries,
+    isChangesMode,
+    isVisible,
+    openFiles: panelOpenFiles
+  })
+  snapshots.set(name, {
+    diffContents: state.diffContents,
+    fileContents: state.fileContents
+  })
+  return null
+}
+
+function dispatchExternalChange(file: OpenFile): void {
+  act(() => {
+    window.dispatchEvent(
+      new CustomEvent(ORCA_EDITOR_EXTERNAL_FILE_CHANGE_EVENT, {
+        detail: {
+          worktreeId: file.worktreeId,
+          worktreePath: '/repo',
+          relativePath: file.relativePath
+        }
+      })
+    )
+  })
+}
+
+function ExternalChangeLayoutEmitter({ file }: { file: OpenFile }): null {
+  useLayoutEffect(() => {
+    window.dispatchEvent(
+      new CustomEvent(ORCA_EDITOR_EXTERNAL_FILE_CHANGE_EVENT, {
+        detail: {
+          worktreeId: file.worktreeId,
+          worktreePath: '/repo',
+          relativePath: file.relativePath
+        }
+      })
+    )
+  }, [file])
+  return null
+}
+
+function textDiff(modifiedContent: string): DiffContent {
+  return {
+    kind: 'text',
+    originalContent: 'old',
+    modifiedContent,
+    originalIsBinary: false,
+    modifiedIsBinary: false
+  }
+}
+
+describe('useEditorPanelContentState visibility', () => {
+  let container: HTMLDivElement
+  let root: Root
+
+  beforeEach(() => {
+    snapshots.clear()
+    mocks.getRuntimeGitDiff.mockReset()
+    mocks.readRuntimeFileContent.mockReset()
+    mocks.getState.mockReset()
+    mocks.getState.mockReturnValue({
+      settings: null,
+      openFiles: [],
+      setLastKnownDiskSignature: vi.fn()
+    })
+    container = document.body.appendChild(document.createElement('div'))
+    root = createRoot(container)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
+  })
+
+  it('defers the initial remote read until reveal', async () => {
+    const file = makeFile('initial')
+    mocks.readRuntimeFileContent.mockResolvedValue({ content: 'remote', isBinary: false })
+
+    await act(async () => root.render(<Probe activeFile={file} isVisible={false} />))
+    expect(mocks.readRuntimeFileContent).not.toHaveBeenCalled()
+
+    await act(async () => root.render(<Probe activeFile={file} />))
+    await vi.waitFor(() =>
+      expect(snapshots.get('main')?.fileContents[file.id]?.content).toBe('remote')
+    )
+    expect(mocks.readRuntimeFileContent).toHaveBeenCalledOnce()
+  })
+
+  it('invalidates a hidden tab and rejects its older in-flight result', async () => {
+    const file = makeFile('stale')
+    const staleRead = createDeferred<FileContent>()
+    const freshRead = createDeferred<FileContent>()
+    mocks.readRuntimeFileContent
+      .mockReturnValueOnce(staleRead.promise)
+      .mockReturnValueOnce(freshRead.promise)
+
+    await act(async () => root.render(<Probe activeFile={file} />))
+    await vi.waitFor(() => expect(mocks.readRuntimeFileContent).toHaveBeenCalledOnce())
+    await act(async () => root.render(<Probe activeFile={file} isVisible={false} />))
+    dispatchExternalChange(file)
+    expect(mocks.readRuntimeFileContent).toHaveBeenCalledOnce()
+
+    await act(async () => {
+      staleRead.resolve({ content: 'stale', isBinary: false })
+      await staleRead.promise
+    })
+    expect(snapshots.get('main')?.fileContents[file.id]).toBeUndefined()
+
+    await act(async () => root.render(<Probe activeFile={file} />))
+    await vi.waitFor(() => expect(mocks.readRuntimeFileContent).toHaveBeenCalledTimes(2))
+    await act(async () => {
+      freshRead.resolve({ content: 'fresh', isBinary: false })
+      await freshRead.promise
+    })
+    await vi.waitFor(() =>
+      expect(snapshots.get('main')?.fileContents[file.id]?.content).toBe('fresh')
+    )
+  })
+
+  it('keeps invalidated bytes on screen until the reveal read lands', async () => {
+    const file = makeFile('no-flash')
+    const freshRead = createDeferred<FileContent>()
+    mocks.readRuntimeFileContent
+      .mockResolvedValueOnce({ content: 'old', isBinary: false })
+      .mockReturnValueOnce(freshRead.promise)
+
+    await act(async () => root.render(<Probe activeFile={file} />))
+    await vi.waitFor(() =>
+      expect(snapshots.get('main')?.fileContents[file.id]?.content).toBe('old')
+    )
+
+    await act(async () => root.render(<Probe activeFile={file} isVisible={false} />))
+    dispatchExternalChange(file)
+    expect(snapshots.get('main')?.fileContents[file.id]?.content).toBe('old')
+
+    await act(async () => root.render(<Probe activeFile={file} />))
+    await vi.waitFor(() => expect(mocks.readRuntimeFileContent).toHaveBeenCalledTimes(2))
+    // Why: an unresolved reveal read must not blank the pane to "Loading…".
+    expect(snapshots.get('main')?.fileContents[file.id]?.content).toBe('old')
+
+    await act(async () => {
+      freshRead.resolve({ content: 'fresh', isBinary: false })
+      await freshRead.promise
+    })
+    await vi.waitFor(() =>
+      expect(snapshots.get('main')?.fileContents[file.id]).toEqual({
+        content: 'fresh',
+        isBinary: false
+      })
+    )
+  })
+
+  it('does not re-read while the reveal read is still in flight', async () => {
+    const file = makeFile('flip-flop')
+    const pendingRead = createDeferred<FileContent>()
+    mocks.readRuntimeFileContent.mockReturnValue(pendingRead.promise)
+
+    await act(async () => root.render(<Probe activeFile={file} isVisible={false} />))
+    await act(async () => root.render(<Probe activeFile={file} />))
+    expect(mocks.readRuntimeFileContent).toHaveBeenCalledOnce()
+
+    await act(async () => root.render(<Probe activeFile={file} isVisible={false} />))
+    await act(async () => root.render(<Probe activeFile={file} />))
+    expect(mocks.readRuntimeFileContent).toHaveBeenCalledOnce()
+
+    await act(async () => {
+      pendingRead.resolve({ content: 'remote', isBinary: false })
+      await pendingRead.promise
+    })
+    await vi.waitFor(() =>
+      expect(snapshots.get('main')?.fileContents[file.id]?.content).toBe('remote')
+    )
+    expect(mocks.readRuntimeFileContent).toHaveBeenCalledOnce()
+  })
+
+  it('publishes hidden visibility before a watcher event in the same commit', async () => {
+    const file = makeFile('commit-visibility')
+    mocks.readRuntimeFileContent.mockResolvedValue({ content: 'old', isBinary: false })
+
+    await act(async () => root.render(<Probe activeFile={file} />))
+    await vi.waitFor(() => expect(mocks.readRuntimeFileContent).toHaveBeenCalledOnce())
+
+    await act(async () =>
+      root.render(
+        <>
+          <Probe activeFile={file} isVisible={false} />
+          <ExternalChangeLayoutEmitter file={file} />
+        </>
+      )
+    )
+
+    expect(mocks.readRuntimeFileContent).toHaveBeenCalledOnce()
+    expect(snapshots.get('main')?.fileContents[file.id]).toEqual({
+      content: 'old',
+      isBinary: false,
+      isStale: true
+    })
+  })
+
+  it('shares one post-change read between visible source and preview panels', async () => {
+    const source = makeFile('source', {
+      filePath: '/repo/readme.md',
+      relativePath: 'readme.md',
+      language: 'markdown'
+    })
+    const preview = makeFile('preview', {
+      filePath: '/repo/readme.md',
+      relativePath: 'readme.md',
+      language: 'markdown',
+      mode: 'markdown-preview',
+      markdownPreviewSourceFileId: source.id
+    })
+    mocks.readRuntimeFileContent
+      .mockResolvedValueOnce({ content: 'old', isBinary: false })
+      .mockResolvedValueOnce({ content: 'fresh', isBinary: false })
+
+    await act(async () => {
+      root.render(
+        <>
+          <Probe activeFile={source} name="source" openFiles={[source, preview]} />
+          <Probe activeFile={preview} name="preview" openFiles={[source, preview]} />
+        </>
+      )
+    })
+    await vi.waitFor(() => expect(mocks.readRuntimeFileContent).toHaveBeenCalledOnce())
+
+    dispatchExternalChange(source)
+    await vi.waitFor(() => expect(mocks.readRuntimeFileContent).toHaveBeenCalledTimes(2))
+    await vi.waitFor(() => {
+      expect(snapshots.get('source')?.fileContents[source.id]?.content).toBe('fresh')
+      expect(snapshots.get('preview')?.fileContents[preview.id]?.content).toBe('fresh')
+    })
+  })
+
+  it('invalidates a hidden file nonce without reading until reveal', async () => {
+    const file = makeFile('file-nonce')
+    mocks.readRuntimeFileContent
+      .mockResolvedValueOnce({ content: 'old', isBinary: false })
+      .mockResolvedValueOnce({ content: 'fresh', isBinary: false })
+
+    await act(async () => root.render(<Probe activeFile={file} />))
+    await vi.waitFor(() =>
+      expect(snapshots.get('main')?.fileContents[file.id]?.content).toBe('old')
+    )
+
+    const changed = { ...file, fileContentReloadNonce: 1 }
+    await act(async () => root.render(<Probe activeFile={changed} isVisible={false} />))
+    expect(snapshots.get('main')?.fileContents[file.id]?.isStale).toBe(true)
+    expect(mocks.readRuntimeFileContent).toHaveBeenCalledOnce()
+
+    await act(async () => root.render(<Probe activeFile={changed} />))
+    await vi.waitFor(() =>
+      expect(snapshots.get('main')?.fileContents[file.id]?.content).toBe('fresh')
+    )
+    expect(mocks.readRuntimeFileContent).toHaveBeenCalledTimes(2)
+  })
+
+  it('invalidates a hidden diff nonce without reading until reveal', async () => {
+    const file = makeFile('diff-nonce', { mode: 'diff', diffSource: 'unstaged' })
+    const staleDiff = createDeferred<DiffContent>()
+    const freshDiff = createDeferred<DiffContent>()
+    mocks.getRuntimeGitDiff
+      .mockReturnValueOnce(staleDiff.promise)
+      .mockReturnValueOnce(freshDiff.promise)
+
+    await act(async () => root.render(<Probe activeFile={file} />))
+    await vi.waitFor(() => expect(mocks.getRuntimeGitDiff).toHaveBeenCalledOnce())
+
+    const changed = { ...file, diffContentReloadNonce: 1 }
+    await act(async () => root.render(<Probe activeFile={changed} isVisible={false} />))
+    expect(mocks.getRuntimeGitDiff).toHaveBeenCalledOnce()
+    await act(async () => {
+      staleDiff.resolve(textDiff('stale diff'))
+      await staleDiff.promise
+    })
+    expect(snapshots.get('main')?.diffContents[file.id]).toBeUndefined()
+
+    await act(async () => root.render(<Probe activeFile={changed} />))
+    await vi.waitFor(() => expect(mocks.getRuntimeGitDiff).toHaveBeenCalledTimes(2))
+    await act(async () => {
+      freshDiff.resolve(textDiff('fresh diff'))
+      await freshDiff.promise
+    })
+    await vi.waitFor(() =>
+      expect(snapshots.get('main')?.diffContents[file.id]?.modifiedContent).toBe('fresh diff')
+    )
+    expect(mocks.getRuntimeGitDiff).toHaveBeenCalledTimes(2)
+  })
+
+  it('keeps an invalidated diff on screen until the reveal read lands', async () => {
+    const file = makeFile('diff-no-flash', { mode: 'diff', diffSource: 'unstaged' })
+    const freshDiff = createDeferred<DiffContent>()
+    mocks.getRuntimeGitDiff
+      .mockResolvedValueOnce(textDiff('old diff'))
+      .mockReturnValueOnce(freshDiff.promise)
+
+    await act(async () => root.render(<Probe activeFile={file} />))
+    await vi.waitFor(() =>
+      expect(snapshots.get('main')?.diffContents[file.id]?.modifiedContent).toBe('old diff')
+    )
+
+    await act(async () => root.render(<Probe activeFile={file} isVisible={false} />))
+    dispatchExternalChange(file)
+    // Why: the viewers render "Loading diff…" purely on a missing entry, so a
+    // retained (stale-marked) entry is what keeps the pane painted.
+    expect(snapshots.get('main')?.diffContents[file.id]?.modifiedContent).toBe('old diff')
+    expect(snapshots.get('main')?.diffContents[file.id]?.isStale).toBe(true)
+    expect(mocks.getRuntimeGitDiff).toHaveBeenCalledOnce()
+
+    await act(async () => root.render(<Probe activeFile={file} />))
+    await vi.waitFor(() => expect(mocks.getRuntimeGitDiff).toHaveBeenCalledTimes(2))
+    expect(snapshots.get('main')?.diffContents[file.id]?.modifiedContent).toBe('old diff')
+
+    await act(async () => {
+      freshDiff.resolve(textDiff('fresh diff'))
+      await freshDiff.promise
+    })
+    await vi.waitFor(() =>
+      expect(snapshots.get('main')?.diffContents[file.id]).toEqual(textDiff('fresh diff'))
+    )
+    expect(mocks.getRuntimeGitDiff).toHaveBeenCalledTimes(2)
+  })
+
+  it('invalidates a hidden Git-status diff without reading until reveal', async () => {
+    const file = makeFile('status', { mode: 'diff', diffSource: 'unstaged' })
+    const status: GitStatusEntry[] = [
+      { path: file.relativePath, status: 'modified', area: 'unstaged' }
+    ]
+    mocks.getRuntimeGitDiff
+      .mockResolvedValueOnce(textDiff('old diff'))
+      .mockResolvedValueOnce(textDiff('fresh diff'))
+
+    await act(async () => root.render(<Probe activeFile={file} />))
+    await vi.waitFor(() => expect(snapshots.get('main')?.diffContents[file.id]).toBeDefined())
+    await act(async () =>
+      root.render(<Probe activeFile={file} gitStatusEntries={status} isVisible={false} />)
+    )
+    expect(snapshots.get('main')?.diffContents[file.id]?.isStale).toBe(true)
+    expect(mocks.getRuntimeGitDiff).toHaveBeenCalledOnce()
+
+    await act(async () => root.render(<Probe activeFile={file} gitStatusEntries={status} />))
+    await vi.waitFor(() =>
+      expect(snapshots.get('main')?.diffContents[file.id]?.modifiedContent).toBe('fresh diff')
+    )
+    expect(mocks.getRuntimeGitDiff).toHaveBeenCalledTimes(2)
+  })
+
+  it('invalidates an inactive cached Changes diff after an external edit', async () => {
+    const file = makeFile('changes-cache')
+    const changesMode = { [file.id]: 'changes' as const }
+    mocks.readRuntimeFileContent
+      .mockResolvedValueOnce({ content: 'old', isBinary: false })
+      .mockResolvedValueOnce({ content: 'fresh', isBinary: false })
+    mocks.getRuntimeGitDiff
+      .mockResolvedValueOnce(textDiff('old diff'))
+      .mockResolvedValueOnce(textDiff('fresh diff'))
+
+    await act(async () =>
+      root.render(<Probe activeFile={file} editorViewMode={changesMode} isChangesMode />)
+    )
+    await vi.waitFor(() => expect(snapshots.get('main')?.diffContents[file.id]).toBeDefined())
+    await act(async () => root.render(<Probe activeFile={file} />))
+
+    dispatchExternalChange(file)
+    await vi.waitFor(() => expect(mocks.readRuntimeFileContent).toHaveBeenCalledTimes(2))
+    expect(mocks.getRuntimeGitDiff).toHaveBeenCalledOnce()
+    expect(snapshots.get('main')?.diffContents[file.id]?.isStale).toBe(true)
+
+    await act(async () =>
+      root.render(<Probe activeFile={file} editorViewMode={changesMode} isChangesMode />)
+    )
+    await vi.waitFor(() =>
+      expect(snapshots.get('main')?.diffContents[file.id]?.modifiedContent).toBe('fresh diff')
+    )
+    expect(mocks.getRuntimeGitDiff).toHaveBeenCalledTimes(2)
+  })
+})
diff --git a/src/renderer/src/components/editor/useLocalImageSrc.ts b/src/renderer/src/components/editor/useLocalImageSrc.ts
index 9a8327af090..df174160bb8 100644
--- a/src/renderer/src/components/editor/useLocalImageSrc.ts
+++ b/src/renderer/src/components/editor/useLocalImageSrc.ts
@@ -130,7 +130,7 @@ if (typeof window !== 'undefined') {
   window.addEventListener('focus', invalidateImageCache)
 }
 
-if (typeof import.meta !== 'undefined' && import.meta.hot) {
+if (import.meta !== undefined && import.meta.hot) {
   // Why: Vite can re-evaluate this module without a full renderer reload.
   // Disposing the module-level listener and blob URLs prevents dev-session leaks.
   import.meta.hot.dispose(disposeImageCacheModuleState)
diff --git a/src/renderer/src/components/emulator-pane/emulator-device-frame-visibility.test.tsx b/src/renderer/src/components/emulator-pane/emulator-device-frame-visibility.test.tsx
index f202aa9dcdd..cbd7ad3de92 100644
--- a/src/renderer/src/components/emulator-pane/emulator-device-frame-visibility.test.tsx
+++ b/src/renderer/src/components/emulator-pane/emulator-device-frame-visibility.test.tsx
@@ -182,4 +182,19 @@ describe('EmulatorDeviceFrame window-visibility gating', () => {
     expect(stopFrameStream).not.toHaveBeenCalled()
     expect(startFrameStream).toHaveBeenCalledTimes(1)
   })
+
+  it('resumes a parked stream when user input proves hidden visibility is stale', async () => {
+    vi.useFakeTimers()
+    await renderFrame(true)
+
+    await act(async () => setDocumentVisibility('hidden'))
+    await act(async () => vi.advanceTimersByTime(EMULATOR_STREAM_PARK_DELAY_MS))
+    expect(stopFrameStream).toHaveBeenCalledWith({ streamId: 'stream-1' })
+
+    await act(async () => {
+      document.dispatchEvent(new KeyboardEvent('keydown', { key: 'a' }))
+    })
+    expect(document.visibilityState).toBe('hidden')
+    expect(startFrameStream).toHaveBeenCalledTimes(2)
+  })
 })
diff --git a/src/renderer/src/components/emulator-pane/use-emulator-stream-window-visibility.ts b/src/renderer/src/components/emulator-pane/use-emulator-stream-window-visibility.ts
index 3ca818b2d6f..f23ac9d793d 100644
--- a/src/renderer/src/components/emulator-pane/use-emulator-stream-window-visibility.ts
+++ b/src/renderer/src/components/emulator-pane/use-emulator-stream-window-visibility.ts
@@ -1,59 +1,4 @@
-import { useEffect, useState, useSyncExternalStore } from 'react'
-import { isWindowVisible } from '@/lib/window-visibility-interval'
-import {
-  isDocumentVisibilityProvenStale,
-  registerStaleDocumentVisibilityRecovery
-} from '../terminal-pane/stale-document-visibility'
-
-// Why: after display sleep macOS can wedge document.visibilityState at 'hidden'
-// with no further visibilitychange event; honor the terminal occlusion-staleness
-// latch so a window the user is actually looking at is never treated as hidden —
-// otherwise the emulator freezes on a black frame with no recovery (same bug class
-// as the 78MB terminal drop that motivated the latch).
-function getWindowVisibleSnapshot(): boolean {
-  return isWindowVisible() || isDocumentVisibilityProvenStale()
-}
-
-function subscribeWindowVisible(onChange: () => void): () => void {
-  const handler = (): void => onChange()
-  document.addEventListener('visibilitychange', handler)
-  // Why: the stale latch flips visibility to proven-visible without emitting a
-  // visibilitychange, so recompute when it fires too.
-  const unregister = registerStaleDocumentVisibilityRecovery(handler)
-  return () => {
-    document.removeEventListener('visibilitychange', handler)
-    unregister()
-  }
-}
-
-// Why: parking is delayed so a quick Cmd+Tab / app-switch round-trip does not tear
-// down and renegotiate the device stream (MJPEG reconnect or scrcpy H.264 keyframe),
-// which is heavier than a terminal resync and flashes the "Connecting…" UI. Re-showing
-// restores immediately.
-export const EMULATOR_STREAM_PARK_DELAY_MS = 500
-
-/**
- * Reactive "is this window visible enough to keep the emulator device stream
- * running" signal. Returns true while the window is visible (or occlusion state is
- * proven stale) and defers the visible→hidden transition by `parkDelayMs`.
- */
-export function useEmulatorStreamWindowVisible(
-  parkDelayMs = EMULATOR_STREAM_PARK_DELAY_MS
-): boolean {
-  const rawVisible = useSyncExternalStore(
-    subscribeWindowVisible,
-    getWindowVisibleSnapshot,
-    getWindowVisibleSnapshot
-  )
-  const [effectiveVisible, setEffectiveVisible] = useState(rawVisible)
-  useEffect(() => {
-    if (rawVisible) {
-      // Restore immediately so returning to the window resumes without delay.
-      setEffectiveVisible(true)
-      return
-    }
-    const timer = window.setTimeout(() => setEffectiveVisible(false), parkDelayMs)
-    return () => window.clearTimeout(timer)
-  }, [rawVisible, parkDelayMs])
-  return effectiveVisible
-}
+export {
+  WINDOW_STREAM_PARK_DELAY_MS as EMULATOR_STREAM_PARK_DELAY_MS,
+  useWindowStreamVisible as useEmulatorStreamWindowVisible
+} from '@/hooks/use-window-stream-visibility'
diff --git a/src/renderer/src/components/feature-tips/CliSkillSetupTerminal.test.tsx b/src/renderer/src/components/feature-tips/CliSkillSetupTerminal.test.tsx
new file mode 100644
index 00000000000..ebb2481d485
--- /dev/null
+++ b/src/renderer/src/components/feature-tips/CliSkillSetupTerminal.test.tsx
@@ -0,0 +1,62 @@
+// @vitest-environment happy-dom
+
+import { cleanup, render } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { TooltipProvider } from '@/components/ui/tooltip'
+import { CliSkillSetupTerminal } from './CliSkillSetupTerminal'
+
+const mocks = vi.hoisted(() => ({
+  runtime: {
+    agentRuntime: { runtime: 'wsl' as const, wslDistro: 'Missing', label: 'WSL Missing' },
+    installDisabledReason: 'The selected WSL distro is unavailable.',
+    terminalShellOverride: 'powershell.exe'
+  },
+  terminalCommand: ''
+}))
+
+vi.mock('@/hooks/useActiveProjectSkillRuntime', () => ({
+  useActiveProjectSkillRuntime: () => mocks.runtime
+}))
+
+vi.mock('@/components/onboarding/OnboardingInlineCommandTerminal', () => ({
+  OnboardingInlineCommandTerminal: ({
+    command,
+    prepareCommandForShell,
+    shellOverride
+  }: {
+    command: string
+    prepareCommandForShell?: (command: string, shellOverride?: string) => string
+    shellOverride?: string
+  }) => {
+    mocks.terminalCommand = prepareCommandForShell?.(command, shellOverride) ?? command
+    return null
+  }
+}))
+
+describe('CliSkillSetupTerminal', () => {
+  beforeEach(() => {
+    mocks.terminalCommand = ''
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: {
+        platform: { get: () => ({ platform: 'win32' }) }
+      }
+    })
+  })
+
+  afterEach(() => {
+    cleanup()
+    Reflect.deleteProperty(window, 'api')
+  })
+
+  it('runs the Windows host fallback when the selected WSL runtime needs repair', () => {
+    render(
+      <TooltipProvider>
+        <CliSkillSetupTerminal />
+      </TooltipProvider>
+    )
+
+    expect(mocks.terminalCommand).toMatch(/^cmd\.exe \/d \/s \/c /)
+    expect(mocks.terminalCommand).not.toContain('wsl.exe')
+  })
+})
diff --git a/src/renderer/src/components/feature-tips/CliSkillSetupTerminal.tsx b/src/renderer/src/components/feature-tips/CliSkillSetupTerminal.tsx
index d1e025cbb0d..c9919fe849c 100644
--- a/src/renderer/src/components/feature-tips/CliSkillSetupTerminal.tsx
+++ b/src/renderer/src/components/feature-tips/CliSkillSetupTerminal.tsx
@@ -21,12 +21,11 @@ export function CliSkillSetupTerminal(): React.JSX.Element {
     ORCA_CLI_ORCHESTRATION_SKILL_INSTALL_COMMAND,
     activeSkillRuntime.installDisabledReason ? undefined : activeSkillRuntime.agentRuntime
   )
-  // The copied string stays as built; only what we execute is adapted.
-  const setupTerminalCommand = buildSkillSetupTerminalCommand(
-    skillCommand,
-    activeSkillRuntime.terminalShellOverride
-  )
-
+  const terminalRuntime = activeSkillRuntime.installDisabledReason
+    ? undefined
+    : activeSkillRuntime.agentRuntime
+  const prepareCommandForShell = (command: string, effectiveShell: string | undefined): string =>
+    buildSkillSetupTerminalCommand(command, effectiveShell, terminalRuntime)
   const handleCopySkillCommand = async (): Promise<void> => {
     try {
       await window.api.ui.writeClipboardText(skillCommand)
@@ -78,7 +77,8 @@ export function CliSkillSetupTerminal(): React.JSX.Element {
         </Tooltip>
       </div>
       <OnboardingInlineCommandTerminal
-        command={setupTerminalCommand}
+        command={skillCommand}
+        prepareCommandForShell={prepareCommandForShell}
         title={translate(
           'auto.components.feature.tips.CliSkillSetupTerminal.84e9576dac',
           'Skill setup'
@@ -97,6 +97,7 @@ export function CliSkillSetupTerminal(): React.JSX.Element {
         autoScrollIntoView={false}
         worktreeId="feature-tip-cli-skills-terminal"
         shellOverride={activeSkillRuntime.terminalShellOverride}
+        forceHostRuntime={Boolean(activeSkillRuntime.installDisabledReason)}
       />
     </div>
   )
diff --git a/src/renderer/src/components/feature-wall/BrowserUseSkillSetupCard.tsx b/src/renderer/src/components/feature-wall/BrowserUseSkillSetupCard.tsx
index bac0e6d258f..8edf52ec9a8 100644
--- a/src/renderer/src/components/feature-wall/BrowserUseSkillSetupCard.tsx
+++ b/src/renderer/src/components/feature-wall/BrowserUseSkillSetupCard.tsx
@@ -59,6 +59,7 @@ export function BrowserUseSkillSetupCard(props: {
       terminalAriaLabel="Browser Use skill install terminal"
       terminalWorktreeId="feature-wall-browser-use-skill-terminal"
       terminalShellOverride={activeSkillRuntime.terminalShellOverride}
+      terminalRuntime={activeSkillRuntime.agentRuntime}
       installed={skill.installed}
       loading={skill.loading}
       error={activeSkillRuntime.installDisabledReason ?? skill.error}
diff --git a/src/renderer/src/components/feature-wall/FeatureTourPreview.test.tsx b/src/renderer/src/components/feature-wall/FeatureTourPreview.test.tsx
deleted file mode 100644
index 94295008e13..00000000000
--- a/src/renderer/src/components/feature-wall/FeatureTourPreview.test.tsx
+++ /dev/null
@@ -1,28 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { renderToStaticMarkup } from 'react-dom/server'
-import { FEATURE_TOUR_PREVIEW_COPY, FeatureTourPreview } from './FeatureTourPreview'
-
-describe('FeatureTourPreview first-run copy', () => {
-  it('teaches that workspaces keep terminal and agent activity together', () => {
-    const workspaceFrame = FEATURE_TOUR_PREVIEW_COPY.find((frame) => frame.id === 1)
-
-    expect(workspaceFrame?.caption).toContain('terminal')
-    expect(workspaceFrame?.caption).toContain('agent activity')
-  })
-
-  it('teaches that opening a workspace returns to its terminal', () => {
-    const terminalFrame = FEATURE_TOUR_PREVIEW_COPY.find((frame) => frame.id === 4)
-
-    expect(terminalFrame?.caption).toContain('Open any workspace')
-    expect(terminalFrame?.caption).toContain('return to its terminal')
-  })
-
-  it('renders the cycling captions into the first-run preview', () => {
-    const html = renderToStaticMarkup(<FeatureTourPreview />)
-
-    expect(html).toContain(
-      'Each workspace keeps its branch, terminal, and agent activity together.'
-    )
-    expect(html).toContain('Open any workspace to return to its terminal')
-  })
-})
diff --git a/src/renderer/src/components/feature-wall/FeatureTourPreview.tsx b/src/renderer/src/components/feature-wall/FeatureTourPreview.tsx
deleted file mode 100644
index c92b6c4d237..00000000000
--- a/src/renderer/src/components/feature-wall/FeatureTourPreview.tsx
+++ /dev/null
@@ -1,341 +0,0 @@
-import type { JSX } from 'react'
-import { cn } from '@/lib/utils'
-import { ClaudeIcon, OpenCodeGoIcon } from '../status-bar/icons'
-import {
-  CodexInlineIcon,
-  CursorIcon,
-  MailGlyph,
-  WorkingSpinner
-} from './feature-tour-preview-glyphs'
-import {
-  FEATURE_TOUR_ORCHESTRATION_CHILDREN,
-  FEATURE_TOUR_PREVIEW_COPY
-} from './feature-tour-preview-copy'
-import { FeatureTourWorkspaceCard } from './FeatureTourWorkspaceCard'
-import { FeatureTourTerminalFrame } from './FeatureTourTerminalFrame'
-import { translate } from '@/i18n/i18n'
-
-export { FEATURE_TOUR_PREVIEW_COPY } from './feature-tour-preview-copy'
-export type { FeatureTourPreviewFrameCopy } from './feature-tour-preview-copy'
-
-function WorkspaceFrame(): JSX.Element {
-  return (
-    <div className="absolute inset-0 flex flex-col gap-5 bg-card px-4 py-4">
-      <div className="text-[14.5px] font-semibold uppercase tracking-[0.07em] leading-none text-muted-foreground">
-        {translate(
-          'auto.components.feature.wall.FeatureTourPreview.56a0271428',
-          'Isolated workspaces'
-        )}
-      </div>
-      {/* Why: 3 cards in a row tells the "ship several at once" story by
-          composition; the wide preview aspect (~4.9:1) makes a vertical stack
-          read as wasted space. The grid auto-sizes (no flex-1) so the cards
-          don't stretch to the container's bottom edge — keeps headroom under
-          the dot indicators. */}
-      <div className="grid grid-cols-3 gap-3 px-4">
-        <FeatureTourWorkspaceCard
-          status="working"
-          title={translate(
-            'auto.components.feature.wall.FeatureTourPreview.3c4adfd821',
-            'fix login race condition'
-          )}
-          agents={[
-            { kind: 'claude', barWidth: '60%', state: 'working' },
-            { kind: 'codex', barWidth: '52%', state: 'working' }
-          ]}
-        />
-        <FeatureTourWorkspaceCard
-          status="done"
-          title={translate(
-            'auto.components.feature.wall.FeatureTourPreview.9c812e0d7c',
-            'speed up CI pipeline'
-          )}
-          agents={[{ kind: 'opencode-go', barWidth: '70%', state: 'done' }]}
-        />
-        <FeatureTourWorkspaceCard
-          status="working"
-          title={translate(
-            'auto.components.feature.wall.FeatureTourPreview.e38112b289',
-            'refactor billing webhook'
-          )}
-          agents={[{ kind: 'claude', barWidth: '38%', state: 'working' }]}
-        />
-      </div>
-    </div>
-  )
-}
-
-function OrchestrationFrame(): JSX.Element {
-  // Why: a horizontal fan (root → 3 children L→R) reads naturally as
-  // "fans out and ships parallel PRs" at the wide aspect; the previous
-  // top-down tree wasted the horizontal space. SVG paths are sized to a
-  // 600×130 viewBox and stretched non-uniformly, so the dashed lines flex
-  // with the container while the absolutely-positioned cards stay aligned
-  // to viewport-relative anchors (root left, children right column).
-  return (
-    <div className="absolute inset-0 flex flex-col gap-5 bg-card px-4 py-4">
-      <div className="text-[14.5px] font-semibold uppercase tracking-[0.07em] leading-none text-muted-foreground">
-        {translate(
-          'auto.components.feature.wall.FeatureTourPreview.e44269e97d',
-          'Agent orchestration'
-        )}
-      </div>
-      <div className="relative w-full flex-1">
-        {/* Why: viewBox is percent-units (100×100, preserveAspectRatio="none")
-            so endpoints anchor to the same percentage anchors as the cards
-            and the bubbles — root right edge at 34%, child left edge at 64%,
-            child Y centers at 18%/50%/82%. Explicit width/height attrs are
-            required because an SVG with a 1:1 viewBox and only inset-0
-            otherwise picks its intrinsic 1:1 aspect for height. */}
-        <svg
-          className="pointer-events-none absolute inset-0 text-foreground/30"
-          viewBox="0 0 100 100"
-          preserveAspectRatio="none"
-          width="100%"
-          height="100%"
-          aria-hidden
-        >
-          {/* Why: vectorEffect is NOT inheritable in SVG, so the
-              non-scaling-stroke attribute must live on each path. Hoisting
-              it onto <g> let preserveAspectRatio="none" stretch the dashes
-              into trapezoids on the diagonal connectors. */}
-          <path
-            d="M 34 50 C 49 50, 49 18, 64 18"
-            fill="none"
-            stroke="currentColor"
-            strokeWidth="1"
-            strokeDasharray="2 3"
-            vectorEffect="non-scaling-stroke"
-          />
-          <path
-            d="M 34 50 L 64 50"
-            fill="none"
-            stroke="currentColor"
-            strokeWidth="1"
-            strokeDasharray="2 3"
-            vectorEffect="non-scaling-stroke"
-          />
-          <path
-            d="M 34 50 C 49 50, 49 82, 64 82"
-            fill="none"
-            stroke="currentColor"
-            strokeWidth="1"
-            strokeDasharray="2 3"
-            vectorEffect="non-scaling-stroke"
-          />
-        </svg>
-
-        {/* Why: parent matches WorkspaceCard composition — spinner + title row,
-            then a Claude agent row underneath — so the user reads it as "a
-            workspace running Claude as the orchestrator," consistent with how
-            workspaces look elsewhere in the app. */}
-        <div className="absolute left-0 top-1/2 flex w-[34%] -translate-y-1/2 flex-col rounded-md border border-border bg-background px-3 py-2">
-          <div className="flex items-center gap-2">
-            <WorkingSpinner />
-            <span className="truncate text-[15px] font-medium leading-none text-foreground">
-              {translate(
-                'auto.components.feature.wall.FeatureTourPreview.cebc7769cd',
-                'redesign auth flow'
-              )}
-            </span>
-          </div>
-          <div className="mt-2 flex items-center gap-1.5 pl-3.5">
-            <WorkingSpinner size="xs" />
-            <ClaudeIcon size={13} />
-            <span className="truncate text-[12.5px] leading-none text-muted-foreground">
-              {translate(
-                'auto.components.feature.wall.FeatureTourPreview.5171768676',
-                'orchestrating 3 agents'
-              )}
-            </span>
-          </div>
-        </div>
-
-        {/* Why: children mirror the parent's WorkspaceCard composition so the
-            fan reads as "coordinator workspace dispatches to 3 child
-            workspaces, each running its own agent." */}
-        {FEATURE_TOUR_ORCHESTRATION_CHILDREN.map(({ key, position, label, agent }) => (
-          <div
-            key={key}
-            className={cn(
-              'feature-tour-orch-child absolute right-0 flex w-[36%] flex-col rounded-md border border-border bg-background px-3 py-2',
-              key,
-              position
-            )}
-          >
-            <div className="flex items-center gap-2">
-              <WorkingSpinner />
-              <span className="truncate font-mono text-[14px] font-medium leading-none text-foreground">
-                {label}
-              </span>
-            </div>
-            <div className="mt-2 flex items-center gap-1.5 pl-3.5">
-              <WorkingSpinner size="xs" />
-              {agent === 'claude' ? (
-                <ClaudeIcon size={12} />
-              ) : agent === 'codex' ? (
-                <CodexInlineIcon />
-              ) : (
-                <OpenCodeGoIcon size={12} />
-              )}
-              <span className="h-2 flex-1 rounded-full bg-foreground/15" />
-            </div>
-          </div>
-        ))}
-
-        {FEATURE_TOUR_ORCHESTRATION_CHILDREN.map(({ key }) => (
-          <div key={`bubble-${key}`} className={cn('feature-tour-orch-bubble', key)}>
-            <MailGlyph />
-          </div>
-        ))}
-      </div>
-    </div>
-  )
-}
-
-function TasksFrame(): JSX.Element {
-  // Why: a left→right pipeline reads as "pick from backlog → workspace
-  // appears" in one glance. The wide aspect lets the backlog and the
-  // resulting workspace card sit side-by-side instead of stacked, which
-  // makes the cause/effect visible in the composition itself.
-  return (
-    <div className="absolute inset-0 flex flex-col gap-5 bg-card px-4 py-4">
-      <div className="text-[14.5px] font-semibold uppercase tracking-[0.07em] leading-none text-muted-foreground">
-        {translate(
-          'auto.components.feature.wall.FeatureTourPreview.bee6b4088d',
-          'GitHub & Linear tasks'
-        )}
-      </div>
-      <div className="relative grid flex-1 grid-cols-[minmax(0,1fr)_minmax(0,1fr)] items-center gap-4 px-4">
-        <div className="flex flex-col gap-2">
-          <div className="flex h-9 items-center gap-2.5 rounded-md border border-border bg-background px-3">
-            <span className="inline-flex h-5 items-center justify-center rounded-[3px] border border-border bg-muted px-1.5 font-mono text-[13px] leading-none text-muted-foreground">
-              {translate('auto.components.feature.wall.FeatureTourPreview.0688842445', 'GH #1799')}
-            </span>
-            {/* Why: surrounding rows show only the issue number + a skeleton
-                so the user's eye is drawn to the row that has real text — the
-                one the cursor clicks on. */}
-            <span className="h-2 w-[60%] rounded-full bg-foreground/12" />
-          </div>
-          <div className="feature-tour-tasks-row relative flex h-9 items-center gap-2.5 rounded-md border border-border bg-background px-3">
-            <span className="inline-flex h-5 items-center justify-center rounded-[3px] border border-border bg-muted px-1.5 font-mono text-[13px] leading-none text-muted-foreground">
-              {translate('auto.components.feature.wall.FeatureTourPreview.fc0cc0b267', 'GH #1842')}
-            </span>
-            <span className="truncate text-[15px] font-medium leading-none text-foreground">
-              {translate(
-                'auto.components.feature.wall.FeatureTourPreview.c1f28c03b2',
-                'Worktree picker truncates'
-              )}
-            </span>
-            <span className="feature-tour-tasks-pill relative ml-auto flex h-6 items-center justify-center overflow-hidden rounded-full border border-emerald-500/30 bg-emerald-500/15">
-              <span className="feature-tour-tasks-pill-label flex items-center gap-1 whitespace-nowrap pl-3 pr-2.5 text-[13px] font-semibold leading-none tracking-[0.01em] text-primary-foreground">
-                {translate('auto.components.feature.wall.FeatureTourPreview.40bbd92ef4', 'Start')}
-                <svg
-                  width="11"
-                  height="11"
-                  viewBox="0 0 16 16"
-                  fill="none"
-                  stroke="currentColor"
-                  strokeWidth="2"
-                  strokeLinecap="round"
-                  strokeLinejoin="round"
-                  aria-hidden
-                >
-                  <path d="M3 8h10" />
-                  <path d="M9 4l4 4-4 4" />
-                </svg>
-              </span>
-            </span>
-            {/* Why: cursor + ring live inside the row so they anchor to the
-                pill's right-edge ml-auto, instead of using fixed pixel offsets
-                that drift when the preview is resized. */}
-            <span className="feature-tour-tasks-cursor">
-              <CursorIcon />
-            </span>
-            <span className="feature-tour-tasks-click-ring" aria-hidden />
-          </div>
-          <div className="flex h-9 items-center gap-2.5 rounded-md border border-border bg-background px-3">
-            <span className="inline-flex h-5 items-center justify-center rounded-[3px] border border-border bg-muted px-1.5 font-mono text-[13px] leading-none text-muted-foreground">
-              {translate('auto.components.feature.wall.FeatureTourPreview.d54aefe09e', 'LIN-329')}
-            </span>
-            <span className="h-2 w-[45%] rounded-full bg-foreground/12" />
-          </div>
-        </div>
-
-        <div className="feature-tour-tasks-workspace flex flex-col gap-2 rounded-md border border-border bg-background px-4 py-2.5">
-          <div className="flex items-center gap-2.5">
-            <WorkingSpinner />
-            <span className="truncate text-[15.5px] font-medium leading-none text-foreground">
-              {translate(
-                'auto.components.feature.wall.FeatureTourPreview.3822d8d14b',
-                'fix/worktree-picker-truncates'
-              )}
-            </span>
-            <span className="ml-auto inline-flex">
-              <ClaudeIcon size={13} />
-            </span>
-          </div>
-          <div className="flex items-center gap-2.5 pl-4">
-            <WorkingSpinner size="xs" />
-            <ClaudeIcon size={12} />
-            <span className="h-2 w-[55%] rounded-full bg-foreground/15" />
-          </div>
-          <div className="text-[13.5px] leading-none text-muted-foreground">
-            {translate(
-              'auto.components.feature.wall.FeatureTourPreview.2a7cfc82c8',
-              'Linked to GH #1842'
-            )}
-          </div>
-        </div>
-      </div>
-    </div>
-  )
-}
-
-export function FeatureTourPreview(props: { className?: string }): JSX.Element {
-  return (
-    <div
-      className={cn(
-        'relative h-[260px] w-full overflow-hidden rounded-lg border border-border bg-muted/40',
-        props.className
-      )}
-      aria-hidden
-      data-feature-tour-nudge-visual
-    >
-      <div className="feature-tour-frame" data-frame="1">
-        <WorkspaceFrame />
-      </div>
-      <div className="feature-tour-frame" data-frame="2">
-        <OrchestrationFrame />
-      </div>
-      <div className="feature-tour-frame" data-frame="3">
-        <TasksFrame />
-      </div>
-      <div className="feature-tour-frame" data-frame="4">
-        <FeatureTourTerminalFrame />
-      </div>
-      <div className="pointer-events-none absolute inset-x-0 bottom-0 z-[6] h-[66px] border-t border-border/70 bg-card/95">
-        {FEATURE_TOUR_PREVIEW_COPY.map((frame) => (
-          <div
-            key={frame.id}
-            className="feature-tour-copy-slide justify-center px-4 py-2.5 pr-20"
-            data-frame={frame.id}
-          >
-            <div className="truncate text-[13px] font-semibold leading-tight text-foreground">
-              {frame.title}
-            </div>
-            <div className="line-clamp-2 text-[12px] leading-snug text-muted-foreground">
-              {frame.caption}
-            </div>
-          </div>
-        ))}
-      </div>
-      <div className="absolute bottom-3 right-4 z-[7] flex items-center justify-center gap-1.5">
-        <span className="feature-tour-dot" data-frame="1" />
-        <span className="feature-tour-dot" data-frame="2" />
-        <span className="feature-tour-dot" data-frame="3" />
-        <span className="feature-tour-dot" data-frame="4" />
-      </div>
-    </div>
-  )
-}
diff --git a/src/renderer/src/components/feature-wall/FeatureTourTerminalFrame.tsx b/src/renderer/src/components/feature-wall/FeatureTourTerminalFrame.tsx
deleted file mode 100644
index d21314126c2..00000000000
--- a/src/renderer/src/components/feature-wall/FeatureTourTerminalFrame.tsx
+++ /dev/null
@@ -1,122 +0,0 @@
-import type { JSX } from 'react'
-import { ClaudeIcon } from '../status-bar/icons'
-import { translate } from '@/i18n/i18n'
-
-export function FeatureTourTerminalFrame(): JSX.Element {
-  return (
-    <div className="absolute inset-0 flex flex-col gap-5 bg-card px-4 py-4">
-      <div className="text-[14.5px] font-semibold uppercase tracking-[0.07em] leading-none text-muted-foreground">
-        {translate(
-          'auto.components.feature.wall.FeatureTourPreview.1aa8a9a24a',
-          'Splittable terminal'
-        )}
-      </div>
-      <div className="mx-4 flex min-h-0 flex-1 flex-col overflow-hidden rounded-md border border-border bg-background">
-        <div className="flex items-center gap-1.5 border-b border-border bg-muted/40 px-2 py-1">
-          <span className="size-1.5 rounded-full bg-foreground/15" />
-          <span className="size-1.5 rounded-full bg-foreground/15" />
-          <span className="size-1.5 rounded-full bg-foreground/15" />
-          <span className="ml-2 font-mono text-[13.5px] leading-none text-muted-foreground">
-            {translate('auto.components.feature.wall.FeatureTourPreview.04d54d50ec', 'orca · zsh')}
-          </span>
-        </div>
-        <div className="grid flex-1 grid-cols-2 divide-x divide-border font-mono text-[14.5px] leading-[1.4] text-foreground">
-          <div className="min-w-0 p-2">
-            <div className="flex items-center gap-1">
-              <span className="text-emerald-500">$</span>
-              <span className="feature-tour-terminal-line relative inline-block whitespace-nowrap text-foreground">
-                {translate(
-                  'auto.components.feature.wall.FeatureTourPreview.6218a9014d',
-                  'pnpm playwright test'
-                )}
-              </span>
-            </div>
-            <div className="mt-1.5 flex flex-col gap-1">
-              <div
-                className="feature-tour-terminal-output truncate text-muted-foreground"
-                data-line="1"
-              >
-                {translate(
-                  'auto.components.feature.wall.FeatureTourPreview.8279e9d95b',
-                  'Running 12 tests'
-                )}
-              </div>
-              <div
-                className="feature-tour-terminal-output flex min-w-0 items-center gap-1.5"
-                data-line="2"
-              >
-                <span className="font-bold text-emerald-600">✓</span>
-                <span className="truncate">
-                  {translate(
-                    'auto.components.feature.wall.FeatureTourPreview.24fedd5a52',
-                    'login.spec.ts'
-                  )}
-                </span>
-              </div>
-              <div
-                className="feature-tour-terminal-output flex min-w-0 items-center gap-1.5"
-                data-line="3"
-              >
-                <span className="inline-block size-2 animate-spin rounded-full border-[1.5px] border-foreground/20 border-t-foreground" />
-                <span className="truncate">
-                  {translate(
-                    'auto.components.feature.wall.FeatureTourPreview.6ed43cb0e0',
-                    'dashboard.spec.ts'
-                  )}
-                </span>
-              </div>
-            </div>
-          </div>
-          <div className="min-w-0 p-2">
-            <div className="flex items-center gap-1">
-              <span className="text-emerald-500">$</span>
-              <span className="text-foreground">
-                {translate('auto.components.feature.wall.FeatureTourPreview.771d8881c2', 'claude')}
-              </span>
-            </div>
-            <div className="mt-1.5 flex flex-col gap-1">
-              <div
-                className="feature-tour-terminal-output flex min-w-0 items-center gap-1.5"
-                data-line="1"
-              >
-                <ClaudeIcon size={12} />
-                <span className="truncate text-muted-foreground">
-                  {translate(
-                    'auto.components.feature.wall.FeatureTourPreview.952d3ddd9a',
-                    'session started'
-                  )}
-                </span>
-              </div>
-              <div
-                className="feature-tour-terminal-output flex min-w-0 items-center gap-1"
-                data-line="2"
-              >
-                <span className="text-amber-600">
-                  {translate('auto.components.feature.wall.FeatureTourPreview.1170621527', '>')}
-                </span>
-                <span className="truncate">
-                  {translate(
-                    'auto.components.feature.wall.FeatureTourPreview.ef8b164dd1',
-                    'review src/auth'
-                  )}
-                </span>
-              </div>
-              <div
-                className="feature-tour-terminal-output flex min-w-0 items-center gap-1.5"
-                data-line="3"
-              >
-                <span className="inline-block size-2 animate-spin rounded-full border-[1.5px] border-amber-600/20 border-t-amber-600" />
-                <span className="truncate text-muted-foreground">
-                  {translate(
-                    'auto.components.feature.wall.FeatureTourPreview.304ad0dfc1',
-                    'Thinking...'
-                  )}
-                </span>
-              </div>
-            </div>
-          </div>
-        </div>
-      </div>
-    </div>
-  )
-}
diff --git a/src/renderer/src/components/feature-wall/FeatureTourWorkspaceCard.tsx b/src/renderer/src/components/feature-wall/FeatureTourWorkspaceCard.tsx
deleted file mode 100644
index 0004b27ef2c..00000000000
--- a/src/renderer/src/components/feature-wall/FeatureTourWorkspaceCard.tsx
+++ /dev/null
@@ -1,64 +0,0 @@
-import type { JSX } from 'react'
-import { cn } from '@/lib/utils'
-import { ClaudeIcon, OpenCodeGoIcon } from '../status-bar/icons'
-import { CodexInlineIcon, WorkingSpinner } from './feature-tour-preview-glyphs'
-
-export type FeatureTourWorkspaceCardAgent = {
-  kind: 'claude' | 'codex' | 'opencode-go'
-  barWidth: string
-  state: 'working' | 'done'
-}
-
-export function FeatureTourWorkspaceCard({
-  status,
-  title,
-  agents
-}: {
-  status: 'working' | 'done'
-  title: string
-  agents: readonly FeatureTourWorkspaceCardAgent[]
-}): JSX.Element {
-  return (
-    <div
-      className={cn(
-        'flex min-w-0 flex-col rounded-md border bg-background px-3 py-2',
-        status === 'done' ? 'border-border/70' : 'border-border'
-      )}
-    >
-      <div className="flex items-center gap-2">
-        {status === 'working' ? (
-          <WorkingSpinner />
-        ) : (
-          <span className="size-2 rounded-full bg-emerald-500" />
-        )}
-        <span
-          className={cn(
-            'truncate text-[16.5px] leading-none',
-            status === 'done' ? 'text-muted-foreground' : 'font-medium text-foreground'
-          )}
-        >
-          {title}
-        </span>
-      </div>
-      <div className="mt-2 flex flex-col gap-1.5 pl-3.5">
-        {agents.map((agent, idx) => (
-          <div key={idx} className="flex items-center gap-1.5">
-            {agent.state === 'working' ? (
-              <WorkingSpinner size="xs" />
-            ) : (
-              <span className="inline-block size-1.5 rounded-full bg-emerald-500" />
-            )}
-            {agent.kind === 'claude' ? (
-              <ClaudeIcon size={13} />
-            ) : agent.kind === 'codex' ? (
-              <CodexInlineIcon />
-            ) : (
-              <OpenCodeGoIcon size={13} />
-            )}
-            <span className="h-2 rounded-full bg-foreground/15" style={{ width: agent.barWidth }} />
-          </div>
-        ))}
-      </div>
-    </div>
-  )
-}
diff --git a/src/renderer/src/components/feature-wall/FeatureWallBrowserAction.tsx b/src/renderer/src/components/feature-wall/FeatureWallBrowserAction.tsx
index 2e039c2f2ce..b6d185e9092 100644
--- a/src/renderer/src/components/feature-wall/FeatureWallBrowserAction.tsx
+++ b/src/renderer/src/components/feature-wall/FeatureWallBrowserAction.tsx
@@ -16,9 +16,15 @@ import {
   promptForSetupGuideProject,
   useSetupTargetWorktree
 } from './FeatureWallSetupWorkflowActions'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 export function BrowserAction(props: { done: boolean }): React.JSX.Element {
   const targetWorktree = useSetupTargetWorktree()
+  const browserCreationEnabled = useAppStore(
+    (state) =>
+      getClientCreationActionPolicy(state, targetWorktree?.id ?? null)['managed-browser'].state ===
+      'enabled'
+  )
   const openModal = useAppStore((s) => s.openModal)
   const closeModal = useAppStore((s) => s.closeModal)
   const openNewBrowserTabInActiveWorkspace = useAppStore(
@@ -39,7 +45,9 @@ export function BrowserAction(props: { done: boolean }): React.JSX.Element {
       state.activeGroupIdByWorktree[targetWorktree.id] ??
       state.groupsByWorktree[targetWorktree.id]?.[0]?.id
     if (groupId) {
-      void openNewBrowserTabInActiveWorkspace(groupId)
+      void openNewBrowserTabInActiveWorkspace(groupId).catch((error) => {
+        toast.error(error instanceof Error ? error.message : String(error))
+      })
     } else {
       toast.warning(
         translate(
@@ -58,7 +66,7 @@ export function BrowserAction(props: { done: boolean }): React.JSX.Element {
 
   return (
     <div className="flex flex-wrap items-center gap-2.5">
-      {props.done ? null : (
+      {props.done || !browserCreationEnabled ? null : (
         <Button type="button" size="sm" className="w-fit gap-2" onClick={handleTryIt}>
           <ArrowUpRight className="size-3.5" />
           {translate(
diff --git a/src/renderer/src/components/feature-wall/WorkbenchAnimatedVisual.tsx b/src/renderer/src/components/feature-wall/WorkbenchAnimatedVisual.tsx
index a5c02d28afc..600fb99b51e 100644
--- a/src/renderer/src/components/feature-wall/WorkbenchAnimatedVisual.tsx
+++ b/src/renderer/src/components/feature-wall/WorkbenchAnimatedVisual.tsx
@@ -3,10 +3,9 @@
 import { useEffect, useLayoutEffect, useRef, useState } from 'react'
 import type { JSX } from 'react'
 import { cn } from '@/lib/utils'
-import { ClaudeIcon } from '../status-bar/icons'
+import { ClaudeIcon, OpenAIIcon } from '../status-bar/icons'
 import { useShortcutLabel } from '@/hooks/useShortcutLabel'
 import { FeatureWallClickRing } from './FeatureWallClickRing'
-import { CodexInlineIcon } from './feature-tour-preview-glyphs'
 import { translate } from '@/i18n/i18n'
 
 // Why: the right-click menu needs the same icons as the real Orca menu so the
@@ -815,8 +814,8 @@ function RightPaneScrollback(props: {
           return (
             <TermLine key={i} muted>
               {props.isCodex ? (
-                <span className="mr-1.5 inline-flex align-[-2px]">
-                  <CodexInlineIcon />
+                <span aria-hidden className="mr-1.5 inline-flex text-foreground align-[-2px]">
+                  <OpenAIIcon />
                 </span>
               ) : (
                 <span className="mr-1.5 text-foreground">●</span>
@@ -873,8 +872,8 @@ function RightPaneScrollback(props: {
           <TermLine key={i}>
             {line.withGlyph ? (
               props.isCodex ? (
-                <span className="mr-1.5 inline-flex align-[-2px]">
-                  <CodexInlineIcon />
+                <span aria-hidden className="mr-1.5 inline-flex text-foreground align-[-2px]">
+                  <OpenAIIcon />
                 </span>
               ) : (
                 <span className="mr-1.5 text-amber-600">●</span>
diff --git a/src/renderer/src/components/feature-wall/feature-tour-preview-copy.ts b/src/renderer/src/components/feature-wall/feature-tour-preview-copy.ts
deleted file mode 100644
index 1aa0dc8abbc..00000000000
--- a/src/renderer/src/components/feature-wall/feature-tour-preview-copy.ts
+++ /dev/null
@@ -1,109 +0,0 @@
-import { translate } from '@/i18n/i18n'
-
-type FrameId = 1 | 2 | 3 | 4
-
-export type FeatureTourPreviewFrameCopy = {
-  id: FrameId
-  title: string
-  caption: string
-}
-
-export const FEATURE_TOUR_PREVIEW_COPY: readonly FeatureTourPreviewFrameCopy[] = [
-  {
-    id: 1,
-    get title() {
-      return translate(
-        'auto.components.feature.wall.FeatureTourPreview.56a0271428',
-        'Isolated workspaces'
-      )
-    },
-    get caption() {
-      return translate(
-        'auto.components.feature.wall.FeatureTourPreview.47f16ecf34',
-        'Ship several things at once. Each workspace keeps its branch, terminal, and agent activity together.'
-      )
-    }
-  },
-  {
-    id: 2,
-    get title() {
-      return translate(
-        'auto.components.feature.wall.FeatureTourPreview.e44269e97d',
-        'Agent orchestration'
-      )
-    },
-    get caption() {
-      return translate(
-        'auto.components.feature.wall.FeatureTourPreview.70aa182266',
-        'Hand off a goal and walk away. A coordinator agent fans out and ships parallel PRs.'
-      )
-    }
-  },
-  {
-    id: 3,
-    get title() {
-      return translate(
-        'auto.components.feature.wall.FeatureTourPreview.ef737dcee1',
-        'GitHub & Linear tasks'
-      )
-    },
-    get caption() {
-      return translate(
-        'auto.components.feature.wall.FeatureTourPreview.f10c14dd9d',
-        'Skip the tab-switching. Pick from your GitHub or Linear backlog and start a workspace in one click.'
-      )
-    }
-  },
-  {
-    id: 4,
-    get title() {
-      return translate(
-        'auto.components.feature.wall.FeatureTourPreview.1aa8a9a24a',
-        'Splittable terminal'
-      )
-    },
-    get caption() {
-      return translate(
-        'auto.components.feature.wall.FeatureTourPreview.5d6ee181b6',
-        'Open any workspace to return to its terminal, then split panes for tests, logs, and agents.'
-      )
-    }
-  }
-]
-
-export type FeatureTourOrchestrationChildAgent = 'claude' | 'codex' | 'opencode-go'
-
-export const FEATURE_TOUR_ORCHESTRATION_CHILDREN: readonly {
-  key: 'top' | 'mid' | 'bot'
-  position: string
-  label: string
-  agent: FeatureTourOrchestrationChildAgent
-}[] = [
-  // Why: card vertical centers anchor to 18% / 50% / 82% — the same Y
-  // endpoints the dashed SVG paths terminate at — so the connectors land on
-  // each card's center regardless of card height.
-  {
-    key: 'top',
-    position: 'top-[18%] -translate-y-1/2',
-    get label() {
-      return translate('auto.components.feature.wall.FeatureTourPreview.b1f17bcc74', 'PR 1/3')
-    },
-    agent: 'claude'
-  },
-  {
-    key: 'mid',
-    position: 'top-1/2 -translate-y-1/2',
-    get label() {
-      return translate('auto.components.feature.wall.FeatureTourPreview.cfdfd4d6b4', 'PR 2/3')
-    },
-    agent: 'codex'
-  },
-  {
-    key: 'bot',
-    position: 'top-[82%] -translate-y-1/2',
-    get label() {
-      return translate('auto.components.feature.wall.FeatureTourPreview.ec4a73f5e6', 'PR 3/3')
-    },
-    agent: 'opencode-go'
-  }
-]
diff --git a/src/renderer/src/components/feature-wall/feature-tour-preview-glyphs.tsx b/src/renderer/src/components/feature-wall/feature-tour-preview-glyphs.tsx
deleted file mode 100644
index a3fa74f8d1f..00000000000
--- a/src/renderer/src/components/feature-wall/feature-tour-preview-glyphs.tsx
+++ /dev/null
@@ -1,64 +0,0 @@
-import type { JSX } from 'react'
-import { cn } from '@/lib/utils'
-
-export function CodexInlineIcon(): JSX.Element {
-  return (
-    <svg
-      width={14}
-      height={14}
-      viewBox="0 0 24 24"
-      aria-hidden
-      focusable="false"
-      className="text-foreground"
-    >
-      <path
-        fill="currentColor"
-        d="M9.205 8.658v-2.26c0-.19.072-.333.238-.428l4.543-2.616c.619-.357 1.356-.523 2.117-.523 2.854 0 4.662 2.212 4.662 4.566 0 .167 0 .357-.024.547l-4.71-2.759a.797.797 0 00-.856 0l-5.97 3.473zm10.609 8.8V12.06c0-.333-.143-.57-.429-.737l-5.97-3.473 1.95-1.118a.433.433 0 01.476 0l4.543 2.617c1.309.76 2.189 2.378 2.189 3.948 0 1.808-1.07 3.473-2.76 4.163zM7.802 12.703l-1.95-1.142c-.167-.095-.239-.238-.239-.428V5.899c0-2.545 1.95-4.472 4.591-4.472 1 0 1.927.333 2.712.928L8.23 5.067c-.285.166-.428.404-.428.737v6.898zM12 15.128l-2.795-1.57v-3.33L12 8.658l2.795 1.57v3.33L12 15.128zm1.796 7.23c-1 0-1.927-.332-2.712-.927l4.686-2.712c.285-.166.428-.404.428-.737v-6.898l1.974 1.142c.167.095.238.238.238.428v5.233c0 2.545-1.974 4.472-4.614 4.472zm-5.637-5.303l-4.544-2.617c-1.308-.761-2.188-2.378-2.188-3.948A4.482 4.482 0 014.21 6.327v5.423c0 .333.143.571.428.738l5.947 3.449-1.95 1.118a.432.432 0 01-.476 0zm-.262 3.9c-2.688 0-4.662-2.021-4.662-4.519 0-.19.024-.38.047-.57l4.686 2.71c.286.167.571.167.856 0l5.97-3.448v2.26c0 .19-.07.333-.237.428l-4.543 2.616c-.619.357-1.356.523-2.117.523zm5.899 2.83a5.947 5.947 0 005.827-4.756C22.287 18.339 24 15.84 24 13.296c0-1.665-.713-3.282-1.998-4.448.119-.5.19-.999.19-1.498 0-3.401-2.759-5.947-5.946-5.947-.642 0-1.26.095-1.88.31A5.962 5.962 0 0010.205 0a5.947 5.947 0 00-5.827 4.757C1.713 5.447 0 7.945 0 10.49c0 1.666.713 3.283 1.998 4.448-.119.5-.19 1-.19 1.499 0 3.401 2.759 5.946 5.946 5.946.642 0 1.26-.095 1.88-.309a5.96 5.96 0 004.162 1.713z"
-      />
-    </svg>
-  )
-}
-
-export function WorkingSpinner({
-  size = 'sm',
-  reducedMotion = false
-}: {
-  size?: 'sm' | 'xs'
-  reducedMotion?: boolean
-}): JSX.Element {
-  // Why: matches AgentStateDot's working indicator so the preview teaches
-  // the same state language users see in the real app.
-  const ring = size === 'xs' ? 'size-1.5 border' : 'size-2 border-2'
-  return (
-    <span
-      className={cn(
-        'inline-block shrink-0 rounded-full border-yellow-500',
-        reducedMotion ? 'border-t-yellow-500' : 'animate-spin border-t-transparent',
-        ring
-      )}
-      aria-hidden
-    />
-  )
-}
-
-export function CursorIcon(): JSX.Element {
-  return (
-    <svg viewBox="0 0 16 16" aria-hidden focusable="false">
-      <path
-        d="M2 1.5 L2 12 L5 9 L7.2 14.5 L9.5 13.6 L7.3 8 L11.5 8 Z"
-        className="fill-background stroke-foreground"
-        strokeWidth={1}
-        strokeLinejoin="round"
-      />
-    </svg>
-  )
-}
-
-export function MailGlyph(): JSX.Element {
-  return (
-    <svg viewBox="0 0 24 24" aria-hidden width="9" height="9" fill="none" strokeWidth={1.6}>
-      <rect x="3" y="5" width="18" height="14" rx="2" stroke="currentColor" />
-      <path d="M3 7l9 6 9-6" stroke="currentColor" />
-    </svg>
-  )
-}
diff --git a/src/renderer/src/components/floating-terminal/FloatingTerminalOrchestrationDialog.tsx b/src/renderer/src/components/floating-terminal/FloatingTerminalOrchestrationDialog.tsx
index 06f87ac3844..bc0540cda14 100644
--- a/src/renderer/src/components/floating-terminal/FloatingTerminalOrchestrationDialog.tsx
+++ b/src/renderer/src/components/floating-terminal/FloatingTerminalOrchestrationDialog.tsx
@@ -146,6 +146,7 @@ export function FloatingTerminalOrchestrationDialog({
           terminalAriaLabel="Orchestration skill install terminal"
           terminalWorktreeId="floating-terminal-orchestration-skill-terminal"
           terminalShellOverride={activeSkillRuntime.terminalShellOverride}
+          terminalRuntime={activeSkillRuntime.agentRuntime}
           installed={orchestrationSkillDetected}
           loading={orchestrationSkillLoading}
           error={activeSkillRuntime.installDisabledReason ?? orchestrationSkillError}
diff --git a/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.test.tsx b/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.test.tsx
index 9fc9e12680e..43e74374d9d 100644
--- a/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.test.tsx
+++ b/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.test.tsx
@@ -2518,6 +2518,16 @@ describe('FloatingTerminalPanel close behavior', () => {
 
     expect(editorPanel.props.markdownAnnotationsEnabled).toBe(false)
     expect(editorPanel.props.activeFileId).toBe('notes')
+    expect(editorPanel.props.isVisible).toBe(true)
+  })
+
+  it('marks the retained floating editor hidden when the panel is closed', async () => {
+    setFloatingEditorTabs([makeFile({ id: 'notes' })])
+
+    const element = await renderPanel(false)
+    const editorPanel = findByProp(element, 'activeFileId')
+
+    expect(editorPanel.props.isVisible).toBe(false)
   })
 
   it('keeps the panel open when the explicit close action removes the last tab', async () => {
diff --git a/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tsx b/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tsx
index 94c0a23160e..2f60cb89902 100644
--- a/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tsx
+++ b/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tsx
@@ -116,6 +116,7 @@ import { shouldRestoreMaximizedPanelBounds } from './floating-terminal-panel-res
 import { translate } from '@/i18n/i18n'
 import { consumeFloatingTerminalOpenMaximizedIntent } from '@/lib/floating-terminal'
 import { selectFloatingTerminalPanelInputs } from './floating-terminal-panel-inputs'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 const LOCAL_RUNTIME_SETTINGS = { activeRuntimeEnvironmentId: null } as const
 const NO_ACTIVITY_TERMINAL_PORTALS = []
 
@@ -271,6 +272,11 @@ export function FloatingTerminalPanel({
   const newMarkdownShortcut = useShortcutKeyDetails('tab.newMarkdown')
   const openMarkdownShortcut = useShortcutKeyDetails('tab.openMarkdown')
   const closeShortcut = useShortcutKeyDetails('tab.close')
+  const managedBrowserCreationEnabled = useAppStore(
+    (state) =>
+      getClientCreationActionPolicy(state, FLOATING_TERMINAL_WORKTREE_ID)['managed-browser']
+        .state === 'enabled'
+  )
 
   const [cwd, setCwd] = useState<string | null>(null)
   const [markdownCwd, setMarkdownCwd] = useState<string | null>(null)
@@ -389,6 +395,7 @@ export function FloatingTerminalPanel({
     terminalTabs: tabs,
     assignments: terminalAssignments,
     isWorktreeActive: open,
+    activeTerminalTabId: activeTerminalId,
     coldParkTerminalPanes: false,
     shouldMeasureHiddenWorktree: false,
     activityTerminalPortals: NO_ACTIVITY_TERMINAL_PORTALS
@@ -794,6 +801,14 @@ export function FloatingTerminalPanel({
   )
 
   const createFloatingBrowserTab = useCallback(() => {
+    const availability = getClientCreationActionPolicy(
+      useAppStore.getState(),
+      FLOATING_TERMINAL_WORKTREE_ID
+    )['managed-browser']
+    if (availability.state !== 'enabled') {
+      toast.error(availability.reason)
+      return
+    }
     const url = browserDefaultUrl ?? 'about:blank'
     createBrowserTab(FLOATING_TERMINAL_WORKTREE_ID, url, {
       title: translate(
@@ -1284,6 +1299,14 @@ export function FloatingTerminalPanel({
         if (resolution.action === 'tab.newTerminal') {
           createFloatingTerminalTab()
         } else if (resolution.action === 'tab.newBrowser') {
+          const availability = getClientCreationActionPolicy(
+            useAppStore.getState(),
+            FLOATING_TERMINAL_WORKTREE_ID
+          )['managed-browser']
+          if (availability.state !== 'enabled') {
+            toast.error(availability.reason)
+            return 'handled'
+          }
           createFloatingBrowserTab()
         } else if (resolution.action === 'tab.newMarkdown') {
           createFloatingMarkdownTab()
@@ -1947,6 +1970,7 @@ export function FloatingTerminalPanel({
                 <EditorPanel
                   activeFileId={activeEditorFile.id}
                   activeViewStateId={activeEditorUnifiedId}
+                  isVisible={open}
                   markdownAnnotationsEnabled={false}
                 />
               </Suspense>
@@ -1958,6 +1982,7 @@ export function FloatingTerminalPanel({
               onNewMarkdown={createFloatingMarkdownTab}
               onOpenMarkdown={openFloatingMarkdownTab}
               onNewBrowser={createFloatingBrowserTab}
+              showNewBrowser={managedBrowserCreationEnabled}
               onClose={() => onOpenChange(false)}
               onFocusPanel={focusPanelForShortcuts}
               newTerminalShortcut={newTerminalShortcut}
@@ -2100,6 +2125,7 @@ function FloatingTerminalEmptyState({
   onNewMarkdown,
   onOpenMarkdown,
   onNewBrowser,
+  showNewBrowser,
   onClose,
   onFocusPanel,
   newTerminalShortcut,
@@ -2112,6 +2138,7 @@ function FloatingTerminalEmptyState({
   onNewMarkdown: () => void
   onOpenMarkdown: () => void
   onNewBrowser: () => void
+  showNewBrowser: boolean
   onClose: () => void
   onFocusPanel: () => void
   newTerminalShortcut: ShortcutKeyComboDetails
@@ -2175,21 +2202,23 @@ function FloatingTerminalEmptyState({
           </span>
           <FloatingEmptyStateShortcut shortcut={openMarkdownShortcut} />
         </Button>
-        <Button
-          type="button"
-          variant="ghost"
-          className="grid h-8 w-full grid-cols-[1rem_minmax(0,1fr)_auto] items-center gap-2.5 rounded-md px-3 py-0 text-sm font-normal text-foreground hover:bg-muted/40 hover:text-foreground"
-          onClick={onNewBrowser}
-        >
-          <Globe className="size-3.5 opacity-90" />
-          <span className="truncate text-left leading-none">
-            {translate(
-              'auto.components.floating.terminal.FloatingTerminalPanel.8b07759314',
-              'New Browser'
-            )}
-          </span>
-          <FloatingEmptyStateShortcut shortcut={newBrowserShortcut} />
-        </Button>
+        {showNewBrowser ? (
+          <Button
+            type="button"
+            variant="ghost"
+            className="grid h-8 w-full grid-cols-[1rem_minmax(0,1fr)_auto] items-center gap-2.5 rounded-md px-3 py-0 text-sm font-normal text-foreground hover:bg-muted/40 hover:text-foreground"
+            onClick={onNewBrowser}
+          >
+            <Globe className="size-3.5 opacity-90" />
+            <span className="truncate text-left leading-none">
+              {translate(
+                'auto.components.floating.terminal.FloatingTerminalPanel.8b07759314',
+                'New Browser'
+              )}
+            </span>
+            <FloatingEmptyStateShortcut shortcut={newBrowserShortcut} />
+          </Button>
+        ) : null}
         <Button
           type="button"
           variant="ghost"
diff --git a/src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.test.tsx b/src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.test.tsx
index a4be125a2f9..189a77c9b58 100644
--- a/src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.test.tsx
+++ b/src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.test.tsx
@@ -185,6 +185,13 @@ afterEach(() => {
 
 describe('FloatingTerminalWindowControls default-agent launch', () => {
   it('activates the new agent tab so the floating panel selects and focuses it', () => {
+    ;(
+      storeBox.state as {
+        settings: Record<string, unknown>
+      }
+    ).settings.nativeChatSessionOptions = {
+      claude: { model: 'opus', valuesByModel: { opus: { effort: 'high' } } }
+    }
     const element = FloatingTerminalWindowControls({
       maximized: false,
       onToggleMaximized: vi.fn(),
@@ -194,6 +201,8 @@ describe('FloatingTerminalWindowControls default-agent launch', () => {
     const launch = findOnClickByAriaLabel(element, 'Open Claude in floating workspace')
     launch()
 
+    expect(mocks.buildAgentStartupPlan.mock.calls[0]?.[0]).not.toHaveProperty('sessionOptions')
+
     expect(mocks.createTab).toHaveBeenCalledWith(
       FLOATING_TERMINAL_WORKTREE_ID,
       undefined,
diff --git a/src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.tsx b/src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.tsx
index b97290541bb..b7150aa7cef 100644
--- a/src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.tsx
+++ b/src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.tsx
@@ -20,8 +20,6 @@ import {
 } from '../../../../shared/tui-agent-launch-defaults'
 import { translate } from '@/i18n/i18n'
 import { useOptionalShortcutLabel } from '@/hooks/useShortcutLabel'
-import { resolveNativeChatLaunchSessionOptions } from '@/components/native-chat/native-chat-session-option-enrichment'
-import { seedNativeChatAppliedSessionOptions } from '@/components/native-chat/native-chat-session-option-cache'
 
 type FloatingTerminalWindowControlsProps = {
   maximized: boolean
@@ -80,10 +78,6 @@ export function FloatingTerminalWindowControls({
       cmdOverrides: state.settings?.agentCmdOverrides ?? {},
       agentArgs: resolveTuiAgentLaunchArgs(defaultAgent, state.settings?.agentDefaultArgs),
       agentEnv: resolveTuiAgentLaunchEnv(defaultAgent, state.settings?.agentDefaultEnv),
-      sessionOptions: resolveNativeChatLaunchSessionOptions(
-        state.settings?.nativeChatSessionOptions,
-        defaultAgent
-      ),
       platform: CLIENT_PLATFORM,
       allowEmptyPromptLaunch: true
     })
@@ -98,7 +92,6 @@ export function FloatingTerminalWindowControls({
       return
     }
     const tab = createTab(FLOATING_TERMINAL_WORKTREE_ID, undefined, undefined, { activate: false })
-    seedNativeChatAppliedSessionOptions(tab.id, defaultAgent, startupPlan.sessionOptions)
     state.queueTabStartupCommand(tab.id, {
       command: startupPlan.launchCommand,
       ...(startupPlan.env ? { env: startupPlan.env } : {}),
diff --git a/src/renderer/src/components/floating-terminal/floating-terminal-panel-bounds.ts b/src/renderer/src/components/floating-terminal/floating-terminal-panel-bounds.ts
index aef4c99dfe6..91e97c2de79 100644
--- a/src/renderer/src/components/floating-terminal/floating-terminal-panel-bounds.ts
+++ b/src/renderer/src/components/floating-terminal/floating-terminal-panel-bounds.ts
@@ -60,7 +60,7 @@ function clampValue(value: number, min: number, max: number): number {
 }
 
 function getWindowStorage(): Storage | null {
-  return typeof window !== 'undefined' && typeof window.localStorage !== 'undefined'
+  return typeof window !== 'undefined' && window.localStorage !== undefined
     ? window.localStorage
     : null
 }
diff --git a/src/renderer/src/components/floating-terminal/floating-terminal-trigger-position.ts b/src/renderer/src/components/floating-terminal/floating-terminal-trigger-position.ts
index effee92d52a..fb127b23778 100644
--- a/src/renderer/src/components/floating-terminal/floating-terminal-trigger-position.ts
+++ b/src/renderer/src/components/floating-terminal/floating-terminal-trigger-position.ts
@@ -48,7 +48,7 @@ function isAnchorY(value: unknown): value is FloatingTerminalAnchorY {
 }
 
 function getWindowStorage(): Storage | null {
-  return typeof window !== 'undefined' && typeof window.localStorage !== 'undefined'
+  return typeof window !== 'undefined' && window.localStorage !== undefined
     ? window.localStorage
     : null
 }
diff --git a/src/renderer/src/components/github-checks-tab-state.test.ts b/src/renderer/src/components/github-checks-tab-state.test.ts
index e4e9a63bae9..66a0c06b722 100644
--- a/src/renderer/src/components/github-checks-tab-state.test.ts
+++ b/src/renderer/src/components/github-checks-tab-state.test.ts
@@ -1,8 +1,10 @@
 import { describe, expect, it } from 'vitest'
-import type { PRCheckDetail } from '../../../shared/types'
+import type { PRCheckDetail, PRCheckRunDetails } from '../../../shared/types'
 import {
+  beginGitHubChecksTabDetails,
   createGitHubChecksTabState,
   resolveGitHubChecksTabState,
+  settleGitHubChecksTabDetails,
   toggleGitHubChecksTabExpandedKey,
   updateGitHubChecksTabDetails,
   updateGitHubChecksTabLocalChecks
@@ -15,14 +17,30 @@ const check = (name: string): PRCheckDetail => ({
   url: null
 })
 
+const checkRunDetails: PRCheckRunDetails = {
+  name: 'unit',
+  status: 'completed',
+  conclusion: 'failure',
+  url: null,
+  detailsUrl: null,
+  startedAt: null,
+  completedAt: null,
+  title: 'Unit tests',
+  summary: null,
+  text: null,
+  annotations: [],
+  jobs: []
+}
+
 describe('github checks tab state', () => {
   it('preserves local check state while the source checks reference is unchanged', () => {
     const sourceChecks = [check('unit')]
-    const state = updateGitHubChecksTabLocalChecks(createGitHubChecksTabState(sourceChecks), [
-      check('refreshed')
-    ])
+    const state = updateGitHubChecksTabLocalChecks(
+      createGitHubChecksTabState(sourceChecks, 'repo-a'),
+      [check('refreshed')]
+    )
 
-    expect(resolveGitHubChecksTabState(state, sourceChecks)).toBe(state)
+    expect(resolveGitHubChecksTabState(state, sourceChecks, 'repo-a')).toBe(state)
   })
 
   it('resets local checks and expanded details when source checks change', () => {
@@ -30,14 +48,18 @@ describe('github checks tab state', () => {
     const nextSource = [check('next')]
     const stateWithDetails = updateGitHubChecksTabDetails(
       toggleGitHubChecksTabExpandedKey(
-        updateGitHubChecksTabLocalChecks(createGitHubChecksTabState(oldSource), [check('local')]),
+        updateGitHubChecksTabLocalChecks(createGitHubChecksTabState(oldSource, 'repo-a'), [
+          check('local')
+        ]),
         'unit'
       ),
       'unit',
       { loading: true, details: null, error: null }
     )
 
-    expect(resolveGitHubChecksTabState(stateWithDetails, nextSource)).toEqual({
+    expect(resolveGitHubChecksTabState(stateWithDetails, nextSource, 'repo-a')).toEqual({
+      contextKey: 'repo-a',
+      contextOwner: stateWithDetails.contextOwner,
       sourceChecks: nextSource,
       localChecks: null,
       expandedCheckKey: null,
@@ -47,11 +69,15 @@ describe('github checks tab state', () => {
 
   it('toggles expanded check keys without discarding loaded details', () => {
     const sourceChecks = [check('unit')]
-    const state = updateGitHubChecksTabDetails(createGitHubChecksTabState(sourceChecks), 'unit', {
-      loading: false,
-      details: null,
-      error: 'No details'
-    })
+    const state = updateGitHubChecksTabDetails(
+      createGitHubChecksTabState(sourceChecks, 'repo-a'),
+      'unit',
+      {
+        loading: false,
+        details: null,
+        error: 'No details'
+      }
+    )
 
     const expanded = toggleGitHubChecksTabExpandedKey(state, 'unit')
     const collapsed = toggleGitHubChecksTabExpandedKey(expanded, 'unit')
@@ -60,4 +86,142 @@ describe('github checks tab state', () => {
     expect(collapsed.expandedCheckKey).toBeNull()
     expect(collapsed.detailsByCheckKey).toBe(state.detailsByCheckKey)
   })
+
+  it('settles details only for the request that still owns the check key', () => {
+    const sourceChecks = [check('unit')]
+    const loading = beginGitHubChecksTabDetails(
+      createGitHubChecksTabState(sourceChecks, 'repo-a'),
+      'unit',
+      2
+    )
+
+    expect(
+      settleGitHubChecksTabDetails(loading, 'unit', 1, {
+        loading: false,
+        details: null,
+        error: 'stale'
+      })
+    ).toBe(loading)
+    expect(
+      settleGitHubChecksTabDetails(loading, 'unit', 2, {
+        loading: false,
+        details: null,
+        error: 'current'
+      }).detailsByCheckKey.unit
+    ).toEqual({ requestId: 2, loading: false, details: null, error: 'current' })
+  })
+
+  it('gives a retry ownership over an older in-flight request', () => {
+    const sourceChecks = [check('unit')]
+    const first = beginGitHubChecksTabDetails(
+      createGitHubChecksTabState(sourceChecks, 'repo-a'),
+      'unit',
+      1
+    )
+    const retry = beginGitHubChecksTabDetails(first, 'unit', 2)
+
+    expect(retry.detailsByCheckKey.unit).toEqual({
+      requestId: 2,
+      loading: true,
+      details: null,
+      error: null
+    })
+
+    expect(
+      settleGitHubChecksTabDetails(retry, 'unit', 1, {
+        loading: false,
+        details: null,
+        error: 'old failure'
+      })
+    ).toBe(retry)
+    expect(
+      settleGitHubChecksTabDetails(retry, 'unit', 2, {
+        loading: false,
+        details: null,
+        error: 'retry failure'
+      }).detailsByCheckKey.unit
+    ).toEqual({ requestId: 2, loading: false, details: null, error: 'retry failure' })
+  })
+
+  it('keeps a retry error visible while the replacement request is loading', () => {
+    const sourceChecks = [check('unit')]
+    const failed = settleGitHubChecksTabDetails(
+      beginGitHubChecksTabDetails(createGitHubChecksTabState(sourceChecks, 'repo-a'), 'unit', 1),
+      'unit',
+      1,
+      { loading: false, details: null, error: 'first failure' }
+    )
+
+    expect(beginGitHubChecksTabDetails(failed, 'unit', 2).detailsByCheckKey.unit).toEqual({
+      requestId: 2,
+      loading: true,
+      details: null,
+      error: 'first failure'
+    })
+  })
+
+  it('clears loaded details when a retry starts after a successful load', () => {
+    const sourceChecks = [check('unit')]
+    const loaded = settleGitHubChecksTabDetails(
+      beginGitHubChecksTabDetails(createGitHubChecksTabState(sourceChecks, 'repo-a'), 'unit', 1),
+      'unit',
+      1,
+      { loading: false, details: checkRunDetails, error: null }
+    )
+
+    expect(loaded.detailsByCheckKey.unit.details).toBe(checkRunDetails)
+    expect(beginGitHubChecksTabDetails(loaded, 'unit', 2).detailsByCheckKey.unit).toEqual({
+      requestId: 2,
+      loading: true,
+      details: null,
+      error: null
+    })
+  })
+
+  it('drops settlement after a source refresh clears request ownership', () => {
+    const oldSource = [check('old')]
+    const loading = updateGitHubChecksTabDetails(
+      createGitHubChecksTabState(oldSource, 'repo-a'),
+      'unit',
+      {
+        requestId: 1,
+        loading: true,
+        details: null,
+        error: null
+      }
+    )
+    const refreshed = resolveGitHubChecksTabState(loading, [check('new')], 'repo-a')
+
+    expect(refreshed.contextOwner).toBe(loading.contextOwner)
+
+    expect(
+      settleGitHubChecksTabDetails(refreshed, 'unit', 1, {
+        loading: false,
+        details: null,
+        error: 'stale'
+      })
+    ).toBe(refreshed)
+  })
+
+  it('resets request ownership when the context changes with the same checks array', () => {
+    const sourceChecks = [check('unit')]
+    const loading = updateGitHubChecksTabDetails(
+      createGitHubChecksTabState(sourceChecks, 'repo-a'),
+      'unit',
+      { requestId: 1, loading: true, details: null, error: null }
+    )
+
+    const nextContext = resolveGitHubChecksTabState(loading, sourceChecks, 'repo-b')
+    expect(nextContext).toEqual({
+      contextKey: 'repo-b',
+      contextOwner: expect.any(Object),
+      sourceChecks,
+      localChecks: null,
+      expandedCheckKey: null,
+      detailsByCheckKey: {}
+    })
+    const revisited = resolveGitHubChecksTabState(nextContext, sourceChecks, 'repo-a')
+    expect(revisited.contextOwner).not.toBe(loading.contextOwner)
+    expect(revisited.contextOwner).not.toBe(nextContext.contextOwner)
+  })
 })
diff --git a/src/renderer/src/components/github-checks-tab-state.ts b/src/renderer/src/components/github-checks-tab-state.ts
index 2995af7d0b9..e408eb6ef9d 100644
--- a/src/renderer/src/components/github-checks-tab-state.ts
+++ b/src/renderer/src/components/github-checks-tab-state.ts
@@ -1,12 +1,15 @@
 import type { PRCheckDetail, PRCheckRunDetails } from '../../../shared/types'
 
 export type CheckDetailsLoadState = {
+  requestId?: number
   loading: boolean
   details: PRCheckRunDetails | null
   error: string | null
 }
 
 export type GitHubChecksTabState = {
+  contextKey: string
+  contextOwner: object
   sourceChecks: GitHubChecksSource
   localChecks: PRCheckDetail[] | null
   expandedCheckKey: string | null
@@ -15,8 +18,13 @@ export type GitHubChecksTabState = {
 
 type GitHubChecksSource = readonly PRCheckDetail[] | null | undefined
 
-export function createGitHubChecksTabState(sourceChecks: GitHubChecksSource): GitHubChecksTabState {
+export function createGitHubChecksTabState(
+  sourceChecks: GitHubChecksSource,
+  contextKey: string
+): GitHubChecksTabState {
   return {
+    contextKey,
+    contextOwner: {},
     sourceChecks,
     localChecks: null,
     expandedCheckKey: null,
@@ -26,9 +34,29 @@ export function createGitHubChecksTabState(sourceChecks: GitHubChecksSource): Gi
 
 export function resolveGitHubChecksTabState(
   state: GitHubChecksTabState,
-  sourceChecks: GitHubChecksSource
+  sourceChecks: GitHubChecksSource,
+  contextKey: string
 ): GitHubChecksTabState {
-  return state.sourceChecks === sourceChecks ? state : createGitHubChecksTabState(sourceChecks)
+  if (state.contextKey !== contextKey) {
+    return createGitHubChecksTabState(sourceChecks, contextKey)
+  }
+  return state.sourceChecks === sourceChecks
+    ? state
+    : resetGitHubChecksTabForSource(state, sourceChecks)
+}
+
+export function resetGitHubChecksTabForSource(
+  state: GitHubChecksTabState,
+  sourceChecks: GitHubChecksSource = state.sourceChecks
+): GitHubChecksTabState {
+  return {
+    contextKey: state.contextKey,
+    contextOwner: state.contextOwner,
+    sourceChecks,
+    localChecks: null,
+    expandedCheckKey: null,
+    detailsByCheckKey: {}
+  }
 }
 
 export function updateGitHubChecksTabLocalChecks(
@@ -51,6 +79,11 @@ export function toggleGitHubChecksTabExpandedKey(
   }
 }
 
+/**
+ * Unfenced write: an entry stored without a `requestId` silently drops the
+ * settlement of any request already in flight for that key. Use
+ * `beginGitHubChecksTabDetails` whenever a settlement is expected.
+ */
 export function updateGitHubChecksTabDetails(
   state: GitHubChecksTabState,
   key: string,
@@ -64,3 +97,34 @@ export function updateGitHubChecksTabDetails(
     }
   }
 }
+
+export function beginGitHubChecksTabDetails(
+  state: GitHubChecksTabState,
+  key: string,
+  requestId: number
+): GitHubChecksTabState {
+  const current = state.detailsByCheckKey[key]
+  return updateGitHubChecksTabDetails(state, key, {
+    requestId,
+    loading: true,
+    details: null,
+    error: current?.error ?? null
+  })
+}
+
+/**
+ * A context change is fenced indirectly: `resolveGitHubChecksTabState` swaps in
+ * a state with an empty `detailsByCheckKey`, so requests from the old context
+ * find no owning entry here and settle into nothing.
+ */
+export function settleGitHubChecksTabDetails(
+  state: GitHubChecksTabState,
+  key: string,
+  requestId: number,
+  details: Omit<CheckDetailsLoadState, 'requestId'>
+): GitHubChecksTabState {
+  if (state.detailsByCheckKey[key]?.requestId !== requestId) {
+    return state
+  }
+  return updateGitHubChecksTabDetails(state, key, { ...details, requestId })
+}
diff --git a/src/renderer/src/components/github-item-dialog-source-boundary.test.ts b/src/renderer/src/components/github-item-dialog-source-boundary.test.ts
index a773910d332..6c487a5d140 100644
--- a/src/renderer/src/components/github-item-dialog-source-boundary.test.ts
+++ b/src/renderer/src/components/github-item-dialog-source-boundary.test.ts
@@ -230,6 +230,42 @@ describe('GitHubItemDialog source host boundaries', () => {
     expect(checksSection).toContain('window.api.gh.prChecks({')
     expect(checksSection).toContain('window.api.gh.rerunPRChecks({')
     expect(checksSection).toContain('prCheckDetails({')
+    expect(checksSection).toMatch(
+      /withGitHubCheckDetailsTimeout\(\(signal\) =>\s*runtimeHost\s*\?\s*callRuntimeRpc[\s\S]*:\s*window\.api\.gh\.prCheckDetails\(\{/
+    )
+    expect(checksSection).toContain('{ timeoutMs: 30_000, signal }')
+  })
+
+  it('makes failed check detail loads retryable and fences stale responses', () => {
+    const source = componentSource('GitHubItemDialog.tsx')
+    const checksSection = sourceBetween(
+      source,
+      'function ChecksTab',
+      'function GitHubLabelsSettingsLink'
+    )
+
+    expect(checksSection).toContain('createGitHubChecksTabState(checks, checkDetailsContextKey)')
+    expect(checksSection).toContain('checksState,\n    checks,\n    checkDetailsContextKey')
+    expect(checksSection).toContain('resetGitHubChecksTabForSource(current)')
+    expect(checksSection).toContain(
+      'committedChecksContextOwnerRef.current !== refreshContextOwner'
+    )
+    expect(checksSection).toContain('activeChecksRefreshRequestIdRef.current !== refreshRequestId')
+    expect(checksSection).toContain('current.contextOwner === refreshContextOwner')
+    expect(checksSection).toContain(
+      'const rerunContextOwner = committedChecksContextOwnerRef.current'
+    )
+    expect(checksSection).toContain('committedChecksContextOwnerRef.current !== rerunContextOwner')
+    expect(checksSection).toContain('await handleRefresh(rerunContextOwner)')
+    expect(checksSection).toContain('!mountedRef.current ||')
+    expect(checksSection).toContain('settleGitHubChecksTabDetails(current, key, requestId, next)')
+    expect(checksSection).toContain(
+      'onClick={() => requestCheckDetails(check, getCheckDetailsKey(check))}'
+    )
+    expect(checksSection).toContain('disabled={state.loading}')
+    expect(checksSection).toContain('aria-busy={state.loading}')
+    expect(checksSection).toContain("translate('githubChecks.retrying', 'Retrying…')")
+    expect(checksSection).toContain("'Retry'")
   })
 
   it('uses hydrated work item details for the page checks tab', () => {
diff --git a/src/renderer/src/components/github/pr-file-content-size.test.ts b/src/renderer/src/components/github/pr-file-content-size.test.ts
new file mode 100644
index 00000000000..700a9579ec4
--- /dev/null
+++ b/src/renderer/src/components/github/pr-file-content-size.test.ts
@@ -0,0 +1,16 @@
+import { describe, expect, it } from 'vitest'
+import type { GitHubPRFileContents } from '../../../../shared/types'
+import { getPRFileContentsCacheByteCount } from './pr-file-content-size'
+
+describe('PR file content size', () => {
+  it('counts astral characters and lone surrogates as UTF-8 bytes', () => {
+    const contents: GitHubPRFileContents = {
+      original: '😀\ud800',
+      modified: '\udc00é',
+      originalIsBinary: false,
+      modifiedIsBinary: false
+    }
+
+    expect(getPRFileContentsCacheByteCount(contents)).toBe(12)
+  })
+})
diff --git a/src/renderer/src/components/github/pr-file-content-size.ts b/src/renderer/src/components/github/pr-file-content-size.ts
index 89e0f26903c..0e20c92bd1d 100644
--- a/src/renderer/src/components/github/pr-file-content-size.ts
+++ b/src/renderer/src/components/github/pr-file-content-size.ts
@@ -1,5 +1,6 @@
 import { MAX_RENDERED_DIFF_COMBINED_CHARACTERS } from '@/components/editor/large-diff-render-limit'
 import type { GitHubPRFile, GitHubPRFileContents } from '../../../../shared/types'
+import { getUtf8ByteLength } from '../../../../shared/utf8-byte-limits'
 
 export const PR_FILE_CONTENT_CACHE_MAX_BYTES = MAX_RENDERED_DIFF_COMBINED_CHARACTERS * 4
 
@@ -7,29 +8,6 @@ export function isPRFileViewed(file: GitHubPRFile): boolean {
   return file.viewerViewedState === 'VIEWED'
 }
 
-export function getUtf8ByteCount(value: string): number {
-  let byteCount = 0
-  for (let index = 0; index < value.length; index += 1) {
-    const code = value.charCodeAt(index)
-    if (code < 0x80) {
-      byteCount += 1
-    } else if (code < 0x800) {
-      byteCount += 2
-    } else if (code >= 0xd800 && code <= 0xdbff && index + 1 < value.length) {
-      const next = value.charCodeAt(index + 1)
-      if (next >= 0xdc00 && next <= 0xdfff) {
-        byteCount += 4
-        index += 1
-      } else {
-        byteCount += 3
-      }
-    } else {
-      byteCount += 3
-    }
-  }
-  return byteCount
-}
-
 export function isPRFileContentsTooLargeSentinel(contents: GitHubPRFileContents): boolean {
   return contents.originalTooLarge === true || contents.modifiedTooLarge === true
 }
@@ -38,7 +16,7 @@ export function getPRFileContentsCacheByteCount(contents: GitHubPRFileContents):
   if (isPRFileContentsTooLargeSentinel(contents)) {
     return 0
   }
-  return getUtf8ByteCount(contents.original) + getUtf8ByteCount(contents.modified)
+  return getUtf8ByteLength(contents.original) + getUtf8ByteLength(contents.modified)
 }
 
 export function getRetainedPRFileContentsByteCount(contents: GitHubPRFileContents): number | null {
diff --git a/src/renderer/src/components/landing-preflight-dismissal.ts b/src/renderer/src/components/landing-preflight-dismissal.ts
index 76ef2a47bf5..1fae17b0a3d 100644
--- a/src/renderer/src/components/landing-preflight-dismissal.ts
+++ b/src/renderer/src/components/landing-preflight-dismissal.ts
@@ -23,7 +23,7 @@ function storageKey(issueId: string): string {
 
 /** GitHub-backed project identity keys for the current repo set, de-duped so
  *  the same GitHub project added twice doesn't read as two distinct projects. */
-export function githubProjectKeys(repos: Repo[]): string[] {
+export function githubProjectKeys(repos: readonly Repo[]): string[] {
   const keys = repos
     .filter((repo) => isGitHubBackedRepo(repo))
     .map((repo) => getProjectIdentityKey(repo))
@@ -45,7 +45,7 @@ function readRecord(issueId: string): DismissalRecord | null {
 
 /** True when the issue was dismissed and no new GitHub project has appeared
  *  since. A GitHub key present now but absent from the snapshot re-surfaces it. */
-export function isPreflightIssueDismissed(issueId: string, repos: Repo[]): boolean {
+export function isPreflightIssueDismissed(issueId: string, repos: readonly Repo[]): boolean {
   const record = readRecord(issueId)
   if (!record) {
     return false
@@ -55,7 +55,7 @@ export function isPreflightIssueDismissed(issueId: string, repos: Repo[]): boole
   return !hasNewGithubProject
 }
 
-export function dismissPreflightIssue(issueId: string, repos: Repo[]): void {
+export function dismissPreflightIssue(issueId: string, repos: readonly Repo[]): void {
   try {
     const record: DismissalRecord = { githubKeys: githubProjectKeys(repos) }
     localStorage.setItem(storageKey(issueId), JSON.stringify(record))
diff --git a/src/renderer/src/components/native-chat/NativeChatComposer.test.tsx b/src/renderer/src/components/native-chat/NativeChatComposer.test.tsx
index 665f95449e9..e7a6269f533 100644
--- a/src/renderer/src/components/native-chat/NativeChatComposer.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatComposer.test.tsx
@@ -30,10 +30,13 @@ const mocks = vi.hoisted(() => ({
   } | null,
   createClaudeModelSwitchConfirmationObserver: vi.fn(),
   discoverCommitMessageModels: vi.fn(),
+  draft: 'hello',
   getMainBufferSnapshot: vi.fn(),
   sendHandle: { cancel: vi.fn(), settleAfterMs: 500 },
   sendNativeChatMessage: vi.fn(),
+  sendNativeChatTypedCommand: vi.fn(),
   sendNativeChatMessageVerified: vi.fn(),
+  typeNativeChatCommand: vi.fn(),
   trackPendingSend: vi.fn(),
   setDraft: vi.fn(),
   draftScopeKeys: [] as string[],
@@ -63,8 +66,10 @@ vi.mock('@/lib/agent-paste-draft', () => ({
 }))
 vi.mock('./native-chat-runtime-send', () => ({
   sendNativeChatMessage: (...args: unknown[]) => mocks.sendNativeChatMessage(...args),
+  sendNativeChatTypedCommand: (...args: unknown[]) => mocks.sendNativeChatTypedCommand(...args),
   sendNativeChatMessageVerified: (...args: unknown[]) =>
     mocks.sendNativeChatMessageVerified(...args),
+  typeNativeChatCommand: (...args: unknown[]) => mocks.typeNativeChatCommand(...args),
   sendNativeChatMessageWithImageAttachments: vi.fn(),
   submitNativeChatPrompt: vi.fn()
 }))
@@ -85,7 +90,7 @@ vi.mock('@/lib/native-chat-telemetry', () => ({
 vi.mock('./use-native-chat-draft', () => ({
   useNativeChatDraft: (scopeKey: string) => {
     mocks.draftScopeKeys.push(scopeKey)
-    return { draft: 'hello', setDraft: mocks.setDraft }
+    return { draft: mocks.draft, setDraft: mocks.setDraft }
   }
 }))
 vi.mock('./native-chat-draft-cache', () => ({
@@ -142,6 +147,7 @@ describe('NativeChatComposer', () => {
     clearNativeChatModelEnrichmentForTests()
     mocks.fieldProps = null
     mocks.modelSwitchOutcome = 'applied'
+    mocks.draft = 'hello'
     mocks.draftScopeKeys.length = 0
     mocks.confirmationObserver = null
     mocks.createClaudeModelSwitchConfirmationObserver.mockImplementation(() => {
@@ -180,7 +186,9 @@ describe('NativeChatComposer', () => {
       ]
     })
     mocks.sendNativeChatMessage.mockReturnValue(mocks.sendHandle)
+    mocks.sendNativeChatTypedCommand.mockReturnValue(mocks.sendHandle)
     mocks.sendNativeChatMessageVerified.mockResolvedValue(true)
+    mocks.typeNativeChatCommand.mockResolvedValue(true)
     mocks.sendHandle.settleAfterMs = 500
     Object.defineProperty(window, 'api', {
       configurable: true,
@@ -234,6 +242,57 @@ describe('NativeChatComposer', () => {
     expect(mocks.trackPendingSend).toHaveBeenCalledWith(mocks.sendHandle, 'pending-1')
   })
 
+  it('types Codex slash composer sends instead of pasting them', () => {
+    mocks.draft = '/status'
+    render(
+      <NativeChatComposer
+        terminalTabId="tab-1"
+        paneKey="tab-1:leaf-1"
+        targetPtyId="pty-1"
+        agent="codex"
+      />
+    )
+
+    act(() => mocks.fieldProps?.onSend?.())
+
+    expect(mocks.sendNativeChatTypedCommand).toHaveBeenCalledWith({}, 'pty-1', '/status')
+    expect(mocks.sendNativeChatMessage).not.toHaveBeenCalled()
+  })
+
+  it('keeps Codex skill sends pasted', () => {
+    mocks.draft = '$ref-oss'
+    render(
+      <NativeChatComposer
+        terminalTabId="tab-1"
+        paneKey="tab-1:leaf-1"
+        targetPtyId="pty-1"
+        agent="codex"
+      />
+    )
+
+    act(() => mocks.fieldProps?.onSend?.())
+
+    expect(mocks.sendNativeChatMessage).toHaveBeenCalledWith({}, 'pty-1', '$ref-oss', undefined)
+    expect(mocks.sendNativeChatTypedCommand).not.toHaveBeenCalled()
+  })
+
+  it.each(['claude', 'openclaude'] as const)('keeps %s slash composer sends pasted', (agent) => {
+    mocks.draft = '/clear'
+    render(
+      <NativeChatComposer
+        terminalTabId="tab-1"
+        paneKey="tab-1:leaf-1"
+        targetPtyId="pty-1"
+        agent={agent}
+      />
+    )
+
+    act(() => mocks.fieldProps?.onSend?.())
+
+    expect(mocks.sendNativeChatMessage).toHaveBeenCalledWith({}, 'pty-1', '/clear', undefined)
+    expect(mocks.sendNativeChatTypedCommand).not.toHaveBeenCalled()
+  })
+
   it('retires the launch-draft seed once a send clears the TUI input line', () => {
     render(
       <NativeChatComposer
@@ -550,7 +609,7 @@ describe('NativeChatComposer', () => {
     expect(onSwitchToTerminal).toHaveBeenCalledOnce()
   })
 
-  it('applies a Codex model change without switching to the terminal', async () => {
+  it('types the Codex picker command and switches to the terminal', async () => {
     mocks.sendHandle.settleAfterMs = 0
     const onSwitchToTerminal = vi.fn()
     render(
@@ -563,17 +622,17 @@ describe('NativeChatComposer', () => {
       />
     )
 
-    // Codex model changes are value-bearing commands; only effort still uses the TUI picker.
     await act(async () => {
-      await mocks.fieldProps?.sessionOptionsSurface?.setOption('model', 'gpt-5.5')
+      await mocks.fieldProps?.sessionOptionsSurface?.invokeAction('model')
     })
 
-    expect(mocks.sendNativeChatMessageVerified).toHaveBeenCalledWith(
+    expect(mocks.typeNativeChatCommand).toHaveBeenCalledWith(
       {},
       'pty-1',
-      '/model gpt-5.5',
+      '/model',
       expect.any(AbortSignal)
     )
-    expect(onSwitchToTerminal).not.toHaveBeenCalled()
+    expect(mocks.sendNativeChatMessageVerified).not.toHaveBeenCalled()
+    expect(onSwitchToTerminal).toHaveBeenCalledOnce()
   })
 })
diff --git a/src/renderer/src/components/native-chat/NativeChatComposer.tsx b/src/renderer/src/components/native-chat/NativeChatComposer.tsx
index 3cad0b3ac2c..7ec609f8aa1 100644
--- a/src/renderer/src/components/native-chat/NativeChatComposer.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatComposer.tsx
@@ -4,12 +4,14 @@ import { sendRuntimePtyInput } from '@/runtime/runtime-terminal-inspection'
 import { getSettingsForAgentTabRuntimeOwner } from '@/lib/agent-paste-draft'
 import {
   sendNativeChatMessage,
+  sendNativeChatTypedCommand,
   sendNativeChatMessageWithImageAttachments,
   submitNativeChatPrompt
 } from './native-chat-runtime-send'
 import type { NativeChatSendHandle } from './native-chat-runtime-send'
 import { resolveNativeChatLaunchDraftSend } from './native-chat-launch-draft-send'
 import { getVerifiedNativeChatCommands } from '../../../../shared/native-chat-agent-profiles'
+import { isSlashCommandDraft } from '../../../../shared/native-chat-slash-commands'
 import { emitNativeChatMessageSent } from '@/lib/native-chat-telemetry'
 import {
   applyMentionSuggestion,
@@ -263,7 +265,10 @@ export const NativeChatComposer = forwardRef<NativeChatComposerHandle, NativeCha
       // command/unknown send, otherwise `clearImageAttachments()` below drops
       // them silently when the text starts with the agent's slash/skill prefix.
       if (classification !== 'chat' && imagePaths.length === 0) {
-        pendingHandle = sendNativeChatMessage(target.settings, target.ptyId, text, sendOptions)
+        pendingHandle =
+          agent === 'codex' && isSlashCommandDraft(text)
+            ? sendNativeChatTypedCommand(target.settings, target.ptyId, text)
+            : sendNativeChatMessage(target.settings, target.ptyId, text, sendOptions)
       } else if (imagePaths.length > 0) {
         pendingHandle = sendNativeChatMessageWithImageAttachments(
           target.settings,
diff --git a/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx b/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx
index e7d3eda0985..cc9963b94b2 100644
--- a/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx
@@ -40,7 +40,23 @@ vi.mock('@/components/ui/dropdown-menu', () => {
       children: React.ReactNode
       disabled?: boolean
     }) => <div data-disabled={disabled || undefined}>{children}</div>,
-    DropdownMenuContent: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+    DropdownMenuContent: ({
+      children,
+      side,
+      collisionPadding
+    }: {
+      children: React.ReactNode
+      side?: string
+      collisionPadding?: number
+    }) => (
+      <div
+        data-testid="session-option-menu"
+        data-side={side}
+        data-collision-padding={collisionPadding}
+      >
+        {children}
+      </div>
+    ),
     DropdownMenuLabel: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
     DropdownMenuSeparator: () => <hr />,
     DropdownMenuItem: ({
@@ -172,6 +188,23 @@ const fast: SessionOptionDescriptor = {
 afterEach(() => cleanup())
 
 describe('NativeChatSessionOptionPickers', () => {
+  it('prefers collision-aware upward placement for model and option menus', () => {
+    render(
+      <NativeChatSessionOptionPickers
+        surface={surface}
+        snapshot={[model(), effort]}
+        isWorking={false}
+      />
+    )
+
+    const menus = screen.getAllByTestId('session-option-menu')
+    expect(menus).toHaveLength(2)
+    for (const menu of menus) {
+      expect(menu.getAttribute('data-side')).toBe('top')
+      expect(menu.getAttribute('data-collision-padding')).toBe('8')
+    }
+  })
+
   it('renders model and joined option labels, and hides an empty options pill', () => {
     const { rerender } = render(
       <NativeChatSessionOptionPickers
diff --git a/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.tsx b/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.tsx
index 2b83d68ea95..7a298d5ace3 100644
--- a/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.tsx
@@ -242,7 +242,7 @@ function NativeChatSessionOptionPickersInner({
             disabledReason={optionsReason}
             dispatched={options.some((descriptor) => descriptor.valueSource === 'dispatched')}
           />
-          <DropdownMenuContent align="start" className="w-60">
+          <DropdownMenuContent align="start" side="top" collisionPadding={8} className="w-60">
             {options.map((descriptor, index) => {
               const reason = nativeChatSessionOptionDisabledReason(descriptor.disabledReason)
               return (
@@ -272,7 +272,7 @@ function NativeChatSessionOptionPickersInner({
           disabledReason={modelReason}
           dispatched={model.valueSource === 'dispatched'}
         />
-        <DropdownMenuContent align="start" className="w-64">
+        <DropdownMenuContent align="start" side="top" collisionPadding={8} className="w-64">
           {modelReason && !model.settable ? (
             <DropdownMenuLabel className="font-normal">{modelReason}</DropdownMenuLabel>
           ) : null}
diff --git a/src/renderer/src/components/native-chat/NativeChatView.tsx b/src/renderer/src/components/native-chat/NativeChatView.tsx
index 2fb458166ec..4da40f7a1fc 100644
--- a/src/renderer/src/components/native-chat/NativeChatView.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatView.tsx
@@ -2,7 +2,6 @@ import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { useShallow } from 'zustand/react/shallow'
 import { useAppStore } from '../../store'
 import { useNativeChatLaunchDraftSignal } from './use-native-chat-launch-draft-adoption'
-import type { NativeChatSession } from '../../../../shared/native-chat-types'
 import { useNativeChatRetainedSession } from './use-native-chat-retained-session'
 import { selectNativeChatViewState } from './native-chat-view-state'
 import { NativeChatMessageList } from './NativeChatMessageList'
@@ -47,18 +46,18 @@ import {
   emptyNativeChatContextMenuActions,
   useNativeChatContextMenu
 } from './use-native-chat-context-menu'
-import type { NativeChatContextMenuActions } from './use-native-chat-context-menu'
 import { resolveNativeChatFileLinkContext } from './native-chat-file-link'
 import { selectNativeChatRuntimeEnvironmentId } from './native-chat-runtime-owner'
 import { useNativeChatPasteBridge } from './use-native-chat-paste-bridge'
 import { useNativeChatFileLinkClick } from './use-native-chat-file-link-click'
-import type { NativeChatViewProps } from './native-chat-view-types'
+import type { NativeChatResolvedViewProps, NativeChatViewProps } from './native-chat-view-types'
 
 export type { NativeChatViewProps } from './native-chat-view-types'
 
 /** Resolves an agent terminal into its native conversation and composer UI. */
 export default function NativeChatView({
   terminalTabId,
+  isVisible,
   paneKey: preferredPaneKey,
   targetPtyId = null,
   launchAgent,
@@ -94,6 +93,7 @@ export default function NativeChatView({
           agent={resolution.agent}
           sessionId={resolution.sessionId}
           transcriptPath={resolution.transcriptPath}
+          isVisible={isVisible}
           targetPtyId={targetPtyId}
           terminalTabId={terminalTabId}
           onSwitchToTerminal={onSwitchToTerminal}
@@ -110,22 +110,13 @@ function NativeChatResolvedView({
   agent,
   sessionId,
   transcriptPath,
+  isVisible,
   targetPtyId,
   terminalTabId,
   onSwitchToTerminal,
   readTerminalScreen,
   contextMenuActions
-}: {
-  paneKey: string
-  agent: NativeChatSession['agent']
-  sessionId: string | null
-  transcriptPath: string | null
-  targetPtyId: string | null
-  terminalTabId: string
-  onSwitchToTerminal?: () => void
-  readTerminalScreen?: () => string | null
-  contextMenuActions?: Omit<NativeChatContextMenuActions, 'onPaste'>
-}): React.JSX.Element {
+}: NativeChatResolvedViewProps): React.JSX.Element {
   // Primitive owner selection (no useShallow): routes the pane's read/subscribe to
   // the remote runtime host for a runtime-owned pane; null keeps the local path.
   const runtimeEnvironmentId = useAppStore((s) =>
@@ -136,7 +127,8 @@ function NativeChatResolvedView({
     agent,
     sessionId,
     transcriptPath,
-    runtimeEnvironmentId
+    runtimeEnvironmentId,
+    enabled: isVisible
   })
   const launchPrompt = useAppStore((s) => s.nativeChatLaunchPromptByTabId[terminalTabId] ?? null)
   const clearNativeChatLaunchPrompt = useAppStore((s) => s.clearNativeChatLaunchPrompt)
diff --git a/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts b/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts
index b96d3fad358..826d70aea9f 100644
--- a/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts
+++ b/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts
@@ -43,14 +43,14 @@ function hasClaudeModelSwitchSuccess(buffer: string, modelLabel: string): boolea
   // every picker token prevents one context variant from confirming another.
   const labelTokens = modelLabel.toLowerCase().match(/[a-z]+|\d+[a-z]*/g) ?? []
   const successStart = text.lastIndexOf('setmodelto')
-  if (successStart < 0 || labelTokens.length === 0) {
+  if (successStart === -1 || labelTokens.length === 0) {
     return false
   }
   const successText = text.slice(successStart)
   let tokenEnd = 0
   for (const token of labelTokens) {
     const tokenStart = successText.indexOf(token, tokenEnd)
-    if (tokenStart < 0) {
+    if (tokenStart === -1) {
       return false
     }
     tokenEnd = tokenStart + token.length
diff --git a/src/renderer/src/components/native-chat/claude-terminal-session-options.ts b/src/renderer/src/components/native-chat/claude-terminal-session-options.ts
index 3b8ad86a47a..c7e88eaa898 100644
--- a/src/renderer/src/components/native-chat/claude-terminal-session-options.ts
+++ b/src/renderer/src/components/native-chat/claude-terminal-session-options.ts
@@ -52,7 +52,7 @@ function frameCell(line: string): string {
   if (line.startsWith(FRAME_COLUMN)) {
     const afterBorder = line.slice(FRAME_COLUMN.length)
     const columnEnd = afterBorder.indexOf(FRAME_COLUMN)
-    return (columnEnd < 0 ? afterBorder : afterBorder.slice(0, columnEnd)).trim()
+    return (columnEnd === -1 ? afterBorder : afterBorder.slice(0, columnEnd)).trim()
   }
   // Unframed buffers put the descriptor on the row directly, behind box art.
   return line.replace(/^[^A-Za-z0-9]+/, '').trim()
@@ -171,7 +171,7 @@ function labelNamesReportedModel(reportedModel: string, label: string): boolean
   let cursor = 1
   for (const token of labelTokens.slice(1)) {
     const found = nameTokens.indexOf(token, cursor)
-    if (found < 0) {
+    if (found === -1) {
       return false
     }
     cursor = found + 1
@@ -212,7 +212,7 @@ export function readClaudeSessionOptionsFromTerminalScreen(
   }
   const lines = normalizedScreenLines(screen)
   const headerIndex = lines.findIndex(isClaudeHeaderRow)
-  if (headerIndex < 0) {
+  if (headerIndex === -1) {
     return null
   }
   const descriptorCell = claudeModelDescriptorCell(lines, headerIndex)
diff --git a/src/renderer/src/components/native-chat/native-chat-launch-session-options.test.ts b/src/renderer/src/components/native-chat/native-chat-launch-session-options.test.ts
new file mode 100644
index 00000000000..551be10ab0c
--- /dev/null
+++ b/src/renderer/src/components/native-chat/native-chat-launch-session-options.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest'
+import { resolveInitialNativeChatSessionOptions } from './native-chat-launch-session-options'
+
+const settings = {
+  experimentalNativeChat: true,
+  openAgentTabsInChatByDefault: true,
+  nativeChatSessionOptions: {
+    codex: {
+      model: 'gpt-5.2-codex',
+      valuesByModel: { 'gpt-5.2-codex': { effort: 'medium' } }
+    }
+  }
+}
+
+describe('resolveInitialNativeChatSessionOptions', () => {
+  it('omits native-chat preferences from terminal-default launches', () => {
+    expect(
+      resolveInitialNativeChatSessionOptions(
+        { ...settings, openAgentTabsInChatByDefault: false },
+        { agent: 'codex' }
+      )
+    ).toBeUndefined()
+  })
+
+  it('applies native-chat preferences when the launch resolves to chat', () => {
+    expect(resolveInitialNativeChatSessionOptions(settings, { agent: 'codex' })).toEqual({
+      model: 'gpt-5.2-codex',
+      effort: 'medium'
+    })
+  })
+
+  it('omits preferences when a draft forces the initial view back to terminal', () => {
+    expect(
+      resolveInitialNativeChatSessionOptions(settings, {
+        agent: 'codex',
+        promptDelivery: 'draft',
+        launchDraftText: 'one\u2028two'
+      })
+    ).toBeUndefined()
+  })
+
+  it('omits preferences when a remote transcript forces the initial view to terminal', () => {
+    const grokSettings = {
+      ...settings,
+      nativeChatSessionOptions: { grok: { model: 'grok-4.5' } }
+    }
+    expect(
+      resolveInitialNativeChatSessionOptions(grokSettings, {
+        agent: 'grok',
+        nativeChatTranscriptIsLocalReadable: false
+      })
+    ).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/components/native-chat/native-chat-launch-session-options.ts b/src/renderer/src/components/native-chat/native-chat-launch-session-options.ts
new file mode 100644
index 00000000000..2257bb77120
--- /dev/null
+++ b/src/renderer/src/components/native-chat/native-chat-launch-session-options.ts
@@ -0,0 +1,33 @@
+import type { GlobalSettings, TuiAgent } from '../../../../shared/types'
+import type { SessionOptionValue } from '../../../../shared/native-chat-session-options'
+import {
+  decideInitialAgentTabViewMode,
+  type NativeChatLaunchPromptDelivery
+} from '@/lib/native-chat-initial-view-mode'
+import { resolveNativeChatLaunchSessionOptions } from './native-chat-session-option-enrichment'
+
+type NativeChatLaunchSettings = Pick<
+  GlobalSettings,
+  'experimentalNativeChat' | 'openAgentTabsInChatByDefault' | 'nativeChatSessionOptions'
+>
+
+export type InitialNativeChatSessionOptionsArgs = {
+  agent: TuiAgent
+  promptDelivery?: NativeChatLaunchPromptDelivery
+  launchDraftText?: string
+  nativeChatTranscriptIsLocalReadable?: boolean
+}
+
+export function resolveInitialNativeChatSessionOptions(
+  settings: NativeChatLaunchSettings | null | undefined,
+  args: InitialNativeChatSessionOptionsArgs
+): Record<string, SessionOptionValue> | undefined {
+  const viewMode = decideInitialAgentTabViewMode({
+    experimentalNativeChat: settings?.experimentalNativeChat,
+    openAgentTabsInChatByDefault: settings?.openAgentTabsInChatByDefault,
+    ...args
+  })
+  return viewMode === 'chat'
+    ? resolveNativeChatLaunchSessionOptions(settings?.nativeChatSessionOptions, args.agent)
+    : undefined
+}
diff --git a/src/renderer/src/components/native-chat/native-chat-pending-occurrence.ts b/src/renderer/src/components/native-chat/native-chat-pending-occurrence.ts
index 7185b6ad1d3..5a4631421bc 100644
--- a/src/renderer/src/components/native-chat/native-chat-pending-occurrence.ts
+++ b/src/renderer/src/components/native-chat/native-chat-pending-occurrence.ts
@@ -191,7 +191,7 @@ export function selectPendingIndicesRepresentedByUserTexts(
       }
       represented.add(entry.index)
       const at = remaining.findIndex((candidate) => candidate.index === entry.index)
-      if (at >= 0) {
+      if (at !== -1) {
         remaining.splice(at, 1)
       }
     }
diff --git a/src/renderer/src/components/native-chat/native-chat-pending.ts b/src/renderer/src/components/native-chat/native-chat-pending.ts
index 410de8add38..a33b4e27838 100644
--- a/src/renderer/src/components/native-chat/native-chat-pending.ts
+++ b/src/renderer/src/components/native-chat/native-chat-pending.ts
@@ -99,7 +99,7 @@ function messagesAfterPendingBoundary(
     return messages.filter((message) => messageIsAfterPendingTimestamp(message, pending))
   }
   const boundaryIndex = messages.findIndex((message) => message.id === pending.afterMessageId)
-  if (boundaryIndex >= 0) {
+  if (boundaryIndex !== -1) {
     return messages.slice(boundaryIndex + 1)
   }
   // A bounded authoritative read can page the boundary out. Fall back to the
@@ -164,7 +164,7 @@ export function prunePendingSends(
       return false
     }
     const openIndex = stillOpen.indexOf(entry)
-    return openIndex < 0 || !gluedRepresented.has(openIndex)
+    return openIndex === -1 || !gluedRepresented.has(openIndex)
   })
   return next.length === pending.length ? pending : next
 }
@@ -208,7 +208,7 @@ export function pendingSendsAsMessages(
         return false
       }
       const openIndex = stillVisible.indexOf(entry)
-      return openIndex < 0 || !gluedRepresented.has(openIndex)
+      return openIndex === -1 || !gluedRepresented.has(openIndex)
     })
     .map((entry) => ({
       id: `pending:${entry.id}`,
diff --git a/src/renderer/src/components/native-chat/native-chat-pty-session-options.test.ts b/src/renderer/src/components/native-chat/native-chat-pty-session-options.test.ts
index 0dd5e19025d..37850bccaec 100644
--- a/src/renderer/src/components/native-chat/native-chat-pty-session-options.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-pty-session-options.test.ts
@@ -565,7 +565,7 @@ describe('native chat PTY session options', () => {
     )
 
     const result = await surface.invokeAction('effort')
-    expect(dispatch).toHaveBeenCalledWith('/model')
+    expect(dispatch).toHaveBeenCalledWith('/model', { delivery: 'type' })
     expect(onAgentPicker).toHaveBeenCalledOnce()
     expect(result.snapshot).toHaveLength(1)
     expect(result.snapshot[0]).toMatchObject({ valueSource: 'unknown' })
diff --git a/src/renderer/src/components/native-chat/native-chat-read-retry-timer.ts b/src/renderer/src/components/native-chat/native-chat-read-retry-timer.ts
new file mode 100644
index 00000000000..58f5f742924
--- /dev/null
+++ b/src/renderer/src/components/native-chat/native-chat-read-retry-timer.ts
@@ -0,0 +1,31 @@
+const RETRY_DELAYS_MS = [1_000, 2_000, 4_000, 8_000]
+const FIXED_RETRY_DELAY_MS = 10_000
+
+function retryDelayMs(attempt: number): number {
+  return RETRY_DELAYS_MS[attempt] ?? FIXED_RETRY_DELAY_MS
+}
+
+export type NativeChatReadRetryTimer = {
+  schedule: (attempt: number, retry: () => void) => void
+  cancel: () => void
+}
+
+export function createNativeChatReadRetryTimer(): NativeChatReadRetryTimer {
+  let timer: ReturnType<typeof setTimeout> | null = null
+  const cancel = (): void => {
+    if (timer !== null) {
+      clearTimeout(timer)
+      timer = null
+    }
+  }
+  return {
+    schedule(attempt, retry): void {
+      cancel()
+      timer = setTimeout(() => {
+        timer = null
+        retry()
+      }, retryDelayMs(attempt))
+    },
+    cancel
+  }
+}
diff --git a/src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts b/src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts
index 93a63765a46..9a16199d52a 100644
--- a/src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts
@@ -11,7 +11,9 @@ vi.mock('@/runtime/runtime-terminal-inspection', () => ({
 
 import {
   sendNativeChatMessage,
+  sendNativeChatTypedCommand,
   sendNativeChatMessageVerified,
+  typeNativeChatCommand,
   sendNativeChatMessageWithImageAttachments,
   submitNativeChatPrompt,
   sendNativeChatAskAnswer,
@@ -252,6 +254,69 @@ describe('sendNativeChatMessageVerified', () => {
   })
 })
 
+describe('typeNativeChatCommand', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    sendRuntimePtyInput.mockReset().mockReturnValue(true)
+    sendRuntimePtyInputVerified.mockReset().mockResolvedValue(true)
+    resetNativeChatPtySendQueuesForTests()
+  })
+  afterEach(() => {
+    vi.useRealTimers()
+    resetNativeChatPtySendQueuesForTests()
+  })
+
+  it('writes the Codex picker command as keys instead of one pasted text write', async () => {
+    const result = typeNativeChatCommand(SETTINGS, PTY, '/model')
+    await vi.runAllTimersAsync()
+
+    await expect(result).resolves.toBe(true)
+    expectWriteOrder(sendRuntimePtyInputVerified.mock.calls, [
+      NATIVE_CHAT_CLEAR_UNSUBMITTED_INPUT,
+      '/',
+      'm',
+      'o',
+      'd',
+      'e',
+      'l',
+      NATIVE_CHAT_SUBMIT
+    ])
+  })
+
+  it('queues composer commands as the same paced key sequence', async () => {
+    const handle = sendNativeChatTypedCommand(SETTINGS, PTY, '/status')
+    await vi.runAllTimersAsync()
+    await handle.settled
+
+    expectWriteOrder(sendRuntimePtyInputVerified.mock.calls, [
+      NATIVE_CHAT_CLEAR_UNSUBMITTED_INPUT,
+      '/',
+      's',
+      't',
+      'a',
+      't',
+      'u',
+      's',
+      NATIVE_CHAT_SUBMIT
+    ])
+  })
+
+  it('does not clear into the next queued send after cancellation', async () => {
+    const command = sendNativeChatTypedCommand(SETTINGS, PTY, '/status')
+    command.cancel()
+    const next = sendNativeChatMessage(SETTINGS, PTY, 'next')
+    await vi.runAllTimersAsync()
+    await Promise.all([command.settled, next.settled])
+
+    expectWriteOrder(sendRuntimePtyInput.mock.calls, [
+      NATIVE_CHAT_CLEAR_UNSUBMITTED_INPUT,
+      NATIVE_CHAT_CLEAR_UNSUBMITTED_INPUT,
+      buildNativeChatPasteBytes('next'),
+      NATIVE_CHAT_SUBMIT
+    ])
+  })
+})
+
 describe('sendNativeChatMessageWithImageAttachments', () => {
   beforeEach(() => {
     vi.useFakeTimers()
diff --git a/src/renderer/src/components/native-chat/native-chat-runtime-send.ts b/src/renderer/src/components/native-chat/native-chat-runtime-send.ts
index a2974474b2b..a3b34b4f716 100644
--- a/src/renderer/src/components/native-chat/native-chat-runtime-send.ts
+++ b/src/renderer/src/components/native-chat/native-chat-runtime-send.ts
@@ -19,6 +19,10 @@ import {
   buildNativeChatPasteBytes,
   NATIVE_CHAT_SUBMIT
 } from './native-chat-send'
+import {
+  AGENT_TUI_COMMAND_KEY_INTERVAL_MS,
+  typeAgentTuiCommand
+} from '../../../../shared/agent-tui-command-typing'
 import {
   cancelNativeChatPtySends,
   enqueueNativeChatPtySend,
@@ -213,6 +217,61 @@ export async function sendNativeChatMessageVerified(
   return sendRuntimePtyInputVerified(settings, ptyId, NATIVE_CHAT_SUBMIT)
 }
 
+/** Types a slash command as individual keys so Codex opens its command palette. */
+export async function typeNativeChatCommand(
+  settings: RuntimeSettings,
+  ptyId: string,
+  command: string,
+  signal?: AbortSignal
+): Promise<boolean> {
+  cancelNativeChatPtySends(ptyId)
+  await waitForNativeChatPtyIdle(ptyId)
+  const outcome = await typeAgentTuiCommand({
+    command,
+    signal,
+    write: async (key) =>
+      (await sendRuntimePtyInputVerified(settings, ptyId, key)) ? 'accepted' : 'rejected'
+  })
+  return outcome === 'accepted'
+}
+
+/** Queues a typed slash command with composer sends on the same PTY. */
+export function sendNativeChatTypedCommand(
+  settings: RuntimeSettings,
+  ptyId: string,
+  command: string
+): NativeChatSendHandle {
+  const controller = new AbortController()
+  return enqueueNativeChatPtySend(
+    ptyId,
+    (command.length + 1) * AGENT_TUI_COMMAND_KEY_INTERVAL_MS,
+    ({ isCancelled, markSubmitted }) => {
+      const finish = (outcome: 'accepted' | 'rejected' | 'unknown'): void => {
+        if (!isCancelled() && outcome !== 'accepted') {
+          clearUnsubmittedAgentInput(settings, ptyId)
+        }
+        markSubmitted()
+      }
+      void typeAgentTuiCommand({
+        command,
+        signal: controller.signal,
+        write: async (key) => {
+          if (isCancelled()) {
+            return 'rejected'
+          }
+          return (await sendRuntimePtyInputVerified(settings, ptyId, key)) ? 'accepted' : 'rejected'
+        }
+      }).then(finish, () => finish('rejected'))
+    },
+    {
+      onCancelUnsubmitted: () => {
+        controller.abort()
+        clearUnsubmittedAgentInput(settings, ptyId)
+      }
+    }
+  )
+}
+
 export function sendNativeChatMessageWithImageAttachments(
   settings: RuntimeSettings,
   ptyId: string,
diff --git a/src/renderer/src/components/native-chat/native-chat-session-option-apply.ts b/src/renderer/src/components/native-chat/native-chat-session-option-apply.ts
index 98481e1035c..5585512633a 100644
--- a/src/renderer/src/components/native-chat/native-chat-session-option-apply.ts
+++ b/src/renderer/src/components/native-chat/native-chat-session-option-apply.ts
@@ -109,7 +109,9 @@ async function handleAgentPicker(
   ctx: SessionOptionApplyContext,
   midSession: Extract<CatalogMidSessionApply, { kind: 'agent-picker' }>
 ): Promise<SessionOptionSetResult> {
-  await ctx.dispatchCommand(midSession.command)
+  await (midSession.delivery
+    ? ctx.dispatchCommand(midSession.command, { delivery: midSession.delivery })
+    : ctx.dispatchCommand(midSession.command))
   ctx.clearModelTruth()
   const snapshot = ctx.publish()
   ctx.onAgentPicker?.()
diff --git a/src/renderer/src/components/native-chat/native-chat-session-option-command-dispatch.ts b/src/renderer/src/components/native-chat/native-chat-session-option-command-dispatch.ts
index c510990dc5e..d7b071c55e3 100644
--- a/src/renderer/src/components/native-chat/native-chat-session-option-command-dispatch.ts
+++ b/src/renderer/src/components/native-chat/native-chat-session-option-command-dispatch.ts
@@ -1,4 +1,7 @@
-import type { CatalogAgentInteractionDetection } from '../../../../shared/agent-session-option-catalog'
+import type {
+  CatalogAgentInteractionDetection,
+  CatalogCommandDelivery
+} from '../../../../shared/agent-session-option-catalog'
 import type { ClaudeModelSwitchOutcome } from './claude-model-switch-confirmation'
 
 export type NativeChatSessionOptionDispatchResult = {
@@ -10,6 +13,7 @@ export type NativeChatSessionOptionDispatchCommand = (
   options?: {
     detectAgentInteraction?: CatalogAgentInteractionDetection
     expectedChoiceLabel?: string
+    delivery?: CatalogCommandDelivery
   }
 ) =>
   | Promise<NativeChatSessionOptionDispatchResult | void>
diff --git a/src/renderer/src/components/native-chat/native-chat-stream-teardown.ts b/src/renderer/src/components/native-chat/native-chat-stream-teardown.ts
new file mode 100644
index 00000000000..d640c14801d
--- /dev/null
+++ b/src/renderer/src/components/native-chat/native-chat-stream-teardown.ts
@@ -0,0 +1,24 @@
+import type { NativeChatSessionTransport } from './native-chat-session-transport'
+
+/** Normalizes desktop's synchronous teardown and the paired web bridge's deferred teardown. */
+export function openNativeChatTranscriptStream(
+  transport: NativeChatSessionTransport,
+  args: Parameters<NativeChatSessionTransport['subscribe']>[0],
+  onFrame: Parameters<NativeChatSessionTransport['subscribe']>[1]
+): () => void {
+  const teardown = transport.subscribe(args, onFrame) as unknown
+  if (typeof teardown === 'function') {
+    return teardown as () => void
+  }
+  if (!teardown || typeof (teardown as { then?: unknown }).then !== 'function') {
+    return () => undefined
+  }
+  const deferredTeardown = (teardown as Promise<unknown>).catch(() => undefined)
+  return () => {
+    void deferredTeardown.then((resolvedTeardown) => {
+      if (typeof resolvedTeardown === 'function') {
+        ;(resolvedTeardown as () => void)()
+      }
+    })
+  }
+}
diff --git a/src/renderer/src/components/native-chat/native-chat-view-types.ts b/src/renderer/src/components/native-chat/native-chat-view-types.ts
index 2dce759075d..ca374bab11c 100644
--- a/src/renderer/src/components/native-chat/native-chat-view-types.ts
+++ b/src/renderer/src/components/native-chat/native-chat-view-types.ts
@@ -1,9 +1,12 @@
 import type { TuiAgent } from '../../../../shared/types'
+import type { NativeChatSession } from '../../../../shared/native-chat-types'
 import type { NativeChatContextMenuActions } from './use-native-chat-context-menu'
 
 export type NativeChatViewProps = {
   /** The terminal tab hosting the agent. paneKey is `${tabId}:${leafId}`. */
   terminalTabId: string
+  /** Whether the hosted terminal surface is currently visible. */
+  isVisible: boolean
   /** Specific split leaf this chat surface replaces. */
   paneKey?: string
   /** PTY bound to `paneKey`, used for composer and interactive-card sends. */
@@ -18,3 +21,16 @@ export type NativeChatViewProps = {
   readTerminalScreen?: () => string | null
   contextMenuActions?: Omit<NativeChatContextMenuActions, 'onPaste'>
 }
+
+export type NativeChatResolvedViewProps = {
+  paneKey: string
+  agent: NativeChatSession['agent']
+  sessionId: string | null
+  transcriptPath: string | null
+  isVisible: boolean
+  targetPtyId: string | null
+  terminalTabId: string
+  onSwitchToTerminal?: () => void
+  readTerminalScreen?: () => string | null
+  contextMenuActions?: Omit<NativeChatContextMenuActions, 'onPaste'>
+}
diff --git a/src/renderer/src/components/native-chat/use-native-chat-assembled-messages.ts b/src/renderer/src/components/native-chat/use-native-chat-assembled-messages.ts
new file mode 100644
index 00000000000..7ec4beab524
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-native-chat-assembled-messages.ts
@@ -0,0 +1,86 @@
+import { useLayoutEffect, useMemo, useRef } from 'react'
+import type { AgentType, NativeChatMessage } from '../../../../shared/native-chat-types'
+import {
+  applyAppends,
+  createIncrementalAssembler,
+  type IncrementalChatAssembler,
+  reset as resetAssembler
+} from './native-chat-incremental-assembler'
+import { prepareNativeChatLiveMessages } from './native-chat-live-message-preparation'
+
+type AssemblyCache = {
+  assembler: IncrementalChatAssembler
+  baseSignature: string
+  baseMessages: readonly NativeChatMessage[]
+  transcript: readonly NativeChatMessage[]
+  assembledMessages: NativeChatMessage[]
+}
+
+function cloneAssembler(assembler: IncrementalChatAssembler): IncrementalChatAssembler {
+  return {
+    byId: new Map(assembler.byId),
+    byTurn: new Map(assembler.byTurn),
+    messages: assembler.messages
+  }
+}
+
+function sharesPrefix(
+  whole: readonly NativeChatMessage[],
+  prefix: readonly NativeChatMessage[],
+  length: number
+): boolean {
+  for (let index = 0; index < length; index += 1) {
+    if (whole[index] !== prefix[index]) {
+      return false
+    }
+  }
+  return true
+}
+
+/** Keeps transcript assembly off the status-only render axis. */
+export function useNativeChatAssembledMessages(args: {
+  agent: AgentType
+  sessionId: string | null
+  baseMessages: readonly NativeChatMessage[]
+  appended: NativeChatMessage[]
+}): { assembledMessages: NativeChatMessage[]; normalizedMessages: NativeChatMessage[] } {
+  const committedCacheRef = useRef<AssemblyCache | null>(null)
+  const { agent, sessionId, baseMessages, appended } = args
+
+  const assembly = useMemo<AssemblyCache>(() => {
+    const committed = committedCacheRef.current
+    const transcript =
+      appended.length > 0 ? [...baseMessages, ...appended] : (baseMessages as NativeChatMessage[])
+    const baseSignature = `${agent}\u0000${sessionId ?? ''}`
+    const baseChanged =
+      !committed ||
+      baseSignature !== committed.baseSignature ||
+      baseMessages !== committed.baseMessages
+    const applied = committed?.transcript ?? []
+    const isSuffixExtension =
+      !baseChanged &&
+      transcript.length >= applied.length &&
+      sharesPrefix(transcript, applied, applied.length)
+    // A discarded render must not mutate the last committed assembler.
+    const assembler = baseChanged
+      ? createIncrementalAssembler()
+      : cloneAssembler(committed.assembler)
+
+    const assembledMessages = isSuffixExtension
+      ? transcript.length > applied.length
+        ? applyAppends(assembler, transcript.slice(applied.length))
+        : assembler.messages
+      : resetAssembler(assembler, transcript)
+    return { assembler, baseSignature, baseMessages, transcript, assembledMessages }
+  }, [agent, appended, baseMessages, sessionId])
+
+  useLayoutEffect(() => {
+    committedCacheRef.current = assembly
+  }, [assembly])
+
+  const normalizedMessages = useMemo(
+    () => prepareNativeChatLiveMessages(assembly.assembledMessages, agent),
+    [agent, assembly.assembledMessages]
+  )
+  return { assembledMessages: assembly.assembledMessages, normalizedMessages }
+}
diff --git a/src/renderer/src/components/native-chat/use-native-chat-live-session-visibility.test.ts b/src/renderer/src/components/native-chat/use-native-chat-live-session-visibility.test.ts
new file mode 100644
index 00000000000..a4855b9600b
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-native-chat-live-session-visibility.test.ts
@@ -0,0 +1,397 @@
+// @vitest-environment happy-dom
+
+import { act, createElement } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+import { useAppStore } from '@/store'
+import { NATIVE_CHAT_INITIAL_LIMIT, nextNativeChatLimit } from './native-chat-pagination'
+
+const { resetTransport, subscriptions, transport } = vi.hoisted(() => {
+  type Subscription = {
+    onFrame: (frame: unknown) => void
+    unsubscribe: ReturnType<typeof vi.fn>
+  }
+  const subscriptions: Subscription[] = []
+  const transport = {
+    readSession: vi.fn(),
+    subscribe: vi.fn()
+  }
+  const resetTransport = (): void => {
+    subscriptions.splice(0)
+    transport.readSession.mockReset().mockImplementation(() => new Promise(() => {}))
+    transport.subscribe.mockReset().mockImplementation((_args, onFrame) => {
+      const subscription = { onFrame, unsubscribe: vi.fn() }
+      subscriptions.push(subscription)
+      return subscription.unsubscribe
+    })
+  }
+  return { resetTransport, subscriptions, transport }
+})
+
+vi.mock('./native-chat-session-transport', () => ({
+  getNativeChatSessionTransport: () => transport
+}))
+
+import type {
+  NativeChatLiveSession,
+  UseNativeChatLiveSessionArgs
+} from './use-native-chat-live-session'
+import { useNativeChatRetainedSession } from './use-native-chat-retained-session'
+
+const BASE_ARGS: UseNativeChatLiveSessionArgs = {
+  paneKey: 'tab-1:leaf-1',
+  agent: 'claude',
+  sessionId: 'session-1',
+  transcriptPath: '/remote/session-1.jsonl',
+  runtimeEnvironmentId: 'environment-1',
+  enabled: true
+}
+
+function assistant(id: string, timestamp: number): NativeChatMessage {
+  return {
+    id,
+    role: 'assistant',
+    blocks: [{ type: 'text', text: id }],
+    timestamp,
+    source: 'transcript'
+  }
+}
+
+function deferred<T>(): {
+  promise: Promise<T>
+  resolve: (value: T) => void
+  reject: (reason: unknown) => void
+} {
+  let resolve = (_value: T): void => {}
+  let reject = (_reason: unknown): void => {}
+  const promise = new Promise<T>((promiseResolve, promiseReject) => {
+    resolve = promiseResolve
+    reject = promiseReject
+  })
+  return { promise, reject, resolve }
+}
+
+describe('useNativeChatLiveSession visibility', () => {
+  let root: Root
+  let latest: NativeChatLiveSession | null = null
+  const renders = vi.fn()
+
+  function Probe(props: UseNativeChatLiveSessionArgs): null {
+    renders()
+    latest = useNativeChatRetainedSession(props)
+    return null
+  }
+
+  async function render(props: UseNativeChatLiveSessionArgs): Promise<void> {
+    await act(async () => {
+      root.render(createElement(Probe, props))
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+  }
+
+  async function emit(index: number, frame: unknown): Promise<void> {
+    await act(async () => {
+      subscriptions[index]?.onFrame(frame)
+      await Promise.resolve()
+    })
+  }
+
+  beforeEach(() => {
+    globalThis.IS_REACT_ACT_ENVIRONMENT = true
+    root = createRoot(document.createElement('div'))
+    latest = null
+    renders.mockClear()
+    resetTransport()
+    useAppStore.setState({ agentStatusByPaneKey: {} })
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    vi.useRealTimers()
+  })
+
+  it('does no transcript IO when initially hidden', async () => {
+    await render({ ...BASE_ARGS, enabled: false })
+
+    expect(transport.readSession).not.toHaveBeenCalled()
+    expect(transport.subscribe).not.toHaveBeenCalled()
+  })
+
+  it('unsubscribes on hide, retains committed messages, and rejects hidden work', async () => {
+    useAppStore.setState({
+      agentStatusByPaneKey: {
+        [BASE_ARGS.paneKey]: { state: 'working', stateStartedAt: 100 }
+      }
+    } as never)
+    await render(BASE_ARGS)
+    await emit(0, {
+      type: 'snapshot',
+      messages: [assistant('committed', 1)],
+      hasMore: true,
+      lifecycle: { state: 'working', turnId: 'turn-1', timestamp: 100 }
+    })
+    const staleLoadEarlier = latest?.loadEarlier
+
+    await render({ ...BASE_ARGS, enabled: false })
+
+    expect(subscriptions[0]?.unsubscribe).toHaveBeenCalledOnce()
+    expect(latest?.messages.map((message) => message.id)).toEqual(['committed'])
+    expect(latest?.readPhase).toBe('ready')
+    expect(latest?.status).toBe('working')
+
+    const readsAfterHide = transport.readSession.mock.calls.length
+    staleLoadEarlier?.()
+    latest?.loadEarlier()
+    expect(transport.readSession).toHaveBeenCalledTimes(readsAfterHide)
+
+    const rendersAfterHide = renders.mock.calls.length
+    await act(async () => {
+      for (let index = 0; index < 1_000; index += 1) {
+        subscriptions[0]?.onFrame({
+          type: 'appended',
+          messages: [assistant(`stale-hidden-${index}`, index + 2)]
+        })
+      }
+      await Promise.resolve()
+    })
+    expect(renders).toHaveBeenCalledTimes(rendersAfterHide)
+    expect(latest?.messages.map((message) => message.id)).toEqual(['committed'])
+  })
+
+  it('cancels a not-found retry when hidden', async () => {
+    vi.useFakeTimers()
+    transport.readSession.mockResolvedValue({ error: 'not found', notFound: true })
+
+    await render(BASE_ARGS)
+    expect(transport.readSession).toHaveBeenCalledOnce()
+
+    await render({ ...BASE_ARGS, enabled: false })
+    await act(async () => vi.advanceTimersByTimeAsync(60_000))
+
+    expect(transport.readSession).toHaveBeenCalledOnce()
+    expect(subscriptions[0]?.unsubscribe).toHaveBeenCalledOnce()
+  })
+
+  it('reopens one fresh stream whose snapshot wins every stale generation', async () => {
+    const oldSeed = deferred<{ messages: NativeChatMessage[] }>()
+    const freshSeed = deferred<{ messages: NativeChatMessage[] }>()
+    transport.readSession
+      .mockImplementationOnce(() => oldSeed.promise)
+      .mockImplementationOnce(() => freshSeed.promise)
+
+    await render(BASE_ARGS)
+    await emit(0, {
+      type: 'snapshot',
+      messages: [assistant('before-hide', 1)],
+      hasMore: false
+    })
+    await render({ ...BASE_ARGS, enabled: false })
+    await render(BASE_ARGS)
+
+    expect(transport.readSession).toHaveBeenCalledTimes(2)
+    expect(transport.subscribe).toHaveBeenCalledTimes(2)
+    expect(subscriptions[0]?.unsubscribe).toHaveBeenCalledOnce()
+    expect(subscriptions[1]?.unsubscribe).not.toHaveBeenCalled()
+    expect(latest?.readPhase).toBe('loading')
+    expect(latest?.messages.map((message) => message.id)).toEqual(['before-hide'])
+
+    await emit(1, {
+      type: 'snapshot',
+      messages: [assistant('fresh', 3)],
+      hasMore: false
+    })
+    await emit(0, {
+      type: 'replacement',
+      messages: [assistant('stale-stream', 4)],
+      hasMore: false
+    })
+    await act(async () => {
+      oldSeed.resolve({ messages: [assistant('stale-old-seed', 5)] })
+      freshSeed.resolve({ messages: [assistant('stale-fresh-seed', 6)] })
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+
+    expect(latest?.messages.map((message) => message.id)).toEqual(['fresh'])
+  })
+
+  it('closes a deferred paired-client stream after a rapid hide and reveal', async () => {
+    const deferredTeardown = deferred<() => void>()
+    const oldUnsubscribe = vi.fn()
+    transport.subscribe.mockImplementationOnce((_args, onFrame) => {
+      subscriptions.push({ onFrame, unsubscribe: oldUnsubscribe })
+      return deferredTeardown.promise
+    })
+
+    await render(BASE_ARGS)
+    await render({ ...BASE_ARGS, enabled: false })
+    await render(BASE_ARGS)
+
+    expect(transport.subscribe).toHaveBeenCalledTimes(2)
+    expect(subscriptions).toHaveLength(2)
+    expect(subscriptions[1]?.unsubscribe).not.toHaveBeenCalled()
+
+    await act(async () => {
+      deferredTeardown.resolve(oldUnsubscribe)
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+
+    expect(oldUnsubscribe).toHaveBeenCalledOnce()
+    expect(subscriptions[1]?.unsubscribe).not.toHaveBeenCalled()
+  })
+
+  it('contains a deferred paired-client stream-handle rejection', async () => {
+    const deferredTeardown = deferred<() => void>()
+    transport.subscribe.mockImplementationOnce((_args, onFrame) => {
+      subscriptions.push({ onFrame, unsubscribe: vi.fn() })
+      return deferredTeardown.promise
+    })
+
+    await render(BASE_ARGS)
+    await act(async () => {
+      deferredTeardown.reject(new Error('stream setup failed'))
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+    await render({ ...BASE_ARGS, enabled: false })
+
+    expect(transport.subscribe).toHaveBeenCalledOnce()
+  })
+
+  it('drops retained messages when the hidden transcript identity changes', async () => {
+    await render(BASE_ARGS)
+    await emit(0, {
+      type: 'snapshot',
+      messages: [assistant('session-a', 1)],
+      hasMore: false
+    })
+    await render({ ...BASE_ARGS, enabled: false })
+    const hiddenSessionB = {
+      ...BASE_ARGS,
+      enabled: false,
+      sessionId: 'session-2',
+      transcriptPath: '/remote/session-2.jsonl',
+      runtimeEnvironmentId: 'environment-2'
+    }
+
+    await render(hiddenSessionB)
+    await render(hiddenSessionB)
+
+    expect(transport.readSession).toHaveBeenCalledOnce()
+    expect(transport.subscribe).toHaveBeenCalledOnce()
+    expect(latest?.readPhase).toBe('loading')
+    expect(latest?.messages).toEqual([])
+
+    await render({ ...hiddenSessionB, enabled: true })
+    await emit(1, {
+      type: 'snapshot',
+      messages: [assistant('session-b', 2)],
+      hasMore: false
+    })
+
+    expect(transport.readSession).toHaveBeenCalledTimes(2)
+    expect(transport.subscribe).toHaveBeenCalledTimes(2)
+    expect(latest?.messages.map((message) => message.id)).toEqual(['session-b'])
+  })
+
+  it('reveals with the paged window and restarts it only on a source change', async () => {
+    const pagedLimit = nextNativeChatLimit(NATIVE_CHAT_INITIAL_LIMIT)
+    transport.readSession.mockResolvedValue({ messages: [assistant('read', 0)] })
+    const initialMessages = Array.from({ length: NATIVE_CHAT_INITIAL_LIMIT }, (_unused, index) =>
+      assistant(`old-${index}`, index)
+    )
+
+    await render(BASE_ARGS)
+    await emit(0, { type: 'snapshot', messages: initialMessages, hasMore: true })
+    await act(async () => {
+      latest?.loadEarlier()
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+    expect(transport.readSession.mock.calls[1]?.[2]).toBe(pagedLimit)
+
+    await render({ ...BASE_ARGS, enabled: false })
+    await render(BASE_ARGS)
+
+    expect(transport.readSession.mock.calls[2]?.[2]).toBe(pagedLimit)
+    expect(transport.subscribe.mock.calls[1]?.[0]?.limit).toBe(pagedLimit)
+
+    await render({
+      ...BASE_ARGS,
+      sessionId: 'session-2',
+      transcriptPath: '/remote/session-2.jsonl'
+    })
+
+    expect(transport.readSession.mock.calls[3]?.[2]).toBe(NATIVE_CHAT_INITIAL_LIMIT)
+  })
+
+  it('lets the pending read repair a stream error frame', async () => {
+    const seed = deferred<{ messages: NativeChatMessage[] }>()
+    transport.readSession.mockImplementationOnce(() => seed.promise)
+
+    await render(BASE_ARGS)
+    await emit(0, { type: 'snapshot', messages: [], hasMore: false, error: 'stream failed' })
+    expect(latest?.status).toBe('error')
+
+    await act(async () => {
+      seed.resolve({ messages: [assistant('seeded', 1)] })
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+
+    expect(latest?.readPhase).toBe('ready')
+    expect(latest?.messages.map((message) => message.id)).toEqual(['seeded'])
+  })
+
+  it('keeps the retained transcript when the reveal stream errors', async () => {
+    await render(BASE_ARGS)
+    await emit(0, {
+      type: 'snapshot',
+      messages: [assistant('committed', 1)],
+      hasMore: false
+    })
+    await render({ ...BASE_ARGS, enabled: false })
+    await render(BASE_ARGS)
+    await emit(1, { type: 'snapshot', messages: [], hasMore: false, error: 'stream failed' })
+
+    expect(latest?.messages.map((message) => message.id)).toEqual(['committed'])
+    expect(latest?.status).not.toBe('error')
+  })
+
+  it('fences pagination started before a rapid hide and reveal', async () => {
+    const initialSeed = deferred<{ messages: NativeChatMessage[] }>()
+    const oldPage = deferred<{ messages: NativeChatMessage[] }>()
+    const revealSeed = deferred<{ messages: NativeChatMessage[] }>()
+    transport.readSession
+      .mockImplementationOnce(() => initialSeed.promise)
+      .mockImplementationOnce(() => oldPage.promise)
+      .mockImplementationOnce(() => revealSeed.promise)
+    const initialMessages = Array.from({ length: NATIVE_CHAT_INITIAL_LIMIT }, (_unused, index) =>
+      assistant(`old-${index}`, index)
+    )
+
+    await render(BASE_ARGS)
+    await emit(0, { type: 'snapshot', messages: initialMessages, hasMore: true })
+    await act(async () => latest?.loadEarlier())
+    expect(transport.readSession).toHaveBeenCalledTimes(2)
+
+    await render({ ...BASE_ARGS, enabled: false })
+    await render(BASE_ARGS)
+    await emit(1, {
+      type: 'snapshot',
+      messages: [assistant('fresh-after-reveal', 1_000)],
+      hasMore: false
+    })
+    await act(async () => {
+      oldPage.resolve({ messages: [assistant('stale-page', -1)] })
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+
+    expect(transport.readSession).toHaveBeenCalledTimes(3)
+    expect(latest?.messages.map((message) => message.id)).toEqual(['fresh-after-reveal'])
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-native-chat-live-session.ts b/src/renderer/src/components/native-chat/use-native-chat-live-session.ts
index a50f8683426..6044da30673 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-live-session.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-live-session.ts
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
 import {
   NATIVE_CHAT_SOURCE_PRIORITY,
   type AgentType,
@@ -10,13 +10,7 @@ import {
   createNativeChatMerger,
   replaceList
 } from '../../../../shared/native-chat-merge'
-import {
-  applyAppends,
-  createIncrementalAssembler,
-  reset as resetAssembler
-} from './native-chat-incremental-assembler'
 import { mergeNativeChatLiveSession } from './native-chat-live-status'
-import { prepareNativeChatLiveMessages } from './native-chat-live-message-preparation'
 import {
   hasMoreNativeChatHistory,
   NATIVE_CHAT_INITIAL_LIMIT,
@@ -25,6 +19,9 @@ import {
 import { getNativeChatSessionTransport } from './native-chat-session-transport'
 import { useNativeChatTranscriptLifecycle } from './use-native-chat-transcript-lifecycle'
 import { useNativeChatHookStatus } from './use-native-chat-hook-status'
+import { useNativeChatAssembledMessages } from './use-native-chat-assembled-messages'
+import { createNativeChatReadRetryTimer } from './native-chat-read-retry-timer'
+import { openNativeChatTranscriptStream } from './native-chat-stream-teardown'
 
 export type UseNativeChatLiveSessionArgs = {
   /** Composite `${tabId}:${leafId}` key — selects the live hook entry. */
@@ -36,6 +33,8 @@ export type UseNativeChatLiveSessionArgs = {
   transcriptPath?: string | null
   /** Runtime owner (Model B): non-null routes read/subscribe to the remote host; null keeps the local IPC path. */
   runtimeEnvironmentId?: string | null
+  /** False suspends transcript IO while retaining the last committed session. */
+  enabled?: boolean
 }
 
 /** A live session plus the older-history pagination controls the view needs. */
@@ -55,20 +54,6 @@ export type NativeChatLiveSession = NativeChatSession & {
 // Stable empty-base reference so a non-ready read doesn't churn the base axis.
 const EMPTY_MESSAGES: readonly NativeChatMessage[] = []
 
-/** True when `whole`'s first `len` entries are referentially identical to `prefix` (a tail-extension), so the assembler can splice just the suffix. */
-function sharesPrefix(
-  whole: readonly NativeChatMessage[],
-  prefix: readonly NativeChatMessage[],
-  len: number
-): boolean {
-  for (let i = 0; i < len; i += 1) {
-    if (whole[i] !== prefix[i]) {
-      return false
-    }
-  }
-  return true
-}
-
 let subscriptionCounter = 0
 
 function nextSubscriptionId(): string {
@@ -76,15 +61,9 @@ function nextSubscriptionId(): string {
   return `native-chat-${subscriptionCounter}-${Date.now()}`
 }
 
-// Why: a new session's transcript can take minutes to appear on disk (#8401); a `notFound` miss retries with backoff until the window below elapses.
-const NOTFOUND_RETRY_DELAYS_MS = [1_000, 2_000, 4_000, 8_000]
-const NOTFOUND_RETRY_FIXED_DELAY_MS = 10_000
+// Why: a new session's transcript can take minutes to appear on disk (#8401).
 const NOTFOUND_RETRY_WINDOW_MS = 60_000
 
-function notFoundRetryDelayMs(attempt: number): number {
-  return NOTFOUND_RETRY_DELAYS_MS[attempt] ?? NOTFOUND_RETRY_FIXED_DELAY_MS
-}
-
 export type ReadState =
   | { phase: 'loading' }
   | { phase: 'ready'; messages: NativeChatMessage[] }
@@ -101,13 +80,13 @@ export type ReadState =
  * Transport: per-owner (getNativeChatSessionTransport) — a runtime-owned pane
  * (Model B) reads/tails the remote host; local/ssh panes keep the local IPC path.
  *
- * Teardown: subscription closes on unmount and on owner/agent/sessionId change so
- * a swap or owner-flip never leaks a watcher.
+ * Teardown: subscription closes when hidden, unmounted, or rebound so no source
+ * generation leaks a watcher.
  */
 export function useNativeChatLiveSession(
   args: UseNativeChatLiveSessionArgs
 ): NativeChatLiveSession {
-  const { paneKey, agent, sessionId, transcriptPath, runtimeEnvironmentId } = args
+  const { paneKey, agent, sessionId, transcriptPath, runtimeEnvironmentId, enabled = true } = args
   // Stable per owner id so a re-render without an owner flip keeps the same transport and doesn't re-subscribe.
   const transport = useMemo(
     () => getNativeChatSessionTransport(runtimeEnvironmentId ?? null),
@@ -127,23 +106,43 @@ export function useNativeChatLiveSession(
 
   const [hookState, hookStateStartedAt, hookHasWorkingSubagents] = useNativeChatHookStatus(paneKey)
 
+  const latestEnabled = useRef(enabled)
+  // Fence late frames before passive cleanup closes the previous stream.
+  useLayoutEffect(() => {
+    latestEnabled.current = enabled
+  }, [enabled])
   const latestSessionId = useRef<string | null>(sessionId)
   latestSessionId.current = sessionId
   // Tracks the current transport so a load-earlier resolve from a prior host is discarded after an owner flip (session id can stay the same).
   const latestTransport = useRef(transport)
   latestTransport.current = transport
   const transcriptEpochRef = useRef(0)
-
-  // Incremental assembler: suffix-extensions take the fast append path, anything else resets so the cache can't drift from a full rebuild (#17).
-  const assemblerRef = useRef(createIncrementalAssembler())
-  const appliedTranscriptRef = useRef<readonly NativeChatMessage[]>([])
-  const baseSigRef = useRef<string | null>(null)
-  const baseMessagesRef = useRef<readonly NativeChatMessage[]>(EMPTY_MESSAGES)
+  const sourceKey = JSON.stringify([
+    paneKey,
+    runtimeEnvironmentId ?? null,
+    agent,
+    sessionId,
+    transcriptPath ?? null
+  ])
+  const retainedSourceKeyRef = useRef(sourceKey)
 
   useEffect(() => {
     // Why: agent/path/owner rebinds can keep the same session; every source generation must invalidate pagination captured before it.
     transcriptEpochRef.current += 1
     setLoadingEarlier(false)
+    const sourceChanged = retainedSourceKeyRef.current !== sourceKey
+    retainedSourceKeyRef.current = sourceKey
+    if (!enabled) {
+      if (sourceChanged) {
+        limitRef.current = NATIVE_CHAT_INITIAL_LIMIT
+        transcriptLifecycleControl.reset()
+        setRead({ phase: 'loading' })
+        replaceList(appendMergerRef.current, [])
+        setAppended([])
+        setHasMore(false)
+      }
+      return () => undefined
+    }
     transcriptLifecycleControl.reset()
     if (!sessionId) {
       // No session id yet: surface live hook state on an empty transcript; backfills once the id arrives.
@@ -151,17 +150,20 @@ export function useNativeChatLiveSession(
       replaceList(appendMergerRef.current, [])
       setAppended([])
       setHasMore(false)
-      return
+      return () => undefined
     }
 
     let cancelled = false
     // Set by the first authoritative frame so the readSession seed below can't clobber a live snapshot.
     let frameArrived = false
-    let retryTimer: ReturnType<typeof setTimeout> | null = null
+    const retryTimer = createNativeChatReadRetryTimer()
     const retryStartedAt = Date.now()
     // Re-bound as a const: TS drops the `!sessionId` narrowing inside the hoisted nested function.
     const activeSessionId = sessionId
-    limitRef.current = NATIVE_CHAT_INITIAL_LIMIT
+    // Why: a reveal re-reads the same source, so keep the window the user paged in; only a new source starts over.
+    if (sourceChanged) {
+      limitRef.current = NATIVE_CHAT_INITIAL_LIMIT
+    }
     setRead({ phase: 'loading' })
     replaceList(appendMergerRef.current, [])
     setAppended([])
@@ -169,22 +171,19 @@ export function useNativeChatLiveSession(
 
     // Independent initial seed in case subscribe never delivers a snapshot; applied only until an authoritative frame lands so a live snapshot wins.
     function loadSession(attempt: number): void {
-      if (frameArrived) {
+      if (!latestEnabled.current || frameArrived) {
         return
       }
       void transport
         .readSession(agent, activeSessionId, limitRef.current, transcriptPath ?? undefined)
         .then((result) => {
-          if (cancelled || frameArrived) {
+          if (cancelled || !latestEnabled.current || frameArrived) {
             return
           }
           if (result && 'error' in result) {
             // A not-yet-flushed transcript: stay in 'loading' and retry with backoff instead of a permanent error (#8401).
             if (result.notFound && Date.now() - retryStartedAt < NOTFOUND_RETRY_WINDOW_MS) {
-              retryTimer = setTimeout(() => {
-                retryTimer = null
-                loadSession(attempt + 1)
-              }, notFoundRetryDelayMs(attempt))
+              retryTimer.schedule(attempt, () => loadSession(attempt + 1))
               return
             }
             setRead({ phase: 'error', error: result.error })
@@ -196,7 +195,7 @@ export function useNativeChatLiveSession(
           setHasMore(hasMoreNativeChatHistory(messages.length, limitRef.current))
         })
         .catch((err: unknown) => {
-          if (!cancelled && !frameArrived) {
+          if (!cancelled && latestEnabled.current && !frameArrived) {
             setRead({ phase: 'error', error: err instanceof Error ? err.message : String(err) })
           }
         })
@@ -205,7 +204,8 @@ export function useNativeChatLiveSession(
     loadSession(0)
 
     const subscriptionId = nextSubscriptionId()
-    const unsubscribe = transport.subscribe(
+    const closeStream = openNativeChatTranscriptStream(
+      transport,
       {
         subscriptionId,
         agent,
@@ -214,53 +214,48 @@ export function useNativeChatLiveSession(
         limit: limitRef.current
       },
       (frame) => {
-        if (!cancelled) {
-          if (frame.type === 'snapshot' || frame.type === 'replacement') {
-            // Why: snapshots and inode replacements are authoritative generations; older pagination must not repaint them.
-            frameArrived = true
-            transcriptEpochRef.current += 1
-            setLoadingEarlier(false)
-            if ('error' in frame && frame.error) {
-              setRead({ phase: 'error', error: frame.error })
-              return
-            }
-            transcriptLifecycleControl.replace(frame.lifecycle)
-            replaceList(appendMergerRef.current, frame.messages)
-            setAppended([])
-            setRead({ phase: 'ready', messages: appendMergerRef.current.list })
-            setHasMore(frame.hasMore)
+        if (cancelled || !latestEnabled.current) {
+          return
+        }
+        if (frame.type === 'snapshot' || frame.type === 'replacement') {
+          // Why: snapshots and inode replacements are authoritative generations; older pagination must not repaint them.
+          transcriptEpochRef.current += 1
+          setLoadingEarlier(false)
+          if ('error' in frame && frame.error) {
+            // Why: an error frame carries no transcript, so it must not consume the seed — a healthy read still has to repair the pane.
+            setRead({ phase: 'error', error: frame.error })
             return
           }
-          transcriptLifecycleControl.append(frame.lifecycle)
-          // Merge by id then bound to the window; the base read + assembler re-dedup mean trimming the append tail can't drop a covered turn (#6).
-          setAppended(applyAppend(appendMergerRef.current, frame.messages, limitRef.current))
+          frameArrived = true
+          transcriptLifecycleControl.replace(frame.lifecycle)
+          replaceList(appendMergerRef.current, frame.messages)
+          setAppended([])
+          setRead({ phase: 'ready', messages: appendMergerRef.current.list })
+          setHasMore(frame.hasMore)
+          return
         }
+        transcriptLifecycleControl.append(frame.lifecycle)
+        // Merge by id then bound to the window; the base read + assembler re-dedup mean trimming the append tail can't drop a covered turn (#6).
+        setAppended(applyAppend(appendMergerRef.current, frame.messages, limitRef.current))
       }
     )
 
     return () => {
       cancelled = true
-      if (retryTimer) {
-        clearTimeout(retryTimer)
-        retryTimer = null
-      }
-      // Web RPC bridge returns a Promise (not the desktop sync unsubscribe fn); calling it as a function crashed the view, so resolve first.
-      const teardown = unsubscribe as unknown
-      if (typeof teardown === 'function') {
-        ;(teardown as () => void)()
-      } else if (teardown && typeof (teardown as { then?: unknown }).then === 'function') {
-        void (teardown as Promise<unknown>).then((fn) => {
-          if (typeof fn === 'function') {
-            ;(fn as () => void)()
-          }
-        })
-      }
+      retryTimer.cancel()
+      closeStream()
     }
     // `transport` identity changes on an owner flip, re-running this effect to re-subscribe against the new host.
-  }, [agent, sessionId, transcriptPath, transport, transcriptLifecycleControl])
+  }, [agent, enabled, sessionId, sourceKey, transcriptPath, transport, transcriptLifecycleControl])
 
   const loadEarlier = useCallback(() => {
-    if (!sessionId || loadingEarlier || !hasMore || read.phase !== 'ready') {
+    if (
+      !latestEnabled.current ||
+      !sessionId ||
+      loadingEarlier ||
+      !hasMore ||
+      read.phase !== 'ready'
+    ) {
       return
     }
     const nextLimit = nextNativeChatLimit(limitRef.current)
@@ -272,6 +267,7 @@ export function useNativeChatLiveSession(
       .then((result) => {
         // Ignore a stale resolve from a swapped session or flipped owner — either would paint the wrong host's history.
         if (
+          !latestEnabled.current ||
           latestSessionId.current !== sessionId ||
           latestTransport.current !== transport ||
           transcriptEpochRef.current !== requestEpoch
@@ -292,7 +288,7 @@ export function useNativeChatLiveSession(
       })
       .finally(() => {
         // Clear the loading flag on the current epoch even when the result is discarded, so a stale resolve can't wedge it true.
-        if (transcriptEpochRef.current === requestEpoch) {
+        if (latestEnabled.current && transcriptEpochRef.current === requestEpoch) {
           setLoadingEarlier(false)
         }
       })
@@ -309,39 +305,12 @@ export function useNativeChatLiveSession(
 
   // Computed outside the status memo so hookState churn (status-only) never re-runs the assembler.
   const baseMessages = read.phase === 'ready' ? read.messages : EMPTY_MESSAGES
-  const assembledMessages = useMemo(() => {
-    const transcript =
-      appended.length > 0 ? [...baseMessages, ...appended] : (baseMessages as NativeChatMessage[])
-    // Base-axis signature: any change forces a full assembler reset so a missed trigger can't leave the cache stale.
-    const baseSig = `${agent}\u0000${sessionId ?? ''}`
-    const baseChanged = baseSig !== baseSigRef.current || baseMessages !== baseMessagesRef.current
-    const applied = appliedTranscriptRef.current
-    const isSuffixExtension =
-      !baseChanged &&
-      transcript.length >= applied.length &&
-      sharesPrefix(transcript, applied, applied.length)
-
-    let out: NativeChatMessage[]
-    if (isSuffixExtension && transcript.length > applied.length) {
-      out = applyAppends(assemblerRef.current, transcript.slice(applied.length))
-    } else if (isSuffixExtension) {
-      out = assemblerRef.current.messages
-    } else {
-      out = resetAssembler(assemblerRef.current, transcript)
-    }
-    baseSigRef.current = baseSig
-    baseMessagesRef.current = baseMessages
-    appliedTranscriptRef.current = transcript
-    return out
-    // baseMessages/appended are the only message-set inputs; sessionId/agent gate the reset. hookState intentionally excluded.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [baseMessages, appended, sessionId, agent])
-
-  // Keep presentation transforms off the status-only render axis.
-  const normalizedMessages = useMemo(
-    () => prepareNativeChatLiveMessages(assembledMessages, agent),
-    [assembledMessages, agent]
-  )
+  const { assembledMessages, normalizedMessages } = useNativeChatAssembledMessages({
+    agent,
+    sessionId,
+    baseMessages,
+    appended
+  })
 
   return useMemo<NativeChatLiveSession>(() => {
     const session = mergeNativeChatLiveSession({
diff --git a/src/renderer/src/components/native-chat/use-native-chat-picker-command-dispatch.test.tsx b/src/renderer/src/components/native-chat/use-native-chat-picker-command-dispatch.test.tsx
new file mode 100644
index 00000000000..90c495a2bc7
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-native-chat-picker-command-dispatch.test.tsx
@@ -0,0 +1,73 @@
+// @vitest-environment happy-dom
+
+import { act, renderHook } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { EMPTY_HISTORY } from './native-chat-composer-state'
+
+const sendNativeChatMessage = vi.fn()
+const sendNativeChatTypedCommand = vi.fn()
+
+vi.mock('./native-chat-runtime-send', () => ({
+  sendNativeChatMessage: (...args: unknown[]) => sendNativeChatMessage(...args),
+  sendNativeChatTypedCommand: (...args: unknown[]) => sendNativeChatTypedCommand(...args)
+}))
+vi.mock('@/lib/native-chat-telemetry', () => ({
+  emitNativeChatMessageSent: vi.fn(),
+  emitNativeChatPickerItemAccepted: vi.fn(),
+  emitNativeChatSendClassified: vi.fn()
+}))
+
+import { useNativeChatPickerCommandDispatch } from './use-native-chat-picker-command-dispatch'
+
+const COMMAND = {
+  kind: 'command' as const,
+  id: 'command:status',
+  name: 'status',
+  description: 'Show status',
+  skillCollision: false
+}
+
+function renderDispatch(agent: 'codex' | 'claude' | 'openclaude') {
+  return renderHook(() =>
+    useNativeChatPickerCommandDispatch({
+      agent,
+      disabled: false,
+      isDispatchingSessionOption: false,
+      resolveTarget: () => ({ settings: {}, ptyId: 'pty-1' }),
+      sessionOptionsSurface: null,
+      trackPendingSend: vi.fn(),
+      setHistory: vi.fn((update) => update(EMPTY_HISTORY)),
+      setDraft: vi.fn(),
+      setCaret: vi.fn(),
+      setActiveSuggestion: vi.fn(),
+      clearSkillOrigin: vi.fn(),
+      clearImageAttachments: vi.fn(),
+      setNotice: vi.fn()
+    })
+  )
+}
+
+describe('useNativeChatPickerCommandDispatch', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    const handle = { cancel: vi.fn(), settleAfterMs: 0 }
+    sendNativeChatMessage.mockReturnValue(handle)
+    sendNativeChatTypedCommand.mockReturnValue(handle)
+  })
+
+  it('types Codex autocomplete commands', () => {
+    const hook = renderDispatch('codex')
+    act(() => hook.result.current(COMMAND))
+
+    expect(sendNativeChatTypedCommand).toHaveBeenCalledWith({}, 'pty-1', '/status')
+    expect(sendNativeChatMessage).not.toHaveBeenCalled()
+  })
+
+  it.each(['claude', 'openclaude'] as const)('keeps %s autocomplete commands pasted', (agent) => {
+    const hook = renderDispatch(agent)
+    act(() => hook.result.current(COMMAND))
+
+    expect(sendNativeChatMessage).toHaveBeenCalledWith({}, 'pty-1', '/status')
+    expect(sendNativeChatTypedCommand).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-native-chat-picker-command-dispatch.ts b/src/renderer/src/components/native-chat/use-native-chat-picker-command-dispatch.ts
index 66f34362fce..0022514fd97 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-picker-command-dispatch.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-picker-command-dispatch.ts
@@ -5,7 +5,7 @@ import {
   emitNativeChatPickerItemAccepted,
   emitNativeChatSendClassified
 } from '@/lib/native-chat-telemetry'
-import { sendNativeChatMessage } from './native-chat-runtime-send'
+import { sendNativeChatMessage, sendNativeChatTypedCommand } from './native-chat-runtime-send'
 import {
   nativeChatComposerTargetIsRemote,
   type NativeChatResolvedTarget
@@ -57,7 +57,11 @@ export function useNativeChatPickerCommandDispatch(args: {
       if (!target || disabled || isDispatchingSessionOption) {
         return
       }
-      trackPendingSend(sendNativeChatMessage(target.settings, target.ptyId, text))
+      trackPendingSend(
+        agent === 'codex'
+          ? sendNativeChatTypedCommand(target.settings, target.ptyId, text)
+          : sendNativeChatMessage(target.settings, target.ptyId, text)
+      )
       emitNativeChatPickerItemAccepted({ agent, itemKind: 'command' })
       // Why: picker dispatch is a catalog-verified command send; it must leave
       // the same telemetry and composer state as the typed path — including
diff --git a/src/renderer/src/components/native-chat/use-native-chat-retained-session.test.ts b/src/renderer/src/components/native-chat/use-native-chat-retained-session.test.ts
index 17b5801b05a..bee8efe98ed 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-retained-session.test.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-retained-session.test.ts
@@ -88,6 +88,28 @@ describe('useNativeChatRetainedSession', () => {
     expect(latest?.messages).toEqual([])
   })
 
+  it('keeps retained messages instead of a full-pane read error', async () => {
+    liveSession.mockReturnValue(session('ready', [message('settled')]))
+    await render(ARGS)
+
+    liveSession.mockReturnValue({ ...session('error', []), status: 'error', error: 'read failed' })
+    await render(ARGS)
+
+    expect(latest?.messages.map((entry) => entry.id)).toEqual(['settled'])
+    expect(latest?.readPhase).toBe('error')
+    expect(latest?.status).toBe('ready')
+    expect(latest?.error).toBeUndefined()
+  })
+
+  it('surfaces a read error when nothing was retained', async () => {
+    liveSession.mockReturnValue({ ...session('error', []), status: 'error', error: 'read failed' })
+    await render(ARGS)
+
+    expect(latest?.messages).toEqual([])
+    expect(latest?.status).toBe('error')
+    expect(latest?.error).toBe('read failed')
+  })
+
   it('does not overwrite retention with the session-less view', async () => {
     liveSession.mockReturnValue(session('ready', [message('settled')]))
     await render(ARGS)
diff --git a/src/renderer/src/components/native-chat/use-native-chat-retained-session.ts b/src/renderer/src/components/native-chat/use-native-chat-retained-session.ts
index e10ccecf5aa..6d176f2ac55 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-retained-session.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-retained-session.ts
@@ -38,16 +38,17 @@ export function useNativeChatRetainedSession(
   const messages = retentionRef.current.visible({
     identity,
     messages: session.messages,
-    settled: readPhase === 'ready',
-    loading: readPhase === 'loading'
+    settled: readPhase === 'ready'
   })
   if (messages === session.messages && readPhase === session.readPhase) {
     return session
   }
-  return {
-    ...session,
-    messages,
-    readPhase,
-    ...(sessionMatchesIdentity ? {} : { status: 'loading' as const, error: undefined })
+  if (!sessionMatchesIdentity) {
+    return { ...session, messages, readPhase, status: 'loading', error: undefined }
   }
+  // Retained history beats the full-pane error: a reveal-time read/stream failure is usually transient.
+  if (session.status === 'error' && messages.length > 0) {
+    return { ...session, messages, readPhase, status: 'ready', error: undefined }
+  }
+  return { ...session, messages, readPhase }
 }
diff --git a/src/renderer/src/components/native-chat/use-native-chat-session-option-command.test.tsx b/src/renderer/src/components/native-chat/use-native-chat-session-option-command.test.tsx
new file mode 100644
index 00000000000..5a43cd9b4be
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-native-chat-session-option-command.test.tsx
@@ -0,0 +1,64 @@
+// @vitest-environment happy-dom
+
+import { act, renderHook } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const sendNativeChatMessageVerified = vi.fn()
+const typeNativeChatCommand = vi.fn()
+
+vi.mock('./native-chat-runtime-send', () => ({
+  sendNativeChatMessageVerified: (...args: unknown[]) => sendNativeChatMessageVerified(...args),
+  typeNativeChatCommand: (...args: unknown[]) => typeNativeChatCommand(...args)
+}))
+vi.mock('./native-chat-pty-send-queue', () => ({
+  cancelNativeChatPtySends: vi.fn(),
+  waitForNativeChatPtyIdle: vi.fn()
+}))
+vi.mock('@/lib/native-chat-telemetry', () => ({ emitNativeChatMessageSent: vi.fn() }))
+
+import { useNativeChatSessionOptionCommand } from './use-native-chat-session-option-command'
+
+function renderDispatch(agent: 'codex' | 'claude' | 'openclaude') {
+  return renderHook(() =>
+    useNativeChatSessionOptionCommand({
+      agent,
+      disabled: false,
+      resolveTarget: () => ({ settings: {}, ptyId: 'pty-1' }),
+      setHistory: vi.fn()
+    })
+  )
+}
+
+describe('useNativeChatSessionOptionCommand', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    sendNativeChatMessageVerified.mockResolvedValue(true)
+    typeNativeChatCommand.mockResolvedValue(true)
+  })
+
+  it('types Codex option commands even without caller delivery metadata', async () => {
+    const hook = renderDispatch('codex')
+    await act(() => hook.result.current.dispatch('/model'))
+
+    expect(typeNativeChatCommand).toHaveBeenCalledWith(
+      {},
+      'pty-1',
+      '/model',
+      expect.any(AbortSignal)
+    )
+    expect(sendNativeChatMessageVerified).not.toHaveBeenCalled()
+  })
+
+  it.each(['claude', 'openclaude'] as const)('keeps %s option commands pasted', async (agent) => {
+    const hook = renderDispatch(agent)
+    await act(() => hook.result.current.dispatch('/model sonnet', { delivery: 'type' }))
+
+    expect(sendNativeChatMessageVerified).toHaveBeenCalledWith(
+      {},
+      'pty-1',
+      '/model sonnet',
+      expect.any(AbortSignal)
+    )
+    expect(typeNativeChatCommand).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-native-chat-session-option-command.ts b/src/renderer/src/components/native-chat/use-native-chat-session-option-command.ts
index 96d3cbdf479..b5c6e5da9fc 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-session-option-command.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-session-option-command.ts
@@ -6,7 +6,7 @@ import {
   type NativeChatResolvedTarget
 } from './native-chat-composer-target'
 import { pushHistory, type HistoryState } from './native-chat-composer-state'
-import { sendNativeChatMessageVerified } from './native-chat-runtime-send'
+import { sendNativeChatMessageVerified, typeNativeChatCommand } from './native-chat-runtime-send'
 import { cancelNativeChatPtySends, waitForNativeChatPtyIdle } from './native-chat-pty-send-queue'
 import {
   createClaudeModelSwitchConfirmationObserver,
@@ -86,12 +86,20 @@ export function useNativeChatSessionOptionCommand(args: {
           // submit immediately so historical output cannot satisfy the match.
           observer.arm()
         }
-        const accepted = await sendNativeChatMessageVerified(
-          target.settings,
-          target.ptyId,
-          command,
-          sendController.signal
-        )
+        const accepted =
+          agent === 'codex'
+            ? await typeNativeChatCommand(
+                target.settings,
+                target.ptyId,
+                command,
+                sendController.signal
+              )
+            : await sendNativeChatMessageVerified(
+                target.settings,
+                target.ptyId,
+                command,
+                sendController.signal
+              )
         if (!accepted) {
           throw new Error('The terminal did not accept the command.')
         }
diff --git a/src/renderer/src/components/new-workspace/ProjectHostSetupCombobox.test.tsx b/src/renderer/src/components/new-workspace/ProjectHostSetupCombobox.test.tsx
deleted file mode 100644
index 06b1267f80b..00000000000
--- a/src/renderer/src/components/new-workspace/ProjectHostSetupCombobox.test.tsx
+++ /dev/null
@@ -1,157 +0,0 @@
-// @vitest-environment happy-dom
-
-import React, { act } from 'react'
-import { createRoot, type Root } from 'react-dom/client'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type {
-  NeedsSetupProjectHostOption,
-  ProjectHostSetupOption
-} from '@/lib/project-host-setup-options'
-import ProjectHostSetupCombobox from './ProjectHostSetupCombobox'
-
-vi.mock('@/components/ui/popover', () => ({
-  Popover: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
-  PopoverContent: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
-  PopoverTrigger: ({ children }: { children: React.ReactNode }) => <>{children}</>
-}))
-
-vi.mock('@/components/ui/command', () => ({
-  Command: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
-  CommandEmpty: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
-  CommandList: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
-  CommandItem: ({
-    children,
-    disabled,
-    onSelect,
-    value
-  }: {
-    children: React.ReactNode
-    disabled?: boolean
-    onSelect?: (value: string) => void
-    value: string
-  }) => (
-    <button
-      type="button"
-      data-command-value={value}
-      disabled={disabled}
-      onClick={() => onSelect?.(value)}
-    >
-      {children}
-    </button>
-  )
-}))
-
-let container: HTMLDivElement
-let root: Root
-
-const readyOption: ProjectHostSetupOption = {
-  id: 'local-setup',
-  kind: 'ready',
-  projectId: 'project-1',
-  hostId: 'local',
-  repoId: 'local-repo',
-  label: 'Local Mac',
-  detail: 'Orca',
-  path: '/Users/alice/orca'
-}
-
-const needsSetupOption: NeedsSetupProjectHostOption = {
-  id: 'needs-setup:ssh:builder',
-  kind: 'needs-setup',
-  projectId: 'project-1',
-  hostId: 'ssh:builder',
-  label: 'Builder',
-  detail: 'Project location not set',
-  isAvailable: true,
-  attention: false
-}
-
-const unavailableOption: NeedsSetupProjectHostOption = {
-  id: 'needs-setup:runtime:old',
-  kind: 'needs-setup',
-  projectId: 'project-1',
-  hostId: 'runtime:old',
-  label: 'Old server',
-  detail: 'Update Orca on this host to set up projects',
-  isAvailable: false,
-  attention: false
-}
-
-beforeEach(() => {
-  container = document.createElement('div')
-  document.body.appendChild(container)
-  root = createRoot(container)
-})
-
-afterEach(() => {
-  act(() => {
-    root.unmount()
-  })
-  container.remove()
-})
-
-function renderCombobox({
-  onValueChange = vi.fn()
-}: {
-  onValueChange?: (setupId: string) => void
-} = {}): void {
-  act(() => {
-    root.render(
-      <ProjectHostSetupCombobox
-        options={[readyOption, needsSetupOption]}
-        value={readyOption.id}
-        onValueChange={onValueChange}
-      />
-    )
-  })
-}
-
-describe('ProjectHostSetupCombobox', () => {
-  it('routes ready setup rows through onValueChange', () => {
-    const onValueChange = vi.fn()
-
-    renderCombobox({ onValueChange })
-
-    act(() => {
-      container
-        .querySelector<HTMLButtonElement>('[data-command-value="local-setup"]')
-        ?.dispatchEvent(new MouseEvent('click', { bubbles: true }))
-    })
-
-    expect(onValueChange).toHaveBeenCalledWith('local-setup')
-  })
-
-  it('hides hosts that need setup from the run target list', () => {
-    const onValueChange = vi.fn()
-
-    renderCombobox({ onValueChange })
-
-    expect(
-      container.querySelector<HTMLButtonElement>('[data-command-value="needs-setup:ssh:builder"]')
-    ).toBeNull()
-    expect(container.textContent).not.toContain('Project location not set')
-    expect(onValueChange).not.toHaveBeenCalled()
-  })
-
-  it('hides unavailable setup rows from the run target list', () => {
-    const onValueChange = vi.fn()
-
-    act(() => {
-      root.render(
-        <ProjectHostSetupCombobox
-          options={[readyOption, unavailableOption]}
-          value={readyOption.id}
-          onValueChange={onValueChange}
-        />
-      )
-    })
-
-    const unavailableButton = container.querySelector<HTMLButtonElement>(
-      '[data-command-value="needs-setup:runtime:old"]'
-    )
-    expect(unavailableButton).toBeNull()
-    expect(container.textContent).not.toContain('Update Orca on this host')
-
-    expect(onValueChange).not.toHaveBeenCalled()
-  })
-})
diff --git a/src/renderer/src/components/new-workspace/ProjectHostSetupCombobox.tsx b/src/renderer/src/components/new-workspace/ProjectHostSetupCombobox.tsx
deleted file mode 100644
index 22df2d5f192..00000000000
--- a/src/renderer/src/components/new-workspace/ProjectHostSetupCombobox.tsx
+++ /dev/null
@@ -1,105 +0,0 @@
-import React from 'react'
-import { Check, ChevronsUpDown, Server } from 'lucide-react'
-import { Button } from '@/components/ui/button'
-import { Command, CommandEmpty, CommandItem, CommandList } from '@/components/ui/command'
-import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
-import { cn } from '@/lib/utils'
-import type { ProjectHostSetupOption } from '@/lib/project-host-setup-options'
-import { translate } from '@/i18n/i18n'
-
-type ProjectHostSetupComboboxProps = {
-  options: readonly ProjectHostSetupOption[]
-  value: string | null
-  onValueChange: (setupId: string) => void
-}
-
-export default function ProjectHostSetupCombobox({
-  options,
-  value,
-  onValueChange
-}: ProjectHostSetupComboboxProps): React.JSX.Element {
-  const [open, setOpen] = React.useState(false)
-  const readyOptions = options.filter((option) => option.kind === 'ready')
-  const selected = readyOptions.find((option) => option.id === value) ?? readyOptions[0] ?? null
-
-  const handleSelect = React.useCallback(
-    (setupId: string): void => {
-      const option = options.find((candidate) => candidate.id === setupId)
-      if (!option) {
-        return
-      }
-      if (!readyOptions.some((candidate) => candidate.id === setupId)) {
-        return
-      }
-      onValueChange(setupId)
-      setOpen(false)
-    },
-    [onValueChange, options, readyOptions]
-  )
-
-  return (
-    <Popover open={open} onOpenChange={setOpen}>
-      <PopoverTrigger asChild>
-        <Button
-          type="button"
-          variant="outline"
-          role="combobox"
-          aria-expanded={open}
-          className="h-9 w-full justify-between border-input px-3 text-sm font-normal focus:border-ring focus:ring-[3px] focus:ring-ring/50"
-        >
-          {selected ? (
-            <span className="inline-flex min-w-0 items-center gap-1.5">
-              <Server className="size-3.5 shrink-0 text-muted-foreground" />
-              <span className="truncate">{selected.label}</span>
-            </span>
-          ) : (
-            <span className="text-muted-foreground">
-              {translate(
-                'auto.components.new.workspace.ProjectHostSetupCombobox.placeholder',
-                'Choose host'
-              )}
-            </span>
-          )}
-          <ChevronsUpDown className="size-3.5 shrink-0 opacity-50" />
-        </Button>
-      </PopoverTrigger>
-      <PopoverContent
-        align="start"
-        className="w-[var(--radix-popover-trigger-width)] min-w-[18rem] p-0"
-      >
-        <Command value={selected?.id ?? ''}>
-          <CommandList>
-            <CommandEmpty>
-              {translate(
-                'auto.components.new.workspace.ProjectHostSetupCombobox.empty',
-                'No hosts are ready for this project.'
-              )}
-            </CommandEmpty>
-            {readyOptions.map((option) => (
-              <CommandItem
-                key={option.id}
-                value={option.id}
-                onSelect={() => handleSelect(option.id)}
-                className="items-center gap-2 px-3 py-2"
-              >
-                <Check
-                  className={cn(
-                    'size-4 text-foreground',
-                    option.id === selected?.id ? 'opacity-100' : 'opacity-0'
-                  )}
-                />
-                <Server className="size-3.5 shrink-0 text-muted-foreground" />
-                <div className="min-w-0 flex-1">
-                  <div className="truncate text-sm">{option.label}</div>
-                  <div className="mt-0.5 truncate text-[11px] text-muted-foreground">
-                    {option.path}
-                  </div>
-                </div>
-              </CommandItem>
-            ))}
-          </CommandList>
-        </Command>
-      </PopoverContent>
-    </Popover>
-  )
-}
diff --git a/src/renderer/src/components/new-workspace/SmartWorkspaceNameField.tsx b/src/renderer/src/components/new-workspace/SmartWorkspaceNameField.tsx
index 539f40deb7c..6ddc4e3ae93 100644
--- a/src/renderer/src/components/new-workspace/SmartWorkspaceNameField.tsx
+++ b/src/renderer/src/components/new-workspace/SmartWorkspaceNameField.tsx
@@ -114,7 +114,7 @@ type RepoOption = ReturnType<typeof useAppStore.getState>['repos'][number]
 const EMPTY_REPO_SEARCH_REPOS: readonly RepoOption[] = []
 
 type SmartWorkspaceNameFieldProps = {
-  repos: RepoOption[]
+  repos: readonly RepoOption[]
   repoId: string
   onRepoChange: (repoId: string) => void
   value: string
diff --git a/src/renderer/src/components/new-workspace/project-combobox-matching.ts b/src/renderer/src/components/new-workspace/project-combobox-matching.ts
index ac298ebd6c5..2e3459ac745 100644
--- a/src/renderer/src/components/new-workspace/project-combobox-matching.ts
+++ b/src/renderer/src/components/new-workspace/project-combobox-matching.ts
@@ -10,7 +10,7 @@ export type ScoredProjectOption = {
 
 function substringHits(text: string, query: string): number[] | null {
   const at = text.toLowerCase().indexOf(query)
-  return at < 0 ? null : Array.from({ length: query.length }, (_, offset) => at + offset)
+  return at === -1 ? null : Array.from({ length: query.length }, (_, offset) => at + offset)
 }
 
 /**
@@ -27,7 +27,7 @@ function nameHitsFor(name: string, query: string): number[] | null {
   let cursor = 0
   for (const char of query) {
     const found = haystack.indexOf(char, cursor)
-    if (found < 0) {
+    if (found === -1) {
       return null
     }
     hits.push(found)
@@ -60,7 +60,7 @@ export function rankProjectOptions(
   const scored: ScoredProjectOption[] = []
   for (const option of options) {
     const recentAt = recentIds.indexOf(option.id)
-    const recency = recentAt < 0 ? 0 : 32 - recentAt * 4
+    const recency = recentAt === -1 ? 0 : 32 - recentAt * 4
     if (query.length === 0) {
       scored.push({ option, score: recency, nameHits: [], detailHits: [] })
       continue
diff --git a/src/renderer/src/components/new-workspace/use-jira-url-source.test.tsx b/src/renderer/src/components/new-workspace/use-jira-url-source.test.tsx
index fc3a60a5504..1f6df54bfb2 100644
--- a/src/renderer/src/components/new-workspace/use-jira-url-source.test.tsx
+++ b/src/renderer/src/components/new-workspace/use-jira-url-source.test.tsx
@@ -50,7 +50,7 @@ function site(id: string, email = `${id}@example.com`): JiraSite {
 
 function status(
   sites: JiraSite[],
-  selectedSiteId: string | 'all' | null = null
+  selectedSiteId: (string & {}) | 'all' | null = null
 ): JiraConnectionStatus {
   return {
     connected: true,
diff --git a/src/renderer/src/components/new-workspace/use-jira-url-source.ts b/src/renderer/src/components/new-workspace/use-jira-url-source.ts
index e1dc6efd6a6..0441e37edc9 100644
--- a/src/renderer/src/components/new-workspace/use-jira-url-source.ts
+++ b/src/renderer/src/components/new-workspace/use-jira-url-source.ts
@@ -54,7 +54,7 @@ function getPreferredSite(
   matches: JiraSite[],
   selectedAccount: AccountSelection | null,
   requestKey: string,
-  selectedSiteId: string | 'all' | null | undefined,
+  selectedSiteId: (string & {}) | 'all' | null | undefined,
   activeSiteId: string | null | undefined
 ): JiraSite | null {
   const explicitId = selectedAccount?.requestKey === requestKey ? selectedAccount.siteId : null
diff --git a/src/renderer/src/components/onboarding/AgentFeatureSetupStep.test.tsx b/src/renderer/src/components/onboarding/AgentFeatureSetupStep.test.tsx
deleted file mode 100644
index 832af22219c..00000000000
--- a/src/renderer/src/components/onboarding/AgentFeatureSetupStep.test.tsx
+++ /dev/null
@@ -1,30 +0,0 @@
-import { renderToStaticMarkup } from 'react-dom/server'
-import { describe, expect, it, vi } from 'vitest'
-import { AgentFeatureSetupStep } from './AgentFeatureSetupStep'
-
-describe('AgentFeatureSetupStep', () => {
-  it('renders the agent feature setup checklist', () => {
-    const html = renderToStaticMarkup(
-      <AgentFeatureSetupStep
-        featureSetup={{
-          browserUse: true,
-          computerUse: true,
-          orchestration: true,
-          linearTickets: false
-        }}
-        onFeatureSetupChange={vi.fn()}
-        featureSetupCommand={null}
-        featureSetupCommandSelection={null}
-        setupBusyLabel={null}
-        onStartFeatureSetup={vi.fn()}
-      />
-    )
-
-    expect(html).toContain('Agent Browser Use')
-    expect(html).toContain('Computer Use')
-    expect(html).toContain('Agent Orchestration')
-    expect(html).toContain('Linear agent skill')
-    expect(html).toContain('Enable capabilities')
-    expect(html).toContain('role="checkbox"')
-  })
-})
diff --git a/src/renderer/src/components/onboarding/AgentFeatureSetupStep.tsx b/src/renderer/src/components/onboarding/AgentFeatureSetupStep.tsx
deleted file mode 100644
index 647600e02bb..00000000000
--- a/src/renderer/src/components/onboarding/AgentFeatureSetupStep.tsx
+++ /dev/null
@@ -1,64 +0,0 @@
-import { Loader2, Terminal } from 'lucide-react'
-import { Button } from '@/components/ui/button'
-import { FeatureSetupChecklist } from './FeatureSetupChecklist'
-import { FeatureSetupInlineTerminal } from './FeatureSetupInlineTerminal'
-import {
-  hasSelectedOnboardingFeatureSetup,
-  type OnboardingFeatureSetupSelection
-} from './onboarding-feature-setup'
-import { translate } from '@/i18n/i18n'
-
-type AgentFeatureSetupStepProps = {
-  featureSetup: OnboardingFeatureSetupSelection
-  onFeatureSetupChange: (value: OnboardingFeatureSetupSelection) => void
-  featureSetupCommand: string | null
-  featureSetupCommandSelection: OnboardingFeatureSetupSelection | null
-  setupBusyLabel: string | null
-  onStartFeatureSetup: () => void
-}
-
-export function AgentFeatureSetupStep({
-  featureSetup,
-  onFeatureSetupChange,
-  featureSetupCommand,
-  featureSetupCommandSelection,
-  setupBusyLabel,
-  onStartFeatureSetup
-}: AgentFeatureSetupStepProps): React.JSX.Element {
-  const hasSelectedFeatures = hasSelectedOnboardingFeatureSetup(featureSetup)
-  const showSetupAction = !featureSetupCommand
-
-  return (
-    <>
-      <FeatureSetupChecklist value={featureSetup} onChange={onFeatureSetupChange} />
-      {showSetupAction ? (
-        <div className="mt-4 flex items-center">
-          <Button
-            type="button"
-            variant="default"
-            className="shrink-0"
-            disabled={!hasSelectedFeatures || Boolean(setupBusyLabel)}
-            onClick={onStartFeatureSetup}
-          >
-            {setupBusyLabel ? (
-              <Loader2 className="size-4 animate-spin" />
-            ) : (
-              <Terminal className="size-4" />
-            )}
-            {setupBusyLabel ??
-              translate(
-                'auto.components.onboarding.AgentFeatureSetupStep.97dcdc010f',
-                'Install CLI & Skills'
-              )}
-          </Button>
-        </div>
-      ) : null}
-      {featureSetupCommand ? (
-        <FeatureSetupInlineTerminal
-          command={featureSetupCommand}
-          selection={featureSetupCommandSelection ?? featureSetup}
-        />
-      ) : null}
-    </>
-  )
-}
diff --git a/src/renderer/src/components/onboarding/FeatureSetupChecklist.tsx b/src/renderer/src/components/onboarding/FeatureSetupChecklist.tsx
deleted file mode 100644
index 36fb6443ce6..00000000000
--- a/src/renderer/src/components/onboarding/FeatureSetupChecklist.tsx
+++ /dev/null
@@ -1,159 +0,0 @@
-import type { ReactNode } from 'react'
-import { Check, Globe2, MonitorCog, TicketCheck, Workflow } from 'lucide-react'
-import { cn } from '@/lib/utils'
-import type {
-  OnboardingFeatureSetupId,
-  OnboardingFeatureSetupSelection
-} from './onboarding-feature-setup'
-import { translate } from '@/i18n/i18n'
-
-type FeatureSetupChecklistProps = {
-  value: OnboardingFeatureSetupSelection
-  onChange: (value: OnboardingFeatureSetupSelection) => void
-}
-
-type FeatureSetupRow = {
-  id: OnboardingFeatureSetupId
-  title: string
-  description: string
-  setupSummary: string
-  icon: ReactNode
-}
-
-const FEATURE_SETUP_ROWS: readonly FeatureSetupRow[] = [
-  {
-    id: 'browserUse',
-    get title() {
-      return translate(
-        'auto.components.onboarding.FeatureSetupChecklist.ea85d9e628',
-        'Agent Browser Use'
-      )
-    },
-    get description() {
-      return translate(
-        'auto.components.onboarding.FeatureSetupChecklist.01426f3a23',
-        'Agents can navigate sites, inspect pages, and work through browser tasks.'
-      )
-    },
-    setupSummary: 'Enables browser use, prepares orca-cli, and leaves cookies for Settings.',
-    icon: <Globe2 className="size-4" />
-  },
-  {
-    id: 'computerUse',
-    get title() {
-      return translate(
-        'auto.components.onboarding.FeatureSetupChecklist.1ecfb490ac',
-        'Computer Use'
-      )
-    },
-    get description() {
-      return translate(
-        'auto.components.onboarding.FeatureSetupChecklist.c5292c409d',
-        'Agents can inspect app windows and operate local apps when you ask.'
-      )
-    },
-    setupSummary: 'Registers the Orca CLI, opens permissions, and prepares the skill.',
-    icon: <MonitorCog className="size-4" />
-  },
-  {
-    id: 'orchestration',
-    get title() {
-      return translate(
-        'auto.components.onboarding.FeatureSetupChecklist.399cf885c0',
-        'Agent Orchestration'
-      )
-    },
-    get description() {
-      return translate(
-        'auto.components.onboarding.FeatureSetupChecklist.77f74946f5',
-        'Agents can message each other, take tasks, and coordinate handoffs.'
-      )
-    },
-    setupSummary: 'Registers the Orca CLI, enables orchestration, and prepares the skill.',
-    icon: <Workflow className="size-4" />
-  },
-  {
-    id: 'linearTickets',
-    get title() {
-      return translate(
-        'auto.components.onboarding.FeatureSetupChecklist.linearTicketsTitle',
-        'Linear agent skill'
-      )
-    },
-    get description() {
-      return translate(
-        'auto.components.onboarding.FeatureSetupChecklist.linearTicketsDescription',
-        'Agents can use linked Linear tasks for richer ticket-aware handoffs.'
-      )
-    },
-    get setupSummary() {
-      return translate(
-        'auto.components.onboarding.FeatureSetupChecklist.linearTicketsSetupSummary',
-        'Recommended for Linear workspaces; does not affect Linear connection setup.'
-      )
-    },
-    icon: <TicketCheck className="size-4" />
-  }
-]
-
-export function FeatureSetupChecklist({
-  value,
-  onChange
-}: FeatureSetupChecklistProps): React.JSX.Element {
-  return (
-    <section className="mt-6">
-      <div className="grid gap-3 md:grid-cols-4">
-        {FEATURE_SETUP_ROWS.map((row) => {
-          const selected = value[row.id]
-          return (
-            <button
-              key={row.id}
-              type="button"
-              role="checkbox"
-              aria-checked={selected}
-              className={cn(
-                'flex min-h-40 flex-col rounded-lg border px-4 py-3 text-left transition-colors',
-                'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2',
-                selected
-                  ? 'border-ring bg-accent text-foreground ring-2 ring-ring/25'
-                  : 'border-border bg-muted/20 text-muted-foreground hover:bg-muted/40'
-              )}
-              onClick={() => onChange({ ...value, [row.id]: !selected })}
-            >
-              <span className="flex items-start justify-between gap-3">
-                <span
-                  className={cn(
-                    'flex size-8 items-center justify-center rounded-lg border',
-                    selected
-                      ? 'border-border bg-muted text-foreground'
-                      : 'border-border bg-muted/40'
-                  )}
-                >
-                  {row.icon}
-                </span>
-                <span
-                  aria-hidden
-                  className={cn(
-                    'flex size-5 items-center justify-center rounded-full border transition-colors',
-                    selected
-                      ? 'border-primary bg-primary text-primary-foreground'
-                      : 'border-border bg-background'
-                  )}
-                >
-                  {selected ? <Check className="size-3" strokeWidth={3} /> : null}
-                </span>
-              </span>
-              <span className="mt-3 text-sm font-medium text-foreground">{row.title}</span>
-              <span className="mt-1 text-xs leading-relaxed text-muted-foreground">
-                {row.description}
-              </span>
-              <span className="mt-auto pt-3 text-[11px] leading-relaxed text-muted-foreground">
-                {row.setupSummary}
-              </span>
-            </button>
-          )
-        })}
-      </div>
-    </section>
-  )
-}
diff --git a/src/renderer/src/components/onboarding/FeatureSetupInlineTerminal.test.tsx b/src/renderer/src/components/onboarding/FeatureSetupInlineTerminal.test.tsx
index 024e617490e..d097d537f20 100644
--- a/src/renderer/src/components/onboarding/FeatureSetupInlineTerminal.test.tsx
+++ b/src/renderer/src/components/onboarding/FeatureSetupInlineTerminal.test.tsx
@@ -13,7 +13,16 @@ const mocks = vi.hoisted(() => ({
     (command: string, runtime?: { runtime: 'host' | 'wsl' }) =>
       `${runtime?.runtime ?? 'host'}:${command}`
   ),
-  terminalProps: null as { command: string; shellOverride?: string } | null
+  buildSetupCommand: vi.fn(
+    (command: string, shellOverride: string | undefined, runtime?: { runtime: 'host' | 'wsl' }) =>
+      `${runtime?.runtime ?? 'host'}-${shellOverride ?? 'default'}:${command}`
+  ),
+  terminalProps: null as {
+    command: string
+    forceHostRuntime?: boolean
+    prepareCommandForShell?: (command: string, shellOverride?: string) => string
+    shellOverride?: string
+  } | null
 }))
 
 vi.mock('@/hooks/useActiveProjectSkillRuntime', () => ({
@@ -21,11 +30,17 @@ vi.mock('@/hooks/useActiveProjectSkillRuntime', () => ({
 }))
 
 vi.mock('../settings/CliSkillRuntimeSetup', () => ({
-  buildSkillCommandForRuntime: mocks.buildCommand
+  buildSkillCommandForRuntime: mocks.buildCommand,
+  buildSkillSetupTerminalCommand: mocks.buildSetupCommand
 }))
 
 vi.mock('./OnboardingInlineCommandTerminal', () => ({
-  OnboardingInlineCommandTerminal: (props: { command: string; shellOverride?: string }) => {
+  OnboardingInlineCommandTerminal: (props: {
+    command: string
+    forceHostRuntime?: boolean
+    prepareCommandForShell?: (command: string, shellOverride?: string) => string
+    shellOverride?: string
+  }) => {
     mocks.terminalProps = props
     return null
   }
@@ -43,6 +58,7 @@ describe('FeatureSetupInlineTerminal', () => {
     mocks.runtime.installDisabledReason = null
     mocks.terminalProps = null
     mocks.buildCommand.mockClear()
+    mocks.buildSetupCommand.mockClear()
   })
 
   it('runs the command through the resolved WSL runtime', () => {
@@ -57,8 +73,12 @@ describe('FeatureSetupInlineTerminal', () => {
     })
     expect(mocks.terminalProps).toMatchObject({
       command: 'wsl:npx skills add orchestration',
+      forceHostRuntime: false,
       shellOverride: 'powershell.exe'
     })
+    expect(
+      mocks.terminalProps?.prepareCommandForShell?.('wsl:npx skills add orchestration', 'wsl.exe')
+    ).toBe('wsl-wsl.exe:wsl:npx skills add orchestration')
   })
 
   it('uses the host command builder when the WSL runtime needs repair', () => {
@@ -71,8 +91,12 @@ describe('FeatureSetupInlineTerminal', () => {
     expect(mocks.buildCommand).toHaveBeenCalledWith('npx skills add orchestration', undefined)
     expect(mocks.terminalProps).toMatchObject({
       command: 'host:npx skills add orchestration',
+      forceHostRuntime: true,
       shellOverride: 'powershell.exe'
     })
+    expect(
+      mocks.terminalProps?.prepareCommandForShell?.('host:npx skills add orchestration', 'wsl.exe')
+    ).toBe('host-wsl.exe:host:npx skills add orchestration')
   })
 
   it('keeps the runtime captured when setup started', () => {
@@ -96,5 +120,8 @@ describe('FeatureSetupInlineTerminal', () => {
       command: 'host:npx skills add orchestration',
       shellOverride: 'cmd.exe'
     })
+    expect(
+      mocks.terminalProps?.prepareCommandForShell?.('host:npx skills add orchestration', 'cmd.exe')
+    ).toBe('host-cmd.exe:host:npx skills add orchestration')
   })
 })
diff --git a/src/renderer/src/components/onboarding/FeatureSetupInlineTerminal.tsx b/src/renderer/src/components/onboarding/FeatureSetupInlineTerminal.tsx
index 3d7f2fcb3da..849e841ca2a 100644
--- a/src/renderer/src/components/onboarding/FeatureSetupInlineTerminal.tsx
+++ b/src/renderer/src/components/onboarding/FeatureSetupInlineTerminal.tsx
@@ -2,7 +2,10 @@ import { useCallback, useMemo, useRef, type KeyboardEvent } from 'react'
 import { track } from '@/lib/telemetry'
 import { notifyInstalledAgentSkillsChanged } from '@/hooks/useInstalledAgentSkills'
 import { useActiveProjectSkillRuntime } from '@/hooks/useActiveProjectSkillRuntime'
-import { buildSkillCommandForRuntime } from '../settings/CliSkillRuntimeSetup'
+import {
+  buildSkillCommandForRuntime,
+  buildSkillSetupTerminalCommand
+} from '../settings/CliSkillRuntimeSetup'
 import { OnboardingInlineCommandTerminal } from './OnboardingInlineCommandTerminal'
 import {
   getOnboardingFeatureSetupAgentRuntime,
@@ -29,9 +32,12 @@ export function FeatureSetupInlineTerminal({
   const terminalInteractedTrackedRef = useRef(false)
   const activeSkillRuntime = useActiveProjectSkillRuntime()
   const setupRuntime = runtimeContext ?? activeSkillRuntime
-  const runtimeCommand = buildSkillCommandForRuntime(
-    command,
-    getOnboardingFeatureSetupAgentRuntime(setupRuntime)
+  const agentRuntime = getOnboardingFeatureSetupAgentRuntime(setupRuntime)
+  const copiedCommand = buildSkillCommandForRuntime(command, agentRuntime)
+  const prepareCommandForShell = useCallback(
+    (terminalCommand: string, effectiveShell: string | undefined) =>
+      buildSkillSetupTerminalCommand(terminalCommand, effectiveShell, agentRuntime),
+    [agentRuntime]
   )
 
   const selectionTelemetry = useMemo(
@@ -70,8 +76,10 @@ export function FeatureSetupInlineTerminal({
 
   return (
     <OnboardingInlineCommandTerminal
-      command={runtimeCommand}
+      command={copiedCommand}
+      prepareCommandForShell={prepareCommandForShell}
       shellOverride={setupRuntime.terminalShellOverride}
+      forceHostRuntime={Boolean(setupRuntime.installDisabledReason)}
       title={translate(
         'auto.components.onboarding.FeatureSetupInlineTerminal.c767ab7061',
         'Skill setup'
diff --git a/src/renderer/src/components/onboarding/OnboardingFlow.tsx b/src/renderer/src/components/onboarding/OnboardingFlow.tsx
index c5546aa95e6..f32b401fff2 100644
--- a/src/renderer/src/components/onboarding/OnboardingFlow.tsx
+++ b/src/renderer/src/components/onboarding/OnboardingFlow.tsx
@@ -100,15 +100,13 @@ const stepTooltipLabels = {
 type OnboardingFlowProps = {
   onboarding: OnboardingState
   onOnboardingChange: (state: OnboardingState) => void
-  onSettingsDetourStart?: () => void
 }
 
 export default function OnboardingFlow({
   onboarding,
-  onOnboardingChange,
-  onSettingsDetourStart
+  onOnboardingChange
 }: OnboardingFlowProps): React.JSX.Element {
-  const flow = useOnboardingFlow(onboarding, onOnboardingChange, { onSettingsDetourStart })
+  const flow = useOnboardingFlow(onboarding, onOnboardingChange)
   const continueShortcutModifierLabel = getScreenSubmitModifierLabel()
   const { currentStep, stepIndex, busyLabel } = flow
   const copy = stepCopy[currentStep.id]
@@ -321,7 +319,7 @@ export default function OnboardingFlow({
               busyLabel={busyLabel}
               onSkipToRepo={() => void flow.skipToRepo()}
               stepIndex={stepIndex}
-              onBack={flow.nestedScan ? flow.cancelNested : flow.back}
+              onBack={flow.back}
               showPrimary
               primaryBusy={shouldShowFooterBusy}
               primaryLabel={footerPrimaryLabel}
diff --git a/src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.command-finished.test.tsx b/src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.command-finished.test.tsx
index 1b55391dec4..8631ba540c2 100644
--- a/src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.command-finished.test.tsx
+++ b/src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.command-finished.test.tsx
@@ -8,9 +8,10 @@ import {
   ORCA_TERMINAL_COMMAND_FINISHED_EVENT,
   type TerminalCommandFinishedEventDetail
 } from '@/hooks/terminal-command-finished-event'
+import { PASTE_TERMINAL_TEXT_EVENT, type PasteTerminalTextDetail } from '@/constants/terminal'
 
 const mocks = vi.hoisted(() => ({
-  createTab: vi.fn(() => ({ id: 'tab-1' })),
+  createTab: vi.fn(() => ({ id: 'tab-1', shellOverride: 'wsl.exe' })),
   closeTab: vi.fn(),
   setActiveTabForWorktree: vi.fn(),
   setTabCustomTitle: vi.fn()
@@ -27,7 +28,12 @@ vi.mock('@/store', () => ({
 }))
 
 vi.mock('@/components/terminal-pane/TerminalPane', () => ({
-  default: () => <div data-testid="terminal-pane" />
+  default: (props: { tabId: string }) => (
+    <div data-testid="terminal-pane" data-terminal-tab-id={props.tabId}>
+      <div data-pty-id="pty-1" />
+      <div className="xterm-rows">$</div>
+    </div>
+  )
 }))
 
 vi.mock('@/lib/focus-terminal-tab-surface', () => ({
@@ -69,6 +75,81 @@ describe('OnboardingInlineCommandTerminal command-finished forwarding', () => {
     container?.remove()
     container = null
     Reflect.deleteProperty(window, 'api')
+    vi.useRealTimers()
+  })
+
+  it('prepares auto-paste again when the resolved tab shell changes', async () => {
+    vi.useFakeTimers()
+    mocks.createTab
+      .mockReturnValueOnce({ id: 'tab-1', shellOverride: 'wsl.exe' })
+      .mockReturnValueOnce({ id: 'tab-2', shellOverride: 'powershell.exe' })
+    const prepareCommandForShell = vi.fn(
+      (command: string, shellOverride: string | undefined) => `${shellOverride}:${command}`
+    )
+    const pasted: PasteTerminalTextDetail[] = []
+    const handlePaste = (event: Event): void => {
+      pasted.push((event as CustomEvent<PasteTerminalTextDetail>).detail)
+    }
+    window.addEventListener(PASTE_TERMINAL_TEXT_EVENT, handlePaste)
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    try {
+      await act(async () => {
+        root?.render(
+          <OnboardingInlineCommandTerminal
+            command="npx skills add orchestration"
+            prepareCommandForShell={prepareCommandForShell}
+            shellOverride="powershell.exe"
+            title="Skill setup"
+            ariaLabel="Skill setup terminal"
+          />
+        )
+      })
+      await act(async () => {})
+      await act(async () => {
+        vi.advanceTimersByTime(250)
+      })
+      await act(async () => {
+        root?.render(
+          <OnboardingInlineCommandTerminal
+            command="npx skills add orchestration"
+            forceHostRuntime
+            prepareCommandForShell={prepareCommandForShell}
+            shellOverride="powershell.exe"
+            title="Skill setup"
+            ariaLabel="Skill setup terminal"
+          />
+        )
+      })
+      await act(async () => {})
+      await act(async () => {
+        vi.advanceTimersByTime(250)
+      })
+
+      expect(prepareCommandForShell).toHaveBeenCalledWith('npx skills add orchestration', 'wsl.exe')
+      expect(prepareCommandForShell).toHaveBeenCalledWith(
+        'npx skills add orchestration',
+        'powershell.exe'
+      )
+      expect(mocks.createTab).toHaveBeenCalledWith(
+        'ephemeral-setup-terminal:onboarding-inline-terminal',
+        undefined,
+        'powershell.exe',
+        expect.objectContaining({ forceHostRuntime: true })
+      )
+      expect(pasted).toContainEqual({
+        tabId: 'tab-1',
+        text: 'wsl.exe:npx skills add orchestration'
+      })
+      expect(pasted).toContainEqual({
+        tabId: 'tab-2',
+        text: 'powershell.exe:npx skills add orchestration'
+      })
+    } finally {
+      window.removeEventListener(PASTE_TERMINAL_TEXT_EVENT, handlePaste)
+    }
   })
 
   it('forwards exit codes only for its own branded worktree id', async () => {
diff --git a/src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.tsx b/src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.tsx
index 0a7f0ae7a8f..e2e6141ef0e 100644
--- a/src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.tsx
+++ b/src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.tsx
@@ -21,6 +21,7 @@ const PTY_TEXT_FALLBACK_MS = 750
 
 type OnboardingInlineCommandTerminalProps = {
   command: string
+  prepareCommandForShell?: (command: string, shellOverride: string | undefined) => string
   title: string
   description?: string
   ariaLabel: string
@@ -30,6 +31,7 @@ type OnboardingInlineCommandTerminalProps = {
   autoScrollIntoView?: boolean
   worktreeId?: string
   shellOverride?: string
+  forceHostRuntime?: boolean
   onOpened?: () => void
   onInteracted?: (method: 'keyboard' | 'pointer', event?: KeyboardEvent<HTMLElement>) => void
   onTerminalExit?: () => void
@@ -43,6 +45,7 @@ type OnboardingInlineCommandTerminalProps = {
  */
 export function OnboardingInlineCommandTerminal({
   command,
+  prepareCommandForShell,
   title,
   description,
   ariaLabel,
@@ -52,6 +55,7 @@ export function OnboardingInlineCommandTerminal({
   autoScrollIntoView = true,
   worktreeId: worktreeIdProp = ONBOARDING_INLINE_TERMINAL_WORKTREE_ID,
   shellOverride,
+  forceHostRuntime = false,
   onOpened,
   onInteracted,
   onTerminalExit,
@@ -75,13 +79,17 @@ export function OnboardingInlineCommandTerminal({
     []
   )
   const [cwd, setCwd] = useState<string | null>(null)
-  const [tabId, setTabId] = useState<string | null>(null)
+  const [createdTab, setCreatedTab] = useState<{
+    id: string
+    shellOverride: string | undefined
+  } | null>(null)
+  const tabId = createdTab?.id ?? null
   // Why: starts at `prefersReducedMotion` so users opted out of motion never
   // see the slide-in frame; otherwise we flip to true after first paint so the
   // CSS transition has a starting state to interpolate from.
   const [entered, setEntered] = useState(prefersReducedMotion)
   const terminalSectionRef = useRef<HTMLElement>(null)
-  const autoInsertedRef = useRef<string | null>(null)
+  const autoInsertedRef = useRef<{ tabId: string; command: string } | null>(null)
 
   useEffect(() => {
     onOpened?.()
@@ -120,11 +128,12 @@ export function OnboardingInlineCommandTerminal({
   useEffect(() => {
     const tab = createTab(worktreeId, undefined, shellOverride, {
       activate: false,
-      recordInteraction: false
+      recordInteraction: false,
+      forceHostRuntime
     })
     setActiveTabForWorktree(worktreeId, tab.id)
     setTabCustomTitle(tab.id, title, { recordInteraction: false })
-    setTabId(tab.id)
+    setCreatedTab({ id: tab.id, shellOverride: tab.shellOverride })
     return () => {
       // Why: inline setup panels can disappear after detection succeeds; close
       // the backing tab so installer shells do not keep running invisibly.
@@ -133,6 +142,7 @@ export function OnboardingInlineCommandTerminal({
   }, [
     closeTab,
     createTab,
+    forceHostRuntime,
     setActiveTabForWorktree,
     setTabCustomTitle,
     shellOverride,
@@ -201,9 +211,17 @@ export function OnboardingInlineCommandTerminal({
   }, [autoScrollIntoView, entered, prefersReducedMotion])
 
   const insertCommand = useCallback(() => {
-    if (!tabId) {
+    if (!createdTab) {
       return
     }
+    const terminalCommand = prepareCommandForShell?.(command, createdTab.shellOverride) ?? command
+    if (
+      autoInsertedRef.current?.tabId === createdTab.id &&
+      autoInsertedRef.current.command === terminalCommand
+    ) {
+      return
+    }
+    autoInsertedRef.current = { tabId: createdTab.id, command: terminalCommand }
     if (autoScrollIntoView) {
       terminalSectionRef.current?.scrollIntoView({
         behavior: 'auto',
@@ -213,16 +231,16 @@ export function OnboardingInlineCommandTerminal({
     window.dispatchEvent(
       new CustomEvent<PasteTerminalTextDetail>(PASTE_TERMINAL_TEXT_EVENT, {
         detail: {
-          tabId,
-          text: command.trim()
+          tabId: createdTab.id,
+          text: terminalCommand.trim()
         }
       })
     )
-    focusTerminalTabSurface(tabId)
-  }, [autoScrollIntoView, command, tabId])
+    focusTerminalTabSurface(createdTab.id)
+  }, [autoScrollIntoView, command, createdTab, prepareCommandForShell])
 
   useEffect(() => {
-    if (!tabId || !cwd || autoInsertedRef.current === command) {
+    if (!tabId || !cwd) {
       return
     }
     let canceled = false
@@ -236,7 +254,6 @@ export function OnboardingInlineCommandTerminal({
       }
       insertionTimer = window.setTimeout(() => {
         if (!canceled) {
-          autoInsertedRef.current = command
           insertCommand()
         }
       }, AUTO_INSERT_DELAY_MS)
@@ -280,7 +297,7 @@ export function OnboardingInlineCommandTerminal({
         window.clearTimeout(insertionTimer)
       }
     }
-  }, [command, cwd, insertCommand, tabId])
+  }, [cwd, insertCommand, tabId])
 
   // Why: grid 0fr → 1fr animates to the child's natural height without a
   // hardcoded max-height, so we don't leave dead space if the terminal
diff --git a/src/renderer/src/components/onboarding/RepoStep.test.tsx b/src/renderer/src/components/onboarding/RepoStep.test.tsx
deleted file mode 100644
index de01325e1d5..00000000000
--- a/src/renderer/src/components/onboarding/RepoStep.test.tsx
+++ /dev/null
@@ -1,135 +0,0 @@
-import { renderToStaticMarkup } from 'react-dom/server'
-import type { ComponentProps } from 'react'
-import { describe, expect, it, vi } from 'vitest'
-import { RepoStep } from './RepoStep'
-import { TooltipProvider } from '../ui/tooltip'
-
-function renderRepoStep(overrides: Partial<ComponentProps<typeof RepoStep>> = {}): string {
-  return renderToStaticMarkup(
-    <TooltipProvider>
-      <RepoStep
-        cloneUrl=""
-        onCloneUrlChange={vi.fn()}
-        nestedScan={null}
-        nestedSelectedPaths={new Set()}
-        onNestedSelectedPathsChange={vi.fn()}
-        onImportNested={vi.fn()}
-        onCancelNested={vi.fn()}
-        onStopNestedScan={vi.fn()}
-        nestedScanInProgress={false}
-        onOpenFolder={vi.fn()}
-        onOpenServerFolder={vi.fn()}
-        onClone={vi.fn()}
-        onOpenSshSettings={vi.fn()}
-        serverPath=""
-        onServerPathChange={vi.fn()}
-        cloneDestination=""
-        onCloneDestinationChange={vi.fn()}
-        workspaceDir="/workspace"
-        runtimeActive={false}
-        busyLabel={null}
-        error={null}
-        {...overrides}
-      />
-    </TooltipProvider>
-  )
-}
-
-describe('RepoStep', () => {
-  it('renders the add project options without existing-project chrome', () => {
-    const html = renderRepoStep()
-
-    expect(html).not.toContain('Project already added')
-    expect(html).toContain('Browse for a folder')
-    expect(html).toContain('Clone a repo')
-  })
-
-  it('presents the local-folder card itself as the browse action', () => {
-    const html = renderRepoStep()
-
-    expect(html).toContain('border-border bg-muted/30')
-    expect(html).toContain('focus:border-foreground/70')
-    expect(html).toContain('focus:ring-2 focus:ring-inset focus:ring-foreground/25')
-    expect(html).toContain('autofocus=""')
-    expect(html).toContain('Browse for a folder')
-    expect(html).toContain('group-hover:translate-x-0.5')
-    expect(html).toContain('w-fit max-w-[calc(100%-3.75rem)]')
-    expect(html).toContain('Want to import many repos at once? Select the parent folder.')
-  })
-
-  it('disables the nested import action when no repositories are selected', () => {
-    const html = renderRepoStep({
-      nestedScan: {
-        selectedPath: '/workspace/platform',
-        selectedPathKind: 'non_git_folder',
-        repos: [{ path: '/workspace/platform/apps/web', displayName: 'web', depth: 2 }],
-        truncated: false,
-        timedOut: false,
-        stopped: false,
-        durationMs: 4,
-        maxDepth: 3,
-        maxRepos: 100,
-        timeoutMs: null
-      }
-    })
-
-    expect(html).toContain('Import repositories')
-    expect(html).toContain('Scanned folder: platform - /workspace/platform')
-    expect(html).not.toContain('Group name')
-    expect(html).not.toContain('Import separately')
-    expect(html).not.toContain('Import as project group')
-    expect(html.match(/disabled=""/g)?.length).toBeGreaterThanOrEqual(1)
-  })
-
-  it('shows a stop action and disables import while nested scan is still running', () => {
-    const html = renderRepoStep({
-      nestedScan: {
-        selectedPath: '/workspace/platform',
-        selectedPathKind: 'non_git_folder',
-        repos: [{ path: '/workspace/platform/apps/web', displayName: 'web', depth: 2 }],
-        truncated: false,
-        timedOut: false,
-        stopped: false,
-        durationMs: 4,
-        maxDepth: 3,
-        maxRepos: 100,
-        timeoutMs: null
-      },
-      nestedScanInProgress: true,
-      nestedSelectedPaths: new Set(['/workspace/platform/apps/web'])
-    })
-
-    expect(html).toContain('Scanning... Found 1 repository in this folder.')
-    expect(html).toContain('aria-label="Stop scan"')
-    expect(html).toContain('Showing partial scan results.')
-    expect(html.match(/disabled=""/g)?.length).toBeGreaterThanOrEqual(3)
-  })
-
-  it('shows a flat nested repository checklist with collision labels', () => {
-    const html = renderRepoStep({
-      nestedScan: {
-        selectedPath: '/workspace/platform',
-        selectedPathKind: 'non_git_folder',
-        repos: [
-          { path: '/workspace/platform/web', displayName: 'web', depth: 1 },
-          { path: '/workspace/platform/payments/api', displayName: 'api', depth: 2 },
-          { path: '/workspace/platform/billing/api', displayName: 'api', depth: 2 }
-        ],
-        truncated: false,
-        timedOut: false,
-        stopped: false,
-        durationMs: 4,
-        maxDepth: 3,
-        maxRepos: 100,
-        timeoutMs: null
-      },
-      nestedSelectedPaths: new Set(['/workspace/platform/web'])
-    })
-
-    expect(html).toContain('Found 3 repositories in this folder.')
-    expect(html).toContain('web')
-    expect(html).toContain('payments/api')
-    expect(html).toContain('billing/api')
-    expect(html).not.toContain('Project group')
-  })
-})
diff --git a/src/renderer/src/components/onboarding/RepoStep.tsx b/src/renderer/src/components/onboarding/RepoStep.tsx
deleted file mode 100644
index 0202ef6a6a6..00000000000
--- a/src/renderer/src/components/onboarding/RepoStep.tsx
+++ /dev/null
@@ -1,322 +0,0 @@
-import {
-  ArrowRight,
-  CircleStop,
-  FolderOpen,
-  GitBranch,
-  Lightbulb,
-  Loader2,
-  Server
-} from 'lucide-react'
-import type { Dispatch, SetStateAction } from 'react'
-import { Button } from '@/components/ui/button'
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
-import type { NestedRepoScanResult } from '../../../../shared/types'
-import { translate } from '@/i18n/i18n'
-import { RepoStepNestedImportPanel } from './RepoStepNestedImportPanel'
-
-type RepoStepProps = {
-  cloneUrl: string
-  onCloneUrlChange: (value: string) => void
-  nestedScan: NestedRepoScanResult | null
-  nestedScanInProgress: boolean
-  nestedSelectedPaths: Set<string>
-  onNestedSelectedPathsChange: Dispatch<SetStateAction<Set<string>>>
-  onImportNested: () => void
-  onCancelNested: () => void
-  onStopNestedScan: () => void
-  onOpenFolder: () => void
-  onOpenServerFolder: (kind: 'git' | 'folder') => void
-  onClone: () => void
-  onOpenSshSettings: () => void
-  serverPath: string
-  onServerPathChange: (value: string) => void
-  cloneDestination: string
-  onCloneDestinationChange: (value: string) => void
-  workspaceDir: string
-  runtimeActive: boolean
-  busyLabel: string | null
-  error: string | null
-}
-
-export function RepoStep({
-  cloneUrl,
-  onCloneUrlChange,
-  nestedScan,
-  nestedScanInProgress,
-  nestedSelectedPaths,
-  onNestedSelectedPathsChange,
-  onImportNested,
-  onCancelNested,
-  onStopNestedScan,
-  onOpenFolder,
-  onOpenServerFolder,
-  onClone,
-  onOpenSshSettings,
-  serverPath,
-  onServerPathChange,
-  cloneDestination,
-  onCloneDestinationChange,
-  workspaceDir,
-  runtimeActive,
-  busyLabel,
-  error
-}: RepoStepProps) {
-  const disabled = Boolean(busyLabel)
-  if (nestedScan) {
-    return (
-      <RepoStepNestedImportPanel
-        nestedScan={nestedScan}
-        nestedScanInProgress={nestedScanInProgress}
-        nestedSelectedPaths={nestedSelectedPaths}
-        onNestedSelectedPathsChange={onNestedSelectedPathsChange}
-        onImportNested={onImportNested}
-        onCancelNested={onCancelNested}
-        onStopNestedScan={onStopNestedScan}
-        busyLabel={busyLabel}
-        error={error}
-        disabled={disabled}
-      />
-    )
-  }
-  return (
-    <div className="space-y-3">
-      {runtimeActive ? (
-        <form
-          className="rounded-lg border border-border bg-muted/30 p-5"
-          onSubmit={(event) => {
-            event.preventDefault()
-            onOpenServerFolder('git')
-          }}
-        >
-          <div className="flex items-center gap-4">
-            <div className="grid size-11 shrink-0 place-items-center rounded-lg bg-muted text-foreground">
-              <FolderOpen className="size-5" />
-            </div>
-            <div className="min-w-0 flex-1">
-              <div className="text-base font-semibold text-foreground">
-                {translate(
-                  'auto.components.onboarding.RepoStep.8cab104e3c',
-                  'Open a project on this host'
-                )}
-              </div>
-              <div className="mt-0.5 text-[13px] text-muted-foreground">
-                {translate(
-                  'auto.components.onboarding.RepoStep.466108ab89',
-                  'Enter a path that exists on the selected host.'
-                )}
-              </div>
-            </div>
-          </div>
-          <div className="mt-4 flex flex-col gap-2 sm:flex-row">
-            <input
-              className="min-w-0 flex-1 rounded-lg border border-border bg-background px-4 py-3 font-mono text-sm text-foreground outline-none transition focus:border-foreground/50 focus:ring-2 focus:ring-foreground/15"
-              placeholder={translate(
-                'auto.components.onboarding.RepoStep.2ebbc26343',
-                '/home/user/project'
-              )}
-              value={serverPath}
-              disabled={disabled}
-              spellCheck={false}
-              onChange={(event) => onServerPathChange(event.target.value)}
-            />
-            <button
-              type="submit"
-              className="shrink-0 rounded-lg bg-primary px-4 py-3 text-sm font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-40"
-              disabled={!serverPath.trim() || disabled}
-            >
-              {translate('auto.components.onboarding.RepoStep.3863747c56', 'Add Git Project')}
-            </button>
-            <button
-              type="button"
-              className="shrink-0 rounded-lg border border-border bg-background px-4 py-3 text-sm font-medium text-foreground hover:bg-muted/60 disabled:opacity-40"
-              disabled={!serverPath.trim() || disabled}
-              onClick={() => onOpenServerFolder('folder')}
-            >
-              {translate('auto.components.onboarding.RepoStep.e8214aa632', 'Open as Folder')}
-            </button>
-          </div>
-        </form>
-      ) : (
-        <button
-          type="button"
-          className="group w-full rounded-xl border border-border bg-muted/30 p-5 text-left transition hover:border-foreground/40 hover:bg-muted/60 focus:border-foreground/70 focus:bg-muted/40 focus:outline-none focus:ring-2 focus:ring-inset focus:ring-foreground/25 disabled:opacity-60"
-          disabled={disabled}
-          autoFocus={!disabled}
-          onClick={onOpenFolder}
-        >
-          <div className="flex min-w-0 items-center gap-4">
-            <div className="grid size-11 shrink-0 place-items-center rounded-lg bg-muted text-foreground">
-              <FolderOpen className="size-5" />
-            </div>
-            <div className="min-w-0 flex-1">
-              <div className="flex min-w-0 items-center gap-2">
-                <div className="min-w-0 text-base font-semibold text-foreground">
-                  {translate(
-                    'auto.components.onboarding.RepoStep.f4e9c8dcf8',
-                    'Browse for a folder'
-                  )}
-                </div>
-                <ArrowRight className="size-4 shrink-0 text-muted-foreground transition group-hover:translate-x-0.5 group-hover:text-foreground" />
-              </div>
-              <div className="mt-0.5 text-[13px] text-muted-foreground">
-                {translate(
-                  'auto.components.onboarding.RepoStep.831524961f',
-                  'Choose any local directory, git repo or not.'
-                )}
-              </div>
-            </div>
-          </div>
-          <div className="ml-[3.75rem] mt-3 flex w-fit max-w-[calc(100%-3.75rem)] items-center gap-2 rounded-lg border border-border bg-muted px-3 py-2 text-[12px] text-muted-foreground">
-            <span className="grid size-6 shrink-0 place-items-center rounded-md border border-border bg-background text-foreground">
-              <Lightbulb className="size-3.5" />
-            </span>
-            <span>
-              {translate(
-                'auto.components.onboarding.RepoStep.6558d50c69',
-                'Want to import many repos at once? Select the parent folder.'
-              )}
-            </span>
-          </div>
-        </button>
-      )}
-
-      <form
-        className="rounded-lg border border-border bg-muted/30 p-5"
-        onSubmit={(e) => {
-          e.preventDefault()
-          onClone()
-        }}
-      >
-        <div className="flex items-center gap-4">
-          <div className="grid size-11 shrink-0 place-items-center rounded-lg bg-muted text-foreground">
-            <GitBranch className="size-5" />
-          </div>
-          <div className="min-w-0 flex-1">
-            <div className="text-base font-semibold text-foreground">
-              {translate('auto.components.onboarding.RepoStep.132425a3e3', 'Clone a repo')}
-            </div>
-            <div className="mt-0.5 text-[13px] text-muted-foreground">
-              {translate(
-                'auto.components.onboarding.RepoStep.288d8444b7',
-                'Paste an HTTPS or SSH URL.'
-              )}
-            </div>
-          </div>
-        </div>
-        <div className="mt-4 flex gap-2">
-          <input
-            className="min-w-0 flex-1 rounded-lg border border-border bg-background px-4 py-3 font-mono text-sm text-foreground outline-none transition focus:border-foreground/50 focus:ring-2 focus:ring-foreground/15"
-            placeholder={translate(
-              'auto.components.onboarding.RepoStep.955134915e',
-              'git@github.com:org/repo.git'
-            )}
-            value={cloneUrl}
-            disabled={disabled}
-            onChange={(event) => onCloneUrlChange(event.target.value)}
-          />
-          <button
-            type="submit"
-            className="shrink-0 rounded-lg bg-primary px-5 py-3 text-sm font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-40"
-            disabled={!cloneUrl.trim() || (runtimeActive && !cloneDestination.trim()) || disabled}
-          >
-            {translate('auto.components.onboarding.RepoStep.7932e95f68', 'Clone')}
-          </button>
-        </div>
-        {runtimeActive && (
-          <div className="mt-2 space-y-1">
-            <label className="text-[11px] font-medium text-muted-foreground">
-              {translate('auto.components.onboarding.RepoStep.24c7c8696c', 'Clone into host path')}
-            </label>
-            <input
-              className="w-full rounded-lg border border-border bg-background px-4 py-3 font-mono text-sm text-foreground outline-none transition focus:border-foreground/50 focus:ring-2 focus:ring-foreground/15"
-              placeholder={translate(
-                'auto.components.onboarding.RepoStep.7ec3f48820',
-                '/home/user'
-              )}
-              value={cloneDestination}
-              disabled={disabled}
-              spellCheck={false}
-              onChange={(event) => onCloneDestinationChange(event.target.value)}
-            />
-          </div>
-        )}
-      </form>
-
-      <div className="flex flex-wrap items-center justify-between gap-3 px-1 pt-1 text-xs text-muted-foreground">
-        <div className="flex min-w-0 items-center gap-2">
-          <span>{translate('auto.components.onboarding.RepoStep.7b679207e4', 'Workspace')}</span>
-          <span className="truncate font-mono text-foreground">
-            {runtimeActive
-              ? translate('auto.components.onboarding.RepoStep.cf23006ba7', 'Selected host')
-              : workspaceDir}
-          </span>
-        </div>
-        {runtimeActive ? (
-          <div className="flex items-center gap-1.5">
-            <Server className="size-3.5" />
-            <span>
-              {translate('auto.components.onboarding.RepoStep.c33b190ca3', 'Host paths only')}
-            </span>
-          </div>
-        ) : (
-          <button
-            type="button"
-            className="inline-flex min-w-0 items-center gap-1.5 rounded-md px-1.5 py-1 text-muted-foreground transition hover:bg-muted hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50"
-            disabled={disabled}
-            onClick={onOpenSshSettings}
-          >
-            <Server className="size-3.5 shrink-0" />
-            <span className="truncate">
-              {translate(
-                'auto.components.onboarding.RepoStep.b7c4da0504',
-                'SSH? Set hosts up in Settings'
-              )}
-            </span>
-            <ArrowRight className="size-3.5 shrink-0" />
-          </button>
-        )}
-      </div>
-
-      {busyLabel && (
-        <div className="flex items-center gap-2 rounded-lg border border-blue-400/30 bg-blue-400/10 px-4 py-2.5 text-sm text-blue-700 dark:text-blue-200">
-          <span className="min-w-0 flex-1">{busyLabel}</span>
-          {nestedScanInProgress ? (
-            <Tooltip>
-              <TooltipTrigger asChild>
-                <Button
-                  type="button"
-                  variant="ghost"
-                  size="icon-xs"
-                  className="group text-muted-foreground hover:bg-destructive/10 hover:text-destructive focus-visible:bg-destructive/10 focus-visible:text-destructive focus-visible:ring-destructive/40"
-                  aria-label={translate(
-                    'auto.components.onboarding.RepoStep.c3d9d44ca2',
-                    'Stop scan'
-                  )}
-                  title={translate(
-                    'auto.components.onboarding.RepoStep.c7af322fc3',
-                    'Stop scanning'
-                  )}
-                  onClick={onStopNestedScan}
-                >
-                  <Loader2 className="size-3.5 animate-spin text-annotation-highlight group-hover:hidden group-focus-visible:hidden" />
-                  <CircleStop className="hidden size-3.5 group-hover:block group-focus-visible:block" />
-                </Button>
-              </TooltipTrigger>
-              <TooltipContent side="top" sideOffset={4}>
-                {translate(
-                  'auto.components.onboarding.RepoStep.e8fdb36338',
-                  'Scanning repositories. Click to stop.'
-                )}
-              </TooltipContent>
-            </Tooltip>
-          ) : null}
-        </div>
-      )}
-      {error && (
-        <div className="rounded-lg border border-red-400/30 bg-red-400/10 px-4 py-2.5 text-sm text-red-700 dark:text-red-200">
-          {error}
-        </div>
-      )}
-    </div>
-  )
-}
diff --git a/src/renderer/src/components/onboarding/RepoStepNestedImportPanel.tsx b/src/renderer/src/components/onboarding/RepoStepNestedImportPanel.tsx
deleted file mode 100644
index e7b24e2b71e..00000000000
--- a/src/renderer/src/components/onboarding/RepoStepNestedImportPanel.tsx
+++ /dev/null
@@ -1,145 +0,0 @@
-import { ArrowLeft, CircleStop, FolderOpen, Loader2 } from 'lucide-react'
-import type { Dispatch, SetStateAction } from 'react'
-import { Button } from '@/components/ui/button'
-import { NestedRepoChecklist } from '@/components/repo/NestedRepoChecklist'
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
-import { translate } from '@/i18n/i18n'
-import type { NestedRepoScanResult } from '../../../../shared/types'
-import { getRuntimePathBasename } from '../../../../shared/cross-platform-path'
-import { NestedRepoScanLimitNotice } from '../repo/NestedRepoScanLimitNotice'
-
-type RepoStepNestedImportPanelProps = {
-  nestedScan: NestedRepoScanResult
-  nestedScanInProgress: boolean
-  nestedSelectedPaths: Set<string>
-  onNestedSelectedPathsChange: Dispatch<SetStateAction<Set<string>>>
-  onImportNested: () => void
-  onCancelNested: () => void
-  onStopNestedScan: () => void
-  busyLabel: string | null
-  error: string | null
-  disabled: boolean
-}
-
-export function RepoStepNestedImportPanel({
-  nestedScan,
-  nestedScanInProgress,
-  nestedSelectedPaths,
-  onNestedSelectedPathsChange,
-  onImportNested,
-  onCancelNested,
-  onStopNestedScan,
-  busyLabel,
-  error,
-  disabled
-}: RepoStepNestedImportPanelProps) {
-  const folderName = getRuntimePathBasename(nestedScan.selectedPath) || nestedScan.selectedPath
-  const nestedImportDisabled = disabled || nestedScanInProgress
-  return (
-    <div className="flex h-full min-h-0 min-w-0 flex-col gap-3">
-      <div className="flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden rounded-lg border border-border bg-muted/30 p-5">
-        <div className="flex min-w-0 shrink-0 items-center gap-4">
-          <div className="grid size-11 shrink-0 place-items-center rounded-lg bg-muted text-foreground">
-            <FolderOpen className="size-5" />
-          </div>
-          <div className="min-w-0 flex-1">
-            <div className="text-base font-semibold text-foreground">
-              {translate('auto.components.onboarding.RepoStep.2d20200346', 'Import repositories')}
-            </div>
-            <div className="mt-0.5 flex min-w-0 items-center gap-1.5 text-[13px] text-muted-foreground">
-              {nestedScanInProgress ? (
-                <Tooltip>
-                  <TooltipTrigger asChild>
-                    <Button
-                      type="button"
-                      variant="ghost"
-                      size="icon-xs"
-                      className="group text-muted-foreground hover:bg-destructive/10 hover:text-destructive focus-visible:bg-destructive/10 focus-visible:text-destructive focus-visible:ring-destructive/40"
-                      aria-label={translate(
-                        'auto.components.onboarding.RepoStep.c3d9d44ca2',
-                        'Stop scan'
-                      )}
-                      title={translate(
-                        'auto.components.onboarding.RepoStep.c7af322fc3',
-                        'Stop scanning'
-                      )}
-                      onClick={onStopNestedScan}
-                    >
-                      <Loader2 className="size-3.5 animate-spin text-annotation-highlight group-hover:hidden group-focus-visible:hidden" />
-                      <CircleStop className="hidden size-3.5 group-hover:block group-focus-visible:block" />
-                    </Button>
-                  </TooltipTrigger>
-                  <TooltipContent side="top" sideOffset={4}>
-                    {translate(
-                      'auto.components.onboarding.RepoStep.e8fdb36338',
-                      'Scanning repositories. Click to stop.'
-                    )}
-                  </TooltipContent>
-                </Tooltip>
-              ) : null}
-              <span className="min-w-0 truncate">
-                {translate(
-                  'auto.components.onboarding.RepoStep.2e6438dd34',
-                  '{{value0}}Found {{value1}} {{value2}} in this folder.',
-                  {
-                    value0: nestedScanInProgress ? 'Scanning... ' : '',
-                    value1: nestedScan.repos.length,
-                    value2: nestedScan.repos.length === 1 ? 'repository' : 'repositories'
-                  }
-                )}
-              </span>
-            </div>
-            <div className="mt-0.5 truncate text-[11px] text-muted-foreground">
-              {translate('auto.components.onboarding.RepoStep.cecd6593fa', 'Scanned folder:')}{' '}
-              {folderName} - {nestedScan.selectedPath}
-            </div>
-          </div>
-        </div>
-        <NestedRepoChecklist
-          scan={nestedScan}
-          selectedPaths={nestedSelectedPaths}
-          onSelectedPathsChange={onNestedSelectedPathsChange}
-          disabled={nestedImportDisabled}
-          className="mt-4 flex-1"
-        />
-        {nestedScanInProgress ||
-        nestedScan.truncated ||
-        nestedScan.timedOut ||
-        nestedScan.stopped ? (
-          <div className="mt-2 shrink-0">
-            <NestedRepoScanLimitNotice scan={nestedScan} />
-          </div>
-        ) : null}
-        <div className="mt-4 flex shrink-0 flex-wrap items-center gap-2">
-          <button
-            type="button"
-            className="inline-flex items-center gap-1 rounded-lg px-3 py-3 text-sm text-muted-foreground hover:bg-muted/60 hover:text-foreground disabled:opacity-40"
-            disabled={disabled && !nestedScanInProgress}
-            onClick={onCancelNested}
-          >
-            <ArrowLeft className="size-3.5" />
-            {translate('auto.components.onboarding.RepoStep.27ca610db1', 'Back')}
-          </button>
-          <button
-            type="button"
-            className="ml-auto rounded-lg bg-primary px-4 py-3 text-sm font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-40"
-            disabled={nestedImportDisabled || nestedSelectedPaths.size === 0}
-            onClick={onImportNested}
-          >
-            {translate('auto.components.onboarding.RepoStep.2d20200346', 'Import repositories')}
-          </button>
-        </div>
-      </div>
-      {busyLabel ? (
-        <div className="shrink-0 rounded-lg border border-blue-400/30 bg-blue-400/10 px-4 py-2.5 text-sm text-blue-700 dark:text-blue-200">
-          {busyLabel}
-        </div>
-      ) : null}
-      {error ? (
-        <div className="shrink-0 rounded-lg border border-red-400/30 bg-red-400/10 px-4 py-2.5 text-sm text-red-700 dark:text-red-200">
-          {error}
-        </div>
-      ) : null}
-    </div>
-  )
-}
diff --git a/src/renderer/src/components/onboarding/onboarding-feature-setup.test.ts b/src/renderer/src/components/onboarding/onboarding-feature-setup.test.ts
index 0ae4d86ca7d..29ef6bd9fca 100644
--- a/src/renderer/src/components/onboarding/onboarding-feature-setup.test.ts
+++ b/src/renderer/src/components/onboarding/onboarding-feature-setup.test.ts
@@ -129,14 +129,13 @@ describe('onboarding feature setup runner', () => {
     )
   })
 
-  it('wraps the copied command for a WSL runtime', () => {
+  it('keeps the copied command valid for the WSL target shell', () => {
     const text = buildOnboardingFeatureSetupClipboardText(
       { browserUse: false, computerUse: false, orchestration: true, linearTickets: false },
       { runtime: 'wsl', wslDistro: 'Ubuntu', label: 'WSL Ubuntu' }
     )
 
-    expect(text).toContain("wsl.exe -d 'Ubuntu'")
-    expect(text).not.toBe(ORCHESTRATION_ONLY_SKILL_INSTALL_COMMAND)
+    expect(text).toBe(ORCHESTRATION_ONLY_SKILL_INSTALL_COMMAND)
   })
 
   it('leaves the copied command bare for a host runtime', () => {
diff --git a/src/renderer/src/components/onboarding/onboarding-folder-agent-startup.test.ts b/src/renderer/src/components/onboarding/onboarding-folder-agent-startup.test.ts
index 18068817358..fa8a791ace1 100644
--- a/src/renderer/src/components/onboarding/onboarding-folder-agent-startup.test.ts
+++ b/src/renderer/src/components/onboarding/onboarding-folder-agent-startup.test.ts
@@ -40,6 +40,45 @@ describe('buildOnboardingFolderAgentStartup', () => {
     expect(startup).toBeUndefined()
   })
 
+  it('omits native-chat preferences from terminal-default folder launches', () => {
+    const startup = buildOnboardingFolderAgentStartup({
+      ...getDefaultSettings('/tmp/orca-workspaces'),
+      defaultTuiAgent: 'codex',
+      experimentalNativeChat: true,
+      openAgentTabsInChatByDefault: false,
+      nativeChatSessionOptions: {
+        codex: {
+          model: 'gpt-5.2-codex',
+          valuesByModel: { 'gpt-5.2-codex': { effort: 'medium' } }
+        }
+      }
+    })
+
+    expect(startup?.command).not.toContain("'-m'")
+    expect(startup?.sessionOptions).toBeUndefined()
+  })
+
+  it('applies native-chat preferences to chat-default folder launches', () => {
+    const startup = buildOnboardingFolderAgentStartup({
+      ...getDefaultSettings('/tmp/orca-workspaces'),
+      defaultTuiAgent: 'codex',
+      experimentalNativeChat: true,
+      openAgentTabsInChatByDefault: true,
+      nativeChatSessionOptions: {
+        codex: {
+          model: 'gpt-5.2-codex',
+          valuesByModel: { 'gpt-5.2-codex': { effort: 'medium' } }
+        }
+      }
+    })
+
+    expect(startup?.command).toContain("'-m' 'gpt-5.2-codex'")
+    expect(startup?.sessionOptions).toEqual({
+      model: 'gpt-5.2-codex',
+      effort: 'medium'
+    })
+  })
+
   it('does not infer an agent from auto mode', () => {
     const startup = buildOnboardingFolderAgentStartup({
       ...getDefaultSettings('/tmp/orca-workspaces'),
diff --git a/src/renderer/src/components/onboarding/onboarding-tour-outcome-tracker.test.ts b/src/renderer/src/components/onboarding/onboarding-tour-outcome-tracker.test.ts
deleted file mode 100644
index fefefe03968..00000000000
--- a/src/renderer/src/components/onboarding/onboarding-tour-outcome-tracker.test.ts
+++ /dev/null
@@ -1,122 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  createOnboardingTourOutcomeTracker,
-  markOnboardingTourIntroReached,
-  markOnboardingTourStarted,
-  recordOnboardingTourDepthSummary,
-  resolveOnboardingTourOutcome,
-  resolvePendingOnboardingTourOutcome
-} from './onboarding-tour-outcome-tracker'
-
-const depthSummary = {
-  furthest_step: 'review_ship',
-  last_group_id: 'review',
-  visited_workflow_count: 5,
-  visited_substep_count: 9,
-  completed_workflow_count: 4,
-  completed_substep_count: 7
-} as const
-
-describe('onboarding tour outcome tracker', () => {
-  it('emits one skipped outcome for one intro skip', () => {
-    const tracker = createOnboardingTourOutcomeTracker()
-    markOnboardingTourIntroReached(tracker, 100)
-
-    expect(resolveOnboardingTourOutcome(tracker, 'skipped_intro', 250, 'button')).toEqual({
-      outcome: 'skipped_intro',
-      intro_duration_ms: 150,
-      advanced_via: 'button'
-    })
-    expect(resolveOnboardingTourOutcome(tracker, 'skipped_intro', 260, 'button')).toBeNull()
-  })
-
-  it('emits one completed outcome with inline tour depth', () => {
-    const tracker = createOnboardingTourOutcomeTracker()
-    markOnboardingTourIntroReached(tracker, 100)
-    markOnboardingTourStarted(tracker, 175)
-    recordOnboardingTourDepthSummary(tracker, depthSummary)
-
-    expect(resolveOnboardingTourOutcome(tracker, 'completed_inline', 575, 'button')).toEqual({
-      outcome: 'completed_inline',
-      intro_duration_ms: 75,
-      tour_dwell_ms: 400,
-      furthest_step: 'review_ship',
-      visited_workflow_count: 5,
-      visited_substep_count: 9,
-      completed_workflow_count: 4,
-      completed_substep_count: 7,
-      advanced_via: 'button'
-    })
-    expect(resolvePendingOnboardingTourOutcome(tracker, 600)).toBeNull()
-  })
-
-  it('does not resolve a back or step jump partial before session resolution', () => {
-    const tracker = createOnboardingTourOutcomeTracker()
-    markOnboardingTourIntroReached(tracker, 100)
-    markOnboardingTourStarted(tracker, 125)
-
-    expect(tracker.startedInline).toBe(true)
-    recordOnboardingTourDepthSummary(tracker, {
-      visited_workflow_count: 1,
-      visited_substep_count: 0,
-      completed_workflow_count: 1,
-      completed_substep_count: 0
-    })
-    expect(resolveOnboardingTourOutcome(tracker, 'completed_inline', 225, 'button')).toMatchObject({
-      outcome: 'completed_inline'
-    })
-    expect(resolvePendingOnboardingTourOutcome(tracker, 250)).toBeNull()
-  })
-
-  it('classifies a started tour as partial even if the final action is skip', () => {
-    const tracker = createOnboardingTourOutcomeTracker()
-    markOnboardingTourIntroReached(tracker, 100)
-    markOnboardingTourStarted(tracker, 150)
-    recordOnboardingTourDepthSummary(tracker, {
-      furthest_step: 'tasks',
-      last_group_id: 'tasks',
-      visited_workflow_count: 2,
-      visited_substep_count: 0,
-      completed_workflow_count: 1,
-      completed_substep_count: 0
-    })
-
-    expect(resolveOnboardingTourOutcome(tracker, 'skipped_intro', 400, 'button')).toEqual({
-      outcome: 'started_partial',
-      intro_duration_ms: 50,
-      tour_dwell_ms: 250,
-      furthest_step: 'tasks',
-      visited_workflow_count: 2,
-      visited_substep_count: 0,
-      completed_workflow_count: 1,
-      completed_substep_count: 0,
-      advanced_via: 'button'
-    })
-  })
-
-  it('emits at most one pending partial on session close or unmount', () => {
-    const tracker = createOnboardingTourOutcomeTracker()
-    markOnboardingTourIntroReached(tracker, 100)
-    markOnboardingTourStarted(tracker, 150)
-    recordOnboardingTourDepthSummary(tracker, {
-      furthest_step: 'workbench_editor',
-      last_group_id: 'workbench',
-      visited_workflow_count: 1,
-      visited_substep_count: 2,
-      completed_workflow_count: 0,
-      completed_substep_count: 2
-    })
-
-    expect(resolvePendingOnboardingTourOutcome(tracker, 450)).toEqual({
-      outcome: 'started_partial',
-      intro_duration_ms: 50,
-      tour_dwell_ms: 300,
-      furthest_step: 'workbench_editor',
-      visited_workflow_count: 1,
-      visited_substep_count: 2,
-      completed_workflow_count: 0,
-      completed_substep_count: 2
-    })
-    expect(resolvePendingOnboardingTourOutcome(tracker, 475)).toBeNull()
-  })
-})
diff --git a/src/renderer/src/components/onboarding/onboarding-tour-outcome-tracker.ts b/src/renderer/src/components/onboarding/onboarding-tour-outcome-tracker.ts
deleted file mode 100644
index 069f5679465..00000000000
--- a/src/renderer/src/components/onboarding/onboarding-tour-outcome-tracker.ts
+++ /dev/null
@@ -1,122 +0,0 @@
-import { FEATURE_WALL_MAX_DWELL_MS } from '../../../../shared/feature-wall-telemetry'
-import type { FeatureWallTourDepthSummary } from '../../../../shared/feature-wall-tour-depth'
-import type { EventProps } from '../../../../shared/telemetry-events'
-
-type OnboardingTourOutcome = EventProps<'onboarding_tour_outcome'>['outcome']
-type OnboardingTourOutcomePayload = EventProps<'onboarding_tour_outcome'>
-
-export type OnboardingTourOutcomeTracker = {
-  reachedIntro: boolean
-  startedInline: boolean
-  completedInline: boolean
-  emitted: boolean
-  introStartedAtMs: number | null
-  introDurationMs: number | null
-  tourStartedAtMs: number | null
-  latestDepthSummary: FeatureWallTourDepthSummary | null
-}
-
-export function createOnboardingTourOutcomeTracker(): OnboardingTourOutcomeTracker {
-  return {
-    reachedIntro: false,
-    startedInline: false,
-    completedInline: false,
-    emitted: false,
-    introStartedAtMs: null,
-    introDurationMs: null,
-    tourStartedAtMs: null,
-    latestDepthSummary: null
-  }
-}
-
-function boundedDurationMs(startedAtMs: number | null, nowMs: number): number | undefined {
-  if (startedAtMs === null) {
-    return undefined
-  }
-  return Math.min(FEATURE_WALL_MAX_DWELL_MS, Math.max(0, Math.round(nowMs - startedAtMs)))
-}
-
-export function markOnboardingTourIntroReached(
-  tracker: OnboardingTourOutcomeTracker,
-  nowMs: number
-): void {
-  if (tracker.reachedIntro) {
-    return
-  }
-  tracker.reachedIntro = true
-  tracker.introStartedAtMs = nowMs
-}
-
-export function markOnboardingTourStarted(
-  tracker: OnboardingTourOutcomeTracker,
-  nowMs: number
-): void {
-  if (!tracker.reachedIntro) {
-    markOnboardingTourIntroReached(tracker, nowMs)
-  }
-  tracker.startedInline = true
-  tracker.introDurationMs = boundedDurationMs(tracker.introStartedAtMs, nowMs) ?? 0
-  tracker.tourStartedAtMs = nowMs
-}
-
-export function recordOnboardingTourDepthSummary(
-  tracker: OnboardingTourOutcomeTracker,
-  summary: FeatureWallTourDepthSummary
-): void {
-  tracker.latestDepthSummary = summary
-}
-
-export function resolveOnboardingTourOutcome(
-  tracker: OnboardingTourOutcomeTracker,
-  outcome: OnboardingTourOutcome,
-  nowMs: number,
-  advancedVia?: NonNullable<OnboardingTourOutcomePayload['advanced_via']>
-): OnboardingTourOutcomePayload | null {
-  if (!tracker.reachedIntro || tracker.emitted) {
-    return null
-  }
-  const resolvedOutcome =
-    tracker.completedInline || outcome === 'completed_inline'
-      ? 'completed_inline'
-      : tracker.startedInline
-        ? 'started_partial'
-        : outcome
-  const introDurationMs =
-    tracker.introDurationMs ?? boundedDurationMs(tracker.introStartedAtMs, nowMs)
-  const depthSummary = resolvedOutcome === 'skipped_intro' ? null : tracker.latestDepthSummary
-  const tourDwellMs =
-    resolvedOutcome === 'skipped_intro'
-      ? undefined
-      : boundedDurationMs(tracker.tourStartedAtMs, nowMs)
-
-  tracker.emitted = true
-  if (resolvedOutcome === 'completed_inline') {
-    tracker.completedInline = true
-  }
-
-  return {
-    outcome: resolvedOutcome,
-    ...(introDurationMs !== undefined ? { intro_duration_ms: introDurationMs } : {}),
-    ...(tourDwellMs !== undefined ? { tour_dwell_ms: tourDwellMs } : {}),
-    ...(depthSummary
-      ? {
-          ...(depthSummary.furthest_step ? { furthest_step: depthSummary.furthest_step } : {}),
-          visited_workflow_count: depthSummary.visited_workflow_count,
-          visited_substep_count: depthSummary.visited_substep_count,
-          completed_workflow_count: depthSummary.completed_workflow_count,
-          completed_substep_count: depthSummary.completed_substep_count
-        }
-      : {}),
-    ...(advancedVia ? { advanced_via: advancedVia } : {})
-  }
-}
-
-export function resolvePendingOnboardingTourOutcome(
-  tracker: OnboardingTourOutcomeTracker,
-  nowMs: number
-): OnboardingTourOutcomePayload | null {
-  if (!tracker.startedInline || tracker.completedInline) {
-    return null
-  }
-  return resolveOnboardingTourOutcome(tracker, 'started_partial', nowMs)
-}
diff --git a/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.test.ts b/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.test.ts
index 893e1c38fac..1dfbc0c708a 100644
--- a/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.test.ts
+++ b/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.test.ts
@@ -23,9 +23,8 @@ import type { StepNumber } from './use-onboarding-flow-types'
 
 type CloseWithCallback = (
   outcome: 'completed' | 'dismissed',
-  checklist: Partial<OnboardingState['checklist']>,
   lastStepReached: StepNumber,
-  completedPath?: 'open_folder' | 'clone_url' | 'add_project_modal',
+  completedPath?: 'add_project_modal',
   dismissedExtras?: DismissedExtras
 ) => Promise<boolean>
 
@@ -48,7 +47,6 @@ function setApi(api: {
 function CloseWithProbe(props: { onReady: (closeWith: CloseWithCallback) => void }): null {
   const closeWith = useCloseWith({
     onOnboardingChange: vi.fn(),
-    onboardingChecklist: makeOnboardingState().checklist,
     startTimeRef: { current: Date.now() },
     setError: vi.fn()
   })
@@ -145,7 +143,7 @@ describe('onboarding flow persistence', () => {
     }))
 
     await act(async () => {
-      await closeWith?.('completed', {}, 5)
+      await closeWith?.('completed', 5)
     })
 
     const api = (
diff --git a/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.ts b/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.ts
index c0354249fc5..12a8c6e22a2 100644
--- a/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.ts
+++ b/src/renderer/src/components/onboarding/use-onboarding-flow-persistence.ts
@@ -35,7 +35,6 @@ export function buildCompletedOnboardingNotificationSettings(
 
 type CloseWithDeps = {
   onOnboardingChange: (state: OnboardingState) => void
-  onboardingChecklist: OnboardingState['checklist']
   startTimeRef: { current: number }
   setError: (msg: string | null) => void
 }
@@ -67,12 +66,7 @@ export function trackOnboardingDismissed(
   track('onboarding_dismissed', buildOnboardingDismissedPayload(lastStepReached, dismissedExtras))
 }
 
-export function useCloseWith({
-  onOnboardingChange,
-  onboardingChecklist,
-  startTimeRef,
-  setError
-}: CloseWithDeps) {
+export function useCloseWith({ onOnboardingChange, startTimeRef, setError }: CloseWithDeps) {
   // Why: onboarding closes exactly once. On the final notifications step both
   // the "Add your first project" handoff (completed) and a click-off/Escape
   // dismissal (dismissed) can reach closeWith, and next()'s persist window
@@ -83,9 +77,8 @@ export function useCloseWith({
   return useCallback(
     async (
       outcome: 'completed' | 'dismissed',
-      checklist: Partial<OnboardingState['checklist']>,
       lastStepReached: StepNumber,
-      completedPath?: 'open_folder' | 'clone_url' | 'add_project_modal',
+      completedPath?: 'add_project_modal',
       dismissedExtras?: DismissedExtras
     ): Promise<boolean> => {
       if (closedRef.current) {
@@ -94,18 +87,12 @@ export function useCloseWith({
       closedRef.current = true
       let nextState: OnboardingState
       try {
-        // Why: main-process updateOnboarding already merges with current state,
-        // so spreading the local (potentially stale) onboarding.checklist would
-        // overwrite concurrent updates.
         nextState = await window.api.onboarding.update({
           flowVersion: ONBOARDING_FLOW_VERSION,
           closedAt: Date.now(),
           outcome,
           lastCompletedStep: outcome === 'completed' ? ONBOARDING_FINAL_STEP : -1,
-          checklist: {
-            ...checklist,
-            dismissed: outcome === 'dismissed'
-          }
+          checklist: { dismissed: outcome === 'dismissed' }
         })
       } catch (err) {
         // Why: the persist failed, so onboarding did not actually close — clear
@@ -124,22 +111,6 @@ export function useCloseWith({
           path: completedPath,
           total_duration_ms: total
         })
-        // Why: checklist items completed by the wizard itself must fire
-        // `activation_checklist_item_completed` so the post-wizard panel and
-        // analytics agree. Other items (ranFirstAgent, triedCmdJ, …) emit
-        // from their own product surfaces.
-        if (checklist.addedRepo && !onboardingChecklist.addedRepo) {
-          track('activation_checklist_item_completed', {
-            item: 'addedRepo',
-            time_since_completed_ms: 0
-          })
-        }
-        if (checklist.addedFolder && !onboardingChecklist.addedFolder) {
-          track('activation_checklist_item_completed', {
-            item: 'addedFolder',
-            time_since_completed_ms: 0
-          })
-        }
       }
       if (outcome === 'completed') {
         // Why: closeWith updates parent state synchronously from this hook's
@@ -152,7 +123,7 @@ export function useCloseWith({
       }
       return true
     },
-    [onOnboardingChange, onboardingChecklist, startTimeRef, setError]
+    [onOnboardingChange, startTimeRef, setError]
   )
 }
 
diff --git a/src/renderer/src/components/onboarding/use-onboarding-flow.default-checkout.test.ts b/src/renderer/src/components/onboarding/use-onboarding-flow.default-checkout.test.ts
deleted file mode 100644
index 62f2df5b254..00000000000
--- a/src/renderer/src/components/onboarding/use-onboarding-flow.default-checkout.test.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const ONBOARDING_FLOW_PATH = join(import.meta.dirname, 'use-onboarding-flow.ts')
-
-describe('useOnboardingFlow project-added handoff', () => {
-  it('routes Git repo completion through the shared default-checkout opener', () => {
-    const source = readFileSync(ONBOARDING_FLOW_PATH, 'utf8')
-
-    expect(source).toContain('openProjectDefaultCheckout({')
-    expect(source).toContain('repoId: projectId')
-    expect(source).toContain(
-      "source: path === 'clone_url' ? 'onboarding_clone_url' : 'onboarding_open_folder'"
-    )
-    expect(source).toContain('setHideDefaultBranchWorkspace')
-    expect(source).not.toContain("openModal('project-added'")
-  })
-})
diff --git a/src/renderer/src/components/onboarding/use-onboarding-flow.test.ts b/src/renderer/src/components/onboarding/use-onboarding-flow.test.ts
index 39270546c94..0133a720059 100644
--- a/src/renderer/src/components/onboarding/use-onboarding-flow.test.ts
+++ b/src/renderer/src/components/onboarding/use-onboarding-flow.test.ts
@@ -43,7 +43,7 @@ describe('prepareSkippedOnboardingPreferences', () => {
     })
   })
 
-  it('keeps the selected agent preference before jumping to repo setup', async () => {
+  it('keeps the selected agent preference before opening project setup', async () => {
     const setTheme = vi.fn()
     const applyTheme = vi.fn()
     const updateSettings = vi.fn().mockResolvedValue(undefined)
diff --git a/src/renderer/src/components/onboarding/use-onboarding-flow.ts b/src/renderer/src/components/onboarding/use-onboarding-flow.ts
index b21b4c742e8..b5376b363f1 100644
--- a/src/renderer/src/components/onboarding/use-onboarding-flow.ts
+++ b/src/renderer/src/components/onboarding/use-onboarding-flow.ts
@@ -3,35 +3,15 @@ import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { toast } from 'sonner'
 import { getAgentCatalog } from '@/lib/agent-catalog'
 import { useAppStore } from '@/store'
-import { activateAndRevealWorktree } from '@/lib/worktree-activation'
 import { applyDocumentTheme } from '@/lib/document-theme'
 import { track } from '@/lib/telemetry'
-import { getSelectedNestedRepoPathsInScanOrder } from '@/lib/nested-repo-selected-paths'
 import { buildAgentPickedPayload } from './agent-picked-payload'
 import { ONBOARDING_FINAL_STEP, ONBOARDING_FLOW_VERSION } from '../../../../shared/constants'
-import { isGitRepoKind } from '../../../../shared/repo-kind'
-import {
-  buildNestedRepoImportActionTelemetry,
-  buildNestedRepoImportResultTelemetry,
-  buildNestedRepoScanTelemetry,
-  createNestedRepoTelemetryAttemptId,
-  shouldEmitNestedRepoImportSubmitTelemetry,
-  type NestedRepoTelemetryRuntimeKind
-} from '../../../../shared/nested-repo-telemetry'
 import type { EventProps } from '../../../../shared/telemetry-events'
-import type {
-  GlobalSettings,
-  NestedRepoScanResult,
-  OnboardingState,
-  Repo,
-  TuiAgent
-} from '../../../../shared/types'
+import type { GlobalSettings, OnboardingState, TuiAgent } from '../../../../shared/types'
 import { STEPS, type StepNumber } from './use-onboarding-flow-types'
 import { persistStep, useCloseWith, usePersistCurrentStep } from './use-onboarding-flow-persistence'
-import { callRuntimeRpc, getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
-import { buildOnboardingFolderAgentStartup } from '@/lib/onboarding-folder-agent-startup'
 import { resolveOnboardingSettingsHydration } from './onboarding-settings-hydration'
-import { openProjectDefaultCheckout } from '../sidebar/project-added-default-checkout'
 import { translate } from '@/i18n/i18n'
 import { resolveAgentPermissionModeSummary } from '../../../../shared/tui-agent-permissions'
 import { isWindowsUserAgent } from '@/components/terminal-pane/pane-helpers'
@@ -85,10 +65,6 @@ function resolveStepIndex(
   return nextIndex
 }
 
-function createNestedRepoScanId(): string {
-  return `nested-repo-scan-${Date.now()}-${Math.random().toString(36).slice(2)}`
-}
-
 function getGitHubTaskSourceStatus(
   status: ReturnType<typeof useAppStore.getState>['preflightStatus'],
   loading: boolean
@@ -187,7 +163,7 @@ export async function prepareSkippedOnboardingPreferences({
         await updateSettings({ theme: themeToRestore })
       }
     }
-    // Why: the repo step seeds folder terminals from saved settings, so preserve the visible agent choice on skip.
+    // Why: skipping bypasses step persistence, so save the visible agent choice before closing.
     if (currentStepId === 'agent' && selectedAgent) {
       await updateSettings({ defaultTuiAgent: selectedAgent })
     }
@@ -208,10 +184,8 @@ export async function prepareSkippedOnboardingPreferences({
 
 export function useOnboardingFlow(
   onboarding: OnboardingState,
-  onOnboardingChange: (state: OnboardingState) => void,
-  options: { onSettingsDetourStart?: () => void } = {}
+  onOnboardingChange: (state: OnboardingState) => void
 ) {
-  const { onSettingsDetourStart } = options
   const settings = useAppStore((s) => s.settings)
   const updateSettings = useAppStore((s) => s.updateSettings)
   const refreshDetectedAgents = useAppStore((s) => s.refreshDetectedAgents)
@@ -219,24 +193,13 @@ export function useOnboardingFlow(
   const isDetectingAgents = useAppStore((s) => s.isDetectingAgents || s.isRefreshingAgents)
   const pathSource = useAppStore((s) => s.pathSource)
   const pathFailureReason = useAppStore((s) => s.pathFailureReason)
-  const fetchRepos = useAppStore((s) => s.fetchRepos)
-  const fetchWorktrees = useAppStore((s) => s.fetchWorktrees)
-  const setHideDefaultBranchWorkspace = useAppStore((s) => s.setHideDefaultBranchWorkspace)
-  const addRepoPath = useAppStore((s) => s.addRepoPath)
-  const scanNestedRepos = useAppStore((s) => s.scanNestedRepos)
-  const cancelNestedRepoScan = useAppStore((s) => s.cancelNestedRepoScan)
-  const importNestedRepos = useAppStore((s) => s.importNestedRepos)
   const openModal = useAppStore((s) => s.openModal)
-  const openSettingsPage = useAppStore((s) => s.openSettingsPage)
-  const openSettingsTarget = useAppStore((s) => s.openSettingsTarget)
   const preflightStatus = useAppStore((s) => s.preflightStatus)
   const preflightStatusChecked = useAppStore((s) => s.preflightStatusChecked)
   const preflightStatusLoading = useAppStore((s) => s.preflightStatusLoading)
   const refreshPreflightStatus = useAppStore((s) => s.refreshPreflightStatus)
   const linearStatus = useAppStore((s) => s.linearStatus)
   const linearStatusChecked = useAppStore((s) => s.linearStatusChecked)
-  // Why: repos are hydrated before onboarding mounts; the sync read lets the final step render added state without a flash.
-  const repos = useAppStore((s) => s.repos)
   // Why: renderToStaticMarkup uses Zustand's initial snapshot; the sync read keeps tests and the first client render aligned.
   const effectivePreflightStatus = preflightStatus ?? useAppStore.getState().preflightStatus
 
@@ -266,20 +229,8 @@ export function useOnboardingFlow(
   )
   // Why: hydrate theme from saved settings so users who already chose one see it preselected.
   const [theme, setTheme] = useState<GlobalSettings['theme']>(settings?.theme ?? 'dark')
-  const [cloneUrl, setCloneUrl] = useState('')
-  const [serverPath, setServerPath] = useState('')
-  const [cloneDestination, setCloneDestination] = useState('')
-  const [nestedScan, setNestedScan] = useState<NestedRepoScanResult | null>(null)
-  const [nestedSelectedPaths, setNestedSelectedPaths] = useState<Set<string>>(new Set())
-  const [nestedAttemptId, setNestedAttemptId] = useState<string | null>(null)
-  const [nestedRuntimeKind, setNestedRuntimeKind] = useState<NestedRepoTelemetryRuntimeKind | null>(
-    null
-  )
-  const [nestedScanInProgress, setNestedScanInProgress] = useState(false)
-  const [nestedImportScanId, setNestedImportScanId] = useState<string | null>(null)
-  const nestedScanIdRef = useRef<string | null>(null)
   const [busyLabel, setBusyLabel] = useState<string | null>(null)
-  const [error, setError] = useState<string | null>(null)
+  const [, setError] = useState<string | null>(null)
 
   // Why: settings hydrate async after the lazy initializers run; re-sync once before commit unless the user edited the field.
   const themeInteractedRef = useRef(false)
@@ -377,8 +328,6 @@ export function useOnboardingFlow(
     0,
     progressSteps.findIndex(({ index }) => index === displayedStepIndex)
   )
-  const hasExistingProject = repos.length > 0
-
   // Why: pin start time once so onboarding_completed reports a real funnel duration.
   const startTimeRef = useRef<number>(Date.now())
 
@@ -528,58 +477,10 @@ export function useOnboardingFlow(
 
   const closeWith = useCloseWith({
     onOnboardingChange,
-    onboardingChecklist: onboarding.checklist,
     startTimeRef,
     setError
   })
 
-  const completeRepo = useCallback(
-    async (projectId: string, isGit: boolean, path: 'open_folder' | 'clone_url') => {
-      await fetchRepos()
-      // Why: a non-authoritative Git refresh should still complete onboarding onto the project row as a fallback.
-      await fetchWorktrees(projectId, isGit ? { requireAuthoritative: true } : undefined)
-      const worktrees = useAppStore.getState().worktreesByRepo[projectId] ?? []
-      if (isGit) {
-        await openProjectDefaultCheckout({
-          repoId: projectId,
-          source: path === 'clone_url' ? 'onboarding_clone_url' : 'onboarding_open_folder',
-          setHideDefaultBranchWorkspace
-        })
-      } else {
-        const worktree = worktrees[0] ?? null
-        if (worktree) {
-          // Why: non-git folders skip the composer, so seed their first terminal with the chosen default agent here.
-          const startup = buildOnboardingFolderAgentStartup(settings)
-          activateAndRevealWorktree(worktree.id, { startup })
-        }
-      }
-      // Why: next() short-circuits the repo step; emit step_completed here, gated on closeWith success so a persistence failure can't double-count.
-      const closed = await closeWith(
-        'completed',
-        isGit ? { addedRepo: true } : { addedFolder: true },
-        ONBOARDING_FINAL_STEP,
-        path
-      )
-      if (!closed) {
-        return
-      }
-      // Why: the final repo step has no keyboard-vs-button distinction, so emit duration_ms without advanced_via. See docs/onboarding-telemetry-extensions.md §3.
-      track('onboarding_step_completed', {
-        step: ONBOARDING_FINAL_STEP,
-        value_kind: 'repo',
-        duration_ms: consumeStepDurationMs()
-      })
-    },
-    [
-      closeWith,
-      consumeStepDurationMs,
-      fetchRepos,
-      fetchWorktrees,
-      setHideDefaultBranchWorkspace,
-      settings
-    ]
-  )
-
   const persistCurrentStep = usePersistCurrentStep({
     currentStepId: currentStep.id,
     selectedAgent,
@@ -639,12 +540,7 @@ export function useOnboardingFlow(
           trackCurrentStepCompleted(advancedVia)
           if (currentStep.id === 'notifications') {
             setBusyLabel('Opening Add Project...')
-            const closed = await closeWith(
-              'completed',
-              {},
-              ONBOARDING_FINAL_STEP,
-              'add_project_modal'
-            )
+            const closed = await closeWith('completed', ONBOARDING_FINAL_STEP, 'add_project_modal')
             if (closed) {
               openModal('add-repo')
             }
@@ -689,388 +585,6 @@ export function useOnboardingFlow(
     ]
   )
 
-  const showNestedRepoReview = useCallback(
-    (
-      scan: NestedRepoScanResult,
-      attemptId: string,
-      runtimeKind: NestedRepoTelemetryRuntimeKind,
-      inProgress = false,
-      scanId: string | null = null
-    ) => {
-      setNestedScan(scan)
-      setNestedSelectedPaths(new Set(scan.repos.map((repo) => repo.path)))
-      setNestedAttemptId(attemptId)
-      setNestedRuntimeKind(runtimeKind)
-      setNestedScanInProgress(inProgress)
-      setNestedImportScanId(scanId)
-    },
-    []
-  )
-
-  const onboardingNestedRepoRuntimeKind: NestedRepoTelemetryRuntimeKind =
-    settings?.activeRuntimeEnvironmentId?.trim() ? 'runtime' : 'local'
-
-  const openFolder = useCallback(
-    async (kind: 'git' | 'folder' = 'git') => {
-      // Why: re-entry guard — rapid Cmd+Enter must not launch duplicate pickers.
-      if (busyLabel !== null) {
-        return
-      }
-      setError(null)
-      if (settings?.activeRuntimeEnvironmentId?.trim()) {
-        const path = serverPath.trim()
-        if (!path) {
-          const message = 'Enter a path on the selected host.'
-          setError(message)
-          return
-        }
-        track('onboarding_step4_path_clicked', { path: 'open_folder' })
-        setBusyLabel(kind === 'git' ? 'Scanning for repositories…' : 'Opening folder…')
-        try {
-          if (kind === 'git') {
-            const attemptId = createNestedRepoTelemetryAttemptId()
-            const scan = await scanNestedRepos(path)
-            track(
-              'add_repo_nested_scan_result',
-              buildNestedRepoScanTelemetry({
-                attemptId,
-                surface: 'onboarding',
-                runtimeKind: 'runtime',
-                scan
-              })
-            )
-            if (scan?.selectedPathKind === 'non_git_folder' && scan.repos.length > 0) {
-              showNestedRepoReview(scan, attemptId, 'runtime')
-              return
-            }
-          }
-          setBusyLabel(kind === 'git' ? 'Opening project…' : 'Opening folder…')
-          const repo = await addRepoPath(path, kind)
-          if (!repo) {
-            track('onboarding_step4_path_failed', { path: 'open_folder', reason: 'invalid_path' })
-            return
-          }
-          await completeRepo(repo.id, isGitRepoKind(repo), 'open_folder')
-        } catch (err) {
-          setError(err instanceof Error ? err.message : String(err))
-          track('onboarding_step4_path_failed', { path: 'open_folder', reason: 'invalid_path' })
-        } finally {
-          nestedScanIdRef.current = null
-          setNestedScanInProgress(false)
-          setBusyLabel(null)
-        }
-        return
-      }
-      track('onboarding_step4_path_clicked', { path: 'open_folder' })
-      const path = await window.api.repos.pickFolder()
-      if (!path) {
-        track('onboarding_step4_path_failed', { path: 'open_folder', reason: 'cancelled' })
-        return
-      }
-      setBusyLabel('Opening project…')
-      try {
-        let result = await window.api.repos.add({ path })
-        if ('error' in result && result.error.includes('Not a valid git repository')) {
-          setBusyLabel('Scanning for repositories...')
-          const attemptId = createNestedRepoTelemetryAttemptId()
-          const scanId = createNestedRepoScanId()
-          nestedScanIdRef.current = scanId
-          setNestedScanInProgress(true)
-          const scan = await scanNestedRepos(path, undefined, {
-            scanId,
-            onProgress: (progressScan) => {
-              if (
-                nestedScanIdRef.current !== scanId ||
-                progressScan.selectedPathKind !== 'non_git_folder' ||
-                progressScan.repos.length === 0
-              ) {
-                return
-              }
-              showNestedRepoReview(progressScan, attemptId, 'local', true, scanId)
-            }
-          })
-          if (nestedScanIdRef.current !== scanId) {
-            return
-          }
-          nestedScanIdRef.current = null
-          setNestedScanInProgress(false)
-          track(
-            'add_repo_nested_scan_result',
-            buildNestedRepoScanTelemetry({
-              attemptId,
-              surface: 'onboarding',
-              runtimeKind: 'local',
-              scan
-            })
-          )
-          if (scan?.selectedPathKind === 'non_git_folder' && scan.repos.length > 0) {
-            showNestedRepoReview(scan, attemptId, 'local', false, scanId)
-            return
-          }
-          result = await window.api.repos.add({ path, kind: 'folder' })
-        }
-        if ('error' in result) {
-          throw new Error(result.error)
-        }
-        await completeRepo(result.repo.id, isGitRepoKind(result.repo), 'open_folder')
-      } catch (err) {
-        setError(err instanceof Error ? err.message : String(err))
-        track('onboarding_step4_path_failed', { path: 'open_folder', reason: 'invalid_path' })
-      } finally {
-        nestedScanIdRef.current = null
-        setNestedScanInProgress(false)
-        setBusyLabel(null)
-      }
-    },
-    [
-      addRepoPath,
-      busyLabel,
-      completeRepo,
-      scanNestedRepos,
-      serverPath,
-      showNestedRepoReview,
-      settings?.activeRuntimeEnvironmentId
-    ]
-  )
-
-  const importNested = useCallback(async () => {
-    const mode = 'separate'
-    const attemptId = nestedAttemptId
-    if (
-      !nestedScan ||
-      !attemptId ||
-      !shouldEmitNestedRepoImportSubmitTelemetry({
-        attemptId,
-        selectedCount: nestedSelectedPaths.size,
-        isBusy: busyLabel !== null
-      })
-    ) {
-      return
-    }
-    const foundCount = nestedScan.repos.length
-    const selectedCount = nestedSelectedPaths.size
-    const runtimeKind = nestedRuntimeKind ?? onboardingNestedRepoRuntimeKind
-    setError(null)
-    setBusyLabel('Importing repositories…')
-    track(
-      'add_repo_nested_import_action',
-      buildNestedRepoImportActionTelemetry({
-        attemptId,
-        surface: 'onboarding',
-        runtimeKind,
-        action: 'import_separate',
-        foundCount,
-        selectedCount
-      })
-    )
-    let resultTracked = false
-    try {
-      const selectedProjectPaths = getSelectedNestedRepoPathsInScanOrder(
-        nestedScan,
-        nestedSelectedPaths
-      )
-      const result = await importNestedRepos({
-        parentPath: nestedScan.selectedPath,
-        groupName: '',
-        // Why: Set insertion order can drift after deselect/reselect; match the visible scan order users reviewed.
-        projectPaths: selectedProjectPaths,
-        ...(nestedImportScanId ? { scanId: nestedImportScanId } : {}),
-        mode
-      })
-      track(
-        'add_repo_nested_import_result',
-        buildNestedRepoImportResultTelemetry({
-          attemptId,
-          surface: 'onboarding',
-          runtimeKind,
-          mode,
-          foundCount,
-          selectedCount,
-          result
-        })
-      )
-      resultTracked = true
-      const importedRepoIds =
-        result?.projects
-          .map((entry) => entry.projectId)
-          .filter((projectId): projectId is string => typeof projectId === 'string') ?? []
-      const projectId = importedRepoIds[0]
-      if (!projectId) {
-        const firstFailure = result?.projects.find((entry) => entry.status === 'failed')?.error
-        throw new Error(
-          firstFailure ? `No repositories imported: ${firstFailure}` : 'No repositories imported'
-        )
-      }
-      for (const importedRepoId of importedRepoIds) {
-        // Why: imported repos are already persisted, so a non-authoritative SSH refresh shouldn't block revealing the first project.
-        await fetchWorktrees(importedRepoId, { requireAuthoritative: true })
-      }
-      await completeRepo(projectId, true, 'open_folder')
-    } catch (err) {
-      if (!resultTracked) {
-        track(
-          'add_repo_nested_import_result',
-          buildNestedRepoImportResultTelemetry({
-            attemptId,
-            surface: 'onboarding',
-            runtimeKind,
-            mode,
-            foundCount,
-            selectedCount,
-            result: null
-          })
-        )
-      }
-      setError(err instanceof Error ? err.message : String(err))
-      track('onboarding_step4_path_failed', { path: 'open_folder', reason: 'invalid_path' })
-    } finally {
-      setBusyLabel(null)
-    }
-  }, [
-    busyLabel,
-    completeRepo,
-    fetchWorktrees,
-    importNestedRepos,
-    nestedAttemptId,
-    nestedScan,
-    nestedSelectedPaths,
-    nestedImportScanId,
-    nestedRuntimeKind,
-    onboardingNestedRepoRuntimeKind
-  ])
-
-  const trackNestedBackAndClear = useCallback(() => {
-    if (nestedScan && nestedAttemptId) {
-      track(
-        'add_repo_nested_import_action',
-        buildNestedRepoImportActionTelemetry({
-          attemptId: nestedAttemptId,
-          surface: 'onboarding',
-          runtimeKind: nestedRuntimeKind ?? onboardingNestedRepoRuntimeKind,
-          action: 'back',
-          foundCount: nestedScan.repos.length,
-          selectedCount: nestedSelectedPaths.size
-        })
-      )
-    }
-    setNestedScan(null)
-    setNestedSelectedPaths(new Set())
-    setNestedAttemptId(null)
-    setNestedRuntimeKind(null)
-    setNestedScanInProgress(false)
-    setNestedImportScanId(null)
-    nestedScanIdRef.current = null
-    setBusyLabel(null)
-    setError(null)
-  }, [
-    nestedAttemptId,
-    nestedRuntimeKind,
-    nestedScan,
-    nestedSelectedPaths.size,
-    onboardingNestedRepoRuntimeKind
-  ])
-
-  // Why: lets the user back out of the nested-repo step to re-pick a folder/clone target.
-  const cancelNested = useCallback(() => {
-    if (busyLabel !== null && !nestedScanInProgress) {
-      return
-    }
-    if (nestedScanInProgress && nestedScanIdRef.current) {
-      void cancelNestedRepoScan(nestedScanIdRef.current)
-    }
-    trackNestedBackAndClear()
-  }, [busyLabel, cancelNestedRepoScan, nestedScanInProgress, trackNestedBackAndClear])
-
-  const stopNestedScan = useCallback(() => {
-    const scanId = nestedScanIdRef.current
-    if (!scanId) {
-      return
-    }
-    void cancelNestedRepoScan(scanId)
-  }, [cancelNestedRepoScan])
-
-  const canImportNestedForTelemetry = useCallback((): boolean => {
-    return Boolean(nestedScan && nestedAttemptId && nestedSelectedPaths.size > 0)
-  }, [nestedAttemptId, nestedScan, nestedSelectedPaths.size])
-
-  const clone = useCallback(async () => {
-    // Why: re-entry guard — prevents Enter spamming from triggering duplicate clones.
-    if (busyLabel !== null) {
-      return
-    }
-    const trimmed = cloneUrl.trim()
-    if (!trimmed || !settings) {
-      return
-    }
-    setError(null)
-    track('onboarding_step4_path_clicked', { path: 'clone_url' })
-    const target = getActiveRuntimeTarget(settings)
-    const destination =
-      target.kind === 'environment' ? cloneDestination.trim() : settings.workspaceDir
-    if (!destination) {
-      const message = 'Enter a host path for the clone destination.'
-      setError(message)
-      return
-    }
-    setBusyLabel('Cloning repo…')
-    try {
-      const repo =
-        target.kind === 'environment'
-          ? (
-              await callRuntimeRpc<{ repo: Repo }>(
-                target,
-                'repo.clone',
-                { url: trimmed, destination },
-                { timeoutMs: 10 * 60_000 }
-              )
-            ).repo
-          : await window.api.repos.clone({
-              url: trimmed,
-              destination
-            })
-      await completeRepo(repo.id, true, 'clone_url')
-    } catch (err) {
-      setError(err instanceof Error ? err.message : String(err))
-      track('onboarding_step4_path_failed', { path: 'clone_url', reason: 'clone_failed' })
-      toast.error(
-        translate('auto.components.onboarding.use.onboarding.flow.fd74e7558e', 'Clone failed'),
-        {
-          description: err instanceof Error ? err.message : String(err)
-        }
-      )
-    } finally {
-      setBusyLabel(null)
-    }
-  }, [busyLabel, cloneDestination, cloneUrl, completeRepo, settings])
-
-  const continueWithExistingProject = useCallback(
-    async (advancedVia: 'button' | 'keyboard' = 'button') => {
-      if (busyLabel !== null || repos.length === 0) {
-        return
-      }
-      setError(null)
-      setBusyLabel('Finishing...')
-      try {
-        const checklist = repos.some((repo) => isGitRepoKind(repo))
-          ? { addedRepo: true }
-          : { addedFolder: true }
-        const closed = await closeWith('completed', checklist, ONBOARDING_FINAL_STEP)
-        if (!closed) {
-          return
-        }
-        track('onboarding_step_completed', {
-          step: ONBOARDING_FINAL_STEP,
-          value_kind: 'repo',
-          duration_ms: consumeStepDurationMs(),
-          advanced_via: advancedVia
-        })
-      } finally {
-        setBusyLabel(null)
-      }
-    },
-    [busyLabel, closeWith, consumeStepDurationMs, repos]
-  )
-
   const skipToRepo = useCallback(async () => {
     if (busyLabel) {
       return
@@ -1098,7 +612,7 @@ export function useOnboardingFlow(
     const valueKind = currentStep.valueKind
     setBusyLabel('Opening Add Project...')
     try {
-      const closed = await closeWith('completed', {}, ONBOARDING_FINAL_STEP, 'add_project_modal')
+      const closed = await closeWith('completed', ONBOARDING_FINAL_STEP, 'add_project_modal')
       if (!closed) {
         return
       }
@@ -1147,76 +661,23 @@ export function useOnboardingFlow(
         return false
       }
       setError(null)
-      const closed = await closeWith('dismissed', {}, currentStep.stepNumber, undefined, {
+      return closeWith('dismissed', currentStep.stepNumber, undefined, {
         durationMs: consumeStepDurationMs(),
         advancedVia
       })
-      if (closed) {
-        if (nestedScan) {
-          trackNestedBackAndClear()
-        }
-      }
-      return closed
     },
-    [
-      busyLabel,
-      closeWith,
-      consumeStepDurationMs,
-      currentStep.stepNumber,
-      nestedScan,
-      trackNestedBackAndClear
-    ]
+    [busyLabel, closeWith, consumeStepDurationMs, currentStep.stepNumber]
   )
 
-  const openSshSettings = useCallback(async () => {
-    if (busyLabel) {
-      return
-    }
-    setError(null)
-    try {
-      onOnboardingChange(await persistStep(currentStep.stepNumber - 1))
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err)
-      setError(message)
-      toast.error(
-        translate(
-          'auto.components.onboarding.use.onboarding.flow.dce4bdce5b',
-          'Could not open SSH settings'
-        ),
-        { description: message }
-      )
-      return
-    }
-    // Why: SSH users need a temporary Settings detour without marking required repo setup dismissed.
-    onSettingsDetourStart?.()
-    // Why: set the target before the lazy Settings view mounts; a timer could fire before it subscribes and strand users on General.
-    openSettingsTarget({ pane: 'ssh', repoId: null, sectionId: 'ssh' })
-    openSettingsPage()
-  }, [
-    busyLabel,
-    currentStep.stepNumber,
-    onOnboardingChange,
-    onSettingsDetourStart,
-    openSettingsPage,
-    openSettingsTarget
-  ])
-
   const back = useCallback(() => {
-    if (nestedScan) {
-      trackNestedBackAndClear()
-      return
-    }
     setStepIndex(getPreviousStepIndex)
-  }, [getPreviousStepIndex, nestedScan, trackNestedBackAndClear])
+  }, [getPreviousStepIndex])
 
   const jumpToStep = useCallback(
     (idx: number) => {
-      if (nestedScan && idx !== stepIndex) {
-        trackNestedBackAndClear()
-      }
       setStepIndex(resolveStepIndex(idx, skipOptions, idx < stepIndex ? 'backward' : 'forward'))
     },
-    [nestedScan, skipOptions, stepIndex, trackNestedBackAndClear]
+    [skipOptions, stepIndex]
   )
 
   return {
@@ -1232,23 +693,7 @@ export function useOnboardingFlow(
     setYoloPermissions: setYoloPermissionsInteractive,
     theme,
     setTheme: setThemeInteractive,
-    cloneUrl,
-    setCloneUrl,
-    nestedScan,
-    nestedScanInProgress,
-    nestedSelectedPaths,
-    setNestedSelectedPaths,
-    importNested,
-    cancelNested,
-    stopNestedScan,
-    canImportNestedForTelemetry,
-    hasExistingProject,
-    serverPath,
-    setServerPath,
-    cloneDestination,
-    setCloneDestination,
     busyLabel,
-    error,
     detectedSet,
     isDetectingAgents,
     next,
@@ -1256,10 +701,6 @@ export function useOnboardingFlow(
     dismissOnboarding,
     back,
     jumpToStep,
-    setLifecycleRootRef,
-    openFolder,
-    continueWithExistingProject,
-    openSshSettings,
-    clone
+    setLifecycleRootRef
   }
 }
diff --git a/src/renderer/src/components/orca-profiles/OrcaProfileAvatar.tsx b/src/renderer/src/components/orca-profiles/OrcaProfileAvatar.tsx
deleted file mode 100644
index 07980102743..00000000000
--- a/src/renderer/src/components/orca-profiles/OrcaProfileAvatar.tsx
+++ /dev/null
@@ -1,22 +0,0 @@
-import { cn } from '@/lib/utils'
-import type { OrcaProfileSummary } from '../../../../shared/orca-profiles'
-
-export function OrcaProfileAvatar({
-  profile,
-  className
-}: {
-  profile: OrcaProfileSummary
-  className?: string
-}): React.JSX.Element {
-  return (
-    <span
-      className={cn(
-        'inline-flex size-5 shrink-0 items-center justify-center rounded-full border border-border bg-muted text-[11px] font-semibold text-muted-foreground',
-        className
-      )}
-      aria-hidden
-    >
-      {profile.avatar.initials.slice(0, 2).toUpperCase()}
-    </span>
-  )
-}
diff --git a/src/renderer/src/components/orca-profiles/OrcaProfileCloudMenuItems.tsx b/src/renderer/src/components/orca-profiles/OrcaProfileCloudMenuItems.tsx
deleted file mode 100644
index a21681a48b8..00000000000
--- a/src/renderer/src/components/orca-profiles/OrcaProfileCloudMenuItems.tsx
+++ /dev/null
@@ -1,136 +0,0 @@
-import { Check, Cloud, Loader2, LogIn, LogOut, Plus } from 'lucide-react'
-import {
-  DropdownMenuItem,
-  DropdownMenuLabel,
-  DropdownMenuSeparator,
-  DropdownMenuSub,
-  DropdownMenuSubContent,
-  DropdownMenuSubTrigger
-} from '@/components/ui/dropdown-menu'
-import { translate } from '@/i18n/i18n'
-import type {
-  OrcaCloudOrgSummary,
-  OrcaProfileAuthStatus,
-  OrcaProfileSummary
-} from '../../../../shared/orca-profiles'
-
-function getConnectLabel(authStatus: OrcaProfileAuthStatus | null, connecting: boolean): string {
-  if (connecting) {
-    return translate('auto.components.orca.profiles.switcher.signInWaiting', 'Waiting for sign-in…')
-  }
-  if (authStatus?.configured !== true) {
-    return translate(
-      'auto.components.orca.profiles.switcher.cloud.unavailable',
-      'Orca sign-in unavailable'
-    )
-  }
-  if (authStatus.state === 'reconnect-required') {
-    return translate('auto.components.orca.profiles.switcher.signInAgain', 'Sign in again')
-  }
-  return translate('auto.components.orca.profiles.switcher.signIn', 'Sign in to Orca')
-}
-
-export function OrcaProfileCloudMenuItems({
-  activeProfile,
-  authStatus,
-  connecting,
-  profileActionDisabled,
-  allowProfileCreation,
-  separateAuthActions,
-  onConnect,
-  onCreateProfileForOrg,
-  onSelectOrg,
-  onRequestSignOut
-}: {
-  activeProfile: OrcaProfileSummary
-  authStatus: OrcaProfileAuthStatus | null
-  connecting: boolean
-  profileActionDisabled: boolean
-  allowProfileCreation: boolean
-  separateAuthActions: boolean
-  onConnect: () => void
-  onCreateProfileForOrg: (organization: OrcaCloudOrgSummary) => void
-  onSelectOrg: (orgId: string) => void
-  onRequestSignOut: () => void
-}): React.JSX.Element {
-  const cloudConfigured = authStatus?.configured === true
-  const organizations = authStatus?.organizations ?? []
-  const showOrganizationChoices = activeProfile.kind === 'cloud-linked' && organizations.length > 1
-  // Why: profile creation is hidden in the downscoped account menu, so the
-  // "Create profile for org" submenu only appears when multi-profile UI is on.
-  const showCloudProfileCreation =
-    allowProfileCreation && activeProfile.kind === 'cloud-linked' && organizations.length > 0
-  const orgActionDisabled = profileActionDisabled || authStatus?.state !== 'connected'
-  const activeOrgId = activeProfile.cloud?.activeOrgId
-  const showSignIn = authStatus?.state !== 'connected'
-
-  return (
-    <>
-      {showOrganizationChoices || showCloudProfileCreation ? (
-        <>
-          <DropdownMenuSeparator />
-          <DropdownMenuLabel>
-            {translate('auto.components.orca.profiles.switcher.organization', 'Organization')}
-          </DropdownMenuLabel>
-          {showOrganizationChoices
-            ? organizations.map((organization) => (
-                <DropdownMenuItem
-                  key={organization.orgId}
-                  disabled={orgActionDisabled}
-                  onSelect={() => {
-                    if (organization.orgId !== activeOrgId) {
-                      onSelectOrg(organization.orgId)
-                    }
-                  }}
-                  className="min-w-0"
-                >
-                  <Cloud />
-                  <span className="min-w-0 flex-1 truncate">{organization.name}</span>
-                  {organization.orgId === activeOrgId ? <Check className="size-3.5" /> : null}
-                </DropdownMenuItem>
-              ))
-            : null}
-          {showCloudProfileCreation ? (
-            <DropdownMenuSub>
-              <DropdownMenuSubTrigger disabled={orgActionDisabled}>
-                <Plus />
-                {translate(
-                  'auto.components.orca.profiles.switcher.create.profile.for.org',
-                  'Create profile for org'
-                )}
-              </DropdownMenuSubTrigger>
-              <DropdownMenuSubContent className="w-48">
-                {organizations.map((organization) => (
-                  <DropdownMenuItem
-                    key={organization.orgId}
-                    onSelect={() => onCreateProfileForOrg(organization)}
-                    className="min-w-0"
-                  >
-                    <Cloud />
-                    <span className="min-w-0 flex-1 truncate">{organization.name}</span>
-                  </DropdownMenuItem>
-                ))}
-              </DropdownMenuSubContent>
-            </DropdownMenuSub>
-          ) : null}
-        </>
-      ) : null}
-
-      {separateAuthActions || showOrganizationChoices || showCloudProfileCreation ? (
-        <DropdownMenuSeparator />
-      ) : null}
-      {showSignIn ? (
-        <DropdownMenuItem disabled={profileActionDisabled || !cloudConfigured} onSelect={onConnect}>
-          {connecting ? <Loader2 className="size-4 animate-spin" /> : <LogIn />}
-          {getConnectLabel(authStatus, connecting)}
-        </DropdownMenuItem>
-      ) : null}
-      {activeProfile.kind === 'cloud-linked' ? (
-        <DropdownMenuItem disabled={profileActionDisabled} onSelect={onRequestSignOut}>
-          <LogOut />
-          {translate('auto.components.orca.profiles.switcher.signout', 'Sign out')}
-        </DropdownMenuItem>
-      ) : null}
-    </>
-  )
-}
diff --git a/src/renderer/src/components/orca-profiles/OrcaProfileCreateDialog.tsx b/src/renderer/src/components/orca-profiles/OrcaProfileCreateDialog.tsx
deleted file mode 100644
index 40ac5022e23..00000000000
--- a/src/renderer/src/components/orca-profiles/OrcaProfileCreateDialog.tsx
+++ /dev/null
@@ -1,66 +0,0 @@
-import { Loader2 } from 'lucide-react'
-import { Button } from '@/components/ui/button'
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle
-} from '@/components/ui/dialog'
-import { Input } from '@/components/ui/input'
-import { translate } from '@/i18n/i18n'
-
-export function OrcaProfileCreateDialog({
-  open,
-  onOpenChange,
-  name,
-  onNameChange,
-  creating,
-  switching,
-  onSubmit
-}: {
-  open: boolean
-  onOpenChange: (open: boolean) => void
-  name: string
-  onNameChange: (name: string) => void
-  creating: boolean
-  switching: boolean
-  onSubmit: (event: React.FormEvent<HTMLFormElement>) => void
-}): React.JSX.Element {
-  return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="sm:max-w-[380px]">
-        <form onSubmit={onSubmit} className="space-y-4">
-          <DialogHeader>
-            <DialogTitle>
-              {translate('auto.components.orca.profiles.switcher.16e3681072', 'New local profile')}
-            </DialogTitle>
-            <DialogDescription>
-              {translate(
-                'auto.components.orca.profiles.switcher.e3b91a3d90',
-                'Create an empty profile for separate projects and worktrees.'
-              )}
-            </DialogDescription>
-          </DialogHeader>
-          <Input
-            autoFocus
-            value={name}
-            onChange={(event) => onNameChange(event.target.value)}
-            placeholder={translate(
-              'auto.components.orca.profiles.switcher.f322e1f4d6',
-              'Profile name'
-            )}
-            maxLength={80}
-          />
-          <DialogFooter>
-            <Button type="submit" size="sm" disabled={creating || switching}>
-              {creating || switching ? <Loader2 className="size-4 animate-spin" /> : null}
-              {translate('auto.components.orca.profiles.switcher.cfa59f8ad1', 'Create and Switch')}
-            </Button>
-          </DialogFooter>
-        </form>
-      </DialogContent>
-    </Dialog>
-  )
-}
diff --git a/src/renderer/src/components/orca-profiles/OrcaProfileManagementDialog.tsx b/src/renderer/src/components/orca-profiles/OrcaProfileManagementDialog.tsx
deleted file mode 100644
index 8f1577c7998..00000000000
--- a/src/renderer/src/components/orca-profiles/OrcaProfileManagementDialog.tsx
+++ /dev/null
@@ -1,272 +0,0 @@
-import { useMemo, useState } from 'react'
-import { ArrowRightLeft, Copy, FolderGit2, Loader2, MoveRight } from 'lucide-react'
-import { toast } from 'sonner'
-import { Button } from '@/components/ui/button'
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogHeader,
-  DialogTitle
-} from '@/components/ui/dialog'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuLabel,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger
-} from '@/components/ui/dropdown-menu'
-import { ScrollArea } from '@/components/ui/scroll-area'
-import { translate } from '@/i18n/i18n'
-import { useAppStore } from '@/store'
-import type {
-  OrcaProfileSummary,
-  TransferOrcaProfileProjectMode
-} from '../../../../shared/orca-profiles'
-import type { Repo } from '../../../../shared/types'
-import { OrcaProfileAvatar } from './OrcaProfileAvatar'
-import {
-  OrcaProfileProjectTransferConfirmDialog,
-  type PendingProjectTransfer
-} from './OrcaProfileProjectTransferConfirmDialog'
-import { getOrcaProfileProjectLiveWorkSummary } from './orca-profile-switch-liveness'
-
-type PendingTransfer = {
-  repoId: string
-  targetProfileId: string
-  mode: TransferOrcaProfileProjectMode
-}
-
-function pendingKey(value: PendingTransfer): string {
-  return `${value.mode}:${value.repoId}:${value.targetProfileId}`
-}
-
-function getRepoPath(repo: Repo): string {
-  return repo.path || repo.displayName
-}
-
-function ProjectTransferMenu({
-  repo,
-  sourceProfileId,
-  targetProfiles,
-  pending,
-  onTransfer
-}: {
-  repo: Repo
-  sourceProfileId: string
-  targetProfiles: OrcaProfileSummary[]
-  pending: PendingTransfer | null
-  onTransfer: (
-    repo: Repo,
-    targetProfile: OrcaProfileSummary,
-    mode: TransferOrcaProfileProjectMode
-  ) => void
-}): React.JSX.Element {
-  const disabled = targetProfiles.length === 0 || Boolean(pending)
-  const repoPending = pending?.repoId === repo.id
-  const renderTargetItems = (mode: TransferOrcaProfileProjectMode): React.JSX.Element[] =>
-    targetProfiles.map((profile) => {
-      const targetPending =
-        pending &&
-        pendingKey(pending) === pendingKey({ repoId: repo.id, targetProfileId: profile.id, mode })
-      return (
-        <DropdownMenuItem
-          key={`${mode}:${profile.id}`}
-          disabled={Boolean(pending) || profile.id === sourceProfileId}
-          onSelect={() => onTransfer(repo, profile, mode)}
-        >
-          {mode === 'move' ? <MoveRight /> : <Copy />}
-          <OrcaProfileAvatar profile={profile} />
-          <span className="min-w-0 truncate">{profile.name}</span>
-          {targetPending ? <Loader2 className="ml-auto size-3.5 animate-spin" /> : null}
-        </DropdownMenuItem>
-      )
-    })
-
-  return (
-    <DropdownMenu>
-      <DropdownMenuTrigger asChild>
-        <Button variant="outline" size="xs" disabled={disabled}>
-          {repoPending ? <Loader2 className="size-3.5 animate-spin" /> : <ArrowRightLeft />}
-          {translate('auto.components.orca.profiles.management.04e7bd2a23', 'Transfer')}
-        </Button>
-      </DropdownMenuTrigger>
-      <DropdownMenuContent align="end" className="w-56">
-        <DropdownMenuLabel>
-          {translate('auto.components.orca.profiles.management.128c7dfe64', 'Copy to')}
-        </DropdownMenuLabel>
-        {renderTargetItems('copy')}
-        <DropdownMenuSeparator />
-        <DropdownMenuLabel>
-          {translate('auto.components.orca.profiles.management.df8b7d876b', 'Move to')}
-        </DropdownMenuLabel>
-        {renderTargetItems('move')}
-      </DropdownMenuContent>
-    </DropdownMenu>
-  )
-}
-
-export function OrcaProfileManagementDialog({
-  open,
-  onOpenChange,
-  activeProfile,
-  profiles
-}: {
-  open: boolean
-  onOpenChange: (open: boolean) => void
-  activeProfile: OrcaProfileSummary
-  profiles: OrcaProfileSummary[]
-}): React.JSX.Element {
-  const repos = useAppStore((s) => s.repos)
-  const transferProject = useAppStore((s) => s.transferOrcaProfileProject)
-  const [pending, setPending] = useState<PendingTransfer | null>(null)
-  const [pendingConfirmation, setPendingConfirmation] = useState<PendingProjectTransfer | null>(
-    null
-  )
-  const targetProfiles = useMemo(
-    () => profiles.filter((profile) => profile.id !== activeProfile.id),
-    [activeProfile.id, profiles]
-  )
-
-  const runTransfer = async (
-    repo: Repo,
-    targetProfile: OrcaProfileSummary,
-    mode: TransferOrcaProfileProjectMode
-  ): Promise<void> => {
-    if (pending) {
-      return
-    }
-    const nextPending = { repoId: repo.id, targetProfileId: targetProfile.id, mode }
-    setPending(nextPending)
-    const result = await transferProject({
-      sourceProfileId: activeProfile.id,
-      targetProfileId: targetProfile.id,
-      repoId: repo.id,
-      mode
-    })
-    setPending(null)
-    if (result?.status === 'transferred') {
-      toast.success(
-        mode === 'move'
-          ? translate('auto.components.orca.profiles.management.9aa26347b3', 'Project moved')
-          : translate('auto.components.orca.profiles.management.816ce624b6', 'Project copied'),
-        {
-          description: targetProfile.name
-        }
-      )
-    }
-  }
-
-  const handleTransfer = (
-    repo: Repo,
-    targetProfile: OrcaProfileSummary,
-    mode: TransferOrcaProfileProjectMode
-  ): void => {
-    if (pending) {
-      return
-    }
-    const liveWorkSummary = getOrcaProfileProjectLiveWorkSummary(useAppStore.getState(), repo.id)
-    if (mode === 'move' || liveWorkSummary.hasLiveWork) {
-      setPendingConfirmation({ repo, targetProfile, mode, liveWorkSummary })
-      return
-    }
-    void runTransfer(repo, targetProfile, mode)
-  }
-
-  const confirmTransfer = async (): Promise<void> => {
-    if (!pendingConfirmation) {
-      return
-    }
-    const next = pendingConfirmation
-    await runTransfer(next.repo, next.targetProfile, next.mode)
-    setPendingConfirmation(null)
-  }
-
-  return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="gap-4 sm:max-w-[640px]">
-        <DialogHeader>
-          <DialogTitle>
-            {translate('auto.components.orca.profiles.management.2c45bda8d3', 'Manage profiles')}
-          </DialogTitle>
-          <DialogDescription>
-            {translate(
-              'auto.components.orca.profiles.management.2db945e4a0',
-              'Copy or move projects from the active profile to another local profile.'
-            )}
-          </DialogDescription>
-        </DialogHeader>
-
-        <div className="rounded-md border border-border">
-          <div className="flex items-center gap-2 border-b border-border px-3 py-2">
-            <OrcaProfileAvatar profile={activeProfile} />
-            <div className="min-w-0">
-              <div className="truncate text-sm font-medium">{activeProfile.name}</div>
-              <div className="truncate text-xs text-muted-foreground">
-                {translate(
-                  repos.length === 1
-                    ? 'auto.components.orca.profiles.management.projectCountSingular'
-                    : 'auto.components.orca.profiles.management.projectCountPlural',
-                  repos.length === 1 ? '{{count}} project' : '{{count}} projects',
-                  { count: repos.length }
-                )}
-              </div>
-            </div>
-          </div>
-          <ScrollArea className="max-h-[360px]">
-            {repos.length === 0 ? (
-              <div className="px-3 py-8 text-center text-sm text-muted-foreground">
-                {translate(
-                  'auto.components.orca.profiles.management.8668cb2946',
-                  'No projects in this profile.'
-                )}
-              </div>
-            ) : (
-              <div className="divide-y divide-border">
-                {repos.map((repo) => (
-                  <div key={repo.id} className="flex min-w-0 items-center gap-3 px-3 py-2.5">
-                    <FolderGit2 className="size-4 shrink-0 text-muted-foreground" />
-                    <div className="min-w-0 flex-1">
-                      <div className="truncate text-sm font-medium">{repo.displayName}</div>
-                      <div className="truncate font-mono text-[11px] text-muted-foreground">
-                        {getRepoPath(repo)}
-                      </div>
-                    </div>
-                    <ProjectTransferMenu
-                      repo={repo}
-                      sourceProfileId={activeProfile.id}
-                      targetProfiles={targetProfiles}
-                      pending={pending}
-                      onTransfer={(selectedRepo, targetProfile, mode) => {
-                        handleTransfer(selectedRepo, targetProfile, mode)
-                      }}
-                    />
-                  </div>
-                ))}
-              </div>
-            )}
-          </ScrollArea>
-        </div>
-
-        {targetProfiles.length === 0 ? (
-          <div className="text-xs text-muted-foreground">
-            {translate(
-              'auto.components.orca.profiles.management.93034915ab',
-              'Create another profile before copying projects.'
-            )}
-          </div>
-        ) : null}
-        <OrcaProfileProjectTransferConfirmDialog
-          activeProfileName={activeProfile.name}
-          pendingTransfer={pendingConfirmation}
-          pending={Boolean(pending)}
-          onCancel={() => setPendingConfirmation(null)}
-          onConfirm={() => {
-            void confirmTransfer()
-          }}
-        />
-      </DialogContent>
-    </Dialog>
-  )
-}
diff --git a/src/renderer/src/components/orca-profiles/OrcaProfileMenuHeader.tsx b/src/renderer/src/components/orca-profiles/OrcaProfileMenuHeader.tsx
deleted file mode 100644
index 692f11163d2..00000000000
--- a/src/renderer/src/components/orca-profiles/OrcaProfileMenuHeader.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-import { CircleUserRound } from 'lucide-react'
-import { DropdownMenuLabel } from '@/components/ui/dropdown-menu'
-import type { OrcaProfileSummary } from '../../../../shared/orca-profiles'
-import { OrcaProfileAvatar } from './OrcaProfileAvatar'
-
-export function OrcaProfileMenuHeader({
-  profile,
-  title,
-  subtitle,
-  showProfileAvatar
-}: {
-  profile: OrcaProfileSummary
-  title: string
-  subtitle: string
-  showProfileAvatar: boolean
-}): React.JSX.Element {
-  return (
-    <DropdownMenuLabel className="px-2 py-1.5">
-      <div className="flex min-w-0 items-center gap-2">
-        {showProfileAvatar ? (
-          <OrcaProfileAvatar profile={profile} className="size-7 text-xs" />
-        ) : (
-          <CircleUserRound className="size-5 text-muted-foreground" />
-        )}
-        <div className="min-w-0">
-          <div className="truncate text-[13px] font-semibold text-foreground">{title}</div>
-          <div className="truncate text-[11px] font-medium text-muted-foreground">{subtitle}</div>
-        </div>
-      </div>
-    </DropdownMenuLabel>
-  )
-}
diff --git a/src/renderer/src/components/orca-profiles/OrcaProfileOrgMemberRow.tsx b/src/renderer/src/components/orca-profiles/OrcaProfileOrgMemberRow.tsx
deleted file mode 100644
index 894e21c8481..00000000000
--- a/src/renderer/src/components/orca-profiles/OrcaProfileOrgMemberRow.tsx
+++ /dev/null
@@ -1,135 +0,0 @@
-import { useState } from 'react'
-import { Loader2, UserMinus } from 'lucide-react'
-import { Button } from '@/components/ui/button'
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue
-} from '@/components/ui/select'
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
-import { translate } from '@/i18n/i18n'
-import { cn } from '@/lib/utils'
-import type { OrcaOrgMember, OrcaOrgRole } from '../../../../shared/orca-profiles'
-import {
-  ORG_ROLE_OPTIONS,
-  orgMemberInitials,
-  orgRoleLabel
-} from './orca-profile-org-members-labels'
-
-export function OrcaProfileOrgMemberRow({
-  member,
-  canManage,
-  isSelf,
-  busy,
-  onChangeRole,
-  onRemove
-}: {
-  member: OrcaOrgMember
-  canManage: boolean
-  isSelf: boolean
-  busy: boolean
-  onChangeRole: (role: OrcaOrgRole) => void
-  onRemove: () => void
-}): React.JSX.Element {
-  const [confirmingRemove, setConfirmingRemove] = useState(false)
-  // Why: teammates provisioned server-side who never signed into Orca have no
-  // userId, so the API cannot target them for role/remove mutations.
-  const neverSignedIn = member.userId === null
-  const actionsDisabled = !canManage || isSelf || neverSignedIn || busy
-  const displayName = member.displayName?.trim() || member.email
-
-  const roleControl = canManage ? (
-    <Select
-      value={member.role}
-      disabled={actionsDisabled}
-      onValueChange={(value) => onChangeRole(value as OrcaOrgRole)}
-    >
-      <SelectTrigger
-        size="sm"
-        className="w-28"
-        aria-label={translate('auto.components.orca.profiles.org.members.role.label', 'Role')}
-      >
-        <SelectValue />
-      </SelectTrigger>
-      <SelectContent>
-        {ORG_ROLE_OPTIONS.map((role) => (
-          <SelectItem key={role} value={role}>
-            {orgRoleLabel(role)}
-          </SelectItem>
-        ))}
-      </SelectContent>
-    </Select>
-  ) : (
-    <span className="text-xs font-medium text-muted-foreground">{orgRoleLabel(member.role)}</span>
-  )
-
-  return (
-    <div className="flex items-center gap-2.5 py-1.5">
-      <span
-        className="inline-flex size-7 shrink-0 items-center justify-center rounded-full border border-border bg-muted text-[11px] font-semibold text-muted-foreground"
-        aria-hidden
-      >
-        {orgMemberInitials(member.displayName, member.email)}
-      </span>
-      <div className="min-w-0 flex-1">
-        <div className="truncate text-[13px] font-medium text-foreground">{displayName}</div>
-        <div className="truncate text-[11px] text-muted-foreground">{member.email}</div>
-      </div>
-
-      {neverSignedIn && canManage ? (
-        <Tooltip>
-          <TooltipTrigger asChild>
-            <span className={cn('cursor-default')}>{roleControl}</span>
-          </TooltipTrigger>
-          <TooltipContent side="top">
-            {translate(
-              'auto.components.orca.profiles.org.members.not.signed.in',
-              "They haven't signed in to Orca yet."
-            )}
-          </TooltipContent>
-        </Tooltip>
-      ) : (
-        roleControl
-      )}
-
-      {canManage ? (
-        confirmingRemove && !actionsDisabled ? (
-          <div className="flex items-center gap-1">
-            <Button
-              variant="destructive"
-              size="xs"
-              onClick={() => {
-                setConfirmingRemove(false)
-                onRemove()
-              }}
-            >
-              {translate('auto.components.orca.profiles.org.members.remove.confirm', 'Remove')}
-            </Button>
-            <Button variant="ghost" size="xs" onClick={() => setConfirmingRemove(false)}>
-              {translate('auto.components.orca.profiles.org.members.remove.cancel', 'Cancel')}
-            </Button>
-          </div>
-        ) : (
-          <Button
-            variant="ghost"
-            size="icon-xs"
-            disabled={actionsDisabled}
-            onClick={() => setConfirmingRemove(true)}
-            aria-label={translate(
-              'auto.components.orca.profiles.org.members.remove.label',
-              'Remove teammate'
-            )}
-          >
-            {busy ? (
-              <Loader2 className="size-3.5 animate-spin" />
-            ) : (
-              <UserMinus className="size-3.5" />
-            )}
-          </Button>
-        )
-      ) : null}
-    </div>
-  )
-}
diff --git a/src/renderer/src/components/orca-profiles/OrcaProfileOrgMembersDialog.test.tsx b/src/renderer/src/components/orca-profiles/OrcaProfileOrgMembersDialog.test.tsx
deleted file mode 100644
index 35e3a07ae90..00000000000
--- a/src/renderer/src/components/orca-profiles/OrcaProfileOrgMembersDialog.test.tsx
+++ /dev/null
@@ -1,151 +0,0 @@
-// @vitest-environment happy-dom
-
-import type { ReactNode } from 'react'
-import { render, screen, cleanup } from '@testing-library/react'
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import type { OrcaOrgMembersRoster } from '../../../../shared/orca-profiles'
-import { OrcaProfileOrgMembersDialog } from './OrcaProfileOrgMembersDialog'
-
-vi.mock('@/components/ui/dialog', () => ({
-  Dialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  DialogContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  DialogHeader: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  DialogTitle: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  DialogDescription: ({ children }: { children: ReactNode }) => <div>{children}</div>
-}))
-
-vi.mock('@/components/ui/scroll-area', () => ({
-  ScrollArea: ({ children }: { children: ReactNode }) => <div>{children}</div>
-}))
-
-vi.mock('@/components/ui/tooltip', () => ({
-  Tooltip: ({ children }: { children: ReactNode }) => <>{children}</>,
-  TooltipTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
-  TooltipContent: ({ children }: { children: ReactNode }) => <span>{children}</span>
-}))
-
-vi.mock('@/components/ui/button', () => ({
-  Button: ({
-    children,
-    disabled,
-    'aria-label': ariaLabel,
-    type
-  }: {
-    children?: ReactNode
-    disabled?: boolean
-    'aria-label'?: string
-    type?: 'button' | 'submit'
-  }) => (
-    <button aria-label={ariaLabel} disabled={disabled} type={type}>
-      {children}
-    </button>
-  )
-}))
-
-vi.mock('@/components/ui/input', () => ({
-  Input: ({ placeholder, disabled }: { placeholder?: string; disabled?: boolean }) => (
-    <input placeholder={placeholder} disabled={disabled} />
-  )
-}))
-
-vi.mock('@/components/ui/select', () => ({
-  Select: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  SelectContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  SelectItem: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  SelectValue: () => null,
-  SelectTrigger: ({
-    disabled,
-    'aria-label': ariaLabel,
-    children
-  }: {
-    disabled?: boolean
-    'aria-label'?: string
-    children?: ReactNode
-  }) => (
-    <button aria-label={ariaLabel} disabled={disabled}>
-      {children}
-    </button>
-  )
-}))
-
-const managerRoster: OrcaOrgMembersRoster = {
-  members: [
-    { userId: 'user-viewer', email: 'me@example.com', displayName: 'Me', role: 'admin' },
-    { userId: 'user-2', email: 'other@example.com', displayName: 'Other', role: 'member' },
-    { userId: null, email: 'never@example.com', role: 'member' }
-  ],
-  pendingInvites: [{ email: 'pending@example.com', role: 'member', createdAt: 1 }],
-  viewerRole: 'owner',
-  canManageMembers: true
-}
-
-const memberRoster: OrcaOrgMembersRoster = {
-  members: [
-    { userId: 'user-1', email: 'boss@example.com', displayName: 'Boss', role: 'owner' },
-    { userId: 'user-2', email: 'peer@example.com', displayName: 'Peer', role: 'member' }
-  ],
-  pendingInvites: [],
-  viewerRole: 'member',
-  canManageMembers: false
-}
-
-function stubOrgMembersApi(roster: OrcaOrgMembersRoster): void {
-  ;(window as unknown as { api: unknown }).api = {
-    orcaProfiles: {
-      orgMembersList: vi.fn().mockResolvedValue({ status: 'ok', roster })
-    }
-  }
-}
-
-describe('OrcaProfileOrgMembersDialog', () => {
-  afterEach(() => {
-    cleanup()
-    vi.restoreAllMocks()
-  })
-
-  it('shows the invite form and a role select per member for managers', async () => {
-    stubOrgMembersApi(managerRoster)
-    render(
-      <OrcaProfileOrgMembersDialog
-        open
-        onOpenChange={() => {}}
-        orgId="org-1"
-        orgName="Acme"
-        viewerUserId="user-viewer"
-      />
-    )
-
-    expect(await screen.findByText('other@example.com')).toBeTruthy()
-    // Invite form present.
-    expect(screen.getByPlaceholderText('teammate@example.com')).toBeTruthy()
-    // Pending invite listed with a revoke action.
-    expect(screen.getByText('pending@example.com')).toBeTruthy()
-    // One role select per member.
-    expect(screen.getAllByLabelText('Role')).toHaveLength(3)
-    // Self and the never-signed-in row disable their remove action; the peer's stays enabled.
-    const removeButtons = screen.getAllByLabelText('Remove teammate') as HTMLButtonElement[]
-    expect(removeButtons).toHaveLength(3)
-    expect(removeButtons.filter((button) => button.disabled)).toHaveLength(2)
-    // Never-signed-in explanation is present.
-    expect(screen.getByText("They haven't signed in to Orca yet.")).toBeTruthy()
-  })
-
-  it('renders a read-only roster for non-managers', async () => {
-    stubOrgMembersApi(memberRoster)
-    render(
-      <OrcaProfileOrgMembersDialog
-        open
-        onOpenChange={() => {}}
-        orgId="org-1"
-        viewerUserId="user-2"
-      />
-    )
-
-    expect(await screen.findByText('boss@example.com')).toBeTruthy()
-    expect(screen.getByText('peer@example.com')).toBeTruthy()
-    // No management affordances.
-    expect(screen.queryByPlaceholderText('teammate@example.com')).toBeNull()
-    expect(screen.queryAllByLabelText('Role')).toHaveLength(0)
-    expect(screen.queryAllByLabelText('Remove teammate')).toHaveLength(0)
-  })
-})
diff --git a/src/renderer/src/components/orca-profiles/OrcaProfileOrgMembersDialog.tsx b/src/renderer/src/components/orca-profiles/OrcaProfileOrgMembersDialog.tsx
deleted file mode 100644
index 95c5344ebcb..00000000000
--- a/src/renderer/src/components/orca-profiles/OrcaProfileOrgMembersDialog.tsx
+++ /dev/null
@@ -1,300 +0,0 @@
-import { useCallback, useEffect, useState } from 'react'
-import { Loader2, Mail, RefreshCw, Users } from 'lucide-react'
-import { Button } from '@/components/ui/button'
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogHeader,
-  DialogTitle
-} from '@/components/ui/dialog'
-import { Input } from '@/components/ui/input'
-import { ScrollArea } from '@/components/ui/scroll-area'
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue
-} from '@/components/ui/select'
-import { translate } from '@/i18n/i18n'
-import type {
-  OrcaOrgMember,
-  OrcaOrgMembersRoster,
-  OrcaOrgRole,
-  OrcaProfileOrgMemberMutationResult
-} from '../../../../shared/orca-profiles'
-import { OrcaProfileOrgMemberRow } from './OrcaProfileOrgMemberRow'
-import {
-  describeOrgMutationError,
-  ORG_ROLE_OPTIONS,
-  orgRoleLabel
-} from './orca-profile-org-members-labels'
-
-type DialogProps = {
-  open: boolean
-  onOpenChange: (open: boolean) => void
-  orgId: string
-  orgName?: string
-  viewerUserId?: string
-}
-
-function isOk(result: OrcaProfileOrgMemberMutationResult): result is { status: 'ok' } {
-  return result.status === 'ok'
-}
-
-export function OrcaProfileOrgMembersDialog({
-  open,
-  onOpenChange,
-  orgId,
-  orgName,
-  viewerUserId
-}: DialogProps): React.JSX.Element {
-  const [roster, setRoster] = useState<OrcaOrgMembersRoster | null>(null)
-  const [loading, setLoading] = useState(false)
-  const [loadError, setLoadError] = useState(false)
-  const [actionError, setActionError] = useState<string | null>(null)
-  const [pendingMemberId, setPendingMemberId] = useState<string | null>(null)
-  const [pendingInviteEmail, setPendingInviteEmail] = useState<string | null>(null)
-  const [inviteEmail, setInviteEmail] = useState('')
-  const [inviteRole, setInviteRole] = useState<OrcaOrgRole>('member')
-  const [inviting, setInviting] = useState(false)
-
-  const refresh = useCallback(async (): Promise<void> => {
-    setLoading(true)
-    setLoadError(false)
-    setActionError(null)
-    const result = await window.api.orcaProfiles.orgMembersList({ orgId })
-    if (result.status === 'ok') {
-      setRoster(result.roster)
-    } else {
-      setRoster(null)
-      setLoadError(true)
-    }
-    setLoading(false)
-  }, [orgId])
-
-  // Why: reload every time the dialog opens so a manager always acts on the
-  // current roster, and clear transient dialog state when it closes.
-  useEffect(() => {
-    if (open) {
-      void refresh()
-    } else {
-      setActionError(null)
-      setInviteEmail('')
-      setInviteRole('member')
-    }
-  }, [open, refresh])
-
-  const canManage = roster?.canManageMembers === true
-
-  const runMutation = async (
-    mutation: Promise<OrcaProfileOrgMemberMutationResult>
-  ): Promise<boolean> => {
-    setActionError(null)
-    const result = await mutation
-    if (isOk(result)) {
-      await refresh()
-      return true
-    }
-    setActionError(describeOrgMutationError(result))
-    return false
-  }
-
-  const handleChangeRole = async (member: OrcaOrgMember, role: OrcaOrgRole): Promise<void> => {
-    if (member.userId === null || role === member.role) {
-      return
-    }
-    setPendingMemberId(member.userId)
-    await runMutation(
-      window.api.orcaProfiles.orgMemberChangeRole({ orgId, userId: member.userId, role })
-    )
-    setPendingMemberId(null)
-  }
-
-  const handleRemove = async (member: OrcaOrgMember): Promise<void> => {
-    if (member.userId === null) {
-      return
-    }
-    setPendingMemberId(member.userId)
-    await runMutation(window.api.orcaProfiles.orgMemberRemove({ orgId, userId: member.userId }))
-    setPendingMemberId(null)
-  }
-
-  const handleRevoke = async (email: string): Promise<void> => {
-    setPendingInviteEmail(email)
-    await runMutation(window.api.orcaProfiles.orgInviteRevoke({ orgId, email }))
-    setPendingInviteEmail(null)
-  }
-
-  const handleInvite = async (event: React.FormEvent<HTMLFormElement>): Promise<void> => {
-    event.preventDefault()
-    const email = inviteEmail.trim()
-    if (!email || inviting) {
-      return
-    }
-    setInviting(true)
-    const ok = await runMutation(
-      window.api.orcaProfiles.orgMemberInvite({ orgId, email, role: inviteRole })
-    )
-    setInviting(false)
-    if (ok) {
-      setInviteEmail('')
-      setInviteRole('member')
-    }
-  }
-
-  return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="sm:max-w-[520px]">
-        <DialogHeader>
-          <DialogTitle className="flex items-center gap-2">
-            <Users className="size-4 text-muted-foreground" />
-            {translate('auto.components.orca.profiles.org.members.title', 'Organization members')}
-          </DialogTitle>
-          <DialogDescription>
-            {orgName
-              ? translate(
-                  'auto.components.orca.profiles.org.members.subtitle.named',
-                  'People in {{orgName}} who can collaborate on Orca.',
-                  { orgName }
-                )
-              : translate(
-                  'auto.components.orca.profiles.org.members.subtitle.default',
-                  'People in your organization who can collaborate on Orca.'
-                )}
-          </DialogDescription>
-        </DialogHeader>
-
-        {loading ? (
-          <div className="flex items-center justify-center py-10 text-muted-foreground">
-            <Loader2 className="size-5 animate-spin" />
-          </div>
-        ) : loadError ? (
-          <div className="flex flex-col items-center gap-3 py-8 text-center">
-            <p className="text-sm text-muted-foreground">
-              {translate(
-                'auto.components.orca.profiles.org.members.load.error',
-                "Couldn't load organization members."
-              )}
-            </p>
-            <Button variant="outline" size="sm" onClick={() => void refresh()}>
-              <RefreshCw className="size-3.5" />
-              {translate('auto.components.orca.profiles.org.members.retry', 'Try again')}
-            </Button>
-          </div>
-        ) : roster ? (
-          <div className="flex flex-col gap-4">
-            {actionError ? (
-              <p className="rounded-md bg-destructive/10 px-3 py-2 text-xs text-destructive">
-                {actionError}
-              </p>
-            ) : null}
-
-            <ScrollArea className="max-h-[280px] pr-2">
-              <div className="divide-y divide-border/60">
-                {roster.members.map((member) => (
-                  <OrcaProfileOrgMemberRow
-                    key={member.userId ?? member.email}
-                    member={member}
-                    canManage={canManage}
-                    isSelf={member.userId !== null && member.userId === viewerUserId}
-                    busy={pendingMemberId === member.userId}
-                    onChangeRole={(role) => void handleChangeRole(member, role)}
-                    onRemove={() => void handleRemove(member)}
-                  />
-                ))}
-              </div>
-            </ScrollArea>
-
-            {canManage && roster.pendingInvites.length > 0 ? (
-              <div className="flex flex-col gap-1.5">
-                <p className="text-[11px] font-semibold tracking-wide text-muted-foreground uppercase">
-                  {translate(
-                    'auto.components.orca.profiles.org.members.pending.title',
-                    'Pending invites'
-                  )}
-                </p>
-                {roster.pendingInvites.map((invite) => (
-                  <div key={invite.email} className="flex items-center gap-2.5 py-1">
-                    <Mail className="size-4 shrink-0 text-muted-foreground" />
-                    <span className="min-w-0 flex-1 truncate text-[13px] text-foreground">
-                      {invite.email}
-                    </span>
-                    <span className="text-[11px] font-medium text-muted-foreground">
-                      {orgRoleLabel(invite.role)}
-                    </span>
-                    <Button
-                      variant="ghost"
-                      size="xs"
-                      disabled={pendingInviteEmail === invite.email}
-                      onClick={() => void handleRevoke(invite.email)}
-                    >
-                      {pendingInviteEmail === invite.email ? (
-                        <Loader2 className="size-3 animate-spin" />
-                      ) : null}
-                      {translate(
-                        'auto.components.orca.profiles.org.members.pending.revoke',
-                        'Revoke'
-                      )}
-                    </Button>
-                  </div>
-                ))}
-              </div>
-            ) : null}
-
-            {canManage ? (
-              <form onSubmit={(event) => void handleInvite(event)} className="flex items-end gap-2">
-                <div className="flex min-w-0 flex-1 flex-col gap-1">
-                  <label
-                    htmlFor="orca-org-invite-email"
-                    className="text-[11px] font-semibold tracking-wide text-muted-foreground uppercase"
-                  >
-                    {translate('auto.components.orca.profiles.org.members.invite.title', 'Invite')}
-                  </label>
-                  <Input
-                    id="orca-org-invite-email"
-                    type="email"
-                    value={inviteEmail}
-                    onChange={(event) => setInviteEmail(event.target.value)}
-                    disabled={inviting}
-                    placeholder={translate(
-                      'auto.components.orca.profiles.org.members.invite.placeholder',
-                      'teammate@example.com'
-                    )}
-                  />
-                </div>
-                <Select
-                  value={inviteRole}
-                  disabled={inviting}
-                  onValueChange={(value) => setInviteRole(value as OrcaOrgRole)}
-                >
-                  <SelectTrigger
-                    className="w-28"
-                    aria-label={translate(
-                      'auto.components.orca.profiles.org.members.invite.role',
-                      'Invite role'
-                    )}
-                  >
-                    <SelectValue />
-                  </SelectTrigger>
-                  <SelectContent>
-                    {ORG_ROLE_OPTIONS.map((role) => (
-                      <SelectItem key={role} value={role}>
-                        {orgRoleLabel(role)}
-                      </SelectItem>
-                    ))}
-                  </SelectContent>
-                </Select>
-                <Button type="submit" size="sm" disabled={inviting || !inviteEmail.trim()}>
-                  {inviting ? <Loader2 className="size-4 animate-spin" /> : null}
-                  {translate('auto.components.orca.profiles.org.members.invite.submit', 'Send')}
-                </Button>
-              </form>
-            ) : null}
-          </div>
-        ) : null}
-      </DialogContent>
-    </Dialog>
-  )
-}
diff --git a/src/renderer/src/components/orca-profiles/OrcaProfileProjectTransferConfirmDialog.tsx b/src/renderer/src/components/orca-profiles/OrcaProfileProjectTransferConfirmDialog.tsx
deleted file mode 100644
index 4b5678e52b1..00000000000
--- a/src/renderer/src/components/orca-profiles/OrcaProfileProjectTransferConfirmDialog.tsx
+++ /dev/null
@@ -1,162 +0,0 @@
-import { ArrowRightLeft, Loader2 } from 'lucide-react'
-import { Button } from '@/components/ui/button'
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle
-} from '@/components/ui/dialog'
-import { translate } from '@/i18n/i18n'
-import type {
-  OrcaProfileSummary,
-  TransferOrcaProfileProjectMode
-} from '../../../../shared/orca-profiles'
-import type { Repo } from '../../../../shared/types'
-import type { OrcaProfileSwitchLiveWorkSummary } from './orca-profile-switch-liveness'
-
-type PendingProjectTransfer = {
-  repo: Repo
-  targetProfile: OrcaProfileSummary
-  mode: TransferOrcaProfileProjectMode
-  liveWorkSummary: OrcaProfileSwitchLiveWorkSummary
-}
-
-export type { PendingProjectTransfer }
-
-function liveWorkLines(summary: OrcaProfileSwitchLiveWorkSummary): string[] {
-  const lines: string[] = []
-  if (summary.liveTerminalTabCount > 0) {
-    lines.push(
-      translate(
-        summary.liveTerminalTabCount === 1
-          ? 'auto.components.orca.profiles.project.transfer.confirm.terminalSingular'
-          : 'auto.components.orca.profiles.project.transfer.confirm.terminalPlural',
-        summary.liveTerminalTabCount === 1
-          ? '{{count}} live terminal tab'
-          : '{{count}} live terminal tabs',
-        { count: summary.liveTerminalTabCount }
-      )
-    )
-  }
-  if (summary.liveAgentCount > 0) {
-    lines.push(
-      translate(
-        summary.liveAgentCount === 1
-          ? 'auto.components.orca.profiles.project.transfer.confirm.agentSingular'
-          : 'auto.components.orca.profiles.project.transfer.confirm.agentPlural',
-        summary.liveAgentCount === 1 ? '{{count}} active agent' : '{{count}} active agents',
-        { count: summary.liveAgentCount }
-      )
-    )
-  }
-  if (summary.browserWorkspaceCount > 0) {
-    lines.push(
-      translate(
-        summary.browserWorkspaceCount === 1
-          ? 'auto.components.orca.profiles.project.transfer.confirm.browserSingular'
-          : 'auto.components.orca.profiles.project.transfer.confirm.browserPlural',
-        summary.browserWorkspaceCount === 1
-          ? '{{count}} browser workspace'
-          : '{{count}} browser workspaces',
-        { count: summary.browserWorkspaceCount }
-      )
-    )
-  }
-  return lines
-}
-
-export function OrcaProfileProjectTransferConfirmDialog({
-  activeProfileName,
-  pendingTransfer,
-  pending,
-  onCancel,
-  onConfirm
-}: {
-  activeProfileName: string
-  pendingTransfer: PendingProjectTransfer | null
-  pending: boolean
-  onCancel: () => void
-  onConfirm: () => void
-}): React.JSX.Element {
-  const mode = pendingTransfer?.mode ?? 'copy'
-  const repoName = pendingTransfer?.repo.displayName ?? ''
-  const targetName = pendingTransfer?.targetProfile.name ?? ''
-  const lines = pendingTransfer ? liveWorkLines(pendingTransfer.liveWorkSummary) : []
-
-  return (
-    <Dialog
-      open={Boolean(pendingTransfer)}
-      onOpenChange={(open) => {
-        if (!open && !pending) {
-          onCancel()
-        }
-      }}
-    >
-      <DialogContent className="sm:max-w-[440px]">
-        <DialogHeader>
-          <DialogTitle className="flex items-center gap-2">
-            <ArrowRightLeft className="size-4 text-muted-foreground" />
-            {mode === 'move'
-              ? translate(
-                  'auto.components.orca.profiles.project.transfer.confirm.move.title',
-                  'Move project?'
-                )
-              : translate(
-                  'auto.components.orca.profiles.project.transfer.confirm.copy.title',
-                  'Copy project?'
-                )}
-          </DialogTitle>
-          <DialogDescription>
-            {mode === 'move'
-              ? translate(
-                  'auto.components.orca.profiles.project.transfer.confirm.move.description',
-                  'Move {{repoName}} to {{targetName}}. Orca removes it from {{activeProfileName}}, keeps files in place, and relaunches into {{targetName}}.',
-                  { activeProfileName, repoName, targetName }
-                )
-              : translate(
-                  'auto.components.orca.profiles.project.transfer.confirm.copy.description',
-                  'Copy {{repoName}} to {{targetName}}. Both profiles will point at the same files with separate Orca metadata.',
-                  { repoName, targetName }
-                )}
-          </DialogDescription>
-        </DialogHeader>
-
-        {lines.length > 0 ? (
-          <div className="rounded-md border border-border bg-muted/40 px-3 py-2 text-sm">
-            <div className="mb-1 font-medium text-foreground">
-              {translate(
-                'auto.components.orca.profiles.project.transfer.confirm.live.work',
-                'Live work in this project'
-              )}
-            </div>
-            <ul className="space-y-1 text-xs text-muted-foreground">
-              {lines.map((line) => (
-                <li key={line}>{line}</li>
-              ))}
-            </ul>
-          </div>
-        ) : null}
-
-        <DialogFooter>
-          <Button variant="ghost" size="sm" onClick={onCancel} disabled={pending}>
-            {translate('auto.components.orca.profiles.project.transfer.confirm.cancel', 'Cancel')}
-          </Button>
-          <Button size="sm" onClick={onConfirm} disabled={pending || !pendingTransfer}>
-            {pending ? <Loader2 className="size-4 animate-spin" /> : null}
-            {mode === 'move'
-              ? translate(
-                  'auto.components.orca.profiles.project.transfer.confirm.move.action',
-                  'Move project'
-                )
-              : translate(
-                  'auto.components.orca.profiles.project.transfer.confirm.copy.action',
-                  'Copy project'
-                )}
-          </Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-  )
-}
diff --git a/src/renderer/src/components/orca-profiles/OrcaProfileSwitchConfirmDialog.tsx b/src/renderer/src/components/orca-profiles/OrcaProfileSwitchConfirmDialog.tsx
deleted file mode 100644
index 89c80e99aa6..00000000000
--- a/src/renderer/src/components/orca-profiles/OrcaProfileSwitchConfirmDialog.tsx
+++ /dev/null
@@ -1,129 +0,0 @@
-import { AlertTriangle, Loader2 } from 'lucide-react'
-import { Button } from '@/components/ui/button'
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle
-} from '@/components/ui/dialog'
-import { translate } from '@/i18n/i18n'
-import type { OrcaProfileSummary } from '../../../../shared/orca-profiles'
-import type { OrcaProfileSwitchLiveWorkSummary } from './orca-profile-switch-liveness'
-
-function liveWorkLines(summary: OrcaProfileSwitchLiveWorkSummary): string[] {
-  const lines: string[] = []
-  if (summary.liveTerminalTabCount > 0) {
-    lines.push(
-      translate(
-        summary.liveTerminalTabCount === 1
-          ? 'auto.components.orca.profiles.switch.confirm.terminalSingular'
-          : 'auto.components.orca.profiles.switch.confirm.terminalPlural',
-        summary.liveTerminalTabCount === 1
-          ? '{{count}} live terminal tab'
-          : '{{count}} live terminal tabs',
-        { count: summary.liveTerminalTabCount }
-      )
-    )
-  }
-  if (summary.liveAgentCount > 0) {
-    lines.push(
-      translate(
-        summary.liveAgentCount === 1
-          ? 'auto.components.orca.profiles.switch.confirm.agentSingular'
-          : 'auto.components.orca.profiles.switch.confirm.agentPlural',
-        summary.liveAgentCount === 1 ? '{{count}} active agent' : '{{count}} active agents',
-        { count: summary.liveAgentCount }
-      )
-    )
-  }
-  if (summary.browserWorkspaceCount > 0) {
-    lines.push(
-      translate(
-        summary.browserWorkspaceCount === 1
-          ? 'auto.components.orca.profiles.switch.confirm.browserSingular'
-          : 'auto.components.orca.profiles.switch.confirm.browserPlural',
-        summary.browserWorkspaceCount === 1
-          ? '{{count}} browser workspace'
-          : '{{count}} browser workspaces',
-        { count: summary.browserWorkspaceCount }
-      )
-    )
-  }
-  return lines
-}
-
-export function OrcaProfileSwitchConfirmDialog({
-  open,
-  onOpenChange,
-  onConfirm,
-  activeProfileName,
-  targetProfile,
-  liveWorkSummary,
-  switching
-}: {
-  open: boolean
-  onOpenChange: (open: boolean) => void
-  onConfirm: () => void
-  activeProfileName: string
-  targetProfile: OrcaProfileSummary | null
-  liveWorkSummary: OrcaProfileSwitchLiveWorkSummary
-  switching: boolean
-}): React.JSX.Element {
-  const targetName =
-    targetProfile?.name ??
-    translate('auto.components.orca.profiles.switch.confirm.target', 'the selected profile')
-  const lines = liveWorkLines(liveWorkSummary)
-
-  return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="sm:max-w-[420px]">
-        <DialogHeader>
-          <DialogTitle className="flex items-center gap-2">
-            <AlertTriangle className="size-4 text-muted-foreground" />
-            {translate('auto.components.orca.profiles.switch.confirm.title', 'Switch profiles?')}
-          </DialogTitle>
-          <DialogDescription>
-            {translate(
-              'auto.components.orca.profiles.switch.confirm.description',
-              'Switching to {{targetName}} will relaunch Orca and reload the workspace for {{activeProfileName}}.',
-              { activeProfileName, targetName }
-            )}
-          </DialogDescription>
-        </DialogHeader>
-
-        {lines.length > 0 ? (
-          <div className="rounded-md border border-border bg-muted/40 px-3 py-2 text-sm">
-            <div className="mb-1 font-medium text-foreground">
-              {translate(
-                'auto.components.orca.profiles.switch.confirm.live.work',
-                'Live work in this profile'
-              )}
-            </div>
-            <ul className="space-y-1 text-xs text-muted-foreground">
-              {lines.map((line) => (
-                <li key={line}>{line}</li>
-              ))}
-            </ul>
-          </div>
-        ) : null}
-
-        <DialogFooter>
-          <Button
-            variant="ghost"
-            size="sm"
-            onClick={() => onOpenChange(false)}
-            disabled={switching}
-          >
-            {translate('auto.components.orca.profiles.switch.confirm.cancel', 'Cancel')}
-          </Button>
-          <Button size="sm" onClick={onConfirm} disabled={switching}>
-            {switching ? <Loader2 className="size-4 animate-spin" /> : null}
-            {translate('auto.components.orca.profiles.switch.confirm.switch', 'Switch profile')}
-          </Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-  )
-}
diff --git a/src/renderer/src/components/orca-profiles/OrcaProfileSwitcher.test.tsx b/src/renderer/src/components/orca-profiles/OrcaProfileSwitcher.test.tsx
deleted file mode 100644
index 3759d07a49f..00000000000
--- a/src/renderer/src/components/orca-profiles/OrcaProfileSwitcher.test.tsx
+++ /dev/null
@@ -1,234 +0,0 @@
-// @vitest-environment happy-dom
-
-import type { ReactNode } from 'react'
-import { renderToStaticMarkup } from 'react-dom/server'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { AppState } from '@/store'
-import type { OrcaProfileAuthStatus, OrcaProfileSummary } from '../../../../shared/orca-profiles'
-import { OrcaProfileSwitcher } from './OrcaProfileSwitcher'
-
-const mocks = vi.hoisted(() => ({
-  state: {} as Partial<AppState>
-}))
-
-vi.mock('@/store', () => ({
-  useAppStore: (selector: (state: Partial<AppState>) => unknown) => selector(mocks.state)
-}))
-
-vi.mock('@/components/ui/dropdown-menu', () => ({
-  DropdownMenu: ({ children }: { children: ReactNode }) => <>{children}</>,
-  DropdownMenuContent: ({ children }: { children: ReactNode }) => <>{children}</>,
-  DropdownMenuItem: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  DropdownMenuLabel: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  DropdownMenuSeparator: () => <hr />,
-  DropdownMenuTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
-  DropdownMenuSub: ({ children }: { children: ReactNode }) => <>{children}</>,
-  DropdownMenuSubContent: ({ children }: { children: ReactNode }) => <>{children}</>,
-  DropdownMenuSubTrigger: ({ children }: { children: ReactNode }) => <div>{children}</div>
-}))
-
-vi.mock('@/components/ui/tooltip', () => ({
-  Tooltip: ({ children }: { children: ReactNode }) => <>{children}</>,
-  TooltipContent: ({ children }: { children: ReactNode }) => <span>{children}</span>,
-  TooltipTrigger: ({ children }: { children: ReactNode }) => <>{children}</>
-}))
-
-vi.mock('@/components/ui/button', () => ({
-  Button: ({
-    children,
-    'aria-label': ariaLabel
-  }: {
-    children: ReactNode
-    'aria-label'?: string
-  }) => <button aria-label={ariaLabel}>{children}</button>
-}))
-
-vi.mock('./OrcaProfileAvatar', () => ({
-  OrcaProfileAvatar: () => <span data-testid="avatar" />
-}))
-
-vi.mock('./OrcaProfileCreateDialog', () => ({
-  OrcaProfileCreateDialog: () => <div data-testid="create-dialog" />
-}))
-
-vi.mock('./OrcaProfileManagementDialog', () => ({
-  OrcaProfileManagementDialog: () => <div data-testid="management-dialog" />
-}))
-
-vi.mock('./OrcaProfileSwitchConfirmDialog', () => ({
-  OrcaProfileSwitchConfirmDialog: () => <div data-testid="switch-confirm-dialog" />
-}))
-
-vi.mock('./OrcaProfileSignOutConfirmDialog', () => ({
-  OrcaProfileSignOutConfirmDialog: () => <div data-testid="signout-confirm-dialog" />
-}))
-
-vi.mock('./orca-profile-switch-liveness', () => ({
-  getOrcaProfileSwitchLiveWorkSummary: () => ({ hasLiveWork: false })
-}))
-
-const cloudProfile: OrcaProfileSummary = {
-  id: 'local-default',
-  name: 'Personal',
-  avatar: { kind: 'initials', initials: 'P', color: 'neutral' },
-  kind: 'cloud-linked',
-  createdAt: 1,
-  updatedAt: 1,
-  lastOpenedAt: 1,
-  cloud: {
-    cloudProfileId: 'cloud-1',
-    userId: 'user-1',
-    email: 'nina@example.com',
-    activeOrgId: 'org-1',
-    activeOrgName: 'Acme',
-    linkedAt: 2
-  }
-}
-
-const localProfile: OrcaProfileSummary = {
-  id: 'local-default',
-  name: 'Personal',
-  avatar: { kind: 'initials', initials: 'P', color: 'neutral' },
-  kind: 'local',
-  createdAt: 1,
-  updatedAt: 1,
-  lastOpenedAt: 1
-}
-
-const connectedAuthStatus: OrcaProfileAuthStatus = {
-  activeProfileId: 'local-default',
-  configured: true,
-  state: 'connected',
-  persistence: 'encrypted',
-  cloud: cloudProfile.cloud,
-  organizations: [
-    { orgId: 'org-1', name: 'Acme' },
-    { orgId: 'org-2', name: 'Globex' }
-  ]
-}
-
-const unconfiguredAuthStatus: OrcaProfileAuthStatus = {
-  activeProfileId: 'local-default',
-  configured: false,
-  state: 'unconfigured',
-  persistence: 'none'
-}
-
-const signedOutAuthStatus: OrcaProfileAuthStatus = {
-  activeProfileId: 'local-default',
-  configured: true,
-  state: 'local',
-  persistence: 'none'
-}
-
-function baseState(overrides: Partial<AppState>): Partial<AppState> {
-  return {
-    orcaProfiles: [cloudProfile],
-    activeOrcaProfileId: 'local-default',
-    orcaProfilesLoading: false,
-    orcaProfileSwitching: false,
-    orcaProfileConnecting: false,
-    orcaProfileAuthStatus: connectedAuthStatus,
-    orcaProfilesMultiProfileUi: false,
-    fetchOrcaProfiles: vi.fn(),
-    createLocalOrcaProfile: vi.fn(),
-    createCloudLinkedOrcaProfile: vi.fn(),
-    connectCurrentOrcaProfile: vi.fn(),
-    signOutCurrentOrcaProfile: vi.fn(),
-    selectOrcaProfileOrg: vi.fn(),
-    switchOrcaProfile: vi.fn(),
-    ...overrides
-  }
-}
-
-describe('OrcaProfileSwitcher', () => {
-  beforeEach(() => {
-    mocks.state = baseState({})
-  })
-
-  it('renders an account menu without profile management when the flag is off and cloud is configured', () => {
-    mocks.state = baseState({ orcaProfilesMultiProfileUi: false })
-    const html = renderToStaticMarkup(<OrcaProfileSwitcher />)
-
-    expect(html).toContain('aria-label="Account"')
-    expect(html).toContain('nina@example.com')
-    expect(html).toContain('Acme')
-    // Cloud actions stay reachable in the downscoped account menu.
-    expect(html).toContain('Sign out')
-    expect(html).not.toContain('Reconnect profile')
-    // Profile management surfaces are gone.
-    expect(html).not.toContain('Manage profiles')
-    expect(html).not.toContain('New local profile')
-    expect(html).not.toContain('Create profile for org')
-    expect(html).not.toContain('data-testid="create-dialog"')
-    expect(html).not.toContain('data-testid="management-dialog"')
-    expect(html).not.toContain('data-testid="switch-confirm-dialog"')
-    // Sign-out remains mounted.
-    expect(html).toContain('data-testid="signout-confirm-dialog"')
-  })
-
-  it('presents only the sign-in action before an account identity exists', () => {
-    mocks.state = baseState({
-      orcaProfiles: [localProfile],
-      orcaProfileAuthStatus: signedOutAuthStatus,
-      orcaProfilesMultiProfileUi: false
-    })
-    const html = renderToStaticMarkup(<OrcaProfileSwitcher />)
-
-    expect(html).toContain('Sign in to Orca')
-    expect(html).not.toContain('Orca account')
-    expect(html).not.toContain('Signed out')
-    expect(html).not.toContain('Personal')
-    expect(html).not.toContain('>Local<')
-  })
-
-  it('gives a reconnect-required account an explicit recovery action', () => {
-    mocks.state = baseState({
-      orcaProfileAuthStatus: {
-        ...connectedAuthStatus,
-        state: 'reconnect-required'
-      },
-      orcaProfilesMultiProfileUi: false
-    })
-    const html = renderToStaticMarkup(<OrcaProfileSwitcher />)
-
-    expect(html).toContain('nina@example.com')
-    expect(html).toContain('Sign-in required')
-    expect(html).toContain('Sign in again')
-  })
-
-  it('names the pending browser authentication step', () => {
-    mocks.state = baseState({
-      orcaProfiles: [localProfile],
-      orcaProfileAuthStatus: signedOutAuthStatus,
-      orcaProfileConnecting: true,
-      orcaProfilesMultiProfileUi: false
-    })
-    const html = renderToStaticMarkup(<OrcaProfileSwitcher />)
-
-    expect(html).toContain('Waiting for sign-in…')
-  })
-
-  it('renders nothing when the flag is off and cloud is unconfigured', () => {
-    mocks.state = baseState({
-      orcaProfilesMultiProfileUi: false,
-      orcaProfileAuthStatus: unconfiguredAuthStatus
-    })
-    const html = renderToStaticMarkup(<OrcaProfileSwitcher />)
-
-    expect(html).toBe('')
-  })
-
-  it('renders the full multi-profile menu when the flag is on', () => {
-    mocks.state = baseState({ orcaProfilesMultiProfileUi: true })
-    const html = renderToStaticMarkup(<OrcaProfileSwitcher />)
-
-    expect(html).toContain('aria-label="Switch profile"')
-    expect(html).toContain('Manage profiles')
-    expect(html).toContain('New local profile')
-    expect(html).toContain('Create profile for org')
-    expect(html).toContain('data-testid="create-dialog"')
-    expect(html).toContain('data-testid="management-dialog"')
-    expect(html).toContain('data-testid="switch-confirm-dialog"')
-  })
-})
diff --git a/src/renderer/src/components/orca-profiles/OrcaProfileSwitcher.tsx b/src/renderer/src/components/orca-profiles/OrcaProfileSwitcher.tsx
deleted file mode 100644
index f5858d4aa7d..00000000000
--- a/src/renderer/src/components/orca-profiles/OrcaProfileSwitcher.tsx
+++ /dev/null
@@ -1,424 +0,0 @@
-import { useEffect, useMemo, useRef, useState } from 'react'
-import {
-  Check,
-  ChevronDown,
-  CircleUserRound,
-  Cloud,
-  Laptop,
-  Loader2,
-  Plus,
-  Settings2,
-  Users
-} from 'lucide-react'
-import { useShallow } from 'zustand/react/shallow'
-import { Button } from '@/components/ui/button'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger
-} from '@/components/ui/dropdown-menu'
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
-import { translate } from '@/i18n/i18n'
-import { cn } from '@/lib/utils'
-import { useAppStore } from '@/store'
-import type { OrcaCloudOrgSummary, OrcaProfileSummary } from '../../../../shared/orca-profiles'
-import { OrcaProfileAvatar } from './OrcaProfileAvatar'
-import { OrcaProfileCloudMenuItems } from './OrcaProfileCloudMenuItems'
-import { OrcaProfileCreateDialog } from './OrcaProfileCreateDialog'
-import { OrcaProfileOrgMembersDialog } from './OrcaProfileOrgMembersDialog'
-import { OrcaProfileManagementDialog } from './OrcaProfileManagementDialog'
-import { OrcaProfileMenuHeader } from './OrcaProfileMenuHeader'
-import { OrcaProfileSignOutConfirmDialog } from './OrcaProfileSignOutConfirmDialog'
-import { OrcaProfileSwitchConfirmDialog } from './OrcaProfileSwitchConfirmDialog'
-import { getOrcaAccountIdentity } from './orca-account-identity'
-import { getOrcaProfileSwitchLiveWorkSummary } from './orca-profile-switch-liveness'
-
-function isWebClient(): boolean {
-  return Boolean((window as unknown as { __ORCA_WEB_CLIENT__?: boolean }).__ORCA_WEB_CLIENT__)
-}
-
-function getProfileSubtitle(profile: OrcaProfileSummary): string {
-  if (profile.cloud?.activeOrgName) {
-    return profile.cloud.activeOrgName
-  }
-  if (profile.cloud?.email) {
-    return profile.cloud.email
-  }
-  return translate('auto.components.orca.profiles.switcher.b4f9d1125d', 'Local')
-}
-
-export function OrcaProfileSwitcher({
-  placement = 'titlebar'
-}: {
-  placement?: 'titlebar' | 'sidebar'
-}): React.JSX.Element | null {
-  const profiles = useAppStore((s) => s.orcaProfiles)
-  const activeProfileId = useAppStore((s) => s.activeOrcaProfileId)
-  const loading = useAppStore((s) => s.orcaProfilesLoading)
-  const switching = useAppStore((s) => s.orcaProfileSwitching)
-  const connecting = useAppStore((s) => s.orcaProfileConnecting)
-  const authStatus = useAppStore((s) => s.orcaProfileAuthStatus)
-  const multiProfileUi = useAppStore((s) => s.orcaProfilesMultiProfileUi)
-  const fetchProfiles = useAppStore((s) => s.fetchOrcaProfiles)
-  const createLocalProfile = useAppStore((s) => s.createLocalOrcaProfile)
-  const createCloudLinkedProfile = useAppStore((s) => s.createCloudLinkedOrcaProfile)
-  const connectCurrentProfile = useAppStore((s) => s.connectCurrentOrcaProfile)
-  const signOutCurrentProfile = useAppStore((s) => s.signOutCurrentOrcaProfile)
-  const selectOrg = useAppStore((s) => s.selectOrcaProfileOrg)
-  const switchProfile = useAppStore((s) => s.switchOrcaProfile)
-  const liveWorkSummary = useAppStore(useShallow((s) => getOrcaProfileSwitchLiveWorkSummary(s)))
-  const [dialogOpen, setDialogOpen] = useState(false)
-  const [managementOpen, setManagementOpen] = useState(false)
-  const [newProfileName, setNewProfileName] = useState('')
-  const [creating, setCreating] = useState(false)
-  const [creatingCloudProfile, setCreatingCloudProfile] = useState(false)
-  const [signOutConfirmOpen, setSignOutConfirmOpen] = useState(false)
-  const [signingOut, setSigningOut] = useState(false)
-  const [orgMembersOpen, setOrgMembersOpen] = useState(false)
-  const [pendingSwitchProfileId, setPendingSwitchProfileId] = useState<string | null>(null)
-  const activeProfile = useMemo(
-    () => profiles.find((profile) => profile.id === activeProfileId) ?? profiles[0] ?? null,
-    [activeProfileId, profiles]
-  )
-  const pendingSwitchProfile = useMemo(
-    () => profiles.find((profile) => profile.id === pendingSwitchProfileId) ?? null,
-    [pendingSwitchProfileId, profiles]
-  )
-
-  // Why: one attempt per mount — retrying on every loading toggle would spin
-  // an unbounded IPC loop when the list call persistently fails.
-  const fetchAttemptedRef = useRef(false)
-  useEffect(() => {
-    if (profiles.length === 0 && !loading && !fetchAttemptedRef.current) {
-      fetchAttemptedRef.current = true
-      void fetchProfiles()
-    }
-  }, [fetchProfiles, loading, profiles.length])
-
-  // Why: the Orca Cloud account UX isn't ready for production users yet, so the
-  // trigger stays hidden in packaged builds. Dev builds still show it when cloud
-  // auth is configured. electron-vite build forces NODE_ENV=production, so PROD
-  // is baked true even for the e2e bundle; exempt MODE==='e2e' so the switcher
-  // specs can exercise the render path while real packaged prod builds stay hidden.
-  if (import.meta.env.PROD && import.meta.env.MODE !== 'e2e') {
-    return null
-  }
-
-  // Why: paired web/mobile clients only see the desktop stub's fabricated
-  // profile list; showing a switcher there would misreport the active profile
-  // and none of its actions can work remotely.
-  if (isWebClient() || !activeProfile) {
-    return null
-  }
-
-  // Why: with multi-profile UI downscoped, local-only builds (no cloud
-  // configured) have nothing to offer in an account menu — show no trigger.
-  if (!multiProfileUi && authStatus?.configured !== true) {
-    return null
-  }
-
-  const handleCreateProfile = async (event: React.FormEvent<HTMLFormElement>): Promise<void> => {
-    event.preventDefault()
-    if (creating || switching) {
-      return
-    }
-    setCreating(true)
-    const profile = await createLocalProfile(newProfileName)
-    setCreating(false)
-    if (!profile) {
-      return
-    }
-    setNewProfileName('')
-    setDialogOpen(false)
-    if (liveWorkSummary.hasLiveWork) {
-      setPendingSwitchProfileId(profile.id)
-      return
-    }
-    await switchProfile(profile.id)
-  }
-
-  const handleSwitchProfile = (profileId: string): void => {
-    if (profileId === activeProfileId || switching) {
-      return
-    }
-    if (liveWorkSummary.hasLiveWork) {
-      setPendingSwitchProfileId(profileId)
-      return
-    }
-    void switchProfile(profileId)
-  }
-
-  const handleConfirmSwitchProfile = (): void => {
-    if (!pendingSwitchProfileId || switching) {
-      return
-    }
-    void switchProfile(pendingSwitchProfileId)
-  }
-
-  const handleCreateCloudProfileForOrg = async (
-    organization: OrcaCloudOrgSummary
-  ): Promise<void> => {
-    if (creatingCloudProfile || switching) {
-      return
-    }
-    setCreatingCloudProfile(true)
-    const result = await createCloudLinkedProfile({
-      orgId: organization.orgId,
-      name: organization.name
-    })
-    setCreatingCloudProfile(false)
-    if (result?.status !== 'created') {
-      return
-    }
-    if (liveWorkSummary.hasLiveWork) {
-      setPendingSwitchProfileId(result.profile.id)
-      return
-    }
-    await switchProfile(result.profile.id)
-  }
-
-  const handleConfirmSignOut = async (): Promise<void> => {
-    if (signingOut) {
-      return
-    }
-    setSigningOut(true)
-    const result = await signOutCurrentProfile()
-    setSigningOut(false)
-    if (result) {
-      setSignOutConfirmOpen(false)
-    }
-  }
-
-  const profileActionDisabled =
-    switching || creating || creatingCloudProfile || connecting || signingOut
-  // Why: teammate management needs a connected cloud profile scoped to an org;
-  // the server enforces role permissions, and the dialog adapts via
-  // canManageMembers, so cloud-linked + org + connected is enough to reveal it.
-  const activeOrgId = activeProfile.cloud?.activeOrgId
-  const showOrgMembers =
-    activeProfile.kind === 'cloud-linked' &&
-    Boolean(activeOrgId) &&
-    authStatus?.state === 'connected'
-  const sidebarPlacement = placement === 'sidebar'
-  const triggerLabel = multiProfileUi
-    ? translate('auto.components.orca.profiles.switcher.4815f7d163', 'Switch profile')
-    : translate('auto.components.orca.profiles.switcher.account', 'Account')
-  const accountIdentity = getOrcaAccountIdentity(activeProfile, authStatus)
-  const showAccountIdentity =
-    multiProfileUi ||
-    authStatus?.state === 'connected' ||
-    authStatus?.state === 'reconnect-required'
-
-  return (
-    <>
-      <DropdownMenu>
-        <Tooltip>
-          <TooltipTrigger asChild>
-            <DropdownMenuTrigger asChild>
-              <Button
-                variant="ghost"
-                size={sidebarPlacement ? 'icon-xs' : 'xs'}
-                className={cn(
-                  'text-muted-foreground titlebar-profile-switcher',
-                  sidebarPlacement ? 'px-0' : 'mr-2 max-w-[180px] gap-1.5 px-1.5'
-                )}
-                disabled={profileActionDisabled}
-                aria-label={triggerLabel}
-              >
-                {sidebarPlacement && switching ? (
-                  <Loader2 className="size-3 animate-spin" />
-                ) : !multiProfileUi ? (
-                  <CircleUserRound className="size-4" />
-                ) : (
-                  <OrcaProfileAvatar
-                    profile={activeProfile}
-                    className={
-                      sidebarPlacement
-                        ? 'size-4 border-worktree-sidebar-border bg-worktree-sidebar-accent text-[10px] text-worktree-sidebar-accent-foreground'
-                        : undefined
-                    }
-                  />
-                )}
-                {!sidebarPlacement ? (
-                  <>
-                    <span className="hidden max-w-[108px] truncate text-xs font-medium sm:inline">
-                      {multiProfileUi
-                        ? activeProfile.name
-                        : showAccountIdentity
-                          ? accountIdentity.title
-                          : triggerLabel}
-                    </span>
-                    {switching ? <Loader2 className="size-3 animate-spin" /> : <ChevronDown />}
-                  </>
-                ) : null}
-              </Button>
-            </DropdownMenuTrigger>
-          </TooltipTrigger>
-          <TooltipContent side={sidebarPlacement ? 'top' : 'bottom'} sideOffset={6}>
-            {triggerLabel}
-          </TooltipContent>
-        </Tooltip>
-        <DropdownMenuContent
-          align={sidebarPlacement ? 'start' : 'end'}
-          side={sidebarPlacement ? 'top' : 'bottom'}
-          sideOffset={sidebarPlacement ? 8 : 6}
-          className="w-64"
-        >
-          {showAccountIdentity ? (
-            <>
-              <OrcaProfileMenuHeader
-                profile={activeProfile}
-                title={multiProfileUi ? activeProfile.name : accountIdentity.title}
-                subtitle={
-                  multiProfileUi ? getProfileSubtitle(activeProfile) : accountIdentity.subtitle
-                }
-                showProfileAvatar={multiProfileUi}
-              />
-              <DropdownMenuSeparator />
-            </>
-          ) : null}
-          {multiProfileUi
-            ? profiles.map((profile) => {
-                const active = profile.id === activeProfileId
-                return (
-                  <DropdownMenuItem
-                    key={profile.id}
-                    disabled={profileActionDisabled}
-                    onSelect={() => handleSwitchProfile(profile.id)}
-                    className="min-w-0"
-                  >
-                    <OrcaProfileAvatar profile={profile} />
-                    <span className="min-w-0 flex-1">
-                      <span className="block truncate">{profile.name}</span>
-                      <span className="block truncate text-[11px] font-normal text-muted-foreground">
-                        {getProfileSubtitle(profile)}
-                      </span>
-                    </span>
-                    {profile.kind === 'cloud-linked' ? <Cloud className="size-3.5" /> : <Laptop />}
-                    {active && <Check className="size-3.5 text-foreground" />}
-                  </DropdownMenuItem>
-                )
-              })
-            : null}
-          {showOrgMembers ? (
-            <>
-              <DropdownMenuSeparator />
-              <DropdownMenuItem
-                disabled={profileActionDisabled}
-                onSelect={() => setOrgMembersOpen(true)}
-              >
-                <Users />
-                {translate(
-                  'auto.components.orca.profiles.switcher.org.members',
-                  'Organization members'
-                )}
-              </DropdownMenuItem>
-            </>
-          ) : null}
-          <OrcaProfileCloudMenuItems
-            activeProfile={activeProfile}
-            authStatus={authStatus}
-            connecting={connecting}
-            profileActionDisabled={profileActionDisabled}
-            allowProfileCreation={multiProfileUi}
-            separateAuthActions={showAccountIdentity || showOrgMembers}
-            onConnect={() => {
-              void connectCurrentProfile()
-            }}
-            onCreateProfileForOrg={(organization) => {
-              void handleCreateCloudProfileForOrg(organization)
-            }}
-            onSelectOrg={(orgId) => {
-              void selectOrg(orgId)
-            }}
-            onRequestSignOut={() => setSignOutConfirmOpen(true)}
-          />
-          {multiProfileUi ? (
-            <>
-              <DropdownMenuSeparator />
-              <DropdownMenuItem
-                disabled={profileActionDisabled}
-                onSelect={() => {
-                  setManagementOpen(true)
-                }}
-              >
-                <Settings2 />
-                {translate('auto.components.orca.profiles.switcher.d00d853e2a', 'Manage profiles')}
-              </DropdownMenuItem>
-              <DropdownMenuItem
-                disabled={profileActionDisabled}
-                onSelect={() => {
-                  setDialogOpen(true)
-                }}
-              >
-                <Plus />
-                {translate(
-                  'auto.components.orca.profiles.switcher.c106c674fe',
-                  'New local profile'
-                )}
-              </DropdownMenuItem>
-            </>
-          ) : null}
-        </DropdownMenuContent>
-      </DropdownMenu>
-
-      {multiProfileUi ? (
-        <>
-          <OrcaProfileCreateDialog
-            open={dialogOpen}
-            onOpenChange={setDialogOpen}
-            name={newProfileName}
-            onNameChange={setNewProfileName}
-            creating={creating}
-            switching={switching}
-            onSubmit={handleCreateProfile}
-          />
-          <OrcaProfileManagementDialog
-            open={managementOpen}
-            onOpenChange={setManagementOpen}
-            activeProfile={activeProfile}
-            profiles={profiles}
-          />
-        </>
-      ) : null}
-      {showOrgMembers && activeOrgId ? (
-        <OrcaProfileOrgMembersDialog
-          open={orgMembersOpen}
-          onOpenChange={setOrgMembersOpen}
-          orgId={activeOrgId}
-          orgName={activeProfile.cloud?.activeOrgName}
-          viewerUserId={activeProfile.cloud?.userId}
-        />
-      ) : null}
-      <OrcaProfileSignOutConfirmDialog
-        open={signOutConfirmOpen}
-        onOpenChange={(open) => {
-          if (!signingOut) {
-            setSignOutConfirmOpen(open)
-          }
-        }}
-        onConfirm={() => {
-          void handleConfirmSignOut()
-        }}
-        signingOut={signingOut}
-      />
-      {multiProfileUi ? (
-        <OrcaProfileSwitchConfirmDialog
-          open={Boolean(pendingSwitchProfileId)}
-          onOpenChange={(open) => {
-            if (!open && !switching) {
-              setPendingSwitchProfileId(null)
-            }
-          }}
-          onConfirm={handleConfirmSwitchProfile}
-          activeProfileName={activeProfile.name}
-          targetProfile={pendingSwitchProfile}
-          liveWorkSummary={liveWorkSummary}
-          switching={switching}
-        />
-      ) : null}
-    </>
-  )
-}
diff --git a/src/renderer/src/components/orca-profiles/orca-account-identity.ts b/src/renderer/src/components/orca-profiles/orca-account-identity.ts
deleted file mode 100644
index 65ab7231058..00000000000
--- a/src/renderer/src/components/orca-profiles/orca-account-identity.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import { translate } from '@/i18n/i18n'
-import type { OrcaProfileAuthStatus, OrcaProfileSummary } from '../../../../shared/orca-profiles'
-
-export function getOrcaAccountIdentity(
-  profile: OrcaProfileSummary,
-  authStatus: OrcaProfileAuthStatus | null
-): { title: string; subtitle: string } {
-  // Why: the account-only menu must not present a local execution profile as
-  // an authenticated Orca identity.
-  const cloud = authStatus?.cloud ?? profile.cloud
-  if (authStatus?.state === 'connected') {
-    return {
-      title:
-        cloud?.displayName?.trim() ||
-        cloud?.email ||
-        translate('auto.components.orca.profiles.switcher.accountTitle', 'Orca account'),
-      subtitle:
-        cloud?.activeOrgName ||
-        (cloud?.displayName && cloud.email
-          ? cloud.email
-          : translate('auto.components.orca.profiles.switcher.accountSignedIn', 'Signed in'))
-    }
-  }
-  if (authStatus?.state === 'reconnect-required') {
-    return {
-      title:
-        cloud?.displayName?.trim() ||
-        cloud?.email ||
-        translate('auto.components.orca.profiles.switcher.accountTitle', 'Orca account'),
-      subtitle: translate(
-        'auto.components.orca.profiles.switcher.accountSignInRequired',
-        'Sign-in required'
-      )
-    }
-  }
-  return {
-    title: translate('auto.components.orca.profiles.switcher.accountTitle', 'Orca account'),
-    subtitle: translate('auto.components.orca.profiles.switcher.accountSignedOut', 'Signed out')
-  }
-}
diff --git a/src/renderer/src/components/orca-profiles/orca-profile-org-members-labels.ts b/src/renderer/src/components/orca-profiles/orca-profile-org-members-labels.ts
deleted file mode 100644
index 9378d77cec1..00000000000
--- a/src/renderer/src/components/orca-profiles/orca-profile-org-members-labels.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import { translate } from '@/i18n/i18n'
-import type {
-  OrcaOrgRole,
-  OrcaProfileOrgMemberMutationResult
-} from '../../../../shared/orca-profiles'
-
-export const ORG_ROLE_OPTIONS: readonly OrcaOrgRole[] = ['owner', 'admin', 'member']
-
-export function orgRoleLabel(role: OrcaOrgRole): string {
-  switch (role) {
-    case 'owner':
-      return translate('auto.components.orca.profiles.org.members.role.owner', 'Owner')
-    case 'admin':
-      return translate('auto.components.orca.profiles.org.members.role.admin', 'Admin')
-    case 'member':
-      return translate('auto.components.orca.profiles.org.members.role.member', 'Member')
-  }
-}
-
-export function orgMemberInitials(displayName: string | undefined, email: string): string {
-  const source = displayName?.trim() || email.trim()
-  if (!source) {
-    return '?'
-  }
-  const words = source.split(/\s+/).filter(Boolean)
-  if (words.length >= 2) {
-    return `${words[0][0]}${words[1][0]}`.toUpperCase()
-  }
-  return source.slice(0, 2).toUpperCase()
-}
-
-// Why: the dialog maps every non-ok mutation status to a precise, translated
-// message so managers see why an action was rejected instead of a raw code.
-export function describeOrgMutationError(
-  result: Exclude<OrcaProfileOrgMemberMutationResult, { status: 'ok' }>
-): string {
-  switch (result.status) {
-    case 'forbidden':
-      return translate(
-        'auto.components.orca.profiles.org.members.error.forbidden',
-        "Your role can't do that."
-      )
-    case 'conflict':
-      return translate(
-        'auto.components.orca.profiles.org.members.error.conflict',
-        'Already a member or invited.'
-      )
-    case 'invalid':
-      return result.reason === 'cannot_remove_self'
-        ? translate(
-            'auto.components.orca.profiles.org.members.error.remove.self',
-            "You can't remove yourself."
-          )
-        : translate(
-            'auto.components.orca.profiles.org.members.error.own.role',
-            "You can't change your own role."
-          )
-    case 'not-found':
-      return translate(
-        'auto.components.orca.profiles.org.members.error.not.found',
-        'That teammate is no longer in this organization.'
-      )
-    case 'reconnect-required':
-      return translate(
-        'auto.components.orca.profiles.org.members.error.reconnect',
-        'Reconnect your profile to manage members.'
-      )
-    case 'unconfigured':
-      return translate(
-        'auto.components.orca.profiles.org.members.error.unconfigured',
-        'Organization management is unavailable in this build.'
-      )
-    case 'failed':
-      return translate(
-        'auto.components.orca.profiles.org.members.error.failed',
-        'Something went wrong. Please try again.'
-      )
-  }
-}
diff --git a/src/renderer/src/components/orca-profiles/orca-profile-switch-liveness.test.ts b/src/renderer/src/components/orca-profiles/orca-profile-switch-liveness.test.ts
deleted file mode 100644
index 1dfc0873727..00000000000
--- a/src/renderer/src/components/orca-profiles/orca-profile-switch-liveness.test.ts
+++ /dev/null
@@ -1,194 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
-import type { BrowserWorkspace, TerminalTab } from '../../../../shared/types'
-import {
-  getOrcaProfileProjectLiveWorkSummary,
-  getOrcaProfileSwitchLiveWorkSummary,
-  type OrcaProfileSwitchLiveWorkState
-} from './orca-profile-switch-liveness'
-
-const NOW = 1_000_000
-
-function makeState(
-  overrides: Partial<OrcaProfileSwitchLiveWorkState> = {}
-): OrcaProfileSwitchLiveWorkState {
-  return {
-    agentStatusByPaneKey: {},
-    browserTabsByWorktree: {},
-    ptyIdsByTabId: {},
-    runtimePaneTitlesByTabId: {},
-    tabsByWorktree: {},
-    ...overrides
-  }
-}
-
-function makeTab(
-  overrides: Partial<Omit<TerminalTab, 'id' | 'worktreeId'>> & {
-    id: string
-    worktreeId?: string
-  }
-): TerminalTab {
-  const { id, worktreeId = 'worktree-1', ...rest } = overrides
-  return {
-    id,
-    color: null,
-    createdAt: NOW,
-    customTitle: null,
-    ptyId: null,
-    sortOrder: 0,
-    title: 'zsh',
-    worktreeId,
-    ...rest
-  }
-}
-
-function makeAgentEntry(overrides: Partial<AgentStatusEntry> = {}): AgentStatusEntry {
-  return {
-    paneKey: 'tab-1:0',
-    prompt: '',
-    state: 'working',
-    stateHistory: [],
-    stateStartedAt: NOW,
-    updatedAt: NOW,
-    ...overrides
-  }
-}
-
-function makeBrowserWorkspace(id: string): BrowserWorkspace {
-  return {
-    id,
-    activePageId: null,
-    canGoBack: false,
-    canGoForward: false,
-    createdAt: NOW,
-    faviconUrl: null,
-    label: 'Browser',
-    loadError: null,
-    loading: false,
-    pageIds: [],
-    title: 'Browser',
-    url: 'about:blank',
-    worktreeId: 'worktree-1'
-  }
-}
-
-describe('getOrcaProfileSwitchLiveWorkSummary', () => {
-  it('reports quiet profiles as safe to switch without confirmation', () => {
-    expect(getOrcaProfileSwitchLiveWorkSummary(makeState(), NOW)).toEqual({
-      browserWorkspaceCount: 0,
-      hasLiveWork: false,
-      liveAgentCount: 0,
-      livePtyCount: 0,
-      liveTerminalTabCount: 0
-    })
-  })
-
-  it('counts live PTYs as live terminal work', () => {
-    const summary = getOrcaProfileSwitchLiveWorkSummary(
-      makeState({
-        ptyIdsByTabId: {
-          'tab-1': ['pty-1', 'pty-2'],
-          'tab-2': []
-        }
-      }),
-      NOW
-    )
-
-    expect(summary).toMatchObject({
-      hasLiveWork: true,
-      livePtyCount: 2,
-      liveTerminalTabCount: 1
-    })
-  })
-
-  it('counts fresh working explicit agent status', () => {
-    const summary = getOrcaProfileSwitchLiveWorkSummary(
-      makeState({
-        agentStatusByPaneKey: {
-          'tab-1:0': makeAgentEntry({ paneKey: 'tab-1:0', state: 'working' }),
-          'tab-2:0': makeAgentEntry({ paneKey: 'tab-2:0', state: 'done' }),
-          'tab-3:0': makeAgentEntry({
-            paneKey: 'tab-3:0',
-            state: 'waiting',
-            updatedAt: -999_999_999
-          })
-        }
-      }),
-      NOW
-    )
-
-    expect(summary.liveAgentCount).toBe(1)
-    expect(summary.hasLiveWork).toBe(true)
-  })
-
-  it('counts title-detected agents only when the tab has a live PTY', () => {
-    const summary = getOrcaProfileSwitchLiveWorkSummary(
-      makeState({
-        ptyIdsByTabId: {
-          'tab-live': ['pty-1']
-        },
-        tabsByWorktree: {
-          'worktree-1': [
-            makeTab({ id: 'tab-live', title: 'Codex working' }),
-            makeTab({ id: 'tab-slept', title: 'Codex working' })
-          ]
-        }
-      }),
-      NOW
-    )
-
-    expect(summary.liveAgentCount).toBe(1)
-    expect(summary.hasLiveWork).toBe(true)
-  })
-
-  it('counts browser workspaces as live browser work', () => {
-    const summary = getOrcaProfileSwitchLiveWorkSummary(
-      makeState({
-        browserTabsByWorktree: {
-          'worktree-1': [makeBrowserWorkspace('browser-1'), makeBrowserWorkspace('browser-2')]
-        }
-      }),
-      NOW
-    )
-
-    expect(summary).toMatchObject({
-      browserWorkspaceCount: 2,
-      hasLiveWork: true
-    })
-  })
-
-  it('filters live work to the selected project', () => {
-    const summary = getOrcaProfileProjectLiveWorkSummary(
-      makeState({
-        agentStatusByPaneKey: {
-          'other-tab:0': makeAgentEntry({
-            paneKey: 'other-tab:0',
-            worktreeId: 'repo-other::/workspace/other'
-          })
-        },
-        browserTabsByWorktree: {
-          'repo-1::/workspace/orca': [makeBrowserWorkspace('browser-1')],
-          'repo-other::/workspace/other': [makeBrowserWorkspace('browser-2')]
-        },
-        ptyIdsByTabId: {
-          'tab-live': ['pty-1'],
-          'other-tab': ['pty-2']
-        },
-        tabsByWorktree: {
-          'repo-1::/workspace/orca': [makeTab({ id: 'tab-live', title: 'Codex working' })],
-          'repo-other::/workspace/other': [makeTab({ id: 'other-tab', title: 'Codex working' })]
-        }
-      }),
-      'repo-1',
-      NOW
-    )
-
-    expect(summary).toMatchObject({
-      browserWorkspaceCount: 1,
-      hasLiveWork: true,
-      liveAgentCount: 1,
-      livePtyCount: 1,
-      liveTerminalTabCount: 1
-    })
-  })
-})
diff --git a/src/renderer/src/components/orca-profiles/orca-profile-switch-liveness.ts b/src/renderer/src/components/orca-profiles/orca-profile-switch-liveness.ts
deleted file mode 100644
index c96a1812157..00000000000
--- a/src/renderer/src/components/orca-profiles/orca-profile-switch-liveness.ts
+++ /dev/null
@@ -1,180 +0,0 @@
-import type { AppState } from '@/store/types'
-import {
-  AGENT_STATUS_STALE_AFTER_MS,
-  type AgentStatusEntry
-} from '../../../../shared/agent-status-types'
-import type { TerminalTab } from '../../../../shared/types'
-import { getRepoIdFromWorktreeId } from '../../../../shared/worktree-id'
-import { detectAgentStatusFromTitle, isExplicitAgentStatusFresh } from '@/lib/agent-status'
-import { tabHasLivePty } from '@/lib/tab-has-live-pty'
-
-export type OrcaProfileSwitchLiveWorkState = Pick<
-  AppState,
-  | 'agentStatusByPaneKey'
-  | 'browserTabsByWorktree'
-  | 'ptyIdsByTabId'
-  | 'runtimePaneTitlesByTabId'
-  | 'tabsByWorktree'
->
-
-export type OrcaProfileSwitchLiveWorkSummary = {
-  hasLiveWork: boolean
-  liveAgentCount: number
-  livePtyCount: number
-  liveTerminalTabCount: number
-  browserWorkspaceCount: number
-}
-
-const LIVE_AGENT_STATES = new Set<AgentStatusEntry['state']>(['working', 'blocked', 'waiting'])
-
-export function getOrcaProfileSwitchLiveWorkSummary(
-  state: OrcaProfileSwitchLiveWorkState,
-  now = Date.now()
-): OrcaProfileSwitchLiveWorkSummary {
-  const terminalSummary = getLiveTerminalSummary(state)
-  const liveAgentCount = getLiveAgentKeys(state, now).size
-  const browserWorkspaceCount = Object.values(state.browserTabsByWorktree).reduce(
-    (count, workspaces) => count + workspaces.length,
-    0
-  )
-
-  return {
-    hasLiveWork:
-      terminalSummary.livePtyCount > 0 || liveAgentCount > 0 || browserWorkspaceCount > 0,
-    liveAgentCount,
-    livePtyCount: terminalSummary.livePtyCount,
-    liveTerminalTabCount: terminalSummary.liveTerminalTabCount,
-    browserWorkspaceCount
-  }
-}
-
-export function getOrcaProfileProjectLiveWorkSummary(
-  state: OrcaProfileSwitchLiveWorkState,
-  repoId: string,
-  now = Date.now()
-): OrcaProfileSwitchLiveWorkSummary {
-  const tabsByWorktree = Object.fromEntries(
-    Object.entries(state.tabsByWorktree).filter(([worktreeId]) =>
-      worktreeBelongsToRepo(worktreeId, repoId)
-    )
-  )
-  const tabIds = new Set(Object.values(tabsByWorktree).flatMap((tabs) => tabs.map((tab) => tab.id)))
-  const browserTabsByWorktree = Object.fromEntries(
-    Object.entries(state.browserTabsByWorktree).filter(([worktreeId]) =>
-      worktreeBelongsToRepo(worktreeId, repoId)
-    )
-  )
-  const ptyIdsByTabId = Object.fromEntries(
-    Object.entries(state.ptyIdsByTabId).filter(([tabId]) => tabIds.has(tabId))
-  )
-  const runtimePaneTitlesByTabId = Object.fromEntries(
-    Object.entries(state.runtimePaneTitlesByTabId).filter(([tabId]) => tabIds.has(tabId))
-  )
-  const agentStatusByPaneKey = Object.fromEntries(
-    Object.entries(state.agentStatusByPaneKey).filter(([paneKey, entry]) =>
-      agentEntryBelongsToProject(paneKey, entry, repoId, tabIds)
-    )
-  )
-
-  return getOrcaProfileSwitchLiveWorkSummary(
-    {
-      agentStatusByPaneKey,
-      browserTabsByWorktree,
-      ptyIdsByTabId,
-      runtimePaneTitlesByTabId,
-      tabsByWorktree
-    },
-    now
-  )
-}
-
-function getLiveTerminalSummary(state: OrcaProfileSwitchLiveWorkState): {
-  livePtyCount: number
-  liveTerminalTabCount: number
-} {
-  const liveTabIds = new Set<string>()
-  let livePtyCount = 0
-
-  for (const [tabId, ptyIds] of Object.entries(state.ptyIdsByTabId)) {
-    if (ptyIds.length === 0) {
-      continue
-    }
-    livePtyCount += ptyIds.length
-    liveTabIds.add(tabId)
-  }
-
-  return {
-    livePtyCount,
-    liveTerminalTabCount: liveTabIds.size
-  }
-}
-
-function getLiveAgentKeys(state: OrcaProfileSwitchLiveWorkState, now: number): Set<string> {
-  const keys = new Set<string>()
-  for (const entry of Object.values(state.agentStatusByPaneKey)) {
-    if (
-      LIVE_AGENT_STATES.has(entry.state) &&
-      isExplicitAgentStatusFresh(entry, now, AGENT_STATUS_STALE_AFTER_MS)
-    ) {
-      keys.add(entry.paneKey)
-    }
-  }
-
-  for (const tabs of Object.values(state.tabsByWorktree)) {
-    for (const tab of tabs) {
-      addTitleDetectedLiveAgentKeys(keys, state, tab)
-    }
-  }
-
-  return keys
-}
-
-function addTitleDetectedLiveAgentKeys(
-  keys: Set<string>,
-  state: OrcaProfileSwitchLiveWorkState,
-  tab: TerminalTab
-): void {
-  if (!tabHasLivePty(state.ptyIdsByTabId, tab.id)) {
-    return
-  }
-
-  const paneTitles = state.runtimePaneTitlesByTabId[tab.id]
-  if (paneTitles && Object.keys(paneTitles).length > 0) {
-    for (const [paneId, title] of Object.entries(paneTitles)) {
-      if (isLiveAgentTitle(title)) {
-        keys.add(`${tab.id}:${paneId}`)
-      }
-    }
-    return
-  }
-
-  if (isLiveAgentTitle(tab.title)) {
-    keys.add(`${tab.id}:title`)
-  }
-}
-
-function isLiveAgentTitle(title: string): boolean {
-  const status = detectAgentStatusFromTitle(title)
-  return status === 'working' || status === 'permission'
-}
-
-function agentEntryBelongsToProject(
-  paneKey: string,
-  entry: AgentStatusEntry,
-  repoId: string,
-  tabIds: Set<string>
-): boolean {
-  if (entry.worktreeId && worktreeBelongsToRepo(entry.worktreeId, repoId)) {
-    return true
-  }
-  return tabIds.has(getPaneKeyTabId(paneKey))
-}
-
-function getPaneKeyTabId(paneKey: string): string {
-  const separatorIndex = paneKey.lastIndexOf(':')
-  return separatorIndex === -1 ? paneKey : paneKey.slice(0, separatorIndex)
-}
-
-function worktreeBelongsToRepo(worktreeId: string, repoId: string): boolean {
-  return getRepoIdFromWorktreeId(worktreeId) === repoId
-}
diff --git a/src/renderer/src/components/pr-comments-resolution-prompt.test.ts b/src/renderer/src/components/pr-comments-resolution-prompt.test.ts
index 875794753af..902481e9ba3 100644
--- a/src/renderer/src/components/pr-comments-resolution-prompt.test.ts
+++ b/src/renderer/src/components/pr-comments-resolution-prompt.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import type { PRComment } from '../../../shared/types'
-import { groupPRComments } from '@/lib/pr-comment-groups'
+import { groupPRComments } from '../../../shared/pr-comment-groups'
 import {
   buildPRCommentsResolutionPrompt,
   isResolvablePRCommentGroup
diff --git a/src/renderer/src/components/pr-comments-resolution-prompt.ts b/src/renderer/src/components/pr-comments-resolution-prompt.ts
index 8aecb0ad3e2..d86a4e8d653 100644
--- a/src/renderer/src/components/pr-comments-resolution-prompt.ts
+++ b/src/renderer/src/components/pr-comments-resolution-prompt.ts
@@ -1,5 +1,5 @@
 import type { PRComment } from '../../../shared/types'
-import type { PRCommentGroup } from '@/lib/pr-comment-groups'
+import type { PRCommentGroup } from '../../../shared/pr-comment-groups'
 
 export type PRCommentsResolutionReviewKind = 'PR' | 'MR'
 
@@ -150,7 +150,7 @@ export function buildPRCommentsResolutionPrompt({
     '- For outdated comments, inspect the current file and nearby code before editing. Apply the reviewer intent only if it still matches the current code.',
     '- Keep changes minimal and coherent. If multiple selected comments conflict or require a larger design decision, stop and report the tradeoff instead of guessing.',
     '- Preserve unrelated staged and unstaged work. Do not run destructive cleanup commands such as git reset --hard, git checkout ., git restore ., or git stash.',
-    '- Host thread resolution and any fixing replies are handled by Orca after launch. Do not resolve or unresolve threads on the host, reply on the host, edit host comments, or use provider APIs/CLIs just to change review state.',
+    '- Orca acknowledges this feedback on the host itself after launch. Do not resolve or unresolve threads on the host, reply on the host, edit host comments, or use provider APIs/CLIs just to change review state.',
     '- Do not push, create commits, or rewrite history.',
     '- Run git diff --check before finishing. Run the most focused relevant tests, typecheck, or lint command you can reasonably identify; if validation is impractical, explain why.',
     '',
diff --git a/src/renderer/src/components/pull-request-page-host-boundary.test.ts b/src/renderer/src/components/pull-request-page-host-boundary.test.ts
index 10407760e6d..223df6300d8 100644
--- a/src/renderer/src/components/pull-request-page-host-boundary.test.ts
+++ b/src/renderer/src/components/pull-request-page-host-boundary.test.ts
@@ -249,6 +249,41 @@ describe('PullRequestPage host boundaries', () => {
     expect(checksSection).toContain('window.api.gh.prChecks({')
     expect(checksSection).toContain('window.api.gh.rerunPRChecks({')
     expect(checksSection).toContain('prCheckDetails({')
+    expect(checksSection).toMatch(
+      /withGitHubCheckDetailsTimeout\(\(signal\) =>\s*runtimeHost\s*\?\s*callRuntimeRpc[\s\S]*:\s*window\.api\.gh\.prCheckDetails\(\{/
+    )
+    expect(checksSection).toContain('{ timeoutMs: 30_000, signal }')
+  })
+
+  it('makes failed check detail loads retryable and fences stale settlements', () => {
+    const source = componentSource('PullRequestPage.tsx')
+    const checksSection = sourceBetween(source, 'function ChecksTab', 'function MentionTextarea')
+
+    expect(checksSection).toContain('const requestId = ++nextCheckDetailsRequestIdRef.current')
+    expect(checksSection).toContain('settleGitHubChecksTabDetails(current, key, requestId')
+    expect(checksSection).toContain('createGitHubChecksTabState(checks, checkDetailsContextKey)')
+    expect(checksSection).toContain('checksState,\n    checks,\n    checkDetailsContextKey')
+    expect(checksSection).toContain('resetGitHubChecksTabForSource(current)')
+    expect(checksSection).toContain(
+      'committedChecksContextOwnerRef.current !== refreshContextOwner'
+    )
+    expect(checksSection).toContain('activeChecksRefreshRequestIdRef.current !== refreshRequestId')
+    expect(checksSection).toContain('current.contextOwner === refreshContextOwner')
+    expect(checksSection).toContain(
+      'const rerunContextOwner = committedChecksContextOwnerRef.current'
+    )
+    expect(checksSection).toContain('committedChecksContextOwnerRef.current !== rerunContextOwner')
+    expect(checksSection).toContain('await handleRefresh(rerunContextOwner)')
+    expect(checksSection).toContain('!mountedRef.current ||')
+    expect(checksSection).toContain(
+      'onClick={() => requestCheckDetails(check, getCheckDetailsKey(check))}'
+    )
+    expect(checksSection).toContain('disabled={state.loading}')
+    expect(checksSection).toContain('aria-busy={state.loading}')
+    expect(checksSection).toContain("translate('githubChecks.retrying', 'Retrying…')")
+    expect(checksSection).toContain(
+      "translate('auto.components.PullRequestPage.5df7c41d2a', 'Retry')"
+    )
   })
 
   it('routes edit metadata and mutations through the PR source context', () => {
diff --git a/src/renderer/src/components/quick-open-file-list.react.test.tsx b/src/renderer/src/components/quick-open-file-list.react.test.tsx
index 8dc6c550344..fc00fac9891 100644
--- a/src/renderer/src/components/quick-open-file-list.react.test.tsx
+++ b/src/renderer/src/components/quick-open-file-list.react.test.tsx
@@ -192,6 +192,43 @@ describe('useRuntimeFileListForWorktree', () => {
     expect(cancelRuntimeFileListMock).toHaveBeenCalledWith(listContext, listRequest.requestToken)
   })
 
+  it('cancels the in-flight scan as soon as listing is disabled', async () => {
+    const workspaceKey = folderWorkspaceKey('folder-workspace-1')
+    listRuntimeFilesMock.mockReturnValue(new Promise<string[]>(() => {}))
+
+    useAppStore.setState({
+      folderWorkspaces: [makeFolderWorkspace({ connectionId: 'ssh-1' })],
+      projectGroups: [makeProjectGroup({ connectionId: 'ssh-1' })],
+      repos: [],
+      worktreesByRepo: {}
+    } as Partial<AppState>)
+
+    const root = await renderProbe({
+      enabled: true,
+      onState: () => {},
+      worktreeId: workspaceKey
+    })
+    await waitForListRuntimeFilesCall()
+
+    const [listContext, listRequest] = listRuntimeFilesMock.mock.calls[0]
+    expect(listContext.connectionId).toBe('ssh-1')
+    expect(cancelRuntimeFileListMock).not.toHaveBeenCalled()
+
+    await act(async () => {
+      root.render(
+        createElement(HookProbe, {
+          enabled: false,
+          onState: () => {},
+          worktreeId: workspaceKey
+        })
+      )
+    })
+    await flushEffects()
+
+    expect(cancelRuntimeFileListMock).toHaveBeenCalledTimes(1)
+    expect(cancelRuntimeFileListMock).toHaveBeenCalledWith(listContext, listRequest.requestToken)
+  })
+
   it('does not restart the scan when unrelated ownership metadata changes', async () => {
     const workspaceKey = folderWorkspaceKey('folder-workspace-1')
     useAppStore.setState({
diff --git a/src/renderer/src/components/quick-open-search.ts b/src/renderer/src/components/quick-open-search.ts
index db13042c8fa..690c59aae00 100644
--- a/src/renderer/src/components/quick-open-search.ts
+++ b/src/renderer/src/components/quick-open-search.ts
@@ -29,6 +29,22 @@ export function prepareQuickOpenFiles(files: readonly string[]): QuickOpenIndexe
   })
 }
 
+const preparedQuickOpenFiles = new WeakMap<readonly string[], QuickOpenIndexedFile[]>()
+
+// Why: keystroke-driven callers re-classify on every character, but the index
+// only changes when the file list array itself is replaced.
+export function getPreparedQuickOpenFiles(
+  files: readonly string[]
+): readonly QuickOpenIndexedFile[] {
+  const cached = preparedQuickOpenFiles.get(files)
+  if (cached) {
+    return cached
+  }
+  const prepared = prepareQuickOpenFiles(files)
+  preparedQuickOpenFiles.set(files, prepared)
+  return prepared
+}
+
 export function isQuickOpenQueryTooLarge(
   query: string,
   maxBytes = QUICK_OPEN_QUERY_MAX_BYTES
diff --git a/src/renderer/src/components/repo/RepoCombobox.tsx b/src/renderer/src/components/repo/RepoCombobox.tsx
index f9fef8ad902..868c7be2d22 100644
--- a/src/renderer/src/components/repo/RepoCombobox.tsx
+++ b/src/renderer/src/components/repo/RepoCombobox.tsx
@@ -19,7 +19,7 @@ import RepoBadgeLabel from './RepoBadgeLabel'
 import { translate } from '@/i18n/i18n'
 
 type RepoComboboxProps = {
-  repos: Repo[]
+  repos: readonly Repo[]
   value: string
   onValueChange: (repoId: string) => void
   onValueSelected?: (repoId: string) => void
diff --git a/src/renderer/src/components/right-sidebar/ChecksPanel.tsx b/src/renderer/src/components/right-sidebar/ChecksPanel.tsx
index 9fc66a78819..25489863d7f 100644
--- a/src/renderer/src/components/right-sidebar/ChecksPanel.tsx
+++ b/src/renderer/src/components/right-sidebar/ChecksPanel.tsx
@@ -42,6 +42,7 @@ import {
 import { isFolderRepo } from '../../../../shared/repo-kind'
 import { githubProjectHost } from '../../../../shared/github-project-identity'
 import HostedReviewActions from './HostedReviewActions'
+import { GitHubPRStackMap, type GitHubPRStackMapNavigationModifiers } from './GitHubPRStackMap'
 import {
   PullRequestIcon,
   prStateColor,
@@ -78,17 +79,16 @@ import {
   getBrokenChecks,
   getCheckDetailsPromptKey
 } from '../pr-checks-fix-prompt'
-import {
-  buildPRCommentsResolutionPrompt,
-  isResolvablePRCommentGroup
-} from '../pr-comments-resolution-prompt'
+import { buildPRCommentsResolutionPrompt } from '../pr-comments-resolution-prompt'
 import { buildPRCommentConversationReplyBody } from './pr-comment-fixing-reply-body'
+import { buildSnapshottedThreadResolver } from './pr-comment-snapshotted-thread-resolver'
 import {
   acknowledgePRCommentsAfterAiLaunch,
   attachPRReviewReplyParent,
   canPostPRReviewThreadReply,
   checksPanelReviewStableKey,
   clearPendingPRCommentAiAck,
+  hasPRCommentGroupNeedingReply,
   resolvePRReviewReplyThreadId,
   setPendingPRCommentAiAck,
   takePendingPRCommentAiAck
@@ -99,9 +99,10 @@ import type {
 } from './pr-comments-ai-launch-ack'
 import { parseGitHubIssueOrPRLink } from '../../../../shared/github-links'
 import { startFixChecksAgent } from '@/lib/fix-checks-agent-launch'
-import type {
-  HostedReviewCreationEligibility,
-  HostedReviewProvider
+import {
+  hostedReviewProviderSupportsDraft,
+  type HostedReviewCreationEligibility,
+  type HostedReviewProvider
 } from '../../../../shared/hosted-review'
 import { resolveHostedReviewCreationProvider } from '../../../../shared/hosted-review-creation-providers'
 import { normalizeGlobalWindowsRuntimeDefault } from '../../../../shared/project-execution-runtime'
@@ -187,11 +188,13 @@ import { resolveSourceControlLaunchPlatform } from '@/lib/source-control-launch-
 import { getLocalProjectExecutionRuntimeContext } from '@/lib/local-preflight-context'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { CreateHostedReviewComposer } from './CreateHostedReviewComposer'
+import { useHostedReviewStackParent } from './useHostedReviewStackParent'
+import { resolveCreatedHostedReviewLink } from './source-control-created-review-link'
 import { formatCreateError } from './create-pull-request-review-copy'
 import { stripBaseRef, useCreatePullRequestDialogFields } from './useCreatePullRequestDialogFields'
 import { localizedHostedReviewCopy } from '@/i18n/hosted-review-localized-copy'
 import { translate } from '@/i18n/i18n'
-import { groupPRComments, type PRCommentGroup } from '@/lib/pr-comment-groups'
+import type { PRCommentGroup } from '../../../../shared/pr-comment-groups'
 import {
   openChecksPanelHostedReviewUrl,
   resolveChecksPanelHostedReviewModifierDestination,
@@ -473,6 +476,7 @@ export default function ChecksPanel(): React.JSX.Element {
     (s) => s.getHostedReviewCreationEligibility
   )
   const createHostedReview = useAppStore((s) => s.createHostedReview)
+  const createStackedHostedReview = useAppStore((s) => s.createStackedHostedReview)
   const enqueueGitHubPRRefresh = useAppStore((s) => s.enqueueGitHubPRRefresh)
   const conflictOperation = useAppStore((s) =>
     activeWorktreeId ? (s.gitConflictOperationByWorktree[activeWorktreeId] ?? 'unknown') : 'unknown'
@@ -1317,10 +1321,13 @@ export default function ChecksPanel(): React.JSX.Element {
     setBody: setPrBody,
     draft: prDraft,
     setDraft: setPrDraft,
+    stackedCreationSupported: prStackedCreationSupported,
+    repoDefaultBaseRef: prRepoDefaultBaseRef,
     baseQuery: prBaseQuery,
     setBaseQuery: setPrBaseQuery,
     baseResults: prBaseResults,
     setBaseResults: setPrBaseResults,
+    baseSearchPending: prBaseSearchPending,
     baseSearchError: prBaseSearchError,
     generating: prGenerating,
     generateError: prGenerateError,
@@ -1357,6 +1364,17 @@ export default function ChecksPanel(): React.JSX.Element {
       onCancelGenerate: handleCancelGeneratePullRequestFieldsForActive
     }
   })
+  const stackParentReview = useHostedReviewStackParent({
+    enabled: hostedReviewCreateProvider === 'github' && prStackedCreationSupported,
+    repoPath: repo?.path ?? '',
+    repoId: repo?.id ?? null,
+    base: prBase,
+    // Why: the repo default, not eligibility's defaultBaseRef — that one resolves to
+    // the worktree's own base, which is exactly the branch a stacked PR targets.
+    repoDefaultBase: prRepoDefaultBaseRef,
+    head: branch,
+    fetchHostedReviewForBranch
+  })
   useEffect(() => {
     // Why: PR generation can finish while this composer is hidden by a worktree switch; hydrate once the original composer is visible again.
     if (
@@ -3107,9 +3125,6 @@ export default function ChecksPanel(): React.JSX.Element {
       if (commentResolutionAckBusyRef.current) {
         return
       }
-      const selectedThreadIds = selectedGroups.flatMap((group) =>
-        group.kind === 'thread' && isResolvablePRCommentGroup(group) ? [group.threadId] : []
-      )
       if (selectedGroups.length === 0) {
         toast.message(
           translate(
@@ -3149,12 +3164,26 @@ export default function ChecksPanel(): React.JSX.Element {
         }
       })()
       const githubTarget = githubTargetFromPr ?? githubTargetFromUrl
+      // Why: resolving needs no prRepo, so a degraded PR entry that only yields a number must
+      // still ack by resolving instead of failing every selected thread.
+      const githubResolveTarget =
+        githubTarget ??
+        (activeReview.provider === 'github' && prNumber
+          ? { repoPath: repo.path, repoId: repo.id, prNumber }
+          : undefined)
+      // Why: the ack resolves against this MR after delivery, so pin the iid now — the panel
+      // may already be showing a different review by then.
+      const gitlabTarget =
+        activeReview.provider === 'gitlab'
+          ? { repoPath: repo.path, repoId: repo.id, iid: activeReview.number }
+          : undefined
       const commentResolution = {
         reviewContextKey: stateRequestKey,
         provider: activeReview.provider,
-        selectedThreadIds,
         selectedGroups,
-        githubTarget
+        githubTarget,
+        githubResolveTarget,
+        gitlabTarget
       }
       claimedCommentResolutionRef.current = null
       commentResolutionLaunchAcceptedRef.current = false
@@ -3166,13 +3195,13 @@ export default function ChecksPanel(): React.JSX.Element {
           { value0: activeReview.provider === 'gitlab' ? 'MR' : 'PR' }
         ),
         // Why: only GitHub with a resolved PR target posts fixing replies; other providers
-        // must not be promised a reply the ack never sends. Review threads get one reply
-        // each, conversation comments share one — so the copy stays deliberately vague.
+        // must not be promised a reply the ack never sends. Resolvable threads are acked by
+        // resolving alone, so the copy leads with that.
         description:
           githubTarget && activeReview.provider === 'github'
             ? translate(
-                'auto.components.right.sidebar.ChecksPanel.ed3f79c031',
-                'Review the prompt before starting an agent. After the prompt is delivered, Orca replies to the selected comments and resolves host threads when possible.'
+                'auto.components.right.sidebar.ChecksPanel.5eb2163b6b',
+                'Review the prompt before starting an agent. After the prompt is delivered, Orca resolves the selected host threads and replies to comments it cannot resolve.'
               )
             : translate(
                 'auto.components.right.sidebar.ChecksPanel.abf59262fb',
@@ -3238,25 +3267,42 @@ export default function ChecksPanel(): React.JSX.Element {
         checksPanelReviewStableKey(asyncResultKeyRef.current) === launchStableKey
       const githubTarget = resolution.githubTarget
       const canReplyOnHost = resolution.provider === 'github' && githubTarget != null
-      // Why: only GitHub posts fixing replies today; a GitLab MR reaching replied=0 is expected, not an error.
-      let lastReplyError =
-        resolution.provider === 'github' && githubTarget == null
+      // Why: only GitHub posts fixing replies today; a GitLab MR reaching replied=0 is expected,
+      // and a missing reply target only matters when something in the selection needs a reply.
+      let lastHostError =
+        resolution.provider === 'github' &&
+        githubTarget == null &&
+        hasPRCommentGroupNeedingReply(resolution.selectedGroups)
           ? translate(
               'auto.components.right.sidebar.ChecksPanel.7e4b2a19c0',
               'Could not resolve the GitHub PR to reply on.'
             )
           : undefined
+      const resolveSnapshottedThread = buildSnapshottedThreadResolver({
+        provider: resolution.provider,
+        githubResolveTarget: resolution.githubResolveTarget,
+        gitlabTarget: resolution.gitlabTarget,
+        resolveReviewThread,
+        resolveGitLabDiscussion: (args) =>
+          resolveGitLabMRDiscussionForChecks({ ...args, settings }),
+        isPanelStillOnLaunchReview,
+        onResolvedOptimistically: (threadId) => {
+          setComments((prev) => markPRCommentThreadResolved(prev, threadId, true))
+        },
+        onResolveFailed: ({ threadId, error }) => {
+          lastHostError =
+            error ||
+            translate(
+              'auto.components.right.sidebar.ChecksPanel.430f1a62d4',
+              'Could not resolve the selected thread on the host.'
+            )
+          console.warn('Post-launch thread resolve failed:', threadId, error)
+        }
+      })
       const counts = await acknowledgePRCommentsAfterAiLaunch({
         groups: resolution.selectedGroups,
         deps: {
-          isStillCurrent: isPanelStillOnLaunchReview,
-          isThreadStillResolvable: (threadId) => {
-            const currentGroup = groupPRComments(commentsRef.current).find(
-              (group) => group.kind === 'thread' && group.threadId === threadId
-            )
-            return Boolean(currentGroup && isResolvablePRCommentGroup(currentGroup))
-          },
-          resolveThread: (threadId) => handleResolve(threadId, true, { notifyOnFailure: false }),
+          resolveThread: resolveSnapshottedThread,
           canReply: canReplyOnHost,
           replyInThread: async (comment, body) => {
             if (!githubTarget || !canPostPRReviewThreadReply(comment)) {
@@ -3297,11 +3343,11 @@ export default function ChecksPanel(): React.JSX.Element {
                 }
                 return true
               }
-              lastReplyError = result.error
+              lastHostError = result.error
               console.warn('In-thread fixing reply failed:', result.error)
               return false
             } catch (err) {
-              lastReplyError = err instanceof Error ? err.message : String(err)
+              lastHostError = err instanceof Error ? err.message : String(err)
               console.warn('Failed to post in-thread fixing reply for review comment:', err)
               return false
             }
@@ -3328,11 +3374,11 @@ export default function ChecksPanel(): React.JSX.Element {
                 }
                 return true
               }
-              lastReplyError = result.error
+              lastHostError = result.error
               console.warn('Conversation fixing reply failed:', result.error)
               return false
             } catch (err) {
-              lastReplyError = err instanceof Error ? err.message : String(err)
+              lastHostError = err instanceof Error ? err.message : String(err)
               console.warn('Failed to post conversation fixing reply for review comment:', err)
               return false
             }
@@ -3345,9 +3391,12 @@ export default function ChecksPanel(): React.JSX.Element {
       }
 
       // Why: surface the underlying API error when replies were possible but none landed.
+      // Resolvable threads are acked by resolving, so replied=0 is correct when nothing needed one.
       const repliedNoneDespiteHostSupport =
-        canReplyOnHost && counts.replied === 0 && resolution.selectedGroups.length > 0
-      if (counts.failed > 0 || repliedNoneDespiteHostSupport || lastReplyError) {
+        canReplyOnHost &&
+        counts.replied === 0 &&
+        hasPRCommentGroupNeedingReply(resolution.selectedGroups)
+      if (counts.failed > 0 || repliedNoneDespiteHostSupport || lastHostError) {
         toast.error(
           translate(
             'auto.components.right.sidebar.ChecksPanel.f273f2271c',
@@ -3357,7 +3406,7 @@ export default function ChecksPanel(): React.JSX.Element {
               value1: counts.replied,
               value2: counts.skipped,
               value3: counts.failed,
-              value4: lastReplyError ? ` ${lastReplyError}` : ''
+              value4: lastHostError ? ` ${lastHostError}` : ''
             }
           )
         )
@@ -3380,8 +3429,9 @@ export default function ChecksPanel(): React.JSX.Element {
       addPRConversationComment,
       addPRReviewCommentReply,
       clearSentCommentSelection,
-      handleResolve,
-      refreshCommentsAfterBulkResolve
+      refreshCommentsAfterBulkResolve,
+      resolveReviewThread,
+      settings
     ]
   )
 
@@ -3734,6 +3784,18 @@ export default function ChecksPanel(): React.JSX.Element {
     [activeReview, activeWorktreeId]
   )
 
+  const handleOpenStackPR = useCallback(
+    (url: string, modifiers: GitHubPRStackMapNavigationModifiers) => {
+      openChecksPanelHostedReviewUrl({
+        url,
+        event: modifiers,
+        isMac: isMacPlatform(),
+        worktreeId: activeWorktreeId
+      })
+    },
+    [activeWorktreeId]
+  )
+
   const handleUnlinkPullRequest = useCallback(() => {
     if (!activeWorktreeId || activeReview?.provider !== 'github' || linkedPR === null) {
       return
@@ -3893,26 +3955,18 @@ export default function ChecksPanel(): React.JSX.Element {
       setRightSidebarOpen(true)
       setRightSidebarTab('checks')
       try {
-        if (activeWorktreeId && result.provider === 'github') {
-          await updateWorktreeMeta(activeWorktreeId, { linkedPR: result.number })
-        }
-        if (activeWorktreeId && result.provider === 'gitlab') {
-          await updateWorktreeMeta(activeWorktreeId, { linkedGitLabMR: result.number })
-        }
-        if (activeWorktreeId && result.provider === 'azure-devops') {
-          await updateWorktreeMeta(activeWorktreeId, { linkedAzureDevOpsPR: result.number })
-        }
-        if (activeWorktreeId && result.provider === 'gitea') {
-          await updateWorktreeMeta(activeWorktreeId, { linkedGiteaPR: result.number })
+        const createdLink = resolveCreatedHostedReviewLink(result.provider, result.number)
+        if (activeWorktreeId && result.provider !== 'unsupported') {
+          await updateWorktreeMeta(activeWorktreeId, createdLink.worktree)
         }
         const linkedReviewNumbers = {
-          linkedGitHubPR: result.provider === 'github' ? result.number : linkedPR,
+          linkedGitHubPR: linkedPR,
           fallbackGitHubPR: fallbackGitHubPRNumber,
-          linkedGitLabMR: result.provider === 'gitlab' ? result.number : linkedGitLabMR,
+          linkedGitLabMR,
           linkedBitbucketPR,
-          linkedAzureDevOpsPR:
-            result.provider === 'azure-devops' ? result.number : linkedAzureDevOpsPR,
-          linkedGiteaPR: result.provider === 'gitea' ? result.number : linkedGiteaPR
+          linkedAzureDevOpsPR,
+          linkedGiteaPR,
+          ...createdLink.lookup
         }
         if (result.provider === 'gitlab') {
           const refreshedReview = await refreshHostedReviewCard(fetchHostedReviewForBranch, {
@@ -3963,121 +4017,86 @@ export default function ChecksPanel(): React.JSX.Element {
     ]
   )
 
-  const handleCreatePullRequest = useCallback(async (): Promise<void> => {
-    if (!repo || !branch || !createComposerOpen || prGenerating || createPrInFlightRef.current) {
-      return
-    }
+  const handleCreatePullRequest = useCallback(
+    async (stacked = false): Promise<void> => {
+      if (!repo || !branch || !createComposerOpen || prGenerating || createPrInFlightRef.current) {
+        return
+      }
 
-    const requestContextKey = panelContextKey
-    const isCurrentCreateRequest = (): boolean =>
-      panelContextKeyRef.current === requestContextKey &&
-      createPrInFlightRef.current === requestContextKey
-    const base = stripBaseRef(prBase).trim()
-    const title = prTitle.trim()
-    const worktreePath = activeWorktreePath ?? repo.path
-    if (!title) {
-      setCreatePrError(
-        translate(
-          'auto.components.right.sidebar.SourceControl.f3a8b2c1d0e5',
-          'Enter a {{value0}} title.',
-          {
-            value0: hostedReviewCreateCopy.reviewLabel
+      const requestContextKey = panelContextKey
+      const isCurrentCreateRequest = (): boolean =>
+        panelContextKeyRef.current === requestContextKey &&
+        createPrInFlightRef.current === requestContextKey
+      const base = stripBaseRef(prBase).trim()
+      const title = prTitle.trim()
+      const worktreePath = activeWorktreePath ?? repo.path
+      if (!title) {
+        setCreatePrError(
+          translate(
+            'auto.components.right.sidebar.SourceControl.f3a8b2c1d0e5',
+            'Enter a {{value0}} title.',
+            {
+              value0: hostedReviewCreateCopy.reviewLabel
+            }
+          )
+        )
+        return
+      }
+      if (!base || stripBaseRef(base).toLowerCase() === stripBaseRef(branch).toLowerCase()) {
+        setCreatePrError(
+          translate(
+            'auto.components.right.sidebar.SourceControl.ae743199cd',
+            'Choose a different base branch before creating a {{value0}}.',
+            { value0: hostedReviewCreateCopy.reviewLabel }
+          )
+        )
+        return
+      }
+
+      createPrInFlightRef.current = requestContextKey
+      setIsCreatingPr(true)
+      setCreatePrError(null)
+      let pushed = false
+      try {
+        const shouldPushBeforeCreate =
+          createPrPushFirst || hostedReviewCreation?.blockedReason === 'needs_push'
+        if (shouldPushBeforeCreate) {
+          const ok = await pushBeforeCreatePullRequest()
+          if (!isCurrentCreateRequest()) {
+            return
           }
-        )
-      )
-      return
-    }
-    if (!base || stripBaseRef(base).toLowerCase() === stripBaseRef(branch).toLowerCase()) {
-      setCreatePrError(
-        translate(
-          'auto.components.right.sidebar.SourceControl.ae743199cd',
-          'Choose a different base branch before creating a {{value0}}.',
-          { value0: hostedReviewCreateCopy.reviewLabel }
-        )
-      )
-      return
-    }
-
-    createPrInFlightRef.current = requestContextKey
-    setIsCreatingPr(true)
-    setCreatePrError(null)
-    let pushed = false
-    try {
-      const shouldPushBeforeCreate =
-        createPrPushFirst || hostedReviewCreation?.blockedReason === 'needs_push'
-      if (shouldPushBeforeCreate) {
-        const ok = await pushBeforeCreatePullRequest()
+          if (!ok) {
+            setCreatePrError('Push failed. Resolve the push error, then try again.')
+            return
+          }
+          pushed = true
+        }
+        const createInput = {
+          repoId: repo.id,
+          provider: hostedReviewCreateProvider,
+          base,
+          head: normalizeHostedReviewHeadRef(branch),
+          title,
+          body: prBody,
+          draft: prDraft && hostedReviewProviderSupportsDraft(hostedReviewCreateProvider),
+          worktreePath,
+          useTemplate: prCreationDefaults.useTemplate
+        }
+        const result = stacked
+          ? await createStackedHostedReview(repo.path, createInput)
+          : await createHostedReview(repo.path, createInput)
         if (!isCurrentCreateRequest()) {
           return
         }
-        if (!ok) {
-          setCreatePrError('Push failed. Resolve the push error, then try again.')
-          return
-        }
-        pushed = true
-      }
-      const result = await createHostedReview(repo.path, {
-        repoId: repo.id,
-        provider: hostedReviewCreateProvider,
-        base,
-        head: normalizeHostedReviewHeadRef(branch),
-        title,
-        body: prBody,
-        draft: prDraft,
-        worktreePath,
-        useTemplate: prCreationDefaults.useTemplate
-      })
-      if (!isCurrentCreateRequest()) {
-        return
-      }
-      if (result.ok) {
-        await handlePullRequestCreated({
-          provider: hostedReviewCreateProvider,
-          number: result.number,
-          url: result.url
-        })
-        if (prCreationDefaults.openAfterCreate) {
-          openHttpLink(result.url, { worktreeId: activeWorktreeId })
-        }
-        if (activePullRequestGenerationKey) {
-          updatePullRequestGenerationRecord(
-            activePullRequestGenerationKey,
-            clearPullRequestGenerationRequiresPushBeforeCreate
-          )
-        }
-        return
-      }
-      if (result.existingReview?.url) {
-        const number = result.existingReview.number
-        toast.success(
-          number
-            ? translate(
-                'auto.components.right.sidebar.ChecksPanel.b6ce28da5b',
-                '{{value0}} #{{value1}} is already open',
-                { value0: hostedReviewCreateCopy.titleLabel, value1: number }
-              )
-            : translate(
-                'auto.components.right.sidebar.ChecksPanel.cf9e69f3be',
-                '{{value0}} is already open',
-                { value0: hostedReviewCreateCopy.titleLabel }
-              ),
-          {
-            action: {
-              label: translate(
-                'auto.components.right.sidebar.ChecksPanel.192e686e57',
-                'Open on {{value0}}',
-                { value0: hostedReviewCreateCopy.providerName }
-              ),
-              onClick: () => window.api.shell.openUrl(result.existingReview!.url)
-            }
-          }
-        )
-        if (number) {
+        if (result.ok) {
           await handlePullRequestCreated({
             provider: hostedReviewCreateProvider,
-            number,
-            url: result.existingReview.url
+            number: result.number,
+            url: result.url
           })
+          if (prCreationDefaults.openAfterCreate) {
+            openHttpLink(result.url, { worktreeId: activeWorktreeId })
+          }
           if (activePullRequestGenerationKey) {
             updatePullRequestGenerationRecord(
               activePullRequestGenerationKey,
@@ -4086,55 +4105,110 @@ export default function ChecksPanel(): React.JSX.Element {
           }
           return
         }
+        if ('existingReview' in result && result.existingReview?.url) {
+          const number = result.existingReview.number
+          toast.success(
+            number
+              ? translate(
+                  'auto.components.right.sidebar.ChecksPanel.b6ce28da5b',
+                  '{{value0}} #{{value1}} is already open',
+                  { value0: hostedReviewCreateCopy.titleLabel, value1: number }
+                )
+              : translate(
+                  'auto.components.right.sidebar.ChecksPanel.cf9e69f3be',
+                  '{{value0}} is already open',
+                  { value0: hostedReviewCreateCopy.titleLabel }
+                ),
+            {
+              action: {
+                label: translate(
+                  'auto.components.right.sidebar.ChecksPanel.192e686e57',
+                  'Open on {{value0}}',
+                  { value0: hostedReviewCreateCopy.providerName }
+                ),
+                onClick: () => window.api.shell.openUrl(result.existingReview!.url)
+              }
+            }
+          )
+          if (number) {
+            await handlePullRequestCreated({
+              provider: hostedReviewCreateProvider,
+              number,
+              url: result.existingReview.url
+            })
+            if (activePullRequestGenerationKey) {
+              updatePullRequestGenerationRecord(
+                activePullRequestGenerationKey,
+                clearPullRequestGenerationRequiresPushBeforeCreate
+              )
+            }
+            return
+          }
+        }
+        // Why: stacked creation can create the pull request and still fail to register
+        // the stack. Link the review that exists before surfacing the stack failure, or
+        // the workspace stays unaware of a PR the user can already see on GitHub.
+        if ('createdReview' in result && result.createdReview?.url) {
+          const { number, url } = result.createdReview
+          if (number) {
+            await handlePullRequestCreated({
+              provider: hostedReviewCreateProvider,
+              number,
+              url
+            })
+          }
+        }
+        setCreatePrError(formatCreateError(result, pushed, hostedReviewCreateCopy.shortLabel))
+      } catch (error) {
+        if (!isCurrentCreateRequest()) {
+          return
+        }
+        setCreatePrError(
+          error instanceof Error
+            ? error.message
+            : translate(
+                'auto.components.right.sidebar.SourceControl.e2b7a1c0d9f4',
+                'Failed to create {{value0}}',
+                { value0: hostedReviewCreateCopy.reviewLabel }
+              )
+        )
+      } finally {
+        if (createPrInFlightRef.current === requestContextKey) {
+          createPrInFlightRef.current = null
+          setIsCreatingPr(false)
+          setGitStatusRefreshNonce((value) => value + 1)
+        }
       }
-      setCreatePrError(formatCreateError(result, pushed, hostedReviewCreateCopy.shortLabel))
-    } catch (error) {
-      if (!isCurrentCreateRequest()) {
-        return
-      }
-      setCreatePrError(
-        error instanceof Error
-          ? error.message
-          : translate(
-              'auto.components.right.sidebar.SourceControl.e2b7a1c0d9f4',
-              'Failed to create {{value0}}',
-              { value0: hostedReviewCreateCopy.reviewLabel }
-            )
-      )
-    } finally {
-      if (createPrInFlightRef.current === requestContextKey) {
-        createPrInFlightRef.current = null
-        setIsCreatingPr(false)
-        setGitStatusRefreshNonce((value) => value + 1)
-      }
-    }
-  }, [
-    activeWorktreePath,
-    activeWorktreeId,
-    activePullRequestGenerationKey,
-    branch,
-    createComposerOpen,
-    createHostedReview,
-    createPrPushFirst,
-    handlePullRequestCreated,
-    hostedReviewCreateCopy.providerName,
-    hostedReviewCreateCopy.reviewLabel,
-    hostedReviewCreateCopy.shortLabel,
-    hostedReviewCreateCopy.titleLabel,
-    hostedReviewCreateProvider,
-    hostedReviewCreation?.blockedReason,
-    panelContextKey,
-    prBase,
-    prBody,
-    prCreationDefaults.openAfterCreate,
-    prCreationDefaults.useTemplate,
-    prDraft,
-    prGenerating,
-    prTitle,
-    pushBeforeCreatePullRequest,
-    repo,
-    updatePullRequestGenerationRecord
-  ])
+    },
+    [
+      activeWorktreePath,
+      activeWorktreeId,
+      activePullRequestGenerationKey,
+      branch,
+      createComposerOpen,
+      createHostedReview,
+      createStackedHostedReview,
+      createPrPushFirst,
+      handlePullRequestCreated,
+      hostedReviewCreateCopy.providerName,
+      hostedReviewCreateCopy.reviewLabel,
+      hostedReviewCreateCopy.shortLabel,
+      hostedReviewCreateCopy.titleLabel,
+      hostedReviewCreateProvider,
+      hostedReviewCreation?.blockedReason,
+      panelContextKey,
+      prBase,
+      prBody,
+      prCreationDefaults.openAfterCreate,
+      prCreationDefaults.useTemplate,
+      prDraft,
+      prGenerating,
+      prTitle,
+      pushBeforeCreatePullRequest,
+      repo,
+      updatePullRequestGenerationRecord
+    ]
+  )
 
   // ── Empty state ──
   if (!activeWorktree) {
@@ -4276,10 +4350,12 @@ export default function ChecksPanel(): React.JSX.Element {
         {!operationInProgress && createComposerOpen ? (
           <div className="mt-4 border-t border-border pt-3">
             <CreateHostedReviewComposer
+              key={panelContextKey}
               className="p-0"
               provider={hostedReviewCreateProvider}
               branch={branch}
               base={prBase}
+              repoDefaultBase={prRepoDefaultBaseRef}
               setBase={handlePrBaseChange}
               title={prTitle}
               setTitle={handlePrTitleChange}
@@ -4287,10 +4363,13 @@ export default function ChecksPanel(): React.JSX.Element {
               setBody={setPrBody}
               draft={prDraft}
               setDraft={setPrDraft}
+              stackedCreationSupported={prStackedCreationSupported}
+              stackParentReview={stackParentReview}
               baseQuery={prBaseQuery}
               setBaseQuery={setPrBaseQuery}
               baseResults={prBaseResults}
               setBaseResults={setPrBaseResults}
+              baseSearchPending={prBaseSearchPending}
               baseSearchError={prBaseSearchError}
               aiGenerationEnabled={sourceControlAiActionsVisible && prAiGenerationEnabled}
               generating={prGenerating}
@@ -4316,7 +4395,7 @@ export default function ChecksPanel(): React.JSX.Element {
               }}
               onGenerate={() => void handleGeneratePullRequestFields()}
               onCancelGenerate={handleCancelGeneratePullRequestFields}
-              onPrimaryAction={() => void handleCreatePullRequest()}
+              onPrimaryAction={(stacked) => void handleCreatePullRequest(stacked)}
             />
           </div>
         ) : null}
@@ -4437,6 +4516,14 @@ export default function ChecksPanel(): React.JSX.Element {
 
         {detachedHeadDisplay && <DetachedHeadBadge display={detachedHeadDisplay} side="bottom" />}
 
+        {activeReview.provider === 'github' && pr?.stack ? (
+          <GitHubPRStackMap
+            stack={pr.stack}
+            currentPRNumber={pr.number}
+            onOpenPullRequest={handleOpenStackPR}
+          />
+        ) : null}
+
         {/* Review title */}
         {editingTitle ? (
           <div className="flex items-center gap-1">
@@ -4532,6 +4619,7 @@ export default function ChecksPanel(): React.JSX.Element {
           checksLoading={checksLoading}
           checkDetailsContextKey={stateRequestKey}
           onLoadCheckDetails={handleLoadCheckDetails}
+          githubRepository={pr?.prRepo ?? null}
           getGitLabProjectRef={getGitLabProjectRef}
         />
       )}
diff --git a/src/renderer/src/components/right-sidebar/CreateHostedReviewBasePicker.tsx b/src/renderer/src/components/right-sidebar/CreateHostedReviewBasePicker.tsx
new file mode 100644
index 00000000000..3f1cc1d37a2
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/CreateHostedReviewBasePicker.tsx
@@ -0,0 +1,292 @@
+import { Check, ChevronDown } from 'lucide-react'
+import { useId, useRef, useState } from 'react'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+import type { LocalizedHostedReviewCopy } from '@/i18n/hosted-review-localized-copy'
+import { COMPOSER_FIELD_CLASS } from './create-hosted-review-composer-field-class'
+import { CreateHostedReviewComposerMessage } from './CreateHostedReviewComposerMessage'
+import { stripBaseRef } from './useCreatePullRequestDialogFields'
+
+type CreateHostedReviewBasePickerProps = {
+  copy: LocalizedHostedReviewCopy
+  base: string
+  setBase: (value: string) => void
+  /** The repo's default branch, where an emptied field lands. Null until resolved. */
+  repoDefaultBase: string | null
+  editing: boolean
+  setEditing: (value: boolean) => void
+  baseQuery: string
+  setBaseQuery: (value: string) => void
+  baseResults: string[]
+  setBaseResults: (value: string[]) => void
+  baseSearchPending: boolean
+  baseSearchError: string | null
+  fieldsLocked: boolean
+  strippedBranch: string
+  baseSameAsBranch: boolean
+}
+
+/**
+ * The composer's merge target: a labelled full-width combobox whose results stay
+ * attached to it, plus the base-scoped errors.
+ */
+export function CreateHostedReviewBasePicker({
+  copy,
+  base,
+  setBase,
+  repoDefaultBase,
+  editing,
+  setEditing,
+  baseQuery,
+  setBaseQuery,
+  baseResults,
+  setBaseResults,
+  baseSearchPending,
+  baseSearchError,
+  fieldsLocked,
+  strippedBranch,
+  baseSameAsBranch
+}: CreateHostedReviewBasePickerProps): React.JSX.Element {
+  const [activeResult, setActiveResult] = useState(-1)
+  const inputRef = useRef<HTMLInputElement>(null)
+  // Why: marks a blur that an explicit Enter/Escape already resolved.
+  const settledRef = useRef(false)
+  const fieldId = useId()
+  const resultsId = useId()
+
+  const trimmedQuery = baseQuery.trim()
+  const trimmedRepoDefault = repoDefaultBase?.trim() ?? ''
+  const showResults = editing && baseResults.length > 0
+  // Why: emptying the field is how you say "not this branch"; name where it lands so
+  // the reset isn't an invisible behaviour.
+  const showRepoDefaultHint = editing && trimmedQuery.length === 0 && trimmedRepoDefault.length > 0
+  // Why: only claim "no branches match" once a search has actually settled, so the
+  // debounce window can't report an absence the app hasn't observed yet.
+  const showNoResults =
+    editing &&
+    baseResults.length === 0 &&
+    trimmedQuery.length >= 2 &&
+    !baseSearchPending &&
+    !baseSearchError
+
+  const closeSearch = (): void => {
+    setEditing(false)
+    setBaseQuery('')
+    setBaseResults([])
+    setActiveResult(-1)
+  }
+
+  const commitSearch = (value: string): void => {
+    // Why: an emptied field commits the repo default rather than silently restoring
+    // the branch the user just cleared. With no default resolved yet there is nothing
+    // honest to fall back to, so the committed base stands.
+    const nextBase = value.trim() || trimmedRepoDefault
+    if (nextBase) {
+      setBase(nextBase)
+    }
+    settledRef.current = true
+    closeSearch()
+    inputRef.current?.blur()
+  }
+
+  const cancelSearch = (): void => {
+    settledRef.current = true
+    closeSearch()
+    inputRef.current?.blur()
+  }
+
+  const handleBlur = (): void => {
+    // Why: Enter and Escape blur the input themselves; without this they would
+    // re-enter the commit path below with the pre-close query still in scope.
+    if (settledRef.current) {
+      settledRef.current = false
+      closeSearch()
+      return
+    }
+    // Why: clicking away from an emptied field means what pressing Enter on it
+    // means — land on the repo default instead of restoring what was cleared.
+    // A partial query still cancels; only an empty one is an instruction.
+    if (trimmedQuery.length === 0 && trimmedRepoDefault) {
+      setBase(trimmedRepoDefault)
+    }
+    closeSearch()
+  }
+
+  const moveActiveResult = (delta: number): void => {
+    if (baseResults.length === 0) {
+      return
+    }
+    setActiveResult((current) => {
+      const next = current + delta
+      if (next < 0) {
+        return baseResults.length - 1
+      }
+      return next >= baseResults.length ? 0 : next
+    })
+  }
+
+  const handleKeyDown = (event: React.KeyboardEvent<HTMLInputElement>): void => {
+    if (event.key === 'ArrowDown' || event.key === 'ArrowUp') {
+      event.preventDefault()
+      moveActiveResult(event.key === 'ArrowDown' ? 1 : -1)
+      return
+    }
+    if (event.key === 'Enter') {
+      event.preventDefault()
+      commitSearch(baseResults[activeResult] ?? baseQuery)
+      return
+    }
+    if (event.key === 'Escape') {
+      event.preventDefault()
+      cancelSearch()
+    }
+  }
+
+  return (
+    // Why: the base owns the full sidebar width — branch names are long — and the
+    // head branch rides the label row instead of costing another line.
+    <div className="space-y-1.5">
+      <div className="flex min-w-0 items-baseline justify-between gap-2">
+        {/* Why: the label holds its line and the head branch absorbs the squeeze —
+            a wrapping two-word label next to a one-line ref reads as broken. */}
+        <Label
+          htmlFor={fieldId}
+          className="shrink-0 whitespace-nowrap text-[11px] font-medium text-muted-foreground"
+        >
+          {translate(
+            'auto.components.right.sidebar.CreateHostedReviewBasePicker.205ef284fa',
+            'Base branch'
+          )}
+        </Label>
+        <span className="min-w-0 truncate text-[11px] text-muted-foreground" title={strippedBranch}>
+          {translate(
+            'auto.components.right.sidebar.CreateHostedReviewBasePicker.bb4b41d563',
+            'from {{value0}}',
+            { value0: strippedBranch }
+          )}
+        </span>
+      </div>
+
+      <div className="relative">
+        <Input
+          id={fieldId}
+          ref={inputRef}
+          aria-label={translate(
+            'auto.components.right.sidebar.SourceControl.6055949c50',
+            '{{value0}} base branch',
+            { value0: copy.titleLabel }
+          )}
+          role="combobox"
+          aria-autocomplete="list"
+          aria-expanded={showResults}
+          // Why: the listbox only exists while results show, and an aria-controls
+          // IDREF that resolves to nothing is worse than no reference at all.
+          aria-controls={showResults ? resultsId : undefined}
+          aria-activedescendant={
+            showResults && activeResult >= 0 ? `${resultsId}-${activeResult}` : undefined
+          }
+          aria-invalid={baseSameAsBranch || undefined}
+          // Why: an input can't ellipsize, and base refs routinely overflow the sidebar.
+          title={editing ? undefined : base}
+          value={editing ? baseQuery : base}
+          disabled={fieldsLocked}
+          onFocus={(event) => {
+            // Why: a programmatic blur that never fired would otherwise leave the
+            // flag set and swallow the next real one.
+            settledRef.current = false
+            setEditing(true)
+            setBaseQuery(event.currentTarget.value)
+          }}
+          onBlur={handleBlur}
+          onChange={(event) => {
+            setBaseQuery(event.target.value)
+            setActiveResult(-1)
+          }}
+          onKeyDown={handleKeyDown}
+          // Why: the placeholder is where an emptied field lands, so it has to be the
+          // repo's real default — a hardcoded "main" lies on a trunk-named repo.
+          placeholder={
+            trimmedRepoDefault ||
+            translate('auto.components.right.sidebar.SourceControl.e64a632456', 'main')
+          }
+          className={cn(COMPOSER_FIELD_CLASS, 'pl-2 pr-7')}
+        />
+        <ChevronDown
+          className="pointer-events-none absolute right-2 top-1/2 size-3.5 -translate-y-1/2 text-muted-foreground"
+          aria-hidden="true"
+        />
+      </div>
+
+      {showResults ? (
+        <div
+          id={resultsId}
+          role="listbox"
+          className="max-h-40 overflow-auto rounded-md border border-input bg-popover p-1 shadow-xs scrollbar-sleek"
+        >
+          {baseResults.map((ref, index) => {
+            const selected = stripBaseRef(base) === ref
+            return (
+              <button
+                key={ref}
+                id={`${resultsId}-${index}`}
+                type="button"
+                role="option"
+                aria-selected={selected}
+                data-selected={index === activeResult ? 'true' : undefined}
+                disabled={fieldsLocked}
+                className={cn(
+                  'flex h-7 w-full items-center justify-between gap-2 rounded-sm px-2 text-left text-xs hover:bg-accent hover:text-accent-foreground data-[selected=true]:bg-accent data-[selected=true]:text-accent-foreground disabled:cursor-not-allowed disabled:opacity-50 disabled:hover:bg-transparent',
+                  selected && 'text-foreground'
+                )}
+                onMouseDown={(event) => {
+                  event.preventDefault()
+                  commitSearch(ref)
+                }}
+              >
+                <span className="truncate">{ref}</span>
+                {selected ? <Check className="size-3 shrink-0" aria-hidden="true" /> : null}
+              </button>
+            )
+          })}
+        </div>
+      ) : null}
+
+      {showRepoDefaultHint ? (
+        <p className="px-2 text-[11px] text-muted-foreground">
+          {translate(
+            'auto.components.right.sidebar.CreateHostedReviewBasePicker.da4d57c9c2',
+            'Leave empty to use {{value0}}.',
+            { value0: trimmedRepoDefault }
+          )}
+        </p>
+      ) : null}
+
+      {showNoResults ? (
+        <p className="px-2 text-[11px] text-muted-foreground">
+          {translate(
+            'auto.components.right.sidebar.CreateHostedReviewBasePicker.5a9315b61a',
+            'No branches match “{{value0}}”. Press Enter to use it anyway.',
+            { value0: trimmedQuery }
+          )}
+        </p>
+      ) : null}
+
+      {/* Why: base problems belong to the base field, not to the block of
+          operation errors above the submit button. */}
+      {baseSameAsBranch ? (
+        <CreateHostedReviewComposerMessage>
+          {translate(
+            'auto.components.right.sidebar.SourceControl.ae743199cd',
+            'Choose a different base branch before creating a {{value0}}.',
+            { value0: copy.reviewLabel }
+          )}
+        </CreateHostedReviewComposerMessage>
+      ) : null}
+      {baseSearchError ? (
+        <CreateHostedReviewComposerMessage>{baseSearchError}</CreateHostedReviewComposerMessage>
+      ) : null}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/right-sidebar/CreateHostedReviewComposer.tsx b/src/renderer/src/components/right-sidebar/CreateHostedReviewComposer.tsx
index 7caf09dd128..7876e8dca25 100644
--- a/src/renderer/src/components/right-sidebar/CreateHostedReviewComposer.tsx
+++ b/src/renderer/src/components/right-sidebar/CreateHostedReviewComposer.tsx
@@ -1,3 +1,4 @@
+import { useState } from 'react'
 import {
   ChevronDown,
   GitMerge,
@@ -21,10 +22,15 @@ import {
   resolveSupportedHostedReviewCopyProvider
 } from '@/i18n/hosted-review-localized-copy'
 import { translate } from '@/i18n/i18n'
-import type { HostedReviewProvider } from '../../../../shared/hosted-review'
+import {
+  hostedReviewProviderSupportsDraft,
+  type HostedReviewProvider
+} from '../../../../shared/hosted-review'
 import { stripBaseRef } from './useCreatePullRequestDialogFields'
+import type { HostedReviewStackParent } from './useHostedReviewStackParent'
 import type { DropdownActionKind, DropdownEntry } from './source-control-dropdown-items'
 import { CreateHostedReviewComposerFields } from './CreateHostedReviewComposerFields'
+import { getCreateButtonLabel } from './create-hosted-review-button-label'
 import {
   RIGHT_SIDEBAR_MORPHING_PRIMARY_BUTTON_CLASS,
   RIGHT_SIDEBAR_PRIMARY_BUTTON_LABEL_CLASS,
@@ -44,16 +50,20 @@ export type CreateHostedReviewComposerProps = {
   branch: string
   base: string
   setBase: (value: string) => void
+  repoDefaultBase: string | null
   title: string
   setTitle: (value: string) => void
   body: string
   setBody: (value: string) => void
   draft: boolean
   setDraft: (value: boolean) => void
+  stackedCreationSupported: boolean
+  stackParentReview: HostedReviewStackParent | null
   baseQuery: string
   setBaseQuery: (value: string) => void
   baseResults: string[]
   setBaseResults: (value: string[]) => void
+  baseSearchPending: boolean
   baseSearchError: string | null
   aiGenerationEnabled: boolean
   generating: boolean
@@ -67,7 +77,7 @@ export type CreateHostedReviewComposerProps = {
   dropdownItems?: DropdownEntry[]
   onGenerate: () => void
   onCancelGenerate: () => void
-  onPrimaryAction: () => void
+  onPrimaryAction: (stacked: boolean) => void
   onDropdownAction?: (kind: DropdownActionKind) => void
 }
 
@@ -77,16 +87,20 @@ export function CreateHostedReviewComposer({
   branch,
   base,
   setBase,
+  repoDefaultBase,
   title,
   setTitle,
   body,
   setBody,
   draft,
   setDraft,
+  stackedCreationSupported,
+  stackParentReview,
   baseQuery,
   setBaseQuery,
   baseResults,
   setBaseResults,
+  baseSearchPending,
   baseSearchError,
   aiGenerationEnabled,
   generating,
@@ -104,8 +118,24 @@ export function CreateHostedReviewComposer({
   onDropdownAction
 }: CreateHostedReviewComposerProps): React.JSX.Element {
   const copy = localizedHostedReviewCopy(resolveSupportedHostedReviewCopyProvider(provider))
+  // Providers without draft reviews must not carry a stale draft flag into submit.
+  const supportsDraft = hostedReviewProviderSupportsDraft(provider)
+  const effectiveDraft = supportsDraft && draft
   const ReviewIcon = provider === 'gitlab' ? GitMerge : GitPullRequestArrow
+  const stackedModeAvailable = provider === 'github' && stackedCreationSupported
   const normalizedBase = stripBaseRef(base)
+  const stackSelectionKey = stackParentReview
+    ? `${normalizedBase}:${stackParentReview.number}`
+    : null
+  const [stackSelection, setStackSelection] = useState({ key: '', enabled: false })
+  const effectiveStacked =
+    stackedModeAvailable &&
+    stackSelectionKey !== null &&
+    stackSelection.key === stackSelectionKey &&
+    stackSelection.enabled
+  const setStacked = (enabled: boolean): void => {
+    setStackSelection({ key: stackSelectionKey ?? '', enabled })
+  }
   const strippedBranch = stripBaseRef(branch)
   const baseSameAsBranch = normalizedBase.toLowerCase() === strippedBranch.toLowerCase()
   const createDisabled =
@@ -191,7 +221,9 @@ export function CreateHostedReviewComposer({
 
   return (
     <div className={cn('px-3 pb-2', className)}>
-      <div className="space-y-2.5">
+      {/* Why: one gap between groups, tighter gaps inside them — the form reads as
+          content → merge target → options → action instead of a stack of boxes. */}
+      <div className="space-y-3">
         <div className="flex min-w-0 items-center justify-between gap-2">
           <div className="flex min-w-0 items-center gap-1.5 text-xs">
             <ReviewIcon className="size-3.5 shrink-0 text-muted-foreground" aria-hidden="true" />
@@ -223,16 +255,22 @@ export function CreateHostedReviewComposer({
           copy={copy}
           base={base}
           setBase={setBase}
+          repoDefaultBase={repoDefaultBase}
           title={title}
           setTitle={setTitle}
           body={body}
           setBody={setBody}
           draft={draft}
           setDraft={setDraft}
+          supportsDraft={supportsDraft}
+          stacked={effectiveStacked}
+          setStacked={setStacked}
+          stackParentReview={stackedModeAvailable ? stackParentReview : null}
           baseQuery={baseQuery}
           setBaseQuery={setBaseQuery}
           baseResults={baseResults}
           setBaseResults={setBaseResults}
+          baseSearchPending={baseSearchPending}
           baseSearchError={baseSearchError}
           generateError={generateError}
           createError={createError}
@@ -243,14 +281,14 @@ export function CreateHostedReviewComposer({
           baseSameAsBranch={baseSameAsBranch}
         />
 
-        <div className={cn(RIGHT_SIDEBAR_SPLIT_ACTION_ROW_CLASS, 'pt-0.5')}>
+        <div className={RIGHT_SIDEBAR_SPLIT_ACTION_ROW_CLASS}>
           <Button
             type="button"
             size="xs"
             disabled={createDisabled}
-            onClick={() => onPrimaryAction()}
+            onClick={() => onPrimaryAction(effectiveStacked)}
             className={cn(
-              'h-7 px-3 text-xs',
+              'h-8 px-3 text-xs',
               showDropdown && 'rounded-r-none',
               RIGHT_SIDEBAR_MORPHING_PRIMARY_BUTTON_CLASS
             )}
@@ -265,7 +303,8 @@ export function CreateHostedReviewComposer({
               {getCreateButtonLabel({
                 isCreating,
                 pushBeforeCreate,
-                draft,
+                draft: effectiveDraft,
+                stacked: effectiveStacked,
                 shortLabel: copy.shortLabel
               })}
             </span>
@@ -277,7 +316,7 @@ export function CreateHostedReviewComposer({
                   type="button"
                   size="xs"
                   className={cn(
-                    'h-7 rounded-l-none border-l border-primary-foreground/20 px-1.5 shrink-0',
+                    'h-8 rounded-l-none border-l border-primary-foreground/20 px-1.5 shrink-0',
                     createDisabled && 'opacity-50'
                   )}
                   aria-label={translate(
@@ -330,36 +369,3 @@ export function CreateHostedReviewComposer({
     </div>
   )
 }
-
-function getCreateButtonLabel({
-  isCreating,
-  pushBeforeCreate,
-  draft,
-  shortLabel
-}: {
-  isCreating: boolean
-  pushBeforeCreate: boolean
-  draft: boolean
-  shortLabel: string
-}): string {
-  if (isCreating) {
-    return translate('auto.components.right.sidebar.SourceControl.26511c22b4', 'Creating...')
-  }
-  if (pushBeforeCreate) {
-    return translate(
-      'auto.components.right.sidebar.CreateHostedReviewComposer.741ff8a0d2',
-      'Push & Create {{value0}}',
-      { value0: shortLabel }
-    )
-  }
-  if (draft) {
-    return translate(
-      'auto.components.right.sidebar.SourceControl.aaf1451654',
-      'Create draft {{value0}}',
-      { value0: shortLabel }
-    )
-  }
-  return translate('auto.components.right.sidebar.SourceControl.5acbcedc1a', 'Create {{value0}}', {
-    value0: shortLabel
-  })
-}
diff --git a/src/renderer/src/components/right-sidebar/CreateHostedReviewComposerFields.tsx b/src/renderer/src/components/right-sidebar/CreateHostedReviewComposerFields.tsx
index 68591818ec1..4a579fe140c 100644
--- a/src/renderer/src/components/right-sidebar/CreateHostedReviewComposerFields.tsx
+++ b/src/renderer/src/components/right-sidebar/CreateHostedReviewComposerFields.tsx
@@ -1,23 +1,40 @@
-import { ArrowDownUp, Check, ChevronDown, Sparkles, TriangleAlert } from 'lucide-react'
+import { CornerDownRight, GitPullRequestArrow, Sparkles } from 'lucide-react'
+import { useId, useState } from 'react'
+import { Checkbox } from '@/components/ui/checkbox'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
 import { cn } from '@/lib/utils'
 import { translate } from '@/i18n/i18n'
 import type { LocalizedHostedReviewCopy } from '@/i18n/hosted-review-localized-copy'
-import { stripBaseRef } from './useCreatePullRequestDialogFields'
+import { CreateHostedReviewBasePicker } from './CreateHostedReviewBasePicker'
+import { CreateHostedReviewComposerMessage } from './CreateHostedReviewComposerMessage'
+import {
+  COMPOSER_CHECKBOX_CLASS,
+  COMPOSER_FIELD_CLASS,
+  COMPOSER_TEXTAREA_CLASS
+} from './create-hosted-review-composer-field-class'
+import type { HostedReviewStackParent } from './useHostedReviewStackParent'
 
 type CreateHostedReviewComposerFieldsProps = {
   copy: LocalizedHostedReviewCopy
   base: string
   setBase: (value: string) => void
+  repoDefaultBase: string | null
   title: string
   setTitle: (value: string) => void
   body: string
   setBody: (value: string) => void
   draft: boolean
   setDraft: (value: boolean) => void
+  supportsDraft: boolean
+  stacked: boolean
+  setStacked: (value: boolean) => void
+  stackParentReview: HostedReviewStackParent | null
   baseQuery: string
   setBaseQuery: (value: string) => void
   baseResults: string[]
   setBaseResults: (value: string[]) => void
+  baseSearchPending: boolean
   baseSearchError: string | null
   generateError: string | null
   createError: string | null
@@ -32,16 +49,22 @@ export function CreateHostedReviewComposerFields({
   copy,
   base,
   setBase,
+  repoDefaultBase,
   title,
   setTitle,
   body,
   setBody,
   draft,
   setDraft,
+  supportsDraft,
+  stacked,
+  setStacked,
+  stackParentReview,
   baseQuery,
   setBaseQuery,
   baseResults,
   setBaseResults,
+  baseSearchPending,
   baseSearchError,
   generateError,
   createError,
@@ -51,32 +74,16 @@ export function CreateHostedReviewComposerFields({
   strippedBranch,
   baseSameAsBranch
 }: CreateHostedReviewComposerFieldsProps): React.JSX.Element {
+  // Why: owned here, not in the picker — the stack option steps aside while the
+  // base list is open so results never overlap an option about that same base.
+  const [baseEditing, setBaseEditing] = useState(false)
+  const draftFieldId = useId()
+  const stackFieldId = useId()
+
   return (
     <>
-      {/* Why: a single line that shows the head->base flow plain-language so
-          the user can sanity-check the merge direction at a glance. */}
-      <div className="flex min-w-0 items-center gap-1.5 text-[11px] text-muted-foreground">
-        <span className="truncate font-mono text-foreground" title={strippedBranch}>
-          {strippedBranch}
-        </span>
-        <ArrowDownUp className="size-3 rotate-90 shrink-0 opacity-60" aria-hidden="true" />
-        <span
-          className={cn(
-            'truncate font-mono',
-            baseSameAsBranch ? 'text-destructive' : 'text-foreground'
-          )}
-          title={
-            normalizedBase ||
-            translate('auto.components.right.sidebar.SourceControl.7a09d7f9d2', 'base')
-          }
-        >
-          {normalizedBase ||
-            translate('auto.components.right.sidebar.SourceControl.7a09d7f9d2', 'base')}
-        </span>
-      </div>
-
-      <div className="relative space-y-2">
-        <input
+      <div className="relative space-y-1.5">
+        <Input
           aria-label={translate(
             'auto.components.right.sidebar.SourceControl.a6eda33521',
             '{{value0}} title',
@@ -86,7 +93,7 @@ export function CreateHostedReviewComposerFields({
           disabled={fieldsLocked}
           onChange={(event) => setTitle(event.target.value)}
           placeholder={translate('auto.components.right.sidebar.SourceControl.7d6a8f0082', 'Title')}
-          className="h-8 w-full min-w-0 rounded-md border border-border bg-background px-2 text-xs font-medium text-foreground outline-none placeholder:text-muted-foreground/70 focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-60"
+          className={cn(COMPOSER_FIELD_CLASS, 'px-2 font-medium')}
         />
 
         <textarea
@@ -103,7 +110,7 @@ export function CreateHostedReviewComposerFields({
             'auto.components.right.sidebar.SourceControl.a0dc20fc93',
             'Description (optional)'
           )}
-          className="min-h-[7.5rem] w-full resize-y rounded-md border border-border bg-background px-2 py-1.5 text-xs text-foreground outline-none placeholder:text-muted-foreground/70 focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-60 scrollbar-sleek"
+          className={cn(COMPOSER_TEXTAREA_CLASS, 'min-h-[7rem] resize-y scrollbar-sleek')}
         />
 
         {generating ? (
@@ -113,7 +120,7 @@ export function CreateHostedReviewComposerFields({
             className="pointer-events-none absolute inset-0 flex items-center justify-center rounded-md bg-background/40"
             aria-hidden="true"
           >
-            <div className="pointer-events-auto flex items-center gap-1.5 rounded-md border border-border bg-background px-2 py-1 text-[11px] text-muted-foreground shadow-sm">
+            <div className="pointer-events-auto flex items-center gap-1.5 rounded-md border border-border bg-background px-2 py-1 text-[11px] text-muted-foreground shadow-xs">
               <Sparkles className="size-3 animate-pulse text-foreground" />
               <span>
                 {translate(
@@ -126,143 +133,120 @@ export function CreateHostedReviewComposerFields({
         ) : null}
       </div>
 
-      {/* Why: base picker as its own labeled row so the title input can use
-          the full width. The dropdown chevron makes the picker affordance
-          obvious; the inline label clarifies that this is the merge target. */}
-      <div className="flex items-center gap-2">
-        <span className="shrink-0 text-[11px] text-muted-foreground">
-          {translate('auto.components.right.sidebar.SourceControl.1f7119f604', 'Base')}
-        </span>
-        <div className="relative min-w-0 flex-1">
-          <input
-            aria-label={translate(
-              'auto.components.right.sidebar.SourceControl.6055949c50',
-              '{{value0}} base branch',
-              { value0: copy.titleLabel }
-            )}
-            value={baseQuery || base}
-            disabled={fieldsLocked}
-            onChange={(event) => {
-              setBaseQuery(event.target.value)
-              setBase(event.target.value)
-            }}
-            placeholder={translate(
-              'auto.components.right.sidebar.SourceControl.e64a632456',
-              'main'
-            )}
-            className="h-7 w-full min-w-0 rounded-md border border-border bg-background px-2 pr-6 font-mono text-xs text-foreground outline-none placeholder:text-muted-foreground/70 focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-60"
-          />
-          <ChevronDown
-            className="pointer-events-none absolute right-1.5 top-1.5 size-3.5 text-muted-foreground"
-            aria-hidden="true"
-          />
-        </div>
+      <CreateHostedReviewBasePicker
+        copy={copy}
+        base={base}
+        setBase={setBase}
+        repoDefaultBase={repoDefaultBase}
+        editing={baseEditing}
+        setEditing={setBaseEditing}
+        baseQuery={baseQuery}
+        setBaseQuery={setBaseQuery}
+        baseResults={baseResults}
+        setBaseResults={setBaseResults}
+        baseSearchPending={baseSearchPending}
+        baseSearchError={baseSearchError}
+        fieldsLocked={fieldsLocked}
+        strippedBranch={strippedBranch}
+        baseSameAsBranch={baseSameAsBranch}
+      />
+
+      <div className="space-y-2.5">
+        {stackParentReview && !baseEditing ? (
+          <div className="space-y-1.5">
+            <div className="flex items-start gap-2">
+              <Checkbox
+                id={stackFieldId}
+                checked={stacked}
+                disabled={fieldsLocked}
+                onCheckedChange={(value) => setStacked(value === true)}
+                className={cn(COMPOSER_CHECKBOX_CLASS, 'mt-px')}
+              />
+              {/* Why: the base field one row up already names the parent branch, so the
+                  helper explains the effect instead of repeating the ref. */}
+              <Label
+                htmlFor={stackFieldId}
+                className="min-w-0 flex-1 flex-col items-start gap-0.5 text-xs leading-snug"
+              >
+                <span className="text-foreground">
+                  {translate(
+                    'auto.components.right.sidebar.CreateHostedReviewComposerFields.90cabf6cfc',
+                    'Stack this PR above #{{value0}}',
+                    { value0: stackParentReview.number }
+                  )}
+                </span>
+                {stacked ? null : (
+                  <span className="text-[11px] font-normal text-muted-foreground">
+                    {translate(
+                      'auto.components.right.sidebar.CreateHostedReviewComposerFields.ff81473a57',
+                      "Creates a GitHub Stack or extends the parent's existing stack."
+                    )}
+                  </span>
+                )}
+              </Label>
+            </div>
+
+            {stacked ? (
+              // Why: a single hairline instead of a nested card — the relation reads as
+              // detail of the checkbox above it, not as its own framed section.
+              <div className="ml-6 space-y-1 border-l border-border pl-2 text-[11px]">
+                <div className="flex min-w-0 items-center gap-1.5">
+                  <GitPullRequestArrow
+                    className="size-3 shrink-0 text-muted-foreground"
+                    aria-hidden="true"
+                  />
+                  <span className="shrink-0 text-muted-foreground">
+                    #{stackParentReview.number}
+                  </span>
+                  <span className="truncate text-foreground">{normalizedBase}</span>
+                </div>
+                <div className="flex min-w-0 items-center gap-1.5">
+                  <CornerDownRight
+                    className="size-3 shrink-0 text-muted-foreground"
+                    aria-hidden="true"
+                  />
+                  <span className="truncate text-foreground">{strippedBranch}</span>
+                  <span className="shrink-0 text-muted-foreground">
+                    {translate(
+                      'auto.components.right.sidebar.CreateHostedReviewComposerFields.29732f2fb0',
+                      'new PR'
+                    )}
+                  </span>
+                </div>
+              </div>
+            ) : null}
+          </div>
+        ) : null}
+
+        {supportsDraft ? (
+          <div className="flex items-center gap-2">
+            <Checkbox
+              id={draftFieldId}
+              checked={draft}
+              disabled={fieldsLocked}
+              onCheckedChange={(value) => setDraft(value === true)}
+              className={COMPOSER_CHECKBOX_CLASS}
+            />
+            <Label htmlFor={draftFieldId} className="min-w-0 flex-1 truncate text-xs">
+              {translate(
+                'auto.components.right.sidebar.SourceControl.78ddfd0bb4',
+                'Create as draft'
+              )}
+            </Label>
+          </div>
+        ) : null}
       </div>
 
-      <label
-        className={cn(
-          'flex h-7 items-center gap-2 rounded-md border border-border bg-background px-2 text-xs text-foreground transition-colors',
-          fieldsLocked
-            ? 'cursor-not-allowed opacity-60'
-            : 'cursor-pointer hover:bg-accent hover:text-accent-foreground'
-        )}
-      >
-        <input
-          type="checkbox"
-          checked={draft}
-          disabled={fieldsLocked}
-          onChange={(event) => setDraft(event.target.checked)}
-          className="size-3.5 shrink-0 rounded border-border accent-primary"
-        />
-        <span className="min-w-0 flex-1 truncate">
-          {translate('auto.components.right.sidebar.SourceControl.78ddfd0bb4', 'Create as draft')}
-        </span>
-      </label>
-
-      {baseResults.length > 0 ? (
-        <div className="max-h-28 overflow-auto rounded-md border border-border p-1 scrollbar-sleek">
-          {baseResults.map((ref) => (
-            <button
-              key={ref}
-              type="button"
-              disabled={fieldsLocked}
-              className={cn(
-                'flex w-full items-center justify-between rounded-sm px-2 py-1.5 text-left font-mono text-xs hover:bg-accent disabled:cursor-not-allowed disabled:opacity-60 disabled:hover:bg-transparent',
-                stripBaseRef(base) === ref && 'bg-accent text-accent-foreground'
-              )}
-              onClick={() => {
-                if (fieldsLocked) {
-                  return
-                }
-                setBase(ref)
-                setBaseQuery('')
-                setBaseResults([])
-              }}
-            >
-              <span className="truncate">{ref}</span>
-              {stripBaseRef(base) === ref ? <Check className="size-3" /> : null}
-            </button>
-          ))}
+      {generateError || createError ? (
+        <div className="space-y-1">
+          {generateError ? (
+            <CreateHostedReviewComposerMessage>{generateError}</CreateHostedReviewComposerMessage>
+          ) : null}
+          {createError ? (
+            <CreateHostedReviewComposerMessage>{createError}</CreateHostedReviewComposerMessage>
+          ) : null}
         </div>
       ) : null}
-
-      <CreateHostedReviewComposerMessages
-        copy={copy}
-        baseSameAsBranch={baseSameAsBranch}
-        baseSearchError={baseSearchError}
-        generateError={generateError}
-        createError={createError}
-      />
     </>
   )
 }
-
-function CreateHostedReviewComposerMessages({
-  copy,
-  baseSameAsBranch,
-  baseSearchError,
-  generateError,
-  createError
-}: {
-  copy: LocalizedHostedReviewCopy
-  baseSameAsBranch: boolean
-  baseSearchError: string | null
-  generateError: string | null
-  createError: string | null
-}): React.JSX.Element {
-  return (
-    <>
-      {baseSameAsBranch ? (
-        <CreateHostedReviewComposerMessage>
-          {translate(
-            'auto.components.right.sidebar.SourceControl.ae743199cd',
-            'Choose a different base branch before creating a {{value0}}.',
-            { value0: copy.reviewLabel }
-          )}
-        </CreateHostedReviewComposerMessage>
-      ) : null}
-      {baseSearchError ? (
-        <CreateHostedReviewComposerMessage>{baseSearchError}</CreateHostedReviewComposerMessage>
-      ) : null}
-      {generateError ? (
-        <CreateHostedReviewComposerMessage>{generateError}</CreateHostedReviewComposerMessage>
-      ) : null}
-      {createError ? (
-        <CreateHostedReviewComposerMessage>{createError}</CreateHostedReviewComposerMessage>
-      ) : null}
-    </>
-  )
-}
-
-function CreateHostedReviewComposerMessage({
-  children
-}: {
-  children: React.ReactNode
-}): React.JSX.Element {
-  return (
-    <p className="flex items-start gap-1 text-[11px] text-destructive">
-      <TriangleAlert className="mt-px size-3 shrink-0" aria-hidden="true" />
-      <span>{children}</span>
-    </p>
-  )
-}
diff --git a/src/renderer/src/components/right-sidebar/CreateHostedReviewComposerMessage.tsx b/src/renderer/src/components/right-sidebar/CreateHostedReviewComposerMessage.tsx
new file mode 100644
index 00000000000..fb5c1a32397
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/CreateHostedReviewComposerMessage.tsx
@@ -0,0 +1,15 @@
+import { TriangleAlert } from 'lucide-react'
+
+/** Inline blocking message for the create-review composer. */
+export function CreateHostedReviewComposerMessage({
+  children
+}: {
+  children: React.ReactNode
+}): React.JSX.Element {
+  return (
+    <p className="flex items-start gap-1 text-[11px] text-destructive">
+      <TriangleAlert className="mt-px size-3 shrink-0" aria-hidden="true" />
+      <span>{children}</span>
+    </p>
+  )
+}
diff --git a/src/renderer/src/components/right-sidebar/FileExplorer.test.tsx b/src/renderer/src/components/right-sidebar/FileExplorer.test.tsx
index 37fce9ae624..94a25a8443c 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorer.test.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorer.test.tsx
@@ -669,6 +669,24 @@ describe('FileExplorerRow collapse folder action', () => {
     expect(toastErrorMock).toHaveBeenCalledWith('Could not copy the file to the clipboard')
   })
 
+  it('shows an actionable toast when remote clipboard staging is unavailable', async () => {
+    const writeClipboardFile = vi.fn().mockResolvedValue({
+      ok: false,
+      reason: 'staging-unavailable'
+    })
+    ;(
+      globalThis as unknown as {
+        window: { api: { ui: { writeClipboardFile: typeof writeClipboardFile } } }
+      }
+    ).window = { api: { ui: { writeClipboardFile } } }
+
+    await copyFileToOsClipboard(fileNode, 'ssh-1')
+
+    expect(toastErrorMock).toHaveBeenCalledWith(
+      "Could not copy the file because Orca's temporary storage is unavailable"
+    )
+  })
+
   it('shows the remote copy rejection message when SSH materialization fails', async () => {
     const writeClipboardFile = vi.fn().mockRejectedValue(new Error('Remote connection dropped'))
     ;(
diff --git a/src/renderer/src/components/right-sidebar/FileExplorerRow.tsx b/src/renderer/src/components/right-sidebar/FileExplorerRow.tsx
index 6167f08d5c6..9fec091faf0 100644
--- a/src/renderer/src/components/right-sidebar/FileExplorerRow.tsx
+++ b/src/renderer/src/components/right-sidebar/FileExplorerRow.tsx
@@ -425,12 +425,16 @@ export async function copyFileToOsClipboard(
     'auto.components.right.sidebar.FileExplorerRow.b234ab25b4',
     'Could not copy the file to the clipboard'
   )
+  const stagingFailureMessage = translate(
+    'auto.components.right.sidebar.FileExplorerRow.clipboardStagingUnavailable',
+    "Could not copy the file because Orca's temporary storage is unavailable"
+  )
   try {
     const result = await window.api.ui.writeClipboardFile(
       connectionId ? { filePath: node.path, connectionId } : node.path
     )
     if (!result.ok) {
-      toast.error(failureMessage)
+      toast.error(result.reason === 'staging-unavailable' ? stagingFailureMessage : failureMessage)
     }
   } catch (error) {
     toast.error(extractIpcErrorMessage(error, failureMessage))
diff --git a/src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksPanel.tsx b/src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksPanel.tsx
index 0c64561edec..f2e3bdda640 100644
--- a/src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksPanel.tsx
+++ b/src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksPanel.tsx
@@ -181,7 +181,7 @@ export default function FolderWorkspacePrChecksPanel({
           workflowRunId: check.workflowRunId,
           checkName: check.name,
           url: check.url,
-          prRepo: null
+          prRepo: row.githubRepository ?? null
         },
         { repoId: row.repo.id }
       )
diff --git a/src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksRow.tsx b/src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksRow.tsx
index 29d82748467..cd07701bde7 100644
--- a/src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksRow.tsx
+++ b/src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksRow.tsx
@@ -128,6 +128,7 @@ export function FolderWorkspacePrChecksRow({
             checksLoading={row.isRefreshing}
             checkDetailsContextKey={row.refreshIdentity}
             onLoadCheckDetails={onLoadCheckDetails}
+            githubRepository={row.githubRepository ?? null}
             worktreeId={row.worktree.id}
             detailsStickySurface="card"
           />
diff --git a/src/renderer/src/components/right-sidebar/GitHistoryCommitContextMenu.tsx b/src/renderer/src/components/right-sidebar/GitHistoryCommitContextMenu.tsx
index 4746a1cacf8..5ff8e9691fd 100644
--- a/src/renderer/src/components/right-sidebar/GitHistoryCommitContextMenu.tsx
+++ b/src/renderer/src/components/right-sidebar/GitHistoryCommitContextMenu.tsx
@@ -7,6 +7,8 @@ import {
 } from '@/components/ui/context-menu'
 import { translate } from '@/i18n/i18n'
 import type { GitHistoryItem } from '../../../../shared/git-history'
+import { useAppStore } from '@/store'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 export type GitHistoryCommitAction = 'open-remote' | 'copy-hash' | 'copy-message' | 'explain'
 
@@ -17,15 +19,22 @@ export function GitHistoryCommitContextMenu({
   item: GitHistoryItem
   onAction: (action: GitHistoryCommitAction, item: GitHistoryItem) => void
 }): React.JSX.Element {
+  const managedBrowserCreationEnabled = useAppStore(
+    (state) =>
+      getClientCreationActionPolicy(state, state.activeWorktreeId)['managed-browser'].state ===
+      'enabled'
+  )
   return (
     <ContextMenuContent className="w-56">
-      <ContextMenuItem onSelect={() => onAction('open-remote', item)}>
-        <Globe className="size-3.5" />
-        {translate(
-          'auto.components.right.sidebar.GitHistoryCommitContextMenu.7b1c4e9a02',
-          'Open commit in browser'
-        )}
-      </ContextMenuItem>
+      {managedBrowserCreationEnabled ? (
+        <ContextMenuItem onSelect={() => onAction('open-remote', item)}>
+          <Globe className="size-3.5" />
+          {translate(
+            'auto.components.right.sidebar.GitHistoryCommitContextMenu.7b1c4e9a02',
+            'Open commit in browser'
+          )}
+        </ContextMenuItem>
+      ) : null}
       <ContextMenuItem onSelect={() => onAction('copy-hash', item)}>
         <Hash className="size-3.5" />
         {translate(
diff --git a/src/renderer/src/components/right-sidebar/GitHistoryRow.tsx b/src/renderer/src/components/right-sidebar/GitHistoryRow.tsx
index b236d15533c..f41ea2f92b4 100644
--- a/src/renderer/src/components/right-sidebar/GitHistoryRow.tsx
+++ b/src/renderer/src/components/right-sidebar/GitHistoryRow.tsx
@@ -94,7 +94,12 @@ export const GitHistoryRow = React.forwardRef<HTMLElement, GitHistoryRowProps>(
                 {item.subject}
               </span>
             </TooltipTrigger>
-            <TooltipContent side="bottom" sideOffset={6} className="max-w-96 whitespace-pre-wrap">
+            <TooltipContent
+              side="bottom"
+              sideOffset={6}
+              collisionPadding={8}
+              className="max-w-[min(76ch,var(--radix-tooltip-content-available-width))] break-words text-wrap whitespace-pre-wrap"
+            >
               {rowTooltip}
             </TooltipContent>
           </Tooltip>
diff --git a/src/renderer/src/components/right-sidebar/GitHubPRStackMap.test.tsx b/src/renderer/src/components/right-sidebar/GitHubPRStackMap.test.tsx
new file mode 100644
index 00000000000..e29d0b74361
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/GitHubPRStackMap.test.tsx
@@ -0,0 +1,113 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { GitHubPRStack } from '../../../../shared/types'
+import { GitHubPRStackMap } from './GitHubPRStackMap'
+
+const stack: GitHubPRStack = {
+  number: 51,
+  position: 2,
+  size: 3,
+  baseRefName: 'main',
+  entries: [
+    {
+      position: 1,
+      number: 201,
+      title: 'Models',
+      url: 'https://github.com/acme/repo/pull/201',
+      state: 'open',
+      checksStatus: 'success',
+      mergeable: 'MERGEABLE',
+      reviewDecision: 'APPROVED'
+    },
+    {
+      position: 2,
+      number: 202,
+      title: 'API',
+      url: 'https://github.com/acme/repo/pull/202',
+      state: 'open',
+      checksStatus: 'failure',
+      mergeable: 'MERGEABLE'
+    },
+    {
+      position: 3,
+      number: 203,
+      title: 'UI',
+      url: 'https://github.com/acme/repo/pull/203',
+      state: 'draft',
+      checksStatus: 'neutral',
+      mergeable: 'UNKNOWN'
+    }
+  ]
+}
+
+let container: HTMLDivElement
+let root: Root
+
+describe('GitHubPRStackMap', () => {
+  beforeEach(() => {
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
+  })
+
+  it('shows compact identity then expands top-to-bottom with the current PR highlighted', () => {
+    act(() => {
+      root.render(
+        <GitHubPRStackMap stack={stack} currentPRNumber={202} onOpenPullRequest={vi.fn()} />
+      )
+    })
+
+    expect(container.textContent).toContain('Stack #51')
+    expect(container.textContent).toContain('2 of 3 · main')
+    expect(container.querySelectorAll('button[data-stack-pr-number]')).toHaveLength(0)
+
+    const trigger = container.querySelector<HTMLButtonElement>(
+      'button[aria-label="Expand stack #51"]'
+    )
+    act(() => trigger?.click())
+
+    const rows = [...container.querySelectorAll<HTMLButtonElement>('button[data-stack-pr-number]')]
+    expect(rows.map((row) => row.textContent)).toEqual([
+      expect.stringContaining('#203'),
+      expect.stringContaining('#202'),
+      expect.stringContaining('#201')
+    ])
+    expect(rows[1]?.dataset.current).toBe('true')
+    expect(container.textContent).toContain('checks failed')
+    expect(container.textContent).toContain('main')
+  })
+
+  it('opens another PR without changing local branches', () => {
+    const onOpenPullRequest = vi.fn()
+    act(() => {
+      root.render(
+        <GitHubPRStackMap
+          stack={stack}
+          currentPRNumber={202}
+          onOpenPullRequest={onOpenPullRequest}
+        />
+      )
+    })
+    act(() =>
+      container.querySelector<HTMLButtonElement>('button[aria-label="Expand stack #51"]')?.click()
+    )
+    act(() =>
+      container.querySelector<HTMLButtonElement>('button[data-stack-pr-number="203"]')?.click()
+    )
+
+    expect(onOpenPullRequest).toHaveBeenCalledTimes(1)
+    expect(onOpenPullRequest).toHaveBeenCalledWith('https://github.com/acme/repo/pull/203', {
+      metaKey: false,
+      ctrlKey: false,
+      shiftKey: false
+    })
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/GitHubPRStackMap.tsx b/src/renderer/src/components/right-sidebar/GitHubPRStackMap.tsx
new file mode 100644
index 00000000000..e0187b37709
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/GitHubPRStackMap.tsx
@@ -0,0 +1,156 @@
+import { useMemo, useState } from 'react'
+import { ChevronDown, GitBranch, GitPullRequest } from 'lucide-react'
+import type { GitHubPRStack, GitHubPRStackEntry } from '../../../../shared/types'
+import { cn } from '@/lib/utils'
+import { Collapsible, CollapsibleContent, CollapsibleTrigger } from '@/components/ui/collapsible'
+import { translate } from '@/i18n/i18n'
+
+export type GitHubPRStackMapNavigationModifiers = Pick<
+  React.MouseEvent<HTMLButtonElement>,
+  'metaKey' | 'ctrlKey' | 'shiftKey'
+>
+
+function stackEntryStatus(entry: GitHubPRStackEntry): string {
+  if (entry.state === 'merged') {
+    return translate('auto.components.right.sidebar.GitHubPRStackMap.8a9bdc36c0', 'merged')
+  }
+  if (entry.state === 'closed') {
+    return translate('auto.components.right.sidebar.GitHubPRStackMap.3511405914', 'closed')
+  }
+  if (entry.state === 'draft') {
+    return translate('auto.components.right.sidebar.GitHubPRStackMap.568c647ccd', 'draft')
+  }
+  if (entry.mergeable === 'CONFLICTING') {
+    return translate('auto.components.right.sidebar.GitHubPRStackMap.bea9ade223', 'conflicts')
+  }
+  if (entry.checksStatus === 'failure') {
+    return translate('auto.components.right.sidebar.GitHubPRStackMap.838aadf512', 'checks failed')
+  }
+  if (entry.checksStatus === 'pending') {
+    return translate('auto.components.right.sidebar.GitHubPRStackMap.316039b5db', 'checks pending')
+  }
+  if (entry.reviewDecision === 'CHANGES_REQUESTED') {
+    return translate(
+      'auto.components.right.sidebar.GitHubPRStackMap.4b1e5ee9d3',
+      'changes requested'
+    )
+  }
+  if (entry.reviewDecision === 'REVIEW_REQUIRED') {
+    return translate('auto.components.right.sidebar.GitHubPRStackMap.9a17b5255c', 'review needed')
+  }
+  if (entry.reviewDecision === 'APPROVED') {
+    return translate('auto.components.right.sidebar.GitHubPRStackMap.d3d97cf3f2', 'approved')
+  }
+  return translate('auto.components.right.sidebar.GitHubPRStackMap.e6cb964305', 'open')
+}
+
+export function GitHubPRStackMap({
+  stack,
+  currentPRNumber,
+  onOpenPullRequest
+}: {
+  stack: GitHubPRStack
+  currentPRNumber: number
+  onOpenPullRequest: (url: string, modifiers: GitHubPRStackMapNavigationModifiers) => void
+}): React.JSX.Element {
+  const [open, setOpen] = useState(false)
+  const entries = useMemo(
+    () => [...(stack.entries ?? [])].sort((a, b) => b.position - a.position),
+    [stack.entries]
+  )
+
+  return (
+    <Collapsible
+      open={open}
+      onOpenChange={setOpen}
+      className="overflow-hidden rounded-md border border-border"
+    >
+      <CollapsibleTrigger asChild>
+        <button
+          type="button"
+          className="flex w-full items-center gap-2 px-2 py-1.5 text-left text-[11px] hover:bg-accent focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
+          aria-label={
+            open
+              ? translate(
+                  'auto.components.right.sidebar.GitHubPRStackMap.7737bd66be',
+                  'Collapse stack #{{value0}}',
+                  { value0: stack.number }
+                )
+              : translate(
+                  'auto.components.right.sidebar.GitHubPRStackMap.0c1645ebd0',
+                  'Expand stack #{{value0}}',
+                  { value0: stack.number }
+                )
+          }
+        >
+          <GitPullRequest className="size-3.5 shrink-0 text-muted-foreground" />
+          <span className="font-semibold text-foreground">
+            {translate(
+              'auto.components.right.sidebar.GitHubPRStackMap.e3ee2daa32',
+              'Stack #{{value0}}',
+              { value0: stack.number }
+            )}
+          </span>
+          <span className="text-muted-foreground">
+            {translate(
+              'auto.components.right.sidebar.GitHubPRStackMap.cb440931b7',
+              '{{value0}} of {{value1}} · {{value2}}',
+              { value0: stack.position, value1: stack.size, value2: stack.baseRefName }
+            )}
+          </span>
+          <ChevronDown
+            className={cn(
+              'ml-auto size-3.5 shrink-0 text-muted-foreground transition-transform motion-reduce:transition-none',
+              open && 'rotate-180'
+            )}
+          />
+        </button>
+      </CollapsibleTrigger>
+      <CollapsibleContent className="border-t border-border">
+        {entries.length > 0 ? (
+          <div className="py-1">
+            {entries.map((entry) => {
+              const current = entry.number === currentPRNumber
+              return (
+                <button
+                  key={entry.number}
+                  type="button"
+                  data-stack-pr-number={entry.number}
+                  data-current={current ? 'true' : undefined}
+                  className={cn(
+                    'flex w-full min-w-0 items-center gap-2 px-2 py-1.5 text-left text-[11px] hover:bg-accent focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring',
+                    current && 'bg-accent'
+                  )}
+                  onClick={(event) =>
+                    onOpenPullRequest(entry.url, {
+                      metaKey: event.metaKey,
+                      ctrlKey: event.ctrlKey,
+                      shiftKey: event.shiftKey
+                    })
+                  }
+                >
+                  <span className="w-8 shrink-0 font-medium text-foreground">#{entry.number}</span>
+                  <span className="min-w-0 flex-1 truncate text-foreground">{entry.title}</span>
+                  <span className="shrink-0 text-[10px] text-muted-foreground">
+                    {stackEntryStatus(entry)}
+                  </span>
+                </button>
+              )
+            })}
+            <div className="flex items-center gap-2 px-2 py-1.5 text-[11px] text-muted-foreground">
+              <GitBranch className="size-3.5 shrink-0" />
+              <span className="truncate">{stack.baseRefName}</span>
+            </div>
+          </div>
+        ) : (
+          <div className="px-2 py-2 text-[11px] text-muted-foreground">
+            {translate(
+              'auto.components.right.sidebar.GitHubPRStackMap.525259fa17',
+              'Stack details are temporarily unavailable.'
+            )}
+          </div>
+        )}
+      </CollapsibleContent>
+    </Collapsible>
+  )
+}
diff --git a/src/renderer/src/components/right-sidebar/HostedReviewActions.tsx b/src/renderer/src/components/right-sidebar/HostedReviewActions.tsx
index 3c625e2003c..b8adeb40c4f 100644
--- a/src/renderer/src/components/right-sidebar/HostedReviewActions.tsx
+++ b/src/renderer/src/components/right-sidebar/HostedReviewActions.tsx
@@ -28,6 +28,11 @@ import {
   RIGHT_SIDEBAR_SPLIT_ACTION_ROW_CLASS
 } from './right-sidebar-primary-action-layout'
 import { translate } from '@/i18n/i18n'
+import {
+  getGitHubPRStackMergeBlocker,
+  getGitHubPRStackMergeScope,
+  isGitHubPRStackMergeQueueRequired
+} from './github-pr-stack-merge'
 
 export default function HostedReviewActions({
   review,
@@ -48,11 +53,33 @@ export default function HostedReviewActions({
   const isGitLab = review.provider === 'gitlab'
   const shortLabel = isGitLab ? 'MR' : 'PR'
   const reviewLabel = isGitLab ? 'merge request' : 'pull request'
+  const stackMergeScope = useMemo(
+    () => (githubPR?.stack ? getGitHubPRStackMergeScope(githubPR.stack, review.number) : null),
+    [githubPR?.stack, review.number]
+  )
+  const stackUsesMergeQueue = isGitHubPRStackMergeQueueRequired(
+    review.mergeQueueRequired,
+    githubPR?.mergeQueueRequired
+  )
+  const stackMergeLabel =
+    stackMergeScope && stackUsesMergeQueue
+      ? stackMergeScope.count === 1
+        ? translate(
+            'auto.components.right.sidebar.HostedReviewActions.9a41a687b7',
+            'Queue through #{{pr}} · {{count}} PR',
+            { pr: review.number, count: stackMergeScope.count }
+          )
+        : translate(
+            'auto.components.right.sidebar.HostedReviewActions.38a1bccb14',
+            'Queue through #{{pr}} · {{count}} PRs',
+            { pr: review.number, count: stackMergeScope.count }
+          )
+      : stackMergeScope?.label
   const mergePresentation = useMemo(() => {
     if (isGitLab) {
       return { ...presentGitLabMRMergeState(review), autoMergeAction: null }
     }
-    return presentGitHubPRMergeState({
+    const presentation = presentGitHubPRMergeState({
       ...githubPR,
       state: review.state,
       mergeable: review.mergeable,
@@ -63,7 +90,30 @@ export default function HostedReviewActions({
       autoMergeAllowed: review.autoMergeAllowed,
       mergeQueueRequired: review.mergeQueueRequired
     })
-  }, [githubPR, isGitLab, review])
+    if (!githubPR?.stack || !stackMergeScope) {
+      return presentation
+    }
+    const stackBlocker = getGitHubPRStackMergeBlocker(stackMergeScope)
+    return {
+      ...presentation,
+      label: stackMergeLabel ?? stackMergeScope.label,
+      tooltip:
+        stackBlocker ??
+        (stackUsesMergeQueue
+          ? translate(
+              'auto.components.right.sidebar.HostedReviewActions.3de88351c5',
+              'GitHub will add this pull request and every pull request below it to the merge queue.'
+            )
+          : translate(
+              'auto.components.right.sidebar.HostedReviewActions.a32fe6dba6',
+              'GitHub will merge this pull request and every pull request below it in the stack.'
+            )),
+      directMergeAvailable:
+        !stackBlocker &&
+        (stackMergeScope.complete || presentation.directMergeAvailable || stackUsesMergeQueue),
+      autoMergeAction: null
+    }
+  }, [githubPR, isGitLab, review, stackMergeLabel, stackMergeScope, stackUsesMergeQueue])
   const mergeMethods = useMemo(
     () => resolveGitHubPRMergeMethods(isGitLab ? null : (githubPR?.mergeMethodSettings ?? null)),
     [githubPR?.mergeMethodSettings, isGitLab]
@@ -140,12 +190,22 @@ export default function HostedReviewActions({
                     )}
                     <span className={RIGHT_SIDEBAR_PRIMARY_BUTTON_LABEL_CLASS}>
                       {merging
-                        ? translate(
-                            'auto.components.right.sidebar.HostedReviewActions.d2ca293f3d',
-                            'Working...'
-                          )
+                        ? stackMergeScope
+                          ? stackUsesMergeQueue
+                            ? translate(
+                                'auto.components.right.sidebar.HostedReviewActions.73e0e1819d',
+                                'Queueing stack...'
+                              )
+                            : translate(
+                                'auto.components.right.sidebar.HostedReviewActions.e555a41d32',
+                                'Merging stack...'
+                              )
+                          : translate(
+                              'auto.components.right.sidebar.HostedReviewActions.d2ca293f3d',
+                              'Working...'
+                            )
                         : mergePresentation.directMergeAvailable
-                          ? mergeMethods.defaultLabel
+                          ? (stackMergeLabel ?? mergeMethods.defaultLabel)
                           : (mergePresentation.autoMergeAction?.label ?? mergePresentation.label)}
                     </span>
                   </Button>
@@ -198,16 +258,17 @@ export default function HostedReviewActions({
                     <DropdownMenuSeparator />
                   </>
                 )}
-                {mergeMethods.methods.map(({ method, label }) => (
-                  <DropdownMenuItem
-                    key={method}
-                    disabled={directMergeDisabled}
-                    onSelect={() => void handleMerge(method)}
-                  >
-                    <GitMerge className="size-3.5" />
-                    {label}
-                  </DropdownMenuItem>
-                ))}
+                {(!stackMergeScope || !stackUsesMergeQueue) &&
+                  mergeMethods.methods.map(({ method, label }) => (
+                    <DropdownMenuItem
+                      key={method}
+                      disabled={directMergeDisabled}
+                      onSelect={() => void handleMerge(method)}
+                    >
+                      <GitMerge className="size-3.5" />
+                      {label}
+                    </DropdownMenuItem>
+                  ))}
                 <DropdownMenuSeparator />
                 <DropdownMenuItem
                   variant="destructive"
diff --git a/src/renderer/src/components/right-sidebar/PortsPanel.test.tsx b/src/renderer/src/components/right-sidebar/PortsPanel.test.tsx
index 1dc5b616ed5..1943532cb52 100644
--- a/src/renderer/src/components/right-sidebar/PortsPanel.test.tsx
+++ b/src/renderer/src/components/right-sidebar/PortsPanel.test.tsx
@@ -61,7 +61,8 @@ const compatibleStatus = {
   runtimeId: 'runtime-1',
   graphStatus: 'ready',
   runtimeProtocolVersion: RUNTIME_PROTOCOL_VERSION,
-  minCompatibleRuntimeClientVersion: MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION
+  minCompatibleRuntimeClientVersion: MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION,
+  capabilities: ['browser.screencast.v1']
 }
 
 const localScan = vi.fn()
@@ -353,7 +354,8 @@ describe('PortsPanel runtime routing', () => {
       'repo::/workspace/app',
       'http://127.0.0.1:63468',
       {
-        activate: true
+        activate: true,
+        browserRuntimeEnvironmentId: 'env-1'
       }
     )
     expect(setRemoteBrowserPageHandle).toHaveBeenCalledWith('local-page-1', {
@@ -362,6 +364,34 @@ describe('PortsPanel runtime routing', () => {
     })
   })
 
+  it('rejects remote port browser creation before RPC without the screencast provider', async () => {
+    runtimeEnvironmentCall.mockImplementation(({ method }: { method: string }) =>
+      Promise.resolve({
+        id: method,
+        ok: true,
+        result: { ...compatibleStatus, capabilities: [] },
+        _meta: { runtimeId: 'runtime-1' }
+      })
+    )
+    const createBrowserTab = vi.fn()
+
+    await expect(
+      openWorkspacePortInBrowser({
+        port: workspacePort,
+        runtimeTarget: { kind: 'environment', environmentId: 'env-1' },
+        createBrowserTab: createBrowserTab as never,
+        setRemoteBrowserPageHandle: vi.fn() as never
+      })
+    ).resolves.toEqual({
+      ok: false,
+      reason:
+        'Managed browser tabs are unavailable because the paired runtime does not support browser streaming.'
+    })
+
+    expect(runtimeEnvironmentCall.mock.calls.map((call) => call[0].method)).toEqual(['status.get'])
+    expect(createBrowserTab).not.toHaveBeenCalled()
+  })
+
   it('opens workspace ports in the system browser when link routing is off', async () => {
     const createBrowserTab = vi.fn()
     const setRemoteBrowserPageHandle = vi.fn()
@@ -579,7 +609,7 @@ describe('PortsPanel runtime routing', () => {
     expect(createBrowserTab).toHaveBeenCalledWith(
       'repo::/workspace/app',
       'http://127.0.0.1:63468',
-      { activate: true }
+      { activate: true, browserRuntimeEnvironmentId: 'env-1' }
     )
     expect(setRemoteBrowserPageHandle).toHaveBeenCalledWith('local-page-1', {
       environmentId: 'env-1',
diff --git a/src/renderer/src/components/right-sidebar/PortsPanel.tsx b/src/renderer/src/components/right-sidebar/PortsPanel.tsx
index b0c1dae3a4d..2f481e8014d 100644
--- a/src/renderer/src/components/right-sidebar/PortsPanel.tsx
+++ b/src/renderer/src/components/right-sidebar/PortsPanel.tsx
@@ -58,6 +58,7 @@ import {
 import type { PortForwardEntry, EnrichedDetectedPort } from '../../../../shared/ssh-types'
 import type { WorkspacePort } from '../../../../shared/workspace-ports'
 import { translate } from '@/i18n/i18n'
+import { openWorkspaceBrowserTab } from '@/lib/workspace-browser-tab-open'
 
 export {
   killWorkspacePortForTarget,
@@ -804,7 +805,6 @@ function SshPortsPanel(): React.JSX.Element {
   const portForwardsByConnection = useAppStore((s) => s.portForwardsByConnection)
   const detectedPortsByConnection = useAppStore((s) => s.detectedPortsByConnection)
   const sshConnectionStates = useAppStore((s) => s.sshConnectionStates)
-  const createBrowserTab = useAppStore((s) => s.createBrowserTab)
   // Why: scope the panel to the active worktree's SSH connection so
   // actions target the correct machine and the disconnected state
   // reflects the active worktree, not some other SSH session.
@@ -884,11 +884,15 @@ function SshPortsPanel(): React.JSX.Element {
         )
         return
       }
-      createBrowserTab(activeWorktree.id, url, {
-        activate: true
+      void openWorkspaceBrowserTab({
+        workspaceId: activeWorktree.id,
+        url,
+        intent: { kind: 'url' }
+      }).catch((error) => {
+        toast.error(error instanceof Error ? error.message : String(error))
       })
     },
-    [activeWorktree?.id, createBrowserTab, settings]
+    [activeWorktree?.id, settings]
   )
 
   const handleDialogClose = useCallback(() => {
diff --git a/src/renderer/src/components/right-sidebar/PullRequestComposer.generate-tooltip.test.tsx b/src/renderer/src/components/right-sidebar/PullRequestComposer.generate-tooltip.test.tsx
index 238da6cabe0..3bf529e895b 100644
--- a/src/renderer/src/components/right-sidebar/PullRequestComposer.generate-tooltip.test.tsx
+++ b/src/renderer/src/components/right-sidebar/PullRequestComposer.generate-tooltip.test.tsx
@@ -1,7 +1,12 @@
+// @vitest-environment happy-dom
+
 import { renderToStaticMarkup } from 'react-dom/server'
-import { describe, expect, it, vi } from 'vitest'
+import { useState } from 'react'
+import { cleanup, fireEvent, render as renderDom, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import { TooltipProvider } from '@/components/ui/tooltip'
 import { CreateHostedReviewComposer } from './CreateHostedReviewComposer'
+import type { HostedReviewStackParent } from './useHostedReviewStackParent'
 import { resolveDropdownItems } from './source-control-dropdown-items'
 import { resolvePrimaryAction } from './source-control-primary-action'
 
@@ -10,14 +15,38 @@ type RenderPullRequestComposerOptions = {
   generating?: boolean
   generateDisabled?: boolean
   generateDisabledReason?: string
+  stackedCreationSupported?: boolean
+  stackParentReview?: HostedReviewStackParent | null
+  base?: string
+  setBase?: (value: string) => void
+  baseQuery?: string
+  setBaseQuery?: (value: string) => void
+  baseResults?: string[]
+  setBaseResults?: (value: string[]) => void
+  baseSearchPending?: boolean
+  repoDefaultBase?: string | null
+  onPrimaryAction?: (stacked: boolean) => void
 }
 
-function renderPullRequestComposer({
+const EMPTY_BASE_RESULTS: string[] = []
+
+function pullRequestComposerElement({
   aiGenerationEnabled = true,
   generating = false,
   generateDisabled = false,
-  generateDisabledReason
-}: RenderPullRequestComposerOptions = {}): string {
+  generateDisabledReason,
+  stackedCreationSupported = true,
+  stackParentReview = null,
+  base = 'master',
+  setBase = vi.fn(),
+  baseQuery = '',
+  setBaseQuery = vi.fn(),
+  baseResults = [],
+  setBaseResults = vi.fn(),
+  baseSearchPending = false,
+  repoDefaultBase = 'main',
+  onPrimaryAction = vi.fn()
+}: RenderPullRequestComposerOptions = {}): React.JSX.Element {
   const sourceControlInputs = {
     stagedCount: 1,
     hasUnstagedChanges: false,
@@ -31,23 +60,27 @@ function renderPullRequestComposer({
   }
   const primaryAction = resolvePrimaryAction(sourceControlInputs)
 
-  return renderToStaticMarkup(
+  return (
     <TooltipProvider>
       <CreateHostedReviewComposer
         provider="github"
         branch="branch-login-issue"
-        base="master"
-        setBase={vi.fn()}
-        title=""
+        base={base}
+        setBase={setBase}
+        repoDefaultBase={repoDefaultBase}
+        title="Ready to create"
         setTitle={vi.fn()}
         body=""
         setBody={vi.fn()}
         draft={false}
         setDraft={vi.fn()}
-        baseQuery=""
-        setBaseQuery={vi.fn()}
-        baseResults={[]}
-        setBaseResults={vi.fn()}
+        stackedCreationSupported={stackedCreationSupported}
+        stackParentReview={stackParentReview}
+        baseQuery={baseQuery}
+        setBaseQuery={setBaseQuery}
+        baseResults={baseResults}
+        setBaseResults={setBaseResults}
+        baseSearchPending={baseSearchPending}
         baseSearchError={null}
         aiGenerationEnabled={aiGenerationEnabled}
         generating={generating}
@@ -60,13 +93,50 @@ function renderPullRequestComposer({
         dropdownItems={resolveDropdownItems(sourceControlInputs)}
         onGenerate={vi.fn()}
         onCancelGenerate={vi.fn()}
-        onPrimaryAction={vi.fn()}
+        onPrimaryAction={onPrimaryAction}
         onDropdownAction={vi.fn()}
       />
     </TooltipProvider>
   )
 }
 
+function renderPullRequestComposer(options: RenderPullRequestComposerOptions = {}): string {
+  return renderToStaticMarkup(pullRequestComposerElement(options))
+}
+
+function InteractiveBaseComposer({
+  baseResults = EMPTY_BASE_RESULTS,
+  baseSearchPending = false,
+  stackParentReview = null,
+  repoDefaultBase = 'main',
+  initialBase = 'main',
+  onPrimaryAction
+}: {
+  baseResults?: string[]
+  baseSearchPending?: boolean
+  stackParentReview?: HostedReviewStackParent | null
+  repoDefaultBase?: string | null
+  initialBase?: string
+  onPrimaryAction?: (stacked: boolean) => void
+}) {
+  const [base, setBase] = useState(initialBase)
+  const [baseQuery, setBaseQuery] = useState('')
+  const [results, setBaseResults] = useState(baseResults)
+
+  return pullRequestComposerElement({
+    base,
+    setBase,
+    baseQuery,
+    setBaseQuery,
+    baseResults: results,
+    setBaseResults,
+    baseSearchPending,
+    stackParentReview,
+    repoDefaultBase,
+    ...(onPrimaryAction ? { onPrimaryAction } : {})
+  })
+}
+
 function elementByLabel(markup: string, tagName: string, label: string): string {
   const element = [...markup.matchAll(new RegExp(`<${tagName}\\b[\\s\\S]*?</${tagName}>`, 'g'))]
     .map((match) => match[0])
@@ -80,6 +150,8 @@ function elementByLabel(markup: string, tagName: string, label: string): string
 }
 
 describe('CreateHostedReviewComposer generate tooltip', () => {
+  afterEach(cleanup)
+
   it('renders hosted review labels without leaking interpolation placeholders', () => {
     const markup = renderPullRequestComposer()
 
@@ -122,4 +194,244 @@ describe('CreateHostedReviewComposer generate tooltip', () => {
     expect(button).toContain('data-slot="tooltip-trigger"')
     expect(button).not.toContain('disabled=""')
   })
+
+  it('does not ask for a PR type without an open parent review', () => {
+    const markup = renderPullRequestComposer()
+
+    expect(markup).not.toContain('Regular PR')
+    expect(markup).not.toContain('Stacked PR')
+    expect(markup).not.toContain('Stack this PR above')
+  })
+
+  it('shows the parent-child preview and stack create action for an open parent review', () => {
+    const onPrimaryAction = vi.fn()
+    const { container } = renderDom(
+      pullRequestComposerElement({
+        stackParentReview: { number: 13741, url: 'https://github.com/stablyai/orca/pull/13741' },
+        onPrimaryAction
+      })
+    )
+
+    // Unchecked, the helper explains the effect rather than repeating the base ref.
+    expect(container.innerHTML).toContain(
+      "Creates a GitHub Stack or extends the parent's existing stack."
+    )
+
+    fireEvent.click(screen.getByRole('checkbox', { name: /Stack this PR above #13741/ }))
+
+    const markup = container.innerHTML
+
+    expect(markup).toContain('#13741')
+    expect(markup).toContain('master')
+    expect(markup).toContain('branch-login-issue')
+    expect(markup).toContain('Create PR in stack')
+
+    fireEvent.click(screen.getByRole('button', { name: /Create PR in stack/ }))
+    expect(onPrimaryAction).toHaveBeenCalledWith(true)
+  })
+
+  it('drives both options through the shadcn Checkbox primitive', () => {
+    const { container } = renderDom(
+      pullRequestComposerElement({
+        stackParentReview: { number: 13741, url: 'https://github.com/stablyai/orca/pull/13741' }
+      })
+    )
+
+    expect(container.querySelectorAll('[data-slot="checkbox"]')).toHaveLength(2)
+    // Radix keeps a hidden native input for form participation; nothing browser-native renders.
+    for (const native of container.querySelectorAll('input[type="checkbox"]')) {
+      expect(native.getAttribute('aria-hidden')).toBe('true')
+    }
+  })
+
+  it('labels the base field above a full-width combobox and names the head branch', () => {
+    renderDom(<InteractiveBaseComposer />)
+    const input = screen.getByRole('combobox', { name: 'Pull Request base branch' })
+
+    expect(screen.getByText('Base branch').getAttribute('for')).toBe(input.id)
+    expect(input.className).toContain('w-full')
+    expect(screen.getByText('from branch-login-issue')).toBeTruthy()
+  })
+
+  it('marks the base field invalid when it matches the head branch', () => {
+    const { container } = renderDom(pullRequestComposerElement({ base: 'branch-login-issue' }))
+    const input = screen.getByRole('combobox', { name: 'Pull Request base branch' })
+
+    expect(input.getAttribute('aria-invalid')).toBe('true')
+    expect(container.innerHTML).toContain(
+      'Choose a different base branch before creating a pull request.'
+    )
+  })
+
+  it('moves through base results with the arrow keys and commits the highlighted ref', () => {
+    renderDom(
+      <InteractiveBaseComposer
+        baseResults={['release/candidate', 'release/next', 'release/prev']}
+      />
+    )
+    const input = screen.getByRole('combobox', { name: 'Pull Request base branch' })
+
+    fireEvent.focus(input)
+    fireEvent.keyDown(input, { key: 'ArrowDown' })
+    fireEvent.keyDown(input, { key: 'ArrowDown' })
+    expect(input.getAttribute('aria-activedescendant')).toBe(
+      screen.getByRole('option', { name: 'release/next' }).id
+    )
+
+    fireEvent.keyDown(input, { key: 'ArrowUp' })
+    fireEvent.keyDown(input, { key: 'Enter' })
+    expect((input as HTMLInputElement).value).toBe('release/candidate')
+  })
+
+  it('withholds the empty-result message until the base search settles', () => {
+    const { rerender } = renderDom(<InteractiveBaseComposer baseSearchPending />)
+    const input = screen.getByRole('combobox', { name: 'Pull Request base branch' })
+
+    fireEvent.focus(input)
+    fireEvent.change(input, { target: { value: 'nope' } })
+    expect(screen.queryByText(/No branches match/)).toBeNull()
+
+    rerender(<InteractiveBaseComposer baseSearchPending={false} />)
+    fireEvent.focus(input)
+    fireEvent.change(input, { target: { value: 'nope' } })
+    expect(screen.getByText(/No branches match “nope”/)).toBeTruthy()
+  })
+
+  it('commits the repo default when the base field is cleared', () => {
+    renderDom(<InteractiveBaseComposer initialBase="feature/parent" repoDefaultBase="main" />)
+    const input = screen.getByRole('combobox', { name: 'Pull Request base branch' })
+
+    fireEvent.focus(input)
+    fireEvent.change(input, { target: { value: '' } })
+    expect(screen.getByText('Leave empty to use main.')).toBeTruthy()
+
+    fireEvent.keyDown(input, { key: 'Enter' })
+    expect((input as HTMLInputElement).value).toBe('main')
+  })
+
+  it('commits the repo default when an emptied field loses focus', () => {
+    renderDom(<InteractiveBaseComposer initialBase="feature/parent" repoDefaultBase="main" />)
+    const input = screen.getByRole('combobox', { name: 'Pull Request base branch' })
+
+    fireEvent.focus(input)
+    fireEvent.change(input, { target: { value: '' } })
+    fireEvent.blur(input)
+
+    expect((input as HTMLInputElement).value).toBe('main')
+  })
+
+  it('cancels a partial query on blur instead of committing it', () => {
+    renderDom(<InteractiveBaseComposer initialBase="feature/parent" repoDefaultBase="main" />)
+    const input = screen.getByRole('combobox', { name: 'Pull Request base branch' })
+
+    fireEvent.focus(input)
+    fireEvent.change(input, { target: { value: 'rele' } })
+    fireEvent.blur(input)
+
+    expect((input as HTMLInputElement).value).toBe('feature/parent')
+  })
+
+  it('restores the committed base when an emptied field is cancelled', () => {
+    renderDom(<InteractiveBaseComposer initialBase="feature/parent" repoDefaultBase="main" />)
+    const input = screen.getByRole('combobox', { name: 'Pull Request base branch' })
+
+    fireEvent.focus(input)
+    fireEvent.change(input, { target: { value: '' } })
+    fireEvent.keyDown(input, { key: 'Escape' })
+
+    expect((input as HTMLInputElement).value).toBe('feature/parent')
+  })
+
+  it('keeps the committed base when no repo default has resolved yet', () => {
+    renderDom(<InteractiveBaseComposer initialBase="feature/parent" repoDefaultBase={null} />)
+    const input = screen.getByRole('combobox', { name: 'Pull Request base branch' })
+
+    fireEvent.focus(input)
+    fireEvent.change(input, { target: { value: '' } })
+    expect(screen.queryByText(/Leave empty to use/)).toBeNull()
+
+    fireEvent.keyDown(input, { key: 'Enter' })
+    expect((input as HTMLInputElement).value).toBe('feature/parent')
+
+    fireEvent.focus(input)
+    fireEvent.change(input, { target: { value: '' } })
+    fireEvent.blur(input)
+    expect((input as HTMLInputElement).value).toBe('feature/parent')
+  })
+
+  it('drops a stack choice when the base moves off the parent it was made for', () => {
+    // The choice is keyed to base+parent, so a base change can never submit a stacked
+    // create for a parent the composer is no longer showing.
+    const onPrimaryAction = vi.fn()
+    renderDom(
+      <InteractiveBaseComposer
+        initialBase="feature/parent"
+        baseResults={['release/candidate']}
+        stackParentReview={{ number: 13741, url: 'https://github.com/stablyai/orca/pull/13741' }}
+        onPrimaryAction={onPrimaryAction}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('checkbox', { name: /Stack this PR above #13741/ }))
+    expect(screen.getByRole('button', { name: /Create PR in stack/ })).toBeTruthy()
+
+    const input = screen.getByRole('combobox', { name: 'Pull Request base branch' })
+    fireEvent.focus(input)
+    fireEvent.change(input, { target: { value: 'release/candidate' } })
+    fireEvent.keyDown(input, { key: 'Enter' })
+
+    expect(screen.queryByRole('button', { name: /in stack/ })).toBeNull()
+    fireEvent.click(screen.getByRole('button', { name: /^Create PR$/ }))
+    expect(onPrimaryAction).toHaveBeenCalledWith(false)
+  })
+
+  it('hides the stack option while the base search is open', () => {
+    renderDom(
+      <InteractiveBaseComposer
+        baseResults={['release/candidate']}
+        stackParentReview={{ number: 13741, url: 'https://github.com/stablyai/orca/pull/13741' }}
+      />
+    )
+
+    expect(screen.getByRole('checkbox', { name: /Stack this PR above #13741/ })).toBeTruthy()
+
+    fireEvent.focus(screen.getByRole('combobox', { name: 'Pull Request base branch' }))
+    expect(screen.queryByRole('checkbox', { name: /Stack this PR above/ })).toBeNull()
+  })
+
+  it('hides stacked creation when the executing host lacks the capability', () => {
+    const markup = renderPullRequestComposer({
+      stackedCreationSupported: false,
+      stackParentReview: { number: 13741, url: 'https://github.com/stablyai/orca/pull/13741' }
+    })
+
+    expect(markup).not.toContain('Stack this PR above #13741')
+  })
+
+  it('keeps temporary base search text separate from the committed branch', () => {
+    renderDom(<InteractiveBaseComposer />)
+    const input = screen.getByRole('combobox', { name: 'Pull Request base branch' })
+
+    fireEvent.focus(input)
+    fireEvent.change(input, { target: { value: '' } })
+    expect((input as HTMLInputElement).value).toBe('')
+
+    fireEvent.change(input, { target: { value: 'release/candidate' } })
+    expect((input as HTMLInputElement).value).toBe('release/candidate')
+    fireEvent.keyDown(input, { key: 'Escape' })
+    expect((input as HTMLInputElement).value).toBe('main')
+
+    fireEvent.focus(input)
+    fireEvent.change(input, { target: { value: 'release/candidate' } })
+    fireEvent.keyDown(input, { key: 'Enter' })
+    expect((input as HTMLInputElement).value).toBe('release/candidate')
+  })
+
+  it('places base search results directly under the combobox', () => {
+    const { container } = renderDom(<InteractiveBaseComposer baseResults={['release/candidate']} />)
+    fireEvent.focus(screen.getByRole('combobox', { name: 'Pull Request base branch' }))
+
+    const markup = container.innerHTML
+    expect(markup.indexOf('release/candidate')).toBeLessThan(markup.indexOf('Create as draft'))
+  })
 })
diff --git a/src/renderer/src/components/right-sidebar/SourceControl.hosted-review-header-link.test.tsx b/src/renderer/src/components/right-sidebar/SourceControl.hosted-review-header-link.test.tsx
index ee90c607ada..c3544b4ff1f 100644
--- a/src/renderer/src/components/right-sidebar/SourceControl.hosted-review-header-link.test.tsx
+++ b/src/renderer/src/components/right-sidebar/SourceControl.hosted-review-header-link.test.tsx
@@ -8,7 +8,8 @@ const { openHttpLinkMock } = vi.hoisted(() => ({ openHttpLinkMock: vi.fn() }))
 
 vi.mock('@/lib/http-link-routing', () => ({
   openHttpLink: openHttpLinkMock,
-  registerHttpLinkStoreAccessor: vi.fn()
+  registerHttpLinkStoreAccessor: vi.fn(),
+  registerRuntimeHttpLinkBrowserOpener: vi.fn()
 }))
 
 function makeReview(overrides: Partial<HostedReviewInfo> = {}): HostedReviewInfo {
diff --git a/src/renderer/src/components/right-sidebar/SourceControl.tsx b/src/renderer/src/components/right-sidebar/SourceControl.tsx
index d70ad7dc4d8..bbfe20317f5 100644
--- a/src/renderer/src/components/right-sidebar/SourceControl.tsx
+++ b/src/renderer/src/components/right-sidebar/SourceControl.tsx
@@ -246,6 +246,8 @@ import {
 } from './source-control-pull-policy-error-notice'
 import { SourceControlTextGenerationDialog } from './SourceControlTextGenerationDialog'
 import { CreateHostedReviewComposer } from './CreateHostedReviewComposer'
+import { useHostedReviewStackParent } from './useHostedReviewStackParent'
+import { resolveCreatedHostedReviewLink } from './source-control-created-review-link'
 import {
   hasConfiguredCommitMessageGenerationDefaults,
   hasConfiguredSourceControlTextGenerationDefaults
@@ -910,6 +912,7 @@ function SourceControlInner(): React.JSX.Element {
     (s) => s.getHostedReviewCreationEligibility
   )
   const createHostedReview = useAppStore((s) => s.createHostedReview)
+  const createStackedHostedReview = useAppStore((s) => s.createStackedHostedReview)
   const updateWorktreeMeta = useAppStore((s) => s.updateWorktreeMeta)
   const fetchPRForBranch = useAppStore((s) => s.fetchPRForBranch)
   const enqueueGitHubPRRefresh = useAppStore((s) => s.enqueueGitHubPRRefresh)
@@ -2753,26 +2756,18 @@ function SourceControlInner(): React.JSX.Element {
         setRightSidebarTab('checks')
       }
       try {
-        if (worktreeId && result.provider === 'github') {
-          await updateWorktreeMeta(worktreeId, { linkedPR: result.number })
-        }
-        if (worktreeId && result.provider === 'gitlab') {
-          await updateWorktreeMeta(worktreeId, { linkedGitLabMR: result.number })
-        }
-        if (worktreeId && result.provider === 'azure-devops') {
-          await updateWorktreeMeta(worktreeId, { linkedAzureDevOpsPR: result.number })
-        }
-        if (worktreeId && result.provider === 'gitea') {
-          await updateWorktreeMeta(worktreeId, { linkedGiteaPR: result.number })
+        const createdLink = resolveCreatedHostedReviewLink(result.provider, result.number)
+        if (worktreeId && result.provider !== 'unsupported') {
+          await updateWorktreeMeta(worktreeId, createdLink.worktree)
         }
         const linkedReviewNumbers = {
-          linkedGitHubPR: result.provider === 'github' ? result.number : linkedGitHubPR,
+          linkedGitHubPR,
           fallbackGitHubPR: fallbackGitHubPRNumber,
-          linkedGitLabMR: result.provider === 'gitlab' ? result.number : linkedGitLabMR,
+          linkedGitLabMR,
           linkedBitbucketPR,
-          linkedAzureDevOpsPR:
-            result.provider === 'azure-devops' ? result.number : linkedAzureDevOpsPR,
-          linkedGiteaPR: result.provider === 'gitea' ? result.number : linkedGiteaPR
+          linkedAzureDevOpsPR,
+          linkedGiteaPR,
+          ...createdLink.lookup
         }
         if (result.provider === 'gitlab') {
           await fetchHostedReviewForBranch(repoPath, branch, {
@@ -3020,10 +3015,13 @@ function SourceControlInner(): React.JSX.Element {
     setBody: setPrBody,
     draft: prDraft,
     setDraft: setPrDraft,
+    stackedCreationSupported: prStackedCreationSupported,
+    repoDefaultBaseRef: prRepoDefaultBaseRef,
     baseQuery: prBaseQuery,
     setBaseQuery: setPrBaseQuery,
     baseResults: prBaseResults,
     setBaseResults: setPrBaseResults,
+    baseSearchPending: prBaseSearchPending,
     baseSearchError: prBaseSearchError,
     generating: prGenerating,
     generateError: prGenerateError,
@@ -3060,6 +3058,17 @@ function SourceControlInner(): React.JSX.Element {
       onCancelGenerate: handleCancelGeneratePullRequestFieldsForActive
     }
   })
+  const stackParentReview = useHostedReviewStackParent({
+    enabled: hostedReviewCreateProvider === 'github' && prStackedCreationSupported,
+    repoPath: activeRepo?.path ?? '',
+    repoId: activeRepo?.id ?? null,
+    base: prBase,
+    // Why: the repo default, not eligibility's defaultBaseRef — that one resolves to
+    // the worktree's own base, which is exactly the branch a stacked PR targets.
+    repoDefaultBase: prRepoDefaultBaseRef,
+    head: branchName,
+    fetchHostedReviewForBranch
+  })
 
   const handleGeneratePullRequestFieldsClick = useCallback((): void => {
     if (!sourceControlAiActionsVisible) {
@@ -3280,163 +3289,184 @@ function SourceControlInner(): React.JSX.Element {
     worktreePath
   ])
 
-  const handleCreatePullRequest = useCallback(async (): Promise<void> => {
-    if (
-      !activeRepo ||
-      !activeWorktreeId ||
-      !worktreePath ||
-      !hostedReviewCreation ||
-      prGenerating ||
-      createPrInFlightRef.current[activeWorktreeId]
-    ) {
-      return
-    }
-
-    if (!hostedReviewCreation.canCreate) {
-      // Why: blocked Create Review clicks are intentional; the inline notice tells the user which prerequisite to clear.
-      const message = resolveBlockedCreateReviewNoticeMessage(hostedReviewCreation)
-      if (message) {
-        setCreatePrIntentNoticeForWorktree(activeWorktreeId, {
-          tone: 'destructive',
-          message
-        })
+  const handleCreatePullRequest = useCallback(
+    async (stacked = false): Promise<void> => {
+      if (
+        !activeRepo ||
+        !activeWorktreeId ||
+        !worktreePath ||
+        !hostedReviewCreation ||
+        prGenerating ||
+        createPrInFlightRef.current[activeWorktreeId]
+      ) {
+        return
       }
-      return
-    }
 
-    const base = stripBaseRef(prBase).trim()
-    const title = prTitle.trim()
-
-    if (!title) {
-      setCreatePrIntentNoticeForWorktree(activeWorktreeId, {
-        tone: 'destructive',
-        message: translate(
-          'auto.components.right.sidebar.SourceControl.f3a8b2c1d0e5',
-          'Enter a {{value0}} title.',
-          { value0: hostedReviewCreateCopy.reviewLabel }
-        )
-      })
-      return
-    }
-
-    if (!base || stripBaseRef(base).toLowerCase() === stripBaseRef(branchName).toLowerCase()) {
-      setCreatePrIntentNoticeForWorktree(activeWorktreeId, {
-        tone: 'destructive',
-        message: translate(
-          'auto.components.right.sidebar.SourceControl.ae743199cd',
-          'Choose a different base branch before creating a {{value0}}.',
-          { value0: hostedReviewCreateCopy.reviewLabel }
-        )
-      })
-      return
-    }
-
-    createPrInFlightRef.current[activeWorktreeId] = true
-    setCreatePrInFlightByWorktree((prev) => ({ ...prev, [activeWorktreeId]: true }))
-    setCreatePrIntentNoticeForWorktree(activeWorktreeId, null)
-    try {
-      const result = await createHostedReview(activeRepo.path, {
-        repoId: activeRepo.id,
-        provider: hostedReviewCreateProvider,
-        base,
-        head: normalizeHostedReviewHeadRef(branchName),
-        title,
-        body: prBody,
-        draft: prDraft,
-        worktreePath,
-        useTemplate: resolvedPrCreationDefaults.useTemplate
-      })
-
-      if (result.ok) {
-        setCreatePrIntentNoticeForWorktree(activeWorktreeId, null)
-        await handlePullRequestCreated({
-          provider: hostedReviewCreateProvider,
-          number: result.number,
-          url: result.url
-        })
-        if (resolvedPrCreationDefaults.openAfterCreate) {
-          window.api.shell.openUrl(result.url)
+      if (!hostedReviewCreation.canCreate) {
+        // Why: blocked Create Review clicks are intentional; the inline notice tells the user which prerequisite to clear.
+        const message = resolveBlockedCreateReviewNoticeMessage(hostedReviewCreation)
+        if (message) {
+          setCreatePrIntentNoticeForWorktree(activeWorktreeId, {
+            tone: 'destructive',
+            message
+          })
         }
         return
       }
 
-      if (result.existingReview?.url) {
-        const number = result.existingReview.number
-        toast.success(
-          number
-            ? translate(
-                'auto.components.right.sidebar.SourceControl.eef5446523',
-                '{{value0}} #{{value1}} is already open',
-                { value0: hostedReviewCreateCopy.titleLabel, value1: number }
-              )
-            : translate(
-                'auto.components.right.sidebar.SourceControl.d6fb1df5fe',
-                '{{value0}} is already open',
-                { value0: hostedReviewCreateCopy.titleLabel }
-              ),
-          {
-            action: {
-              label: translate(
-                'auto.components.right.sidebar.SourceControl.812cb992ee',
-                'Open on {{value0}}',
-                { value0: hostedReviewCreateCopy.providerName }
-              ),
-              onClick: () => window.api.shell.openUrl(result.existingReview!.url)
-            }
-          }
-        )
-        if (number) {
+      const base = stripBaseRef(prBase).trim()
+      const title = prTitle.trim()
+
+      if (!title) {
+        setCreatePrIntentNoticeForWorktree(activeWorktreeId, {
+          tone: 'destructive',
+          message: translate(
+            'auto.components.right.sidebar.SourceControl.f3a8b2c1d0e5',
+            'Enter a {{value0}} title.',
+            { value0: hostedReviewCreateCopy.reviewLabel }
+          )
+        })
+        return
+      }
+
+      if (!base || stripBaseRef(base).toLowerCase() === stripBaseRef(branchName).toLowerCase()) {
+        setCreatePrIntentNoticeForWorktree(activeWorktreeId, {
+          tone: 'destructive',
+          message: translate(
+            'auto.components.right.sidebar.SourceControl.ae743199cd',
+            'Choose a different base branch before creating a {{value0}}.',
+            { value0: hostedReviewCreateCopy.reviewLabel }
+          )
+        })
+        return
+      }
+
+      createPrInFlightRef.current[activeWorktreeId] = true
+      setCreatePrInFlightByWorktree((prev) => ({ ...prev, [activeWorktreeId]: true }))
+      setCreatePrIntentNoticeForWorktree(activeWorktreeId, null)
+      try {
+        const createInput = {
+          repoId: activeRepo.id,
+          provider: hostedReviewCreateProvider,
+          base,
+          head: normalizeHostedReviewHeadRef(branchName),
+          title,
+          body: prBody,
+          draft: prDraft,
+          worktreePath,
+          useTemplate: resolvedPrCreationDefaults.useTemplate
+        }
+        const result = stacked
+          ? await createStackedHostedReview(activeRepo.path, createInput)
+          : await createHostedReview(activeRepo.path, createInput)
+
+        if (result.ok) {
           setCreatePrIntentNoticeForWorktree(activeWorktreeId, null)
           await handlePullRequestCreated({
             provider: hostedReviewCreateProvider,
-            number,
-            url: result.existingReview.url
+            number: result.number,
+            url: result.url
           })
+          if (resolvedPrCreationDefaults.openAfterCreate) {
+            window.api.shell.openUrl(result.url)
+          }
           return
         }
-      }
 
-      setCreatePrIntentNoticeForWorktree(activeWorktreeId, {
-        tone: 'destructive',
-        message: result.error
-      })
-    } catch (error) {
-      setCreatePrIntentNoticeForWorktree(activeWorktreeId, {
-        tone: 'destructive',
-        message:
-          error instanceof Error
-            ? error.message
-            : translate(
-                'auto.components.right.sidebar.SourceControl.e2b7a1c0d9f4',
-                'Failed to create {{value0}}',
-                { value0: hostedReviewCreateCopy.reviewLabel }
-              )
-      })
-    } finally {
-      createPrInFlightRef.current[activeWorktreeId] = false
-      setCreatePrInFlightByWorktree((prev) => ({ ...prev, [activeWorktreeId]: false }))
-    }
-  }, [
-    activeRepo,
-    activeWorktreeId,
-    branchName,
-    createHostedReview,
-    handlePullRequestCreated,
-    hostedReviewCreation,
-    hostedReviewCreateCopy.providerName,
-    hostedReviewCreateCopy.reviewLabel,
-    hostedReviewCreateCopy.titleLabel,
-    hostedReviewCreateProvider,
-    prBase,
-    prBody,
-    prDraft,
-    prGenerating,
-    prTitle,
-    resolvedPrCreationDefaults.openAfterCreate,
-    resolvedPrCreationDefaults.useTemplate,
-    setCreatePrIntentNoticeForWorktree,
-    worktreePath
-  ])
+        if ('existingReview' in result && result.existingReview?.url) {
+          const number = result.existingReview.number
+          toast.success(
+            number
+              ? translate(
+                  'auto.components.right.sidebar.SourceControl.eef5446523',
+                  '{{value0}} #{{value1}} is already open',
+                  { value0: hostedReviewCreateCopy.titleLabel, value1: number }
+                )
+              : translate(
+                  'auto.components.right.sidebar.SourceControl.d6fb1df5fe',
+                  '{{value0}} is already open',
+                  { value0: hostedReviewCreateCopy.titleLabel }
+                ),
+            {
+              action: {
+                label: translate(
+                  'auto.components.right.sidebar.SourceControl.812cb992ee',
+                  'Open on {{value0}}',
+                  { value0: hostedReviewCreateCopy.providerName }
+                ),
+                onClick: () => window.api.shell.openUrl(result.existingReview!.url)
+              }
+            }
+          )
+          if (number) {
+            setCreatePrIntentNoticeForWorktree(activeWorktreeId, null)
+            await handlePullRequestCreated({
+              provider: hostedReviewCreateProvider,
+              number,
+              url: result.existingReview.url
+            })
+            return
+          }
+        }
+
+        // Why: stacked creation can create the pull request and still fail to register
+        // the stack. Link the review that exists before surfacing the stack failure, or
+        // the workspace stays unaware of a PR the user can already see on GitHub.
+        if ('createdReview' in result && result.createdReview?.url) {
+          const { number, url } = result.createdReview
+          if (number) {
+            await handlePullRequestCreated({
+              provider: hostedReviewCreateProvider,
+              number,
+              url
+            })
+          }
+        }
+
+        setCreatePrIntentNoticeForWorktree(activeWorktreeId, {
+          tone: 'destructive',
+          message: result.error
+        })
+      } catch (error) {
+        setCreatePrIntentNoticeForWorktree(activeWorktreeId, {
+          tone: 'destructive',
+          message:
+            error instanceof Error
+              ? error.message
+              : translate(
+                  'auto.components.right.sidebar.SourceControl.e2b7a1c0d9f4',
+                  'Failed to create {{value0}}',
+                  { value0: hostedReviewCreateCopy.reviewLabel }
+                )
+        })
+      } finally {
+        createPrInFlightRef.current[activeWorktreeId] = false
+        setCreatePrInFlightByWorktree((prev) => ({ ...prev, [activeWorktreeId]: false }))
+      }
+    },
+    [
+      activeRepo,
+      activeWorktreeId,
+      branchName,
+      createHostedReview,
+      createStackedHostedReview,
+      handlePullRequestCreated,
+      hostedReviewCreation,
+      hostedReviewCreateCopy.providerName,
+      hostedReviewCreateCopy.reviewLabel,
+      hostedReviewCreateCopy.titleLabel,
+      hostedReviewCreateProvider,
+      prBase,
+      prBody,
+      prDraft,
+      prGenerating,
+      prTitle,
+      resolvedPrCreationDefaults.openAfterCreate,
+      resolvedPrCreationDefaults.useTemplate,
+      setCreatePrIntentNoticeForWorktree,
+      worktreePath
+    ]
+  )
 
   const createHostedReviewForCreatePrIntent = useCallback(
     async (
@@ -5817,9 +5847,11 @@ function SourceControlInner(): React.JSX.Element {
           {shouldRenderCommitArea(unresolvedConflicts.length, conflictOperation) &&
             (directCreatePrAction ? (
               <CreateHostedReviewComposer
+                key={`${activeRepo?.id ?? ''}:${activeWorktreeId ?? worktreePath ?? ''}:${branchName}`}
                 provider={hostedReviewCreateProvider}
                 branch={branchName}
                 base={prBase}
+                repoDefaultBase={prRepoDefaultBaseRef}
                 setBase={setPrBase}
                 title={prTitle}
                 setTitle={setPrTitle}
@@ -5827,10 +5859,13 @@ function SourceControlInner(): React.JSX.Element {
                 setBody={setPrBody}
                 draft={prDraft}
                 setDraft={setPrDraft}
+                stackedCreationSupported={prStackedCreationSupported}
+                stackParentReview={stackParentReview}
                 baseQuery={prBaseQuery}
                 setBaseQuery={setPrBaseQuery}
                 baseResults={prBaseResults}
                 setBaseResults={setPrBaseResults}
+                baseSearchPending={prBaseSearchPending}
                 baseSearchError={prBaseSearchError}
                 aiGenerationEnabled={sourceControlAiActionsVisible && prAiGenerationEnabled}
                 generating={prGenerating}
@@ -5845,8 +5880,8 @@ function SourceControlInner(): React.JSX.Element {
                 dropdownItems={dropdownItems}
                 onGenerate={handleGeneratePullRequestFieldsClick}
                 onCancelGenerate={handleCancelGeneratePullRequestFields}
-                onPrimaryAction={() => {
-                  void handleCreatePullRequest()
+                onPrimaryAction={(stacked) => {
+                  void handleCreatePullRequest(stacked)
                 }}
                 onDropdownAction={handleActionInvoke}
               />
diff --git a/src/renderer/src/components/right-sidebar/ai-vault-session-publication-gate.test.ts b/src/renderer/src/components/right-sidebar/ai-vault-session-publication-gate.test.ts
new file mode 100644
index 00000000000..9d10440e1b0
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/ai-vault-session-publication-gate.test.ts
@@ -0,0 +1,78 @@
+// @vitest-environment happy-dom
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AiVaultListResult } from '../../../../shared/ai-vault-types'
+import {
+  markInputQuietSchedulerInput,
+  resetInputQuietSchedulerForTest
+} from '@/lib/input-quiet-scheduler'
+import { AiVaultSessionPublicationGate } from './ai-vault-session-publication-gate'
+
+const FIRST: AiVaultListResult = {
+  sessions: [],
+  issues: [],
+  scannedAt: '2026-08-09T00:00:00.000Z'
+}
+const SECOND: AiVaultListResult = {
+  ...FIRST,
+  scannedAt: '2026-08-09T00:00:01.000Z'
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  resetInputQuietSchedulerForTest()
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('AiVaultSessionPublicationGate', () => {
+  it('publishes immediately when terminal input is already quiet', () => {
+    const apply = vi.fn()
+
+    new AiVaultSessionPublicationGate().publish(FIRST, apply)
+
+    expect(apply).toHaveBeenCalledWith(FIRST)
+  })
+
+  it('retains only the newest result while input is active', () => {
+    const apply = vi.fn()
+    const gate = new AiVaultSessionPublicationGate()
+    markInputQuietSchedulerInput()
+
+    gate.publish(FIRST, apply)
+    gate.publish(SECOND, apply)
+    vi.advanceTimersByTime(101)
+
+    expect(apply).toHaveBeenCalledOnce()
+    expect(apply).toHaveBeenCalledWith(SECOND)
+  })
+
+  it('publishes by one second even when input never becomes quiet', () => {
+    const apply = vi.fn()
+    const gate = new AiVaultSessionPublicationGate()
+    markInputQuietSchedulerInput()
+    gate.publish(FIRST, apply)
+
+    for (let elapsed = 90; elapsed < 1_000; elapsed += 90) {
+      vi.advanceTimersByTime(90)
+      markInputQuietSchedulerInput()
+    }
+    vi.advanceTimersByTime(10)
+
+    expect(apply).toHaveBeenCalledWith(FIRST)
+  })
+
+  it('cancels a pending publication on scope change or unmount', () => {
+    const apply = vi.fn()
+    const gate = new AiVaultSessionPublicationGate()
+    markInputQuietSchedulerInput()
+    gate.publish(FIRST, apply)
+
+    gate.cancel()
+    vi.advanceTimersByTime(1_000)
+
+    expect(apply).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/ai-vault-session-publication-gate.ts b/src/renderer/src/components/right-sidebar/ai-vault-session-publication-gate.ts
new file mode 100644
index 00000000000..325c2b51910
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/ai-vault-session-publication-gate.ts
@@ -0,0 +1,41 @@
+import { startTransition } from 'react'
+import type { AiVaultListResult } from '../../../../shared/ai-vault-types'
+import { hasInputBeenQuietFor, scheduleAfterInputQuiet } from '@/lib/input-quiet-scheduler'
+
+const AI_VAULT_PUBLICATION_QUIET_MS = 100
+const AI_VAULT_PUBLICATION_MAX_WAIT_MS = 1_000
+
+export class AiVaultSessionPublicationGate {
+  private generation = 0
+  private cancelPending: (() => void) | null = null
+
+  publish(result: AiVaultListResult, apply: (result: AiVaultListResult) => void): void {
+    this.cancel()
+    const generation = this.generation
+    if (hasInputBeenQuietFor(AI_VAULT_PUBLICATION_QUIET_MS)) {
+      startTransition(() => apply(result))
+      return
+    }
+    this.cancelPending = scheduleAfterInputQuiet(
+      () => {
+        if (generation !== this.generation) {
+          return
+        }
+        this.cancelPending = null
+        startTransition(() => apply(result))
+      },
+      {
+        delayMs: 0,
+        quietMs: AI_VAULT_PUBLICATION_QUIET_MS,
+        idleTimeoutMs: AI_VAULT_PUBLICATION_QUIET_MS,
+        maxWaitMs: AI_VAULT_PUBLICATION_MAX_WAIT_MS
+      }
+    )
+  }
+
+  cancel(): void {
+    this.generation += 1
+    this.cancelPending?.()
+    this.cancelPending = null
+  }
+}
diff --git a/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts b/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts
index d991a9510e1..e0d9eea9b3e 100644
--- a/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts
+++ b/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts
@@ -7,6 +7,7 @@ import {
 import type { ExecutionHostScope } from '../../../../shared/execution-host'
 import { useAppStore } from '@/store'
 import type { AiVaultSessionLimit } from './ai-vault-session-limit'
+import { AiVaultSessionPublicationGate } from './ai-vault-session-publication-gate'
 import {
   aiVaultSessionResultCacheKey,
   cacheAiVaultSessionResult,
@@ -53,6 +54,7 @@ export function useAiVaultSessionRefresh(
   const pendingBackgroundRef = useRef(true)
   const lastAppliedScanRef = useRef<{ scopeKey: string; scannedAt: string } | null>(null)
   const mountedRef = useRef(true)
+  const publicationGateRef = useRef(new AiVaultSessionPublicationGate())
   const scanScopeKey = `${aiVaultSessionResultCacheKey(executionHostScope, scopePaths)}\n${sessionLimit}`
   const scopePathsRef = useRef<readonly string[]>(scopePaths)
   scopePathsRef.current = scopePaths
@@ -89,8 +91,10 @@ export function useAiVaultSessionRefresh(
         const scanKey = `${baseKey}\n${selectedLimit}`
         lastAppliedScanRef.current = { scopeKey: scanKey, scannedAt: cachedResult.scannedAt }
         setError(null)
-        setScanResult(cachedResult)
-        setSessions(cachedResult.sessions)
+        publicationGateRef.current.publish(cachedResult, (published) => {
+          setScanResult(published)
+          setSessions(published.sessions)
+        })
         setLoading(false)
         return
       }
@@ -155,8 +159,12 @@ export function useAiVaultSessionRefresh(
           result,
           replaceHostEntries: args.force === true
         })
-        setScanResult(result)
-        setSessions(result.sessions)
+        publicationGateRef.current.publish(result, (published) => {
+          if (mountedRef.current && scanKey === currentScanScopeKey()) {
+            setScanResult(published)
+            setSessions(published.sessions)
+          }
+        })
       } catch (err) {
         // A cancelled scan is not a failure: another caller's forced refresh
         // preempts the shared scan, and painting its abort would replace the
@@ -214,8 +222,10 @@ export function useAiVaultSessionRefresh(
   useEffect(() => {
     mountedRef.current = true
     const requestToken = requestTokenRef.current
+    const publicationGate = publicationGateRef.current
     return () => {
       mountedRef.current = false
+      publicationGate.cancel()
       refreshIdRef.current += 1
       refreshInFlightRef.current = false
       void window.api.aiVault.cancelListSessions({
@@ -230,6 +240,7 @@ export function useAiVaultSessionRefresh(
 
   // Panel entry reuses the renderer result first, then the host scan cache.
   useEffect(() => {
+    publicationGateRef.current.cancel()
     if (refreshInFlightRef.current) {
       void window.api.aiVault.cancelListSessions({
         requestToken: requestTokenRef.current
diff --git a/src/renderer/src/components/right-sidebar/buildSourceControlAgentDeliveryPlan.ts b/src/renderer/src/components/right-sidebar/buildSourceControlAgentDeliveryPlan.ts
index d4edcd5a62f..7093101eeee 100644
--- a/src/renderer/src/components/right-sidebar/buildSourceControlAgentDeliveryPlan.ts
+++ b/src/renderer/src/components/right-sidebar/buildSourceControlAgentDeliveryPlan.ts
@@ -3,7 +3,7 @@ import { useAppStore } from '@/store'
 import type { TuiAgent } from '../../../../shared/types'
 import type { SourceControlAgentActionDeliveryPlanState } from './SourceControlAgentActionDialogForm'
 import { buildSourceControlAgentConnectionErrorPlan } from './source-control-agent-action-dialog-support'
-import { resolveNativeChatLaunchSessionOptions } from '@/components/native-chat/native-chat-session-option-enrichment'
+import { resolveInitialNativeChatSessionOptions } from '@/components/native-chat/native-chat-launch-session-options'
 
 type BuildSourceControlAgentDeliveryPlanArgs = {
   selectedAgent: TuiAgent | null
@@ -31,21 +31,24 @@ export function buildSourceControlAgentDeliveryPlan({
   if (connectionUnavailable) {
     return buildSourceControlAgentConnectionErrorPlan()
   }
+  const settings = useAppStore.getState().settings
   const result = planSourceControlAgentActionLaunch({
     agent: selectedAgent,
     commandInput,
     agentArgs,
     sessionOptions: selectedAgent
-      ? resolveNativeChatLaunchSessionOptions(
-          useAppStore.getState().settings?.nativeChatSessionOptions,
-          selectedAgent
-        )
+      ? resolveInitialNativeChatSessionOptions(settings, {
+          agent: selectedAgent,
+          promptDelivery,
+          launchDraftText: commandInput.trim(),
+          nativeChatTranscriptIsLocalReadable: !isRemote
+        })
       : undefined,
     promptDelivery,
     detectedAgents,
-    disabledAgents: useAppStore.getState().settings?.disabledTuiAgents,
-    cmdOverrides: useAppStore.getState().settings?.agentCmdOverrides,
-    terminalWindowsShell: useAppStore.getState().settings?.terminalWindowsShell,
+    disabledAgents: settings?.disabledTuiAgents,
+    cmdOverrides: settings?.agentCmdOverrides,
+    terminalWindowsShell: settings?.terminalWindowsShell,
     platform: launchPlatform,
     isRemote
   })
diff --git a/src/renderer/src/components/right-sidebar/checks-list-expanded-details.test.tsx b/src/renderer/src/components/right-sidebar/checks-list-expanded-details.test.tsx
index 1a4bfdd8b58..8555d53b345 100644
--- a/src/renderer/src/components/right-sidebar/checks-list-expanded-details.test.tsx
+++ b/src/renderer/src/components/right-sidebar/checks-list-expanded-details.test.tsx
@@ -7,6 +7,8 @@ import { TooltipProvider } from '@/components/ui/tooltip'
 import type { PRCheckDetail, PRCheckRunDetails } from '../../../../shared/types'
 import { ChecksList } from './checks-panel-content'
 
+globalThis.IS_REACT_ACT_ENVIRONMENT = true
+
 const openCheckRunDetails = vi.fn()
 const patchOpenCheckRunDetails = vi.fn()
 const activeWorktreeState = vi.hoisted(() => ({
@@ -84,6 +86,7 @@ function renderChecksList(
   props: Partial<{
     worktreeId: string
     detailsStickySurface: 'sidebar' | 'card'
+    checkDetailsContextKey: string
     checks: PRCheckDetail[]
     onLoadCheckDetails: (check: PRCheckDetail) => Promise<PRCheckRunDetails | null>
   }> = {}
@@ -94,7 +97,7 @@ function renderChecksList(
         <ChecksList
           checks={props.checks ?? [failingCheck]}
           checksLoading={false}
-          checkDetailsContextKey="repo:42"
+          checkDetailsContextKey={props.checkDetailsContextKey ?? 'repo:42'}
           worktreeId={props.worktreeId}
           detailsStickySurface={props.detailsStickySurface ?? 'sidebar'}
           onLoadCheckDetails={
@@ -212,6 +215,152 @@ describe('ChecksList expanded check details', () => {
     expect(stickyBar?.textContent).not.toContain('View full logs')
   })
 
+  it('finishes the full-details tab when its sidebar unmounts during loading', async () => {
+    let resolveDetails: (details: PRCheckRunDetails) => void = () => {}
+    const request = new Promise<PRCheckRunDetails>((resolve) => {
+      resolveDetails = resolve
+    })
+    renderChecksList({ worktreeId: 'wt-child-1', onLoadCheckDetails: () => request })
+
+    await act(async () => {
+      await Promise.resolve()
+    })
+    patchOpenCheckRunDetails.mockClear()
+    const button = [...container.querySelectorAll('button')].find((candidate) =>
+      candidate.textContent?.includes('View full details')
+    )
+
+    act(() => {
+      button!.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+      root.render(<div />)
+    })
+    await act(async () => {
+      resolveDetails(checkDetails)
+      await request
+    })
+
+    expect(patchOpenCheckRunDetails).toHaveBeenCalledWith(
+      'wt-child-1',
+      'repo:42',
+      failingCheck,
+      expect.objectContaining({ details: checkDetails, loading: false, error: null })
+    )
+  })
+
+  it('shows a load error in the full-details tab after its sidebar unmounts', async () => {
+    let rejectDetails: (error: Error) => void = () => {}
+    const request = new Promise<PRCheckRunDetails>((_resolve, reject) => {
+      rejectDetails = reject
+    })
+    renderChecksList({ worktreeId: 'wt-child-1', onLoadCheckDetails: () => request })
+
+    await act(async () => {
+      await Promise.resolve()
+    })
+    patchOpenCheckRunDetails.mockClear()
+    const button = [...container.querySelectorAll('button')].find((candidate) =>
+      candidate.textContent?.includes('View full details')
+    )
+
+    act(() => {
+      button!.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+      root.render(<div />)
+    })
+    await act(async () => {
+      rejectDetails(new Error('GitHub request failed'))
+      await request.catch(() => undefined)
+    })
+
+    expect(patchOpenCheckRunDetails).toHaveBeenCalledWith(
+      'wt-child-1',
+      'repo:42',
+      failingCheck,
+      expect.objectContaining({ details: null, loading: false, error: 'GitHub request failed' })
+    )
+  })
+
+  it('retries an inline details error', async () => {
+    let resolveRetry: (details: PRCheckRunDetails) => void = () => {}
+    const retryRequest = new Promise<PRCheckRunDetails>((resolve) => {
+      resolveRetry = resolve
+    })
+    const onLoadCheckDetails = vi
+      .fn<() => Promise<PRCheckRunDetails | null>>()
+      .mockRejectedValueOnce(new Error('GitHub request failed'))
+      .mockReturnValueOnce(retryRequest)
+    renderChecksList({ onLoadCheckDetails })
+
+    await act(async () => {
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+    const retry = [...container.querySelectorAll('button')].find(
+      (candidate) => candidate.textContent?.trim() === 'Retry'
+    )
+    retry!.focus()
+
+    await act(async () => {
+      retry!.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+      await Promise.resolve()
+    })
+
+    expect(onLoadCheckDetails).toHaveBeenCalledTimes(2)
+    expect(document.activeElement).toBe(retry)
+    expect(retry?.disabled).toBe(true)
+    expect(retry?.textContent).toContain('Retrying…')
+    expect(retry?.getAttribute('aria-busy')).toBe('true')
+    expect(container.textContent).toContain('GitHub request failed')
+
+    await act(async () => {
+      resolveRetry(checkDetails)
+      await retryRequest
+    })
+
+    expect(container.textContent).toContain('Verify failed')
+  })
+
+  it('ignores a stale inline result after returning to the same context', async () => {
+    const requests: {
+      resolve: (details: PRCheckRunDetails) => void
+      reject: (error: Error) => void
+    }[] = []
+    const onLoadCheckDetails = vi.fn(
+      () =>
+        new Promise<PRCheckRunDetails>((resolve, reject) => {
+          requests.push({ resolve, reject })
+        })
+    )
+
+    renderChecksList({ checkDetailsContextKey: 'repo:A', onLoadCheckDetails })
+    await act(async () => {
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+    renderChecksList({ checkDetailsContextKey: 'repo:B', onLoadCheckDetails })
+    await act(async () => {
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+    renderChecksList({ checkDetailsContextKey: 'repo:A', onLoadCheckDetails })
+    await act(async () => {
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+
+    expect(requests).toHaveLength(3)
+    await act(async () => {
+      requests[2]!.resolve(checkDetails)
+      await Promise.resolve()
+    })
+    await act(async () => {
+      requests[0]!.reject(new Error('stale request failed'))
+      await Promise.resolve()
+    })
+
+    expect(container.textContent).toContain('Verify failed')
+    expect(container.textContent).not.toContain('stale request failed')
+  })
+
   it('uses resolved details when showing the action-required fallback hint', async () => {
     renderChecksList({
       onLoadCheckDetails: async () => ({
diff --git a/src/renderer/src/components/right-sidebar/checks-panel-content.tsx b/src/renderer/src/components/right-sidebar/checks-panel-content.tsx
index 2b2b695b189..ad0824e424f 100644
--- a/src/renderer/src/components/right-sidebar/checks-panel-content.tsx
+++ b/src/renderer/src/components/right-sidebar/checks-panel-content.tsx
@@ -60,22 +60,28 @@ import { CheckJobLogTail } from './check-job-log-tail'
 import {
   filterPRCommentsByAudience,
   getPRCommentAudienceCounts,
-  getPRCommentAudienceEmptyLabel,
   isBotPRComment,
-  normalizePRCommentAuthorLogin,
-  getPrCommentAudienceFilters,
   type PRCommentAudienceFilter
-} from '@/lib/pr-comment-audience'
+} from '../../../../shared/pr-comment-audience'
+import { normalizePRCommentAuthorLogin } from '../../../../shared/pr-bot-author-overrides'
+import {
+  getPRCommentAudienceEmptyLabel,
+  getPrCommentAudienceFilters
+} from '@/lib/pr-comment-audience-labels'
 import { setPRBotAuthorOverride, usePRBotAuthorOverrides } from '@/lib/pr-bot-author-overrides'
-import { getPRCommentGroupId, groupPRComments, type PRCommentGroup } from '@/lib/pr-comment-groups'
+import {
+  getPRCommentGroupId,
+  groupPRComments,
+  type PRCommentGroup
+} from '../../../../shared/pr-comment-groups'
 import {
   getPRCommentGroupActionState,
   isPRCommentGroupQueueableForAI,
   partitionPRCommentGroupsForTriage,
-  sortPRCommentGroupsForTimeline,
+  sortPRCommentGroupsByRecency,
   type PRCommentGroupActionState
 } from '@/lib/pr-comment-action-state'
-import { formatPrCommentRelativeTime } from '@/lib/pr-comment-time'
+import { formatPrCommentRelativeTime } from '../../../../shared/pr-comment-time'
 import {
   getPRCommentPresentationClasses,
   getPRCommentGroupSurfaceClasses,
@@ -88,6 +94,7 @@ import type {
   PRCheckRunDetails,
   PRComment,
   GitHubReactionContent,
+  GitHubRepositoryIdentity,
   PRConflictSummary,
   PRMergeableState
 } from '../../../../shared/types'
@@ -105,6 +112,7 @@ import { useActiveWorktree } from '@/store/selectors'
 import { useAppStore } from '@/store'
 import { sortChecksBySeverity } from '../../../../shared/pr-check-severity-order'
 import { summarizeProviderChecks } from '../../../../shared/provider-check-summary'
+import { createCheckRunDetailsRequestId } from '@/components/editor/check-run-details-tab'
 
 export const PullRequestIcon = GitPullRequest
 
@@ -542,6 +550,7 @@ export function ConflictTriageStrip({
 }
 
 type CheckDetailsLoadState = {
+  requestId?: number
   loading: boolean
   details: PRCheckRunDetails | null
   error: string | null
@@ -673,7 +682,9 @@ function CheckRunDetails({
   checkDetailsContextKey,
   worktreeId,
   detailsStickySurface = 'sidebar',
-  getGitLabProjectRef
+  getGitLabProjectRef,
+  githubRepository,
+  onRetry
 }: {
   check: PRCheckDetail
   state: CheckDetailsLoadState | undefined
@@ -682,6 +693,8 @@ function CheckRunDetails({
   detailsStickySurface?: CheckDetailsStickySurface
   /** Why: a getter, not a value — the source ref is filled by an async fetch and would read stale during render. */
   getGitLabProjectRef?: () => GitLabProjectRef | null
+  githubRepository?: GitHubRepositoryIdentity | null
+  onRetry: () => void
 }): React.JSX.Element {
   const openCheckRunDetails = useAppStore((s) => s.openCheckRunDetails)
   const details = state?.details
@@ -718,9 +731,11 @@ function CheckRunDetails({
       return
     }
     openCheckRunDetails(worktreeId, checkDetailsContextKey, check, {
+      requestId: state?.requestId,
       details: state?.details ?? null,
       loading: state?.loading ?? false,
       error: state?.error ?? null,
+      githubRepository: githubRepository ?? null,
       gitlabProjectRef: getGitLabProjectRef?.() ?? null
     })
   }
@@ -747,8 +762,8 @@ function CheckRunDetails({
           <ViewFullCheckDetailsButton label={fullDetailsLabel} onClick={handleOpenFullDetails} />
         </div>
       )}
-      {state?.loading ? (
-        <div className="flex min-w-0 flex-col gap-2 py-1.5">
+      {state?.loading && !state.error ? (
+        <div role="status" aria-live="polite" className="flex min-w-0 flex-col gap-2 py-1.5">
           <div className="flex items-center gap-2 text-[12px] text-muted-foreground">
             <LoaderCircle className="size-3.5 animate-spin" />
             {translate(
@@ -805,7 +820,30 @@ function CheckRunDetails({
             )}
           </div>
 
-          {state?.error && <div className="text-[12px] text-muted-foreground">{state.error}</div>}
+          {state?.error && (
+            <div role="alert" className="flex items-center justify-between gap-2">
+              <span className="min-w-0 flex-1 break-words text-[12px] text-destructive">
+                {state.error}
+              </span>
+              <Button
+                type="button"
+                variant="outline"
+                size="xs"
+                className="shrink-0"
+                disabled={state.loading}
+                aria-busy={state.loading}
+                onClick={onRetry}
+              >
+                <RefreshCw className={cn('size-3', state.loading && 'animate-spin')} />
+                {state.loading
+                  ? translate('githubChecks.retrying', 'Retrying…')
+                  : translate(
+                      'auto.components.right.sidebar.checks.panel.content.dcb3c546fe',
+                      'Retry'
+                    )}
+              </Button>
+            </div>
+          )}
 
           {hasOutput && (
             <div className="min-w-0">
@@ -973,7 +1011,8 @@ export function ChecksList({
   onLoadCheckDetails,
   worktreeId: worktreeIdOverride,
   detailsStickySurface = 'sidebar',
-  getGitLabProjectRef
+  getGitLabProjectRef,
+  githubRepository
 }: {
   checks: PRCheckDetail[]
   checksLoading: boolean
@@ -984,6 +1023,7 @@ export function ChecksList({
   detailsStickySurface?: CheckDetailsStickySurface
   /** Why: a getter, not a value — the source ref is filled by an async fetch and would read stale during render. */
   getGitLabProjectRef?: () => GitLabProjectRef | null
+  githubRepository?: GitHubRepositoryIdentity | null
 }): React.JSX.Element {
   const activeWorktree = useActiveWorktree()
   const resolvedWorktreeId = worktreeIdOverride ?? activeWorktree?.id ?? null
@@ -1112,55 +1152,114 @@ export function ChecksList({
         return
       }
       const requestContextKey = checkDetailsContextKey
+      const requestId = createCheckRunDetailsRequestId()
+      const retryError = detailsByCheckKey[row.key]?.error ?? null
       setDetailsByCheckKey((current) => ({
         ...current,
-        [row.key]: { loading: true, details: null, error: null }
+        [row.key]: { requestId, loading: true, details: null, error: retryError }
       }))
-      void onLoadCheckDetails(row.check)
+      if (resolvedWorktreeId) {
+        patchOpenCheckRunDetails(resolvedWorktreeId, requestContextKey, row.check, {
+          requestId,
+          details: null,
+          loading: true,
+          error: retryError,
+          githubRepository: githubRepository ?? null,
+          gitlabProjectRef: getGitLabProjectRef?.() ?? null
+        })
+      }
+      const request = Promise.resolve().then(() => onLoadCheckDetails(row.check))
+      void request
         .then((details) => {
-          if (detailsContextRef.current !== requestContextKey) {
-            return
-          }
-          setDetailsByCheckKey((current) => ({
-            ...current,
-            [row.key]: {
-              loading: false,
+          if (resolvedWorktreeId) {
+            patchOpenCheckRunDetails(resolvedWorktreeId, requestContextKey, row.check, {
+              requestId,
               details,
+              loading: false,
               error: details
                 ? null
                 : translate(
                     'auto.components.right.sidebar.checks.panel.content.e15a8b77ef',
                     'No inline details are available for this check.'
                   ),
-              // Why: a detail-less result is only final for this status — re-arm the retry once the job moves on.
-              errorAt: details
-                ? undefined
-                : { status: row.check.status, conclusion: row.check.conclusion }
-            }
-          }))
-        })
-        .catch((err) => {
+              githubRepository: githubRepository ?? null,
+              gitlabProjectRef: getGitLabProjectRef?.() ?? null
+            })
+          }
           if (detailsContextRef.current !== requestContextKey) {
             return
           }
-          setDetailsByCheckKey((current) => ({
-            ...current,
-            [row.key]: {
-              loading: false,
-              details: null,
-              error:
-                err instanceof Error
-                  ? err.message
-                  : translate(
-                      'auto.components.right.sidebar.checks.panel.content.checkDetailsLoadFailed',
-                      'Failed to load check details.'
-                    ),
-              errorAt: { status: row.check.status, conclusion: row.check.conclusion }
+          setDetailsByCheckKey((current) => {
+            if (current[row.key]?.requestId !== requestId) {
+              return current
             }
-          }))
+            return {
+              ...current,
+              [row.key]: {
+                requestId,
+                loading: false,
+                details,
+                error: details
+                  ? null
+                  : translate(
+                      'auto.components.right.sidebar.checks.panel.content.e15a8b77ef',
+                      'No inline details are available for this check.'
+                    ),
+                // Why: a detail-less result is only final for this status — re-arm the retry once the job moves on.
+                errorAt: details
+                  ? undefined
+                  : { status: row.check.status, conclusion: row.check.conclusion }
+              }
+            }
+          })
+        })
+        .catch((err) => {
+          const error =
+            err instanceof Error
+              ? err.message
+              : translate(
+                  'auto.components.right.sidebar.checks.panel.content.e45324fbed',
+                  'Failed to load check details.'
+                )
+          if (resolvedWorktreeId) {
+            patchOpenCheckRunDetails(resolvedWorktreeId, requestContextKey, row.check, {
+              requestId,
+              details: null,
+              loading: false,
+              error,
+              githubRepository: githubRepository ?? null,
+              gitlabProjectRef: getGitLabProjectRef?.() ?? null
+            })
+          }
+          if (detailsContextRef.current !== requestContextKey) {
+            return
+          }
+          setDetailsByCheckKey((current) => {
+            if (current[row.key]?.requestId !== requestId) {
+              return current
+            }
+            return {
+              ...current,
+              [row.key]: {
+                requestId,
+                loading: false,
+                details: null,
+                error,
+                errorAt: { status: row.check.status, conclusion: row.check.conclusion }
+              }
+            }
+          })
         })
     },
-    [checkDetailsContextKey, detailsByCheckKey, onLoadCheckDetails]
+    [
+      checkDetailsContextKey,
+      detailsByCheckKey,
+      getGitLabProjectRef,
+      githubRepository,
+      onLoadCheckDetails,
+      patchOpenCheckRunDetails,
+      resolvedWorktreeId
+    ]
   )
 
   useEffect(() => {
@@ -1184,9 +1283,11 @@ export function ChecksList({
         continue
       }
       patchOpenCheckRunDetails(resolvedWorktreeId, checkDetailsContextKey, row.check, {
+        requestId: detailsState.requestId,
         details: detailsState.details ?? null,
         loading: detailsState.loading ?? false,
         error: detailsState.error ?? null,
+        githubRepository: githubRepository ?? null,
         gitlabProjectRef: getGitLabProjectRef?.() ?? null
       })
     }
@@ -1194,6 +1295,7 @@ export function ChecksList({
     checkDetailsContextKey,
     detailsByCheckKey,
     getGitLabProjectRef,
+    githubRepository,
     patchOpenCheckRunDetails,
     resolvedWorktreeId,
     rows
@@ -1370,6 +1472,8 @@ export function ChecksList({
                       worktreeId={resolvedWorktreeId}
                       detailsStickySurface={detailsStickySurface}
                       getGitLabProjectRef={getGitLabProjectRef}
+                      githubRepository={githubRepository}
+                      onRetry={() => requestCheckDetails(row)}
                     />
                   )}
                 </div>
@@ -2373,9 +2477,13 @@ export function PRCommentsList({
     [botAuthorOverrides, commentFilter, comments]
   )
   const groups = React.useMemo(() => groupPRComments(visibleComments), [visibleComments])
-  const triageGroups = React.useMemo(() => partitionPRCommentGroupsForTriage(groups), [groups])
-  // Why: triage mode prioritizes actionability; timeline restores the host discussion history.
-  const timelineGroups = React.useMemo(() => sortPRCommentGroupsForTimeline(groups), [groups])
+  const triageGroups = React.useMemo(
+    // Why: grouped sections read newest-first so recent discussion surfaces at the top.
+    () => partitionPRCommentGroupsForTriage(sortPRCommentGroupsByRecency(groups, 'newest-first')),
+    [groups]
+  )
+  // Why: timeline reads oldest-first so the discussion history unfolds in order.
+  const timelineGroups = React.useMemo(() => sortPRCommentGroupsByRecency(groups), [groups])
   const canShowResolveWithAI = Boolean(
     onResolveSelectedCommentsWithAI && selectableGroups.length > 0
   )
diff --git a/src/renderer/src/components/right-sidebar/checks-panel-review-creation.ts b/src/renderer/src/components/right-sidebar/checks-panel-review-creation.ts
index 95c9ccfde97..d0534124397 100644
--- a/src/renderer/src/components/right-sidebar/checks-panel-review-creation.ts
+++ b/src/renderer/src/components/right-sidebar/checks-panel-review-creation.ts
@@ -63,7 +63,7 @@ export function isChecksPanelCreateEligibilityConfirmable(input: {
  * provisional or draft-preserve path.
  */
 export function shouldOpenChecksPanelCreateComposer(input: {
-  activeReview: unknown | null
+  activeReview: unknown
   isFolder: boolean
   branch: string
   hostedReviewCreation: HostedReviewCreationEligibility | null
diff --git a/src/renderer/src/components/right-sidebar/create-hosted-review-button-label.ts b/src/renderer/src/components/right-sidebar/create-hosted-review-button-label.ts
new file mode 100644
index 00000000000..61b56b116ce
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/create-hosted-review-button-label.ts
@@ -0,0 +1,54 @@
+import { translate } from '@/i18n/i18n'
+
+/** Resolves the composer's primary-action label for the current submit shape. */
+export function getCreateButtonLabel({
+  isCreating,
+  pushBeforeCreate,
+  draft,
+  stacked,
+  shortLabel
+}: {
+  isCreating: boolean
+  pushBeforeCreate: boolean
+  draft: boolean
+  stacked: boolean
+  shortLabel: string
+}): string {
+  if (isCreating) {
+    return translate('auto.components.right.sidebar.SourceControl.26511c22b4', 'Creating...')
+  }
+  if (pushBeforeCreate && stacked) {
+    return translate(
+      'auto.components.right.sidebar.create.hosted.review.button.label.96ae7358e0',
+      'Push & Create PR in stack'
+    )
+  }
+  if (pushBeforeCreate) {
+    return translate(
+      'auto.components.right.sidebar.CreateHostedReviewComposer.741ff8a0d2',
+      'Push & Create {{value0}}',
+      { value0: shortLabel }
+    )
+  }
+  if (stacked) {
+    return draft
+      ? translate(
+          'auto.components.right.sidebar.create.hosted.review.button.label.8e8149a0bf',
+          'Create draft PR in stack'
+        )
+      : translate(
+          'auto.components.right.sidebar.create.hosted.review.button.label.8df1a05952',
+          'Create PR in stack'
+        )
+  }
+  if (draft) {
+    return translate(
+      'auto.components.right.sidebar.SourceControl.aaf1451654',
+      'Create draft {{value0}}',
+      { value0: shortLabel }
+    )
+  }
+  return translate('auto.components.right.sidebar.SourceControl.5acbcedc1a', 'Create {{value0}}', {
+    value0: shortLabel
+  })
+}
diff --git a/src/renderer/src/components/right-sidebar/create-hosted-review-composer-field-class.ts b/src/renderer/src/components/right-sidebar/create-hosted-review-composer-field-class.ts
new file mode 100644
index 00000000000..599f0d8c7e8
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/create-hosted-review-composer-field-class.ts
@@ -0,0 +1,13 @@
+// Why: no padding here — a field that adds `pr-*` for a trailing icon would tie with
+// `px-*` on specificity and lose, so each field sets its own. Why `md:text-xs`: the
+// Input primitive steps up to 14px at md, too loud for a sidebar full of branch refs.
+export const COMPOSER_FIELD_CLASS = 'h-8 text-xs md:text-xs'
+
+// Why: mirrors the Input primitive's skin so the description can't drift from the
+// title and base fields it sits between; there is no Textarea primitive to extend.
+export const COMPOSER_TEXTAREA_CLASS =
+  'w-full min-w-0 appearance-none rounded-md border border-input bg-transparent px-2 py-1.5 text-xs shadow-xs outline-none transition-[color,box-shadow] placeholder:text-muted-foreground/60 focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 dark:bg-input/30'
+
+// Why: the Checkbox primitive's default hairline is tuned for card/popover surfaces;
+// on the sidebar it needs the same border token the fields use to stay visible.
+export const COMPOSER_CHECKBOX_CLASS = 'shrink-0 border-input'
diff --git a/src/renderer/src/components/right-sidebar/create-pull-request-review-copy.ts b/src/renderer/src/components/right-sidebar/create-pull-request-review-copy.ts
index 4a9a331a0ec..bedabfb6205 100644
--- a/src/renderer/src/components/right-sidebar/create-pull-request-review-copy.ts
+++ b/src/renderer/src/components/right-sidebar/create-pull-request-review-copy.ts
@@ -1,4 +1,7 @@
-import type { CreateHostedReviewResult } from '../../../../shared/hosted-review'
+import type {
+  CreateHostedReviewResult,
+  CreateStackedHostedReviewResult
+} from '../../../../shared/hosted-review'
 import { translate } from '@/i18n/i18n'
 
 export type { LocalizedHostedReviewCopy as CreatePullRequestReviewCopy } from '@/i18n/hosted-review-localized-copy'
@@ -6,7 +9,7 @@ export type { LocalizedHostedReviewCopy as CreatePullRequestReviewCopy } from '@
 export { localizedHostedReviewCopy as reviewCopy } from '@/i18n/hosted-review-localized-copy'
 
 export function formatCreateError(
-  result: CreateHostedReviewResult,
+  result: CreateHostedReviewResult | CreateStackedHostedReviewResult,
   pushed: boolean,
   shortLabel: string
 ): string {
diff --git a/src/renderer/src/components/right-sidebar/github-pr-stack-confirmation.ts b/src/renderer/src/components/right-sidebar/github-pr-stack-confirmation.ts
new file mode 100644
index 00000000000..e219f68952d
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/github-pr-stack-confirmation.ts
@@ -0,0 +1,93 @@
+import type { ConfirmationDialogOptions } from '@/components/confirmation-dialog-context'
+import { translate } from '@/i18n/i18n'
+import type { GitHubPRMergeMethod, GitHubPRStack } from '../../../../shared/types'
+import { getGitHubPRStackMergeScope } from './github-pr-stack-merge'
+
+export function buildGitHubPRStackMergeConfirmation({
+  stack,
+  currentPRNumber,
+  method,
+  usesMergeQueue
+}: {
+  stack: GitHubPRStack
+  currentPRNumber: number
+  method: GitHubPRMergeMethod
+  usesMergeQueue: boolean
+}): ConfirmationDialogOptions {
+  const scope = getGitHubPRStackMergeScope(stack, currentPRNumber)
+  const numbers = scope.entries.map((entry) => `#${entry.number}`).join(', ')
+  const included =
+    scope.complete && numbers
+      ? translate(
+          'auto.components.right.sidebar.github.pr.stack.confirmation.84f6f5b9eb',
+          'Included: {{numbers}}. ',
+          { numbers }
+        )
+      : ''
+
+  if (usesMergeQueue) {
+    return {
+      title: translate(
+        'auto.components.right.sidebar.github.pr.stack.confirmation.541984b2eb',
+        'Queue through #{{pr}}?',
+        { pr: currentPRNumber }
+      ),
+      description:
+        scope.count === 1
+          ? translate(
+              'auto.components.right.sidebar.github.pr.stack.confirmation.4809f55cdb',
+              '{{included}}GitHub will add {{count}} pull request to the merge queue together. The queue chooses the merge method and may merge them in separate groups.',
+              { included, count: scope.count }
+            )
+          : translate(
+              'auto.components.right.sidebar.github.pr.stack.confirmation.be8f2621be',
+              '{{included}}GitHub will add {{count}} pull requests to the merge queue together. The queue chooses the merge method and may merge them in separate groups.',
+              { included, count: scope.count }
+            ),
+      confirmLabel:
+        scope.count === 1
+          ? translate(
+              'auto.components.right.sidebar.github.pr.stack.confirmation.92ca033e72',
+              'Queue {{count}} PR',
+              { count: scope.count }
+            )
+          : translate(
+              'auto.components.right.sidebar.github.pr.stack.confirmation.478a527b15',
+              'Queue {{count}} PRs',
+              { count: scope.count }
+            )
+    }
+  }
+
+  return {
+    title: translate(
+      'auto.components.right.sidebar.github.pr.stack.confirmation.1feef35ca4',
+      'Merge through #{{pr}}?',
+      { pr: currentPRNumber }
+    ),
+    description:
+      scope.count === 1
+        ? translate(
+            'auto.components.right.sidebar.github.pr.stack.confirmation.c3e036c99f',
+            '{{included}}GitHub will merge {{count}} pull request atomically using {{method}}. If it cannot merge, nothing will be merged.',
+            { included, count: scope.count, method }
+          )
+        : translate(
+            'auto.components.right.sidebar.github.pr.stack.confirmation.369aba4b32',
+            '{{included}}GitHub will merge {{count}} pull requests atomically using {{method}}. If any cannot merge, none will.',
+            { included, count: scope.count, method }
+          ),
+    confirmLabel:
+      scope.count === 1
+        ? translate(
+            'auto.components.right.sidebar.github.pr.stack.confirmation.493c78f521',
+            'Merge {{count}} PR',
+            { count: scope.count }
+          )
+        : translate(
+            'auto.components.right.sidebar.github.pr.stack.confirmation.eb7051d268',
+            'Merge {{count}} PRs',
+            { count: scope.count }
+          )
+  }
+}
diff --git a/src/renderer/src/components/right-sidebar/github-pr-stack-merge.test.ts b/src/renderer/src/components/right-sidebar/github-pr-stack-merge.test.ts
new file mode 100644
index 00000000000..be889a5eb74
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/github-pr-stack-merge.test.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it } from 'vitest'
+import type { GitHubPRStack } from '../../../../shared/types'
+import {
+  getGitHubPRStackMergeBlocker,
+  getGitHubPRStackMergeScope,
+  isGitHubPRStackMergeQueueRequired
+} from './github-pr-stack-merge'
+
+function makeStack(): GitHubPRStack {
+  return {
+    number: 51,
+    position: 2,
+    size: 3,
+    baseRefName: 'main',
+    entries: [
+      {
+        position: 1,
+        number: 201,
+        title: 'Models',
+        url: 'https://example.test/201',
+        state: 'open',
+        checksStatus: 'success',
+        mergeable: 'MERGEABLE'
+      },
+      {
+        position: 2,
+        number: 202,
+        title: 'API',
+        url: 'https://example.test/202',
+        state: 'open',
+        checksStatus: 'success',
+        mergeable: 'MERGEABLE'
+      },
+      {
+        position: 3,
+        number: 203,
+        title: 'UI',
+        url: 'https://example.test/203',
+        state: 'draft',
+        checksStatus: 'neutral',
+        mergeable: 'UNKNOWN'
+      }
+    ]
+  }
+}
+
+describe('GitHub stack merge scope', () => {
+  it('uses stack metadata when review metadata has not observed the merge queue', () => {
+    expect(isGitHubPRStackMergeQueueRequired(false, true)).toBe(true)
+  })
+
+  it('includes the current PR and downstack entries, never upstack entries', () => {
+    const scope = getGitHubPRStackMergeScope(makeStack(), 202)
+
+    expect(scope.entries.map((entry) => entry.number)).toEqual([201, 202])
+    expect(scope.complete).toBe(true)
+    expect(scope.label).toBe('Merge through #202 · 2 PRs')
+    expect(getGitHubPRStackMergeBlocker(scope)).toBeNull()
+  })
+
+  it('keeps the GitHub-reported merge count when entry details are incomplete', () => {
+    const stack = makeStack()
+    stack.entries = stack.entries?.filter((entry) => entry.position !== 1)
+
+    const scope = getGitHubPRStackMergeScope(stack, 202)
+
+    expect(scope.entries.map((entry) => entry.number)).toEqual([202])
+    expect(scope.count).toBe(2)
+    expect(scope.complete).toBe(false)
+    expect(scope.label).toBe('Merge through #202 · 2 PRs')
+  })
+
+  it('surfaces the first downstack blocker', () => {
+    const stack = makeStack()
+    stack.entries![0] = { ...stack.entries![0]!, mergeable: 'CONFLICTING' }
+
+    expect(getGitHubPRStackMergeBlocker(getGitHubPRStackMergeScope(stack, 202))).toBe(
+      '#201 has merge conflicts.'
+    )
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/github-pr-stack-merge.ts b/src/renderer/src/components/right-sidebar/github-pr-stack-merge.ts
new file mode 100644
index 00000000000..8eacfb0380b
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/github-pr-stack-merge.ts
@@ -0,0 +1,100 @@
+import type { GitHubPRStack, GitHubPRStackEntry } from '../../../../shared/types'
+import { translate } from '@/i18n/i18n'
+
+export type GitHubPRStackMergeScope = {
+  count: number
+  complete: boolean
+  entries: GitHubPRStackEntry[]
+  label: string
+}
+
+export function isGitHubPRStackMergeQueueRequired(
+  reviewMergeQueueRequired: boolean | null | undefined,
+  stackMergeQueueRequired: boolean | null | undefined
+): boolean {
+  return reviewMergeQueueRequired === true || stackMergeQueueRequired === true
+}
+
+export function getGitHubPRStackMergeScope(
+  stack: GitHubPRStack,
+  currentPRNumber: number
+): GitHubPRStackMergeScope {
+  const entries = [...(stack.entries ?? [])]
+    .filter((entry) => entry.position <= stack.position)
+    .sort((a, b) => a.position - b.position)
+  const count = stack.position
+  const complete =
+    entries.length === count && entries.every((entry, index) => entry.position === index + 1)
+  return {
+    count,
+    complete,
+    entries,
+    label:
+      count === 1
+        ? translate(
+            'auto.components.right.sidebar.github.pr.stack.merge.55ae29b907',
+            'Merge through #{{pr}} · {{count}} PR',
+            { pr: currentPRNumber, count }
+          )
+        : translate(
+            'auto.components.right.sidebar.github.pr.stack.merge.b8446f6ec2',
+            'Merge through #{{pr}} · {{count}} PRs',
+            { pr: currentPRNumber, count }
+          )
+  }
+}
+
+export function getGitHubPRStackMergeBlocker(scope: GitHubPRStackMergeScope): string | null {
+  for (const entry of scope.entries) {
+    if (entry.state === 'draft') {
+      return translate(
+        'auto.components.right.sidebar.github.pr.stack.merge.189d0ec614',
+        '#{{pr}} is still a draft.',
+        { pr: entry.number }
+      )
+    }
+    if (entry.state === 'closed') {
+      return translate(
+        'auto.components.right.sidebar.github.pr.stack.merge.640fb50d9c',
+        '#{{pr}} is closed.',
+        { pr: entry.number }
+      )
+    }
+    if (entry.mergeable === 'CONFLICTING' || entry.mergeStateStatus === 'DIRTY') {
+      return translate(
+        'auto.components.right.sidebar.github.pr.stack.merge.46ffcbda75',
+        '#{{pr}} has merge conflicts.',
+        { pr: entry.number }
+      )
+    }
+    if (entry.reviewDecision === 'CHANGES_REQUESTED') {
+      return translate(
+        'auto.components.right.sidebar.github.pr.stack.merge.6dabefd63e',
+        '#{{pr}} has requested changes.',
+        { pr: entry.number }
+      )
+    }
+    if (entry.reviewDecision === 'REVIEW_REQUIRED') {
+      return translate(
+        'auto.components.right.sidebar.github.pr.stack.merge.2bb21fc326',
+        '#{{pr}} still needs review approval.',
+        { pr: entry.number }
+      )
+    }
+    if (entry.mergeStateStatus === 'BEHIND') {
+      return translate(
+        'auto.components.right.sidebar.github.pr.stack.merge.c23faf74df',
+        '#{{pr}} must be updated.',
+        { pr: entry.number }
+      )
+    }
+    if (entry.mergeStateStatus === 'BLOCKED') {
+      return translate(
+        'auto.components.right.sidebar.github.pr.stack.merge.f561e80968',
+        '#{{pr}} is blocked.',
+        { pr: entry.number }
+      )
+    }
+  }
+  return null
+}
diff --git a/src/renderer/src/components/right-sidebar/hosted-review-github-actions.ts b/src/renderer/src/components/right-sidebar/hosted-review-github-actions.ts
index a498da99071..2481e5b4293 100644
--- a/src/renderer/src/components/right-sidebar/hosted-review-github-actions.ts
+++ b/src/renderer/src/components/right-sidebar/hosted-review-github-actions.ts
@@ -30,7 +30,8 @@ export async function mergeGitHubHostedReview(args: {
         method: args.method,
         prRepo: args.prRepo ?? null
       },
-      { timeoutMs: 30_000 }
+      // Why: GitHub stack merges can run asynchronously for several minutes.
+      { timeoutMs: 4 * 60_000 }
     )
   }
   return window.api.gh.mergePR({
diff --git a/src/renderer/src/components/right-sidebar/hosted-review-header-chrome.tsx b/src/renderer/src/components/right-sidebar/hosted-review-header-chrome.tsx
index 66733779c77..b13a5728d2f 100644
--- a/src/renderer/src/components/right-sidebar/hosted-review-header-chrome.tsx
+++ b/src/renderer/src/components/right-sidebar/hosted-review-header-chrome.tsx
@@ -1,5 +1,5 @@
 import React from 'react'
-import { GitMerge } from 'lucide-react'
+import { GitMerge, GitPullRequestClosed, GitPullRequestDraft } from 'lucide-react'
 import type { HostedReviewInfo } from '../../../../shared/hosted-review'
 import { cn } from '@/lib/utils'
 import { PullRequestIcon } from './checks-panel-content'
@@ -17,6 +17,23 @@ function hostedReviewStateClass(review: HostedReviewInfo): string {
   return 'text-muted-foreground/50'
 }
 
+// Why: draft and closed only differed by a near-identical muted tone on the same
+// glyph, so a draft review read as closed.
+function hostedReviewStateIcon(
+  review: HostedReviewInfo
+): React.ComponentType<{ className?: string }> | null {
+  if (review.state === 'merged') {
+    return GitMerge
+  }
+  if (review.state === 'closed') {
+    return GitPullRequestClosed
+  }
+  if (review.state === 'draft') {
+    return GitPullRequestDraft
+  }
+  return null
+}
+
 export function HostedReviewIcon({
   review,
   className
@@ -24,7 +41,8 @@ export function HostedReviewIcon({
   review: HostedReviewInfo
   className?: string
 }): React.JSX.Element {
-  const Icon = review.provider === 'gitlab' ? GitMerge : PullRequestIcon
+  const providerIcon = review.provider === 'gitlab' ? GitMerge : PullRequestIcon
+  const Icon = hostedReviewStateIcon(review) ?? providerIcon
   return <Icon className={cn(className, hostedReviewStateClass(review))} />
 }
 
diff --git a/src/renderer/src/components/right-sidebar/parent-pr-checks-refresh.test.ts b/src/renderer/src/components/right-sidebar/parent-pr-checks-refresh.test.ts
index 2b9e5dcbe33..9cf77aa2565 100644
--- a/src/renderer/src/components/right-sidebar/parent-pr-checks-refresh.test.ts
+++ b/src/renderer/src/components/right-sidebar/parent-pr-checks-refresh.test.ts
@@ -126,7 +126,8 @@ describe('parent PR checks refresh', () => {
       worktrees: [unlinked, linked],
       repos: [repo]
     })
-    const fetchHostedReviewForBranch = vi.fn(async () => makeReview())
+    const githubRepository = { owner: 'upstream', repo: 'project' }
+    const fetchHostedReviewForBranch = vi.fn(async () => makeReview({ githubRepository }))
     const fetchPRChecks = vi.fn(async () => [])
 
     await runLimitedParentPrChecksRefreshes({
@@ -151,7 +152,7 @@ describe('parent PR checks refresh', () => {
         staleWhileRevalidate: true
       }
     ])
-    expect(fetchPRChecks).toHaveBeenCalledWith('/repo', 7, 'feature', 'abc123', null, {
+    expect(fetchPRChecks).toHaveBeenCalledWith('/repo', 7, 'feature', 'abc123', githubRepository, {
       repoId: 'repo-1',
       force: false
     })
diff --git a/src/renderer/src/components/right-sidebar/parent-pr-checks-refresh.ts b/src/renderer/src/components/right-sidebar/parent-pr-checks-refresh.ts
index 3d5ea1bbc8b..2404950b422 100644
--- a/src/renderer/src/components/right-sidebar/parent-pr-checks-refresh.ts
+++ b/src/renderer/src/components/right-sidebar/parent-pr-checks-refresh.ts
@@ -151,7 +151,7 @@ async function refreshParentPrChecksCandidate(
         review.number,
         candidate.branch,
         review.headSha,
-        null,
+        review.githubRepository ?? null,
         { repoId: candidate.repo.id, force }
       )
     }
diff --git a/src/renderer/src/components/right-sidebar/parent-pr-checks-row-types.ts b/src/renderer/src/components/right-sidebar/parent-pr-checks-row-types.ts
index 9e6f3c2f784..18fc4459da6 100644
--- a/src/renderer/src/components/right-sidebar/parent-pr-checks-row-types.ts
+++ b/src/renderer/src/components/right-sidebar/parent-pr-checks-row-types.ts
@@ -1,4 +1,11 @@
-import type { CheckStatus, PRCheckDetail, PRInfo, Repo, Worktree } from '../../../../shared/types'
+import type {
+  CheckStatus,
+  GitHubRepositoryIdentity,
+  PRCheckDetail,
+  PRInfo,
+  Repo,
+  Worktree
+} from '../../../../shared/types'
 import type { HostedReviewInfo } from '../../../../shared/hosted-review'
 import type { AppState } from '@/store'
 import { translate } from '@/i18n/i18n'
@@ -59,6 +66,7 @@ export type ParentPrChecksRow = {
   reviewState: HostedReviewInfo['state'] | null
   reviewStatus: HostedReviewInfo['status'] | null
   provider: HostedReviewInfo['provider'] | null
+  githubRepository?: GitHubRepositoryIdentity | null
   summary: string
   detailNames: string[]
   checks: PRCheckDetail[]
diff --git a/src/renderer/src/components/right-sidebar/parent-pr-checks-rows.test.ts b/src/renderer/src/components/right-sidebar/parent-pr-checks-rows.test.ts
index d261df5851e..c9e2ebc18cc 100644
--- a/src/renderer/src/components/right-sidebar/parent-pr-checks-rows.test.ts
+++ b/src/renderer/src/components/right-sidebar/parent-pr-checks-rows.test.ts
@@ -590,7 +590,8 @@ describe('buildParentPrChecksProjection', () => {
   it('reads scoped GitHub checks detail names without using details as aggregate truth', () => {
     const repo = makeRepo({ connectionId: 'ssh-1' })
     const worktree = makeWorktree({ id: 'repo-1::/feature' })
-    const review = makeReview({ status: 'failure', headSha: 'abc123' })
+    const githubRepository = { owner: 'upstream', repo: 'project' }
+    const review = makeReview({ status: 'failure', headSha: 'abc123', githubRepository })
     const hostedKey = getHostedReviewCacheKey(
       repo.path,
       'feature',
@@ -601,7 +602,7 @@ describe('buildParentPrChecksProjection', () => {
     const checksKey = getGitHubRepoCacheKey(
       repo.path,
       repo.id,
-      prChecksCacheSuffix(12, null, 'abc123'),
+      prChecksCacheSuffix(12, githubRepository, 'abc123'),
       settings,
       repo.connectionId
     )
@@ -628,6 +629,7 @@ describe('buildParentPrChecksProjection', () => {
 
     expect(projection.rows[0]?.detailNames).toEqual(['build'])
     expect(projection.rows[0]?.status).toBe('failing')
+    expect(projection.rows[0]?.githubRepository).toEqual(githubRepository)
   })
 
   it('prioritizes action-required check detail names before truncating the preview', () => {
diff --git a/src/renderer/src/components/right-sidebar/parent-pr-checks-rows.ts b/src/renderer/src/components/right-sidebar/parent-pr-checks-rows.ts
index 6330c3bbee9..72f4ab921bc 100644
--- a/src/renderer/src/components/right-sidebar/parent-pr-checks-rows.ts
+++ b/src/renderer/src/components/right-sidebar/parent-pr-checks-rows.ts
@@ -147,6 +147,7 @@ function buildParentPrChecksRow(
     reviewState: review?.state ?? fallbackDisplay?.state ?? null,
     reviewStatus: review?.status ?? fallbackDisplay?.status ?? null,
     provider: review?.provider ?? fallbackDisplay?.provider ?? null,
+    githubRepository: review?.provider === 'github' ? (review.githubRepository ?? null) : null,
     summary: getRowSummary(status, review, detailNames),
     detailNames,
     checks: checkDetails,
@@ -251,7 +252,7 @@ function getGitHubChecksEntry(
   args: ParentPrChecksRowSourceArgs & { repo: Repo },
   review: HostedReviewInfo
 ): ParentPrChecksCacheEntry<PRCheckDetail[]> | undefined {
-  const prRepo = null
+  const prRepo = review.githubRepository ?? null
   const withHead = getGitHubRepoCacheKey(
     args.repo.path,
     args.repo.id,
diff --git a/src/renderer/src/components/right-sidebar/pr-comment-filters.test.ts b/src/renderer/src/components/right-sidebar/pr-comment-filters.test.ts
deleted file mode 100644
index 9bcb57cf3f0..00000000000
--- a/src/renderer/src/components/right-sidebar/pr-comment-filters.test.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import type { PRComment } from '../../../../shared/types'
-import { filterPRCommentsByAudience, isAutomatedPRComment } from './pr-comment-filters'
-
-function comment(author: string): PRComment {
-  return {
-    id: author.length,
-    author,
-    authorAvatarUrl: '',
-    body: 'body',
-    createdAt: '2026-04-26T00:00:00.000Z',
-    url: ''
-  }
-}
-
-describe('pr-comment-filters', () => {
-  it('classifies GitHub app and automation authors as bot comments', () => {
-    expect(isAutomatedPRComment(comment('github-actions[bot]'))).toBe(true)
-    expect(isAutomatedPRComment(comment('dependabot[bot]'))).toBe(true)
-    expect(isAutomatedPRComment(comment('renovate-bot'))).toBe(true)
-    expect(isAutomatedPRComment(comment('preview-automation'))).toBe(true)
-  })
-
-  it('keeps normal user logins as human comments', () => {
-    expect(isAutomatedPRComment(comment('octocat'))).toBe(false)
-    expect(isAutomatedPRComment(comment('robotics-dev'))).toBe(false)
-  })
-
-  it('trusts the GitHub-provided isBot flag when true', () => {
-    expect(isAutomatedPRComment({ ...comment('github-actions[bot]'), isBot: true })).toBe(true)
-  })
-
-  it('classifies known AI review services that register as User accounts', () => {
-    // These sign in as regular GitHub users, so GitHub's user.type is 'User'
-    // and their logins have no "bot" / "automation" tokens. Allowlist picks
-    // them up regardless.
-    expect(isAutomatedPRComment({ ...comment('qodo-ai-reviewer'), isBot: false })).toBe(true)
-    expect(isAutomatedPRComment({ ...comment('coderabbitai'), isBot: false })).toBe(true)
-    expect(isAutomatedPRComment(comment('sonarcloud'))).toBe(true)
-    expect(isAutomatedPRComment(comment('codium-ai-reviewer'))).toBe(true)
-  })
-
-  it('filters comments by audience', () => {
-    const comments = [
-      comment('octocat'),
-      comment('github-actions[bot]'),
-      comment('mona'),
-      comment('dependabot[bot]')
-    ]
-
-    expect(filterPRCommentsByAudience(comments, 'all')).toEqual(comments)
-    expect(filterPRCommentsByAudience(comments, 'human').map((c) => c.author)).toEqual([
-      'octocat',
-      'mona'
-    ])
-    expect(filterPRCommentsByAudience(comments, 'bot').map((c) => c.author)).toEqual([
-      'github-actions[bot]',
-      'dependabot[bot]'
-    ])
-  })
-})
diff --git a/src/renderer/src/components/right-sidebar/pr-comment-filters.ts b/src/renderer/src/components/right-sidebar/pr-comment-filters.ts
deleted file mode 100644
index 6da2c17c3df..00000000000
--- a/src/renderer/src/components/right-sidebar/pr-comment-filters.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-export {
-  filterPRCommentsByAudience,
-  isBotPRComment as isAutomatedPRComment,
-  type PRCommentAudienceFilter
-} from '@/lib/pr-comment-audience'
diff --git a/src/renderer/src/components/right-sidebar/pr-comment-snapshotted-thread-resolver.test.ts b/src/renderer/src/components/right-sidebar/pr-comment-snapshotted-thread-resolver.test.ts
new file mode 100644
index 00000000000..ea4b5936ed6
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/pr-comment-snapshotted-thread-resolver.test.ts
@@ -0,0 +1,178 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  buildSnapshottedThreadResolver,
+  type SnapshottedThreadResolverDeps
+} from './pr-comment-snapshotted-thread-resolver'
+
+const PR_REPO = { owner: 'acme', repo: 'widgets', host: 'github.com' }
+
+function deps(
+  overrides: Partial<SnapshottedThreadResolverDeps> = {}
+): SnapshottedThreadResolverDeps {
+  return {
+    provider: 'github',
+    githubResolveTarget: { repoPath: '/repos/widgets', repoId: 'repo-1', prNumber: 42 },
+    resolveReviewThread: vi.fn().mockResolvedValue(true),
+    resolveGitLabDiscussion: vi.fn().mockResolvedValue({ ok: true }),
+    isPanelStillOnLaunchReview: () => true,
+    onResolvedOptimistically: vi.fn(),
+    onResolveFailed: vi.fn(),
+    ...overrides
+  }
+}
+
+describe('buildSnapshottedThreadResolver', () => {
+  it('resolves a GitHub thread against the snapshotted PR, passing prRepo when known', async () => {
+    const resolveReviewThread = vi.fn().mockResolvedValue(true)
+    const onResolvedOptimistically = vi.fn()
+    const resolve = buildSnapshottedThreadResolver(
+      deps({
+        githubResolveTarget: {
+          repoPath: '/repos/widgets',
+          repoId: 'repo-1',
+          prNumber: 42,
+          prRepo: PR_REPO
+        },
+        resolveReviewThread,
+        onResolvedOptimistically
+      })
+    )
+
+    expect(await resolve('T1')).toBe(true)
+    expect(resolveReviewThread).toHaveBeenCalledWith('/repos/widgets', 42, 'T1', true, {
+      repoId: 'repo-1',
+      prRepo: PR_REPO
+    })
+    expect(onResolvedOptimistically).toHaveBeenCalledWith('T1')
+  })
+
+  // Why: resolveReviewThread takes prRepo as an option; a degraded PR entry must still resolve.
+  it('resolves a GitHub thread when the snapshot has no prRepo', async () => {
+    const resolveReviewThread = vi.fn().mockResolvedValue(true)
+    const resolve = buildSnapshottedThreadResolver(deps({ resolveReviewThread }))
+
+    expect(await resolve('T1')).toBe(true)
+    expect(resolveReviewThread).toHaveBeenCalledWith('/repos/widgets', 42, 'T1', true, {
+      repoId: 'repo-1',
+      prRepo: undefined
+    })
+  })
+
+  it('resolves a GitLab discussion against the snapshotted MR iid', async () => {
+    const resolveGitLabDiscussion = vi.fn().mockResolvedValue({ ok: true })
+    const resolveReviewThread = vi.fn()
+    const resolve = buildSnapshottedThreadResolver(
+      deps({
+        provider: 'gitlab',
+        githubResolveTarget: undefined,
+        gitlabTarget: { repoPath: '/repos/widgets', repoId: 'repo-1', iid: 7 },
+        resolveGitLabDiscussion,
+        resolveReviewThread
+      })
+    )
+
+    expect(await resolve('D1')).toBe(true)
+    expect(resolveGitLabDiscussion).toHaveBeenCalledWith({
+      repoPath: '/repos/widgets',
+      repoId: 'repo-1',
+      iid: 7,
+      discussionId: 'D1',
+      resolved: true
+    })
+    expect(resolveReviewThread).not.toHaveBeenCalled()
+  })
+
+  it('fails without calling a host when the provider cannot resolve threads', async () => {
+    const resolveReviewThread = vi.fn()
+    const resolveGitLabDiscussion = vi.fn()
+    const onResolveFailed = vi.fn()
+    const resolve = buildSnapshottedThreadResolver(
+      deps({
+        provider: 'bitbucket',
+        githubResolveTarget: undefined,
+        resolveReviewThread,
+        resolveGitLabDiscussion,
+        onResolveFailed
+      })
+    )
+
+    expect(await resolve('T1')).toBe(false)
+    expect(resolveReviewThread).not.toHaveBeenCalled()
+    expect(resolveGitLabDiscussion).not.toHaveBeenCalled()
+    expect(onResolveFailed).toHaveBeenCalledWith({ threadId: 'T1', error: undefined })
+  })
+
+  it('fails when the snapshotted target is missing', async () => {
+    const resolveGithub = buildSnapshottedThreadResolver(deps({ githubResolveTarget: undefined }))
+    const resolveGitlab = buildSnapshottedThreadResolver(
+      deps({ provider: 'gitlab', githubResolveTarget: undefined, gitlabTarget: undefined })
+    )
+
+    expect(await resolveGithub('T1')).toBe(false)
+    expect(await resolveGitlab('D1')).toBe(false)
+  })
+
+  it('surfaces the GitLab host error instead of swallowing it', async () => {
+    const onResolveFailed = vi.fn()
+    const onResolvedOptimistically = vi.fn()
+    const resolve = buildSnapshottedThreadResolver(
+      deps({
+        provider: 'gitlab',
+        githubResolveTarget: undefined,
+        gitlabTarget: { repoPath: '/repos/widgets', repoId: 'repo-1', iid: 7 },
+        resolveGitLabDiscussion: vi.fn().mockResolvedValue({ ok: false, error: 'timed out' }),
+        onResolveFailed,
+        onResolvedOptimistically
+      })
+    )
+
+    expect(await resolve('D1')).toBe(false)
+    expect(onResolveFailed).toHaveBeenCalledWith({ threadId: 'D1', error: 'timed out' })
+    expect(onResolvedOptimistically).not.toHaveBeenCalled()
+  })
+
+  // Why: one rejected host call must not abort the bulk ack pool.
+  it('reports a rejected host call as a failure', async () => {
+    const onResolveFailed = vi.fn()
+    const resolve = buildSnapshottedThreadResolver(
+      deps({
+        resolveReviewThread: vi.fn().mockRejectedValue(new Error('socket closed')),
+        onResolveFailed
+      })
+    )
+
+    expect(await resolve('T1')).toBe(false)
+    expect(onResolveFailed).toHaveBeenCalledWith({ threadId: 'T1', error: 'socket closed' })
+  })
+
+  it('skips the optimistic update when the resolve failed', async () => {
+    const onResolvedOptimistically = vi.fn()
+    const resolve = buildSnapshottedThreadResolver(
+      deps({
+        resolveReviewThread: vi.fn().mockResolvedValue(false),
+        onResolvedOptimistically
+      })
+    )
+
+    expect(await resolve('T1')).toBe(false)
+    expect(onResolvedOptimistically).not.toHaveBeenCalled()
+  })
+
+  // Why: the host call still belongs to the launch review, but the optimistic row would land
+  // in whatever review the panel navigated to.
+  it('still resolves on the host but skips the optimistic update after the panel moved', async () => {
+    const resolveReviewThread = vi.fn().mockResolvedValue(true)
+    const onResolvedOptimistically = vi.fn()
+    const resolve = buildSnapshottedThreadResolver(
+      deps({
+        resolveReviewThread,
+        isPanelStillOnLaunchReview: () => false,
+        onResolvedOptimistically
+      })
+    )
+
+    expect(await resolve('T1')).toBe(true)
+    expect(resolveReviewThread).toHaveBeenCalledTimes(1)
+    expect(onResolvedOptimistically).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/pr-comment-snapshotted-thread-resolver.ts b/src/renderer/src/components/right-sidebar/pr-comment-snapshotted-thread-resolver.ts
new file mode 100644
index 00000000000..f5fddeb05b2
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/pr-comment-snapshotted-thread-resolver.ts
@@ -0,0 +1,89 @@
+import type { HostedReviewInfo } from '../../../../shared/hosted-review'
+import type {
+  PendingPRCommentAiAckGithubResolveTarget,
+  PendingPRCommentAiAckGitlabTarget
+} from './pr-comments-ai-launch-ack'
+
+/** Host outcome shape; GitLab reports a message, GitHub only reports success. */
+export type SnapshottedThreadResolveOutcome = { ok: boolean; error?: string }
+
+export type SnapshottedThreadResolverDeps = {
+  provider: HostedReviewInfo['provider']
+  githubResolveTarget?: PendingPRCommentAiAckGithubResolveTarget
+  gitlabTarget?: PendingPRCommentAiAckGitlabTarget
+  resolveReviewThread: (
+    repoPath: string,
+    prNumber: number,
+    threadId: string,
+    resolve: boolean,
+    options: {
+      repoId: string
+      prRepo?: PendingPRCommentAiAckGithubResolveTarget['prRepo']
+    }
+  ) => Promise<boolean>
+  resolveGitLabDiscussion: (args: {
+    repoPath: string
+    repoId: string
+    iid: number
+    discussionId: string
+    resolved: boolean
+  }) => Promise<SnapshottedThreadResolveOutcome>
+  /** False once the panel moved to another review: host calls continue, UI writes stop. */
+  isPanelStillOnLaunchReview: () => boolean
+  onResolvedOptimistically: (threadId: string) => void
+  onResolveFailed: (args: { threadId: string; error?: string }) => void
+}
+
+/**
+ * Resolve one host thread against the review snapshotted at launch: the panel can be showing a
+ * different PR/MR by the time the agent prompt lands, so live state must not pick the target.
+ */
+export function buildSnapshottedThreadResolver(
+  deps: SnapshottedThreadResolverDeps
+): (threadId: string) => Promise<boolean> {
+  return async (threadId: string): Promise<boolean> => {
+    const outcome = await resolveOnHost(deps, threadId)
+    if (!outcome.ok) {
+      deps.onResolveFailed({ threadId, error: outcome.error })
+      return false
+    }
+    // Why: the optimistic row must never land in another review's list; the caller's guarded
+    // refresh reconciles whichever panel is actually showing.
+    if (deps.isPanelStillOnLaunchReview()) {
+      deps.onResolvedOptimistically(threadId)
+    }
+    return true
+  }
+}
+
+async function resolveOnHost(
+  deps: SnapshottedThreadResolverDeps,
+  threadId: string
+): Promise<SnapshottedThreadResolveOutcome> {
+  try {
+    if (deps.provider === 'gitlab') {
+      if (!deps.gitlabTarget) {
+        return { ok: false }
+      }
+      return await deps.resolveGitLabDiscussion({
+        repoPath: deps.gitlabTarget.repoPath,
+        repoId: deps.gitlabTarget.repoId,
+        iid: deps.gitlabTarget.iid,
+        discussionId: threadId,
+        resolved: true
+      })
+    }
+    if (deps.provider !== 'github' || !deps.githubResolveTarget) {
+      return { ok: false }
+    }
+    const target = deps.githubResolveTarget
+    const ok = await deps.resolveReviewThread(target.repoPath, target.prNumber, threadId, true, {
+      repoId: target.repoId,
+      prRepo: target.prRepo
+    })
+    return { ok }
+  } catch (err) {
+    // Why: one rejected host call would otherwise abort the whole bulk ack pool.
+    return { ok: false, error: err instanceof Error ? err.message : String(err) }
+  }
+}
diff --git a/src/renderer/src/components/right-sidebar/pr-comments-ai-launch-ack.test.ts b/src/renderer/src/components/right-sidebar/pr-comments-ai-launch-ack.test.ts
index 2f4708f212a..3ae9663f314 100644
--- a/src/renderer/src/components/right-sidebar/pr-comments-ai-launch-ack.test.ts
+++ b/src/renderer/src/components/right-sidebar/pr-comments-ai-launch-ack.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import type { PRComment } from '../../../../shared/types'
-import type { PRCommentGroup } from '@/lib/pr-comment-groups'
+import type { PRCommentGroup } from '../../../../shared/pr-comment-groups'
 import {
   acknowledgePRCommentsAfterAiLaunch,
   attachPRReviewReplyParent,
@@ -8,6 +8,8 @@ import {
   checksPanelReviewStableKey,
   clearPendingPRCommentAiAck,
   getPRCommentGroupReplyTarget,
+  getPRCommentGroupsNeedingReply,
+  hasPRCommentGroupNeedingReply,
   PR_COMMENT_ACK_MAX_CONCURRENCY,
   resolvePRReviewReplyThreadId,
   setPendingPRCommentAiAck,
@@ -290,17 +292,16 @@ describe('checksPanelReviewStableKey', () => {
 })
 
 describe('acknowledgePRCommentsAfterAiLaunch', () => {
-  it('replies in-thread and resolves host-resolvable threads', async () => {
+  // Why: the reported bug — resolving is the acknowledgement, so a resolvable thread must
+  // never also get a "Fixing." reply on top of a thread that visibly collapsed.
+  it('resolves host-resolvable threads without replying to them', async () => {
     const resolveThread = vi.fn().mockResolvedValue(true)
     const replyInThread = vi.fn().mockResolvedValue(true)
     const replyAsConversation = vi.fn().mockResolvedValue(true)
-    const group = openThread('T1')
 
     const result = await acknowledgePRCommentsAfterAiLaunch({
-      groups: [group, openThread('T2', 11)],
+      groups: [openThread('T1'), openThread('T2', 11)],
       deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => true,
         resolveThread,
         canReply: true,
         replyInThread,
@@ -308,24 +309,19 @@ describe('acknowledgePRCommentsAfterAiLaunch', () => {
       }
     })
 
-    expect(result).toEqual({ resolved: 2, replied: 2, skipped: 0, failed: 0 })
-    expect(replyInThread).toHaveBeenCalledTimes(2)
-    expect(replyInThread).toHaveBeenCalledWith(group.root, PR_COMMENT_AI_FIXING_REPLY)
+    expect(result).toEqual({ resolved: 2, replied: 0, skipped: 0, failed: 0 })
+    expect(resolveThread.mock.calls.map(([threadId]) => threadId)).toEqual(['T1', 'T2'])
+    expect(replyInThread).not.toHaveBeenCalled()
     expect(replyAsConversation).not.toHaveBeenCalled()
-    expect(resolveThread).toHaveBeenCalledTimes(2)
   })
 
-  // Why: on GitHub canReply is true; a failed resolve still leaves the thread open and
-  // must count as failed or the success toast lies.
-  it('still replies in-thread when resolve fails, and counts the failed resolve', async () => {
-    const replyInThread = vi.fn().mockResolvedValue(true)
-    const group = openThread('T1')
+  // Why: a failed resolve leaves the thread open on the host, so the toast must not claim success.
+  it('counts a failed resolve instead of falling back to a reply', async () => {
+    const replyInThread = vi.fn()
 
     const result = await acknowledgePRCommentsAfterAiLaunch({
-      groups: [group],
+      groups: [openThread('T1')],
       deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => true,
         resolveThread: vi.fn().mockResolvedValue(false),
         canReply: true,
         replyInThread,
@@ -333,19 +329,161 @@ describe('acknowledgePRCommentsAfterAiLaunch', () => {
       }
     })
 
-    expect(result).toEqual({ resolved: 0, replied: 1, skipped: 0, failed: 1 })
-    expect(replyInThread).toHaveBeenCalledWith(group.root, PR_COMMENT_AI_FIXING_REPLY)
+    expect(result).toEqual({ resolved: 0, replied: 0, skipped: 0, failed: 1 })
+    expect(replyInThread).not.toHaveBeenCalled()
   })
 
-  it('posts a conversation @-reply for standalone conversation comments', async () => {
-    const replyAsConversation = vi.fn().mockResolvedValue(true)
-    const group = standalone(42)
+  // Why: GitLab reaches the ack with canReply false, so a failed resolve has no reply to fall
+  // back on and must still be counted.
+  it('counts a failed resolve on a provider that cannot reply', async () => {
+    const replyInThread = vi.fn()
+    const replyAsConversation = vi.fn()
+
+    const result = await acknowledgePRCommentsAfterAiLaunch({
+      groups: [openThread('T1')],
+      deps: {
+        resolveThread: vi.fn().mockResolvedValue(false),
+        canReply: false,
+        replyInThread,
+        replyAsConversation
+      }
+    })
+
+    expect(result).toEqual({ resolved: 0, replied: 0, skipped: 0, failed: 1 })
+    expect(replyInThread).not.toHaveBeenCalled()
+    expect(replyAsConversation).not.toHaveBeenCalled()
+  })
+
+  // Why: resolve used to be gated on panel/live-comment state and got silently skipped when
+  // a slow agent launch outlived either; the snapshotted threadId must always be attempted.
+  it('resolves every selected thread with no live-state gate', async () => {
+    const resolveThread = vi.fn().mockResolvedValue(true)
+
+    const result = await acknowledgePRCommentsAfterAiLaunch({
+      groups: [openThread('T1'), openThread('T2', 11), openThread('T3', 12)],
+      deps: {
+        resolveThread,
+        canReply: true,
+        replyInThread: vi.fn(),
+        replyAsConversation: vi.fn()
+      }
+    })
+
+    expect(resolveThread).toHaveBeenCalledTimes(3)
+    expect(result).toEqual({ resolved: 3, replied: 0, skipped: 0, failed: 0 })
+  })
+
+  // Why: GitLab MRs reach the ack with canReply false; resolve is the whole acknowledgement there.
+  it('resolves threads on providers that cannot reply', async () => {
+    const resolveThread = vi.fn().mockResolvedValue(true)
+
+    const result = await acknowledgePRCommentsAfterAiLaunch({
+      groups: [openThread('T1')],
+      deps: {
+        resolveThread,
+        canReply: false,
+        replyInThread: vi.fn(),
+        replyAsConversation: vi.fn()
+      }
+    })
+
+    expect(result).toEqual({ resolved: 1, replied: 0, skipped: 0, failed: 0 })
+    expect(resolveThread).toHaveBeenCalledWith('T1')
+  })
+
+  // Why: a summary thread GitHub *can* resolve is acked by resolving, even though its
+  // pullrequestreview anchor rules out a nested reply.
+  it('resolves a review-summary thread instead of batching it into a conversation post', async () => {
+    const resolveThread = vi.fn().mockResolvedValue(true)
+    const replyAsConversation = vi.fn()
+    const summaryThread: PRCommentGroup = {
+      kind: 'thread',
+      threadId: 'T_summary',
+      root: comment({
+        id: 30,
+        threadId: 'T_summary',
+        isResolved: false,
+        url: 'https://github.com/acme/widgets/pull/42#pullrequestreview-999'
+      }),
+      replies: []
+    }
+
+    const result = await acknowledgePRCommentsAfterAiLaunch({
+      groups: [summaryThread],
+      deps: {
+        resolveThread,
+        canReply: true,
+        replyInThread: vi.fn(),
+        replyAsConversation
+      }
+    })
+
+    expect(result).toEqual({ resolved: 1, replied: 0, skipped: 0, failed: 0 })
+    expect(resolveThread).toHaveBeenCalledWith('T_summary')
+    expect(replyAsConversation).not.toHaveBeenCalled()
+  })
+
+  // Why: an already-resolved thread has nothing left to close, so it falls back to a reply.
+  it('replies in-thread when the thread is already resolved', async () => {
+    const replyInThread = vi.fn().mockResolvedValue(true)
+    const resolveThread = vi.fn()
+    const group: PRCommentGroup = {
+      kind: 'thread',
+      threadId: 'T1',
+      root: comment({ id: 10, threadId: 'T1', path: 'a.ts', isResolved: true }),
+      replies: []
+    }
 
     const result = await acknowledgePRCommentsAfterAiLaunch({
       groups: [group],
       deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => true,
+        resolveThread,
+        canReply: true,
+        replyInThread,
+        replyAsConversation: vi.fn()
+      }
+    })
+
+    expect(result).toEqual({ resolved: 0, replied: 1, skipped: 0, failed: 0 })
+    expect(resolveThread).not.toHaveBeenCalled()
+    expect(replyInThread).toHaveBeenCalledWith(group.root, PR_COMMENT_AI_FIXING_REPLY)
+  })
+
+  // Why: GitHub's replies endpoint keys off the top-level review comment id; replying to the
+  // newest reply 404s.
+  it('replies to the thread root, not the newest reply, on an already-resolved thread', async () => {
+    const replyInThread = vi.fn().mockResolvedValue(true)
+    const root = comment({ id: 10, threadId: 'T1', path: 'a.ts', isResolved: true })
+    const group: PRCommentGroup = {
+      kind: 'thread',
+      threadId: 'T1',
+      root,
+      replies: [
+        comment({ id: 11, threadId: 'T1', path: 'a.ts', body: 'first' }),
+        comment({ id: 12, threadId: 'T1', path: 'a.ts', body: 'latest' })
+      ]
+    }
+
+    const result = await acknowledgePRCommentsAfterAiLaunch({
+      groups: [group],
+      deps: {
+        resolveThread: vi.fn(),
+        canReply: true,
+        replyInThread,
+        replyAsConversation: vi.fn()
+      }
+    })
+
+    expect(result).toEqual({ resolved: 0, replied: 1, skipped: 0, failed: 0 })
+    expect(replyInThread).toHaveBeenCalledWith(root, PR_COMMENT_AI_FIXING_REPLY)
+  })
+
+  it('posts a conversation @-reply for standalone conversation comments', async () => {
+    const replyAsConversation = vi.fn().mockResolvedValue(true)
+
+    const result = await acknowledgePRCommentsAfterAiLaunch({
+      groups: [standalone(42)],
+      deps: {
         resolveThread: vi.fn(),
         canReply: true,
         replyInThread: vi.fn(),
@@ -364,8 +502,6 @@ describe('acknowledgePRCommentsAfterAiLaunch', () => {
     await acknowledgePRCommentsAfterAiLaunch({
       groups: [openThread('T1'), openThread('T2', 11)],
       deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => true,
         resolveThread: vi.fn().mockResolvedValue(true),
         canReply: true,
         replyInThread: vi.fn().mockResolvedValue(true),
@@ -379,13 +515,10 @@ describe('acknowledgePRCommentsAfterAiLaunch', () => {
   it('posts a conversation @-reply for CodeRabbit review summaries', async () => {
     const replyInThread = vi.fn().mockResolvedValue(true)
     const replyAsConversation = vi.fn().mockResolvedValue(true)
-    const group = codeRabbitReviewSummary(77)
 
     const result = await acknowledgePRCommentsAfterAiLaunch({
-      groups: [group],
+      groups: [codeRabbitReviewSummary(77)],
       deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => true,
         resolveThread: vi.fn(),
         canReply: true,
         replyInThread,
@@ -398,8 +531,8 @@ describe('acknowledgePRCommentsAfterAiLaunch', () => {
     expect(replyAsConversation).toHaveBeenCalledWith(`@coderabbitai ${PR_COMMENT_AI_FIXING_REPLY}`)
   })
 
-  // Why: the reported bug — N selected summaries used to produce N near-identical
-  // "Fixing." conversation comments; one combined post covers the whole set.
+  // Why: N selected summaries used to produce N near-identical "Fixing." conversation
+  // comments; one combined post covers the whole set.
   it('combines every unresolvable review summary into one conversation comment', async () => {
     const replyAsConversation = vi.fn().mockResolvedValue(true)
     const resolveThread = vi.fn()
@@ -407,8 +540,6 @@ describe('acknowledgePRCommentsAfterAiLaunch', () => {
     const result = await acknowledgePRCommentsAfterAiLaunch({
       groups: [codeRabbitReviewSummary(30), codeRabbitReviewSummary(31), standalone(32)],
       deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => false,
         resolveThread,
         canReply: true,
         replyInThread: vi.fn(),
@@ -432,31 +563,8 @@ describe('acknowledgePRCommentsAfterAiLaunch', () => {
     expect(resolveThread).not.toHaveBeenCalled()
   })
 
-  it('mixes in-thread and conversation replies in a single selection', async () => {
-    const replyInThread = vi.fn().mockResolvedValue(true)
-    const replyAsConversation = vi.fn().mockResolvedValue(true)
-    const thread = openThread('T1', 10)
-    const summary = codeRabbitReviewSummary(30)
-
-    const result = await acknowledgePRCommentsAfterAiLaunch({
-      groups: [thread, summary],
-      deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => true,
-        resolveThread: vi.fn().mockResolvedValue(true),
-        canReply: true,
-        replyInThread,
-        replyAsConversation
-      }
-    })
-
-    expect(result).toEqual({ resolved: 1, replied: 2, skipped: 0, failed: 0 })
-    expect(replyInThread).toHaveBeenCalledWith(thread.root, PR_COMMENT_AI_FIXING_REPLY)
-    expect(replyAsConversation).toHaveBeenCalledWith(`@coderabbitai ${PR_COMMENT_AI_FIXING_REPLY}`)
-  })
-
-  // Why: nestable threads keep one reply each; only the conversation half is batched.
-  it('replies once per thread and once for the whole conversation set', async () => {
+  it('resolves threads and batches the conversation half in a single selection', async () => {
+    const resolveThread = vi.fn().mockResolvedValue(true)
     const replyInThread = vi.fn().mockResolvedValue(true)
     const replyAsConversation = vi.fn().mockResolvedValue(true)
 
@@ -468,27 +576,42 @@ describe('acknowledgePRCommentsAfterAiLaunch', () => {
         standalone(31)
       ],
       deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => true,
-        resolveThread: vi.fn().mockResolvedValue(true),
+        resolveThread,
         canReply: true,
         replyInThread,
         replyAsConversation
       }
     })
 
-    expect(result).toEqual({ resolved: 2, replied: 3, skipped: 0, failed: 0 })
-    expect(replyInThread).toHaveBeenCalledTimes(2)
+    expect(result).toEqual({ resolved: 2, replied: 1, skipped: 0, failed: 0 })
+    expect(replyInThread).not.toHaveBeenCalled()
     expect(replyAsConversation).toHaveBeenCalledTimes(1)
     expect(replyAsConversation.mock.calls[0]?.[0]).toContain('Fixing:')
   })
 
+  // Why: a path-only review comment with no thread metadata still nests a reply.
+  it('replies in-thread for an unresolvable comment that supports nesting', async () => {
+    const replyInThread = vi.fn().mockResolvedValue(true)
+    const target = comment({ id: 10, path: 'src/a.ts', line: 12 })
+
+    const result = await acknowledgePRCommentsAfterAiLaunch({
+      groups: [{ kind: 'standalone', comment: target }],
+      deps: {
+        resolveThread: vi.fn(),
+        canReply: true,
+        replyInThread,
+        replyAsConversation: vi.fn()
+      }
+    })
+
+    expect(result).toEqual({ resolved: 0, replied: 1, skipped: 0, failed: 0 })
+    expect(replyInThread).toHaveBeenCalledWith(target, PR_COMMENT_AI_FIXING_REPLY)
+  })
+
   it('counts a failed conversation reply instead of silently reporting success', async () => {
     const result = await acknowledgePRCommentsAfterAiLaunch({
       groups: [codeRabbitReviewSummary(30)],
       deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => false,
         resolveThread: vi.fn(),
         canReply: true,
         replyInThread: vi.fn(),
@@ -499,37 +622,10 @@ describe('acknowledgePRCommentsAfterAiLaunch', () => {
     expect(result).toEqual({ resolved: 0, replied: 0, skipped: 0, failed: 1 })
   })
 
-  it('replies to the thread root in a multi-comment thread', async () => {
-    const replyInThread = vi.fn().mockResolvedValue(true)
-    const group: PRCommentGroup = {
-      kind: 'thread',
-      threadId: 'T1',
-      root: comment({ id: 10, threadId: 'T1', path: 'a.ts', isResolved: false }),
-      replies: [comment({ id: 11, threadId: 'T1', path: 'a.ts', body: 'prior reply' })]
-    }
-
-    const result = await acknowledgePRCommentsAfterAiLaunch({
-      groups: [group],
-      deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => false,
-        resolveThread: vi.fn(),
-        canReply: true,
-        replyInThread,
-        replyAsConversation: vi.fn()
-      }
-    })
-
-    expect(result).toEqual({ resolved: 0, replied: 1, skipped: 0, failed: 0 })
-    expect(replyInThread).toHaveBeenCalledWith(group.root, PR_COMMENT_AI_FIXING_REPLY)
-  })
-
-  it('skips when reply is unavailable and resolve cannot run', async () => {
+  it('skips an unresolvable comment when the provider cannot reply', async () => {
     const result = await acknowledgePRCommentsAfterAiLaunch({
       groups: [standalone()],
       deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => true,
         resolveThread: vi.fn(),
         canReply: false,
         replyInThread: vi.fn(),
@@ -540,27 +636,10 @@ describe('acknowledgePRCommentsAfterAiLaunch', () => {
     expect(result).toEqual({ resolved: 0, replied: 0, skipped: 1, failed: 0 })
   })
 
-  it('counts a failure when resolve fails and reply is unavailable', async () => {
-    const result = await acknowledgePRCommentsAfterAiLaunch({
-      groups: [openThread('T1')],
-      deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => true,
-        resolveThread: vi.fn().mockResolvedValue(false),
-        canReply: false,
-        replyInThread: vi.fn(),
-        replyAsConversation: vi.fn()
-      }
-    })
-
-    expect(result).toEqual({ resolved: 0, replied: 0, skipped: 0, failed: 1 })
-  })
-
   it('keeps a durable pending payload across take', () => {
     const payload: PendingPRCommentAiAck = {
       reviewContextKey: 'repo::main::owner/repo::12::abc',
       provider: 'github',
-      selectedThreadIds: ['T1'],
       selectedGroups: [openThread('T1')]
     }
     clearPendingPRCommentAiAck()
@@ -569,136 +648,78 @@ describe('acknowledgePRCommentsAfterAiLaunch', () => {
     expect(takePendingPRCommentAiAck()).toBeNull()
   })
 
-  it('still posts all replies when the review context becomes stale mid-loop', async () => {
-    let live = true
-    const replyInThread = vi.fn().mockImplementation(async () => {
-      live = false
-      return true
-    })
-    const resolveThread = vi.fn().mockResolvedValue(true)
-
-    const result = await acknowledgePRCommentsAfterAiLaunch({
-      groups: [openThread('T1'), openThread('T2', 11), openThread('T3', 12)],
-      deps: {
-        isStillCurrent: () => live,
-        isThreadStillResolvable: () => true,
-        resolveThread,
-        canReply: true,
-        replyInThread,
-        replyAsConversation: vi.fn()
-      }
-    })
-
-    // Why: replies must not depend on checks-panel key stability; resolve stops after context
-    // goes stale, and each skipped resolve is reported rather than silently counted as success.
-    expect(replyInThread).toHaveBeenCalledTimes(3)
-    expect(resolveThread).toHaveBeenCalledTimes(0)
-    expect(result).toEqual({ resolved: 0, replied: 3, skipped: 3, failed: 0 })
-  })
-
-  // Why: resolving after a failed reply closes the thread with no ack at all.
-  it('leaves a thread open when its fixing reply failed', async () => {
-    const resolveThread = vi.fn().mockResolvedValue(true)
-
-    const result = await acknowledgePRCommentsAfterAiLaunch({
-      groups: [openThread('T1')],
-      deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => true,
-        resolveThread,
-        canReply: true,
-        replyInThread: vi.fn().mockResolvedValue(false),
-        replyAsConversation: vi.fn()
-      }
-    })
-
-    expect(result).toEqual({ resolved: 0, replied: 0, skipped: 0, failed: 1 })
-    expect(resolveThread).not.toHaveBeenCalled()
-  })
-
-  it('does not resolve batched conversation groups when the combined post failed', async () => {
-    const resolveThread = vi.fn()
-    const summaryThread: PRCommentGroup = {
-      kind: 'thread',
-      threadId: 'T_summary',
-      root: comment({
-        id: 30,
-        threadId: 'T_summary',
-        isResolved: false,
-        url: 'https://github.com/acme/widgets/pull/42#pullrequestreview-999'
-      }),
-      replies: []
+  // Why: the ack resolves after delivery, by which point the panel may show another review —
+  // the host target must ride along in the payload, not be re-read from live state.
+  it('carries the snapshotted GitLab target through take', () => {
+    const payload: PendingPRCommentAiAck = {
+      reviewContextKey: 'repo::main::gitlab::7::abc',
+      provider: 'gitlab',
+      selectedGroups: [openThread('D1')],
+      gitlabTarget: { repoPath: '/repos/widgets', repoId: 'repo-1', iid: 7 }
     }
-
-    const result = await acknowledgePRCommentsAfterAiLaunch({
-      groups: [summaryThread],
-      deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => true,
-        resolveThread,
-        canReply: true,
-        replyInThread: vi.fn(),
-        replyAsConversation: vi.fn().mockResolvedValue(false)
-      }
+    clearPendingPRCommentAiAck()
+    setPendingPRCommentAiAck(payload)
+    expect(takePendingPRCommentAiAck()?.gitlabTarget).toEqual({
+      repoPath: '/repos/widgets',
+      repoId: 'repo-1',
+      iid: 7
     })
-
-    expect(result).toEqual({ resolved: 0, replied: 0, skipped: 0, failed: 1 })
-    expect(resolveThread).not.toHaveBeenCalled()
   })
 
-  it('reports a resolvable thread as skipped when the panel context moved', async () => {
-    const resolveThread = vi.fn()
-
-    const result = await acknowledgePRCommentsAfterAiLaunch({
-      groups: [openThread('T1')],
-      deps: {
-        isStillCurrent: () => false,
-        isThreadStillResolvable: () => true,
-        resolveThread,
-        canReply: true,
-        replyInThread: vi.fn().mockResolvedValue(true),
-        replyAsConversation: vi.fn()
-      }
-    })
-
-    expect(result).toEqual({ resolved: 0, replied: 1, skipped: 1, failed: 0 })
-    expect(resolveThread).not.toHaveBeenCalled()
-  })
-
-  it('runs groups with bounded concurrency, replying before resolving in each group', async () => {
+  it('runs groups with bounded concurrency', async () => {
     const groups = Array.from({ length: 9 }, (_, index) => openThread(`T${index}`, 100 + index))
-    const order: string[] = []
     let inFlight = 0
     let peakInFlight = 0
 
-    const track = async <T>(label: string, value: T): Promise<T> => {
-      inFlight += 1
-      peakInFlight = Math.max(peakInFlight, inFlight)
-      order.push(label)
-      await Promise.resolve()
-      inFlight -= 1
-      return value
-    }
-
     const result = await acknowledgePRCommentsAfterAiLaunch({
       groups,
       deps: {
-        isStillCurrent: () => true,
-        isThreadStillResolvable: () => true,
-        resolveThread: (threadId) => track(`resolve:${threadId}`, true),
+        resolveThread: async () => {
+          inFlight += 1
+          peakInFlight = Math.max(peakInFlight, inFlight)
+          await Promise.resolve()
+          inFlight -= 1
+          return true
+        },
         canReply: true,
-        replyInThread: (comment) => track(`reply:${comment.threadId}`, true),
+        replyInThread: vi.fn(),
         replyAsConversation: vi.fn()
       }
     })
 
-    expect(result).toEqual({ resolved: 9, replied: 9, skipped: 0, failed: 0 })
+    expect(result).toEqual({ resolved: 9, replied: 0, skipped: 0, failed: 0 })
     expect(peakInFlight).toBeGreaterThan(1)
     expect(peakInFlight).toBeLessThanOrEqual(PR_COMMENT_ACK_MAX_CONCURRENCY)
-    for (const group of groups) {
-      expect(order.indexOf(`reply:${group.threadId}`)).toBeLessThan(
-        order.indexOf(`resolve:${group.threadId}`)
-      )
+  })
+})
+
+describe('getPRCommentGroupsNeedingReply', () => {
+  it('keeps only the groups the host cannot close for us', () => {
+    const summary = codeRabbitReviewSummary(30)
+    const conversation = standalone(31)
+    const resolvedThread: PRCommentGroup = {
+      kind: 'thread',
+      threadId: 'T_done',
+      root: comment({ id: 12, threadId: 'T_done', isResolved: true }),
+      replies: []
     }
+
+    expect(
+      getPRCommentGroupsNeedingReply([
+        openThread('T1'),
+        summary,
+        conversation,
+        resolvedThread,
+        openThread('T2', 11)
+      ])
+    ).toEqual([summary, conversation, resolvedThread])
+  })
+})
+
+describe('hasPRCommentGroupNeedingReply', () => {
+  it('matches the filtered list without materializing it', () => {
+    expect(hasPRCommentGroupNeedingReply([openThread('T1'), openThread('T2', 11)])).toBe(false)
+    expect(hasPRCommentGroupNeedingReply([openThread('T1'), standalone(31)])).toBe(true)
+    expect(hasPRCommentGroupNeedingReply([])).toBe(false)
   })
 })
diff --git a/src/renderer/src/components/right-sidebar/pr-comments-ai-launch-ack.ts b/src/renderer/src/components/right-sidebar/pr-comments-ai-launch-ack.ts
index c73ab1aee1d..6c427f84acc 100644
--- a/src/renderer/src/components/right-sidebar/pr-comments-ai-launch-ack.ts
+++ b/src/renderer/src/components/right-sidebar/pr-comments-ai-launch-ack.ts
@@ -1,6 +1,6 @@
 import type { PRComment, PRInfo } from '../../../../shared/types'
 import type { HostedReviewInfo } from '../../../../shared/hosted-review'
-import { getPRCommentGroupRoot, type PRCommentGroup } from '@/lib/pr-comment-groups'
+import { getPRCommentGroupRoot, type PRCommentGroup } from '../../../../shared/pr-comment-groups'
 import { isResolvablePRCommentGroup } from '../pr-comments-resolution-prompt'
 import {
   buildPRCommentBatchConversationReplyBody,
@@ -15,9 +15,7 @@ export type PRCommentAiLaunchAckCounts = {
 }
 
 export type PRCommentAiLaunchAckDeps = {
-  isStillCurrent: () => boolean
-  /** True when the thread is still open and host-resolvable in live comment state. */
-  isThreadStillResolvable: (threadId: string) => boolean
+  /** Resolve a host thread. Always called against the threadId snapshotted at launch. */
   resolveThread: (threadId: string) => Promise<boolean>
   /** Provider supports posting a reply (GitHub in the Checks panel today). */
   canReply: boolean
@@ -164,26 +162,37 @@ async function mapWithBoundedConcurrency<T, R>(
 type BatchedConversationReply = {
   counts: PRCommentAiLaunchAckCounts
   handled: ReadonlySet<PRCommentGroup>
-  replyOk: boolean
 }
 
 const NO_BATCHED_CONVERSATION_REPLY: BatchedConversationReply = {
   counts: EMPTY_ACK_COUNTS,
-  handled: new Set(),
-  replyOk: false
+  handled: new Set()
+}
+
+/** Groups that need a posted reply because the host cannot close them for us. */
+export function getPRCommentGroupsNeedingReply(
+  groups: readonly PRCommentGroup[]
+): PRCommentGroup[] {
+  return groups.filter((group) => !isResolvablePRCommentGroup(group))
+}
+
+/** Emptiness test for the above without materializing the filtered list. */
+export function hasPRCommentGroupNeedingReply(groups: readonly PRCommentGroup[]): boolean {
+  return groups.some((group) => !isResolvablePRCommentGroup(group))
 }
 
 /**
- * After launching an agent for selected review feedback:
- * post a fixing reply (one nested reply per review thread, one combined conversation
- * comment for everything that has no nested-reply endpoint), then resolve host threads.
+ * After launching an agent for selected review feedback, acknowledge every selection
+ * exactly once: host-resolvable threads are resolved, and anything the host cannot close
+ * gets a fixing reply (one nested reply per review thread, one combined conversation
+ * comment for everything with no nested-reply endpoint).
  *
- * Why: replies use a snapshotted GitHub target and must not abort just because
- * the checks-panel async key churned mid-launch. isStillCurrent only gates
- * host-thread resolve + UI refresh, not the reply posts themselves.
+ * Why resolve instead of reply: a resolved thread collapses on the host, which *is* the
+ * acknowledgement — an extra "Fixing." comment only adds noise to a thread the user can
+ * already see is handled.
  *
- * Groups run through a bounded pool; reply-before-resolve stays serial *within*
- * a group because the resolve decision reads live comment state the reply mutates.
+ * Every host call targets state snapshotted at launch, so a slow agent start or the user
+ * navigating away can no longer silently drop the resolve. Groups run through a bounded pool.
  */
 export async function acknowledgePRCommentsAfterAiLaunch(args: {
   groups: readonly PRCommentGroup[]
@@ -192,7 +201,7 @@ export async function acknowledgePRCommentsAfterAiLaunch(args: {
   // Why: conversation comments have no replies endpoint, so one post per selected item
   // would spam the PR timeline with near-identical "Fixing." comments.
   const conversationGroups = args.deps.canReply
-    ? args.groups.filter(
+    ? getPRCommentGroupsNeedingReply(args.groups).filter(
         (group) => !canPostPRReviewThreadReply(getPRCommentGroupReplyTarget(group))
       )
     : []
@@ -228,8 +237,7 @@ async function postBatchedConversationReply(
   return {
     // Why: one host POST covers the whole set, so the toast must count it once.
     counts: { ...EMPTY_ACK_COUNTS, replied: replyOk ? 1 : 0, failed: replyOk ? 0 : 1 },
-    handled: new Set(groups),
-    replyOk
+    handled: new Set(groups)
   }
 }
 
@@ -239,50 +247,34 @@ async function acknowledgePRCommentGroup(
   batch: BatchedConversationReply
 ): Promise<PRCommentAiLaunchAckCounts> {
   const counts = { ...EMPTY_ACK_COUNTS }
-  const threadId =
-    group.kind === 'thread' && isResolvablePRCommentGroup(group) ? group.threadId : null
 
-  if (deps.canReply) {
-    const replyOk = batch.handled.has(group)
-      ? batch.replyOk
-      : await postInThreadFixingReply(group, deps, counts)
-    // Why: resolving a thread whose fixing reply never landed closes it silently —
-    // the user was promised an ack, so leave it open and let the toast report the failure.
-    if (!replyOk) {
-      return counts
-    }
-  }
-
-  if (threadId == null || !deps.isThreadStillResolvable(threadId)) {
-    if (!deps.canReply) {
-      counts.skipped += 1
+  if (isResolvablePRCommentGroup(group)) {
+    if (await deps.resolveThread(group.threadId)) {
+      counts.resolved += 1
+    } else {
+      counts.failed += 1
     }
     return counts
   }
 
-  // Why: resolve is UI/host-state sensitive; skip it if the panel context moved.
-  // Replies already used a snapshotted target and must not be gated the same way.
-  if (!deps.isStillCurrent()) {
+  if (!deps.canReply) {
     counts.skipped += 1
     return counts
   }
-
-  if (await deps.resolveThread(threadId)) {
-    counts.resolved += 1
-  } else {
-    // Why: a resolve failure leaves the thread open on the host regardless of whether
-    // the reply landed; counting it only when !canReply made GitHub failures invisible.
-    counts.failed += 1
+  // The combined conversation post already covered this group and counted itself.
+  if (batch.handled.has(group)) {
+    return counts
   }
+  await postInThreadFixingReply(group, deps, counts)
   return counts
 }
 
-/** Mutates counts in place; returns whether the nested reply landed. */
+/** Mutates counts in place. */
 async function postInThreadFixingReply(
   group: PRCommentGroup,
   deps: PRCommentAiLaunchAckDeps,
   counts: PRCommentAiLaunchAckCounts
-): Promise<boolean> {
+): Promise<void> {
   const replyOk = await deps.replyInThread(
     getPRCommentGroupReplyTarget(group),
     PR_COMMENT_AI_FIXING_REPLY
@@ -292,24 +284,41 @@ async function postInThreadFixingReply(
   } else {
     counts.failed += 1
   }
-  return replyOk
 }
 
-/** Snapshotted at queue time so the post-launch ack does not depend on live React state. */
-export type PendingPRCommentAiAckGithubTarget = {
+/**
+ * Snapshotted at queue time so the post-launch ack does not depend on live React state.
+ * Resolving a thread only needs the PR handle — prRepo is optional on resolveReviewThread,
+ * so a PR cache entry without it must still be able to ack by resolving.
+ */
+export type PendingPRCommentAiAckGithubResolveTarget = {
   repoPath: string
   repoId: string
   prNumber: number
+  prRepo?: NonNullable<PRInfo['prRepo']>
+}
+
+/** The reply endpoints genuinely need prRepo, so they get the stricter target. */
+export type PendingPRCommentAiAckGithubTarget = PendingPRCommentAiAckGithubResolveTarget & {
   prRepo: NonNullable<PRInfo['prRepo']>
 }
 
+/** Snapshotted at queue time so the post-launch ack does not depend on live React state. */
+export type PendingPRCommentAiAckGitlabTarget = {
+  repoPath: string
+  repoId: string
+  iid: number
+}
+
 /** What a queued comment-resolution launch must still ack once its prompt is delivered. */
 export type PendingPRCommentAiAck = {
   reviewContextKey: string
   provider: HostedReviewInfo['provider']
-  selectedThreadIds: string[]
   selectedGroups: PRCommentGroup[]
+  /** Reply target: requires prRepo. */
   githubTarget?: PendingPRCommentAiAckGithubTarget
+  githubResolveTarget?: PendingPRCommentAiAckGithubResolveTarget
+  gitlabTarget?: PendingPRCommentAiAckGitlabTarget
 }
 
 /** Durable pending ack payload so dialog close / re-renders cannot drop it before launch. */
diff --git a/src/renderer/src/components/right-sidebar/pr-comments-list-selection.test.tsx b/src/renderer/src/components/right-sidebar/pr-comments-list-selection.test.tsx
index a7b9af2153f..c6f0130d1c1 100644
--- a/src/renderer/src/components/right-sidebar/pr-comments-list-selection.test.tsx
+++ b/src/renderer/src/components/right-sidebar/pr-comments-list-selection.test.tsx
@@ -7,46 +7,66 @@ import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { TooltipProvider } from '@/components/ui/tooltip'
 
-vi.mock('@/components/ui/dropdown-menu', () => ({
-  DropdownMenu: ({ children }: { children: ReactNode }) => <>{children}</>,
-  DropdownMenuContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  DropdownMenuLabel: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  DropdownMenuItem: ({
-    children,
-    onSelect
-  }: {
-    children: ReactNode
-    onSelect?: (event: Event) => void
-  }) => (
-    <button
-      type="button"
-      role="menuitem"
-      onClick={() => onSelect?.({ preventDefault: () => {} } as unknown as Event)}
-    >
-      {children}
-    </button>
-  ),
-  DropdownMenuRadioGroup: ({ children }: { children: ReactNode }) => <>{children}</>,
-  DropdownMenuRadioItem: ({
-    children,
-    onSelect
-  }: {
-    children: ReactNode
-    onSelect?: (event: Event) => void
-  }) => (
-    <button
-      type="button"
-      role="menuitemradio"
-      onClick={() => onSelect?.({ preventDefault: () => {} } as unknown as Event)}
-    >
-      {children}
-    </button>
-  ),
-  DropdownMenuSeparator: () => <hr />,
-  DropdownMenuTrigger: ({ children }: { children: ReactNode }) => <>{children}</>
-}))
+vi.mock('@/components/ui/dropdown-menu', () => {
+  // Radix keeps the selection callback on the group, so the mocked items need it too.
+  let onRadioValueChange: ((value: string) => void) | undefined
+  return {
+    DropdownMenu: ({ children }: { children: ReactNode }) => <>{children}</>,
+    DropdownMenuContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+    DropdownMenuLabel: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+    DropdownMenuItem: ({
+      children,
+      onSelect
+    }: {
+      children: ReactNode
+      onSelect?: (event: Event) => void
+    }) => (
+      <button
+        type="button"
+        role="menuitem"
+        onClick={() => onSelect?.({ preventDefault: () => {} } as unknown as Event)}
+      >
+        {children}
+      </button>
+    ),
+    DropdownMenuRadioGroup: ({
+      children,
+      onValueChange
+    }: {
+      children: ReactNode
+      onValueChange?: (value: string) => void
+    }) => {
+      onRadioValueChange = onValueChange
+      return <>{children}</>
+    },
+    DropdownMenuRadioItem: ({
+      children,
+      value,
+      onSelect
+    }: {
+      children: ReactNode
+      value?: string
+      onSelect?: (event: Event) => void
+    }) => (
+      <button
+        type="button"
+        role="menuitemradio"
+        onClick={() => {
+          onSelect?.({ preventDefault: () => {} } as unknown as Event)
+          if (value !== undefined) {
+            onRadioValueChange?.(value)
+          }
+        }}
+      >
+        {children}
+      </button>
+    ),
+    DropdownMenuSeparator: () => <hr />,
+    DropdownMenuTrigger: ({ children }: { children: ReactNode }) => <>{children}</>
+  }
+})
 import type { PRComment } from '../../../../shared/types'
-import type { PRCommentGroup } from '@/lib/pr-comment-groups'
+import type { PRCommentGroup } from '../../../../shared/pr-comment-groups'
 import {
   MAX_PERSISTED_PR_COMMENTS_LIST_SELECTIONS,
   clearPRCommentsListSelectionsForTests,
@@ -167,6 +187,24 @@ function hasButton(label: string): boolean {
   )
 }
 
+function selectDisplayMode(label: string): void {
+  const item = [...container.querySelectorAll('[role="menuitemradio"]')].find(
+    (candidate) => candidate.textContent === label
+  )
+  if (!item) {
+    throw new Error(`Display mode not found: ${label}`)
+  }
+  act(() => {
+    item.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+  })
+}
+
+function renderedGroupOrder(labels: readonly string[]): string[] {
+  return [...container.querySelectorAll('[data-testid="pr-comment-group"]')].map(
+    (row) => labels.find((label) => row.textContent?.includes(label)) ?? '<unmatched>'
+  )
+}
+
 function clickMenuItem(label: string): void {
   clickButton('More comment actions')
   const menuItem =
@@ -256,12 +294,20 @@ describe('PRCommentsList comment resolution selection', () => {
   it('lets a user queue one eligible comment thread for the agent from the visible row action', () => {
     const onResolveSelectedCommentsWithAI = vi.fn()
     renderList({
+      // Why: distinct timestamps pin thread-1 to the first row under the newest-first grouped order.
       comments: [
-        comment({ id: 1, threadId: 'thread-1', path: 'src/a.ts', isResolved: false }),
+        comment({
+          id: 1,
+          createdAt: '2026-05-15T00:00:00Z',
+          threadId: 'thread-1',
+          path: 'src/a.ts',
+          isResolved: false
+        }),
         comment({
           id: 2,
           author: 'bob',
           body: 'Second thread.',
+          createdAt: '2026-05-14T00:00:00Z',
           threadId: 'thread-2',
           path: 'src/b.ts',
           isResolved: false
@@ -499,3 +545,62 @@ describe('PRCommentsList comment resolution selection', () => {
     expect(hasButton('Send 1 queued comments to AI')).toBe(true)
   })
 })
+
+describe('PRCommentsList comment ordering', () => {
+  const labels = ['Oldest note.', 'Middle note.', 'Newest note.']
+
+  it('reads newest-first in grouped mode and oldest-first in timeline mode', () => {
+    renderList({
+      comments: [
+        comment({ id: 1, body: 'Middle note.', createdAt: '2026-05-14T00:00:00Z' }),
+        comment({ id: 2, body: 'Newest note.', createdAt: '2026-05-15T00:00:00Z' }),
+        comment({ id: 3, body: 'Oldest note.', createdAt: '2026-05-13T00:00:00Z' })
+      ]
+    })
+
+    expect(renderedGroupOrder(labels)).toEqual(['Newest note.', 'Middle note.', 'Oldest note.'])
+
+    selectDisplayMode('Timeline')
+
+    expect(renderedGroupOrder(labels)).toEqual(['Oldest note.', 'Middle note.', 'Newest note.'])
+  })
+
+  it('ranks a replied-to thread by its fresh reply in grouped mode only', () => {
+    const threadLabels = ['Replied thread.', 'Quiet thread.']
+    renderList({
+      comments: [
+        comment({
+          id: 1,
+          body: 'Replied thread.',
+          createdAt: '2026-05-14T00:00:00Z',
+          threadId: 'thread-1',
+          path: 'src/a.ts',
+          isResolved: false
+        }),
+        comment({
+          id: 2,
+          body: 'Quiet thread.',
+          createdAt: '2026-05-13T00:00:00Z',
+          threadId: 'thread-2',
+          path: 'src/b.ts',
+          isResolved: false
+        }),
+        comment({
+          id: 3,
+          body: 'Fresh reply.',
+          createdAt: '2026-05-16T00:00:00Z',
+          threadId: 'thread-1',
+          path: 'src/a.ts',
+          isResolved: false
+        })
+      ]
+    })
+
+    expect(renderedGroupOrder(threadLabels)).toEqual(['Replied thread.', 'Quiet thread.'])
+
+    // Why: timeline ranks by when a thread started, so the quiet older root leads again.
+    selectDisplayMode('Timeline')
+
+    expect(renderedGroupOrder(threadLabels)).toEqual(['Quiet thread.', 'Replied thread.'])
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/pr-comments-list-selection.ts b/src/renderer/src/components/right-sidebar/pr-comments-list-selection.ts
index 6767e405c05..6245f6ff131 100644
--- a/src/renderer/src/components/right-sidebar/pr-comments-list-selection.ts
+++ b/src/renderer/src/components/right-sidebar/pr-comments-list-selection.ts
@@ -1,5 +1,9 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { getPRCommentGroupId, groupPRComments, type PRCommentGroup } from '@/lib/pr-comment-groups'
+import {
+  getPRCommentGroupId,
+  groupPRComments,
+  type PRCommentGroup
+} from '../../../../shared/pr-comment-groups'
 import { isPRCommentGroupQueueableForAI } from '@/lib/pr-comment-action-state'
 import type { PRComment } from '../../../../shared/types'
 
diff --git a/src/renderer/src/components/right-sidebar/source-control-create-review-blocked-action.ts b/src/renderer/src/components/right-sidebar/source-control-create-review-blocked-action.ts
index 1e5c02efb84..fd0824d41cc 100644
--- a/src/renderer/src/components/right-sidebar/source-control-create-review-blocked-action.ts
+++ b/src/renderer/src/components/right-sidebar/source-control-create-review-blocked-action.ts
@@ -33,6 +33,9 @@ export function resolveHostedReviewAuthInstruction(provider: HostedReviewProvide
   if (provider === 'gitea') {
     return 'Set ORCA_GITEA_TOKEN'
   }
+  if (provider === 'bitbucket') {
+    return 'Connect Bitbucket in Settings > Integrations'
+  }
   return 'Run gh auth login'
 }
 
diff --git a/src/renderer/src/components/right-sidebar/source-control-created-review-link.test.ts b/src/renderer/src/components/right-sidebar/source-control-created-review-link.test.ts
new file mode 100644
index 00000000000..f427fcc3b7a
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/source-control-created-review-link.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from 'vitest'
+import type { HostedReviewProvider } from '../../../../shared/hosted-review'
+import { resolveCreatedHostedReviewLink } from './source-control-created-review-link'
+
+describe('resolveCreatedHostedReviewLink', () => {
+  it.each([
+    ['github', { linkedPR: 42 }, { linkedGitHubPR: 42 }],
+    ['gitlab', { linkedGitLabMR: 42 }, { linkedGitLabMR: 42 }],
+    ['bitbucket', { linkedBitbucketPR: 42 }, { linkedBitbucketPR: 42 }],
+    ['azure-devops', { linkedAzureDevOpsPR: 42 }, { linkedAzureDevOpsPR: 42 }],
+    ['gitea', { linkedGiteaPR: 42 }, { linkedGiteaPR: 42 }]
+  ] as const)('links a created %s review by number', (provider, worktree, lookup) => {
+    expect(resolveCreatedHostedReviewLink(provider as HostedReviewProvider, 42)).toEqual({
+      worktree,
+      lookup
+    })
+  })
+
+  it('does not link an unsupported review provider', () => {
+    expect(resolveCreatedHostedReviewLink('unsupported', 42)).toEqual({
+      worktree: {},
+      lookup: {}
+    })
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/source-control-created-review-link.ts b/src/renderer/src/components/right-sidebar/source-control-created-review-link.ts
new file mode 100644
index 00000000000..0ca3d3db8ad
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/source-control-created-review-link.ts
@@ -0,0 +1,45 @@
+import type { HostedReviewProvider } from '../../../../shared/hosted-review'
+
+type WorktreeReviewLink = Partial<{
+  linkedPR: number
+  linkedGitLabMR: number
+  linkedBitbucketPR: number
+  linkedAzureDevOpsPR: number
+  linkedGiteaPR: number
+}>
+
+type HostedReviewLookupLink = Partial<{
+  linkedGitHubPR: number
+  linkedGitLabMR: number
+  linkedBitbucketPR: number
+  linkedAzureDevOpsPR: number
+  linkedGiteaPR: number
+}>
+
+export type CreatedHostedReviewLink = {
+  worktree: WorktreeReviewLink
+  lookup: HostedReviewLookupLink
+}
+
+export function resolveCreatedHostedReviewLink(
+  provider: HostedReviewProvider,
+  number: number
+): CreatedHostedReviewLink {
+  switch (provider) {
+    case 'github':
+      return { worktree: { linkedPR: number }, lookup: { linkedGitHubPR: number } }
+    case 'gitlab':
+      return { worktree: { linkedGitLabMR: number }, lookup: { linkedGitLabMR: number } }
+    case 'azure-devops':
+      return {
+        worktree: { linkedAzureDevOpsPR: number },
+        lookup: { linkedAzureDevOpsPR: number }
+      }
+    case 'gitea':
+      return { worktree: { linkedGiteaPR: number }, lookup: { linkedGiteaPR: number } }
+    case 'bitbucket':
+      return { worktree: { linkedBitbucketPR: number }, lookup: { linkedBitbucketPR: number } }
+    case 'unsupported':
+      return { worktree: {}, lookup: {} }
+  }
+}
diff --git a/src/renderer/src/components/right-sidebar/source-control-hosted-review-creation-eligibility-snapshot.test.ts b/src/renderer/src/components/right-sidebar/source-control-hosted-review-creation-eligibility-snapshot.test.ts
index ec4031c7aed..395e9bb9a3c 100644
--- a/src/renderer/src/components/right-sidebar/source-control-hosted-review-creation-eligibility-snapshot.test.ts
+++ b/src/renderer/src/components/right-sidebar/source-control-hosted-review-creation-eligibility-snapshot.test.ts
@@ -189,7 +189,7 @@ describe('buildLocalBlockerHostedReviewCreationEligibility', () => {
 
   it('returns null for providers that do not support hosted review creation', () => {
     expect(
-      buildLocalBlockerHostedReviewCreationEligibility('bitbucket', {
+      buildLocalBlockerHostedReviewCreationEligibility('unsupported', {
         ...featureBranch,
         hasUncommittedChanges: true,
         hasUpstream: false,
@@ -258,7 +258,7 @@ describe('buildCreatePrIntentUnavailableEligibility', () => {
 
   it('never synthesizes intent eligibility for an unsupported remote provider', () => {
     expect(
-      buildCreatePrIntentUnavailableEligibility('bitbucket', {
+      buildCreatePrIntentUnavailableEligibility('unsupported', {
         ...featureBranch,
         hasUncommittedChanges: true,
         hasUpstream: true,
diff --git a/src/renderer/src/components/right-sidebar/source-control-text-generation-defaults.ts b/src/renderer/src/components/right-sidebar/source-control-text-generation-defaults.ts
index 89212dd6149..08bc9fb6d9d 100644
--- a/src/renderer/src/components/right-sidebar/source-control-text-generation-defaults.ts
+++ b/src/renderer/src/components/right-sidebar/source-control-text-generation-defaults.ts
@@ -21,7 +21,7 @@ function textGenerationRecipeIsConfigured(
   actionId: SourceControlTextActionId,
   recipe: TextGenerationRecipeConfiguration | null | undefined
 ): boolean {
-  if (Object.prototype.hasOwnProperty.call(recipe ?? {}, 'agentId')) {
+  if (Object.hasOwn(recipe ?? {}, 'agentId')) {
     return true
   }
   if (
diff --git a/src/renderer/src/components/right-sidebar/use-hosted-review-actions.test.tsx b/src/renderer/src/components/right-sidebar/use-hosted-review-actions.test.tsx
index 1eae2a150bc..09fd8fe4133 100644
--- a/src/renderer/src/components/right-sidebar/use-hosted-review-actions.test.tsx
+++ b/src/renderer/src/components/right-sidebar/use-hosted-review-actions.test.tsx
@@ -46,10 +46,14 @@ function makeRepo(overrides: Partial<Repo> = {}): Repo {
   } as Repo
 }
 
-function HookProbe(props: { repo: Repo; onRefreshReview: () => Promise<void> }): null {
+function HookProbe(props: {
+  repo: Repo
+  onRefreshReview: () => Promise<void>
+  pullRequest?: PRInfo
+}): null {
   latest = useHostedReviewActions({
     review,
-    githubPR,
+    githubPR: props.pullRequest ?? githubPR,
     repo: props.repo,
     isGitLab: false,
     shortLabel: 'PR',
@@ -61,12 +65,16 @@ function HookProbe(props: { repo: Repo; onRefreshReview: () => Promise<void> }):
   return null
 }
 
-async function renderHook(repo: Repo, onRefreshReview = vi.fn().mockResolvedValue(undefined)) {
+async function renderHook(
+  repo: Repo,
+  onRefreshReview = vi.fn().mockResolvedValue(undefined),
+  pullRequest?: PRInfo
+) {
   const container = document.createElement('div')
   document.body.appendChild(container)
   root = createRoot(container)
   await act(async () => {
-    root?.render(createElement(HookProbe, { repo, onRefreshReview }))
+    root?.render(createElement(HookProbe, { repo, onRefreshReview, pullRequest }))
   })
   return { onRefreshReview }
 }
@@ -115,7 +123,7 @@ describe('useHostedReviewActions', () => {
         method: 'squash',
         prRepo
       },
-      { timeoutMs: 30_000 }
+      { timeoutMs: 4 * 60_000 }
     )
     expect(window.api.gh.mergePR).not.toHaveBeenCalled()
     expect(onRefreshReview).toHaveBeenCalledTimes(1)
@@ -140,4 +148,103 @@ describe('useHostedReviewActions', () => {
     expect(runtimeRpcMocks.callRuntimeRpc).not.toHaveBeenCalled()
     expect(onRefreshReview).toHaveBeenCalledTimes(1)
   })
+
+  it('confirms the downstack merge scope before merging a registered stack', async () => {
+    const stackedPR = {
+      ...githubPR,
+      stack: {
+        number: 51,
+        position: 2,
+        size: 3,
+        baseRefName: 'main',
+        entries: [
+          {
+            position: 1,
+            number: 1014,
+            title: 'Models',
+            url: 'https://github.com/stablyai/orca/pull/1014',
+            state: 'open',
+            checksStatus: 'success',
+            mergeable: 'MERGEABLE'
+          },
+          {
+            position: 2,
+            number: 1015,
+            title: 'API',
+            url: 'https://github.com/stablyai/orca/pull/1015',
+            state: 'open',
+            checksStatus: 'success',
+            mergeable: 'MERGEABLE'
+          },
+          {
+            position: 3,
+            number: 1016,
+            title: 'UI',
+            url: 'https://github.com/stablyai/orca/pull/1016',
+            state: 'open',
+            checksStatus: 'success',
+            mergeable: 'MERGEABLE'
+          }
+        ]
+      }
+    } as PRInfo
+    await renderHook(makeRepo(), undefined, stackedPR)
+
+    await act(async () => {
+      await latest?.handleMerge('squash')
+    })
+
+    expect(confirmationMocks.confirm).toHaveBeenCalledWith({
+      title: 'Merge through #1015?',
+      description:
+        'Included: #1014, #1015. GitHub will merge 2 pull requests atomically using squash. If any cannot merge, none will.',
+      confirmLabel: 'Merge 2 PRs'
+    })
+    expect(window.api.gh.mergePR).toHaveBeenCalledTimes(1)
+  })
+
+  it('describes merge-queue stack behavior without promising atomicity or a method', async () => {
+    const stackedPR = {
+      ...githubPR,
+      mergeQueueRequired: true,
+      stack: {
+        number: 51,
+        position: 2,
+        size: 2,
+        baseRefName: 'main',
+        entries: [
+          {
+            position: 1,
+            number: 1014,
+            title: 'Models',
+            url: 'https://github.com/stablyai/orca/pull/1014',
+            state: 'open',
+            checksStatus: 'success',
+            mergeable: 'MERGEABLE'
+          },
+          {
+            position: 2,
+            number: 1015,
+            title: 'API',
+            url: 'https://github.com/stablyai/orca/pull/1015',
+            state: 'open',
+            checksStatus: 'success',
+            mergeable: 'MERGEABLE'
+          }
+        ]
+      }
+    } as PRInfo
+    await renderHook(makeRepo(), undefined, stackedPR)
+
+    await act(async () => {
+      await latest?.handleMerge('squash')
+    })
+
+    expect(confirmationMocks.confirm).toHaveBeenCalledWith({
+      title: 'Queue through #1015?',
+      description:
+        'Included: #1014, #1015. GitHub will add 2 pull requests to the merge queue together. The queue chooses the merge method and may merge them in separate groups.',
+      confirmLabel: 'Queue 2 PRs'
+    })
+  })
 })
diff --git a/src/renderer/src/components/right-sidebar/use-hosted-review-actions.ts b/src/renderer/src/components/right-sidebar/use-hosted-review-actions.ts
index eec79060650..6830fe86eee 100644
--- a/src/renderer/src/components/right-sidebar/use-hosted-review-actions.ts
+++ b/src/renderer/src/components/right-sidebar/use-hosted-review-actions.ts
@@ -10,6 +10,7 @@ import {
   updateGitHubHostedReviewState
 } from './hosted-review-github-actions'
 import { translate } from '@/i18n/i18n'
+import { buildGitHubPRStackMergeConfirmation } from './github-pr-stack-confirmation'
 
 export type HostedReviewActionInfo = Pick<
   HostedReviewInfo,
@@ -62,6 +63,21 @@ export function useHostedReviewActions({
 
   const handleMerge = useCallback(
     async (method: GitHubPRMergeMethod = defaultMergeMethod) => {
+      if (!isGitLab && githubPR?.stack) {
+        const usesMergeQueue =
+          review.mergeQueueRequired === true || githubPR.mergeQueueRequired === true
+        const confirmed = await confirm(
+          buildGitHubPRStackMergeConfirmation({
+            stack: githubPR.stack,
+            currentPRNumber: review.number,
+            method,
+            usesMergeQueue
+          })
+        )
+        if (!confirmed) {
+          return
+        }
+      }
       setMerging(true)
       setActionError(null)
       try {
@@ -89,7 +105,18 @@ export function useHostedReviewActions({
         setMerging(false)
       }
     },
-    [githubPR?.prRepo, isGitLab, defaultMergeMethod, onRefreshReview, repo, review.number]
+    [
+      confirm,
+      githubPR?.prRepo,
+      githubPR?.mergeQueueRequired,
+      githubPR?.stack,
+      isGitLab,
+      defaultMergeMethod,
+      onRefreshReview,
+      repo,
+      review.mergeQueueRequired,
+      review.number
+    ]
   )
 
   const handleAutoMerge = useCallback(async () => {
diff --git a/src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.repo-default.test.ts b/src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.repo-default.test.ts
new file mode 100644
index 00000000000..3121d553423
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.repo-default.test.ts
@@ -0,0 +1,145 @@
+// @vitest-environment happy-dom
+
+import React, { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { HostedReviewCreationEligibility } from '../../../../shared/hosted-review'
+
+const getRuntimeRepoBaseRefDefault = vi.fn()
+
+vi.mock('@/runtime/runtime-repo-client', () => ({
+  getRuntimeRepoBaseRefDefault: (...args: unknown[]) => getRuntimeRepoBaseRefDefault(...args),
+  searchRuntimeRepoBaseRefDetails: vi.fn(async () => [])
+}))
+
+const { useCreatePullRequestDialogFields } = await import('./useCreatePullRequestDialogFields')
+
+type DialogFields = ReturnType<typeof useCreatePullRequestDialogFields>
+
+function eligibilityFor(defaultBaseRef: string): HostedReviewCreationEligibility {
+  return {
+    provider: 'github',
+    review: null,
+    canCreate: true,
+    blockedReason: null,
+    nextAction: null,
+    reviewLookupOutcome: 'not_found',
+    defaultBaseRef,
+    title: 'Review title',
+    body: 'Review body'
+  }
+}
+
+function renderFields(initialRepoId: string): {
+  current: () => DialogFields
+  switchRepo: (repoId: string, defaultBaseRef: string) => Promise<void>
+  unmount: () => void
+} {
+  globalThis.IS_REACT_ACT_ENVIRONMENT = true
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const root: Root = createRoot(container)
+  let latest: DialogFields | null = null
+  let repoId = initialRepoId
+  let eligibility = eligibilityFor('refs/remotes/origin/main')
+
+  function Harness(): null {
+    latest = useCreatePullRequestDialogFields({
+      open: true,
+      repoId,
+      worktreeId: `wt-${repoId}`,
+      worktreePath: '/repo/wt',
+      branch: 'feature/child',
+      eligibility,
+      settings: null,
+      submitting: false
+    })
+    return null
+  }
+
+  const render = async (): Promise<void> => {
+    await act(async () => {
+      root.render(React.createElement(Harness))
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+  }
+
+  return {
+    current: () => {
+      if (!latest) {
+        throw new Error('dialog fields were not rendered')
+      }
+      return latest
+    },
+    switchRepo: async (nextRepoId, defaultBaseRef) => {
+      repoId = nextRepoId
+      eligibility = eligibilityFor(defaultBaseRef)
+      await render()
+    },
+    unmount: () => {
+      act(() => root.unmount())
+      container.remove()
+    }
+  }
+}
+
+beforeEach(() => {
+  getRuntimeRepoBaseRefDefault.mockReset()
+})
+
+describe('useCreatePullRequestDialogFields repo default base ref', () => {
+  it('reports the repo default branch, not the worktree base from eligibility', async () => {
+    getRuntimeRepoBaseRefDefault.mockResolvedValue({
+      defaultBaseRef: 'refs/remotes/origin/main',
+      remoteCount: 1
+    })
+    const harness = renderFields('repo-1')
+    try {
+      await harness.switchRepo('repo-1', 'refs/remotes/origin/feature/parent')
+
+      expect(harness.current().repoDefaultBaseRef).toBe('main')
+      // Eligibility still drives the field itself; only the "is this the repo
+      // default?" answer comes from the repo lookup.
+      expect(harness.current().base).toBe('feature/parent')
+    } finally {
+      harness.unmount()
+    }
+  })
+
+  it('probes the repo default once per repo', async () => {
+    getRuntimeRepoBaseRefDefault.mockResolvedValue({
+      defaultBaseRef: 'refs/remotes/origin/main',
+      remoteCount: 1
+    })
+    const harness = renderFields('repo-1')
+    try {
+      await harness.switchRepo('repo-1', 'refs/remotes/origin/feature/parent')
+      await harness.switchRepo('repo-1', 'refs/remotes/origin/feature/other')
+
+      expect(getRuntimeRepoBaseRefDefault).toHaveBeenCalledTimes(1)
+      expect(harness.current().repoDefaultBaseRef).toBe('main')
+    } finally {
+      harness.unmount()
+    }
+  })
+
+  it('drops a previous repo default instead of applying it to the next repo', async () => {
+    getRuntimeRepoBaseRefDefault.mockResolvedValue({
+      defaultBaseRef: 'refs/remotes/origin/main',
+      remoteCount: 1
+    })
+    const harness = renderFields('repo-1')
+    try {
+      await harness.switchRepo('repo-1', 'refs/remotes/origin/main')
+      expect(harness.current().repoDefaultBaseRef).toBe('main')
+
+      getRuntimeRepoBaseRefDefault.mockReturnValue(new Promise(() => {}))
+      await harness.switchRepo('repo-2', 'refs/remotes/origin/trunk')
+
+      expect(harness.current().repoDefaultBaseRef).toBeNull()
+    } finally {
+      harness.unmount()
+    }
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.ts b/src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.ts
index 1bc838642a0..c9720c751bf 100644
--- a/src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.ts
+++ b/src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.ts
@@ -166,8 +166,14 @@ export function useCreatePullRequestDialogFields({
   const [title, setTitle] = useState('')
   const [body, setBody] = useState('')
   const [draft, setDraft] = useState(false)
+  // Why: stamped with the repo it came from — this hook outlives a repo switch, and a
+  // previous repo's default branch would silently suppress the stacked-PR lookup.
+  const [repoDefault, setRepoDefault] = useState<{ repoId: string; baseRef: string } | null>(null)
   const [baseQuery, setBaseQuery] = useState('')
   const [baseResults, setBaseResults] = useState<string[]>([])
+  // Why: lets the picker withhold "no branches match" until a search settles, so
+  // the debounce and an SSH round-trip can't read as an observed absence.
+  const [baseSearchPending, setBaseSearchPending] = useState(false)
   const [baseSearchError, setBaseSearchError] = useState<string | null>(null)
   const [generating, setGenerating] = useState(false)
   const [generateError, setGenerateError] = useState<string | null>(null)
@@ -397,31 +403,46 @@ export function useCreatePullRequestDialogFields({
 
   const effectiveGenerating = generation?.generating ?? generating
   const effectiveGenerateError = generation?.generateError ?? generateError
+  const repoDefaultBaseRef = repoDefault?.repoId === repoId ? repoDefault.baseRef : null
 
+  // Why: resolved separately from eligibility's defaultBaseRef, which reports the
+  // worktree's own base. Consumers that need "is this the repo's default branch?"
+  // must ask this one, not that one.
   useEffect(() => {
-    if (!open || base) {
+    // Why: the repo default doesn't move while a repo stays open, so skip the probe
+    // once it is known — on a remote runtime it is an RPC round-trip per composer open.
+    if (!open || repoDefaultBaseRef) {
       return
     }
     let stale = false
     void getRuntimeRepoBaseRefDefault(settings, repoId)
       .then((result) => {
         if (!stale && result.defaultBaseRef) {
-          setBase(stripBaseRef(result.defaultBaseRef))
+          setRepoDefault({ repoId, baseRef: stripBaseRef(result.defaultBaseRef) })
         }
       })
       .catch(() => undefined)
     return () => {
       stale = true
     }
-  }, [base, open, repoId, settings])
+  }, [open, repoDefaultBaseRef, repoId, settings])
+
+  useEffect(() => {
+    if (!open || base || !repoDefaultBaseRef) {
+      return
+    }
+    setBase(repoDefaultBaseRef)
+  }, [base, open, repoDefaultBaseRef])
 
   useEffect(() => {
     if (!open || baseQuery.trim().length < 2) {
       setBaseResults([])
+      setBaseSearchPending(false)
       setBaseSearchError(null)
       return
     }
     let stale = false
+    setBaseSearchPending(true)
     const timer = window.setTimeout(() => {
       void searchRuntimeRepoBaseRefDetails(settings, repoId, baseQuery.trim(), 20)
         .then((results) => {
@@ -436,6 +457,11 @@ export function useCreatePullRequestDialogFields({
             setBaseSearchError('Branch discovery failed.')
           }
         })
+        .finally(() => {
+          if (!stale) {
+            setBaseSearchPending(false)
+          }
+        })
     }, 200)
     return () => {
       stale = true
@@ -608,12 +634,15 @@ export function useCreatePullRequestDialogFields({
     setBody: setUserBody,
     draft,
     setDraft: setUserDraft,
+    stackedCreationSupported: eligibility?.stackedCreationSupported === true,
+    repoDefaultBaseRef,
     fieldRevisions: fieldRevisionsRef.current,
     applyGeneratedFields,
     baseQuery,
     setBaseQuery,
     baseResults,
     setBaseResults,
+    baseSearchPending,
     baseSearchError,
     generating: effectiveGenerating,
     generateError: effectiveGenerateError,
diff --git a/src/renderer/src/components/right-sidebar/useGitHistoryCommitActions.ts b/src/renderer/src/components/right-sidebar/useGitHistoryCommitActions.ts
index ed943889453..c60c6f1f3e0 100644
--- a/src/renderer/src/components/right-sidebar/useGitHistoryCommitActions.ts
+++ b/src/renderer/src/components/right-sidebar/useGitHistoryCommitActions.ts
@@ -18,6 +18,7 @@ import {
   type SourceControlRowOpenEvent
 } from './source-control-split-open'
 import type { GitHistoryCommitAction } from './GitHistoryCommitContextMenu'
+import { openWorkspaceBrowserTab } from '@/lib/workspace-browser-tab-open'
 
 const EMPTY_BRANCH_CHANGE_ENTRIES: GitBranchChangeEntry[] = []
 
@@ -47,7 +48,6 @@ export function useGitHistoryCommitActions({
 }): GitHistoryCommitActions {
   const openCommitAllDiffs = useAppStore((s) => s.openCommitAllDiffs)
   const openCommitDiff = useAppStore((s) => s.openCommitDiff)
-  const createBrowserTab = useAppStore((s) => s.createBrowserTab)
 
   // Caches each commit's compare result so expanding a commit fetches its files
   // once, and opening a single file (or the combined diff) reuses that same
@@ -202,16 +202,20 @@ export function useGitHistoryCommitActions({
           { sha: item.id }
         )
           .then((url) => {
-            if (url) {
-              createBrowserTab(activeWorktreeId, url, { activate: true })
-            } else {
+            if (!url) {
               toast.error(
                 translate(
                   'auto.components.right.sidebar.SourceControl.04a5d7239b',
                   'This repository has no supported web remote'
                 )
               )
+              return
             }
+            return openWorkspaceBrowserTab({
+              workspaceId: activeWorktreeId,
+              url,
+              intent: { kind: 'url' }
+            })
           })
           .catch(() => {
             toast.error(
@@ -279,7 +283,7 @@ export function useGitHistoryCommitActions({
         promptDelivery: 'submit-after-ready'
       })
     },
-    [activeRepoSettings, activeWorktreeId, copyCommitText, createBrowserTab, worktreePath]
+    [activeRepoSettings, activeWorktreeId, copyCommitText, worktreePath]
   )
 
   return { loadCommitFiles, openHistoryCommitDiff, openCommitFile, handleCommitAction }
diff --git a/src/renderer/src/components/right-sidebar/useGitStatusPolling.rerender.test.ts b/src/renderer/src/components/right-sidebar/useGitStatusPolling.rerender.test.ts
index 2f9c3ddabdb..348bf8a1f36 100644
--- a/src/renderer/src/components/right-sidebar/useGitStatusPolling.rerender.test.ts
+++ b/src/renderer/src/components/right-sidebar/useGitStatusPolling.rerender.test.ts
@@ -217,7 +217,7 @@ describe('useGitStatusPolling rerender stability', () => {
     useAppStore.setState({
       repos: [{ ...repo, connectionId: 'ssh-1' }],
       sshConnectionStates: new Map([
-        ['ssh-1', { status: 'disconnected', error: null, reconnectAttempt: 0 }]
+        ['ssh-1', { targetId: 'ssh-1', status: 'disconnected', error: null, reconnectAttempt: 0 }]
       ])
     } as Partial<AppState>)
     await renderHook()
diff --git a/src/renderer/src/components/right-sidebar/useHostedReviewStackParent.test.tsx b/src/renderer/src/components/right-sidebar/useHostedReviewStackParent.test.tsx
new file mode 100644
index 00000000000..0a3b9623444
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/useHostedReviewStackParent.test.tsx
@@ -0,0 +1,154 @@
+// @vitest-environment happy-dom
+
+import { act, renderHook } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { HostedReviewInfo } from '../../../../shared/hosted-review'
+import { useHostedReviewStackParent } from './useHostedReviewStackParent'
+
+function makeReview(overrides: Partial<HostedReviewInfo> = {}): HostedReviewInfo {
+  return {
+    provider: 'github',
+    number: 13741,
+    title: 'Parent review',
+    state: 'open',
+    url: 'https://github.com/stablyai/orca/pull/13741',
+    status: 'success',
+    updatedAt: '2026-08-11T00:00:00.000Z',
+    mergeable: 'MERGEABLE',
+    ...overrides
+  }
+}
+
+const baseOptions = {
+  enabled: true,
+  repoPath: '/repo/orca',
+  repoId: 'repo-1',
+  base: 'feature/parent',
+  repoDefaultBase: 'main',
+  head: 'feature/child'
+}
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('useHostedReviewStackParent', () => {
+  it('debounces the active branch lookup and preserves repo routing context', async () => {
+    vi.useFakeTimers()
+    const fetchHostedReviewForBranch = vi.fn(async () => makeReview())
+    const { result } = renderHook(() =>
+      useHostedReviewStackParent({ ...baseOptions, fetchHostedReviewForBranch })
+    )
+
+    await act(async () => vi.advanceTimersByTime(299))
+    expect(fetchHostedReviewForBranch).not.toHaveBeenCalled()
+
+    await act(async () => vi.advanceTimersByTime(1))
+
+    expect(fetchHostedReviewForBranch).toHaveBeenCalledWith('/repo/orca', 'feature/parent', {
+      repoId: 'repo-1',
+      active: true
+    })
+    expect(result.current).toEqual({
+      number: 13741,
+      url: 'https://github.com/stablyai/orca/pull/13741'
+    })
+  })
+
+  it('looks up the worktree base branch a child forked from', async () => {
+    vi.useFakeTimers()
+    const fetchHostedReviewForBranch = vi.fn(async () => makeReview())
+    const { result } = renderHook(() =>
+      useHostedReviewStackParent({
+        ...baseOptions,
+        // The worktree was created off feature/parent, so eligibility reports it as
+        // the default base; the repo default is still main and stacking still applies.
+        base: 'feature/parent',
+        repoDefaultBase: 'main',
+        fetchHostedReviewForBranch
+      })
+    )
+
+    await act(async () => vi.runAllTimers())
+
+    expect(fetchHostedReviewForBranch).toHaveBeenCalledTimes(1)
+    expect(result.current?.number).toBe(13741)
+  })
+
+  it.each([
+    { base: 'origin/main', repoDefaultBase: 'main', head: 'feature/child' },
+    { base: 'refs/heads/feature/child', repoDefaultBase: 'main', head: 'feature/child' },
+    { base: '', repoDefaultBase: 'main', head: 'feature/child' }
+  ])('skips ineligible base $base', async (options) => {
+    vi.useFakeTimers()
+    const fetchHostedReviewForBranch = vi.fn(async () => makeReview())
+    renderHook(() =>
+      useHostedReviewStackParent({
+        ...baseOptions,
+        ...options,
+        fetchHostedReviewForBranch
+      })
+    )
+
+    await act(async () => vi.runAllTimers())
+
+    expect(fetchHostedReviewForBranch).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    makeReview({ provider: 'gitlab' }),
+    makeReview({ state: 'closed' }),
+    makeReview({ state: 'merged' })
+  ])('rejects a non-open GitHub review', async (review) => {
+    vi.useFakeTimers()
+    const fetchHostedReviewForBranch = vi.fn(async () => review)
+    const { result } = renderHook(() =>
+      useHostedReviewStackParent({ ...baseOptions, fetchHostedReviewForBranch })
+    )
+
+    await act(async () => vi.runAllTimers())
+
+    expect(result.current).toBeNull()
+  })
+
+  it.each(['open', 'draft'] as const)('accepts a %s GitHub review', async (state) => {
+    vi.useFakeTimers()
+    const fetchHostedReviewForBranch = vi.fn(async () => makeReview({ state }))
+    const { result } = renderHook(() =>
+      useHostedReviewStackParent({ ...baseOptions, fetchHostedReviewForBranch })
+    )
+
+    await act(async () => vi.runAllTimers())
+
+    expect(result.current?.number).toBe(13741)
+  })
+
+  it('ignores a stale result after the base changes', async () => {
+    vi.useFakeTimers()
+    let resolveFirst: (review: HostedReviewInfo) => void = () => undefined
+    let resolveSecond: (review: HostedReviewInfo) => void = () => undefined
+    const first = new Promise<HostedReviewInfo>((resolve) => {
+      resolveFirst = resolve
+    })
+    const second = new Promise<HostedReviewInfo>((resolve) => {
+      resolveSecond = resolve
+    })
+    const fetchHostedReviewForBranch = vi.fn((_repoPath: string, branch: string) =>
+      branch === 'feature/first' ? first : second
+    )
+    const { result, rerender } = renderHook(
+      ({ base }) =>
+        useHostedReviewStackParent({ ...baseOptions, base, fetchHostedReviewForBranch }),
+      { initialProps: { base: 'feature/first' } }
+    )
+
+    await act(async () => vi.advanceTimersByTime(300))
+    rerender({ base: 'feature/second' })
+    await act(async () => vi.advanceTimersByTime(300))
+    await act(async () => resolveSecond(makeReview({ number: 22, url: 'https://example.test/22' })))
+    expect(result.current?.number).toBe(22)
+
+    await act(async () => resolveFirst(makeReview({ number: 11, url: 'https://example.test/11' })))
+    expect(result.current?.number).toBe(22)
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/useHostedReviewStackParent.ts b/src/renderer/src/components/right-sidebar/useHostedReviewStackParent.ts
new file mode 100644
index 00000000000..8fa41ba89f3
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/useHostedReviewStackParent.ts
@@ -0,0 +1,92 @@
+import { useEffect, useState } from 'react'
+import type { HostedReviewInfo } from '../../../../shared/hosted-review'
+import { normalizeHostedReviewBaseRef } from '../../../../shared/hosted-review-refs'
+
+export type HostedReviewStackParent = Pick<HostedReviewInfo, 'number' | 'url'>
+
+type FetchHostedReviewForBranch = (
+  repoPath: string,
+  branch: string,
+  options?: { repoId?: string; active?: boolean }
+) => Promise<HostedReviewInfo | null>
+
+type UseHostedReviewStackParentOptions = {
+  enabled: boolean
+  repoPath: string
+  repoId?: string | null
+  base: string
+  /**
+   * The repo's own default branch — not the worktree's base. Stacking on the
+   * repo default is meaningless, so that one case skips the lookup; every other
+   * base still gets one, including the worktree base a child branch forked from
+   * (the case stacking exists for).
+   */
+  repoDefaultBase?: string | null
+  head: string
+  fetchHostedReviewForBranch: FetchHostedReviewForBranch
+}
+
+type SettledLookup = {
+  key: string
+  review: HostedReviewStackParent | null
+}
+
+const LOOKUP_DEBOUNCE_MS = 300
+
+export function useHostedReviewStackParent({
+  enabled,
+  repoPath,
+  repoId,
+  base,
+  repoDefaultBase,
+  head,
+  fetchHostedReviewForBranch
+}: UseHostedReviewStackParentOptions): HostedReviewStackParent | null {
+  const normalizedBase = normalizeHostedReviewBaseRef(base).trim()
+  const normalizedDefault = normalizeHostedReviewBaseRef(repoDefaultBase ?? '').trim()
+  const normalizedHead = normalizeHostedReviewBaseRef(head).trim()
+  const canLookup =
+    enabled &&
+    repoPath.length > 0 &&
+    normalizedBase.length > 0 &&
+    normalizedBase.toLowerCase() !== normalizedDefault.toLowerCase() &&
+    normalizedBase.toLowerCase() !== normalizedHead.toLowerCase()
+  const lookupKey = canLookup ? `${repoId ?? repoPath}:${normalizedBase}` : null
+  const [settled, setSettled] = useState<SettledLookup | null>(null)
+
+  useEffect(() => {
+    if (!lookupKey) {
+      return
+    }
+    let cancelled = false
+    const timer = setTimeout(() => {
+      void fetchHostedReviewForBranch(repoPath, normalizedBase, {
+        ...(repoId ? { repoId } : {}),
+        active: true
+      }).then(
+        (review) => {
+          if (cancelled) {
+            return
+          }
+          const openGitHubReview =
+            review?.provider === 'github' && (review.state === 'open' || review.state === 'draft')
+              ? { number: review.number, url: review.url }
+              : null
+          setSettled({ key: lookupKey, review: openGitHubReview })
+        },
+        () => {
+          if (!cancelled) {
+            setSettled({ key: lookupKey, review: null })
+          }
+        }
+      )
+    }, LOOKUP_DEBOUNCE_MS)
+
+    return () => {
+      cancelled = true
+      clearTimeout(timer)
+    }
+  }, [fetchHostedReviewForBranch, lookupKey, normalizedBase, repoId, repoPath])
+
+  return lookupKey && settled?.key === lookupKey ? settled.review : null
+}
diff --git a/src/renderer/src/components/settings/AccountsPane.tsx b/src/renderer/src/components/settings/AccountsPane.tsx
index 81dd540ff5f..c8500b99cfa 100644
--- a/src/renderer/src/components/settings/AccountsPane.tsx
+++ b/src/renderer/src/components/settings/AccountsPane.tsx
@@ -383,12 +383,12 @@ export function AccountsPane({
     useState<CodexRateLimitAccountsState>(emptyCodexAccountsState)
   const [codexAccountsLoaded, setCodexAccountsLoaded] = useState(false)
   const [codexAction, setCodexAction] = useState<
-    'idle' | 'adding' | `reauth:${string}` | `remove:${string}` | `select:${string | 'system'}`
+    'idle' | 'adding' | `reauth:${string}` | `remove:${string}` | `select:${string}`
   >('idle')
   const [claudeAccounts, setClaudeAccounts] =
     useState<ClaudeRateLimitAccountsState>(emptyClaudeAccountsState)
   const [claudeAction, setClaudeAction] = useState<
-    'idle' | 'adding' | `reauth:${string}` | `remove:${string}` | `select:${string | 'system'}`
+    'idle' | 'adding' | `reauth:${string}` | `remove:${string}` | `select:${string}`
   >('idle')
   // Why: capture the account's runtime slot when the dialog opens; the roster
   // can change underneath an open dialog and lose the slot to diff for restarts.
diff --git a/src/renderer/src/components/settings/AgentAwakeSetting.tsx b/src/renderer/src/components/settings/AgentAwakeSetting.tsx
index 7df934be0c7..216dff6facf 100644
--- a/src/renderer/src/components/settings/AgentAwakeSetting.tsx
+++ b/src/renderer/src/components/settings/AgentAwakeSetting.tsx
@@ -57,7 +57,7 @@ export function AgentAwakeSetting({
               },
               {
                 value: 'auto',
-                label: translate('auto.components.settings.AgentAwakeSetting.auto', 'Auto')
+                label: translate('auto.components.settings.AgentAwakeSetting.auto', 'Agent')
               },
               {
                 value: 'off',
diff --git a/src/renderer/src/components/settings/AgentSkillSetupPanel.test.tsx b/src/renderer/src/components/settings/AgentSkillSetupPanel.test.tsx
index 158ac81c408..64476a005ef 100644
--- a/src/renderer/src/components/settings/AgentSkillSetupPanel.test.tsx
+++ b/src/renderer/src/components/settings/AgentSkillSetupPanel.test.tsx
@@ -15,6 +15,8 @@ const mocks = vi.hoisted(() => ({
   terminalProps: [] as {
     command: string
     description: string
+    shellOverride?: string
+    prepareCommandForShell?: (command: string, shellOverride?: string) => string
     onTerminalExit?: () => void
     onCommandFinished?: (bestEffortExitCode: number | null) => void
   }[],
@@ -46,6 +48,8 @@ vi.mock('../onboarding/OnboardingInlineCommandTerminal', () => ({
   OnboardingInlineCommandTerminal: (props: {
     command: string
     description: string
+    shellOverride?: string
+    prepareCommandForShell?: (command: string, shellOverride?: string) => string
     onTerminalExit?: () => void
     onCommandFinished?: (bestEffortExitCode: number | null) => void
   }) => {
@@ -171,6 +175,9 @@ describe('AgentSkillSetupPanel', () => {
         },
         ui: {
           writeClipboardText: mocks.clipboardWrite
+        },
+        platform: {
+          get: () => ({ platform: 'win32' })
         }
       }
     })
@@ -360,6 +367,27 @@ describe('AgentSkillSetupPanel', () => {
     expect(mocks.toastSuccess).toHaveBeenCalledWith('Copied command.')
   })
 
+  it('copies the POSIX WSL command while the setup pane runs the PowerShell wrapper', async () => {
+    await renderInteractivePanel({
+      terminalShellOverride: 'powershell.exe',
+      terminalRuntime: { runtime: 'wsl', wslDistro: 'Ubuntu', label: 'WSL Ubuntu' }
+    })
+
+    await clickButton('Install')
+
+    const terminalProps = mocks.terminalProps.at(-1)
+    expect(terminalProps?.command).toBe(INSTALL_COMMAND)
+    expect(terminalProps?.prepareCommandForShell?.(INSTALL_COMMAND, 'powershell.exe')).toMatch(
+      /^& \{ \$PSNativeCommandArgumentPassing = 'Legacy'; wsl\.exe -d 'Ubuntu'/
+    )
+    await act(async () => {
+      container
+        ?.querySelector<HTMLButtonElement>('button[aria-label="Copy command"]')
+        ?.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+    })
+    expect(mocks.clipboardWrite).toHaveBeenCalledWith(INSTALL_COMMAND)
+  })
+
   it('shows a visible pending state while CLI setup preflight is running', async () => {
     let resolvePreflight: (() => void) | null = null
     const preflight = new Promise<void>((resolve) => {
@@ -414,6 +442,76 @@ describe('AgentSkillSetupPanel', () => {
     expect(mocks.terminalProps.at(-1)).toMatchObject({ command: INSTALL_COMMAND })
   })
 
+  it('keeps an open terminal on the WSL runtime captured when it opened', async () => {
+    await renderInteractivePanel({
+      terminalShellOverride: 'powershell.exe',
+      terminalRuntime: { runtime: 'wsl', wslDistro: 'Ubuntu', label: 'WSL Ubuntu' }
+    })
+    await clickButton('Install')
+    const openedCommand = mocks.terminalProps.at(-1)?.command
+    const openedPrepareCommand = mocks.terminalProps.at(-1)?.prepareCommandForShell
+
+    await rerenderInteractivePanel({
+      terminalShellOverride: 'powershell.exe',
+      terminalRuntime: { runtime: 'wsl', wslDistro: 'Fedora', label: 'WSL Fedora' }
+    })
+
+    expect(mocks.terminalProps.at(-1)?.command).toBe(openedCommand)
+    expect(openedPrepareCommand?.(INSTALL_COMMAND, 'powershell.exe')).toContain(
+      "wsl.exe -d 'Ubuntu'"
+    )
+
+    await rerenderInteractivePanel({
+      terminalRuntime: { runtime: 'host', label: 'Windows' }
+    })
+
+    expect(mocks.terminalProps.at(-1)).toMatchObject({
+      command: openedCommand,
+      shellOverride: 'powershell.exe'
+    })
+  })
+
+  it('captures the current runtime when retrying a failed command', async () => {
+    await renderInteractivePanel({
+      terminalShellOverride: 'powershell.exe',
+      terminalRuntime: { runtime: 'wsl', wslDistro: 'Ubuntu', label: 'WSL Ubuntu' }
+    })
+    await clickButton('Install')
+    await act(async () => {
+      mocks.terminalProps.at(-1)?.onCommandFinished?.(1)
+    })
+
+    await rerenderInteractivePanel({
+      terminalShellOverride: 'powershell.exe',
+      terminalRuntime: { runtime: 'wsl', wslDistro: 'Fedora', label: 'WSL Fedora' }
+    })
+    expect(
+      mocks.terminalProps.at(-1)?.prepareCommandForShell?.(INSTALL_COMMAND, 'powershell.exe')
+    ).toContain("wsl.exe -d 'Ubuntu'")
+
+    await clickButton('Retry')
+
+    expect(
+      mocks.terminalProps.at(-1)?.prepareCommandForShell?.(INSTALL_COMMAND, 'powershell.exe')
+    ).toContain("wsl.exe -d 'Fedora'")
+
+    await act(async () => {
+      mocks.terminalProps.at(-1)?.onCommandFinished?.(1)
+    })
+    await rerenderInteractivePanel({
+      terminalShellOverride: 'powershell.exe',
+      terminalRuntime: { runtime: 'host', label: 'Windows' }
+    })
+
+    await clickButton('Retry')
+
+    const retryCommand = mocks.terminalProps
+      .at(-1)
+      ?.prepareCommandForShell?.(INSTALL_COMMAND, 'powershell.exe')
+    expect(retryCommand).toMatch(/^cmd\.exe \/d \/s \/c /)
+    expect(retryCommand).not.toContain('wsl.exe')
+  })
+
   it('falls back to the install command for installed callers without installedCommand', async () => {
     await renderInteractivePanel({ installed: true })
 
diff --git a/src/renderer/src/components/settings/AgentSkillSetupPanel.tsx b/src/renderer/src/components/settings/AgentSkillSetupPanel.tsx
index 8db579cfa2f..4d4da099310 100644
--- a/src/renderer/src/components/settings/AgentSkillSetupPanel.tsx
+++ b/src/renderer/src/components/settings/AgentSkillSetupPanel.tsx
@@ -5,7 +5,7 @@ import { IntegrationStatusPill } from '../integration-status-pill'
 import { SkillFreshnessStatusPill } from '../skills/SkillFreshnessStatusPill'
 import { OnboardingInlineCommandTerminal } from '../onboarding/OnboardingInlineCommandTerminal'
 import { AgentSkillSetupFailureNotice } from './AgentSkillSetupFailureNotice'
-import { buildSkillSetupTerminalCommand } from './CliSkillRuntimeSetup'
+import { createTerminalSnapshot, type SkillTerminalSnapshot } from './agent-skill-terminal-snapshot'
 import type { AgentSkillSetupPanelProps } from './agent-skill-setup-panel-props'
 import { Button } from '../ui/button'
 import { Tooltip, TooltipContent, TooltipTrigger } from '../ui/tooltip'
@@ -31,7 +31,8 @@ export function AgentSkillSetupPanel({
   error,
   installDisabled = false,
   terminalHeightPx,
-  terminalShellOverride,
+  terminalShellOverride: shellOverride,
+  terminalRuntime: runtime,
   leading,
   icon,
   variant = 'card',
@@ -59,7 +60,7 @@ export function AgentSkillSetupPanel({
     installedInstallLabel ??
     translate('auto.components.settings.AgentSkillSetupPanel.updateLabel', 'Update')
   const [terminalOpen, setTerminalOpen] = useState(false)
-  const [terminalCommand, setTerminalCommand] = useState<string | null>(null)
+  const [terminalSnapshot, setTerminalSnapshot] = useState<SkillTerminalSnapshot | null>(null)
   const [terminalAttempt, setTerminalAttempt] = useState(0)
   const [terminalOpening, setTerminalOpening] = useState(false)
   const [setupAttemptRunning, setSetupAttemptRunning] = useState(false)
@@ -74,16 +75,15 @@ export function AgentSkillSetupPanel({
     [getPrerequisiteStatus]
   )
   const activeCommand = installed ? (installedCommand ?? command) : command
-  // Why: the inline terminal auto-inserts when its command changes, so keep an
-  // already-open terminal pinned to the command selected by the user's click.
-  const openTerminalCommand = terminalCommand ?? activeCommand
+  // Why: the inline terminal auto-inserts when its command changes, so keep the
+  // already-open terminal pinned to the command and runtime selected at click.
+  const openTerminalCommand = terminalSnapshot?.copiedCommand ?? activeCommand
 
   const openSetupTerminal = (): void => {
     if (terminalOpening || setupAttemptRunning) {
       return
     }
-    const nextCommand =
-      setupCommandFailedCode !== null && terminalCommand ? terminalCommand : activeCommand
+    const nextSnapshot = createTerminalSnapshot(activeCommand, shellOverride, runtime)
     setTerminalOpening(true)
     if (setupCommandFailedCode !== null) {
       setTerminalOpen(false)
@@ -100,7 +100,7 @@ export function AgentSkillSetupPanel({
         if (mountedRef.current) {
           setTerminalOpening(false)
           if (shouldOpenTerminal) {
-            setTerminalCommand(nextCommand)
+            setTerminalSnapshot(nextSnapshot)
             setTerminalAttempt((attempt) => attempt + 1)
             setTerminalOpen(true)
             setupAttemptRunningRef.current = true
@@ -352,7 +352,7 @@ export function AgentSkillSetupPanel({
           </div>
         ) : null}
       </div>
-      {terminalOpen ? (
+      {terminalOpen && terminalSnapshot ? (
         <div
           className={cn(
             'min-w-0 max-w-full overflow-hidden',
@@ -387,11 +387,11 @@ export function AgentSkillSetupPanel({
               </TooltipContent>
             </Tooltip>
           </div>
-          {/* The copied string above stays as built; only what we run is adapted. */}
           <OnboardingInlineCommandTerminal
             key={terminalAttempt}
             worktreeId={terminalWorktreeId}
-            command={buildSkillSetupTerminalCommand(openTerminalCommand, terminalShellOverride)}
+            command={openTerminalCommand}
+            prepareCommandForShell={terminalSnapshot.prepareCommandForShell}
             title={terminalTitle}
             description={translate(
               'auto.components.settings.AgentSkillSetupPanel.runCommandDescription',
@@ -399,7 +399,7 @@ export function AgentSkillSetupPanel({
             )}
             ariaLabel={terminalAriaLabel}
             terminalHeightPx={terminalHeightPx}
-            shellOverride={terminalShellOverride}
+            shellOverride={terminalSnapshot.shellOverride}
             terminalTopMarginPx={8}
             descriptionPaddingClassName="px-4 py-2"
             autoScrollIntoView={false}
diff --git a/src/renderer/src/components/settings/AgentsPane.test.tsx b/src/renderer/src/components/settings/AgentsPane.test.tsx
index af821f94920..3b2f7bb964b 100644
--- a/src/renderer/src/components/settings/AgentsPane.test.tsx
+++ b/src/renderer/src/components/settings/AgentsPane.test.tsx
@@ -244,10 +244,10 @@ describe('AgentsPane', () => {
     expect(markup).not.toContain('aria-label="Agent runtime"')
     expect(markup).toContain('Keep computer awake')
     expect(markup).toContain(
-      'Choose On, Auto while agents are working, or Off. Orca also asks this device to stay awake when the lid is closed, subject to its power policy.'
+      'Choose On, Agent, or Off. Agent mode stays awake while agents are working. Orca also asks this device to stay awake when the lid is closed, subject to its power policy.'
     )
     expect(markup).toContain('role="radiogroup"')
-    expect(markup).toContain('>Auto<')
+    expect(markup).toContain('>Agent<')
   })
 
   it('hides desktop-only awake modes in paired web clients', () => {
@@ -316,7 +316,7 @@ describe('AgentsPane', () => {
 
   it('describes Windows lid behavior according to the device', () => {
     expect(getAgentAwakeDescription('Windows')).toBe(
-      "Choose On, Auto while agents are working, or Off. Lid-close behavior follows this device's power settings."
+      "Choose On, Agent, or Off. Agent mode stays awake while agents are working; lid-close behavior follows this device's power settings."
     )
   })
 
diff --git a/src/renderer/src/components/settings/BrowserProfileRow.tsx b/src/renderer/src/components/settings/BrowserProfileRow.tsx
index 891164d5bd5..a6324661901 100644
--- a/src/renderer/src/components/settings/BrowserProfileRow.tsx
+++ b/src/renderer/src/components/settings/BrowserProfileRow.tsx
@@ -14,6 +14,7 @@ import {
   DropdownMenuSubTrigger,
   DropdownMenuTrigger
 } from '../ui/dropdown-menu'
+import { BrowserCookieImportDisclosure } from '../BrowserCookieImportDisclosure'
 import { useAppStore } from '../../store'
 import { BROWSER_FAMILY_LABELS } from '../../../../shared/constants'
 import { translate } from '@/i18n/i18n'
@@ -80,7 +81,8 @@ export function BrowserProfileRow({
                 value1: browser?.label ?? browserFamily,
                 value2: profile.label
               }
-            )
+            ),
+        result.executionHostLabel
       )
     } else {
       toast.error(result.reason)
@@ -96,7 +98,8 @@ export function BrowserProfileRow({
           'auto.components.settings.BrowserProfileRow.b4c167764d',
           'Imported {{value0}} cookies from file into {{value1}}.',
           { value0: result.summary.importedCookies, value1: profile.label }
-        )
+        ),
+        result.executionHostLabel
       )
     } else if (result.reason !== 'canceled') {
       toast.error(result.reason)
@@ -213,6 +216,7 @@ export function BrowserProfileRow({
             <DropdownMenuItem onSelect={() => void handleImportFromFile()}>
               {translate('auto.components.settings.BrowserProfileRow.ebb78dfd6f', 'From File…')}
             </DropdownMenuItem>
+            <BrowserCookieImportDisclosure />
           </DropdownMenuContent>
         </DropdownMenu>
         {isDefault ? (
diff --git a/src/renderer/src/components/settings/BrowserUseCookieImportStep.tsx b/src/renderer/src/components/settings/BrowserUseCookieImportStep.tsx
index 1332883e4a1..28f6f5221c9 100644
--- a/src/renderer/src/components/settings/BrowserUseCookieImportStep.tsx
+++ b/src/renderer/src/components/settings/BrowserUseCookieImportStep.tsx
@@ -3,6 +3,7 @@ import { toast } from 'sonner'
 import { emitBrowserCookieImportToast } from '@/lib/browser-cookie-import-toast'
 import { cn } from '@/lib/utils'
 import { Button } from '../ui/button'
+import { BrowserCookieImportDisclosure } from '../BrowserCookieImportDisclosure'
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -58,7 +59,8 @@ export function BrowserUseCookieImportStep({
             value1: browser?.label ?? browserFamily,
             value2: browserProfile ? ` (${browserProfile})` : ''
           }
-        )
+        ),
+        result.executionHostLabel
       )
     } else {
       toast.error(result.reason)
@@ -74,7 +76,8 @@ export function BrowserUseCookieImportStep({
           'auto.components.settings.BrowserUsePane.8f2675c2f3',
           'Imported {{value0}} cookies from file.',
           { value0: result.summary.importedCookies }
-        )
+        ),
+        result.executionHostLabel
       )
     } else if (result.reason !== 'canceled') {
       toast.error(result.reason)
@@ -204,6 +207,7 @@ export function BrowserUseCookieImportStep({
             <DropdownMenuItem onSelect={() => void handleImportFromFile()}>
               {translate('auto.components.settings.BrowserUsePane.be6df68384', 'From File…')}
             </DropdownMenuItem>
+            <BrowserCookieImportDisclosure />
           </DropdownMenuContent>
         </DropdownMenu>
       </div>
diff --git a/src/renderer/src/components/settings/BrowserUsePane.tsx b/src/renderer/src/components/settings/BrowserUsePane.tsx
index 9871615acdf..73564a22d4e 100644
--- a/src/renderer/src/components/settings/BrowserUsePane.tsx
+++ b/src/renderer/src/components/settings/BrowserUsePane.tsx
@@ -282,6 +282,7 @@ export function BrowserUseSetup({
             skillError={activeSkillRuntime.installDisabledReason ?? skillError}
             disabled={step2Blocked}
             terminalShellOverride={activeSkillRuntime.terminalShellOverride}
+            terminalRuntime={activeSkillRuntime.agentRuntime}
             preInstallNotice={AGENT_SKILL_CLI_PREREQUISITE_NOTICE}
             getPrerequisiteStatus={() =>
               activeSkillRuntime.agentRuntime?.runtime === 'wsl'
diff --git a/src/renderer/src/components/settings/BrowserUseSkillStep.tsx b/src/renderer/src/components/settings/BrowserUseSkillStep.tsx
index a9a63cefa73..399293d2756 100644
--- a/src/renderer/src/components/settings/BrowserUseSkillStep.tsx
+++ b/src/renderer/src/components/settings/BrowserUseSkillStep.tsx
@@ -1,5 +1,6 @@
 import type { ReactNode } from 'react'
 import { AgentSkillSetupPanel } from './AgentSkillSetupPanel'
+import type { LocalAgentRuntime } from './CliSkillRuntimeSetup'
 import { StepBadge } from './SetupStepBadge'
 import { translate } from '@/i18n/i18n'
 
@@ -11,6 +12,7 @@ type Props = {
   skillError: string | null
   disabled?: boolean
   terminalShellOverride?: string
+  terminalRuntime?: LocalAgentRuntime
   preInstallNotice?: ReactNode
   getPrerequisiteStatus?: () => Promise<Awaited<ReturnType<typeof window.api.cli.getInstallStatus>>>
   onBeforeOpenTerminal?: () => void | Promise<void>
@@ -25,6 +27,7 @@ export function BrowserUseSkillStep({
   skillError,
   disabled = false,
   terminalShellOverride,
+  terminalRuntime,
   preInstallNotice,
   getPrerequisiteStatus,
   onBeforeOpenTerminal,
@@ -47,6 +50,7 @@ export function BrowserUseSkillStep({
       terminalAriaLabel="Browser Use skill install terminal"
       terminalWorktreeId="settings-browser-use-skill-terminal"
       terminalShellOverride={terminalShellOverride}
+      terminalRuntime={terminalRuntime}
       installed={skillDetected}
       loading={skillLoading}
       error={skillError}
diff --git a/src/renderer/src/components/settings/CliSection.test.tsx b/src/renderer/src/components/settings/CliSection.test.tsx
index 20830a2febf..e07bbd77f28 100644
--- a/src/renderer/src/components/settings/CliSection.test.tsx
+++ b/src/renderer/src/components/settings/CliSection.test.tsx
@@ -4,6 +4,10 @@ import { renderToStaticMarkup } from 'react-dom/server'
 import { cleanup, render, screen } from '@testing-library/react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { getDefaultSettings } from '../../../../shared/constants'
+import {
+  ORCA_CLI_SKILL_INSTALL_COMMAND,
+  ORCA_CLI_SKILL_UPDATE_COMMAND
+} from '@/lib/agent-feature-install-commands'
 import { CliSection } from './CliSection'
 
 const capturedPanel = vi.hoisted(() => ({
@@ -11,6 +15,7 @@ const capturedPanel = vi.hoisted(() => ({
   props: null as null | {
     command: string
     installedCommand: string
+    terminalRuntime?: { runtime: 'host' | 'wsl'; wslDistro?: string | null; label: string }
     freshnessSkillName?: string
     getPrerequisiteStatus: () => Promise<unknown>
     onBeforeOpenTerminal: () => Promise<void>
@@ -135,12 +140,13 @@ describe('CliSection project runtime defaults', () => {
         sourceKinds: ['global']
       })
     )
-    expect(capturedPanel.props?.command).toMatch(
-      /^& \{ \$PSNativeCommandArgumentPassing = 'Legacy'; wsl\.exe -d 'Ubuntu' -- sh -c 'eval \\"`printf %s [A-Za-z0-9+/=]+ \| base64 -d`\\"'/
-    )
-    expect(capturedPanel.props?.installedCommand).toMatch(
-      /^& \{ \$PSNativeCommandArgumentPassing = 'Legacy'; wsl\.exe -d 'Ubuntu' -- sh -c 'eval \\"`printf %s [A-Za-z0-9+/=]+ \| base64 -d`\\"'/
-    )
+    expect(capturedPanel.props?.command).toBe(ORCA_CLI_SKILL_INSTALL_COMMAND)
+    expect(capturedPanel.props?.installedCommand).toBe(ORCA_CLI_SKILL_UPDATE_COMMAND)
+    expect(capturedPanel.props?.terminalRuntime).toEqual({
+      runtime: 'wsl',
+      wslDistro: 'Ubuntu',
+      label: 'WSL Ubuntu'
+    })
     expect(getWslInstallStatus).toHaveBeenCalledWith({ distro: 'Ubuntu' })
     expect(getWslInstallStatus).toHaveBeenCalledTimes(2)
   })
diff --git a/src/renderer/src/components/settings/CliSection.tsx b/src/renderer/src/components/settings/CliSection.tsx
index 40f575fd780..e37a45ef3d6 100644
--- a/src/renderer/src/components/settings/CliSection.tsx
+++ b/src/renderer/src/components/settings/CliSection.tsx
@@ -379,6 +379,7 @@ export function CliSection({
               terminalAriaLabel="CLI skill install terminal"
               terminalWorktreeId={`settings-cli-skill-terminal-${agentRuntime.runtime}`}
               terminalShellOverride={cliSkillTerminalShellOverride}
+              terminalRuntime={agentRuntime}
               installed={cliSkillDetected}
               loading={cliSkillLoading}
               error={cliSkillError}
diff --git a/src/renderer/src/components/settings/CliSkillRuntimeSetup.test.tsx b/src/renderer/src/components/settings/CliSkillRuntimeSetup.test.tsx
index 07d632fe284..b362af3abff 100644
--- a/src/renderer/src/components/settings/CliSkillRuntimeSetup.test.tsx
+++ b/src/renderer/src/components/settings/CliSkillRuntimeSetup.test.tsx
@@ -36,64 +36,67 @@ describe('CliSkillRuntimeSetup runtime helpers', () => {
   const windowsNpxGuidance =
     'echo ERROR: npx was not found. Install Node.js LTS from https://nodejs.org/ to get npx. & echo Then close this terminal and start skill setup again - a new terminal picks up the updated PATH. & exit /b 1'
 
-  it('wraps WSL skill installs as a directly runnable selected-distro command', () => {
+  it('keeps copied WSL skill installs valid for the target POSIX shell', () => {
     const skillCommand = 'npx skills add orchestration --global'
-    const command = buildSkillInstallCommandForRuntime(skillCommand, {
+    const runtime = {
       runtime: 'wsl',
       wslDistro: 'Ubuntu',
       label: 'WSL Ubuntu'
-    })
+    } as const
+    const command = buildSkillInstallCommandForRuntime(skillCommand, runtime)
+    const setupCommand = buildSkillSetupTerminalCommand(command, 'powershell.exe', runtime, 'win32')
     const encoded = Buffer.from(buildWslLoginShellCommand(skillCommand), 'utf8').toString('base64')
 
-    expect(command).toBe(
+    expect(command).toBe(skillCommand)
+    expect(setupCommand).toBe(
       `& { $PSNativeCommandArgumentPassing = 'Legacy'; wsl.exe -d 'Ubuntu' -- sh -c 'eval \\"\`printf %s ${encoded} | base64 -d\`\\"' } # Runs: ${skillCommand}`
     )
-    expect(decodeWslLoginShellScript(command)).toContain(
+    expect(decodeWslLoginShellScript(setupCommand)).toContain(
       'exec "$_orca_wsl_shell" -ilc \'npx skills add orchestration --global\''
     )
   })
 
   it('keeps a Windows-selected WSL install inside WSL without the host preflight', () => {
     const skillCommand = 'npx skills add orchestration --global'
-    const command = buildSkillCommandForRuntime(
-      skillCommand,
-      {
-        runtime: 'wsl',
-        wslDistro: 'Ubuntu',
-        label: 'WSL Ubuntu'
-      },
-      'win32'
-    )
+    const runtime = {
+      runtime: 'wsl',
+      wslDistro: 'Ubuntu',
+      label: 'WSL Ubuntu'
+    } as const
+    const command = buildSkillCommandForRuntime(skillCommand, runtime, 'win32')
+    const setupCommand = buildSkillSetupTerminalCommand(command, 'powershell.exe', runtime, 'win32')
 
-    expect(command).toContain("wsl.exe -d 'Ubuntu'")
-    expect(command).not.toContain('where.exe npx')
-    expect(decodeWslLoginShellScript(command)).toContain(
+    expect(command).toBe(skillCommand)
+    expect(setupCommand).toContain("wsl.exe -d 'Ubuntu'")
+    expect(setupCommand).not.toContain('where.exe npx')
+    expect(decodeWslLoginShellScript(setupCommand)).toContain(
       'exec "$_orca_wsl_shell" -ilc \'npx skills add orchestration --global\''
     )
   })
 
-  it('wraps WSL skill updates as a directly runnable selected-distro command', () => {
-    const command = buildSkillCommandForRuntime('npx skills update orchestration --global', {
+  it('wraps WSL skill updates for the selected distro setup terminal', () => {
+    const runtime = {
       runtime: 'wsl',
       wslDistro: 'Fedora Remix',
       label: 'WSL Fedora Remix'
-    })
+    } as const
+    const command = buildSkillCommandForRuntime('npx skills update orchestration --global', runtime)
+    const setupCommand = buildSkillSetupTerminalCommand(command, 'powershell.exe', runtime, 'win32')
 
-    expect(decodeWslLoginShellScript(command)).toContain(
+    expect(decodeWslLoginShellScript(setupCommand)).toContain(
       'exec "$_orca_wsl_shell" -ilc \'npx skills update orchestration --global\''
     )
   })
 
-  it('scopes the PS5-compatible argv mode when pasted into PowerShell 7', () => {
-    const command = buildSkillCommandForRuntime('npx skills update orchestration --global', {
-      runtime: 'wsl',
-      label: 'WSL'
-    })
+  it('scopes the PS5-compatible argv mode in the PowerShell setup terminal', () => {
+    const runtime = { runtime: 'wsl', label: 'WSL' } as const
+    const command = buildSkillCommandForRuntime('npx skills update orchestration --global', runtime)
+    const setupCommand = buildSkillSetupTerminalCommand(command, 'powershell.exe', runtime, 'win32')
 
-    expect(command).toMatch(
+    expect(setupCommand).toMatch(
       /^& \{ \$PSNativeCommandArgumentPassing = 'Legacy'; wsl\.exe -- sh -c 'eval \\"`printf/
     )
-    expect(command).toContain('`\\"\' } # Runs: npx skills update orchestration --global')
+    expect(setupCommand).toContain('`\\"\' } # Runs: npx skills update orchestration --global')
   })
 
   it.skipIf(process.platform === 'win32')(
@@ -122,10 +125,15 @@ describe('CliSkillRuntimeSetup runtime helpers', () => {
       chmodSync(join(npxBin, 'npx'), 0o755)
 
       try {
-        const wrapped = buildSkillCommandForRuntime('npx skills update orchestration --global', {
+        const runtime = {
           runtime: 'wsl',
           label: 'WSL'
-        })
+        } as const
+        const copied = buildSkillCommandForRuntime(
+          'npx skills update orchestration --global',
+          runtime
+        )
+        const wrapped = buildSkillSetupTerminalCommand(copied, 'powershell.exe', runtime, 'win32')
         expect(
           execFileSync('/bin/sh', ['-c', getWslOuterShellScript(wrapped)], {
             encoding: 'utf8',
@@ -285,7 +293,7 @@ describe('CliSkillRuntimeSetup runtime helpers', () => {
       const copied = buildSkillCommandForRuntime(installCommand, windowsHost, 'win32')
       expect(copied).toBe(installCommand)
       // Orca forces its own setup terminal to powershell.exe, where cmd.exe works.
-      expect(buildSkillSetupTerminalCommand(copied, 'powershell.exe', 'win32')).toBe(
+      expect(buildSkillSetupTerminalCommand(copied, 'powershell.exe', undefined, 'win32')).toBe(
         `${windowsNpxPreflightPrefix}${windowsNpxGuidance}) else (${installCommand})"`
       )
     } finally {
@@ -306,25 +314,56 @@ describe('CliSkillRuntimeSetup runtime helpers', () => {
         { runtime: 'host', label: 'Windows' },
         'win32'
       )
-      expect(buildSkillSetupTerminalCommand(copied, undefined, 'win32')).toBe(copied)
+      expect(buildSkillSetupTerminalCommand(copied, undefined, undefined, 'win32')).toBe(copied)
       // An already-wrapped command must not gain a second preflight.
-      expect(buildSkillSetupTerminalCommand(copied, 'powershell.exe', 'win32')).toBe(copied)
+      expect(buildSkillSetupTerminalCommand(copied, 'powershell.exe', undefined, 'win32')).toBe(
+        copied
+      )
     } finally {
       useAppStore.setState({ settings: previous.settings })
     }
   })
 
-  it('leaves WSL and non-Windows setup terminal commands untouched', () => {
-    const wslCommand = buildSkillCommandForRuntime(
-      'npx skills add orchestration --global',
-      { runtime: 'wsl', wslDistro: 'Ubuntu', label: 'WSL Ubuntu' },
+  it('adapts bare WSL setup commands to the shell that Orca created', () => {
+    const runtime = { runtime: 'wsl', wslDistro: 'Ubuntu', label: 'WSL Ubuntu' } as const
+    const skillCommand = 'npx skills add orchestration --global'
+    const copiedCommand = buildSkillCommandForRuntime(skillCommand, runtime, 'win32')
+
+    expect(copiedCommand).toBe(skillCommand)
+    expect(
+      buildSkillSetupTerminalCommand(copiedCommand, 'powershell.exe', runtime, 'win32')
+    ).toContain("wsl.exe -d 'Ubuntu'")
+    expect(buildSkillSetupTerminalCommand(copiedCommand, 'wsl.exe', runtime, 'win32')).toBe(
+      skillCommand
+    )
+    expect(
+      buildSkillSetupTerminalCommand(
+        'npx skills add orchestration --global',
+        undefined,
+        undefined,
+        'linux'
+      )
+    ).toBe('npx skills add orchestration --global')
+  })
+
+  it('preserves the exact WSL script when adapting setup-terminal auto-paste', () => {
+    const skillCommand = "printf 'héllo\n# Runs: unchanged'"
+    const runtime = {
+      runtime: 'wsl',
+      wslDistro: 'Ubuntu',
+      label: 'WSL Ubuntu'
+    } as const
+    const copiedCommand = buildSkillCommandForRuntime(skillCommand, runtime)
+    const powershellCommand = buildSkillSetupTerminalCommand(
+      copiedCommand,
+      'powershell.exe',
+      runtime,
       'win32'
     )
 
-    expect(buildSkillSetupTerminalCommand(wslCommand, 'powershell.exe', 'win32')).toBe(wslCommand)
-    expect(
-      buildSkillSetupTerminalCommand('npx skills add orchestration --global', undefined, 'linux')
-    ).toBe('npx skills add orchestration --global')
+    expect(buildSkillSetupTerminalCommand(powershellCommand, 'wsl.exe', runtime, 'win32')).toBe(
+      buildWslLoginShellCommand(skillCommand)
+    )
   })
 
   it('keeps the bare reinstall rewrite for POSIX-family Windows skill updates', () => {
diff --git a/src/renderer/src/components/settings/CliSkillRuntimeSetup.tsx b/src/renderer/src/components/settings/CliSkillRuntimeSetup.tsx
index 1e8ac06c414..2b68c2e0945 100644
--- a/src/renderer/src/components/settings/CliSkillRuntimeSetup.tsx
+++ b/src/renderer/src/components/settings/CliSkillRuntimeSetup.tsx
@@ -8,6 +8,7 @@ import {
   quotePowerShellNativeArgument
 } from '../../../../shared/powershell-native-argument'
 import { buildWslLoginShellCommand } from '../../../../shared/wsl-login-shell-command'
+import { isWslShellName } from '../../../../shared/local-windows-terminal-runtime'
 import { resolveWindowsShellStartupFamily } from '../../../../shared/windows-terminal-shell'
 import { getProjectAgentSkillTerminalShellOverride } from '@/lib/project-skill-runtime'
 import { useAppStore } from '@/store'
@@ -95,19 +96,7 @@ export function buildSkillCommandForRuntime(
       'copied-command'
     )
   }
-
-  const distroArg = resolvedRuntime.wslDistro?.trim()
-    ? ` -d ${quotePowerShellLiteral(resolvedRuntime.wslDistro.trim())}`
-    : ''
-  // Why: encoding preserves the user's configured login-shell PATH while
-  // avoiding raw multiline and nested quotes at the copy/paste boundary.
-  const encodedScript = encodeWslLoginShellScript(normalizedCommand)
-  const visibleCommand = normalizedCommand.replace(/[\r\n]+/g, ' ')
-  const shellScript = `eval "\`printf %s ${encodedScript} | base64 -d\`"`
-  const wslCommand = `wsl.exe${distroArg} -- sh -c ${quotePowerShellNativeArgument(shellScript)}`
-  // Why: scope Legacy argv parsing to this invocation so Windows PowerShell
-  // 5.1 and PowerShell 7 pass the same embedded quotes to wsl.exe.
-  return `& { $PSNativeCommandArgumentPassing = 'Legacy'; ${wslCommand} } # Runs: ${visibleCommand}`
+  return normalizedCommand
 }
 
 function normalizeWindowsSkillUpdateCommand(
@@ -138,18 +127,29 @@ function normalizeWindowsSkillUpdateCommand(
 type SkillCommandTarget = 'copied-command' | 'orca-setup-terminal'
 
 /**
- * Re-adds the npx preflight for Orca's own setup terminal, which
- * `getAgentSkillTerminalShellOverride` forces onto powershell.exe. The copied
- * string stays bare for POSIX-family shells; only the executed one is wrapped.
+ * Adapts a copied skill command for Orca's inline setup terminal auto-paste.
+ * Host Windows installs may gain an npx preflight; WSL-targeted PowerShell wrappers
+ * must become bash-native because the daemon forces wsl.exe for WSL worktrees.
  */
 export function buildSkillSetupTerminalCommand(
   copiedCommand: string,
-  terminalShellOverride: string | undefined,
+  effectiveShell: string | undefined,
+  runtime?: LocalAgentRuntime,
   currentPlatform = getSkillCommandPlatform()
 ): string {
-  if (!isSetupTerminalForcedToPowerShell(terminalShellOverride)) {
+  // Why: the created tab is authoritative when project runtime replaces the requested shell.
+  const wslNative = isWslShellName(effectiveShell)
+    ? decodeWslSetupTerminalCommand(copiedCommand)
+    : null
+  if (wslNative) {
+    return wslNative
+  }
+  if (!isSetupTerminalForcedToPowerShell(effectiveShell)) {
     return copiedCommand
   }
+  if (runtime?.runtime === 'wsl' && currentPlatform === 'win32') {
+    return buildPowerShellWslSkillCommand(copiedCommand, runtime)
+  }
   return wrapWindowsSkillCommandWithNpxPrerequisite(
     copiedCommand,
     currentPlatform,
@@ -157,6 +157,42 @@ export function buildSkillSetupTerminalCommand(
   )
 }
 
+function buildPowerShellWslSkillCommand(command: string, runtime: LocalAgentRuntime): string {
+  const distroArg = runtime.wslDistro?.trim()
+    ? ` -d ${quotePowerShellLiteral(runtime.wslDistro.trim())}`
+    : ''
+  // Why: encoding preserves the user's configured login-shell PATH across the Windows argv boundary.
+  const encodedScript = encodeWslLoginShellScript(command)
+  const visibleCommand = command.replace(/[\r\n]+/g, ' ')
+  const shellScript = `eval "\`printf %s ${encodedScript} | base64 -d\`"`
+  const wslCommand = `wsl.exe${distroArg} -- sh -c ${quotePowerShellNativeArgument(shellScript)}`
+  return `& { $PSNativeCommandArgumentPassing = 'Legacy'; ${wslCommand} } # Runs: ${visibleCommand}`
+}
+
+function decodeWslSetupTerminalCommand(command: string): string | null {
+  if (
+    !command.startsWith("& { $PSNativeCommandArgumentPassing = 'Legacy'; wsl.exe") ||
+    !command.includes(' } # Runs: ')
+  ) {
+    return null
+  }
+
+  const encoded = /-- sh -c 'eval \\"`printf %s ([A-Za-z0-9+/=]+) \| base64 -d`\\"'/.exec(
+    command
+  )?.[1]
+  if (!encoded) {
+    return null
+  }
+
+  try {
+    const binary = atob(encoded)
+    const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0))
+    return new TextDecoder().decode(bytes)
+  } catch {
+    return null
+  }
+}
+
 function isSetupTerminalForcedToPowerShell(terminalShellOverride: string | undefined): boolean {
   const trimmedOverride = terminalShellOverride?.trim()
   return (
diff --git a/src/renderer/src/components/settings/ComputerUseSkillSetupPanel.tsx b/src/renderer/src/components/settings/ComputerUseSkillSetupPanel.tsx
index e916686c25e..9acfddd23bc 100644
--- a/src/renderer/src/components/settings/ComputerUseSkillSetupPanel.tsx
+++ b/src/renderer/src/components/settings/ComputerUseSkillSetupPanel.tsx
@@ -59,6 +59,7 @@ export function ComputerUseSkillSetupPanel(): React.JSX.Element {
       terminalAriaLabel="Computer Use skill install terminal"
       terminalWorktreeId="settings-computer-use-skill-terminal"
       terminalShellOverride={activeSkillRuntime.terminalShellOverride}
+      terminalRuntime={activeSkillRuntime.agentRuntime}
       installed={computerUseSkillDetected}
       loading={computerUseSkillLoading}
       error={activeSkillRuntime.installDisabledReason ?? computerUseSkillError}
diff --git a/src/renderer/src/components/settings/EphemeralVmsPane.tsx b/src/renderer/src/components/settings/EphemeralVmsPane.tsx
index 06c8fe02741..acd042444c3 100644
--- a/src/renderer/src/components/settings/EphemeralVmsPane.tsx
+++ b/src/renderer/src/components/settings/EphemeralVmsPane.tsx
@@ -163,6 +163,7 @@ export function EphemeralVmsPane(): React.JSX.Element {
         )}
         terminalWorktreeId="settings-ephemeral-vms-skill-terminal"
         terminalShellOverride={activeSkillRuntime.terminalShellOverride}
+        terminalRuntime={activeSkillRuntime.agentRuntime}
         installed={skillDetected}
         loading={skillLoading}
         error={activeSkillRuntime.installDisabledReason ?? skillError}
diff --git a/src/renderer/src/components/settings/FloatingWorkspacePane.tsx b/src/renderer/src/components/settings/FloatingWorkspacePane.tsx
index acffb2d007c..14ace880d92 100644
--- a/src/renderer/src/components/settings/FloatingWorkspacePane.tsx
+++ b/src/renderer/src/components/settings/FloatingWorkspacePane.tsx
@@ -10,6 +10,7 @@ import { getFloatingWorkspaceSearchEntries } from './floating-workspace-search'
 import { matchesSettingsSearch } from './settings-search'
 import { useAppStore } from '../../store'
 import { translate } from '@/i18n/i18n'
+import { isWebClientLocation } from '@/lib/web-client-location'
 
 type FloatingWorkspacePaneProps = {
   settings: GlobalSettings
@@ -35,6 +36,7 @@ export function FloatingWorkspacePane({
   updateSettings
 }: FloatingWorkspacePaneProps): React.JSX.Element | null {
   const searchQuery = useAppStore((state) => state.settingsSearchQuery)
+  const includeBrowser = !isWebClientLocation()
   const [resolvedFloatingWorkspacePath, setResolvedFloatingWorkspacePath] = useState('')
 
   useEffect(() => {
@@ -72,7 +74,7 @@ export function FloatingWorkspacePane({
     resolvedFloatingWorkspacePath
   })
 
-  if (!matchesSettingsSearch(searchQuery, getFloatingWorkspaceSearchEntries())) {
+  if (!matchesSettingsSearch(searchQuery, getFloatingWorkspaceSearchEntries({ includeBrowser }))) {
     return null
   }
 
@@ -91,7 +93,7 @@ export function FloatingWorkspacePane({
           'floating workspace',
           'floating terminal',
           'terminal',
-          'browser',
+          ...(includeBrowser ? ['browser'] : []),
           'markdown',
           'note',
           'global',
diff --git a/src/renderer/src/components/settings/FontAutocomplete.tsx b/src/renderer/src/components/settings/FontAutocomplete.tsx
new file mode 100644
index 00000000000..aae2c65eaaf
--- /dev/null
+++ b/src/renderer/src/components/settings/FontAutocomplete.tsx
@@ -0,0 +1,333 @@
+import type React from 'react'
+import { useCallback, useEffect, useId, useMemo, useRef, useState } from 'react'
+import { Check, ChevronsUpDown, CircleX } from 'lucide-react'
+import { Input } from '../ui/input'
+import { Popover, PopoverAnchor, PopoverContent } from '../ui/popover'
+import { ScrollArea } from '../ui/scroll-area'
+import { filterFontSuggestions, getRenderedFontSuggestions } from './settings-form-option-filter'
+import { translate } from '@/i18n/i18n'
+
+type FontAutocompleteProps = {
+  value: string
+  suggestions: string[]
+  onChange: (value: string) => void
+  placeholder?: string
+  onRequestSuggestions?: () => void
+  /** Fires with whichever option the user is currently highlighting in the
+   *  dropdown (via mouse hover or keyboard arrow), or null when nothing is
+   *  highlighted / the dropdown is closed. Lets a consumer show a live
+   *  preview of the font without committing the selection. */
+  onPreviewFontFamily?: (font: string | null) => void
+}
+
+export function FontAutocomplete({
+  value,
+  suggestions,
+  onChange,
+  placeholder = 'SF Mono',
+  onRequestSuggestions,
+  onPreviewFontFamily
+}: FontAutocompleteProps): React.JSX.Element {
+  const [query, setQuery] = useState(value)
+  const [prevValue, setPrevValue] = useState(value)
+  const [open, setOpen] = useState(false)
+  const [highlightedIndex, setHighlightedIndex] = useState(-1)
+  const [isFilteringQuery, setIsFilteringQuery] = useState(false)
+  const inputRef = useRef<HTMLInputElement | null>(null)
+  const rootRef = useRef<HTMLDivElement | null>(null)
+  const previewFontFamilyRef = useRef(onPreviewFontFamily)
+  const listboxId = useId()
+
+  useEffect(() => {
+    previewFontFamilyRef.current = onPreviewFontFamily
+  }, [onPreviewFontFamily])
+
+  const setRootNode = useCallback((element: HTMLDivElement | null): void => {
+    rootRef.current = element
+    if (!element) {
+      // Why: settings search can unmount this control while a hover preview is
+      // active; the consumer must not keep rendering that transient font.
+      previewFontFamilyRef.current?.(null)
+    }
+  }, [])
+
+  if (value !== prevValue) {
+    setPrevValue(value)
+    setQuery(value)
+    if (value !== query) {
+      setIsFilteringQuery(false)
+    }
+  }
+
+  const requestSuggestions = useCallback((): void => {
+    onRequestSuggestions?.()
+  }, [onRequestSuggestions])
+
+  const handleOpenChange = (nextOpen: boolean): void => {
+    setOpen(nextOpen)
+    if (nextOpen) {
+      requestSuggestions()
+    }
+    if (!nextOpen) {
+      setIsFilteringQuery(false)
+    }
+  }
+
+  const normalizedQuery = query.trim().toLowerCase()
+  const normalizedValue = value.trim().toLowerCase()
+  const filteredSuggestions = useMemo(
+    () => filterFontSuggestions(suggestions, query),
+    [suggestions, query]
+  )
+  // Why: the committed font fills the input, but opening the chooser should
+  // still reveal every installed font instead of only fonts sharing that name.
+  const visibleSuggestions =
+    !isFilteringQuery && normalizedQuery === normalizedValue ? suggestions : filteredSuggestions
+  const renderedSuggestions = useMemo(
+    () => getRenderedFontSuggestions(visibleSuggestions, highlightedIndex),
+    [visibleSuggestions, highlightedIndex]
+  )
+
+  // Why: sync the highlighted index during render rather than via useEffect so
+  // the correct item is highlighted on the very first paint after open/filter
+  // changes — useEffect would leave one render with the stale index visible.
+  const [prevVisibleSuggestions, setPrevVisibleSuggestions] = useState(visibleSuggestions)
+  const [prevOpen, setPrevOpen] = useState(open)
+  const [prevHighlightedValue, setPrevHighlightedValue] = useState(value)
+  if (
+    visibleSuggestions !== prevVisibleSuggestions ||
+    open !== prevOpen ||
+    value !== prevHighlightedValue
+  ) {
+    setPrevVisibleSuggestions(visibleSuggestions)
+    setPrevOpen(open)
+    setPrevHighlightedValue(value)
+    if (!open || visibleSuggestions.length === 0) {
+      setHighlightedIndex(-1)
+    } else {
+      const selectedIndex = visibleSuggestions.indexOf(value)
+      setHighlightedIndex(Math.max(selectedIndex, 0))
+    }
+  }
+
+  // Why: notify the consumer of the currently-highlighted font so it can
+  // render a live preview. Closing the dropdown or moving past all options
+  // clears the preview back to the committed value.
+  useEffect(() => {
+    if (!onPreviewFontFamily) {
+      return
+    }
+    if (!open || highlightedIndex < 0) {
+      onPreviewFontFamily(null)
+      return
+    }
+    onPreviewFontFamily(visibleSuggestions[highlightedIndex] ?? null)
+  }, [visibleSuggestions, highlightedIndex, onPreviewFontFamily, open])
+
+  const commitValue = (nextValue: string): void => {
+    setQuery(nextValue)
+    setIsFilteringQuery(false)
+    onChange(nextValue)
+    setOpen(false)
+  }
+
+  const focusInput = (): void => {
+    inputRef.current?.focus()
+  }
+  const popoverAvailableHeightStyle = {
+    // Why: tailwind-merge rewrites this arbitrary max-height class on the
+    // ScrollArea root, so keep the Radix available-height clamp as inline style.
+    maxHeight: 'var(--radix-popover-content-available-height)'
+  } as React.CSSProperties
+
+  return (
+    <div ref={setRootNode} className="relative max-w-sm">
+      <Popover open={open} onOpenChange={handleOpenChange}>
+        <PopoverAnchor asChild>
+          <div className="relative">
+            <Input
+              ref={inputRef}
+              value={query}
+              onChange={(e) => {
+                const next = e.target.value
+                requestSuggestions()
+                setQuery(next)
+                setIsFilteringQuery(true)
+                onChange(next)
+                setOpen(true)
+              }}
+              onFocus={() => {
+                requestSuggestions()
+                setIsFilteringQuery(false)
+                setOpen(true)
+              }}
+              onKeyDown={(e) => {
+                if (e.key === 'Escape') {
+                  if (open) {
+                    e.preventDefault()
+                    setOpen(false)
+                    setIsFilteringQuery(false)
+                  }
+                  return
+                }
+
+                if (e.key === 'ArrowDown') {
+                  e.preventDefault()
+                  setOpen(true)
+                  if (visibleSuggestions.length > 0) {
+                    setHighlightedIndex((current) =>
+                      current < 0 ? 0 : Math.min(current + 1, visibleSuggestions.length - 1)
+                    )
+                  }
+                  return
+                }
+
+                if (e.key === 'ArrowUp') {
+                  e.preventDefault()
+                  setOpen(true)
+                  if (visibleSuggestions.length > 0) {
+                    setHighlightedIndex((current) =>
+                      current < 0 ? visibleSuggestions.length - 1 : Math.max(current - 1, 0)
+                    )
+                  }
+                  return
+                }
+
+                if (e.key === 'Enter' && open && highlightedIndex >= 0) {
+                  const highlightedFont = visibleSuggestions[highlightedIndex]
+                  if (highlightedFont) {
+                    e.preventDefault()
+                    commitValue(highlightedFont)
+                  }
+                }
+              }}
+              placeholder={placeholder}
+              className="pr-18"
+              role="combobox"
+              aria-autocomplete="list"
+              aria-expanded={open}
+              aria-controls={listboxId}
+              aria-activedescendant={
+                open && highlightedIndex >= 0
+                  ? `${listboxId}-option-${highlightedIndex}`
+                  : undefined
+              }
+            />
+            <div className="absolute inset-y-0 right-2 flex items-center gap-1">
+              {query ? (
+                <button
+                  type="button"
+                  onMouseDown={(e) => e.preventDefault()}
+                  onClick={() => {
+                    setQuery('')
+                    setIsFilteringQuery(false)
+                    onChange('')
+                    setOpen(true)
+                    focusInput()
+                  }}
+                  className="rounded-sm p-1 text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
+                  aria-label={translate(
+                    'auto.components.settings.SettingsFormControls.a4ff6143f8',
+                    'Clear font selection'
+                  )}
+                  title={translate(
+                    'auto.components.settings.SettingsFormControls.74bcecd5ec',
+                    'Clear'
+                  )}
+                >
+                  <CircleX className="size-3.5" />
+                </button>
+              ) : null}
+              <button
+                type="button"
+                onMouseDown={(e) => e.preventDefault()}
+                onClick={() => {
+                  const nextOpen = !open
+                  setOpen(nextOpen)
+                  if (!nextOpen) {
+                    setIsFilteringQuery(false)
+                  }
+                  if (nextOpen) {
+                    requestSuggestions()
+                    focusInput()
+                  }
+                }}
+                className="rounded-sm p-1 text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
+                aria-label={translate(
+                  'auto.components.settings.SettingsFormControls.c766f8ac75',
+                  'Toggle font suggestions'
+                )}
+                title={translate(
+                  'auto.components.settings.SettingsFormControls.b55371ea18',
+                  'Fonts'
+                )}
+              >
+                <ChevronsUpDown className="size-3.5" />
+              </button>
+            </div>
+          </div>
+        </PopoverAnchor>
+
+        {/* Why: portal the dropdown outside the settings section — an in-flow
+          absolute panel makes the highlighted option's scrollIntoView scroll
+          the whole settings pane, pushing the section content out of view. */}
+        <PopoverContent
+          align="start"
+          className="w-[var(--radix-popover-trigger-width)]"
+          onOpenAutoFocus={(e) => e.preventDefault()}
+          onCloseAutoFocus={(e) => e.preventDefault()}
+          onInteractOutside={(e) => {
+            // Why: the input and its clear/toggle buttons are the anchor, not
+            // the content, so Radix would otherwise dismiss on every click there.
+            if (rootRef.current?.contains(e.target as Node)) {
+              e.preventDefault()
+            }
+          }}
+        >
+          <ScrollArea
+            className={renderedSuggestions.length > 8 ? 'h-64' : undefined}
+            style={popoverAvailableHeightStyle}
+            viewportProps={{ style: popoverAvailableHeightStyle }}
+          >
+            <div id={listboxId} role="listbox" className="p-1">
+              {visibleSuggestions.length > 0 ? (
+                renderedSuggestions.map(({ font, sourceIndex }) => (
+                  <button
+                    key={font}
+                    type="button"
+                    id={`${listboxId}-option-${sourceIndex}`}
+                    role="option"
+                    aria-selected={sourceIndex === highlightedIndex}
+                    ref={(element) => {
+                      if (element && sourceIndex === highlightedIndex) {
+                        element.scrollIntoView({ block: 'nearest' })
+                      }
+                    }}
+                    onMouseDown={(e) => e.preventDefault()}
+                    onMouseEnter={() => setHighlightedIndex(sourceIndex)}
+                    onClick={() => commitValue(font)}
+                    className={`flex w-full items-center justify-between rounded-sm px-3 py-2 text-left text-sm transition-colors ${
+                      sourceIndex === highlightedIndex
+                        ? 'bg-accent text-accent-foreground'
+                        : 'hover:bg-muted/60'
+                    }`}
+                  >
+                    <span className="truncate">{font}</span>
+                    {font === value ? <Check className="ml-3 size-4 shrink-0" /> : null}
+                  </button>
+                ))
+              ) : (
+                <div className="px-3 py-3 text-sm text-muted-foreground">
+                  {translate(
+                    'auto.components.settings.SettingsFormControls.42a4d15a30',
+                    'No matching fonts.'
+                  )}
+                </div>
+              )}
+            </div>
+          </ScrollArea>
+        </PopoverContent>
+      </Popover>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/settings/LinearAgentSkillPane.tsx b/src/renderer/src/components/settings/LinearAgentSkillPane.tsx
index 8461d16cccd..4916474ebdc 100644
--- a/src/renderer/src/components/settings/LinearAgentSkillPane.tsx
+++ b/src/renderer/src/components/settings/LinearAgentSkillPane.tsx
@@ -83,6 +83,7 @@ export function LinearAgentSkillPane(): React.JSX.Element {
       )}
       terminalWorktreeId="settings-linear-skill-terminal"
       terminalShellOverride={skillSetup.terminalShellOverride}
+      terminalRuntime={skillSetup.terminalRuntime}
       installed={skillSetup.skillInstalled}
       loading={skillSetup.skillLoading}
       error={skillSetup.error}
diff --git a/src/renderer/src/components/settings/OrchestrationPane.tsx b/src/renderer/src/components/settings/OrchestrationPane.tsx
index 09910c8659b..f60290968f2 100644
--- a/src/renderer/src/components/settings/OrchestrationPane.tsx
+++ b/src/renderer/src/components/settings/OrchestrationPane.tsx
@@ -105,6 +105,7 @@ export function OrchestrationPane(): React.JSX.Element {
         terminalAriaLabel="Orchestration skill install terminal"
         terminalWorktreeId="settings-orchestration-skill-terminal"
         terminalShellOverride={activeSkillRuntime.terminalShellOverride}
+        terminalRuntime={activeSkillRuntime.agentRuntime}
         installed={orchestrationSkillDetected}
         loading={orchestrationSkillLoading}
         error={activeSkillRuntime.installDisabledReason ?? orchestrationSkillError}
diff --git a/src/renderer/src/components/settings/OrchestrationSetupCard.tsx b/src/renderer/src/components/settings/OrchestrationSetupCard.tsx
index b47b65a0c62..39e01a59683 100644
--- a/src/renderer/src/components/settings/OrchestrationSetupCard.tsx
+++ b/src/renderer/src/components/settings/OrchestrationSetupCard.tsx
@@ -56,6 +56,7 @@ export function OrchestrationSetupCard(props: {
       terminalAriaLabel="Orchestration skill install terminal"
       terminalWorktreeId="feature-wall-orchestration-skill-terminal"
       terminalShellOverride={activeSkillRuntime.terminalShellOverride}
+      terminalRuntime={activeSkillRuntime.agentRuntime}
       installed={skill.installed}
       loading={skill.loading}
       error={activeSkillRuntime.installDisabledReason ?? skill.error}
diff --git a/src/renderer/src/components/settings/QuickCommandsList.tsx b/src/renderer/src/components/settings/QuickCommandsList.tsx
index bffc71f2d82..3a0042b32a8 100644
--- a/src/renderer/src/components/settings/QuickCommandsList.tsx
+++ b/src/renderer/src/components/settings/QuickCommandsList.tsx
@@ -1,4 +1,4 @@
-import { Pencil, Trash2 } from 'lucide-react'
+import { Check, Copy, Pencil, TerminalSquare, Trash2 } from 'lucide-react'
 import type {
   Repo,
   TerminalQuickCommand,
@@ -10,6 +10,7 @@ import {
   isTerminalAgentQuickCommand
 } from '../../../../shared/terminal-quick-commands'
 import { AgentIcon, getAgentLabel } from '@/lib/agent-catalog'
+import { useClipboardTextCopyFeedback } from '@/hooks/use-clipboard-text-copy-feedback'
 import { cn } from '@/lib/utils'
 import { translate } from '@/i18n/i18n'
 import { Badge } from '../ui/badge'
@@ -28,6 +29,15 @@ function getScopeLabel(
   return repo ? getQuickCommandRepoLabel(repo) : 'Missing project'
 }
 
+function getRunModeLabel(command: TerminalQuickCommand): string {
+  if (isTerminalAgentQuickCommand(command)) {
+    return translate('auto.components.settings.QuickCommandsPane.4ccc63da87', 'Agent')
+  }
+  return command.appendEnter
+    ? translate('auto.components.settings.QuickCommandsPane.9b3e338d62', 'Enter')
+    : translate('auto.components.settings.QuickCommandsPane.9fcfc29519', 'Insert')
+}
+
 function QuickCommandRow({
   command,
   repoById,
@@ -40,15 +50,35 @@ function QuickCommandRow({
   onRemove: (command: TerminalQuickCommand) => void
 }): React.JSX.Element {
   const scope = getTerminalQuickCommandScope(command)
+  const body = getTerminalQuickCommandBody(command)
+  const { canCopy, copyText, status } = useClipboardTextCopyFeedback(body)
+  const commandName = command.label || 'quick command'
+
+  const copyLabel =
+    status === 'copied'
+      ? translate('auto.components.settings.QuickCommandsPane.8d525e5f15', 'Copied')
+      : status === 'failed'
+        ? translate('auto.components.settings.QuickCommandsPane.53b17a4b1b', "Couldn't copy")
+        : canCopy
+          ? translate('auto.components.settings.QuickCommandsPane.a9a564b7e7', 'Copy {{value0}}', {
+              value0: commandName
+            })
+          : translate('auto.components.settings.QuickCommandsPane.69a1441a21', 'Nothing to copy')
+  const editLabel = translate(
+    'auto.components.settings.QuickCommandsPane.7d90fd5299',
+    'Edit {{value0}}',
+    { value0: commandName }
+  )
+
   return (
-    <div className="flex items-center gap-3 rounded-md border border-border/60 bg-background px-3 py-2 shadow-xs">
+    <div className="group/qc flex items-center gap-3 rounded-md px-2 py-2.5 transition-colors hover:bg-accent/60 focus-within:bg-accent/60">
       <div className="min-w-0 flex-1">
         <div className="flex min-w-0 items-center gap-2">
           <div className="truncate text-sm font-medium">
             {command.label ||
               translate('auto.components.settings.QuickCommandsPane.2bb9e38e93', 'Untitled')}
           </div>
-          <Badge variant="outline" className="max-w-44 gap-1.5">
+          <Badge variant="outline" className="max-w-44 gap-1.5 text-[11px] font-normal">
             {scope.type === 'repo' ? (
               <>
                 <RepoBadgeMark color={repoById.get(scope.repoId)?.badgeColor} />
@@ -59,16 +89,16 @@ function QuickCommandRow({
             )}
           </Badge>
         </div>
-        <div className="flex min-w-0 items-center gap-1.5 text-xs text-foreground/80">
+        <div className="mt-0.5 flex min-w-0 items-center gap-1.5 text-xs text-muted-foreground">
           {isTerminalAgentQuickCommand(command) ? (
-            <span className="shrink-0 text-muted-foreground">
+            <span className="shrink-0">
               <AgentIcon agent={command.agent} size={12} />
             </span>
           ) : null}
           <span className={cn('truncate', isTerminalAgentQuickCommand(command) ? '' : 'font-mono')}>
             {isTerminalAgentQuickCommand(command)
-              ? `${getAgentLabel(command.agent)}: ${getTerminalQuickCommandBody(command)}`
-              : getTerminalQuickCommandBody(command) ||
+              ? `${getAgentLabel(command.agent)}: ${body}`
+              : body ||
                 translate(
                   'auto.components.settings.QuickCommandsPane.0252ddd578',
                   'No command text'
@@ -76,44 +106,95 @@ function QuickCommandRow({
           </span>
         </div>
       </div>
-      <div className="shrink-0 text-[11px] font-medium text-foreground/75">
-        {isTerminalAgentQuickCommand(command)
-          ? translate('auto.components.settings.QuickCommandsPane.4ccc63da87', 'Agent')
-          : command.appendEnter
-            ? translate('auto.components.settings.QuickCommandsPane.9b3e338d62', 'Enter')
-            : translate('auto.components.settings.QuickCommandsPane.9fcfc29519', 'Insert')}
+      <div className="w-12 shrink-0 text-right text-[11px] text-muted-foreground">
+        {getRunModeLabel(command)}
+      </div>
+      {/* Why can-hover: touch devices never hover, so the actions must stay visible there. */}
+      <div className="flex shrink-0 items-center gap-0.5 transition-opacity can-hover:opacity-0 group-hover/qc:opacity-100 group-focus-within/qc:opacity-100">
+        <Button
+          type="button"
+          variant="ghost"
+          size="icon-sm"
+          aria-label={editLabel}
+          title={editLabel}
+          onClick={() => onEdit(command)}
+        >
+          <Pencil />
+        </Button>
+        <Button
+          type="button"
+          variant="ghost"
+          size="icon-sm"
+          disabled={!canCopy}
+          aria-label={copyLabel}
+          title={copyLabel}
+          onClick={() => void copyText()}
+          className={cn(
+            status === 'copied' && 'text-status-success',
+            status === 'failed' && 'text-destructive'
+          )}
+        >
+          {status === 'copied' ? <Check /> : <Copy />}
+        </Button>
+        <Button
+          type="button"
+          variant="ghost"
+          size="icon-sm"
+          aria-label={translate(
+            'auto.components.settings.QuickCommandsPane.8764c6e9e4',
+            'Remove {{value0}}',
+            { value0: commandName }
+          )}
+          onClick={() => onRemove(command)}
+          className="text-muted-foreground hover:text-destructive"
+        >
+          <Trash2 />
+        </Button>
+      </div>
+    </div>
+  )
+}
+
+function QuickCommandsEmptyState({
+  hasCommands,
+  hasQuery
+}: {
+  hasCommands: boolean
+  hasQuery: boolean
+}): React.JSX.Element {
+  if (hasCommands) {
+    return (
+      <div className="px-2 py-10 text-center text-sm text-muted-foreground">
+        {hasQuery
+          ? translate(
+              'auto.components.settings.QuickCommandsList.noSearchMatches',
+              'No commands match this search.'
+            )
+          : translate(
+              'auto.components.settings.QuickCommandsPane.3eb9897ab0',
+              'No commands in the selected scopes.'
+            )}
+      </div>
+    )
+  }
+  // Why no action here: the toolbar's Add Command sits directly above.
+  return (
+    <div className="flex flex-col items-center gap-3 px-2 py-10 text-center">
+      <TerminalSquare className="size-7 text-muted-foreground/50" />
+      <div className="space-y-1">
+        <p className="text-sm text-muted-foreground">
+          {translate(
+            'auto.components.settings.QuickCommandsPane.38d61927e6',
+            'No quick commands saved.'
+          )}
+        </p>
+        <p className="text-xs text-muted-foreground/80">
+          {translate(
+            'auto.components.settings.QuickCommandsPane.c36912efd5',
+            'Run them from the Quick Commands button in the tab bar, or right-click inside any terminal.'
+          )}
+        </p>
       </div>
-      <Button
-        type="button"
-        variant="ghost"
-        size="icon-sm"
-        aria-label={translate(
-          'auto.components.settings.QuickCommandsPane.7d90fd5299',
-          'Edit {{value0}}',
-          {
-            value0: command.label || 'quick command'
-          }
-        )}
-        onClick={() => onEdit(command)}
-      >
-        <Pencil />
-      </Button>
-      <Button
-        type="button"
-        variant="ghost"
-        size="icon-sm"
-        aria-label={translate(
-          'auto.components.settings.QuickCommandsPane.8764c6e9e4',
-          'Remove {{value0}}',
-          {
-            value0: command.label || 'quick command'
-          }
-        )}
-        onClick={() => onRemove(command)}
-        className="text-muted-foreground hover:text-destructive"
-      >
-        <Trash2 />
-      </Button>
     </div>
   )
 }
@@ -121,43 +202,32 @@ function QuickCommandRow({
 export function QuickCommandsList({
   commands,
   visibleCommands,
+  hasQuery,
   repoById,
   onEdit,
   onRemove
 }: {
   commands: TerminalQuickCommand[]
   visibleCommands: TerminalQuickCommand[]
+  hasQuery: boolean
   repoById: Map<string, Pick<Repo, 'displayName' | 'path' | 'badgeColor'>>
   onEdit: (command: TerminalQuickCommand) => void
   onRemove: (command: TerminalQuickCommand) => void
 }): React.JSX.Element {
+  if (visibleCommands.length === 0) {
+    return <QuickCommandsEmptyState hasCommands={commands.length > 0} hasQuery={hasQuery} />
+  }
   return (
-    <div className="overflow-hidden rounded-lg border border-border/50 bg-muted/20">
-      {visibleCommands.length === 0 ? (
-        <div className="px-3 py-6 text-sm text-muted-foreground">
-          {commands.length === 0
-            ? translate(
-                'auto.components.settings.QuickCommandsPane.38d61927e6',
-                'No quick commands saved.'
-              )
-            : translate(
-                'auto.components.settings.QuickCommandsPane.3eb9897ab0',
-                'No commands in the selected scopes.'
-              )}
-        </div>
-      ) : (
-        <div className="max-h-[60vh] space-y-2 overflow-y-auto p-2 scrollbar-sleek">
-          {visibleCommands.map((command) => (
-            <QuickCommandRow
-              key={command.id}
-              command={command}
-              repoById={repoById}
-              onEdit={onEdit}
-              onRemove={onRemove}
-            />
-          ))}
-        </div>
-      )}
+    <div className="-mx-2 divide-y divide-border/50">
+      {visibleCommands.map((command) => (
+        <QuickCommandRow
+          key={command.id}
+          command={command}
+          repoById={repoById}
+          onEdit={onEdit}
+          onRemove={onRemove}
+        />
+      ))}
     </div>
   )
 }
diff --git a/src/renderer/src/components/settings/QuickCommandsPane.tsx b/src/renderer/src/components/settings/QuickCommandsPane.tsx
index f7f703e7ac1..a4f1ea85fe4 100644
--- a/src/renderer/src/components/settings/QuickCommandsPane.tsx
+++ b/src/renderer/src/components/settings/QuickCommandsPane.tsx
@@ -1,26 +1,25 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { Plus } from 'lucide-react'
 import type { GlobalSettings, TerminalQuickCommand } from '../../../../shared/types'
 import { getTerminalQuickCommandScope } from '../../../../shared/terminal-quick-commands'
 import {
   createTerminalQuickCommandDraft,
   TerminalQuickCommandDialog
 } from '@/components/terminal-quick-commands/TerminalQuickCommandDialog'
+import { searchTerminalQuickCommands } from '@/lib/terminal-quick-command-search'
 import { useAppStore } from '../../store'
 import { Button } from '../ui/button'
-import { Label } from '../ui/label'
 import { useConfirmationDialog } from '@/components/confirmation-dialog-context'
 import { getSettingOwnershipSummary } from './setting-ownership'
 import { translate } from '@/i18n/i18n'
 import { QuickCommandsList } from './QuickCommandsList'
-import { GLOBAL_SCOPE_KEY, QuickCommandsScopeFilter } from './QuickCommandsScopeFilter'
+import { QuickCommandsToolbar } from './QuickCommandsToolbar'
+import { GLOBAL_SCOPE_KEY } from './QuickCommandsScopeFilter'
 import {
   getRepoExecutionHostId,
   LOCAL_EXECUTION_HOST_ID,
   parseExecutionHostId,
   type ExecutionHostId
 } from '../../../../shared/execution-host'
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '../ui/select'
 import {
   getTerminalQuickCommandHostOptions,
   shouldShowTerminalQuickCommandHostOwnership
@@ -130,6 +129,7 @@ export function QuickCommandsPane({
   // automatically rather than being silently excluded.
   const [scopeSelection, setScopeSelection] = useState<ReadonlySet<string> | null>(null)
   const [scopePopoverOpen, setScopePopoverOpen] = useState(false)
+  const [query, setQuery] = useState('')
 
   const availableHostId = getAvailableQuickCommandHostId(selectedHostId, hostOptions)
   const editorHostIsCurrent =
@@ -164,7 +164,7 @@ export function QuickCommandsPane({
   const effectiveSelection: ReadonlySet<string> = scopeSelection ?? allScopeKeys
   const showAll = scopeSelection === null
 
-  const visibleCommands = commands.filter((command) => {
+  const scopedCommands = commands.filter((command) => {
     const scope = getTerminalQuickCommandScope(command)
     if (showAll) {
       return true
@@ -174,6 +174,7 @@ export function QuickCommandsPane({
     }
     return effectiveSelection.has(scope.repoId)
   })
+  const visibleCommands = searchTerminalQuickCommands(scopedCommands, query)
 
   const createDraftForCurrentFilter = useCallback((): TerminalQuickCommand => {
     // Why: when the user has narrowed to a single repo scope, the natural
@@ -273,68 +274,32 @@ export function QuickCommandsPane({
     void useAppStore.getState().deleteTerminalQuickCommand(selectedHostId, command.id)
   }
 
-  return (
-    <div className="space-y-3">
-      <div className="flex items-center justify-between gap-3 py-2">
-        <div className="space-y-1">
-          <Label>
-            {translate('auto.components.settings.QuickCommandsPane.f91b649324', 'Saved Commands')}
-          </Label>
-          <p className="text-xs text-muted-foreground">
-            {shouldShowTerminalQuickCommandHostOwnership(hostOptions)
-              ? ownership.description
-              : translate(
-                  'auto.components.settings.settingOwnership.terminalQuickCommands',
-                  'Commands are saved on this client, then scoped globally or to a project setup so they run from the selected terminal context.'
-                )}
-          </p>
-        </div>
-        <Button
-          type="button"
-          variant="outline"
-          size="sm"
-          disabled={!canManageSelectedHost}
-          onClick={() =>
-            setEditor({
-              mode: 'add',
-              command: createDraftForCurrentFilter(),
-              connectionGeneration: selectedRuntimeConnectionGeneration,
-              hostId: selectedHostId
-            })
-          }
-        >
-          <Plus />
-          {translate('auto.components.settings.QuickCommandsPane.5aacc8f7dc', 'Add Command')}
-        </Button>
-      </div>
+  const openAddDialog = (): void =>
+    setEditor({
+      mode: 'add',
+      command: createDraftForCurrentFilter(),
+      connectionGeneration: selectedRuntimeConnectionGeneration,
+      hostId: selectedHostId
+    })
 
+  return (
+    <div className="space-y-4">
       {shouldShowTerminalQuickCommandHostOwnership(hostOptions) ? (
-        <div className="space-y-2">
-          <Label htmlFor="quick-command-storage-host">
-            {translate('auto.components.settings.QuickCommandsPane.89f7e57fcc', 'Saved on')}
-          </Label>
-          <Select
-            value={selectedHostId}
-            onValueChange={(value) => {
-              setSelectedHostId(value as ExecutionHostId)
-              setScopeSelection(null)
-            }}
-          >
-            <SelectTrigger id="quick-command-storage-host" size="sm" className="w-56">
-              <SelectValue />
-            </SelectTrigger>
-            <SelectContent>
-              {hostOptions.map((host) => (
-                <SelectItem key={host.id} value={host.id}>
-                  {host.label}
-                </SelectItem>
-              ))}
-            </SelectContent>
-          </Select>
-        </div>
+        <p className="text-xs text-muted-foreground">{ownership.description}</p>
       ) : null}
 
-      <QuickCommandsScopeFilter
+      <QuickCommandsToolbar
+        query={query}
+        setQuery={setQuery}
+        hostOptions={hostOptions}
+        showHostSelect={shouldShowTerminalQuickCommandHostOwnership(hostOptions)}
+        selectedHostId={selectedHostId}
+        onHostChange={(hostId) => {
+          setSelectedHostId(hostId)
+          setScopeSelection(null)
+        }}
+        canAdd={canManageSelectedHost}
+        onAdd={openAddDialog}
         repos={hostRepos}
         effectiveSelection={effectiveSelection}
         showAll={showAll}
@@ -408,6 +373,7 @@ export function QuickCommandsPane({
           <QuickCommandsList
             commands={commands}
             visibleCommands={visibleCommands}
+            hasQuery={query.trim().length > 0}
             repoById={repoById}
             onEdit={(command) =>
               setEditor({
@@ -428,6 +394,7 @@ export function QuickCommandsPane({
           mode={editor.mode}
           command={editor.command}
           repos={hostRepos}
+          defaultAdvancedOpen
           onOpenChange={(open) => !open && setEditor(null)}
           onSave={saveCommand}
         />
diff --git a/src/renderer/src/components/settings/QuickCommandsScopeFilter.tsx b/src/renderer/src/components/settings/QuickCommandsScopeFilter.tsx
index e845b9dd0b4..749d554b783 100644
--- a/src/renderer/src/components/settings/QuickCommandsScopeFilter.tsx
+++ b/src/renderer/src/components/settings/QuickCommandsScopeFilter.tsx
@@ -21,7 +21,7 @@ function ScopeTriggerLabel({
 }: {
   showAll: boolean
   effectiveSelection: ReadonlySet<string>
-  repos: Repo[]
+  repos: readonly Repo[]
 }): React.JSX.Element {
   if (showAll) {
     return (
@@ -57,7 +57,7 @@ export function QuickCommandsScopeFilter({
   handleSelectAll,
   toggleScope
 }: {
-  repos: Repo[]
+  repos: readonly Repo[]
   effectiveSelection: ReadonlySet<string>
   showAll: boolean
   scopePopoverOpen: boolean
diff --git a/src/renderer/src/components/settings/QuickCommandsToolbar.tsx b/src/renderer/src/components/settings/QuickCommandsToolbar.tsx
new file mode 100644
index 00000000000..65e034eeb3f
--- /dev/null
+++ b/src/renderer/src/components/settings/QuickCommandsToolbar.tsx
@@ -0,0 +1,116 @@
+import type { Dispatch, SetStateAction } from 'react'
+import { Plus, Search } from 'lucide-react'
+import type { Repo } from '../../../../shared/types'
+import type { ExecutionHostId } from '../../../../shared/execution-host'
+import { Button } from '../ui/button'
+import { Input } from '../ui/input'
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '../ui/select'
+import { translate } from '@/i18n/i18n'
+import { QuickCommandsScopeFilter } from './QuickCommandsScopeFilter'
+
+type QuickCommandsToolbarProps = {
+  query: string
+  setQuery: (query: string) => void
+  hostOptions: readonly { id: ExecutionHostId; label: string }[]
+  showHostSelect: boolean
+  selectedHostId: ExecutionHostId
+  onHostChange: (hostId: ExecutionHostId) => void
+  canAdd: boolean
+  onAdd: () => void
+  repos: readonly Repo[]
+  effectiveSelection: ReadonlySet<string>
+  showAll: boolean
+  scopePopoverOpen: boolean
+  setScopePopoverOpen: Dispatch<SetStateAction<boolean>>
+  handleSelectAll: () => void
+  toggleScope: (key: string) => void
+}
+
+export function QuickCommandsToolbar({
+  query,
+  setQuery,
+  hostOptions,
+  showHostSelect,
+  selectedHostId,
+  onHostChange,
+  canAdd,
+  onAdd,
+  repos,
+  effectiveSelection,
+  showAll,
+  scopePopoverOpen,
+  setScopePopoverOpen,
+  handleSelectAll,
+  toggleScope
+}: QuickCommandsToolbarProps): React.JSX.Element {
+  const searchLabel = translate(
+    'auto.components.settings.QuickCommandsToolbar.searchLabel',
+    'Search commands'
+  )
+
+  return (
+    <div className="flex flex-wrap items-center gap-2">
+      <div className="relative min-w-52 flex-1">
+        <Search className="pointer-events-none absolute top-1/2 left-2.5 size-3.5 -translate-y-1/2 text-muted-foreground" />
+        <Input
+          value={query}
+          onChange={(event) => setQuery(event.target.value)}
+          placeholder={searchLabel}
+          aria-label={searchLabel}
+          className="h-8 pl-8 text-xs"
+        />
+      </div>
+
+      <QuickCommandsScopeFilter
+        repos={repos}
+        effectiveSelection={effectiveSelection}
+        showAll={showAll}
+        scopePopoverOpen={scopePopoverOpen}
+        setScopePopoverOpen={setScopePopoverOpen}
+        handleSelectAll={handleSelectAll}
+        toggleScope={toggleScope}
+      />
+
+      {showHostSelect ? (
+        <Select
+          value={selectedHostId}
+          onValueChange={(value) => onHostChange(value as ExecutionHostId)}
+        >
+          <SelectTrigger
+            id="quick-command-storage-host"
+            size="sm"
+            aria-label={translate(
+              'auto.components.settings.QuickCommandsPane.89f7e57fcc',
+              'Saved on'
+            )}
+            className="text-xs"
+          >
+            <span className="text-muted-foreground">
+              {translate('auto.components.settings.QuickCommandsPane.89f7e57fcc', 'Saved on')}
+            </span>
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            {hostOptions.map((host) => (
+              <SelectItem key={host.id} value={host.id}>
+                {host.label}
+              </SelectItem>
+            ))}
+          </SelectContent>
+        </Select>
+      ) : null}
+
+      <Button
+        type="button"
+        variant="outline"
+        size="sm"
+        disabled={!canAdd}
+        onClick={onAdd}
+        className="ml-auto"
+      >
+        <Plus />
+        {translate('auto.components.settings.QuickCommandsPane.5aacc8f7dc', 'Add Command')}
+      </Button>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/settings/SettingsConstants.ts b/src/renderer/src/components/settings/SettingsConstants.ts
index 260d8b48971..f129bea3265 100644
--- a/src/renderer/src/components/settings/SettingsConstants.ts
+++ b/src/renderer/src/components/settings/SettingsConstants.ts
@@ -11,7 +11,7 @@ export {
 } from '../../../../shared/ui-zoom-level'
 
 export function zoomLevelToPercent(level: number): number {
-  return Math.round(100 * Math.pow(1.2, level))
+  return Math.round(100 * 1.2 ** level)
 }
 
 export function mergeFontSuggestions(
diff --git a/src/renderer/src/components/settings/SettingsFormControls.tsx b/src/renderer/src/components/settings/SettingsFormControls.tsx
index 703dbbfbb21..b82e90a0984 100644
--- a/src/renderer/src/components/settings/SettingsFormControls.tsx
+++ b/src/renderer/src/components/settings/SettingsFormControls.tsx
@@ -1,26 +1,16 @@
-/* eslint-disable max-lines -- Why: these small settings form primitives and controls
-co-locate shared layout and keyboard interaction logic, which keeps the settings
-panel wiring simple even though the file exceeds the default line limit. */
 import type React from 'react'
-import { useCallback, useEffect, useId, useMemo, useRef, useState } from 'react'
-import { ScrollArea } from '../ui/scroll-area'
+import { useState } from 'react'
 import { Input } from '../ui/input'
 import { Label } from '../ui/label'
-import { Popover, PopoverAnchor, PopoverContent } from '../ui/popover'
 import { Tooltip, TooltipContent, TooltipTrigger } from '../ui/tooltip'
 import { Switch } from '../ui/switch'
-import { Check, ChevronsUpDown, CircleX } from 'lucide-react'
-import { normalizeColor, type TerminalThemeOption } from '@/lib/terminal-theme'
-import { MAX_THEME_RESULTS } from './SettingsConstants'
-import {
-  filterFontSuggestions,
-  filterTerminalThemeOptions,
-  getRenderedFontSuggestions,
-  isSettingsFormOptionQueryTooLarge
-} from './settings-form-option-filter'
+import { normalizeColor } from '@/lib/terminal-theme'
 import { cn } from '@/lib/utils'
 import { translate } from '@/i18n/i18n'
 
+export { FontAutocomplete } from './FontAutocomplete'
+export { ThemePicker } from './TerminalThemePicker'
+
 type SettingsSwitchProps = {
   checked: boolean
   onChange: () => void
@@ -261,19 +251,6 @@ export function SettingsSubsectionHeader({
   )
 }
 
-type ThemePickerProps = {
-  label: string
-  description: string
-  selectedTheme: string
-  themeOptions: TerminalThemeOption[]
-  query: string
-  onQueryChange: (value: string) => void
-  onSelectTheme: (theme: string) => void
-  /** Bumps when themes are imported; scrolls the Imported group into view and
-   *  briefly highlights it so freshly-imported themes are easy to find. */
-  importedHighlightSignal?: number
-}
-
 type ColorFieldProps = {
   label: string
   description: string
@@ -294,200 +271,6 @@ type NumberFieldProps = {
   suffix?: string
 }
 
-type FontAutocompleteProps = {
-  value: string
-  suggestions: string[]
-  onChange: (value: string) => void
-  placeholder?: string
-  onRequestSuggestions?: () => void
-  /** Fires with whichever option the user is currently highlighting in the
-   *  dropdown (via mouse hover or keyboard arrow), or null when nothing is
-   *  highlighted / the dropdown is closed. Lets a consumer show a live
-   *  preview of the font without committing the selection. */
-  onPreviewFontFamily?: (font: string | null) => void
-}
-
-export function ThemePicker({
-  label,
-  description,
-  selectedTheme,
-  themeOptions,
-  query,
-  onQueryChange,
-  onSelectTheme,
-  importedHighlightSignal
-}: ThemePickerProps): React.JSX.Element {
-  const importedGroupRef = useRef<HTMLDivElement | null>(null)
-  const [highlightImported, setHighlightImported] = useState(false)
-
-  // Why: imported themes render below the built-in list inside a fixed-height
-  // scroll area, so after an import they sit off-screen. On each import signal,
-  // scroll the Imported group into view and flash a highlight so it's easy to spot.
-  useEffect(() => {
-    if (!importedHighlightSignal) {
-      return
-    }
-    importedGroupRef.current?.scrollIntoView({ behavior: 'smooth', block: 'nearest' })
-    setHighlightImported(true)
-    const timer = setTimeout(() => setHighlightImported(false), 2000)
-    return () => clearTimeout(timer)
-  }, [importedHighlightSignal])
-
-  const themeQuery = query.trim()
-  const shouldShowThemeQueryLabel =
-    themeQuery.length > 0 && !isSettingsFormOptionQueryTooLarge(themeQuery)
-  const matchingThemes = filterTerminalThemeOptions(themeOptions, query)
-  const selectedThemeLabel =
-    themeOptions.find((option) => option.value === selectedTheme)?.label ?? selectedTheme
-  const groupedThemes = [
-    {
-      label: translate('auto.components.settings.SettingsFormControls.builtin_themes', 'Built-in'),
-      themes: matchingThemes
-        .filter((theme) => theme.group === 'built-in')
-        .slice(0, MAX_THEME_RESULTS)
-    },
-    {
-      label: translate('auto.components.settings.SettingsFormControls.imported_themes', 'Imported'),
-      themes: matchingThemes
-        .filter((theme) => theme.group === 'imported')
-        .slice(0, MAX_THEME_RESULTS)
-    }
-  ].filter((group) => group.themes.length > 0)
-  const visibleThemeCount = groupedThemes.reduce((sum, group) => sum + group.themes.length, 0)
-
-  return (
-    <div className="space-y-3">
-      <div className="space-y-1">
-        <Label>{label}</Label>
-        <p className="text-xs text-muted-foreground">{description}</p>
-      </div>
-      <Input
-        value={query}
-        onChange={(e) => onQueryChange(e.target.value)}
-        placeholder={translate(
-          'auto.components.settings.SettingsFormControls.search_terminal_themes',
-          'Search terminal themes'
-        )}
-      />
-      <div className="rounded-lg border border-border/50">
-        <div className="flex items-center justify-between border-b border-border/50 px-3 py-2 text-xs text-muted-foreground">
-          <span>
-            {translate('auto.components.settings.SettingsFormControls.fbb428db98', 'Selected:')}{' '}
-            {selectedThemeLabel}
-          </span>
-          <span>
-            {translate('auto.components.settings.SettingsFormControls.4e11f87ca6', 'Showing')}{' '}
-            {visibleThemeCount}
-            {shouldShowThemeQueryLabel
-              ? translate(
-                  'auto.components.settings.SettingsFormControls.c822571b2e',
-                  ' matching "{{value0}}"',
-                  { value0: themeQuery }
-                )
-              : translate(
-                  'auto.components.settings.SettingsFormControls.cb330ef7f8',
-                  ' of {{value0}}',
-                  { value0: themeOptions.length }
-                )}
-          </span>
-        </div>
-        <ScrollArea className="h-64">
-          <div className="space-y-1 p-2">
-            {groupedThemes.map((group) => {
-              const isImported =
-                group.label ===
-                translate(
-                  'auto.components.settings.SettingsFormControls.imported_themes',
-                  'Imported'
-                )
-              return (
-                <div
-                  key={group.label}
-                  ref={isImported ? importedGroupRef : undefined}
-                  className={cn(
-                    'space-y-1 rounded-md transition-colors duration-500',
-                    isImported && highlightImported && 'bg-accent/40 ring-1 ring-accent'
-                  )}
-                >
-                  <p className="px-3 pt-2 text-[11px] font-semibold uppercase tracking-[0.05em] text-muted-foreground">
-                    {group.label}
-                  </p>
-                  {group.themes.map((theme) => (
-                    <button
-                      key={theme.value}
-                      onClick={() => onSelectTheme(theme.value)}
-                      className={cn(
-                        'flex w-full items-center justify-between gap-3 rounded-md px-3 py-2 text-left text-sm transition-colors',
-                        selectedTheme === theme.value
-                          ? 'bg-accent font-medium text-accent-foreground'
-                          : 'hover:bg-accent'
-                      )}
-                    >
-                      <span className="min-w-0 flex-1">
-                        <span className="block truncate">{theme.label}</span>
-                        {theme.sourceLabel ? (
-                          <span className="block truncate text-[11px] font-normal text-muted-foreground">
-                            {translate(
-                              'auto.components.settings.SettingsFormControls.imported_from',
-                              'Imported from {{value0}}',
-                              { value0: theme.sourceLabel }
-                            )}
-                            {theme.mode && theme.mode !== 'unknown' ? ` · ${theme.mode}` : ''}
-                          </span>
-                        ) : null}
-                      </span>
-                      {/* Why: hide swatches on the current row so the color grid
-                        doesn't shift left to make room for the "Current" label. */}
-                      {theme.group === 'imported' &&
-                      theme.previewTheme &&
-                      selectedTheme !== theme.value ? (
-                        <span className="flex shrink-0 overflow-hidden rounded-sm border border-border/60">
-                          {[
-                            theme.previewTheme.black,
-                            theme.previewTheme.red,
-                            theme.previewTheme.green,
-                            theme.previewTheme.yellow,
-                            theme.previewTheme.blue,
-                            theme.previewTheme.magenta,
-                            theme.previewTheme.cyan,
-                            theme.previewTheme.white
-                          ].map((color, index) => (
-                            <span
-                              key={index}
-                              className="h-3 w-2"
-                              style={{ backgroundColor: color ?? 'transparent' }}
-                            />
-                          ))}
-                        </span>
-                      ) : null}
-                      {selectedTheme === theme.value ? (
-                        <span className="ml-3 shrink-0 text-[11px] uppercase tracking-[0.16em]">
-                          {translate(
-                            'auto.components.settings.SettingsFormControls.9119fb2268',
-                            'Current'
-                          )}
-                        </span>
-                      ) : null}
-                    </button>
-                  ))}
-                </div>
-              )
-            })}
-            {visibleThemeCount === 0 ? (
-              <div className="px-3 py-6 text-sm text-muted-foreground">
-                {translate(
-                  'auto.components.settings.SettingsFormControls.ceefb9d7f1',
-                  'No themes found.'
-                )}
-              </div>
-            ) : null}
-          </div>
-        </ScrollArea>
-      </div>
-    </div>
-  )
-}
-
 export function ColorField({
   label,
   description,
@@ -596,313 +379,3 @@ export function NumberField({
     />
   )
 }
-
-export function FontAutocomplete({
-  value,
-  suggestions,
-  onChange,
-  placeholder = 'SF Mono',
-  onRequestSuggestions,
-  onPreviewFontFamily
-}: FontAutocompleteProps): React.JSX.Element {
-  const [query, setQuery] = useState(value)
-  const [prevValue, setPrevValue] = useState(value)
-  const [open, setOpen] = useState(false)
-  const [highlightedIndex, setHighlightedIndex] = useState(-1)
-  const [isFilteringQuery, setIsFilteringQuery] = useState(false)
-  const inputRef = useRef<HTMLInputElement | null>(null)
-  const rootRef = useRef<HTMLDivElement | null>(null)
-  const previewFontFamilyRef = useRef(onPreviewFontFamily)
-  const listboxId = useId()
-
-  previewFontFamilyRef.current = onPreviewFontFamily
-
-  const setRootNode = useCallback((element: HTMLDivElement | null): void => {
-    rootRef.current = element
-    if (!element) {
-      // Why: settings search can unmount this control while a hover preview is
-      // active; the consumer must not keep rendering that transient font.
-      previewFontFamilyRef.current?.(null)
-    }
-  }, [])
-
-  if (value !== prevValue) {
-    setPrevValue(value)
-    setQuery(value)
-    if (value !== query) {
-      setIsFilteringQuery(false)
-    }
-  }
-
-  const requestSuggestions = useCallback((): void => {
-    onRequestSuggestions?.()
-  }, [onRequestSuggestions])
-
-  const handleOpenChange = (nextOpen: boolean): void => {
-    setOpen(nextOpen)
-    if (nextOpen) {
-      requestSuggestions()
-    }
-    if (!nextOpen) {
-      setIsFilteringQuery(false)
-    }
-  }
-
-  const normalizedQuery = query.trim().toLowerCase()
-  const normalizedValue = value.trim().toLowerCase()
-  const filteredSuggestions = useMemo(
-    () => filterFontSuggestions(suggestions, query),
-    [suggestions, query]
-  )
-  // Why: the committed font fills the input, but opening the chooser should
-  // still reveal every installed font instead of only fonts sharing that name.
-  const visibleSuggestions =
-    !isFilteringQuery && normalizedQuery === normalizedValue ? suggestions : filteredSuggestions
-  const renderedSuggestions = useMemo(
-    () => getRenderedFontSuggestions(visibleSuggestions, highlightedIndex),
-    [visibleSuggestions, highlightedIndex]
-  )
-
-  // Why: sync the highlighted index during render rather than via useEffect so
-  // the correct item is highlighted on the very first paint after open/filter
-  // changes — useEffect would leave one render with the stale index visible.
-  const [prevVisibleSuggestions, setPrevVisibleSuggestions] = useState(visibleSuggestions)
-  const [prevOpen, setPrevOpen] = useState(open)
-  const [prevHighlightedValue, setPrevHighlightedValue] = useState(value)
-  if (
-    visibleSuggestions !== prevVisibleSuggestions ||
-    open !== prevOpen ||
-    value !== prevHighlightedValue
-  ) {
-    setPrevVisibleSuggestions(visibleSuggestions)
-    setPrevOpen(open)
-    setPrevHighlightedValue(value)
-    if (!open || visibleSuggestions.length === 0) {
-      setHighlightedIndex(-1)
-    } else {
-      const selectedIndex = visibleSuggestions.indexOf(value)
-      setHighlightedIndex(Math.max(selectedIndex, 0))
-    }
-  }
-
-  // Why: notify the consumer of the currently-highlighted font so it can
-  // render a live preview. Closing the dropdown or moving past all options
-  // clears the preview back to the committed value.
-  useEffect(() => {
-    if (!onPreviewFontFamily) {
-      return
-    }
-    if (!open || highlightedIndex < 0) {
-      onPreviewFontFamily(null)
-      return
-    }
-    onPreviewFontFamily(visibleSuggestions[highlightedIndex] ?? null)
-  }, [visibleSuggestions, highlightedIndex, onPreviewFontFamily, open])
-
-  const commitValue = (nextValue: string): void => {
-    setQuery(nextValue)
-    setIsFilteringQuery(false)
-    onChange(nextValue)
-    setOpen(false)
-  }
-
-  const focusInput = (): void => {
-    inputRef.current?.focus()
-  }
-  const popoverAvailableHeightStyle = {
-    // Why: tailwind-merge rewrites this arbitrary max-height class on the
-    // ScrollArea root, so keep the Radix available-height clamp as inline style.
-    maxHeight: 'var(--radix-popover-content-available-height)'
-  } as React.CSSProperties
-
-  return (
-    <div ref={setRootNode} className="relative max-w-sm">
-      <Popover open={open} onOpenChange={handleOpenChange}>
-        <PopoverAnchor asChild>
-          <div className="relative">
-            <Input
-              ref={inputRef}
-              value={query}
-              onChange={(e) => {
-                const next = e.target.value
-                requestSuggestions()
-                setQuery(next)
-                setIsFilteringQuery(true)
-                onChange(next)
-                setOpen(true)
-              }}
-              onFocus={() => {
-                requestSuggestions()
-                setIsFilteringQuery(false)
-                setOpen(true)
-              }}
-              onKeyDown={(e) => {
-                if (e.key === 'Escape') {
-                  if (open) {
-                    e.preventDefault()
-                    setOpen(false)
-                    setIsFilteringQuery(false)
-                  }
-                  return
-                }
-
-                if (e.key === 'ArrowDown') {
-                  e.preventDefault()
-                  setOpen(true)
-                  if (visibleSuggestions.length > 0) {
-                    setHighlightedIndex((current) =>
-                      current < 0 ? 0 : Math.min(current + 1, visibleSuggestions.length - 1)
-                    )
-                  }
-                  return
-                }
-
-                if (e.key === 'ArrowUp') {
-                  e.preventDefault()
-                  setOpen(true)
-                  if (visibleSuggestions.length > 0) {
-                    setHighlightedIndex((current) =>
-                      current < 0 ? visibleSuggestions.length - 1 : Math.max(current - 1, 0)
-                    )
-                  }
-                  return
-                }
-
-                if (e.key === 'Enter' && open && highlightedIndex >= 0) {
-                  const highlightedFont = visibleSuggestions[highlightedIndex]
-                  if (highlightedFont) {
-                    e.preventDefault()
-                    commitValue(highlightedFont)
-                  }
-                }
-              }}
-              placeholder={placeholder}
-              className="pr-18"
-              role="combobox"
-              aria-autocomplete="list"
-              aria-expanded={open}
-              aria-controls={listboxId}
-              aria-activedescendant={
-                open && highlightedIndex >= 0
-                  ? `${listboxId}-option-${highlightedIndex}`
-                  : undefined
-              }
-            />
-            <div className="absolute inset-y-0 right-2 flex items-center gap-1">
-              {query ? (
-                <button
-                  type="button"
-                  onMouseDown={(e) => e.preventDefault()}
-                  onClick={() => {
-                    setQuery('')
-                    setIsFilteringQuery(false)
-                    onChange('')
-                    setOpen(true)
-                    focusInput()
-                  }}
-                  className="rounded-sm p-1 text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
-                  aria-label={translate(
-                    'auto.components.settings.SettingsFormControls.a4ff6143f8',
-                    'Clear font selection'
-                  )}
-                  title={translate(
-                    'auto.components.settings.SettingsFormControls.74bcecd5ec',
-                    'Clear'
-                  )}
-                >
-                  <CircleX className="size-3.5" />
-                </button>
-              ) : null}
-              <button
-                type="button"
-                onMouseDown={(e) => e.preventDefault()}
-                onClick={() => {
-                  const nextOpen = !open
-                  setOpen(nextOpen)
-                  if (!nextOpen) {
-                    setIsFilteringQuery(false)
-                  }
-                  if (nextOpen) {
-                    requestSuggestions()
-                    focusInput()
-                  }
-                }}
-                className="rounded-sm p-1 text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
-                aria-label={translate(
-                  'auto.components.settings.SettingsFormControls.c766f8ac75',
-                  'Toggle font suggestions'
-                )}
-                title={translate(
-                  'auto.components.settings.SettingsFormControls.b55371ea18',
-                  'Fonts'
-                )}
-              >
-                <ChevronsUpDown className="size-3.5" />
-              </button>
-            </div>
-          </div>
-        </PopoverAnchor>
-
-        {/* Why: portal the dropdown outside the settings section — an in-flow
-          absolute panel makes the highlighted option's scrollIntoView scroll
-          the whole settings pane, pushing the section content out of view. */}
-        <PopoverContent
-          align="start"
-          className="w-[var(--radix-popover-trigger-width)]"
-          onOpenAutoFocus={(e) => e.preventDefault()}
-          onCloseAutoFocus={(e) => e.preventDefault()}
-          onInteractOutside={(e) => {
-            // Why: the input and its clear/toggle buttons are the anchor, not
-            // the content, so Radix would otherwise dismiss on every click there.
-            if (rootRef.current?.contains(e.target as Node)) {
-              e.preventDefault()
-            }
-          }}
-        >
-          <ScrollArea
-            className={renderedSuggestions.length > 8 ? 'h-64' : undefined}
-            style={popoverAvailableHeightStyle}
-            viewportProps={{ style: popoverAvailableHeightStyle }}
-          >
-            <div id={listboxId} role="listbox" className="p-1">
-              {visibleSuggestions.length > 0 ? (
-                renderedSuggestions.map(({ font, sourceIndex }) => (
-                  <button
-                    key={font}
-                    type="button"
-                    id={`${listboxId}-option-${sourceIndex}`}
-                    role="option"
-                    aria-selected={sourceIndex === highlightedIndex}
-                    ref={(element) => {
-                      if (element && sourceIndex === highlightedIndex) {
-                        element.scrollIntoView({ block: 'nearest' })
-                      }
-                    }}
-                    onMouseDown={(e) => e.preventDefault()}
-                    onMouseEnter={() => setHighlightedIndex(sourceIndex)}
-                    onClick={() => commitValue(font)}
-                    className={`flex w-full items-center justify-between rounded-sm px-3 py-2 text-left text-sm transition-colors ${
-                      sourceIndex === highlightedIndex
-                        ? 'bg-accent text-accent-foreground'
-                        : 'hover:bg-muted/60'
-                    }`}
-                  >
-                    <span className="truncate">{font}</span>
-                    {font === value ? <Check className="ml-3 size-4 shrink-0" /> : null}
-                  </button>
-                ))
-              ) : (
-                <div className="px-3 py-3 text-sm text-muted-foreground">
-                  {translate(
-                    'auto.components.settings.SettingsFormControls.42a4d15a30',
-                    'No matching fonts.'
-                  )}
-                </div>
-              )}
-            </div>
-          </ScrollArea>
-        </PopoverContent>
-      </Popover>
-    </div>
-  )
-}
diff --git a/src/renderer/src/components/settings/ShortcutsPane.tsx b/src/renderer/src/components/settings/ShortcutsPane.tsx
index 8c8b2eb2222..97d5a553163 100644
--- a/src/renderer/src/components/settings/ShortcutsPane.tsx
+++ b/src/renderer/src/components/settings/ShortcutsPane.tsx
@@ -1,4 +1,5 @@
 import React, { useEffect, useMemo, useState } from 'react'
+import { useShallow } from 'zustand/react/shallow'
 import {
   findKeybindingConflictsForDefinitions,
   formatKeybindingList,
@@ -14,22 +15,12 @@ import { EMPTY_DISABLED_TUI_AGENTS } from './shortcut-groups'
 import { useAppStore } from '../../store'
 import { KeybindingsFileActions } from './KeybindingsFileActions'
 import { SettingsSubsectionHeader } from './SettingsFormControls'
-import { getShortcutTerminalStatus } from './shortcut-terminal-status'
 import {
   hasCommonBindingOverride,
-  hasOwnBindingOverride,
   removeBindingOverride,
   sameBindings
 } from './keybinding-override-edits'
-import {
-  buildShortcutGlobalSearchMatcher,
-  matchesShortcutFilter,
-  matchesShortcutLocalSearch,
-  normalizeShortcutLocalSearchQuery,
-  ShortcutFilterRail,
-  type ShortcutFilter,
-  type ShortcutRowsByGroup
-} from './ShortcutFilterRail'
+import { ShortcutFilterRail, type ShortcutFilter } from './ShortcutFilterRail'
 import { ShortcutRowsList } from './ShortcutRowsList'
 import { ShortcutTerminalPolicyControl } from './ShortcutTerminalPolicyControl'
 import { getTerminalShortcutPolicySearchEntry } from './shortcuts-search'
@@ -45,6 +36,8 @@ import { useMountedRef } from '@/hooks/useMountedRef'
 import { translate } from '@/i18n/i18n'
 import { useEditablePluginCommands } from '@/store/plugin-panels'
 import { buildShortcutDefinitionCatalog } from './shortcut-definition-catalog'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
+import { buildShortcutRowVisibility } from './shortcut-row-visibility'
 
 const isMac = navigator.userAgent.includes('Mac')
 const platform: NodeJS.Platform = isMac
@@ -68,23 +61,28 @@ export function ShortcutsPane(): React.JSX.Element {
   const resetKeybindingOverride = useAppStore((state) => state.resetKeybindingOverride)
   const disableKeybindingAction = useAppStore((state) => state.disableKeybindingAction)
   const pluginCommands = useEditablePluginCommands()
+  const [managedBrowserCreationEnabled, mobileEmulatorCreationEnabled] = useAppStore(
+    useShallow((state) => {
+      const policy = getClientCreationActionPolicy(state, state.activeWorktreeId)
+      return [
+        policy['managed-browser'].state === 'enabled',
+        policy['mobile-emulator'].state === 'enabled'
+      ] as const
+    })
+  )
   const mountedRef = useMountedRef()
   const [errors, setErrors] = useState<Partial<Record<KeybindingActionId, string>>>({})
   const [recordingActionId, setRecordingActionId] = useState<KeybindingActionId | null>(null)
-  // Which binding index of the recording action is being captured. Equals the
-  // effective length when capturing a brand-new (appended) binding.
+  // The effective length targets a new appended binding.
   const [recordingBindingIndex, setRecordingBindingIndex] = useState<number | null>(null)
-  // Bindings an action had right before it was disabled, so "Enable" can restore
-  // them in one click instead of forcing a reset-to-default.
+  // Preserve disabled bindings so Enable can restore them.
   const [disableMemory, setDisableMemory] = useState<Partial<Record<KeybindingActionId, string[]>>>(
     {}
   )
   const [shortcutQuery, setShortcutQuery] = useState('')
   const [shortcutFilter, setShortcutFilter] = useState<ShortcutFilter>('all')
 
-  // Why: tell the main process to suspend global shortcut dispatch while any row
-  // is recording, so the captured chord lands in the editor instead of firing.
-  // One source of truth here avoids races between per-row recorder effects.
+  // Why: suspend global dispatch so a captured chord reaches the editor.
   useEffect(() => {
     window.api.ui.setShortcutRecorderFocused(recordingActionId !== null)
     return () => window.api.ui.setShortcutRecorderFocused(false)
@@ -110,55 +108,31 @@ export function ShortcutsPane(): React.JSX.Element {
     const definition = definitionForAction(actionId)
     return definition ? getEffectiveKeybindingsForDefinition(definition, platform, overrides) : []
   }
-  const shortcutGroups = useMemo<ShortcutRowsByGroup[]>(
+  const { filterCounts, shortcutRows, visibleShortcutCount, visibleShortcutGroups } = useMemo(
     () =>
-      groups.map((group) => ({
-        title: group.title,
-        rows: group.items.map((item) => {
-          const effective = getEffectiveKeybindingsForDefinition(item, platform, keybindings)
-          const modified = hasOwnBindingOverride(keybindings, item.id)
-          const warnings = conflictByAction.get(item.id) ?? []
-          return {
-            item,
-            groupTitle: group.title,
-            effective,
-            modified,
-            warnings,
-            terminalStatus: getShortcutTerminalStatus(
-              item,
-              terminalShortcutPolicy,
-              effective.length > 0
-            )
-          }
-        })
-      })),
-    [conflictByAction, groups, keybindings, terminalShortcutPolicy]
-  )
-  const shortcutSearchQuery = normalizeShortcutLocalSearchQuery(shortcutQuery)
-  const shortcutRows = shortcutGroups.flatMap((group) => group.rows)
-  const matchesShortcutGlobalSearch = buildShortcutGlobalSearchMatcher(shortcutRows, searchQuery)
-  const matchesShortcutSearch = (row: ShortcutRowsByGroup['rows'][number]): boolean =>
-    shortcutSearchQuery !== null &&
-    matchesShortcutGlobalSearch(row) &&
-    matchesShortcutLocalSearch(row, shortcutSearchQuery, platform)
-  const baseVisibleRows = shortcutRows.filter((row) => matchesShortcutSearch(row))
-  const filterCounts: Record<ShortcutFilter, number> = {
-    all: baseVisibleRows.length,
-    modified: baseVisibleRows.filter((row) => row.modified).length,
-    unassigned: baseVisibleRows.filter((row) => row.effective.length === 0).length,
-    conflicts: baseVisibleRows.filter((row) => row.warnings.length > 0).length
-  }
-  const visibleShortcutGroups = shortcutGroups
-    .map((group) => ({
-      title: group.title,
-      rows: group.rows.filter(
-        (row) => matchesShortcutSearch(row) && matchesShortcutFilter(row, shortcutFilter)
-      )
-    }))
-    .filter((group) => group.rows.length > 0)
-  const visibleShortcutCount = visibleShortcutGroups.reduce(
-    (sum, group) => sum + group.rows.length,
-    0
+      buildShortcutRowVisibility({
+        groups,
+        keybindings,
+        conflictByAction,
+        terminalShortcutPolicy,
+        platform,
+        managedBrowserCreationEnabled,
+        mobileEmulatorCreationEnabled,
+        settingsSearchQuery: searchQuery,
+        shortcutQuery,
+        shortcutFilter
+      }),
+    [
+      conflictByAction,
+      groups,
+      keybindings,
+      managedBrowserCreationEnabled,
+      mobileEmulatorCreationEnabled,
+      searchQuery,
+      shortcutFilter,
+      shortcutQuery,
+      terminalShortcutPolicy
+    ]
   )
 
   const saveBindings = async (
@@ -236,8 +210,7 @@ export function ShortcutsPane(): React.JSX.Element {
       return
     }
 
-    // Edit just the targeted binding (or append a new one) instead of replacing
-    // the whole list, so an action's other bindings survive the capture.
+    // Preserve sibling bindings when editing or appending one chord.
     const current = effectiveBindingsForAction(actionId)
     const next =
       recordingBindingIndex === null || recordingBindingIndex >= current.length
@@ -290,8 +263,7 @@ export function ShortcutsPane(): React.JSX.Element {
   }
 
   const clearRecordingForAction = (actionId: KeybindingActionId): void => {
-    // Why: disable/reset are final shortcut edits; the next keypress must not
-    // be captured into the shortcut the user just removed or restored.
+    // Why: final edits must not leave the recorder armed.
     if (recordingActionId === actionId) {
       setRecordingBindingIndex(null)
     }
@@ -367,9 +339,7 @@ export function ShortcutsPane(): React.JSX.Element {
           />
 
           <ShortcutRowsList
-            // overflow-x-hidden is explicit: overflow-y-auto alone makes the
-            // browser compute overflow-x to auto, which produced the phantom
-            // horizontal scroll when long edit-time content popped in.
+            // Why: overflow-y-auto otherwise creates a phantom horizontal scrollbar.
             className="min-h-0 min-w-0 flex-1 overflow-x-hidden overflow-y-auto pr-1 scrollbar-sleek"
             groups={visibleShortcutGroups}
             platform={platform}
diff --git a/src/renderer/src/components/settings/TaskSourceLinearSetup.tsx b/src/renderer/src/components/settings/TaskSourceLinearSetup.tsx
index deb6ab2d72d..8b349db4959 100644
--- a/src/renderer/src/components/settings/TaskSourceLinearSetup.tsx
+++ b/src/renderer/src/components/settings/TaskSourceLinearSetup.tsx
@@ -137,6 +137,7 @@ export function TaskSourceLinearSetup({
               )}
               terminalWorktreeId="settings-tasks-linear-skill-terminal"
               terminalShellOverride={skillSetup.terminalShellOverride}
+              terminalRuntime={skillSetup.terminalRuntime}
               installed={skillSetup.skillInstalled}
               loading={skillSetup.skillLoading}
               error={skillSetup.error}
diff --git a/src/renderer/src/components/settings/TerminalFontSizeSetting.test.tsx b/src/renderer/src/components/settings/TerminalFontSizeSetting.test.tsx
new file mode 100644
index 00000000000..d5e6ecc54bd
--- /dev/null
+++ b/src/renderer/src/components/settings/TerminalFontSizeSetting.test.tsx
@@ -0,0 +1,89 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { GlobalSettings } from '../../../../shared/types'
+import { TerminalFontSizeSetting } from './TerminalFontSizeSetting'
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, defaultValue: string) => defaultValue
+}))
+
+describe('TerminalFontSizeSetting', () => {
+  let container: HTMLDivElement
+  let root: Root
+
+  beforeEach(() => {
+    globalThis.IS_REACT_ACT_ENVIRONMENT = true
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    document.body.replaceChildren()
+  })
+
+  function renderSetting(terminalFontSize: number, updateSettings = vi.fn()): void {
+    act(() => {
+      root.render(
+        <TerminalFontSizeSetting
+          settings={{ terminalFontSize } as GlobalSettings}
+          updateSettings={updateSettings}
+          forceVisible
+        />
+      )
+    })
+  }
+
+  function getInput(): HTMLInputElement {
+    const input = container.querySelector<HTMLInputElement>('input[type="number"]')
+    if (!input) {
+      throw new Error('font size input not found')
+    }
+    return input
+  }
+
+  function getStepperButtons(): { decrement: HTMLButtonElement; increment: HTMLButtonElement } {
+    const [decrement, increment] = Array.from(
+      container.querySelectorAll<HTMLButtonElement>('button')
+    )
+    if (!decrement || !increment) {
+      throw new Error('stepper buttons not found')
+    }
+    return { decrement, increment }
+  }
+
+  it('keeps the two-digit input compact without native spin buttons', () => {
+    renderSetting(15)
+
+    expect(Array.from(getInput().classList)).toEqual(
+      expect.arrayContaining(['number-input-clean', 'w-14'])
+    )
+  })
+
+  it('steps the font size within the supported range', () => {
+    const updateSettings = vi.fn()
+    renderSetting(15, updateSettings)
+
+    const { decrement, increment } = getStepperButtons()
+
+    act(() => increment.click())
+    expect(updateSettings).toHaveBeenCalledWith({ terminalFontSize: 16 })
+
+    act(() => decrement.click())
+    expect(updateSettings).toHaveBeenCalledWith({ terminalFontSize: 14 })
+  })
+
+  it('disables the steppers at the range bounds', () => {
+    renderSetting(10)
+    expect(getStepperButtons().decrement.disabled).toBe(true)
+    expect(getStepperButtons().increment.disabled).toBe(false)
+
+    renderSetting(24)
+    expect(getStepperButtons().decrement.disabled).toBe(false)
+    expect(getStepperButtons().increment.disabled).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/settings/TerminalFontSizeSetting.tsx b/src/renderer/src/components/settings/TerminalFontSizeSetting.tsx
index 3ce31694e67..61a451c7377 100644
--- a/src/renderer/src/components/settings/TerminalFontSizeSetting.tsx
+++ b/src/renderer/src/components/settings/TerminalFontSizeSetting.tsx
@@ -45,6 +45,7 @@ export function TerminalFontSizeSetting({
             >
               <Minus className="size-3" />
             </Button>
+            {/* Why: native spin buttons overlap the value and duplicate the −/+ steppers. */}
             <Input
               type="number"
               min={10}
@@ -56,7 +57,7 @@ export function TerminalFontSizeSetting({
                   updateSettings({ terminalFontSize: value })
                 }
               }}
-              className="w-14 text-center tabular-nums"
+              className="number-input-clean w-14 text-center tabular-nums"
             />
             <Button
               variant="outline"
diff --git a/src/renderer/src/components/settings/TerminalThemePicker.tsx b/src/renderer/src/components/settings/TerminalThemePicker.tsx
new file mode 100644
index 00000000000..f37d3a5492e
--- /dev/null
+++ b/src/renderer/src/components/settings/TerminalThemePicker.tsx
@@ -0,0 +1,207 @@
+import type React from 'react'
+import { useEffect, useRef, useState } from 'react'
+import { ScrollArea } from '../ui/scroll-area'
+import { Input } from '../ui/input'
+import { Label } from '../ui/label'
+import { MAX_THEME_RESULTS } from './SettingsConstants'
+import {
+  filterTerminalThemeOptions,
+  isSettingsFormOptionQueryTooLarge
+} from './settings-form-option-filter'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+import type { TerminalThemeOption } from '@/lib/terminal-theme'
+
+type ThemePickerProps = {
+  label: string
+  description: string
+  selectedTheme: string
+  themeOptions: TerminalThemeOption[]
+  query: string
+  onQueryChange: (value: string) => void
+  onSelectTheme: (theme: string) => void
+  /** Bumps when themes are imported; scrolls the Imported group into view and
+   *  briefly highlights it so freshly-imported themes are easy to find. */
+  importedHighlightSignal?: number
+}
+
+export function ThemePicker({
+  label,
+  description,
+  selectedTheme,
+  themeOptions,
+  query,
+  onQueryChange,
+  onSelectTheme,
+  importedHighlightSignal
+}: ThemePickerProps): React.JSX.Element {
+  const importedGroupRef = useRef<HTMLDivElement | null>(null)
+  const [highlightImported, setHighlightImported] = useState(false)
+
+  // Why: imported themes render below the built-in list inside a fixed-height
+  // scroll area, so after an import they sit off-screen. On each import signal,
+  // scroll the Imported group into view and flash a highlight so it's easy to spot.
+  useEffect(() => {
+    if (!importedHighlightSignal) {
+      return
+    }
+    importedGroupRef.current?.scrollIntoView({ behavior: 'smooth', block: 'nearest' })
+    setHighlightImported(true)
+    const timer = setTimeout(() => setHighlightImported(false), 2000)
+    return () => clearTimeout(timer)
+  }, [importedHighlightSignal])
+
+  const themeQuery = query.trim()
+  const shouldShowThemeQueryLabel =
+    themeQuery.length > 0 && !isSettingsFormOptionQueryTooLarge(themeQuery)
+  const matchingThemes = filterTerminalThemeOptions(themeOptions, query)
+  const selectedThemeLabel =
+    themeOptions.find((option) => option.value === selectedTheme)?.label ?? selectedTheme
+  const groupedThemes = [
+    {
+      label: translate('auto.components.settings.SettingsFormControls.builtin_themes', 'Built-in'),
+      themes: matchingThemes
+        .filter((theme) => theme.group === 'built-in')
+        .slice(0, MAX_THEME_RESULTS)
+    },
+    {
+      label: translate('auto.components.settings.SettingsFormControls.imported_themes', 'Imported'),
+      themes: matchingThemes
+        .filter((theme) => theme.group === 'imported')
+        .slice(0, MAX_THEME_RESULTS)
+    }
+  ].filter((group) => group.themes.length > 0)
+  const visibleThemeCount = groupedThemes.reduce((sum, group) => sum + group.themes.length, 0)
+
+  return (
+    <div className="space-y-3">
+      <div className="space-y-1">
+        <Label>{label}</Label>
+        <p className="text-xs text-muted-foreground">{description}</p>
+      </div>
+      <Input
+        value={query}
+        onChange={(e) => onQueryChange(e.target.value)}
+        placeholder={translate(
+          'auto.components.settings.SettingsFormControls.search_terminal_themes',
+          'Search terminal themes'
+        )}
+      />
+      <div className="rounded-lg border border-border/50">
+        <div className="flex items-center justify-between border-b border-border/50 px-3 py-2 text-xs text-muted-foreground">
+          <span>
+            {translate('auto.components.settings.SettingsFormControls.fbb428db98', 'Selected:')}{' '}
+            {selectedThemeLabel}
+          </span>
+          <span>
+            {translate('auto.components.settings.SettingsFormControls.4e11f87ca6', 'Showing')}{' '}
+            {visibleThemeCount}
+            {shouldShowThemeQueryLabel
+              ? translate(
+                  'auto.components.settings.SettingsFormControls.c822571b2e',
+                  ' matching "{{value0}}"',
+                  { value0: themeQuery }
+                )
+              : translate(
+                  'auto.components.settings.SettingsFormControls.cb330ef7f8',
+                  ' of {{value0}}',
+                  { value0: themeOptions.length }
+                )}
+          </span>
+        </div>
+        <ScrollArea className="h-64">
+          <div className="space-y-1 p-2">
+            {groupedThemes.map((group) => {
+              const isImported =
+                group.label ===
+                translate(
+                  'auto.components.settings.SettingsFormControls.imported_themes',
+                  'Imported'
+                )
+              return (
+                <div
+                  key={group.label}
+                  ref={isImported ? importedGroupRef : undefined}
+                  className={cn(
+                    'space-y-1 rounded-md transition-colors duration-500',
+                    isImported && highlightImported && 'bg-accent/40 ring-1 ring-accent'
+                  )}
+                >
+                  <p className="px-3 pt-2 text-[11px] font-semibold uppercase tracking-[0.05em] text-muted-foreground">
+                    {group.label}
+                  </p>
+                  {group.themes.map((theme) => (
+                    <button
+                      key={theme.value}
+                      onClick={() => onSelectTheme(theme.value)}
+                      className={cn(
+                        'flex w-full items-center justify-between gap-3 rounded-md px-3 py-2 text-left text-sm transition-colors',
+                        selectedTheme === theme.value
+                          ? 'bg-accent font-medium text-accent-foreground'
+                          : 'hover:bg-accent'
+                      )}
+                    >
+                      <span className="min-w-0 flex-1">
+                        <span className="block truncate">{theme.label}</span>
+                        {theme.sourceLabel ? (
+                          <span className="block truncate text-[11px] font-normal text-muted-foreground">
+                            {translate(
+                              'auto.components.settings.SettingsFormControls.imported_from',
+                              'Imported from {{value0}}',
+                              { value0: theme.sourceLabel }
+                            )}
+                            {theme.mode && theme.mode !== 'unknown' ? ` · ${theme.mode}` : ''}
+                          </span>
+                        ) : null}
+                      </span>
+                      {/* Why: hide swatches on the current row so the color grid
+                        doesn't shift left to make room for the "Current" label. */}
+                      {theme.group === 'imported' &&
+                      theme.previewTheme &&
+                      selectedTheme !== theme.value ? (
+                        <span className="flex shrink-0 overflow-hidden rounded-sm border border-border/60">
+                          {[
+                            theme.previewTheme.black,
+                            theme.previewTheme.red,
+                            theme.previewTheme.green,
+                            theme.previewTheme.yellow,
+                            theme.previewTheme.blue,
+                            theme.previewTheme.magenta,
+                            theme.previewTheme.cyan,
+                            theme.previewTheme.white
+                          ].map((color, index) => (
+                            <span
+                              key={index}
+                              className="h-3 w-2"
+                              style={{ backgroundColor: color ?? 'transparent' }}
+                            />
+                          ))}
+                        </span>
+                      ) : null}
+                      {selectedTheme === theme.value ? (
+                        <span className="ml-3 shrink-0 text-[11px] uppercase tracking-[0.16em]">
+                          {translate(
+                            'auto.components.settings.SettingsFormControls.9119fb2268',
+                            'Current'
+                          )}
+                        </span>
+                      ) : null}
+                    </button>
+                  ))}
+                </div>
+              )
+            })}
+            {visibleThemeCount === 0 ? (
+              <div className="px-3 py-6 text-sm text-muted-foreground">
+                {translate(
+                  'auto.components.settings.SettingsFormControls.ceefb9d7f1',
+                  'No themes found.'
+                )}
+              </div>
+            ) : null}
+          </div>
+        </ScrollArea>
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/settings/VoicePane.test.tsx b/src/renderer/src/components/settings/VoicePane.test.tsx
index 890d971656e..84f6bbd5393 100644
--- a/src/renderer/src/components/settings/VoicePane.test.tsx
+++ b/src/renderer/src/components/settings/VoicePane.test.tsx
@@ -253,4 +253,74 @@ describe('VoicePane', () => {
 
     expect(recordFeatureInteraction).not.toHaveBeenCalled()
   })
+
+  it('merges an in-flight voice write onto the newest settings, not the render-time snapshot', async () => {
+    const updateSettings = vi.fn()
+    let resolveClear: () => void = () => {}
+    const clearing = new Promise<{ configured: boolean }>((resolve) => {
+      resolveClear = () => resolve({ configured: false })
+    })
+    useAppStoreMock.mockImplementation((selector: (state: Record<string, unknown>) => unknown) =>
+      selector({
+        modelStates: [],
+        refreshModelStates: vi.fn(),
+        markFeatureTipsSeen: vi.fn(),
+        recordFeatureInteraction: vi.fn()
+      })
+    )
+    useShortcutLabelMock.mockReturnValue('Ctrl+Shift+Y')
+    installWindowApi(vi.fn(async () => deniedMicrophoneResult))
+    window.api.speech.getOpenAiApiKeyStatus = vi.fn(async () => ({ configured: true }))
+    window.api.speech.clearOpenAiApiKey = vi.fn(() => clearing)
+
+    const settingsWithKey = (enabled: boolean): GlobalSettings =>
+      ({
+        voice: {
+          ...getDefaultVoiceSettings(),
+          enabled,
+          openAiApiKeyConfigured: true,
+          microphoneDeviceId: 'usb-mic',
+          microphoneDeviceLabel: 'USB Microphone'
+        }
+      }) as GlobalSettings
+
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+    await act(async () => {
+      root.render(<VoicePane settings={settingsWithKey(true)} updateSettings={updateSettings} />)
+    })
+
+    const disconnect = container.querySelector<HTMLButtonElement>(
+      'button[aria-label="Disconnect OpenAI API key"]'
+    )
+    if (!disconnect) {
+      throw new Error('Disconnect OpenAI API key button was not rendered')
+    }
+    await act(async () => {
+      disconnect.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+    })
+
+    // The user turns dictation off while the clear-key IPC is still in flight.
+    await act(async () => {
+      root.render(<VoicePane settings={settingsWithKey(false)} updateSettings={updateSettings} />)
+    })
+
+    await act(async () => {
+      resolveClear()
+      await clearing
+    })
+    root.unmount()
+
+    expect(updateSettings).toHaveBeenCalledTimes(1)
+    expect(updateSettings).toHaveBeenCalledWith({
+      voice: {
+        ...getDefaultVoiceSettings(),
+        enabled: false,
+        openAiApiKeyConfigured: false,
+        microphoneDeviceId: 'usb-mic',
+        microphoneDeviceLabel: 'USB Microphone'
+      }
+    })
+  })
 })
diff --git a/src/renderer/src/components/settings/VoicePane.tsx b/src/renderer/src/components/settings/VoicePane.tsx
index a1fdfbe9edd..f6729301702 100644
--- a/src/renderer/src/components/settings/VoicePane.tsx
+++ b/src/renderer/src/components/settings/VoicePane.tsx
@@ -36,6 +36,15 @@ export function VoicePane({ settings, updateSettings }: VoicePaneProps): React.J
   const [openAiKeyPending, setOpenAiKeyPending] = useState(false)
   const [pendingCloudModelId, setPendingCloudModelId] = useState<string | null>(null)
   const mountedRef = useRef(true)
+  // Why: every write here is a read-modify-write of the whole voice object, and the
+  // writers are async (key status probe, save/clear key). Merging onto the render-time
+  // snapshot would resurrect settings that changed while the IPC was in flight — e.g.
+  // reverting `enabled` to false and leaving the microphone picker permanently disabled.
+  // Written in an effect, not during render: the async writers all run post-commit.
+  const voiceSettingsRef = useRef(voiceSettings)
+  useEffect(() => {
+    voiceSettingsRef.current = voiceSettings
+  }, [voiceSettings])
 
   const handlePaneRef = useCallback((node: HTMLDivElement | null): void => {
     mountedRef.current = node !== null
@@ -45,12 +54,12 @@ export function VoicePane({ settings, updateSettings }: VoicePaneProps): React.J
     (updates: Partial<VoiceSettings>): void => {
       updateSettings({
         voice: {
-          ...voiceSettings,
+          ...voiceSettingsRef.current,
           ...updates
         }
       })
     },
-    [updateSettings, voiceSettings]
+    [updateSettings]
   )
 
   useEffect(() => {
diff --git a/src/renderer/src/components/settings/agent-awake-copy.ts b/src/renderer/src/components/settings/agent-awake-copy.ts
index 1076312ed18..307b8ef125d 100644
--- a/src/renderer/src/components/settings/agent-awake-copy.ts
+++ b/src/renderer/src/components/settings/agent-awake-copy.ts
@@ -17,13 +17,13 @@ export function getAgentAwakeDescription(
   if (userAgent.includes('Windows')) {
     return translate(
       AGENT_AWAKE_DESCRIPTION_WINDOWS_KEY,
-      "Choose On, Auto while agents are working, or Off. Lid-close behavior follows this device's power settings."
+      "Choose On, Agent, or Off. Agent mode stays awake while agents are working; lid-close behavior follows this device's power settings."
     )
   }
 
   return translate(
     AGENT_AWAKE_DESCRIPTION_DEFAULT_KEY,
-    'Choose On, Auto while agents are working, or Off. Orca also asks this device to stay awake when the lid is closed, subject to its power policy.'
+    'Choose On, Agent, or Off. Agent mode stays awake while agents are working. Orca also asks this device to stay awake when the lid is closed, subject to its power policy.'
   )
 }
 
diff --git a/src/renderer/src/components/settings/agent-skill-installed-command-callers.test.ts b/src/renderer/src/components/settings/agent-skill-installed-command-callers.test.ts
index 26287618412..5e913c1a85b 100644
--- a/src/renderer/src/components/settings/agent-skill-installed-command-callers.test.ts
+++ b/src/renderer/src/components/settings/agent-skill-installed-command-callers.test.ts
@@ -170,11 +170,11 @@ describe('AgentSkillSetupPanel installed-command call sites', () => {
     )
 
     expect(source).toContain('buildSkillCommandForRuntime(')
-    // The copied string stays bare for POSIX-family shells; the forced-PowerShell
-    // setup terminal keeps the npx preflight.
+    // Clipboard and auto-paste share the source command until the created tab
+    // resolves the shell that prepares the executable form.
     expect(source).toContain('writeClipboardText(skillCommand)')
-    expect(source).toContain('buildSkillSetupTerminalCommand(')
-    expect(source).toContain('command={setupTerminalCommand}')
+    expect(source).toContain('command={skillCommand}')
+    expect(source).toContain('prepareCommandForShell={prepareCommandForShell}')
     expect(source).toContain('shellOverride={activeSkillRuntime.terminalShellOverride}')
     expect(source).not.toContain('command={ORCA_CLI_ORCHESTRATION_SKILL_INSTALL_COMMAND}')
     // This terminal auto-pastes with no install gate, so a repair-required runtime
diff --git a/src/renderer/src/components/settings/agent-skill-setup-panel-props.ts b/src/renderer/src/components/settings/agent-skill-setup-panel-props.ts
index 9596d47d911..d829ebbc75f 100644
--- a/src/renderer/src/components/settings/agent-skill-setup-panel-props.ts
+++ b/src/renderer/src/components/settings/agent-skill-setup-panel-props.ts
@@ -1,5 +1,6 @@
 import type { ComponentProps, ReactNode } from 'react'
 import type { Button } from '../ui/button'
+import type { LocalAgentRuntime } from './CliSkillRuntimeSetup'
 
 type AgentSkillSetupPanelVariant = 'card' | 'inline'
 type SkillPrerequisiteStatus = Awaited<ReturnType<typeof window.api.cli.getInstallStatus>>
@@ -18,6 +19,7 @@ export type AgentSkillSetupPanelProps = {
   installDisabled?: boolean
   terminalHeightPx?: number
   terminalShellOverride?: string
+  terminalRuntime?: LocalAgentRuntime
   leading?: ReactNode
   icon?: ReactNode
   variant?: AgentSkillSetupPanelVariant
diff --git a/src/renderer/src/components/settings/agent-skill-terminal-snapshot.ts b/src/renderer/src/components/settings/agent-skill-terminal-snapshot.ts
new file mode 100644
index 00000000000..4731c6506a1
--- /dev/null
+++ b/src/renderer/src/components/settings/agent-skill-terminal-snapshot.ts
@@ -0,0 +1,22 @@
+import type { LocalAgentRuntime } from './CliSkillRuntimeSetup'
+import { buildSkillSetupTerminalCommand } from './CliSkillRuntimeSetup'
+
+export type SkillTerminalSnapshot = {
+  copiedCommand: string
+  prepareCommandForShell: (command: string, effectiveShell: string | undefined) => string
+  shellOverride: string | undefined
+}
+
+export function createTerminalSnapshot(
+  copiedCommand: string,
+  shellOverride: string | undefined,
+  runtime: LocalAgentRuntime | undefined
+): SkillTerminalSnapshot {
+  const pinnedRuntime = runtime ? { ...runtime } : undefined
+  return {
+    copiedCommand,
+    prepareCommandForShell: (command, effectiveShell) =>
+      buildSkillSetupTerminalCommand(command, effectiveShell, pinnedRuntime),
+    shellOverride
+  }
+}
diff --git a/src/renderer/src/components/settings/bitbucket-credentials-dialog.tsx b/src/renderer/src/components/settings/bitbucket-credentials-dialog.tsx
new file mode 100644
index 00000000000..f95fd29b31d
--- /dev/null
+++ b/src/renderer/src/components/settings/bitbucket-credentials-dialog.tsx
@@ -0,0 +1,387 @@
+import { useId, useLayoutEffect, useState } from 'react'
+import { ExternalLink, LoaderCircle, Lock } from 'lucide-react'
+import type { BitbucketAuthMode } from '../../../../shared/bitbucket-credentials'
+import { useAppStore } from '@/store'
+import { useMountedRef } from '@/hooks/useMountedRef'
+import { Button } from '@/components/ui/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle
+} from '@/components/ui/dialog'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { ToggleGroup, ToggleGroupItem } from '@/components/ui/toggle-group'
+import { cn } from '@/lib/utils'
+import { hasRemoteProviderRuntime } from '@/lib/provider-runtime-context'
+import { translate } from '@/i18n/i18n'
+
+const API_TOKEN_DOCS_URL = 'https://support.atlassian.com/bitbucket-cloud/docs/using-api-tokens/'
+
+type ConnectState = 'idle' | 'connecting' | 'error'
+
+type BitbucketCredentialsDialogProps = {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  /** Latest stored metadata, used to prefill the non-secret fields when editing. */
+  initialAuthMode?: BitbucketAuthMode | null
+  initialEmail?: string | null
+  initialBaseUrl?: string | null
+  /** Env vars win over stored credentials, so saving here would have no effect. */
+  environmentManaged?: boolean
+  onConnected?: () => void
+  overlayClassName?: string
+  contentClassName?: string
+}
+
+export function BitbucketCredentialsDialog({
+  open,
+  onOpenChange,
+  initialAuthMode,
+  initialEmail,
+  initialBaseUrl,
+  environmentManaged = false,
+  onConnected,
+  overlayClassName,
+  contentClassName
+}: BitbucketCredentialsDialogProps): React.JSX.Element {
+  const settings = useAppStore((s) => s.settings)
+  const mountedRef = useMountedRef()
+  const emailId = useId()
+  const apiTokenId = useId()
+  const accessTokenId = useId()
+  const baseUrlId = useId()
+  const errorId = useId()
+
+  const [authMode, setAuthMode] = useState<BitbucketAuthMode>('basic')
+  const [email, setEmail] = useState('')
+  const [apiToken, setApiToken] = useState('')
+  const [accessToken, setAccessToken] = useState('')
+  const [baseUrl, setBaseUrl] = useState('')
+  const [connectState, setConnectState] = useState<ConnectState>('idle')
+  const [connectError, setConnectError] = useState<string | null>(null)
+
+  // Re-sync from the latest stored metadata on every open, not just on mount, so
+  // the Edit flow never shows values from a previous connection. Secrets always
+  // start empty: the main process never hands them back.
+  useLayoutEffect(() => {
+    if (!open) {
+      return
+    }
+    setAuthMode(initialAuthMode ?? 'basic')
+    setEmail(initialEmail ?? '')
+    setBaseUrl(initialBaseUrl ?? '')
+    setApiToken('')
+    setAccessToken('')
+    setConnectState('idle')
+    setConnectError(null)
+    // oxlint-disable-next-line react-hooks/exhaustive-deps -- keyed on `open` alone: a status refresh mid-edit must not overwrite what the user is typing.
+  }, [open])
+
+  const remoteRuntime = hasRemoteProviderRuntime(settings)
+  // Why: only an env-managed connection makes saving pointless. A remote runtime
+  // just means the credential is stored on this machine, so the form stays
+  // usable and only the storage note changes (matching the Jira dialog).
+  const locked = environmentManaged
+  const connecting = connectState === 'connecting'
+  const isTokenMode = authMode === 'token'
+  const hasRequiredFields = isTokenMode
+    ? Boolean(accessToken.trim())
+    : Boolean(email.trim()) && Boolean(apiToken.trim())
+  const canSubmit = !locked && !connecting && hasRequiredFields
+
+  const clearErrorOnEdit = (): void => {
+    if (connectState === 'error') {
+      setConnectState('idle')
+      setConnectError(null)
+    }
+  }
+
+  const handleOpenChange = (nextOpen: boolean): void => {
+    if (!connecting) {
+      onOpenChange(nextOpen)
+    }
+  }
+
+  const handleConnect = async (): Promise<void> => {
+    if (!canSubmit) {
+      return
+    }
+    setConnectState('connecting')
+    setConnectError(null)
+    try {
+      const result = await window.api.bitbucket.connect({
+        authMode,
+        accessToken: isTokenMode ? accessToken.trim() : null,
+        email: isTokenMode ? null : email.trim(),
+        apiToken: isTokenMode ? null : apiToken.trim(),
+        baseUrl: baseUrl.trim() || null
+      })
+      if (!mountedRef.current) {
+        return
+      }
+      if (result.ok) {
+        setApiToken('')
+        setAccessToken('')
+        setConnectState('idle')
+        onOpenChange(false)
+        onConnected?.()
+        return
+      }
+      setConnectState('error')
+      setConnectError(result.error)
+    } catch (error) {
+      if (mountedRef.current) {
+        setConnectState('error')
+        setConnectError(
+          error instanceof Error
+            ? error.message
+            : translate(
+                'auto.components.settings.bitbucket.credentials.dialog.connectFailed',
+                'Connection failed'
+              )
+        )
+      }
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={handleOpenChange}>
+      <DialogContent
+        overlayClassName={overlayClassName}
+        className={cn('sm:max-w-lg', contentClassName)}
+        onKeyDown={(event) => {
+          // Only from a text field: Enter on Cancel or the docs link must do
+          // what that control does, not submit the form.
+          if (!(event.target instanceof HTMLInputElement)) {
+            return
+          }
+          if (event.key === 'Enter' && canSubmit) {
+            event.preventDefault()
+            void handleConnect()
+          }
+        }}
+      >
+        <DialogHeader className="gap-3">
+          <DialogTitle className="leading-tight">
+            {translate(
+              'auto.components.settings.bitbucket.credentials.dialog.title',
+              'Connect Bitbucket'
+            )}
+          </DialogTitle>
+          <DialogDescription>
+            {translate(
+              'auto.components.settings.bitbucket.credentials.dialog.description',
+              'Use a Bitbucket Cloud credential to browse pull requests and build statuses. Orca verifies it before saving.'
+            )}
+          </DialogDescription>
+        </DialogHeader>
+        {locked ? (
+          <p className="text-xs text-muted-foreground">
+            {translate(
+              'auto.components.settings.bitbucket.credentials.dialog.environmentManaged',
+              'Bitbucket is already configured through ORCA_BITBUCKET_* environment variables, which take precedence. Unset them to save a credential in Orca.'
+            )}
+          </p>
+        ) : (
+          <div className="space-y-3">
+            <ToggleGroup
+              type="single"
+              variant="outline"
+              value={authMode}
+              disabled={connecting}
+              onValueChange={(value) => {
+                if (!value || connecting) {
+                  return
+                }
+                setAuthMode(value as BitbucketAuthMode)
+                // An API token and an access token are different secrets; drop
+                // the typed one so it can't be submitted as the other.
+                setApiToken('')
+                setAccessToken('')
+                clearErrorOnEdit()
+              }}
+              aria-label={translate(
+                'auto.components.settings.bitbucket.credentials.dialog.authModeLabel',
+                'Bitbucket authentication method'
+              )}
+            >
+              <ToggleGroupItem value="basic" className="h-8 px-3 text-xs">
+                {translate(
+                  'auto.components.settings.bitbucket.credentials.dialog.modeBasic',
+                  'Email & API token'
+                )}
+              </ToggleGroupItem>
+              <ToggleGroupItem value="token" className="h-8 px-3 text-xs">
+                {translate(
+                  'auto.components.settings.bitbucket.credentials.dialog.modeToken',
+                  'Access token'
+                )}
+              </ToggleGroupItem>
+            </ToggleGroup>
+            {isTokenMode ? (
+              <div className="space-y-2">
+                <Label htmlFor={accessTokenId} className="text-xs">
+                  {translate(
+                    'auto.components.settings.bitbucket.credentials.dialog.accessToken',
+                    'Access token'
+                  )}
+                </Label>
+                <Input
+                  id={accessTokenId}
+                  autoFocus
+                  type="password"
+                  placeholder={translate(
+                    'auto.components.settings.bitbucket.credentials.dialog.accessTokenPlaceholder',
+                    'Repository, project, or workspace access token'
+                  )}
+                  value={accessToken}
+                  onChange={(event) => {
+                    setAccessToken(event.target.value)
+                    clearErrorOnEdit()
+                  }}
+                  disabled={connecting}
+                  aria-invalid={connectState === 'error'}
+                  aria-describedby={connectState === 'error' ? errorId : undefined}
+                />
+              </div>
+            ) : (
+              <>
+                <div className="space-y-2">
+                  <Label htmlFor={emailId} className="text-xs">
+                    {translate(
+                      'auto.components.settings.bitbucket.credentials.dialog.email',
+                      'Atlassian account email'
+                    )}
+                  </Label>
+                  <Input
+                    id={emailId}
+                    autoFocus
+                    type="email"
+                    placeholder={translate(
+                      'auto.components.settings.bitbucket.credentials.dialog.emailPlaceholder',
+                      'you@example.com'
+                    )}
+                    value={email}
+                    onChange={(event) => {
+                      setEmail(event.target.value)
+                      clearErrorOnEdit()
+                    }}
+                    disabled={connecting}
+                  />
+                </div>
+                <div className="space-y-2">
+                  <Label htmlFor={apiTokenId} className="text-xs">
+                    {translate(
+                      'auto.components.settings.bitbucket.credentials.dialog.apiToken',
+                      'API token'
+                    )}
+                  </Label>
+                  <Input
+                    id={apiTokenId}
+                    type="password"
+                    placeholder={translate(
+                      'auto.components.settings.bitbucket.credentials.dialog.apiTokenPlaceholder',
+                      'Atlassian API token'
+                    )}
+                    value={apiToken}
+                    onChange={(event) => {
+                      setApiToken(event.target.value)
+                      clearErrorOnEdit()
+                    }}
+                    disabled={connecting}
+                    aria-invalid={connectState === 'error'}
+                    aria-describedby={connectState === 'error' ? errorId : undefined}
+                  />
+                </div>
+              </>
+            )}
+            <div className="space-y-2">
+              <Label htmlFor={baseUrlId} className="text-xs">
+                {translate(
+                  'auto.components.settings.bitbucket.credentials.dialog.baseUrl',
+                  'API base URL (optional)'
+                )}
+              </Label>
+              <Input
+                id={baseUrlId}
+                placeholder={translate(
+                  'auto.components.settings.bitbucket.credentials.dialog.baseUrlPlaceholder',
+                  'https://api.bitbucket.org/2.0'
+                )}
+                value={baseUrl}
+                onChange={(event) => {
+                  setBaseUrl(event.target.value)
+                  clearErrorOnEdit()
+                }}
+                disabled={connecting}
+              />
+            </div>
+            {connectState === 'error' && connectError ? (
+              <p id={errorId} className="text-xs text-destructive">
+                {connectError}
+              </p>
+            ) : null}
+            <div className="space-y-2 text-xs leading-relaxed text-muted-foreground">
+              <p>
+                {isTokenMode
+                  ? translate(
+                      'auto.components.settings.bitbucket.credentials.dialog.tokenHint',
+                      'Repository, project, and workspace access tokens are created from the matching Bitbucket settings page and need read access to pull requests.'
+                    )
+                  : translate(
+                      'auto.components.settings.bitbucket.credentials.dialog.basicHint',
+                      'Create an Atlassian API token for your account, then pair it with the email address that owns it.'
+                    )}
+              </p>
+              <button
+                type="button"
+                className="inline-flex items-center gap-1 text-primary underline-offset-2 hover:underline"
+                onClick={() => window.api.shell.openUrl(API_TOKEN_DOCS_URL)}
+              >
+                <ExternalLink className="size-3" />
+                {translate(
+                  'auto.components.settings.bitbucket.credentials.dialog.docsLink',
+                  'Bitbucket API token docs'
+                )}
+              </button>
+            </div>
+            <p className="flex items-start gap-1.5 text-[11px] text-muted-foreground/70">
+              <Lock className="size-3 mt-0.5 shrink-0" />
+              {remoteRuntime
+                ? translate(
+                    'auto.components.settings.bitbucket.credentials.dialog.remoteRuntime',
+                    'Stored on this machine, not on the active remote runtime — set ORCA_BITBUCKET_* there instead. Environment variables always take precedence over what you save here.'
+                  )
+                : translate(
+                    'auto.components.settings.bitbucket.credentials.dialog.storageNote',
+                    'Stored on this machine with encrypted storage when the OS keychain is available. ORCA_BITBUCKET_* environment variables always take precedence over what you save here.'
+                  )}
+            </p>
+          </div>
+        )}
+        <DialogFooter>
+          <Button variant="ghost" onClick={() => onOpenChange(false)} disabled={connecting}>
+            {translate('auto.components.settings.bitbucket.credentials.dialog.cancel', 'Cancel')}
+          </Button>
+          <Button onClick={() => void handleConnect()} disabled={!canSubmit}>
+            {connecting ? (
+              <>
+                <LoaderCircle className="size-4 animate-spin" />
+                {translate(
+                  'auto.components.settings.bitbucket.credentials.dialog.verifying',
+                  'Verifying...'
+                )}
+              </>
+            ) : (
+              translate('auto.components.settings.bitbucket.credentials.dialog.connect', 'Connect')
+            )}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/src/renderer/src/components/settings/bitbucket-integration-card.tsx b/src/renderer/src/components/settings/bitbucket-integration-card.tsx
new file mode 100644
index 00000000000..5d8809551cb
--- /dev/null
+++ b/src/renderer/src/components/settings/bitbucket-integration-card.tsx
@@ -0,0 +1,273 @@
+import { useCallback, useEffect, useState } from 'react'
+import { ExternalLink, GitPullRequestArrow, LoaderCircle, Unlink } from 'lucide-react'
+import type { BitbucketConnectionStatus } from '../../../../shared/bitbucket-credentials'
+import { Button } from '@/components/ui/button'
+import { useMountedRef } from '@/hooks/useMountedRef'
+import { IntegrationCardDetails, IntegrationCardShell } from './integration-card-shell'
+import { useIntegrationSubordinateRowClass } from './integration-card-presentation'
+import type { BitbucketStatus } from './integrations-pane-status'
+import { usePreflightCardStatuses } from './source-control-preflight-card-status'
+import { tokenProviderStatusLabel } from './token-source-control-status'
+import { BitbucketCredentialsDialog } from './bitbucket-credentials-dialog'
+import { translate } from '@/i18n/i18n'
+
+const API_TOKEN_DOCS_URL = 'https://support.atlassian.com/bitbucket-cloud/docs/using-api-tokens/'
+const DEFAULT_API_BASE_URL = 'https://api.bitbucket.org/2.0'
+
+export function BitbucketIntegrationCard(): React.JSX.Element {
+  const { statuses, unavailable, refresh } = usePreflightCardStatuses('bitbucket')
+  const status = unavailable ? 'unavailable' : statuses.bitbucketStatus
+  const connected = status === 'connected'
+  const mountedRef = useMountedRef()
+  const subordinateRowClass = useIntegrationSubordinateRowClass('flex items-center gap-3')
+  const [connection, setConnection] = useState<BitbucketConnectionStatus | null>(null)
+  const [dialogOpen, setDialogOpen] = useState(false)
+  const [disconnecting, setDisconnecting] = useState(false)
+  const [disconnectError, setDisconnectError] = useState<string | null>(null)
+
+  // Reads plaintext metadata only — never the encrypted secret — so mounting the
+  // pane cannot trigger a keychain prompt.
+  const loadConnection = useCallback(async () => {
+    try {
+      const next = await window.api.bitbucket.status()
+      if (mountedRef.current) {
+        setConnection(next)
+      }
+    } catch {
+      // Best-effort: the preflight-driven parts of the card still render.
+    }
+  }, [mountedRef])
+
+  useEffect(() => {
+    void loadConnection()
+  }, [loadConnection])
+
+  const envManaged = connection?.source === 'environment'
+  const storedCredential = connection?.source === 'stored'
+  const account = connection?.account ?? statuses.bitbucketAccount
+  // Only surface a base URL the user actually overrode; the default is noise.
+  const baseUrlOverride =
+    connection?.baseUrl && connection.baseUrl !== DEFAULT_API_BASE_URL ? connection.baseUrl : null
+  const authModeLabel = connection?.authMode
+    ? connection.authMode === 'token'
+      ? translate(
+          'auto.components.settings.bitbucket.integration.card.authModeToken',
+          'Access token'
+        )
+      : translate(
+          'auto.components.settings.bitbucket.integration.card.authModeBasic',
+          'Email & API token'
+        )
+    : null
+  const credentialSummary = [authModeLabel, baseUrlOverride].filter(Boolean).join(' · ')
+
+  const handleConnected = (): void => {
+    void loadConnection()
+    refresh()
+  }
+
+  const handleDisconnect = async (): Promise<void> => {
+    setDisconnecting(true)
+    setDisconnectError(null)
+    try {
+      await window.api.bitbucket.disconnect()
+    } catch (error) {
+      // Why: disconnect rethrows when a credential file cannot be deleted.
+      // Unhandled, the card silently re-renders as still connected.
+      if (mountedRef.current) {
+        setDisconnectError(
+          error instanceof Error
+            ? error.message
+            : translate(
+                'auto.components.settings.bitbucket.integration.card.disconnectFailed',
+                'Could not remove the saved Bitbucket credential.'
+              )
+        )
+      }
+    } finally {
+      if (mountedRef.current) {
+        setDisconnecting(false)
+      }
+      void loadConnection()
+      refresh()
+    }
+  }
+
+  return (
+    <IntegrationCardShell
+      icon={<GitPullRequestArrow className="size-5" />}
+      name="Bitbucket"
+      description={
+        connected
+          ? account
+            ? translate(
+                'auto.components.settings.token.source.control.integration.cards.ea204f5e03',
+                '{{value0}} · Pull requests and build statuses',
+                { value0: account }
+              )
+            : translate(
+                'auto.components.settings.token.source.control.integration.cards.0fa5629dad',
+                'Pull requests and build statuses'
+              )
+          : translate(
+              'auto.components.settings.bitbucket.integration.card.description',
+              'Pull requests and build statuses for Bitbucket Cloud.'
+            )
+      }
+      checking={status === 'checking'}
+      statusTone={connected ? 'connected' : 'attention'}
+      statusLabel={tokenProviderStatusLabel({ configured: connected, status })}
+      actions={
+        status !== 'checking' && !envManaged ? (
+          <Button
+            variant={storedCredential ? 'outline' : 'default'}
+            size="sm"
+            onClick={() => setDialogOpen(true)}
+          >
+            {storedCredential
+              ? translate(
+                  'auto.components.settings.bitbucket.integration.card.edit',
+                  'Edit credentials'
+                )
+              : translate('auto.components.settings.bitbucket.integration.card.connect', 'Connect')}
+          </Button>
+        ) : null
+      }
+    >
+      {status !== 'checking' ? (
+        <IntegrationCardDetails>
+          {connected ? (
+            <div className={subordinateRowClass}>
+              <div className="min-w-0 flex-1">
+                <p className="truncate text-sm font-medium text-foreground">
+                  {account ??
+                    translate(
+                      'auto.components.settings.bitbucket.integration.card.accountUnknown',
+                      'Bitbucket Cloud'
+                    )}
+                </p>
+                {credentialSummary ? (
+                  <p className="truncate text-xs text-muted-foreground">{credentialSummary}</p>
+                ) : null}
+              </div>
+              {storedCredential ? (
+                <button
+                  onClick={() => void handleDisconnect()}
+                  disabled={disconnecting}
+                  aria-label={translate(
+                    'auto.components.settings.bitbucket.integration.card.disconnect',
+                    'Disconnect Bitbucket'
+                  )}
+                  className="rounded-md p-1 text-muted-foreground/50 transition-colors hover:text-destructive"
+                >
+                  {disconnecting ? (
+                    <LoaderCircle className="size-3.5 animate-spin" />
+                  ) : (
+                    <Unlink className="size-3.5" />
+                  )}
+                </button>
+              ) : null}
+            </div>
+          ) : null}
+          {disconnectError ? <p className="text-xs text-destructive">{disconnectError}</p> : null}
+          <BitbucketCardNote
+            envManaged={envManaged}
+            status={status}
+            storedCredential={storedCredential}
+          />
+          <div className="flex items-center gap-2">
+            {!connected ? (
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={() => window.api.shell.openUrl(API_TOKEN_DOCS_URL)}
+              >
+                <ExternalLink className="size-3.5 mr-1.5" />
+                {translate(
+                  'auto.components.settings.token.source.control.integration.cards.1a9475dace',
+                  'Learn more'
+                )}
+              </Button>
+            ) : null}
+            <Button variant="ghost" size="sm" onClick={refresh}>
+              {translate(
+                'auto.components.settings.token.source.control.integration.cards.793a06e899',
+                'Re-check'
+              )}
+            </Button>
+          </div>
+        </IntegrationCardDetails>
+      ) : null}
+
+      <BitbucketCredentialsDialog
+        open={dialogOpen}
+        onOpenChange={setDialogOpen}
+        initialAuthMode={connection?.authMode}
+        initialEmail={connection?.email}
+        initialBaseUrl={connection?.baseUrl}
+        environmentManaged={envManaged}
+        onConnected={handleConnected}
+      />
+    </IntegrationCardShell>
+  )
+}
+
+function BitbucketCardNote(props: {
+  envManaged: boolean
+  status: BitbucketStatus | 'unavailable'
+  storedCredential: boolean
+}): React.JSX.Element {
+  if (props.status === 'unavailable') {
+    return (
+      <p className="text-xs text-muted-foreground">
+        {translate(
+          'auto.components.settings.token.source.control.integration.cards.24ac1c69dc',
+          'Bitbucket status is not available in this runtime yet.'
+        )}
+      </p>
+    )
+  }
+  if (props.envManaged) {
+    return (
+      <p className="text-xs text-muted-foreground">
+        {translate(
+          'auto.components.settings.bitbucket.integration.card.envManaged',
+          'Configured via environment variables. Unset the ORCA_BITBUCKET_* variables to manage this credential in Orca.'
+        )}
+      </p>
+    )
+  }
+  if (props.status === 'not-authenticated') {
+    return (
+      <p className="text-xs text-muted-foreground">
+        {props.storedCredential
+          ? translate(
+              'auto.components.settings.bitbucket.integration.card.storedAuthFailed',
+              'The saved Bitbucket credential could not authenticate. Edit it, or check that the token still has pull request access.'
+            )
+          : translate(
+              'auto.components.settings.token.source.control.integration.cards.6154b02093',
+              'Bitbucket credentials are configured but could not authenticate. Check the token and repository permissions, then restart Orca if environment variables changed.'
+            )}
+      </p>
+    )
+  }
+  if (props.storedCredential) {
+    return (
+      <p className="text-xs text-muted-foreground">
+        {translate(
+          'auto.components.settings.bitbucket.integration.card.storedCredential',
+          'Saved in Orca on this machine. ORCA_BITBUCKET_* environment variables take precedence when set.'
+        )}
+      </p>
+    )
+  }
+  return (
+    <p className="text-xs text-muted-foreground">
+      {translate(
+        'auto.components.settings.bitbucket.integration.card.notConfigured',
+        'Connect a Bitbucket Cloud account with an Atlassian API token or an access token. ORCA_BITBUCKET_* environment variables work too and take precedence.'
+      )}
+    </p>
+  )
+}
diff --git a/src/renderer/src/components/settings/floating-workspace-search.ts b/src/renderer/src/components/settings/floating-workspace-search.ts
index 9ca0dca43f6..e0a40747702 100644
--- a/src/renderer/src/components/settings/floating-workspace-search.ts
+++ b/src/renderer/src/components/settings/floating-workspace-search.ts
@@ -2,69 +2,86 @@ import { translate } from '@/i18n/i18n'
 import { translateSearchKeyword } from './settings-search-keywords'
 import { createLocalizedCatalog } from '@/i18n/localized-catalog'
 
-export const getFloatingWorkspaceSearchEntries = createLocalizedCatalog(() => [
-  {
-    title: translate(
-      'auto.components.settings.floating.workspace.search.b2b60e7163',
-      'Floating Workspace'
-    ),
-    description: translate(
-      'auto.components.settings.floating.workspace.search.b96b5ee6cf',
-      'Enable the floating workspace, choose where new tabs start, and choose where the toggle button appears.'
-    ),
-    keywords: [
-      translate(
-        'auto.components.settings.floating.workspace.search.a08e482f6d',
-        'floating workspace'
+function buildFloatingWorkspaceSearchEntries(includeBrowser: boolean) {
+  return [
+    {
+      title: translate(
+        'auto.components.settings.floating.workspace.search.b2b60e7163',
+        'Floating Workspace'
       ),
-      translate(
-        'auto.components.settings.floating.workspace.search.6f183fa1b9',
-        'floating terminal'
+      description: translate(
+        'auto.components.settings.floating.workspace.search.b96b5ee6cf',
+        'Enable the floating workspace, choose where new tabs start, and choose where the toggle button appears.'
       ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.ebeedb2f6a',
-        'quick terminal'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.2b5efa55c9',
-        'global'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.6410fe83d8',
-        'terminal'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.49db74a92d',
-        'browser'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.884e5e6132',
-        'markdown'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.156ffeee08',
-        'note'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.52db6e3baf',
-        'notes'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.a38bfc3f77',
-        'quick panel'
-      ),
-      translate(
-        'auto.components.settings.floating.workspace.search.6765b85e48',
-        'launch directory'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.a452146574',
-        'toggle button'
-      ),
-      ...translateSearchKeyword(
-        'auto.components.settings.floating.workspace.search.94f4d013c8',
-        'status bar'
-      )
-    ]
-  }
-])
+      keywords: [
+        translate(
+          'auto.components.settings.floating.workspace.search.a08e482f6d',
+          'floating workspace'
+        ),
+        translate(
+          'auto.components.settings.floating.workspace.search.6f183fa1b9',
+          'floating terminal'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.ebeedb2f6a',
+          'quick terminal'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.2b5efa55c9',
+          'global'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.6410fe83d8',
+          'terminal'
+        ),
+        ...(includeBrowser
+          ? translateSearchKeyword(
+              'auto.components.settings.floating.workspace.search.49db74a92d',
+              'browser'
+            )
+          : []),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.884e5e6132',
+          'markdown'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.156ffeee08',
+          'note'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.52db6e3baf',
+          'notes'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.a38bfc3f77',
+          'quick panel'
+        ),
+        translate(
+          'auto.components.settings.floating.workspace.search.6765b85e48',
+          'launch directory'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.a452146574',
+          'toggle button'
+        ),
+        ...translateSearchKeyword(
+          'auto.components.settings.floating.workspace.search.94f4d013c8',
+          'status bar'
+        )
+      ]
+    }
+  ]
+}
+
+const getFloatingWorkspaceSearchEntriesWithBrowser = createLocalizedCatalog(() =>
+  buildFloatingWorkspaceSearchEntries(true)
+)
+const getFloatingWorkspaceSearchEntriesWithoutBrowser = createLocalizedCatalog(() =>
+  buildFloatingWorkspaceSearchEntries(false)
+)
+
+export function getFloatingWorkspaceSearchEntries(options?: { includeBrowser?: boolean }) {
+  return options?.includeBrowser === false
+    ? getFloatingWorkspaceSearchEntriesWithoutBrowser()
+    : getFloatingWorkspaceSearchEntriesWithBrowser()
+}
diff --git a/src/renderer/src/components/settings/integrations-search.ts b/src/renderer/src/components/settings/integrations-search.ts
index 2a742728c3c..8d8b6eff1f5 100644
--- a/src/renderer/src/components/settings/integrations-search.ts
+++ b/src/renderer/src/components/settings/integrations-search.ts
@@ -56,8 +56,8 @@ export const getIntegrationsPaneSearchEntries = createLocalizedCatalog(() => [
       'Bitbucket Integration'
     ),
     description: translate(
-      'auto.components.settings.integrations.search.c97d58a0f3',
-      'Bitbucket Cloud authentication via API token environment variables.'
+      'auto.components.settings.integrations.search.760e2446e0',
+      'Bitbucket Cloud authentication with a saved API token or environment variables.'
     ),
     keywords: [
       ...translateSearchKeyword(
@@ -75,6 +75,22 @@ export const getIntegrationsPaneSearchEntries = createLocalizedCatalog(() => [
       ...translateSearchKeyword(
         'auto.components.settings.integrations.search.2ec2bd328c',
         'api token'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.integrations.search.3c3d3d8ffa',
+        'connect'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.integrations.search.a626990bd2',
+        'disconnect'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.integrations.search.20540996ef',
+        'credentials'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.integrations.search.af5ae87847',
+        'access token'
       )
     ]
   },
diff --git a/src/renderer/src/components/settings/keybinding-override-edits.ts b/src/renderer/src/components/settings/keybinding-override-edits.ts
index e0e88d00782..21b339ba98f 100644
--- a/src/renderer/src/components/settings/keybinding-override-edits.ts
+++ b/src/renderer/src/components/settings/keybinding-override-edits.ts
@@ -15,7 +15,7 @@ export function hasOwnBindingOverride(
   overrides: KeybindingOverrides,
   actionId: KeybindingActionId
 ): boolean {
-  return Object.prototype.hasOwnProperty.call(overrides, actionId)
+  return Object.hasOwn(overrides, actionId)
 }
 
 export function removeBindingOverride(
diff --git a/src/renderer/src/components/settings/repository-source-control-ai-draft.ts b/src/renderer/src/components/settings/repository-source-control-ai-draft.ts
index 1e516bab7a8..370f60f3d2f 100644
--- a/src/renderer/src/components/settings/repository-source-control-ai-draft.ts
+++ b/src/renderer/src/components/settings/repository-source-control-ai-draft.ts
@@ -19,7 +19,7 @@ export function hasOwnActionOverride(
   overrides: RepoSourceControlAiOverrides['actionOverrides'],
   actionId: SourceControlActionId
 ): boolean {
-  return Object.prototype.hasOwnProperty.call(overrides ?? {}, actionId)
+  return Object.hasOwn(overrides ?? {}, actionId)
 }
 
 export function triStateValue(value: boolean | null | undefined): 'inherit' | 'on' | 'off' {
diff --git a/src/renderer/src/components/settings/shortcut-row-visibility.test.ts b/src/renderer/src/components/settings/shortcut-row-visibility.test.ts
new file mode 100644
index 00000000000..9077e36cd97
--- /dev/null
+++ b/src/renderer/src/components/settings/shortcut-row-visibility.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest'
+import { getKeybindingDefinition } from '../../../../shared/keybindings'
+import type { ShortcutGroup } from './shortcut-groups'
+import { buildShortcutRowVisibility } from './shortcut-row-visibility'
+
+function creationGroup(): ShortcutGroup {
+  const items = (
+    ['tab.newTerminal', 'tab.newBrowser', 'tab.newMarkdown', 'tab.newSimulator'] as const
+  ).map((actionId) => {
+    const definition = getKeybindingDefinition(actionId)
+    if (!definition) {
+      throw new Error(`Missing keybinding definition: ${actionId}`)
+    }
+    return definition
+  })
+  return { title: 'Tabs', items }
+}
+
+describe('buildShortcutRowVisibility', () => {
+  it('hides client-impossible creation shortcuts without hiding terminal or markdown', () => {
+    const result = buildShortcutRowVisibility({
+      groups: [creationGroup()],
+      keybindings: {},
+      conflictByAction: new Map(),
+      terminalShortcutPolicy: 'orca-first',
+      platform: 'darwin',
+      managedBrowserCreationEnabled: false,
+      mobileEmulatorCreationEnabled: false,
+      settingsSearchQuery: '',
+      shortcutQuery: '',
+      shortcutFilter: 'all'
+    })
+
+    expect(result.shortcutRows.map((row) => row.item.id)).toEqual([
+      'tab.newTerminal',
+      'tab.newMarkdown'
+    ])
+  })
+})
diff --git a/src/renderer/src/components/settings/shortcut-row-visibility.ts b/src/renderer/src/components/settings/shortcut-row-visibility.ts
new file mode 100644
index 00000000000..4a2a6e08f16
--- /dev/null
+++ b/src/renderer/src/components/settings/shortcut-row-visibility.ts
@@ -0,0 +1,96 @@
+import {
+  getEffectiveKeybindingsForDefinition,
+  type KeybindingActionId,
+  type KeybindingOverrides,
+  type TerminalShortcutPolicy
+} from '../../../../shared/keybindings'
+import { hasOwnBindingOverride } from './keybinding-override-edits'
+import type { ShortcutGroup } from './shortcut-groups'
+import { getShortcutTerminalStatus } from './shortcut-terminal-status'
+import {
+  buildShortcutGlobalSearchMatcher,
+  matchesShortcutFilter,
+  matchesShortcutLocalSearch,
+  normalizeShortcutLocalSearchQuery,
+  type ShortcutFilter,
+  type ShortcutRowsByGroup
+} from './ShortcutFilterRail'
+
+export function buildShortcutRowVisibility(options: {
+  groups: ShortcutGroup[]
+  keybindings: KeybindingOverrides
+  conflictByAction: Map<KeybindingActionId, string[]>
+  terminalShortcutPolicy: TerminalShortcutPolicy
+  platform: NodeJS.Platform
+  managedBrowserCreationEnabled: boolean
+  mobileEmulatorCreationEnabled: boolean
+  settingsSearchQuery: string
+  shortcutQuery: string
+  shortcutFilter: ShortcutFilter
+}): {
+  filterCounts: Record<ShortcutFilter, number>
+  shortcutRows: ShortcutRowsByGroup['rows']
+  visibleShortcutCount: number
+  visibleShortcutGroups: ShortcutRowsByGroup[]
+} {
+  const shortcutGroups = options.groups.map((group) => ({
+    title: group.title,
+    rows: group.items
+      .filter(
+        (item) =>
+          (options.managedBrowserCreationEnabled || item.id !== 'tab.newBrowser') &&
+          (options.mobileEmulatorCreationEnabled || item.id !== 'tab.newSimulator')
+      )
+      .map((item) => {
+        const effective = getEffectiveKeybindingsForDefinition(
+          item,
+          options.platform,
+          options.keybindings
+        )
+        return {
+          item,
+          groupTitle: group.title,
+          effective,
+          modified: hasOwnBindingOverride(options.keybindings, item.id),
+          warnings: options.conflictByAction.get(item.id) ?? [],
+          terminalStatus: getShortcutTerminalStatus(
+            item,
+            options.terminalShortcutPolicy,
+            effective.length > 0
+          )
+        }
+      })
+  }))
+  const shortcutRows = shortcutGroups.flatMap((group) => group.rows)
+  const localQuery = normalizeShortcutLocalSearchQuery(options.shortcutQuery)
+  const matchesGlobalSearch = buildShortcutGlobalSearchMatcher(
+    shortcutRows,
+    options.settingsSearchQuery
+  )
+  const matchesSearch = (row: ShortcutRowsByGroup['rows'][number]): boolean =>
+    localQuery !== null &&
+    matchesGlobalSearch(row) &&
+    matchesShortcutLocalSearch(row, localQuery, options.platform)
+  const baseVisibleRows = shortcutRows.filter(matchesSearch)
+  const filterCounts: Record<ShortcutFilter, number> = {
+    all: baseVisibleRows.length,
+    modified: baseVisibleRows.filter((row) => row.modified).length,
+    unassigned: baseVisibleRows.filter((row) => row.effective.length === 0).length,
+    conflicts: baseVisibleRows.filter((row) => row.warnings.length > 0).length
+  }
+  const visibleShortcutGroups = shortcutGroups
+    .map((group) => ({
+      title: group.title,
+      rows: group.rows.filter(
+        (row) => matchesSearch(row) && matchesShortcutFilter(row, options.shortcutFilter)
+      )
+    }))
+    .filter((group) => group.rows.length > 0)
+
+  return {
+    filterCounts,
+    shortcutRows,
+    visibleShortcutCount: visibleShortcutGroups.reduce((sum, group) => sum + group.rows.length, 0),
+    visibleShortcutGroups
+  }
+}
diff --git a/src/renderer/src/components/settings/shortcuts-search.ts b/src/renderer/src/components/settings/shortcuts-search.ts
index 223b1421ee4..2746056f46e 100644
--- a/src/renderer/src/components/settings/shortcuts-search.ts
+++ b/src/renderer/src/components/settings/shortcuts-search.ts
@@ -34,15 +34,35 @@ export const getTerminalShortcutPolicySearchEntry = createLocalizedCatalog(
   })
 )
 
-export const getShortcutsPaneSearchEntries = createLocalizedCatalog(() => [
-  ...KEYBINDING_DEFINITIONS.map((item) => ({
-    title: item.title,
-    description: translate(
-      'auto.components.settings.shortcuts.search.groupShortcut',
-      '{{value0}} shortcut',
-      { value0: item.group }
-    ),
-    keywords: [...item.searchKeywords]
-  })),
-  getTerminalShortcutPolicySearchEntry()
-])
+const getShortcutDefinitionSearchEntries = createLocalizedCatalog(() =>
+  KEYBINDING_DEFINITIONS.map((item) => ({
+    actionId: item.id,
+    searchEntry: {
+      title: item.title,
+      description: translate(
+        'auto.components.settings.shortcuts.search.groupShortcut',
+        '{{value0}} shortcut',
+        { value0: item.group }
+      ),
+      keywords: [...item.searchKeywords]
+    }
+  }))
+)
+
+export function getShortcutsPaneSearchEntries(options?: {
+  includeManagedBrowser?: boolean
+  includeMobileEmulator?: boolean
+}): SettingsSearchEntry[] {
+  const includeManagedBrowser = options?.includeManagedBrowser !== false
+  const includeMobileEmulator = options?.includeMobileEmulator !== false
+  return [
+    ...getShortcutDefinitionSearchEntries()
+      .filter(
+        ({ actionId }) =>
+          (includeManagedBrowser || actionId !== 'tab.newBrowser') &&
+          (includeMobileEmulator || actionId !== 'tab.newSimulator')
+      )
+      .map(({ searchEntry }) => searchEntry),
+    getTerminalShortcutPolicySearchEntry()
+  ]
+}
diff --git a/src/renderer/src/components/settings/source-control-integration-cards.tsx b/src/renderer/src/components/settings/source-control-integration-cards.tsx
index f43b1003d43..a42a9e88637 100644
--- a/src/renderer/src/components/settings/source-control-integration-cards.tsx
+++ b/src/renderer/src/components/settings/source-control-integration-cards.tsx
@@ -4,8 +4,8 @@ export {
 } from './cli-source-control-integration-cards'
 export { deriveCliProviderCardState } from './source-control-preflight-card-status'
 export type { CliProviderCardState } from './source-control-preflight-card-status'
+export { BitbucketIntegrationCard } from './bitbucket-integration-card'
 export {
   AzureDevOpsIntegrationCard,
-  BitbucketIntegrationCard,
   GiteaIntegrationCard
 } from './token-source-control-integration-cards'
diff --git a/src/renderer/src/components/settings/token-source-control-integration-cards.tsx b/src/renderer/src/components/settings/token-source-control-integration-cards.tsx
index 5c609f0543d..1bf0499c628 100644
--- a/src/renderer/src/components/settings/token-source-control-integration-cards.tsx
+++ b/src/renderer/src/components/settings/token-source-control-integration-cards.tsx
@@ -5,114 +5,6 @@ import { usePreflightCardStatuses } from './source-control-preflight-card-status
 import { translate } from '@/i18n/i18n'
 import { tokenProviderStatusLabel } from './token-source-control-status'
 
-export function BitbucketIntegrationCard(): React.JSX.Element {
-  const { statuses, unavailable, refresh } = usePreflightCardStatuses('bitbucket')
-  const status = unavailable ? 'unavailable' : statuses.bitbucketStatus
-  const connected = status === 'connected'
-
-  return (
-    <IntegrationCardShell
-      icon={<GitPullRequestArrow className="size-5" />}
-      name="Bitbucket"
-      description={
-        connected
-          ? statuses.bitbucketAccount
-            ? translate(
-                'auto.components.settings.token.source.control.integration.cards.ea204f5e03',
-                '{{value0}} · Pull requests and build statuses',
-                { value0: statuses.bitbucketAccount }
-              )
-            : translate(
-                'auto.components.settings.token.source.control.integration.cards.0fa5629dad',
-                'Pull requests and build statuses'
-              )
-          : translate(
-              'auto.components.settings.token.source.control.integration.cards.a924e8dcd1',
-              'Pull requests and build statuses via Bitbucket Cloud API tokens.'
-            )
-      }
-      checking={status === 'checking'}
-      statusTone={connected ? 'connected' : 'attention'}
-      statusLabel={tokenProviderStatusLabel({ configured: connected, status })}
-    >
-      {status !== 'checking' && !connected ? (
-        <IntegrationCardDetails>
-          <p className="text-xs text-muted-foreground">
-            {status === 'unavailable' ? (
-              translate(
-                'auto.components.settings.token.source.control.integration.cards.24ac1c69dc',
-                'Bitbucket status is not available in this runtime yet.'
-              )
-            ) : status === 'not-configured' ? (
-              <>
-                {translate(
-                  'auto.components.settings.token.source.control.integration.cards.7bbc9c64f0',
-                  'Set'
-                )}{' '}
-                <span className="font-mono text-[11px]">
-                  {translate(
-                    'auto.components.settings.token.source.control.integration.cards.63a7f47392',
-                    'ORCA_BITBUCKET_EMAIL'
-                  )}
-                </span>{' '}
-                {translate(
-                  'auto.components.settings.token.source.control.integration.cards.fc71a0e7aa',
-                  'and'
-                )}{' '}
-                <span className="font-mono text-[11px]">
-                  {translate(
-                    'auto.components.settings.token.source.control.integration.cards.19416c874c',
-                    'ORCA_BITBUCKET_API_TOKEN'
-                  )}
-                </span>
-                {translate(
-                  'auto.components.settings.token.source.control.integration.cards.087feb92f1',
-                  ', or set'
-                )}{' '}
-                <span className="font-mono text-[11px]">
-                  {translate(
-                    'auto.components.settings.token.source.control.integration.cards.e63fe8f627',
-                    'ORCA_BITBUCKET_ACCESS_TOKEN'
-                  )}
-                </span>
-                .
-              </>
-            ) : (
-              translate(
-                'auto.components.settings.token.source.control.integration.cards.6154b02093',
-                'Bitbucket credentials are configured but could not authenticate. Check the token and repository permissions, then restart Orca if environment variables changed.'
-              )
-            )}
-          </p>
-          <div className="flex items-center gap-2">
-            <Button
-              variant="outline"
-              size="sm"
-              onClick={() =>
-                window.api.shell.openUrl(
-                  'https://support.atlassian.com/bitbucket-cloud/docs/using-api-tokens/'
-                )
-              }
-            >
-              <ExternalLink className="size-3.5 mr-1.5" />
-              {translate(
-                'auto.components.settings.token.source.control.integration.cards.1a9475dace',
-                'Learn more'
-              )}
-            </Button>
-            <Button variant="ghost" size="sm" onClick={refresh}>
-              {translate(
-                'auto.components.settings.token.source.control.integration.cards.793a06e899',
-                'Re-check'
-              )}
-            </Button>
-          </div>
-        </IntegrationCardDetails>
-      ) : null}
-    </IntegrationCardShell>
-  )
-}
-
 export function AzureDevOpsIntegrationCard(): React.JSX.Element {
   const { statuses, unavailable, refresh } = usePreflightCardStatuses('azureDevOps')
   const status = unavailable ? 'unavailable' : statuses.azureDevOpsStatus
diff --git a/src/renderer/src/components/settings/use-linear-agent-skill-setup.ts b/src/renderer/src/components/settings/use-linear-agent-skill-setup.ts
index 2fd89c87cf0..46c7ea2b932 100644
--- a/src/renderer/src/components/settings/use-linear-agent-skill-setup.ts
+++ b/src/renderer/src/components/settings/use-linear-agent-skill-setup.ts
@@ -16,7 +16,8 @@ import { useActiveProjectSkillRuntime } from '@/hooks/useActiveProjectSkillRunti
 import {
   buildSkillCommandForRuntime,
   ensureWslCliAvailableForAgentSkillTerminal,
-  getWslCliDistroRequest
+  getWslCliDistroRequest,
+  type LocalAgentRuntime
 } from './CliSkillRuntimeSetup'
 
 // Shared install/update wiring for Task Sources + Linear settings.
@@ -32,6 +33,7 @@ export function useLinearAgentSkillSetup(): {
   installDisabled: boolean
   error: string | null
   terminalShellOverride: string | undefined
+  terminalRuntime: LocalAgentRuntime | undefined
   preInstallNotice: string
   refreshSkill: () => Promise<boolean>
   getPrerequisiteStatus: () => Promise<Awaited<ReturnType<typeof window.api.cli.getInstallStatus>>>
@@ -99,6 +101,7 @@ export function useLinearAgentSkillSetup(): {
     installDisabled,
     error: activeSkillRuntime.installDisabledReason ?? skillError,
     terminalShellOverride: activeSkillRuntime.terminalShellOverride,
+    terminalRuntime: activeSkillRuntime.agentRuntime,
     preInstallNotice: AGENT_SKILL_CLI_PREREQUISITE_NOTICE,
     refreshSkill,
     getPrerequisiteStatus,
diff --git a/src/renderer/src/components/setup-guide/SetupGuideModal.mount-gating.test.tsx b/src/renderer/src/components/setup-guide/SetupGuideModal.mount-gating.test.tsx
new file mode 100644
index 00000000000..4609a7bb085
--- /dev/null
+++ b/src/renderer/src/components/setup-guide/SetupGuideModal.mount-gating.test.tsx
@@ -0,0 +1,196 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { FEATURE_WALL_SETUP_STEPS } from '../../../../shared/feature-wall-setup-steps'
+import type { FeatureWallSetupProgress } from '../feature-wall/feature-wall-setup-progress'
+import { useAppStore } from '@/store'
+import SetupGuideModal from './SetupGuideModal'
+
+const contentProbe = vi.hoisted(() => ({
+  renders: vi.fn(),
+  storeNotifications: vi.fn(),
+  subscriptions: vi.fn(),
+  unsubscriptions: vi.fn(),
+  telemetryOpenStates: vi.fn(),
+  refreshEnabledStates: vi.fn()
+}))
+
+const progress: FeatureWallSetupProgress = {
+  ready: true,
+  stepDone: {
+    'default-agent': false,
+    'add-two-repos': false,
+    notifications: false,
+    'two-worktrees': false,
+    browser: false,
+    'task-sources': false,
+    'agent-capabilities': false,
+    'setup-script': false
+  },
+  coreDoneCount: 0,
+  coreTotal: FEATURE_WALL_SETUP_STEPS.length
+}
+
+vi.mock('./use-setup-guide-progress', async () => {
+  const React = await import('react')
+  return {
+    useSetupGuideProgress: (shouldRefreshCoreState: boolean) => {
+      contentProbe.renders()
+      contentProbe.refreshEnabledStates(shouldRefreshCoreState)
+      useAppStore((state) => state.activeWorktreeId)
+      React.useEffect(() => {
+        contentProbe.subscriptions()
+        const unsubscribe = useAppStore.subscribe(() => contentProbe.storeNotifications())
+        return () => {
+          contentProbe.unsubscriptions()
+          unsubscribe()
+        }
+      }, [])
+      return progress
+    }
+  }
+})
+
+vi.mock('./use-setup-guide-telemetry', () => ({
+  useSetupGuideOpenCloseTelemetry: ({ isOpen }: { isOpen: boolean }) =>
+    contentProbe.telemetryOpenStates(isOpen)
+}))
+
+vi.mock('../feature-wall/FeatureWallSetupChecklist', () => ({
+  FeatureWallSetupChecklist: () => <div data-setup-guide-content="true" />
+}))
+
+vi.mock('./SetupGuideProgressRing', () => ({
+  SetupGuideProgressRing: () => <span />
+}))
+
+vi.mock('@/components/ui/tooltip', () => ({
+  Tooltip: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  TooltipTrigger: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  TooltipContent: ({ children }: { children: React.ReactNode }) => <>{children}</>
+}))
+
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({ children, open }: { children: React.ReactNode; open?: boolean }) =>
+    open ? <div data-setup-guide-dialog="true">{children}</div> : null,
+  DialogContent: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+  DialogDescription: ({ children }: { children: React.ReactNode }) => <p>{children}</p>,
+  DialogHeader: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+  DialogTitle: ({ children }: { children: React.ReactNode }) => <h2>{children}</h2>
+}))
+
+const initialAppState = useAppStore.getInitialState()
+let testContainer: HTMLDivElement
+let testRoot: Root
+
+async function flushEffects(): Promise<void> {
+  await act(async () => {
+    await Promise.resolve()
+    await Promise.resolve()
+  })
+}
+
+async function churnClosedStore(count: number): Promise<void> {
+  await act(async () => {
+    for (let index = 0; index < count; index += 1) {
+      useAppStore.setState({ activeWorktreeId: `background-${index}` })
+    }
+  })
+}
+
+function activeContentSubscriptions(): number {
+  return (
+    contentProbe.subscriptions.mock.calls.length - contentProbe.unsubscriptions.mock.calls.length
+  )
+}
+
+describe('SetupGuideModal mount gating', () => {
+  beforeEach(() => {
+    globalThis.IS_REACT_ACT_ENVIRONMENT = true
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    contentProbe.renders.mockClear()
+    contentProbe.storeNotifications.mockClear()
+    contentProbe.subscriptions.mockClear()
+    contentProbe.unsubscriptions.mockClear()
+    contentProbe.telemetryOpenStates.mockClear()
+    contentProbe.refreshEnabledStates.mockClear()
+    useAppStore.setState(initialAppState, true)
+    useAppStore.setState({ activeModal: 'none', activeWorktreeId: null })
+    testContainer = document.createElement('div')
+    document.body.appendChild(testContainer)
+    testRoot = createRoot(testContainer)
+  })
+
+  afterEach(async () => {
+    await act(async () => testRoot.unmount())
+    document.body.replaceChildren()
+    useAppStore.setState(initialAppState, true)
+    vi.clearAllTimers()
+    vi.useRealTimers()
+  })
+
+  it('releases setup content after the close animation', async () => {
+    await act(async () => testRoot.render(<SetupGuideModal />))
+    await flushEffects()
+
+    await churnClosedStore(1_000)
+
+    expect(contentProbe.renders).not.toHaveBeenCalled()
+    expect(contentProbe.subscriptions).not.toHaveBeenCalled()
+    expect(contentProbe.storeNotifications).not.toHaveBeenCalled()
+
+    await act(async () => useAppStore.getState().openModal('setup-guide'))
+    await flushEffects()
+
+    expect(testContainer.querySelector('[data-setup-guide-dialog="true"]')).not.toBeNull()
+    expect(activeContentSubscriptions()).toBe(1)
+
+    await act(async () => useAppStore.getState().closeModal())
+
+    expect(testContainer.querySelector('[data-setup-guide-dialog="true"]')).toBeNull()
+    expect(activeContentSubscriptions()).toBe(1)
+    expect(contentProbe.telemetryOpenStates).toHaveBeenLastCalledWith(false)
+    // Why: dropping progress inputs mid-fade would flip completed rows back to "not done yet".
+    expect(contentProbe.refreshEnabledStates).toHaveBeenLastCalledWith(true)
+
+    await act(async () => vi.advanceTimersByTimeAsync(299))
+    expect(activeContentSubscriptions()).toBe(1)
+    expect(contentProbe.refreshEnabledStates).toHaveBeenLastCalledWith(true)
+
+    await act(async () => vi.advanceTimersByTimeAsync(1))
+    expect(activeContentSubscriptions()).toBe(0)
+
+    const rendersAfterUnmount = contentProbe.renders.mock.calls.length
+    const notificationsAfterUnmount = contentProbe.storeNotifications.mock.calls.length
+    await churnClosedStore(1_000)
+
+    expect(contentProbe.renders).toHaveBeenCalledTimes(rendersAfterUnmount)
+    expect(contentProbe.storeNotifications).toHaveBeenCalledTimes(notificationsAfterUnmount)
+  })
+
+  it('cancels the pending unmount when reopened during the linger', async () => {
+    await act(async () => testRoot.render(<SetupGuideModal />))
+    await act(async () => useAppStore.getState().openModal('setup-guide'))
+    await flushEffects()
+
+    await act(async () => useAppStore.getState().closeModal())
+    await act(async () => vi.advanceTimersByTimeAsync(299))
+    await act(async () => useAppStore.getState().openModal('setup-guide'))
+    await act(async () => vi.advanceTimersByTimeAsync(1_000))
+
+    expect(testContainer.querySelector('[data-setup-guide-dialog="true"]')).not.toBeNull()
+    expect(activeContentSubscriptions()).toBe(1)
+
+    // Why: an uncancelled timer from the first close would have already cleared the
+    // linger flag, collapsing this second close into a synchronous unmount that
+    // reports 'interrupted' instead of 'dismissed'.
+    await act(async () => useAppStore.getState().closeModal())
+    expect(activeContentSubscriptions()).toBe(1)
+    await act(async () => vi.advanceTimersByTimeAsync(299))
+    expect(activeContentSubscriptions()).toBe(1)
+    await act(async () => vi.advanceTimersByTimeAsync(1))
+    expect(activeContentSubscriptions()).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/setup-guide/SetupGuideModal.tsx b/src/renderer/src/components/setup-guide/SetupGuideModal.tsx
index fff49c9171f..79d11b7b23c 100644
--- a/src/renderer/src/components/setup-guide/SetupGuideModal.tsx
+++ b/src/renderer/src/components/setup-guide/SetupGuideModal.tsx
@@ -22,18 +22,45 @@ import { useSetupGuideProgress } from './use-setup-guide-progress'
 import { useSetupGuideOpenCloseTelemetry } from './use-setup-guide-telemetry'
 import { translate } from '@/i18n/i18n'
 
+const SETUP_GUIDE_CLOSE_LINGER_MS = 300
+
 export default function SetupGuideModal(): JSX.Element | null {
-  const activeModal = useAppStore((s) => s.activeModal)
+  const open = useAppStore((s) => s.activeModal === 'setup-guide')
+  const [lingering, setLingering] = useState(open)
+  useEffect(() => {
+    if (open) {
+      setLingering(true)
+      return
+    }
+    const timer = window.setTimeout(() => setLingering(false), SETUP_GUIDE_CLOSE_LINGER_MS)
+    return () => window.clearTimeout(timer)
+  }, [open])
+
+  if (!open && !lingering) {
+    return null
+  }
+  return <SetupGuideModalContent open={open} lingering={lingering} />
+}
+
+function SetupGuideModalContent({
+  open,
+  lingering
+}: {
+  open: boolean
+  lingering: boolean
+}): JSX.Element {
   const modalData = useAppStore((s) => s.modalData)
   const closeModal = useAppStore((s) => s.closeModal)
   const setSetupGuideSidebarDismissed = useAppStore((s) => s.setSetupGuideSidebarDismissed)
-  const isOpen = activeModal === 'setup-guide'
   const setupSteps = useMemo(() => getFeatureWallSetupSteps(), [])
   const [userSelectedStep, setUserSelectedStep] = useState(false)
   const [orchestrationSkillInstalled, setOrchestrationSkillInstalled] = useState(false)
   const [browserUseSkillInstalled, setBrowserUseSkillInstalled] = useState(false)
+  // Why: keep progress inputs live through the close-animation linger; dropping
+  // them mid-fade flips completed rows back to "not done yet" on screen.
+  const progressInputsActive = open || lingering
   const progress = useSetupGuideProgress(
-    isOpen,
+    progressInputsActive,
     orchestrationSkillInstalled,
     browserUseSkillInstalled
   )
@@ -52,14 +79,14 @@ export default function SetupGuideModal(): JSX.Element | null {
   const activeStep = setupSteps.find((step) => step.id === activeStepId) ?? setupSteps[0] ?? null
 
   useSetupGuideOpenCloseTelemetry({
-    isOpen,
+    isOpen: open,
     source: telemetrySource,
     progress,
     activeStepId: activeStep?.id ?? null
   })
 
   useEffect(() => {
-    if (!isOpen) {
+    if (!open) {
       setUserSelectedStep(false)
       return
     }
@@ -68,18 +95,18 @@ export default function SetupGuideModal(): JSX.Element | null {
     }
     setUserSelectedStep(false)
     setActiveStepId(requestedStepId)
-  }, [isOpen, requestedStepId])
+  }, [open, requestedStepId])
 
   useEffect(() => {
-    if (!isOpen || userSelectedStep || requestedStepId !== null) {
+    if (!open || userSelectedStep || requestedStepId !== null) {
       return
     }
     setActiveStepId(getFirstIncompleteFeatureWallSetupStepId(progress.stepDone))
-  }, [isOpen, progress.stepDone, requestedStepId, userSelectedStep])
+  }, [open, progress.stepDone, requestedStepId, userSelectedStep])
 
   useEffect(() => {
     if (
-      !isOpen ||
+      !open ||
       userSelectedStep ||
       requestedStepId === null ||
       activeStep?.id !== requestedStepId ||
@@ -91,15 +118,15 @@ export default function SetupGuideModal(): JSX.Element | null {
     if (nextUnfinishedCoreStepId !== activeStep.id) {
       setActiveStepId(nextUnfinishedCoreStepId)
     }
-  }, [activeStep, isOpen, progress.stepDone, requestedStepId, userSelectedStep])
+  }, [activeStep, open, progress.stepDone, requestedStepId, userSelectedStep])
 
   const handleSelectStep = (id: FeatureWallSetupStepId): void => {
     setUserSelectedStep(true)
     setActiveStepId(id)
   }
 
-  const handleOpenChange = (open: boolean): void => {
-    if (!open) {
+  const handleOpenChange = (nextOpen: boolean): void => {
+    if (!nextOpen) {
       closeModal()
     }
   }
@@ -108,12 +135,8 @@ export default function SetupGuideModal(): JSX.Element | null {
     setSetupGuideSidebarDismissed(true)
   }, [setSetupGuideSidebarDismissed])
 
-  if (!isOpen) {
-    return null
-  }
-
   return (
-    <Dialog open={isOpen} onOpenChange={handleOpenChange}>
+    <Dialog open={open} onOpenChange={handleOpenChange}>
       <DialogContent
         className="grid h-[min(780px,calc(100vh-2rem))] w-[min(1080px,calc(100vw-2rem))] max-w-none grid-rows-[auto_minmax(0,1fr)] gap-0 p-0 sm:max-w-none"
         tabIndex={-1}
diff --git a/src/renderer/src/components/sidebar/AddRepoDialog.tsx b/src/renderer/src/components/sidebar/AddRepoDialog.tsx
index 54148a0d4a3..ade12730dee 100644
--- a/src/renderer/src/components/sidebar/AddRepoDialog.tsx
+++ b/src/renderer/src/components/sidebar/AddRepoDialog.tsx
@@ -18,6 +18,7 @@ import {
   useAddRepoHostedController,
   type AddRepoDialogHostedController
 } from './use-add-repo-hosted-controller'
+import { routeAddRepoBrowse } from './add-repo-browse-authority'
 
 export default React.memo(function AddRepoDialog({
   hosted
@@ -308,7 +309,7 @@ export default React.memo(function AddRepoDialog({
         selectedSshTargetId={hostSelection.selectedSshTargetId}
         selectedHostLabel={
           hostSelection.hostOptions.find((host) => host.id === hostSelection.selectedHostId)
-            ?.label ?? hostSelection.selectedHostId
+            ?.label ?? null
         }
         lockSshTargetSelection={hostSelection.selectedParsedHost?.kind === 'ssh'}
         remotePath={remotePath}
@@ -324,26 +325,31 @@ export default React.memo(function AddRepoDialog({
         isCreating={isCreating}
         hostSelector={<AddRepoHostSelectorSlot hostSelection={hostSelection} />}
         showRemoteAction={false}
-        browseHostKind={
-          selectedHostKind === 'ssh' || selectedHostKind === 'runtime' ? selectedHostKind : 'local'
-        }
+        actionsDisabled={!hostSelection.selectedHostId}
+        browseHostKind={selectedHostKind ?? 'runtime'}
         createDefaultParent={createDefaultParent}
         createGitAvailability={createGitAvailability}
         createRuntimeParentStatus={createRuntimeParentStatus}
         createParentDefaultPending={createParentDefaultPending}
         manualCreateParentEntry={isRuntimeEnvironmentActive || selectedHostKind === 'ssh'}
-        onBrowse={
-          selectedHostKind === 'ssh'
-            ? () => void handleOpenRemoteStep(hostSelection.selectedSshTargetId)
-            : selectedHostKind === 'runtime'
-              ? () => setStep('server-path')
-              : handleBrowse
+        onBrowse={() =>
+          routeAddRepoBrowse(hostSelection.selectedParsedHost, {
+            browseLocal: () => void handleBrowse(),
+            browseRuntime: () => setStep('server-path'),
+            browseSsh: (targetId) => void handleOpenRemoteStep(targetId)
+          })
         }
         onOpenCloneStep={() => {
+          if (!hostSelection.selectedHostId) {
+            return
+          }
           setCloneError(null)
           setStep('clone')
         }}
         onOpenCreateStep={() => {
+          if (!hostSelection.selectedHostId) {
+            return
+          }
           setCreateError(null)
           setStep('create')
         }}
diff --git a/src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx b/src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx
index b70c299be36..abdd169d4fd 100644
--- a/src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx
+++ b/src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx
@@ -281,4 +281,16 @@ describe('AddRepoDialogStepContent nested imports', () => {
     expect(html).not.toContain('Create on host')
     expect(html).not.toContain('Want to import many repos at once?')
   })
+
+  it('opens the in-app filesystem browser for a paired runtime', () => {
+    const html = renderStepContent({
+      step: 'server-path',
+      isRuntimeEnvironmentActive: true,
+      activeRuntimeEnvironmentId: 'paired-host'
+    })
+
+    expect(html).toContain('Browse host filesystem')
+    expect(html).toContain('Navigate to a directory and click Select to choose it.')
+    expect(html).toContain('Select folder')
+  })
 })
diff --git a/src/renderer/src/components/sidebar/AddRepoDialogStepContent.tsx b/src/renderer/src/components/sidebar/AddRepoDialogStepContent.tsx
index ee05b70b433..9a0da649f8c 100644
--- a/src/renderer/src/components/sidebar/AddRepoDialogStepContent.tsx
+++ b/src/renderer/src/components/sidebar/AddRepoDialogStepContent.tsx
@@ -46,6 +46,7 @@ type AddRepoDialogStepContentProps = {
   hostSelector?: ReactNode
   showRemoteAction?: boolean
   canCreateProject?: boolean
+  actionsDisabled?: boolean
   manualCreateParentEntry?: boolean
   browseHostKind?: 'local' | 'ssh' | 'runtime'
   createDefaultParent: string
@@ -115,6 +116,7 @@ export function AddRepoDialogStepContent({
   hostSelector,
   showRemoteAction = true,
   canCreateProject = true,
+  actionsDisabled = false,
   manualCreateParentEntry = isRuntimeEnvironmentActive,
   browseHostKind = 'local',
   createDefaultParent,
@@ -159,6 +161,7 @@ export function AddRepoDialogStepContent({
         hostSelector={hostSelector}
         showRemoteAction={showRemoteAction}
         canCreateProject={canCreateProject}
+        actionsDisabled={actionsDisabled}
         browseHostKind={browseHostKind}
         onBrowse={onBrowse}
         onOpenCloneStep={onOpenCloneStep}
diff --git a/src/renderer/src/components/sidebar/AddRepoHostSelector.tsx b/src/renderer/src/components/sidebar/AddRepoHostSelector.tsx
index 0d73eca96cd..b9ab6c89068 100644
--- a/src/renderer/src/components/sidebar/AddRepoHostSelector.tsx
+++ b/src/renderer/src/components/sidebar/AddRepoHostSelector.tsx
@@ -13,7 +13,7 @@ import { canConnectAddRepoHost, canSelectAddRepoHost } from './add-repo-host-ava
 
 type AddRepoHostSelectorProps = {
   hosts: SidebarHostOption[]
-  selectedHostId: ExecutionHostId
+  selectedHostId: ExecutionHostId | null
   open: boolean
   onOpenChange: (open: boolean) => void
   onSelectHost: (hostId: ExecutionHostId) => void
diff --git a/src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx b/src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx
index 40fc712810a..6fa3b88aceb 100644
--- a/src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx
+++ b/src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx
@@ -53,6 +53,7 @@ function renderServerPathStartStep(runtimeEnvironmentId: string | null): string
 
 type LocalStartStepDomOptions = {
   isAdding?: boolean
+  actionsDisabled?: boolean
   addProjectBusyLabel?: string | null
   nestedScanInProgress?: boolean
   nestedScanId?: string | null
@@ -76,6 +77,7 @@ async function renderLocalStartStepDom(
           repoCount={1}
           isSshLikely={isSshLikely}
           isAdding={options.isAdding ?? false}
+          actionsDisabled={options.actionsDisabled ?? false}
           addProjectBusyLabel={options.addProjectBusyLabel ?? null}
           nestedScanInProgress={options.nestedScanInProgress ?? false}
           nestedScanId={options.nestedScanId ?? null}
@@ -257,6 +259,20 @@ describe('AddRepoLocalStartStep', () => {
     })
   })
 
+  it('disables host-scoped actions until a host is selectable', async () => {
+    const { container, root } = await renderLocalStartStepDom(false, { actionsDisabled: true })
+
+    expect(findButton(container, 'Browse folder').disabled).toBe(true)
+    expect(findButton(container, 'Clone from URL').disabled).toBe(true)
+    expect(findButton(container, 'Project on SSH host').disabled).toBe(true)
+    expect(findButton(container, 'Create new project').disabled).toBe(true)
+    expect(findButton(container, 'Browse folder').textContent).not.toContain('⏎')
+
+    await act(async () => {
+      root.unmount()
+    })
+  })
+
   it('marks the autofocused Browse action as selected with the ⏎ chip', async () => {
     const { container, root } = await renderLocalStartStepDom(false)
 
diff --git a/src/renderer/src/components/sidebar/AddRepoStartSteps.tsx b/src/renderer/src/components/sidebar/AddRepoStartSteps.tsx
index 71f8485842b..e5e4b409abc 100644
--- a/src/renderer/src/components/sidebar/AddRepoStartSteps.tsx
+++ b/src/renderer/src/components/sidebar/AddRepoStartSteps.tsx
@@ -69,6 +69,7 @@ type AddRepoLocalStartStepProps = {
   hostSelector?: ReactNode
   showRemoteAction?: boolean
   canCreateProject?: boolean
+  actionsDisabled?: boolean
   browseHostKind?: 'local' | 'ssh' | 'runtime'
   onBrowse: () => void
   onOpenCloneStep: () => void
@@ -87,6 +88,7 @@ export function AddRepoLocalStartStep({
   hostSelector,
   showRemoteAction = true,
   canCreateProject = true,
+  actionsDisabled = false,
   browseHostKind = 'local',
   onBrowse,
   onOpenCloneStep,
@@ -96,6 +98,7 @@ export function AddRepoLocalStartStep({
 }: AddRepoLocalStartStepProps): React.JSX.Element {
   const browseActionRef = useRef<HTMLButtonElement | null>(null)
   const actionsRef = useRef<HTMLDivElement | null>(null)
+  const actionsUnavailable = isAdding || actionsDisabled
   const { primaryAction, secondaryActions } = getAddRepoLocalStartActions({
     isSshLikely,
     onBrowse,
@@ -111,16 +114,13 @@ export function AddRepoLocalStartStep({
   // it follows keyboard focus so Enter always activates the highlighted action. Browse is
   // autofocused on open, so it starts selected; Tab and ↑/↓ move the highlight.
   const [selectedKind, setSelectedKind] = useState<string | null>(primaryAction.kind)
+  const visibleSelectedKind = actionsUnavailable ? null : selectedKind
 
   useEffect(() => {
-    if (isAdding) {
-      setSelectedKind(null)
-      return
-    }
-    if (!isAdding) {
+    if (!actionsUnavailable) {
       browseActionRef.current?.focus()
     }
-  }, [isAdding])
+  }, [actionsUnavailable])
 
   // ↑/↓ rove focus across the action buttons in visual order; focus drives the selection.
   const handleArrowNavigation = (event: React.KeyboardEvent<HTMLDivElement>): void => {
@@ -177,8 +177,8 @@ export function AddRepoLocalStartStep({
           icon={primaryAction.icon}
           title={primaryAction.title}
           description={primaryAction.description}
-          disabled={isAdding}
-          selected={selectedKind === primaryAction.kind}
+          disabled={actionsUnavailable}
+          selected={visibleSelectedKind === primaryAction.kind}
           buttonRef={browseActionRef}
           onClick={primaryAction.onClick}
           onFocus={() => setSelectedKind(primaryAction.kind)}
@@ -199,8 +199,8 @@ export function AddRepoLocalStartStep({
                 icon={action.icon}
                 title={action.title}
                 description={action.description}
-                disabled={isAdding || Boolean(action.disabled)}
-                selected={selectedKind === action.kind}
+                disabled={actionsUnavailable || Boolean(action.disabled)}
+                selected={visibleSelectedKind === action.kind}
                 onClick={action.onClick}
                 onFocus={() => setSelectedKind(action.kind)}
                 className={cn(
diff --git a/src/renderer/src/components/sidebar/DeleteWorktreeDialog.host-context-boundary.test.ts b/src/renderer/src/components/sidebar/DeleteWorktreeDialog.host-context-boundary.test.ts
index 30066815370..27a5f100654 100644
--- a/src/renderer/src/components/sidebar/DeleteWorktreeDialog.host-context-boundary.test.ts
+++ b/src/renderer/src/components/sidebar/DeleteWorktreeDialog.host-context-boundary.test.ts
@@ -2,7 +2,7 @@ import { readFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
 
-const SOURCE = readFileSync(join(__dirname, 'DeleteWorktreeDialog.tsx'), 'utf8')
+const SOURCE = readFileSync(join(__dirname, 'use-delete-worktree-status-hydration.ts'), 'utf8')
 
 function sourceBetween(source: string, startPattern: string, endPattern: string): string {
   const start = source.indexOf(startPattern)
@@ -14,15 +14,21 @@ function sourceBetween(source: string, startPattern: string, endPattern: string)
 
 describe('DeleteWorktreeDialog host-context boundaries', () => {
   it('preloads git status from the selected worktree owner instead of the focused host', () => {
-    const effect = sourceBetween(
-      SOURCE,
-      'const statusTargets = deleteTargets.filter(',
-      'return () => {'
-    )
+    const effect = sourceBetween(SOURCE, 'const targets = deleteTargets.filter(', 'return () => {')
 
     expect(effect).toContain('getSettingsForWorktreeRuntimeOwner')
     expect(effect).toContain('worktreesByRepo: useAppStore.getState().worktreesByRepo')
-    expect(effect).toContain('item.id')
-    expect(effect).not.toContain('settings,\n        worktreeId: item.id')
+    expect(effect).toContain('target.id')
+    expect(effect).not.toContain('settings,\n        worktreeId: target.id')
+  })
+
+  it('does not restart pending status requests when one target hydrates', () => {
+    const effect = sourceBetween(SOURCE, 'useEffect(() => {', '}, [')
+
+    expect(SOURCE).not.toContain('useAppStore((state) => state.gitStatusByWorktree)')
+    expect(effect).toContain('useAppStore.getState().gitStatusByWorktree')
+    expect(effect).toContain('const controller = new AbortController()')
+    expect(effect).toContain('{ signal: controller.signal }')
+    expect(effect).toContain('controller.abort()')
   })
 })
diff --git a/src/renderer/src/components/sidebar/DeleteWorktreeDialog.test.tsx b/src/renderer/src/components/sidebar/DeleteWorktreeDialog.test.tsx
index 3106deda4c7..65700ef574b 100644
--- a/src/renderer/src/components/sidebar/DeleteWorktreeDialog.test.tsx
+++ b/src/renderer/src/components/sidebar/DeleteWorktreeDialog.test.tsx
@@ -43,7 +43,9 @@ vi.mock('@/store', () => ({
 }))
 
 vi.mock('@/store/selectors', () => ({
-  useAllWorktrees: () => mocks.state.allWorktrees()
+  useAllWorktrees: () => mocks.state.allWorktrees(),
+  getWorktreeMapFromState: () =>
+    new Map(mocks.state.allWorktrees().map((worktree) => [worktree.id, worktree]))
 }))
 
 vi.mock('@/components/ui/dialog', () => ({
@@ -91,7 +93,12 @@ vi.mock('./active-worktree-focus-after-delete', () => ({
   prepareActiveWorktreeFocusAfterDelete: () => vi.fn()
 }))
 
+vi.mock('./stale-workspace-list-toast', () => ({
+  showWorkspaceListChangedToast: vi.fn()
+}))
+
 import { runWorktreeDeletesInParallel } from './delete-worktree-flow'
+import { showWorkspaceListChangedToast } from './stale-workspace-list-toast'
 
 function makeWorktree(id: string, path: string): Worktree {
   return {
@@ -153,7 +160,11 @@ describe('DeleteWorktreeDialog lineage copy', () => {
   it('shows child-delete copy and only a delete-all action when the workspace has children', async () => {
     const parent = makeWorktree('Parent workspace', '/workspaces/parent')
     const child = makeWorktree('Child workspace', '/workspaces/child')
-    mocks.state.modalData = { worktreeId: parent.id }
+    mocks.state.modalData = {
+      worktreeId: parent.id,
+      worktreeDeleteIdentities: [{ id: parent.id, instanceId: parent.instanceId }],
+      lineageDeleteIdentities: [child, parent].map(({ id, instanceId }) => ({ id, instanceId }))
+    }
     mocks.state.allWorktrees.mockReturnValue([parent, child])
     mocks.state.worktreeLineageById = {
       [child.id]: makeLineage(child, parent)
@@ -295,7 +306,11 @@ describe('DeleteWorktreeDialog lineage copy', () => {
   it('notifies the dialog caller after a toast force delete succeeds', async () => {
     const workspace = makeWorktree('Workspace', '/workspaces/workspace')
     const onDeleted = vi.fn()
-    mocks.state.modalData = { worktreeId: workspace.id, onDeleted }
+    mocks.state.modalData = {
+      worktreeId: workspace.id,
+      worktreeDeleteIdentities: [{ id: workspace.id, instanceId: workspace.instanceId }],
+      onDeleted
+    }
     mocks.state.allWorktrees.mockReturnValue([workspace])
 
     const { default: DeleteWorktreeDialog } = await import('./DeleteWorktreeDialog')
@@ -318,4 +333,57 @@ describe('DeleteWorktreeDialog lineage copy', () => {
 
     expect(onDeleted).toHaveBeenCalledWith([workspace.id])
   })
+
+  it('rejects confirmation when the workspace instance changed after the dialog opened', async () => {
+    const original = makeWorktree('Workspace', '/workspaces/original')
+    const replacement = { ...original, instanceId: 'replacement-instance' }
+    mocks.state.modalData = {
+      worktreeId: original.id,
+      worktreeDeleteIdentities: [{ id: original.id, instanceId: original.instanceId }]
+    }
+    mocks.state.allWorktrees.mockReturnValue([original])
+
+    const { default: DeleteWorktreeDialog } = await import('./DeleteWorktreeDialog')
+    renderToStaticMarkup(<DeleteWorktreeDialog />)
+    mocks.state.allWorktrees.mockReturnValue([replacement])
+
+    const deleteButton = mocks.buttonProps.find((props) => props.variant === 'destructive') as
+      | { onClick?: (event: never) => void }
+      | undefined
+    deleteButton?.onClick?.(undefined as never)
+
+    expect(showWorkspaceListChangedToast).toHaveBeenCalledOnce()
+    expect(mocks.state.closeModal).toHaveBeenCalledOnce()
+    expect(runWorktreeDeletesInParallel).not.toHaveBeenCalled()
+    expect(mocks.state.removeWorktree).not.toHaveBeenCalled()
+  })
+
+  it('rejects lineage confirmation when a descendant instance changed', async () => {
+    const parent = makeWorktree('Parent workspace', '/workspaces/parent')
+    const child = makeWorktree('Child workspace', '/workspaces/child')
+    const replacement = { ...child, instanceId: 'replacement-instance' }
+    mocks.state.modalData = {
+      worktreeId: parent.id,
+      worktreeDeleteIdentities: [{ id: parent.id, instanceId: parent.instanceId }],
+      lineageDeleteIdentities: [child, parent].map(({ id, instanceId }) => ({ id, instanceId }))
+    }
+    mocks.state.allWorktrees.mockReturnValue([parent, child])
+    mocks.state.worktreeLineageById = {
+      [child.id]: makeLineage(child, parent)
+    }
+
+    const { default: DeleteWorktreeDialog } = await import('./DeleteWorktreeDialog')
+    renderToStaticMarkup(<DeleteWorktreeDialog />)
+    mocks.state.allWorktrees.mockReturnValue([parent, replacement])
+
+    const deleteButton = mocks.buttonProps.find((props) => props.variant === 'destructive') as
+      | { onClick?: () => void }
+      | undefined
+    deleteButton?.onClick?.()
+
+    expect(showWorkspaceListChangedToast).toHaveBeenCalledOnce()
+    expect(mocks.state.closeModal).toHaveBeenCalledOnce()
+    expect(runWorktreeDeletesInParallel).not.toHaveBeenCalled()
+    expect(mocks.state.removeWorktree).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/renderer/src/components/sidebar/DeleteWorktreeDialog.tsx b/src/renderer/src/components/sidebar/DeleteWorktreeDialog.tsx
index 6bbe0581c9a..568faf329b4 100644
--- a/src/renderer/src/components/sidebar/DeleteWorktreeDialog.tsx
+++ b/src/renderer/src/components/sidebar/DeleteWorktreeDialog.tsx
@@ -9,9 +9,6 @@ import {
 import { useAppStore } from '@/store'
 import { useAllWorktrees } from '@/store/selectors'
 import { toast } from 'sonner'
-import { getConnectionId } from '@/lib/connection-context'
-import { getRuntimeGitStatus } from '@/runtime/runtime-git-client'
-import { getSettingsForWorktreeRuntimeOwner } from '@/lib/worktree-runtime-owner'
 import { runWorktreeDeletesInParallel } from './delete-worktree-flow'
 import { prepareActiveWorktreeFocusAfterDelete } from './active-worktree-focus-after-delete'
 import { getWorkspaceDeleteLineage } from './workspace-delete-lineage'
@@ -30,6 +27,8 @@ import {
   isFolderWorkspaceDelete as getIsFolderWorkspaceDelete
 } from './delete-worktree-dialog-copy'
 import { translate } from '@/i18n/i18n'
+import { useDeleteWorktreeStatusHydration } from './use-delete-worktree-status-hydration'
+import { useConfirmedWorktreeDeleteTargets } from './use-confirmed-worktree-delete-targets'
 
 const DeleteWorktreeDialog = React.memo(function DeleteWorktreeDialog() {
   const activeModal = useAppStore((s) => s.activeModal)
@@ -43,9 +42,7 @@ const DeleteWorktreeDialog = React.memo(function DeleteWorktreeDialog() {
   const updateSettings = useAppStore((s) => s.updateSettings)
   const openSettingsTarget = useAppStore((s) => s.openSettingsTarget)
   const openSettingsPage = useAppStore((s) => s.openSettingsPage)
-  const settings = useAppStore((s) => s.settings)
   const gitStatusByWorktree = useAppStore((s) => s.gitStatusByWorktree)
-  const setGitStatus = useAppStore((s) => s.setGitStatus)
 
   const isOpen = activeModal === 'delete-worktree'
   const worktreeId = typeof modalData.worktreeId === 'string' ? modalData.worktreeId : ''
@@ -58,6 +55,12 @@ const DeleteWorktreeDialog = React.memo(function DeleteWorktreeDialog() {
           : [],
     [modalData.worktreeIds, worktreeId]
   )
+  const { worktreeDeleteIdentities, lineageDeleteIdentities, resolveConfirmedTargets } =
+    useConfirmedWorktreeDeleteTargets({
+      worktreeIdentityData: modalData.worktreeDeleteIdentities,
+      lineageIdentityData: modalData.lineageDeleteIdentities,
+      closeModal
+    })
   const onDeleted =
     typeof modalData.onDeleted === 'function'
       ? (modalData.onDeleted as (worktreeIds: string[]) => void)
@@ -146,6 +149,7 @@ const DeleteWorktreeDialog = React.memo(function DeleteWorktreeDialog() {
       repoMap
     })
   }, [deleteStateByWorktreeId, deleteTargets, gitStatusByWorktree, repoMap])
+  useDeleteWorktreeStatusHydration({ isOpen, deleteTargets, repoMap })
 
   if (!isOpen && dontAskAgain) {
     // Why: this checkbox is a one-shot dialog intent; reset it as soon as the
@@ -170,47 +174,6 @@ const DeleteWorktreeDialog = React.memo(function DeleteWorktreeDialog() {
     worktrees.length
   ])
 
-  useEffect(() => {
-    if (!isOpen) {
-      return
-    }
-    const statusTargets = deleteTargets.filter(
-      (item) =>
-        !item.isMainWorktree &&
-        !getIsFolderWorkspaceDelete(repoMap, item) &&
-        gitStatusByWorktree[item.id] === undefined
-    )
-    if (statusTargets.length === 0) {
-      return
-    }
-    let cancelled = false
-    for (const item of statusTargets) {
-      void getRuntimeGitStatus({
-        // Why: delete warnings inspect git state for the selected workspace;
-        // a later focused-host switch must not make this preload query another host.
-        settings: getSettingsForWorktreeRuntimeOwner(
-          { repos, settings, worktreesByRepo: useAppStore.getState().worktreesByRepo },
-          item.id
-        ),
-        worktreeId: item.id,
-        worktreePath: item.path,
-        connectionId: getConnectionId(item.id) ?? undefined
-      })
-        .then((status) => {
-          if (!cancelled) {
-            setGitStatus(item.id, status)
-          }
-        })
-        .catch(() => {
-          // Best-effort only: delete itself still performs the authoritative
-          // backend check and will surface failures through the normal toast.
-        })
-    }
-    return () => {
-      cancelled = true
-    }
-  }, [deleteTargets, gitStatusByWorktree, isOpen, repoMap, repos, setGitStatus, settings])
-
   const handleOpenChange = useCallback(
     (open: boolean) => {
       if (open) {
@@ -254,6 +217,10 @@ const DeleteWorktreeDialog = React.memo(function DeleteWorktreeDialog() {
       if (worktreeIds.length === 0) {
         return
       }
+      const currentWorktrees = resolveConfirmedTargets(worktreeDeleteIdentities, worktreeIds.length)
+      if (!currentWorktrees) {
+        return
+      }
       // Why: force-delete is a recovery path taken after a failed first delete.
       // Saving "don't ask again" from that state would conflate the recovery
       // action with a broader preference. Only persist the preference on the
@@ -303,7 +270,7 @@ const DeleteWorktreeDialog = React.memo(function DeleteWorktreeDialog() {
         // Why: this modal is the destructive confirmation for the workspace
         // folder. Running a non-force remove here just turns dirty files into
         // a redundant Force Delete toast after the user already confirmed.
-        const deletePromise = runWorktreeDeletesInParallel(worktrees, {
+        const deletePromise = runWorktreeDeletesInParallel(currentWorktrees, {
           force: true,
           onForceDeleted: handleForceDeletedFromToast
         })
@@ -326,8 +293,9 @@ const DeleteWorktreeDialog = React.memo(function DeleteWorktreeDialog() {
       persistDontAskAgainPreference,
       removeWorktree,
       worktreeIds.length,
+      worktreeDeleteIdentities,
       worktreeId,
-      worktrees
+      resolveConfirmedTargets
     ]
   )
 
@@ -335,9 +303,16 @@ const DeleteWorktreeDialog = React.memo(function DeleteWorktreeDialog() {
     if (lineageDelete.deleteAllTargets.length <= 1) {
       return
     }
+    const currentTargets = resolveConfirmedTargets(
+      lineageDeleteIdentities,
+      lineageDelete.deleteAllTargets.length
+    )
+    if (!currentTargets) {
+      return
+    }
     // Why: the lineage modal confirms every affected workspace up front, so
     // dirty child workspaces should not create per-workspace force prompts.
-    const deletePromise = runWorktreeDeletesInParallel(lineageDelete.deleteAllTargets, {
+    const deletePromise = runWorktreeDeletesInParallel(currentTargets, {
       force: true,
       onForceDeleted: handleForceDeletedFromToast
     })
@@ -349,7 +324,14 @@ const DeleteWorktreeDialog = React.memo(function DeleteWorktreeDialog() {
         onDeleted?.(deletedIds)
       }
     })
-  }, [closeModal, handleForceDeletedFromToast, lineageDelete.deleteAllTargets, onDeleted])
+  }, [
+    closeModal,
+    handleForceDeletedFromToast,
+    lineageDelete.deleteAllTargets.length,
+    lineageDeleteIdentities,
+    onDeleted,
+    resolveConfirmedTargets
+  ])
 
   return (
     <Dialog open={isOpen} onOpenChange={handleOpenChange}>
diff --git a/src/renderer/src/components/sidebar/LinearAgentSkillSetupDialog.tsx b/src/renderer/src/components/sidebar/LinearAgentSkillSetupDialog.tsx
index 1de868ec200..3e4749f0f3b 100644
--- a/src/renderer/src/components/sidebar/LinearAgentSkillSetupDialog.tsx
+++ b/src/renderer/src/components/sidebar/LinearAgentSkillSetupDialog.tsx
@@ -28,6 +28,7 @@ type LinearAgentSkillSetupDialogProps = {
   command: string
   installedCommand: string
   terminalShellOverride?: string
+  terminalRuntime?: AgentSkillSetupPanelProps['terminalRuntime']
   installed: boolean
   loading: boolean
   error: string | null
@@ -47,6 +48,7 @@ export function LinearAgentSkillSetupDialog({
   command,
   installedCommand,
   terminalShellOverride,
+  terminalRuntime,
   installed,
   loading,
   error,
@@ -137,6 +139,7 @@ export function LinearAgentSkillSetupDialog({
               terminalWorktreeId="sidebar-linear-agent-skill-setup"
               terminalHeightPx={240}
               terminalShellOverride={terminalShellOverride}
+              terminalRuntime={terminalRuntime}
               installed={installed}
               loading={loading}
               error={error}
diff --git a/src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.test.tsx b/src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.test.tsx
index c26f7024a9a..89c12b11a81 100644
--- a/src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.test.tsx
+++ b/src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.test.tsx
@@ -68,11 +68,8 @@ vi.mock('@/lib/agent-skill-cli-prerequisite', () => ({
 vi.mock('../settings/CliSkillRuntimeSetup', () => ({
   buildSkillCommandForRuntime: (
     command: string,
-    runtime: { runtime: string; wslDistro?: string | null }
-  ) =>
-    runtime.runtime === 'wsl'
-      ? `wsl.exe${runtime.wslDistro ? ` -d '${runtime.wslDistro}'` : ''} -- bash -lc '${command}'`
-      : command,
+    _runtime: { runtime: string; wslDistro?: string | null }
+  ) => command,
   ensureWslCliAvailableForAgentSkillTerminal: mocks.ensureWslCli,
   getWslCliDistroRequest: (runtime?: { runtime: string; wslDistro?: string | null }) =>
     runtime?.runtime === 'wsl' && runtime.wslDistro?.trim()
@@ -344,12 +341,12 @@ describe('LinearAgentSkillSetupPrompt', () => {
     })
     await settleRender()
 
-    expect(document.body.textContent).toContain("wsl.exe -d 'Fedora' -- bash -lc 'npx skills add")
+    expect(document.body.textContent).toContain('npx skills add')
     expect(mocks.panelProps.at(-1)).toEqual(
       expect.objectContaining({
-        installedCommand:
-          "wsl.exe -d 'Fedora' -- bash -lc 'npx skills update orca-linear --global'",
+        installedCommand: 'npx skills update orca-linear --global',
         terminalShellOverride: 'powershell.exe',
+        terminalRuntime: expect.objectContaining({ runtime: 'wsl', wslDistro: 'Fedora' }),
         getPrerequisiteStatus: expect.any(Function)
       })
     )
@@ -892,7 +889,10 @@ describe('LinearAgentSkillSetupPrompt', () => {
         ?.dispatchEvent(new MouseEvent('click', { bubbles: true }))
     })
     await settleRender()
-    expect(mocks.panelProps.at(-1)?.command).toContain("wsl.exe -d 'Ubuntu'")
+    expect(mocks.panelProps.at(-1)?.command).toContain('npx skills add')
+    expect(mocks.panelProps.at(-1)?.terminalRuntime).toEqual(
+      expect.objectContaining({ runtime: 'wsl', wslDistro: 'Ubuntu' })
+    )
   })
 
   it('uses remote-safe success copy for remote workspaces', async () => {
diff --git a/src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.tsx b/src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.tsx
index 31c648da74b..4ef5f3f94f8 100644
--- a/src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.tsx
+++ b/src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.tsx
@@ -292,6 +292,7 @@ export function LinearAgentSkillSetupPrompt({
         command={command}
         installedCommand={installedCommand}
         terminalShellOverride={terminalShellOverride}
+        terminalRuntime={agentRuntime}
         installed={skill.installed}
         loading={showCheckingModal || cliLoading || skill.loading}
         error={skill.error}
diff --git a/src/renderer/src/components/sidebar/NonGitFolderDialog.tsx b/src/renderer/src/components/sidebar/NonGitFolderDialog.tsx
index 8cc5ed91d69..20e76e8d2e8 100644
--- a/src/renderer/src/components/sidebar/NonGitFolderDialog.tsx
+++ b/src/renderer/src/components/sidebar/NonGitFolderDialog.tsx
@@ -12,6 +12,7 @@ import { Button } from '@/components/ui/button'
 import { useAppStore } from '@/store'
 import { activateAndRevealWorktree } from '@/lib/worktree-activation'
 import { buildDismissedOnboardingFolderAgentStartup } from '@/lib/onboarding-folder-agent-startup'
+import { isNativeChatTranscriptLocalReadable } from '@/lib/native-chat-transcript-readability'
 import { markOnboardingProjectAdded } from '@/lib/onboarding-project-checklist'
 import { translate } from '@/i18n/i18n'
 import { upsertAddedRepoWithProjectHostSetup } from './add-repo-store-upsert'
@@ -86,7 +87,8 @@ const NonGitFolderDialog = React.memo(function NonGitFolderDialog() {
             const startup = buildDismissedOnboardingFolderAgentStartup(
               useAppStore.getState().settings,
               onboarding,
-              hadProjectBeforeAdd
+              hadProjectBeforeAdd,
+              isNativeChatTranscriptLocalReadable(connectionId)
             )
             activateAndRevealWorktree(folderWorktree.id, {
               sidebarRevealBehavior: 'auto',
diff --git a/src/renderer/src/components/sidebar/PreservedBranchBatchReviewDialog.tsx b/src/renderer/src/components/sidebar/PreservedBranchBatchReviewDialog.tsx
new file mode 100644
index 00000000000..c1340b79327
--- /dev/null
+++ b/src/renderer/src/components/sidebar/PreservedBranchBatchReviewDialog.tsx
@@ -0,0 +1,188 @@
+import { useMemo, useState } from 'react'
+import { Trash2 } from 'lucide-react'
+import { getRepoIdFromWorktreeId } from '../../../../shared/worktree-id'
+import { translate } from '@/i18n/i18n'
+import type { PreservedBranchCleanup } from '@/lib/preserved-branch-cleanup'
+import { useAppStore } from '@/store'
+import { Button } from '../ui/button'
+import { Checkbox } from '../ui/checkbox'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle
+} from '../ui/dialog'
+import { Label } from '../ui/label'
+import { preservedBranchCleanupKey } from '@/lib/preserved-branch-cleanup'
+
+type ActionablePreservedBranch = PreservedBranchCleanup & { expectedHead: string }
+
+function selectionKey(branch: PreservedBranchCleanup): string {
+  return preservedBranchCleanupKey(branch)
+}
+
+function getRepositoryLabel(branch: PreservedBranchCleanup): string {
+  const repoId = getRepoIdFromWorktreeId(branch.worktreeId)
+  return useAppStore.getState().repos?.find((repo) => repo.id === repoId)?.displayName || repoId
+}
+
+export function PreservedBranchBatchReviewDialog({
+  branches,
+  open,
+  onOpenChange,
+  onForceDelete
+}: {
+  branches: readonly PreservedBranchCleanup[]
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  onForceDelete: (branches: readonly ActionablePreservedBranch[]) => void
+}): React.JSX.Element {
+  const actionableBranches = useMemo(
+    () =>
+      branches.filter((branch): branch is ActionablePreservedBranch =>
+        Boolean(branch.expectedHead)
+      ),
+    [branches]
+  )
+  const actionableKeys = useMemo(
+    () => actionableBranches.map((branch) => selectionKey(branch)),
+    [actionableBranches]
+  )
+  const [selectedKeys, setSelectedKeys] = useState<ReadonlySet<string>>(
+    () => new Set(actionableKeys)
+  )
+  const selectedBranches = actionableBranches.filter((branch) =>
+    selectedKeys.has(selectionKey(branch))
+  )
+  const allSelected = selectedBranches.length === actionableBranches.length
+  const someSelected = selectedBranches.length > 0 && !allSelected
+
+  const setBranchSelected = (branch: ActionablePreservedBranch, selected: boolean): void => {
+    setSelectedKeys((current) => {
+      const next = new Set(current)
+      if (selected) {
+        next.add(selectionKey(branch))
+      } else {
+        next.delete(selectionKey(branch))
+      }
+      return next
+    })
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-lg">
+        <DialogHeader>
+          <DialogTitle className="text-sm">
+            {translate(
+              'auto.components.sidebar.PreservedBranchBatchReviewDialog.c4bf8e7eaf',
+              'Review kept branches'
+            )}
+          </DialogTitle>
+          <DialogDescription>
+            {translate(
+              'auto.components.sidebar.PreservedBranchBatchReviewDialog.f21976c9a8',
+              'Select the local branches you want to force delete. Unselected branches stay in their repositories.'
+            )}
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="max-h-72 overflow-y-auto scrollbar-sleek rounded-md border border-border/70 bg-muted/35 text-xs">
+          <div className="sticky top-0 z-10 flex min-h-9 items-center justify-between gap-3 border-b border-border/70 bg-background/95 px-3 backdrop-blur-sm">
+            <Label htmlFor="preserved-branch-select-all" className="gap-2 text-xs">
+              <Checkbox
+                id="preserved-branch-select-all"
+                checked={someSelected ? 'indeterminate' : allSelected}
+                onCheckedChange={(checked) =>
+                  setSelectedKeys(checked === true ? new Set(actionableKeys) : new Set())
+                }
+              />
+              {translate(
+                'auto.components.sidebar.PreservedBranchBatchReviewDialog.38c947f7c5',
+                'Select all'
+              )}
+            </Label>
+            <span className="text-[11px] tabular-nums text-muted-foreground">
+              {translate(
+                'auto.components.sidebar.PreservedBranchBatchReviewDialog.9602129d38',
+                '{{value0}} of {{value1}} selected',
+                { value0: selectedBranches.length, value1: actionableBranches.length }
+              )}
+            </span>
+          </div>
+
+          <ul className="px-3">
+            {branches.map((branch, index) => {
+              const actionableBranch = branch.expectedHead
+                ? (branch as ActionablePreservedBranch)
+                : null
+              const branchKey = selectionKey(branch)
+              const checkboxId = `preserved-branch-${index}`
+              return (
+                <li
+                  key={branchKey}
+                  className="grid min-h-11 grid-cols-[1rem_minmax(0,1fr)_auto] items-center gap-2.5 border-b border-border/50 py-1.5 last:border-0"
+                >
+                  <Checkbox
+                    id={checkboxId}
+                    checked={actionableBranch ? selectedKeys.has(branchKey) : false}
+                    disabled={!actionableBranch}
+                    onCheckedChange={(checked) => {
+                      if (actionableBranch) {
+                        setBranchSelected(actionableBranch, checked === true)
+                      }
+                    }}
+                  />
+                  <Label htmlFor={checkboxId} className="block min-w-0 cursor-pointer leading-snug">
+                    <span className="block break-all font-mono font-medium text-foreground">
+                      {branch.branchName}
+                    </span>
+                    <span className="mt-0.5 block break-all text-[11px] text-muted-foreground">
+                      {getRepositoryLabel(branch)}
+                      {branch.expectedHead ? ` · ${branch.expectedHead.slice(0, 7)}` : ''}
+                    </span>
+                  </Label>
+                  <span className="text-[11px] whitespace-nowrap text-muted-foreground">
+                    {actionableBranch
+                      ? translate(
+                          'auto.components.sidebar.PreservedBranchBatchReviewDialog.ee39e872d5',
+                          'May be unmerged'
+                        )
+                      : translate(
+                          'auto.components.sidebar.PreservedBranchBatchReviewDialog.676db406fd',
+                          'Head unavailable'
+                        )}
+                  </span>
+                </li>
+              )
+            })}
+          </ul>
+        </div>
+
+        <DialogFooter>
+          <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
+            {translate(
+              'auto.components.sidebar.PreservedBranchBatchReviewDialog.285e1e4882',
+              'Cancel'
+            )}
+          </Button>
+          <Button
+            type="button"
+            variant="destructive"
+            disabled={selectedBranches.length === 0}
+            onClick={() => onForceDelete(selectedBranches)}
+          >
+            <Trash2 />
+            {translate(
+              'auto.components.sidebar.PreservedBranchBatchReviewDialog.a0f9863597',
+              'Force Delete {{count}} Branches',
+              { count: selectedBranches.length }
+            )}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/src/renderer/src/components/sidebar/PreservedBranchBatchReviewModal.tsx b/src/renderer/src/components/sidebar/PreservedBranchBatchReviewModal.tsx
new file mode 100644
index 00000000000..34bdbc9d4e8
--- /dev/null
+++ b/src/renderer/src/components/sidebar/PreservedBranchBatchReviewModal.tsx
@@ -0,0 +1,52 @@
+import { useMemo } from 'react'
+import type { PreservedBranchCleanup } from '@/lib/preserved-branch-cleanup'
+import { useAppStore } from '@/store'
+import { PreservedBranchBatchReviewDialog } from './PreservedBranchBatchReviewDialog'
+import {
+  forceDeletePreservedBranchBatch,
+  type ActionablePreservedBranch
+} from './preserved-branch-batch-toast'
+
+function isPreservedBranchCleanup(value: unknown): value is PreservedBranchCleanup {
+  if (!value || typeof value !== 'object') {
+    return false
+  }
+  const branch = value as Partial<PreservedBranchCleanup>
+  return (
+    typeof branch.worktreeId === 'string' &&
+    typeof branch.branchName === 'string' &&
+    (branch.expectedHead === undefined || typeof branch.expectedHead === 'string') &&
+    (branch.hostId === undefined || typeof branch.hostId === 'string') &&
+    (branch.runtimeEnvironmentId === undefined || typeof branch.runtimeEnvironmentId === 'string')
+  )
+}
+
+function getModalBranches(value: unknown): PreservedBranchCleanup[] {
+  return Array.isArray(value) ? value.filter(isPreservedBranchCleanup) : []
+}
+
+export default function PreservedBranchBatchReviewModal(): React.JSX.Element {
+  const activeModal = useAppStore((state) => state.activeModal)
+  const modalData = useAppStore((state) => state.modalData)
+  const closeModal = useAppStore((state) => state.closeModal)
+  const branches = useMemo(() => getModalBranches(modalData.branches), [modalData.branches])
+  const open = activeModal === 'preserved-branch-review' && branches.length > 0
+
+  const handleForceDelete = (selectedBranches: readonly ActionablePreservedBranch[]): void => {
+    closeModal()
+    void forceDeletePreservedBranchBatch(selectedBranches)
+  }
+
+  return (
+    <PreservedBranchBatchReviewDialog
+      branches={branches}
+      open={open}
+      onOpenChange={(nextOpen) => {
+        if (!nextOpen) {
+          closeModal()
+        }
+      }}
+      onForceDelete={handleForceDelete}
+    />
+  )
+}
diff --git a/src/renderer/src/components/sidebar/SidebarFeedbackDialog.test.tsx b/src/renderer/src/components/sidebar/SidebarFeedbackDialog.test.tsx
index 70db571e77f..1920662056c 100644
--- a/src/renderer/src/components/sidebar/SidebarFeedbackDialog.test.tsx
+++ b/src/renderer/src/components/sidebar/SidebarFeedbackDialog.test.tsx
@@ -5,6 +5,8 @@ import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/re
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
+  getPlatform: vi.fn(),
+  getVersion: vi.fn(),
   readFeedbackImageFiles: vi.fn(),
   submit: vi.fn(),
   toastWarning: vi.fn()
@@ -57,14 +59,28 @@ beforeEach(() => {
   mocks.readFeedbackImageFiles.mockReset()
   mocks.submit.mockReset()
   mocks.toastWarning.mockReset()
+  mocks.getPlatform.mockReset()
+  mocks.getVersion.mockReset()
   mocks.submit.mockResolvedValue({ ok: true })
+  mocks.getPlatform.mockReturnValue({
+    platform: 'darwin',
+    osRelease: '25.0.0',
+    arch: 'arm64',
+    shell: '/bin/zsh',
+    displayServer: null
+  })
+  mocks.getVersion.mockResolvedValue('1.4.178-rc.2')
   URL.revokeObjectURL = vi.fn()
   Object.defineProperty(window, 'api', {
     configurable: true,
     value: {
       feedback: { submit: mocks.submit },
       gh: { viewer: vi.fn().mockResolvedValue(null) },
-      shell: { openUrl: vi.fn() }
+      shell: { openUrl: vi.fn() },
+      platform: {
+        get: mocks.getPlatform
+      },
+      updater: { getVersion: mocks.getVersion }
     }
   })
 })
@@ -73,6 +89,106 @@ afterEach(() => {
   cleanup()
 })
 
+describe('SidebarFeedbackDialog environment prefill', () => {
+  it('pre-inserts Orca version and OS info when the dialog opens', async () => {
+    render(<SidebarFeedbackDialog open onOpenChange={vi.fn()} />)
+    const textarea = screen.getByPlaceholderText('What could we improve?') as HTMLTextAreaElement
+
+    await waitFor(() => {
+      expect(textarea.value).toContain('Orca: 1.4.178-rc.2')
+      expect(textarea.value).toContain('OS: darwin 25.0.0 (arm64)')
+      expect(textarea.value).toContain('Shell: /bin/zsh')
+    })
+    expect((screen.getByRole('button', { name: 'Send' }) as HTMLButtonElement).disabled).toBe(true)
+  })
+
+  it('keeps version info when the user types above the prefilled block', async () => {
+    render(<SidebarFeedbackDialog open onOpenChange={vi.fn()} />)
+    const textarea = screen.getByPlaceholderText('What could we improve?') as HTMLTextAreaElement
+    await waitFor(() => expect(textarea.value).toContain('Orca: 1.4.178-rc.2'))
+
+    fireEvent.change(textarea, {
+      target: { value: `Tabs feel slow\n\n${textarea.value.trim()}` }
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Send' }))
+
+    await waitFor(() => expect(mocks.submit).toHaveBeenCalledTimes(1))
+    const submitted = mocks.submit.mock.calls[0]?.[0].feedback as string
+    expect(submitted).toContain('Tabs feel slow')
+    expect(submitted).toContain('Orca: 1.4.178-rc.2')
+  })
+
+  it('preserves early typing and appends the footer after version loading finishes', async () => {
+    let finishVersion: ((version: string) => void) | undefined
+    mocks.getVersion.mockReturnValue(
+      new Promise((resolve) => {
+        finishVersion = resolve
+      })
+    )
+    render(<SidebarFeedbackDialog open onOpenChange={vi.fn()} />)
+    const textarea = screen.getByPlaceholderText('What could we improve?') as HTMLTextAreaElement
+
+    fireEvent.change(textarea, { target: { value: 'Typed before loading' } })
+    textarea.focus()
+    textarea.setSelectionRange(textarea.value.length, textarea.value.length)
+    await act(async () => finishVersion?.('1.4.178-rc.2'))
+
+    await waitFor(() => expect(textarea.value).toContain('Orca: 1.4.178-rc.2'))
+    expect(textarea.value).toContain('Typed before loading')
+    expect(textarea.selectionStart).toBe('Typed before loading'.length)
+  })
+
+  it('enables Send when the user types below the prefilled footer', async () => {
+    render(<SidebarFeedbackDialog open onOpenChange={vi.fn()} />)
+    const textarea = screen.getByPlaceholderText('What could we improve?') as HTMLTextAreaElement
+    await waitFor(() => expect(textarea.value).toContain('Orca: 1.4.178-rc.2'))
+
+    fireEvent.change(textarea, {
+      target: { value: `${textarea.value.trim()}\nText below footer` }
+    })
+
+    expect((screen.getByRole('button', { name: 'Send' }) as HTMLButtonElement).disabled).toBe(false)
+  })
+
+  it('keeps Send disabled for an edited footer with no user text', async () => {
+    render(<SidebarFeedbackDialog open onOpenChange={vi.fn()} />)
+    const textarea = screen.getByPlaceholderText('What could we improve?') as HTMLTextAreaElement
+    await waitFor(() => expect(textarea.value).toContain('Orca: 1.4.178-rc.2'))
+
+    fireEvent.change(textarea, {
+      target: { value: '---\nOrca: custom build\nOS: edited' }
+    })
+
+    expect((screen.getByRole('button', { name: 'Send' }) as HTMLButtonElement).disabled).toBe(true)
+  })
+
+  it('allows a real report after the prefilled footer is deleted', async () => {
+    render(<SidebarFeedbackDialog open onOpenChange={vi.fn()} />)
+    const textarea = screen.getByPlaceholderText('What could we improve?') as HTMLTextAreaElement
+    await waitFor(() => expect(textarea.value).toContain('Orca: 1.4.178-rc.2'))
+    const send = screen.getByRole('button', { name: 'Send' }) as HTMLButtonElement
+
+    fireEvent.change(textarea, { target: { value: '' } })
+    expect(send.disabled).toBe(true)
+    fireEvent.change(textarea, { target: { value: 'Tabs hang after waking the laptop.' } })
+    expect(send.disabled).toBe(false)
+  })
+
+  it('still prefills best-effort details when preload lookups fail', async () => {
+    mocks.getPlatform.mockImplementation(() => {
+      throw new Error('platform unavailable')
+    })
+    mocks.getVersion.mockRejectedValue(new Error('version unavailable'))
+
+    render(<SidebarFeedbackDialog open onOpenChange={vi.fn()} />)
+
+    await waitFor(() => {
+      const textarea = screen.getByPlaceholderText('What could we improve?') as HTMLTextAreaElement
+      expect(textarea.value).toContain('Orca: unknown')
+    })
+  })
+})
+
 describe('SidebarFeedbackDialog image submission', () => {
   it('keeps the dialog scrollable within short windows', () => {
     const { container } = render(<SidebarFeedbackDialog open onOpenChange={vi.fn()} />)
diff --git a/src/renderer/src/components/sidebar/SidebarFeedbackDialog.tsx b/src/renderer/src/components/sidebar/SidebarFeedbackDialog.tsx
index d556f9233a8..1bdd1050a68 100644
--- a/src/renderer/src/components/sidebar/SidebarFeedbackDialog.tsx
+++ b/src/renderer/src/components/sidebar/SidebarFeedbackDialog.tsx
@@ -17,13 +17,12 @@ import type { GitHubViewer } from '../../../../shared/types'
 import { translate } from '@/i18n/i18n'
 import {
   extractImageFilesFromDataTransfer,
-  hasAttachableFeedbackImage,
-  readFeedbackImageFiles,
-  releaseFeedbackImageDraft,
-  type FeedbackImageDraft
+  hasAttachableFeedbackImage
 } from '@/lib/feedback-image-attachments'
+import { stripClientEnvironmentFooter } from '../../../../shared/client-environment-info'
 import { SidebarFeedbackImageAttachments } from './SidebarFeedbackImageAttachments'
-import { useFeedbackImageDrop } from './use-feedback-image-drop'
+import { useSidebarFeedbackEnvironmentPrefill } from './use-sidebar-feedback-environment-prefill'
+import { useSidebarFeedbackImages } from './use-sidebar-feedback-images'
 
 const GITHUB_ISSUES_URL = 'https://github.com/stablyai/orca/issues/'
 const DISCORD_URL = 'https://discord.gg/fzjDKHxv8Q'
@@ -66,98 +65,28 @@ export function SidebarFeedbackDialog({
   const [viewer, setViewer] = useState<GitHubViewer | null>(null)
   const [isViewerLoading, setIsViewerLoading] = useState(false)
   const [submitAnonymously, setSubmitAnonymously] = useState(false)
-  const [images, setImages] = useState<FeedbackImageDraft[]>([])
-  const [pendingImageReadCount, setPendingImageReadCount] = useState(0)
   const mountedRef = useMountedRef()
   const feedbackTextareaRef = useRef<HTMLTextAreaElement>(null)
-  const liveImageDraftsRef = useRef<FeedbackImageDraft[]>([])
+  const {
+    images,
+    pendingImageReadCount,
+    isDragActive,
+    contentRef,
+    dragHandlers,
+    handleAddFiles,
+    handleRemoveImage,
+    clearImages,
+    hasPendingImageReads,
+    getReservedImageSlots
+  } = useSidebarFeedbackImages({ open, isSubmitting, mountedRef })
 
-  const clearImages = React.useCallback(() => {
-    liveImageDraftsRef.current.forEach(releaseFeedbackImageDraft)
-    liveImageDraftsRef.current = []
-    setImages([])
-  }, [])
-
-  // Why: object URLs for the thumbnails leak until revoked, so drop them when
-  // the dialog unmounts as well as when an attachment is removed.
-  React.useEffect(
-    () => () => {
-      liveImageDraftsRef.current.forEach(releaseFeedbackImageDraft)
-      liveImageDraftsRef.current = []
-    },
-    []
-  )
-
-  const imageCount = images.length
-
-  // Why: committed state lags the in-flight reads, so batches still being read
-  // count against capacity — otherwise two quick pastes both see room for four.
-  const pendingImageReadsRef = useRef(0)
-
-  const handleAddFiles = React.useCallback(
-    (files: readonly File[]) => {
-      if (files.length === 0) {
-        return
-      }
-      if (isSubmitting) {
-        toast.warning(
-          translate(
-            'auto.components.sidebar.SidebarFeedbackDialog.attachWhileSending',
-            'Wait for the current feedback to finish sending before attaching more images.'
-          )
-        )
-        return
-      }
-      // Why: read the committed count from the closure rather than a ref. A ref
-      // synced in an effect can still be stale-low right after an add, which
-      // over-accepts and gets the whole submission rejected by the main process.
-      const existingCount = imageCount + pendingImageReadsRef.current
-      pendingImageReadsRef.current += files.length
-      setPendingImageReadCount((current) => current + files.length)
-      void readFeedbackImageFiles(files, existingCount).then(
-        ({ images: added, errors }) => {
-          pendingImageReadsRef.current -= files.length
-          if (!mountedRef.current) {
-            added.forEach(releaseFeedbackImageDraft)
-            return
-          }
-          setPendingImageReadCount((current) => Math.max(0, current - files.length))
-          if (added.length > 0) {
-            liveImageDraftsRef.current = [...liveImageDraftsRef.current, ...added]
-            setImages((existing) => [...existing, ...added])
-          }
-          // Why: never drop an attachment without telling the user — that
-          // silence is what made screenshots vanish in the first place.
-          errors.forEach((error) => toast.warning(error))
-        },
-        (error: unknown) => {
-          pendingImageReadsRef.current -= files.length
-          console.error('Failed to read feedback image attachments:', error)
-          if (mountedRef.current) {
-            setPendingImageReadCount((current) => Math.max(0, current - files.length))
-            toast.error(
-              translate(
-                'auto.components.sidebar.SidebarFeedbackDialog.imageReadFailed',
-                'Could not read the attached images. Try attaching them again.'
-              )
-            )
-          }
-        }
-      )
-    },
-    [imageCount, isSubmitting, mountedRef]
-  )
-
-  const handleRemoveImage = React.useCallback((id: string) => {
-    const removed = liveImageDraftsRef.current.find((image) => image.id === id)
-    if (removed) {
-      releaseFeedbackImageDraft(removed)
-      liveImageDraftsRef.current = liveImageDraftsRef.current.filter((image) => image.id !== id)
-    }
-    setImages((current) => current.filter((image) => image.id !== id))
-  }, [])
-
-  const { isDragActive, contentRef, dragHandlers } = useFeedbackImageDrop(open, handleAddFiles)
+  useSidebarFeedbackEnvironmentPrefill({
+    open,
+    feedback,
+    setFeedback,
+    textareaRef: feedbackTextareaRef,
+    mountedRef
+  })
 
   React.useEffect(() => {
     if (!open) {
@@ -191,11 +120,12 @@ export function SidebarFeedbackDialog({
   }, [open])
 
   const handleSubmit = async (): Promise<void> => {
-    if (isSubmitting || pendingImageReadsRef.current > 0) {
+    if (isSubmitting || hasPendingImageReads()) {
       return
     }
     const trimmed = feedback.trim()
-    if (!trimmed) {
+    const userText = stripClientEnvironmentFooter(feedback).trim()
+    if (!trimmed || !userText) {
       toast.warning(
         translate(
           'auto.components.sidebar.SidebarFeedbackDialog.a2fd890d9e',
@@ -287,7 +217,7 @@ export function SidebarFeedbackDialog({
           // Why: consume the paste only when something is actually attachable.
           // An unsupported image still routes through for its rejection toast,
           // but preventing default there would silently eat co-pasted text.
-          if (hasAttachableFeedbackImage(pasted, imageCount + pendingImageReadsRef.current)) {
+          if (hasAttachableFeedbackImage(pasted, getReservedImageSlots())) {
             event.preventDefault()
           }
           handleAddFiles(pasted)
@@ -430,7 +360,11 @@ export function SidebarFeedbackDialog({
           </Button>
           <Button
             onClick={() => void handleSubmit()}
-            disabled={isSubmitting || pendingImageReadCount > 0 || !feedback.trim()}
+            disabled={
+              isSubmitting ||
+              pendingImageReadCount > 0 ||
+              stripClientEnvironmentFooter(feedback).trim() === ''
+            }
           >
             {isSubmitting
               ? translate('auto.components.sidebar.SidebarFeedbackDialog.69969ba364', 'Sending…')
diff --git a/src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.test.tsx b/src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.test.tsx
index a98d881b09f..3afe412fb8f 100644
--- a/src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.test.tsx
+++ b/src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.test.tsx
@@ -33,6 +33,12 @@ function setState(overrides: Record<string, unknown> = {}): void {
     setHideCliCreatedWorkspaces: vi.fn(),
     hideDetachedHeadWorkspaces: false,
     setHideDetachedHeadWorkspaces: vi.fn(),
+    hideWorkspacesFromOtherDevices: false,
+    setHideWorkspacesFromOtherDevices: vi.fn(),
+    worktreesByRepo: {},
+    folderWorkspaces: [],
+    runtimeEnvironments: [],
+    runtimeStatusByEnvironmentId: new Map(),
     alwaysShowDefaultBranchWorkspace: true,
     setAlwaysShowDefaultBranchWorkspace: vi.fn(),
     ...overrides
@@ -83,4 +89,47 @@ describe('SidebarWorkspaceFilterSection', () => {
     render()
     expect(rowLabels()).not.toContain(EXEMPTION_LABEL)
   })
+
+  it('shows the other-client filter only when it can hide a known workspace', () => {
+    setState({
+      worktreesByRepo: {
+        repo: [
+          {
+            id: 'other',
+            runtimeOwnerEnvironmentId: 'server',
+            creatorProvenance: { kind: 'paired-device', deviceId: 'other-client' }
+          }
+        ]
+      },
+      runtimeEnvironments: [{ id: 'server', pairedDeviceId: 'this-client' }]
+    })
+    render()
+
+    expect(rowLabels()).toContain('Hide other-client workspaces')
+  })
+
+  it('hides the other-client filter when every known workspace belongs to this client', () => {
+    setState({
+      worktreesByRepo: {
+        repo: [
+          {
+            id: 'own',
+            runtimeOwnerEnvironmentId: 'server',
+            creatorProvenance: { kind: 'paired-device', deviceId: 'this-client' }
+          }
+        ]
+      },
+      runtimeEnvironments: [{ id: 'server', pairedDeviceId: 'this-client' }]
+    })
+    render()
+
+    expect(rowLabels()).not.toContain('Hide other-client workspaces')
+  })
+
+  it('keeps an enabled other-client filter available to turn off', () => {
+    setState({ hideWorkspacesFromOtherDevices: true })
+    render()
+
+    expect(rowLabels()).toContain('Hide other-client workspaces')
+  })
 })
diff --git a/src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.tsx b/src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.tsx
index 216009ae8b7..4186da051bb 100644
--- a/src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.tsx
+++ b/src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.tsx
@@ -1,8 +1,21 @@
-import React from 'react'
-import { CalendarClock, GitBranch, GitCommitHorizontal, Moon, SquareTerminal } from 'lucide-react'
+import React, { useMemo } from 'react'
+import {
+  CalendarClock,
+  GitBranch,
+  GitCommitHorizontal,
+  MonitorSmartphone,
+  Moon,
+  SquareTerminal
+} from 'lucide-react'
 import { useAppStore } from '@/store'
 import { translate } from '@/i18n/i18n'
+import { getIndexedAllWorktrees } from '@/store/worktree-repo-index'
 import { FilterToggleRow } from './FilterToggleRow'
+import {
+  getPairedDeviceIdsByEnvironment,
+  isFolderWorkspaceFromOtherDevice,
+  isWorkspaceFromOtherDevice
+} from './workspace-creator-visibility'
 
 const SidebarWorkspaceFilterSection = React.memo(function SidebarWorkspaceFilterSection() {
   const showSleepingWorkspaces = useAppStore((s) => s.showSleepingWorkspaces)
@@ -17,10 +30,43 @@ const SidebarWorkspaceFilterSection = React.memo(function SidebarWorkspaceFilter
   const setHideCliCreatedWorkspaces = useAppStore((s) => s.setHideCliCreatedWorkspaces)
   const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces)
   const setHideDetachedHeadWorkspaces = useAppStore((s) => s.setHideDetachedHeadWorkspaces)
+  const hideWorkspacesFromOtherDevices = useAppStore((s) => s.hideWorkspacesFromOtherDevices)
+  const setHideWorkspacesFromOtherDevices = useAppStore((s) => s.setHideWorkspacesFromOtherDevices)
+  const worktreesByRepo = useAppStore((s) => s.worktreesByRepo)
+  const folderWorkspaces = useAppStore((s) => s.folderWorkspaces)
+  const runtimeEnvironments = useAppStore((s) => s.runtimeEnvironments)
+  const runtimeStatusByEnvironmentId = useAppStore((s) => s.runtimeStatusByEnvironmentId)
   const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace)
   const setAlwaysShowDefaultBranchWorkspace = useAppStore(
     (s) => s.setAlwaysShowDefaultBranchWorkspace
   )
+  const showOtherClientFilter = useMemo(() => {
+    if (hideWorkspacesFromOtherDevices) {
+      return true
+    }
+    const pairedDeviceIds = getPairedDeviceIdsByEnvironment(
+      runtimeEnvironments,
+      runtimeStatusByEnvironmentId
+    )
+    const worktrees = getIndexedAllWorktrees(worktreesByRepo)
+    return (
+      worktrees.some(
+        (worktree) => !worktree.isArchived && isWorkspaceFromOtherDevice(worktree, pairedDeviceIds)
+      ) ||
+      folderWorkspaces.some((workspace) => {
+        if (workspace.isArchived) {
+          return false
+        }
+        return isFolderWorkspaceFromOtherDevice(workspace, pairedDeviceIds)
+      })
+    )
+  }, [
+    folderWorkspaces,
+    hideWorkspacesFromOtherDevices,
+    runtimeEnvironments,
+    runtimeStatusByEnvironmentId,
+    worktreesByRepo
+  ])
 
   return (
     <>
@@ -83,6 +129,21 @@ const SidebarWorkspaceFilterSection = React.memo(function SidebarWorkspaceFilter
         checked={hideCliCreatedWorkspaces}
         onChange={setHideCliCreatedWorkspaces}
       />
+      {showOtherClientFilter && (
+        <FilterToggleRow
+          icon={<MonitorSmartphone className="size-3.5" />}
+          label={translate(
+            'auto.components.sidebar.SidebarWorkspaceFilterSection.otherClients',
+            'Hide other-client workspaces'
+          )}
+          ariaLabel={translate(
+            'auto.components.sidebar.SidebarWorkspaceFilterSection.otherClientsAria',
+            'Hide workspaces created from other Orca clients on shared remote servers'
+          )}
+          checked={hideWorkspacesFromOtherDevices}
+          onChange={setHideWorkspacesFromOtherDevices}
+        />
+      )}
       <FilterToggleRow
         icon={<GitCommitHorizontal className="size-3.5" />}
         label={translate(
diff --git a/src/renderer/src/components/sidebar/SidebarWorkspaceOptionsMenu.tsx b/src/renderer/src/components/sidebar/SidebarWorkspaceOptionsMenu.tsx
index 1dca41c8915..302d654faea 100644
--- a/src/renderer/src/components/sidebar/SidebarWorkspaceOptionsMenu.tsx
+++ b/src/renderer/src/components/sidebar/SidebarWorkspaceOptionsMenu.tsx
@@ -41,6 +41,7 @@ const SidebarWorkspaceOptionsMenu = React.memo(function SidebarWorkspaceOptionsM
   const hideAutomationGeneratedWorkspaces = useAppStore((s) => s.hideAutomationGeneratedWorkspaces)
   const hideCliCreatedWorkspaces = useAppStore((s) => s.hideCliCreatedWorkspaces)
   const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces)
+  const hideWorkspacesFromOtherDevices = useAppStore((s) => s.hideWorkspacesFromOtherDevices)
   const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace)
   const filterRepoIds = useAppStore((s) => s.filterRepoIds)
   const repos = useAppStore((s) => s.repos)
@@ -92,6 +93,7 @@ const SidebarWorkspaceOptionsMenu = React.memo(function SidebarWorkspaceOptionsM
     hideAutomationGeneratedWorkspaces ||
     hideCliCreatedWorkspaces ||
     hideDetachedHeadWorkspaces ||
+    hideWorkspacesFromOtherDevices ||
     hasSleepingExemptionFilter ||
     hasRepoFilter ||
     hasHostVisibilityFilter
@@ -101,6 +103,7 @@ const SidebarWorkspaceOptionsMenu = React.memo(function SidebarWorkspaceOptionsM
     (hideAutomationGeneratedWorkspaces ? 1 : 0) +
     (hideCliCreatedWorkspaces ? 1 : 0) +
     (hideDetachedHeadWorkspaces ? 1 : 0) +
+    (hideWorkspacesFromOtherDevices ? 1 : 0) +
     (hasSleepingExemptionFilter ? 1 : 0) +
     (hasHostVisibilityFilter ? 1 : 0) +
     selectedCount
diff --git a/src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.mount-gating.test.tsx b/src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.mount-gating.test.tsx
new file mode 100644
index 00000000000..32f399610fa
--- /dev/null
+++ b/src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.mount-gating.test.tsx
@@ -0,0 +1,269 @@
+// @vitest-environment happy-dom
+
+import React, { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useAppStore } from '@/store'
+import { readStoreListenerCount } from '@/store/store-listener-census'
+import type * as ContextualTour from '@/components/contextual-tours/use-contextual-tour'
+import type * as VisibleWorkspaceKanban from './use-visible-workspace-kanban-worktree-ids'
+import WorkspaceKanbanDrawer from './WorkspaceKanbanDrawer'
+
+const { contentProbe, contextualTourMock } = vi.hoisted(() => ({
+  contentProbe: {
+    mounts: vi.fn(),
+    projections: vi.fn(),
+    renders: vi.fn(),
+    storeNotifications: vi.fn(),
+    unmounts: vi.fn()
+  },
+  contextualTourMock: vi.fn()
+}))
+
+vi.mock('sonner', () => ({ toast: { error: vi.fn(), warning: vi.fn() } }))
+
+vi.mock('@/components/ui/sheet', () => ({
+  // Why: keep children mounted while closed so this measures Orca's gate, not Radix's portal.
+  Sheet: ({ children, open }: { children: React.ReactNode; open?: boolean }) => (
+    <div data-sheet-open={open ? 'true' : 'false'}>{children}</div>
+  ),
+  SheetContent: ({
+    children,
+    'data-workspace-board-drag-preview': dragPreview
+  }: {
+    children: React.ReactNode
+    'data-workspace-board-drag-preview'?: string
+  }) => (
+    <div data-workspace-board-drag-preview={dragPreview} data-slot="sheet-content">
+      {children}
+    </div>
+  )
+}))
+
+vi.mock('./WorkspaceKanbanDrawerHeader', () => ({
+  default: () => <div data-workspace-board-heavy-content="true" />
+}))
+vi.mock('./WorkspaceKanbanLaneGrid', () => ({ default: () => <div /> }))
+vi.mock('./WorkspaceKanbanPinDropTarget', () => ({ default: () => <div /> }))
+vi.mock('./WorkspaceKanbanAreaSelectionOverlay', () => ({
+  default: React.forwardRef<HTMLDivElement>((_, ref) => <div ref={ref} />)
+}))
+
+vi.mock('./use-visible-workspace-kanban-worktree-ids', async (importOriginal) => {
+  const actual = await importOriginal<typeof VisibleWorkspaceKanban>()
+  return {
+    ...actual,
+    useVisibleWorkspaceKanbanWorktreeIds: (
+      params: Parameters<typeof actual.useVisibleWorkspaceKanbanWorktreeIds>[0]
+    ) => {
+      const visibleIds = actual.useVisibleWorkspaceKanbanWorktreeIds(params)
+      contentProbe.renders()
+      contentProbe.projections()
+      React.useEffect(() => {
+        contentProbe.mounts()
+        const unsubscribe = useAppStore.subscribe(() => contentProbe.storeNotifications())
+        return () => {
+          contentProbe.unmounts()
+          unsubscribe()
+        }
+      }, [])
+      return visibleIds
+    }
+  }
+})
+
+vi.mock('./use-workspace-kanban-selection', () => ({
+  useWorkspaceKanbanSelection: () => ({
+    selectedWorktreeIds: new Set<string>(),
+    selectedWorktrees: [],
+    selectionAnchorId: null,
+    updateSelectionForGesture: vi.fn(),
+    updateSelectionForArea: vi.fn(),
+    clearSelection: vi.fn(),
+    selectForContextMenu: vi.fn(() => [])
+  })
+}))
+vi.mock('./use-workspace-kanban-area-selection', () => ({
+  useWorkspaceKanbanAreaSelection: () => ({ handleAreaSelectionPointerDown: vi.fn() })
+}))
+vi.mock('./use-workspace-kanban-column-resize', () => ({
+  useWorkspaceKanbanColumnResize: () => ({
+    columnWidth: 308,
+    isResizingColumn: false,
+    onColumnResizeStart: vi.fn(),
+    onColumnResizeKeyDown: vi.fn()
+  })
+}))
+vi.mock('./use-workspace-kanban-card-pointer-drag', () => ({
+  useWorkspaceKanbanCardPointerDrag: () => ({
+    isPointerDragActiveRef: { current: false },
+    onCardPointerDownCapture: vi.fn()
+  })
+}))
+vi.mock('./use-workspace-kanban-shift-wheel-scroll', () => ({
+  useWorkspaceKanbanShiftWheelScroll: vi.fn()
+}))
+vi.mock('./use-workspace-kanban-outside-dismiss', () => ({
+  isWorkspaceBoardKeepOpenTarget: () => false,
+  useWorkspaceKanbanOutsideDismiss: vi.fn()
+}))
+vi.mock('./use-workspace-status-drop', () => ({ useWorkspaceStatusDocumentDrop: vi.fn() }))
+vi.mock('@/components/contextual-tours/use-contextual-tour', async (importOriginal) => {
+  const actual = await importOriginal<typeof ContextualTour>()
+  return {
+    ...actual,
+    useContextualTour: (...args: Parameters<typeof actual.useContextualTour>) => {
+      contextualTourMock(...args)
+      actual.useContextualTour(...args)
+    }
+  }
+})
+
+const initialAppState = useAppStore.getInitialState()
+const onOpenChange = vi.fn()
+const onMenuOpenChange = vi.fn()
+let testContainer: HTMLDivElement
+let testRoot: Root
+
+function activeContentSubscriptions(): number {
+  return contentProbe.mounts.mock.calls.length - contentProbe.unmounts.mock.calls.length
+}
+
+function requireStoreListenerCount(): number {
+  const count = readStoreListenerCount()
+  expect(count).not.toBeNull()
+  return count ?? 0
+}
+
+async function flushEffects(): Promise<void> {
+  await act(async () => {
+    await Promise.resolve()
+    await Promise.resolve()
+  })
+}
+
+async function renderDrawer(open: boolean, dragPreview = false): Promise<void> {
+  await act(async () => {
+    testRoot.render(
+      <WorkspaceKanbanDrawer
+        open={open}
+        statusBarVisible={true}
+        dragPreview={dragPreview}
+        preserveOpenForMenu={false}
+        onOpenChange={onOpenChange}
+        onMenuOpenChange={onMenuOpenChange}
+      />
+    )
+  })
+  await flushEffects()
+}
+
+async function churnRemoteWorkspaceState(count: number): Promise<void> {
+  await act(async () => {
+    for (let index = 0; index < count; index += 1) {
+      useAppStore.setState({
+        worktreesByRepo: {},
+        tabsByWorktree: {},
+        ptyIdsByTabId: {},
+        browserTabsByWorktree: {},
+        agentStatusEpoch: index
+      })
+    }
+  })
+}
+
+describe('WorkspaceKanbanDrawer mount gating', () => {
+  beforeEach(() => {
+    globalThis.IS_REACT_ACT_ENVIRONMENT = true
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    Object.values(contentProbe).forEach((probe) => probe.mockClear())
+    contextualTourMock.mockClear()
+    onOpenChange.mockClear()
+    onMenuOpenChange.mockClear()
+    useAppStore.setState(initialAppState, true)
+    testContainer = document.createElement('div')
+    document.body.appendChild(testContainer)
+    testRoot = createRoot(testContainer)
+  })
+
+  afterEach(async () => {
+    await act(async () => testRoot.unmount())
+    document.body.replaceChildren()
+    useAppStore.setState(initialAppState, true)
+    vi.clearAllTimers()
+    vi.useRealTimers()
+  })
+
+  it('unmounts heavy content after the close animation and isolates closed churn', async () => {
+    const listenerBaseline = requireStoreListenerCount()
+    await renderDrawer(false)
+    const closedListenerCount = requireStoreListenerCount()
+
+    expect(closedListenerCount).toBe(listenerBaseline)
+    expect(testContainer.querySelector('[data-workspace-board-heavy-content]')).toBeNull()
+    expect(activeContentSubscriptions()).toBe(0)
+
+    await renderDrawer(true)
+    const openListenerCount = requireStoreListenerCount()
+    expect(openListenerCount).toBeGreaterThan(closedListenerCount + 15)
+    expect(activeContentSubscriptions()).toBe(1)
+
+    await renderDrawer(false)
+    expect(testContainer.querySelector('[data-sheet-open="false"]')).not.toBeNull()
+    await act(async () => vi.advanceTimersByTimeAsync(299))
+    expect(testContainer.querySelector('[data-workspace-board-heavy-content]')).not.toBeNull()
+    expect(activeContentSubscriptions()).toBe(1)
+
+    const lingeringNotifications = contentProbe.storeNotifications.mock.calls.length
+    await churnRemoteWorkspaceState(1)
+    expect(contentProbe.storeNotifications).toHaveBeenCalledTimes(lingeringNotifications + 1)
+
+    await act(async () => vi.advanceTimersByTimeAsync(1))
+    expect(testContainer.querySelector('[data-workspace-board-heavy-content]')).toBeNull()
+    expect(activeContentSubscriptions()).toBe(0)
+    expect(requireStoreListenerCount()).toBe(closedListenerCount)
+
+    const hiddenProjectionCount = contentProbe.projections.mock.calls.length
+    const hiddenRenderCount = contentProbe.renders.mock.calls.length
+    const hiddenNotificationCount = contentProbe.storeNotifications.mock.calls.length
+    await churnRemoteWorkspaceState(1_000)
+
+    expect(contentProbe.projections).toHaveBeenCalledTimes(hiddenProjectionCount)
+    expect(contentProbe.renders).toHaveBeenCalledTimes(hiddenRenderCount)
+    expect(contentProbe.storeNotifications).toHaveBeenCalledTimes(hiddenNotificationCount)
+  })
+
+  it('cancels the pending unmount when reopened at 299 ms', async () => {
+    await renderDrawer(true)
+    await renderDrawer(false)
+    await act(async () => vi.advanceTimersByTimeAsync(299))
+    await renderDrawer(true)
+    await act(async () => vi.advanceTimersByTimeAsync(1_000))
+
+    expect(testContainer.querySelector('[data-sheet-open="true"]')).not.toBeNull()
+    expect(testContainer.querySelector('[data-workspace-board-heavy-content]')).not.toBeNull()
+    expect(activeContentSubscriptions()).toBe(1)
+  })
+
+  it('preserves drag preview presentation when the preview becomes a full board', async () => {
+    await renderDrawer(true, true)
+
+    expect(testContainer.querySelector('[data-workspace-board-drag-preview="true"]')).not.toBeNull()
+    expect(contextualTourMock).toHaveBeenLastCalledWith(
+      'workspace-board',
+      false,
+      'workspace_board_visible'
+    )
+
+    await renderDrawer(true, false)
+
+    expect(testContainer.querySelector('[data-workspace-board-drag-preview]')).toBeNull()
+    expect(contextualTourMock).toHaveBeenLastCalledWith(
+      'workspace-board',
+      true,
+      'workspace_board_visible'
+    )
+    expect(contentProbe.mounts).toHaveBeenCalledTimes(1)
+    expect(activeContentSubscriptions()).toBe(1)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.tsx b/src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.tsx
index d3998031dcb..b457c378a15 100644
--- a/src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.tsx
+++ b/src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.tsx
@@ -66,6 +66,9 @@ type WorkspaceKanbanDrawerProps = {
   onMenuOpenChange: (open: boolean) => void
 }
 
+// Why: outlast the Sheet close animation so the board does not disappear mid-slide.
+const WORKSPACE_BOARD_CLOSE_LINGER_MS = 300
+
 function formatTaskStatusSyncMessage(message: WorkspaceBoardTaskStatusSyncMessage): string {
   switch (message.kind) {
     case 'issue-read-failed':
@@ -140,7 +143,26 @@ function formatTaskStatusSyncDescription(result: WorkspaceBoardTaskStatusSyncRes
     .join('. ')
 }
 
-export default function WorkspaceKanbanDrawer({
+export default function WorkspaceKanbanDrawer(
+  props: WorkspaceKanbanDrawerProps
+): React.JSX.Element | null {
+  const [lingering, setLingering] = useState(props.open)
+  useEffect(() => {
+    if (props.open) {
+      setLingering(true)
+      return
+    }
+    const timer = window.setTimeout(() => setLingering(false), WORKSPACE_BOARD_CLOSE_LINGER_MS)
+    return () => window.clearTimeout(timer)
+  }, [props.open])
+
+  if (!props.open && !lingering) {
+    return null
+  }
+  return <WorkspaceKanbanDrawerContent {...props} />
+}
+
+function WorkspaceKanbanDrawerContent({
   leftSidebarStyle,
   open,
   statusBarVisible,
diff --git a/src/renderer/src/components/sidebar/WorktreeActivityStatusIndicator.test.tsx b/src/renderer/src/components/sidebar/WorktreeActivityStatusIndicator.test.tsx
deleted file mode 100644
index 633dce8a46e..00000000000
--- a/src/renderer/src/components/sidebar/WorktreeActivityStatusIndicator.test.tsx
+++ /dev/null
@@ -1,41 +0,0 @@
-import React from 'react'
-import { renderToStaticMarkup } from 'react-dom/server'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { WorktreeStatus } from '@/lib/worktree-status'
-import { WorktreeActivityStatusIndicator } from './WorktreeActivityStatusIndicator'
-
-const mocks = vi.hoisted(() => ({
-  status: 'inactive' as WorktreeStatus
-}))
-
-vi.mock('./use-worktree-activity-status', () => ({
-  useWorktreeActivityStatus: vi.fn(() => mocks.status)
-}))
-
-function renderMarkup(status: WorktreeStatus): string {
-  mocks.status = status
-  return renderToStaticMarkup(
-    React.createElement(WorktreeActivityStatusIndicator, { worktreeId: 'wt-child' })
-  )
-}
-
-describe('WorktreeActivityStatusIndicator', () => {
-  beforeEach(() => {
-    mocks.status = 'inactive'
-  })
-
-  it('renders the shared inactive status for slept worktrees', () => {
-    const markup = renderMarkup('inactive')
-
-    expect(markup).toContain('Inactive')
-    expect(markup).toContain('bg-neutral-500/40')
-    expect(markup).not.toContain('bg-emerald-500')
-  })
-
-  it('renders the shared active status when the worktree is live', () => {
-    const markup = renderMarkup('active')
-
-    expect(markup).toContain('Active')
-    expect(markup).toContain('bg-emerald-500')
-  })
-})
diff --git a/src/renderer/src/components/sidebar/WorktreeActivityStatusIndicator.tsx b/src/renderer/src/components/sidebar/WorktreeActivityStatusIndicator.tsx
deleted file mode 100644
index be187336da8..00000000000
--- a/src/renderer/src/components/sidebar/WorktreeActivityStatusIndicator.tsx
+++ /dev/null
@@ -1,21 +0,0 @@
-import React from 'react'
-import { getWorktreeStatusLabel } from '@/lib/worktree-status'
-import StatusIndicator from './StatusIndicator'
-import { useWorktreeActivityStatus } from './use-worktree-activity-status'
-
-export function WorktreeActivityStatusIndicator({
-  worktreeId,
-  className
-}: {
-  worktreeId: string
-  className?: string
-}): React.JSX.Element {
-  const status = useWorktreeActivityStatus(worktreeId)
-
-  return (
-    <>
-      <StatusIndicator status={status} aria-hidden="true" className={className} />
-      <span className="sr-only">{getWorktreeStatusLabel(status)}</span>
-    </>
-  )
-}
diff --git a/src/renderer/src/components/sidebar/WorktreeCard.tsx b/src/renderer/src/components/sidebar/WorktreeCard.tsx
index b53a03ec833..b26643fb68d 100644
--- a/src/renderer/src/components/sidebar/WorktreeCard.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCard.tsx
@@ -1,211 +1,11 @@
-/* eslint-disable max-lines -- Why: the worktree card centralizes sidebar card state (selection, drag, agent status, git info, context menu) in one cohesive component so sidebar rendering doesn't fan out across files. */
-import React, { useEffect, useCallback, useState } from 'react'
-import { useAppStore } from '@/store'
-import { getHostedReviewCacheKey } from '@/store/slices/hosted-review'
-import { issueCacheKey as getIssueCacheKey } from '@/store/slices/github'
-import { getGitHubPRCacheKey } from '@/store/slices/github-cache-key'
-import { Badge } from '@/components/ui/badge'
-import { Button } from '@/components/ui/button'
-import { Tooltip, TooltipTrigger, TooltipContent } from '@/components/ui/tooltip'
-import {
-  AlertCircle,
-  AlertTriangle,
-  ChevronDown,
-  GitMerge,
-  LoaderCircle,
-  Server,
-  ServerOff,
-  Star,
-  Trash2,
-  Workflow
-} from 'lucide-react'
-import CacheTimer, { usePromptCacheCountdownStartedAt } from './CacheTimer'
-import WorktreeContextMenu from './WorktreeContextMenu'
-import { AutoRenameFailedDialog } from './AutoRenameFailedDialog'
-import { LinearAgentSkillSetupPrompt } from './LinearAgentSkillSetupPrompt'
-import WorktreeCardAgents from './WorktreeCardAgents'
-import { useWorktreeAgentRows } from './useWorktreeAgentRows'
-import { WorktreeCardStatusSlot } from './WorktreeCardStatusSlot'
-import { cn } from '@/lib/utils'
-import { WorktreeCardSshHostControl } from './WorktreeCardSshHostControl'
-import { activateWorktreeFromSidebar } from '@/lib/sidebar-worktree-activation'
-import { isFolderRepo } from '../../../../shared/repo-kind'
-import type { HostedReviewInfo } from '../../../../shared/hosted-review'
-import { hostedReviewInfoFromGitHubPRInfo } from '../../../../shared/hosted-review-github'
-import type {
-  GitHubWorkItem,
-  Worktree,
-  WorkspaceStatus,
-  Repo,
-  IssueInfo,
-  LinearIssue
-} from '../../../../shared/types'
-import { CONFLICT_OPERATION_LABELS } from './WorktreeCardHelpers'
-import {
-  WorktreeCardDetailsHover,
-  hasWorktreeCardDetails,
-  WorktreeCardMetaBadges,
-  type WorktreeCardIssueDisplay
-} from './WorktreeCardMeta'
-import { getWorktreeCardJiraIssueDisplay } from './worktree-card-jira-issue-display'
-import { WorktreeCardPortsDetails, WorktreeCardPortsTrigger } from './WorktreeCardPorts'
-import { writeWorkspaceDragData } from './workspace-status'
-import {
-  getWorktreeCardPrDisplay,
-  isCachedMergedBranchPRCurrentForWorktree
-} from './worktree-card-pr-display'
-import type { WorktreeCardPrDisplay } from './worktree-card-pr-display'
-import {
-  coerceWorktreeCardVisibleTitle,
-  getWorktreeCardTitleDisplay
-} from './worktree-card-title-display'
-import { useWorktreeCardDetailsHoverControl } from './worktree-card-details-hover-state'
-import { isEventTargetInsideCurrentTarget } from './worktree-card-dom-events'
-import { getWorkspacePortsByWorktreeId } from '@/lib/workspace-port-groups'
-import { RepoBadgeMark } from '@/components/repo/RepoBadgeLabel'
-import { RepoIconGlyph } from '@/components/repo/repo-icon'
-import { resolveRepoHeaderColor } from './project-header-color'
-import { installWindowVisibilityInterval, isWindowVisible } from '@/lib/window-visibility-interval'
-import { isMacAppDataPath } from '@/lib/passive-macos-app-data-access'
-import { runWorktreeDelete } from './delete-worktree-flow'
-import { WorktreeTitleInlineRename } from './WorktreeTitleInlineRename'
-import { TruncatedSidebarLabel } from './truncated-sidebar-label'
-import {
-  canShowWorkspaceDeleteQuickAction,
-  useWorkspaceDeleteModifierPressed
-} from './workspace-delete-quick-action'
-import { DetachedHeadBadge } from '@/components/DetachedHeadBadge'
-import { getWorktreeGitIdentityDisplay } from '@/lib/worktree-git-identity-display'
-import {
-  getFlushWorktreeCardPaddingLeft,
-  getNewCardStyleParentContentMarginLeft
-} from './worktree-list-indentation'
-import { translate } from '@/i18n/i18n'
-import { recordRendererCrashBreadcrumb } from '@/lib/crash-diagnostics'
-import { folderWorkspaceKey, parseWorkspaceKey } from '../../../../shared/workspace-scope'
-import {
-  getRepoExecutionHostId,
-  isRuntimeOwnedSshTargetId,
-  parseExecutionHostId,
-  toRuntimeExecutionHostId
-} from '../../../../shared/execution-host'
-import { getHostDisplayLabelOverrides } from '../../../../shared/host-setting-overrides'
-import { DEFAULT_AGENT_ACTIVITY_DISPLAY_MODE } from '../../../../shared/constants'
-import { getExplicitRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
-import {
-  selectRuntimeAwareSshStatus,
-  selectRuntimeAwareSshTargetLabel,
-  selectRuntimeAwareSshTargetRemoved
-} from '@/store/slices/runtime-environment-ssh'
-import { hydrateRuntimeEnvironmentSshState } from '@/runtime/runtime-environment-ssh-state'
+import React from 'react'
 
-type WorktreeRenameRequest = {
-  worktreeId: string
-  rowKey?: string
-}
+import { WorktreeCardSurface } from './worktree-card-surface'
+import type { WorktreeCardProps } from './worktree-card-model'
+import { useWorktreeCardController } from './use-worktree-card-controller'
 
-export type ActiveSurfaceVariant = 'primary' | 'secondary'
-
-type WorktreeCardProps = {
-  worktree: Worktree
-  repo: Repo | undefined
-  isActive: boolean
-  isCurrentWorktree?: boolean
-  isActiveSurface?: boolean
-  activeSurfaceVariant?: ActiveSurfaceVariant
-  isMultiSelected?: boolean
-  revealHighlight?: boolean
-  revealHighlightTone?: 'default' | 'ai'
-  selectedWorktrees?: readonly Worktree[]
-  hideRepoBadge?: boolean
-  hostContextLabel?: string
-  inPinnedSection?: boolean
-  activationRowKey?: string
-  renameRowKey?: string
-  contentIndent?: number
-  flushSurface?: boolean
-  lineageChildCount?: number
-  lineageCollapsed?: boolean
-  lineageChildren?: React.ReactNode
-  lineageChildrenStyle?: React.CSSProperties
-  onLineageToggle?: (event: React.MouseEvent<HTMLButtonElement>) => void
-  isLineageDropTarget?: boolean
-  onActivate?: () => void
-  onImmediateActivate?: (worktreeId: string, rowKey: string | undefined) => void
-  onSelectionGesture?: (event: React.MouseEvent<HTMLElement>, worktreeId: string) => boolean
-  onContextMenuSelect?: (
-    event: React.MouseEvent<HTMLElement>,
-    worktree: Worktree
-  ) => readonly Worktree[]
-  onAssignWorkspaceStatus?: (worktreeIds: readonly string[], status: WorkspaceStatus) => void
-  onCardDragStart?: (
-    event: React.DragEvent<HTMLDivElement>,
-    worktreeId: string,
-    draggedIds: readonly string[]
-  ) => void
-  onCardDragEnd?: (event: React.DragEvent<HTMLDivElement>) => void
-  nativeDragEnabled?: boolean
-  affiliateListMode?: boolean
-  statusPrDisplay?: WorktreeCardPrDisplay | null
-}
-
-const EMPTY_WORKSPACE_PORTS = []
-const HOSTED_REVIEW_CARD_REFRESH_INTERVAL_MS = 60_000
-
-export function shouldBeginWorktreeRename(
-  request: WorktreeRenameRequest | null,
-  worktreeId: string,
-  rowKey: string | undefined
-): boolean {
-  return (
-    request?.worktreeId === worktreeId &&
-    (request.rowKey === undefined || request.rowKey === rowKey)
-  )
-}
-
-function formatSparseDirectoryPreview(directories: string[]): string {
-  const preview = directories.slice(0, 4).join(', ')
-  return directories.length <= 4 ? preview : `${preview}, +${directories.length - 4} more`
-}
-
-function isWebClient(): boolean {
-  return Boolean((window as unknown as { __ORCA_WEB_CLIENT__?: boolean }).__ORCA_WEB_CLIENT__)
-}
-
-function getDirectoryName(folderPath: string): string {
-  const normalized = folderPath.replace(/[\\/]+$/, '')
-  const parts = normalized.split(/[\\/]+/)
-  return parts.at(-1) || normalized || folderPath
-}
-
-// Why: pinned repo icon and compact inline badge share this chip shell so both repo cues read as the same affordance.
-function RepoIdentityChip({
-  repo,
-  children
-}: {
-  repo: Repo
-  children: React.ReactNode
-}): React.JSX.Element {
-  return (
-    <Tooltip>
-      <TooltipTrigger asChild>
-        <span
-          className="inline-flex size-4 shrink-0 items-center justify-center rounded-[4px] border border-worktree-sidebar-border bg-worktree-sidebar-accent/55"
-          aria-label={translate(
-            'auto.components.sidebar.WorktreeCard.35ccfe2475',
-            'Project {{value0}}',
-            { value0: repo.displayName }
-          )}
-        >
-          {children}
-        </span>
-      </TooltipTrigger>
-      <TooltipContent side="right" sideOffset={8}>
-        {repo.displayName}
-      </TooltipContent>
-    </Tooltip>
-  )
-}
+export { shouldBeginWorktreeRename } from './worktree-card-model'
+export type { ActiveSurfaceVariant } from './worktree-card-model'
 
 const WorktreeCard = React.memo(function WorktreeCard({
   worktree,
@@ -240,1719 +40,43 @@ const WorktreeCard = React.memo(function WorktreeCard({
   isLineageDropTarget = false,
   affiliateListMode = false,
   statusPrDisplay = null
-}: WorktreeCardProps) {
-  const openModal = useAppStore((s) => s.openModal)
-  const openTaskPage = useAppStore((s) => s.openTaskPage)
-  const openAutomationsPage = useAppStore((s) => s.openAutomationsPage)
-  const setPendingAutomationRunNavigation = useAppStore((s) => s.setPendingAutomationRunNavigation)
-  const updateWorktreeMeta = useAppStore((s) => s.updateWorktreeMeta)
-  const deleteFolderWorkspace = useAppStore((s) => s.deleteFolderWorkspace)
-  const setActiveWorktree = useAppStore((s) => s.setActiveWorktree)
-  const renamingWorktreeId = useAppStore((s) => s.renamingWorktreeId)
-  const setRenamingWorktreeId = useAppStore((s) => s.setRenamingWorktreeId)
-  const fetchHostedReviewForBranch = useAppStore((s) => s.fetchHostedReviewForBranch)
-  const settings = useAppStore((s) => s.settings)
-  const fetchIssue = useAppStore((s) => s.fetchIssue)
-  const fetchLinearIssue = useAppStore((s) => s.fetchLinearIssue)
-  const cardProps = useAppStore((s) => s.worktreeCardProperties)
-  const agentActivityDisplayMode =
-    useAppStore((s) => s.agentActivityDisplayMode) ?? DEFAULT_AGENT_ACTIVITY_DISPLAY_MODE
-  const projectGroups = useAppStore((s) => s.projectGroups)
-  const newCardStyle = settings?.experimentalNewWorktreeCardStyle === true
-  const compactCards = !newCardStyle && settings?.compactWorktreeCards === true
-  const handleEditIssue = useCallback(
-    (e: React.MouseEvent) => {
-      e.stopPropagation()
-      openModal('edit-meta', {
-        worktreeId: worktree.id,
-        // Why: the same workspace ID can exist under two hosts. Naming the owner
-        // keeps the dialog on the clicked row instead of the ambiguous lookup.
-        repoId: worktree.repoId,
-        currentDisplayName: worktree.displayName,
-        currentIssue: worktree.linkedIssue,
-        currentPR: worktree.linkedPR,
-        currentComment: worktree.comment,
-        focus: 'issue'
-      })
-    },
-    [worktree, openModal]
-  )
-
-  const handleEditComment = useCallback(
-    (e: React.MouseEvent) => {
-      e.stopPropagation()
-      openModal('edit-meta', {
-        worktreeId: worktree.id,
-        repoId: worktree.repoId,
-        currentDisplayName: worktree.displayName,
-        currentIssue: worktree.linkedIssue,
-        currentPR: worktree.linkedPR,
-        currentComment: worktree.comment,
-        focus: 'comment'
-      })
-    },
-    [worktree, openModal]
-  )
-
-  const handleOpenAutomation = useCallback(
-    (e: React.MouseEvent) => {
-      e.stopPropagation()
-      const automationId = worktree.automationProvenance?.automationId
-      if (!automationId) {
-        return
-      }
-      const hostId = worktree.automationProvenance?.hostId ?? worktree.hostId
-      setPendingAutomationRunNavigation({
-        automationId,
-        runId: null,
-        ...(hostId ? { hostId } : {})
-      })
-      openAutomationsPage()
-    },
-    [
-      openAutomationsPage,
-      setPendingAutomationRunNavigation,
-      worktree.automationProvenance?.automationId,
-      worktree.automationProvenance?.hostId,
-      worktree.hostId
-    ]
-  )
-
-  const handleOpenAutomationRun = useCallback(
-    (e: React.MouseEvent) => {
-      e.stopPropagation()
-      const provenance = worktree.automationProvenance
-      if (!provenance) {
-        return
-      }
-      const hostId = provenance.hostId ?? worktree.hostId
-      setPendingAutomationRunNavigation({
-        automationId: provenance.automationId,
-        runId: provenance.automationRunId,
-        ...(hostId ? { hostId } : {})
-      })
-      openAutomationsPage()
-    },
-    [
-      openAutomationsPage,
-      setPendingAutomationRunNavigation,
-      worktree.automationProvenance,
-      worktree.hostId
-    ]
-  )
-
-  const deleteState = useAppStore((s) => s.deleteStateByWorktreeId[worktree.id])
-  const conflictOperation = useAppStore((s) => s.gitConflictOperationByWorktree[worktree.id])
-  const remoteBranchConflict = useAppStore((s) => s.remoteBranchConflictByWorktreeId[worktree.id])
-  const workspacePorts = useAppStore(
-    (s) =>
-      getWorkspacePortsByWorktreeId(s.workspacePortScan?.result).get(worktree.id) ??
-      EMPTY_WORKSPACE_PORTS
-  )
-
-  // SSH disconnected state
-  const sshOwnerEnvironmentId = useAppStore((s) =>
-    repo?.connectionId ? getExplicitRuntimeEnvironmentIdForWorktree(s, worktree.id) : null
-  )
-  const sshStatus = useAppStore((s) => {
-    // Why: runtime-owned SSH targets suppress their ssh:state-changed broadcasts, so don't show a false "disconnected" chip for them.
-    if (!repo?.connectionId || isRuntimeOwnedSshTargetId(repo.connectionId)) {
-      return null
-    }
-    return selectRuntimeAwareSshStatus(s, sshOwnerEnvironmentId, repo.connectionId)
-  })
-  useEffect(() => {
-    if (sshOwnerEnvironmentId) {
-      void hydrateRuntimeEnvironmentSshState(sshOwnerEnvironmentId).catch(() => {})
-    }
-  }, [sshOwnerEnvironmentId])
-  const isSshDisconnected = sshStatus != null && sshStatus !== 'connected'
-  // Why: only reported on positive evidence, so a removed host never offers a Connect that can
-  // only fail. Runtime-owned targets are excluded for the same reason sshStatus excludes them —
-  // ssh:listTargets filters them out, so "absent from the target list" is not evidence of removal.
-  const sshTargetRemoved = useAppStore((s) =>
-    repo?.connectionId && !isRuntimeOwnedSshTargetId(repo.connectionId)
-      ? selectRuntimeAwareSshTargetRemoved(s, sshOwnerEnvironmentId, repo.connectionId)
-      : false
-  )
-
-  const parsedRepoHost = parseExecutionHostId(repo?.executionHostId)
-  const runtimeOwnerEnvironmentId =
-    worktree.runtimeOwnerEnvironmentId ??
-    (parsedRepoHost?.kind === 'runtime' ? parsedRepoHost.environmentId : null)
-  const runtimeHostId = runtimeOwnerEnvironmentId
-    ? toRuntimeExecutionHostId(runtimeOwnerEnvironmentId)
-    : null
-  const runtimeEnvironmentName = useAppStore((s) =>
-    runtimeOwnerEnvironmentId
-      ? (s.runtimeEnvironments.find((environment) => environment.id === runtimeOwnerEnvironmentId)
-          ?.name ?? null)
-      : null
-  )
-  const runtimeHostLabel = runtimeHostId
-    ? (getHostDisplayLabelOverrides(settings).get(runtimeHostId) ?? runtimeEnvironmentName)
-    : null
-  // Why: runtime ("Orca server") hosts get the same disconnected dimming as SSH when their environment has no live status.
-  const isRuntimeDisconnected = useAppStore((s) => {
-    if (!runtimeOwnerEnvironmentId) {
-      return false
-    }
-    return !s.runtimeStatusByEnvironmentId.get(runtimeOwnerEnvironmentId)?.status
-  })
-  const [titleRenaming, setTitleRenaming] = useState(false)
-  const [showRenameErrorDialog, setShowRenameErrorDialog] = useState(false)
-  // Why: read the target label from its owning host's store instead of exposing HUB-private SSH metadata as client-local state.
-  const sshTargetLabel = useAppStore((s) =>
-    repo?.connectionId
-      ? selectRuntimeAwareSshTargetLabel(s, sshOwnerEnvironmentId, repo.connectionId)
-      : ''
-  )
-
-  const gitIdentityDisplay = getWorktreeGitIdentityDisplay(worktree)
-  const detachedHeadDisplay = gitIdentityDisplay?.kind === 'detached' ? gitIdentityDisplay : null
-  const branch = gitIdentityDisplay?.kind === 'branch' ? gitIdentityDisplay.branchName : ''
-  const workspaceScope = parseWorkspaceKey(worktree.id)
-  const folderWorkspaceId =
-    workspaceScope?.type === 'folder' ? workspaceScope.folderWorkspaceId : null
-  const isFolder = repo ? isFolderRepo(repo) : folderWorkspaceId !== null
-  // Why: project groups gate folder workspaces, so folder paths stay hidden from identity surfaces until that capability exists.
-  const hasProjectGroups = projectGroups.length > 0
-  const branchIdentityDisplay = !isFolder && branch.length > 0 ? branch : undefined
-  const folderPathIdentityDisplay =
-    isFolder && hasProjectGroups && worktree.path.trim().length > 0 ? worktree.path : undefined
-  const identityDisplay = branchIdentityDisplay ?? folderPathIdentityDisplay
-  const hasPathIdentityEnabled = cardProps.includes('branch')
-  const showIdentityInNewCard = newCardStyle && hasPathIdentityEnabled && Boolean(identityDisplay)
-  const folderMetaRowContent = newCardStyle
-    ? hasPathIdentityEnabled && Boolean(folderPathIdentityDisplay)
-    : isFolder
-  const hostedReviewCacheKey =
-    repo && branch
-      ? getHostedReviewCacheKey(
-          repo.path,
-          branch,
-          settings,
-          repo.id,
-          repo.connectionId,
-          repo.executionHostId,
-          true
-        )
-      : ''
-  const prCacheKey =
-    repo && branch
-      ? getGitHubPRCacheKey(
-          repo.path,
-          repo.id,
-          branch,
-          settings,
-          repo.connectionId,
-          repo.executionHostId,
-          true
-        )
-      : ''
-  const issueCacheKey =
-    repo && worktree.linkedIssue
-      ? getIssueCacheKey(
-          repo.path,
-          repo.id,
-          worktree.linkedIssue,
-          settings,
-          repo.connectionId,
-          repo.executionHostId,
-          true
-        )
-      : ''
-  // Why: use 'all' — the issue may belong to a different Linear workspace than the selected one.
-  const linearIssueCacheKey = worktree.linkedLinearIssue ? `all::${worktree.linkedLinearIssue}` : ''
-
-  // Subscribe to ONLY the specific cache entry, not entire review/issue caches.
-  const hostedReviewEntry = useAppStore((s) =>
-    hostedReviewCacheKey ? s.hostedReviewCache[hostedReviewCacheKey] : undefined
-  )
-  const prCacheEntry = useAppStore((s) => (prCacheKey ? s.prCache?.[prCacheKey] : undefined))
-  const issueEntry = useAppStore((s) => (issueCacheKey ? s.issueCache[issueCacheKey] : undefined))
-  const linearIssueEntry = useAppStore((s) =>
-    linearIssueCacheKey ? s.linearIssueCache[linearIssueCacheKey] : undefined
-  )
-  const linearIssueFallbackEntry = useAppStore((s) =>
-    worktree.linkedLinearIssue ? s.linearIssueCache[worktree.linkedLinearIssue] : undefined
-  )
-
-  const hostedReview: HostedReviewInfo | null | undefined =
-    hostedReviewEntry !== undefined ? hostedReviewEntry.data : undefined
-  const linkedGitHubPR = worktree.linkedPR ?? null
-  const linkedGitLabMR = worktree.linkedGitLabMR ?? null
-  const linkedBitbucketPR = worktree.linkedBitbucketPR ?? null
-  const linkedAzureDevOpsPR = worktree.linkedAzureDevOpsPR ?? null
-  const linkedGiteaPR = worktree.linkedGiteaPR ?? null
-  const hasNonGitHubLinkedReview =
-    linkedGitLabMR !== null ||
-    linkedBitbucketPR !== null ||
-    linkedAzureDevOpsPR !== null ||
-    linkedGiteaPR !== null
-  const hasLinkedReview =
-    linkedGitHubPR !== null ||
-    linkedGitLabMR !== null ||
-    linkedBitbucketPR !== null ||
-    linkedAzureDevOpsPR !== null ||
-    linkedGiteaPR !== null
-  // Why: a newer hosted-review miss trusts the merged-PR cache only when the stored head proves it still describes the current commit.
-  const cachedBranchPR = prCacheEntry?.data
-  const cachedBranchPRFetchedAt = prCacheEntry?.fetchedAt
-  const cachedMergedBranchPRMatchesCurrentHead = isCachedMergedBranchPRCurrentForWorktree(
-    cachedBranchPR,
-    worktree
-  )
-  const cachedBranchFallbackGitHubPRNumber =
-    linkedGitHubPR === null &&
-    !hasNonGitHubLinkedReview &&
-    cachedBranchPR?.number !== undefined &&
-    (cachedBranchPR.state !== 'merged' || cachedMergedBranchPRMatchesCurrentHead)
-      ? cachedBranchPR.number
-      : null
-  const cachedBranchPRCanDriveDisplay =
-    cachedBranchPR?.state !== 'merged' || cachedMergedBranchPRMatchesCurrentHead
-  const hostedReviewMatchesHeadMatchedCachedMergedPR =
-    cachedMergedBranchPRMatchesCurrentHead &&
-    cachedBranchPR !== null &&
-    cachedBranchPR !== undefined &&
-    hostedReview?.provider === 'github' &&
-    hostedReview.number === cachedBranchPR.number
-  const useCachedBranchReview =
-    cachedBranchPR !== undefined &&
-    cachedBranchPR !== null &&
-    !hasNonGitHubLinkedReview &&
-    cachedBranchPRCanDriveDisplay &&
-    (hostedReview === undefined ||
-      (cachedMergedBranchPRMatchesCurrentHead && !hostedReviewMatchesHeadMatchedCachedMergedPR) ||
-      (hostedReview === null &&
-        ((cachedBranchPRFetchedAt !== undefined &&
-          cachedBranchPRFetchedAt > (hostedReviewEntry?.fetchedAt ?? 0)) ||
-          cachedMergedBranchPRMatchesCurrentHead)))
-  const cachedBranchReview = useCachedBranchReview
-    ? hostedReviewInfoFromGitHubPRInfo(cachedBranchPR)
-    : hostedReview
-  // Why: branch provenance does not supersede the head-ownership gate for merged PRs.
-  const branchLookupGitHubPRNumber =
-    hostedReview?.provider === 'github' &&
-    hostedReview.state === 'merged' &&
-    !isCachedMergedBranchPRCurrentForWorktree(hostedReview, worktree)
-      ? null
-      : hostedReviewEntry?.branchLookupGitHubPRNumber
-  const prDisplay = getWorktreeCardPrDisplay(
-    cachedBranchReview,
-    linkedGitHubPR,
-    linkedGitLabMR,
-    linkedBitbucketPR,
-    linkedAzureDevOpsPR,
-    linkedGiteaPR,
-    {
-      reviewHintKey:
-        (useCachedBranchReview || cachedMergedBranchPRMatchesCurrentHead) && !hasLinkedReview
-          ? ''
-          : hostedReviewEntry?.linkedReviewHintKey,
-      branchLookupGitHubPRNumber
-    }
-  )
-  const issue: IssueInfo | null | undefined = worktree.linkedIssue
-    ? issueEntry !== undefined
-      ? issueEntry.data
-      : undefined
-    : null
-  const issueDisplay: WorktreeCardIssueDisplay | null =
-    issue ??
-    (worktree.linkedIssue
-      ? {
-          number: worktree.linkedIssue,
-          // Why: linked metadata persists immediately but GitHub details arrive async; show the link number so it doesn't look unlinked.
-          title: issue === null ? 'Issue details unavailable' : 'Loading issue...'
-        }
-      : null)
-  const linearStatus = useAppStore((s) => s.linearStatus)
-  const linearIssue: LinearIssue | null | undefined = worktree.linkedLinearIssue
-    ? (linearIssueEntry?.data ?? linearIssueFallbackEntry?.data)
-    : null
-
-  // Why: build a fallback Linear URL from org key + identifier while full issue data is still loading, so the link stays navigable.
-  const linearOrgUrlKey = linearStatus?.viewer?.organizationUrlKey
-  const linearWorkspaceUrlKeys = linearStatus?.workspaces?.map((ws) => ({
-    id: ws.id,
-    organizationUrlKey: ws.organizationUrlKey
-  }))
-  const linearIssueUrlFallback = React.useMemo(() => {
-    if (!worktree.linkedLinearIssue || linearIssue?.url) {
-      return undefined
-    }
-
-    // Try to get the orgUrlKey from the issue's workspace if we have workspaceId
-    let orgUrlKey: string | undefined
-    if (linearIssue?.workspaceId && linearWorkspaceUrlKeys) {
-      const issueWorkspace = linearWorkspaceUrlKeys.find((ws) => ws.id === linearIssue.workspaceId)
-      orgUrlKey = issueWorkspace?.organizationUrlKey
-    }
-
-    // Fall back to current viewer's org if no workspace match
-    if (!orgUrlKey) {
-      orgUrlKey = linearOrgUrlKey
-    }
-
-    if (!orgUrlKey) {
-      return undefined
-    }
-
-    return `https://linear.app/${encodeURIComponent(orgUrlKey)}/issue/${encodeURIComponent(worktree.linkedLinearIssue)}`
-  }, [
-    worktree.linkedLinearIssue,
-    linearIssue?.url,
-    linearIssue?.workspaceId,
-    linearOrgUrlKey,
-    linearWorkspaceUrlKeys
-  ])
-
-  const linearIssueDisplay = worktree.linkedLinearIssue
-    ? linearIssue
-      ? {
-          identifier: linearIssue.identifier,
-          title: linearIssue.title,
-          url: linearIssue.url,
-          stateName: linearIssue.state?.name,
-          labels: linearIssue.labels
-        }
-      : {
-          identifier: worktree.linkedLinearIssue,
-          title:
-            linearIssueEntry || linearIssueFallbackEntry
-              ? 'Linear issue details unavailable'
-              : 'Loading Linear issue...',
-          url: linearIssueUrlFallback
-        }
-    : null
-  const jiraIssueDisplay = getWorktreeCardJiraIssueDisplay(worktree)
-  const cardTitleDisplay = getWorktreeCardTitleDisplay({
-    storedDisplayName: worktree.displayName,
-    branchName: branch,
-    linearIssueTitle: linearIssueDisplay?.title,
-    jiraIssueTitle: jiraIssueDisplay?.title,
-    issueTitle: issueDisplay?.title,
-    reviewTitle: prDisplay?.title
-  })
-  const legacyCardTitleDisplay = coerceWorktreeCardVisibleTitle(worktree.displayName)
-  const visibleCardTitle = newCardStyle ? cardTitleDisplay : legacyCardTitleDisplay
-  const isDeleting = deleteState?.isDeleting ?? false
-  const isQueuedForDeletion = deleteState?.phase === 'queued'
-  const deleteLabel = isQueuedForDeletion
-    ? translate('auto.components.sidebar.WorktreeCard.ef18787206', 'Queued for deletion')
-    : translate('auto.components.sidebar.WorktreeCard.691ccfd622', 'Deleting…')
-  const deleteModifierPressed = useWorkspaceDeleteModifierPressed()
-
-  const showStatus = cardProps.includes('status')
-  const showIssue = cardProps.includes('issue')
-  const showLinearIssue = cardProps.includes('linear-issue')
-  const showJiraIssue = cardProps.includes('jira-issue')
-  const showPR = cardProps.includes('pr')
-  const showAutomation = cardProps.includes('automation')
-  const showCli = cardProps.includes('cli')
-  const showComment = cardProps.includes('comment')
-  const showPorts = cardProps.includes('ports')
-  const shouldRefreshHostedReview = newCardStyle ? showStatus : showPR
-  const detailsHoverControl = useWorktreeCardDetailsHoverControl()
-  const hoverDetailsOpen = detailsHoverControl.hoverOpen
-
-  // Why: card surfaces are presentational, so skip hosted-review fetches when hidden to save rate-limit budget.
-  useEffect(() => {
-    // Why: paired web must not fan out per-card decoration RPCs during startup; host session/tab parity is critical.
-    if (isWebClient()) {
-      return
-    }
-    if (
-      !repo ||
-      isFolder ||
-      worktree.isBare ||
-      !hostedReviewCacheKey ||
-      !shouldRefreshHostedReview ||
-      isMacAppDataPath(repo.path)
-    ) {
-      return
-    }
-    const refreshHostedReview = (): void => {
-      // Why: branch lookup is lossy for fork/deleted-head PRs; reuse a known PR number from explicit metadata when we have one.
-      void fetchHostedReviewForBranch(repo.path, branch, {
-        repoId: repo.id,
-        linkedGitHubPR: worktree.linkedPR ?? null,
-        ...(cachedBranchFallbackGitHubPRNumber !== null
-          ? { fallbackGitHubPR: cachedBranchFallbackGitHubPRNumber }
-          : {}),
-        currentHeadOid: worktree.head ?? null,
-        linkedGitLabMR,
-        linkedBitbucketPR,
-        linkedAzureDevOpsPR,
-        linkedGiteaPR,
-        staleWhileRevalidate: true
-      })
-    }
-    // Why: PRs created outside Orca (e.g. `gh pr create`) emit no renderer event; poll visible cards to discover them.
-    return installWindowVisibilityInterval({
-      run: refreshHostedReview,
-      intervalMs: HOSTED_REVIEW_CARD_REFRESH_INTERVAL_MS
-    })
-  }, [
+}: WorktreeCardProps): React.JSX.Element {
+  const card = useWorktreeCardController({
+    worktree,
     repo,
-    isFolder,
-    worktree.isBare,
-    worktree.linkedPR,
-    worktree.head,
-    cachedBranchFallbackGitHubPRNumber,
-    linkedGitLabMR,
-    linkedBitbucketPR,
-    linkedAzureDevOpsPR,
-    linkedGiteaPR,
-    fetchHostedReviewForBranch,
-    branch,
-    hostedReviewCacheKey,
-    shouldRefreshHostedReview
-  ])
-
-  useEffect(() => {
-    if (
-      !newCardStyle ||
-      !hoverDetailsOpen ||
-      shouldRefreshHostedReview ||
-      isWebClient() ||
-      !repo ||
-      isFolder ||
-      worktree.isBare ||
-      !hostedReviewCacheKey ||
-      isMacAppDataPath(repo.path)
-    ) {
-      return
-    }
-    // Why: hidden card metadata is revealed on whole-card hover, so fetch lazily instead of always-on polling.
-    void fetchHostedReviewForBranch(repo.path, branch, {
-      repoId: repo.id,
-      linkedGitHubPR: worktree.linkedPR ?? null,
-      ...(cachedBranchFallbackGitHubPRNumber !== null
-        ? { fallbackGitHubPR: cachedBranchFallbackGitHubPRNumber }
-        : {}),
-      currentHeadOid: worktree.head ?? null,
-      linkedGitLabMR,
-      linkedBitbucketPR,
-      linkedAzureDevOpsPR,
-      linkedGiteaPR,
-      staleWhileRevalidate: true
-    })
-  }, [
-    hoverDetailsOpen,
-    newCardStyle,
-    shouldRefreshHostedReview,
-    repo,
-    isFolder,
-    worktree.isBare,
-    worktree.linkedPR,
-    worktree.head,
-    cachedBranchFallbackGitHubPRNumber,
-    linkedGitLabMR,
-    linkedBitbucketPR,
-    linkedAzureDevOpsPR,
-    linkedGiteaPR,
-    fetchHostedReviewForBranch,
-    branch,
-    hostedReviewCacheKey
-  ])
-
-  // Why: same as above for issues — hidden-surface polling only burns GitHub calls for invisible data.
-  useEffect(() => {
-    // Why: per-card decoration lookups from the browser flood the RPC path at paired-web startup; the host is authoritative.
-    if (
-      isWebClient() ||
-      !repo ||
-      isFolder ||
-      !worktree.linkedIssue ||
-      !issueCacheKey ||
-      !showIssue
-    ) {
-      return
-    }
-
-    const issueNumber = worktree.linkedIssue
-
-    // Why: fallback poll behind activity triggers; stopped while hidden to avoid waking idle workspaces.
-    return installWindowVisibilityInterval({
-      run: () => void fetchIssue(repo.path, issueNumber, { repoId: repo.id }),
-      intervalMs: 5 * 60_000
-    })
-  }, [repo, isFolder, worktree.linkedIssue, fetchIssue, issueCacheKey, showIssue])
-
-  useEffect(() => {
-    if (
-      !newCardStyle ||
-      !hoverDetailsOpen ||
-      showIssue ||
-      isWebClient() ||
-      !repo ||
-      isFolder ||
-      !worktree.linkedIssue ||
-      !issueCacheKey
-    ) {
-      return
-    }
-    void fetchIssue(repo.path, worktree.linkedIssue, { repoId: repo.id })
-  }, [
-    newCardStyle,
-    hoverDetailsOpen,
-    showIssue,
-    repo,
-    isFolder,
-    worktree.linkedIssue,
-    fetchIssue,
-    issueCacheKey
-  ])
-
-  useEffect(() => {
-    if (!worktree.linkedLinearIssue || !showLinearIssue) {
-      return
-    }
-    const linearIssueId = worktree.linkedLinearIssue
-    const refreshLinearIssueIfVisible = (): void => {
-      if (!isWindowVisible()) {
-        return
-      }
-      void fetchLinearIssue(linearIssueId, 'all')
-    }
-    refreshLinearIssueIfVisible()
-    window.addEventListener('focus', refreshLinearIssueIfVisible)
-    document.addEventListener('visibilitychange', refreshLinearIssueIfVisible)
-    return () => {
-      window.removeEventListener('focus', refreshLinearIssueIfVisible)
-      document.removeEventListener('visibilitychange', refreshLinearIssueIfVisible)
-    }
-  }, [worktree.linkedLinearIssue, fetchLinearIssue, showLinearIssue])
-
-  useEffect(() => {
-    if (!newCardStyle || !hoverDetailsOpen || showLinearIssue || !worktree.linkedLinearIssue) {
-      return
-    }
-    void fetchLinearIssue(worktree.linkedLinearIssue, 'all')
-  }, [
-    newCardStyle,
-    hoverDetailsOpen,
-    showLinearIssue,
-    worktree.linkedLinearIssue,
-    fetchLinearIssue
-  ])
-
-  // Stable click handler – ignore clicks that are really text selections.
-  const handleClick = useCallback(
-    (event: React.MouseEvent<HTMLDivElement>) => {
-      if (!isEventTargetInsideCurrentTarget(event.currentTarget, event.target)) {
-        return
-      }
-      const selection = window.getSelection()
-      // Why: only suppress the click for a selection inside this card; a foreign selection must not block worktree switching.
-      if (selection && selection.toString().length > 0) {
-        const card = event.currentTarget
-        const anchor = selection.anchorNode
-        const focus = selection.focusNode
-        const selectionInsideCard =
-          (anchor instanceof Node && card.contains(anchor)) ||
-          (focus instanceof Node && card.contains(focus))
-        if (selectionInsideCard) {
-          return
-        }
-      }
-      const selectionOnly = affiliateListMode
-        ? false
-        : (onSelectionGesture?.(event, worktree.id) ?? false)
-      if (selectionOnly) {
-        event.preventDefault()
-        event.stopPropagation()
-        return
-      }
-      if (isDeleting) {
-        event.preventDefault()
-        event.stopPropagation()
-        return
-      }
-      // Why: route sidebar clicks through the shared activation path so the back/forward stack stays complete.
-      recordRendererCrashBreadcrumb('sidebar_worktree_activate', {
-        worktreeId: worktree.id,
-        repoId: worktree.repoId,
-        wasActive: isActive,
-        sshDisconnected: isSshDisconnected
-      })
-      onImmediateActivate?.(worktree.id, activationRowKey)
-      void activateWorktreeFromSidebar(
-        worktree.id,
-        worktree.hostId ?? (repo ? getRepoExecutionHostId(repo) : undefined)
-      )
-      onActivate?.()
-    },
-    [
-      affiliateListMode,
-      worktree.id,
-      worktree.repoId,
-      worktree.hostId,
-      repo,
-      isActive,
-      isDeleting,
-      activationRowKey,
-      isSshDisconnected,
-      onActivate,
-      onImmediateActivate,
-      onSelectionGesture
-    ]
-  )
-
-  const handleRenameTitle = useCallback(
-    // Inline rename has no surface for the failure; the store already logs and
-    // refetches, which reverts the optimistic title in place.
-    async (displayName: string): Promise<void> => {
-      await updateWorktreeMeta(worktree.id, { displayName })
-    },
-    [updateWorktreeMeta, worktree.id]
-  )
-
-  const handleDoubleClick = useCallback(
-    (event: React.MouseEvent<HTMLDivElement>) => {
-      if (affiliateListMode) {
-        return
-      }
-      if (!isEventTargetInsideCurrentTarget(event.currentTarget, event.target)) {
-        return
-      }
-      openModal('edit-meta', {
-        worktreeId: worktree.id,
-        repoId: worktree.repoId,
-        currentDisplayName: worktree.displayName,
-        currentIssue: worktree.linkedIssue,
-        currentPR: worktree.linkedPR,
-        currentComment: worktree.comment
-      })
-    },
-    [
-      openModal,
-      affiliateListMode,
-      worktree.comment,
-      worktree.displayName,
-      worktree.id,
-      worktree.linkedIssue,
-      worktree.linkedPR,
-      worktree.repoId
-    ]
-  )
-
-  const handleToggleUnreadQuick = useCallback(
-    (event: React.MouseEvent<HTMLButtonElement>) => {
-      event.preventDefault()
-      event.stopPropagation()
-      updateWorktreeMeta(worktree.id, { isUnread: !worktree.isUnread })
-    },
-    [worktree.id, worktree.isUnread, updateWorktreeMeta]
-  )
-  // Why: delete is destructive, so it only appears while holding Option/Alt, not in the ordinary hover chrome.
-  const showDeleteQuickAction =
-    !affiliateListMode &&
-    canShowWorkspaceDeleteQuickAction({
-      deleteModifierPressed,
-      isDeleting,
-      isMainWorktree: worktree.isMainWorktree
-    })
-  const handleWorkspaceQuickAction = useCallback(
-    (event: React.MouseEvent<HTMLButtonElement>) => {
-      event.preventDefault()
-      event.stopPropagation()
-      if (showDeleteQuickAction) {
-        if (folderWorkspaceId) {
-          void deleteFolderWorkspace(folderWorkspaceId).then((deleted) => {
-            if (
-              deleted &&
-              useAppStore.getState().activeWorktreeId === folderWorkspaceKey(folderWorkspaceId)
-            ) {
-              setActiveWorktree(null)
-            }
-          })
-          return
-        }
-        runWorktreeDelete(worktree.id)
-      }
-    },
-    [
-      deleteFolderWorkspace,
-      folderWorkspaceId,
-      setActiveWorktree,
-      showDeleteQuickAction,
-      worktree.id
-    ]
-  )
-  const handleOpenRenameErrorDialog = useCallback((event: React.MouseEvent<HTMLButtonElement>) => {
-    event.preventDefault()
-    event.stopPropagation()
-    setShowRenameErrorDialog(true)
-  }, [])
-  const unreadTooltip = worktree.isUnread ? 'Mark read' : 'Mark unread'
-  const lineageChildAriaLabel =
-    lineageChildCount === 1
-      ? lineageCollapsed
-        ? translate(
-            'auto.components.sidebar.WorktreeList.20bebf9c7f',
-            'Show {{value0}} child workspace',
-            { value0: lineageChildCount }
-          )
-        : translate(
-            'auto.components.sidebar.WorktreeList.e97297cb75',
-            'Hide {{value0}} child workspace',
-            { value0: lineageChildCount }
-          )
-      : lineageCollapsed
-        ? translate(
-            'auto.components.sidebar.WorktreeList.c1f4a31623',
-            'Show {{value0}} child workspaces',
-            { value0: lineageChildCount }
-          )
-        : translate(
-            'auto.components.sidebar.WorktreeList.0cd15956d4',
-            'Hide {{value0}} child workspaces',
-            { value0: lineageChildCount }
-          )
-  const childWorkspaceShortLabel = `${lineageChildCount} ${
-    lineageChildCount === 1
-      ? translate('auto.components.sidebar.WorktreeList.0c6ee14f23', 'child')
-      : translate('auto.components.sidebar.WorktreeList.045a8aed48', 'children')
-  }`
-  const showLineageChildChip = lineageChildCount > 0 && onLineageToggle !== undefined
-
-  const handleDragStart = useCallback(
-    (event: React.DragEvent<HTMLDivElement>) => {
-      if (!isEventTargetInsideCurrentTarget(event.currentTarget, event.target)) {
-        event.preventDefault()
-        return
-      }
-      if (isDeleting) {
-        event.preventDefault()
-        return
-      }
-      const dragIds =
-        isMultiSelected && selectedWorktrees && selectedWorktrees.length > 1
-          ? selectedWorktrees.map((item) => item.id)
-          : worktree.id
-      writeWorkspaceDragData(event.dataTransfer, dragIds)
-      onCardDragStart?.(event, worktree.id, Array.isArray(dragIds) ? dragIds : [dragIds])
-    },
-    [isDeleting, isMultiSelected, onCardDragStart, selectedWorktrees, worktree.id]
-  )
-
-  const handleDragEnd = useCallback(
-    (event: React.DragEvent<HTMLDivElement>) => {
-      if (!isEventTargetInsideCurrentTarget(event.currentTarget, event.target)) {
-        return
-      }
-      onCardDragEnd?.(event)
-    },
-    [onCardDragEnd]
-  )
-
-  const handleContextMenuSelect = useCallback(
-    (event: React.MouseEvent<HTMLElement>) => onContextMenuSelect?.(event, worktree) ?? [worktree],
-    [onContextMenuSelect, worktree]
-  )
-
-  const stopQuickActionPointerPropagation = useCallback(
-    (event: React.PointerEvent<HTMLButtonElement>) => {
-      // Why: document-level pointer handling dismisses the Kanban board; quick actions must not count as card activation.
-      event.stopPropagation()
-    },
-    []
-  )
-
-  // Why: unread lives in the left status lane, so the Status toggle owns both the dot/PR slot and unread emphasis.
-  const showUnreadEmphasis = showStatus && worktree.isUnread
-  const hoverIssue = issueDisplay
-  const hoverLinearIssue = linearIssueDisplay
-  const hoverJiraIssue = jiraIssueDisplay
-  const hoverReview = prDisplay
-  const statusLaneReview = statusPrDisplay ?? hoverReview
-  const hoverComment = worktree.comment
-  const metaIssue = showIssue ? hoverIssue : null
-  const metaLinearIssue = showLinearIssue ? hoverLinearIssue : null
-  const metaJiraIssue = showJiraIssue ? hoverJiraIssue : null
-  const metaReview = showPR ? hoverReview : null
-  const metaAutomationProvenance = showAutomation ? worktree.automationProvenance : null
-  const metaCliProvenance = showCli ? worktree.cliProvenance : null
-  const metaComment = showComment ? hoverComment : null
-  const showInlineAgentList = cardProps.includes('inline-agents') && (newCardStyle || !compactCards)
-  const compactInlineAgentRows = useWorktreeAgentRows(
-    worktree.id,
-    showInlineAgentList && agentActivityDisplayMode === 'compact'
-  )
-  const compactInlineAgentRowsVisible =
-    showInlineAgentList &&
-    agentActivityDisplayMode === 'compact' &&
-    compactInlineAgentRows.length > 0
-  const showAggregateCacheTimer = !compactCards && !compactInlineAgentRowsVisible
-  const handleOpenGitHubIssueInOrca = useCallback(
-    (e: React.MouseEvent) => {
-      e.stopPropagation()
-      const issueUrl = hoverIssue && 'url' in hoverIssue ? hoverIssue.url : undefined
-      if (!repo || !hoverIssue || !issueUrl) {
-        return
-      }
-      const item: GitHubWorkItem = {
-        id: issueUrl,
-        type: 'issue',
-        number: hoverIssue.number,
-        title: hoverIssue.title,
-        state: 'state' in hoverIssue ? (hoverIssue.state ?? 'open') : 'open',
-        url: issueUrl,
-        labels: 'labels' in hoverIssue ? (hoverIssue.labels ?? []) : [],
-        updatedAt: new Date().toISOString(),
-        author: null,
-        repoId: repo.id
-      }
-      openTaskPage({ taskSource: 'github', preselectedRepoId: repo.id, openGitHubWorkItem: item })
-    },
-    [hoverIssue, openTaskPage, repo]
-  )
-  const handleOpenReviewInOrca = useCallback(
-    (e: React.MouseEvent) => {
-      e.stopPropagation()
-      if (!repo || !hoverReview?.url || hoverReview.provider !== 'github') {
-        return
-      }
-      const item: GitHubWorkItem = {
-        id: hoverReview.url,
-        type: 'pr',
-        number: hoverReview.number,
-        title: hoverReview.title,
-        state: hoverReview.state ?? 'open',
-        url: hoverReview.url,
-        labels: [],
-        updatedAt: 'updatedAt' in hoverReview ? hoverReview.updatedAt : new Date().toISOString(),
-        author: null,
-        headSha: 'headSha' in hoverReview ? hoverReview.headSha : undefined,
-        repoId: repo.id
-      }
-      openTaskPage({ taskSource: 'github', preselectedRepoId: repo.id, openGitHubWorkItem: item })
-    },
-    [hoverReview, openTaskPage, repo]
-  )
-  const hoverReviewProvider = hoverReview?.provider
-  const hasExplicitLinkedReview =
-    (hoverReviewProvider === 'github' && worktree.linkedPR !== null) ||
-    (hoverReviewProvider === 'gitlab' && linkedGitLabMR !== null) ||
-    (hoverReviewProvider === 'bitbucket' && linkedBitbucketPR !== null) ||
-    (hoverReviewProvider === 'azure-devops' && linkedAzureDevOpsPR !== null) ||
-    (hoverReviewProvider === 'gitea' && linkedGiteaPR !== null)
-  const handleUnlinkReview = useCallback(() => {
-    switch (hoverReviewProvider) {
-      case 'github':
-        void updateWorktreeMeta(worktree.id, { linkedPR: null })
-        return
-      case 'gitlab':
-        void updateWorktreeMeta(worktree.id, { linkedGitLabMR: null })
-        return
-      case 'bitbucket':
-        void updateWorktreeMeta(worktree.id, { linkedBitbucketPR: null })
-        return
-      case 'azure-devops':
-        void updateWorktreeMeta(worktree.id, { linkedAzureDevOpsPR: null })
-        return
-      case 'gitea':
-        void updateWorktreeMeta(worktree.id, { linkedGiteaPR: null })
-        break
-      case 'unsupported':
-      case undefined:
-        break
-    }
-  }, [hoverReviewProvider, updateWorktreeMeta, worktree.id])
-  const handleOpenLinearIssueInOrca = useCallback(
-    (e: React.MouseEvent) => {
-      e.stopPropagation()
-      if (!linearIssue) {
-        return
-      }
-      openTaskPage({ taskSource: 'linear', openLinearIssue: linearIssue })
-    },
-    [linearIssue, openTaskPage]
-  )
-  const hasDetails = hasWorktreeCardDetails({
-    issue: metaIssue,
-    linearIssue: metaLinearIssue,
-    jiraIssue: metaJiraIssue,
-    review: newCardStyle ? null : metaReview,
-    comment: metaComment,
-    automationProvenance: metaAutomationProvenance,
-    cliProvenance: metaCliProvenance
+    isActive,
+    isActiveSurface,
+    activeSurfaceVariant,
+    isMultiSelected,
+    revealHighlight,
+    revealHighlightTone,
+    selectedWorktrees,
+    onActivate,
+    onImmediateActivate,
+    onSelectionGesture,
+    onContextMenuSelect,
+    onAssignWorkspaceStatus,
+    onCardDragStart,
+    onCardDragEnd,
+    nativeDragEnabled,
+    hideRepoBadge,
+    hostContextLabel,
+    inPinnedSection,
+    activationRowKey,
+    renameRowKey,
+    contentIndent,
+    flushSurface,
+    lineageChildCount,
+    lineageCollapsed,
+    lineageChildren,
+    lineageChildrenStyle,
+    onLineageToggle,
+    isLineageDropTarget,
+    affiliateListMode,
+    statusPrDisplay
   })
-  const hasPorts = showPorts && workspacePorts.length > 0
-  const cacheStartedAt = usePromptCacheCountdownStartedAt(worktree.id, showAggregateCacheTimer)
-  const cacheTtlMs = useAppStore((s) =>
-    showAggregateCacheTimer ? (s.settings?.promptCacheTtlMs ?? 0) : 0
-  )
-  // Why: pinned trees mix repos, so the repo icon shows regardless of groupBy's hideRepoBadge.
-  const showPinnedRepoIcon = inPinnedSection && !!repo
-  // Why: new card style retired the Compact/Detailed switch; repo identity uses the compact chip, not a lower pill.
-  const showRepoIdentityInTitle = newCardStyle || compactCards
-  const showInlineRepoBadge =
-    showRepoIdentityInTitle && !!repo && !hideRepoBadge && !isFolder && !showPinnedRepoIcon
-  const showRepoBadgeInMetaRow =
-    !showRepoIdentityInTitle && !!repo && !hideRepoBadge && !showPinnedRepoIcon
-  const showHostContextBadge = !compactCards && !!hostContextLabel
-  const showDetachedHeadInMetaRow = !compactCards && !isFolder && detachedHeadDisplay !== null
-  const showBranch =
-    !isFolder &&
-    branch.length > 0 &&
-    !newCardStyle &&
-    (!compactCards || branch !== worktree.displayName)
-  // Why: rebases already surface in source control, so dense cards skip the persistent rebase chip.
-  const showConflictOperationBadge =
-    !!conflictOperation && conflictOperation !== 'unknown' && conflictOperation !== 'rebase'
-  const hasMetadataBadge = showConflictOperationBadge
-  const showUnreadQuickAction = !affiliateListMode && showStatus && !newCardStyle
-  // Why: the slot owns the unread/status lane; legacy keeps the bell toggle, the new card keeps the glyph passive.
-  const showCombinedStatusSlot = showStatus
-  const showTitleRowPrimary = compactCards && worktree.isMainWorktree && !isFolder
-  const showMetaRowDetails = !newCardStyle && !compactCards && (hasDetails || hasPorts)
-  const showTitleRowIndicators = (newCardStyle || compactCards) && (hasDetails || hasPorts)
-  // Why: grouped views can hide the repo badge; don't reserve a blank metadata lane unless there's real content.
-  const hasDetailedMetaRowContent = Boolean(
-    (showRepoBadgeInMetaRow && repo) ||
-    showHostContextBadge ||
-    folderMetaRowContent ||
-    showBranch ||
-    showIdentityInNewCard ||
-    showDetachedHeadInMetaRow ||
-    showConflictOperationBadge ||
-    cacheStartedAt != null ||
-    showMetaRowDetails
-  )
-  const hasMetaRow = compactCards
-    ? hasMetadataBadge || cacheStartedAt != null
-    : hasDetailedMetaRowContent
-  const showHeaderActions = showTitleRowPrimary || showDeleteQuickAction
-  // Why: normalize the title once so title/branch de-dupe and identity-only hover eligibility stay in sync.
-  const trimmedVisibleCardTitle = visibleCardTitle.trim()
-  const showBranchIdentityHover = newCardStyle
-    ? Boolean(identityDisplay) &&
-      !cardProps.includes('branch') &&
-      identityDisplay !== trimmedVisibleCardTitle
-    : compactCards && showBranch
-  const hoverBranchName = newCardStyle
-    ? identityDisplay
-    : showBranchIdentityHover
-      ? branch
-      : undefined
-  const hoverWorkspaceTitle =
-    trimmedVisibleCardTitle.length > 0 && trimmedVisibleCardTitle !== hoverBranchName
-      ? trimmedVisibleCardTitle
-      : undefined
-  const hasHoverIdentity = Boolean(hoverWorkspaceTitle || hoverBranchName)
-  const hasHoverDetails =
-    newCardStyle &&
-    (hasWorktreeCardDetails({
-      issue: hoverIssue,
-      linearIssue: hoverLinearIssue,
-      jiraIssue: hoverJiraIssue,
-      review: hoverReview,
-      comment: hoverComment,
-      automationProvenance: metaAutomationProvenance,
-      cliProvenance: metaCliProvenance
-    }) ||
-      workspacePorts.length > 0 ||
-      hasHoverIdentity)
-  // Why: the parent row owns metadata hover; don't stack the title's truncation tooltip on the details popover.
-  const titleWrapper = newCardStyle
-    ? hasHoverDetails
-      ? (title: React.ReactElement): React.ReactElement => title
-      : undefined
-    : compactCards && (showBranchIdentityHover || hasDetails || hasPorts)
-      ? (title: React.ReactElement): React.ReactElement => (
-          <WorktreeCardDetailsHover
-            issue={metaIssue}
-            linearIssue={metaLinearIssue}
-            jiraIssue={metaJiraIssue}
-            review={metaReview}
-            comment={metaComment}
-            automationProvenance={metaAutomationProvenance}
-            cliProvenance={metaCliProvenance}
-            automationHostId={worktree.hostId}
-            branchName={showBranchIdentityHover ? branch : undefined}
-            workspaceTitle={worktree.displayName}
-            identityOrder="branch-first"
-            detailsAfter={hasPorts ? <WorktreeCardPortsDetails ports={workspacePorts} /> : null}
-            openDelay={100}
-            // Why: compact mode also renders the plug/badge hover root; sharing one open-state made hovering the
-            // plug force-open the wider title card and race it closed (#9304), so let this title hover own its state.
-            onEditIssue={affiliateListMode ? undefined : handleEditIssue}
-            onEditComment={affiliateListMode ? undefined : handleEditComment}
-            onOpenGitHubIssueInOrca={
-              metaIssue && 'url' in metaIssue && metaIssue.url
-                ? handleOpenGitHubIssueInOrca
-                : undefined
-            }
-            onOpenLinearIssueInOrca={linearIssue?.url ? handleOpenLinearIssueInOrca : undefined}
-            onOpenReviewInOrca={
-              metaReview?.url && metaReview.provider === 'github'
-                ? handleOpenReviewInOrca
-                : undefined
-            }
-            onOpenAutomation={affiliateListMode ? undefined : handleOpenAutomation}
-            onOpenAutomationRun={affiliateListMode ? undefined : handleOpenAutomationRun}
-            // Why: compact mode hides the metadata badge row, so title hover carries the explicit-link affordance.
-            onUnlinkReview={
-              !affiliateListMode && hasExplicitLinkedReview ? handleUnlinkReview : undefined
-            }
-          >
-            {title}
-          </WorktreeCardDetailsHover>
-        )
-      : undefined
-  // Why: sidebar rows need a small surface inset while content stays aligned with the pre-inset layout.
-  const applyNewCardStyleStatusLaneOffset = newCardStyle && showCombinedStatusSlot
-  const cardPaddingLeft = flushSurface
-    ? getFlushWorktreeCardPaddingLeft(contentIndent, applyNewCardStyleStatusLaneOffset)
-    : contentIndent > 0
-      ? `calc(0.125rem + ${contentIndent}px)`
-      : null
-  const parentContentMarginLeft =
-    flushSurface && applyNewCardStyleStatusLaneOffset
-      ? getNewCardStyleParentContentMarginLeft(contentIndent)
-      : 0
-  const cardStyle = cardPaddingLeft ? { paddingLeft: cardPaddingLeft } : undefined
-  const detailsAndPortsContent =
-    hasDetails || hasPorts ? (
-      <div className="flex shrink-0 items-center gap-1">
-        {hasPorts && <WorktreeCardPortsTrigger ports={workspacePorts} />}
-        {hasDetails && (
-          <WorktreeCardMetaBadges
-            issue={metaIssue}
-            linearIssue={metaLinearIssue}
-            jiraIssue={metaJiraIssue}
-            review={newCardStyle ? null : metaReview}
-            comment={metaComment}
-            automationProvenance={metaAutomationProvenance}
-            cliProvenance={metaCliProvenance}
-            className="ml-0 pr-0"
-          />
-        )}
-      </div>
-    ) : null
-  const detailsAndPorts =
-    detailsAndPortsContent && !newCardStyle ? (
-      <WorktreeCardDetailsHover
-        issue={metaIssue}
-        linearIssue={metaLinearIssue}
-        jiraIssue={metaJiraIssue}
-        review={metaReview}
-        comment={metaComment}
-        automationProvenance={metaAutomationProvenance}
-        cliProvenance={metaCliProvenance}
-        automationHostId={worktree.hostId}
-        detailsAfter={hasPorts ? <WorktreeCardPortsDetails ports={workspacePorts} /> : null}
-        hoverControl={detailsHoverControl}
-        onEditIssue={affiliateListMode ? undefined : handleEditIssue}
-        onEditComment={affiliateListMode ? undefined : handleEditComment}
-        onOpenGitHubIssueInOrca={
-          metaIssue && 'url' in metaIssue && metaIssue.url ? handleOpenGitHubIssueInOrca : undefined
-        }
-        onOpenLinearIssueInOrca={linearIssue?.url ? handleOpenLinearIssueInOrca : undefined}
-        onOpenReviewInOrca={
-          metaReview?.url && metaReview.provider === 'github' ? handleOpenReviewInOrca : undefined
-        }
-        onOpenAutomation={affiliateListMode ? undefined : handleOpenAutomation}
-        onOpenAutomationRun={affiliateListMode ? undefined : handleOpenAutomationRun}
-        // Why: branch lookup can surface a review without persisted metadata; only unlink when explicitly linked.
-        onUnlinkReview={
-          !affiliateListMode && hasExplicitLinkedReview ? handleUnlinkReview : undefined
-        }
-      >
-        {detailsAndPortsContent}
-      </WorktreeCardDetailsHover>
-    ) : (
-      detailsAndPortsContent
-    )
-  const titleRowIndicators = showTitleRowIndicators ? (
-    <div className="ml-auto flex shrink-0 items-center gap-1 pr-1.5">{detailsAndPorts}</div>
-  ) : null
-  const hasSecondaryCardContent =
-    hasMetaRow || !!remoteBranchConflict || showInlineAgentList || showLineageChildChip
-  const titleOnlyCard = !hasSecondaryCardContent
 
-  const parentCardContent = (
-    <div
-      className={cn(
-        'flex w-full min-w-0 gap-0.5 pl-0',
-        titleOnlyCard ? 'items-center' : 'items-start'
-      )}
-      style={
-        parentContentMarginLeft < 0 ? { marginLeft: `${parentContentMarginLeft}px` } : undefined
-      }
-      data-worktree-card-parent-content=""
-    >
-      {showCombinedStatusSlot ? (
-        <div
-          className={cn(
-            'flex shrink-0 justify-center',
-            newCardStyle ? 'mr-1 w-5 items-center' : 'items-start pt-[2px]',
-            affiliateListMode && 'px-1'
-          )}
-          data-worktree-card-status-slot=""
-        >
-          <WorktreeCardStatusSlot
-            worktreeId={worktree.id}
-            showStatus={showStatus}
-            showUnreadAction={showUnreadQuickAction}
-            isUnread={worktree.isUnread}
-            unreadTooltip={unreadTooltip}
-            onPointerDown={stopQuickActionPointerPropagation}
-            onToggleUnread={handleToggleUnreadQuick}
-            prDisplay={statusLaneReview}
-            newCardStyle={newCardStyle}
-            hasBranchIdentity={Boolean(branchIdentityDisplay)}
-          />
-        </div>
-      ) : null}
-
-      {/* Content area */}
-      <div
-        className={cn(
-          'flex min-w-0 flex-1 flex-col gap-1.5',
-          // Why: inline agent rows intentionally outdent into the card gutter; inner elements handle truncation.
-          showInlineAgentList || (!newCardStyle && lineageChildren)
-            ? 'overflow-visible'
-            : 'overflow-hidden'
-        )}
-      >
-        {/* Header row: Title */}
-        <div className="flex min-w-0 items-center justify-between gap-2">
-          <div className="flex min-w-0 flex-1 items-center gap-1.5">
-            {showPinnedRepoIcon && (
-              <RepoIdentityChip repo={repo}>
-                <RepoIconGlyph
-                  repoIcon={repo.repoIcon}
-                  color={resolveRepoHeaderColor(repo.badgeColor)}
-                  className="size-full"
-                  iconClassName="size-3"
-                />
-              </RepoIdentityChip>
-            )}
-
-            {repo?.connectionId && (
-              <WorktreeCardSshHostControl
-                targetId={repo.connectionId}
-                targetLabel={sshTargetLabel || repo.displayName}
-                status={sshStatus}
-                targetRemoved={sshTargetRemoved}
-                sshOwnerEnvironmentId={sshOwnerEnvironmentId}
-                iconOnly={compactCards || newCardStyle}
-                onPointerDown={stopQuickActionPointerPropagation}
-              />
-            )}
-
-            {!repo?.connectionId && parsedRepoHost?.kind === 'runtime' && (
-              <Tooltip>
-                <TooltipTrigger asChild>
-                  <span className="shrink-0 inline-flex items-center">
-                    {isRuntimeDisconnected ? (
-                      // Passive by design: runtime ("Orca server") hosts have no
-                      // renderer-reachable connect API, unlike the SSH glyph above which is
-                      // now a control. Don't "fix" the inconsistency by wiring one up.
-                      <ServerOff className="size-3 text-destructive" />
-                    ) : (
-                      <Server className="size-3 text-muted-foreground" />
-                    )}
-                  </span>
-                </TooltipTrigger>
-                <TooltipContent side="right" sideOffset={8}>
-                  {isRuntimeDisconnected
-                    ? runtimeHostLabel
-                      ? translate(
-                          'auto.components.sidebar.WorktreeCard.runtimeHostDisconnectedNamed',
-                          '{{hostName}} disconnected',
-                          { hostName: runtimeHostLabel }
-                        )
-                      : translate(
-                          'auto.components.sidebar.WorktreeCard.runtimeHostDisconnected',
-                          'Server disconnected'
-                        )
-                    : runtimeHostLabel
-                      ? translate(
-                          'auto.components.sidebar.WorktreeCard.runtimeHostProjectNamed',
-                          'Project on {{hostName}}',
-                          { hostName: runtimeHostLabel }
-                        )
-                      : translate(
-                          'auto.components.sidebar.WorktreeCard.runtimeHostProject',
-                          'Project on Orca server'
-                        )}
-                </TooltipContent>
-              </Tooltip>
-            )}
-
-            {showInlineRepoBadge && (
-              <RepoIdentityChip repo={repo}>
-                <RepoIconGlyph
-                  repoIcon={repo.repoIcon}
-                  color={resolveRepoHeaderColor(repo.badgeColor)}
-                  className="size-full"
-                  iconClassName="size-3"
-                />
-              </RepoIdentityChip>
-            )}
-
-            {/* Why: unread alert lives in the left status lane; title-row contrast comes from weight and dimmed read titles. */}
-            <WorktreeTitleInlineRename
-              displayName={visibleCardTitle}
-              disabled={isDeleting || affiliateListMode}
-              showUnreadEmphasis={showUnreadEmphasis}
-              dimReadTitle={newCardStyle}
-              className="text-[13px] leading-5"
-              editingClassName="flex-1"
-              titleWrapper={titleWrapper}
-              onEditingChange={affiliateListMode ? undefined : setTitleRenaming}
-              onRename={handleRenameTitle}
-              beginEditing={
-                !affiliateListMode &&
-                shouldBeginWorktreeRename(renamingWorktreeId, worktree.id, renameRowKey)
-              }
-              onBeginEditingConsumed={
-                affiliateListMode ? undefined : () => setRenamingWorktreeId(null)
-              }
-            />
-
-            {typeof worktree.firstAgentMessageRenameError === 'string' &&
-            worktree.firstAgentMessageRenameError.length > 0 &&
-            !titleRenaming ? (
-              // Why: the error can be raw agent CLI output, so the badge opens a dialog rather than a tooltip.
-              <Tooltip>
-                <TooltipTrigger asChild>
-                  <Button
-                    type="button"
-                    variant="ghost"
-                    onPointerDown={stopQuickActionPointerPropagation}
-                    onClick={handleOpenRenameErrorDialog}
-                    onDoubleClick={handleOpenRenameErrorDialog}
-                    className="h-4 shrink-0 gap-0.5 rounded !px-0.5 text-[10px] font-medium leading-none text-destructive border border-destructive/40 bg-destructive/10 hover:bg-destructive/15 hover:text-destructive has-[>svg]:!px-0.5"
-                    aria-label={translate(
-                      'auto.components.sidebar.WorktreeCard.02e19349f4',
-                      'Auto-rename failed: view error'
-                    )}
-                  >
-                    <AlertCircle className="size-2.5" />
-                    {translate('auto.components.sidebar.WorktreeCard.74522ee457', 'rename failed')}
-                  </Button>
-                </TooltipTrigger>
-                <TooltipContent side="right" sideOffset={8}>
-                  {translate(
-                    'auto.components.sidebar.WorktreeCard.4eba2ea99e',
-                    'Auto-name failed. Click to see details.'
-                  )}
-                </TooltipContent>
-              </Tooltip>
-            ) : null}
-            {!compactCards && worktree.isMainWorktree && !isFolder && (
-              <Tooltip>
-                <TooltipTrigger asChild>
-                  <Badge
-                    variant="outline"
-                    className="h-[16px] px-1.5 text-[10px] font-medium rounded shrink-0 leading-none text-foreground/70 border-foreground/20 bg-foreground/[0.06]"
-                  >
-                    {translate('auto.components.sidebar.WorktreeCard.7d517f82e2', 'primary')}
-                  </Badge>
-                </TooltipTrigger>
-                <TooltipContent side="right" sideOffset={8}>
-                  {translate(
-                    'auto.components.sidebar.WorktreeCard.0777de5970',
-                    'Primary worktree (original clone directory)'
-                  )}
-                </TooltipContent>
-              </Tooltip>
-            )}
-
-            {worktree.isSparse && (
-              <Tooltip>
-                <TooltipTrigger asChild>
-                  <Badge
-                    variant="outline"
-                    className="h-[16px] px-1.5 text-[10px] font-medium rounded shrink-0 leading-none text-amber-700 dark:text-amber-300 border-amber-500/30 bg-amber-500/5"
-                  >
-                    {translate('auto.components.sidebar.WorktreeCard.4f964d5e8c', 'sparse')}
-                  </Badge>
-                </TooltipTrigger>
-                <TooltipContent side="right" sideOffset={8} className="max-w-72">
-                  <div className="space-y-1">
-                    <div>
-                      {translate(
-                        'auto.components.sidebar.WorktreeCard.0f33af979b',
-                        'Partial checkout. Files outside these paths are not on disk.'
-                      )}
-                    </div>
-                    {worktree.sparseDirectories && worktree.sparseDirectories.length > 0 ? (
-                      <div className="font-mono text-[11px] opacity-80">
-                        {formatSparseDirectoryPreview(worktree.sparseDirectories)}
-                      </div>
-                    ) : null}
-                  </div>
-                </TooltipContent>
-              </Tooltip>
-            )}
-
-            {showTitleRowIndicators && titleRowIndicators}
-          </div>
-
-          {showHeaderActions && (
-            <div className="ml-auto flex shrink-0 items-center justify-center gap-1 pr-1.5">
-              {showTitleRowPrimary && (
-                <Tooltip>
-                  <TooltipTrigger asChild>
-                    <span
-                      className="shrink-0 inline-flex items-center"
-                      aria-label={translate(
-                        'auto.components.sidebar.WorktreeCard.0d224eff10',
-                        'Primary worktree'
-                      )}
-                    >
-                      <Star className="size-3 fill-amber-400 text-amber-400" />
-                    </span>
-                  </TooltipTrigger>
-                  <TooltipContent side="right" sideOffset={8}>
-                    {translate(
-                      'auto.components.sidebar.WorktreeCard.0777de5970',
-                      'Primary worktree (original clone directory)'
-                    )}
-                  </TooltipContent>
-                </Tooltip>
-              )}
-
-              {showDeleteQuickAction && (
-                <Tooltip>
-                  <TooltipTrigger asChild>
-                    <button
-                      type="button"
-                      data-workspace-board-preserve-open=""
-                      onPointerDown={stopQuickActionPointerPropagation}
-                      onClick={handleWorkspaceQuickAction}
-                      className={cn(
-                        'inline-flex size-4 items-center justify-center rounded bg-transparent opacity-0 transition-colors transition-opacity',
-                        'group-hover/worktree-card:opacity-100 group-focus-within/worktree-card:opacity-100 focus-visible:opacity-100',
-                        'text-muted-foreground hover:bg-destructive/10 hover:text-destructive focus-visible:bg-destructive/10 focus-visible:text-destructive'
-                      )}
-                      aria-label={translate(
-                        'auto.components.sidebar.WorktreeCard.6f09f58541',
-                        'Delete workspace'
-                      )}
-                    >
-                      <Trash2 className="size-3.5" />
-                    </button>
-                  </TooltipTrigger>
-                  <TooltipContent side="right" sideOffset={8}>
-                    {translate(
-                      'auto.components.sidebar.WorktreeCard.6f09f58541',
-                      'Delete workspace'
-                    )}
-                  </TooltipContent>
-                </Tooltip>
-              )}
-            </div>
-          )}
-        </div>
-
-        {hasMetaRow && (
-          <div className="flex items-center gap-1.5 min-w-0" data-worktree-card-meta-row="">
-            <div className="flex min-w-0 flex-1 items-center gap-1.5 overflow-hidden">
-              {showRepoBadgeInMetaRow && repo && (
-                <div className="flex items-center gap-1.5 shrink-0 px-1.5 py-0.5 rounded-[4px] bg-accent border border-border dark:bg-accent/50 dark:border-border/60">
-                  <RepoBadgeMark color={repo.badgeColor} />
-                  <span className="text-[10px] font-semibold text-foreground truncate max-w-[6rem] leading-none lowercase">
-                    {repo.displayName}
-                  </span>
-                </div>
-              )}
-
-              {showHostContextBadge && (
-                <Badge
-                  variant="secondary"
-                  className="h-[16px] max-w-[7rem] shrink-0 rounded border border-border bg-accent px-1.5 text-[10px] font-medium leading-none text-muted-foreground dark:bg-accent/80 dark:border-border/50"
-                >
-                  <span className="truncate">{hostContextLabel}</span>
-                </Badge>
-              )}
-
-              {showIdentityInNewCard ? (
-                <TruncatedSidebarLabel
-                  text={identityDisplay!}
-                  className="text-[11px] text-muted-foreground leading-none"
-                  tooltipEnabled={!hasHoverDetails}
-                />
-              ) : isFolder && !newCardStyle ? (
-                <span
-                  className="min-w-0 truncate font-mono text-[11px] leading-none text-muted-foreground"
-                  title={worktree.path}
-                >
-                  {getDirectoryName(worktree.path)}
-                </span>
-              ) : showBranch ? (
-                <TruncatedSidebarLabel
-                  text={branch}
-                  className="text-[11px] text-muted-foreground leading-none"
-                  // Why: whole-card details hover already shows full identity; a nested tooltip would compete for it.
-                  tooltipEnabled={!hasHoverDetails}
-                />
-              ) : showDetachedHeadInMetaRow && detachedHeadDisplay ? (
-                <DetachedHeadBadge
-                  display={detachedHeadDisplay}
-                  label="sidebar"
-                  side="right"
-                  className="h-[16px]"
-                />
-              ) : null}
-
-              {showConflictOperationBadge && (
-                <Badge
-                  variant="outline"
-                  className="h-[16px] px-1.5 text-[10px] font-medium rounded shrink-0 gap-1 text-amber-600 border-amber-500/30 bg-amber-500/5 dark:text-amber-400 dark:border-amber-400/30 dark:bg-amber-400/5 leading-none"
-                >
-                  <GitMerge className="size-2.5" />
-                  {CONFLICT_OPERATION_LABELS[conflictOperation]}
-                </Badge>
-              )}
-
-              {cacheStartedAt != null && (
-                <CacheTimer startedAt={cacheStartedAt} ttlMs={cacheTtlMs} />
-              )}
-            </div>
-
-            {showMetaRowDetails && (
-              <div className="ml-auto flex shrink-0 items-center gap-1 pr-1.5">
-                {detailsAndPorts}
-              </div>
-            )}
-          </div>
-        )}
-
-        {remoteBranchConflict && (
-          <div className="mt-0.5 flex items-start gap-1.5 rounded border border-amber-500/25 bg-amber-500/5 px-1.5 py-1 text-[10.5px] leading-snug text-amber-700 dark:text-amber-300">
-            <AlertTriangle className="mt-[1px] size-3 shrink-0" />
-            <span className="min-w-0 flex-1">
-              {translate(
-                'auto.components.sidebar.WorktreeCard.a88c92d0e3',
-                '{{value0}}/{{value1}} already exists.',
-                {
-                  value0: remoteBranchConflict.remote,
-                  value1: remoteBranchConflict.branchName
-                }
-              )}
-            </span>
-          </div>
-        )}
-
-        {isActive && worktree.linkedLinearIssue ? (
-          <LinearAgentSkillSetupPrompt
-            linked
-            remote={Boolean(repo?.connectionId || settings?.activeRuntimeEnvironmentId?.trim())}
-            surface="modal"
-            settings={settings}
-          />
-        ) : null}
-
-        {/* Why: counterbalance the card stack gap (-mt-1) so agents right after the title read as one header group. */}
-        {showInlineAgentList && (
-          <WorktreeCardAgents
-            worktreeId={worktree.id}
-            agents={agentActivityDisplayMode === 'compact' ? compactInlineAgentRows : undefined}
-            className={hasMetaRow || remoteBranchConflict ? 'mt-0' : '-mt-1'}
-          />
-        )}
-
-        {showLineageChildChip && (
-          <div
-            className={cn('relative mt-1 flex min-w-0 justify-start', !newCardStyle && '-ml-1')}
-            style={{
-              color: 'color-mix(in srgb, var(--muted-foreground) 42%, var(--worktree-sidebar))'
-            }}
-          >
-            <Tooltip>
-              <TooltipTrigger asChild>
-                <Button
-                  type="button"
-                  variant="ghost"
-                  size="xs"
-                  className="relative z-10 h-[18px] max-w-[8rem] gap-1 rounded-md border border-worktree-sidebar-border bg-worktree-sidebar px-1.5 text-[10px] font-medium leading-none text-muted-foreground shadow-none hover:bg-worktree-sidebar-accent hover:text-foreground focus-visible:ring-1 focus-visible:ring-worktree-sidebar-ring"
-                  aria-label={lineageChildAriaLabel}
-                  aria-expanded={!lineageCollapsed}
-                  onClick={onLineageToggle}
-                >
-                  <Workflow className="size-2.5" />
-                  <span className="truncate">{childWorkspaceShortLabel}</span>
-                  <ChevronDown
-                    className={cn(
-                      'size-2.5 transition-transform',
-                      lineageCollapsed && '-rotate-90'
-                    )}
-                  />
-                </Button>
-              </TooltipTrigger>
-              <TooltipContent side="right" sideOffset={8}>
-                {lineageCollapsed
-                  ? translate(
-                      'auto.components.sidebar.WorktreeCard.8cb634cda6',
-                      'Show child workspaces'
-                    )
-                  : translate(
-                      'auto.components.sidebar.WorktreeCard.57eaa61b55',
-                      'Hide child workspaces'
-                    )}
-              </TooltipContent>
-            </Tooltip>
-          </div>
-        )}
-
-        {!newCardStyle && lineageChildren && (
-          <div className="-ml-[1.125rem] mt-1.5 w-[calc(100%+1.125rem)] space-y-1">
-            {lineageChildren}
-          </div>
-        )}
-      </div>
-    </div>
-  )
-
-  const parentHoverTriggerBody = (
-    <div className="group/worktree-card w-full min-w-0" data-worktree-card-hover-trigger="">
-      {parentCardContent}
-    </div>
-  )
-
-  const parentCardBodyWithHoverDetails =
-    hasHoverDetails && !titleRenaming ? (
-      <WorktreeCardDetailsHover
-        issue={hoverIssue}
-        linearIssue={hoverLinearIssue}
-        jiraIssue={hoverJiraIssue}
-        review={hoverReview}
-        comment={hoverComment}
-        automationProvenance={metaAutomationProvenance}
-        cliProvenance={metaCliProvenance}
-        automationHostId={worktree.hostId}
-        branchName={hoverBranchName}
-        workspaceTitle={hoverWorkspaceTitle}
-        workspaceTitleRenameDisabled={isDeleting || affiliateListMode}
-        detailsAfter={
-          workspacePorts.length > 0 ? <WorktreeCardPortsDetails ports={workspacePorts} /> : null
-        }
-        openDelay={100}
-        hoverControl={detailsHoverControl}
-        onRenameWorkspaceTitle={affiliateListMode ? undefined : handleRenameTitle}
-        onEditIssue={affiliateListMode ? undefined : handleEditIssue}
-        onEditComment={affiliateListMode ? undefined : handleEditComment}
-        onOpenGitHubIssueInOrca={
-          hoverIssue && 'url' in hoverIssue && hoverIssue.url
-            ? handleOpenGitHubIssueInOrca
-            : undefined
-        }
-        onOpenLinearIssueInOrca={linearIssue?.url ? handleOpenLinearIssueInOrca : undefined}
-        onOpenReviewInOrca={
-          hoverReview?.url && hoverReview.provider === 'github' ? handleOpenReviewInOrca : undefined
-        }
-        onOpenAutomation={affiliateListMode ? undefined : handleOpenAutomation}
-        onOpenAutomationRun={affiliateListMode ? undefined : handleOpenAutomationRun}
-        // Why: branch lookup can surface a review without persisted metadata; only unlink when explicitly linked.
-        onUnlinkReview={
-          !affiliateListMode && hasExplicitLinkedReview ? handleUnlinkReview : undefined
-        }
-      >
-        {parentHoverTriggerBody}
-      </WorktreeCardDetailsHover>
-    ) : (
-      parentHoverTriggerBody
-    )
-
-  const cardBody = (
-    <div
-      className={cn(
-        'relative flex cursor-pointer flex-col pr-1.5 transition-[background-color,border-color,opacity,box-shadow] duration-200 outline-none select-none',
-        titleOnlyCard ? 'py-2' : 'pt-1.25 pb-1.5',
-        flushSurface ? 'ml-1 w-[calc(100%-0.25rem)]' : 'ml-1',
-        'rounded-lg',
-        // Why: the live data attribute updates before React state during navigation,
-        // so it must own the complete active style without stale utility classes.
-        isLineageDropTarget
-          ? 'border border-accent-foreground/20 bg-accent/80'
-          : isActiveSurface
-            ? 'border border-transparent'
-            : isMultiSelected
-              ? 'border border-worktree-sidebar-ring/35 bg-worktree-sidebar-accent/70 ring-1 ring-worktree-sidebar-ring/30'
-              : 'border border-transparent worktree-sidebar-card-hover',
-        isActiveSurface && isMultiSelected && 'ring-1 ring-worktree-sidebar-ring/35',
-        revealHighlight && [
-          'scroll-to-current-workspace-reveal-highlight',
-          revealHighlightTone === 'ai' && 'scroll-to-current-workspace-reveal-highlight--ai'
-        ],
-        titleRenaming && '!border-transparent !bg-transparent !shadow-none !ring-0',
-        isDeleting && 'opacity-50 grayscale cursor-not-allowed',
-        // Why: no SSH dim — the inline host control now states the disconnected state
-        // explicitly, and a subtree opacity would composite its destructive tint and spinner
-        // down to an illegible alpha (a descendant cannot escape an ancestor's opacity).
-        isRuntimeDisconnected && !isDeleting && 'opacity-60'
-      )}
-      data-worktree-card-surface="true"
-      data-worktree-card-active={isActiveSurface ? activeSurfaceVariant : undefined}
-      onClick={handleClick}
-      onDoubleClick={affiliateListMode ? undefined : handleDoubleClick}
-      draggable={!affiliateListMode && nativeDragEnabled && !isDeleting && !titleRenaming}
-      onDragStart={!affiliateListMode && nativeDragEnabled ? handleDragStart : undefined}
-      onDragEnd={!affiliateListMode && nativeDragEnabled ? handleDragEnd : undefined}
-      aria-busy={isDeleting}
-      style={cardStyle}
-    >
-      {isDeleting && (
-        <div className="absolute inset-0 z-10 flex items-center justify-center rounded-lg bg-background/50 backdrop-blur-[1px]">
-          <div className="inline-flex items-center gap-1.5 rounded-full bg-background px-3 py-1 text-[11px] font-medium text-foreground shadow-sm border border-border/50">
-            {!isQueuedForDeletion ? (
-              <LoaderCircle className="size-3.5 animate-spin text-muted-foreground" />
-            ) : null}
-            {deleteLabel}
-          </div>
-        </div>
-      )}
-      {parentCardBodyWithHoverDetails}
-
-      {newCardStyle && lineageChildren ? (
-        <div
-          className="mt-1.5 space-y-1"
-          data-worktree-lineage-children=""
-          style={lineageChildrenStyle}
-        >
-          {lineageChildren}
-        </div>
-      ) : null}
-    </div>
-  )
-
-  return (
-    <>
-      {affiliateListMode ? (
-        cardBody
-      ) : (
-        <WorktreeContextMenu
-          worktree={worktree}
-          selectedWorktrees={selectedWorktrees}
-          onContextMenuSelect={handleContextMenuSelect}
-          onAssignWorkspaceStatus={onAssignWorkspaceStatus}
-        >
-          {cardBody}
-        </WorktreeContextMenu>
-      )}
-
-      {typeof worktree.firstAgentMessageRenameError === 'string' &&
-        worktree.firstAgentMessageRenameError.length > 0 && (
-          <AutoRenameFailedDialog
-            open={showRenameErrorDialog}
-            onOpenChange={setShowRenameErrorDialog}
-            worktreeId={worktree.id}
-            worktreeName={worktree.displayName}
-            error={worktree.firstAgentMessageRenameError}
-          />
-        )}
-    </>
-  )
+  return <WorktreeCardSurface card={card} />
 })
 
 export default WorktreeCard
diff --git a/src/renderer/src/components/sidebar/WorktreeContextMenu.tsx b/src/renderer/src/components/sidebar/WorktreeContextMenu.tsx
index 1063c5145e5..be61dd64d3d 100644
--- a/src/renderer/src/components/sidebar/WorktreeContextMenu.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeContextMenu.tsx
@@ -40,7 +40,10 @@ import type {
   WorkspaceStatus,
   WorkspaceStatusDefinition
 } from '../../../../shared/types'
-import { runWorktreeBatchDelete, runWorktreeDelete } from './delete-worktree-flow'
+import {
+  deferWorktreeContextMenuDeleteIntent,
+  type WorktreeContextMenuDeleteIntent
+} from './worktree-context-menu-delete-intent'
 import { runSleepWorktrees } from './sleep-worktree-flow'
 import { activateAndRevealWorktree } from '@/lib/worktree-activation'
 import { VIRTUALIZED_SCROLL_ANCHOR_RECORD_EVENT } from '@/hooks/useVirtualizedScrollAnchor'
@@ -62,11 +65,7 @@ import {
 import { WorkspaceSleepMenuItems } from './WorkspaceSleepMenuItems'
 import { isEventTargetInsideCurrentTarget } from './worktree-card-dom-events'
 import { translate } from '@/i18n/i18n'
-import {
-  folderWorkspaceKey,
-  parseWorkspaceKey,
-  worktreeWorkspaceKey
-} from '../../../../shared/workspace-scope'
+import { parseWorkspaceKey, worktreeWorkspaceKey } from '../../../../shared/workspace-scope'
 
 type Props = {
   worktree: Worktree
@@ -332,8 +331,6 @@ const WorktreeContextMenu = React.memo(function WorktreeContextMenu({
   const projectGroups = useAppStore((s) => s.projectGroups)
   const createProjectGroup = useAppStore((s) => s.createProjectGroup)
   const moveProjectToGroup = useAppStore((s) => s.moveProjectToGroup)
-  const deleteFolderWorkspace = useAppStore((s) => s.deleteFolderWorkspace)
-  const setActiveWorktree = useAppStore((s) => s.setActiveWorktree)
   const repo = useRepoById(worktree.repoId)
   const deleteState = useAppStore((s) => s.deleteStateByWorktreeId[worktree.id])
   const [menuOpen, setMenuOpen] = useState(false)
@@ -674,47 +671,30 @@ const WorktreeContextMenu = React.memo(function WorktreeContextMenu({
   }, [sleepWorktreesAfterMenuClose, subtreeSleepableWorktrees])
 
   const handleDelete = useCallback(() => {
-    // Folder mode handled inline because it routes to a different modal;
-    // standard delete delegates to the shared runWorktreeDelete helper.
     const restoreSidebarPosition = preserveDeleteSiblingPosition(scopeRef.current)
     scopeRef.current
       ?.closest('[data-worktree-sidebar]')
       ?.dispatchEvent(new Event(VIRTUALIZED_SCROLL_ANCHOR_RECORD_EVENT))
-    setMenuOpenState(false)
-    // Why: Delete can remove the active row and remount the sidebar. Run it
-    // after menu close for the same reason as Sleep above.
-    window.setTimeout(() => {
-      if (isMultiContext) {
-        runWorktreeBatchDelete(batchDeleteWorktrees.map((item) => item.id))
-        restoreSidebarPosition()
-        return
-      }
-      if (folderWorkspaceId) {
-        void deleteFolderWorkspace(folderWorkspaceId).then((deleted) => {
-          if (
-            deleted &&
-            useAppStore.getState().activeWorktreeId === folderWorkspaceKey(folderWorkspaceId)
-          ) {
-            setActiveWorktree(null)
+    const intent: WorktreeContextMenuDeleteIntent = isMultiContext
+      ? {
+          kind: 'batch',
+          worktrees: batchDeleteWorktrees.map(({ id, instanceId }) => ({ id, instanceId }))
+        }
+      : folderWorkspaceId
+        ? { kind: 'folder', folderWorkspaceId }
+        : {
+            kind: 'worktree',
+            worktree: { id: worktree.id, instanceId: worktree.instanceId }
           }
-        })
-        restoreSidebarPosition()
-        return
-      }
-      // Why delegate to runWorktreeDelete: keeps the delete-vs-project-removal
-      // decision tree (and its rationale) in one place shared with command
-      // surfaces and the memory popover's inline Delete action.
-      runWorktreeDelete(worktree.id)
-      restoreSidebarPosition()
-    }, 50)
+    deferWorktreeContextMenuDeleteIntent(intent, restoreSidebarPosition)
+    setMenuOpenState(false)
   }, [
     batchDeleteWorktrees,
-    deleteFolderWorkspace,
     folderWorkspaceId,
     isMultiContext,
-    setActiveWorktree,
     setMenuOpenState,
-    worktree.id
+    worktree.id,
+    worktree.instanceId
   ])
 
   const handleOpenParent = useCallback(() => {
diff --git a/src/renderer/src/components/sidebar/WorktreeList.card-memo-stability.test.tsx b/src/renderer/src/components/sidebar/WorktreeList.card-memo-stability.test.tsx
index 9d0a2e3694b..5c9dda301d3 100644
--- a/src/renderer/src/components/sidebar/WorktreeList.card-memo-stability.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeList.card-memo-stability.test.tsx
@@ -3,6 +3,7 @@
 import { act, type ReactNode } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
 import type { Repo, Worktree, WorktreeCardProperty } from '../../../../shared/types'
 
 globalThis.IS_REACT_ACT_ENVIRONMENT = true
@@ -17,6 +18,7 @@ const mockStore = vi.hoisted(() => ({
 // (React.memo shallow-equal props) does NOT invoke it — which is the claim
 // under test: order-preserving epoch bumps must not re-render cards.
 const cardRenderSpy = vi.hoisted(() => vi.fn())
+const trackSpy = vi.hoisted(() => vi.fn())
 
 type WorktreeListComponent = React.ComponentType<{
   scrollOffsetRef: React.RefObject<number>
@@ -96,6 +98,8 @@ vi.mock('@/lib/sidebar-worktree-activation', () => ({
   activateWorktreeFromSidebar: mockStore.activateWorktreeFromSidebar
 }))
 
+vi.mock('@/lib/telemetry', () => ({ track: trackSpy }))
+
 vi.mock('@/lib/worktree-activation', () => ({
   activateAndRevealWorktree: vi.fn()
 }))
@@ -320,4 +324,57 @@ describe('WorktreeCard memo bail-out across epoch bumps', () => {
     expect(cardRenderSpy.mock.calls.length).toBeGreaterThan(countAfterMount)
     expect(cardRenderSpy).toHaveBeenCalledWith('wt-a')
   })
+
+  it('tracks Smart attention changes that preserve the displayed order', async () => {
+    mockStore.state = { ...mockStore.state, sortBy: 'smart' }
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+    mountedRoots.push(root)
+
+    await renderList(root)
+    const renderedOrder = (): (string | null)[] =>
+      [...container.querySelectorAll('[data-mock-worktree-card]')].map((card) =>
+        card.getAttribute('data-mock-worktree-card')
+      )
+    expect(renderedOrder()).toEqual(['wt-a', 'wt-b'])
+    expect(trackSpy).not.toHaveBeenCalledWith('smart_sort_class_distribution', expect.anything())
+
+    const now = Date.now()
+    const paneKey = 'tab-a:11111111-1111-4111-8111-111111111111'
+    const working: AgentStatusEntry = {
+      state: 'working',
+      prompt: '',
+      updatedAt: now,
+      stateStartedAt: now,
+      agentType: 'codex',
+      paneKey,
+      worktreeId: 'wt-a',
+      stateHistory: []
+    }
+    mockStore.state = {
+      ...mockStore.state,
+      agentStatusByPaneKey: { [paneKey]: working },
+      repos: [...(mockStore.state.repos as Repo[])]
+    }
+    await renderList(root)
+
+    expect(renderedOrder()).toEqual(['wt-a', 'wt-b'])
+    expect(trackSpy).toHaveBeenCalledWith(
+      'smart_sort_class_distribution',
+      expect.objectContaining({ class_3: 1, total_worktrees: 2 })
+    )
+
+    mockStore.state = {
+      ...mockStore.state,
+      agentStatusByPaneKey: {
+        [paneKey]: { ...working, state: 'blocked', stateStartedAt: now + 1, updatedAt: now + 1 }
+      },
+      repos: [...(mockStore.state.repos as Repo[])]
+    }
+    await renderList(root)
+
+    expect(renderedOrder()).toEqual(['wt-a', 'wt-b'])
+    expect(trackSpy).toHaveBeenCalledWith('smart_sort_class_1_promotion', { cause: 'blocked' })
+  })
 })
diff --git a/src/renderer/src/components/sidebar/WorktreeList.lineage-child-card.test.ts b/src/renderer/src/components/sidebar/WorktreeList.lineage-child-card.test.ts
index 9d97e502065..4e8896fb44d 100644
--- a/src/renderer/src/components/sidebar/WorktreeList.lineage-child-card.test.ts
+++ b/src/renderer/src/components/sidebar/WorktreeList.lineage-child-card.test.ts
@@ -201,10 +201,6 @@ vi.mock('./WorktreeTitleInlineRename', () => ({
     )
 }))
 
-vi.mock('./WorktreeActivityStatusIndicator', () => ({
-  WorktreeActivityStatusIndicator: () => React.createElement('span', { 'data-status-dot': true })
-}))
-
 vi.mock('./WorktreeContextMenu', () => ({
   default: ({ children }: { children: React.ReactNode }) =>
     React.createElement(React.Fragment, null, children),
diff --git a/src/renderer/src/components/sidebar/WorktreeList.tsx b/src/renderer/src/components/sidebar/WorktreeList.tsx
index 422b765f082..575d50d23d1 100644
--- a/src/renderer/src/components/sidebar/WorktreeList.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeList.tsx
@@ -110,6 +110,11 @@ import {
   revealElementInScrollContainer,
   WORKTREE_SIDEBAR_REVEAL_TOP_INSET
 } from './worktree-sidebar-reveal'
+import {
+  createPendingRevealScroll,
+  isRevealScrollSettling,
+  type PendingRevealScroll
+} from './worktree-sidebar-reveal-scroll-settle'
 import {
   getWorkspaceStatus,
   getWorkspaceStatusFromGroupKey,
@@ -124,6 +129,11 @@ import {
   setVisibleWorktreeIds,
   sidebarHasActiveFilters
 } from './visible-worktrees'
+import {
+  EMPTY_PAIRED_DEVICE_IDS_BY_ENVIRONMENT,
+  filterFolderWorkspacesFromOtherDevices,
+  getPairedDeviceIdsByEnvironment
+} from './workspace-creator-visibility'
 import {
   getCyclicProjectedWorktreeLineageIds,
   getWorktreeLineageAncestors
@@ -142,6 +152,8 @@ import {
 } from '@/hooks/useVirtualizedScrollAnchor'
 import { activateAndRevealWorktree } from '@/lib/worktree-activation'
 import { useFolderWorkspacePathStatusCacheExpiryTick } from '@/lib/folder-workspace-path-status-cache-expiry'
+import { useWorktreeListScrollToTop } from './use-worktree-list-scroll-to-top'
+import { WorktreeListScrollToTopButton } from './WorktreeListScrollToTopButton'
 import {
   getFolderWorkspacePathStatusDescription,
   getFolderWorkspacePathStatusTitle
@@ -486,7 +498,8 @@ function revealMountedWorktreeElement(
   container: HTMLElement,
   worktreeId: string,
   behavior: ScrollBehavior,
-  optionId?: string
+  optionId?: string,
+  onScrollIssued?: (targetTop: number) => void
 ): HTMLElement | null {
   const element = optionId
     ? document.getElementById(optionId)
@@ -494,19 +507,24 @@ function revealMountedWorktreeElement(
   if (!element || !container.contains(element)) {
     return null
   }
-  return revealElementInScrollContainer(container, element, behavior) ? element : null
+  return revealElementInScrollContainer(container, element, behavior, onScrollIssued)
+    ? element
+    : null
 }
 
 function revealMountedSidebarRowElement(
   container: HTMLElement,
   rowKey: string,
-  behavior: ScrollBehavior
+  behavior: ScrollBehavior,
+  onScrollIssued?: (targetTop: number) => void
 ): HTMLElement | null {
   const element = document.getElementById(getWorktreeOptionId(rowKey))
   if (!element || !container.contains(element)) {
     return null
   }
-  return revealElementInScrollContainer(container, element, behavior) ? element : null
+  return revealElementInScrollContainer(container, element, behavior, onScrollIssued)
+    ? element
+    : null
 }
 
 function getRenderRowSidebarKey(row: RenderRow): string | null {
@@ -1369,6 +1387,8 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
   scrollAnchorRef
 }: VirtualizedWorktreeViewportProps) {
   const scrollRef = useRef<HTMLDivElement>(null)
+  // Why: callback-ref only mutates scrollRef; state re-runs the scroll-to-top listener attach.
+  const [scrollElement, setScrollElement] = useState<HTMLDivElement | null>(null)
   const suppressMeasurementAdjustmentUntilRef = useRef(0)
   const directScrollInputUntilRef = useRef(0)
   const [dragOverStatus, setDragOverStatus] = useState<WorkspaceStatus | null>(null)
@@ -1401,6 +1421,7 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
   const pendingRevealRetryRef = useRef<{ worktreeId: string; count: number } | null>(null)
   const pendingRowRevealRetryRef = useRef<{ rowKey: string; count: number } | null>(null)
   const pendingRevealFrameIdsRef = useRef<Set<number>>(new Set())
+  const pendingRevealScrollRef = useRef<PendingRevealScroll | null>(null)
   const revealHighlightFrameIdRef = useRef<number | null>(null)
   const revealHighlightTimeoutRef = useRef<number | null>(null)
   const cancelPendingRevealFrames = useCallback(() => {
@@ -2033,14 +2054,34 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
     suppressMeasurementAdjustmentUntilRef.current = suppressUntil
     directScrollInputUntilRef.current = suppressUntil
   }, [])
+  const { showScrollToTop, scrollToTop } = useWorktreeListScrollToTop({
+    scrollElement,
+    onUserScrollIntent: markDirectScrollInput
+  })
   const hasDirectScrollInput = useCallback(
     () => window.performance.now() < directScrollInputUntilRef.current,
     []
   )
+  const markRevealScroll = useCallback((targetTop: number) => {
+    pendingRevealScrollRef.current = createPendingRevealScroll(targetTop, window.performance.now())
+  }, [])
+  const isRevealScrollSettlingNow = useCallback(() => {
+    const settling = isRevealScrollSettling({
+      now: window.performance.now(),
+      pending: pendingRevealScrollRef.current,
+      scrollTop: scrollRef.current?.scrollTop ?? 0
+    })
+    if (!settling) {
+      pendingRevealScrollRef.current = null
+    }
+    return settling
+  }, [])
   // Why: programmatic scrolls keep measurement correction quiet, but only direct input blocks anchor-restore retries.
+  // A reveal's smooth scroll is the exception: restoring the anchor mid-animation cancels it a few pixels in.
   const shouldSkipScrollAnchorRestore = useCallback(
-    () => window.performance.now() < directScrollInputUntilRef.current,
-    []
+    () =>
+      window.performance.now() < directScrollInputUntilRef.current || isRevealScrollSettlingNow(),
+    [isRevealScrollSettlingNow]
   )
 
   const virtualizer = useVirtualizer({
@@ -2206,7 +2247,8 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
               container,
               pendingRevealWorktree.worktreeId,
               pendingRevealWorktree.behavior,
-              getRenderRowOptionId(targetRow, pendingRevealWorktree.worktreeId)
+              getRenderRowOptionId(targetRow, pendingRevealWorktree.worktreeId),
+              markRevealScroll
             )
           : null
         if (revealedOption) {
@@ -2278,6 +2320,7 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
     projectGroups,
     pendingRevealRetryTick,
     flashRevealedRow,
+    markRevealScroll,
     setRenamingWorktreeId,
     schedulePendingRevealFrame,
     cancelPendingRevealFrames
@@ -2366,7 +2409,8 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
         ? revealMountedSidebarRowElement(
             container,
             pendingRevealSidebarRow.rowKey,
-            pendingRevealSidebarRow.behavior
+            pendingRevealSidebarRow.behavior,
+            markRevealScroll
           )
         : null
       if (revealedElement) {
@@ -2401,6 +2445,7 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
     virtualizer,
     pendingRevealRetryTick,
     flashRevealedRow,
+    markRevealScroll,
     clearPendingRevealSidebarRow,
     schedulePendingRevealFrame,
     cancelPendingRevealFrames
@@ -2651,6 +2696,7 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
         clearWorktreeDrag()
       }
       scrollRef.current = node
+      setScrollElement(node)
     },
     [
       cancelPendingRevealFrames,
@@ -5166,6 +5212,7 @@ const VirtualizedWorktreeViewport = React.memo(function VirtualizedWorktreeViewp
           })}
         </div>
       </div>
+      {showScrollToTop ? <WorktreeListScrollToTopButton onClick={scrollToTop} /> : null}
     </div>
   )
 })
@@ -5222,6 +5269,7 @@ const WorktreeList = React.memo(function WorktreeList({
   const hideAutomationGeneratedWorkspaces = useAppStore((s) => s.hideAutomationGeneratedWorkspaces)
   const hideCliCreatedWorkspaces = useAppStore((s) => s.hideCliCreatedWorkspaces)
   const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces)
+  const hideWorkspacesFromOtherDevices = useAppStore((s) => s.hideWorkspacesFromOtherDevices)
   const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace)
   const filterRepoIds = useAppStore((s) => s.filterRepoIds)
   const openModal = useAppStore((s) => s.openModal)
@@ -5310,6 +5358,13 @@ const WorktreeList = React.memo(function WorktreeList({
   const sshConnectionStates = useAppStore((s) => s.sshConnectionStates)
   const runtimeEnvironments = useAppStore((s) => s.runtimeEnvironments)
   const runtimeStatusByEnvironmentId = useAppStore((s) => s.runtimeStatusByEnvironmentId)
+  const pairedDeviceIdsByEnvironment = useMemo(
+    () =>
+      hideWorkspacesFromOtherDevices
+        ? getPairedDeviceIdsByEnvironment(runtimeEnvironments, runtimeStatusByEnvironmentId)
+        : EMPTY_PAIRED_DEVICE_IDS_BY_ENVIRONMENT,
+    [hideWorkspacesFromOtherDevices, runtimeEnvironments, runtimeStatusByEnvironmentId]
+  )
 
   const sortEpoch = useAppStore((s) => s.sortEpoch)
 
@@ -5355,7 +5410,7 @@ const WorktreeList = React.memo(function WorktreeList({
   // Why a ref alongside the memo: telemetry effects need the last attention map without re-reading store state.
   const lastAttentionByWorktreeRef = useRef<Map<string, WorktreeAttention> | null>(null)
 
-  const sortedIds = useMemo(() => {
+  const recomputedSortedIds = useMemo(() => {
     const state = useAppStore.getState()
     const nonArchivedWorktrees = getAllWorktreesFromState(state).filter(
       (worktree) => !worktree.isArchived
@@ -5403,6 +5458,8 @@ const WorktreeList = React.memo(function WorktreeList({
     // debouncedSortEpoch is an intentional trigger not read in the memo; its change (debounced) signals a recompute.
     // oxlint-disable-next-line react-hooks/exhaustive-deps
   }, [debouncedSortEpoch, repoMap, sortBy])
+  // Why: stable ID order prevents rank-only refreshes from echoing an unchanged snapshot.
+  const sortedIds = useReusedArrayIdentity(recomputedSortedIds)
 
   // Why a ref of prior class: fire class_1_promotion only on transitions into Class 1, not every recompute that stays there.
   const prevClassByWorktreeIdRef = useRef<Map<string, SmartClass>>(new Map())
@@ -5428,9 +5485,9 @@ const WorktreeList = React.memo(function WorktreeList({
     }
     prevClassByWorktreeIdRef.current = next
     hasObservedSmartOnceRef.current = true
-  }, [sortBy, sortedIds])
+  }, [sortBy, recomputedSortedIds])
 
-  // Why retry on sortedIds: Smart may activate before attention hydrates; fire once, then stay quiet until the user leaves Smart.
+  // Why retry on recomputation: Smart may activate before attention hydrates; fire once, then stay quiet until the user leaves Smart.
   const hasTrackedSmartDistributionRef = useRef(false)
   useEffect(() => {
     if (sortBy !== 'smart') {
@@ -5467,7 +5524,7 @@ const WorktreeList = React.memo(function WorktreeList({
       total_worktrees: attention.size
     })
     hasTrackedSmartDistributionRef.current = true
-  }, [sortBy, sortedIds])
+  }, [sortBy, recomputedSortedIds])
 
   // Why fire on the transition: switching away from Smart is the signal; compare via ref so a round-trip doesn't double-fire.
   const prevSortByRef = useRef(sortBy)
@@ -5510,6 +5567,8 @@ const WorktreeList = React.memo(function WorktreeList({
       hideAutomationGeneratedWorkspaces,
       hideCliCreatedWorkspaces,
       hideDetachedHeadWorkspaces,
+      hideWorkspacesFromOtherDevices,
+      pairedDeviceIdsByEnvironment,
       alwaysShowDefaultBranchWorkspace,
       repoMap,
       workspaceHostScope,
@@ -5528,6 +5587,7 @@ const WorktreeList = React.memo(function WorktreeList({
     hideAutomationGeneratedWorkspaces,
     hideCliCreatedWorkspaces,
     hideDetachedHeadWorkspaces,
+    hideWorkspacesFromOtherDevices,
     alwaysShowDefaultBranchWorkspace,
     workspaceHostScope,
     visibleWorkspaceHostIds,
@@ -5539,7 +5599,8 @@ const WorktreeList = React.memo(function WorktreeList({
     sortedIds,
     worktreeMap,
     worktreeLineageById,
-    worktreesByRepo
+    worktreesByRepo,
+    pairedDeviceIdsByEnvironment
   ])
   // Why: agentStatusEpoch bumps recompute this memo even when membership and
   // order are unchanged; keeping the previous identity stops the whole
@@ -5628,16 +5689,28 @@ const WorktreeList = React.memo(function WorktreeList({
     () => filterProjectGroupsForVisibleHosts(projectGroups, visibleHostIdSet, defaultHostId),
     [defaultHostId, projectGroups, visibleHostIdSet]
   )
-  const visibleFolderWorkspacesForRows = useMemo(
-    () =>
-      filterFolderWorkspacesForVisibleHosts(
-        folderWorkspaces,
-        projectGroups,
-        visibleHostIdSet,
-        defaultHostId
-      ),
-    [defaultHostId, folderWorkspaces, projectGroups, visibleHostIdSet]
-  )
+  const visibleFolderWorkspacesForRows = useMemo(() => {
+    const hostVisibleWorkspaces = filterFolderWorkspacesForVisibleHosts(
+      folderWorkspaces,
+      projectGroups,
+      visibleHostIdSet,
+      defaultHostId
+    )
+    if (!hideWorkspacesFromOtherDevices) {
+      return hostVisibleWorkspaces
+    }
+    return filterFolderWorkspacesFromOtherDevices(
+      hostVisibleWorkspaces,
+      pairedDeviceIdsByEnvironment
+    )
+  }, [
+    defaultHostId,
+    folderWorkspaces,
+    hideWorkspacesFromOtherDevices,
+    pairedDeviceIdsByEnvironment,
+    projectGroups,
+    visibleHostIdSet
+  ])
   const repoOrder = useMemo(() => {
     return getLogicalRepoOrderRankById(repos.map((repo) => repo.id))
   }, [repos])
@@ -6490,6 +6563,7 @@ const WorktreeList = React.memo(function WorktreeList({
       hideAutomationGeneratedWorkspaces,
       hideCliCreatedWorkspaces,
       hideDetachedHeadWorkspaces,
+      hideWorkspacesFromOtherDevices,
       alwaysShowDefaultBranchWorkspace,
       visibleWorkspaceHostIds,
       workspaceHostScope
@@ -6501,6 +6575,7 @@ const WorktreeList = React.memo(function WorktreeList({
       hideAutomationGeneratedWorkspaces,
       hideCliCreatedWorkspaces,
       hideDetachedHeadWorkspaces,
+      hideWorkspacesFromOtherDevices,
       alwaysShowDefaultBranchWorkspace,
       visibleWorkspaceHostIds,
       workspaceHostScope
@@ -6514,6 +6589,7 @@ const WorktreeList = React.memo(function WorktreeList({
   )
   const setHideCliCreatedWorkspaces = useAppStore((s) => s.setHideCliCreatedWorkspaces)
   const setHideDetachedHeadWorkspaces = useAppStore((s) => s.setHideDetachedHeadWorkspaces)
+  const setHideWorkspacesFromOtherDevices = useAppStore((s) => s.setHideWorkspacesFromOtherDevices)
   const setAlwaysShowDefaultBranchWorkspace = useAppStore(
     (s) => s.setAlwaysShowDefaultBranchWorkspace
   )
@@ -6540,6 +6616,9 @@ const WorktreeList = React.memo(function WorktreeList({
     if (actions.resetHideDetachedHeadWorkspaces) {
       setHideDetachedHeadWorkspaces(false)
     }
+    if (actions.resetHideWorkspacesFromOtherDevices) {
+      setHideWorkspacesFromOtherDevices(false)
+    }
     if (actions.resetAlwaysShowDefaultBranchWorkspace) {
       setAlwaysShowDefaultBranchWorkspace(true)
     }
@@ -6553,6 +6632,7 @@ const WorktreeList = React.memo(function WorktreeList({
     setHideAutomationGeneratedWorkspaces,
     setHideCliCreatedWorkspaces,
     setHideDetachedHeadWorkspaces,
+    setHideWorkspacesFromOtherDevices,
     setAlwaysShowDefaultBranchWorkspace,
     setVisibleWorkspaceHostIds,
     filterState
diff --git a/src/renderer/src/components/sidebar/WorktreeListScrollToTopButton.tsx b/src/renderer/src/components/sidebar/WorktreeListScrollToTopButton.tsx
new file mode 100644
index 00000000000..696557189f7
--- /dev/null
+++ b/src/renderer/src/components/sidebar/WorktreeListScrollToTopButton.tsx
@@ -0,0 +1,50 @@
+import { ChevronsUp } from 'lucide-react'
+import React from 'react'
+import { Button } from '@/components/ui/button'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { translate } from '@/i18n/i18n'
+import { cn } from '@/lib/utils'
+
+export function WorktreeListScrollToTopButton({
+  onClick,
+  className
+}: {
+  onClick: () => void
+  className?: string
+}): React.JSX.Element {
+  const label = translate(
+    'auto.components.sidebar.WorktreeListScrollToTopButton.jumpToTop',
+    'Jump to top'
+  )
+
+  return (
+    <div
+      className={cn(
+        'pointer-events-none absolute inset-x-0 top-2 z-40 flex justify-center',
+        className
+      )}
+    >
+      <Tooltip>
+        <TooltipTrigger asChild>
+          <Button
+            type="button"
+            variant="ghost"
+            size="icon-xs"
+            aria-label={label}
+            onClick={onClick}
+            className={cn(
+              'pointer-events-auto size-6 text-muted-foreground',
+              'hover:bg-worktree-sidebar-accent hover:text-worktree-sidebar-accent-foreground',
+              'animate-in fade-in-0 duration-150 motion-reduce:animate-none'
+            )}
+          >
+            <ChevronsUp className="size-3.5" />
+          </Button>
+        </TooltipTrigger>
+        <TooltipContent side="bottom" sideOffset={4}>
+          {label}
+        </TooltipContent>
+      </Tooltip>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/sidebar/WorktreeTitleInlineRename.editor-lifecycle.test.tsx b/src/renderer/src/components/sidebar/WorktreeTitleInlineRename.editor-lifecycle.test.tsx
new file mode 100644
index 00000000000..97ea646e5c7
--- /dev/null
+++ b/src/renderer/src/components/sidebar/WorktreeTitleInlineRename.editor-lifecycle.test.tsx
@@ -0,0 +1,200 @@
+// @vitest-environment happy-dom
+
+import { StrictMode, useState } from 'react'
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { WorktreeTitleInlineRename } from './WorktreeTitleInlineRename'
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string) => fallback
+}))
+
+vi.mock('@/components/workspace-emoji/WorkspaceEmojiSuggestionPopover', () => ({
+  WorkspaceEmojiSuggestionPopover: () => null
+}))
+
+vi.mock('@/components/workspace-emoji/useWorkspaceEmojiShortcodeInput', () => ({
+  useWorkspaceEmojiShortcodeInput: ({
+    onValueChange
+  }: {
+    onValueChange: (value: string) => void
+  }) => ({
+    close: vi.fn(),
+    commandValue: '',
+    handleKeyDown: () => false,
+    handleValueChange: (value: string) => onValueChange(value),
+    onCommandValueChange: vi.fn(),
+    open: false,
+    selectSuggestion: vi.fn(),
+    suggestions: [],
+    syncCursor: vi.fn()
+  })
+}))
+
+afterEach(() => {
+  cleanup()
+  // cleanup only unmounts, so a prototype spy would outlive its test
+  vi.restoreAllMocks()
+})
+
+const DISPLAY_NAME = 'Feature workspace'
+
+function renameEditor(): HTMLInputElement | null {
+  return screen.queryByRole<HTMLInputElement>('textbox', { name: 'Rename workspace' })
+}
+
+type HarnessProps = {
+  displayName?: string
+  onRename?: (displayName: string) => Promise<void> | void
+  onEditingChange?: (editing: boolean) => void
+  showUnreadEmphasis?: boolean
+}
+
+// Mirrors WorktreeCard: the card clears the trigger as soon as the title consumes it,
+// so from then on the editor stays open on its own state.
+function ShortcutRenameHarness({
+  displayName = DISPLAY_NAME,
+  onRename = vi.fn(),
+  onEditingChange,
+  showUnreadEmphasis = false
+}: HarnessProps): React.JSX.Element {
+  const [renameRequested, setRenameRequested] = useState(true)
+  return (
+    <WorktreeTitleInlineRename
+      displayName={displayName}
+      showUnreadEmphasis={showUnreadEmphasis}
+      onRename={onRename}
+      onEditingChange={onEditingChange}
+      beginEditing={renameRequested}
+      onBeginEditingConsumed={() => setRenameRequested(false)}
+    />
+  )
+}
+
+function openEditorByShortcut(props: HarnessProps = {}): {
+  input: HTMLInputElement
+  markUnread: () => void
+  renameElsewhere: (displayName: string) => void
+} {
+  const { rerender } = render(<ShortcutRenameHarness {...props} />)
+  const input = renameEditor()
+  if (!input) {
+    throw new Error('the rename shortcut did not open an editor')
+  }
+  return {
+    input,
+    markUnread: () => rerender(<ShortcutRenameHarness {...props} showUnreadEmphasis={true} />),
+    renameElsewhere: (displayName) =>
+      rerender(<ShortcutRenameHarness {...props} displayName={displayName} />)
+  }
+}
+
+describe('WorktreeTitleInlineRename editor lifecycle', () => {
+  it('closes the shortcut-opened editor on Escape', () => {
+    const { input } = openEditorByShortcut()
+
+    fireEvent.keyDown(input, { key: 'Escape' })
+
+    expect(renameEditor()).toBeNull()
+  })
+
+  it('closes the shortcut-opened editor once the rename commits', async () => {
+    const onRename = vi.fn().mockResolvedValue(undefined)
+    const { input } = openEditorByShortcut({ onRename })
+
+    fireEvent.change(input, { target: { value: 'Renamed workspace' } })
+    fireEvent.keyDown(input, { key: 'Enter' })
+
+    await waitFor(() => expect(renameEditor()).toBeNull())
+    expect(onRename).toHaveBeenCalledWith('Renamed workspace')
+  })
+
+  it('closes the shortcut-opened editor when it loses focus', async () => {
+    const { input } = openEditorByShortcut()
+
+    fireEvent.blur(input)
+
+    await waitFor(() => expect(renameEditor()).toBeNull())
+  })
+
+  // The parent re-enables drag off this callback, so a close that skips it leaves the
+  // card wedged even though the editor disappeared.
+  it('reports both edit-mode transitions to the parent exactly once', () => {
+    const onEditingChange = vi.fn()
+    const { input } = openEditorByShortcut({ onEditingChange })
+
+    expect(onEditingChange.mock.calls).toEqual([[true]])
+
+    fireEvent.keyDown(input, { key: 'Escape' })
+
+    expect(onEditingChange.mock.calls).toEqual([[true], [false]])
+  })
+
+  it('reports the shortcut-open transition once in Strict Mode', () => {
+    const onEditingChange = vi.fn()
+
+    render(
+      <StrictMode>
+        <ShortcutRenameHarness onEditingChange={onEditingChange} />
+      </StrictMode>
+    )
+
+    expect(onEditingChange.mock.calls).toEqual([[true]])
+  })
+
+  it('opens the editor on double-click and reports it the same way', () => {
+    const onEditingChange = vi.fn()
+    render(
+      <WorktreeTitleInlineRename
+        displayName={DISPLAY_NAME}
+        onRename={vi.fn()}
+        onEditingChange={onEditingChange}
+      />
+    )
+    expect(renameEditor()).toBeNull()
+
+    fireEvent.doubleClick(screen.getByText(DISPLAY_NAME))
+
+    expect(renameEditor()).not.toBeNull()
+    expect(onEditingChange.mock.calls).toEqual([[true]])
+  })
+
+  it('focuses and selects the current name when the editor opens', () => {
+    const select = vi.spyOn(HTMLInputElement.prototype, 'select')
+
+    const { input } = openEditorByShortcut()
+
+    expect(document.activeElement).toBe(input)
+    expect(select).toHaveBeenCalledTimes(1)
+  })
+
+  // The hovercard editor never sets the unread flag, so a title change is the only
+  // way its key used to move.
+  it('leaves an open editor untouched when the workspace is renamed elsewhere', () => {
+    const { input, renameElsewhere } = openEditorByShortcut()
+    fireEvent.change(input, { target: { value: 'Half typed name' } })
+    const selectAfterOpen = vi.spyOn(HTMLInputElement.prototype, 'select')
+
+    renameElsewhere('Renamed by an agent')
+
+    expect(renameEditor()).toBe(input)
+    expect(input.value).toBe('Half typed name')
+    expect(document.activeElement).toBe(input)
+    expect(selectAfterOpen).not.toHaveBeenCalled()
+  })
+
+  it('leaves an open editor untouched when an unread notification arrives', () => {
+    const { input, markUnread } = openEditorByShortcut()
+    fireEvent.change(input, { target: { value: 'Half typed name' } })
+    const selectAfterOpen = vi.spyOn(HTMLInputElement.prototype, 'select')
+
+    markUnread()
+
+    // A remount re-runs focus + select and the next keystroke replaces the name; the
+    // value and focus assertions catch the same loss arriving without one.
+    expect(renameEditor()).toBe(input)
+    expect(input.value).toBe('Half typed name')
+    expect(document.activeElement).toBe(input)
+    expect(selectAfterOpen).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/sidebar/WorktreeTitleInlineRename.tsx b/src/renderer/src/components/sidebar/WorktreeTitleInlineRename.tsx
index ec670c3c506..9a6ef537a84 100644
--- a/src/renderer/src/components/sidebar/WorktreeTitleInlineRename.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeTitleInlineRename.tsx
@@ -123,6 +123,8 @@ export function WorktreeTitleInlineRename({
     [measureTitleTruncated, wrapTitle]
   )
 
+  // Why: remounts the rendered title so truncation is measured again. The editor must
+  // not share it — an unread flip would remount the input and reselect what was typed.
   const titleElementKey = `${displayName}:${showUnreadEmphasis ? 'unread' : 'read'}`
   // Why: the sidebar row needs a text-only editor to avoid layout jumps; the
   // hovercard can use a compact field that reads more like native rename UI.
@@ -149,6 +151,12 @@ export function WorktreeTitleInlineRename({
     [measureTitleTruncated, onEditingChange]
   )
 
+  // Why: double-click and the shortcut both open here, so neither can skip a step.
+  const openRenameEditor = useCallback(() => {
+    setValue(displayName)
+    setEditingMode(true)
+  }, [displayName, setEditingMode])
+
   const handleInputRef = useCallback((input: HTMLInputElement | null) => {
     inputElementRef.current = input
     if (!input) {
@@ -170,9 +178,8 @@ export function WorktreeTitleInlineRename({
     if (disabled || editing) {
       return
     }
-    setValue(displayName)
-    setEditing(true)
-  }, [beginEditing, disabled, editing, displayName, onBeginEditingConsumed])
+    openRenameEditor()
+  }, [beginEditing, disabled, editing, onBeginEditingConsumed, openRenameEditor])
 
   const stopCardEvent = useCallback((event: React.SyntheticEvent) => {
     event.stopPropagation()
@@ -185,10 +192,9 @@ export function WorktreeTitleInlineRename({
       }
       event.preventDefault()
       event.stopPropagation()
-      setValue(displayName)
-      setEditingMode(true)
+      openRenameEditor()
     },
-    [disabled, displayName, setEditingMode]
+    [disabled, openRenameEditor]
   )
 
   const cancelRename = useCallback(() => {
@@ -260,7 +266,6 @@ export function WorktreeTitleInlineRename({
     return (
       <>
         <span
-          key={`editing:${titleElementKey}`}
           ref={handleRootRef}
           className={cn(
             'relative grid min-w-0 truncate leading-tight text-foreground',
diff --git a/src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts b/src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts
new file mode 100644
index 00000000000..35ce05a2244
--- /dev/null
+++ b/src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it, vi } from 'vitest'
+import { parseExecutionHostId } from '../../../../shared/execution-host'
+import { routeAddRepoBrowse } from './add-repo-browse-authority'
+
+describe('routeAddRepoBrowse', () => {
+  it('opens paired host browsing without invoking native pickFolders', () => {
+    const pickFolders = vi.fn()
+    const browseRuntime = vi.fn()
+
+    routeAddRepoBrowse(parseExecutionHostId('runtime:paired-host'), {
+      browseLocal: pickFolders,
+      browseRuntime,
+      browseSsh: vi.fn()
+    })
+
+    expect(browseRuntime).toHaveBeenCalledOnce()
+    expect(pickFolders).not.toHaveBeenCalled()
+  })
+
+  it('preserves native folder browsing for desktop local hosts', () => {
+    const pickFolders = vi.fn()
+
+    routeAddRepoBrowse(parseExecutionHostId('local'), {
+      browseLocal: pickFolders,
+      browseRuntime: vi.fn(),
+      browseSsh: vi.fn()
+    })
+
+    expect(pickFolders).toHaveBeenCalledOnce()
+  })
+
+  it('preserves SSH host browsing', () => {
+    const browseSsh = vi.fn()
+
+    routeAddRepoBrowse(parseExecutionHostId('ssh:builder'), {
+      browseLocal: vi.fn(),
+      browseRuntime: vi.fn(),
+      browseSsh
+    })
+
+    expect(browseSsh).toHaveBeenCalledWith('builder')
+  })
+})
diff --git a/src/renderer/src/components/sidebar/add-repo-browse-authority.ts b/src/renderer/src/components/sidebar/add-repo-browse-authority.ts
new file mode 100644
index 00000000000..364e21201e4
--- /dev/null
+++ b/src/renderer/src/components/sidebar/add-repo-browse-authority.ts
@@ -0,0 +1,24 @@
+import type { ParsedExecutionHost } from '../../../../shared/execution-host'
+
+export type AddRepoBrowseAuthorityActions = {
+  browseLocal: () => void
+  browseRuntime: () => void
+  browseSsh: (targetId: string) => void
+}
+
+export function routeAddRepoBrowse(
+  host: ParsedExecutionHost | null,
+  actions: AddRepoBrowseAuthorityActions
+): void {
+  if (host?.kind === 'runtime') {
+    actions.browseRuntime()
+    return
+  }
+  if (host?.kind === 'ssh') {
+    actions.browseSsh(host.targetId)
+    return
+  }
+  if (host?.kind === 'local') {
+    actions.browseLocal()
+  }
+}
diff --git a/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts b/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts
index 9187dd02e13..9f06dda9df2 100644
--- a/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts
+++ b/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts
@@ -58,6 +58,8 @@ function visibleOptions(overrides: Partial<VisibleOptions> = {}): VisibleOptions
     hideAutomationGeneratedWorkspaces: false,
     hideCliCreatedWorkspaces: false,
     hideDetachedHeadWorkspaces: false,
+    hideWorkspacesFromOtherDevices: false,
+    pairedDeviceIdsByEnvironment: new Map(),
     repoMap,
     workspaceHostScope: 'all',
     defaultHostId: LOCAL_EXECUTION_HOST_ID,
@@ -95,6 +97,7 @@ describe('#8873 default-branch workspace under "Hide sleeping"', () => {
       'hideAutomationGeneratedWorkspaces',
       'hideCliCreatedWorkspaces',
       'hideDetachedHeadWorkspaces',
+      'hideWorkspacesFromOtherDevices',
       'alwaysShowDefaultBranchWorkspace',
       'visibleWorkspaceHostIds',
       'workspaceHostScope'
diff --git a/src/renderer/src/components/sidebar/delete-worktree-flow.test.ts b/src/renderer/src/components/sidebar/delete-worktree-flow.test.ts
index 941c4d38eaa..248b8883ae0 100644
--- a/src/renderer/src/components/sidebar/delete-worktree-flow.test.ts
+++ b/src/renderer/src/components/sidebar/delete-worktree-flow.test.ts
@@ -74,7 +74,11 @@ vi.mock('./delete-worktree-failure-toast', () => ({
 
 import { toast } from 'sonner'
 import { showDeleteWorktreeFailureToast } from './delete-worktree-failure-toast'
-import { runWorktreeBatchDelete, runWorktreeDelete } from './delete-worktree-flow'
+import {
+  runWorktreeBatchDelete,
+  runWorktreeDelete,
+  runWorktreeDeletesInParallel
+} from './delete-worktree-flow'
 
 function setWorktrees(
   worktrees: {
@@ -101,7 +105,7 @@ function setWorktrees(
   )
 }
 
-describe('runWorktreeBatchDelete', () => {
+describe('delete worktree flow', () => {
   beforeEach(() => {
     mocks.state.settings = { skipDeleteWorktreeConfirm: false }
     mocks.state.clearWorktreeDeleteState.mockClear()
@@ -129,6 +133,10 @@ describe('runWorktreeBatchDelete', () => {
     expect(mocks.state.clearWorktreeDeleteState).not.toHaveBeenCalledWith('main')
     expect(mocks.state.openModal).toHaveBeenCalledWith('delete-worktree', {
       worktreeIds: ['wt-1', 'wt-2'],
+      worktreeDeleteIdentities: [
+        { id: 'wt-1', instanceId: 'wt-1-instance' },
+        { id: 'wt-2', instanceId: 'wt-2-instance' }
+      ],
       allowSkipConfirm: false
     })
   })
@@ -139,7 +147,10 @@ describe('runWorktreeBatchDelete', () => {
     const started = runWorktreeBatchDelete(['main', 'wt-1'])
 
     expect(started).toBe(true)
-    expect(mocks.state.openModal).toHaveBeenCalledWith('delete-worktree', { worktreeId: 'wt-1' })
+    expect(mocks.state.openModal).toHaveBeenCalledWith('delete-worktree', {
+      worktreeId: 'wt-1',
+      worktreeDeleteIdentities: [{ id: 'wt-1', instanceId: 'wt-1-instance' }]
+    })
   })
 
   it('treats duplicate selected ids as one delete target', () => {
@@ -149,7 +160,91 @@ describe('runWorktreeBatchDelete', () => {
 
     expect(started).toBe(true)
     expect(mocks.state.clearWorktreeDeleteState).toHaveBeenCalledTimes(1)
-    expect(mocks.state.openModal).toHaveBeenCalledWith('delete-worktree', { worktreeId: 'wt-1' })
+    expect(mocks.state.openModal).toHaveBeenCalledWith('delete-worktree', {
+      worktreeId: 'wt-1',
+      worktreeDeleteIdentities: [{ id: 'wt-1', instanceId: 'wt-1-instance' }]
+    })
+  })
+
+  it('rejects the whole batch when a selected path belongs to a different instance', () => {
+    setWorktrees([
+      { id: 'wt-1', instanceId: 'instance-1' },
+      { id: 'wt-2', instanceId: 'instance-2' }
+    ])
+
+    const started = runWorktreeBatchDelete([
+      { id: 'wt-1', instanceId: 'instance-1' },
+      { id: 'wt-2', instanceId: 'replaced-instance' }
+    ])
+
+    expect(started).toBe(false)
+    expect(mocks.state.clearWorktreeDeleteState).not.toHaveBeenCalled()
+    expect(mocks.state.openModal).not.toHaveBeenCalled()
+    expect(mocks.state.removeWorktree).not.toHaveBeenCalled()
+    expect(toast.info).toHaveBeenCalledWith(
+      'Workspace list changed',
+      expect.objectContaining({
+        description: 'Refresh Space and try again if the workspace list looks stale.'
+      })
+    )
+  })
+
+  it('opens batch confirmation when every selected instance is still current', () => {
+    setWorktrees([
+      { id: 'wt-1', instanceId: 'instance-1' },
+      { id: 'wt-2', instanceId: 'instance-2' }
+    ])
+
+    const started = runWorktreeBatchDelete([
+      { id: 'wt-1', instanceId: 'instance-1' },
+      { id: 'wt-2', instanceId: 'instance-2' }
+    ])
+
+    expect(started).toBe(true)
+    expect(toast.info).not.toHaveBeenCalled()
+    expect(mocks.state.openModal).toHaveBeenCalledWith('delete-worktree', {
+      worktreeIds: ['wt-1', 'wt-2'],
+      worktreeDeleteIdentities: [
+        { id: 'wt-1', instanceId: 'instance-1' },
+        { id: 'wt-2', instanceId: 'instance-2' }
+      ],
+      allowSkipConfirm: false
+    })
+  })
+
+  it('revalidates each queued instance immediately before execution', async () => {
+    setWorktrees([
+      { id: 'wt-1', instanceId: 'instance-1', path: '/workspaces/first-longer' },
+      { id: 'wt-2', instanceId: 'instance-2', path: '/workspaces/second' }
+    ])
+    const targets = Array.from(mocks.state.worktreeMap.values())
+    let finishFirst!: (result: { ok: true }) => void
+    mocks.state.removeWorktree.mockImplementationOnce(
+      () => new Promise((resolve) => (finishFirst = resolve))
+    )
+
+    const deletion = runWorktreeDeletesInParallel(targets)
+    await vi.waitFor(() =>
+      expect(mocks.state.removeWorktree).toHaveBeenCalledWith('wt-1', false, {
+        suppressPreservedBranchToast: true
+      })
+    )
+    setWorktrees([
+      { id: 'wt-1', instanceId: 'instance-1', path: '/workspaces/first-longer' },
+      { id: 'wt-2', instanceId: 'replacement-instance', path: '/workspaces/second' }
+    ])
+    finishFirst({ ok: true })
+
+    await expect(deletion).resolves.toEqual(['wt-1'])
+    expect(mocks.state.removeWorktree).not.toHaveBeenCalledWith('wt-2', false, {
+      suppressPreservedBranchToast: true
+    })
+    expect(toast.info).toHaveBeenCalledWith(
+      'Workspace list changed',
+      expect.objectContaining({
+        description: 'Refresh Space and try again if the workspace list looks stale.'
+      })
+    )
   })
 
   it('keeps batch deletes behind confirmation when confirmation is skipped', () => {
@@ -166,6 +261,10 @@ describe('runWorktreeBatchDelete', () => {
     expect(mocks.state.removeWorktree).not.toHaveBeenCalled()
     expect(mocks.state.openModal).toHaveBeenCalledWith('delete-worktree', {
       worktreeIds: ['wt-1', 'wt-2'],
+      worktreeDeleteIdentities: [
+        { id: 'wt-1', instanceId: 'wt-1-instance' },
+        { id: 'wt-2', instanceId: 'wt-2-instance' }
+      ],
       allowSkipConfirm: false,
       onDeleted
     })
@@ -271,6 +370,11 @@ describe('runWorktreeBatchDelete', () => {
     expect(mocks.state.removeWorktree).not.toHaveBeenCalled()
     expect(mocks.state.openModal).toHaveBeenCalledWith('delete-worktree', {
       worktreeId: 'parent',
+      worktreeDeleteIdentities: [{ id: 'parent', instanceId: 'parent-instance' }],
+      lineageDeleteIdentities: [
+        { id: 'child', instanceId: 'child-instance' },
+        { id: 'parent', instanceId: 'parent-instance' }
+      ],
       allowSkipConfirm: false
     })
   })
@@ -297,10 +401,80 @@ describe('runWorktreeBatchDelete', () => {
     expect(mocks.state.removeWorktree).not.toHaveBeenCalled()
     expect(mocks.state.openModal).toHaveBeenCalledWith('delete-worktree', {
       worktreeId: 'parent',
+      worktreeDeleteIdentities: [{ id: 'parent', instanceId: 'parent-instance' }],
+      lineageDeleteIdentities: [
+        { id: 'child', instanceId: 'child-instance' },
+        { id: 'parent', instanceId: 'parent-instance' }
+      ],
       allowSkipConfirm: false
     })
   })
 
+  it('reports a stale list instead of silently dropping a delete whose row vanished', () => {
+    mocks.state.settings = { skipDeleteWorktreeConfirm: true }
+    setWorktrees([])
+
+    runWorktreeDelete('wt-1')
+
+    expect(mocks.state.removeWorktree).not.toHaveBeenCalled()
+    expect(mocks.state.openModal).not.toHaveBeenCalled()
+    expect(mocks.state.clearWorktreeDeleteState).not.toHaveBeenCalled()
+    expect(toast.info).toHaveBeenCalledWith(
+      'Workspace list changed',
+      expect.objectContaining({
+        description: 'Refresh Space and try again if the workspace list looks stale.'
+      })
+    )
+  })
+
+  it('rejects a delayed delete when the path now belongs to a different instance', () => {
+    mocks.state.settings = { skipDeleteWorktreeConfirm: true }
+    setWorktrees([{ id: 'wt-1', instanceId: 'instance-2' }])
+
+    runWorktreeDelete('wt-1', { expectedInstanceId: 'instance-1' })
+
+    expect(mocks.state.removeWorktree).not.toHaveBeenCalled()
+    expect(mocks.state.openModal).not.toHaveBeenCalled()
+    expect(toast.info).toHaveBeenCalledWith(
+      'Workspace list changed',
+      expect.objectContaining({
+        description: 'Refresh Space and try again if the workspace list looks stale.'
+      })
+    )
+  })
+
+  it('runs a delayed delete when the captured instance is still current', () => {
+    mocks.state.settings = { skipDeleteWorktreeConfirm: true }
+    setWorktrees([{ id: 'wt-1', instanceId: 'instance-1', displayName: 'one' }])
+
+    runWorktreeDelete('wt-1', { expectedInstanceId: 'instance-1' })
+
+    expect(toast.info).not.toHaveBeenCalled()
+    expect(mocks.state.removeWorktree).toHaveBeenCalledWith('wt-1', false)
+  })
+
+  // Why: the delete-current-workspace shortcut (useIpcEvents) forwards whatever workspace is
+  // active, and a folder workspace is never in the worktree map — claiming it vanished would lie.
+  it('stays silent for a folder workspace, which this funnel does not route', () => {
+    mocks.state.settings = { skipDeleteWorktreeConfirm: true }
+    setWorktrees([])
+
+    runWorktreeDelete('folder:11111111-2222-3333-4444-555555555555')
+
+    expect(mocks.state.removeWorktree).not.toHaveBeenCalled()
+    expect(toast.info).not.toHaveBeenCalled()
+  })
+
+  it('does not report a stale list when the workspace is still present', () => {
+    mocks.state.settings = { skipDeleteWorktreeConfirm: true }
+    setWorktrees([{ id: 'wt-1', displayName: 'one' }])
+
+    runWorktreeDelete('wt-1')
+
+    expect(toast.info).not.toHaveBeenCalled()
+    expect(mocks.state.removeWorktree).toHaveBeenCalledWith('wt-1', false)
+  })
+
   it('opens project removal confirmation for a primary workspace', () => {
     mocks.state.settings = { skipDeleteWorktreeConfirm: true }
     setWorktrees([
@@ -334,6 +508,7 @@ describe('runWorktreeBatchDelete', () => {
     expect(mocks.state.removeWorktree).not.toHaveBeenCalled()
     expect(mocks.state.openModal).toHaveBeenCalledWith('delete-worktree', {
       worktreeId: 'wt-1',
+      worktreeDeleteIdentities: [{ id: 'wt-1', instanceId: 'wt-1-instance' }],
       allowSkipConfirm: false,
       onDeleted
     })
diff --git a/src/renderer/src/components/sidebar/delete-worktree-flow.ts b/src/renderer/src/components/sidebar/delete-worktree-flow.ts
index 6259789187b..2daca622729 100644
--- a/src/renderer/src/components/sidebar/delete-worktree-flow.ts
+++ b/src/renderer/src/components/sidebar/delete-worktree-flow.ts
@@ -1,221 +1,46 @@
-import { toast } from 'sonner'
 import { useAppStore } from '@/store'
 import { getAllWorktreesFromState, getWorktreeMapFromState } from '@/store/selectors'
 import { findRepoForHost } from '@/store/slices/repo-host-identity'
-import { activateAndRevealWorktree } from '@/lib/worktree-activation'
-import { prepareActiveWorktreeFocusAfterDelete } from './active-worktree-focus-after-delete'
-import { showDeleteWorktreeFailureToast } from './delete-worktree-failure-toast'
+import {
+  showNoDeletableWorkspacesToast,
+  showWorkspaceListChangedToast
+} from './stale-workspace-list-toast'
 import { getWorkspaceDeleteLineage } from './workspace-delete-lineage'
 import { resolveSshWorkspaceForget } from './ssh-workspace-forget-resolution'
 import { isPairedWebClientWindow } from '@/lib/desktop-window-chrome'
+import { parseWorkspaceKey } from '../../../../shared/workspace-scope'
 import {
-  isPathInsideOrEqual,
-  normalizeRuntimePathForComparison
-} from '../../../../shared/cross-platform-path'
-import type { Worktree } from '../../../../shared/types'
-import { translate } from '@/i18n/i18n'
+  resolveWorktreeBatchDeleteTargets,
+  toWorktreeDeleteIdentities,
+  type WorktreeBatchDeleteOptions,
+  type WorktreeDeleteIdentity,
+  type WorktreeDeleteOptions
+} from './worktree-delete-request'
+import {
+  runWorktreeDeletesInParallel,
+  runWorktreeDeleteWithToast
+} from './worktree-delete-execution'
 
-type WorktreeBatchDeleteOptions = {
-  forceConfirm?: boolean
-  onDeleted?: (worktreeIds: string[]) => void
-}
-
-type WorktreeDeleteWithToastOptions = {
-  force?: boolean
-  onForceDeleted?: (worktreeId: string) => void
-  // Why: batch deletes suppress the per-delete focus handoff to focus one survivor after the batch (see runWorktreeDeletesInParallel).
-  focusSuccessorOnDelete?: boolean
-}
-
-// Why: a failed delete usually means unresolved changes, so land on the diff panel, not just focus the worktree.
-function viewWorktreeDiff(worktreeId: string): void {
-  activateAndRevealWorktree(worktreeId)
-  const state = useAppStore.getState()
-  state.setRightSidebarTab('source-control')
-  state.setRightSidebarOpen(true)
-}
-
-function isStrictDescendantPath(parentPath: string, childPath: string): boolean {
-  return (
-    normalizeRuntimePathForComparison(parentPath) !==
-      normalizeRuntimePathForComparison(childPath) && isPathInsideOrEqual(parentPath, childPath)
-  )
-}
-
-export async function runWorktreeDeletesInParallel(
-  targets: readonly Pick<Worktree, 'id' | 'displayName' | 'repoId' | 'path'>[],
-  options: WorktreeDeleteWithToastOptions = {}
-): Promise<string[]> {
-  // Why: refresh races can leave duplicate rows, but a destructive command must run once per identity.
-  const uniqueTargets = Array.from(new Map(targets.map((target) => [target.id, target])).values())
-  // Why: capture the viewed workspace before any delete so we can focus one survivor after the batch settles, not per delete.
-  const activeWorktreeIdBefore = useAppStore.getState().activeWorktreeId
-  const commitBatchFocus = activeWorktreeIdBefore
-    ? prepareActiveWorktreeFocusAfterDelete(activeWorktreeIdBefore)
-    : null
-  // Why: mark every target deleting up front for immediate in-flight feedback, even though deletes serialize per repo.
-  useAppStore.getState().markWorktreesDeleting(uniqueTargets.map((target) => target.id))
-  // Why: worktree remove/prune/branch -D race on shared ref locks; group by repoId to serialize per repo (cross-repo stays parallel).
-  const groups = new Map<string, (typeof uniqueTargets)[number][]>()
-  for (const target of uniqueTargets) {
-    const group = groups.get(target.repoId)
-    if (group) {
-      group.push(target)
-    } else {
-      groups.set(target.repoId, [target])
-    }
-  }
-  for (const group of groups.values()) {
-    // Why: delete nested children first — else the parent delete is rejected while it still contains a registered worktree.
-    group.sort((a, b) => b.path.length - a.path.length)
-  }
-  const groupResults = await Promise.all(
-    Array.from(groups.values()).map(async (group) => {
-      const deletedInGroup: string[] = []
-      const failedInGroup: (typeof group)[number][] = []
-      for (const target of group) {
-        if (failedInGroup.some((failed) => isStrictDescendantPath(target.path, failed.path))) {
-          useAppStore.getState().clearWorktreeDeleteState(target.id)
-          continue
-        }
-        const deleted = await runWorktreeDeleteWithToast(target.id, target.displayName, {
-          ...options,
-          focusSuccessorOnDelete: false
-        })
-        if (deleted) {
-          deletedInGroup.push(target.id)
-        } else {
-          // Why: after a descendant delete fails, deleting an ancestor can still remove that child from disk (it lives under the parent).
-          failedInGroup.push(target)
-        }
-      }
-      return deletedInGroup
-    })
-  )
-  const deletedSet = new Set(groupResults.flat())
-  // Why: focus a survivor once after the batch settles — an intermediate focus could spawn a terminal in a to-be-deleted workspace.
-  if (activeWorktreeIdBefore && deletedSet.has(activeWorktreeIdBefore)) {
-    commitBatchFocus?.()
-  }
-  return uniqueTargets.filter((target) => deletedSet.has(target.id)).map((target) => target.id)
-}
-
-/**
- * Shared delete-with-toast flow for both DeleteWorktreeDialog (confirm) and
- * WorktreeContextMenu (skip-confirm), so both entry points behave identically.
- *
- * A renderer-layer helper (not a store action) to keep UI concerns out of the store slice.
- */
-export function runWorktreeDeleteWithToast(
-  worktreeId: string,
-  worktreeName: string,
-  options: WorktreeDeleteWithToastOptions = {}
-): Promise<boolean> {
-  const removeWorktree = useAppStore.getState().removeWorktree
-  const commitFocus = prepareActiveWorktreeFocusAfterDelete(worktreeId)
-  const focusSuccessor = options.focusSuccessorOnDelete !== false
-
-  return removeWorktree(worktreeId, options.force === true)
-    .then((result) => {
-      if (result.ok) {
-        // Why: keep the user on a live workspace instead of the Landing screen when they delete the one they were viewing.
-        if (focusSuccessor) {
-          commitFocus()
-        }
-        return true
-      }
-      const state = useAppStore.getState().deleteStateByWorktreeId[worktreeId]
-      const canForceDelete = state?.canForceDelete ?? false
-      const hasKnownChanges =
-        (useAppStore.getState().gitStatusByWorktree[worktreeId]?.length ?? 0) > 0
-      showDeleteWorktreeFailureToast({
-        error: result.error,
-        canForceDelete,
-        forceDeleteReason: state?.forceDeleteReason ?? null,
-        lockReason: state?.lockReason ?? null,
-        hasKnownChanges,
-        onViewChanges: () => viewWorktreeDiff(worktreeId),
-        onForceDelete: () => {
-          // Why: recapture at click time — the user may have navigated away while the toast was open, so focus only hands off if still viewed.
-          const commitForceFocus = prepareActiveWorktreeFocusAfterDelete(worktreeId)
-          // Why (#11960): the user clicked Force Delete on a failure toast, so this
-          // retry may waive the PTY-stop proof the first attempt could not satisfy.
-          const forceRemoval = useAppStore
-            .getState()
-            .removeWorktree(worktreeId, true, { allowUnverifiedPtyStop: true })
-          forceRemoval
-            .then((forceResult) => {
-              if (!forceResult.ok) {
-                toast.error(
-                  translate(
-                    'auto.components.sidebar.delete.worktree.flow.4f3876c0f5',
-                    'Force delete failed'
-                  ),
-                  {
-                    description: forceResult.error,
-                    action: {
-                      label: translate(
-                        'auto.components.sidebar.delete.worktree.flow.7488ed8711',
-                        'View'
-                      ),
-                      onClick: () => viewWorktreeDiff(worktreeId)
-                    }
-                  }
-                )
-                return
-              }
-              commitForceFocus()
-              options.onForceDeleted?.(worktreeId)
-            })
-            .catch((err: unknown) => {
-              toast.error(
-                translate(
-                  'auto.components.sidebar.delete.worktree.flow.ae57cbf6e4',
-                  'Failed to delete workspace'
-                ),
-                {
-                  description: err instanceof Error ? err.message : String(err),
-                  action: {
-                    label: translate(
-                      'auto.components.sidebar.delete.worktree.flow.7488ed8711',
-                      'View'
-                    ),
-                    onClick: () => viewWorktreeDiff(worktreeId)
-                  }
-                }
-              )
-            })
-        },
-        worktreeId,
-        worktreeName
-      })
-      return false
-    })
-    .catch((err: unknown) => {
-      toast.error(
-        translate(
-          'auto.components.sidebar.delete.worktree.flow.ae57cbf6e4',
-          'Failed to delete workspace'
-        ),
-        {
-          description: err instanceof Error ? err.message : String(err)
-        }
-      )
-      return false
-    })
-}
+export { runWorktreeDeletesInParallel, runWorktreeDeleteWithToast }
 
 /**
  * Shared funnel for the standard (non-folder) delete decision tree (WorktreeContextMenu,
  * MemoryStatusSegment); branches on the `skipDeleteWorktreeConfirm` preference.
  *
- * The missing-record guard is defense-in-depth: refuse to act if the record vanished
- * between render and click (concurrent delete or state reset).
+ * The missing-record and instance guards reject stale actions after concurrent state changes.
  */
-export function runWorktreeDelete(worktreeId: string): void {
+export function runWorktreeDelete(worktreeId: string, options: WorktreeDeleteOptions = {}): void {
   const state = useAppStore.getState()
   const target = getWorktreeMapFromState(state).get(worktreeId) ?? null
-  if (!target) {
+  const instanceChanged =
+    Object.hasOwn(options, 'expectedInstanceId') &&
+    target?.instanceId !== options.expectedInstanceId
+  if (!target || instanceChanged) {
+    // Why: folder workspaces are never in the worktree map — their callers own that route, so a
+    // miss there is a routing gap, not a stale list, and must not claim the workspace is gone.
+    if (parseWorkspaceKey(worktreeId)?.type !== 'folder') {
+      showWorkspaceListChangedToast()
+    }
     return
   }
   if (target.isMainWorktree) {
@@ -254,9 +79,12 @@ export function runWorktreeDelete(worktreeId: string): void {
     return
   }
 
-  const hasLineageChildren =
-    getWorkspaceDeleteLineage(target, getAllWorktreesFromState(state), state.worktreeLineageById)
-      .descendants.length > 0
+  const deleteLineage = getWorkspaceDeleteLineage(
+    target,
+    getAllWorktreesFromState(state),
+    state.worktreeLineageById
+  )
+  const hasLineageChildren = deleteLineage.descendants.length > 0
   const skipConfirm = state.settings?.skipDeleteWorktreeConfirm ?? false
   if (skipConfirm && !hasLineageChildren) {
     void runWorktreeDeleteWithToast(worktreeId, target.displayName)
@@ -264,33 +92,32 @@ export function runWorktreeDelete(worktreeId: string): void {
   }
   state.openModal('delete-worktree', {
     worktreeId,
+    worktreeDeleteIdentities: toWorktreeDeleteIdentities([target]),
+    ...(hasLineageChildren
+      ? {
+          lineageDeleteIdentities: toWorktreeDeleteIdentities(deleteLineage.deleteAllTargets)
+        }
+      : {}),
     ...(hasLineageChildren ? { allowSkipConfirm: false } : {})
   })
 }
 
 export function runWorktreeBatchDelete(
-  worktreeIds: readonly string[],
+  requestedWorktrees: readonly string[] | readonly WorktreeDeleteIdentity[],
   options: WorktreeBatchDeleteOptions = {}
 ): boolean {
   const state = useAppStore.getState()
-  const worktreeMap = getWorktreeMapFromState(state)
-  const targets = Array.from(new Set(worktreeIds))
-    .map((id) => worktreeMap.get(id) ?? null)
-    .filter((worktree): worktree is Worktree => worktree != null && !worktree.isMainWorktree)
+  const targets = resolveWorktreeBatchDeleteTargets(
+    requestedWorktrees,
+    getWorktreeMapFromState(state)
+  )
+  if (!targets) {
+    showWorkspaceListChangedToast()
+    return false
+  }
 
   if (targets.length === 0) {
-    toast.info(
-      translate(
-        'auto.components.sidebar.delete.worktree.flow.7243145cd6',
-        'No deletable workspaces selected'
-      ),
-      {
-        description: translate(
-          'auto.components.sidebar.delete.worktree.flow.b81b4e40ca',
-          'Refresh Space and try again if the workspace list looks stale.'
-        )
-      }
-    )
+    showNoDeletableWorkspacesToast()
     return false
   }
 
@@ -299,13 +126,15 @@ export function runWorktreeBatchDelete(
   }
 
   // Why: bulk cleanup can destroy many directories at once, so batch/Space deletes keep an explicit confirmation step.
-  const singleTargetHasLineageChildren =
-    targets.length === 1 &&
-    getWorkspaceDeleteLineage(
-      targets[0],
-      getAllWorktreesFromState(state),
-      state.worktreeLineageById
-    ).descendants.length > 0
+  const singleTargetLineage =
+    targets.length === 1
+      ? getWorkspaceDeleteLineage(
+          targets[0],
+          getAllWorktreesFromState(state),
+          state.worktreeLineageById
+        )
+      : null
+  const singleTargetHasLineageChildren = (singleTargetLineage?.descendants.length ?? 0) > 0
   const skipConfirm =
     !options.forceConfirm &&
     targets.length === 1 &&
@@ -325,6 +154,14 @@ export function runWorktreeBatchDelete(
   if (targets.length === 1) {
     state.openModal('delete-worktree', {
       worktreeId: targets[0].id,
+      worktreeDeleteIdentities: toWorktreeDeleteIdentities(targets),
+      ...(singleTargetHasLineageChildren && singleTargetLineage
+        ? {
+            lineageDeleteIdentities: toWorktreeDeleteIdentities(
+              singleTargetLineage.deleteAllTargets
+            )
+          }
+        : {}),
       ...(options.forceConfirm || singleTargetHasLineageChildren
         ? { allowSkipConfirm: false }
         : {}),
@@ -335,6 +172,7 @@ export function runWorktreeBatchDelete(
 
   state.openModal('delete-worktree', {
     worktreeIds: targets.map((target) => target.id),
+    worktreeDeleteIdentities: toWorktreeDeleteIdentities(targets),
     allowSkipConfirm: false,
     ...(options.onDeleted ? { onDeleted: options.onDeleted } : {})
   })
diff --git a/src/renderer/src/components/sidebar/delete-worktree-parallel-flow.test.ts b/src/renderer/src/components/sidebar/delete-worktree-parallel-flow.test.ts
index 817a02f2040..42411ff6fce 100644
--- a/src/renderer/src/components/sidebar/delete-worktree-parallel-flow.test.ts
+++ b/src/renderer/src/components/sidebar/delete-worktree-parallel-flow.test.ts
@@ -46,8 +46,21 @@ vi.mock('sonner', () => ({
   }
 }))
 
+vi.mock('./preserved-branch-batch-toast', () => ({
+  showPreservedBranchBatchToast: vi.fn()
+}))
+
 import { toast } from 'sonner'
 import { runWorktreeDeletesInParallel } from './delete-worktree-flow'
+import { showPreservedBranchBatchToast } from './preserved-branch-batch-toast'
+
+function runDeletesForCurrentWorktrees(
+  targets: Parameters<typeof runWorktreeDeletesInParallel>[0],
+  options?: Parameters<typeof runWorktreeDeletesInParallel>[1]
+) {
+  mocks.state.worktreeMap = new Map(targets.map((target) => [target.id, target]))
+  return runWorktreeDeletesInParallel(targets, options)
+}
 
 function deferredDeleteResult(): {
   promise: Promise<{ ok: true }>
@@ -62,12 +75,14 @@ function deferredDeleteResult(): {
 
 describe('runWorktreeDeletesInParallel', () => {
   beforeEach(() => {
-    mocks.state.removeWorktree.mockClear().mockResolvedValue({ ok: true })
+    mocks.state.removeWorktree.mockReset().mockResolvedValue({ ok: true })
     mocks.state.clearWorktreeDeleteState.mockClear()
     mocks.state.markWorktreesDeleting.mockClear()
+    mocks.state.worktreeMap = new Map()
     mocks.state.deleteStateByWorktreeId = {}
     vi.mocked(toast.error).mockClear()
     vi.mocked(toast.info).mockClear()
+    vi.mocked(showPreservedBranchBatchToast).mockClear()
   })
 
   it('starts every selected delete before waiting for earlier deletes to finish', async () => {
@@ -77,14 +92,18 @@ describe('runWorktreeDeletesInParallel', () => {
       .mockReturnValueOnce(first.promise)
       .mockReturnValueOnce(second.promise)
 
-    const deleted = runWorktreeDeletesInParallel([
+    const deleted = runDeletesForCurrentWorktrees([
       { id: 'wt-1', displayName: 'one', repoId: 'repo-a', path: '/workspaces/one' },
       { id: 'wt-2', displayName: 'two', repoId: 'repo-b', path: '/workspaces/two' }
     ])
 
     expect(mocks.state.removeWorktree).toHaveBeenCalledTimes(2)
-    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(1, 'wt-1', false)
-    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(2, 'wt-2', false)
+    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(1, 'wt-1', false, {
+      suppressPreservedBranchToast: true
+    })
+    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(2, 'wt-2', false, {
+      suppressPreservedBranchToast: true
+    })
     expect(mocks.state.markWorktreesDeleting).toHaveBeenCalledWith(['wt-1', 'wt-2'])
 
     second.resolve({ ok: true })
@@ -98,7 +117,7 @@ describe('runWorktreeDeletesInParallel', () => {
     const childDelete = deferredDeleteResult()
     mocks.state.removeWorktree.mockReturnValueOnce(childDelete.promise)
 
-    const deleted = runWorktreeDeletesInParallel([
+    const deleted = runDeletesForCurrentWorktrees([
       { id: 'parent', displayName: 'parent', repoId: 'repo-a', path: '/workspaces/parent' },
       { id: 'child', displayName: 'child', repoId: 'repo-a', path: '/workspaces/parent/child' }
     ])
@@ -115,26 +134,34 @@ describe('runWorktreeDeletesInParallel', () => {
       canForceDelete: false
     })
     expect(mocks.state.removeWorktree).toHaveBeenCalledTimes(1)
-    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(1, 'child', false)
+    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(1, 'child', false, {
+      suppressPreservedBranchToast: true
+    })
 
     childDelete.resolve({ ok: true })
 
     await expect(deleted).resolves.toEqual(['parent', 'child'])
-    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(2, 'parent', false)
+    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(2, 'parent', false, {
+      suppressPreservedBranchToast: true
+    })
   })
 
   it('deletes nested workspaces before their parent within the same repo', async () => {
-    await runWorktreeDeletesInParallel([
+    await runDeletesForCurrentWorktrees([
       { id: 'parent', displayName: 'parent', repoId: 'repo-a', path: '/workspaces/parent' },
       { id: 'child', displayName: 'child', repoId: 'repo-a', path: '/workspaces/parent/child' }
     ])
 
-    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(1, 'child', false)
-    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(2, 'parent', false)
+    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(1, 'child', false, {
+      suppressPreservedBranchToast: true
+    })
+    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(2, 'parent', false, {
+      suppressPreservedBranchToast: true
+    })
   })
 
   it('passes confirmed force to each delete', async () => {
-    await runWorktreeDeletesInParallel(
+    await runDeletesForCurrentWorktrees(
       [
         { id: 'wt-1', displayName: 'one', repoId: 'repo-a', path: '/workspaces/one' },
         { id: 'wt-2', displayName: 'two', repoId: 'repo-b', path: '/workspaces/two' }
@@ -142,8 +169,12 @@ describe('runWorktreeDeletesInParallel', () => {
       { force: true }
     )
 
-    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(1, 'wt-1', true)
-    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(2, 'wt-2', true)
+    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(1, 'wt-1', true, {
+      suppressPreservedBranchToast: true
+    })
+    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(2, 'wt-2', true, {
+      suppressPreservedBranchToast: true
+    })
   })
 
   it('deletes a duplicated target identity only once', async () => {
@@ -157,7 +188,7 @@ describe('runWorktreeDeletesInParallel', () => {
       .mockResolvedValueOnce({ ok: true })
       .mockResolvedValueOnce({ ok: false, error: 'selector_not_found' })
 
-    await expect(runWorktreeDeletesInParallel([target, target])).resolves.toEqual(['wt-1'])
+    await expect(runDeletesForCurrentWorktrees([target, target])).resolves.toEqual(['wt-1'])
 
     expect(mocks.state.markWorktreesDeleting).toHaveBeenCalledWith(['wt-1'])
     expect(mocks.state.removeWorktree).toHaveBeenCalledTimes(1)
@@ -176,15 +207,42 @@ describe('runWorktreeDeletesInParallel', () => {
     })
 
     await expect(
-      runWorktreeDeletesInParallel([
+      runDeletesForCurrentWorktrees([
         { id: 'parent', displayName: 'parent', repoId: 'repo-a', path: '/workspaces/parent' },
         { id: 'child', displayName: 'child', repoId: 'repo-a', path: '/workspaces/parent/child' }
       ])
     ).resolves.toEqual([])
 
     expect(mocks.state.removeWorktree).toHaveBeenCalledTimes(1)
-    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(1, 'child', false)
+    expect(mocks.state.removeWorktree).toHaveBeenNthCalledWith(1, 'child', false, {
+      suppressPreservedBranchToast: true
+    })
     expect(mocks.state.clearWorktreeDeleteState).toHaveBeenCalledWith('parent')
     expect(mocks.state.deleteStateByWorktreeId['parent']).toBeUndefined()
   })
+
+  it('replaces per-workspace branch warnings with one batch result', async () => {
+    mocks.state.removeWorktree
+      .mockResolvedValueOnce({
+        ok: true,
+        preservedBranch: { branchName: 'feature/one', head: 'head-one' }
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        preservedBranch: { branchName: 'feature/two', head: 'head-two' }
+      })
+
+    await expect(
+      runDeletesForCurrentWorktrees([
+        { id: 'wt-1', displayName: 'one', repoId: 'repo-a', path: '/workspaces/one' },
+        { id: 'wt-2', displayName: 'two', repoId: 'repo-b', path: '/workspaces/two' }
+      ])
+    ).resolves.toEqual(['wt-1', 'wt-2'])
+
+    expect(showPreservedBranchBatchToast).toHaveBeenCalledOnce()
+    expect(showPreservedBranchBatchToast).toHaveBeenCalledWith(2, [
+      { worktreeId: 'wt-1', branchName: 'feature/one', expectedHead: 'head-one' },
+      { worktreeId: 'wt-2', branchName: 'feature/two', expectedHead: 'head-two' }
+    ])
+  })
 })
diff --git a/src/renderer/src/components/sidebar/preserved-branch-batch-toast.test.tsx b/src/renderer/src/components/sidebar/preserved-branch-batch-toast.test.tsx
new file mode 100644
index 00000000000..cba83d4c26e
--- /dev/null
+++ b/src/renderer/src/components/sidebar/preserved-branch-batch-toast.test.tsx
@@ -0,0 +1,208 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { toast } from 'sonner'
+import type { PreservedBranchCleanup } from '@/lib/preserved-branch-cleanup'
+import PreservedBranchBatchReviewModal from './PreservedBranchBatchReviewModal'
+import {
+  forceDeletePreservedBranchBatch,
+  showPreservedBranchBatchToast
+} from './preserved-branch-batch-toast'
+
+globalThis.IS_REACT_ACT_ENVIRONMENT = true
+
+const mocks = vi.hoisted(() => {
+  const state = {
+    activeModal: 'none',
+    modalData: {} as Record<string, unknown>,
+    repos: [],
+    closeModal: vi.fn(),
+    openModal: vi.fn(),
+    forceDeletePreservedBranch: vi.fn()
+  }
+  return { state }
+})
+
+vi.mock('@/store', () => {
+  const useAppStore = Object.assign(
+    (selector: (state: typeof mocks.state) => unknown) => selector(mocks.state),
+    { getState: () => mocks.state }
+  )
+  return { useAppStore }
+})
+
+vi.mock('sonner', () => ({
+  toast: {
+    warning: vi.fn(),
+    loading: vi.fn(),
+    success: vi.fn(),
+    error: vi.fn(),
+    dismiss: vi.fn()
+  }
+}))
+
+const mountedRoots: Root[] = []
+
+function renderToastBody(): HTMLElement {
+  const description = vi.mocked(toast.warning).mock.calls.at(-1)?.[1]
+    ?.description as React.ReactElement
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const root = createRoot(container)
+  mountedRoots.push(root)
+  act(() => root.render(description))
+  return container
+}
+
+function renderReviewModal(branches: readonly PreservedBranchCleanup[]): void {
+  mocks.state.activeModal = 'preserved-branch-review'
+  mocks.state.modalData = { branches }
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const root = createRoot(container)
+  mountedRoots.push(root)
+  act(() => root.render(<PreservedBranchBatchReviewModal />))
+}
+
+async function clickButton(container: HTMLElement, label: string): Promise<void> {
+  const button = [...container.querySelectorAll('button')].find(
+    (element) => element.textContent?.trim() === label
+  )
+  if (!button) {
+    throw new Error(`button "${label}" not found`)
+  }
+  await act(async () => {
+    button.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+    await Promise.resolve()
+  })
+}
+
+async function clickCheckbox(id: string): Promise<void> {
+  const checkbox = document.getElementById(id)
+  if (!checkbox) {
+    throw new Error(`checkbox "${id}" not found`)
+  }
+  await act(async () => {
+    checkbox.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+    await Promise.resolve()
+  })
+}
+
+beforeEach(() => {
+  mocks.state.activeModal = 'none'
+  mocks.state.modalData = {}
+  mocks.state.closeModal.mockReset()
+  mocks.state.openModal.mockReset()
+  mocks.state.forceDeletePreservedBranch.mockReset().mockResolvedValue({ ok: true, deleted: true })
+})
+
+afterEach(() => {
+  mountedRoots.splice(0).forEach((root) => act(() => root.unmount()))
+  document.body.innerHTML = ''
+  vi.clearAllMocks()
+})
+
+describe('showPreservedBranchBatchToast', () => {
+  it('explains disk cleanup and opens one review dialog for the batch', async () => {
+    const branches = [
+      { worktreeId: 'repo-a::one', branchName: 'feature/one', expectedHead: 'head-one' },
+      { worktreeId: 'repo-b::two', branchName: 'feature/two', expectedHead: 'head-two' }
+    ]
+    showPreservedBranchBatchToast(12, branches)
+    const body = renderToastBody()
+
+    expect(toast.warning).toHaveBeenCalledWith(
+      '12 workspaces removed, 2 branches kept',
+      expect.objectContaining({ dismissible: true, duration: Infinity })
+    )
+    expect(body.textContent).toContain('Kept branches do not retain workspace folders')
+    expect(body.textContent).toContain('Orca may continue freeing workspace disk space')
+
+    await clickButton(body, 'Review 2 Branches')
+
+    expect(mocks.state.openModal).toHaveBeenCalledWith('preserved-branch-review', { branches })
+    expect(toast.dismiss).toHaveBeenCalledWith('preserved-branch-batch:repo-a::one:2')
+    expect(mocks.state.forceDeletePreservedBranch).not.toHaveBeenCalled()
+  })
+
+  it('force-deletes only the branches selected in review', async () => {
+    renderReviewModal([
+      { worktreeId: 'repo-a::one', branchName: 'feature/one', expectedHead: 'head-one' },
+      { worktreeId: 'repo-b::two', branchName: 'feature/two', expectedHead: 'head-two' }
+    ])
+
+    expect(document.body.textContent).toContain('Review kept branches')
+    expect(document.body.textContent).toContain('2 of 2 selected')
+    await clickCheckbox('preserved-branch-1')
+    expect(document.body.textContent).toContain('1 of 2 selected')
+    expect(
+      document.getElementById('preserved-branch-select-all')?.querySelector('.lucide-minus')
+    ).not.toBeNull()
+    await clickButton(document.body, 'Force Delete 1 Branch')
+
+    expect(mocks.state.closeModal).toHaveBeenCalledOnce()
+    expect(mocks.state.forceDeletePreservedBranch).toHaveBeenCalledOnce()
+    expect(mocks.state.forceDeletePreservedBranch).toHaveBeenCalledWith(
+      'repo-a::one',
+      'feature/one',
+      'head-one',
+      { suppressToast: true }
+    )
+    expect(toast.success).toHaveBeenCalledWith('Local branches deleted: 1', {
+      id: 'force-delete-branch-batch:repo-a::one:1'
+    })
+  })
+
+  it('keeps older-server branches visible without offering an unsafe delete', () => {
+    showPreservedBranchBatchToast(3, [{ worktreeId: 'repo-a::one', branchName: 'feature/one' }])
+    const body = renderToastBody()
+
+    expect(body.querySelector('button')).toBeNull()
+    expect(toast.warning).toHaveBeenCalledWith(
+      '3 workspaces removed, 1 branch kept',
+      expect.not.objectContaining({ duration: Infinity })
+    )
+  })
+
+  it('serializes branch deletion within one repository', async () => {
+    let resolveFirst: (result: { ok: true; deleted: true }) => void = () => {}
+    mocks.state.forceDeletePreservedBranch
+      .mockReset()
+      .mockReturnValueOnce(
+        new Promise<{ ok: true; deleted: true }>((resolve) => {
+          resolveFirst = resolve
+        })
+      )
+      .mockResolvedValueOnce({ ok: true, deleted: true })
+    const deletion = forceDeletePreservedBranchBatch([
+      { worktreeId: 'repo-a::one', branchName: 'feature/one', expectedHead: 'head-one' },
+      { worktreeId: 'repo-a::two', branchName: 'feature/two', expectedHead: 'head-two' }
+    ])
+
+    expect(mocks.state.forceDeletePreservedBranch).toHaveBeenCalledTimes(1)
+    resolveFirst({ ok: true, deleted: true })
+    await deletion
+    expect(mocks.state.forceDeletePreservedBranch).toHaveBeenCalledTimes(2)
+  })
+
+  it('shows an unavailable branch without blocking review of actionable branches', async () => {
+    renderReviewModal([
+      { worktreeId: 'repo-a::one', branchName: 'feature/one', expectedHead: 'head-one' },
+      { worktreeId: 'repo-b::two', branchName: 'feature/two' }
+    ])
+
+    expect(document.body.textContent).toContain('Head unavailable')
+    expect((document.getElementById('preserved-branch-1') as HTMLButtonElement).disabled).toBe(true)
+    await clickButton(document.body, 'Force Delete 1 Branch')
+
+    expect(mocks.state.forceDeletePreservedBranch).toHaveBeenCalledOnce()
+    expect(mocks.state.forceDeletePreservedBranch).toHaveBeenCalledWith(
+      'repo-a::one',
+      'feature/one',
+      'head-one',
+      { suppressToast: true }
+    )
+  })
+})
diff --git a/src/renderer/src/components/sidebar/preserved-branch-batch-toast.tsx b/src/renderer/src/components/sidebar/preserved-branch-batch-toast.tsx
new file mode 100644
index 00000000000..d98cd37a438
--- /dev/null
+++ b/src/renderer/src/components/sidebar/preserved-branch-batch-toast.tsx
@@ -0,0 +1,190 @@
+import { Trash2 } from 'lucide-react'
+import { toast } from 'sonner'
+import { useAppStore } from '@/store'
+import { translate } from '@/i18n/i18n'
+import { mapWithConcurrency } from '../../../../shared/map-with-concurrency'
+import { getRepoIdFromWorktreeId } from '../../../../shared/worktree-id'
+import { Button } from '../ui/button'
+import type { PreservedBranchCleanup } from '@/lib/preserved-branch-cleanup'
+
+const BRANCH_REPO_DELETE_CONCURRENCY = 4
+
+export type ActionablePreservedBranch = PreservedBranchCleanup & { expectedHead: string }
+
+type PreservedBranchDeleteResult = {
+  branch: ActionablePreservedBranch
+  result: { ok: true; deleted: true } | { ok: false; error: string }
+}
+
+function PreservedBranchBatchToastBody({
+  branches,
+  onReview
+}: {
+  branches: readonly PreservedBranchCleanup[]
+  onReview: () => void
+}): React.JSX.Element {
+  const actionableCount = branches.filter((branch) => branch.expectedHead).length
+  return (
+    <div className="flex w-[300px] max-w-[calc(100vw-96px)] flex-col gap-3">
+      <p className="min-w-0 break-words text-sm leading-5 text-popover-foreground/80">
+        {translate(
+          'auto.components.sidebar.preserved.branch.batch.toast.a3cdd9d9e6',
+          'Git kept {{count}} local branches because they may contain unmerged commits. Kept branches do not retain workspace folders; their commits remain in the repository. Orca may continue freeing workspace disk space in the background.',
+          { count: branches.length }
+        )}
+      </p>
+      {actionableCount > 0 ? (
+        <Button type="button" variant="destructive" size="sm" className="w-full" onClick={onReview}>
+          <Trash2 className="size-3.5" />
+          {translate(
+            'auto.components.sidebar.preserved.branch.batch.toast.6310412304',
+            'Review {{count}} Branches',
+            { count: actionableCount }
+          )}
+        </Button>
+      ) : null}
+    </div>
+  )
+}
+
+export function showPreservedBranchBatchToast(
+  workspaceCount: number,
+  branches: readonly PreservedBranchCleanup[]
+): void {
+  if (branches.length === 0) {
+    return
+  }
+  const actionableCount = branches.filter((branch) => branch.expectedHead).length
+  const toastId = `preserved-branch-batch:${branches[0].worktreeId}:${branches.length}`
+  const removedWorkspaces = translate(
+    'auto.components.sidebar.preserved.branch.batch.toast.cea24c2b7d',
+    '{{count}} workspaces removed',
+    { count: workspaceCount }
+  )
+  const keptBranches = translate(
+    'auto.components.sidebar.preserved.branch.batch.toast.0e0379f24a',
+    '{{count}} branches kept',
+    { count: branches.length }
+  )
+  const onReview = (): void => {
+    useAppStore.getState().openModal('preserved-branch-review', { branches })
+    toast.dismiss(toastId)
+  }
+
+  toast.warning(
+    translate(
+      'auto.components.sidebar.preserved.branch.batch.toast.4cf75caab7',
+      '{{value0}}, {{value1}}',
+      { value0: removedWorkspaces, value1: keptBranches }
+    ),
+    {
+      id: toastId,
+      description: <PreservedBranchBatchToastBody branches={branches} onReview={onReview} />,
+      dismissible: true,
+      ...(actionableCount > 0 ? { duration: Infinity } : {})
+    }
+  )
+}
+
+export async function forceDeletePreservedBranchBatch(
+  branches: readonly ActionablePreservedBranch[]
+): Promise<void> {
+  if (branches.length === 0) {
+    return
+  }
+  const progressToastId = `force-delete-branch-batch:${branches[0].worktreeId}:${branches.length}`
+  toast.loading(
+    translate(
+      'auto.components.sidebar.preserved.branch.batch.toast.e61d78054f',
+      'Deleting local branches: {{value0}}',
+      { value0: branches.length }
+    ),
+    { id: progressToastId }
+  )
+  const branchesByRepo = new Map<string, ActionablePreservedBranch[]>()
+  for (const branch of branches) {
+    const repoId = getRepoIdFromWorktreeId(branch.worktreeId)
+    const repoBranches = branchesByRepo.get(repoId)
+    if (repoBranches) {
+      repoBranches.push(branch)
+    } else {
+      branchesByRepo.set(repoId, [branch])
+    }
+  }
+  const groupResults = await mapWithConcurrency(
+    [...branchesByRepo.values()],
+    BRANCH_REPO_DELETE_CONCURRENCY,
+    async (repoBranches) => {
+      const results: PreservedBranchDeleteResult[] = []
+      for (const branch of repoBranches) {
+        results.push({
+          branch,
+          result: await useAppStore
+            .getState()
+            .forceDeletePreservedBranch(branch.worktreeId, branch.branchName, branch.expectedHead, {
+              suppressToast: true,
+              ...(branch.hostId ? { hostId: branch.hostId } : {}),
+              ...(branch.runtimeEnvironmentId
+                ? { runtimeEnvironmentId: branch.runtimeEnvironmentId }
+                : {})
+            })
+        })
+      }
+      return results
+    }
+  )
+  const results = groupResults.flat()
+  const failures = results.filter((result) => !result.result.ok)
+  if (failures.length === 0) {
+    toast.success(
+      translate(
+        'auto.components.sidebar.preserved.branch.batch.toast.1e1a5f6763',
+        'Local branches deleted: {{value0}}',
+        { value0: branches.length }
+      ),
+      { id: progressToastId }
+    )
+    return
+  }
+  const deletedCount = branches.length - failures.length
+  const description = failures
+    .map(({ branch, result }) => (result.ok ? '' : `${branch.branchName}: ${result.error}`))
+    .filter(Boolean)
+    .join('; ')
+  const failedBranches = failures.map(({ branch }) => branch)
+  toast.error(
+    translate(
+      'auto.components.sidebar.preserved.branch.batch.toast.43d9395605',
+      '{{value0}} deleted, {{value1}} not deleted',
+      { value0: deletedCount, value1: failures.length }
+    ),
+    {
+      id: progressToastId,
+      description: (
+        <div className="flex w-[300px] max-w-[calc(100vw-96px)] flex-col gap-3">
+          <p className="min-w-0 break-words text-sm leading-5 text-popover-foreground/80">
+            {description}
+          </p>
+          <Button
+            type="button"
+            variant="destructive"
+            size="sm"
+            className="w-full"
+            onClick={() => {
+              void forceDeletePreservedBranchBatch(failedBranches)
+            }}
+          >
+            <Trash2 className="size-3.5" />
+            {translate(
+              'auto.components.sidebar.preserved.branch.batch.toast.d42f1f14e0',
+              'Retry {{count}} Branches',
+              { count: failedBranches.length }
+            )}
+          </Button>
+        </div>
+      ),
+      duration: Infinity,
+      dismissible: true
+    }
+  )
+}
diff --git a/src/renderer/src/components/sidebar/preserved-branch-toast.tsx b/src/renderer/src/components/sidebar/preserved-branch-toast.tsx
index b7b343aaceb..03529ad4657 100644
--- a/src/renderer/src/components/sidebar/preserved-branch-toast.tsx
+++ b/src/renderer/src/components/sidebar/preserved-branch-toast.tsx
@@ -63,7 +63,7 @@ function PreservedBranchToastBody({
         <div className="flex min-w-0 overflow-hidden">
           <Button
             type="button"
-            variant="default"
+            variant="destructive"
             size="sm"
             className="w-full min-w-0"
             onClick={onForceDelete}
diff --git a/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts b/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts
index 7fe5d255110..e7cc2a94eba 100644
--- a/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts
+++ b/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts
@@ -39,6 +39,7 @@ function filterState(overrides: Partial<FilterState> = {}): FilterState {
     hideAutomationGeneratedWorkspaces: false,
     hideCliCreatedWorkspaces: false,
     hideDetachedHeadWorkspaces: false,
+    hideWorkspacesFromOtherDevices: false,
     alwaysShowDefaultBranchWorkspace: true,
     workspaceHostScope: 'all',
     ...overrides
@@ -91,6 +92,12 @@ describe('sidebarHasActiveFilters', () => {
     expect(sidebarHasActiveFilters(filterState({ hideDetachedHeadWorkspaces: true }))).toBe(true)
   })
 
+  it('returns true when workspaces from other devices are hidden', () => {
+    expect(sidebarHasActiveFilters(filterState({ hideWorkspacesFromOtherDevices: true }))).toBe(
+      true
+    )
+  })
+
   it('returns true when sleeping workspaces are hidden', () => {
     expect(sidebarHasActiveFilters(filterState({ showSleepingWorkspaces: false }))).toBe(true)
   })
@@ -139,6 +146,7 @@ describe('computeClearFilterActions', () => {
       resetHideAutomationGeneratedWorkspaces: false,
       resetHideCliCreatedWorkspaces: false,
       resetHideDetachedHeadWorkspaces: false,
+      resetHideWorkspacesFromOtherDevices: false,
       resetAlwaysShowDefaultBranchWorkspace: false,
       resetVisibleWorkspaceHostIds: false
     })
@@ -155,6 +163,7 @@ describe('computeClearFilterActions', () => {
       resetHideAutomationGeneratedWorkspaces: false,
       resetHideCliCreatedWorkspaces: false,
       resetHideDetachedHeadWorkspaces: false,
+      resetHideWorkspacesFromOtherDevices: false,
       resetAlwaysShowDefaultBranchWorkspace: false,
       resetVisibleWorkspaceHostIds: false
     })
@@ -170,6 +179,7 @@ describe('computeClearFilterActions', () => {
       resetHideAutomationGeneratedWorkspaces: true,
       resetHideCliCreatedWorkspaces: false,
       resetHideDetachedHeadWorkspaces: false,
+      resetHideWorkspacesFromOtherDevices: false,
       resetAlwaysShowDefaultBranchWorkspace: false,
       resetVisibleWorkspaceHostIds: false
     })
@@ -183,6 +193,7 @@ describe('computeClearFilterActions', () => {
       resetHideAutomationGeneratedWorkspaces: false,
       resetHideCliCreatedWorkspaces: true,
       resetHideDetachedHeadWorkspaces: false,
+      resetHideWorkspacesFromOtherDevices: false,
       resetAlwaysShowDefaultBranchWorkspace: false,
       resetVisibleWorkspaceHostIds: false
     })
@@ -196,6 +207,7 @@ describe('computeClearFilterActions', () => {
       resetHideAutomationGeneratedWorkspaces: false,
       resetHideCliCreatedWorkspaces: false,
       resetHideDetachedHeadWorkspaces: true,
+      resetHideWorkspacesFromOtherDevices: false,
       resetAlwaysShowDefaultBranchWorkspace: false,
       resetVisibleWorkspaceHostIds: false
     })
@@ -222,6 +234,7 @@ describe('computeClearFilterActions', () => {
       resetHideAutomationGeneratedWorkspaces: false,
       resetHideCliCreatedWorkspaces: false,
       resetHideDetachedHeadWorkspaces: false,
+      resetHideWorkspacesFromOtherDevices: false,
       resetAlwaysShowDefaultBranchWorkspace: false,
       resetVisibleWorkspaceHostIds: true
     })
@@ -237,6 +250,7 @@ describe('computeClearFilterActions', () => {
       resetHideAutomationGeneratedWorkspaces: false,
       resetHideCliCreatedWorkspaces: false,
       resetHideDetachedHeadWorkspaces: false,
+      resetHideWorkspacesFromOtherDevices: false,
       resetAlwaysShowDefaultBranchWorkspace: true,
       resetVisibleWorkspaceHostIds: false
     })
@@ -260,6 +274,7 @@ describe('computeClearFilterActions', () => {
       resetHideAutomationGeneratedWorkspaces: true,
       resetHideCliCreatedWorkspaces: false,
       resetHideDetachedHeadWorkspaces: false,
+      resetHideWorkspacesFromOtherDevices: false,
       resetAlwaysShowDefaultBranchWorkspace: false,
       resetVisibleWorkspaceHostIds: true
     })
diff --git a/src/renderer/src/components/sidebar/smart-attention.test.ts b/src/renderer/src/components/sidebar/smart-attention.test.ts
index 2c4324938cd..8723cf937fc 100644
--- a/src/renderer/src/components/sidebar/smart-attention.test.ts
+++ b/src/renderer/src/components/sidebar/smart-attention.test.ts
@@ -195,6 +195,70 @@ describe('resolveAttention', () => {
     })
   })
 
+  it('drops a done pane out of Class 2 once the completion itself ages out', () => {
+    const justInside = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      stateStartedAt: NOW - AGENT_STATUS_STALE_AFTER_MS,
+      updatedAt: NOW - 1_000
+    })
+    expect(resolveAttention([hookPane(justInside)], NOW)).toEqual({
+      cls: 2,
+      attentionTimestamp: NOW - AGENT_STATUS_STALE_AFTER_MS
+    })
+
+    const justOutside = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      stateStartedAt: NOW - AGENT_STATUS_STALE_AFTER_MS - 1,
+      updatedAt: NOW - 1_000
+    })
+    expect(resolveAttention([hookPane(justOutside)], NOW)).toEqual(IDLE)
+  })
+
+  it('does not let same-state done writes extend Class 2 eligibility', () => {
+    // The captured regression: updatedAt was 3m04s newer than the completion, keeping a 32m-old
+    // "done" row above two spinners.
+    const entry = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      stateStartedAt: NOW - 32 * 60_000,
+      updatedAt: NOW - 29 * 60_000
+    })
+    expect(resolveAttention([hookPane(entry)], NOW)).toEqual(IDLE)
+  })
+
+  it('keeps an expired done pane from masking a live working sibling', () => {
+    const expiredDone = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      stateStartedAt: NOW - AGENT_STATUS_STALE_AFTER_MS - 60_000,
+      updatedAt: NOW - 1_000
+    })
+    const working = makeEntry({
+      paneKey: 't:2',
+      state: 'working',
+      stateStartedAt: NOW - 10_000,
+      updatedAt: NOW - 1_000
+    })
+    expect(resolveAttention(hookPanes([expiredDone, working]), NOW)).toEqual({
+      cls: 3,
+      attentionTimestamp: NOW - 10_000
+    })
+  })
+
+  it('ages out a session-boundary completion from its real completion time', () => {
+    const boundary = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      sessionBoundary: true,
+      stateStartedAt: NOW - 1_000,
+      updatedAt: NOW - 500,
+      stateHistory: [makeHistory('done', NOW - AGENT_STATUS_STALE_AFTER_MS - 1)]
+    })
+    expect(resolveAttention([hookPane(boundary)], NOW)).toEqual(IDLE)
+  })
+
   it('classifies a working pane with prior done as Class 3 with the prior timestamp', () => {
     const entry = makeEntry({
       paneKey: 't:1',
diff --git a/src/renderer/src/components/sidebar/smart-attention.ts b/src/renderer/src/components/sidebar/smart-attention.ts
index d1a182cb224..5238a9091eb 100644
--- a/src/renderer/src/components/sidebar/smart-attention.ts
+++ b/src/renderer/src/components/sidebar/smart-attention.ts
@@ -1,4 +1,5 @@
 import { classifyTitleActivity, isExplicitAgentStatusFresh } from '@/lib/pane-agent-evidence'
+import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
 import { migrationUnsupportedToAgentStatusEntry } from '@/lib/migration-unsupported-agent-entry'
 import { tabHasLivePty } from '@/lib/tab-has-live-pty'
 import { resolveRuntimePaneTitleLeafId } from '@/lib/runtime-pane-title-leaf-id'
@@ -15,9 +16,9 @@ import { parsePaneKey } from '../../../../shared/stable-pane-id'
 /**
  * Ordinal class for the "Smart" sort. Lower number = more attention-demanding.
  *   1 — Needs you (`blocked` / `waiting`)
- *   2 — Done (`done`, not interrupted)
+ *   2 — Done (`done`, not interrupted, completed within AGENT_STATUS_STALE_AFTER_MS)
  *   3 — Working (`working`)
- *   4 — Idle (no live entry, stale entry, or interrupted `done`)
+ *   4 — Idle (no live entry, stale entry, interrupted `done`, or an aged-out completion)
  *
  * Primary sort key; ties fall back to the attention timestamp. See docs/smart-worktree-order-redesign.md.
  */
@@ -34,7 +35,7 @@ export type AttentionCause = 'blocked' | 'waiting' | 'title-heuristic'
  * Per-worktree resolution computed once before sorting.
  *
  * `attentionTimestamp` by class:
- *   - Class 1 / 2: `stateStartedAt` of the current entry.
+ *   - Class 1: `stateStartedAt` of the current entry. Class 2: the entry's completion time.
  *   - Class 3: `stateStartedAt` of the most recent prior `done`/`blocked`/`waiting` entry,
  *     falling back to the current `working` `stateStartedAt`.
  *   - Class 4: `0` — comparator drops to `effectiveRecentActivity` for idle ordering.
@@ -98,21 +99,6 @@ export function mostRecentAttentionInHistory(history: AgentStateHistoryEntry[]):
   return max > 0 ? max : null
 }
 
-function mostRecentCompletedTurnInHistory(history: AgentStateHistoryEntry[]): number | null {
-  let max = 0
-  for (const entry of history) {
-    if (
-      entry.state === 'done' &&
-      entry.interrupted !== true &&
-      Number.isFinite(entry.startedAt) &&
-      entry.startedAt > max
-    ) {
-      max = entry.startedAt
-    }
-  }
-  return max > 0 ? max : null
-}
-
 /**
  * One pane's contribution to a worktree's attention class. Fresh hook entries win; hookless
  * panes fall back to the title heuristic (design doc Edge case 9). Authority is per-pane, not per-worktree.
@@ -152,21 +138,19 @@ export function resolveAttention(panes: PaneInput[], now: number): WorktreeAtten
         ts = entry.stateStartedAt
         cause = entry.state
       } else if (entry.state === 'done') {
-        // Why: interrupted `done` (Ctrl+C) means the user is done with the turn; treat as idle, not Class 2.
-        if (entry.interrupted) {
+        // Why: null covers interrupted `done` (Ctrl+C — user is finished with it) and idle session
+        // boundaries; neither is attention.
+        const completedAt = agentEntryCompletionAt(entry)
+        if (completedAt === null) {
+          continue
+        }
+        // Why: same-state `done` writes advance updatedAt without moving the completion, so the hook
+        // freshness gate alone can keep a row in Class 2 long after the UI shows it aged out.
+        if (now - completedAt > AGENT_STATUS_STALE_AFTER_MS) {
           continue
         }
         cls = 2
-        if (entry.sessionBoundary) {
-          // Why: idle connect is not new attention; only preserve a real completion it displaced.
-          const completedAt = mostRecentCompletedTurnInHistory(entry.stateHistory)
-          if (completedAt === null) {
-            continue
-          }
-          ts = completedAt
-        } else {
-          ts = entry.stateStartedAt
-        }
+        ts = completedAt
       } else {
         // working
         cls = 3
diff --git a/src/renderer/src/components/sidebar/smart-sort.test.ts b/src/renderer/src/components/sidebar/smart-sort.test.ts
index 47c437f5199..75af8fae1cc 100644
--- a/src/renderer/src/components/sidebar/smart-sort.test.ts
+++ b/src/renderer/src/components/sidebar/smart-sort.test.ts
@@ -109,7 +109,8 @@ function ptyMapForTabs(tabsByWorktree: Record<string, TerminalTab[]>): Record<st
  * Sort helper: builds the attention map and runs the smart comparator. Mirrors
  * what callers do in production (visible-worktrees, WorktreeList).
  */
-function sortSmart(
+function sortSmartAt(
+  now: number,
   worktrees: Worktree[],
   tabsByWorktree: Record<string, TerminalTab[]>,
   agentStatusByPaneKey: Record<string, AgentStatusEntry>
@@ -120,9 +121,17 @@ function sortSmart(
     agentStatusByPaneKey,
     {},
     ptyMapForTabs(tabsByWorktree),
-    NOW
+    now
   )
-  return [...worktrees].sort(buildWorktreeComparator('smart', repoMap, NOW, attention))
+  return [...worktrees].sort(buildWorktreeComparator('smart', repoMap, now, attention))
+}
+
+function sortSmart(
+  worktrees: Worktree[],
+  tabsByWorktree: Record<string, TerminalTab[]>,
+  agentStatusByPaneKey: Record<string, AgentStatusEntry>
+): Worktree[] {
+  return sortSmartAt(NOW, worktrees, tabsByWorktree, agentStatusByPaneKey)
 }
 
 describe('smart sort — class invariants', () => {
@@ -354,6 +363,62 @@ describe('smart sort — interrupted and stale handling', () => {
   })
 })
 
+describe('smart sort — completed-agent eligibility clock', () => {
+  // Captured regression (docs/smart-sort-agent-activity-findings.md): a `done` row whose
+  // updatedAt was 3m04s newer than its completion outranked two live spinners.
+  const SCREENSHOT_AT = new Date('2026-03-27T21:44:39.000Z').getTime()
+  const at = (hhmmss: string): number => new Date(`2026-03-27T${hhmmss}.000Z`).getTime()
+
+  function capturedFixture(workingUpdatedAt = at('21:44:30')) {
+    const done = makeWorktree({ id: 'fix-linear-persistent', displayName: 'fix-linear-persistent' })
+    const workingA = makeWorktree({ id: 'allow-editing', displayName: 'allow-editing' })
+    const workingB = makeWorktree({ id: 'resume-terminal', displayName: 'resume-terminal' })
+    const tabs = {
+      [done.id]: [makeTab({ id: 'tab-done', worktreeId: done.id })],
+      [workingA.id]: [makeTab({ id: 'tab-a', worktreeId: workingA.id })],
+      [workingB.id]: [makeTab({ id: 'tab-b', worktreeId: workingB.id })]
+    }
+    const entries = {
+      [paneKey('tab-done', '1')]: makeEntry({
+        paneKey: paneKey('tab-done', '1'),
+        state: 'done',
+        stateStartedAt: at('21:12:09'),
+        // Same-state `done` writes pushed updatedAt 3m04s past the completion.
+        updatedAt: at('21:15:13')
+      }),
+      [paneKey('tab-a', '1')]: makeEntry({
+        paneKey: paneKey('tab-a', '1'),
+        state: 'working',
+        stateStartedAt: workingUpdatedAt - 68_000,
+        updatedAt: workingUpdatedAt
+      }),
+      [paneKey('tab-b', '1')]: makeEntry({
+        paneKey: paneKey('tab-b', '1'),
+        state: 'working',
+        stateStartedAt: workingUpdatedAt - 145_000,
+        updatedAt: workingUpdatedAt - 5_000
+      })
+    }
+    return { worktrees: [done, workingA, workingB], tabs, entries }
+  }
+
+  it('ranks the two spinners above the 32-minute-old completion', () => {
+    const { worktrees, tabs, entries } = capturedFixture()
+    const sorted = sortSmartAt(SCREENSHOT_AT, worktrees, tabs, entries)
+    expect(sorted.map((w) => w.id)).toEqual([
+      'allow-editing',
+      'resume-terminal',
+      'fix-linear-persistent'
+    ])
+  })
+
+  it('still ranks that completion above the spinners inside its own window', () => {
+    const { worktrees, tabs, entries } = capturedFixture(at('21:39:50'))
+    const sorted = sortSmartAt(at('21:40:00'), worktrees, tabs, entries)
+    expect(sorted[0].id).toBe('fix-linear-persistent')
+  })
+})
+
 describe('smart sort — Class 4 ordering', () => {
   it('breaks ties on effectiveRecentActivity, then displayName', () => {
     const recentlyActive = makeWorktree({
diff --git a/src/renderer/src/components/sidebar/stale-workspace-list-toast.ts b/src/renderer/src/components/sidebar/stale-workspace-list-toast.ts
new file mode 100644
index 00000000000..890d4c91a60
--- /dev/null
+++ b/src/renderer/src/components/sidebar/stale-workspace-list-toast.ts
@@ -0,0 +1,33 @@
+import { toast } from 'sonner'
+import { translate } from '@/i18n/i18n'
+
+// Why: keys keep their original `delete.worktree.flow` namespace so the existing
+// translations are not orphaned by the move out of that module.
+function staleWorkspaceListToast(title: string): void {
+  toast.info(title, {
+    description: translate(
+      'auto.components.sidebar.delete.worktree.flow.b81b4e40ca',
+      'Refresh Space and try again if the workspace list looks stale.'
+    )
+  })
+}
+
+/** A delete target changed or vanished after the action was selected. */
+export function showWorkspaceListChangedToast(): void {
+  staleWorkspaceListToast(
+    translate(
+      'auto.components.sidebar.delete.worktree.flow.workspaceListChanged',
+      'Workspace list changed'
+    )
+  )
+}
+
+/** A multi-select delete whose selection resolved to nothing deletable. */
+export function showNoDeletableWorkspacesToast(): void {
+  staleWorkspaceListToast(
+    translate(
+      'auto.components.sidebar.delete.worktree.flow.7243145cd6',
+      'No deletable workspaces selected'
+    )
+  )
+}
diff --git a/src/renderer/src/components/sidebar/use-add-repo-host-change-reset.ts b/src/renderer/src/components/sidebar/use-add-repo-host-change-reset.ts
index effec4b5192..52a77a3b581 100644
--- a/src/renderer/src/components/sidebar/use-add-repo-host-change-reset.ts
+++ b/src/renderer/src/components/sidebar/use-add-repo-host-change-reset.ts
@@ -7,7 +7,7 @@ export function useAddRepoHostChangeReset({
   onResetHostScopedState
 }: {
   isOpen: boolean
-  selectedHostId: string
+  selectedHostId: string | null
   onResetClosed: () => void
   onResetHostScopedState: () => void
 }) {
diff --git a/src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts b/src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts
index b9a77b2e9bd..45a4fb9abbc 100644
--- a/src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts
+++ b/src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts
@@ -17,7 +17,8 @@ const mocks = vi.hoisted(() => ({
     runtimeEnvironments: [] as { id: string; name: string; source?: 'manual' | 'ephemeral-vm' }[]
   },
   sshConnect: vi.fn(),
-  sshGetState: vi.fn()
+  sshGetState: vi.fn(),
+  isWebClient: false
 }))
 
 vi.mock('react', async (importOriginal) => {
@@ -64,6 +65,10 @@ vi.mock('./use-sidebar-host-scope-options', () => ({
   useSidebarHostScopeOptions: () => ({ hostOptions: mocks.hostOptions })
 }))
 
+vi.mock('@/lib/web-client-location', () => ({
+  isWebClientLocation: () => mocks.isWebClient
+}))
+
 describe('useAddRepoHostSelection', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -103,6 +108,7 @@ describe('useAddRepoHostSelection', () => {
     mocks.storeState.runtimeEnvironments = []
     mocks.sshConnect.mockReset()
     mocks.sshGetState.mockReset()
+    mocks.isWebClient = false
     vi.stubGlobal('window', {
       api: {
         ssh: {
@@ -137,6 +143,35 @@ describe('useAddRepoHostSelection', () => {
     expect(setStep).toHaveBeenCalledWith('add')
   })
 
+  it('uses the paired runtime as the only local filesystem authority in web clients', async () => {
+    mocks.isWebClient = true
+    mocks.stateValues = ['local', false]
+    const { useAddRepoHostSelection } = await import('./use-add-repo-host-selection')
+
+    const result = useAddRepoHostSelection({ isOpen: true, setStep: vi.fn() })
+
+    expect(result.hostOptions.map((host) => host.id)).toEqual(['ssh:ssh-1', 'runtime:env-1'])
+    expect(result.selectedHostId).toBe('runtime:env-1')
+    expect(result.selectedParsedHost).toMatchObject({
+      kind: 'runtime',
+      environmentId: 'env-1'
+    })
+  })
+
+  it('has no local fallback while a paired web runtime is loading', async () => {
+    mocks.isWebClient = true
+    mocks.stateValues = ['local', false]
+    mocks.hostOptions = [mocks.hostOptions[0]]
+    const { useAddRepoHostSelection } = await import('./use-add-repo-host-selection')
+
+    const result = useAddRepoHostSelection({ isOpen: true, setStep: vi.fn() })
+
+    expect(result.hostOptions).toEqual([])
+    expect(result.selectedHostId).toBeNull()
+    expect(result.selectedParsedHost).toBeNull()
+    expect(mocks.stateSetters[0]).not.toHaveBeenCalledWith('local')
+  })
+
   it('selects a local or SSH host without changing the durable active server', async () => {
     mocks.stateValues = ['runtime:env-1', false]
     mocks.storeState.settings = { activeRuntimeEnvironmentId: 'env-1' }
diff --git a/src/renderer/src/components/sidebar/use-add-repo-host-selection.ts b/src/renderer/src/components/sidebar/use-add-repo-host-selection.ts
index 684fa75d78b..29f1fadc761 100644
--- a/src/renderer/src/components/sidebar/use-add-repo-host-selection.ts
+++ b/src/renderer/src/components/sidebar/use-add-repo-host-selection.ts
@@ -13,6 +13,7 @@ import type { AddRepoDialogStep } from './add-repo-dialog-types'
 import { useSidebarHostScopeOptions } from './use-sidebar-host-scope-options'
 import { canSelectAddRepoHost } from './add-repo-host-availability'
 import { translate } from '@/i18n/i18n'
+import { isWebClientLocation } from '@/lib/web-client-location'
 
 export function useAddRepoHostSelection({
   isOpen,
@@ -22,7 +23,7 @@ export function useAddRepoHostSelection({
   setStep: (step: AddRepoDialogStep) => void
 }): {
   hostOptions: ReturnType<typeof useSidebarHostScopeOptions>['hostOptions']
-  selectedHostId: ExecutionHostId
+  selectedHostId: ExecutionHostId | null
   selectedParsedHost: ReturnType<typeof parseExecutionHostId>
   selectedSshTargetId: string | null
   hostSelectorOpen: boolean
@@ -35,6 +36,7 @@ export function useAddRepoHostSelection({
   const sshConnectionStates = useAppStore((s) => s.sshConnectionStates)
   const runtimeEnvironments = useAppStore((s) => s.runtimeEnvironments)
   const { hostOptions } = useSidebarHostScopeOptions()
+  const isWebClient = isWebClientLocation()
   const ephemeralRuntimeEnvironmentIds = useMemo(
     () =>
       new Set(
@@ -49,26 +51,31 @@ export function useAddRepoHostSelection({
       hostOptions.filter((host) => {
         const parsed = parseExecutionHostId(host.id)
         return (
-          parsed?.kind !== 'runtime' || !ephemeralRuntimeEnvironmentIds.has(parsed.environmentId)
+          !(isWebClient && parsed?.kind === 'local') &&
+          (parsed?.kind !== 'runtime' || !ephemeralRuntimeEnvironmentIds.has(parsed.environmentId))
         )
       }),
-    [ephemeralRuntimeEnvironmentIds, hostOptions]
+    [ephemeralRuntimeEnvironmentIds, hostOptions, isWebClient]
   )
   const [selectedAddProjectHostId, setSelectedAddProjectHostId] =
     useState<ExecutionHostId>(LOCAL_EXECUTION_HOST_ID)
   const [hostSelectorOpen, setHostSelectorOpen] = useState(false)
   const previousOpenRef = useRef(false)
+  const pairedWebRuntimeHost = isWebClient
+    ? selectableHostOptions.find((host) => host.kind === 'runtime' && canSelectAddRepoHost(host))
+    : undefined
 
   const selectedHost =
     selectableHostOptions.find(
       (host) => host.id === selectedAddProjectHostId && canSelectAddRepoHost(host)
     ) ??
+    pairedWebRuntimeHost ??
     selectableHostOptions.find(
       (host) => host.id === LOCAL_EXECUTION_HOST_ID && canSelectAddRepoHost(host)
     ) ??
     selectableHostOptions.find((host) => canSelectAddRepoHost(host)) ??
     selectableHostOptions[0]
-  const selectedHostId = selectedHost?.id ?? LOCAL_EXECUTION_HOST_ID
+  const selectedHostId = selectedHost?.id ?? (isWebClient ? null : LOCAL_EXECUTION_HOST_ID)
   const selectedParsedHost = parseExecutionHostId(selectedHostId)
   const selectedSshTargetId =
     selectedParsedHost?.kind === 'ssh' ? selectedParsedHost.targetId : null
@@ -80,14 +87,16 @@ export function useAddRepoHostSelection({
         (host) => host.id === focusedHostId && canSelectAddRepoHost(host)
       )
         ? focusedHostId
-        : LOCAL_EXECUTION_HOST_ID
-      setSelectedAddProjectHostId(nextHostId)
+        : (pairedWebRuntimeHost?.id ?? (isWebClient ? null : LOCAL_EXECUTION_HOST_ID))
+      if (nextHostId) {
+        setSelectedAddProjectHostId(nextHostId)
+      }
     }
     if (!isOpen) {
       setHostSelectorOpen(false)
     }
     previousOpenRef.current = isOpen
-  }, [isOpen, selectableHostOptions, settings])
+  }, [isOpen, isWebClient, pairedWebRuntimeHost?.id, selectableHostOptions, settings])
 
   const handleSelectAddProjectHost = useCallback(
     async (hostId: ExecutionHostId): Promise<void> => {
diff --git a/src/renderer/src/components/sidebar/use-confirmed-worktree-delete-targets.ts b/src/renderer/src/components/sidebar/use-confirmed-worktree-delete-targets.ts
new file mode 100644
index 00000000000..f2e0dd7929b
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-confirmed-worktree-delete-targets.ts
@@ -0,0 +1,45 @@
+import { useCallback, useMemo } from 'react'
+import { useAppStore } from '@/store'
+import { getWorktreeMapFromState } from '@/store/selectors'
+import {
+  readWorktreeDeleteIdentities,
+  resolveWorktreeBatchDeleteTargets,
+  type WorktreeDeleteIdentity
+} from './worktree-delete-request'
+import { showWorkspaceListChangedToast } from './stale-workspace-list-toast'
+
+export function useConfirmedWorktreeDeleteTargets({
+  worktreeIdentityData,
+  lineageIdentityData,
+  closeModal
+}: {
+  worktreeIdentityData: unknown
+  lineageIdentityData: unknown
+  closeModal: () => void
+}) {
+  const worktreeDeleteIdentities = useMemo(
+    () => readWorktreeDeleteIdentities(worktreeIdentityData),
+    [worktreeIdentityData]
+  )
+  const lineageDeleteIdentities = useMemo(
+    () => readWorktreeDeleteIdentities(lineageIdentityData),
+    [lineageIdentityData]
+  )
+  const resolveConfirmedTargets = useCallback(
+    (identities: readonly WorktreeDeleteIdentity[], expectedCount: number) => {
+      const targets = resolveWorktreeBatchDeleteTargets(
+        identities,
+        getWorktreeMapFromState(useAppStore.getState())
+      )
+      if (!targets || targets.length !== expectedCount) {
+        showWorkspaceListChangedToast()
+        closeModal()
+        return null
+      }
+      return targets
+    },
+    [closeModal]
+  )
+
+  return { worktreeDeleteIdentities, lineageDeleteIdentities, resolveConfirmedTargets }
+}
diff --git a/src/renderer/src/components/sidebar/use-delete-worktree-status-hydration.ts b/src/renderer/src/components/sidebar/use-delete-worktree-status-hydration.ts
new file mode 100644
index 00000000000..2a88a430c50
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-delete-worktree-status-hydration.ts
@@ -0,0 +1,60 @@
+import { useEffect } from 'react'
+import { useAppStore } from '@/store'
+import { getConnectionId } from '@/lib/connection-context'
+import { getSettingsForWorktreeRuntimeOwner } from '@/lib/worktree-runtime-owner'
+import { getRuntimeGitStatus } from '@/runtime/runtime-git-client'
+import type { Repo, Worktree } from '../../../../shared/types'
+import { isFolderWorkspaceDelete } from './delete-worktree-dialog-copy'
+
+export function useDeleteWorktreeStatusHydration({
+  isOpen,
+  deleteTargets,
+  repoMap
+}: {
+  isOpen: boolean
+  deleteTargets: readonly Worktree[]
+  repoMap: ReadonlyMap<string, Repo>
+}): void {
+  const repos = useAppStore((state) => state.repos)
+  const settings = useAppStore((state) => state.settings)
+  const setGitStatus = useAppStore((state) => state.setGitStatus)
+
+  useEffect(() => {
+    if (!isOpen) {
+      return
+    }
+    const gitStatusByWorktree = useAppStore.getState().gitStatusByWorktree
+    const targets = deleteTargets.filter(
+      (target) =>
+        !target.isMainWorktree &&
+        !isFolderWorkspaceDelete(repoMap, target) &&
+        gitStatusByWorktree[target.id] === undefined
+    )
+    const controller = new AbortController()
+    for (const target of targets) {
+      void getRuntimeGitStatus(
+        {
+          settings: getSettingsForWorktreeRuntimeOwner(
+            { repos, settings, worktreesByRepo: useAppStore.getState().worktreesByRepo },
+            target.id
+          ),
+          worktreeId: target.id,
+          worktreePath: target.path,
+          connectionId: getConnectionId(target.id) ?? undefined
+        },
+        { signal: controller.signal }
+      )
+        .then((status) => {
+          if (!controller.signal.aborted) {
+            setGitStatus(target.id, status)
+          }
+        })
+        .catch(() => {
+          // Best effort only; deletion performs the authoritative backend check.
+        })
+    }
+    return () => {
+      controller.abort()
+    }
+  }, [deleteTargets, isOpen, repoMap, repos, setGitStatus, settings])
+}
diff --git a/src/renderer/src/components/sidebar/use-sidebar-feedback-environment-prefill.ts b/src/renderer/src/components/sidebar/use-sidebar-feedback-environment-prefill.ts
new file mode 100644
index 00000000000..ea6ee05e911
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-sidebar-feedback-environment-prefill.ts
@@ -0,0 +1,84 @@
+import { useLayoutEffect, useEffect, useRef, type RefObject } from 'react'
+import { resolveClientEnvironmentInfo } from '@/lib/client-environment-info'
+import {
+  appendClientEnvironmentFooter,
+  type ClientEnvironmentInfo
+} from '../../../../shared/client-environment-info'
+
+type FeedbackSelection = {
+  feedback: string
+  start: number
+  end: number
+  direction: 'forward' | 'backward' | 'none'
+}
+
+function insertClientEnvironmentFooter(params: {
+  feedback: string
+  environmentInfo: ClientEnvironmentInfo
+}): string {
+  const withFooter = appendClientEnvironmentFooter({
+    message: params.feedback,
+    info: params.environmentInfo
+  })
+  return params.feedback.trim() === '' ? `\n\n${withFooter}` : withFooter
+}
+
+/** Prefill version/OS footer without stealing caret while the user is typing. */
+export function useSidebarFeedbackEnvironmentPrefill(params: {
+  open: boolean
+  feedback: string
+  setFeedback: (updater: (current: string) => string) => void
+  textareaRef: RefObject<HTMLTextAreaElement | null>
+  mountedRef: RefObject<boolean>
+}): void {
+  const { open, feedback, setFeedback, textareaRef, mountedRef } = params
+  const pendingFeedbackSelectionRef = useRef<FeedbackSelection | null>(null)
+
+  useLayoutEffect(() => {
+    const pending = pendingFeedbackSelectionRef.current
+    if (!pending) {
+      return
+    }
+    pendingFeedbackSelectionRef.current = null
+    if (pending.feedback !== feedback) {
+      return
+    }
+    const textarea = textareaRef.current
+    if (textarea && document.activeElement === textarea) {
+      textarea.setSelectionRange(pending.start, pending.end, pending.direction)
+    }
+  }, [feedback, textareaRef])
+
+  // Why: copied feedback does not include the structured IPC metadata.
+  useEffect(() => {
+    if (!open) {
+      return
+    }
+
+    let cancelled = false
+    void resolveClientEnvironmentInfo().then((environmentInfo) => {
+      if (cancelled || !mountedRef.current) {
+        return
+      }
+      const textarea = textareaRef.current
+      if (textarea && document.activeElement === textarea) {
+        pendingFeedbackSelectionRef.current = {
+          feedback: insertClientEnvironmentFooter({
+            feedback: textarea.value,
+            environmentInfo
+          }),
+          start: textarea.selectionStart,
+          end: textarea.selectionEnd,
+          direction: textarea.selectionDirection
+        }
+      }
+      setFeedback((current) =>
+        insertClientEnvironmentFooter({ feedback: current, environmentInfo })
+      )
+    })
+
+    return () => {
+      cancelled = true
+    }
+  }, [open, mountedRef, setFeedback, textareaRef])
+}
diff --git a/src/renderer/src/components/sidebar/use-sidebar-feedback-images.ts b/src/renderer/src/components/sidebar/use-sidebar-feedback-images.ts
new file mode 100644
index 00000000000..6bbf0c9c627
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-sidebar-feedback-images.ts
@@ -0,0 +1,129 @@
+import { useCallback, useEffect, useRef, useState, type RefObject } from 'react'
+import { toast } from 'sonner'
+import { translate } from '@/i18n/i18n'
+import {
+  readFeedbackImageFiles,
+  releaseFeedbackImageDraft,
+  type FeedbackImageDraft
+} from '@/lib/feedback-image-attachments'
+import { useFeedbackImageDrop } from './use-feedback-image-drop'
+
+export function useSidebarFeedbackImages(params: {
+  open: boolean
+  isSubmitting: boolean
+  mountedRef: RefObject<boolean>
+}): {
+  images: FeedbackImageDraft[]
+  pendingImageReadCount: number
+  isDragActive: boolean
+  contentRef: ReturnType<typeof useFeedbackImageDrop>['contentRef']
+  dragHandlers: ReturnType<typeof useFeedbackImageDrop>['dragHandlers']
+  handleAddFiles: (files: readonly File[]) => void
+  handleRemoveImage: (id: string) => void
+  clearImages: () => void
+  hasPendingImageReads: () => boolean
+  /** Live committed+pending count for paste capacity checks. */
+  getReservedImageSlots: () => number
+} {
+  const [images, setImages] = useState<FeedbackImageDraft[]>([])
+  const [pendingImageReadCount, setPendingImageReadCount] = useState(0)
+  const liveImageDraftsRef = useRef<FeedbackImageDraft[]>([])
+  // Why: committed state lags in-flight reads, so batches still being read count
+  // against capacity — otherwise two quick pastes both see room for four.
+  const pendingImageReadsRef = useRef(0)
+  const imageCount = images.length
+
+  const clearImages = useCallback(() => {
+    liveImageDraftsRef.current.forEach(releaseFeedbackImageDraft)
+    liveImageDraftsRef.current = []
+    setImages([])
+  }, [])
+
+  // Why: object URLs for the thumbnails leak until revoked.
+  useEffect(
+    () => () => {
+      liveImageDraftsRef.current.forEach(releaseFeedbackImageDraft)
+      liveImageDraftsRef.current = []
+    },
+    []
+  )
+
+  const handleAddFiles = useCallback(
+    (files: readonly File[]) => {
+      if (files.length === 0) {
+        return
+      }
+      if (params.isSubmitting) {
+        toast.warning(
+          translate(
+            'auto.components.sidebar.SidebarFeedbackDialog.attachWhileSending',
+            'Wait for the current feedback to finish sending before attaching more images.'
+          )
+        )
+        return
+      }
+      // Why: read the committed count from the closure rather than a ref. A ref
+      // synced in an effect can still be stale-low right after an add.
+      const existingCount = imageCount + pendingImageReadsRef.current
+      pendingImageReadsRef.current += files.length
+      setPendingImageReadCount((current) => current + files.length)
+      void readFeedbackImageFiles(files, existingCount).then(
+        ({ images: added, errors }) => {
+          pendingImageReadsRef.current -= files.length
+          if (!params.mountedRef.current) {
+            added.forEach(releaseFeedbackImageDraft)
+            return
+          }
+          setPendingImageReadCount((current) => Math.max(0, current - files.length))
+          if (added.length > 0) {
+            liveImageDraftsRef.current = [...liveImageDraftsRef.current, ...added]
+            setImages((existing) => [...existing, ...added])
+          }
+          // Why: never drop an attachment without telling the user.
+          errors.forEach((error) => toast.warning(error))
+        },
+        (error: unknown) => {
+          pendingImageReadsRef.current -= files.length
+          console.error('Failed to read feedback image attachments:', error)
+          if (params.mountedRef.current) {
+            setPendingImageReadCount((current) => Math.max(0, current - files.length))
+            toast.error(
+              translate(
+                'auto.components.sidebar.SidebarFeedbackDialog.imageReadFailed',
+                'Could not read the attached images. Try attaching them again.'
+              )
+            )
+          }
+        }
+      )
+    },
+    [imageCount, params.isSubmitting, params.mountedRef]
+  )
+
+  const handleRemoveImage = useCallback((id: string) => {
+    const removed = liveImageDraftsRef.current.find((image) => image.id === id)
+    if (removed) {
+      releaseFeedbackImageDraft(removed)
+      liveImageDraftsRef.current = liveImageDraftsRef.current.filter((image) => image.id !== id)
+    }
+    setImages((current) => current.filter((image) => image.id !== id))
+  }, [])
+
+  const { isDragActive, contentRef, dragHandlers } = useFeedbackImageDrop(
+    params.open,
+    handleAddFiles
+  )
+
+  return {
+    images,
+    pendingImageReadCount,
+    isDragActive,
+    contentRef,
+    dragHandlers,
+    handleAddFiles,
+    handleRemoveImage,
+    clearImages,
+    hasPendingImageReads: () => pendingImageReadsRef.current > 0,
+    getReservedImageSlots: () => liveImageDraftsRef.current.length + pendingImageReadsRef.current
+  }
+}
diff --git a/src/renderer/src/components/sidebar/use-visible-workspace-kanban-worktree-ids.ts b/src/renderer/src/components/sidebar/use-visible-workspace-kanban-worktree-ids.ts
index 0e565018667..180ef7d6daf 100644
--- a/src/renderer/src/components/sidebar/use-visible-workspace-kanban-worktree-ids.ts
+++ b/src/renderer/src/components/sidebar/use-visible-workspace-kanban-worktree-ids.ts
@@ -4,6 +4,11 @@ import type { Repo, Worktree } from '../../../../shared/types'
 import { computeVisibleWorktreeIds } from './visible-worktrees'
 import { getWorktreeIdsWithLiveAgent } from '@/lib/worktree-activity-state'
 import { getSettingsFocusedExecutionHostId } from '../../../../shared/execution-host'
+import type { AppState } from '@/store/types'
+import {
+  EMPTY_PAIRED_DEVICE_IDS_BY_ENVIRONMENT,
+  getPairedDeviceIdsByEnvironment
+} from './workspace-creator-visibility'
 
 type UseVisibleWorkspaceKanbanWorktreeIdsParams = {
   allWorktrees: readonly Worktree[]
@@ -11,6 +16,8 @@ type UseVisibleWorkspaceKanbanWorktreeIdsParams = {
 }
 
 const EMPTY_WORKTREE_ID_SET: ReadonlySet<string> = new Set()
+const EMPTY_RUNTIME_ENVIRONMENTS: AppState['runtimeEnvironments'] = []
+const EMPTY_RUNTIME_STATUS_BY_ENVIRONMENT_ID: AppState['runtimeStatusByEnvironmentId'] = new Map()
 
 export function useVisibleWorkspaceKanbanWorktreeIds({
   allWorktrees,
@@ -22,6 +29,15 @@ export function useVisibleWorkspaceKanbanWorktreeIds({
   const hideAutomationGeneratedWorkspaces = useAppStore((s) => s.hideAutomationGeneratedWorkspaces)
   const hideCliCreatedWorkspaces = useAppStore((s) => s.hideCliCreatedWorkspaces)
   const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces)
+  const hideWorkspacesFromOtherDevices = useAppStore((s) => s.hideWorkspacesFromOtherDevices)
+  const runtimeEnvironments = useAppStore((s) =>
+    s.hideWorkspacesFromOtherDevices ? s.runtimeEnvironments : EMPTY_RUNTIME_ENVIRONMENTS
+  )
+  const runtimeStatusByEnvironmentId = useAppStore((s) =>
+    s.hideWorkspacesFromOtherDevices
+      ? s.runtimeStatusByEnvironmentId
+      : EMPTY_RUNTIME_STATUS_BY_ENVIRONMENT_ID
+  )
   const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace)
   const workspaceHostScope = useAppStore((s) => s.workspaceHostScope)
   const visibleWorkspaceHostIds = useAppStore((s) => s.visibleWorkspaceHostIds)
@@ -62,6 +78,10 @@ export function useVisibleWorkspaceKanbanWorktreeIds({
         hideAutomationGeneratedWorkspaces,
         hideCliCreatedWorkspaces,
         hideDetachedHeadWorkspaces,
+        hideWorkspacesFromOtherDevices,
+        pairedDeviceIdsByEnvironment: hideWorkspacesFromOtherDevices
+          ? getPairedDeviceIdsByEnvironment(runtimeEnvironments, runtimeStatusByEnvironmentId)
+          : EMPTY_PAIRED_DEVICE_IDS_BY_ENVIRONMENT,
         alwaysShowDefaultBranchWorkspace,
         repoMap,
         workspaceHostScope,
@@ -81,12 +101,15 @@ export function useVisibleWorkspaceKanbanWorktreeIds({
     hideAutomationGeneratedWorkspaces,
     hideCliCreatedWorkspaces,
     hideDetachedHeadWorkspaces,
+    hideWorkspacesFromOtherDevices,
     alwaysShowDefaultBranchWorkspace,
     workspaceHostScope,
     visibleWorkspaceHostIds,
     settings,
     ptyIdsByTabId,
     repoMap,
+    runtimeEnvironments,
+    runtimeStatusByEnvironmentId,
     showSleepingWorkspaces,
     tabsByWorktree,
     worktreeIdsWithLiveAgent,
diff --git a/src/renderer/src/components/sidebar/use-worktree-card-activation-actions.ts b/src/renderer/src/components/sidebar/use-worktree-card-activation-actions.ts
new file mode 100644
index 00000000000..cfbc652ef05
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-card-activation-actions.ts
@@ -0,0 +1,150 @@
+import React, { useCallback } from 'react'
+
+import { getRepoExecutionHostId } from '../../../../shared/execution-host'
+import { recordRendererCrashBreadcrumb } from '@/lib/crash-diagnostics'
+import { activateWorktreeFromSidebar } from '@/lib/sidebar-worktree-activation'
+import { isEventTargetInsideCurrentTarget } from './worktree-card-dom-events'
+import type { WorktreeCardProps } from './worktree-card-model'
+import type { useWorktreeCardFoundation } from './use-worktree-card-foundation'
+import type { useWorktreeCardLinkedDetails } from './use-worktree-card-linked-details'
+
+type Foundation = ReturnType<typeof useWorktreeCardFoundation>
+type LinkedDetails = ReturnType<typeof useWorktreeCardLinkedDetails>
+
+export function useWorktreeCardActivationActions({
+  worktree,
+  repo,
+  affiliateListMode,
+  onSelectionGesture,
+  isActive,
+  activationRowKey,
+  onActivate,
+  onImmediateActivate,
+  isDeleting,
+  isSshDisconnected,
+  updateWorktreeMeta,
+  openModal
+}: Pick<
+  WorktreeCardProps,
+  | 'worktree'
+  | 'repo'
+  | 'affiliateListMode'
+  | 'onSelectionGesture'
+  | 'isActive'
+  | 'activationRowKey'
+  | 'onActivate'
+  | 'onImmediateActivate'
+> &
+  Pick<Foundation, 'isSshDisconnected' | 'updateWorktreeMeta' | 'openModal'> &
+  Pick<LinkedDetails, 'isDeleting'>) {
+  // Stable click handler – ignore clicks that are really text selections.
+  const handleClick = useCallback(
+    (event: React.MouseEvent<HTMLDivElement>) => {
+      if (!isEventTargetInsideCurrentTarget(event.currentTarget, event.target)) {
+        return
+      }
+      const selection = window.getSelection()
+      // Why: only suppress the click for a selection inside this card; a foreign selection must not block worktree switching.
+      if (selection && selection.toString().length > 0) {
+        const card = event.currentTarget
+        const anchor = selection.anchorNode
+        const focus = selection.focusNode
+        const selectionInsideCard =
+          (anchor instanceof Node && card.contains(anchor)) ||
+          (focus instanceof Node && card.contains(focus))
+        if (selectionInsideCard) {
+          return
+        }
+      }
+      const selectionOnly = affiliateListMode
+        ? false
+        : (onSelectionGesture?.(event, worktree.id) ?? false)
+      if (selectionOnly) {
+        event.preventDefault()
+        event.stopPropagation()
+        return
+      }
+      if (isDeleting) {
+        event.preventDefault()
+        event.stopPropagation()
+        return
+      }
+      // Why: route sidebar clicks through the shared activation path so the back/forward stack stays complete.
+      recordRendererCrashBreadcrumb('sidebar_worktree_activate', {
+        worktreeId: worktree.id,
+        repoId: worktree.repoId,
+        wasActive: isActive,
+        sshDisconnected: isSshDisconnected
+      })
+      onImmediateActivate?.(worktree.id, activationRowKey)
+      void activateWorktreeFromSidebar(
+        worktree.id,
+        worktree.hostId ?? (repo ? getRepoExecutionHostId(repo) : undefined)
+      )
+      onActivate?.()
+    },
+    [
+      affiliateListMode,
+      worktree.id,
+      worktree.repoId,
+      worktree.hostId,
+      repo,
+      isActive,
+      isDeleting,
+      activationRowKey,
+      isSshDisconnected,
+      onActivate,
+      onImmediateActivate,
+      onSelectionGesture
+    ]
+  )
+
+  const handleRenameTitle = useCallback(
+    // Inline rename has no surface for the failure; the store already logs and
+    // refetches, which reverts the optimistic title in place.
+    async (displayName: string): Promise<void> => {
+      await updateWorktreeMeta(worktree.id, { displayName })
+    },
+    [updateWorktreeMeta, worktree.id]
+  )
+
+  const handleDoubleClick = useCallback(
+    (event: React.MouseEvent<HTMLDivElement>) => {
+      if (affiliateListMode) {
+        return
+      }
+      if (!isEventTargetInsideCurrentTarget(event.currentTarget, event.target)) {
+        return
+      }
+      openModal('edit-meta', {
+        worktreeId: worktree.id,
+        repoId: worktree.repoId,
+        currentDisplayName: worktree.displayName,
+        currentIssue: worktree.linkedIssue,
+        currentPR: worktree.linkedPR,
+        currentComment: worktree.comment
+      })
+    },
+    [
+      openModal,
+      affiliateListMode,
+      worktree.comment,
+      worktree.displayName,
+      worktree.id,
+      worktree.linkedIssue,
+      worktree.linkedPR,
+      worktree.repoId
+    ]
+  )
+
+  const handleToggleUnreadQuick = useCallback(
+    (event: React.MouseEvent<HTMLButtonElement>) => {
+      event.preventDefault()
+      event.stopPropagation()
+      updateWorktreeMeta(worktree.id, { isUnread: !worktree.isUnread })
+    },
+    [worktree.id, worktree.isUnread, updateWorktreeMeta]
+  )
+
+  return { handleClick, handleRenameTitle, handleDoubleClick, handleToggleUnreadQuick }
+}
diff --git a/src/renderer/src/components/sidebar/use-worktree-card-controller.ts b/src/renderer/src/components/sidebar/use-worktree-card-controller.ts
new file mode 100644
index 00000000000..6a116991023
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-card-controller.ts
@@ -0,0 +1,165 @@
+import { canShowWorkspaceDeleteQuickAction } from './workspace-delete-quick-action'
+import { useWorktreeCardDetailsHoverControl } from './worktree-card-details-hover-state'
+import type { ResolvedWorktreeCardProps } from './worktree-card-model'
+import { useWorktreeCardActivationActions } from './use-worktree-card-activation-actions'
+import { useWorktreeCardFoundation } from './use-worktree-card-foundation'
+import { useWorktreeCardLifecycleEffects } from './use-worktree-card-lifecycle-effects'
+import { useWorktreeCardLinkedDetails } from './use-worktree-card-linked-details'
+import { useWorktreeCardReviewDetails } from './use-worktree-card-review-details'
+import { useWorktreeCardSecondaryDetails } from './use-worktree-card-secondary-details'
+import { useWorktreeCardWorkspaceActions } from './use-worktree-card-workspace-actions'
+
+export function useWorktreeCardController(props: ResolvedWorktreeCardProps) {
+  const { worktree, repo } = props
+  const foundation = useWorktreeCardFoundation({ worktree, repo })
+  const review = useWorktreeCardReviewDetails({
+    worktree,
+    repo,
+    settings: foundation.settings,
+    projectGroups: foundation.projectGroups,
+    cardProps: foundation.cardProps,
+    newCardStyle: foundation.newCardStyle
+  })
+  const linked = useWorktreeCardLinkedDetails({
+    worktree,
+    newCardStyle: foundation.newCardStyle,
+    deleteState: foundation.deleteState,
+    branch: review.branch,
+    issueEntry: review.issueEntry,
+    linearIssueEntry: review.linearIssueEntry,
+    linearIssueFallbackEntry: review.linearIssueFallbackEntry,
+    prDisplay: review.prDisplay
+  })
+
+  const showStatus = foundation.cardProps.includes('status')
+  const showIssue = foundation.cardProps.includes('issue')
+  const showLinearIssue = foundation.cardProps.includes('linear-issue')
+  const showJiraIssue = foundation.cardProps.includes('jira-issue')
+  const showPR = foundation.cardProps.includes('pr')
+  const showAutomation = foundation.cardProps.includes('automation')
+  const showCli = foundation.cardProps.includes('cli')
+  const showComment = foundation.cardProps.includes('comment')
+  const showPorts = foundation.cardProps.includes('ports')
+  const shouldRefreshHostedReview = foundation.newCardStyle ? showStatus : showPR
+  const detailsHoverControl = useWorktreeCardDetailsHoverControl()
+  const hoverDetailsOpen = detailsHoverControl.hoverOpen
+
+  useWorktreeCardLifecycleEffects({
+    worktree,
+    repo,
+    isFolder: review.isFolder,
+    hostedReviewCacheKey: review.hostedReviewCacheKey,
+    cachedBranchFallbackGitHubPRNumber: review.cachedBranchFallbackGitHubPRNumber,
+    linkedGitLabMR: review.linkedGitLabMR,
+    linkedBitbucketPR: review.linkedBitbucketPR,
+    linkedAzureDevOpsPR: review.linkedAzureDevOpsPR,
+    linkedGiteaPR: review.linkedGiteaPR,
+    branch: review.branch,
+    fetchHostedReviewForBranch: foundation.fetchHostedReviewForBranch,
+    shouldRefreshHostedReview,
+    newCardStyle: foundation.newCardStyle,
+    hoverDetailsOpen,
+    showIssue,
+    issueCacheKey: review.issueCacheKey,
+    fetchIssue: foundation.fetchIssue,
+    showLinearIssue,
+    fetchLinearIssue: foundation.fetchLinearIssue
+  })
+
+  const activation = useWorktreeCardActivationActions({
+    worktree,
+    repo,
+    affiliateListMode: props.affiliateListMode,
+    onSelectionGesture: props.onSelectionGesture,
+    isActive: props.isActive,
+    activationRowKey: props.activationRowKey,
+    onActivate: props.onActivate,
+    onImmediateActivate: props.onImmediateActivate,
+    isDeleting: linked.isDeleting,
+    isSshDisconnected: foundation.isSshDisconnected,
+    updateWorktreeMeta: foundation.updateWorktreeMeta,
+    openModal: foundation.openModal
+  })
+
+  // Why: delete is destructive, so it only appears while holding Option/Alt, not in the ordinary hover chrome.
+  const showDeleteQuickAction =
+    !props.affiliateListMode &&
+    canShowWorkspaceDeleteQuickAction({
+      deleteModifierPressed: linked.deleteModifierPressed,
+      isDeleting: linked.isDeleting,
+      isMainWorktree: worktree.isMainWorktree
+    })
+  const workspaceActions = useWorktreeCardWorkspaceActions({
+    worktree,
+    lineageChildCount: props.lineageChildCount,
+    lineageCollapsed: props.lineageCollapsed,
+    onLineageToggle: props.onLineageToggle,
+    isMultiSelected: props.isMultiSelected,
+    selectedWorktrees: props.selectedWorktrees,
+    onCardDragStart: props.onCardDragStart,
+    onCardDragEnd: props.onCardDragEnd,
+    onContextMenuSelect: props.onContextMenuSelect,
+    folderWorkspaceId: review.folderWorkspaceId,
+    deleteFolderWorkspace: foundation.deleteFolderWorkspace,
+    setActiveWorktree: foundation.setActiveWorktree,
+    setShowRenameErrorDialog: foundation.setShowRenameErrorDialog,
+    isDeleting: linked.isDeleting,
+    showDeleteQuickAction
+  })
+
+  const secondary = useWorktreeCardSecondaryDetails({
+    worktree,
+    repo,
+    statusPrDisplay: props.statusPrDisplay,
+    showStatus,
+    showIssue,
+    showLinearIssue,
+    showJiraIssue,
+    showPR,
+    showAutomation,
+    showCli,
+    showComment,
+    showPorts,
+    issueDisplay: linked.issueDisplay,
+    linearIssue: linked.linearIssue,
+    linearIssueDisplay: linked.linearIssueDisplay,
+    jiraIssueDisplay: linked.jiraIssueDisplay,
+    prDisplay: review.prDisplay,
+    linkedGitLabMR: review.linkedGitLabMR,
+    linkedBitbucketPR: review.linkedBitbucketPR,
+    linkedAzureDevOpsPR: review.linkedAzureDevOpsPR,
+    linkedGiteaPR: review.linkedGiteaPR,
+    cardProps: foundation.cardProps,
+    newCardStyle: foundation.newCardStyle,
+    compactCards: foundation.compactCards,
+    agentActivityDisplayMode: foundation.agentActivityDisplayMode,
+    workspacePorts: foundation.workspacePorts,
+    openTaskPage: foundation.openTaskPage,
+    updateWorktreeMeta: foundation.updateWorktreeMeta,
+    settings: foundation.settings
+  })
+
+  return {
+    ...props,
+    ...foundation,
+    ...review,
+    ...linked,
+    detailsHoverControl,
+    showStatus,
+    showIssue,
+    showLinearIssue,
+    showJiraIssue,
+    showPR,
+    showAutomation,
+    showCli,
+    showComment,
+    showPorts,
+    shouldRefreshHostedReview,
+    ...activation,
+    showDeleteQuickAction,
+    ...workspaceActions,
+    ...secondary
+  }
+}
+
+export type WorktreeCardController = ReturnType<typeof useWorktreeCardController>
diff --git a/src/renderer/src/components/sidebar/use-worktree-card-foundation.ts b/src/renderer/src/components/sidebar/use-worktree-card-foundation.ts
new file mode 100644
index 00000000000..0f607473cac
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-card-foundation.ts
@@ -0,0 +1,229 @@
+import React, { useCallback, useEffect, useState } from 'react'
+
+import { DEFAULT_AGENT_ACTIVITY_DISPLAY_MODE } from '../../../../shared/constants'
+import {
+  isRuntimeOwnedSshTargetId,
+  parseExecutionHostId,
+  toRuntimeExecutionHostId
+} from '../../../../shared/execution-host'
+import { getHostDisplayLabelOverrides } from '../../../../shared/host-setting-overrides'
+import { getWorkspacePortsByWorktreeId } from '@/lib/workspace-port-groups'
+import { getExplicitRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import { hydrateRuntimeEnvironmentSshState } from '@/runtime/runtime-environment-ssh-state'
+import { useAppStore } from '@/store'
+import {
+  selectRuntimeAwareSshStatus,
+  selectRuntimeAwareSshTargetLabel,
+  selectRuntimeAwareSshTargetRemoved
+} from '@/store/slices/runtime-environment-ssh'
+import { EMPTY_WORKSPACE_PORTS, type WorktreeCardProps } from './worktree-card-model'
+
+export function useWorktreeCardFoundation({
+  worktree,
+  repo
+}: Pick<WorktreeCardProps, 'worktree' | 'repo'>) {
+  const openModal = useAppStore((s) => s.openModal)
+  const openTaskPage = useAppStore((s) => s.openTaskPage)
+  const openAutomationsPage = useAppStore((s) => s.openAutomationsPage)
+  const setPendingAutomationRunNavigation = useAppStore((s) => s.setPendingAutomationRunNavigation)
+  const updateWorktreeMeta = useAppStore((s) => s.updateWorktreeMeta)
+  const deleteFolderWorkspace = useAppStore((s) => s.deleteFolderWorkspace)
+  const setActiveWorktree = useAppStore((s) => s.setActiveWorktree)
+  const renamingWorktreeId = useAppStore((s) => s.renamingWorktreeId)
+  const setRenamingWorktreeId = useAppStore((s) => s.setRenamingWorktreeId)
+  const fetchHostedReviewForBranch = useAppStore((s) => s.fetchHostedReviewForBranch)
+  const settings = useAppStore((s) => s.settings)
+  const fetchIssue = useAppStore((s) => s.fetchIssue)
+  const fetchLinearIssue = useAppStore((s) => s.fetchLinearIssue)
+  const cardProps = useAppStore((s) => s.worktreeCardProperties)
+  const agentActivityDisplayMode =
+    useAppStore((s) => s.agentActivityDisplayMode) ?? DEFAULT_AGENT_ACTIVITY_DISPLAY_MODE
+  const projectGroups = useAppStore((s) => s.projectGroups)
+  const newCardStyle = settings?.experimentalNewWorktreeCardStyle === true
+  const compactCards = !newCardStyle && settings?.compactWorktreeCards === true
+  const handleEditIssue = useCallback(
+    (e: React.MouseEvent) => {
+      e.stopPropagation()
+      openModal('edit-meta', {
+        worktreeId: worktree.id,
+        // Why: the same workspace ID can exist under two hosts. Naming the owner
+        // keeps the dialog on the clicked row instead of the ambiguous lookup.
+        repoId: worktree.repoId,
+        currentDisplayName: worktree.displayName,
+        currentIssue: worktree.linkedIssue,
+        currentPR: worktree.linkedPR,
+        currentComment: worktree.comment,
+        focus: 'issue'
+      })
+    },
+    [worktree, openModal]
+  )
+
+  const handleEditComment = useCallback(
+    (e: React.MouseEvent) => {
+      e.stopPropagation()
+      openModal('edit-meta', {
+        worktreeId: worktree.id,
+        repoId: worktree.repoId,
+        currentDisplayName: worktree.displayName,
+        currentIssue: worktree.linkedIssue,
+        currentPR: worktree.linkedPR,
+        currentComment: worktree.comment,
+        focus: 'comment'
+      })
+    },
+    [worktree, openModal]
+  )
+
+  const handleOpenAutomation = useCallback(
+    (e: React.MouseEvent) => {
+      e.stopPropagation()
+      const automationId = worktree.automationProvenance?.automationId
+      if (!automationId) {
+        return
+      }
+      const hostId = worktree.automationProvenance?.hostId ?? worktree.hostId
+      setPendingAutomationRunNavigation({
+        automationId,
+        runId: null,
+        ...(hostId ? { hostId } : {})
+      })
+      openAutomationsPage()
+    },
+    [
+      openAutomationsPage,
+      setPendingAutomationRunNavigation,
+      worktree.automationProvenance?.automationId,
+      worktree.automationProvenance?.hostId,
+      worktree.hostId
+    ]
+  )
+
+  const handleOpenAutomationRun = useCallback(
+    (e: React.MouseEvent) => {
+      e.stopPropagation()
+      const provenance = worktree.automationProvenance
+      if (!provenance) {
+        return
+      }
+      const hostId = provenance.hostId ?? worktree.hostId
+      setPendingAutomationRunNavigation({
+        automationId: provenance.automationId,
+        runId: provenance.automationRunId,
+        ...(hostId ? { hostId } : {})
+      })
+      openAutomationsPage()
+    },
+    [
+      openAutomationsPage,
+      setPendingAutomationRunNavigation,
+      worktree.automationProvenance,
+      worktree.hostId
+    ]
+  )
+
+  const deleteState = useAppStore((s) => s.deleteStateByWorktreeId[worktree.id])
+  const conflictOperation = useAppStore((s) => s.gitConflictOperationByWorktree[worktree.id])
+  const remoteBranchConflict = useAppStore((s) => s.remoteBranchConflictByWorktreeId[worktree.id])
+  const workspacePorts = useAppStore(
+    (s) =>
+      getWorkspacePortsByWorktreeId(s.workspacePortScan?.result).get(worktree.id) ??
+      EMPTY_WORKSPACE_PORTS
+  )
+
+  const sshOwnerEnvironmentId = useAppStore((s) =>
+    repo?.connectionId ? getExplicitRuntimeEnvironmentIdForWorktree(s, worktree.id) : null
+  )
+  const sshStatus = useAppStore((s) => {
+    // Why: runtime-owned SSH targets suppress their ssh:state-changed broadcasts, so don't show a false "disconnected" chip for them.
+    if (!repo?.connectionId || isRuntimeOwnedSshTargetId(repo.connectionId)) {
+      return null
+    }
+    return selectRuntimeAwareSshStatus(s, sshOwnerEnvironmentId, repo.connectionId)
+  })
+  useEffect(() => {
+    if (sshOwnerEnvironmentId) {
+      void hydrateRuntimeEnvironmentSshState(sshOwnerEnvironmentId).catch(() => {})
+    }
+  }, [sshOwnerEnvironmentId])
+  const isSshDisconnected = sshStatus != null && sshStatus !== 'connected'
+  // Why: only reported on positive evidence, so a removed host never offers a Connect that can
+  // only fail. Runtime-owned targets are excluded for the same reason sshStatus excludes them —
+  // ssh:listTargets filters them out, so "absent from the target list" is not evidence of removal.
+  const sshTargetRemoved = useAppStore((s) =>
+    repo?.connectionId && !isRuntimeOwnedSshTargetId(repo.connectionId)
+      ? selectRuntimeAwareSshTargetRemoved(s, sshOwnerEnvironmentId, repo.connectionId)
+      : false
+  )
+
+  const parsedRepoHost = parseExecutionHostId(repo?.executionHostId)
+  const runtimeOwnerEnvironmentId =
+    worktree.runtimeOwnerEnvironmentId ??
+    (parsedRepoHost?.kind === 'runtime' ? parsedRepoHost.environmentId : null)
+  const runtimeHostId = runtimeOwnerEnvironmentId
+    ? toRuntimeExecutionHostId(runtimeOwnerEnvironmentId)
+    : null
+  const runtimeEnvironmentName = useAppStore((s) =>
+    runtimeOwnerEnvironmentId
+      ? (s.runtimeEnvironments.find((environment) => environment.id === runtimeOwnerEnvironmentId)
+          ?.name ?? null)
+      : null
+  )
+  const runtimeHostLabel = runtimeHostId
+    ? (getHostDisplayLabelOverrides(settings).get(runtimeHostId) ?? runtimeEnvironmentName)
+    : null
+  // Why: runtime ("Orca server") hosts get the same disconnected dimming as SSH when their environment has no live status.
+  const isRuntimeDisconnected = useAppStore((s) => {
+    if (!runtimeOwnerEnvironmentId) {
+      return false
+    }
+    return !s.runtimeStatusByEnvironmentId.get(runtimeOwnerEnvironmentId)?.status
+  })
+  const [titleRenaming, setTitleRenaming] = useState(false)
+  const [showRenameErrorDialog, setShowRenameErrorDialog] = useState(false)
+  // Why: read the target label from its owning host's store instead of exposing HUB-private SSH metadata as client-local state.
+  const sshTargetLabel = useAppStore((s) =>
+    repo?.connectionId
+      ? selectRuntimeAwareSshTargetLabel(s, sshOwnerEnvironmentId, repo.connectionId)
+      : ''
+  )
+
+  return {
+    openModal,
+    openTaskPage,
+    updateWorktreeMeta,
+    deleteFolderWorkspace,
+    setActiveWorktree,
+    renamingWorktreeId,
+    setRenamingWorktreeId,
+    fetchHostedReviewForBranch,
+    settings,
+    fetchIssue,
+    fetchLinearIssue,
+    cardProps,
+    agentActivityDisplayMode,
+    projectGroups,
+    newCardStyle,
+    compactCards,
+    handleEditIssue,
+    handleEditComment,
+    handleOpenAutomation,
+    handleOpenAutomationRun,
+    deleteState,
+    conflictOperation,
+    remoteBranchConflict,
+    workspacePorts,
+    sshOwnerEnvironmentId,
+    sshStatus,
+    isSshDisconnected,
+    sshTargetRemoved,
+    parsedRepoHost,
+    runtimeHostLabel,
+    isRuntimeDisconnected,
+    titleRenaming,
+    setTitleRenaming,
+    showRenameErrorDialog,
+    setShowRenameErrorDialog,
+    sshTargetLabel
+  }
+}
diff --git a/src/renderer/src/components/sidebar/use-worktree-card-lifecycle-effects.ts b/src/renderer/src/components/sidebar/use-worktree-card-lifecycle-effects.ts
new file mode 100644
index 00000000000..77dfa0331c3
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-card-lifecycle-effects.ts
@@ -0,0 +1,239 @@
+import { useEffect } from 'react'
+
+import { isMacAppDataPath } from '@/lib/passive-macos-app-data-access'
+import { installWindowVisibilityInterval, isWindowVisible } from '@/lib/window-visibility-interval'
+import {
+  HOSTED_REVIEW_CARD_REFRESH_INTERVAL_MS,
+  isWebClient,
+  type WorktreeCardProps
+} from './worktree-card-model'
+import type { useWorktreeCardFoundation } from './use-worktree-card-foundation'
+import type { useWorktreeCardReviewDetails } from './use-worktree-card-review-details'
+
+type Foundation = ReturnType<typeof useWorktreeCardFoundation>
+type ReviewDetails = ReturnType<typeof useWorktreeCardReviewDetails>
+
+export function useWorktreeCardLifecycleEffects({
+  worktree,
+  repo,
+  isFolder,
+  hostedReviewCacheKey,
+  cachedBranchFallbackGitHubPRNumber,
+  linkedGitLabMR,
+  linkedBitbucketPR,
+  linkedAzureDevOpsPR,
+  linkedGiteaPR,
+  branch,
+  fetchHostedReviewForBranch,
+  shouldRefreshHostedReview,
+  newCardStyle,
+  hoverDetailsOpen,
+  showIssue,
+  issueCacheKey,
+  fetchIssue,
+  showLinearIssue,
+  fetchLinearIssue
+}: Pick<WorktreeCardProps, 'worktree' | 'repo'> &
+  Pick<
+    ReviewDetails,
+    | 'isFolder'
+    | 'hostedReviewCacheKey'
+    | 'cachedBranchFallbackGitHubPRNumber'
+    | 'linkedGitLabMR'
+    | 'linkedBitbucketPR'
+    | 'linkedAzureDevOpsPR'
+    | 'linkedGiteaPR'
+    | 'branch'
+    | 'issueCacheKey'
+  > &
+  Pick<
+    Foundation,
+    'fetchHostedReviewForBranch' | 'newCardStyle' | 'fetchIssue' | 'fetchLinearIssue'
+  > & {
+    shouldRefreshHostedReview: boolean
+    hoverDetailsOpen: boolean
+    showIssue: boolean
+    showLinearIssue: boolean
+  }): void {
+  // Why: card surfaces are presentational, so skip hosted-review fetches when hidden to save rate-limit budget.
+  useEffect(() => {
+    // Why: paired web must not fan out per-card decoration RPCs during startup; host session/tab parity is critical.
+    if (isWebClient()) {
+      return
+    }
+    if (
+      !repo ||
+      isFolder ||
+      worktree.isBare ||
+      !hostedReviewCacheKey ||
+      !shouldRefreshHostedReview ||
+      isMacAppDataPath(repo.path)
+    ) {
+      return
+    }
+    const refreshHostedReview = (): void => {
+      // Why: branch lookup is lossy for fork/deleted-head PRs; reuse a known PR number from explicit metadata when we have one.
+      void fetchHostedReviewForBranch(repo.path, branch, {
+        repoId: repo.id,
+        linkedGitHubPR: worktree.linkedPR ?? null,
+        ...(cachedBranchFallbackGitHubPRNumber !== null
+          ? { fallbackGitHubPR: cachedBranchFallbackGitHubPRNumber }
+          : {}),
+        currentHeadOid: worktree.head ?? null,
+        linkedGitLabMR,
+        linkedBitbucketPR,
+        linkedAzureDevOpsPR,
+        linkedGiteaPR,
+        staleWhileRevalidate: true
+      })
+    }
+    // Why: PRs created outside Orca (e.g. `gh pr create`) emit no renderer event; poll visible cards to discover them.
+    return installWindowVisibilityInterval({
+      run: refreshHostedReview,
+      intervalMs: HOSTED_REVIEW_CARD_REFRESH_INTERVAL_MS
+    })
+  }, [
+    repo,
+    isFolder,
+    worktree.isBare,
+    worktree.linkedPR,
+    worktree.head,
+    cachedBranchFallbackGitHubPRNumber,
+    linkedGitLabMR,
+    linkedBitbucketPR,
+    linkedAzureDevOpsPR,
+    linkedGiteaPR,
+    fetchHostedReviewForBranch,
+    branch,
+    hostedReviewCacheKey,
+    shouldRefreshHostedReview
+  ])
+
+  useEffect(() => {
+    if (
+      !newCardStyle ||
+      !hoverDetailsOpen ||
+      shouldRefreshHostedReview ||
+      isWebClient() ||
+      !repo ||
+      isFolder ||
+      worktree.isBare ||
+      !hostedReviewCacheKey ||
+      isMacAppDataPath(repo.path)
+    ) {
+      return
+    }
+    // Why: hidden card metadata is revealed on whole-card hover, so fetch lazily instead of always-on polling.
+    void fetchHostedReviewForBranch(repo.path, branch, {
+      repoId: repo.id,
+      linkedGitHubPR: worktree.linkedPR ?? null,
+      ...(cachedBranchFallbackGitHubPRNumber !== null
+        ? { fallbackGitHubPR: cachedBranchFallbackGitHubPRNumber }
+        : {}),
+      currentHeadOid: worktree.head ?? null,
+      linkedGitLabMR,
+      linkedBitbucketPR,
+      linkedAzureDevOpsPR,
+      linkedGiteaPR,
+      staleWhileRevalidate: true
+    })
+  }, [
+    hoverDetailsOpen,
+    newCardStyle,
+    shouldRefreshHostedReview,
+    repo,
+    isFolder,
+    worktree.isBare,
+    worktree.linkedPR,
+    worktree.head,
+    cachedBranchFallbackGitHubPRNumber,
+    linkedGitLabMR,
+    linkedBitbucketPR,
+    linkedAzureDevOpsPR,
+    linkedGiteaPR,
+    fetchHostedReviewForBranch,
+    branch,
+    hostedReviewCacheKey
+  ])
+
+  // Why: same as above for issues — hidden-surface polling only burns GitHub calls for invisible data.
+  useEffect(() => {
+    // Why: per-card decoration lookups from the browser flood the RPC path at paired-web startup; the host is authoritative.
+    if (
+      isWebClient() ||
+      !repo ||
+      isFolder ||
+      !worktree.linkedIssue ||
+      !issueCacheKey ||
+      !showIssue
+    ) {
+      return
+    }
+
+    const issueNumber = worktree.linkedIssue
+
+    // Why: fallback poll behind activity triggers; stopped while hidden to avoid waking idle workspaces.
+    return installWindowVisibilityInterval({
+      run: () => void fetchIssue(repo.path, issueNumber, { repoId: repo.id }),
+      intervalMs: 5 * 60_000
+    })
+  }, [repo, isFolder, worktree.linkedIssue, fetchIssue, issueCacheKey, showIssue])
+
+  useEffect(() => {
+    if (
+      !newCardStyle ||
+      !hoverDetailsOpen ||
+      showIssue ||
+      isWebClient() ||
+      !repo ||
+      isFolder ||
+      !worktree.linkedIssue ||
+      !issueCacheKey
+    ) {
+      return
+    }
+    void fetchIssue(repo.path, worktree.linkedIssue, { repoId: repo.id })
+  }, [
+    newCardStyle,
+    hoverDetailsOpen,
+    showIssue,
+    repo,
+    isFolder,
+    worktree.linkedIssue,
+    fetchIssue,
+    issueCacheKey
+  ])
+
+  useEffect(() => {
+    if (!worktree.linkedLinearIssue || !showLinearIssue) {
+      return
+    }
+    const linearIssueId = worktree.linkedLinearIssue
+    const refreshLinearIssueIfVisible = (): void => {
+      if (!isWindowVisible()) {
+        return
+      }
+      void fetchLinearIssue(linearIssueId, 'all')
+    }
+    refreshLinearIssueIfVisible()
+    window.addEventListener('focus', refreshLinearIssueIfVisible)
+    document.addEventListener('visibilitychange', refreshLinearIssueIfVisible)
+    return () => {
+      window.removeEventListener('focus', refreshLinearIssueIfVisible)
+      document.removeEventListener('visibilitychange', refreshLinearIssueIfVisible)
+    }
+  }, [worktree.linkedLinearIssue, fetchLinearIssue, showLinearIssue])
+
+  useEffect(() => {
+    if (!newCardStyle || !hoverDetailsOpen || showLinearIssue || !worktree.linkedLinearIssue) {
+      return
+    }
+    void fetchLinearIssue(worktree.linkedLinearIssue, 'all')
+  }, [
+    newCardStyle,
+    hoverDetailsOpen,
+    showLinearIssue,
+    worktree.linkedLinearIssue,
+    fetchLinearIssue
+  ])
+}
diff --git a/src/renderer/src/components/sidebar/use-worktree-card-linked-details.ts b/src/renderer/src/components/sidebar/use-worktree-card-linked-details.ts
new file mode 100644
index 00000000000..fcf91b71a93
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-card-linked-details.ts
@@ -0,0 +1,137 @@
+import React from 'react'
+
+import { translate } from '@/i18n/i18n'
+import { useAppStore } from '@/store'
+import type { IssueInfo, LinearIssue } from '../../../../shared/types'
+import { getWorktreeCardJiraIssueDisplay } from './worktree-card-jira-issue-display'
+import type { WorktreeCardIssueDisplay } from './WorktreeCardMeta'
+import {
+  coerceWorktreeCardVisibleTitle,
+  getWorktreeCardTitleDisplay
+} from './worktree-card-title-display'
+import { useWorkspaceDeleteModifierPressed } from './workspace-delete-quick-action'
+import type { WorktreeCardProps } from './worktree-card-model'
+import type { useWorktreeCardFoundation } from './use-worktree-card-foundation'
+import type { useWorktreeCardReviewDetails } from './use-worktree-card-review-details'
+
+type Foundation = ReturnType<typeof useWorktreeCardFoundation>
+type ReviewDetails = ReturnType<typeof useWorktreeCardReviewDetails>
+
+export function useWorktreeCardLinkedDetails({
+  worktree,
+  newCardStyle,
+  deleteState,
+  branch,
+  issueEntry,
+  linearIssueEntry,
+  linearIssueFallbackEntry,
+  prDisplay
+}: Pick<WorktreeCardProps, 'worktree'> &
+  Pick<Foundation, 'newCardStyle' | 'deleteState'> &
+  Pick<
+    ReviewDetails,
+    'branch' | 'issueEntry' | 'linearIssueEntry' | 'linearIssueFallbackEntry' | 'prDisplay'
+  >) {
+  const issue: IssueInfo | null | undefined = worktree.linkedIssue
+    ? issueEntry !== undefined
+      ? issueEntry.data
+      : undefined
+    : null
+  const issueDisplay: WorktreeCardIssueDisplay | null =
+    issue ??
+    (worktree.linkedIssue
+      ? {
+          number: worktree.linkedIssue,
+          // Why: linked metadata persists immediately but GitHub details arrive async; show the link number so it doesn't look unlinked.
+          title: issue === null ? 'Issue details unavailable' : 'Loading issue...'
+        }
+      : null)
+  const linearStatus = useAppStore((s) => s.linearStatus)
+  const linearIssue: LinearIssue | null | undefined = worktree.linkedLinearIssue
+    ? (linearIssueEntry?.data ?? linearIssueFallbackEntry?.data)
+    : null
+
+  // Why: build a fallback Linear URL from org key + identifier while full issue data is still loading, so the link stays navigable.
+  const linearOrgUrlKey = linearStatus?.viewer?.organizationUrlKey
+  const linearWorkspaceUrlKeys = linearStatus?.workspaces?.map((ws) => ({
+    id: ws.id,
+    organizationUrlKey: ws.organizationUrlKey
+  }))
+  const linearIssueUrlFallback = React.useMemo(() => {
+    if (!worktree.linkedLinearIssue || linearIssue?.url) {
+      return undefined
+    }
+
+    // Try to get the orgUrlKey from the issue's workspace if we have workspaceId
+    let orgUrlKey: string | undefined
+    if (linearIssue?.workspaceId && linearWorkspaceUrlKeys) {
+      const issueWorkspace = linearWorkspaceUrlKeys.find((ws) => ws.id === linearIssue.workspaceId)
+      orgUrlKey = issueWorkspace?.organizationUrlKey
+    }
+
+    // Fall back to current viewer's org if no workspace match
+    if (!orgUrlKey) {
+      orgUrlKey = linearOrgUrlKey
+    }
+
+    if (!orgUrlKey) {
+      return undefined
+    }
+
+    return `https://linear.app/${encodeURIComponent(orgUrlKey)}/issue/${encodeURIComponent(worktree.linkedLinearIssue)}`
+  }, [
+    worktree.linkedLinearIssue,
+    linearIssue?.url,
+    linearIssue?.workspaceId,
+    linearOrgUrlKey,
+    linearWorkspaceUrlKeys
+  ])
+
+  const linearIssueDisplay = worktree.linkedLinearIssue
+    ? linearIssue
+      ? {
+          identifier: linearIssue.identifier,
+          title: linearIssue.title,
+          url: linearIssue.url,
+          stateName: linearIssue.state?.name,
+          labels: linearIssue.labels
+        }
+      : {
+          identifier: worktree.linkedLinearIssue,
+          title:
+            linearIssueEntry || linearIssueFallbackEntry
+              ? 'Linear issue details unavailable'
+              : 'Loading Linear issue...',
+          url: linearIssueUrlFallback
+        }
+    : null
+  const jiraIssueDisplay = getWorktreeCardJiraIssueDisplay(worktree)
+  const cardTitleDisplay = getWorktreeCardTitleDisplay({
+    storedDisplayName: worktree.displayName,
+    branchName: branch,
+    linearIssueTitle: linearIssueDisplay?.title,
+    jiraIssueTitle: jiraIssueDisplay?.title,
+    issueTitle: issueDisplay?.title,
+    reviewTitle: prDisplay?.title
+  })
+  const legacyCardTitleDisplay = coerceWorktreeCardVisibleTitle(worktree.displayName)
+  const visibleCardTitle = newCardStyle ? cardTitleDisplay : legacyCardTitleDisplay
+  const isDeleting = deleteState?.isDeleting ?? false
+  const isQueuedForDeletion = deleteState?.phase === 'queued'
+  const deleteLabel = isQueuedForDeletion
+    ? translate('auto.components.sidebar.WorktreeCard.ef18787206', 'Queued for deletion')
+    : translate('auto.components.sidebar.WorktreeCard.691ccfd622', 'Deleting…')
+  const deleteModifierPressed = useWorkspaceDeleteModifierPressed()
+
+  return {
+    issueDisplay,
+    linearIssue,
+    linearIssueDisplay,
+    jiraIssueDisplay,
+    visibleCardTitle,
+    isDeleting,
+    isQueuedForDeletion,
+    deleteLabel,
+    deleteModifierPressed
+  }
+}
diff --git a/src/renderer/src/components/sidebar/use-worktree-card-review-details.ts b/src/renderer/src/components/sidebar/use-worktree-card-review-details.ts
new file mode 100644
index 00000000000..23129542be2
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-card-review-details.ts
@@ -0,0 +1,198 @@
+import { getWorktreeGitIdentityDisplay } from '@/lib/worktree-git-identity-display'
+import { useAppStore } from '@/store'
+import { getGitHubPRCacheKey } from '@/store/slices/github-cache-key'
+import { issueCacheKey as getIssueCacheKey } from '@/store/slices/github'
+import { getHostedReviewCacheKey } from '@/store/slices/hosted-review'
+import { hostedReviewInfoFromGitHubPRInfo } from '../../../../shared/hosted-review-github'
+import type { HostedReviewInfo } from '../../../../shared/hosted-review'
+import { isFolderRepo } from '../../../../shared/repo-kind'
+import { parseWorkspaceKey } from '../../../../shared/workspace-scope'
+import {
+  getWorktreeCardPrDisplay,
+  isCachedMergedBranchPRCurrentForWorktree
+} from './worktree-card-pr-display'
+import type { WorktreeCardProps } from './worktree-card-model'
+import type { useWorktreeCardFoundation } from './use-worktree-card-foundation'
+
+type Foundation = ReturnType<typeof useWorktreeCardFoundation>
+
+export function useWorktreeCardReviewDetails({
+  worktree,
+  repo,
+  settings,
+  projectGroups,
+  cardProps,
+  newCardStyle
+}: Pick<WorktreeCardProps, 'worktree' | 'repo'> &
+  Pick<Foundation, 'settings' | 'projectGroups' | 'cardProps' | 'newCardStyle'>) {
+  const gitIdentityDisplay = getWorktreeGitIdentityDisplay(worktree)
+  const detachedHeadDisplay = gitIdentityDisplay?.kind === 'detached' ? gitIdentityDisplay : null
+  const branch = gitIdentityDisplay?.kind === 'branch' ? gitIdentityDisplay.branchName : ''
+  const workspaceScope = parseWorkspaceKey(worktree.id)
+  const folderWorkspaceId =
+    workspaceScope?.type === 'folder' ? workspaceScope.folderWorkspaceId : null
+  const isFolder = repo ? isFolderRepo(repo) : folderWorkspaceId !== null
+  // Why: project groups gate folder workspaces, so folder paths stay hidden from identity surfaces until that capability exists.
+  const hasProjectGroups = projectGroups.length > 0
+  const branchIdentityDisplay = !isFolder && branch.length > 0 ? branch : undefined
+  const folderPathIdentityDisplay =
+    isFolder && hasProjectGroups && worktree.path.trim().length > 0 ? worktree.path : undefined
+  const identityDisplay = branchIdentityDisplay ?? folderPathIdentityDisplay
+  const hasPathIdentityEnabled = cardProps.includes('branch')
+  const showIdentityInNewCard = newCardStyle && hasPathIdentityEnabled && Boolean(identityDisplay)
+  const folderMetaRowContent = newCardStyle
+    ? hasPathIdentityEnabled && Boolean(folderPathIdentityDisplay)
+    : isFolder
+  const hostedReviewCacheKey =
+    repo && branch
+      ? getHostedReviewCacheKey(
+          repo.path,
+          branch,
+          settings,
+          repo.id,
+          repo.connectionId,
+          repo.executionHostId,
+          true
+        )
+      : ''
+  const prCacheKey =
+    repo && branch
+      ? getGitHubPRCacheKey(
+          repo.path,
+          repo.id,
+          branch,
+          settings,
+          repo.connectionId,
+          repo.executionHostId,
+          true
+        )
+      : ''
+  const issueCacheKey =
+    repo && worktree.linkedIssue
+      ? getIssueCacheKey(
+          repo.path,
+          repo.id,
+          worktree.linkedIssue,
+          settings,
+          repo.connectionId,
+          repo.executionHostId,
+          true
+        )
+      : ''
+  // Why: use 'all' — the issue may belong to a different Linear workspace than the selected one.
+  const linearIssueCacheKey = worktree.linkedLinearIssue ? `all::${worktree.linkedLinearIssue}` : ''
+
+  // Subscribe to ONLY the specific cache entry, not entire review/issue caches.
+  const hostedReviewEntry = useAppStore((s) =>
+    hostedReviewCacheKey ? s.hostedReviewCache[hostedReviewCacheKey] : undefined
+  )
+  const prCacheEntry = useAppStore((s) => (prCacheKey ? s.prCache?.[prCacheKey] : undefined))
+  const issueEntry = useAppStore((s) => (issueCacheKey ? s.issueCache[issueCacheKey] : undefined))
+  const linearIssueEntry = useAppStore((s) =>
+    linearIssueCacheKey ? s.linearIssueCache[linearIssueCacheKey] : undefined
+  )
+  const linearIssueFallbackEntry = useAppStore((s) =>
+    worktree.linkedLinearIssue ? s.linearIssueCache[worktree.linkedLinearIssue] : undefined
+  )
+
+  const hostedReview: HostedReviewInfo | null | undefined =
+    hostedReviewEntry !== undefined ? hostedReviewEntry.data : undefined
+  const linkedGitHubPR = worktree.linkedPR ?? null
+  const linkedGitLabMR = worktree.linkedGitLabMR ?? null
+  const linkedBitbucketPR = worktree.linkedBitbucketPR ?? null
+  const linkedAzureDevOpsPR = worktree.linkedAzureDevOpsPR ?? null
+  const linkedGiteaPR = worktree.linkedGiteaPR ?? null
+  const hasNonGitHubLinkedReview =
+    linkedGitLabMR !== null ||
+    linkedBitbucketPR !== null ||
+    linkedAzureDevOpsPR !== null ||
+    linkedGiteaPR !== null
+  const hasLinkedReview =
+    linkedGitHubPR !== null ||
+    linkedGitLabMR !== null ||
+    linkedBitbucketPR !== null ||
+    linkedAzureDevOpsPR !== null ||
+    linkedGiteaPR !== null
+  // Why: a newer hosted-review miss trusts the merged-PR cache only when the stored head proves it still describes the current commit.
+  const cachedBranchPR = prCacheEntry?.data
+  const cachedBranchPRFetchedAt = prCacheEntry?.fetchedAt
+  const cachedMergedBranchPRMatchesCurrentHead = isCachedMergedBranchPRCurrentForWorktree(
+    cachedBranchPR,
+    worktree
+  )
+  const cachedBranchFallbackGitHubPRNumber =
+    linkedGitHubPR === null &&
+    !hasNonGitHubLinkedReview &&
+    cachedBranchPR?.number !== undefined &&
+    (cachedBranchPR.state !== 'merged' || cachedMergedBranchPRMatchesCurrentHead)
+      ? cachedBranchPR.number
+      : null
+  const cachedBranchPRCanDriveDisplay =
+    cachedBranchPR?.state !== 'merged' || cachedMergedBranchPRMatchesCurrentHead
+  const hostedReviewMatchesHeadMatchedCachedMergedPR =
+    cachedMergedBranchPRMatchesCurrentHead &&
+    cachedBranchPR !== null &&
+    cachedBranchPR !== undefined &&
+    hostedReview?.provider === 'github' &&
+    hostedReview.number === cachedBranchPR.number
+  const useCachedBranchReview =
+    cachedBranchPR !== undefined &&
+    cachedBranchPR !== null &&
+    !hasNonGitHubLinkedReview &&
+    cachedBranchPRCanDriveDisplay &&
+    (hostedReview === undefined ||
+      (cachedMergedBranchPRMatchesCurrentHead && !hostedReviewMatchesHeadMatchedCachedMergedPR) ||
+      (hostedReview === null &&
+        ((cachedBranchPRFetchedAt !== undefined &&
+          cachedBranchPRFetchedAt > (hostedReviewEntry?.fetchedAt ?? 0)) ||
+          cachedMergedBranchPRMatchesCurrentHead)))
+  const cachedBranchReview = useCachedBranchReview
+    ? hostedReviewInfoFromGitHubPRInfo(cachedBranchPR)
+    : hostedReview
+  // Why: branch provenance does not supersede the head-ownership gate for merged PRs.
+  const branchLookupGitHubPRNumber =
+    hostedReview?.provider === 'github' &&
+    hostedReview.state === 'merged' &&
+    !isCachedMergedBranchPRCurrentForWorktree(hostedReview, worktree)
+      ? null
+      : hostedReviewEntry?.branchLookupGitHubPRNumber
+  const prDisplay = getWorktreeCardPrDisplay(
+    cachedBranchReview,
+    linkedGitHubPR,
+    linkedGitLabMR,
+    linkedBitbucketPR,
+    linkedAzureDevOpsPR,
+    linkedGiteaPR,
+    {
+      reviewHintKey:
+        (useCachedBranchReview || cachedMergedBranchPRMatchesCurrentHead) && !hasLinkedReview
+          ? ''
+          : hostedReviewEntry?.linkedReviewHintKey,
+      branchLookupGitHubPRNumber
+    }
+  )
+
+  return {
+    detachedHeadDisplay,
+    branch,
+    folderWorkspaceId,
+    isFolder,
+    branchIdentityDisplay,
+    folderPathIdentityDisplay,
+    identityDisplay,
+    showIdentityInNewCard,
+    folderMetaRowContent,
+    hostedReviewCacheKey,
+    issueCacheKey,
+    issueEntry,
+    linearIssueEntry,
+    linearIssueFallbackEntry,
+    linkedGitHubPR,
+    linkedGitLabMR,
+    linkedBitbucketPR,
+    linkedAzureDevOpsPR,
+    linkedGiteaPR,
+    cachedBranchFallbackGitHubPRNumber,
+    prDisplay
+  }
+}
diff --git a/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.store-subscriptions.test.tsx b/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.store-subscriptions.test.tsx
new file mode 100644
index 00000000000..693dba8f412
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.store-subscriptions.test.tsx
@@ -0,0 +1,168 @@
+// @vitest-environment happy-dom
+
+import { act, type ReactNode } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, describe, expect, it } from 'vitest'
+import { useAppStore } from '@/store'
+import { readStoreListenerCount } from '@/store/store-listener-census'
+import type { GlobalSettings, Worktree } from '../../../../shared/types'
+import { usePromptCacheCountdownStartedAt } from './CacheTimer'
+import { useWorktreeCardSecondaryDetails } from './use-worktree-card-secondary-details'
+import { useWorktreeAgentRows } from './useWorktreeAgentRows'
+
+const WORKTREE_ID = 'repo-1::/repo/worktrees/card'
+const originalState = useAppStore.getState()
+
+let root: Root | null = null
+let container: HTMLDivElement | null = null
+
+function mount(node: ReactNode): void {
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+  act(() => root?.render(node))
+}
+
+function unmount(): void {
+  if (root) {
+    act(() => root?.unmount())
+  }
+  root = null
+  container?.remove()
+  container = null
+}
+
+function listenerCount(): number {
+  const count = readStoreListenerCount()
+  if (count === null) {
+    throw new Error('store listener census unavailable')
+  }
+  return count
+}
+
+function makeWorktree(): Worktree {
+  return {
+    id: WORKTREE_ID,
+    repoId: 'repo-1',
+    path: '/repo/worktrees/card',
+    displayName: 'Card',
+    branch: 'feature/card',
+    head: 'abc123',
+    isBare: false,
+    isMainWorktree: false,
+    comment: '',
+    linkedIssue: null,
+    linkedPR: null,
+    linkedLinearIssue: null,
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 1
+  }
+}
+
+function makeSettings(promptCacheTtlMs: number): GlobalSettings {
+  return { promptCacheTimerEnabled: true, promptCacheTtlMs } as GlobalSettings
+}
+
+function secondaryDetailsArgs(settings: GlobalSettings) {
+  return {
+    worktree: makeWorktree(),
+    repo: undefined,
+    statusPrDisplay: null,
+    showStatus: false,
+    showIssue: false,
+    showLinearIssue: false,
+    showJiraIssue: false,
+    showPR: false,
+    showAutomation: false,
+    showCli: false,
+    showComment: false,
+    showPorts: false,
+    issueDisplay: null,
+    linearIssue: null,
+    linearIssueDisplay: null,
+    jiraIssueDisplay: null,
+    prDisplay: null,
+    linkedGitLabMR: null,
+    linkedBitbucketPR: null,
+    linkedAzureDevOpsPR: null,
+    linkedGiteaPR: null,
+    cardProps: [] as never,
+    newCardStyle: false,
+    compactCards: false,
+    agentActivityDisplayMode: 'compact' as const,
+    workspacePorts: [],
+    openTaskPage: (() => {}) as never,
+    updateWorktreeMeta: (() => {}) as never,
+    settings
+  }
+}
+
+afterEach(() => {
+  unmount()
+  useAppStore.setState(originalState, true)
+})
+
+describe('useWorktreeCardSecondaryDetails store subscriptions', () => {
+  it('adds no store listener of its own beyond the hooks it composes', () => {
+    const settings = makeSettings(300_000)
+
+    // Baseline: the two hooks it composes, mounted on their own.
+    const composedBaseline = listenerCount()
+    function ComposedProbe(): null {
+      useWorktreeAgentRows(WORKTREE_ID, false)
+      usePromptCacheCountdownStartedAt(WORKTREE_ID, true)
+      return null
+    }
+    mount(<ComposedProbe />)
+    const composedListeners = listenerCount() - composedBaseline
+    unmount()
+
+    const baseline = listenerCount()
+    function Probe(): null {
+      useWorktreeCardSecondaryDetails(secondaryDetailsArgs(settings))
+      return null
+    }
+    mount(<Probe />)
+
+    // Why: promptCacheTtlMs comes from the settings the card already subscribes to,
+    // so this hook must not open a third subscription for the same field.
+    expect(listenerCount() - baseline).toBe(composedListeners)
+
+    unmount()
+    expect(listenerCount()).toBe(baseline)
+  })
+
+  it('reads the cache TTL from the passed settings', () => {
+    let cacheTtlMs = -1
+    function Probe({ ttl }: { ttl: number }): null {
+      cacheTtlMs = useWorktreeCardSecondaryDetails(
+        secondaryDetailsArgs(makeSettings(ttl))
+      ).cacheTtlMs
+      return null
+    }
+
+    mount(<Probe ttl={300_000} />)
+    expect(cacheTtlMs).toBe(300_000)
+
+    act(() => root?.render(<Probe ttl={120_000} />))
+    expect(cacheTtlMs).toBe(120_000)
+  })
+
+  it('reports no TTL while the aggregate cache timer is suppressed', () => {
+    let cacheTtlMs = -1
+    function Probe(): null {
+      // compactCards suppresses the aggregate timer row.
+      cacheTtlMs = useWorktreeCardSecondaryDetails({
+        ...secondaryDetailsArgs(makeSettings(300_000)),
+        compactCards: true
+      }).cacheTtlMs
+      return null
+    }
+
+    mount(<Probe />)
+    expect(cacheTtlMs).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.ts b/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.ts
new file mode 100644
index 00000000000..ebc7cf483c8
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-card-secondary-details.ts
@@ -0,0 +1,225 @@
+import React, { useCallback } from 'react'
+
+import type { GitHubWorkItem } from '../../../../shared/types'
+import { hasWorktreeCardDetails } from './WorktreeCardMeta'
+import { usePromptCacheCountdownStartedAt } from './CacheTimer'
+import { useWorktreeAgentRows } from './useWorktreeAgentRows'
+import type { WorktreeCardProps } from './worktree-card-model'
+import type { useWorktreeCardFoundation } from './use-worktree-card-foundation'
+import type { useWorktreeCardLinkedDetails } from './use-worktree-card-linked-details'
+import type { useWorktreeCardReviewDetails } from './use-worktree-card-review-details'
+
+type Foundation = ReturnType<typeof useWorktreeCardFoundation>
+type LinkedDetails = ReturnType<typeof useWorktreeCardLinkedDetails>
+type ReviewDetails = ReturnType<typeof useWorktreeCardReviewDetails>
+
+export function useWorktreeCardSecondaryDetails({
+  worktree,
+  repo,
+  statusPrDisplay,
+  showStatus,
+  showIssue,
+  showLinearIssue,
+  showJiraIssue,
+  showPR,
+  showAutomation,
+  showCli,
+  showComment,
+  showPorts,
+  issueDisplay,
+  linearIssue,
+  linearIssueDisplay,
+  jiraIssueDisplay,
+  prDisplay,
+  linkedGitLabMR,
+  linkedBitbucketPR,
+  linkedAzureDevOpsPR,
+  linkedGiteaPR,
+  cardProps,
+  newCardStyle,
+  compactCards,
+  agentActivityDisplayMode,
+  workspacePorts,
+  openTaskPage,
+  updateWorktreeMeta,
+  settings
+}: Pick<WorktreeCardProps, 'worktree' | 'repo' | 'statusPrDisplay'> &
+  Pick<
+    Foundation,
+    | 'cardProps'
+    | 'newCardStyle'
+    | 'compactCards'
+    | 'agentActivityDisplayMode'
+    | 'workspacePorts'
+    | 'openTaskPage'
+    | 'updateWorktreeMeta'
+    | 'settings'
+  > &
+  Pick<LinkedDetails, 'issueDisplay' | 'linearIssue' | 'linearIssueDisplay' | 'jiraIssueDisplay'> &
+  Pick<
+    ReviewDetails,
+    'prDisplay' | 'linkedGitLabMR' | 'linkedBitbucketPR' | 'linkedAzureDevOpsPR' | 'linkedGiteaPR'
+  > & {
+    showStatus: boolean
+    showIssue: boolean
+    showLinearIssue: boolean
+    showJiraIssue: boolean
+    showPR: boolean
+    showAutomation: boolean
+    showCli: boolean
+    showComment: boolean
+    showPorts: boolean
+  }) {
+  // Why: unread lives in the left status lane, so the Status toggle owns both the dot/PR slot and unread emphasis.
+  const showUnreadEmphasis = showStatus && worktree.isUnread
+  const hoverIssue = issueDisplay
+  const hoverLinearIssue = linearIssueDisplay
+  const hoverJiraIssue = jiraIssueDisplay
+  const hoverReview = prDisplay
+  const statusLaneReview = statusPrDisplay ?? hoverReview
+  const hoverComment = worktree.comment
+  const metaIssue = showIssue ? hoverIssue : null
+  const metaLinearIssue = showLinearIssue ? hoverLinearIssue : null
+  const metaJiraIssue = showJiraIssue ? hoverJiraIssue : null
+  const metaReview = showPR ? hoverReview : null
+  const metaAutomationProvenance = showAutomation ? worktree.automationProvenance : null
+  const metaCliProvenance = showCli ? worktree.cliProvenance : null
+  const metaComment = showComment ? hoverComment : null
+  const showInlineAgentList = cardProps.includes('inline-agents') && (newCardStyle || !compactCards)
+  const compactInlineAgentRows = useWorktreeAgentRows(
+    worktree.id,
+    showInlineAgentList && agentActivityDisplayMode === 'compact'
+  )
+  const compactInlineAgentRowsVisible =
+    showInlineAgentList &&
+    agentActivityDisplayMode === 'compact' &&
+    compactInlineAgentRows.length > 0
+  const showAggregateCacheTimer = !compactCards && !compactInlineAgentRowsVisible
+  const handleOpenGitHubIssueInOrca = useCallback(
+    (e: React.MouseEvent) => {
+      e.stopPropagation()
+      const issueUrl = hoverIssue && 'url' in hoverIssue ? hoverIssue.url : undefined
+      if (!repo || !hoverIssue || !issueUrl) {
+        return
+      }
+      const item: GitHubWorkItem = {
+        id: issueUrl,
+        type: 'issue',
+        number: hoverIssue.number,
+        title: hoverIssue.title,
+        state: 'state' in hoverIssue ? (hoverIssue.state ?? 'open') : 'open',
+        url: issueUrl,
+        labels: 'labels' in hoverIssue ? (hoverIssue.labels ?? []) : [],
+        updatedAt: new Date().toISOString(),
+        author: null,
+        repoId: repo.id
+      }
+      openTaskPage({ taskSource: 'github', preselectedRepoId: repo.id, openGitHubWorkItem: item })
+    },
+    [hoverIssue, openTaskPage, repo]
+  )
+  const handleOpenReviewInOrca = useCallback(
+    (e: React.MouseEvent) => {
+      e.stopPropagation()
+      if (!repo || !hoverReview?.url || hoverReview.provider !== 'github') {
+        return
+      }
+      const item: GitHubWorkItem = {
+        id: hoverReview.url,
+        type: 'pr',
+        number: hoverReview.number,
+        title: hoverReview.title,
+        state: hoverReview.state ?? 'open',
+        url: hoverReview.url,
+        labels: [],
+        updatedAt: 'updatedAt' in hoverReview ? hoverReview.updatedAt : new Date().toISOString(),
+        author: null,
+        headSha: 'headSha' in hoverReview ? hoverReview.headSha : undefined,
+        repoId: repo.id
+      }
+      openTaskPage({ taskSource: 'github', preselectedRepoId: repo.id, openGitHubWorkItem: item })
+    },
+    [hoverReview, openTaskPage, repo]
+  )
+  const hoverReviewProvider = hoverReview?.provider
+  const hasExplicitLinkedReview =
+    (hoverReviewProvider === 'github' && worktree.linkedPR !== null) ||
+    (hoverReviewProvider === 'gitlab' && linkedGitLabMR !== null) ||
+    (hoverReviewProvider === 'bitbucket' && linkedBitbucketPR !== null) ||
+    (hoverReviewProvider === 'azure-devops' && linkedAzureDevOpsPR !== null) ||
+    (hoverReviewProvider === 'gitea' && linkedGiteaPR !== null)
+  const handleUnlinkReview = useCallback(() => {
+    switch (hoverReviewProvider) {
+      case 'github':
+        void updateWorktreeMeta(worktree.id, { linkedPR: null })
+        return
+      case 'gitlab':
+        void updateWorktreeMeta(worktree.id, { linkedGitLabMR: null })
+        return
+      case 'bitbucket':
+        void updateWorktreeMeta(worktree.id, { linkedBitbucketPR: null })
+        return
+      case 'azure-devops':
+        void updateWorktreeMeta(worktree.id, { linkedAzureDevOpsPR: null })
+        return
+      case 'gitea':
+        void updateWorktreeMeta(worktree.id, { linkedGiteaPR: null })
+        break
+      case 'unsupported':
+      case undefined:
+        break
+    }
+  }, [hoverReviewProvider, updateWorktreeMeta, worktree.id])
+  const handleOpenLinearIssueInOrca = useCallback(
+    (e: React.MouseEvent) => {
+      e.stopPropagation()
+      if (!linearIssue) {
+        return
+      }
+      openTaskPage({ taskSource: 'linear', openLinearIssue: linearIssue })
+    },
+    [linearIssue, openTaskPage]
+  )
+  const hasDetails = hasWorktreeCardDetails({
+    issue: metaIssue,
+    linearIssue: metaLinearIssue,
+    jiraIssue: metaJiraIssue,
+    review: newCardStyle ? null : metaReview,
+    comment: metaComment,
+    automationProvenance: metaAutomationProvenance,
+    cliProvenance: metaCliProvenance
+  })
+  const hasPorts = showPorts && workspacePorts.length > 0
+  const cacheStartedAt = usePromptCacheCountdownStartedAt(worktree.id, showAggregateCacheTimer)
+  // Why: derived from the settings the card already subscribes to — a third store
+  // subscription for this one field costs a listener per card on every store write.
+  const cacheTtlMs = showAggregateCacheTimer ? (settings?.promptCacheTtlMs ?? 0) : 0
+
+  return {
+    showUnreadEmphasis,
+    hoverIssue,
+    hoverLinearIssue,
+    hoverJiraIssue,
+    hoverReview,
+    statusLaneReview,
+    hoverComment,
+    metaIssue,
+    metaLinearIssue,
+    metaJiraIssue,
+    metaReview,
+    metaAutomationProvenance,
+    metaCliProvenance,
+    metaComment,
+    showInlineAgentList,
+    compactInlineAgentRows,
+    handleOpenGitHubIssueInOrca,
+    handleOpenReviewInOrca,
+    hasExplicitLinkedReview,
+    handleUnlinkReview,
+    handleOpenLinearIssueInOrca,
+    hasDetails,
+    hasPorts,
+    cacheStartedAt,
+    cacheTtlMs
+  }
+}
diff --git a/src/renderer/src/components/sidebar/use-worktree-card-workspace-actions.ts b/src/renderer/src/components/sidebar/use-worktree-card-workspace-actions.ts
new file mode 100644
index 00000000000..7ea43da8911
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-card-workspace-actions.ts
@@ -0,0 +1,173 @@
+import React, { useCallback } from 'react'
+
+import { folderWorkspaceKey } from '../../../../shared/workspace-scope'
+import { translate } from '@/i18n/i18n'
+import { useAppStore } from '@/store'
+import { runWorktreeDelete } from './delete-worktree-flow'
+import { isEventTargetInsideCurrentTarget } from './worktree-card-dom-events'
+import type { ResolvedWorktreeCardProps } from './worktree-card-model'
+import { writeWorkspaceDragData } from './workspace-status'
+import type { useWorktreeCardFoundation } from './use-worktree-card-foundation'
+import type { useWorktreeCardLinkedDetails } from './use-worktree-card-linked-details'
+import type { useWorktreeCardReviewDetails } from './use-worktree-card-review-details'
+
+type Foundation = ReturnType<typeof useWorktreeCardFoundation>
+type LinkedDetails = ReturnType<typeof useWorktreeCardLinkedDetails>
+type ReviewDetails = ReturnType<typeof useWorktreeCardReviewDetails>
+
+export function useWorktreeCardWorkspaceActions({
+  worktree,
+  lineageChildCount,
+  lineageCollapsed,
+  onLineageToggle,
+  isMultiSelected,
+  selectedWorktrees,
+  onCardDragStart,
+  onCardDragEnd,
+  onContextMenuSelect,
+  folderWorkspaceId,
+  deleteFolderWorkspace,
+  setActiveWorktree,
+  setShowRenameErrorDialog,
+  isDeleting,
+  showDeleteQuickAction
+}: Pick<
+  ResolvedWorktreeCardProps,
+  | 'worktree'
+  | 'lineageChildCount'
+  | 'lineageCollapsed'
+  | 'onLineageToggle'
+  | 'isMultiSelected'
+  | 'selectedWorktrees'
+  | 'onCardDragStart'
+  | 'onCardDragEnd'
+  | 'onContextMenuSelect'
+> &
+  Pick<Foundation, 'deleteFolderWorkspace' | 'setActiveWorktree' | 'setShowRenameErrorDialog'> &
+  Pick<LinkedDetails, 'isDeleting'> &
+  Pick<ReviewDetails, 'folderWorkspaceId'> & {
+    showDeleteQuickAction: boolean
+  }) {
+  const handleWorkspaceQuickAction = useCallback(
+    (event: React.MouseEvent<HTMLButtonElement>) => {
+      event.preventDefault()
+      event.stopPropagation()
+      if (showDeleteQuickAction) {
+        if (folderWorkspaceId) {
+          void deleteFolderWorkspace(folderWorkspaceId).then((deleted) => {
+            if (
+              deleted &&
+              useAppStore.getState().activeWorktreeId === folderWorkspaceKey(folderWorkspaceId)
+            ) {
+              setActiveWorktree(null)
+            }
+          })
+          return
+        }
+        runWorktreeDelete(worktree.id)
+      }
+    },
+    [
+      deleteFolderWorkspace,
+      folderWorkspaceId,
+      setActiveWorktree,
+      showDeleteQuickAction,
+      worktree.id
+    ]
+  )
+  const handleOpenRenameErrorDialog = useCallback(
+    (event: React.MouseEvent<HTMLButtonElement>) => {
+      event.preventDefault()
+      event.stopPropagation()
+      setShowRenameErrorDialog(true)
+    },
+    [setShowRenameErrorDialog]
+  )
+  const unreadTooltip = worktree.isUnread ? 'Mark read' : 'Mark unread'
+  const lineageChildAriaLabel =
+    lineageChildCount === 1
+      ? lineageCollapsed
+        ? translate(
+            'auto.components.sidebar.WorktreeList.20bebf9c7f',
+            'Show {{value0}} child workspace',
+            { value0: lineageChildCount }
+          )
+        : translate(
+            'auto.components.sidebar.WorktreeList.e97297cb75',
+            'Hide {{value0}} child workspace',
+            { value0: lineageChildCount }
+          )
+      : lineageCollapsed
+        ? translate(
+            'auto.components.sidebar.WorktreeList.c1f4a31623',
+            'Show {{value0}} child workspaces',
+            { value0: lineageChildCount }
+          )
+        : translate(
+            'auto.components.sidebar.WorktreeList.0cd15956d4',
+            'Hide {{value0}} child workspaces',
+            { value0: lineageChildCount }
+          )
+  const childWorkspaceShortLabel = `${lineageChildCount} ${
+    lineageChildCount === 1
+      ? translate('auto.components.sidebar.WorktreeList.0c6ee14f23', 'child')
+      : translate('auto.components.sidebar.WorktreeList.045a8aed48', 'children')
+  }`
+  const showLineageChildChip = lineageChildCount > 0 && onLineageToggle !== undefined
+
+  const handleDragStart = useCallback(
+    (event: React.DragEvent<HTMLDivElement>) => {
+      if (!isEventTargetInsideCurrentTarget(event.currentTarget, event.target)) {
+        event.preventDefault()
+        return
+      }
+      if (isDeleting) {
+        event.preventDefault()
+        return
+      }
+      const dragIds =
+        isMultiSelected && selectedWorktrees && selectedWorktrees.length > 1
+          ? selectedWorktrees.map((item) => item.id)
+          : worktree.id
+      writeWorkspaceDragData(event.dataTransfer, dragIds)
+      onCardDragStart?.(event, worktree.id, Array.isArray(dragIds) ? dragIds : [dragIds])
+    },
+    [isDeleting, isMultiSelected, onCardDragStart, selectedWorktrees, worktree.id]
+  )
+
+  const handleDragEnd = useCallback(
+    (event: React.DragEvent<HTMLDivElement>) => {
+      if (!isEventTargetInsideCurrentTarget(event.currentTarget, event.target)) {
+        return
+      }
+      onCardDragEnd?.(event)
+    },
+    [onCardDragEnd]
+  )
+
+  const handleContextMenuSelect = useCallback(
+    (event: React.MouseEvent<HTMLElement>) => onContextMenuSelect?.(event, worktree) ?? [worktree],
+    [onContextMenuSelect, worktree]
+  )
+
+  const stopQuickActionPointerPropagation = useCallback(
+    (event: React.PointerEvent<HTMLButtonElement>) => {
+      // Why: document-level pointer handling dismisses the Kanban board; quick actions must not count as card activation.
+      event.stopPropagation()
+    },
+    []
+  )
+
+  return {
+    handleWorkspaceQuickAction,
+    handleOpenRenameErrorDialog,
+    unreadTooltip,
+    lineageChildAriaLabel,
+    childWorkspaceShortLabel,
+    showLineageChildChip,
+    handleDragStart,
+    handleDragEnd,
+    handleContextMenuSelect,
+    stopQuickActionPointerPropagation
+  }
+}
diff --git a/src/renderer/src/components/sidebar/use-worktree-list-scroll-to-top.test.ts b/src/renderer/src/components/sidebar/use-worktree-list-scroll-to-top.test.ts
new file mode 100644
index 00000000000..286221602e1
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-list-scroll-to-top.test.ts
@@ -0,0 +1,175 @@
+// @vitest-environment happy-dom
+import { act, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useWorktreeListScrollToTop } from './use-worktree-list-scroll-to-top'
+import { HARD_SCROLL_UP } from './worktree-list-hard-scroll-up'
+
+let clockMs = 0
+
+function advance(ms: number): void {
+  clockMs += ms
+  act(() => {
+    vi.advanceTimersByTime(ms)
+  })
+}
+
+function createViewportElement({
+  scrollTop = 1200,
+  scrollHeight = 5000,
+  clientHeight = 1000
+}: { scrollTop?: number; scrollHeight?: number; clientHeight?: number } = {}): HTMLElement {
+  const element = document.createElement('div')
+  // happy-dom reports zero layout; stub the metrics the detector reads.
+  Object.defineProperty(element, 'scrollHeight', { value: scrollHeight, configurable: true })
+  Object.defineProperty(element, 'clientHeight', { value: clientHeight, configurable: true })
+  Object.defineProperty(element, 'scrollTop', {
+    value: scrollTop,
+    configurable: true,
+    writable: true
+  })
+  element.scrollTo = vi.fn(() => {
+    element.scrollTop = 0
+  }) as unknown as HTMLElement['scrollTo']
+  element.focus = vi.fn()
+  document.body.append(element)
+  return element
+}
+
+/** Enough upward wheel travel to clear `hardTotalDeltaPx` inside the intent window. */
+function dispatchHardWheelUp(element: HTMLElement, samples = 4): void {
+  for (let i = 0; i < samples; i += 1) {
+    clockMs += 16
+    act(() => {
+      element.dispatchEvent(new WheelEvent('wheel', { deltaY: -240 }))
+    })
+  }
+}
+
+describe('useWorktreeListScrollToTop', () => {
+  beforeEach(() => {
+    clockMs = 0
+    vi.useFakeTimers()
+    vi.spyOn(window.performance, 'now').mockImplementation(() => clockMs)
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    vi.restoreAllMocks()
+    document.body.replaceChildren()
+  })
+
+  it('shows on a hard upward wheel gesture and hides on the idle deadline', () => {
+    const element = createViewportElement()
+    const { result } = renderHook(() => useWorktreeListScrollToTop({ scrollElement: element }))
+
+    dispatchHardWheelUp(element)
+    expect(result.current.showScrollToTop).toBe(true)
+
+    advance(HARD_SCROLL_UP.hideAfterIdleMs)
+    expect(result.current.showScrollToTop).toBe(false)
+  })
+
+  it('does not extend the idle deadline on non-intent scroll noise', () => {
+    const element = createViewportElement()
+    const { result } = renderHook(() => useWorktreeListScrollToTop({ scrollElement: element }))
+
+    dispatchHardWheelUp(element)
+    const intentAt = clockMs
+    // Let the hard samples age out so later ticks are judged on their own.
+    advance(HARD_SCROLL_UP.windowMs + 16)
+
+    // Gentle upward ticks keep arriving but never refresh intent.
+    for (let i = 0; i < 6; i += 1) {
+      advance(200)
+      act(() => {
+        element.dispatchEvent(new WheelEvent('wheel', { deltaY: -4 }))
+      })
+    }
+    expect(clockMs - intentAt).toBeLessThan(HARD_SCROLL_UP.hideAfterIdleMs)
+    expect(result.current.showScrollToTop).toBe(true)
+
+    advance(intentAt + HARD_SCROLL_UP.hideAfterIdleMs - clockMs)
+    expect(result.current.showScrollToTop).toBe(false)
+  })
+
+  it('re-arms the idle timer when intent is refreshed', () => {
+    const element = createViewportElement()
+    const { result } = renderHook(() => useWorktreeListScrollToTop({ scrollElement: element }))
+
+    dispatchHardWheelUp(element)
+    advance(HARD_SCROLL_UP.hideAfterIdleMs - 200)
+    expect(result.current.showScrollToTop).toBe(true)
+
+    dispatchHardWheelUp(element)
+    advance(HARD_SCROLL_UP.hideAfterIdleMs - 200)
+    expect(result.current.showScrollToTop).toBe(true)
+
+    advance(200)
+    expect(result.current.showScrollToTop).toBe(false)
+  })
+
+  it('suppresses detection for the post-jump window after scrollToTop', () => {
+    const element = createViewportElement()
+    const onUserScrollIntent = vi.fn()
+    const { result } = renderHook(() =>
+      useWorktreeListScrollToTop({ scrollElement: element, onUserScrollIntent })
+    )
+
+    dispatchHardWheelUp(element)
+    act(() => {
+      result.current.scrollToTop()
+    })
+    const jumpAt = clockMs
+    expect(onUserScrollIntent).toHaveBeenCalledTimes(1)
+    expect(element.scrollTo).toHaveBeenCalledWith({ top: 0, behavior: 'auto' })
+    expect(result.current.showScrollToTop).toBe(false)
+
+    // Momentum events land back at depth while suppression is active.
+    element.scrollTop = 1200
+    dispatchHardWheelUp(element)
+    expect(clockMs).toBeLessThan(jumpAt + HARD_SCROLL_UP.suppressAfterJumpMs)
+    expect(result.current.showScrollToTop).toBe(false)
+
+    advance(HARD_SCROLL_UP.suppressAfterJumpMs)
+    dispatchHardWheelUp(element)
+    expect(result.current.showScrollToTop).toBe(true)
+  })
+
+  it('force-hides when the list stops being scrollable, even mid-gesture', () => {
+    const element = createViewportElement()
+    const { result } = renderHook(() => useWorktreeListScrollToTop({ scrollElement: element }))
+
+    dispatchHardWheelUp(element)
+    expect(result.current.showScrollToTop).toBe(true)
+
+    Object.defineProperty(element, 'scrollHeight', { value: 1100, configurable: true })
+    act(() => {
+      element.dispatchEvent(new WheelEvent('wheel', { deltaY: -240 }))
+    })
+    expect(result.current.showScrollToTop).toBe(false)
+
+    // The pending idle timer was cleared, so nothing flips state later.
+    advance(HARD_SCROLL_UP.hideAfterIdleMs * 2)
+    expect(result.current.showScrollToTop).toBe(false)
+  })
+
+  it('clears the timer and detaches listeners when the scroll element goes away', () => {
+    const element = createViewportElement()
+    const { result, rerender } = renderHook(
+      ({ scrollElement }: { scrollElement: HTMLElement | null }) =>
+        useWorktreeListScrollToTop({ scrollElement }),
+      { initialProps: { scrollElement: element as HTMLElement | null } }
+    )
+
+    dispatchHardWheelUp(element)
+    expect(result.current.showScrollToTop).toBe(true)
+
+    rerender({ scrollElement: null })
+    expect(result.current.showScrollToTop).toBe(false)
+
+    dispatchHardWheelUp(element)
+    advance(HARD_SCROLL_UP.hideAfterIdleMs * 2)
+    expect(result.current.showScrollToTop).toBe(false)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/use-worktree-list-scroll-to-top.test.tsx b/src/renderer/src/components/sidebar/use-worktree-list-scroll-to-top.test.tsx
new file mode 100644
index 00000000000..f35bde00ffc
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-list-scroll-to-top.test.tsx
@@ -0,0 +1,102 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { useWorktreeListScrollToTop } from './use-worktree-list-scroll-to-top'
+
+function createScroller(): HTMLElement {
+  const element = document.createElement('div')
+  element.tabIndex = 0
+  document.body.append(element)
+  Object.defineProperties(element, {
+    scrollHeight: { configurable: true, value: 5000 },
+    clientHeight: { configurable: true, value: 500 },
+    // 16px narrower than offsetWidth so the scrollbar hit-test has a realistic gutter.
+    clientWidth: { configurable: true, value: 284 },
+    offsetWidth: { configurable: true, value: 300 }
+  })
+  element.getBoundingClientRect = () => ({
+    bottom: 500,
+    height: 500,
+    left: 0,
+    right: 300,
+    top: 0,
+    width: 300,
+    x: 0,
+    y: 0,
+    toJSON: () => ({})
+  })
+  return element
+}
+
+afterEach(() => {
+  cleanup()
+  vi.restoreAllMocks()
+  document.body.replaceChildren()
+})
+
+describe('useWorktreeListScrollToTop', () => {
+  it('ignores fast programmatic scrolling', () => {
+    const element = createScroller()
+    let now = 0
+    vi.spyOn(window.performance, 'now').mockImplementation(() => now)
+    const view = renderHook(() => useWorktreeListScrollToTop({ scrollElement: element }))
+
+    for (const sample of [
+      { t: 0, scrollTop: 2200 },
+      { t: 80, scrollTop: 2000 },
+      { t: 170, scrollTop: 1700 }
+    ]) {
+      now = sample.t
+      element.scrollTop = sample.scrollTop
+      act(() => element.dispatchEvent(new Event('scroll')))
+    }
+
+    expect(view.result.current.showScrollToTop).toBe(false)
+  })
+
+  it('detects velocity while the scrollbar is actively dragged', () => {
+    const element = createScroller()
+    let now = 0
+    vi.spyOn(window.performance, 'now').mockImplementation(() => now)
+    const view = renderHook(() => useWorktreeListScrollToTop({ scrollElement: element }))
+
+    act(() =>
+      element.dispatchEvent(new PointerEvent('pointerdown', { clientX: 295, pointerType: 'mouse' }))
+    )
+    for (const sample of [
+      { t: 0, scrollTop: 2200 },
+      { t: 80, scrollTop: 2000 },
+      { t: 170, scrollTop: 1700 }
+    ]) {
+      now = sample.t
+      element.scrollTop = sample.scrollTop
+      act(() => element.dispatchEvent(new Event('scroll')))
+    }
+
+    expect(view.result.current.showScrollToTop).toBe(true)
+  })
+
+  it('returns focus to the list after jumping to the top', () => {
+    const element = createScroller()
+    element.scrollTop = 1200
+    element.scrollTo = vi.fn(({ top }) => {
+      element.scrollTop = Number(top)
+    })
+    const view = renderHook(() => useWorktreeListScrollToTop({ scrollElement: element }))
+
+    act(() => {
+      for (let index = 0; index < 4; index += 1) {
+        element.dispatchEvent(new WheelEvent('wheel', { deltaY: -200 }))
+      }
+    })
+    const button = document.createElement('button')
+    document.body.append(button)
+    button.focus()
+
+    act(() => view.result.current.scrollToTop())
+
+    expect(element.scrollTop).toBe(0)
+    expect(document.activeElement).toBe(element)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/use-worktree-list-scroll-to-top.ts b/src/renderer/src/components/sidebar/use-worktree-list-scroll-to-top.ts
new file mode 100644
index 00000000000..3199c69543a
--- /dev/null
+++ b/src/renderer/src/components/sidebar/use-worktree-list-scroll-to-top.ts
@@ -0,0 +1,230 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+import {
+  createHardScrollUpDetectorState,
+  HARD_SCROLL_UP,
+  reduceHardScrollUpOnDismiss,
+  reduceHardScrollUpOnIdle,
+  reduceHardScrollUpOnScroll,
+  reduceHardScrollUpOnWheel,
+  type HardScrollUpDetectorState
+} from './worktree-list-hard-scroll-up'
+
+function readViewport(element: HTMLElement): { scrollTop: number; maxScroll: number } {
+  const maxScroll = Math.max(0, element.scrollHeight - element.clientHeight)
+  return {
+    scrollTop: element.scrollTop,
+    maxScroll
+  }
+}
+
+function shouldForceHide(viewport: { scrollTop: number; maxScroll: number }): boolean {
+  return (
+    viewport.scrollTop <= HARD_SCROLL_UP.nearTopPx ||
+    viewport.maxScroll < HARD_SCROLL_UP.minScrollablePx
+  )
+}
+
+/**
+ * Offers a jump-to-top affordance when the user is hard-scrolling up a long
+ * worktree list (common with smart/agent-activity ranking).
+ *
+ * Visibility is deadline-based from `lastIntentAt` so scroll noise cannot keep
+ * the button stuck forever.
+ */
+export function useWorktreeListScrollToTop({
+  scrollElement,
+  onUserScrollIntent
+}: {
+  scrollElement: HTMLElement | null
+  /** Called when the user clicks jump-to-top so virtualizer scroll guards engage. */
+  onUserScrollIntent?: () => void
+}): {
+  showScrollToTop: boolean
+  scrollToTop: () => void
+} {
+  const detectorRef = useRef<HardScrollUpDetectorState>(createHardScrollUpDetectorState())
+  const [showScrollToTop, setShowScrollToTop] = useState(false)
+  const showScrollToTopRef = useRef(false)
+  const idleTimerRef = useRef<number | null>(null)
+  const scrollbarDragRef = useRef(false)
+  const touchScrollRef = useRef(false)
+  // Why: jump-to-top can still emit a burst of scroll events; ignore them briefly so the button does not reappear.
+  const suppressDetectionUntilRef = useRef(0)
+
+  const publishVisible = useCallback((next: HardScrollUpDetectorState) => {
+    detectorRef.current = next
+    if (showScrollToTopRef.current !== next.visible) {
+      showScrollToTopRef.current = next.visible
+      setShowScrollToTop(next.visible)
+    }
+  }, [])
+
+  const clearIdleTimer = useCallback(() => {
+    if (idleTimerRef.current !== null) {
+      window.clearTimeout(idleTimerRef.current)
+      idleTimerRef.current = null
+    }
+  }, [])
+
+  // Arm once per intent timestamp; do not reset on every scroll tick (that stuck the button).
+  const armIdleHide = useCallback(
+    (element: HTMLElement, lastIntentAt: number) => {
+      clearIdleTimer()
+      const fireAt = lastIntentAt + HARD_SCROLL_UP.hideAfterIdleMs
+      const delayMs = Math.max(0, fireAt - window.performance.now())
+
+      idleTimerRef.current = window.setTimeout(() => {
+        idleTimerRef.current = null
+        const now = window.performance.now()
+
+        // Jump-to-top already dismissed; if a stale timer lands in the suppress window, force-hide.
+        if (now < suppressDetectionUntilRef.current) {
+          publishVisible(createHardScrollUpDetectorState())
+          return
+        }
+
+        const viewport = readViewport(element)
+        const next = reduceHardScrollUpOnIdle(detectorRef.current, {
+          ...viewport,
+          t: now
+        })
+        // Belt-and-suspenders: if still visible past the deadline, force dismiss.
+        if (next.visible && now - next.lastIntentAt >= HARD_SCROLL_UP.hideAfterIdleMs) {
+          publishVisible(createHardScrollUpDetectorState())
+          return
+        }
+        publishVisible(next)
+      }, delayMs)
+    },
+    [clearIdleTimer, publishVisible]
+  )
+
+  const applyDetectorResult = useCallback(
+    (
+      element: HTMLElement,
+      previous: HardScrollUpDetectorState,
+      next: HardScrollUpDetectorState
+    ) => {
+      publishVisible(next)
+      if (!next.visible) {
+        clearIdleTimer()
+        return
+      }
+      // Only re-arm when intent is refreshed; scroll spam must not extend lifetime.
+      if (next.lastIntentAt !== previous.lastIntentAt) {
+        armIdleHide(element, next.lastIntentAt)
+      }
+    },
+    [armIdleHide, clearIdleTimer, publishVisible]
+  )
+
+  useEffect(() => {
+    if (!scrollElement) {
+      clearIdleTimer()
+      publishVisible(createHardScrollUpDetectorState())
+      return
+    }
+
+    const onWheel = (event: WheelEvent): void => {
+      const now = window.performance.now()
+      const viewport = readViewport(scrollElement)
+
+      // Always allow force-hide even while jump-to-top is suppressing detection.
+      if (shouldForceHide(viewport)) {
+        publishVisible(createHardScrollUpDetectorState())
+        clearIdleTimer()
+        return
+      }
+
+      if (now < suppressDetectionUntilRef.current) {
+        return
+      }
+
+      const previous = detectorRef.current
+      const next = reduceHardScrollUpOnWheel(previous, {
+        ...viewport,
+        t: now,
+        deltaY: event.deltaY,
+        deltaMode: event.deltaMode
+      })
+      applyDetectorResult(scrollElement, previous, next)
+    }
+
+    const onScroll = (): void => {
+      const now = window.performance.now()
+      const viewport = readViewport(scrollElement)
+
+      if (shouldForceHide(viewport)) {
+        publishVisible(createHardScrollUpDetectorState())
+        clearIdleTimer()
+        return
+      }
+
+      if (now < suppressDetectionUntilRef.current) {
+        return
+      }
+
+      // Scroll events do not expose their origin; only velocity-detect gestures we observed directly.
+      if (!scrollbarDragRef.current && !touchScrollRef.current) {
+        return
+      }
+
+      const previous = detectorRef.current
+      const next = reduceHardScrollUpOnScroll(previous, {
+        ...viewport,
+        t: now
+      })
+      applyDetectorResult(scrollElement, previous, next)
+    }
+
+    const onPointerDown = (event: PointerEvent): void => {
+      if (event.pointerType === 'touch') {
+        touchScrollRef.current = true
+        return
+      }
+      const rect = scrollElement.getBoundingClientRect()
+      const nativeScrollbarWidth = scrollElement.offsetWidth - scrollElement.clientWidth
+      const scrollbarHitWidth = Math.max(12, nativeScrollbarWidth)
+      scrollbarDragRef.current =
+        event.target === scrollElement && event.clientX >= rect.right - scrollbarHitWidth
+    }
+
+    const onPointerEnd = (): void => {
+      scrollbarDragRef.current = false
+      touchScrollRef.current = false
+    }
+
+    scrollElement.addEventListener('wheel', onWheel, { passive: true })
+    scrollElement.addEventListener('scroll', onScroll, { passive: true })
+    scrollElement.addEventListener('pointerdown', onPointerDown, { passive: true })
+    window.addEventListener('pointerup', onPointerEnd, { passive: true })
+    window.addEventListener('pointercancel', onPointerEnd, { passive: true })
+    return () => {
+      scrollElement.removeEventListener('wheel', onWheel)
+      scrollElement.removeEventListener('scroll', onScroll)
+      scrollElement.removeEventListener('pointerdown', onPointerDown)
+      window.removeEventListener('pointerup', onPointerEnd)
+      window.removeEventListener('pointercancel', onPointerEnd)
+      onPointerEnd()
+      clearIdleTimer()
+    }
+  }, [applyDetectorResult, clearIdleTimer, publishVisible, scrollElement])
+
+  const scrollToTop = useCallback(() => {
+    if (!scrollElement) {
+      return
+    }
+    onUserScrollIntent?.()
+    publishVisible(reduceHardScrollUpOnDismiss(detectorRef.current))
+    clearIdleTimer()
+    suppressDetectionUntilRef.current =
+      window.performance.now() + HARD_SCROLL_UP.suppressAfterJumpMs
+    scrollElement.scrollTo({ top: 0, behavior: 'auto' })
+    scrollElement.focus({ preventScroll: true })
+  }, [clearIdleTimer, onUserScrollIntent, publishVisible, scrollElement])
+
+  return {
+    showScrollToTop,
+    scrollToTop
+  }
+}
diff --git a/src/renderer/src/components/sidebar/visible-worktree-activity-inputs.test.ts b/src/renderer/src/components/sidebar/visible-worktree-activity-inputs.test.ts
index 6012330e53a..c96aa38d50d 100644
--- a/src/renderer/src/components/sidebar/visible-worktree-activity-inputs.test.ts
+++ b/src/renderer/src/components/sidebar/visible-worktree-activity-inputs.test.ts
@@ -2,8 +2,7 @@ import { describe, expect, it } from 'vitest'
 import type { BrowserWorkspace, TerminalTab } from '../../../../shared/types'
 import {
   getVisibleWorktreeBrowserActivityTabs,
-  getVisibleWorktreeTerminalActivityTabs,
-  getWorktreeSectionTerminalActivityTabs
+  getVisibleWorktreeTerminalActivityTabs
 } from './visible-worktree-activity-inputs'
 
 function terminalTab(id: string, title: string): TerminalTab {
@@ -95,40 +94,6 @@ describe('visible worktree activity inputs', () => {
     expect(second['wt-1']).toBe(first['wt-1'])
   })
 
-  it('preserves section terminal projection when only wake bookkeeping changes', () => {
-    const first = getWorktreeSectionTerminalActivityTabs({
-      'wt-1': [terminalTab('tab-1', 'Codex working')]
-    })
-
-    const second = getWorktreeSectionTerminalActivityTabs({
-      'wt-1': [
-        {
-          ...terminalTab('tab-1', 'Codex working'),
-          generation: 2,
-          pendingActivationSpawn: true
-        }
-      ]
-    })
-
-    // Why: slept-workspace wake updates generation/pendingActivationSpawn to
-    // remount terminal panes; collapsed section dots only need id + title.
-    expect(second).toBe(first)
-    expect(second['wt-1']).toBe(first['wt-1'])
-  })
-
-  it('updates section terminal projection when terminal title changes', () => {
-    const first = getWorktreeSectionTerminalActivityTabs({
-      'wt-1': [terminalTab('tab-1', 'zsh')]
-    })
-
-    const second = getWorktreeSectionTerminalActivityTabs({
-      'wt-1': [terminalTab('tab-1', 'Codex working')]
-    })
-
-    expect(second).not.toBe(first)
-    expect(second['wt-1']).toEqual([{ id: 'tab-1', title: 'Codex working' }])
-  })
-
   it('preserves browser activity projection when only browser metadata changes', () => {
     const first = getVisibleWorktreeBrowserActivityTabs({
       'wt-1': [browserTab('browser-1', 'First')]
diff --git a/src/renderer/src/components/sidebar/visible-worktree-activity-inputs.ts b/src/renderer/src/components/sidebar/visible-worktree-activity-inputs.ts
index ff81a9e201c..d843e8d20c1 100644
--- a/src/renderer/src/components/sidebar/visible-worktree-activity-inputs.ts
+++ b/src/renderer/src/components/sidebar/visible-worktree-activity-inputs.ts
@@ -2,7 +2,6 @@ import type { BrowserWorkspace, TerminalTab } from '../../../../shared/types'
 
 export type TerminalActivityTab = Pick<TerminalTab, 'id'>
 export type BrowserActivityTab = Pick<BrowserWorkspace, 'id'>
-export type WorktreeSectionTerminalActivityTab = Pick<TerminalTab, 'id' | 'title'>
 
 function haveSameProjection<T, U>(
   previous: readonly U[] | undefined,
@@ -75,30 +74,6 @@ export function getVisibleWorktreeTerminalActivityTabs(
   return projection
 }
 
-let cachedSectionTerminalSource: Record<string, TerminalTab[]> | null = null
-let cachedSectionTerminalProjection: Record<string, WorktreeSectionTerminalActivityTab[]> | null =
-  null
-
-export function getWorktreeSectionTerminalActivityTabs(
-  tabsByWorktree: Record<string, TerminalTab[]>
-): Record<string, WorktreeSectionTerminalActivityTab[]> {
-  if (cachedSectionTerminalSource === tabsByWorktree && cachedSectionTerminalProjection) {
-    return cachedSectionTerminalProjection
-  }
-  const { projection, unchanged } = projectTabs(
-    tabsByWorktree,
-    cachedSectionTerminalProjection,
-    (tab) => ({ id: tab.id, title: tab.title }),
-    (previousTab, nextTab) => previousTab.id === nextTab.id && previousTab.title === nextTab.title
-  )
-  cachedSectionTerminalSource = tabsByWorktree
-  if (unchanged && cachedSectionTerminalProjection) {
-    return cachedSectionTerminalProjection
-  }
-  cachedSectionTerminalProjection = projection
-  return projection
-}
-
 let cachedBrowserSource: Record<string, BrowserWorkspace[]> | null = null
 let cachedBrowserProjection: Record<string, BrowserActivityTab[]> | null = null
 
diff --git a/src/renderer/src/components/sidebar/visible-worktrees.test.ts b/src/renderer/src/components/sidebar/visible-worktrees.test.ts
index ee212e44ec9..07e2d32a4b3 100644
--- a/src/renderer/src/components/sidebar/visible-worktrees.test.ts
+++ b/src/renderer/src/components/sidebar/visible-worktrees.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { computeVisibleWorktreeIds } from './visible-worktrees'
+import { getPairedDeviceIdsByEnvironment } from './workspace-creator-visibility'
 import type { Repo, TerminalTab, Worktree, WorktreeLineage } from '../../../../shared/types'
 import { LOCAL_EXECUTION_HOST_ID } from '../../../../shared/execution-host'
 
@@ -79,6 +80,8 @@ function visibleOptions(overrides: Partial<VisibleOptions> = {}): VisibleOptions
     hideAutomationGeneratedWorkspaces: false,
     hideCliCreatedWorkspaces: false,
     hideDetachedHeadWorkspaces: false,
+    hideWorkspacesFromOtherDevices: false,
+    pairedDeviceIdsByEnvironment: new Map(),
     repoMap,
     workspaceHostScope: 'all',
     defaultHostId: LOCAL_EXECUTION_HOST_ID,
@@ -88,6 +91,68 @@ function visibleOptions(overrides: Partial<VisibleOptions> = {}): VisibleOptions
 }
 
 describe('computeVisibleWorktreeIds', () => {
+  it('prefers the authenticated live device id over cached pairing metadata', () => {
+    const deviceIds = getPairedDeviceIdsByEnvironment(
+      [{ id: 'env-1', pairedDeviceId: 'cached-device' } as never],
+      new Map([
+        [
+          'env-1',
+          {
+            status: { pairedDeviceId: 'authenticated-device' } as never
+          }
+        ]
+      ])
+    )
+
+    expect(deviceIds.get('env-1')).toBe('authenticated-device')
+  })
+
+  it('hides only known workspaces created by another device', () => {
+    const own = {
+      ...makeWorktree('own'),
+      runtimeOwnerEnvironmentId: 'env-1',
+      creatorProvenance: { kind: 'paired-device' as const, deviceId: 'device-a' }
+    }
+    const other = {
+      ...makeWorktree('other'),
+      runtimeOwnerEnvironmentId: 'env-1',
+      creatorProvenance: { kind: 'paired-device' as const, deviceId: 'device-b' }
+    }
+    const host = {
+      ...makeWorktree('host'),
+      runtimeOwnerEnvironmentId: 'env-1',
+      creatorProvenance: { kind: 'host' as const }
+    }
+    const legacy = { ...makeWorktree('legacy'), runtimeOwnerEnvironmentId: 'env-1' }
+
+    const result = computeVisibleWorktreeIds(
+      { repo1: [own, other, host, legacy] },
+      [own.id, other.id, host.id, legacy.id],
+      visibleOptions({
+        hideWorkspacesFromOtherDevices: true,
+        pairedDeviceIdsByEnvironment: new Map([['env-1', 'device-a']])
+      })
+    )
+
+    expect(result).toEqual([own.id, legacy.id])
+  })
+
+  it('fails open when an older host does not publish the requester device id', () => {
+    const other = {
+      ...makeWorktree('other'),
+      runtimeOwnerEnvironmentId: 'env-1',
+      creatorProvenance: { kind: 'paired-device' as const, deviceId: 'device-b' }
+    }
+
+    const result = computeVisibleWorktreeIds(
+      { repo1: [other] },
+      [other.id],
+      visibleOptions({ hideWorkspacesFromOtherDevices: true })
+    )
+
+    expect(result).toEqual([other.id])
+  })
+
   it('keeps browser-tab worktrees visible when sleeping workspaces are hidden', () => {
     const wt = makeWorktree('wt-browser')
 
diff --git a/src/renderer/src/components/sidebar/visible-worktrees.ts b/src/renderer/src/components/sidebar/visible-worktrees.ts
index 38ffcd8c6d5..f85083db406 100644
--- a/src/renderer/src/components/sidebar/visible-worktrees.ts
+++ b/src/renderer/src/components/sidebar/visible-worktrees.ts
@@ -21,6 +21,11 @@ import {
 } from './worktree-lineage-projection'
 import { computeRenderedSidebarWorktreeOrder } from './rendered-sidebar-worktree-order'
 import { getWorktreeGitIdentityDisplay } from '@/lib/worktree-git-identity-display'
+import {
+  EMPTY_PAIRED_DEVICE_IDS_BY_ENVIRONMENT,
+  getPairedDeviceIdsByEnvironment,
+  isWorkspaceFromOtherDevice
+} from './workspace-creator-visibility'
 
 /**
  * Whether a worktree represents the repo's default-branch row that the
@@ -94,6 +99,7 @@ export type SidebarFilterState = {
   hideAutomationGeneratedWorkspaces: boolean
   hideCliCreatedWorkspaces: boolean
   hideDetachedHeadWorkspaces: boolean
+  hideWorkspacesFromOtherDevices: boolean
   /** Keeps each project's main workspace out of the "Hide sleeping" sweep; absent means on. */
   alwaysShowDefaultBranchWorkspace?: boolean
   visibleWorkspaceHostIds?: readonly ExecutionHostId[] | null
@@ -117,6 +123,7 @@ export function sidebarHasActiveFilters(state: SidebarFilterState): boolean {
     state.hideAutomationGeneratedWorkspaces ||
     state.hideCliCreatedWorkspaces ||
     state.hideDetachedHeadWorkspaces ||
+    state.hideWorkspacesFromOtherDevices ||
     // Why: turning this off is the only way to narrow the list below the
     // default, so Clear Filters must be able to undo it like any other filter.
     state.alwaysShowDefaultBranchWorkspace === false ||
@@ -134,6 +141,7 @@ export type ClearFilterActions = {
   resetHideAutomationGeneratedWorkspaces: boolean
   resetHideCliCreatedWorkspaces: boolean
   resetHideDetachedHeadWorkspaces: boolean
+  resetHideWorkspacesFromOtherDevices: boolean
   resetAlwaysShowDefaultBranchWorkspace: boolean
   resetVisibleWorkspaceHostIds: boolean
 }
@@ -156,6 +164,7 @@ export function computeClearFilterActions(state: SidebarFilterState): ClearFilte
     resetHideAutomationGeneratedWorkspaces: state.hideAutomationGeneratedWorkspaces,
     resetHideCliCreatedWorkspaces: state.hideCliCreatedWorkspaces,
     resetHideDetachedHeadWorkspaces: state.hideDetachedHeadWorkspaces,
+    resetHideWorkspacesFromOtherDevices: state.hideWorkspacesFromOtherDevices,
     resetAlwaysShowDefaultBranchWorkspace: state.alwaysShowDefaultBranchWorkspace === false,
     resetVisibleWorkspaceHostIds:
       state.visibleWorkspaceHostIds != null ||
@@ -193,6 +202,8 @@ export function computeVisibleWorktreeIds(
     hideAutomationGeneratedWorkspaces: boolean
     hideCliCreatedWorkspaces: boolean
     hideDetachedHeadWorkspaces: boolean
+    hideWorkspacesFromOtherDevices: boolean
+    pairedDeviceIdsByEnvironment: ReadonlyMap<string, string>
     // Why optional here, against the "why required" rule above: omitting it
     // must fail *open*. A caller that forgets the flag then shows an extra row
     // instead of silently re-hiding the project's entry point, which is the
@@ -216,6 +227,12 @@ export function computeVisibleWorktreeIds(
   // every other valid ancestor can bypass filters so children never orphan.
   const lineageAncestorById = new Map(all.map((w) => [w.id, w]))
 
+  if (opts.hideWorkspacesFromOtherDevices) {
+    all = all.filter(
+      (worktree) => !isWorkspaceFromOtherDevice(worktree, opts.pairedDeviceIdsByEnvironment)
+    )
+  }
+
   if (opts.hideDefaultBranchWorkspace) {
     all = all.filter((w) => !isDefaultBranchWorkspace(w))
   }
@@ -416,6 +433,13 @@ export function getVisibleWorktreeIds(): string[] {
     hideAutomationGeneratedWorkspaces: state.hideAutomationGeneratedWorkspaces,
     hideCliCreatedWorkspaces: state.hideCliCreatedWorkspaces,
     hideDetachedHeadWorkspaces: state.hideDetachedHeadWorkspaces,
+    hideWorkspacesFromOtherDevices: state.hideWorkspacesFromOtherDevices,
+    pairedDeviceIdsByEnvironment: state.hideWorkspacesFromOtherDevices
+      ? getPairedDeviceIdsByEnvironment(
+          state.runtimeEnvironments,
+          state.runtimeStatusByEnvironmentId
+        )
+      : EMPTY_PAIRED_DEVICE_IDS_BY_ENVIRONMENT,
     alwaysShowDefaultBranchWorkspace: state.alwaysShowDefaultBranchWorkspace,
     repoMap,
     workspaceHostScope: state.workspaceHostScope,
diff --git a/src/renderer/src/components/sidebar/workspace-creator-visibility.test.ts b/src/renderer/src/components/sidebar/workspace-creator-visibility.test.ts
new file mode 100644
index 00000000000..1cbd5eedb08
--- /dev/null
+++ b/src/renderer/src/components/sidebar/workspace-creator-visibility.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest'
+import type { FolderWorkspace } from '../../../../shared/types'
+import { filterFolderWorkspacesFromOtherDevices } from './workspace-creator-visibility'
+
+function makeFolderWorkspace(
+  id: string,
+  creatorProvenance: FolderWorkspace['creatorProvenance']
+): FolderWorkspace {
+  return {
+    id,
+    projectGroupId: 'project',
+    name: id,
+    folderPath: `/tmp/${id}`,
+    executionHostId: 'runtime:env-1',
+    creatorProvenance,
+    linkedTask: null,
+    comment: '',
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 0,
+    createdAt: 0,
+    updatedAt: 0
+  }
+}
+
+describe('filterFolderWorkspacesFromOtherDevices', () => {
+  it('uses the same client ownership rules as git workspaces', () => {
+    const own = makeFolderWorkspace('own', {
+      kind: 'paired-device',
+      deviceId: 'device-a'
+    })
+    const other = makeFolderWorkspace('other', {
+      kind: 'paired-device',
+      deviceId: 'device-b'
+    })
+    const host = makeFolderWorkspace('host', { kind: 'host' })
+    const legacy = makeFolderWorkspace('legacy', undefined)
+
+    const result = filterFolderWorkspacesFromOtherDevices(
+      [own, other, host, legacy],
+      new Map([['env-1', 'device-a']])
+    )
+
+    expect(result.map((workspace) => workspace.id)).toEqual(['own', 'legacy'])
+  })
+})
diff --git a/src/renderer/src/components/sidebar/workspace-creator-visibility.ts b/src/renderer/src/components/sidebar/workspace-creator-visibility.ts
new file mode 100644
index 00000000000..1cc4e208cfd
--- /dev/null
+++ b/src/renderer/src/components/sidebar/workspace-creator-visibility.ts
@@ -0,0 +1,62 @@
+import type { RuntimeStatus } from '../../../../shared/runtime-types'
+import type { PublicKnownRuntimeEnvironment } from '../../../../shared/runtime-environments'
+import type { FolderWorkspace, Worktree } from '../../../../shared/types'
+import { folderWorkspaceToWorktree } from '../../../../shared/folder-workspace-worktree'
+import { normalizeWorkspaceCreatorProvenance } from '../../../../shared/workspace-creator-provenance'
+
+type RuntimeStatusEntry = { status: RuntimeStatus | null }
+
+export const EMPTY_PAIRED_DEVICE_IDS_BY_ENVIRONMENT: ReadonlyMap<string, string> = new Map()
+
+export function getPairedDeviceIdsByEnvironment(
+  environments: readonly PublicKnownRuntimeEnvironment[],
+  statuses: ReadonlyMap<string, RuntimeStatusEntry>
+): ReadonlyMap<string, string> {
+  const result = new Map<string, string>()
+  for (const environment of environments) {
+    const deviceId =
+      statuses.get(environment.id)?.status?.pairedDeviceId ?? environment.pairedDeviceId
+    if (deviceId) {
+      result.set(environment.id, deviceId)
+    }
+  }
+  return result
+}
+
+export function isWorkspaceFromOtherDevice(
+  worktree: Worktree,
+  pairedDeviceIdsByEnvironment: ReadonlyMap<string, string>
+): boolean {
+  const creator = normalizeWorkspaceCreatorProvenance(worktree.creatorProvenance)
+  if (!creator) {
+    return false
+  }
+  const environmentId = worktree.runtimeOwnerEnvironmentId
+  if (!environmentId) {
+    return creator.kind !== 'host'
+  }
+  const pairedDeviceId = pairedDeviceIdsByEnvironment.get(environmentId)
+  if (!pairedDeviceId) {
+    return false
+  }
+  return creator.kind !== 'paired-device' || creator.deviceId !== pairedDeviceId
+}
+
+export function isFolderWorkspaceFromOtherDevice(
+  workspace: FolderWorkspace,
+  pairedDeviceIdsByEnvironment: ReadonlyMap<string, string>
+): boolean {
+  return isWorkspaceFromOtherDevice(
+    folderWorkspaceToWorktree(workspace),
+    pairedDeviceIdsByEnvironment
+  )
+}
+
+export function filterFolderWorkspacesFromOtherDevices(
+  workspaces: readonly FolderWorkspace[],
+  pairedDeviceIdsByEnvironment: ReadonlyMap<string, string>
+): FolderWorkspace[] {
+  return workspaces.filter(
+    (workspace) => !isFolderWorkspaceFromOtherDevice(workspace, pairedDeviceIdsByEnvironment)
+  )
+}
diff --git a/src/renderer/src/components/sidebar/worktree-card-header.tsx b/src/renderer/src/components/sidebar/worktree-card-header.tsx
new file mode 100644
index 00000000000..0c063e28dee
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-card-header.tsx
@@ -0,0 +1,321 @@
+import React from 'react'
+import { AlertCircle, Server, ServerOff, Star, Trash2 } from 'lucide-react'
+
+import { RepoIconGlyph } from '@/components/repo/repo-icon'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { translate } from '@/i18n/i18n'
+import { cn } from '@/lib/utils'
+import type { Repo } from '../../../../shared/types'
+import { resolveRepoHeaderColor } from './project-header-color'
+import { formatSparseDirectoryPreview, shouldBeginWorktreeRename } from './worktree-card-model'
+import type { WorktreeCardPresentation } from './worktree-card-presentation'
+import { WorktreeCardSshHostControl } from './WorktreeCardSshHostControl'
+import { WorktreeTitleInlineRename } from './WorktreeTitleInlineRename'
+import type { WorktreeCardController } from './use-worktree-card-controller'
+
+// Why: pinned repo icon and compact inline badge share this chip shell so both repo cues read as the same affordance.
+function RepoIdentityChip({
+  repo,
+  children
+}: {
+  repo: Repo
+  children: React.ReactNode
+}): React.JSX.Element {
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <span
+          className="inline-flex size-4 shrink-0 items-center justify-center rounded-[4px] border border-worktree-sidebar-border bg-worktree-sidebar-accent/55"
+          aria-label={translate(
+            'auto.components.sidebar.WorktreeCard.35ccfe2475',
+            'Project {{value0}}',
+            { value0: repo.displayName }
+          )}
+        >
+          {children}
+        </span>
+      </TooltipTrigger>
+      <TooltipContent side="right" sideOffset={8}>
+        {repo.displayName}
+      </TooltipContent>
+    </Tooltip>
+  )
+}
+
+export function WorktreeCardHeader({
+  card,
+  presentation
+}: {
+  card: WorktreeCardController
+  presentation: WorktreeCardPresentation
+}): React.JSX.Element {
+  const {
+    worktree,
+    repo,
+    affiliateListMode,
+    renameRowKey,
+    compactCards,
+    newCardStyle,
+    parsedRepoHost,
+    sshTargetLabel,
+    sshStatus,
+    sshTargetRemoved,
+    sshOwnerEnvironmentId,
+    stopQuickActionPointerPropagation,
+    isRuntimeDisconnected,
+    runtimeHostLabel,
+    visibleCardTitle,
+    isDeleting,
+    showUnreadEmphasis,
+    setTitleRenaming,
+    handleRenameTitle,
+    renamingWorktreeId,
+    setRenamingWorktreeId,
+    titleRenaming,
+    handleOpenRenameErrorDialog,
+    isFolder,
+    handleWorkspaceQuickAction
+  } = card
+  const {
+    showPinnedRepoIcon,
+    showInlineRepoBadge,
+    showHeaderActions,
+    showTitleRowPrimary,
+    showDeleteQuickAction,
+    showTitleRowIndicators,
+    titleRowIndicators,
+    titleWrapper
+  } = presentation
+
+  return (
+    <div className="flex min-w-0 items-center justify-between gap-2">
+      <div className="flex min-w-0 flex-1 items-center gap-1.5">
+        {showPinnedRepoIcon && (
+          <RepoIdentityChip repo={repo!}>
+            <RepoIconGlyph
+              repoIcon={repo!.repoIcon}
+              color={resolveRepoHeaderColor(repo!.badgeColor)}
+              className="size-full"
+              iconClassName="size-3"
+            />
+          </RepoIdentityChip>
+        )}
+
+        {repo?.connectionId && (
+          <WorktreeCardSshHostControl
+            targetId={repo.connectionId}
+            targetLabel={sshTargetLabel || repo.displayName}
+            status={sshStatus}
+            targetRemoved={sshTargetRemoved}
+            sshOwnerEnvironmentId={sshOwnerEnvironmentId}
+            iconOnly={compactCards || newCardStyle}
+            onPointerDown={stopQuickActionPointerPropagation}
+          />
+        )}
+
+        {!repo?.connectionId && parsedRepoHost?.kind === 'runtime' && (
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <span className="shrink-0 inline-flex items-center">
+                {isRuntimeDisconnected ? (
+                  // Passive by design: runtime ("Orca server") hosts have no
+                  // renderer-reachable connect API, unlike the SSH glyph above which is
+                  // now a control. Don't "fix" the inconsistency by wiring one up.
+                  <ServerOff className="size-3 text-destructive" />
+                ) : (
+                  <Server className="size-3 text-muted-foreground" />
+                )}
+              </span>
+            </TooltipTrigger>
+            <TooltipContent side="right" sideOffset={8}>
+              {isRuntimeDisconnected
+                ? runtimeHostLabel
+                  ? translate(
+                      'auto.components.sidebar.WorktreeCard.runtimeHostDisconnectedNamed',
+                      '{{hostName}} disconnected',
+                      { hostName: runtimeHostLabel }
+                    )
+                  : translate(
+                      'auto.components.sidebar.WorktreeCard.runtimeHostDisconnected',
+                      'Server disconnected'
+                    )
+                : runtimeHostLabel
+                  ? translate(
+                      'auto.components.sidebar.WorktreeCard.runtimeHostProjectNamed',
+                      'Project on {{hostName}}',
+                      { hostName: runtimeHostLabel }
+                    )
+                  : translate(
+                      'auto.components.sidebar.WorktreeCard.runtimeHostProject',
+                      'Project on Orca server'
+                    )}
+            </TooltipContent>
+          </Tooltip>
+        )}
+
+        {showInlineRepoBadge && (
+          <RepoIdentityChip repo={repo!}>
+            <RepoIconGlyph
+              repoIcon={repo!.repoIcon}
+              color={resolveRepoHeaderColor(repo!.badgeColor)}
+              className="size-full"
+              iconClassName="size-3"
+            />
+          </RepoIdentityChip>
+        )}
+
+        {/* Why: unread alert lives in the left status lane; title-row contrast comes from weight and dimmed read titles. */}
+        <WorktreeTitleInlineRename
+          displayName={visibleCardTitle}
+          disabled={isDeleting || affiliateListMode}
+          showUnreadEmphasis={showUnreadEmphasis}
+          dimReadTitle={newCardStyle}
+          className="text-[13px] leading-5"
+          editingClassName="flex-1"
+          titleWrapper={titleWrapper}
+          onEditingChange={affiliateListMode ? undefined : setTitleRenaming}
+          onRename={handleRenameTitle}
+          beginEditing={
+            !affiliateListMode &&
+            shouldBeginWorktreeRename(renamingWorktreeId, worktree.id, renameRowKey)
+          }
+          onBeginEditingConsumed={affiliateListMode ? undefined : () => setRenamingWorktreeId(null)}
+        />
+
+        {typeof worktree.firstAgentMessageRenameError === 'string' &&
+        worktree.firstAgentMessageRenameError.length > 0 &&
+        !titleRenaming ? (
+          // Why: the error can be raw agent CLI output, so the badge opens a dialog rather than a tooltip.
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <Button
+                type="button"
+                variant="ghost"
+                onPointerDown={stopQuickActionPointerPropagation}
+                onClick={handleOpenRenameErrorDialog}
+                onDoubleClick={handleOpenRenameErrorDialog}
+                className="h-4 shrink-0 gap-0.5 rounded !px-0.5 text-[10px] font-medium leading-none text-destructive border border-destructive/40 bg-destructive/10 hover:bg-destructive/15 hover:text-destructive has-[>svg]:!px-0.5"
+                aria-label={translate(
+                  'auto.components.sidebar.WorktreeCard.02e19349f4',
+                  'Auto-rename failed: view error'
+                )}
+              >
+                <AlertCircle className="size-2.5" />
+                {translate('auto.components.sidebar.WorktreeCard.74522ee457', 'rename failed')}
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent side="right" sideOffset={8}>
+              {translate(
+                'auto.components.sidebar.WorktreeCard.4eba2ea99e',
+                'Auto-name failed. Click to see details.'
+              )}
+            </TooltipContent>
+          </Tooltip>
+        ) : null}
+        {!compactCards && worktree.isMainWorktree && !isFolder && (
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <Badge
+                variant="outline"
+                className="h-[16px] px-1.5 text-[10px] font-medium rounded shrink-0 leading-none text-foreground/70 border-foreground/20 bg-foreground/[0.06]"
+              >
+                {translate('auto.components.sidebar.WorktreeCard.7d517f82e2', 'primary')}
+              </Badge>
+            </TooltipTrigger>
+            <TooltipContent side="right" sideOffset={8}>
+              {translate(
+                'auto.components.sidebar.WorktreeCard.0777de5970',
+                'Primary worktree (original clone directory)'
+              )}
+            </TooltipContent>
+          </Tooltip>
+        )}
+
+        {worktree.isSparse && (
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <Badge
+                variant="outline"
+                className="h-[16px] px-1.5 text-[10px] font-medium rounded shrink-0 leading-none text-amber-700 dark:text-amber-300 border-amber-500/30 bg-amber-500/5"
+              >
+                {translate('auto.components.sidebar.WorktreeCard.4f964d5e8c', 'sparse')}
+              </Badge>
+            </TooltipTrigger>
+            <TooltipContent side="right" sideOffset={8} className="max-w-72">
+              <div className="space-y-1">
+                <div>
+                  {translate(
+                    'auto.components.sidebar.WorktreeCard.0f33af979b',
+                    'Partial checkout. Files outside these paths are not on disk.'
+                  )}
+                </div>
+                {worktree.sparseDirectories && worktree.sparseDirectories.length > 0 ? (
+                  <div className="font-mono text-[11px] opacity-80">
+                    {formatSparseDirectoryPreview(worktree.sparseDirectories)}
+                  </div>
+                ) : null}
+              </div>
+            </TooltipContent>
+          </Tooltip>
+        )}
+
+        {showTitleRowIndicators && titleRowIndicators}
+      </div>
+
+      {showHeaderActions && (
+        <div className="ml-auto flex shrink-0 items-center justify-center gap-1 pr-1.5">
+          {showTitleRowPrimary && (
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <span
+                  className="shrink-0 inline-flex items-center"
+                  aria-label={translate(
+                    'auto.components.sidebar.WorktreeCard.0d224eff10',
+                    'Primary worktree'
+                  )}
+                >
+                  <Star className="size-3 fill-amber-400 text-amber-400" />
+                </span>
+              </TooltipTrigger>
+              <TooltipContent side="right" sideOffset={8}>
+                {translate(
+                  'auto.components.sidebar.WorktreeCard.0777de5970',
+                  'Primary worktree (original clone directory)'
+                )}
+              </TooltipContent>
+            </Tooltip>
+          )}
+
+          {showDeleteQuickAction && (
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <button
+                  type="button"
+                  data-workspace-board-preserve-open=""
+                  onPointerDown={stopQuickActionPointerPropagation}
+                  onClick={handleWorkspaceQuickAction}
+                  className={cn(
+                    'inline-flex size-4 items-center justify-center rounded bg-transparent opacity-0 transition-colors transition-opacity',
+                    'group-hover/worktree-card:opacity-100 group-focus-within/worktree-card:opacity-100 focus-visible:opacity-100',
+                    'text-muted-foreground hover:bg-destructive/10 hover:text-destructive focus-visible:bg-destructive/10 focus-visible:text-destructive'
+                  )}
+                  aria-label={translate(
+                    'auto.components.sidebar.WorktreeCard.6f09f58541',
+                    'Delete workspace'
+                  )}
+                >
+                  <Trash2 className="size-3.5" />
+                </button>
+              </TooltipTrigger>
+              <TooltipContent side="right" sideOffset={8}>
+                {translate('auto.components.sidebar.WorktreeCard.6f09f58541', 'Delete workspace')}
+              </TooltipContent>
+            </Tooltip>
+          )}
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/sidebar/worktree-card-meta-row.tsx b/src/renderer/src/components/sidebar/worktree-card-meta-row.tsx
new file mode 100644
index 00000000000..1c4e3343af5
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-card-meta-row.tsx
@@ -0,0 +1,114 @@
+import React from 'react'
+import { GitMerge } from 'lucide-react'
+
+import { DetachedHeadBadge } from '@/components/DetachedHeadBadge'
+import { RepoBadgeMark } from '@/components/repo/RepoBadgeLabel'
+import { Badge } from '@/components/ui/badge'
+import CacheTimer from './CacheTimer'
+import { CONFLICT_OPERATION_LABELS } from './WorktreeCardHelpers'
+import { TruncatedSidebarLabel } from './truncated-sidebar-label'
+import { getDirectoryName } from './worktree-card-model'
+import type { WorktreeCardPresentation } from './worktree-card-presentation'
+import type { WorktreeCardController } from './use-worktree-card-controller'
+
+export function WorktreeCardMetaRow({
+  card,
+  presentation
+}: {
+  card: WorktreeCardController
+  presentation: WorktreeCardPresentation
+}): React.JSX.Element {
+  const {
+    worktree,
+    repo,
+    hostContextLabel,
+    identityDisplay,
+    isFolder,
+    newCardStyle,
+    branch,
+    detachedHeadDisplay,
+    conflictOperation,
+    cacheStartedAt,
+    cacheTtlMs
+  } = card
+  const {
+    showRepoBadgeInMetaRow,
+    showHostContextBadge,
+    showIdentityInNewCard,
+    hasHoverDetails,
+    showBranch,
+    showDetachedHeadInMetaRow,
+    showConflictOperationBadge,
+    showMetaRowDetails,
+    detailsAndPorts
+  } = presentation
+
+  return (
+    <div className="flex items-center gap-1.5 min-w-0" data-worktree-card-meta-row="">
+      <div className="flex min-w-0 flex-1 items-center gap-1.5 overflow-hidden">
+        {showRepoBadgeInMetaRow && repo && (
+          <div className="flex items-center gap-1.5 shrink-0 px-1.5 py-0.5 rounded-[4px] bg-accent border border-border dark:bg-accent/50 dark:border-border/60">
+            <RepoBadgeMark color={repo.badgeColor} />
+            <span className="text-[10px] font-semibold text-foreground truncate max-w-[6rem] leading-none lowercase">
+              {repo.displayName}
+            </span>
+          </div>
+        )}
+
+        {showHostContextBadge && (
+          <Badge
+            variant="secondary"
+            className="h-[16px] max-w-[7rem] shrink-0 rounded border border-border bg-accent px-1.5 text-[10px] font-medium leading-none text-muted-foreground dark:bg-accent/80 dark:border-border/50"
+          >
+            <span className="truncate">{hostContextLabel}</span>
+          </Badge>
+        )}
+
+        {showIdentityInNewCard ? (
+          <TruncatedSidebarLabel
+            text={identityDisplay!}
+            className="text-[11px] text-muted-foreground leading-none"
+            tooltipEnabled={!hasHoverDetails}
+          />
+        ) : isFolder && !newCardStyle ? (
+          <span
+            className="min-w-0 truncate font-mono text-[11px] leading-none text-muted-foreground"
+            title={worktree.path}
+          >
+            {getDirectoryName(worktree.path)}
+          </span>
+        ) : showBranch ? (
+          <TruncatedSidebarLabel
+            text={branch}
+            className="text-[11px] text-muted-foreground leading-none"
+            // Why: whole-card details hover already shows full identity; a nested tooltip would compete for it.
+            tooltipEnabled={!hasHoverDetails}
+          />
+        ) : showDetachedHeadInMetaRow && detachedHeadDisplay ? (
+          <DetachedHeadBadge
+            display={detachedHeadDisplay}
+            label="sidebar"
+            side="right"
+            className="h-[16px]"
+          />
+        ) : null}
+
+        {showConflictOperationBadge && (
+          <Badge
+            variant="outline"
+            className="h-[16px] px-1.5 text-[10px] font-medium rounded shrink-0 gap-1 text-amber-600 border-amber-500/30 bg-amber-500/5 dark:text-amber-400 dark:border-amber-400/30 dark:bg-amber-400/5 leading-none"
+          >
+            <GitMerge className="size-2.5" />
+            {CONFLICT_OPERATION_LABELS[conflictOperation]}
+          </Badge>
+        )}
+
+        {cacheStartedAt != null && <CacheTimer startedAt={cacheStartedAt} ttlMs={cacheTtlMs} />}
+      </div>
+
+      {showMetaRowDetails && (
+        <div className="ml-auto flex shrink-0 items-center gap-1 pr-1.5">{detailsAndPorts}</div>
+      )}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/sidebar/worktree-card-model.ts b/src/renderer/src/components/sidebar/worktree-card-model.ts
new file mode 100644
index 00000000000..2331b92d2cd
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-card-model.ts
@@ -0,0 +1,116 @@
+import type React from 'react'
+
+import type { Repo, WorkspaceStatus, Worktree } from '../../../../shared/types'
+import type { WorktreeCardPrDisplay } from './worktree-card-pr-display'
+
+export type WorktreeRenameRequest = {
+  worktreeId: string
+  rowKey?: string
+}
+
+export type ActiveSurfaceVariant = 'primary' | 'secondary'
+
+export type WorktreeCardProps = {
+  worktree: Worktree
+  repo: Repo | undefined
+  isActive: boolean
+  isCurrentWorktree?: boolean
+  isActiveSurface?: boolean
+  activeSurfaceVariant?: ActiveSurfaceVariant
+  isMultiSelected?: boolean
+  revealHighlight?: boolean
+  revealHighlightTone?: 'default' | 'ai'
+  selectedWorktrees?: readonly Worktree[]
+  hideRepoBadge?: boolean
+  hostContextLabel?: string
+  inPinnedSection?: boolean
+  activationRowKey?: string
+  renameRowKey?: string
+  contentIndent?: number
+  flushSurface?: boolean
+  lineageChildCount?: number
+  lineageCollapsed?: boolean
+  lineageChildren?: React.ReactNode
+  lineageChildrenStyle?: React.CSSProperties
+  onLineageToggle?: (event: React.MouseEvent<HTMLButtonElement>) => void
+  isLineageDropTarget?: boolean
+  onActivate?: () => void
+  onImmediateActivate?: (worktreeId: string, rowKey: string | undefined) => void
+  onSelectionGesture?: (event: React.MouseEvent<HTMLElement>, worktreeId: string) => boolean
+  onContextMenuSelect?: (
+    event: React.MouseEvent<HTMLElement>,
+    worktree: Worktree
+  ) => readonly Worktree[]
+  onAssignWorkspaceStatus?: (worktreeIds: readonly string[], status: WorkspaceStatus) => void
+  onCardDragStart?: (
+    event: React.DragEvent<HTMLDivElement>,
+    worktreeId: string,
+    draggedIds: readonly string[]
+  ) => void
+  onCardDragEnd?: (event: React.DragEvent<HTMLDivElement>) => void
+  nativeDragEnabled?: boolean
+  affiliateListMode?: boolean
+  statusPrDisplay?: WorktreeCardPrDisplay | null
+}
+
+type DefaultedWorktreeCardProp =
+  | 'isActiveSurface'
+  | 'activeSurfaceVariant'
+  | 'isMultiSelected'
+  | 'revealHighlight'
+  | 'revealHighlightTone'
+  | 'nativeDragEnabled'
+  | 'inPinnedSection'
+  | 'contentIndent'
+  | 'flushSurface'
+  | 'lineageChildCount'
+  | 'lineageCollapsed'
+  | 'isLineageDropTarget'
+  | 'affiliateListMode'
+  | 'statusPrDisplay'
+
+export type ResolvedWorktreeCardProps = Omit<WorktreeCardProps, DefaultedWorktreeCardProp> & {
+  isActiveSurface: boolean
+  activeSurfaceVariant: ActiveSurfaceVariant
+  isMultiSelected: boolean
+  revealHighlight: boolean
+  revealHighlightTone: 'default' | 'ai'
+  nativeDragEnabled: boolean
+  inPinnedSection: boolean
+  contentIndent: number
+  flushSurface: boolean
+  lineageChildCount: number
+  lineageCollapsed: boolean
+  isLineageDropTarget: boolean
+  affiliateListMode: boolean
+  statusPrDisplay: WorktreeCardPrDisplay | null
+}
+
+export const EMPTY_WORKSPACE_PORTS = []
+export const HOSTED_REVIEW_CARD_REFRESH_INTERVAL_MS = 60_000
+
+export function shouldBeginWorktreeRename(
+  request: WorktreeRenameRequest | null,
+  worktreeId: string,
+  rowKey: string | undefined
+): boolean {
+  return (
+    request?.worktreeId === worktreeId &&
+    (request.rowKey === undefined || request.rowKey === rowKey)
+  )
+}
+
+export function formatSparseDirectoryPreview(directories: string[]): string {
+  const preview = directories.slice(0, 4).join(', ')
+  return directories.length <= 4 ? preview : `${preview}, +${directories.length - 4} more`
+}
+
+export function isWebClient(): boolean {
+  return Boolean((window as unknown as { __ORCA_WEB_CLIENT__?: boolean }).__ORCA_WEB_CLIENT__)
+}
+
+export function getDirectoryName(folderPath: string): string {
+  const normalized = folderPath.replace(/[\\/]+$/, '')
+  const parts = normalized.split(/[\\/]+/)
+  return parts.at(-1) || normalized || folderPath
+}
diff --git a/src/renderer/src/components/sidebar/worktree-card-parent-content.tsx b/src/renderer/src/components/sidebar/worktree-card-parent-content.tsx
new file mode 100644
index 00000000000..d1b24cca2ad
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-card-parent-content.tsx
@@ -0,0 +1,86 @@
+import React from 'react'
+
+import { cn } from '@/lib/utils'
+import { WorktreeCardHeader } from './worktree-card-header'
+import { WorktreeCardMetaRow } from './worktree-card-meta-row'
+import type { WorktreeCardPresentation } from './worktree-card-presentation'
+import { WorktreeCardSecondaryRows } from './worktree-card-secondary-rows'
+import { WorktreeCardStatusSlot } from './WorktreeCardStatusSlot'
+import type { WorktreeCardController } from './use-worktree-card-controller'
+
+export function WorktreeCardParentContent({
+  card,
+  presentation
+}: {
+  card: WorktreeCardController
+  presentation: WorktreeCardPresentation
+}): React.JSX.Element {
+  const {
+    worktree,
+    affiliateListMode,
+    newCardStyle,
+    lineageChildren,
+    showStatus,
+    unreadTooltip,
+    stopQuickActionPointerPropagation,
+    handleToggleUnreadQuick,
+    statusLaneReview,
+    branchIdentityDisplay,
+    showInlineAgentList
+  } = card
+  const { titleOnlyCard, parentContentMarginLeft, showCombinedStatusSlot, showUnreadQuickAction } =
+    presentation
+
+  return (
+    <div
+      className={cn(
+        'flex w-full min-w-0 gap-0.5 pl-0',
+        titleOnlyCard ? 'items-center' : 'items-start'
+      )}
+      style={
+        parentContentMarginLeft < 0 ? { marginLeft: `${parentContentMarginLeft}px` } : undefined
+      }
+      data-worktree-card-parent-content=""
+    >
+      {showCombinedStatusSlot ? (
+        <div
+          className={cn(
+            'flex shrink-0 justify-center',
+            newCardStyle ? 'mr-1 w-5 items-center' : 'items-start pt-[2px]',
+            affiliateListMode && 'px-1'
+          )}
+          data-worktree-card-status-slot=""
+        >
+          <WorktreeCardStatusSlot
+            worktreeId={worktree.id}
+            showStatus={showStatus}
+            showUnreadAction={showUnreadQuickAction}
+            isUnread={worktree.isUnread}
+            unreadTooltip={unreadTooltip}
+            onPointerDown={stopQuickActionPointerPropagation}
+            onToggleUnread={handleToggleUnreadQuick}
+            prDisplay={statusLaneReview}
+            newCardStyle={newCardStyle}
+            hasBranchIdentity={Boolean(branchIdentityDisplay)}
+          />
+        </div>
+      ) : null}
+
+      {/* Content area */}
+      <div
+        className={cn(
+          'flex min-w-0 flex-1 flex-col gap-1.5',
+          // Why: inline agent rows intentionally outdent into the card gutter; inner elements handle truncation.
+          showInlineAgentList || (!newCardStyle && lineageChildren)
+            ? 'overflow-visible'
+            : 'overflow-hidden'
+        )}
+      >
+        {/* Header row: Title */}
+        <WorktreeCardHeader card={card} presentation={presentation} />
+        {presentation.hasMetaRow && <WorktreeCardMetaRow card={card} presentation={presentation} />}
+        <WorktreeCardSecondaryRows card={card} presentation={presentation} />
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/sidebar/worktree-card-presentation.tsx b/src/renderer/src/components/sidebar/worktree-card-presentation.tsx
new file mode 100644
index 00000000000..5ce1e94501c
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-card-presentation.tsx
@@ -0,0 +1,288 @@
+import React from 'react'
+
+import {
+  getFlushWorktreeCardPaddingLeft,
+  getNewCardStyleParentContentMarginLeft
+} from './worktree-list-indentation'
+import {
+  hasWorktreeCardDetails,
+  WorktreeCardDetailsHover,
+  WorktreeCardMetaBadges
+} from './WorktreeCardMeta'
+import { WorktreeCardPortsDetails, WorktreeCardPortsTrigger } from './WorktreeCardPorts'
+import type { WorktreeCardController } from './use-worktree-card-controller'
+
+export function buildWorktreeCardPresentation(card: WorktreeCardController) {
+  const {
+    worktree,
+    repo,
+    inPinnedSection,
+    hideRepoBadge,
+    hostContextLabel,
+    affiliateListMode,
+    flushSurface,
+    contentIndent,
+    newCardStyle,
+    compactCards,
+    isFolder,
+    detachedHeadDisplay,
+    branch,
+    identityDisplay,
+    folderMetaRowContent,
+    showIdentityInNewCard,
+    conflictOperation,
+    cardProps,
+    cacheStartedAt,
+    hasDetails,
+    hasPorts,
+    showStatus,
+    showInlineAgentList,
+    showLineageChildChip,
+    remoteBranchConflict,
+    visibleCardTitle,
+    workspacePorts,
+    metaIssue,
+    metaLinearIssue,
+    metaJiraIssue,
+    metaReview,
+    metaComment,
+    metaAutomationProvenance,
+    metaCliProvenance,
+    hoverIssue,
+    hoverLinearIssue,
+    hoverJiraIssue,
+    hoverReview,
+    hoverComment,
+    linearIssue,
+    handleEditIssue,
+    handleEditComment,
+    handleOpenGitHubIssueInOrca,
+    handleOpenLinearIssueInOrca,
+    handleOpenReviewInOrca,
+    handleOpenAutomation,
+    handleOpenAutomationRun,
+    hasExplicitLinkedReview,
+    handleUnlinkReview,
+    detailsHoverControl,
+    showDeleteQuickAction
+  } = card
+
+  // Why: pinned trees mix repos, so the repo icon shows regardless of groupBy's hideRepoBadge.
+  const showPinnedRepoIcon = inPinnedSection && !!repo
+  // Why: new card style retired the Compact/Detailed switch; repo identity uses the compact chip, not a lower pill.
+  const showRepoIdentityInTitle = newCardStyle || compactCards
+  const showInlineRepoBadge =
+    showRepoIdentityInTitle && !!repo && !hideRepoBadge && !isFolder && !showPinnedRepoIcon
+  const showRepoBadgeInMetaRow =
+    !showRepoIdentityInTitle && !!repo && !hideRepoBadge && !showPinnedRepoIcon
+  const showHostContextBadge = !compactCards && !!hostContextLabel
+  const showDetachedHeadInMetaRow = !compactCards && !isFolder && detachedHeadDisplay !== null
+  const showBranch =
+    !isFolder &&
+    branch.length > 0 &&
+    !newCardStyle &&
+    (!compactCards || branch !== worktree.displayName)
+  // Why: rebases already surface in source control, so dense cards skip the persistent rebase chip.
+  const showConflictOperationBadge =
+    !!conflictOperation && conflictOperation !== 'unknown' && conflictOperation !== 'rebase'
+  const hasMetadataBadge = showConflictOperationBadge
+  const showUnreadQuickAction = !affiliateListMode && showStatus && !newCardStyle
+  // Why: the slot owns the unread/status lane; legacy keeps the bell toggle, the new card keeps the glyph passive.
+  const showCombinedStatusSlot = showStatus
+  const showTitleRowPrimary = compactCards && worktree.isMainWorktree && !isFolder
+  const showMetaRowDetails = !newCardStyle && !compactCards && (hasDetails || hasPorts)
+  const showTitleRowIndicators = (newCardStyle || compactCards) && (hasDetails || hasPorts)
+  // Why: grouped views can hide the repo badge; don't reserve a blank metadata lane unless there's real content.
+  const hasDetailedMetaRowContent = Boolean(
+    (showRepoBadgeInMetaRow && repo) ||
+    showHostContextBadge ||
+    folderMetaRowContent ||
+    showBranch ||
+    showIdentityInNewCard ||
+    showDetachedHeadInMetaRow ||
+    showConflictOperationBadge ||
+    cacheStartedAt != null ||
+    showMetaRowDetails
+  )
+  const hasMetaRow = compactCards
+    ? hasMetadataBadge || cacheStartedAt != null
+    : hasDetailedMetaRowContent
+  const showHeaderActions = showTitleRowPrimary || showDeleteQuickAction
+  // Why: normalize the title once so title/branch de-dupe and identity-only hover eligibility stay in sync.
+  const trimmedVisibleCardTitle = visibleCardTitle.trim()
+  const showBranchIdentityHover = newCardStyle
+    ? Boolean(identityDisplay) &&
+      !cardProps.includes('branch') &&
+      identityDisplay !== trimmedVisibleCardTitle
+    : compactCards && showBranch
+  const hoverBranchName = newCardStyle
+    ? identityDisplay
+    : showBranchIdentityHover
+      ? branch
+      : undefined
+  const hoverWorkspaceTitle =
+    trimmedVisibleCardTitle.length > 0 && trimmedVisibleCardTitle !== hoverBranchName
+      ? trimmedVisibleCardTitle
+      : undefined
+  const hasHoverIdentity = Boolean(hoverWorkspaceTitle || hoverBranchName)
+  const hasHoverDetails =
+    newCardStyle &&
+    (hasWorktreeCardDetails({
+      issue: hoverIssue,
+      linearIssue: hoverLinearIssue,
+      jiraIssue: hoverJiraIssue,
+      review: hoverReview,
+      comment: hoverComment,
+      automationProvenance: metaAutomationProvenance,
+      cliProvenance: metaCliProvenance
+    }) ||
+      workspacePorts.length > 0 ||
+      hasHoverIdentity)
+  // Why: the parent row owns metadata hover; don't stack the title's truncation tooltip on the details popover.
+  const titleWrapper = newCardStyle
+    ? hasHoverDetails
+      ? (title: React.ReactElement): React.ReactElement => title
+      : undefined
+    : compactCards && (showBranchIdentityHover || hasDetails || hasPorts)
+      ? (title: React.ReactElement): React.ReactElement => (
+          <WorktreeCardDetailsHover
+            issue={metaIssue}
+            linearIssue={metaLinearIssue}
+            jiraIssue={metaJiraIssue}
+            review={metaReview}
+            comment={metaComment}
+            automationProvenance={metaAutomationProvenance}
+            cliProvenance={metaCliProvenance}
+            automationHostId={worktree.hostId}
+            branchName={showBranchIdentityHover ? branch : undefined}
+            workspaceTitle={worktree.displayName}
+            identityOrder="branch-first"
+            detailsAfter={hasPorts ? <WorktreeCardPortsDetails ports={workspacePorts} /> : null}
+            openDelay={100}
+            // Why: compact mode also renders the plug/badge hover root; sharing one open-state made hovering the
+            // plug force-open the wider title card and race it closed (#9304), so let this title hover own its state.
+            onEditIssue={affiliateListMode ? undefined : handleEditIssue}
+            onEditComment={affiliateListMode ? undefined : handleEditComment}
+            onOpenGitHubIssueInOrca={
+              metaIssue && 'url' in metaIssue && metaIssue.url
+                ? handleOpenGitHubIssueInOrca
+                : undefined
+            }
+            onOpenLinearIssueInOrca={linearIssue?.url ? handleOpenLinearIssueInOrca : undefined}
+            onOpenReviewInOrca={
+              metaReview?.url && metaReview.provider === 'github'
+                ? handleOpenReviewInOrca
+                : undefined
+            }
+            onOpenAutomation={affiliateListMode ? undefined : handleOpenAutomation}
+            onOpenAutomationRun={affiliateListMode ? undefined : handleOpenAutomationRun}
+            // Why: compact mode hides the metadata badge row, so title hover carries the explicit-link affordance.
+            onUnlinkReview={
+              !affiliateListMode && hasExplicitLinkedReview ? handleUnlinkReview : undefined
+            }
+          >
+            {title}
+          </WorktreeCardDetailsHover>
+        )
+      : undefined
+  // Why: sidebar rows need a small surface inset while content stays aligned with the pre-inset layout.
+  const applyNewCardStyleStatusLaneOffset = newCardStyle && showCombinedStatusSlot
+  const cardPaddingLeft = flushSurface
+    ? getFlushWorktreeCardPaddingLeft(contentIndent, applyNewCardStyleStatusLaneOffset)
+    : contentIndent > 0
+      ? `calc(0.125rem + ${contentIndent}px)`
+      : null
+  const parentContentMarginLeft =
+    flushSurface && applyNewCardStyleStatusLaneOffset
+      ? getNewCardStyleParentContentMarginLeft(contentIndent)
+      : 0
+  const cardStyle = cardPaddingLeft ? { paddingLeft: cardPaddingLeft } : undefined
+  const detailsAndPortsContent =
+    hasDetails || hasPorts ? (
+      <div className="flex shrink-0 items-center gap-1">
+        {hasPorts && <WorktreeCardPortsTrigger ports={workspacePorts} />}
+        {hasDetails && (
+          <WorktreeCardMetaBadges
+            issue={metaIssue}
+            linearIssue={metaLinearIssue}
+            jiraIssue={metaJiraIssue}
+            review={newCardStyle ? null : metaReview}
+            comment={metaComment}
+            automationProvenance={metaAutomationProvenance}
+            cliProvenance={metaCliProvenance}
+            className="ml-0 pr-0"
+          />
+        )}
+      </div>
+    ) : null
+  const detailsAndPorts =
+    detailsAndPortsContent && !newCardStyle ? (
+      <WorktreeCardDetailsHover
+        issue={metaIssue}
+        linearIssue={metaLinearIssue}
+        jiraIssue={metaJiraIssue}
+        review={metaReview}
+        comment={metaComment}
+        automationProvenance={metaAutomationProvenance}
+        cliProvenance={metaCliProvenance}
+        automationHostId={worktree.hostId}
+        detailsAfter={hasPorts ? <WorktreeCardPortsDetails ports={workspacePorts} /> : null}
+        hoverControl={detailsHoverControl}
+        onEditIssue={affiliateListMode ? undefined : handleEditIssue}
+        onEditComment={affiliateListMode ? undefined : handleEditComment}
+        onOpenGitHubIssueInOrca={
+          metaIssue && 'url' in metaIssue && metaIssue.url ? handleOpenGitHubIssueInOrca : undefined
+        }
+        onOpenLinearIssueInOrca={linearIssue?.url ? handleOpenLinearIssueInOrca : undefined}
+        onOpenReviewInOrca={
+          metaReview?.url && metaReview.provider === 'github' ? handleOpenReviewInOrca : undefined
+        }
+        onOpenAutomation={affiliateListMode ? undefined : handleOpenAutomation}
+        onOpenAutomationRun={affiliateListMode ? undefined : handleOpenAutomationRun}
+        // Why: branch lookup can surface a review without persisted metadata; only unlink when explicitly linked.
+        onUnlinkReview={
+          !affiliateListMode && hasExplicitLinkedReview ? handleUnlinkReview : undefined
+        }
+      >
+        {detailsAndPortsContent}
+      </WorktreeCardDetailsHover>
+    ) : (
+      detailsAndPortsContent
+    )
+  const titleRowIndicators = showTitleRowIndicators ? (
+    <div className="ml-auto flex shrink-0 items-center gap-1 pr-1.5">{detailsAndPorts}</div>
+  ) : null
+  const hasSecondaryCardContent =
+    hasMetaRow || !!remoteBranchConflict || showInlineAgentList || showLineageChildChip
+  const titleOnlyCard = !hasSecondaryCardContent
+
+  return {
+    showPinnedRepoIcon,
+    showInlineRepoBadge,
+    showRepoBadgeInMetaRow,
+    showHostContextBadge,
+    showIdentityInNewCard,
+    showDetachedHeadInMetaRow,
+    showBranch,
+    showConflictOperationBadge,
+    showUnreadQuickAction,
+    showCombinedStatusSlot,
+    showTitleRowPrimary,
+    showMetaRowDetails,
+    showTitleRowIndicators,
+    hasMetaRow,
+    showHeaderActions,
+    showDeleteQuickAction,
+    hoverBranchName,
+    hoverWorkspaceTitle,
+    hasHoverDetails,
+    titleWrapper,
+    parentContentMarginLeft,
+    cardStyle,
+    detailsAndPorts,
+    titleRowIndicators,
+    titleOnlyCard
+  }
+}
+
+export type WorktreeCardPresentation = ReturnType<typeof buildWorktreeCardPresentation>
diff --git a/src/renderer/src/components/sidebar/worktree-card-secondary-rows.tsx b/src/renderer/src/components/sidebar/worktree-card-secondary-rows.tsx
new file mode 100644
index 00000000000..c71d9d6b0cb
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-card-secondary-rows.tsx
@@ -0,0 +1,122 @@
+import React from 'react'
+import { AlertTriangle, ChevronDown, Workflow } from 'lucide-react'
+
+import { Button } from '@/components/ui/button'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { translate } from '@/i18n/i18n'
+import { cn } from '@/lib/utils'
+import { LinearAgentSkillSetupPrompt } from './LinearAgentSkillSetupPrompt'
+import WorktreeCardAgents from './WorktreeCardAgents'
+import type { WorktreeCardPresentation } from './worktree-card-presentation'
+import type { WorktreeCardController } from './use-worktree-card-controller'
+
+export function WorktreeCardSecondaryRows({
+  card,
+  presentation
+}: {
+  card: WorktreeCardController
+  presentation: WorktreeCardPresentation
+}): React.JSX.Element {
+  const {
+    worktree,
+    repo,
+    settings,
+    isActive,
+    newCardStyle,
+    lineageChildren,
+    lineageCollapsed,
+    onLineageToggle,
+    remoteBranchConflict,
+    showInlineAgentList,
+    agentActivityDisplayMode,
+    compactInlineAgentRows,
+    showLineageChildChip,
+    lineageChildAriaLabel,
+    childWorkspaceShortLabel
+  } = card
+  const { hasMetaRow } = presentation
+
+  return (
+    <>
+      {remoteBranchConflict && (
+        <div className="mt-0.5 flex items-start gap-1.5 rounded border border-amber-500/25 bg-amber-500/5 px-1.5 py-1 text-[10.5px] leading-snug text-amber-700 dark:text-amber-300">
+          <AlertTriangle className="mt-[1px] size-3 shrink-0" />
+          <span className="min-w-0 flex-1">
+            {translate(
+              'auto.components.sidebar.WorktreeCard.a88c92d0e3',
+              '{{value0}}/{{value1}} already exists.',
+              {
+                value0: remoteBranchConflict.remote,
+                value1: remoteBranchConflict.branchName
+              }
+            )}
+          </span>
+        </div>
+      )}
+
+      {isActive && worktree.linkedLinearIssue ? (
+        <LinearAgentSkillSetupPrompt
+          linked
+          remote={Boolean(repo?.connectionId || settings?.activeRuntimeEnvironmentId?.trim())}
+          surface="modal"
+          settings={settings}
+        />
+      ) : null}
+
+      {/* Why: counterbalance the card stack gap (-mt-1) so agents right after the title read as one header group. */}
+      {showInlineAgentList && (
+        <WorktreeCardAgents
+          worktreeId={worktree.id}
+          agents={agentActivityDisplayMode === 'compact' ? compactInlineAgentRows : undefined}
+          className={hasMetaRow || remoteBranchConflict ? 'mt-0' : '-mt-1'}
+        />
+      )}
+
+      {showLineageChildChip && (
+        <div
+          className={cn('relative mt-1 flex min-w-0 justify-start', !newCardStyle && '-ml-1')}
+          style={{
+            color: 'color-mix(in srgb, var(--muted-foreground) 42%, var(--worktree-sidebar))'
+          }}
+        >
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <Button
+                type="button"
+                variant="ghost"
+                size="xs"
+                className="relative z-10 h-[18px] max-w-[8rem] gap-1 rounded-md border border-worktree-sidebar-border bg-worktree-sidebar px-1.5 text-[10px] font-medium leading-none text-muted-foreground shadow-none hover:bg-worktree-sidebar-accent hover:text-foreground focus-visible:ring-1 focus-visible:ring-worktree-sidebar-ring"
+                aria-label={lineageChildAriaLabel}
+                aria-expanded={!lineageCollapsed}
+                onClick={onLineageToggle}
+              >
+                <Workflow className="size-2.5" />
+                <span className="truncate">{childWorkspaceShortLabel}</span>
+                <ChevronDown
+                  className={cn('size-2.5 transition-transform', lineageCollapsed && '-rotate-90')}
+                />
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent side="right" sideOffset={8}>
+              {lineageCollapsed
+                ? translate(
+                    'auto.components.sidebar.WorktreeCard.8cb634cda6',
+                    'Show child workspaces'
+                  )
+                : translate(
+                    'auto.components.sidebar.WorktreeCard.57eaa61b55',
+                    'Hide child workspaces'
+                  )}
+            </TooltipContent>
+          </Tooltip>
+        </div>
+      )}
+
+      {!newCardStyle && lineageChildren && (
+        <div className="-ml-[1.125rem] mt-1.5 w-[calc(100%+1.125rem)] space-y-1">
+          {lineageChildren}
+        </div>
+      )}
+    </>
+  )
+}
diff --git a/src/renderer/src/components/sidebar/worktree-card-surface.tsx b/src/renderer/src/components/sidebar/worktree-card-surface.tsx
new file mode 100644
index 00000000000..7bc0abdcb89
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-card-surface.tsx
@@ -0,0 +1,208 @@
+import React from 'react'
+import { LoaderCircle } from 'lucide-react'
+
+import { cn } from '@/lib/utils'
+import { AutoRenameFailedDialog } from './AutoRenameFailedDialog'
+import WorktreeContextMenu from './WorktreeContextMenu'
+import { WorktreeCardDetailsHover } from './WorktreeCardMeta'
+import { WorktreeCardPortsDetails } from './WorktreeCardPorts'
+import { WorktreeCardParentContent } from './worktree-card-parent-content'
+import { buildWorktreeCardPresentation } from './worktree-card-presentation'
+import type { WorktreeCardController } from './use-worktree-card-controller'
+
+export function WorktreeCardSurface({ card }: { card: WorktreeCardController }): React.JSX.Element {
+  const presentation = buildWorktreeCardPresentation(card)
+  const {
+    worktree,
+    selectedWorktrees,
+    onAssignWorkspaceStatus,
+    affiliateListMode,
+    isActiveSurface,
+    activeSurfaceVariant,
+    isMultiSelected,
+    revealHighlight,
+    revealHighlightTone,
+    flushSurface,
+    isLineageDropTarget,
+    nativeDragEnabled,
+    lineageChildren,
+    lineageChildrenStyle,
+    newCardStyle,
+    titleRenaming,
+    isDeleting,
+    isRuntimeDisconnected,
+    isQueuedForDeletion,
+    deleteLabel,
+    handleClick,
+    handleDoubleClick,
+    handleDragStart,
+    handleDragEnd,
+    handleContextMenuSelect,
+    hoverIssue,
+    hoverLinearIssue,
+    hoverJiraIssue,
+    hoverReview,
+    hoverComment,
+    metaAutomationProvenance,
+    metaCliProvenance,
+    workspacePorts,
+    detailsHoverControl,
+    handleRenameTitle,
+    handleEditIssue,
+    handleEditComment,
+    handleOpenGitHubIssueInOrca,
+    linearIssue,
+    handleOpenLinearIssueInOrca,
+    handleOpenReviewInOrca,
+    handleOpenAutomation,
+    handleOpenAutomationRun,
+    hasExplicitLinkedReview,
+    handleUnlinkReview,
+    showRenameErrorDialog,
+    setShowRenameErrorDialog
+  } = card
+  const { titleOnlyCard, hasHoverDetails, hoverBranchName, hoverWorkspaceTitle, cardStyle } =
+    presentation
+
+  const parentCardContent = <WorktreeCardParentContent card={card} presentation={presentation} />
+
+  const parentHoverTriggerBody = (
+    <div className="group/worktree-card w-full min-w-0" data-worktree-card-hover-trigger="">
+      {parentCardContent}
+    </div>
+  )
+
+  const parentCardBodyWithHoverDetails =
+    hasHoverDetails && !titleRenaming ? (
+      <WorktreeCardDetailsHover
+        issue={hoverIssue}
+        linearIssue={hoverLinearIssue}
+        jiraIssue={hoverJiraIssue}
+        review={hoverReview}
+        comment={hoverComment}
+        automationProvenance={metaAutomationProvenance}
+        cliProvenance={metaCliProvenance}
+        automationHostId={worktree.hostId}
+        branchName={hoverBranchName}
+        workspaceTitle={hoverWorkspaceTitle}
+        workspaceTitleRenameDisabled={isDeleting || affiliateListMode}
+        detailsAfter={
+          workspacePorts.length > 0 ? <WorktreeCardPortsDetails ports={workspacePorts} /> : null
+        }
+        openDelay={100}
+        hoverControl={detailsHoverControl}
+        onRenameWorkspaceTitle={affiliateListMode ? undefined : handleRenameTitle}
+        onEditIssue={affiliateListMode ? undefined : handleEditIssue}
+        onEditComment={affiliateListMode ? undefined : handleEditComment}
+        onOpenGitHubIssueInOrca={
+          hoverIssue && 'url' in hoverIssue && hoverIssue.url
+            ? handleOpenGitHubIssueInOrca
+            : undefined
+        }
+        onOpenLinearIssueInOrca={linearIssue?.url ? handleOpenLinearIssueInOrca : undefined}
+        onOpenReviewInOrca={
+          hoverReview?.url && hoverReview.provider === 'github' ? handleOpenReviewInOrca : undefined
+        }
+        onOpenAutomation={affiliateListMode ? undefined : handleOpenAutomation}
+        onOpenAutomationRun={affiliateListMode ? undefined : handleOpenAutomationRun}
+        // Why: branch lookup can surface a review without persisted metadata; only unlink when explicitly linked.
+        onUnlinkReview={
+          !affiliateListMode && hasExplicitLinkedReview ? handleUnlinkReview : undefined
+        }
+      >
+        {parentHoverTriggerBody}
+      </WorktreeCardDetailsHover>
+    ) : (
+      parentHoverTriggerBody
+    )
+
+  const cardBody = (
+    <div
+      className={cn(
+        'relative flex cursor-pointer flex-col pr-1.5 transition-[background-color,border-color,opacity,box-shadow] duration-200 outline-none select-none',
+        titleOnlyCard ? 'py-2' : 'pt-1.25 pb-1.5',
+        flushSurface ? 'ml-1 w-[calc(100%-0.25rem)]' : 'ml-1',
+        'rounded-lg',
+        // Why: the live data attribute updates before React state during navigation,
+        // so it must own the complete active style without stale utility classes.
+        isLineageDropTarget
+          ? 'border border-accent-foreground/20 bg-accent/80'
+          : isActiveSurface
+            ? 'border border-transparent'
+            : isMultiSelected
+              ? 'border border-worktree-sidebar-ring/35 bg-worktree-sidebar-accent/70 ring-1 ring-worktree-sidebar-ring/30'
+              : 'border border-transparent worktree-sidebar-card-hover',
+        isActiveSurface && isMultiSelected && 'ring-1 ring-worktree-sidebar-ring/35',
+        revealHighlight && [
+          'scroll-to-current-workspace-reveal-highlight',
+          revealHighlightTone === 'ai' && 'scroll-to-current-workspace-reveal-highlight--ai'
+        ],
+        titleRenaming && '!border-transparent !bg-transparent !shadow-none !ring-0',
+        isDeleting && 'opacity-50 grayscale cursor-not-allowed',
+        // Why: no SSH dim — the inline host control now states the disconnected state
+        // explicitly, and a subtree opacity would composite its destructive tint and spinner
+        // down to an illegible alpha (a descendant cannot escape an ancestor's opacity).
+        isRuntimeDisconnected && !isDeleting && 'opacity-60'
+      )}
+      data-worktree-card-surface="true"
+      data-worktree-card-active={isActiveSurface ? activeSurfaceVariant : undefined}
+      onClick={handleClick}
+      onDoubleClick={affiliateListMode ? undefined : handleDoubleClick}
+      draggable={!affiliateListMode && nativeDragEnabled && !isDeleting && !titleRenaming}
+      onDragStart={!affiliateListMode && nativeDragEnabled ? handleDragStart : undefined}
+      onDragEnd={!affiliateListMode && nativeDragEnabled ? handleDragEnd : undefined}
+      aria-busy={isDeleting}
+      style={cardStyle}
+    >
+      {isDeleting && (
+        <div className="absolute inset-0 z-10 flex items-center justify-center rounded-lg bg-background/50 backdrop-blur-[1px]">
+          <div className="inline-flex items-center gap-1.5 rounded-full bg-background px-3 py-1 text-[11px] font-medium text-foreground shadow-sm border border-border/50">
+            {!isQueuedForDeletion ? (
+              <LoaderCircle className="size-3.5 animate-spin text-muted-foreground" />
+            ) : null}
+            {deleteLabel}
+          </div>
+        </div>
+      )}
+      {parentCardBodyWithHoverDetails}
+
+      {newCardStyle && lineageChildren ? (
+        <div
+          className="mt-1.5 space-y-1"
+          data-worktree-lineage-children=""
+          style={lineageChildrenStyle}
+        >
+          {lineageChildren}
+        </div>
+      ) : null}
+    </div>
+  )
+
+  return (
+    <>
+      {affiliateListMode ? (
+        cardBody
+      ) : (
+        <WorktreeContextMenu
+          worktree={worktree}
+          selectedWorktrees={selectedWorktrees}
+          onContextMenuSelect={handleContextMenuSelect}
+          onAssignWorkspaceStatus={onAssignWorkspaceStatus}
+        >
+          {cardBody}
+        </WorktreeContextMenu>
+      )}
+
+      {typeof worktree.firstAgentMessageRenameError === 'string' &&
+        worktree.firstAgentMessageRenameError.length > 0 && (
+          <AutoRenameFailedDialog
+            open={showRenameErrorDialog}
+            onOpenChange={setShowRenameErrorDialog}
+            worktreeId={worktree.id}
+            worktreeName={worktree.displayName}
+            error={worktree.firstAgentMessageRenameError}
+          />
+        )}
+    </>
+  )
+}
diff --git a/src/renderer/src/components/sidebar/worktree-context-menu-delete-intent.test.ts b/src/renderer/src/components/sidebar/worktree-context-menu-delete-intent.test.ts
new file mode 100644
index 00000000000..20d28499be9
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-context-menu-delete-intent.test.ts
@@ -0,0 +1,76 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ runDelete: vi.fn(), runBatchDelete: vi.fn() }))
+
+vi.mock('@/store', () => ({ useAppStore: { getState: vi.fn() } }))
+vi.mock('./delete-worktree-flow', () => ({
+  runWorktreeDelete: mocks.runDelete,
+  runWorktreeBatchDelete: mocks.runBatchDelete
+}))
+
+import { deferWorktreeContextMenuDeleteIntent } from './worktree-context-menu-delete-intent'
+
+describe('deferWorktreeContextMenuDeleteIntent', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    vi.unstubAllGlobals()
+  })
+
+  it('dispatches the selected workspace identity after the menu event completes', () => {
+    const defer = vi.fn<(callback: () => void) => void>()
+    const intent = {
+      kind: 'worktree' as const,
+      worktree: { id: 'repo::/work/wt', instanceId: 'instance-1' }
+    }
+    const onDispatched = vi.fn()
+
+    deferWorktreeContextMenuDeleteIntent(intent, onDispatched, defer)
+
+    expect(mocks.runDelete).not.toHaveBeenCalled()
+    expect(onDispatched).not.toHaveBeenCalled()
+    expect(defer).toHaveBeenCalledOnce()
+
+    const [deferred] = defer.mock.calls[0]
+    deferred()
+
+    expect(mocks.runDelete).toHaveBeenCalledWith('repo::/work/wt', {
+      expectedInstanceId: 'instance-1'
+    })
+    expect(onDispatched).toHaveBeenCalledOnce()
+  })
+
+  it('preserves every selected workspace identity for batch validation', () => {
+    const intent = {
+      kind: 'batch' as const,
+      worktrees: [
+        { id: 'wt-1', instanceId: 'instance-1' },
+        { id: 'wt-2', instanceId: 'instance-2' }
+      ]
+    }
+
+    deferWorktreeContextMenuDeleteIntent(intent, undefined, (callback) => callback())
+
+    expect(mocks.runBatchDelete).toHaveBeenCalledWith(intent.worktrees)
+  })
+
+  it('dispatches on the next macrotask by default', () => {
+    vi.useFakeTimers()
+    vi.stubGlobal('window', { setTimeout })
+    const intent = {
+      kind: 'worktree' as const,
+      worktree: { id: 'wt-1', instanceId: 'instance-1' }
+    }
+
+    deferWorktreeContextMenuDeleteIntent(intent)
+
+    expect(mocks.runDelete).not.toHaveBeenCalled()
+    vi.runAllTimers()
+    expect(mocks.runDelete).toHaveBeenCalledWith('wt-1', {
+      expectedInstanceId: 'instance-1'
+    })
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-context-menu-delete-intent.ts b/src/renderer/src/components/sidebar/worktree-context-menu-delete-intent.ts
new file mode 100644
index 00000000000..7662af6d247
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-context-menu-delete-intent.ts
@@ -0,0 +1,38 @@
+import { useAppStore } from '@/store'
+import { folderWorkspaceKey } from '../../../../shared/workspace-scope'
+import { runWorktreeBatchDelete, runWorktreeDelete } from './delete-worktree-flow'
+import type { WorktreeDeleteIdentity } from './worktree-delete-request'
+
+export type WorktreeContextMenuDeleteIntent =
+  | { kind: 'worktree'; worktree: WorktreeDeleteIdentity }
+  | { kind: 'batch'; worktrees: readonly WorktreeDeleteIdentity[] }
+  | { kind: 'folder'; folderWorkspaceId: string }
+
+export function runWorktreeContextMenuDeleteIntent(intent: WorktreeContextMenuDeleteIntent): void {
+  if (intent.kind === 'batch') {
+    runWorktreeBatchDelete(intent.worktrees)
+    return
+  }
+  if (intent.kind === 'worktree') {
+    runWorktreeDelete(intent.worktree.id, { expectedInstanceId: intent.worktree.instanceId })
+    return
+  }
+  const state = useAppStore.getState()
+  void state.deleteFolderWorkspace(intent.folderWorkspaceId).then((deleted) => {
+    const current = useAppStore.getState()
+    if (deleted && current.activeWorktreeId === folderWorkspaceKey(intent.folderWorkspaceId)) {
+      current.setActiveWorktree(null)
+    }
+  })
+}
+
+export function deferWorktreeContextMenuDeleteIntent(
+  intent: WorktreeContextMenuDeleteIntent,
+  onDispatched?: () => void,
+  defer: (callback: () => void) => void = (callback) => window.setTimeout(callback, 0)
+): void {
+  defer(() => {
+    runWorktreeContextMenuDeleteIntent(intent)
+    onDispatched?.()
+  })
+}
diff --git a/src/renderer/src/components/sidebar/worktree-delete-execution.ts b/src/renderer/src/components/sidebar/worktree-delete-execution.ts
new file mode 100644
index 00000000000..889587306d0
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-delete-execution.ts
@@ -0,0 +1,226 @@
+import { toast } from 'sonner'
+import { useAppStore } from '@/store'
+import { getWorktreeMapFromState } from '@/store/selectors'
+import { activateAndRevealWorktree } from '@/lib/worktree-activation'
+import { translate } from '@/i18n/i18n'
+import {
+  isPathInsideOrEqual,
+  normalizeRuntimePathForComparison
+} from '../../../../shared/cross-platform-path'
+import type { Worktree } from '../../../../shared/types'
+import { prepareActiveWorktreeFocusAfterDelete } from './active-worktree-focus-after-delete'
+import { showDeleteWorktreeFailureToast } from './delete-worktree-failure-toast'
+import { showWorkspaceListChangedToast } from './stale-workspace-list-toast'
+import { showPreservedBranchBatchToast } from './preserved-branch-batch-toast'
+import type { PreservedBranchCleanup } from '@/lib/preserved-branch-cleanup'
+import type { WorktreeDeleteWithToastOptions } from './worktree-delete-request'
+
+// A failed delete usually means unresolved changes, so land on the diff panel.
+function viewWorktreeDiff(worktreeId: string): void {
+  activateAndRevealWorktree(worktreeId)
+  const state = useAppStore.getState()
+  state.setRightSidebarTab('source-control')
+  state.setRightSidebarOpen(true)
+}
+
+function isStrictDescendantPath(parentPath: string, childPath: string): boolean {
+  return (
+    normalizeRuntimePathForComparison(parentPath) !==
+      normalizeRuntimePathForComparison(childPath) && isPathInsideOrEqual(parentPath, childPath)
+  )
+}
+
+export async function runWorktreeDeletesInParallel(
+  targets: readonly Pick<Worktree, 'id' | 'instanceId' | 'displayName' | 'repoId' | 'path'>[],
+  options: WorktreeDeleteWithToastOptions = {}
+): Promise<string[]> {
+  // A destructive command must run once per identity even if a refresh duplicated rows.
+  const uniqueTargets = Array.from(new Map(targets.map((target) => [target.id, target])).values())
+  // Batch focus is committed once after every target settles.
+  const activeWorktreeIdBefore = useAppStore.getState().activeWorktreeId
+  const commitBatchFocus = activeWorktreeIdBefore
+    ? prepareActiveWorktreeFocusAfterDelete(activeWorktreeIdBefore)
+    : null
+  // Mark all targets up front so the sidebar shows immediate progress.
+  useAppStore.getState().markWorktreesDeleting(uniqueTargets.map((target) => target.id))
+  // Git worktree removal shares repo locks, while separate repos can proceed in parallel.
+  const groups = new Map<string, (typeof uniqueTargets)[number][]>()
+  for (const target of uniqueTargets) {
+    const group = groups.get(target.repoId)
+    if (group) {
+      group.push(target)
+    } else {
+      groups.set(target.repoId, [target])
+    }
+  }
+  for (const group of groups.values()) {
+    // Children must leave first or Git rejects their registered ancestor.
+    group.sort((a, b) => b.path.length - a.path.length)
+  }
+  const preservedBranches: PreservedBranchCleanup[] = []
+  const aggregatePreservedBranches = uniqueTargets.length > 1
+  let listChanged = false
+  const groupResults = await Promise.all(
+    Array.from(groups.values()).map(async (group) => {
+      const deletedInGroup: string[] = []
+      const failedInGroup: (typeof group)[number][] = []
+      for (const target of group) {
+        // A queued target may be recreated while an earlier repo sibling is deleting.
+        const currentTarget = getWorktreeMapFromState(useAppStore.getState()).get(target.id)
+        if (!currentTarget || currentTarget.instanceId !== target.instanceId) {
+          useAppStore.getState().clearWorktreeDeleteState(target.id)
+          listChanged = true
+          continue
+        }
+        if (failedInGroup.some((failed) => isStrictDescendantPath(target.path, failed.path))) {
+          useAppStore.getState().clearWorktreeDeleteState(target.id)
+          continue
+        }
+        const deleted = await runWorktreeDeleteWithToast(target.id, target.displayName, {
+          ...options,
+          focusSuccessorOnDelete: false,
+          suppressPreservedBranchToast: aggregatePreservedBranches,
+          onPreservedBranch: (branch) => {
+            preservedBranches.push(branch)
+            options.onPreservedBranch?.(branch)
+          }
+        })
+        if (deleted) {
+          deletedInGroup.push(target.id)
+        } else {
+          // A failed child makes deleting its ancestor unsafe because the child lives below it.
+          failedInGroup.push(target)
+        }
+      }
+      return deletedInGroup
+    })
+  )
+  if (listChanged) {
+    showWorkspaceListChangedToast()
+  }
+  const deletedSet = new Set(groupResults.flat())
+  // Intermediate focus can spawn a terminal in another target that is still queued.
+  if (activeWorktreeIdBefore && deletedSet.has(activeWorktreeIdBefore)) {
+    commitBatchFocus?.()
+  }
+  if (aggregatePreservedBranches && preservedBranches.length > 0) {
+    const targetOrder = new Map(uniqueTargets.map((target, index) => [target.id, index]))
+    preservedBranches.sort(
+      (left, right) =>
+        (targetOrder.get(left.worktreeId) ?? Number.MAX_SAFE_INTEGER) -
+        (targetOrder.get(right.worktreeId) ?? Number.MAX_SAFE_INTEGER)
+    )
+    showPreservedBranchBatchToast(deletedSet.size, preservedBranches)
+  }
+  return uniqueTargets.filter((target) => deletedSet.has(target.id)).map((target) => target.id)
+}
+
+/** Shared confirmed and skip-confirm execution with consistent failure recovery. */
+export function runWorktreeDeleteWithToast(
+  worktreeId: string,
+  worktreeName: string,
+  options: WorktreeDeleteWithToastOptions = {}
+): Promise<boolean> {
+  const removeWorktree = useAppStore.getState().removeWorktree
+  const commitFocus = prepareActiveWorktreeFocusAfterDelete(worktreeId)
+  const focusSuccessor = options.focusSuccessorOnDelete !== false
+
+  const removal = options.suppressPreservedBranchToast
+    ? removeWorktree(worktreeId, options.force === true, { suppressPreservedBranchToast: true })
+    : removeWorktree(worktreeId, options.force === true)
+  return removal
+    .then((result) => {
+      if (result.ok) {
+        if (result.preservedBranch) {
+          options.onPreservedBranch?.({
+            worktreeId,
+            branchName: result.preservedBranch.branchName,
+            expectedHead: result.preservedBranch.head,
+            ...(result.preservedBranch.hostId ? { hostId: result.preservedBranch.hostId } : {}),
+            ...(result.preservedBranch.runtimeEnvironmentId
+              ? { runtimeEnvironmentId: result.preservedBranch.runtimeEnvironmentId }
+              : {})
+          })
+        }
+        if (focusSuccessor) {
+          commitFocus()
+        }
+        return true
+      }
+      const state = useAppStore.getState().deleteStateByWorktreeId[worktreeId]
+      const canForceDelete = state?.canForceDelete ?? false
+      const hasKnownChanges =
+        (useAppStore.getState().gitStatusByWorktree[worktreeId]?.length ?? 0) > 0
+      showDeleteWorktreeFailureToast({
+        error: result.error,
+        canForceDelete,
+        forceDeleteReason: state?.forceDeleteReason ?? null,
+        lockReason: state?.lockReason ?? null,
+        hasKnownChanges,
+        onViewChanges: () => viewWorktreeDiff(worktreeId),
+        onForceDelete: () => {
+          // Recapture focus because the user may have navigated while the toast was open.
+          const commitForceFocus = prepareActiveWorktreeFocusAfterDelete(worktreeId)
+          // The explicit Force Delete retry may waive an unverified PTY-stop proof.
+          const forceRemoval = useAppStore
+            .getState()
+            .removeWorktree(worktreeId, true, { allowUnverifiedPtyStop: true })
+          forceRemoval
+            .then((forceResult) => {
+              if (!forceResult.ok) {
+                toast.error(
+                  translate(
+                    'auto.components.sidebar.delete.worktree.flow.4f3876c0f5',
+                    'Force delete failed'
+                  ),
+                  {
+                    description: forceResult.error,
+                    action: {
+                      label: translate(
+                        'auto.components.sidebar.delete.worktree.flow.7488ed8711',
+                        'View'
+                      ),
+                      onClick: () => viewWorktreeDiff(worktreeId)
+                    }
+                  }
+                )
+                return
+              }
+              commitForceFocus()
+              options.onForceDeleted?.(worktreeId)
+            })
+            .catch((err: unknown) => {
+              toast.error(
+                translate(
+                  'auto.components.sidebar.delete.worktree.flow.ae57cbf6e4',
+                  'Failed to delete workspace'
+                ),
+                {
+                  description: err instanceof Error ? err.message : String(err),
+                  action: {
+                    label: translate(
+                      'auto.components.sidebar.delete.worktree.flow.7488ed8711',
+                      'View'
+                    ),
+                    onClick: () => viewWorktreeDiff(worktreeId)
+                  }
+                }
+              )
+            })
+        },
+        worktreeId,
+        worktreeName
+      })
+      return false
+    })
+    .catch((err: unknown) => {
+      toast.error(
+        translate(
+          'auto.components.sidebar.delete.worktree.flow.ae57cbf6e4',
+          'Failed to delete workspace'
+        ),
+        { description: err instanceof Error ? err.message : String(err) }
+      )
+      return false
+    })
+}
diff --git a/src/renderer/src/components/sidebar/worktree-delete-request.ts b/src/renderer/src/components/sidebar/worktree-delete-request.ts
new file mode 100644
index 00000000000..71ef9e87cda
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-delete-request.ts
@@ -0,0 +1,68 @@
+import type { Worktree } from '../../../../shared/types'
+import type { PreservedBranchCleanup } from '@/lib/preserved-branch-cleanup'
+
+export type WorktreeBatchDeleteOptions = {
+  forceConfirm?: boolean
+  onDeleted?: (worktreeIds: string[]) => void
+}
+
+export type WorktreeDeleteIdentity = Pick<Worktree, 'id' | 'instanceId'>
+
+export type WorktreeDeleteOptions = {
+  expectedInstanceId?: string
+}
+
+export type WorktreeDeleteWithToastOptions = {
+  force?: boolean
+  onForceDeleted?: (worktreeId: string) => void
+  onPreservedBranch?: (branch: PreservedBranchCleanup) => void
+  suppressPreservedBranchToast?: boolean
+  // Batch deletion commits one focus handoff after all targets settle.
+  focusSuccessorOnDelete?: boolean
+}
+
+export function toWorktreeDeleteIdentities(
+  worktrees: readonly Pick<Worktree, 'id' | 'instanceId'>[]
+): WorktreeDeleteIdentity[] {
+  return worktrees.map(({ id, instanceId }) => ({ id, instanceId }))
+}
+
+export function resolveWorktreeBatchDeleteTargets(
+  requestedWorktrees: readonly string[] | readonly WorktreeDeleteIdentity[],
+  worktreeMap: ReadonlyMap<string, Worktree>
+): Worktree[] | null {
+  const uniqueRequests = Array.from(
+    new Map(
+      requestedWorktrees.map(
+        (request) => [typeof request === 'string' ? request : request.id, request] as const
+      )
+    ).values()
+  )
+  const targets: Worktree[] = []
+  for (const request of uniqueRequests) {
+    const worktreeId = typeof request === 'string' ? request : request.id
+    const target = worktreeMap.get(worktreeId) ?? null
+    if (typeof request !== 'string' && (!target || target.instanceId !== request.instanceId)) {
+      return null
+    }
+    if (target && !target.isMainWorktree) {
+      targets.push(target)
+    }
+  }
+  return targets
+}
+
+export function readWorktreeDeleteIdentities(value: unknown): WorktreeDeleteIdentity[] {
+  if (!Array.isArray(value)) {
+    return []
+  }
+  return value.flatMap((entry) => {
+    if (!entry || typeof entry !== 'object' || !('id' in entry) || typeof entry.id !== 'string') {
+      return []
+    }
+    const instanceId = 'instanceId' in entry ? entry.instanceId : undefined
+    return instanceId === undefined || typeof instanceId === 'string'
+      ? [{ id: entry.id, instanceId }]
+      : []
+  })
+}
diff --git a/src/renderer/src/components/sidebar/worktree-lineage-projection.ts b/src/renderer/src/components/sidebar/worktree-lineage-projection.ts
index 38c8584c064..040a40eb737 100644
--- a/src/renderer/src/components/sidebar/worktree-lineage-projection.ts
+++ b/src/renderer/src/components/sidebar/worktree-lineage-projection.ts
@@ -15,7 +15,7 @@ export function getProjectedWorktreeLineage(
   worktree: Worktree,
   lineageById: Readonly<Record<string, WorktreeLineage>>
 ): WorktreeLineage | null | undefined {
-  if (Object.prototype.hasOwnProperty.call(lineageById, worktree.id)) {
+  if (Object.hasOwn(lineageById, worktree.id)) {
     return lineageById[worktree.id]
   }
   return (worktree as WorktreeWithResolvedLineage).lineage
diff --git a/src/renderer/src/components/sidebar/worktree-list-groups.ts b/src/renderer/src/components/sidebar/worktree-list-groups.ts
index 777e9fcfbe6..a154eea8263 100644
--- a/src/renderer/src/components/sidebar/worktree-list-groups.ts
+++ b/src/renderer/src/components/sidebar/worktree-list-groups.ts
@@ -1006,9 +1006,7 @@ export function buildRows(
   workspaceStatuses: readonly WorkspaceStatusDefinition[] = cloneDefaultWorkspaceStatuses(),
   projectOrderBy: ProjectOrderBy = 'manual',
   lineageById: Record<string, WorktreeLineage> = {},
-  worktreeMap: Map<string, Worktree> = new Map(
-    worktrees.map((worktree) => [worktree.id, worktree])
-  ),
+  worktreeMap = new Map<string, Worktree>(worktrees.map((worktree) => [worktree.id, worktree])),
   nestLineage = false,
   settings?: AppState['settings'],
   projectGroups: readonly ProjectGroup[] = [],
diff --git a/src/renderer/src/components/sidebar/worktree-list-hard-scroll-up.test.ts b/src/renderer/src/components/sidebar/worktree-list-hard-scroll-up.test.ts
new file mode 100644
index 00000000000..c3a51731e52
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-list-hard-scroll-up.test.ts
@@ -0,0 +1,262 @@
+import { describe, expect, it } from 'vitest'
+import {
+  createHardScrollUpDetectorState,
+  HARD_SCROLL_UP,
+  normalizeWheelDeltaY,
+  reduceHardScrollUpOnDismiss,
+  reduceHardScrollUpOnIdle,
+  reduceHardScrollUpOnScroll,
+  reduceHardScrollUpOnWheel
+} from './worktree-list-hard-scroll-up'
+
+const DEEP = {
+  scrollTop: 1200,
+  maxScroll: 4000
+} as const
+
+const SHORT_LIST = {
+  scrollTop: 200,
+  maxScroll: 200
+} as const
+
+describe('normalizeWheelDeltaY', () => {
+  it('keeps pixel mode and expands line/page modes', () => {
+    expect(normalizeWheelDeltaY(-40, 0)).toBe(-40)
+    expect(normalizeWheelDeltaY(-3, 1)).toBe(-48)
+    expect(normalizeWheelDeltaY(-1, 2)).toBe(-600)
+  })
+})
+
+describe('reduceHardScrollUpOnWheel', () => {
+  it('stays hidden for short lists and near-top viewports', () => {
+    let state = createHardScrollUpDetectorState()
+    for (let i = 0; i < 10; i += 1) {
+      state = reduceHardScrollUpOnWheel(state, {
+        ...SHORT_LIST,
+        t: i * 16,
+        deltaY: -120
+      })
+    }
+    expect(state.visible).toBe(false)
+
+    state = createHardScrollUpDetectorState()
+    for (let i = 0; i < 10; i += 1) {
+      state = reduceHardScrollUpOnWheel(state, {
+        scrollTop: 20,
+        maxScroll: 4000,
+        t: i * 16,
+        deltaY: -120
+      })
+    }
+    expect(state.visible).toBe(false)
+  })
+
+  it('does not show on gentle upward scrolling', () => {
+    let state = createHardScrollUpDetectorState()
+    // Small trackpad ticks — effort exists but is not "hard".
+    for (let i = 0; i < 8; i += 1) {
+      state = reduceHardScrollUpOnWheel(state, {
+        ...DEEP,
+        t: i * 40,
+        deltaY: -18
+      })
+    }
+    expect(state.visible).toBe(false)
+  })
+
+  it('shows after a sustained hard upward wheel burst', () => {
+    let state = createHardScrollUpDetectorState()
+    // ~5 hard ticks in < window: 5 * 160 = 800 >= hardTotalDeltaPx
+    for (let i = 0; i < 5; i += 1) {
+      state = reduceHardScrollUpOnWheel(state, {
+        ...DEEP,
+        scrollTop: DEEP.scrollTop - i * 40,
+        t: 1000 + i * 40,
+        deltaY: -160
+      })
+    }
+    expect(state.visible).toBe(true)
+    expect(state.lastIntentAt).toBe(1000 + 4 * 40)
+  })
+
+  it('shows after a trackpad fling (high peak + enough total)', () => {
+    let state = createHardScrollUpDetectorState()
+    const deltas = [-40, -120, -200, -80]
+    deltas.forEach((deltaY, i) => {
+      state = reduceHardScrollUpOnWheel(state, {
+        ...DEEP,
+        t: 2000 + i * 30,
+        deltaY
+      })
+    })
+    expect(state.visible).toBe(true)
+  })
+
+  it('hides on significant downward scroll', () => {
+    let state = createHardScrollUpDetectorState()
+    for (let i = 0; i < 5; i += 1) {
+      state = reduceHardScrollUpOnWheel(state, {
+        ...DEEP,
+        t: i * 40,
+        deltaY: -160
+      })
+    }
+    expect(state.visible).toBe(true)
+
+    state = reduceHardScrollUpOnWheel(state, {
+      ...DEEP,
+      t: 500,
+      deltaY: 80
+    })
+    expect(state.visible).toBe(false)
+    expect(state.wheelSamples).toEqual([])
+    expect(state.scrollSamples).toEqual([])
+  })
+
+  it('hides after cumulative small downward wheel events', () => {
+    let state = createHardScrollUpDetectorState()
+    for (let i = 0; i < 5; i += 1) {
+      state = reduceHardScrollUpOnWheel(state, {
+        ...DEEP,
+        t: i * 40,
+        deltaY: -160
+      })
+    }
+
+    state = reduceHardScrollUpOnWheel(state, { ...DEEP, t: 220, deltaY: 20 })
+    state = reduceHardScrollUpOnWheel(state, { ...DEEP, t: 260, deltaY: 20 })
+    expect(state.visible).toBe(true)
+    expect(state.lastIntentAt).toBe(160)
+
+    state = reduceHardScrollUpOnWheel(state, { ...DEEP, t: 300, deltaY: 20 })
+    expect(state).toEqual(createHardScrollUpDetectorState())
+  })
+
+  it('clears when the user reaches the top', () => {
+    let state = createHardScrollUpDetectorState()
+    for (let i = 0; i < 5; i += 1) {
+      state = reduceHardScrollUpOnWheel(state, {
+        ...DEEP,
+        t: i * 40,
+        deltaY: -160
+      })
+    }
+    expect(state.visible).toBe(true)
+
+    state = reduceHardScrollUpOnWheel(state, {
+      scrollTop: 10,
+      maxScroll: 4000,
+      t: 400,
+      deltaY: -20
+    })
+    expect(state.visible).toBe(false)
+  })
+})
+
+describe('reduceHardScrollUpOnScroll', () => {
+  it('shows when scrollbar drag velocity is hard upward', () => {
+    let state = createHardScrollUpDetectorState()
+    // Drop 500px in 250ms => 2000 px/s
+    state = reduceHardScrollUpOnScroll(state, {
+      scrollTop: 1500,
+      maxScroll: 4000,
+      t: 0
+    })
+    state = reduceHardScrollUpOnScroll(state, {
+      scrollTop: 1000,
+      maxScroll: 4000,
+      t: HARD_SCROLL_UP.velocitySustainMs + 90
+    })
+    expect(state.visible).toBe(true)
+  })
+
+  it('ignores slow scrollbar movement', () => {
+    let state = createHardScrollUpDetectorState()
+    state = reduceHardScrollUpOnScroll(state, {
+      scrollTop: 1500,
+      maxScroll: 4000,
+      t: 0
+    })
+    state = reduceHardScrollUpOnScroll(state, {
+      scrollTop: 1450,
+      maxScroll: 4000,
+      t: 300
+    })
+    expect(state.visible).toBe(false)
+  })
+
+  it('hides after cumulative small downward scrollbar movement', () => {
+    let state = createHardScrollUpDetectorState()
+    state = reduceHardScrollUpOnScroll(state, { ...DEEP, scrollTop: 1500, t: 0 })
+    state = reduceHardScrollUpOnScroll(state, { ...DEEP, scrollTop: 1000, t: 250 })
+    expect(state.visible).toBe(true)
+
+    state = reduceHardScrollUpOnScroll(state, { ...DEEP, scrollTop: 1020, t: 280 })
+    state = reduceHardScrollUpOnScroll(state, { ...DEEP, scrollTop: 1040, t: 310 })
+    expect(state.visible).toBe(true)
+    expect(state.lastIntentAt).toBe(250)
+
+    state = reduceHardScrollUpOnScroll(state, { ...DEEP, scrollTop: 1060, t: 340 })
+    expect(state).toEqual(createHardScrollUpDetectorState())
+  })
+})
+
+describe('reduceHardScrollUpOnIdle / dismiss', () => {
+  it('auto-hides after idle while still deep', () => {
+    let state = createHardScrollUpDetectorState()
+    for (let i = 0; i < 5; i += 1) {
+      state = reduceHardScrollUpOnWheel(state, {
+        ...DEEP,
+        t: i * 40,
+        deltaY: -160
+      })
+    }
+    expect(state.visible).toBe(true)
+
+    state = reduceHardScrollUpOnIdle(state, {
+      ...DEEP,
+      t: state.lastIntentAt + HARD_SCROLL_UP.hideAfterIdleMs - 1
+    })
+    expect(state.visible).toBe(true)
+
+    state = reduceHardScrollUpOnIdle(state, {
+      ...DEEP,
+      t: state.lastIntentAt + HARD_SCROLL_UP.hideAfterIdleMs
+    })
+    expect(state.visible).toBe(false)
+  })
+
+  it('hides on later non-intent scroll after the idle deadline (scroll spam must not extend)', () => {
+    let state = createHardScrollUpDetectorState()
+    for (let i = 0; i < 5; i += 1) {
+      state = reduceHardScrollUpOnWheel(state, {
+        ...DEEP,
+        t: 1000 + i * 40,
+        deltaY: -160
+      })
+    }
+    const intentAt = state.lastIntentAt
+    expect(state.visible).toBe(true)
+
+    // Tiny non-intent scrolls after the deadline must still clear visibility.
+    state = reduceHardScrollUpOnScroll(state, {
+      scrollTop: DEEP.scrollTop - 2,
+      maxScroll: DEEP.maxScroll,
+      t: intentAt + HARD_SCROLL_UP.hideAfterIdleMs + 10
+    })
+    expect(state.visible).toBe(false)
+  })
+
+  it('dismiss resets state', () => {
+    let state = createHardScrollUpDetectorState()
+    for (let i = 0; i < 5; i += 1) {
+      state = reduceHardScrollUpOnWheel(state, {
+        ...DEEP,
+        t: i * 40,
+        deltaY: -160
+      })
+    }
+    state = reduceHardScrollUpOnDismiss(state)
+    expect(state).toEqual(createHardScrollUpDetectorState())
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-list-hard-scroll-up.ts b/src/renderer/src/components/sidebar/worktree-list-hard-scroll-up.ts
new file mode 100644
index 00000000000..7db5b88dc09
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-list-hard-scroll-up.ts
@@ -0,0 +1,338 @@
+/**
+ * Detects intentional "hard scroll up" on a long worktree list so we can offer
+ * a jump-to-top control. Tuned for trackpad wheel streams and scrollbar drags.
+ */
+
+export const HARD_SCROLL_UP = {
+  /** Only samples inside this window contribute to intent. */
+  windowMs: 480,
+  /** List must be scrollable by at least this much. */
+  minScrollablePx: 480,
+  /** Must be at least this far from the top before the button can appear. */
+  minDepthPx: 280,
+  /** Hide once the viewport is this close to the top. */
+  nearTopPx: 56,
+  /** Minimum upward wheel samples in the window. */
+  minUpEvents: 3,
+  /** Accumulated |deltaY| (px) for a sustained hard-up gesture. */
+  hardTotalDeltaPx: 720,
+  /** Peak single-sample |deltaY| that marks a fling/burst. */
+  burstPeakDeltaPx: 90,
+  /** Accumulated |deltaY| paired with a burst peak. */
+  burstTotalDeltaPx: 320,
+  /** Scroll-position velocity (px/s upward) that counts as hard drag/fling. */
+  hardVelocityPxPerSec: 1600,
+  /** How long hard velocity must be sustained. */
+  velocitySustainMs: 160,
+  /** Clear intent after idle so the button does not linger forever. */
+  hideAfterIdleMs: 2600,
+  /** Significant down-scroll cancels upward intent. */
+  significantDownDeltaPx: 48,
+  /** Cap stored samples so long sessions stay cheap. */
+  maxSamples: 32,
+  /** Ignore scroll input this long after a programmatic jump to top. */
+  suppressAfterJumpMs: 120
+} as const
+
+export type HardScrollUpWheelSample = {
+  t: number
+  /** Positive = toward top (up). Normalized to CSS pixels. */
+  upDeltaPx: number
+}
+
+export type HardScrollUpScrollSample = {
+  t: number
+  scrollTop: number
+}
+
+export type HardScrollUpDetectorState = {
+  // Why: wheel + scroll both fire for the same gesture; keep them separate so
+  // wheel magnitude is not double-counted with scrollTop deltas.
+  wheelSamples: HardScrollUpWheelSample[]
+  scrollSamples: HardScrollUpScrollSample[]
+  wheelDownDeltaPx: number
+  scrollDownDeltaPx: number
+  visible: boolean
+  lastIntentAt: number
+}
+
+export type HardScrollUpViewport = {
+  scrollTop: number
+  maxScroll: number
+  t: number
+}
+
+export function createHardScrollUpDetectorState(): HardScrollUpDetectorState {
+  return {
+    wheelSamples: [],
+    scrollSamples: [],
+    wheelDownDeltaPx: 0,
+    scrollDownDeltaPx: 0,
+    visible: false,
+    lastIntentAt: 0
+  }
+}
+
+export function normalizeWheelDeltaY(deltaY: number, deltaMode: number): number {
+  // WheelEvent.DOM_DELTA_LINE / DOM_DELTA_PAGE — convert to approximate CSS px.
+  if (deltaMode === 1) {
+    return deltaY * 16
+  }
+  if (deltaMode === 2) {
+    return deltaY * 600
+  }
+  return deltaY
+}
+
+function pruneByTime<T extends { t: number }>(samples: readonly T[], t: number): T[] {
+  const cutoff = t - HARD_SCROLL_UP.windowMs
+  const pruned = samples.filter((sample) => sample.t >= cutoff)
+  if (pruned.length <= HARD_SCROLL_UP.maxSamples) {
+    return pruned
+  }
+  return pruned.slice(pruned.length - HARD_SCROLL_UP.maxSamples)
+}
+
+function isListLongEnough(maxScroll: number): boolean {
+  return maxScroll >= HARD_SCROLL_UP.minScrollablePx
+}
+
+function isDeepEnough(scrollTop: number): boolean {
+  return scrollTop >= HARD_SCROLL_UP.minDepthPx
+}
+
+function isNearTop(scrollTop: number): boolean {
+  return scrollTop <= HARD_SCROLL_UP.nearTopPx
+}
+
+function computeWheelIntent(samples: readonly HardScrollUpWheelSample[]): boolean {
+  const upSamples = samples.filter((sample) => sample.upDeltaPx > 0)
+  if (upSamples.length < HARD_SCROLL_UP.minUpEvents) {
+    return false
+  }
+
+  let totalUp = 0
+  let peakUp = 0
+  for (const sample of upSamples) {
+    totalUp += sample.upDeltaPx
+    if (sample.upDeltaPx > peakUp) {
+      peakUp = sample.upDeltaPx
+    }
+  }
+
+  if (totalUp >= HARD_SCROLL_UP.hardTotalDeltaPx) {
+    return true
+  }
+
+  return peakUp >= HARD_SCROLL_UP.burstPeakDeltaPx && totalUp >= HARD_SCROLL_UP.burstTotalDeltaPx
+}
+
+function computeVelocityIntent(samples: readonly HardScrollUpScrollSample[], t: number): boolean {
+  if (samples.length < 2) {
+    return false
+  }
+
+  const newest = samples.at(-1)
+  if (!newest || t - newest.t > HARD_SCROLL_UP.velocitySustainMs) {
+    return false
+  }
+
+  // Walk backward to the oldest sample still inside the window, then measure
+  // average upward velocity across that span.
+  let oldest = newest
+  for (let i = samples.length - 2; i >= 0; i -= 1) {
+    const sample = samples.at(i)
+    if (!sample) {
+      continue
+    }
+    if (newest.t - sample.t > HARD_SCROLL_UP.windowMs) {
+      break
+    }
+    oldest = sample
+  }
+
+  const elapsedMs = newest.t - oldest.t
+  if (elapsedMs < HARD_SCROLL_UP.velocitySustainMs) {
+    return false
+  }
+
+  const upwardPx = oldest.scrollTop - newest.scrollTop
+  if (upwardPx <= 0) {
+    return false
+  }
+
+  const velocity = (upwardPx / elapsedMs) * 1000
+  return velocity >= HARD_SCROLL_UP.hardVelocityPxPerSec
+}
+
+function withVisibility(
+  state: HardScrollUpDetectorState,
+  { t, scrollTop, maxScroll, intent }: HardScrollUpViewport & { intent: boolean }
+): HardScrollUpDetectorState {
+  if (!isListLongEnough(maxScroll) || isNearTop(scrollTop)) {
+    if (
+      !state.visible &&
+      state.wheelSamples.length === 0 &&
+      state.scrollSamples.length === 0 &&
+      state.wheelDownDeltaPx === 0 &&
+      state.scrollDownDeltaPx === 0 &&
+      state.lastIntentAt === 0
+    ) {
+      return state
+    }
+    return createHardScrollUpDetectorState()
+  }
+
+  if (intent && isDeepEnough(scrollTop)) {
+    return {
+      ...state,
+      visible: true,
+      lastIntentAt: t
+    }
+  }
+
+  // Why: hide on the deadline itself even if only non-intent scroll noise arrives;
+  // the hook also arms a timer, but event-driven hide must not depend on timer re-arms.
+  if (state.visible && t - state.lastIntentAt >= HARD_SCROLL_UP.hideAfterIdleMs) {
+    return createHardScrollUpDetectorState()
+  }
+
+  return state
+}
+
+/**
+ * Ingest a wheel event. `deltaY` follows the browser convention (negative = up).
+ */
+export function reduceHardScrollUpOnWheel(
+  state: HardScrollUpDetectorState,
+  {
+    deltaY,
+    deltaMode = 0,
+    scrollTop,
+    maxScroll,
+    t
+  }: HardScrollUpViewport & { deltaY: number; deltaMode?: number }
+): HardScrollUpDetectorState {
+  if (!isListLongEnough(maxScroll)) {
+    return createHardScrollUpDetectorState()
+  }
+
+  if (isNearTop(scrollTop)) {
+    return withVisibility(state, { t, scrollTop, maxScroll, intent: false })
+  }
+
+  const pixelDeltaY = normalizeWheelDeltaY(deltaY, deltaMode)
+  // Browser: negative deltaY = scroll up (content moves down, viewport toward top).
+  const upDeltaPx = -pixelDeltaY
+  const wheelDownDeltaPx =
+    upDeltaPx < 0
+      ? state.wheelDownDeltaPx + Math.abs(upDeltaPx)
+      : upDeltaPx > 0
+        ? 0
+        : state.wheelDownDeltaPx
+
+  if (wheelDownDeltaPx >= HARD_SCROLL_UP.significantDownDeltaPx) {
+    return createHardScrollUpDetectorState()
+  }
+
+  const nextWheelSamples = pruneByTime(
+    upDeltaPx > 0 ? [...state.wheelSamples, { t, upDeltaPx }] : [],
+    t
+  )
+  const nextScrollSamples = pruneByTime(state.scrollSamples, t)
+
+  const intent = upDeltaPx > 0 && computeWheelIntent(nextWheelSamples)
+  return withVisibility(
+    {
+      ...state,
+      wheelSamples: nextWheelSamples,
+      scrollSamples: nextScrollSamples,
+      wheelDownDeltaPx
+    },
+    { t, scrollTop, maxScroll, intent }
+  )
+}
+
+/**
+ * Ingest a scroll position sample from an active scrollbar/touch gesture.
+ * Velocity-based; ignores tiny no-op scrolls.
+ */
+export function reduceHardScrollUpOnScroll(
+  state: HardScrollUpDetectorState,
+  { scrollTop, maxScroll, t }: HardScrollUpViewport
+): HardScrollUpDetectorState {
+  if (!isListLongEnough(maxScroll)) {
+    return createHardScrollUpDetectorState()
+  }
+
+  if (isNearTop(scrollTop)) {
+    return withVisibility(state, { t, scrollTop, maxScroll, intent: false })
+  }
+
+  const last = state.scrollSamples.at(-1)
+  const downDeltaPx = last ? Math.max(0, scrollTop - last.scrollTop) : 0
+  const upDeltaPx = last ? Math.max(0, last.scrollTop - scrollTop) : 0
+  const scrollDownDeltaPx =
+    downDeltaPx > 0
+      ? state.scrollDownDeltaPx + downDeltaPx
+      : upDeltaPx > 0
+        ? 0
+        : state.scrollDownDeltaPx
+
+  if (scrollDownDeltaPx >= HARD_SCROLL_UP.significantDownDeltaPx) {
+    return createHardScrollUpDetectorState()
+  }
+
+  // Ignore pure no-ops so a stalled scrollbar does not pad the window.
+  if (last && last.scrollTop === scrollTop && t - last.t < 16) {
+    return withVisibility(state, {
+      t,
+      scrollTop,
+      maxScroll,
+      intent: false
+    })
+  }
+
+  const nextScrollSamples = pruneByTime(
+    [...(downDeltaPx > 0 ? [] : state.scrollSamples), { t, scrollTop }],
+    t
+  )
+  const nextWheelSamples = pruneByTime(state.wheelSamples, t)
+
+  const intent = upDeltaPx > 0 && computeVelocityIntent(nextScrollSamples, t)
+  return withVisibility(
+    {
+      ...state,
+      wheelSamples: nextWheelSamples,
+      scrollSamples: nextScrollSamples,
+      scrollDownDeltaPx
+    },
+    { t, scrollTop, maxScroll, intent }
+  )
+}
+
+/** Idle tick so the button auto-hides without requiring more input. */
+export function reduceHardScrollUpOnIdle(
+  state: HardScrollUpDetectorState,
+  { scrollTop, maxScroll, t }: HardScrollUpViewport
+): HardScrollUpDetectorState {
+  if (!state.visible) {
+    return state
+  }
+  return withVisibility(state, { t, scrollTop, maxScroll, intent: false })
+}
+
+export function reduceHardScrollUpOnDismiss(
+  state: HardScrollUpDetectorState
+): HardScrollUpDetectorState {
+  if (
+    !state.visible &&
+    state.wheelSamples.length === 0 &&
+    state.scrollSamples.length === 0 &&
+    state.wheelDownDeltaPx === 0 &&
+    state.scrollDownDeltaPx === 0
+  ) {
+    return state
+  }
+  return createHardScrollUpDetectorState()
+}
diff --git a/src/renderer/src/components/sidebar/worktree-review-helpers.test.tsx b/src/renderer/src/components/sidebar/worktree-review-helpers.test.tsx
index 7ca741d4ced..2be58e1bff5 100644
--- a/src/renderer/src/components/sidebar/worktree-review-helpers.test.tsx
+++ b/src/renderer/src/components/sidebar/worktree-review-helpers.test.tsx
@@ -44,4 +44,85 @@ describe('ReviewIcon', () => {
     expect(blocked).not.toContain('text-emerald-500/80')
     expect(blocked).not.toBe(passing)
   })
+
+  // Why: #13088 — a draft with failing checks used the same glyph as every other
+  // review and was painted red, so it was indistinguishable from a closed PR.
+  it('gives a draft its own glyph and never paints it with a check tone', () => {
+    const draft = renderToStaticMarkup(
+      <ReviewIcon
+        review={{
+          provider: 'github',
+          number: 1,
+          title: 'Draft',
+          state: 'draft',
+          status: 'failure'
+        }}
+        className="size-3"
+        variant="generic"
+      />
+    )
+    const closed = renderToStaticMarkup(
+      <ReviewIcon
+        review={{ provider: 'github', number: 1, title: 'Closed', state: 'closed' }}
+        className="size-3"
+        variant="generic"
+      />
+    )
+
+    expect(draft).toContain('lucide-git-pull-request-draft')
+    expect(draft).not.toContain('text-rose-500/85')
+    expect(closed).toContain('lucide-git-pull-request-closed')
+    expect(draft).not.toBe(closed)
+  })
+
+  it('keeps check tones on open reviews so failing checks still stand out', () => {
+    const failing = renderToStaticMarkup(
+      <ReviewIcon
+        review={{ provider: 'github', number: 1, title: 'Open', state: 'open', status: 'failure' }}
+        className="size-3"
+        variant="generic"
+      />
+    )
+
+    expect(failing).toContain('text-rose-500/85')
+  })
+
+  it('renders merged reviews with the merge glyph', () => {
+    const merged = renderToStaticMarkup(
+      <ReviewIcon
+        review={{ provider: 'github', number: 1, title: 'Merged', state: 'merged' }}
+        className="size-3"
+        variant="generic"
+      />
+    )
+
+    expect(merged).toContain('lucide-git-merge')
+  })
+
+  // Why: a closed MR used to render the merge glyph, which read as "already merged".
+  it('overrides the GitLab provider glyph for closed merge requests', () => {
+    const closed = renderToStaticMarkup(
+      <ReviewIcon review={{ ...gitlabReview, state: 'closed' }} className="size-3" />
+    )
+
+    expect(closed).toContain('lucide-git-pull-request-closed')
+    expect(closed).not.toContain('lucide-git-merge')
+  })
+
+  // Why: folder cards render a stateless row while a linked review loads or its
+  // details fail. There is no state glyph to contradict, so problems must still be
+  // visible — but a tone-less row must not be promoted to a passing green.
+  it('flags problems on a stateless row without ever claiming success', () => {
+    const stateless = (status: 'failure' | 'pending' | 'success') =>
+      renderToStaticMarkup(
+        <ReviewIcon
+          review={{ provider: 'github', number: 1, title: 'Loading PR...', status }}
+          className="size-3"
+        />
+      )
+
+    expect(stateless('failure')).toContain('text-rose-500/85')
+    expect(stateless('pending')).toContain('text-amber-500/85')
+    expect(stateless('success')).not.toContain('text-emerald-500/80')
+  })
 })
diff --git a/src/renderer/src/components/sidebar/worktree-review-helpers.tsx b/src/renderer/src/components/sidebar/worktree-review-helpers.tsx
index 7f096a954dc..96e64fb4423 100644
--- a/src/renderer/src/components/sidebar/worktree-review-helpers.tsx
+++ b/src/renderer/src/components/sidebar/worktree-review-helpers.tsx
@@ -1,4 +1,4 @@
-import { GitMerge } from 'lucide-react'
+import { GitMerge, GitPullRequestClosed, GitPullRequestDraft } from 'lucide-react'
 import { cn } from '@/lib/utils'
 import { PullRequestIcon } from './WorktreeCardHelpers'
 import type { WorktreeCardPrDisplay } from './worktree-card-pr-display'
@@ -23,6 +23,60 @@ export function getProviderName(review: WorktreeCardPrDisplay): string {
   return 'GitHub'
 }
 
+// Why: the glyph must carry review state — tone alone made a draft with failing
+// checks render as a red PR icon, which reads as closed.
+function getStateIcon(
+  state: WorktreeCardPrDisplay['state']
+): React.ComponentType<{ className?: string }> | null {
+  if (state === 'merged') {
+    return GitMerge
+  }
+  if (state === 'closed') {
+    return GitPullRequestClosed
+  }
+  if (state === 'draft') {
+    return GitPullRequestDraft
+  }
+  return null
+}
+
+// Why: checks only gate a review that is actually open; draft/closed/merged keep
+// their state tone so the glyph agrees with its tooltip. A stateless row (folder
+// cards render one while a linked review is loading or its details failed) has no
+// state glyph to contradict, so it still flags problems — but never claims success,
+// since emerald would assert an open review we have not confirmed.
+function getCheckTone(review: WorktreeCardPrDisplay): string | null {
+  if (review.state && review.state !== 'open') {
+    return null
+  }
+  if (review.status === 'failure') {
+    return 'text-rose-500/85'
+  }
+  if (review.status === 'pending') {
+    return 'text-amber-500/85'
+  }
+  if (review.state === 'open' && review.status === 'success') {
+    return 'text-emerald-500/80'
+  }
+  return null
+}
+
+function getStateTone(state: WorktreeCardPrDisplay['state']): string {
+  if (state === 'merged') {
+    return 'text-purple-600/70 dark:text-purple-400/70'
+  }
+  if (state === 'open') {
+    return 'text-emerald-500/80'
+  }
+  if (state === 'closed') {
+    return 'text-muted-foreground/60'
+  }
+  if (state === 'draft') {
+    return 'text-muted-foreground/50'
+  }
+  return 'text-muted-foreground opacity-70'
+}
+
 export function ReviewIcon({
   review,
   className,
@@ -32,28 +86,8 @@ export function ReviewIcon({
   className?: string
   variant?: 'provider' | 'generic'
 }): React.JSX.Element {
-  const Icon = variant === 'provider' && review.provider === 'gitlab' ? GitMerge : PullRequestIcon
-  const checkTone =
-    review.state !== 'merged' && review.status === 'failure'
-      ? 'text-rose-500/85'
-      : review.state !== 'merged' && review.status === 'pending'
-        ? 'text-amber-500/85'
-        : review.state === 'open' && review.status === 'success'
-          ? 'text-emerald-500/80'
-          : null
-  return (
-    <Icon
-      className={cn(
-        className,
-        checkTone,
-        review.state === 'merged' && 'text-purple-600/70 dark:text-purple-400/70',
-        !checkTone && review.state === 'open' && 'text-emerald-500/80',
-        !checkTone && review.state === 'closed' && 'text-muted-foreground/60',
-        !checkTone && review.state === 'draft' && 'text-muted-foreground/50',
-        !checkTone &&
-          (!review.state || !['merged', 'open', 'closed', 'draft'].includes(review.state)) &&
-          'text-muted-foreground opacity-70'
-      )}
-    />
-  )
+  const providerIcon =
+    variant === 'provider' && review.provider === 'gitlab' ? GitMerge : PullRequestIcon
+  const Icon = getStateIcon(review.state) ?? providerIcon
+  return <Icon className={cn(className, getCheckTone(review) ?? getStateTone(review.state))} />
 }
diff --git a/src/renderer/src/components/sidebar/worktree-section-activity.test.ts b/src/renderer/src/components/sidebar/worktree-section-activity.test.ts
deleted file mode 100644
index 5de876fedb3..00000000000
--- a/src/renderer/src/components/sidebar/worktree-section-activity.test.ts
+++ /dev/null
@@ -1,200 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
-import { makePaneKey } from '../../../../shared/stable-pane-id'
-import type { ProjectGroup, Repo, TerminalTab, Worktree } from '../../../../shared/types'
-import {
-  getProjectGroupHeaderKey,
-  PINNED_GROUP_KEY,
-  type WorktreeGroupBy
-} from './worktree-list-groups'
-import {
-  buildWorktreeSectionActivitySummaries,
-  type WorktreeSectionActivityState
-} from './worktree-section-activity'
-
-const LEAF_ID = '11111111-1111-4111-8111-111111111111'
-
-function makeRepo(overrides: Partial<Repo> = {}): Repo {
-  return {
-    id: 'repo-1',
-    path: '/tmp/repo-1',
-    displayName: 'repo',
-    badgeColor: '#000000',
-    addedAt: 0,
-    ...overrides
-  }
-}
-
-function makeProjectGroup(overrides: Partial<ProjectGroup>): ProjectGroup {
-  return {
-    id: 'group-1',
-    name: 'Group',
-    parentPath: null,
-    parentGroupId: null,
-    createdFrom: 'manual',
-    tabOrder: 0,
-    isCollapsed: false,
-    color: null,
-    createdAt: 0,
-    updatedAt: 0,
-    ...overrides
-  }
-}
-
-function makeWorktree(overrides: Partial<Worktree> = {}): Worktree {
-  return {
-    id: 'wt-1',
-    repoId: 'repo-1',
-    path: '/tmp/repo-1-feature',
-    branch: 'refs/heads/feature',
-    head: 'abc123',
-    isBare: false,
-    isMainWorktree: false,
-    linkedIssue: null,
-    linkedPR: null,
-    linkedLinearIssue: null,
-    isArchived: false,
-    isUnread: false,
-    isPinned: false,
-    comment: '',
-    displayName: 'feature',
-    sortOrder: 0,
-    lastActivityAt: 0,
-    ...overrides
-  }
-}
-
-function makeTerminalTab(overrides: Partial<TerminalTab> = {}): TerminalTab {
-  return {
-    id: 'tab-1',
-    ptyId: null,
-    worktreeId: 'wt-1',
-    title: 'zsh',
-    customTitle: null,
-    color: null,
-    sortOrder: 0,
-    createdAt: 0,
-    ...overrides
-  }
-}
-
-function makeState(
-  overrides: Partial<WorktreeSectionActivityState> = {}
-): WorktreeSectionActivityState {
-  return {
-    tabsByWorktree: {},
-    browserTabsByWorktree: {},
-    ptyIdsByTabId: {},
-    runtimePaneTitlesByTabId: {},
-    terminalLayoutRootsByTabId: {},
-    agentStatusEpoch: 0,
-    agentStatusByPaneKey: {},
-    migrationUnsupportedByPtyId: {},
-    retainedAgentsByPaneKey: {},
-    ...overrides
-  }
-}
-
-function buildSummaries({
-  groupBy = 'repo',
-  worktrees,
-  repos,
-  projectGroups = [],
-  state
-}: {
-  groupBy?: WorktreeGroupBy
-  worktrees: readonly Worktree[]
-  repos: readonly Repo[]
-  projectGroups?: readonly ProjectGroup[]
-  state: WorktreeSectionActivityState
-}) {
-  return buildWorktreeSectionActivitySummaries({
-    groupBy,
-    worktrees,
-    repoMap: new Map(repos.map((repo) => [repo.id, repo])),
-    prCache: null,
-    workspaceStatuses: [],
-    projectGroups,
-    state
-  })
-}
-
-describe('buildWorktreeSectionActivitySummaries', () => {
-  it('counts running worktrees across repo project-group ancestors', () => {
-    const parent = makeProjectGroup({ id: 'parent', name: 'Parent' })
-    const child = makeProjectGroup({
-      id: 'child',
-      name: 'Child',
-      parentGroupId: parent.id
-    })
-    const repo = makeRepo({ projectGroupId: child.id })
-    const worktree = makeWorktree({ repoId: repo.id })
-    const state = makeState({
-      tabsByWorktree: {
-        [worktree.id]: [
-          makeTerminalTab({ id: 'tab-1', worktreeId: worktree.id, title: 'Codex working' })
-        ]
-      },
-      ptyIdsByTabId: {
-        'tab-1': ['pty-1']
-      }
-    })
-
-    const summaries = buildSummaries({
-      worktrees: [worktree],
-      repos: [repo],
-      projectGroups: [parent, child],
-      state
-    })
-
-    expect(summaries.get(getProjectGroupHeaderKey(parent.id))).toEqual({
-      runningCount: 1
-    })
-    expect(summaries.get(getProjectGroupHeaderKey(child.id))).toEqual({
-      runningCount: 1
-    })
-    expect(summaries.get(`repo:${repo.id}`)).toEqual({
-      runningCount: 1
-    })
-  })
-
-  it('counts pinned workspace activity on pinned and natural headers', () => {
-    const repo = makeRepo({ projectGroupId: 'group-1' })
-    const worktree = makeWorktree({ repoId: repo.id, isPinned: true })
-    const now = Date.now()
-    const entry: AgentStatusEntry = {
-      state: 'working',
-      prompt: '',
-      updatedAt: now,
-      stateStartedAt: now,
-      paneKey: makePaneKey('tab-1', LEAF_ID),
-      stateHistory: []
-    }
-    const state = makeState({
-      tabsByWorktree: {
-        [worktree.id]: [makeTerminalTab({ id: 'tab-1', worktreeId: worktree.id })]
-      },
-      agentStatusEpoch: 1,
-      agentStatusByPaneKey: {
-        [entry.paneKey]: entry
-      }
-    })
-
-    const summaries = buildSummaries({
-      worktrees: [worktree],
-      repos: [repo],
-      projectGroups: [makeProjectGroup({ id: 'group-1' })],
-      state
-    })
-
-    expect(summaries.get(PINNED_GROUP_KEY)).toEqual({
-      runningCount: 1
-    })
-    expect(summaries.get(`repo:${repo.id}`)).toEqual({
-      runningCount: 1
-    })
-    expect(summaries.get(getProjectGroupHeaderKey('group-1'))).toEqual({
-      runningCount: 1
-    })
-  })
-})
diff --git a/src/renderer/src/components/sidebar/worktree-section-activity.ts b/src/renderer/src/components/sidebar/worktree-section-activity.ts
deleted file mode 100644
index fb81da4f0cf..00000000000
--- a/src/renderer/src/components/sidebar/worktree-section-activity.ts
+++ /dev/null
@@ -1,116 +0,0 @@
-import type { AppState } from '@/store/types'
-import { resolveWorktreeStatus } from '@/lib/worktree-status'
-import type {
-  ProjectGroup,
-  Repo,
-  TerminalPaneLayoutNode,
-  TerminalTab,
-  Worktree,
-  WorkspaceStatusDefinition
-} from '../../../../shared/types'
-import {
-  getGroupKeysForWorktree,
-  type WorktreeGroupBy,
-  PINNED_GROUP_KEY
-} from './worktree-list-groups'
-import {
-  selectLivePtyIdsForWorktree,
-  selectRuntimePaneTitlesForWorktree
-} from './worktree-card-status-inputs'
-import { selectWorktreeAgentActivitySummary } from './worktree-agent-activity-summary'
-import type { BrowserActivityTab } from './visible-worktree-activity-inputs'
-
-export type WorktreeSectionActivityState = Pick<
-  AppState,
-  | 'ptyIdsByTabId'
-  | 'runtimePaneTitlesByTabId'
-  | 'agentStatusEpoch'
-  | 'agentStatusByPaneKey'
-  | 'migrationUnsupportedByPtyId'
-  | 'retainedAgentsByPaneKey'
-> & {
-  tabsByWorktree: Record<string, readonly Pick<TerminalTab, 'id' | 'title'>[]>
-  browserTabsByWorktree: Record<string, readonly BrowserActivityTab[]>
-  terminalLayoutRootsByTabId: Record<string, TerminalPaneLayoutNode | null | undefined>
-}
-
-export type WorktreeSectionActivitySummary = {
-  runningCount: number
-}
-
-export const EMPTY_WORKTREE_SECTION_ACTIVITY: WorktreeSectionActivitySummary = {
-  runningCount: 0
-}
-
-export function buildWorktreeSectionActivitySummaries({
-  groupBy,
-  worktrees,
-  repoMap,
-  prCache,
-  workspaceStatuses,
-  settings,
-  projectGroups,
-  state
-}: {
-  groupBy: WorktreeGroupBy
-  worktrees: readonly Worktree[]
-  repoMap: Map<string, Repo>
-  prCache: Record<string, unknown> | null
-  workspaceStatuses: readonly WorkspaceStatusDefinition[]
-  settings?: AppState['settings']
-  projectGroups: readonly ProjectGroup[]
-  state: WorktreeSectionActivityState
-}): Map<string, WorktreeSectionActivitySummary> {
-  const summaries = new Map<string, WorktreeSectionActivitySummary>()
-
-  for (const worktree of worktrees) {
-    const groupKeys = [
-      ...(worktree.isPinned ? [PINNED_GROUP_KEY] : []),
-      ...getGroupKeysForWorktree(
-        groupBy,
-        worktree,
-        repoMap,
-        prCache,
-        workspaceStatuses,
-        settings,
-        projectGroups
-      )
-    ]
-    if (groupKeys.length === 0) {
-      continue
-    }
-
-    const status = getSectionWorktreeStatus(state, worktree.id)
-    for (const groupKey of groupKeys) {
-      const summary = summaries.get(groupKey) ?? { ...EMPTY_WORKTREE_SECTION_ACTIVITY }
-      if (status === 'working') {
-        summary.runningCount++
-      }
-      summaries.set(groupKey, summary)
-    }
-  }
-
-  return summaries
-}
-
-function getSectionWorktreeStatus(
-  state: WorktreeSectionActivityState,
-  worktreeId: string
-): ReturnType<typeof resolveWorktreeStatus> {
-  const agentSummary = selectWorktreeAgentActivitySummary(state, worktreeId)
-
-  // Why: collapsed headers must mirror the card dot semantics exactly; otherwise
-  // a hidden section can advertise different activity than its visible cards.
-  return resolveWorktreeStatus({
-    tabs: state.tabsByWorktree[worktreeId] ?? [],
-    browserTabs: state.browserTabsByWorktree[worktreeId] ?? [],
-    ptyIdsByTabId: selectLivePtyIdsForWorktree(state, worktreeId),
-    runtimePaneTitlesByTabId: selectRuntimePaneTitlesForWorktree(state, worktreeId),
-    agentStatusPaneIdsByTabId: agentSummary.agentStatusPaneIdsByTabId,
-    terminalLayoutRootsByTabId: state.terminalLayoutRootsByTabId,
-    hasPermission: agentSummary.hasPermission,
-    hasLiveWorking: agentSummary.hasLiveWorking,
-    hasLiveDone: agentSummary.hasLiveDone,
-    hasRetainedDone: agentSummary.hasRetainedDone
-  })
-}
diff --git a/src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.test.ts b/src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.test.ts
new file mode 100644
index 00000000000..9ba2cd592d0
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.test.ts
@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vitest'
+import {
+  createPendingRevealScroll,
+  isRevealScrollSettling,
+  REVEAL_SCROLL_SETTLE_TIMEOUT_MS
+} from './worktree-sidebar-reveal-scroll-settle'
+
+describe('isRevealScrollSettling', () => {
+  it('is not settling without a reveal scroll in flight', () => {
+    expect(isRevealScrollSettling({ now: 0, pending: null, scrollTop: 120 })).toBe(false)
+  })
+
+  it('stays settling while a smooth reveal scroll is still animating', () => {
+    // Regression: the anchor restore wrote scrollTop two frames into the animation and
+    // cancelled it after a couple of pixels, so revealing took several button clicks.
+    const pending = createPendingRevealScroll(387, 0)
+    expect(isRevealScrollSettling({ now: 16, pending, scrollTop: 2 })).toBe(true)
+    expect(isRevealScrollSettling({ now: 200, pending, scrollTop: 260 })).toBe(true)
+  })
+
+  it('stops settling once the scroll reaches its target', () => {
+    const pending = createPendingRevealScroll(387, 0)
+    expect(isRevealScrollSettling({ now: 300, pending, scrollTop: 387 })).toBe(false)
+    // Sub-pixel landings still count as arrived.
+    expect(isRevealScrollSettling({ now: 300, pending, scrollTop: 386.5 })).toBe(false)
+  })
+
+  it('stops settling after the timeout so an unreachable target cannot pin the guard open', () => {
+    const pending = createPendingRevealScroll(387, 0)
+    expect(
+      isRevealScrollSettling({ now: REVEAL_SCROLL_SETTLE_TIMEOUT_MS, pending, scrollTop: 40 })
+    ).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.ts b/src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.ts
new file mode 100644
index 00000000000..6f0d5d878f6
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.ts
@@ -0,0 +1,36 @@
+/**
+ * Tracks a smooth reveal scroll the sidebar issued itself.
+ *
+ * A smooth scroll animates across many frames, and any other scrollTop write
+ * during that window silently cancels it. The sidebar's scroll-anchor restore
+ * writes exactly that, so without this the reveal stops a couple of pixels in
+ * and the user has to click the reveal button repeatedly.
+ */
+export type PendingRevealScroll = {
+  targetTop: number
+  expiresAt: number
+}
+
+/** Ceiling for a browser smooth-scroll animation; also the escape hatch when the target turns out to be unreachable. */
+export const REVEAL_SCROLL_SETTLE_TIMEOUT_MS = 1000
+
+const SETTLED_TOLERANCE_PX = 1
+
+export function createPendingRevealScroll(targetTop: number, now: number): PendingRevealScroll {
+  return { targetTop, expiresAt: now + REVEAL_SCROLL_SETTLE_TIMEOUT_MS }
+}
+
+export function isRevealScrollSettling({
+  now,
+  pending,
+  scrollTop
+}: {
+  now: number
+  pending: PendingRevealScroll | null
+  scrollTop: number
+}): boolean {
+  if (!pending || now >= pending.expiresAt) {
+    return false
+  }
+  return Math.abs(scrollTop - pending.targetTop) > SETTLED_TOLERANCE_PX
+}
diff --git a/src/renderer/src/components/sidebar/worktree-sidebar-reveal.test.ts b/src/renderer/src/components/sidebar/worktree-sidebar-reveal.test.ts
new file mode 100644
index 00000000000..8218c0e0144
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-sidebar-reveal.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it, vi } from 'vitest'
+import { revealElementInScrollContainer } from './worktree-sidebar-reveal'
+
+function makeContainer(scrollTop: number, clientHeight: number) {
+  const scrollTo = vi.fn()
+  const container = {
+    clientHeight,
+    scrollTop,
+    contains: () => true,
+    getBoundingClientRect: () => ({ top: 0, bottom: clientHeight }) as DOMRect,
+    scrollTo
+  }
+  return { container: container as unknown as HTMLElement, scrollTo }
+}
+
+function makeElement(top: number, bottom: number): Element {
+  return {
+    getBoundingClientRect: () => ({ top, bottom }) as DOMRect
+  } as unknown as Element
+}
+
+describe('revealElementInScrollContainer', () => {
+  it('reports the scroll target it issues so callers can guard the animation', () => {
+    const { container, scrollTo } = makeContainer(0, 673)
+    const onScrollIssued = vi.fn()
+
+    // A card mounted below the fold: reveal scrolls until its bottom is in view.
+    const revealed = revealElementInScrollContainer(
+      container,
+      makeElement(1005, 1060),
+      'smooth',
+      onScrollIssued
+    )
+
+    expect(revealed).toBe(true)
+    expect(scrollTo).toHaveBeenCalledWith({ top: 387, behavior: 'smooth' })
+    expect(onScrollIssued).toHaveBeenCalledWith(387)
+  })
+
+  it('does not report a scroll when the element is already in view', () => {
+    const { container, scrollTo } = makeContainer(0, 673)
+    const onScrollIssued = vi.fn()
+
+    const revealed = revealElementInScrollContainer(
+      container,
+      makeElement(200, 260),
+      'smooth',
+      onScrollIssued
+    )
+
+    expect(revealed).toBe(true)
+    expect(scrollTo).not.toHaveBeenCalled()
+    expect(onScrollIssued).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-sidebar-reveal.ts b/src/renderer/src/components/sidebar/worktree-sidebar-reveal.ts
index 38b158532af..ffc8bd7f8df 100644
--- a/src/renderer/src/components/sidebar/worktree-sidebar-reveal.ts
+++ b/src/renderer/src/components/sidebar/worktree-sidebar-reveal.ts
@@ -38,7 +38,10 @@ export function getScrollTopToRevealBounds(
 export function revealElementInScrollContainer(
   container: HTMLElement,
   element: Element,
-  behavior: ScrollBehavior
+  behavior: ScrollBehavior,
+  // Why: any other scrollTop write cancels the scroll issued here mid-animation;
+  // callers use this to stand their scroll-position guards down until it lands.
+  onScrollIssued?: (targetTop: number) => void
 ): boolean {
   if (!container.contains(element)) {
     return false
@@ -59,6 +62,8 @@ export function revealElementInScrollContainer(
     window.matchMedia?.('(prefers-reduced-motion: reduce)').matches === true
   const resolvedBehavior: ScrollBehavior =
     behavior === 'smooth' && prefersReducedMotion ? 'auto' : behavior
-  container.scrollTo({ top: Math.max(0, nextScrollTop), behavior: resolvedBehavior })
+  const targetTop = Math.max(0, nextScrollTop)
+  onScrollIssued?.(targetTop)
+  container.scrollTo({ top: targetTop, behavior: resolvedBehavior })
   return true
 }
diff --git a/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.test.ts b/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.test.ts
index f20ace97b4f..44c3e7f2639 100644
--- a/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.test.ts
+++ b/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.test.ts
@@ -331,6 +331,22 @@ describe('buildTitleDerivedAgentRows', () => {
     }
   })
 
+  // Why: the native marker is the only signal a hookless OpenCode pane emits, so
+  // without it the sidebar showed no row for a running session.
+  it('rows an OpenCode pane from its undecorated native session title', () => {
+    const rows = buildWorktreeAgentRows({
+      tabs: [makeTab('tab-1')],
+      entries: [],
+      retained: [],
+      runtimePaneTitlesByTabId: { 'tab-1': { 1: 'OC | Ad hoc build' } },
+      ptyIdsByTabId: { 'tab-1': ['pty-opencode'] },
+      terminalLayoutsByTabId: { 'tab-1': makeSingleLayout(LEAF_ID_1) },
+      now: 2000
+    })
+
+    expect(rows.map((row) => [row.agentType, row.state])).toEqual([['opencode', 'idle']])
+  })
+
   it('still resolves Claude from a title that presents Claude, owner or not', () => {
     const rowsFor = (title: string, launchAgent?: TuiAgent) =>
       buildWorktreeAgentRows({
diff --git a/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.ts b/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.ts
index ceba63d3e07..9224fe2cba3 100644
--- a/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.ts
+++ b/src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.ts
@@ -285,7 +285,7 @@ function resolveLeafIdForTitleFallback(args: {
   }
 
   const paneIndex = args.paneTitleEntries.findIndex(([paneId]) => Number(paneId) === args.paneId)
-  return paneIndex >= 0 ? (leafIds[paneIndex] ?? null) : null
+  return paneIndex !== -1 ? (leafIds[paneIndex] ?? null) : null
 }
 
 function collectLeafIds(node: TerminalPaneLayoutNode | null): string[] {
diff --git a/src/renderer/src/components/source-control/SourceControlActionVariableChips.tsx b/src/renderer/src/components/source-control/SourceControlActionVariableChips.tsx
index 7a99c800eb1..cd853cf42a5 100644
--- a/src/renderer/src/components/source-control/SourceControlActionVariableChips.tsx
+++ b/src/renderer/src/components/source-control/SourceControlActionVariableChips.tsx
@@ -23,7 +23,7 @@ function hasVariablePreview(
 ): boolean {
   return Boolean(
     variablePreviews &&
-    Object.prototype.hasOwnProperty.call(variablePreviews, variable) &&
+    Object.hasOwn(variablePreviews, variable) &&
     variablePreviews[variable] !== undefined &&
     variablePreviews[variable] !== null
   )
diff --git a/src/renderer/src/components/stats/ClaudeUsageDetails.tsx b/src/renderer/src/components/stats/ClaudeUsageDetails.tsx
index fc16182b759..6e484c1bd0e 100644
--- a/src/renderer/src/components/stats/ClaudeUsageDetails.tsx
+++ b/src/renderer/src/components/stats/ClaudeUsageDetails.tsx
@@ -5,8 +5,8 @@ import type {
   ClaudeUsageSummary
 } from '../../../../shared/claude-usage-types'
 import { ClaudeUsageDailyChart } from './ClaudeUsageDailyChart'
-import { ClaudeUsageRecentSessionsTable } from './ClaudeUsageRecentSessionsTable'
 import { UsageBreakdownSection } from './UsageBreakdownSection'
+import { UsageRecentSessionsTable } from './UsageRecentSessionsTable'
 import { translate } from '@/i18n/i18n'
 
 type ClaudeUsageDetailsProps = {
@@ -57,7 +57,30 @@ export function ClaudeUsageDetails({
         />
       </div>
 
-      <ClaudeUsageRecentSessionsTable recentSessions={recentSessions} summary={summary ?? null} />
+      <UsageRecentSessionsTable
+        title={translate('auto.components.stats.ClaudeUsagePane.7e76c84153', 'Recent sessions')}
+        description={
+          <>
+            {translate('auto.components.stats.ClaudeUsagePane.abfc4a4943', 'Cache reuse rate:')}{' '}
+            {summary?.cacheReuseRate !== null && summary?.cacheReuseRate !== undefined
+              ? `${Math.round(summary.cacheReuseRate * 100)}%`
+              : translate('auto.components.stats.ClaudeUsagePane.7765a4c3e1', 'n/a')}
+          </>
+        }
+        headings={[
+          translate('auto.components.stats.ClaudeUsagePane.01476891c7', 'Last active'),
+          translate('auto.components.stats.ClaudeUsagePane.c17bed0416', 'Project'),
+          translate('auto.components.stats.ClaudeUsagePane.1afc25eb06', 'Model'),
+          translate('auto.components.stats.ClaudeUsagePane.0f03975d59', 'Turns'),
+          translate('auto.components.stats.ClaudeUsagePane.faf3444859', 'Input'),
+          translate('auto.components.stats.ClaudeUsagePane.a8b7487ff7', 'Output'),
+          translate('auto.components.stats.ClaudeUsagePane.21ea00bfa8', 'Cache')
+        ]}
+        unknownModel={translate('auto.components.stats.ClaudeUsagePane.cfe2282ffa', 'Unknown')}
+        rows={recentSessions}
+        getActivity={(row) => row.turns}
+        getTrailingTokens={(row) => row.cacheReadTokens + row.cacheWriteTokens}
+      />
     </>
   )
 }
diff --git a/src/renderer/src/components/stats/ClaudeUsagePane.tsx b/src/renderer/src/components/stats/ClaudeUsagePane.tsx
index 8b24f0aca39..c47846c8c28 100644
--- a/src/renderer/src/components/stats/ClaudeUsagePane.tsx
+++ b/src/renderer/src/components/stats/ClaudeUsagePane.tsx
@@ -5,29 +5,16 @@ import {
   DatabaseZap,
   FolderKanban,
   Gauge,
-  RefreshCw,
-  SlidersHorizontal,
   Sparkles,
   Waypoints
 } from 'lucide-react'
 import type { ClaudeUsageRange, ClaudeUsageScope } from '../../../../shared/claude-usage-types'
 import { useAppStore } from '../../store'
-import { Button } from '../ui/button'
-import { Switch } from '../ui/switch'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuLabel,
-  DropdownMenuRadioGroup,
-  DropdownMenuRadioItem,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger
-} from '../ui/dropdown-menu'
-import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '../ui/tooltip'
 import { ClaudeUsageDetails } from './ClaudeUsageDetails'
 import { ClaudeUsageLoadingState } from './ClaudeUsageLoadingState'
 import { ShareUsageButton } from './ShareUsageButton'
 import { StatCard } from './StatCard'
+import { UsageFilterRadioGroup, UsageTrackingPaneShell } from './UsageTrackingPaneShell'
 import { formatCost, formatTokens, formatUpdatedAt } from './usage-formatters'
 import { translate } from '@/i18n/i18n'
 
@@ -86,34 +73,27 @@ export function ClaudeUsagePane(): React.JSX.Element {
     void setClaudeUsageEnabled(enabled)
   }
 
+  const title = translate(
+    'auto.components.stats.ClaudeUsagePane.6afacbee37',
+    'Claude Usage Tracking'
+  )
+  const enableLabel = translate(
+    'auto.components.stats.ClaudeUsagePane.424cd50412',
+    'Enable Claude usage analytics'
+  )
+
   if (!scanState?.enabled) {
     return (
-      <div className="rounded-lg border border-border/60 bg-card/40 p-4">
-        <div className="flex items-start justify-between gap-4">
-          <div className="space-y-2">
-            <h3 className="text-sm font-semibold text-foreground">
-              {translate(
-                'auto.components.stats.ClaudeUsagePane.6afacbee37',
-                'Claude Usage Tracking'
-              )}
-            </h3>
-            <p className="text-sm text-muted-foreground">
-              {translate(
-                'auto.components.stats.ClaudeUsagePane.0cb1a36d7d',
-                'Reads local Claude usage logs to show token, model, and session stats.'
-              )}
-            </p>
-          </div>
-          <Switch
-            checked={false}
-            aria-label={translate(
-              'auto.components.stats.ClaudeUsagePane.424cd50412',
-              'Enable Claude usage analytics'
-            )}
-            onCheckedChange={handleSetEnabled}
-          />
-        </div>
-      </div>
+      <UsageTrackingPaneShell
+        enabled={false}
+        title={title}
+        disabledDescription={translate(
+          'auto.components.stats.ClaudeUsagePane.0cb1a36d7d',
+          'Reads local Claude usage logs to show token, model, and session stats.'
+        )}
+        enableLabel={enableLabel}
+        onEnabledChange={handleSetEnabled}
+      />
     )
   }
 
@@ -124,204 +104,145 @@ export function ClaudeUsagePane(): React.JSX.Element {
   const hasAnyData = summary?.hasAnyClaudeData ?? scanState.hasAnyClaudeData
 
   return (
-    <div className="space-y-4 rounded-lg border border-border/60 bg-card/30 p-4">
-      <div className="flex items-start justify-between gap-4">
-        <div className="min-w-0 flex-1">
-          <h3 className="text-sm font-semibold text-foreground">
-            {translate('auto.components.stats.ClaudeUsagePane.6afacbee37', 'Claude Usage Tracking')}
-          </h3>
-          <p className="mt-1 text-xs text-muted-foreground">
-            {formatUpdatedAt(scanState.lastScanCompletedAt)}
-            {scanState.lastScanError
-              ? translate(
-                  'auto.components.stats.ClaudeUsagePane.2d41fd45c6',
-                  ' • Last scan error: {{value0}}',
-                  { value0: scanState.lastScanError }
-                )
-              : ''}
-          </p>
-        </div>
-        <div className="flex shrink-0 items-center gap-2 self-start">
-          {summary && daily.length > 0 && (
-            <ShareUsageButton provider="claude" summary={summary} daily={daily} range={range} />
-          )}
-          <DropdownMenu>
-            <TooltipProvider delayDuration={250}>
-              <Tooltip>
-                <TooltipTrigger asChild>
-                  <DropdownMenuTrigger asChild>
-                    <Button
-                      variant="ghost"
-                      size="icon-xs"
-                      aria-label={translate(
-                        'auto.components.stats.ClaudeUsagePane.e9bf9fce0e',
-                        'Claude usage options'
-                      )}
-                    >
-                      <SlidersHorizontal className="size-3.5" />
-                    </Button>
-                  </DropdownMenuTrigger>
-                </TooltipTrigger>
-                <TooltipContent side="bottom" sideOffset={6}>
-                  {translate('auto.components.stats.ClaudeUsagePane.dd29209b21', 'Filters')}
-                </TooltipContent>
-              </Tooltip>
-            </TooltipProvider>
-            <DropdownMenuContent align="end" className="w-60">
-              <DropdownMenuLabel>
-                {translate('auto.components.stats.ClaudeUsagePane.f61cffb9c8', 'Scope')}
-              </DropdownMenuLabel>
-              <DropdownMenuRadioGroup
-                value={scope}
-                onValueChange={(value) => void setClaudeUsageScope(value as ClaudeUsageScope)}
-              >
-                {SCOPE_OPTIONS.map((option) => (
-                  <DropdownMenuRadioItem key={option.value} value={option.value}>
-                    {option.label}
-                  </DropdownMenuRadioItem>
-                ))}
-              </DropdownMenuRadioGroup>
-              <DropdownMenuSeparator />
-              <DropdownMenuLabel>
-                {translate('auto.components.stats.ClaudeUsagePane.505be9aac4', 'Range')}
-              </DropdownMenuLabel>
-              <DropdownMenuRadioGroup
-                value={range}
-                onValueChange={(value) => void setClaudeUsageRange(value as ClaudeUsageRange)}
-              >
-                {RANGE_OPTIONS.map((option) => (
-                  <DropdownMenuRadioItem key={option} value={option}>
-                    {RANGE_LABELS[option]}
-                  </DropdownMenuRadioItem>
-                ))}
-              </DropdownMenuRadioGroup>
-            </DropdownMenuContent>
-          </DropdownMenu>
-          <TooltipProvider delayDuration={250}>
-            <Tooltip>
-              <TooltipTrigger asChild>
-                <Button
-                  variant="ghost"
-                  size="icon-xs"
-                  onClick={() => void refreshClaudeUsage()}
-                  disabled={scanState.isScanning}
-                  aria-label={translate(
-                    'auto.components.stats.ClaudeUsagePane.c5b9b344d0',
-                    'Refresh Claude usage'
-                  )}
-                >
-                  <RefreshCw className={`size-3.5 ${scanState.isScanning ? 'animate-spin' : ''}`} />
-                </Button>
-              </TooltipTrigger>
-              <TooltipContent side="bottom" sideOffset={6}>
-                {translate('auto.components.stats.ClaudeUsagePane.8d18bbb771', 'Refresh')}
-              </TooltipContent>
-            </Tooltip>
-          </TooltipProvider>
-          <Switch
-            checked
-            aria-label={translate(
-              'auto.components.stats.ClaudeUsagePane.424cd50412',
-              'Enable Claude usage analytics'
-            )}
-            onCheckedChange={handleSetEnabled}
-          />
-        </div>
-      </div>
-
-      <div className="flex items-center justify-between gap-3">
-        <p className="text-xs text-muted-foreground">
-          {SCOPE_OPTIONS.find((option) => option.value === scope)?.label} • {RANGE_LABELS[range]}
-        </p>
-      </div>
-
-      {!hasAnyData ? (
-        <div className="rounded-lg border border-dashed border-border/60 bg-card/30 px-4 py-6 text-sm text-muted-foreground">
-          {translate(
-            'auto.components.stats.ClaudeUsagePane.7dde9331fd',
-            'No local Claude usage found yet for this scope.'
-          )}
-        </div>
-      ) : (
+    <UsageTrackingPaneShell
+      enabled
+      title={title}
+      status={
         <>
-          <div className="grid gap-3 md:grid-cols-2 xl:grid-cols-4">
-            <StatCard
-              label={translate('auto.components.stats.ClaudeUsagePane.ea71fae8fc', 'Input tokens')}
-              value={formatTokens(summary?.inputTokens ?? 0)}
-              icon={<Sparkles className="size-4" />}
-            />
-            <StatCard
-              label={translate('auto.components.stats.ClaudeUsagePane.2b8a2f14aa', 'Output tokens')}
-              value={formatTokens(summary?.outputTokens ?? 0)}
-              icon={<Activity className="size-4" />}
-            />
-            <StatCard
-              label={translate('auto.components.stats.ClaudeUsagePane.268cf0af51', 'Cache read')}
-              value={formatTokens(summary?.cacheReadTokens ?? 0)}
-              icon={<DatabaseZap className="size-4" />}
-            />
-            <StatCard
-              label={translate('auto.components.stats.ClaudeUsagePane.b786fb4a70', 'Cache write')}
-              value={formatTokens(summary?.cacheWriteTokens ?? 0)}
-              icon={<Waypoints className="size-4" />}
-            />
-            <StatCard
-              label={translate(
-                'auto.components.stats.ClaudeUsagePane.1634c4f404',
-                'Cache reuse rate'
-              )}
-              value={
-                summary?.cacheReuseRate !== null && summary?.cacheReuseRate !== undefined
-                  ? `${Math.round(summary.cacheReuseRate * 100)}%`
-                  : 'n/a'
-              }
-              icon={<Gauge className="size-4" />}
-            />
-            <StatCard
-              label={translate(
-                'auto.components.stats.ClaudeUsagePane.8cc23be4a3',
-                'Zero-cache-read turns'
-              )}
-              value={
-                summary && summary.turns > 0
-                  ? `${Math.round((summary.zeroCacheReadTurns / summary.turns) * 100)}%`
-                  : 'n/a'
-              }
-              icon={<DatabaseZap className="size-4" />}
-            />
-            <StatCard
-              label={translate(
-                'auto.components.stats.ClaudeUsagePane.0f3e696ca9',
-                'Sessions / Turns'
-              )}
-              value={`${(summary?.sessions ?? 0).toLocaleString()} / ${(summary?.turns ?? 0).toLocaleString()}`}
-              icon={<FolderKanban className="size-4" />}
-            />
-            <StatCard
-              label={translate(
-                'auto.components.stats.ClaudeUsagePane.b26d4ddb58',
-                'Est. API-equivalent cost'
-              )}
-              value={formatCost(summary?.estimatedCostUsd ?? null)}
-              icon={<Coins className="size-4" />}
-            />
-          </div>
-          <p className="px-1 text-xs text-muted-foreground">
-            {translate(
-              'auto.components.stats.ClaudeUsagePane.51ae85fa00',
-              'Cache reuse rate is calculated as cache read tokens / (input tokens + cache read tokens).'
-            )}
-          </p>
-
-          <ClaudeUsageDetails
-            daily={daily}
-            modelBreakdown={modelBreakdown}
-            projectBreakdown={projectBreakdown}
-            recentSessions={recentSessions}
-            summary={summary}
-          />
+          {formatUpdatedAt(scanState.lastScanCompletedAt)}
+          {scanState.lastScanError
+            ? translate(
+                'auto.components.stats.ClaudeUsagePane.2d41fd45c6',
+                ' • Last scan error: {{value0}}',
+                { value0: scanState.lastScanError }
+              )
+            : ''}
         </>
+      }
+      isRefreshing={scanState.isScanning}
+      hasData={hasAnyData}
+      enableLabel={enableLabel}
+      optionsLabel={translate(
+        'auto.components.stats.ClaudeUsagePane.e9bf9fce0e',
+        'Claude usage options'
       )}
-    </div>
+      filtersLabel={translate('auto.components.stats.ClaudeUsagePane.dd29209b21', 'Filters')}
+      refreshAriaLabel={translate(
+        'auto.components.stats.ClaudeUsagePane.c5b9b344d0',
+        'Refresh Claude usage'
+      )}
+      refreshLabel={translate('auto.components.stats.ClaudeUsagePane.8d18bbb771', 'Refresh')}
+      filterSections={[
+        <UsageFilterRadioGroup
+          key="scope"
+          label={translate('auto.components.stats.ClaudeUsagePane.f61cffb9c8', 'Scope')}
+          value={scope}
+          options={SCOPE_OPTIONS}
+          onValueChange={(value) => void setClaudeUsageScope(value)}
+        />,
+        <UsageFilterRadioGroup
+          key="range"
+          label={translate('auto.components.stats.ClaudeUsagePane.505be9aac4', 'Range')}
+          value={range}
+          options={RANGE_OPTIONS.map((value) => ({ value, label: RANGE_LABELS[value] }))}
+          onValueChange={(value) => void setClaudeUsageRange(value)}
+        />
+      ]}
+      selectionSummary={
+        <>
+          {SCOPE_OPTIONS.find((option) => option.value === scope)?.label} • {RANGE_LABELS[range]}
+        </>
+      }
+      emptyMessage={translate(
+        'auto.components.stats.ClaudeUsagePane.7dde9331fd',
+        'No local Claude usage found yet for this scope.'
+      )}
+      onEnabledChange={handleSetEnabled}
+      onRefresh={() => void refreshClaudeUsage()}
+      headerAction={
+        summary && daily.length > 0 ? (
+          <ShareUsageButton provider="claude" summary={summary} daily={daily} range={range} />
+        ) : undefined
+      }
+    >
+      <>
+        <div className="grid gap-3 md:grid-cols-2 xl:grid-cols-4">
+          <StatCard
+            label={translate('auto.components.stats.ClaudeUsagePane.ea71fae8fc', 'Input tokens')}
+            value={formatTokens(summary?.inputTokens ?? 0)}
+            icon={<Sparkles className="size-4" />}
+          />
+          <StatCard
+            label={translate('auto.components.stats.ClaudeUsagePane.2b8a2f14aa', 'Output tokens')}
+            value={formatTokens(summary?.outputTokens ?? 0)}
+            icon={<Activity className="size-4" />}
+          />
+          <StatCard
+            label={translate('auto.components.stats.ClaudeUsagePane.268cf0af51', 'Cache read')}
+            value={formatTokens(summary?.cacheReadTokens ?? 0)}
+            icon={<DatabaseZap className="size-4" />}
+          />
+          <StatCard
+            label={translate('auto.components.stats.ClaudeUsagePane.b786fb4a70', 'Cache write')}
+            value={formatTokens(summary?.cacheWriteTokens ?? 0)}
+            icon={<Waypoints className="size-4" />}
+          />
+          <StatCard
+            label={translate(
+              'auto.components.stats.ClaudeUsagePane.1634c4f404',
+              'Cache reuse rate'
+            )}
+            value={
+              summary?.cacheReuseRate !== null && summary?.cacheReuseRate !== undefined
+                ? `${Math.round(summary.cacheReuseRate * 100)}%`
+                : 'n/a'
+            }
+            icon={<Gauge className="size-4" />}
+          />
+          <StatCard
+            label={translate(
+              'auto.components.stats.ClaudeUsagePane.8cc23be4a3',
+              'Zero-cache-read turns'
+            )}
+            value={
+              summary && summary.turns > 0
+                ? `${Math.round((summary.zeroCacheReadTurns / summary.turns) * 100)}%`
+                : 'n/a'
+            }
+            icon={<DatabaseZap className="size-4" />}
+          />
+          <StatCard
+            label={translate(
+              'auto.components.stats.ClaudeUsagePane.0f3e696ca9',
+              'Sessions / Turns'
+            )}
+            value={`${(summary?.sessions ?? 0).toLocaleString()} / ${(summary?.turns ?? 0).toLocaleString()}`}
+            icon={<FolderKanban className="size-4" />}
+          />
+          <StatCard
+            label={translate(
+              'auto.components.stats.ClaudeUsagePane.b26d4ddb58',
+              'Est. API-equivalent cost'
+            )}
+            value={formatCost(summary?.estimatedCostUsd ?? null)}
+            icon={<Coins className="size-4" />}
+          />
+        </div>
+        <p className="px-1 text-xs text-muted-foreground">
+          {translate(
+            'auto.components.stats.ClaudeUsagePane.51ae85fa00',
+            'Cache reuse rate is calculated as cache read tokens / (input tokens + cache read tokens).'
+          )}
+        </p>
+
+        <ClaudeUsageDetails
+          daily={daily}
+          modelBreakdown={modelBreakdown}
+          projectBreakdown={projectBreakdown}
+          recentSessions={recentSessions}
+          summary={summary}
+        />
+      </>
+    </UsageTrackingPaneShell>
   )
 }
diff --git a/src/renderer/src/components/stats/ClaudeUsageRecentSessionsTable.tsx b/src/renderer/src/components/stats/ClaudeUsageRecentSessionsTable.tsx
deleted file mode 100644
index 57752c46515..00000000000
--- a/src/renderer/src/components/stats/ClaudeUsageRecentSessionsTable.tsx
+++ /dev/null
@@ -1,81 +0,0 @@
-import type {
-  ClaudeUsageSessionRow,
-  ClaudeUsageSummary
-} from '../../../../shared/claude-usage-types'
-import { translate } from '@/i18n/i18n'
-import { formatSessionTime, formatTokens } from './usage-formatters'
-
-export function ClaudeUsageRecentSessionsTable({
-  recentSessions,
-  summary
-}: {
-  recentSessions: ClaudeUsageSessionRow[]
-  summary: ClaudeUsageSummary | null
-}): React.JSX.Element {
-  return (
-    <section className="rounded-lg border border-border/60 bg-card/40 p-4">
-      <div className="mb-3">
-        <h4 className="text-sm font-semibold text-foreground">
-          {translate('auto.components.stats.ClaudeUsagePane.7e76c84153', 'Recent sessions')}
-        </h4>
-        <p className="text-xs text-muted-foreground">
-          {translate('auto.components.stats.ClaudeUsagePane.abfc4a4943', 'Cache reuse rate:')}{' '}
-          {summary?.cacheReuseRate !== null && summary?.cacheReuseRate !== undefined
-            ? `${Math.round(summary.cacheReuseRate * 100)}%`
-            : translate('auto.components.stats.ClaudeUsagePane.7765a4c3e1', 'n/a')}
-        </p>
-      </div>
-      <div className="overflow-x-auto">
-        <table className="min-w-full text-sm">
-          <thead>
-            <tr className="border-b border-border/60 text-left text-xs text-muted-foreground">
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.ClaudeUsagePane.01476891c7', 'Last active')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.ClaudeUsagePane.c17bed0416', 'Project')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.ClaudeUsagePane.1afc25eb06', 'Model')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.ClaudeUsagePane.0f03975d59', 'Turns')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.ClaudeUsagePane.faf3444859', 'Input')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.ClaudeUsagePane.a8b7487ff7', 'Output')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.ClaudeUsagePane.21ea00bfa8', 'Cache')}
-              </th>
-            </tr>
-          </thead>
-          <tbody>
-            {recentSessions.map((row) => (
-              <tr key={row.sessionId} className="border-b border-border/40 last:border-b-0">
-                <td className="px-2 py-2 text-muted-foreground">
-                  {formatSessionTime(row.lastActiveAt)}
-                </td>
-                <td className="px-2 py-2 text-foreground">{row.projectLabel}</td>
-                <td className="px-2 py-2 text-muted-foreground">
-                  {row.model ??
-                    translate('auto.components.stats.ClaudeUsagePane.cfe2282ffa', 'Unknown')}
-                </td>
-                <td className="px-2 py-2 text-muted-foreground">{row.turns}</td>
-                <td className="px-2 py-2 text-muted-foreground">{formatTokens(row.inputTokens)}</td>
-                <td className="px-2 py-2 text-muted-foreground">
-                  {formatTokens(row.outputTokens)}
-                </td>
-                <td className="px-2 py-2 text-muted-foreground">
-                  {formatTokens(row.cacheReadTokens + row.cacheWriteTokens)}
-                </td>
-              </tr>
-            ))}
-          </tbody>
-        </table>
-      </div>
-    </section>
-  )
-}
diff --git a/src/renderer/src/components/stats/CodexUsageDetails.tsx b/src/renderer/src/components/stats/CodexUsageDetails.tsx
index 7e7a46fd17e..c297d60ab4c 100644
--- a/src/renderer/src/components/stats/CodexUsageDetails.tsx
+++ b/src/renderer/src/components/stats/CodexUsageDetails.tsx
@@ -5,8 +5,8 @@ import type {
   CodexUsageSummary
 } from '../../../../shared/codex-usage-types'
 import { CodexUsageDailyChart } from './CodexUsageDailyChart'
-import { CodexUsageRecentSessionsTable } from './CodexUsageRecentSessionsTable'
 import { UsageBreakdownSection } from './UsageBreakdownSection'
+import { UsageRecentSessionsTable } from './UsageRecentSessionsTable'
 import { translate } from '@/i18n/i18n'
 
 type CodexUsageDetailsProps = {
@@ -58,7 +58,27 @@ export function CodexUsageDetails({
         />
       </div>
 
-      <CodexUsageRecentSessionsTable recentSessions={recentSessions} />
+      <UsageRecentSessionsTable
+        title={translate('auto.components.stats.CodexUsagePane.0cb0983c07', 'Recent sessions')}
+        description={translate(
+          'auto.components.stats.CodexUsagePane.0bd8655475',
+          'Most recent local Codex sessions in this scope.'
+        )}
+        headings={[
+          translate('auto.components.stats.CodexUsagePane.0c36b100be', 'Last active'),
+          translate('auto.components.stats.CodexUsagePane.1a65900aea', 'Project'),
+          translate('auto.components.stats.CodexUsagePane.c2478bcc3c', 'Model'),
+          translate('auto.components.stats.CodexUsagePane.bd0822ca47', 'Events'),
+          translate('auto.components.stats.CodexUsagePane.3acc582214', 'Input'),
+          translate('auto.components.stats.CodexUsagePane.bbd20344b8', 'Output'),
+          translate('auto.components.stats.CodexUsagePane.e0b988599d', 'Total')
+        ]}
+        unknownModel={translate('auto.components.stats.CodexUsagePane.bf6cf2d4dd', 'Unknown')}
+        rows={recentSessions}
+        getActivity={(row) => row.events}
+        getTrailingTokens={(row) => row.totalTokens}
+        getModelSuffix={(row) => (row.hasInferredPricing ? ' *' : '')}
+      />
     </>
   )
 }
diff --git a/src/renderer/src/components/stats/CodexUsagePane.tsx b/src/renderer/src/components/stats/CodexUsagePane.tsx
index ad6e02c7b56..1f36402a87c 100644
--- a/src/renderer/src/components/stats/CodexUsagePane.tsx
+++ b/src/renderer/src/components/stats/CodexUsagePane.tsx
@@ -1,32 +1,12 @@
 import { useEffect } from 'react'
-import {
-  Activity,
-  Brain,
-  Coins,
-  DatabaseZap,
-  FolderKanban,
-  RefreshCw,
-  SlidersHorizontal,
-  Sparkles
-} from 'lucide-react'
+import { Activity, Brain, Coins, DatabaseZap, FolderKanban, Sparkles } from 'lucide-react'
 import type { CodexUsageRange, CodexUsageScope } from '../../../../shared/codex-usage-types'
 import { useAppStore } from '../../store'
-import { Button } from '../ui/button'
-import { Switch } from '../ui/switch'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuLabel,
-  DropdownMenuRadioGroup,
-  DropdownMenuRadioItem,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger
-} from '../ui/dropdown-menu'
-import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '../ui/tooltip'
 import { ClaudeUsageLoadingState } from './ClaudeUsageLoadingState'
 import { CodexUsageDetails } from './CodexUsageDetails'
 import { ShareUsageButton } from './ShareUsageButton'
 import { StatCard } from './StatCard'
+import { UsageFilterRadioGroup, UsageTrackingPaneShell } from './UsageTrackingPaneShell'
 import { formatCost, formatTokens, formatUpdatedAt } from './usage-formatters'
 import { translate } from '@/i18n/i18n'
 
@@ -85,38 +65,31 @@ export function CodexUsagePane(): React.JSX.Element {
     void setCodexUsageEnabled(enabled)
   }
 
+  const title = translate('auto.components.stats.CodexUsagePane.408210470c', 'Codex Usage Tracking')
+  const enableLabel = translate(
+    'auto.components.stats.CodexUsagePane.f7c1affbd5',
+    'Enable Codex usage analytics'
+  )
+
   if (!scanState?.enabled) {
     return (
-      <div className="rounded-lg border border-border/60 bg-card/40 p-4">
-        <div className="flex items-start justify-between gap-4">
-          <div className="space-y-2">
-            <h3 className="text-sm font-semibold text-foreground">
-              {translate('auto.components.stats.CodexUsagePane.408210470c', 'Codex Usage Tracking')}
-            </h3>
-            <p className="text-sm text-muted-foreground">
-              {translate(
-                'auto.components.stats.CodexUsagePane.13badcd8f2',
-                'Reads local Codex usage logs to show token, model, and session stats.'
-              )}
-            </p>
-          </div>
-          <Switch
-            checked={false}
-            aria-label={translate(
-              'auto.components.stats.CodexUsagePane.f7c1affbd5',
-              'Enable Codex usage analytics'
-            )}
-            onCheckedChange={handleSetEnabled}
-          />
-        </div>
-      </div>
+      <UsageTrackingPaneShell
+        enabled={false}
+        title={title}
+        disabledDescription={translate(
+          'auto.components.stats.CodexUsagePane.13badcd8f2',
+          'Reads local Codex usage logs to show token, model, and session stats.'
+        )}
+        enableLabel={enableLabel}
+        onEnabledChange={handleSetEnabled}
+      />
     )
   }
 
   if (!summary && (scanState.isScanning || scanState.lastScanCompletedAt === null)) {
     return (
       <ClaudeUsageLoadingState
-        title={translate('auto.components.stats.CodexUsagePane.408210470c', 'Codex Usage Tracking')}
+        title={title}
         summaryCardCount={6}
         summaryGridClassName="md:grid-cols-3"
       />
@@ -126,183 +99,121 @@ export function CodexUsagePane(): React.JSX.Element {
   const hasAnyData = summary?.hasAnyCodexData ?? scanState.hasAnyCodexData
 
   return (
-    <div className="space-y-4 rounded-lg border border-border/60 bg-card/30 p-4">
-      <div className="flex items-start justify-between gap-4">
-        <div className="min-w-0 flex-1">
-          <h3 className="text-sm font-semibold text-foreground">
-            {translate('auto.components.stats.CodexUsagePane.408210470c', 'Codex Usage Tracking')}
-          </h3>
-          <p className="mt-1 text-xs text-muted-foreground">
-            {formatUpdatedAt(scanState.lastScanCompletedAt)}
-            {scanState.lastScanError
-              ? translate(
-                  'auto.components.stats.CodexUsagePane.8a6655f7a2',
-                  ' • Last scan error: {{value0}}',
-                  { value0: scanState.lastScanError }
-                )
-              : ''}
-          </p>
-        </div>
-        <div className="flex shrink-0 items-center gap-2 self-start">
-          {summary && daily.length > 0 && (
-            <ShareUsageButton provider="codex" summary={summary} daily={daily} range={range} />
-          )}
-          <DropdownMenu>
-            <TooltipProvider delayDuration={250}>
-              <Tooltip>
-                <TooltipTrigger asChild>
-                  <DropdownMenuTrigger asChild>
-                    <Button
-                      variant="ghost"
-                      size="icon-xs"
-                      aria-label={translate(
-                        'auto.components.stats.CodexUsagePane.70b5b8581f',
-                        'Codex usage options'
-                      )}
-                    >
-                      <SlidersHorizontal className="size-3.5" />
-                    </Button>
-                  </DropdownMenuTrigger>
-                </TooltipTrigger>
-                <TooltipContent side="bottom" sideOffset={6}>
-                  {translate('auto.components.stats.CodexUsagePane.1af1a39b2f', 'Filters')}
-                </TooltipContent>
-              </Tooltip>
-            </TooltipProvider>
-            <DropdownMenuContent align="end" className="w-60">
-              <DropdownMenuLabel>
-                {translate('auto.components.stats.CodexUsagePane.6d68e8399a', 'Scope')}
-              </DropdownMenuLabel>
-              <DropdownMenuRadioGroup
-                value={scope}
-                onValueChange={(value) => void setCodexUsageScope(value as CodexUsageScope)}
-              >
-                {SCOPE_OPTIONS.map((option) => (
-                  <DropdownMenuRadioItem key={option.value} value={option.value}>
-                    {option.label}
-                  </DropdownMenuRadioItem>
-                ))}
-              </DropdownMenuRadioGroup>
-              <DropdownMenuSeparator />
-              <DropdownMenuLabel>
-                {translate('auto.components.stats.CodexUsagePane.89162e019b', 'Range')}
-              </DropdownMenuLabel>
-              <DropdownMenuRadioGroup
-                value={range}
-                onValueChange={(value) => void setCodexUsageRange(value as CodexUsageRange)}
-              >
-                {RANGE_OPTIONS.map((option) => (
-                  <DropdownMenuRadioItem key={option} value={option}>
-                    {RANGE_LABELS[option]}
-                  </DropdownMenuRadioItem>
-                ))}
-              </DropdownMenuRadioGroup>
-            </DropdownMenuContent>
-          </DropdownMenu>
-          <TooltipProvider delayDuration={250}>
-            <Tooltip>
-              <TooltipTrigger asChild>
-                <Button
-                  variant="ghost"
-                  size="icon-xs"
-                  onClick={() => void refreshCodexUsage()}
-                  disabled={scanState.isScanning}
-                  aria-label={translate(
-                    'auto.components.stats.CodexUsagePane.ec4d270e2c',
-                    'Refresh Codex usage'
-                  )}
-                >
-                  <RefreshCw className={`size-3.5 ${scanState.isScanning ? 'animate-spin' : ''}`} />
-                </Button>
-              </TooltipTrigger>
-              <TooltipContent side="bottom" sideOffset={6}>
-                {translate('auto.components.stats.CodexUsagePane.3022cda443', 'Refresh')}
-              </TooltipContent>
-            </Tooltip>
-          </TooltipProvider>
-          <Switch
-            checked
-            aria-label={translate(
-              'auto.components.stats.CodexUsagePane.f7c1affbd5',
-              'Enable Codex usage analytics'
-            )}
-            onCheckedChange={handleSetEnabled}
-          />
-        </div>
-      </div>
-
-      <div className="flex items-center justify-between gap-3">
-        <p className="text-xs text-muted-foreground">
-          {SCOPE_OPTIONS.find((option) => option.value === scope)?.label} • {RANGE_LABELS[range]}
-        </p>
-      </div>
-
-      {!hasAnyData ? (
-        <div className="rounded-lg border border-dashed border-border/60 bg-card/30 px-4 py-6 text-sm text-muted-foreground">
-          {translate(
-            'auto.components.stats.CodexUsagePane.4c865393b4',
-            'No local Codex usage found yet for this scope.'
-          )}
-        </div>
-      ) : (
+    <UsageTrackingPaneShell
+      enabled
+      title={title}
+      status={
         <>
-          <div className="grid gap-3 md:grid-cols-3">
-            <StatCard
-              label={translate('auto.components.stats.CodexUsagePane.e365eaa6fd', 'Input tokens')}
-              value={formatTokens(summary?.inputTokens ?? 0)}
-              icon={<Sparkles className="size-4" />}
-            />
-            <StatCard
-              label={translate('auto.components.stats.CodexUsagePane.5d8eba87bd', 'Output tokens')}
-              value={formatTokens(summary?.outputTokens ?? 0)}
-              icon={<Activity className="size-4" />}
-            />
-            <StatCard
-              label={translate('auto.components.stats.CodexUsagePane.a9ac0f423a', 'Cached input')}
-              value={formatTokens(summary?.cachedInputTokens ?? 0)}
-              icon={<DatabaseZap className="size-4" />}
-            />
-            <StatCard
-              label={translate(
-                'auto.components.stats.CodexUsagePane.6e18146e9b',
-                'Reasoning output'
-              )}
-              value={formatTokens(summary?.reasoningOutputTokens ?? 0)}
-              icon={<Brain className="size-4" />}
-            />
-            <StatCard
-              label={translate(
-                'auto.components.stats.CodexUsagePane.907b31865f',
-                'Sessions / Events'
-              )}
-              value={`${(summary?.sessions ?? 0).toLocaleString()} / ${(summary?.events ?? 0).toLocaleString()}`}
-              icon={<FolderKanban className="size-4" />}
-            />
-            <StatCard
-              label={translate(
-                'auto.components.stats.CodexUsagePane.1a18fbd56b',
-                'Est. API-equivalent cost'
-              )}
-              value={formatCost(summary?.estimatedCostUsd ?? null)}
-              icon={<Coins className="size-4" />}
-            />
-          </div>
-          <p className="px-1 text-xs text-muted-foreground">
-            {translate(
-              'auto.components.stats.CodexUsagePane.94ac1f1ee7',
-              'Reasoning tokens are shown for visibility, but cost is calculated from uncached input, cached input, and output only.'
-            )}
-          </p>
-
-          <CodexUsageDetails
-            daily={daily}
-            modelBreakdown={modelBreakdown}
-            projectBreakdown={projectBreakdown}
-            recentSessions={recentSessions}
-            summary={summary}
-          />
+          {formatUpdatedAt(scanState.lastScanCompletedAt)}
+          {scanState.lastScanError
+            ? translate(
+                'auto.components.stats.CodexUsagePane.8a6655f7a2',
+                ' • Last scan error: {{value0}}',
+                { value0: scanState.lastScanError }
+              )
+            : ''}
         </>
+      }
+      isRefreshing={scanState.isScanning}
+      hasData={hasAnyData}
+      enableLabel={enableLabel}
+      optionsLabel={translate(
+        'auto.components.stats.CodexUsagePane.70b5b8581f',
+        'Codex usage options'
       )}
-    </div>
+      filtersLabel={translate('auto.components.stats.CodexUsagePane.1af1a39b2f', 'Filters')}
+      refreshAriaLabel={translate(
+        'auto.components.stats.CodexUsagePane.ec4d270e2c',
+        'Refresh Codex usage'
+      )}
+      refreshLabel={translate('auto.components.stats.CodexUsagePane.3022cda443', 'Refresh')}
+      filterSections={[
+        <UsageFilterRadioGroup
+          key="scope"
+          label={translate('auto.components.stats.CodexUsagePane.6d68e8399a', 'Scope')}
+          value={scope}
+          options={SCOPE_OPTIONS}
+          onValueChange={(value) => void setCodexUsageScope(value)}
+        />,
+        <UsageFilterRadioGroup
+          key="range"
+          label={translate('auto.components.stats.CodexUsagePane.89162e019b', 'Range')}
+          value={range}
+          options={RANGE_OPTIONS.map((value) => ({ value, label: RANGE_LABELS[value] }))}
+          onValueChange={(value) => void setCodexUsageRange(value)}
+        />
+      ]}
+      selectionSummary={
+        <>
+          {SCOPE_OPTIONS.find((option) => option.value === scope)?.label} • {RANGE_LABELS[range]}
+        </>
+      }
+      emptyMessage={translate(
+        'auto.components.stats.CodexUsagePane.4c865393b4',
+        'No local Codex usage found yet for this scope.'
+      )}
+      onEnabledChange={handleSetEnabled}
+      onRefresh={() => void refreshCodexUsage()}
+      headerAction={
+        summary && daily.length > 0 ? (
+          <ShareUsageButton provider="codex" summary={summary} daily={daily} range={range} />
+        ) : undefined
+      }
+    >
+      <>
+        <div className="grid gap-3 md:grid-cols-3">
+          <StatCard
+            label={translate('auto.components.stats.CodexUsagePane.e365eaa6fd', 'Input tokens')}
+            value={formatTokens(summary?.inputTokens ?? 0)}
+            icon={<Sparkles className="size-4" />}
+          />
+          <StatCard
+            label={translate('auto.components.stats.CodexUsagePane.5d8eba87bd', 'Output tokens')}
+            value={formatTokens(summary?.outputTokens ?? 0)}
+            icon={<Activity className="size-4" />}
+          />
+          <StatCard
+            label={translate('auto.components.stats.CodexUsagePane.a9ac0f423a', 'Cached input')}
+            value={formatTokens(summary?.cachedInputTokens ?? 0)}
+            icon={<DatabaseZap className="size-4" />}
+          />
+          <StatCard
+            label={translate('auto.components.stats.CodexUsagePane.6e18146e9b', 'Reasoning output')}
+            value={formatTokens(summary?.reasoningOutputTokens ?? 0)}
+            icon={<Brain className="size-4" />}
+          />
+          <StatCard
+            label={translate(
+              'auto.components.stats.CodexUsagePane.907b31865f',
+              'Sessions / Events'
+            )}
+            value={`${(summary?.sessions ?? 0).toLocaleString()} / ${(summary?.events ?? 0).toLocaleString()}`}
+            icon={<FolderKanban className="size-4" />}
+          />
+          <StatCard
+            label={translate(
+              'auto.components.stats.CodexUsagePane.1a18fbd56b',
+              'Est. API-equivalent cost'
+            )}
+            value={formatCost(summary?.estimatedCostUsd ?? null)}
+            icon={<Coins className="size-4" />}
+          />
+        </div>
+        <p className="px-1 text-xs text-muted-foreground">
+          {translate(
+            'auto.components.stats.CodexUsagePane.94ac1f1ee7',
+            'Reasoning tokens are shown for visibility, but cost is calculated from uncached input, cached input, and output only.'
+          )}
+        </p>
+
+        <CodexUsageDetails
+          daily={daily}
+          modelBreakdown={modelBreakdown}
+          projectBreakdown={projectBreakdown}
+          recentSessions={recentSessions}
+          summary={summary}
+        />
+      </>
+    </UsageTrackingPaneShell>
   )
 }
diff --git a/src/renderer/src/components/stats/CodexUsageRecentSessionsTable.tsx b/src/renderer/src/components/stats/CodexUsageRecentSessionsTable.tsx
deleted file mode 100644
index f5ee1a7a430..00000000000
--- a/src/renderer/src/components/stats/CodexUsageRecentSessionsTable.tsx
+++ /dev/null
@@ -1,75 +0,0 @@
-import type { CodexUsageSessionRow } from '../../../../shared/codex-usage-types'
-import { translate } from '@/i18n/i18n'
-import { formatSessionTime, formatTokens } from './usage-formatters'
-
-export function CodexUsageRecentSessionsTable({
-  recentSessions
-}: {
-  recentSessions: CodexUsageSessionRow[]
-}): React.JSX.Element {
-  return (
-    <section className="rounded-lg border border-border/60 bg-card/40 p-4">
-      <div className="mb-3">
-        <h4 className="text-sm font-semibold text-foreground">
-          {translate('auto.components.stats.CodexUsagePane.0cb0983c07', 'Recent sessions')}
-        </h4>
-        <p className="text-xs text-muted-foreground">
-          {translate(
-            'auto.components.stats.CodexUsagePane.0bd8655475',
-            'Most recent local Codex sessions in this scope.'
-          )}
-        </p>
-      </div>
-      <div className="overflow-x-auto">
-        <table className="min-w-full text-sm">
-          <thead>
-            <tr className="border-b border-border/60 text-left text-xs text-muted-foreground">
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.CodexUsagePane.0c36b100be', 'Last active')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.CodexUsagePane.1a65900aea', 'Project')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.CodexUsagePane.c2478bcc3c', 'Model')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.CodexUsagePane.bd0822ca47', 'Events')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.CodexUsagePane.3acc582214', 'Input')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.CodexUsagePane.bbd20344b8', 'Output')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.CodexUsagePane.e0b988599d', 'Total')}
-              </th>
-            </tr>
-          </thead>
-          <tbody>
-            {recentSessions.map((row) => (
-              <tr key={row.sessionId} className="border-b border-border/40 last:border-b-0">
-                <td className="px-2 py-2 text-muted-foreground">
-                  {formatSessionTime(row.lastActiveAt)}
-                </td>
-                <td className="px-2 py-2 text-foreground">{row.projectLabel}</td>
-                <td className="px-2 py-2 text-muted-foreground">
-                  {row.model ??
-                    translate('auto.components.stats.CodexUsagePane.bf6cf2d4dd', 'Unknown')}
-                  {row.hasInferredPricing ? ' *' : ''}
-                </td>
-                <td className="px-2 py-2 text-muted-foreground">{row.events}</td>
-                <td className="px-2 py-2 text-muted-foreground">{formatTokens(row.inputTokens)}</td>
-                <td className="px-2 py-2 text-muted-foreground">
-                  {formatTokens(row.outputTokens)}
-                </td>
-                <td className="px-2 py-2 text-muted-foreground">{formatTokens(row.totalTokens)}</td>
-              </tr>
-            ))}
-          </tbody>
-        </table>
-      </div>
-    </section>
-  )
-}
diff --git a/src/renderer/src/components/stats/OpenCodeUsageDetails.tsx b/src/renderer/src/components/stats/OpenCodeUsageDetails.tsx
index b3b58733d78..541db1cb7d4 100644
--- a/src/renderer/src/components/stats/OpenCodeUsageDetails.tsx
+++ b/src/renderer/src/components/stats/OpenCodeUsageDetails.tsx
@@ -5,8 +5,8 @@ import type {
   OpenCodeUsageSummary
 } from '../../../../shared/opencode-usage-types'
 import { CodexUsageDailyChart } from './CodexUsageDailyChart'
-import { OpenCodeUsageRecentSessionsTable } from './OpenCodeUsageRecentSessionsTable'
 import { UsageBreakdownSection } from './UsageBreakdownSection'
+import { UsageRecentSessionsTable } from './UsageRecentSessionsTable'
 import { translate } from '@/i18n/i18n'
 
 type OpenCodeUsageDetailsProps = {
@@ -58,7 +58,26 @@ export function OpenCodeUsageDetails({
         />
       </div>
 
-      <OpenCodeUsageRecentSessionsTable recentSessions={recentSessions} />
+      <UsageRecentSessionsTable
+        title={translate('auto.components.stats.OpenCodeUsagePane.4799177b1c', 'Recent sessions')}
+        description={translate(
+          'auto.components.stats.OpenCodeUsagePane.81817a641a',
+          'Most recent local OpenCode sessions in this scope.'
+        )}
+        headings={[
+          translate('auto.components.stats.OpenCodeUsagePane.d97bdf6e27', 'Last active'),
+          translate('auto.components.stats.OpenCodeUsagePane.a4738de041', 'Project'),
+          translate('auto.components.stats.OpenCodeUsagePane.08c78441b7', 'Model'),
+          translate('auto.components.stats.OpenCodeUsagePane.d416f5cf92', 'Events'),
+          translate('auto.components.stats.OpenCodeUsagePane.0f2f266c9d', 'Input'),
+          translate('auto.components.stats.OpenCodeUsagePane.dfc4513657', 'Output'),
+          translate('auto.components.stats.OpenCodeUsagePane.349f7c3f5c', 'Total')
+        ]}
+        unknownModel={translate('auto.components.stats.OpenCodeUsagePane.362231082f', 'Unknown')}
+        rows={recentSessions}
+        getActivity={(row) => row.events}
+        getTrailingTokens={(row) => row.totalTokens}
+      />
     </>
   )
 }
diff --git a/src/renderer/src/components/stats/OpenCodeUsagePane.tsx b/src/renderer/src/components/stats/OpenCodeUsagePane.tsx
index 6c11240a866..861800c99e5 100644
--- a/src/renderer/src/components/stats/OpenCodeUsagePane.tsx
+++ b/src/renderer/src/components/stats/OpenCodeUsagePane.tsx
@@ -1,34 +1,14 @@
 import { useEffect } from 'react'
-import {
-  Activity,
-  Brain,
-  Coins,
-  DatabaseZap,
-  FolderKanban,
-  RefreshCw,
-  SlidersHorizontal,
-  Sparkles
-} from 'lucide-react'
+import { Activity, Brain, Coins, DatabaseZap, FolderKanban, Sparkles } from 'lucide-react'
 import type {
   OpenCodeUsageRange,
   OpenCodeUsageScope
 } from '../../../../shared/opencode-usage-types'
 import { useAppStore } from '../../store'
-import { Button } from '../ui/button'
-import { Switch } from '../ui/switch'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuLabel,
-  DropdownMenuRadioGroup,
-  DropdownMenuRadioItem,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger
-} from '../ui/dropdown-menu'
-import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '../ui/tooltip'
 import { ClaudeUsageLoadingState } from './ClaudeUsageLoadingState'
 import { OpenCodeUsageDetails } from './OpenCodeUsageDetails'
 import { StatCard } from './StatCard'
+import { UsageFilterRadioGroup, UsageTrackingPaneShell } from './UsageTrackingPaneShell'
 import { formatCost, formatTokens, formatUpdatedAt } from './usage-formatters'
 import { translate } from '@/i18n/i18n'
 
@@ -90,44 +70,34 @@ export function OpenCodeUsagePane(): React.JSX.Element {
     void setOpenCodeUsageEnabled(enabled)
   }
 
+  const title = translate(
+    'auto.components.stats.OpenCodeUsagePane.bea80ceae0',
+    'OpenCode Usage Tracking'
+  )
+  const enableLabel = translate(
+    'auto.components.stats.OpenCodeUsagePane.f04131b3be',
+    'Enable OpenCode usage analytics'
+  )
+
   if (!scanState?.enabled) {
     return (
-      <div className="rounded-lg border border-border/60 bg-card/40 p-4">
-        <div className="flex items-start justify-between gap-4">
-          <div className="space-y-2">
-            <h3 className="text-sm font-semibold text-foreground">
-              {translate(
-                'auto.components.stats.OpenCodeUsagePane.bea80ceae0',
-                'OpenCode Usage Tracking'
-              )}
-            </h3>
-            <p className="text-sm text-muted-foreground">
-              {translate(
-                'auto.components.stats.OpenCodeUsagePane.b8b3522436',
-                'Reads local OpenCode usage logs to show token, model, and session stats.'
-              )}
-            </p>
-          </div>
-          <Switch
-            checked={false}
-            aria-label={translate(
-              'auto.components.stats.OpenCodeUsagePane.f04131b3be',
-              'Enable OpenCode usage analytics'
-            )}
-            onCheckedChange={handleSetEnabled}
-          />
-        </div>
-      </div>
+      <UsageTrackingPaneShell
+        enabled={false}
+        title={title}
+        disabledDescription={translate(
+          'auto.components.stats.OpenCodeUsagePane.b8b3522436',
+          'Reads local OpenCode usage logs to show token, model, and session stats.'
+        )}
+        enableLabel={enableLabel}
+        onEnabledChange={handleSetEnabled}
+      />
     )
   }
 
   if (!summary && (scanState.isScanning || scanState.lastScanCompletedAt === null)) {
     return (
       <ClaudeUsageLoadingState
-        title={translate(
-          'auto.components.stats.OpenCodeUsagePane.bea80ceae0',
-          'OpenCode Usage Tracking'
-        )}
+        title={title}
         summaryCardCount={6}
         summaryGridClassName="md:grid-cols-3"
       />
@@ -137,192 +107,116 @@ export function OpenCodeUsagePane(): React.JSX.Element {
   const hasAnyData = summary?.hasAnyOpenCodeData ?? scanState.hasAnyOpenCodeData
 
   return (
-    <div className="space-y-4 rounded-lg border border-border/60 bg-card/30 p-4">
-      <div className="flex items-start justify-between gap-4">
-        <div className="min-w-0 flex-1">
-          <h3 className="text-sm font-semibold text-foreground">
-            {translate(
-              'auto.components.stats.OpenCodeUsagePane.bea80ceae0',
-              'OpenCode Usage Tracking'
-            )}
-          </h3>
-          <p className="mt-1 text-xs text-muted-foreground">
-            {formatUpdatedAt(scanState.lastScanCompletedAt)}
-            {scanState.lastScanError
-              ? translate(
-                  'auto.components.stats.OpenCodeUsagePane.6cc7782458',
-                  ' • Last scan error: {{value0}}',
-                  { value0: scanState.lastScanError }
-                )
-              : ''}
-          </p>
-        </div>
-        <div className="flex shrink-0 items-center gap-2 self-start">
-          <DropdownMenu>
-            <TooltipProvider delayDuration={250}>
-              <Tooltip>
-                <TooltipTrigger asChild>
-                  <DropdownMenuTrigger asChild>
-                    <Button
-                      variant="ghost"
-                      size="icon-xs"
-                      aria-label={translate(
-                        'auto.components.stats.OpenCodeUsagePane.230d6de108',
-                        'OpenCode usage options'
-                      )}
-                    >
-                      <SlidersHorizontal className="size-3.5" />
-                    </Button>
-                  </DropdownMenuTrigger>
-                </TooltipTrigger>
-                <TooltipContent side="bottom" sideOffset={6}>
-                  {translate('auto.components.stats.OpenCodeUsagePane.01583b30aa', 'Filters')}
-                </TooltipContent>
-              </Tooltip>
-            </TooltipProvider>
-            <DropdownMenuContent align="end" className="w-60">
-              <DropdownMenuLabel>
-                {translate('auto.components.stats.OpenCodeUsagePane.40d283c837', 'Scope')}
-              </DropdownMenuLabel>
-              <DropdownMenuRadioGroup
-                value={scope}
-                onValueChange={(value) => void setOpenCodeUsageScope(value as OpenCodeUsageScope)}
-              >
-                {SCOPE_OPTIONS.map((option) => (
-                  <DropdownMenuRadioItem key={option.value} value={option.value}>
-                    {option.label}
-                  </DropdownMenuRadioItem>
-                ))}
-              </DropdownMenuRadioGroup>
-              <DropdownMenuSeparator />
-              <DropdownMenuLabel>
-                {translate('auto.components.stats.OpenCodeUsagePane.b5ed5c9fd0', 'Range')}
-              </DropdownMenuLabel>
-              <DropdownMenuRadioGroup
-                value={range}
-                onValueChange={(value) => void setOpenCodeUsageRange(value as OpenCodeUsageRange)}
-              >
-                {RANGE_OPTIONS.map((option) => (
-                  <DropdownMenuRadioItem key={option} value={option}>
-                    {RANGE_LABELS[option]}
-                  </DropdownMenuRadioItem>
-                ))}
-              </DropdownMenuRadioGroup>
-            </DropdownMenuContent>
-          </DropdownMenu>
-          <TooltipProvider delayDuration={250}>
-            <Tooltip>
-              <TooltipTrigger asChild>
-                <Button
-                  variant="ghost"
-                  size="icon-xs"
-                  onClick={() => void refreshOpenCodeUsage()}
-                  disabled={scanState.isScanning}
-                  aria-label={translate(
-                    'auto.components.stats.OpenCodeUsagePane.bed558df0b',
-                    'Refresh OpenCode usage'
-                  )}
-                >
-                  <RefreshCw className={`size-3.5 ${scanState.isScanning ? 'animate-spin' : ''}`} />
-                </Button>
-              </TooltipTrigger>
-              <TooltipContent side="bottom" sideOffset={6}>
-                {translate('auto.components.stats.OpenCodeUsagePane.603cd138dc', 'Refresh')}
-              </TooltipContent>
-            </Tooltip>
-          </TooltipProvider>
-          <Switch
-            checked
-            aria-label={translate(
-              'auto.components.stats.OpenCodeUsagePane.f04131b3be',
-              'Enable OpenCode usage analytics'
-            )}
-            onCheckedChange={handleSetEnabled}
-          />
-        </div>
-      </div>
-
-      <div className="flex items-center justify-between gap-3">
-        <p className="text-xs text-muted-foreground">
-          {SCOPE_OPTIONS.find((option) => option.value === scope)?.label} • {RANGE_LABELS[range]}
-        </p>
-      </div>
-
-      {!hasAnyData ? (
-        <div className="rounded-lg border border-dashed border-border/60 bg-card/30 px-4 py-6 text-sm text-muted-foreground">
-          {translate(
-            'auto.components.stats.OpenCodeUsagePane.bb6363e08c',
-            'No local OpenCode usage found yet for this scope.'
-          )}
-        </div>
-      ) : (
+    <UsageTrackingPaneShell
+      enabled
+      title={title}
+      status={
         <>
-          <div className="grid gap-3 md:grid-cols-3">
-            <StatCard
-              label={translate(
-                'auto.components.stats.OpenCodeUsagePane.d637a892ed',
-                'Input tokens'
-              )}
-              value={formatTokens(summary?.inputTokens ?? 0)}
-              icon={<Sparkles className="size-4" />}
-            />
-            <StatCard
-              label={translate(
-                'auto.components.stats.OpenCodeUsagePane.7aa4d8ce35',
-                'Output tokens'
-              )}
-              value={formatTokens(summary?.outputTokens ?? 0)}
-              icon={<Activity className="size-4" />}
-            />
-            <StatCard
-              label={translate(
-                'auto.components.stats.OpenCodeUsagePane.603504ee3b',
-                'Cached input'
-              )}
-              value={formatTokens(summary?.cachedInputTokens ?? 0)}
-              icon={<DatabaseZap className="size-4" />}
-            />
-            <StatCard
-              label={translate(
-                'auto.components.stats.OpenCodeUsagePane.5a65d68b77',
-                'Reasoning output'
-              )}
-              value={formatTokens(summary?.reasoningOutputTokens ?? 0)}
-              icon={<Brain className="size-4" />}
-            />
-            <StatCard
-              label={translate(
-                'auto.components.stats.OpenCodeUsagePane.7e9433469a',
-                'Sessions / Events'
-              )}
-              value={`${(summary?.sessions ?? 0).toLocaleString()} / ${(summary?.events ?? 0).toLocaleString()}`}
-              icon={<FolderKanban className="size-4" />}
-            />
-            <StatCard
-              label={translate(
-                'auto.components.stats.OpenCodeUsagePane.15c34d4b08',
-                'Recorded cost'
-              )}
-              value={formatCost(summary?.estimatedCostUsd ?? null)}
-              icon={<Coins className="size-4" />}
-            />
-          </div>
-          <p className="px-1 text-xs text-muted-foreground">
-            {translate(
-              'auto.components.stats.OpenCodeUsagePane.e5bb23d85e',
-              'Cost comes from the local OpenCode database when the assistant message recorded one.'
-            )}
-          </p>
-
-          <OpenCodeUsageDetails
-            daily={daily}
-            modelBreakdown={modelBreakdown}
-            projectBreakdown={projectBreakdown}
-            recentSessions={recentSessions}
-            summary={summary}
-          />
+          {formatUpdatedAt(scanState.lastScanCompletedAt)}
+          {scanState.lastScanError
+            ? translate(
+                'auto.components.stats.OpenCodeUsagePane.6cc7782458',
+                ' • Last scan error: {{value0}}',
+                { value0: scanState.lastScanError }
+              )
+            : ''}
         </>
+      }
+      isRefreshing={scanState.isScanning}
+      hasData={hasAnyData}
+      enableLabel={enableLabel}
+      optionsLabel={translate(
+        'auto.components.stats.OpenCodeUsagePane.230d6de108',
+        'OpenCode usage options'
       )}
-    </div>
+      filtersLabel={translate('auto.components.stats.OpenCodeUsagePane.01583b30aa', 'Filters')}
+      refreshAriaLabel={translate(
+        'auto.components.stats.OpenCodeUsagePane.bed558df0b',
+        'Refresh OpenCode usage'
+      )}
+      refreshLabel={translate('auto.components.stats.OpenCodeUsagePane.603cd138dc', 'Refresh')}
+      filterSections={[
+        <UsageFilterRadioGroup
+          key="scope"
+          label={translate('auto.components.stats.OpenCodeUsagePane.40d283c837', 'Scope')}
+          value={scope}
+          options={SCOPE_OPTIONS}
+          onValueChange={(value) => void setOpenCodeUsageScope(value)}
+        />,
+        <UsageFilterRadioGroup
+          key="range"
+          label={translate('auto.components.stats.OpenCodeUsagePane.b5ed5c9fd0', 'Range')}
+          value={range}
+          options={RANGE_OPTIONS.map((value) => ({ value, label: RANGE_LABELS[value] }))}
+          onValueChange={(value) => void setOpenCodeUsageRange(value)}
+        />
+      ]}
+      selectionSummary={
+        <>
+          {SCOPE_OPTIONS.find((option) => option.value === scope)?.label} • {RANGE_LABELS[range]}
+        </>
+      }
+      emptyMessage={translate(
+        'auto.components.stats.OpenCodeUsagePane.bb6363e08c',
+        'No local OpenCode usage found yet for this scope.'
+      )}
+      onEnabledChange={handleSetEnabled}
+      onRefresh={() => void refreshOpenCodeUsage()}
+    >
+      <>
+        <div className="grid gap-3 md:grid-cols-3">
+          <StatCard
+            label={translate('auto.components.stats.OpenCodeUsagePane.d637a892ed', 'Input tokens')}
+            value={formatTokens(summary?.inputTokens ?? 0)}
+            icon={<Sparkles className="size-4" />}
+          />
+          <StatCard
+            label={translate('auto.components.stats.OpenCodeUsagePane.7aa4d8ce35', 'Output tokens')}
+            value={formatTokens(summary?.outputTokens ?? 0)}
+            icon={<Activity className="size-4" />}
+          />
+          <StatCard
+            label={translate('auto.components.stats.OpenCodeUsagePane.603504ee3b', 'Cached input')}
+            value={formatTokens(summary?.cachedInputTokens ?? 0)}
+            icon={<DatabaseZap className="size-4" />}
+          />
+          <StatCard
+            label={translate(
+              'auto.components.stats.OpenCodeUsagePane.5a65d68b77',
+              'Reasoning output'
+            )}
+            value={formatTokens(summary?.reasoningOutputTokens ?? 0)}
+            icon={<Brain className="size-4" />}
+          />
+          <StatCard
+            label={translate(
+              'auto.components.stats.OpenCodeUsagePane.7e9433469a',
+              'Sessions / Events'
+            )}
+            value={`${(summary?.sessions ?? 0).toLocaleString()} / ${(summary?.events ?? 0).toLocaleString()}`}
+            icon={<FolderKanban className="size-4" />}
+          />
+          <StatCard
+            label={translate('auto.components.stats.OpenCodeUsagePane.15c34d4b08', 'Recorded cost')}
+            value={formatCost(summary?.estimatedCostUsd ?? null)}
+            icon={<Coins className="size-4" />}
+          />
+        </div>
+        <p className="px-1 text-xs text-muted-foreground">
+          {translate(
+            'auto.components.stats.OpenCodeUsagePane.e5bb23d85e',
+            'Cost comes from the local OpenCode database when the assistant message recorded one.'
+          )}
+        </p>
+
+        <OpenCodeUsageDetails
+          daily={daily}
+          modelBreakdown={modelBreakdown}
+          projectBreakdown={projectBreakdown}
+          recentSessions={recentSessions}
+          summary={summary}
+        />
+      </>
+    </UsageTrackingPaneShell>
   )
 }
diff --git a/src/renderer/src/components/stats/OpenCodeUsageRecentSessionsTable.tsx b/src/renderer/src/components/stats/OpenCodeUsageRecentSessionsTable.tsx
deleted file mode 100644
index ad8e3a38152..00000000000
--- a/src/renderer/src/components/stats/OpenCodeUsageRecentSessionsTable.tsx
+++ /dev/null
@@ -1,74 +0,0 @@
-import type { OpenCodeUsageSessionRow } from '../../../../shared/opencode-usage-types'
-import { translate } from '@/i18n/i18n'
-import { formatSessionTime, formatTokens } from './usage-formatters'
-
-export function OpenCodeUsageRecentSessionsTable({
-  recentSessions
-}: {
-  recentSessions: OpenCodeUsageSessionRow[]
-}): React.JSX.Element {
-  return (
-    <section className="rounded-lg border border-border/60 bg-card/40 p-4">
-      <div className="mb-3">
-        <h4 className="text-sm font-semibold text-foreground">
-          {translate('auto.components.stats.OpenCodeUsagePane.4799177b1c', 'Recent sessions')}
-        </h4>
-        <p className="text-xs text-muted-foreground">
-          {translate(
-            'auto.components.stats.OpenCodeUsagePane.81817a641a',
-            'Most recent local OpenCode sessions in this scope.'
-          )}
-        </p>
-      </div>
-      <div className="overflow-x-auto">
-        <table className="min-w-full text-sm">
-          <thead>
-            <tr className="border-b border-border/60 text-left text-xs text-muted-foreground">
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.OpenCodeUsagePane.d97bdf6e27', 'Last active')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.OpenCodeUsagePane.a4738de041', 'Project')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.OpenCodeUsagePane.08c78441b7', 'Model')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.OpenCodeUsagePane.d416f5cf92', 'Events')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.OpenCodeUsagePane.0f2f266c9d', 'Input')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.OpenCodeUsagePane.dfc4513657', 'Output')}
-              </th>
-              <th className="px-2 py-2 font-medium">
-                {translate('auto.components.stats.OpenCodeUsagePane.349f7c3f5c', 'Total')}
-              </th>
-            </tr>
-          </thead>
-          <tbody>
-            {recentSessions.map((row) => (
-              <tr key={row.sessionId} className="border-b border-border/40 last:border-b-0">
-                <td className="px-2 py-2 text-muted-foreground">
-                  {formatSessionTime(row.lastActiveAt)}
-                </td>
-                <td className="px-2 py-2 text-foreground">{row.projectLabel}</td>
-                <td className="px-2 py-2 text-muted-foreground">
-                  {row.model ??
-                    translate('auto.components.stats.OpenCodeUsagePane.362231082f', 'Unknown')}
-                </td>
-                <td className="px-2 py-2 text-muted-foreground">{row.events}</td>
-                <td className="px-2 py-2 text-muted-foreground">{formatTokens(row.inputTokens)}</td>
-                <td className="px-2 py-2 text-muted-foreground">
-                  {formatTokens(row.outputTokens)}
-                </td>
-                <td className="px-2 py-2 text-muted-foreground">{formatTokens(row.totalTokens)}</td>
-              </tr>
-            ))}
-          </tbody>
-        </table>
-      </div>
-    </section>
-  )
-}
diff --git a/src/renderer/src/components/stats/UsageRecentSessionsTable.tsx b/src/renderer/src/components/stats/UsageRecentSessionsTable.tsx
new file mode 100644
index 00000000000..1ffe503b858
--- /dev/null
+++ b/src/renderer/src/components/stats/UsageRecentSessionsTable.tsx
@@ -0,0 +1,86 @@
+import { formatSessionTime, formatTokens } from './usage-formatters'
+
+type UsageRecentSession = {
+  sessionId: string
+  lastActiveAt: string
+  projectLabel: string
+  model: string | null
+  inputTokens: number
+  outputTokens: number
+}
+
+type UsageRecentSessionHeadings = readonly [
+  lastActive: string,
+  project: string,
+  model: string,
+  activity: string,
+  input: string,
+  output: string,
+  trailing: string
+]
+
+type UsageRecentSessionsTableProps<Row extends UsageRecentSession> = {
+  title: React.ReactNode
+  description: React.ReactNode
+  headings: UsageRecentSessionHeadings
+  unknownModel: string
+  rows: readonly Row[]
+  getActivity: (row: Row) => number
+  getTrailingTokens: (row: Row) => number
+  getModelSuffix?: (row: Row) => React.ReactNode
+}
+
+export function UsageRecentSessionsTable<Row extends UsageRecentSession>({
+  title,
+  description,
+  headings,
+  unknownModel,
+  rows,
+  getActivity,
+  getTrailingTokens,
+  getModelSuffix
+}: UsageRecentSessionsTableProps<Row>): React.JSX.Element {
+  return (
+    <section className="rounded-lg border border-border/60 bg-card/40 p-4">
+      <div className="mb-3">
+        <h4 className="text-sm font-semibold text-foreground">{title}</h4>
+        <p className="text-xs text-muted-foreground">{description}</p>
+      </div>
+      <div className="overflow-x-auto">
+        <table className="min-w-full text-sm">
+          <thead>
+            <tr className="border-b border-border/60 text-left text-xs text-muted-foreground">
+              {headings.map((heading) => (
+                <th key={heading} className="px-2 py-2 font-medium">
+                  {heading}
+                </th>
+              ))}
+            </tr>
+          </thead>
+          <tbody>
+            {rows.map((row) => (
+              <tr key={row.sessionId} className="border-b border-border/40 last:border-b-0">
+                <td className="px-2 py-2 text-muted-foreground">
+                  {formatSessionTime(row.lastActiveAt)}
+                </td>
+                <td className="px-2 py-2 text-foreground">{row.projectLabel}</td>
+                <td className="px-2 py-2 text-muted-foreground">
+                  {row.model ?? unknownModel}
+                  {getModelSuffix?.(row)}
+                </td>
+                <td className="px-2 py-2 text-muted-foreground">{getActivity(row)}</td>
+                <td className="px-2 py-2 text-muted-foreground">{formatTokens(row.inputTokens)}</td>
+                <td className="px-2 py-2 text-muted-foreground">
+                  {formatTokens(row.outputTokens)}
+                </td>
+                <td className="px-2 py-2 text-muted-foreground">
+                  {formatTokens(getTrailingTokens(row))}
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+    </section>
+  )
+}
diff --git a/src/renderer/src/components/stats/UsageTrackingPaneShell.test.tsx b/src/renderer/src/components/stats/UsageTrackingPaneShell.test.tsx
new file mode 100644
index 00000000000..b4ba3dd2678
--- /dev/null
+++ b/src/renderer/src/components/stats/UsageTrackingPaneShell.test.tsx
@@ -0,0 +1,106 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+
+import { cleanup, render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { UsageFilterRadioGroup, UsageTrackingPaneShell } from './UsageTrackingPaneShell'
+
+afterEach(cleanup)
+
+function renderEnabled({
+  hasData = false,
+  isRefreshing = false
+}: { hasData?: boolean; isRefreshing?: boolean } = {}) {
+  const onEnabledChange = vi.fn()
+  const onRefresh = vi.fn()
+  const onScopeChange = vi.fn()
+
+  render(
+    <UsageTrackingPaneShell
+      enabled
+      title="Codex Usage Tracking"
+      status="Updated now"
+      isRefreshing={isRefreshing}
+      hasData={hasData}
+      enableLabel="Enable Codex usage analytics"
+      optionsLabel="Codex usage options"
+      filtersLabel="Filters"
+      refreshAriaLabel="Refresh Codex usage"
+      refreshLabel="Refresh"
+      filterSections={[
+        <UsageFilterRadioGroup
+          key="scope"
+          label="Scope"
+          value="orca"
+          options={[
+            { value: 'orca', label: 'Orca worktrees only' },
+            { value: 'all', label: 'All local usage' }
+          ]}
+          onValueChange={onScopeChange}
+        />,
+        <div key="range">Range filter</div>
+      ]}
+      selectionSummary="Orca worktrees only • Last 7 days"
+      emptyMessage="No local Codex usage found yet for this scope."
+      onEnabledChange={onEnabledChange}
+      onRefresh={onRefresh}
+      headerAction={<span>Share usage</span>}
+    >
+      <div>Ready content</div>
+    </UsageTrackingPaneShell>
+  )
+
+  return { onEnabledChange, onRefresh, onScopeChange }
+}
+
+describe('UsageTrackingPaneShell', () => {
+  it('renders the disabled state and enables tracking', async () => {
+    const onEnabledChange = vi.fn()
+    const user = userEvent.setup()
+    render(
+      <UsageTrackingPaneShell
+        enabled={false}
+        title="Codex Usage Tracking"
+        disabledDescription="Reads local Codex usage logs."
+        enableLabel="Enable Codex usage analytics"
+        onEnabledChange={onEnabledChange}
+      />
+    )
+
+    expect(screen.getByText('Reads local Codex usage logs.')).toBeInTheDocument()
+    await user.click(screen.getByRole('switch', { name: 'Enable Codex usage analytics' }))
+    expect(onEnabledChange).toHaveBeenCalledWith(true)
+  })
+
+  it('renders the empty state and wires header actions', async () => {
+    const user = userEvent.setup()
+    const { onEnabledChange, onRefresh, onScopeChange } = renderEnabled()
+
+    expect(screen.getByText('Updated now')).toBeInTheDocument()
+    expect(screen.getByText('Share usage')).toBeInTheDocument()
+    expect(screen.getByText('Orca worktrees only • Last 7 days')).toBeInTheDocument()
+    expect(screen.getByText('No local Codex usage found yet for this scope.')).toBeInTheDocument()
+    expect(screen.queryByText('Ready content')).not.toBeInTheDocument()
+
+    await user.click(screen.getByRole('button', { name: 'Codex usage options' }))
+    expect(screen.getByRole('separator')).toBeInTheDocument()
+    await user.click(screen.getByRole('menuitemradio', { name: 'All local usage' }))
+    await user.click(screen.getByRole('button', { name: 'Refresh Codex usage' }))
+    await user.click(screen.getByRole('switch', { name: 'Enable Codex usage analytics' }))
+    expect(onScopeChange).toHaveBeenCalledWith('all')
+    expect(onRefresh).toHaveBeenCalledOnce()
+    expect(onEnabledChange).toHaveBeenCalledWith(false)
+  })
+
+  it('renders ready content and disables refresh while scanning', () => {
+    renderEnabled({ hasData: true, isRefreshing: true })
+
+    expect(screen.getByText('Ready content')).toBeInTheDocument()
+    expect(
+      screen.queryByText('No local Codex usage found yet for this scope.')
+    ).not.toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Refresh Codex usage' })).toBeDisabled()
+  })
+})
diff --git a/src/renderer/src/components/stats/UsageTrackingPaneShell.tsx b/src/renderer/src/components/stats/UsageTrackingPaneShell.tsx
new file mode 100644
index 00000000000..5ca091f4d19
--- /dev/null
+++ b/src/renderer/src/components/stats/UsageTrackingPaneShell.tsx
@@ -0,0 +1,160 @@
+import { Fragment, type ReactElement, type ReactNode } from 'react'
+import { RefreshCw, SlidersHorizontal } from 'lucide-react'
+import { Button } from '../ui/button'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuLabel,
+  DropdownMenuRadioGroup,
+  DropdownMenuRadioItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger
+} from '../ui/dropdown-menu'
+import { Switch } from '../ui/switch'
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '../ui/tooltip'
+
+type UsageFilterRadioGroupProps<Value extends string> = {
+  label: ReactNode
+  value: Value
+  options: readonly { value: Value; label: ReactNode }[]
+  onValueChange: (value: Value) => void | Promise<void>
+}
+
+export function UsageFilterRadioGroup<Value extends string>({
+  label,
+  value,
+  options,
+  onValueChange
+}: UsageFilterRadioGroupProps<Value>): React.JSX.Element {
+  return (
+    <>
+      <DropdownMenuLabel>{label}</DropdownMenuLabel>
+      <DropdownMenuRadioGroup
+        value={value}
+        onValueChange={(nextValue) => void onValueChange(nextValue as Value)}
+      >
+        {options.map((option) => (
+          <DropdownMenuRadioItem key={option.value} value={option.value}>
+            {option.label}
+          </DropdownMenuRadioItem>
+        ))}
+      </DropdownMenuRadioGroup>
+    </>
+  )
+}
+
+type UsageTrackingPaneShellProps = {
+  title: ReactNode
+  enableLabel: string
+  onEnabledChange: (enabled: boolean) => void
+} & (
+  | {
+      enabled: false
+      disabledDescription: ReactNode
+    }
+  | {
+      enabled: true
+      status: ReactNode
+      isRefreshing: boolean
+      hasData: boolean
+      optionsLabel: string
+      filtersLabel: ReactNode
+      refreshAriaLabel: string
+      refreshLabel: ReactNode
+      filterSections: readonly ReactElement[]
+      selectionSummary: ReactNode
+      emptyMessage: ReactNode
+      onRefresh: () => void | Promise<void>
+      headerAction?: ReactNode
+      children: ReactNode
+    }
+)
+
+export function UsageTrackingPaneShell(props: UsageTrackingPaneShellProps): React.JSX.Element {
+  if (!props.enabled) {
+    return (
+      <div className="rounded-lg border border-border/60 bg-card/40 p-4">
+        <div className="flex items-start justify-between gap-4">
+          <div className="space-y-2">
+            <h3 className="text-sm font-semibold text-foreground">{props.title}</h3>
+            <p className="text-sm text-muted-foreground">{props.disabledDescription}</p>
+          </div>
+          <Switch
+            checked={false}
+            aria-label={props.enableLabel}
+            onCheckedChange={props.onEnabledChange}
+          />
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="space-y-4 rounded-lg border border-border/60 bg-card/30 p-4">
+      <div className="flex items-start justify-between gap-4">
+        <div className="min-w-0 flex-1">
+          <h3 className="text-sm font-semibold text-foreground">{props.title}</h3>
+          <p className="mt-1 text-xs text-muted-foreground">{props.status}</p>
+        </div>
+        <div className="flex shrink-0 items-center gap-2 self-start">
+          {props.headerAction}
+          <DropdownMenu>
+            <TooltipProvider delayDuration={250}>
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <DropdownMenuTrigger asChild>
+                    <Button variant="ghost" size="icon-xs" aria-label={props.optionsLabel}>
+                      <SlidersHorizontal className="size-3.5" />
+                    </Button>
+                  </DropdownMenuTrigger>
+                </TooltipTrigger>
+                <TooltipContent side="bottom" sideOffset={6}>
+                  {props.filtersLabel}
+                </TooltipContent>
+              </Tooltip>
+            </TooltipProvider>
+            <DropdownMenuContent align="end" className="w-60">
+              {props.filterSections.map((section, index) => (
+                <Fragment key={section.key}>
+                  {index > 0 && <DropdownMenuSeparator />}
+                  {section}
+                </Fragment>
+              ))}
+            </DropdownMenuContent>
+          </DropdownMenu>
+          <TooltipProvider delayDuration={250}>
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <Button
+                  variant="ghost"
+                  size="icon-xs"
+                  onClick={() => void props.onRefresh()}
+                  disabled={props.isRefreshing}
+                  aria-label={props.refreshAriaLabel}
+                >
+                  <RefreshCw className={`size-3.5 ${props.isRefreshing ? 'animate-spin' : ''}`} />
+                </Button>
+              </TooltipTrigger>
+              <TooltipContent side="bottom" sideOffset={6}>
+                {props.refreshLabel}
+              </TooltipContent>
+            </Tooltip>
+          </TooltipProvider>
+          <Switch checked aria-label={props.enableLabel} onCheckedChange={props.onEnabledChange} />
+        </div>
+      </div>
+
+      <div className="flex items-center justify-between gap-3">
+        <p className="text-xs text-muted-foreground">{props.selectionSummary}</p>
+      </div>
+
+      {!props.hasData ? (
+        <div className="rounded-lg border border-dashed border-border/60 bg-card/30 px-4 py-6 text-sm text-muted-foreground">
+          {props.emptyMessage}
+        </div>
+      ) : (
+        props.children
+      )}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/status-bar/CaffeinateStatusSegment.tsx b/src/renderer/src/components/status-bar/CaffeinateStatusSegment.tsx
index b991e63a096..6bf6daabcad 100644
--- a/src/renderer/src/components/status-bar/CaffeinateStatusSegment.tsx
+++ b/src/renderer/src/components/status-bar/CaffeinateStatusSegment.tsx
@@ -31,7 +31,7 @@ function modeLabel(mode: ComputerAwakeMode): string {
     return translate('auto.components.status.bar.CaffeinateStatusSegment.on', 'On')
   }
   if (mode === 'auto') {
-    return translate('auto.components.status.bar.CaffeinateStatusSegment.auto', 'Auto')
+    return translate('auto.components.status.bar.CaffeinateStatusSegment.auto', 'Agent')
   }
   return translate('auto.components.status.bar.CaffeinateStatusSegment.off', 'Off')
 }
@@ -137,7 +137,7 @@ export function CaffeinateStatusSegment({
         </DropdownMenuLabel>
         <DropdownMenuSeparator />
         <DropdownMenuRadioGroup value={mode} onValueChange={setMode}>
-          <DropdownMenuRadioItem value="on" className="items-start py-1.5">
+          <DropdownMenuRadioItem value="on" className="py-1.5">
             <span className="flex flex-col">
               <span>{modeLabel('on')}</span>
               <span className="text-[11px] font-normal text-muted-foreground">
@@ -148,7 +148,7 @@ export function CaffeinateStatusSegment({
               </span>
             </span>
           </DropdownMenuRadioItem>
-          <DropdownMenuRadioItem value="auto" className="items-start py-1.5">
+          <DropdownMenuRadioItem value="auto" className="py-1.5">
             <span className="flex flex-col">
               <span>{modeLabel('auto')}</span>
               <span className="text-[11px] font-normal text-muted-foreground">
@@ -159,7 +159,7 @@ export function CaffeinateStatusSegment({
               </span>
             </span>
           </DropdownMenuRadioItem>
-          <DropdownMenuRadioItem value="off" className="items-start py-1.5">
+          <DropdownMenuRadioItem value="off" className="py-1.5">
             <span className="flex flex-col">
               <span>{modeLabel('off')}</span>
               <span className="text-[11px] font-normal text-muted-foreground">
diff --git a/src/renderer/src/components/status-bar/mergeSnapshotAndSessions.ts b/src/renderer/src/components/status-bar/mergeSnapshotAndSessions.ts
index d02588001b9..baf9c189fde 100644
--- a/src/renderer/src/components/status-bar/mergeSnapshotAndSessions.ts
+++ b/src/renderer/src/components/status-bar/mergeSnapshotAndSessions.ts
@@ -69,7 +69,7 @@ function resolveSnapshotSessionLabel(
   if (parsed) {
     const tabs = ctx.tabsByWorktree[worktreeId] ?? []
     const tabIndex = tabs.findIndex((t) => t.id === parsed.tabId)
-    const tab = tabIndex >= 0 ? tabs[tabIndex] : undefined
+    const tab = tabIndex !== -1 ? tabs[tabIndex] : undefined
     if (tab) {
       const custom = tab.customTitle?.trim()
       if (custom) {
@@ -94,7 +94,7 @@ function resolveDaemonSessionLabel(
   if (tabId && resolvedWorktreeId) {
     const tabs = ctx.tabsByWorktree[resolvedWorktreeId] ?? []
     const tabIndex = tabs.findIndex((t) => t.id === tabId)
-    const tab = tabIndex >= 0 ? tabs[tabIndex] : undefined
+    const tab = tabIndex !== -1 ? tabs[tabIndex] : undefined
     if (tab) {
       const custom = tab.customTitle?.trim()
       if (custom) {
diff --git a/src/renderer/src/components/status-bar/resource-usage-open-slices.test.ts b/src/renderer/src/components/status-bar/resource-usage-open-slices.test.ts
index 58a51eed488..85663bc2090 100644
--- a/src/renderer/src/components/status-bar/resource-usage-open-slices.test.ts
+++ b/src/renderer/src/components/status-bar/resource-usage-open-slices.test.ts
@@ -117,7 +117,16 @@ describe('resource usage open slices', () => {
   })
 
   it('gates repo and worktree slices only while closed', () => {
-    const repos = [{ id: 'repo-1', path: '/repo', kind: 'git' }] as AppState['repos']
+    const repos = [
+      {
+        id: 'repo-1',
+        path: '/repo',
+        displayName: 'repo',
+        badgeColor: 'blue',
+        addedAt: 1,
+        kind: 'git'
+      }
+    ] as AppState['repos']
     const row = worktree()
     const worktreesByRepo = {
       'repo-1': [row]
diff --git a/src/renderer/src/components/tab-bar/BrowserTab.tsx b/src/renderer/src/components/tab-bar/BrowserTab.tsx
index 87a268f75f9..e0ecca579d2 100644
--- a/src/renderer/src/components/tab-bar/BrowserTab.tsx
+++ b/src/renderer/src/components/tab-bar/BrowserTab.tsx
@@ -142,7 +142,7 @@ export default function BrowserTab({
   onCloseOthers: () => void
   onCloseToRight: () => void
   onCloseToLeft: () => void
-  onDuplicate: () => void
+  onDuplicate?: () => void
   onTogglePin: () => void
   dragData: TabDragItemData
   dropIndicator?: DropIndicator
@@ -307,11 +307,15 @@ export default function BrowserTab({
             groupId={dragData.groupId}
             trailingSeparator
           />
-          <DropdownMenuItem onSelect={onDuplicate}>
-            <Copy className="size-3.5" />
-            {translate('auto.components.tab.bar.BrowserTab.5d6e89891f', 'Duplicate Tab')}
-          </DropdownMenuItem>
-          <DropdownMenuSeparator />
+          {onDuplicate ? (
+            <>
+              <DropdownMenuItem onSelect={onDuplicate}>
+                <Copy className="size-3.5" />
+                {translate('auto.components.tab.bar.BrowserTab.5d6e89891f', 'Duplicate Tab')}
+              </DropdownMenuItem>
+              <DropdownMenuSeparator />
+            </>
+          ) : null}
           <DropdownMenuItem onSelect={onTogglePin}>
             {isPinned ? <PinOff className="size-3.5" /> : <Pin className="size-3.5" />}
             {isPinned
diff --git a/src/renderer/src/components/tab-bar/TabBar.context-menu.test.ts b/src/renderer/src/components/tab-bar/TabBar.context-menu.test.ts
index 7b3e18d0a18..c8c940c865f 100644
--- a/src/renderer/src/components/tab-bar/TabBar.context-menu.test.ts
+++ b/src/renderer/src/components/tab-bar/TabBar.context-menu.test.ts
@@ -497,6 +497,26 @@ describe('TabBar context menu wiring', () => {
     expect(menuLabels[3]).toContain('New Browser Tab')
   })
 
+  it('omits impossible paired-web actions while keeping terminal and markdown', async () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const element = await renderTabBar({
+      tabs: [TERMINAL_TAB],
+      onNewFileTab: () => {},
+      onOpenFileTab: () => {},
+      onNewSimulatorTab: () => {}
+    })
+
+    const menuLabels = findChildrenByType(element, 'DropdownMenuItem').map((item) =>
+      extractText(item.props.children)
+    )
+
+    expect(menuLabels.some((label) => label.includes('New Terminal'))).toBe(true)
+    expect(menuLabels.some((label) => label.includes('New Markdown'))).toBe(true)
+    expect(menuLabels.some((label) => label.includes('Open Markdown...'))).toBe(true)
+    expect(menuLabels.some((label) => label.includes('Browser'))).toBe(false)
+    expect(menuLabels.some((label) => label.includes('Mobile Emulator'))).toBe(false)
+  })
+
   it('turns New Mobile Emulator into a go-to action when the workspace already has one', async () => {
     const onNewSimulatorTab = vi.fn()
     appStoreSnapshot.unifiedTabsByWorktree = {
diff --git a/src/renderer/src/components/tab-bar/TabBar.tsx b/src/renderer/src/components/tab-bar/TabBar.tsx
index 9e9a5bf580b..42aab95c37e 100644
--- a/src/renderer/src/components/tab-bar/TabBar.tsx
+++ b/src/renderer/src/components/tab-bar/TabBar.tsx
@@ -1,1286 +1,88 @@
-/* oxlint-disable max-lines -- Why: per-type tab render branches (terminal/browser/editor) share little beyond drag data; consolidating costs more clarity than the ~5 lines it saves. */
-import React, { useEffect, useMemo, useRef, useState } from 'react'
-import { useShallow } from 'zustand/react/shallow'
-import { SortableContext } from '@dnd-kit/sortable'
-import {
-  ChevronLeft,
-  ChevronRight,
-  FilePlus,
-  FileText,
-  Globe,
-  Plus,
-  Smartphone,
-  TerminalSquare
-} from 'lucide-react'
-import { toast } from 'sonner'
-import type {
-  BrowserTab as BrowserTabState,
-  Tab,
-  TerminalTab,
-  TuiAgent,
-  WorkspaceVisibleTabType
-} from '../../../../shared/types'
-import type { ProjectExecutionRuntimeResolution } from '../../../../shared/project-execution-runtime'
-import { resolveTerminalTabTitle } from '../../../../shared/tab-title-resolution'
-import { useAppStore } from '../../store'
-import { buildStatusMap } from '../right-sidebar/status-display'
-import type { OpenFile } from '../../store/slices/editor'
-import SortableTab from './SortableTab'
-import EditorFileTab from './EditorFileTab'
-import BrowserTab, { getBrowserTabLabel } from './BrowserTab'
-import { QuickLaunchAgentMenuItems } from './QuickLaunchButton'
-import type { DropIndicator } from './drop-indicator'
-import { reconcileTabOrder } from './reconcile-order'
-import type { HoveredTabInsertion, TabDragItemData } from '../tab-group/useTabDragSplit'
-import { resolveTabIndicatorEdges } from '../tab-group/tab-insertion'
-import { getEditorDisplayLabel } from '@/components/editor/editor-labels'
-import TabBarCreateEntry from './TabBarCreateEntry'
-import { ShellIcon } from './shell-icons'
-import { resolveWindowsShellLaunchTarget } from './windows-shell-launch'
-import { focusTerminalTabSurface } from '@/lib/focus-terminal-tab-surface'
-import { useDetectedAgents } from '@/hooks/useDetectedAgents'
-import { useAgentDetectionTargetForWorktree } from '@/hooks/useAgentDetectionTarget'
-import { launchAgentInNewTab } from '@/lib/launch-agent-in-new-tab'
-import { normalizeRelativePath } from '@/lib/path'
-import {
-  getWindowsTerminalCapabilityOwnerKey,
-  useWindowsTerminalCapabilities
-} from '@/lib/windows-terminal-capabilities'
-import { getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
-import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
-import { getLocalProjectExecutionRuntimeContext } from '@/lib/local-preflight-context'
-import { getConnectionIdFromState } from '@/lib/connection-context'
-import { useOptionalShortcutLabel, useShortcutLabel } from '@/hooks/useShortcutLabel'
-import {
-  type BuiltInWindowsTerminalShell,
-  WINDOWS_GIT_BASH_SHELL
-} from '../../../../shared/windows-terminal-shell'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuSeparator,
-  DropdownMenuShortcut,
-  DropdownMenuTrigger
-} from '@/components/ui/dropdown-menu'
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
-import { Button } from '@/components/ui/button'
-import type { TabCreateEntryArgs } from './tab-create-entry-action'
-import { buildTabAgentLaunchOptions, orderTabLaunchAgents } from './tab-agent-launch-options'
-import { buildTabCreateMenuOptions, type TabCreateMenuOption } from './tab-create-menu-options'
-import { MobileEmulatorTabIntroCallout } from '../emulator-pane/MobileEmulatorTabIntroCallout'
-import { shouldShowMobileEmulatorTabIntro } from '../emulator-pane/mobile-emulator-tab-intro-visibility'
-import { translate } from '@/i18n/i18n'
-import { TabStripScrollIndicator } from './TabStripScrollIndicator'
-import { getTabStripScrollMaskClassName } from './tab-strip-scroll-metrics'
+import React from 'react'
 import { useTabStripOverflowNavigation } from './tab-strip-overflow-navigation'
 import { useTabStripDragScrollHandlers } from './tab-strip-drag-scroll'
-import { shouldShowWindowsShellMenu } from './windows-shell-menu-visibility'
-import { canToggleNativeChat } from '../native-chat/native-chat-availability'
-import { isNativeChatTranscriptLocalReadable } from '@/lib/native-chat-transcript-readability'
-import { selectTabBarAgentProjections } from './tab-agent-types-by-tab-id'
-import { resolveCommittedTitleAgentType } from '@/lib/pane-agent-evidence'
+import type { TabBarProps } from './tab-bar-props'
+import type { TabBarItem } from './tab-bar-item-model'
+import { useTabBarRuntimeModel } from './use-tab-bar-runtime-model'
+import { useTabBarCreateMenuController } from './use-tab-bar-create-menu-controller'
+import { useTabBarItemProjection } from './use-tab-bar-item-projection'
+import { renderTabBarSurface } from './tab-bar-surface'
 
-const isWindows = navigator.userAgent.includes('Windows')
-const isMacOs = navigator.userAgent.includes('Mac')
-const NEW_TAB_MENU_TERMINAL_FOCUS_RETRY_MS = 50
-const NEW_TAB_MENU_TERMINAL_FOCUS_TIMEOUT_MS = 5000
-type GitStatusEntries = ReturnType<typeof useAppStore.getState>['gitStatusByWorktree'][string]
-const EMPTY_GIT_STATUS_ENTRIES: GitStatusEntries = []
-const EMPTY_AGENT_CMD_OVERRIDES: Partial<Record<TuiAgent, string>> = {}
-const EMPTY_UNIFIED_TABS: readonly Tab[] = []
-
-function getProjectRuntimeShellMenuMode(
-  projectRuntime: ProjectExecutionRuntimeResolution | undefined
-): 'host' | 'wsl' | null {
-  if (!projectRuntime) {
-    return null
-  }
-  if (projectRuntime.status === 'repair-required') {
-    return 'wsl'
-  }
-  return projectRuntime.runtime.kind === 'wsl' ? 'wsl' : 'host'
-}
-
-type TabBarProps = {
-  tabs: (TerminalTab & { unifiedTabId?: string })[]
-  activeTabId: string | null
-  groupId?: string
-  worktreeId: string
-  expandedPaneByTabId: Record<string, boolean>
-  onActivate: (tabId: string) => void
-  onClose: (tabId: string) => void
-  onCloseOthers: (tabId: string) => void
-  onCloseToRight: (tabId: string) => void
-  onCloseToLeft: (tabId: string) => void
-  onNewTerminalTab: () => void
-  /** On Windows, opens a new terminal with a specific shell instead of the default. */
-  onNewTerminalWithShell?: (shell: string) => void
-  onNewBrowserTab: () => void
-  onNewSimulatorTab?: () => void
-  onOpenEntry?: (args: TabCreateEntryArgs) => Promise<void>
-  terminalOnly?: boolean
-  showAgentLaunchItems?: boolean
-  onNewFileTab?: () => void
-  onOpenFileTab?: () => void
-  newTabMenuOrder?: 'default' | 'markdown-first'
-  onSetCustomTitle: (tabId: string, title: string | null) => void
-  onSetTabColor: (tabId: string, color: string | null) => void
-  onTogglePaneExpand: (tabId: string) => void
-  editorFiles?: (OpenFile & { tabId?: string })[]
-  browserTabs?: (BrowserTabState & { tabId?: string })[]
-  activeFileId?: string | null
-  activeBrowserTabId?: string | null
-  activeSimulatorTabId?: string | null
-  activeTabType?: WorkspaceVisibleTabType
-  onActivateFile?: (fileId: string) => void
-  onCloseFile?: (fileId: string) => void
-  onActivateBrowserTab?: (tabId: string) => void
-  onCloseBrowserTab?: (tabId: string) => void
-  onDuplicateBrowserTab?: (tabId: string) => void
-  onCloseAllFiles?: () => void
-  onMakePreviewFilePermanent?: (fileId: string, tabId?: string) => void
-  onPinFile?: (fileId: string, tabId?: string) => void
-  tabBarOrder?: string[]
-  hoveredTabInsertion?: HoveredTabInsertion | null
-  /** Floating workspace panels are rounded; skip tab top borders that clash with the curve. */
-  tabStripChrome?: 'default' | 'floating-panel'
-}
-
-type TabItem =
-  | {
-      type: 'terminal'
-      id: string
-      unifiedTabId: string
-      isPinned: boolean
-      data: TerminalTab & { unifiedTabId?: string }
-    }
-  | {
-      type: 'editor'
-      id: string
-      unifiedTabId: string
-      isPinned: boolean
-      data: OpenFile & { tabId?: string }
-    }
-  | {
-      type: 'browser'
-      id: string
-      unifiedTabId: string
-      isPinned: boolean
-      data: BrowserTabState & { tabId?: string }
-    }
-  | {
-      type: 'simulator'
-      id: string
-      unifiedTabId: string
-      isPinned: boolean
-      data: Tab
-    }
-
-function getTabDragLabel(item: TabItem, generatedTitlesEnabled: boolean): string {
-  if (item.type === 'terminal') {
-    return resolveTerminalTabTitle(item.data, generatedTitlesEnabled, item.data.title)
-  }
-  if (item.type === 'browser') {
-    return getBrowserTabLabel(item.data)
-  }
-  if (item.type === 'simulator') {
-    return item.data.label || 'Mobile Emulator'
-  }
-  return getEditorDisplayLabel(item.data)
-}
-
-function getTabLayoutSignature(
-  item: TabItem,
-  {
-    generatedTitlesEnabled,
-    isExpanded,
-    status
-  }: {
-    generatedTitlesEnabled: boolean
-    isExpanded: boolean
-    status?: string | null
-  }
-): string {
-  const label = getTabDragLabel(item, generatedTitlesEnabled)
-  if (item.type === 'terminal') {
-    return `${item.type}:${item.id}:${item.isPinned}:${isExpanded}:${Boolean(item.data.color)}:${label}`
-  }
-  if (item.type === 'browser') {
-    return `${item.type}:${item.id}:${item.isPinned}:${item.data.loading}:${Boolean(item.data.loadError)}:${label}`
-  }
-  if (item.type === 'editor') {
-    return `${item.type}:${item.id}:${item.isPinned}:${item.data.isDirty}:${item.data.isPreview}:${item.data.externalMutation ?? ''}:${status ?? ''}:${label}`
-  }
-  return `${item.type}:${item.id}:${item.isPinned}:${label}`
-}
-
-function createUnifiedTabLookup(tabs: readonly Tab[], groupId: string): Map<string, Tab> {
-  const lookup = new Map<string, Tab>()
-  for (const tab of tabs) {
-    if (tab.groupId !== groupId) {
-      continue
-    }
-    lookup.set(tab.id, tab)
-    if (tab.contentType === 'terminal' || tab.contentType === 'browser') {
-      lookup.set(tab.entityId, tab)
-    }
-  }
-  return lookup
-}
-
-function TabBarInner({
-  tabs,
-  activeTabId,
-  groupId,
-  worktreeId,
-  expandedPaneByTabId,
-  onActivate,
-  onClose,
-  onCloseOthers,
-  onCloseToRight,
-  onCloseToLeft,
-  onNewTerminalTab,
-  onNewTerminalWithShell,
-  onNewBrowserTab,
-  onNewSimulatorTab,
-  onOpenEntry,
-  terminalOnly = false,
-  showAgentLaunchItems = true,
-  onNewFileTab,
-  onOpenFileTab,
-  newTabMenuOrder = 'default',
-  onSetCustomTitle,
-  onSetTabColor,
-  onTogglePaneExpand,
-  editorFiles,
-  browserTabs,
-  activeFileId,
-  activeBrowserTabId,
-  activeSimulatorTabId,
-  activeTabType,
-  onActivateFile,
-  onCloseFile,
-  onActivateBrowserTab,
-  onCloseBrowserTab,
-  onDuplicateBrowserTab,
-  onCloseAllFiles,
-  onMakePreviewFilePermanent,
-  onPinFile,
-  tabBarOrder,
-  hoveredTabInsertion,
-  tabStripChrome = 'default'
-}: TabBarProps): React.JSX.Element {
-  const includeTopTabBorder = tabStripChrome !== 'floating-panel'
-  const newTerminalShortcut = useShortcutLabel('tab.newTerminal')
-  const newBrowserShortcut = useShortcutLabel('tab.newBrowser')
-  const newSimulatorShortcut = useShortcutLabel('tab.newSimulator')
-  const newFileShortcut = useShortcutLabel('tab.newMarkdown')
-  const openMarkdownShortcut = useOptionalShortcutLabel('tab.openMarkdown')
-  const generatedTabTitlesEnabled = useAppStore((s) => s.settings?.tabAutoGenerateTitle === true)
-  const mobileEmulatorEnabled = useAppStore((s) => s.settings?.mobileEmulatorEnabled !== false)
-  const persistedUIReady = useAppStore((s) => s.persistedUIReady)
-  const mobileEmulatorTabIntroDismissed = useAppStore((s) => s.mobileEmulatorTabIntroDismissed)
-  const showMobileEmulatorIntroCallout = shouldShowMobileEmulatorTabIntro({
-    persistedUIReady,
-    mobileEmulatorTabIntroDismissed,
-    mobileEmulatorEnabled,
-    isMacOs
-  })
-  const gitStatusEntries = useAppStore(
-    (s) => s.gitStatusByWorktree[worktreeId] ?? EMPTY_GIT_STATUS_ENTRIES
-  )
-  const unifiedTabs = useAppStore((s) => s.unifiedTabsByWorktree[worktreeId] ?? EMPTY_UNIFIED_TABS)
-  const pinTab = useAppStore((s) => s.pinTab)
-  const unpinTab = useAppStore((s) => s.unpinTab)
-  const activeGroupIdForWorktree = useAppStore((s) => s.activeGroupIdByWorktree[worktreeId])
-  const defaultWindowsShell = useAppStore(
-    (s) => s.settings?.terminalWindowsShell ?? 'powershell.exe'
-  )
-  const defaultWindowsPowerShellImplementation = useAppStore(
-    (s) => s.settings?.terminalWindowsPowerShellImplementation ?? 'auto'
-  )
-  const activeRepoId = useAppStore((s) => s.activeRepoId)
-  const activeWorktreeId = useAppStore((s) => s.activeWorktreeId)
-  const projects = useAppStore((s) => s.projects)
-  const repos = useAppStore((s) => s.repos)
-  const settings = useAppStore((s) => s.settings)
-  const worktreesByRepo = useAppStore((s) => s.worktreesByRepo)
-  // Why: use the worktree's owning host so offered Windows shells match the host that actually runs the terminal.
-  const activeRuntimeEnvironmentId = useAppStore(
-    (s) => getRuntimeEnvironmentIdForWorktree(s, worktreeId)?.trim() || null
-  )
-  // Why: retained tab strips rerun selectors on every store write; reuse canonical indexes, don't flatten both slices here.
-  const worktreeConnectionId = useAppStore(
-    (s) => getConnectionIdFromState(s, worktreeId)?.trim() || null
-  )
-  const worktreeRemotePlatform = useAppStore((s) => {
-    if (!worktreeConnectionId) {
-      return null
-    }
-    return s.sshConnectionStates.get(worktreeConnectionId)?.remotePlatform ?? null
-  })
-  const defaultAgent = useAppStore((s) => s.settings?.defaultTuiAgent)
-  const agentCmdOverrides = useAppStore(
-    (s) => s.settings?.agentCmdOverrides ?? EMPTY_AGENT_CMD_OVERRIDES
-  )
-  const agentDetectionTarget = useAgentDetectionTargetForWorktree(worktreeId)
-  const { detectedIds } = useDetectedAgents(agentDetectionTarget)
-  const agentLaunchOptions = useMemo(
-    () =>
-      buildTabAgentLaunchOptions(
-        orderTabLaunchAgents(defaultAgent, detectedIds ?? []),
-        agentCmdOverrides
-      ),
-    [agentCmdOverrides, defaultAgent, detectedIds]
-  )
-  const isWebClient = (globalThis as { __ORCA_WEB_CLIENT__?: boolean }).__ORCA_WEB_CLIENT__ === true
-  const windowsTerminalCapabilityOwnerKey = getWindowsTerminalCapabilityOwnerKey(
-    activeRuntimeEnvironmentId,
-    worktreeConnectionId
-  )
-  const runtimeTarget = useMemo(
-    () => getActiveRuntimeTarget({ activeRuntimeEnvironmentId }),
-    [activeRuntimeEnvironmentId]
-  )
-  const shouldProbeWindowsShellCapabilities =
-    isWindows ||
-    Boolean(activeRuntimeEnvironmentId?.trim()) ||
-    isWebClient ||
-    Boolean(worktreeConnectionId)
-  const windowsTerminalCapabilities = useWindowsTerminalCapabilities(
-    shouldProbeWindowsShellCapabilities,
-    false,
-    windowsTerminalCapabilityOwnerKey,
-    runtimeTarget,
-    worktreeConnectionId
-  )
-  const shellMenuHostPlatform = worktreeConnectionId
-    ? (worktreeRemotePlatform ?? windowsTerminalCapabilities.hostPlatform)
-    : windowsTerminalCapabilities.hostPlatform
-  const showWindowsShellMenu = shouldShowWindowsShellMenu({
-    activeRuntimeEnvironmentId,
-    hostPlatform: shellMenuHostPlatform,
-    isWindowsClient: isWindows,
-    worktreeHasRemoteConnection: Boolean(worktreeConnectionId)
-  })
-  const localProjectRuntime = useMemo(() => {
-    if (!showWindowsShellMenu || activeRuntimeEnvironmentId?.trim() || worktreeConnectionId) {
-      return undefined
-    }
-    return getLocalProjectExecutionRuntimeContext(
-      {
-        activeRepoId,
-        activeWorktreeId,
-        projects,
-        repos,
-        settings,
-        worktreesByRepo
-      },
-      worktreeId,
-      'win32',
-      {
-        wslAvailable: windowsTerminalCapabilities.isLoading
-          ? undefined
-          : windowsTerminalCapabilities.wslAvailable,
-        availableWslDistros: windowsTerminalCapabilities.isLoading
-          ? null
-          : windowsTerminalCapabilities.wslDistros
-      }
-    )
-  }, [
-    activeRepoId,
-    activeRuntimeEnvironmentId,
-    activeWorktreeId,
-    projects,
-    repos,
-    settings,
-    showWindowsShellMenu,
-    worktreeConnectionId,
-    windowsTerminalCapabilities.isLoading,
-    windowsTerminalCapabilities.wslAvailable,
-    windowsTerminalCapabilities.wslDistros,
+function TabBarInner(props: TabBarProps): React.JSX.Element {
+  const {
     worktreeId,
-    worktreesByRepo
-  ])
-  const projectRuntimeShellMenuMode = getProjectRuntimeShellMenuMode(localProjectRuntime)
-  const resolvedGroupId = groupId ?? activeGroupIdForWorktree ?? worktreeId
-
-  const statusByRelativePath = useMemo(() => buildStatusMap(gitStatusEntries), [gitStatusEntries])
-  const unifiedTabByVisibleId = useMemo(
-    () => createUnifiedTabLookup(unifiedTabs, resolvedGroupId),
-    [resolvedGroupId, unifiedTabs]
-  )
-  const workspaceHasSimulatorTab = useMemo(
-    () => unifiedTabs.some((tab) => tab.contentType === 'simulator'),
-    [unifiedTabs]
-  )
-
-  // Why: tab-wide launch/title hints are safe only before split; gate the view-mode toggle to the active leaf's agent.
-  const toggleTabViewMode = useAppStore((s) => s.toggleTabViewMode)
-  // Why: every retained TabBar observes the same hot maps; one feature-gated selector shares their projections.
-  const { nativeChatEnabled, tabAgentTypesByTabId, nativeChatTabWideFallbackUnsafeTabsById } =
-    useAppStore(useShallow(selectTabBarAgentProjections))
-  const nativeChatTranscriptIsLocalReadable = useAppStore((s) =>
-    isNativeChatTranscriptLocalReadable(getConnectionIdFromState(s, worktreeId))
-  )
-
-  // Why: <webview> clicks are out-of-process, so Radix's document-pointerdown outside-click check misses them; use window blur.
-  const [newTabMenuOpen, setNewTabMenuOpen] = useState(false)
-  const [createMenuQuery, setCreateMenuQuery] = useState('')
-  const pendingNewTabMenuFocusRef = useRef<(() => void) | null>(null)
-  const pendingNewTabMenuFocusAnimationRef = useRef<number | null>(null)
-  const pendingNewTabMenuFocusRetryRef = useRef<number | null>(null)
-  const clearPendingNewTabMenuFocusAnimation = (): void => {
-    if (pendingNewTabMenuFocusAnimationRef.current === null) {
-      return
-    }
-    cancelAnimationFrame(pendingNewTabMenuFocusAnimationRef.current)
-    pendingNewTabMenuFocusAnimationRef.current = null
-  }
-  const clearPendingNewTabMenuFocusRetry = (): void => {
-    if (pendingNewTabMenuFocusRetryRef.current === null) {
-      return
-    }
-    window.clearTimeout(pendingNewTabMenuFocusRetryRef.current)
-    pendingNewTabMenuFocusRetryRef.current = null
-  }
-  const focusNewActiveTerminalWhenReady = (
-    previousActiveTabId: string | null,
-    expiresAt: number
-  ): void => {
-    const state = useAppStore.getState()
-    if (
-      (state.activeTabType === 'terminal' || state.activeTabType === 'simulator') &&
-      state.activeTabId &&
-      state.activeTabId !== previousActiveTabId
-    ) {
-      focusTerminalTabSurface(state.activeTabId)
-      return
-    }
-    if (Date.now() >= expiresAt) {
-      return
-    }
-    pendingNewTabMenuFocusRetryRef.current = window.setTimeout(() => {
-      pendingNewTabMenuFocusRetryRef.current = null
-      focusNewActiveTerminalWhenReady(previousActiveTabId, expiresAt)
-    }, NEW_TAB_MENU_TERMINAL_FOCUS_RETRY_MS)
-  }
-  const queueNewActiveTerminalFocusAfterNewTabMenuClose = (): void => {
-    const previousActiveTabId = useAppStore.getState().activeTabId
-    pendingNewTabMenuFocusRef.current = () => {
-      // Why: paired web/SSH tab creation is async; await the host snapshot's new terminal instead of the pre-existing active tab.
-      focusNewActiveTerminalWhenReady(
-        previousActiveTabId,
-        Date.now() + NEW_TAB_MENU_TERMINAL_FOCUS_TIMEOUT_MS
-      )
-    }
-  }
-  const queueTerminalTabFocusAfterNewTabMenuClose = (tabId: string): void => {
-    pendingNewTabMenuFocusRef.current = () => focusTerminalTabSurface(tabId)
-  }
-  const queueFocusAfterNewTabMenuClose = (focus: () => void): void => {
-    pendingNewTabMenuFocusRef.current = focus
-  }
-  const windowsShellEntries = useMemo(() => {
-    if (!showWindowsShellMenu || !onNewTerminalWithShell) {
-      return undefined
-    }
-    const includeHostShells = projectRuntimeShellMenuMode !== 'wsl'
-    const includeWslShell = projectRuntimeShellMenuMode !== 'host'
-    const allShells: {
-      label: string
-      shell: BuiltInWindowsTerminalShell
-    }[] = []
-    if (includeHostShells) {
-      allShells.push(
-        {
-          label: translate('auto.components.tab.bar.TabBar.2148f65e04', 'PowerShell'),
-          shell: 'powershell.exe'
-        },
-        {
-          label: translate('auto.components.tab.bar.TabBar.1a8af49530', 'CMD Prompt'),
-          shell: 'cmd.exe'
-        }
-      )
-      if (windowsTerminalCapabilities.gitBashAvailable) {
-        allShells.push({
-          label: translate('auto.components.tab.bar.TabBar.efb33546ff', 'Git Bash'),
-          shell: WINDOWS_GIT_BASH_SHELL
-        })
-      }
-    }
-    if (includeWslShell && windowsTerminalCapabilities.wslAvailable) {
-      allShells.push({
-        label: translate('auto.components.tab.bar.TabBar.d1afac112b', 'WSL'),
-        shell: 'wsl.exe'
-      })
-    }
-    if (allShells.length === 0) {
-      return undefined
-    }
-    const defaultEntry =
-      allShells.find((shell) => shell.shell === defaultWindowsShell) ?? allShells[0]
-    const orderedShells = [
-      defaultEntry,
-      ...allShells.filter((shell) => shell.shell !== defaultEntry.shell)
-    ]
-    return orderedShells.map((entry) => ({ label: entry.label, shell: entry.shell }))
-  }, [
-    defaultWindowsShell,
+    groupId,
+    terminalOnly = false,
+    onNewTerminalTab,
     onNewTerminalWithShell,
-    projectRuntimeShellMenuMode,
-    showWindowsShellMenu,
-    windowsTerminalCapabilities.gitBashAvailable,
-    windowsTerminalCapabilities.wslAvailable
-  ])
-  const createMenuOptions = useMemo(
-    () =>
-      buildTabCreateMenuOptions({
-        terminalOnly,
-        windowsShellEntries,
-        hasNewBrowser: !terminalOnly,
-        hasNewMarkdown: !terminalOnly && Boolean(onNewFileTab),
-        hasOpenMarkdown: !terminalOnly && Boolean(onOpenFileTab),
-        hasSimulator: !terminalOnly && mobileEmulatorEnabled && Boolean(onNewSimulatorTab),
-        simulatorIsGoTo: workspaceHasSimulatorTab
-      }),
-    [
-      mobileEmulatorEnabled,
-      onNewFileTab,
-      onNewSimulatorTab,
-      onOpenFileTab,
-      terminalOnly,
-      windowsShellEntries,
-      workspaceHasSimulatorTab
-    ]
-  )
-  const handleSelectCreateMenuOption = (option: TabCreateMenuOption): void => {
-    switch (option.kind) {
-      case 'new-terminal':
-        queueNewActiveTerminalFocusAfterNewTabMenuClose()
-        onNewTerminalTab()
-        break
-      case 'new-terminal-shell':
-        if (!onNewTerminalWithShell || !option.shell) {
-          break
-        }
-        queueNewActiveTerminalFocusAfterNewTabMenuClose()
-        onNewTerminalWithShell(
-          resolveWindowsShellLaunchTarget(
-            option.shell,
-            defaultWindowsPowerShellImplementation,
-            windowsTerminalCapabilities.pwshAvailable
-          )
-        )
-        break
-      case 'new-browser':
-        onNewBrowserTab()
-        break
-      case 'new-markdown':
-        onNewFileTab?.()
-        break
-      case 'open-markdown':
-        onOpenFileTab?.()
-        break
-      case 'new-simulator':
-      case 'go-to-simulator':
-        onNewSimulatorTab?.()
-        break
-    }
-  }
-  const launchAgentFromNewTabEntry = (agent: TuiAgent): void => {
-    const option = agentLaunchOptions.find((candidate) => candidate.agent === agent)
-    const result = launchAgentInNewTab({
-      agent,
-      worktreeId,
-      groupId: resolvedGroupId,
-      launchSource: 'tab_bar_quick_launch'
-    })
-    if (!result) {
-      toast.error(
-        translate(
-          'auto.components.tab.bar.TabBar.ab589350e5',
-          'Could not build launch command for {{value0}}.',
-          { value0: option?.label ?? agent }
-        )
-      )
-      return
-    }
-    if (result.tabId) {
-      queueTerminalTabFocusAfterNewTabMenuClose(result.tabId)
-      return
-    }
-    queueNewActiveTerminalFocusAfterNewTabMenuClose()
-  }
-  const runPendingNewTabMenuFocusAfterClose = (): void => {
-    const pendingFocus = pendingNewTabMenuFocusRef.current
-    pendingNewTabMenuFocusRef.current = null
-    clearPendingNewTabMenuFocusAnimation()
-    clearPendingNewTabMenuFocusRetry()
-    if (pendingFocus) {
-      pendingNewTabMenuFocusAnimationRef.current = requestAnimationFrame(() => {
-        pendingNewTabMenuFocusAnimationRef.current = null
-        pendingFocus()
-      })
-    }
-  }
-
-  const clearPendingNewTabMenuFocusOnUnmountRef = useRef<
-    ((node: HTMLDivElement | null) => void) | null
-  >(null)
-  if (clearPendingNewTabMenuFocusOnUnmountRef.current === null) {
-    clearPendingNewTabMenuFocusOnUnmountRef.current = (node: HTMLDivElement | null): void => {
-      if (node !== null) {
-        return
-      }
-      // Why: cancel the delayed focus handoff via this root ref cleanup, avoiding an otherwise cleanup-only React Effect.
-      clearPendingNewTabMenuFocusAnimation()
-      clearPendingNewTabMenuFocusRetry()
-    }
-  }
-  const clearPendingNewTabMenuFocusOnUnmount = clearPendingNewTabMenuFocusOnUnmountRef.current
-
-  const defaultTerminalMenuItems =
-    windowsShellEntries && onNewTerminalWithShell ? (
-      windowsShellEntries.map((entry, idx) => {
-        const isDefault = idx === 0
-        return (
-          <DropdownMenuItem
-            key={entry.shell}
-            onSelect={() => {
-              // Why: menu models shell categories not executables; preserve the user's chosen PowerShell 7+ over inbox powershell.exe.
-              queueNewActiveTerminalFocusAfterNewTabMenuClose()
-              onNewTerminalWithShell(
-                resolveWindowsShellLaunchTarget(
-                  entry.shell,
-                  defaultWindowsPowerShellImplementation,
-                  windowsTerminalCapabilities.pwshAvailable
-                )
-              )
-            }}
-            className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
-          >
-            <ShellIcon shell={entry.shell} size={14} />
-            <span className="flex-1">
-              {translate('auto.components.tab.bar.TabBar.7c1313d237', 'New Terminal:')}{' '}
-              {entry.label}
-            </span>
-            {isDefault ? <DropdownMenuShortcut>{newTerminalShortcut}</DropdownMenuShortcut> : null}
-          </DropdownMenuItem>
-        )
-      })
-    ) : (
-      <DropdownMenuItem
-        onSelect={() => {
-          queueNewActiveTerminalFocusAfterNewTabMenuClose()
-          onNewTerminalTab()
-        }}
-        className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
-      >
-        <TerminalSquare className="size-4 text-muted-foreground" />
-        {translate('auto.components.tab.bar.TabBar.d364f3c8d4', 'New Terminal')}
-        <DropdownMenuShortcut>{newTerminalShortcut}</DropdownMenuShortcut>
-      </DropdownMenuItem>
-    )
-  const newBrowserMenuItem = !terminalOnly ? (
-    <DropdownMenuItem
-      onSelect={onNewBrowserTab}
-      className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
-    >
-      <Globe className="size-4 text-muted-foreground" />
-      {translate('auto.components.tab.bar.TabBar.4833fb2cbe', 'New Browser Tab')}
-      <DropdownMenuShortcut>{newBrowserShortcut}</DropdownMenuShortcut>
-    </DropdownMenuItem>
-  ) : null
-  const newSimulatorMenuItem =
-    !terminalOnly && mobileEmulatorEnabled && onNewSimulatorTab ? (
-      workspaceHasSimulatorTab ? (
-        <Tooltip>
-          <TooltipTrigger asChild>
-            <DropdownMenuItem
-              onSelect={onNewSimulatorTab}
-              className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
-            >
-              <Smartphone className="size-4 text-muted-foreground" />
-              {translate('auto.components.tab.bar.TabBar.b426bb2615', 'Go to Mobile Emulator')}
-              <DropdownMenuShortcut>{newSimulatorShortcut}</DropdownMenuShortcut>
-            </DropdownMenuItem>
-          </TooltipTrigger>
-          <TooltipContent side="right" sideOffset={8} className="z-[80]">
-            {translate(
-              'auto.components.tab.bar.TabBar.aea43b5748',
-              'Open the existing emulator tab.'
-            )}
-          </TooltipContent>
-        </Tooltip>
-      ) : (
-        <DropdownMenuItem
-          onSelect={onNewSimulatorTab}
-          className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
-        >
-          <Smartphone className="size-4 text-muted-foreground" />
-          {translate('auto.components.tab.bar.TabBar.fd2b42aaa3', 'New Mobile Emulator')}
-          <DropdownMenuShortcut>{newSimulatorShortcut}</DropdownMenuShortcut>
-        </DropdownMenuItem>
-      )
-    ) : null
-  const newMarkdownMenuItem =
-    !terminalOnly && onNewFileTab ? (
-      <DropdownMenuItem
-        onSelect={onNewFileTab}
-        className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
-      >
-        <FilePlus className="size-4 text-muted-foreground" />
-        {translate('auto.components.tab.bar.TabBar.3d5d6c960d', 'New Markdown')}
-        <DropdownMenuShortcut>{newFileShortcut}</DropdownMenuShortcut>
-      </DropdownMenuItem>
-    ) : null
-  const openMarkdownMenuItem =
-    !terminalOnly && onOpenFileTab ? (
-      <DropdownMenuItem
-        onSelect={onOpenFileTab}
-        className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
-      >
-        <FileText className="size-4 text-muted-foreground" />
-        {translate('auto.components.tab.bar.TabBar.4f327c8b3d', 'Open Markdown...')}
-        {openMarkdownShortcut ? (
-          <DropdownMenuShortcut>{openMarkdownShortcut}</DropdownMenuShortcut>
-        ) : null}
-      </DropdownMenuItem>
-    ) : null
-  const mobileEmulatorIntroMenuBlock =
-    showMobileEmulatorIntroCallout &&
-    !terminalOnly &&
-    isMacOs &&
-    mobileEmulatorEnabled &&
-    onNewSimulatorTab ? (
-      <MobileEmulatorTabIntroCallout />
-    ) : null
-  const standardCreateMenuItems =
-    newTabMenuOrder === 'markdown-first' ? (
-      <>
-        {newMarkdownMenuItem}
-        {openMarkdownMenuItem}
-        {defaultTerminalMenuItems}
-        {newBrowserMenuItem}
-        {newSimulatorMenuItem}
-        {mobileEmulatorIntroMenuBlock}
-      </>
-    ) : (
-      <>
-        {defaultTerminalMenuItems}
-        {newBrowserMenuItem}
-        {newMarkdownMenuItem}
-        {openMarkdownMenuItem}
-        {newSimulatorMenuItem}
-        {mobileEmulatorIntroMenuBlock}
-      </>
-    )
-
-  useEffect(() => {
-    if (!newTabMenuOpen) {
-      return
-    }
-    const dismiss = (): void => setNewTabMenuOpen(false)
-    window.addEventListener('blur', dismiss)
-    return () => window.removeEventListener('blur', dismiss)
-  }, [newTabMenuOpen])
-
-  useEffect(() => {
-    if (!newTabMenuOpen) {
-      setCreateMenuQuery('')
-    }
-  }, [newTabMenuOpen])
-
-  const showStaticCreateMenuItems = createMenuQuery.trim().length === 0
-
-  const terminalMap = useMemo(() => new Map(tabs.map((t) => [t.id, t])), [tabs])
-  const editorMap = useMemo(
-    () => new Map((editorFiles ?? []).map((f) => [f.tabId ?? f.id, f])),
-    [editorFiles]
-  )
-  const browserMap = useMemo(
-    () => new Map((browserTabs ?? []).map((t) => [t.id, t])),
-    [browserTabs]
-  )
-
-  const terminalIds = useMemo(() => tabs.map((t) => t.id), [tabs])
-  const editorFileIds = useMemo(() => editorFiles?.map((f) => f.tabId ?? f.id) ?? [], [editorFiles])
-  const browserTabIds = useMemo(() => browserTabs?.map((tab) => tab.id) ?? [], [browserTabs])
-  const simulatorTabIds = useMemo(
-    () =>
-      (unifiedTabs ?? [])
-        .filter((t) => t.groupId === resolvedGroupId && t.contentType === 'simulator')
-        .map((t) => t.id),
-    [unifiedTabs, resolvedGroupId]
-  )
-
-  // Build the unified ordered list, reconciling stored order with current items
-  const orderedItems = useMemo(() => {
-    const ids = reconcileTabOrder(
-      tabBarOrder,
-      terminalIds,
-      editorFileIds,
-      browserTabIds,
-      simulatorTabIds
-    )
-    const items: TabItem[] = []
-    for (const id of ids) {
-      const terminal = terminalMap.get(id)
-      if (terminal) {
-        const unifiedTab = unifiedTabByVisibleId.get(id)
-        items.push({
-          type: 'terminal',
-          id,
-          unifiedTabId: terminal.unifiedTabId ?? unifiedTab?.id ?? terminal.id,
-          isPinned: unifiedTab?.isPinned === true,
-          data: terminal
-        })
-        continue
-      }
-      const file = editorMap.get(id)
-      if (file) {
-        const unifiedTab = unifiedTabByVisibleId.get(id) ?? unifiedTabByVisibleId.get(file.id)
-        items.push({
-          type: 'editor',
-          id,
-          unifiedTabId: file.tabId ?? unifiedTab?.id ?? file.id,
-          isPinned: unifiedTab?.isPinned === true,
-          data: file
-        })
-        continue
-      }
-      const browserTab = browserMap.get(id)
-      if (browserTab) {
-        const unifiedTab = unifiedTabByVisibleId.get(id)
-        items.push({
-          type: 'browser',
-          id,
-          unifiedTabId: browserTab.tabId ?? unifiedTab?.id ?? browserTab.id,
-          isPinned: unifiedTab?.isPinned === true,
-          data: browserTab
-        })
-        continue
-      }
-      const simUnified = unifiedTabByVisibleId.get(id)
-      if (simUnified && simUnified.contentType === 'simulator') {
-        items.push({
-          type: 'simulator',
-          id,
-          unifiedTabId: simUnified.id,
-          isPinned: simUnified.isPinned === true,
-          data: simUnified
-        })
-        continue
-      }
-    }
-    return items
-  }, [
-    tabBarOrder,
-    terminalIds,
-    editorFileIds,
-    browserTabIds,
-    simulatorTabIds,
-    terminalMap,
-    editorMap,
-    browserMap,
-    unifiedTabByVisibleId
-  ])
-
-  const sortableIds = useMemo(() => orderedItems.map((item) => item.id), [orderedItems])
-
-  const activeIndicator =
-    hoveredTabInsertion?.groupId === resolvedGroupId ? hoveredTabInsertion : null
-  const dropIndicatorByVisibleId = useMemo(() => {
-    const indicators = new Map<string, DropIndicator>()
-    for (const edge of resolveTabIndicatorEdges(
-      orderedItems.map((item) => item.id),
-      activeIndicator
-    )) {
-      indicators.set(edge.visibleTabId, edge.side)
-    }
-    return indicators
-  }, [activeIndicator, orderedItems])
-
-  const activeVisibleTabId = useMemo(() => {
-    const activeItem = orderedItems.find((item) => {
-      if (item.type === 'terminal') {
-        return (
-          (activeTabType === 'terminal' || activeTabType === 'simulator') && item.id === activeTabId
-        )
-      }
-      if (item.type === 'browser') {
-        return activeTabType === 'browser' && item.id === activeBrowserTabId
-      }
-      if (item.type === 'simulator') {
-        return activeTabType === 'simulator' && item.id === activeSimulatorTabId
-      }
-      return (
-        (activeTabType === 'editor' || activeTabType === 'simulator') && activeFileId === item.id
-      )
-    })
-    return activeItem?.id ?? null
-  }, [
-    activeBrowserTabId,
-    activeFileId,
-    activeSimulatorTabId,
-    activeTabId,
-    activeTabType,
-    orderedItems
-  ])
-  const tabStripLayoutKey = useMemo(
-    () =>
-      orderedItems
-        .map((item) =>
-          getTabLayoutSignature(item, {
-            generatedTitlesEnabled: generatedTabTitlesEnabled,
-            isExpanded: expandedPaneByTabId[item.id] === true,
-            status:
-              item.type === 'editor'
-                ? (statusByRelativePath.get(normalizeRelativePath(item.data.relativePath)) ?? null)
-                : null
-          })
-        )
-        .join('\u001f'),
-    [expandedPaneByTabId, generatedTabTitlesEnabled, orderedItems, statusByRelativePath]
-  )
-
-  const togglePinned = (item: TabItem): void => {
+    onNewBrowserTab,
+    onNewSimulatorTab,
+    onNewFileTab,
+    onOpenFileTab,
+    onPinFile
+  } = props
+  const runtime = useTabBarRuntimeModel({ worktreeId, groupId })
+  const createMenu = useTabBarCreateMenuController({
+    worktreeId,
+    resolvedGroupId: runtime.resolvedGroupId,
+    terminalOnly,
+    mobileEmulatorEnabled: runtime.mobileEmulatorEnabled,
+    managedBrowserCreationEnabled: runtime.managedBrowserCreationEnabled,
+    mobileEmulatorCreationEnabled: runtime.mobileEmulatorCreationEnabled,
+    workspaceHasSimulatorTab: runtime.workspaceHasSimulatorTab,
+    showWindowsShellMenu: runtime.showWindowsShellMenu,
+    projectRuntimeShellMenuMode: runtime.projectRuntimeShellMenuMode,
+    defaultWindowsShell: runtime.defaultWindowsShell,
+    defaultWindowsPowerShellImplementation: runtime.defaultWindowsPowerShellImplementation,
+    windowsTerminalCapabilities: runtime.windowsTerminalCapabilities,
+    agentLaunchOptions: runtime.agentLaunchOptions,
+    onNewTerminalTab,
+    onNewTerminalWithShell,
+    onNewBrowserTab,
+    onNewSimulatorTab,
+    onNewFileTab,
+    onOpenFileTab
+  })
+  const itemProjection = useTabBarItemProjection({
+    props,
+    resolvedGroupId: runtime.resolvedGroupId,
+    unifiedTabs: runtime.unifiedTabs,
+    unifiedTabByVisibleId: runtime.unifiedTabByVisibleId,
+    generatedTabTitlesEnabled: runtime.generatedTabTitlesEnabled,
+    statusByRelativePath: runtime.statusByRelativePath
+  })
+  const togglePinned = (item: TabBarItem): void => {
     // pinTab/unpinTab mirror the change to the host for remote-server tabs.
     if (item.isPinned) {
-      unpinTab(item.unifiedTabId)
+      runtime.unpinTab(item.unifiedTabId)
       return
     }
     if (item.type === 'editor' && onPinFile) {
       onPinFile(item.data.id, item.unifiedTabId)
       return
     }
-    pinTab(item.unifiedTabId)
+    runtime.pinTab(item.unifiedTabId)
   }
-
-  const { tabStripRef, tabStripOverflowState, scrollTabStrip } = useTabStripOverflowNavigation({
-    activeVisibleTabId,
-    layoutKey: tabStripLayoutKey,
-    tabCount: orderedItems.length,
+  const tabStripNavigation = useTabStripOverflowNavigation({
+    activeVisibleTabId: itemProjection.activeVisibleTabId,
+    layoutKey: itemProjection.tabStripLayoutKey,
+    tabCount: itemProjection.orderedItems.length,
     worktreeId
   })
-  const tabStripDragScroll = useTabStripDragScrollHandlers(scrollTabStrip, {
-    start: tabStripOverflowState.canScrollStart,
-    end: tabStripOverflowState.canScrollEnd
+  const tabStripDragScroll = useTabStripDragScrollHandlers(tabStripNavigation.scrollTabStrip, {
+    start: tabStripNavigation.tabStripOverflowState.canScrollStart,
+    end: tabStripNavigation.tabStripOverflowState.canScrollEnd
   })
 
-  return (
-    <div
-      ref={clearPendingNewTabMenuFocusOnUnmount}
-      className="flex items-stretch h-full overflow-hidden flex-1 min-w-0"
-      // Why: preload routes native OS drops by this marker — only the tab strip opens files in the editor, not terminal panes.
-      data-native-file-drop-target="editor"
-    >
-      {tabStripOverflowState.hasOverflow ? (
-        <Tooltip>
-          <TooltipTrigger asChild>
-            <Button
-              variant="ghost"
-              size="icon-xs"
-              className="mx-0.5 my-auto h-6 w-5 text-muted-foreground hover:bg-accent/50 hover:text-foreground disabled:opacity-35"
-              style={{ WebkitAppRegion: 'no-drag' } as React.CSSProperties}
-              aria-label={translate(
-                'auto.components.tab.bar.TabBar.7a9b4af2af',
-                'Scroll tabs left'
-              )}
-              aria-disabled={!tabStripOverflowState.canScrollStart}
-              disabled={
-                !tabStripDragScroll.isTabDragActive && !tabStripOverflowState.canScrollStart
-              }
-              onClick={() => scrollTabStrip('start')}
-              onPointerEnter={tabStripDragScroll.onDragScrollStartEnter}
-              onPointerLeave={tabStripDragScroll.onDragScrollLeave}
-            >
-              <ChevronLeft className="size-3.5" />
-            </Button>
-          </TooltipTrigger>
-          <TooltipContent side="bottom" sideOffset={6}>
-            {translate('auto.components.tab.bar.TabBar.7a9b4af2af', 'Scroll tabs left')}
-          </TooltipContent>
-        </Tooltip>
-      ) : null}
-      {/* Why: no strategy stops dnd-kit animating siblings, so tabs stay anchored during drag; only the insertion bar moves. */}
-      <SortableContext items={sortableIds}>
-        {/* Why: no-drag lets tab interactions work inside the titlebar's drag region (outer container stays window-draggable). */}
-        <div
-          className="relative flex min-h-0 min-w-0 max-w-full flex-[0_1_auto]"
-          style={{ WebkitAppRegion: 'no-drag' } as React.CSSProperties}
-        >
-          <div
-            ref={tabStripRef}
-            // Why: only `border-r` here — a strip-level `border-l` would render a heavier L-corner than the first tab's own `border-l`.
-            className={[
-              'terminal-tab-strip flex h-full min-w-0 max-w-full flex-1 items-stretch overflow-x-auto overflow-y-hidden border-r border-border/70',
-              getTabStripScrollMaskClassName(tabStripOverflowState)
-            ]
-              .filter(Boolean)
-              .join(' ')}
-          >
-            {orderedItems.map((item, index) => {
-              const dragData: TabDragItemData = {
-                kind: 'tab',
-                worktreeId,
-                groupId: resolvedGroupId,
-                unifiedTabId: item.unifiedTabId,
-                visibleTabId: item.id,
-                tabType: item.type,
-                label: getTabDragLabel(item, generatedTabTitlesEnabled),
-                iconPath: item.type === 'editor' ? item.data.filePath : undefined,
-                color: item.type === 'terminal' ? (item.data.color ?? null) : null
-              }
-              if (item.type === 'terminal') {
-                const terminalTab = {
-                  ...item.data,
-                  title: resolveTerminalTabTitle(
-                    item.data,
-                    generatedTabTitlesEnabled,
-                    item.data.title
-                  )
-                }
-                const unifiedTabForItem = unifiedTabByVisibleId.get(item.id)
-                // Carry the agent *identity* (not just "an agent exists") so the native-chat gate can reject agents like Grok.
-                const resolvedAgent =
-                  resolveCommittedTitleAgentType(unifiedTabForItem?.label ?? '') ??
-                  resolveCommittedTitleAgentType(terminalTab.title)
-                // Key the live-agent lookup by the backing terminal tab id: agent-status pane keys use it, not the unified tab id.
-                const detectedAgent = tabAgentTypesByTabId[terminalTab.id] ?? null
-                const tabWideFallbackSafe =
-                  nativeChatTabWideFallbackUnsafeTabsById[terminalTab.id] !== true
-                const canToggleViewMode =
-                  unifiedTabForItem !== undefined &&
-                  canToggleNativeChat({
-                    experimentalNativeChatEnabled: nativeChatEnabled,
-                    contentType: 'terminal',
-                    launchAgent: tabWideFallbackSafe ? terminalTab.launchAgent : null,
-                    detectedAgent,
-                    resolvedAgent: tabWideFallbackSafe ? resolvedAgent : null,
-                    nativeChatTranscriptIsLocalReadable,
-                    isChatViewMode: unifiedTabForItem.viewMode === 'chat'
-                  })
-                return (
-                  <SortableTab
-                    key={item.id}
-                    tab={terminalTab}
-                    unifiedTabId={item.unifiedTabId}
-                    groupId={resolvedGroupId}
-                    tabCount={orderedItems.length}
-                    canToggleViewMode={canToggleViewMode}
-                    isChatView={nativeChatEnabled && unifiedTabForItem?.viewMode === 'chat'}
-                    onToggleViewMode={
-                      unifiedTabForItem ? () => toggleTabViewMode(unifiedTabForItem.id) : undefined
-                    }
-                    hasTabsToRight={index < orderedItems.length - 1}
-                    hasTabsToLeft={index > 0}
-                    isActive={
-                      (activeTabType === 'terminal' || activeTabType === 'simulator') &&
-                      item.id === activeTabId
-                    }
-                    isPinned={item.isPinned}
-                    isExpanded={expandedPaneByTabId[item.id] === true}
-                    onActivate={onActivate}
-                    onClose={onClose}
-                    onCloseOthers={onCloseOthers}
-                    onCloseToRight={onCloseToRight}
-                    onCloseToLeft={onCloseToLeft}
-                    onSetCustomTitle={onSetCustomTitle}
-                    onSetTabColor={onSetTabColor}
-                    onTogglePin={() => togglePinned(item)}
-                    onToggleExpand={onTogglePaneExpand}
-                    dragData={dragData}
-                    dropIndicator={dropIndicatorByVisibleId.get(item.id) ?? null}
-                    includeTopTabBorder={includeTopTabBorder}
-                  />
-                )
-              }
-              if (item.type === 'browser') {
-                return (
-                  <BrowserTab
-                    key={item.id}
-                    tab={item.data}
-                    isActive={activeTabType === 'browser' && activeBrowserTabId === item.id}
-                    isPinned={item.isPinned}
-                    hasTabsToRight={index < orderedItems.length - 1}
-                    hasTabsToLeft={index > 0}
-                    tabCount={orderedItems.length}
-                    onActivate={() => onActivateBrowserTab?.(item.id)}
-                    onClose={() => onCloseBrowserTab?.(item.id)}
-                    onCloseOthers={() => onCloseOthers(item.id)}
-                    onCloseToRight={() => onCloseToRight(item.id)}
-                    onCloseToLeft={() => onCloseToLeft(item.id)}
-                    onDuplicate={() => onDuplicateBrowserTab?.(item.id)}
-                    onTogglePin={() => togglePinned(item)}
-                    dragData={dragData}
-                    dropIndicator={dropIndicatorByVisibleId.get(item.id) ?? null}
-                    includeTopTabBorder={includeTopTabBorder}
-                  />
-                )
-              }
-              if (item.type === 'simulator') {
-                const simLabel = item.data.label || 'Mobile Emulator'
-                const simFile: OpenFile & { tabId: string } = {
-                  id: item.id,
-                  tabId: item.id,
-                  filePath: simLabel,
-                  relativePath: simLabel,
-                  worktreeId,
-                  language: 'simulator',
-                  isPreview: false,
-                  isDirty: false,
-                  mode: 'edit'
-                }
-                return (
-                  <EditorFileTab
-                    key={item.id}
-                    file={simFile}
-                    isActive={activeTabType === 'simulator' && item.id === activeSimulatorTabId}
-                    isPinned={item.isPinned}
-                    hasTabsToRight={index < orderedItems.length - 1}
-                    hasTabsToLeft={index > 0}
-                    tabCount={orderedItems.length}
-                    statusByRelativePath={statusByRelativePath}
-                    onActivate={() => onActivateFile?.(item.id)}
-                    onClose={() => onCloseFile?.(item.id)}
-                    onCloseOthers={() => onCloseOthers(item.id)}
-                    onCloseToRight={() => onCloseToRight(item.id)}
-                    onCloseToLeft={() => onCloseToLeft(item.id)}
-                    onCloseAll={() => onCloseAllFiles?.()}
-                    onMakePermanent={() => {}}
-                    onTogglePin={() => togglePinned(item)}
-                    dragData={dragData}
-                    dropIndicator={dropIndicatorByVisibleId.get(item.id) ?? null}
-                    includeTopTabBorder={includeTopTabBorder}
-                  />
-                )
-              }
-              return (
-                <EditorFileTab
-                  key={item.id}
-                  file={item.data}
-                  isActive={
-                    (activeTabType === 'editor' || activeTabType === 'simulator') &&
-                    activeFileId === item.id
-                  }
-                  isPinned={item.isPinned}
-                  hasTabsToRight={index < orderedItems.length - 1}
-                  hasTabsToLeft={index > 0}
-                  tabCount={orderedItems.length}
-                  statusByRelativePath={statusByRelativePath}
-                  onActivate={() => onActivateFile?.(item.id)}
-                  onClose={() => onCloseFile?.(item.id)}
-                  onCloseOthers={() => onCloseOthers(item.id)}
-                  onCloseToRight={() => onCloseToRight(item.id)}
-                  onCloseToLeft={() => onCloseToLeft(item.id)}
-                  onCloseAll={() => onCloseAllFiles?.()}
-                  onMakePermanent={() =>
-                    onMakePreviewFilePermanent?.(item.data.id, item.data.tabId)
-                  }
-                  onTogglePin={() => togglePinned(item)}
-                  dragData={dragData}
-                  dropIndicator={dropIndicatorByVisibleId.get(item.id) ?? null}
-                  includeTopTabBorder={includeTopTabBorder}
-                />
-              )
-            })}
-          </div>
-          <TabStripScrollIndicator metrics={tabStripOverflowState} />
-        </div>
-      </SortableContext>
-      {tabStripOverflowState.hasOverflow ? (
-        <Tooltip>
-          <TooltipTrigger asChild>
-            <Button
-              variant="ghost"
-              size="icon-xs"
-              className="mx-0.5 my-auto h-6 w-5 text-muted-foreground hover:bg-accent/50 hover:text-foreground disabled:opacity-35"
-              style={{ WebkitAppRegion: 'no-drag' } as React.CSSProperties}
-              aria-label={translate(
-                'auto.components.tab.bar.TabBar.232e075b07',
-                'Scroll tabs right'
-              )}
-              aria-disabled={!tabStripOverflowState.canScrollEnd}
-              disabled={!tabStripDragScroll.isTabDragActive && !tabStripOverflowState.canScrollEnd}
-              onClick={() => scrollTabStrip('end')}
-              onPointerEnter={tabStripDragScroll.onDragScrollEndEnter}
-              onPointerLeave={tabStripDragScroll.onDragScrollLeave}
-            >
-              <ChevronRight className="size-3.5" />
-            </Button>
-          </TooltipTrigger>
-          <TooltipContent side="bottom" sideOffset={6}>
-            {translate('auto.components.tab.bar.TabBar.232e075b07', 'Scroll tabs right')}
-          </TooltipContent>
-        </Tooltip>
-      ) : null}
-      <DropdownMenu
-        open={newTabMenuOpen}
-        onOpenChange={setNewTabMenuOpen}
-        // Why: modal would disable body pointer events, making the Mobile Emulator "Hide" re-enable toast unclickable.
-        modal={false}
-      >
-        <DropdownMenuTrigger asChild>
-          <button
-            className="ml-2 my-auto flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-muted-foreground hover:bg-accent/50 hover:text-foreground"
-            style={{ WebkitAppRegion: 'no-drag' } as React.CSSProperties}
-            title={translate('auto.components.tab.bar.TabBar.b1a132357f', 'New tab')}
-            // Why: aria-label matches the tooltip so E2E can locate the "+" via getByRole('button', { name: 'New tab' }).
-            aria-label={translate('auto.components.tab.bar.TabBar.b1a132357f', 'New tab')}
-          >
-            <Plus className="w-3.5 h-3.5" />
-          </button>
-        </DropdownMenuTrigger>
-        <DropdownMenuContent
-          align="start"
-          sideOffset={6}
-          className="w-72 max-w-[calc(100vw-1rem)] rounded-[11px] border-border/80 p-1 shadow-[0_16px_36px_rgba(0,0,0,0.24)]"
-          onCloseAutoFocus={(e) => {
-            // Why: Radix restores focus to the "+" trigger on close, stealing it from the freshly-mounted terminal.
-            e.preventDefault()
-            runPendingNewTabMenuFocusAfterClose()
-          }}
-        >
-          {!terminalOnly && onOpenEntry ? (
-            <>
-              <TabBarCreateEntry
-                worktreeId={worktreeId}
-                groupId={resolvedGroupId}
-                menuOpen={newTabMenuOpen}
-                menuOptions={createMenuOptions}
-                agentOptions={agentLaunchOptions}
-                onLaunchAgent={launchAgentFromNewTabEntry}
-                onOpenDefaultTerminal={() => {
-                  queueNewActiveTerminalFocusAfterNewTabMenuClose()
-                  onNewTerminalTab()
-                }}
-                onOpenEntry={onOpenEntry}
-                onQueryChange={setCreateMenuQuery}
-                onQueueSwitchFocus={queueFocusAfterNewTabMenuClose}
-                onSelectMenuOption={handleSelectCreateMenuOption}
-                onDidOpenEntry={() => setNewTabMenuOpen(false)}
-              />
-              {showStaticCreateMenuItems ? <DropdownMenuSeparator /> : null}
-            </>
-          ) : null}
-          {showStaticCreateMenuItems ? standardCreateMenuItems : null}
-          {showStaticCreateMenuItems && showAgentLaunchItems ? (
-            <>
-              <DropdownMenuSeparator />
-              <QuickLaunchAgentMenuItems
-                worktreeId={worktreeId}
-                groupId={resolvedGroupId}
-                onFocusTerminal={queueTerminalTabFocusAfterNewTabMenuClose}
-              />
-            </>
-          ) : null}
-        </DropdownMenuContent>
-      </DropdownMenu>
-    </div>
-  )
+  return renderTabBarSurface({
+    props,
+    runtime,
+    createMenu,
+    itemProjection,
+    tabStripNavigation,
+    tabStripDragScroll,
+    togglePinned
+  })
 }
 
 export default React.memo(TabBarInner)
diff --git a/src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx b/src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx
new file mode 100644
index 00000000000..b40166cbc1d
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx
@@ -0,0 +1,315 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { TooltipProvider } from '@/components/ui/tooltip'
+import { useAppStore } from '@/store'
+import type { AppState } from '@/store/types'
+import type { TabAgentLaunchOption } from './tab-agent-launch-options'
+import type { TabCreateMenuOption } from './tab-create-menu-options'
+import { QUICK_OPEN_QUERY_MAX_BYTES } from '../quick-open-search'
+
+const fileListMock = vi.hoisted(() => ({
+  current: { files: [] as string[], loading: false, loadError: null as string | null }
+}))
+vi.mock('../quick-open-file-list', () => ({
+  useRuntimeFileListForWorktree: () => fileListMock.current
+}))
+
+const tabSearchMock = vi.hoisted(() => ({
+  calls: [] as { enabled: boolean; query: string }[],
+  results: [] as unknown[]
+}))
+vi.mock('./use-open-tab-search', () => ({
+  useOpenTabSearch: ({ enabled, query }: { enabled: boolean; query: string }) => {
+    tabSearchMock.calls.push({ enabled, query })
+    return { query, results: tabSearchMock.results }
+  }
+}))
+
+import TabBarCreateEntry from './TabBarCreateEntry'
+
+;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+
+let container: HTMLDivElement
+let root: Root
+
+function renderEntry(props: Record<string, unknown> = {}): void {
+  act(() => {
+    root.render(
+      <TooltipProvider>
+        <TabBarCreateEntry
+          worktreeId="wt"
+          groupId="g"
+          menuOpen
+          onOpenEntry={vi.fn().mockResolvedValue(undefined)}
+          {...props}
+        />
+      </TooltipProvider>
+    )
+  })
+}
+
+function setQuery(value: string): void {
+  const input = container.querySelector('input')!
+  const nativeSetter = Object.getOwnPropertyDescriptor(
+    window.HTMLInputElement.prototype,
+    'value'
+  )?.set
+  act(() => {
+    nativeSetter?.call(input, value)
+    input.dispatchEvent(new window.Event('input', { bubbles: true }))
+  })
+}
+
+function submit(): void {
+  act(() => {
+    container
+      .querySelector('form')!
+      .dispatchEvent(new window.Event('submit', { bubbles: true, cancelable: true }))
+  })
+}
+
+function press(key: string): void {
+  act(() => {
+    container
+      .querySelector('input')!
+      .dispatchEvent(new window.KeyboardEvent('keydown', { key, bubbles: true, cancelable: true }))
+  })
+}
+
+beforeEach(() => {
+  fileListMock.current = { files: [], loading: false, loadError: null }
+  tabSearchMock.calls = []
+  tabSearchMock.results = []
+  useAppStore.setState(
+    { ...useAppStore.getInitialState(), browserDefaultSearchEngine: null } as AppState,
+    true
+  )
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+
+afterEach(() => {
+  act(() => root.unmount())
+  container.remove()
+  vi.clearAllMocks()
+})
+
+describe('TabBarCreateEntry search behavior', () => {
+  it('tracks the configured provider and submits its exact classification', () => {
+    const onOpenEntry = vi.fn().mockResolvedValue(undefined)
+    renderEntry({ onOpenEntry })
+    setQuery('react hooks')
+    expect(container.querySelector('[role="option"]')?.textContent).toContain('Search Google')
+
+    act(() => useAppStore.setState({ browserDefaultSearchEngine: 'bing' }))
+    expect(container.querySelector('[role="option"]')?.textContent).toContain('Search Bing')
+    submit()
+
+    expect(onOpenEntry).toHaveBeenCalledWith(
+      expect.objectContaining({
+        classification: { kind: 'search', engine: 'bing', query: 'react hooks' }
+      })
+    )
+  })
+
+  it('searches a phrase on Enter while the file index is still loading', () => {
+    fileListMock.current = { files: [], loading: true, loadError: null }
+    const onOpenEntry = vi.fn().mockResolvedValue(undefined)
+    renderEntry({ onOpenEntry })
+    setQuery('natural language')
+
+    expect(container.querySelectorAll('[role="option"]')).toHaveLength(1)
+    expect(container.querySelector('[role="option"]')?.textContent).toContain('Search Google')
+    expect(container.querySelector('[role="status"]')?.textContent).toContain('Loading files...')
+    expect(container.querySelector('[aria-selected="true"]')).not.toBeNull()
+
+    submit()
+    expect(onOpenEntry).toHaveBeenCalledOnce()
+  })
+
+  it('requires an explicit choice for text the loading index could still match', () => {
+    fileListMock.current = { files: [], loading: true, loadError: null }
+    const onOpenEntry = vi.fn().mockResolvedValue(undefined)
+    renderEntry({ onOpenEntry })
+    setQuery('notes.md draft')
+
+    expect(container.querySelector('[role="option"]')?.textContent).toContain('Search Google')
+    expect(container.querySelector('[aria-selected="true"]')).toBeNull()
+
+    submit()
+    expect(onOpenEntry).not.toHaveBeenCalled()
+    expect(container.querySelector('[role="status"]')?.textContent).toContain('Choose an action.')
+
+    press('ArrowDown')
+    submit()
+    expect(onOpenEntry).toHaveBeenCalledOnce()
+  })
+
+  it('arms network actions once the index fails, since no file match can arrive', () => {
+    fileListMock.current = { files: [], loading: false, loadError: 'scan failed' }
+    const onOpenEntry = vi.fn().mockResolvedValue(undefined)
+    renderEntry({ onOpenEntry })
+    setQuery('example.com')
+
+    expect(container.querySelector('[aria-selected="true"]')?.textContent).toContain('Open URL')
+    submit()
+    expect(onOpenEntry).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: expect.objectContaining({ kind: 'host-url' }) })
+    )
+  })
+
+  it('does not auto-open a host-like filename while the file index is unresolved', () => {
+    fileListMock.current = { files: [], loading: true, loadError: null }
+    const onOpenEntry = vi.fn().mockResolvedValue(undefined)
+    renderEntry({ onOpenEntry })
+    setQuery('example.com')
+
+    expect(container.querySelector('[role="option"]')?.textContent).toContain('Open URL')
+    expect(container.querySelector('[aria-selected="true"]')).toBeNull()
+    submit()
+    expect(onOpenEntry).not.toHaveBeenCalled()
+  })
+
+  it('disables the active submission and exposes failures to assistive technology', async () => {
+    let rejectOpen: ((error: Error) => void) | undefined
+    const onOpenEntry = vi.fn(
+      () =>
+        new Promise<void>((_resolve, reject) => {
+          rejectOpen = reject
+        })
+    )
+    renderEntry({ onOpenEntry })
+    setQuery('react hooks')
+    submit()
+
+    // Read-only rather than disabled so the pending input keeps keyboard focus.
+    expect(container.querySelector('input')?.disabled).toBe(false)
+    expect(container.querySelector('input')?.readOnly).toBe(true)
+    expect(container.querySelector('input')?.getAttribute('aria-busy')).toBe('true')
+    expect(container.querySelector<HTMLButtonElement>('[role="option"]')?.disabled).toBe(true)
+    expect(container.querySelector('[role="option"] .animate-spin')).not.toBeNull()
+
+    await act(async () => rejectOpen?.(new Error('Search failed safely.')))
+
+    const input = container.querySelector('input')!
+    expect(input.readOnly).toBe(false)
+    expect(input.getAttribute('aria-busy')).toBeNull()
+    expect(input.getAttribute('aria-expanded')).toBe('false')
+    expect(input.getAttribute('aria-errormessage')).toBe('tab-create-entry-error')
+    expect(container.querySelector('#tab-create-entry-error')?.textContent).toContain(
+      'Search failed safely.'
+    )
+  })
+
+  it('ignores completion from a previous menu session', async () => {
+    let resolveOpen: (() => void) | undefined
+    const onDidOpenEntry = vi.fn()
+    const onOpenEntry = vi.fn(
+      () =>
+        new Promise<void>((resolve) => {
+          resolveOpen = resolve
+        })
+    )
+    renderEntry({ onDidOpenEntry, onOpenEntry })
+    setQuery('react hooks')
+    submit()
+
+    renderEntry({ menuOpen: false, onDidOpenEntry, onOpenEntry })
+    renderEntry({ menuOpen: true, onDidOpenEntry, onOpenEntry })
+    await act(async () => resolveOpen?.())
+
+    expect(onDidOpenEntry).not.toHaveBeenCalled()
+    expect(container.querySelector('input')?.readOnly).toBe(false)
+  })
+
+  it('does not arm ordinary search when a ranked file disappears asynchronously', () => {
+    fileListMock.current = { files: ['project codename'], loading: false, loadError: null }
+    const onOpenEntry = vi.fn().mockResolvedValue(undefined)
+    renderEntry({ onOpenEntry })
+    setQuery('project codename')
+    expect(container.querySelector('[aria-selected="true"]')?.textContent).toContain('Open file')
+
+    fileListMock.current = { files: [], loading: true, loadError: null }
+    renderEntry({ onOpenEntry })
+    expect(container.querySelector('[role="option"]')?.textContent).toContain('Search Google')
+    expect(container.querySelector('[aria-selected="true"]')).toBeNull()
+    expect(container.querySelector('input')?.getAttribute('aria-activedescendant')).toBeNull()
+
+    submit()
+    expect(onOpenEntry).not.toHaveBeenCalled()
+    expect(container.querySelector('[role="status"]')?.textContent).toContain('Choose an action.')
+
+    press('ArrowDown')
+    submit()
+    expect(onOpenEntry).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: expect.objectContaining({ kind: 'search' }) })
+    )
+  })
+
+  it('makes forced search the only category and disables open-tab matching', () => {
+    fileListMock.current = { files: ['gem'], loading: false, loadError: null }
+    tabSearchMock.results = [
+      {
+        id: 'open-tab:workspace:tab-1',
+        title: 'gem tab',
+        contentType: 'terminal',
+        worktreeId: 'wt',
+        tabId: 'tab-1',
+        entityId: 'term-1',
+        groupId: 'g',
+        relativePath: null
+      }
+    ]
+    const menuOptions: TabCreateMenuOption[] = [
+      { id: 'new-browser', kind: 'new-browser', keywords: ['gem'], label: 'Gem action' }
+    ]
+    const agentOptions: TabAgentLaunchOption[] = [
+      { agent: 'gemini', aliases: ['gem'], label: 'Gemini' }
+    ]
+    const onOpenEntry = vi.fn().mockResolvedValue(undefined)
+    renderEntry({ agentOptions, menuOptions, onOpenEntry })
+    setQuery('?gem')
+
+    const rows = container.querySelectorAll('[role="option"]')
+    expect(rows).toHaveLength(1)
+    expect(rows[0].textContent).toContain('Search Google')
+    expect(tabSearchMock.calls.at(-1)).toEqual({ enabled: false, query: '' })
+    submit()
+    expect(onOpenEntry).toHaveBeenCalledWith(
+      expect.objectContaining({
+        classification: { kind: 'search', engine: 'google', query: 'gem' }
+      })
+    )
+  })
+
+  it('treats a bare search prefix as a prompt rather than a submission error', () => {
+    const onOpenEntry = vi.fn().mockResolvedValue(undefined)
+    renderEntry({ onOpenEntry })
+    setQuery('?')
+
+    expect(container.querySelectorAll('[role="option"]')).toHaveLength(0)
+    submit()
+
+    expect(onOpenEntry).not.toHaveBeenCalled()
+    expect(container.querySelector('#tab-create-entry-error')).toBeNull()
+    expect(container.querySelector('input')?.getAttribute('aria-errormessage')).toBeNull()
+  })
+
+  it('blocks oversized forced input without surfacing global actions', () => {
+    renderEntry({
+      menuOptions: [
+        { id: 'new-browser', kind: 'new-browser', keywords: ['x'], label: 'New Browser' }
+      ],
+      agentOptions: [{ agent: 'gemini', aliases: ['x'], label: 'Gemini' }]
+    })
+    setQuery(`?${'x'.repeat(QUICK_OPEN_QUERY_MAX_BYTES)}`)
+
+    expect(container.querySelectorAll('[role="option"]')).toHaveLength(0)
+    expect(container.textContent).toContain('Search text is too large.')
+    expect(tabSearchMock.calls.at(-1)).toEqual({ enabled: false, query: '' })
+  })
+})
diff --git a/src/renderer/src/components/tab-bar/TabBarCreateEntry.tsx b/src/renderer/src/components/tab-bar/TabBarCreateEntry.tsx
index fa65ce24e5f..482d81a1cf3 100644
--- a/src/renderer/src/components/tab-bar/TabBarCreateEntry.tsx
+++ b/src/renderer/src/components/tab-bar/TabBarCreateEntry.tsx
@@ -4,17 +4,10 @@ import { useRuntimeFileListForWorktree } from '../quick-open-file-list'
 import {
   createTabEntryAllowAbsolutePathsSelector,
   getTabEntryOptions,
-  isTabEntryAbsolutePathLike,
-  type TabCreateEntryArgs
+  isTabEntryAbsolutePathLike
 } from './tab-create-entry-action'
-import {
-  findMatchingTabAgentLaunchOptions,
-  type TabAgentLaunchOption
-} from './tab-agent-launch-options'
-import {
-  findMatchingTabCreateMenuOptions,
-  type TabCreateMenuOption
-} from './tab-create-menu-options'
+import { findMatchingTabAgentLaunchOptions } from './tab-agent-launch-options'
+import { findMatchingTabCreateMenuOptions } from './tab-create-menu-options'
 import {
   getActiveOptionId,
   isActiveEntryOption,
@@ -28,42 +21,30 @@ import {
 } from './TabBarCreateEntryRow'
 import { dropFileEntriesCoveredByTabResults } from './open-tab-entry-dedupe'
 import { activateOpenTabSearchResult } from './open-tab-selection-routing'
-import type { OpenTabSearchResult } from './open-tab-search'
 import { useOpenTabSearch } from './use-open-tab-search'
-import type { TuiAgent } from '../../../../shared/types'
-import { translate } from '@/i18n/i18n'
+import { DEFAULT_SEARCH_ENGINE } from '../../../../shared/browser-url'
 import { getRendererAppPlatform } from '@/lib/renderer-app-platform'
 import { useAppStore } from '@/store'
+import { isQuickOpenQueryTooLarge } from '../quick-open-search'
+import { parseForcedSearchQuery } from './tab-create-entry-forced-search'
+import { useNetworkSafeTabEntrySelection } from './tab-create-entry-network-selection'
+import { focusTabEntryMenuItemAtEdge } from './tab-create-entry-keyboard-focus'
+import {
+  getTabEntryChooseActionMessage,
+  getTabEntryOmniboxPlaceholder
+} from './tab-create-entry-copy'
+import {
+  EMPTY_AGENT_OPTIONS,
+  EMPTY_MENU_OPTIONS,
+  EMPTY_TAB_RESULTS
+} from './tab-create-entry-empty-options'
+import type { TabBarCreateEntryProps } from './tab-create-entry-props'
 
-// Leads with tabs: the omnibox now jumps to open tabs before it creates anything.
-function omniboxPlaceholder(): string {
-  return translate(
-    'auto.components.tab.bar.TabBarCreateEntry.0e5b7a3f16',
-    'Search open tabs, files, URLs, agents…'
-  )
+export default function TabBarCreateEntry(props: TabBarCreateEntryProps): React.JSX.Element {
+  return <TabBarCreateEntrySession key={String(props.menuOpen)} {...props} />
 }
 
-const EMPTY_AGENT_OPTIONS: readonly TabAgentLaunchOption[] = []
-const EMPTY_MENU_OPTIONS: readonly TabCreateMenuOption[] = []
-const EMPTY_TAB_RESULTS: readonly OpenTabSearchResult[] = []
-
-type TabBarCreateEntryProps = {
-  agentOptions?: readonly TabAgentLaunchOption[]
-  groupId: string
-  menuOpen: boolean
-  menuOptions?: readonly TabCreateMenuOption[]
-  onDidOpenEntry?: () => void
-  onLaunchAgent?: (agent: TuiAgent) => void
-  onOpenDefaultTerminal?: () => void
-  onOpenEntry?: (args: TabCreateEntryArgs) => Promise<void>
-  onQueryChange?: (query: string) => void
-  /** Runs after the menu closes, so the tab jumped to actually takes focus. */
-  onQueueSwitchFocus?: (focus: () => void) => void
-  onSelectMenuOption?: (option: TabCreateMenuOption) => void
-  worktreeId: string
-}
-
-export default function TabBarCreateEntry({
+function TabBarCreateEntrySession({
   agentOptions = EMPTY_AGENT_OPTIONS,
   groupId,
   menuOpen,
@@ -81,16 +62,33 @@ export default function TabBarCreateEntry({
   const [pending, setPending] = useState(false)
   const [error, setError] = useState<string | null>(null)
   const [switchError, setSwitchError] = useState<string | null>(null)
+  const [selectionGuidance, setSelectionGuidance] = useState<string | null>(null)
   // null = follow ranking (deferred tabs can prepend); set on arrow keys only.
   const [pinnedOptionId, setPinnedOptionId] = useState<string | null>(null)
-  const [lastMenuOpen, setLastMenuOpen] = useState(menuOpen)
   const inputRef = useRef<HTMLInputElement>(null)
+  const submissionIdRef = useRef(0)
+  useEffect(
+    () => () => {
+      submissionIdRef.current += 1
+    },
+    []
+  )
   const fileList = useRuntimeFileListForWorktree({ enabled: menuOpen, worktreeId })
-  const tabSearch = useOpenTabSearch({ enabled: menuOpen, query, worktreeId })
+  const rawQueryOversized = isQuickOpenQueryTooLarge(query)
+  const forcedSearch = parseForcedSearchQuery(query)
+  const terminalQueryMode = rawQueryOversized || forcedSearch.forced
+  const tabSearchQuery = terminalQueryMode ? '' : query
+  const tabSearch = useOpenTabSearch({
+    enabled: menuOpen && !terminalQueryMode,
+    query: tabSearchQuery,
+    worktreeId
+  })
   // Why gate on the query: the search defers, so its rows can still describe an
   // earlier query — Enter must never submit a tab the current query never matched.
-  const tabResults = tabSearch.query === query ? tabSearch.results : EMPTY_TAB_RESULTS
-  const shouldResolveAbsolutePaths = menuOpen && isTabEntryAbsolutePathLike(query.trim())
+  const tabResults =
+    !terminalQueryMode && tabSearch.query === query ? tabSearch.results : EMPTY_TAB_RESULTS
+  const shouldResolveAbsolutePaths =
+    menuOpen && !terminalQueryMode && isTabEntryAbsolutePathLike(query.trim())
   const allowAbsolutePathsSelector = useMemo(
     () =>
       createTabEntryAllowAbsolutePathsSelector(worktreeId, {
@@ -105,6 +103,9 @@ export default function TabBarCreateEntry({
     menuOpen ? (state.getKnownWorktreeById(worktreeId)?.path ?? null) : null
   )
   const localPlatform = getRendererAppPlatform() === 'win32' ? 'windows' : 'posix'
+  const searchEngine = useAppStore(
+    (state) => state.browserDefaultSearchEngine ?? DEFAULT_SEARCH_ENGINE
+  )
 
   // Why: once ArrowDown moves focus into the static menu list, ArrowUp on the
   // first item should return to the search box so the keyboard trip isn't
@@ -144,14 +145,16 @@ export default function TabBarCreateEntry({
   }, [menuOpen])
 
   const matchingMenuOptions = useMemo(
-    () => findMatchingTabCreateMenuOptions(query, menuOptions),
-    [menuOptions, query]
+    () =>
+      terminalQueryMode ? EMPTY_MENU_OPTIONS : findMatchingTabCreateMenuOptions(query, menuOptions),
+    [menuOptions, query, terminalQueryMode]
   )
   const options = useMemo(() => {
     const entryOptions = dropFileEntriesCoveredByTabResults(
       getTabEntryOptions(query, fileList, 4, {
         allowAbsolutePaths,
-        localPlatform
+        localPlatform,
+        searchEngine
       }),
       tabResults,
       worktreePath
@@ -167,25 +170,18 @@ export default function TabBarCreateEntry({
     localPlatform,
     matchingMenuOptions.length,
     query,
+    searchEngine,
     tabResults,
     worktreePath
   ])
   const matchingAgentOptions = useMemo(
-    () => findMatchingTabAgentLaunchOptions(query, agentOptions),
-    [agentOptions, query]
+    () =>
+      terminalQueryMode
+        ? EMPTY_AGENT_OPTIONS
+        : findMatchingTabAgentLaunchOptions(query, agentOptions),
+    [agentOptions, query, terminalQueryMode]
   )
 
-  if (lastMenuOpen !== menuOpen) {
-    setLastMenuOpen(menuOpen)
-    if (!menuOpen) {
-      setQuery('')
-      setPending(false)
-      setError(null)
-      setSwitchError(null)
-      setPinnedOptionId(null)
-    }
-  }
-
   const disabled = !onOpenEntry
   const hasQuery = query.trim().length > 0
   const activeOptions: ActiveOption[] = [
@@ -206,13 +202,15 @@ export default function TabBarCreateEntry({
       option
     }))
   ]
-  // Why pin by id (not index): deferred tab rows prepend and would steal a
-  // user-moved highlight if we kept a raw index. Null pin follows top rank.
-  const pinnedOptionIndex = pinnedOptionId
-    ? activeOptions.findIndex((option) => getActiveOptionId(option) === pinnedOptionId)
-    : -1
-  const activeSelectedIndex = Math.max(pinnedOptionIndex, 0)
-  const selectedActiveOption = activeOptions[activeSelectedIndex]
+  const { activeSelectedIndex, selectedActiveOption } = useNetworkSafeTabEntrySelection({
+    activeOptions,
+    fileIndexFailed: Boolean(fileList.loadError),
+    fileIndexReady: !fileList.loading && !fileList.loadError,
+    forcedSearch: forcedSearch.forced,
+    menuOpen,
+    pinnedOptionId,
+    query
+  })
   const statusOption = options.find(
     (option) => option.classification.kind === 'empty' || option.classification.kind === 'blocked'
   )
@@ -220,7 +218,7 @@ export default function TabBarCreateEntry({
     statusOption != null &&
     (statusOption.classification.kind === 'empty' || statusOption.classification.kind === 'blocked')
       ? statusOption.classification.message
-      : omniboxPlaceholder()
+      : getTabEntryOmniboxPlaceholder()
 
   const submitOption = (option?: ActiveOption) => {
     if (disabled || pending) {
@@ -233,7 +231,15 @@ export default function TabBarCreateEntry({
         onDidOpenEntry?.()
         return
       }
-      setError(statusMessage)
+      if (activeOptions.length > 0) {
+        setSelectionGuidance(getTabEntryChooseActionMessage())
+        return
+      }
+      // Why: an 'empty' status is the placeholder prompt, not a failure — showing
+      // it as an error turns a bare "?" into a red row that reads like a bug.
+      if (statusOption?.classification.kind !== 'empty') {
+        setError(statusMessage)
+      }
       return
     }
     if (selectedOption.kind === 'tab') {
@@ -260,6 +266,7 @@ export default function TabBarCreateEntry({
     }
     setPending(true)
     setError(null)
+    const submissionId = ++submissionIdRef.current
     void onOpenEntry({
       query,
       worktreeId,
@@ -268,13 +275,19 @@ export default function TabBarCreateEntry({
       classification: selectedOption.option.classification
     })
       .then(() => {
-        onDidOpenEntry?.()
+        if (submissionIdRef.current === submissionId) {
+          onDidOpenEntry?.()
+        }
       })
       .catch((caught) => {
-        setError(caught instanceof Error ? caught.message : String(caught))
+        if (submissionIdRef.current === submissionId) {
+          setError(caught instanceof Error ? caught.message : String(caught))
+        }
       })
       .finally(() => {
-        setPending(false)
+        if (submissionIdRef.current === submissionId) {
+          setPending(false)
+        }
       })
   }
 
@@ -292,15 +305,23 @@ export default function TabBarCreateEntry({
             event.stopPropagation()
             const delta = event.key === 'ArrowDown' ? 1 : -1
             const nextIndex =
-              (activeSelectedIndex + delta + activeOptions.length) % activeOptions.length
+              activeSelectedIndex === null
+                ? event.key === 'ArrowDown'
+                  ? 0
+                  : activeOptions.length - 1
+                : (activeSelectedIndex + delta + activeOptions.length) % activeOptions.length
             setPinnedOptionId(getActiveOptionId(activeOptions[nextIndex]))
+            setSelectionGuidance(null)
             return
           }
           // Why: with no result rows the static create/agent items render below;
           // move focus into that Radix menu list so it stays keyboard-navigable
           // from the search box instead of trapping focus in the input.
           if (
-            focusMenuItemAtEdge(event.currentTarget, event.key === 'ArrowDown' ? 'first' : 'last')
+            focusTabEntryMenuItemAtEdge(
+              event.currentTarget,
+              event.key === 'ArrowDown' ? 'first' : 'last'
+            )
           ) {
             event.preventDefault()
             event.stopPropagation()
@@ -326,18 +347,26 @@ export default function TabBarCreateEntry({
             setPinnedOptionId(null)
             setError(null)
             setSwitchError(null)
+            setSelectionGuidance(null)
           }}
+          // Why: disabling the focused input would hand focus to the body and
+          // break arrow/Escape navigation until the submission settles.
           disabled={disabled}
+          readOnly={pending}
+          aria-busy={pending || undefined}
           role="combobox"
-          aria-expanded={activeOptions.length > 0}
-          aria-controls={RESULT_LISTBOX_ID}
+          aria-expanded={!error && activeOptions.length > 0}
+          aria-controls={!error && activeOptions.length > 0 ? RESULT_LISTBOX_ID : undefined}
           aria-autocomplete="list"
           aria-activedescendant={
-            activeOptions.length > 0 && !error ? resultOptionDomId(activeSelectedIndex) : undefined
+            activeSelectedIndex !== null && !error
+              ? resultOptionDomId(activeSelectedIndex)
+              : undefined
           }
-          aria-label={omniboxPlaceholder()}
+          aria-label={getTabEntryOmniboxPlaceholder()}
           aria-invalid={error ? true : undefined}
-          placeholder={omniboxPlaceholder()}
+          aria-errormessage={error ? 'tab-create-entry-error' : undefined}
+          placeholder={getTabEntryOmniboxPlaceholder()}
           className="h-9 rounded-none border-0 bg-transparent px-0 text-xs font-normal text-foreground shadow-none placeholder:font-normal placeholder:text-muted-foreground focus-visible:border-0 focus-visible:ring-0 aria-invalid:border-0 aria-invalid:ring-0 md:text-xs dark:bg-transparent"
         />
       </div>
@@ -345,28 +374,46 @@ export default function TabBarCreateEntry({
           the rows the user can still act on. The live region stays mounted so a
           screen reader announces the failure instead of missing the insertion. */}
       <div role="status">
+        {error ? (
+          <div className="mt-1 px-1" id="tab-create-entry-error">
+            <EntryStatusRow message={error} />
+          </div>
+        ) : null}
         {switchError ? (
           <div className="mt-1 px-1">
             <EntryStatusRow message={switchError} />
           </div>
         ) : null}
+        {selectionGuidance ? (
+          <div className="mt-1 px-1">
+            <EntryStatusRow message={selectionGuidance} />
+          </div>
+        ) : null}
+        {activeOptions.length > 0 && statusOption ? (
+          <div className="mt-1 px-1">
+            <EntryStatusRow loading={fileList.loading} message={statusMessage} />
+          </div>
+        ) : null}
       </div>
-      {error || activeOptions.length > 0 || hasQuery ? (
+      {!error && (activeOptions.length > 0 || hasQuery) ? (
         <div
           className="mt-1 space-y-0.5 px-1"
           id={RESULT_LISTBOX_ID}
-          role={activeOptions.length > 0 && !error ? 'listbox' : undefined}
+          role={activeOptions.length > 0 ? 'listbox' : undefined}
         >
-          {error ? (
-            <EntryStatusRow message={error} />
-          ) : activeOptions.length > 0 ? (
+          {activeOptions.length > 0 ? (
             activeOptions.map((option, index) => (
               <EntryActionRow
                 key={getActiveOptionId(option)}
                 id={resultOptionDomId(index)}
                 option={option}
                 selected={index === activeSelectedIndex}
-                onClick={() => submitOption(option)}
+                disabled={disabled || pending}
+                loading={pending && index === activeSelectedIndex}
+                onClick={() => {
+                  setSelectionGuidance(null)
+                  submitOption(option)
+                }}
               />
             ))
           ) : (
@@ -377,21 +424,3 @@ export default function TabBarCreateEntry({
     </form>
   )
 }
-
-// Moves keyboard focus to the first/last enabled item of the enclosing Radix
-// menu so the static create/agent list stays navigable from the search input.
-function focusMenuItemAtEdge(fromElement: HTMLElement, edge: 'first' | 'last'): boolean {
-  const menu = fromElement.closest('[role="menu"]')
-  if (!menu) {
-    return false
-  }
-  const items = menu.querySelectorAll<HTMLElement>(
-    '[role="menuitem"]:not([data-disabled]):not([aria-disabled="true"])'
-  )
-  const target = edge === 'first' ? items[0] : items.item(items.length - 1)
-  if (!target) {
-    return false
-  }
-  target.focus()
-  return true
-}
diff --git a/src/renderer/src/components/tab-bar/TabBarCreateEntryRow.test.tsx b/src/renderer/src/components/tab-bar/TabBarCreateEntryRow.test.tsx
index 616b3caa0c6..eafad8ad790 100644
--- a/src/renderer/src/components/tab-bar/TabBarCreateEntryRow.test.tsx
+++ b/src/renderer/src/components/tab-bar/TabBarCreateEntryRow.test.tsx
@@ -2,6 +2,7 @@
 
 import { act, createElement } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
+import { getByRole } from '@testing-library/dom'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { TooltipProvider } from '@/components/ui/tooltip'
 import type { ActiveOption } from './tab-create-entry-active-option'
@@ -88,4 +89,18 @@ describe('EntryActionRow', () => {
     expect(renderRow(makeFileOption('README.md')).textContent).toContain('README.md')
     expect(container.textContent).not.toContain('/')
   })
+
+  it('names the provider and query without retaining a built URL', () => {
+    renderRow({
+      kind: 'entry',
+      option: {
+        id: 'search:private project',
+        classification: { kind: 'search', engine: 'kagi', query: 'private project' }
+      }
+    })
+
+    expect(getByRole(container, 'option', { name: 'Search Kagi private project' })).toBeTruthy()
+    expect(container.textContent).toBe('Search Kagi·private project')
+    expect(container.textContent).not.toContain('https://')
+  })
 })
diff --git a/src/renderer/src/components/tab-bar/TabBarCreateEntryRow.tsx b/src/renderer/src/components/tab-bar/TabBarCreateEntryRow.tsx
index 0cca7d4b8c6..5e99818009d 100644
--- a/src/renderer/src/components/tab-bar/TabBarCreateEntryRow.tsx
+++ b/src/renderer/src/components/tab-bar/TabBarCreateEntryRow.tsx
@@ -5,6 +5,7 @@ import {
   GitCompare,
   Globe,
   Loader2,
+  Search,
   Smartphone,
   TerminalSquare
 } from 'lucide-react'
@@ -12,6 +13,7 @@ import { AgentIcon } from '@/lib/agent-catalog'
 import { cn } from '@/lib/utils'
 import { FilePathCursorTooltip, splitTrailingSegment } from '@/components/file-path-cursor-tooltip'
 import { translate } from '@/i18n/i18n'
+import { SEARCH_ENGINE_LABELS } from '../../../../shared/browser-url'
 import type { ActiveOption } from './tab-create-entry-active-option'
 
 export const RESULT_LISTBOX_ID = 'tab-create-entry-results'
@@ -38,12 +40,16 @@ export function EntryStatusRow({
 }
 
 export function EntryActionRow({
+  disabled = false,
   id,
+  loading = false,
   onClick,
   option,
   selected
 }: {
+  disabled?: boolean
   id: string
+  loading?: boolean
   onClick: () => void
   option: ActiveOption
   selected: boolean
@@ -56,15 +62,22 @@ export function EntryActionRow({
       id={id}
       role="option"
       aria-selected={selected}
+      disabled={disabled}
       className={cn(
-        'flex h-6 w-full items-center gap-1.5 rounded-[7px] px-1 text-left text-[11px] leading-5 outline-none',
+        'flex h-6 w-full items-center gap-1.5 rounded-[7px] px-1 text-left text-[11px] leading-5 outline-none disabled:cursor-not-allowed disabled:opacity-50',
         selected
           ? 'bg-black/8 text-accent-foreground dark:bg-white/14'
-          : 'text-muted-foreground hover:bg-black/8 hover:text-accent-foreground dark:hover:bg-white/14'
+          : // Why: CSS :hover still matches a disabled button, so a pending row would
+            // light up under the pointer despite being unactivatable.
+            'text-muted-foreground hover:bg-black/8 hover:text-accent-foreground disabled:hover:bg-transparent disabled:hover:text-muted-foreground dark:hover:bg-white/14 dark:disabled:hover:bg-transparent'
       )}
       onClick={onClick}
     >
-      {presentation.icon}
+      {loading ? (
+        <Loader2 className="size-3.5 shrink-0 animate-spin" aria-hidden="true" />
+      ) : (
+        presentation.icon
+      )}
       <span className={cn('min-w-0 truncate font-medium', presentation.showDetail && 'shrink-0')}>
         {presentation.label}
       </span>
@@ -169,6 +182,19 @@ function getActionPresentation(option: ActiveOption): {
     }
   }
   const { classification } = option.option
+  if (classification.kind === 'search') {
+    return {
+      detail: classification.query,
+      icon: <Search className="size-3.5 shrink-0" aria-hidden="true" />,
+      label: translate(
+        'auto.components.tab.bar.TabBarCreateEntry.searchProvider',
+        'Search {{value0}}',
+        { value0: SEARCH_ENGINE_LABELS[classification.engine] }
+      ),
+      prioritizeFilename: false,
+      showDetail: true
+    }
+  }
   if (classification.kind === 'explicit-url' || classification.kind === 'host-url') {
     return {
       detail: classification.url,
diff --git a/src/renderer/src/components/tab-bar/TabBarQuickCommandAddActions.tsx b/src/renderer/src/components/tab-bar/TabBarQuickCommandAddActions.tsx
index e45ed43c1d2..cac174498ae 100644
--- a/src/renderer/src/components/tab-bar/TabBarQuickCommandAddActions.tsx
+++ b/src/renderer/src/components/tab-bar/TabBarQuickCommandAddActions.tsx
@@ -1,4 +1,4 @@
-import { Play } from 'lucide-react'
+import { Plus } from 'lucide-react'
 import { translate } from '@/i18n/i18n'
 import type { TerminalQuickCommandHost } from '@/hooks/use-terminal-quick-command-hosts'
 
@@ -18,7 +18,7 @@ export function TabBarQuickCommandAddActions({
           onClick={() => onAdd(host.hostId)}
           className="flex w-full cursor-pointer items-center gap-2 rounded-[5px] px-2 py-1.5 text-[12px] text-muted-foreground hover:bg-muted hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
         >
-          <Play className="size-3.5" />
+          <Plus className="size-3.5" />
           {hosts.length === 1
             ? translate(
                 'auto.components.tab.bar.TabBarQuickCommandAddActions.45a2f36d51',
diff --git a/src/renderer/src/components/tab-bar/TabBarQuickCommandItem.test.tsx b/src/renderer/src/components/tab-bar/TabBarQuickCommandItem.test.tsx
new file mode 100644
index 00000000000..9d76902a6f5
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/TabBarQuickCommandItem.test.tsx
@@ -0,0 +1,195 @@
+// @vitest-environment happy-dom
+
+import { act, createElement } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { Command } from '@/components/ui/command'
+import type { HostedTerminalQuickCommand } from '@/hooks/use-terminal-quick-command-hosts'
+import { TabBarQuickCommandItem } from './TabBarQuickCommandItem'
+
+;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+
+vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
+  translate: (_key: string, fallback: string, values?: Record<string, string>) => {
+    if (!values) {
+      return fallback
+    }
+    return Object.entries(values).reduce(
+      (text, [key, value]) => text.replace(`{{${key}}}`, value),
+      fallback
+    )
+  }
+}))
+
+vi.mock('@/lib/agent-catalog', () => ({
+  AgentIcon: () => null,
+  getAgentLabel: (agent: string) => agent
+}))
+
+const entry: HostedTerminalQuickCommand = {
+  key: 'local:cmd-1',
+  hostId: 'local',
+  hostLabel: 'This Mac',
+  command: {
+    id: 'cmd-1',
+    label: 'Git status',
+    action: 'terminal-command',
+    command: 'git status',
+    appendEnter: true,
+    scope: { type: 'repo', repoId: 'repo-1' }
+  }
+}
+
+let container: HTMLDivElement
+let root: Root
+let writeClipboardText: ReturnType<typeof vi.fn>
+
+beforeEach(() => {
+  writeClipboardText = vi.fn().mockResolvedValue(undefined)
+  Object.assign(window, { api: { ui: { writeClipboardText } } })
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+
+afterEach(() => {
+  act(() => root.unmount())
+  container.remove()
+})
+
+function renderItem(item: HostedTerminalQuickCommand = entry): {
+  onRun: ReturnType<typeof vi.fn>
+  onEdit: ReturnType<typeof vi.fn>
+  onDelete: ReturnType<typeof vi.fn>
+} {
+  const onRun = vi.fn()
+  const onEdit = vi.fn()
+  const onDelete = vi.fn()
+  act(() => {
+    root.render(
+      createElement(
+        Command,
+        { shouldFilter: false },
+        createElement(TabBarQuickCommandItem, {
+          entry: item,
+          showHostLabel: false,
+          onRun,
+          onEdit,
+          onDelete
+        })
+      )
+    )
+  })
+  return { onRun, onEdit, onDelete }
+}
+
+describe('TabBarQuickCommandItem', () => {
+  it('copies the command body without running the command', async () => {
+    const { onRun, onEdit, onDelete } = renderItem()
+
+    const copyButton = container.querySelector('button[aria-label="Copy Git status"]')
+    if (!(copyButton instanceof HTMLButtonElement)) {
+      throw new Error('copy button not found')
+    }
+
+    await act(async () => {
+      copyButton.click()
+      await Promise.resolve()
+    })
+
+    expect(writeClipboardText).toHaveBeenCalledWith('git status')
+    expect(onRun).not.toHaveBeenCalled()
+    expect(onEdit).not.toHaveBeenCalled()
+    expect(onDelete).not.toHaveBeenCalled()
+    expect(container.querySelector('button[aria-label="Copied"]')).not.toBeNull()
+  })
+
+  it('copies agent prompt text for agent quick commands', async () => {
+    renderItem({
+      key: 'local:agent-1',
+      hostId: 'local',
+      hostLabel: 'This Mac',
+      command: {
+        id: 'agent-1',
+        label: 'Explore codebase',
+        action: 'agent-prompt',
+        agent: 'claude',
+        prompt: 'Explore the auth module',
+        scope: { type: 'global' }
+      }
+    })
+
+    const copyButton = container.querySelector('button[aria-label="Copy Explore codebase"]')
+    if (!(copyButton instanceof HTMLButtonElement)) {
+      throw new Error('copy button not found')
+    }
+
+    await act(async () => {
+      copyButton.click()
+      await Promise.resolve()
+    })
+
+    expect(writeClipboardText).toHaveBeenCalledWith('Explore the auth module')
+  })
+
+  it('disables copy when the command body is empty', () => {
+    renderItem({
+      key: 'local:empty',
+      hostId: 'local',
+      hostLabel: 'This Mac',
+      command: {
+        id: 'empty',
+        label: 'Empty',
+        action: 'terminal-command',
+        command: '   ',
+        appendEnter: true,
+        scope: { type: 'global' }
+      }
+    })
+
+    const copyButton = container.querySelector('button[aria-label="Nothing to copy"]')
+    if (!(copyButton instanceof HTMLButtonElement)) {
+      throw new Error('disabled copy button not found')
+    }
+    expect(copyButton.disabled).toBe(true)
+    expect(writeClipboardText).not.toHaveBeenCalled()
+  })
+
+  it('surfaces clipboard failure without claiming success', async () => {
+    writeClipboardText.mockRejectedValueOnce(new Error('denied'))
+    renderItem()
+
+    const copyButton = container.querySelector('button[aria-label="Copy Git status"]')
+    if (!(copyButton instanceof HTMLButtonElement)) {
+      throw new Error('copy button not found')
+    }
+
+    await act(async () => {
+      copyButton.click()
+      await Promise.resolve()
+    })
+
+    expect(container.querySelector('button[aria-label="Couldn\'t copy"]')).not.toBeNull()
+    expect(container.querySelector('button[aria-label="Copied"]')).toBeNull()
+  })
+
+  it('prevents nested action pointerdown from selecting the command row', () => {
+    const { onRun } = renderItem()
+    const copyButton = container.querySelector('button[aria-label="Copy Git status"]')
+    if (!(copyButton instanceof HTMLButtonElement)) {
+      throw new Error('copy button not found')
+    }
+
+    const event = new MouseEvent('pointerdown', { bubbles: true, cancelable: true })
+    const stopPropagation = vi.spyOn(event, 'stopPropagation')
+    const preventDefault = vi.spyOn(event, 'preventDefault')
+    act(() => {
+      copyButton.dispatchEvent(event)
+    })
+
+    expect(stopPropagation).toHaveBeenCalled()
+    expect(preventDefault).toHaveBeenCalled()
+    expect(onRun).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/tab-bar/TabBarQuickCommandItem.tsx b/src/renderer/src/components/tab-bar/TabBarQuickCommandItem.tsx
index 269506ba29f..bb419f25d0d 100644
--- a/src/renderer/src/components/tab-bar/TabBarQuickCommandItem.tsx
+++ b/src/renderer/src/components/tab-bar/TabBarQuickCommandItem.tsx
@@ -1,9 +1,15 @@
-import { Pencil, Play, Trash2 } from 'lucide-react'
+import type { MouseEvent, PointerEvent } from 'react'
+import { Check, Copy, Pencil, Play, Trash2 } from 'lucide-react'
 import { CommandItem } from '@/components/ui/command'
-import { isTerminalAgentQuickCommand } from '../../../../shared/terminal-quick-commands'
+import {
+  getTerminalQuickCommandBody,
+  isTerminalAgentQuickCommand
+} from '../../../../shared/terminal-quick-commands'
 import { AgentIcon, getAgentLabel } from '@/lib/agent-catalog'
 import { translate } from '@/i18n/i18n'
+import { useClipboardTextCopyFeedback } from '@/hooks/use-clipboard-text-copy-feedback'
 import type { HostedTerminalQuickCommand } from '@/hooks/use-terminal-quick-command-hosts'
+import { cn } from '@/lib/utils'
 
 type TabBarQuickCommandItemProps = {
   entry: HostedTerminalQuickCommand
@@ -13,6 +19,14 @@ type TabBarQuickCommandItemProps = {
   onDelete: () => void
 }
 
+function stopRowSelect(event: MouseEvent | PointerEvent): void {
+  // Why: cmdk selects the parent CommandItem on click; nested actions must not
+  // also run the quick command. preventDefault keeps focus in the search input
+  // so arrow/Enter navigation still works after Copy (Edit/Delete close the menu).
+  event.preventDefault()
+  event.stopPropagation()
+}
+
 export function TabBarQuickCommandItem({
   entry,
   showHostLabel,
@@ -21,6 +35,25 @@ export function TabBarQuickCommandItem({
   onDelete
 }: TabBarQuickCommandItemProps): React.JSX.Element {
   const { command } = entry
+  const body = getTerminalQuickCommandBody(command)
+  const { canCopy, copyText, status } = useClipboardTextCopyFeedback(body)
+
+  const copyLabel =
+    status === 'copied'
+      ? translate('auto.components.tab.bar.TabBarQuickCommandsButton.8d525e5f15', 'Copied')
+      : status === 'failed'
+        ? translate('auto.components.tab.bar.TabBarQuickCommandsButton.53b17a4b1b', "Couldn't copy")
+        : canCopy
+          ? translate(
+              'auto.components.tab.bar.TabBarQuickCommandsButton.a9a564b7e7',
+              'Copy {{value0}}',
+              { value0: command.label }
+            )
+          : translate(
+              'auto.components.tab.bar.TabBarQuickCommandsButton.69a1441a21',
+              'Nothing to copy'
+            )
+
   return (
     <CommandItem
       value={entry.key}
@@ -53,11 +86,37 @@ export function TabBarQuickCommandItem({
             : command.command}
         </span>
       </span>
-      <span className="flex shrink-0 items-center gap-0.5 can-hover:opacity-0 transition-opacity group-hover/qc:opacity-100 group-data-[selected=true]/qc:opacity-100">
+      <span
+        role="group"
+        aria-label={translate(
+          'auto.components.tab.bar.TabBarQuickCommandsButton.192a4616a5',
+          'Quick command actions'
+        )}
+        className="flex shrink-0 items-center gap-0.5 can-hover:opacity-0 transition-opacity group-hover/qc:opacity-100 group-data-[selected=true]/qc:opacity-100"
+      >
         <button
           type="button"
+          disabled={!canCopy}
+          onPointerDown={stopRowSelect}
           onClick={(event) => {
-            event.stopPropagation()
+            stopRowSelect(event)
+            void copyText()
+          }}
+          className={cn(
+            'cursor-pointer rounded p-1 text-muted-foreground hover:bg-accent hover:text-foreground disabled:cursor-not-allowed disabled:opacity-40 disabled:hover:bg-transparent',
+            status === 'copied' && 'text-status-success',
+            status === 'failed' && 'text-destructive'
+          )}
+          aria-label={copyLabel}
+          title={copyLabel}
+        >
+          {status === 'copied' ? <Check className="size-3" /> : <Copy className="size-3" />}
+        </button>
+        <button
+          type="button"
+          onPointerDown={stopRowSelect}
+          onClick={(event) => {
+            stopRowSelect(event)
             onEdit()
           }}
           className="cursor-pointer rounded p-1 text-muted-foreground hover:bg-accent hover:text-foreground"
@@ -71,8 +130,9 @@ export function TabBarQuickCommandItem({
         </button>
         <button
           type="button"
+          onPointerDown={stopRowSelect}
           onClick={(event) => {
-            event.stopPropagation()
+            stopRowSelect(event)
             onDelete()
           }}
           className="cursor-pointer rounded p-1 text-muted-foreground hover:bg-accent hover:text-destructive"
diff --git a/src/renderer/src/components/tab-bar/TabBarQuickCommandsButton.tsx b/src/renderer/src/components/tab-bar/TabBarQuickCommandsButton.tsx
index bbbdddabc98..5e989f9e4a9 100644
--- a/src/renderer/src/components/tab-bar/TabBarQuickCommandsButton.tsx
+++ b/src/renderer/src/components/tab-bar/TabBarQuickCommandsButton.tsx
@@ -23,6 +23,8 @@ import {
   useTerminalQuickCommandHosts
 } from '@/hooks/use-terminal-quick-command-hosts'
 import { getRepoExecutionHostId, type ExecutionHostId } from '../../../../shared/execution-host'
+import { useProjectHostSetupProjection } from '@/store/selectors'
+import { terminalQuickCommandMatchesWorkspaceProject } from '@/lib/terminal-quick-command-project-scope'
 
 type TabBarQuickCommandsButtonProps = {
   worktreeId: string
@@ -35,6 +37,7 @@ export function TabBarQuickCommandsButton({
 }: TabBarQuickCommandsButtonProps): React.JSX.Element | null {
   const recentByGroup = useAppStore((s) => s.recentQuickCommandIdByGroup)
   const repos = useAppStore((s) => s.repos)
+  const projectHostSetupProjection = useProjectHostSetupProjection()
   const { executionHostId, hosts, refreshRemoteHost, remoteHostLoadFailed, remoteHostPending } =
     useTerminalQuickCommandHosts(worktreeId)
   const confirm = useConfirmationDialog()
@@ -61,12 +64,20 @@ export function TabBarQuickCommandsButton({
       const scope = getTerminalQuickCommandScope(command)
       if (scope.type === 'global') {
         globalList.push(entry)
-      } else if (scope.type === 'repo' && repoId !== null && scope.repoId === repoId) {
+      } else if (
+        scope.type === 'repo' &&
+        terminalQuickCommandMatchesWorkspaceProject(command, {
+          commandHostId: entry.hostId,
+          projectHostSetups: projectHostSetupProjection.setups,
+          targetHostId: executionHostId,
+          targetRepoId: repoId
+        })
+      ) {
         repoList.push(entry)
       }
     }
     return { repoCommands: repoList, globalCommands: globalList }
-  }, [hosts, repoId])
+  }, [executionHostId, hosts, projectHostSetupProjection.setups, repoId])
 
   const recentId = recentByGroup[groupId] ?? null
   // Why: split-button label prefers the most recently used command for this
diff --git a/src/renderer/src/components/tab-bar/TabBarQuickCommandsMenu.tsx b/src/renderer/src/components/tab-bar/TabBarQuickCommandsMenu.tsx
index 1bbdea1b827..02b6cd4ec50 100644
--- a/src/renderer/src/components/tab-bar/TabBarQuickCommandsMenu.tsx
+++ b/src/renderer/src/components/tab-bar/TabBarQuickCommandsMenu.tsx
@@ -276,7 +276,7 @@ export function TabBarQuickCommandsMenu({
           align="end"
           side="bottom"
           sideOffset={6}
-          className="w-72 p-0"
+          className="w-80 p-0"
           onCompositionStart={() => {
             if (!showSearch) {
               menuImeEnter.setComposing(true)
diff --git a/src/renderer/src/components/tab-bar/tab-bar-item-model.ts b/src/renderer/src/components/tab-bar/tab-bar-item-model.ts
new file mode 100644
index 00000000000..89e2891908d
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-bar-item-model.ts
@@ -0,0 +1,242 @@
+import type {
+  BrowserTab as BrowserTabState,
+  Tab,
+  TerminalTab,
+  WorkspaceVisibleTabType
+} from '../../../../shared/types'
+import { resolveTerminalTabTitle } from '../../../../shared/tab-title-resolution'
+import type { OpenFile } from '../../store/slices/editor'
+import { getEditorDisplayLabel } from '@/components/editor/editor-labels'
+import { normalizeRelativePath } from '@/lib/path'
+import { getBrowserTabLabel } from './BrowserTab'
+import type { DropIndicator } from './drop-indicator'
+import { reconcileTabOrder } from './reconcile-order'
+import { resolveTabIndicatorEdges } from '../tab-group/tab-insertion'
+import type { HoveredTabInsertion } from '../tab-group/useTabDragSplit'
+
+export type TabBarItem =
+  | {
+      type: 'terminal'
+      id: string
+      unifiedTabId: string
+      isPinned: boolean
+      data: TerminalTab & { unifiedTabId?: string }
+    }
+  | {
+      type: 'editor'
+      id: string
+      unifiedTabId: string
+      isPinned: boolean
+      data: OpenFile & { tabId?: string }
+    }
+  | {
+      type: 'browser'
+      id: string
+      unifiedTabId: string
+      isPinned: boolean
+      data: BrowserTabState & { tabId?: string }
+    }
+  | {
+      type: 'simulator'
+      id: string
+      unifiedTabId: string
+      isPinned: boolean
+      data: Tab
+    }
+
+export function getTabDragLabel(item: TabBarItem, generatedTitlesEnabled: boolean): string {
+  if (item.type === 'terminal') {
+    return resolveTerminalTabTitle(item.data, generatedTitlesEnabled, item.data.title)
+  }
+  if (item.type === 'browser') {
+    return getBrowserTabLabel(item.data)
+  }
+  if (item.type === 'simulator') {
+    return item.data.label || 'Mobile Emulator'
+  }
+  return getEditorDisplayLabel(item.data)
+}
+
+export function getTabLayoutSignature(
+  item: TabBarItem,
+  {
+    generatedTitlesEnabled,
+    isExpanded,
+    status
+  }: {
+    generatedTitlesEnabled: boolean
+    isExpanded: boolean
+    status?: string | null
+  }
+): string {
+  const label = getTabDragLabel(item, generatedTitlesEnabled)
+  if (item.type === 'terminal') {
+    return `${item.type}:${item.id}:${item.isPinned}:${isExpanded}:${Boolean(item.data.color)}:${label}`
+  }
+  if (item.type === 'browser') {
+    return `${item.type}:${item.id}:${item.isPinned}:${item.data.loading}:${Boolean(item.data.loadError)}:${label}`
+  }
+  if (item.type === 'editor') {
+    return `${item.type}:${item.id}:${item.isPinned}:${item.data.isDirty}:${item.data.isPreview}:${item.data.externalMutation ?? ''}:${status ?? ''}:${label}`
+  }
+  return `${item.type}:${item.id}:${item.isPinned}:${label}`
+}
+
+export function createUnifiedTabLookup(tabs: readonly Tab[], groupId: string): Map<string, Tab> {
+  const lookup = new Map<string, Tab>()
+  for (const tab of tabs) {
+    if (tab.groupId !== groupId) {
+      continue
+    }
+    lookup.set(tab.id, tab)
+    if (tab.contentType === 'terminal' || tab.contentType === 'browser') {
+      lookup.set(tab.entityId, tab)
+    }
+  }
+  return lookup
+}
+
+export function buildOrderedTabItems({
+  tabBarOrder,
+  terminalIds,
+  editorFileIds,
+  browserTabIds,
+  simulatorTabIds,
+  terminalMap,
+  editorMap,
+  browserMap,
+  unifiedTabByVisibleId
+}: {
+  tabBarOrder?: string[]
+  terminalIds: string[]
+  editorFileIds: string[]
+  browserTabIds: string[]
+  simulatorTabIds: string[]
+  terminalMap: Map<string, TerminalTab & { unifiedTabId?: string }>
+  editorMap: Map<string, OpenFile & { tabId?: string }>
+  browserMap: Map<string, BrowserTabState & { tabId?: string }>
+  unifiedTabByVisibleId: Map<string, Tab>
+}): TabBarItem[] {
+  const ids = reconcileTabOrder(
+    tabBarOrder,
+    terminalIds,
+    editorFileIds,
+    browserTabIds,
+    simulatorTabIds
+  )
+  const items: TabBarItem[] = []
+  for (const id of ids) {
+    const terminal = terminalMap.get(id)
+    if (terminal) {
+      const unifiedTab = unifiedTabByVisibleId.get(id)
+      items.push({
+        type: 'terminal',
+        id,
+        unifiedTabId: terminal.unifiedTabId ?? unifiedTab?.id ?? terminal.id,
+        isPinned: unifiedTab?.isPinned === true,
+        data: terminal
+      })
+      continue
+    }
+    const file = editorMap.get(id)
+    if (file) {
+      const unifiedTab = unifiedTabByVisibleId.get(id) ?? unifiedTabByVisibleId.get(file.id)
+      items.push({
+        type: 'editor',
+        id,
+        unifiedTabId: file.tabId ?? unifiedTab?.id ?? file.id,
+        isPinned: unifiedTab?.isPinned === true,
+        data: file
+      })
+      continue
+    }
+    const browserTab = browserMap.get(id)
+    if (browserTab) {
+      const unifiedTab = unifiedTabByVisibleId.get(id)
+      items.push({
+        type: 'browser',
+        id,
+        unifiedTabId: browserTab.tabId ?? unifiedTab?.id ?? browserTab.id,
+        isPinned: unifiedTab?.isPinned === true,
+        data: browserTab
+      })
+      continue
+    }
+    const simulatorTab = unifiedTabByVisibleId.get(id)
+    if (simulatorTab?.contentType === 'simulator') {
+      items.push({
+        type: 'simulator',
+        id,
+        unifiedTabId: simulatorTab.id,
+        isPinned: simulatorTab.isPinned === true,
+        data: simulatorTab
+      })
+    }
+  }
+  return items
+}
+
+export function buildTabDropIndicators(
+  items: readonly TabBarItem[],
+  insertion: HoveredTabInsertion | null
+): Map<string, DropIndicator> {
+  const indicators = new Map<string, DropIndicator>()
+  for (const edge of resolveTabIndicatorEdges(
+    items.map((item) => item.id),
+    insertion
+  )) {
+    indicators.set(edge.visibleTabId, edge.side)
+  }
+  return indicators
+}
+
+export function findActiveVisibleTabId(
+  items: readonly TabBarItem[],
+  active: {
+    activeTabId: string | null
+    activeFileId?: string | null
+    activeBrowserTabId?: string | null
+    activeSimulatorTabId?: string | null
+    activeTabType?: WorkspaceVisibleTabType
+  }
+): string | null {
+  const activeItem = items.find((item) => {
+    if (item.type === 'terminal') {
+      return (
+        (active.activeTabType === 'terminal' || active.activeTabType === 'simulator') &&
+        item.id === active.activeTabId
+      )
+    }
+    if (item.type === 'browser') {
+      return active.activeTabType === 'browser' && item.id === active.activeBrowserTabId
+    }
+    if (item.type === 'simulator') {
+      return active.activeTabType === 'simulator' && item.id === active.activeSimulatorTabId
+    }
+    return (
+      (active.activeTabType === 'editor' || active.activeTabType === 'simulator') &&
+      active.activeFileId === item.id
+    )
+  })
+  return activeItem?.id ?? null
+}
+
+export function buildTabStripLayoutKey(
+  items: readonly TabBarItem[],
+  generatedTitlesEnabled: boolean,
+  expandedPaneByTabId: Record<string, boolean>,
+  statusByRelativePath: Map<string, string>
+): string {
+  return items
+    .map((item) =>
+      getTabLayoutSignature(item, {
+        generatedTitlesEnabled,
+        isExpanded: expandedPaneByTabId[item.id] === true,
+        status:
+          item.type === 'editor'
+            ? (statusByRelativePath.get(normalizeRelativePath(item.data.relativePath)) ?? null)
+            : null
+      })
+    )
+    .join('\u001f')
+}
diff --git a/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx b/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
new file mode 100644
index 00000000000..de672c549a4
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
@@ -0,0 +1,227 @@
+import React from 'react'
+import { resolveTerminalTabTitle } from '../../../../shared/tab-title-resolution'
+import type { OpenFile } from '../../store/slices/editor'
+import { canToggleNativeChat } from '../native-chat/native-chat-availability'
+import { resolveCommittedTitleAgentType } from '@/lib/pane-agent-evidence'
+import SortableTab from './SortableTab'
+import EditorFileTab from './EditorFileTab'
+import BrowserTab from './BrowserTab'
+import type { DropIndicator } from './drop-indicator'
+import type { TabDragItemData } from '../tab-group/useTabDragSplit'
+import { getTabDragLabel, type TabBarItem } from './tab-bar-item-model'
+import type { TabBarProps } from './tab-bar-props'
+import type { TabBarRuntimeModel } from './use-tab-bar-runtime-model'
+
+export function renderTabBarItems({
+  items,
+  props,
+  runtime,
+  dropIndicatorByVisibleId,
+  includeTopTabBorder,
+  togglePinned
+}: {
+  items: TabBarItem[]
+  props: TabBarProps
+  runtime: TabBarRuntimeModel
+  dropIndicatorByVisibleId: Map<string, DropIndicator>
+  includeTopTabBorder: boolean
+  togglePinned: (item: TabBarItem) => void
+}): React.ReactNode[] {
+  const {
+    worktreeId,
+    activeTabId,
+    activeFileId,
+    activeBrowserTabId,
+    activeSimulatorTabId,
+    activeTabType,
+    expandedPaneByTabId,
+    onActivate,
+    onClose,
+    onCloseOthers,
+    onCloseToRight,
+    onCloseToLeft,
+    onSetCustomTitle,
+    onSetTabColor,
+    onTogglePaneExpand,
+    onActivateFile,
+    onCloseFile,
+    onActivateBrowserTab,
+    onCloseBrowserTab,
+    onDuplicateBrowserTab,
+    onCloseAllFiles,
+    onMakePreviewFilePermanent
+  } = props
+  const {
+    resolvedGroupId,
+    generatedTabTitlesEnabled,
+    unifiedTabByVisibleId,
+    nativeChatEnabled,
+    tabAgentTypesByTabId,
+    nativeChatTabWideFallbackUnsafeTabsById,
+    nativeChatTranscriptIsLocalReadable,
+    toggleTabViewMode,
+    statusByRelativePath
+  } = runtime
+
+  return items.map((item, index) => {
+    const dragData: TabDragItemData = {
+      kind: 'tab',
+      worktreeId,
+      groupId: resolvedGroupId,
+      unifiedTabId: item.unifiedTabId,
+      visibleTabId: item.id,
+      tabType: item.type,
+      label: getTabDragLabel(item, generatedTabTitlesEnabled),
+      iconPath: item.type === 'editor' ? item.data.filePath : undefined,
+      color: item.type === 'terminal' ? (item.data.color ?? null) : null
+    }
+    if (item.type === 'terminal') {
+      const terminalTab = {
+        ...item.data,
+        title: resolveTerminalTabTitle(item.data, generatedTabTitlesEnabled, item.data.title)
+      }
+      const unifiedTabForItem = unifiedTabByVisibleId.get(item.id)
+      // Carry the agent *identity* (not just "an agent exists") so the native-chat gate can reject agents like Grok.
+      const resolvedAgent =
+        resolveCommittedTitleAgentType(unifiedTabForItem?.label ?? '') ??
+        resolveCommittedTitleAgentType(terminalTab.title)
+      // Key the live-agent lookup by the backing terminal tab id: agent-status pane keys use it, not the unified tab id.
+      const detectedAgent = tabAgentTypesByTabId[terminalTab.id] ?? null
+      const tabWideFallbackSafe = nativeChatTabWideFallbackUnsafeTabsById[terminalTab.id] !== true
+      const canToggleViewMode =
+        unifiedTabForItem !== undefined &&
+        canToggleNativeChat({
+          experimentalNativeChatEnabled: nativeChatEnabled,
+          contentType: 'terminal',
+          launchAgent: tabWideFallbackSafe ? terminalTab.launchAgent : null,
+          detectedAgent,
+          resolvedAgent: tabWideFallbackSafe ? resolvedAgent : null,
+          nativeChatTranscriptIsLocalReadable,
+          isChatViewMode: unifiedTabForItem.viewMode === 'chat'
+        })
+      return (
+        <SortableTab
+          key={item.id}
+          tab={terminalTab}
+          unifiedTabId={item.unifiedTabId}
+          groupId={resolvedGroupId}
+          tabCount={items.length}
+          canToggleViewMode={canToggleViewMode}
+          isChatView={nativeChatEnabled && unifiedTabForItem?.viewMode === 'chat'}
+          onToggleViewMode={
+            unifiedTabForItem ? () => toggleTabViewMode(unifiedTabForItem.id) : undefined
+          }
+          hasTabsToRight={index < items.length - 1}
+          hasTabsToLeft={index > 0}
+          isActive={
+            (activeTabType === 'terminal' || activeTabType === 'simulator') &&
+            item.id === activeTabId
+          }
+          isPinned={item.isPinned}
+          isExpanded={expandedPaneByTabId[item.id] === true}
+          onActivate={onActivate}
+          onClose={onClose}
+          onCloseOthers={onCloseOthers}
+          onCloseToRight={onCloseToRight}
+          onCloseToLeft={onCloseToLeft}
+          onSetCustomTitle={onSetCustomTitle}
+          onSetTabColor={onSetTabColor}
+          onTogglePin={() => togglePinned(item)}
+          onToggleExpand={onTogglePaneExpand}
+          dragData={dragData}
+          dropIndicator={dropIndicatorByVisibleId.get(item.id) ?? null}
+          includeTopTabBorder={includeTopTabBorder}
+        />
+      )
+    }
+    if (item.type === 'browser') {
+      return (
+        <BrowserTab
+          key={item.id}
+          tab={item.data}
+          isActive={activeTabType === 'browser' && activeBrowserTabId === item.id}
+          isPinned={item.isPinned}
+          hasTabsToRight={index < items.length - 1}
+          hasTabsToLeft={index > 0}
+          tabCount={items.length}
+          onActivate={() => onActivateBrowserTab?.(item.id)}
+          onClose={() => onCloseBrowserTab?.(item.id)}
+          onCloseOthers={() => onCloseOthers(item.id)}
+          onCloseToRight={() => onCloseToRight(item.id)}
+          onCloseToLeft={() => onCloseToLeft(item.id)}
+          onDuplicate={
+            runtime.managedBrowserCreationEnabled
+              ? () => onDuplicateBrowserTab?.(item.id)
+              : undefined
+          }
+          onTogglePin={() => togglePinned(item)}
+          dragData={dragData}
+          dropIndicator={dropIndicatorByVisibleId.get(item.id) ?? null}
+          includeTopTabBorder={includeTopTabBorder}
+        />
+      )
+    }
+    if (item.type === 'simulator') {
+      const simulatorLabel = item.data.label || 'Mobile Emulator'
+      const simulatorFile: OpenFile & { tabId: string } = {
+        id: item.id,
+        tabId: item.id,
+        filePath: simulatorLabel,
+        relativePath: simulatorLabel,
+        worktreeId,
+        language: 'simulator',
+        isPreview: false,
+        isDirty: false,
+        mode: 'edit'
+      }
+      return (
+        <EditorFileTab
+          key={item.id}
+          file={simulatorFile}
+          isActive={activeTabType === 'simulator' && item.id === activeSimulatorTabId}
+          isPinned={item.isPinned}
+          hasTabsToRight={index < items.length - 1}
+          hasTabsToLeft={index > 0}
+          tabCount={items.length}
+          statusByRelativePath={statusByRelativePath}
+          onActivate={() => onActivateFile?.(item.id)}
+          onClose={() => onCloseFile?.(item.id)}
+          onCloseOthers={() => onCloseOthers(item.id)}
+          onCloseToRight={() => onCloseToRight(item.id)}
+          onCloseToLeft={() => onCloseToLeft(item.id)}
+          onCloseAll={() => onCloseAllFiles?.()}
+          onMakePermanent={() => {}}
+          onTogglePin={() => togglePinned(item)}
+          dragData={dragData}
+          dropIndicator={dropIndicatorByVisibleId.get(item.id) ?? null}
+          includeTopTabBorder={includeTopTabBorder}
+        />
+      )
+    }
+    return (
+      <EditorFileTab
+        key={item.id}
+        file={item.data}
+        isActive={
+          (activeTabType === 'editor' || activeTabType === 'simulator') && activeFileId === item.id
+        }
+        isPinned={item.isPinned}
+        hasTabsToRight={index < items.length - 1}
+        hasTabsToLeft={index > 0}
+        tabCount={items.length}
+        statusByRelativePath={statusByRelativePath}
+        onActivate={() => onActivateFile?.(item.id)}
+        onClose={() => onCloseFile?.(item.id)}
+        onCloseOthers={() => onCloseOthers(item.id)}
+        onCloseToRight={() => onCloseToRight(item.id)}
+        onCloseToLeft={() => onCloseToLeft(item.id)}
+        onCloseAll={() => onCloseAllFiles?.()}
+        onMakePermanent={() => onMakePreviewFilePermanent?.(item.data.id, item.data.tabId)}
+        onTogglePin={() => togglePinned(item)}
+        dragData={dragData}
+        dropIndicator={dropIndicatorByVisibleId.get(item.id) ?? null}
+        includeTopTabBorder={includeTopTabBorder}
+      />
+    )
+  })
+}
diff --git a/src/renderer/src/components/tab-bar/tab-bar-props.ts b/src/renderer/src/components/tab-bar/tab-bar-props.ts
new file mode 100644
index 00000000000..6f8d93ec0a7
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-bar-props.ts
@@ -0,0 +1,53 @@
+import type {
+  BrowserTab as BrowserTabState,
+  TerminalTab,
+  WorkspaceVisibleTabType
+} from '../../../../shared/types'
+import type { OpenFile } from '../../store/slices/editor'
+import type { HoveredTabInsertion } from '../tab-group/useTabDragSplit'
+import type { TabCreateEntryArgs } from './tab-create-entry-action'
+
+export type TabBarProps = {
+  tabs: (TerminalTab & { unifiedTabId?: string })[]
+  activeTabId: string | null
+  groupId?: string
+  worktreeId: string
+  expandedPaneByTabId: Record<string, boolean>
+  onActivate: (tabId: string) => void
+  onClose: (tabId: string) => void
+  onCloseOthers: (tabId: string) => void
+  onCloseToRight: (tabId: string) => void
+  onCloseToLeft: (tabId: string) => void
+  onNewTerminalTab: () => void
+  /** On Windows, opens a new terminal with a specific shell instead of the default. */
+  onNewTerminalWithShell?: (shell: string) => void
+  onNewBrowserTab: () => void
+  onNewSimulatorTab?: () => void
+  onOpenEntry?: (args: TabCreateEntryArgs) => Promise<void>
+  terminalOnly?: boolean
+  showAgentLaunchItems?: boolean
+  onNewFileTab?: () => void
+  onOpenFileTab?: () => void
+  newTabMenuOrder?: 'default' | 'markdown-first'
+  onSetCustomTitle: (tabId: string, title: string | null) => void
+  onSetTabColor: (tabId: string, color: string | null) => void
+  onTogglePaneExpand: (tabId: string) => void
+  editorFiles?: (OpenFile & { tabId?: string })[]
+  browserTabs?: (BrowserTabState & { tabId?: string })[]
+  activeFileId?: string | null
+  activeBrowserTabId?: string | null
+  activeSimulatorTabId?: string | null
+  activeTabType?: WorkspaceVisibleTabType
+  onActivateFile?: (fileId: string) => void
+  onCloseFile?: (fileId: string) => void
+  onActivateBrowserTab?: (tabId: string) => void
+  onCloseBrowserTab?: (tabId: string) => void
+  onDuplicateBrowserTab?: (tabId: string) => void
+  onCloseAllFiles?: () => void
+  onMakePreviewFilePermanent?: (fileId: string, tabId?: string) => void
+  onPinFile?: (fileId: string, tabId?: string) => void
+  tabBarOrder?: string[]
+  hoveredTabInsertion?: HoveredTabInsertion | null
+  /** Floating workspace panels are rounded; skip tab top borders that clash with the curve. */
+  tabStripChrome?: 'default' | 'floating-panel'
+}
diff --git a/src/renderer/src/components/tab-bar/tab-bar-static-create-menu.tsx b/src/renderer/src/components/tab-bar/tab-bar-static-create-menu.tsx
new file mode 100644
index 00000000000..9a7a19a9186
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-bar-static-create-menu.tsx
@@ -0,0 +1,200 @@
+import React from 'react'
+import { FilePlus, FileText, Globe, Smartphone, TerminalSquare } from 'lucide-react'
+import { translate } from '@/i18n/i18n'
+import { DropdownMenuItem, DropdownMenuShortcut } from '@/components/ui/dropdown-menu'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { MobileEmulatorTabIntroCallout } from '../emulator-pane/MobileEmulatorTabIntroCallout'
+import { ShellIcon } from './shell-icons'
+import type { WindowsShellMenuEntry } from './tab-bar-windows-shell-options'
+import {
+  isMacOs,
+  type resolveWindowsPowerShellImplementationSetting
+} from './use-tab-bar-runtime-model'
+import type { TabBarProps } from './tab-bar-props'
+import { resolveWindowsShellLaunchTarget } from './windows-shell-launch'
+
+export function renderTabBarStaticCreateMenu({
+  terminalOnly,
+  mobileEmulatorEnabled,
+  managedBrowserCreationEnabled,
+  mobileEmulatorCreationEnabled,
+  workspaceHasSimulatorTab,
+  showMobileEmulatorIntroCallout,
+  props,
+  windowsShellEntries,
+  defaultWindowsPowerShellImplementation,
+  pwshAvailable,
+  newTerminalShortcut,
+  newBrowserShortcut,
+  newSimulatorShortcut,
+  newFileShortcut,
+  openMarkdownShortcut,
+  queueNewActiveTerminalFocusAfterNewTabMenuClose
+}: {
+  props: TabBarProps
+  terminalOnly: boolean
+  mobileEmulatorEnabled: boolean
+  managedBrowserCreationEnabled: boolean
+  mobileEmulatorCreationEnabled: boolean
+  workspaceHasSimulatorTab: boolean
+  showMobileEmulatorIntroCallout: boolean
+  windowsShellEntries: WindowsShellMenuEntry[] | undefined
+  defaultWindowsPowerShellImplementation: ReturnType<
+    typeof resolveWindowsPowerShellImplementationSetting
+  >
+  pwshAvailable: boolean
+  newTerminalShortcut: string
+  newBrowserShortcut: string
+  newSimulatorShortcut: string
+  newFileShortcut: string
+  openMarkdownShortcut: string | null
+  queueNewActiveTerminalFocusAfterNewTabMenuClose: () => void
+}): React.ReactNode {
+  const {
+    newTabMenuOrder = 'default',
+    onNewTerminalTab,
+    onNewTerminalWithShell,
+    onNewBrowserTab,
+    onNewSimulatorTab,
+    onNewFileTab,
+    onOpenFileTab
+  } = props
+  const defaultTerminalMenuItems =
+    windowsShellEntries && onNewTerminalWithShell ? (
+      windowsShellEntries.map((entry, index) => {
+        const isDefault = index === 0
+        return (
+          <DropdownMenuItem
+            key={entry.shell}
+            onSelect={() => {
+              // Why: menu models shell categories not executables; preserve the user's chosen PowerShell 7+ over inbox powershell.exe.
+              queueNewActiveTerminalFocusAfterNewTabMenuClose()
+              onNewTerminalWithShell(
+                resolveWindowsShellLaunchTarget(
+                  entry.shell,
+                  defaultWindowsPowerShellImplementation,
+                  pwshAvailable
+                )
+              )
+            }}
+            className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
+          >
+            <ShellIcon shell={entry.shell} size={14} />
+            <span className="flex-1">
+              {translate('auto.components.tab.bar.TabBar.7c1313d237', 'New Terminal:')}{' '}
+              {entry.label}
+            </span>
+            {isDefault ? <DropdownMenuShortcut>{newTerminalShortcut}</DropdownMenuShortcut> : null}
+          </DropdownMenuItem>
+        )
+      })
+    ) : (
+      <DropdownMenuItem
+        onSelect={() => {
+          queueNewActiveTerminalFocusAfterNewTabMenuClose()
+          onNewTerminalTab()
+        }}
+        className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
+      >
+        <TerminalSquare className="size-4 text-muted-foreground" />
+        {translate('auto.components.tab.bar.TabBar.d364f3c8d4', 'New Terminal')}
+        <DropdownMenuShortcut>{newTerminalShortcut}</DropdownMenuShortcut>
+      </DropdownMenuItem>
+    )
+  const newBrowserMenuItem =
+    !terminalOnly && managedBrowserCreationEnabled ? (
+      <DropdownMenuItem
+        onSelect={onNewBrowserTab}
+        className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
+      >
+        <Globe className="size-4 text-muted-foreground" />
+        {translate('auto.components.tab.bar.TabBar.4833fb2cbe', 'New Browser Tab')}
+        <DropdownMenuShortcut>{newBrowserShortcut}</DropdownMenuShortcut>
+      </DropdownMenuItem>
+    ) : null
+  const newSimulatorMenuItem =
+    !terminalOnly && mobileEmulatorEnabled && mobileEmulatorCreationEnabled && onNewSimulatorTab ? (
+      workspaceHasSimulatorTab ? (
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <DropdownMenuItem
+              onSelect={onNewSimulatorTab}
+              className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
+            >
+              <Smartphone className="size-4 text-muted-foreground" />
+              {translate('auto.components.tab.bar.TabBar.b426bb2615', 'Go to Mobile Emulator')}
+              <DropdownMenuShortcut>{newSimulatorShortcut}</DropdownMenuShortcut>
+            </DropdownMenuItem>
+          </TooltipTrigger>
+          <TooltipContent side="right" sideOffset={8} className="z-[80]">
+            {translate(
+              'auto.components.tab.bar.TabBar.aea43b5748',
+              'Open the existing emulator tab.'
+            )}
+          </TooltipContent>
+        </Tooltip>
+      ) : (
+        <DropdownMenuItem
+          onSelect={onNewSimulatorTab}
+          className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
+        >
+          <Smartphone className="size-4 text-muted-foreground" />
+          {translate('auto.components.tab.bar.TabBar.fd2b42aaa3', 'New Mobile Emulator')}
+          <DropdownMenuShortcut>{newSimulatorShortcut}</DropdownMenuShortcut>
+        </DropdownMenuItem>
+      )
+    ) : null
+  const newMarkdownMenuItem =
+    !terminalOnly && onNewFileTab ? (
+      <DropdownMenuItem
+        onSelect={onNewFileTab}
+        className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
+      >
+        <FilePlus className="size-4 text-muted-foreground" />
+        {translate('auto.components.tab.bar.TabBar.3d5d6c960d', 'New Markdown')}
+        <DropdownMenuShortcut>{newFileShortcut}</DropdownMenuShortcut>
+      </DropdownMenuItem>
+    ) : null
+  const openMarkdownMenuItem =
+    !terminalOnly && onOpenFileTab ? (
+      <DropdownMenuItem
+        onSelect={onOpenFileTab}
+        className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
+      >
+        <FileText className="size-4 text-muted-foreground" />
+        {translate('auto.components.tab.bar.TabBar.4f327c8b3d', 'Open Markdown...')}
+        {openMarkdownShortcut ? (
+          <DropdownMenuShortcut>{openMarkdownShortcut}</DropdownMenuShortcut>
+        ) : null}
+      </DropdownMenuItem>
+    ) : null
+  const mobileEmulatorIntroMenuBlock =
+    showMobileEmulatorIntroCallout &&
+    !terminalOnly &&
+    isMacOs &&
+    mobileEmulatorEnabled &&
+    mobileEmulatorCreationEnabled &&
+    onNewSimulatorTab ? (
+      <MobileEmulatorTabIntroCallout />
+    ) : null
+
+  return newTabMenuOrder === 'markdown-first' ? (
+    <>
+      {newMarkdownMenuItem}
+      {openMarkdownMenuItem}
+      {defaultTerminalMenuItems}
+      {newBrowserMenuItem}
+      {newSimulatorMenuItem}
+      {mobileEmulatorIntroMenuBlock}
+    </>
+  ) : (
+    <>
+      {defaultTerminalMenuItems}
+      {newBrowserMenuItem}
+      {newMarkdownMenuItem}
+      {openMarkdownMenuItem}
+      {newSimulatorMenuItem}
+      {mobileEmulatorIntroMenuBlock}
+    </>
+  )
+}
diff --git a/src/renderer/src/components/tab-bar/tab-bar-surface.tsx b/src/renderer/src/components/tab-bar/tab-bar-surface.tsx
new file mode 100644
index 00000000000..6e1c49ddc94
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-bar-surface.tsx
@@ -0,0 +1,260 @@
+import React from 'react'
+import { SortableContext } from '@dnd-kit/sortable'
+import { ChevronLeft, ChevronRight, Plus } from 'lucide-react'
+import { translate } from '@/i18n/i18n'
+import { Button } from '@/components/ui/button'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger
+} from '@/components/ui/dropdown-menu'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { QuickLaunchAgentMenuItems } from './QuickLaunchButton'
+import TabBarCreateEntry from './TabBarCreateEntry'
+import { TabStripScrollIndicator } from './TabStripScrollIndicator'
+import { getTabStripScrollMaskClassName } from './tab-strip-scroll-metrics'
+import type { useTabStripOverflowNavigation } from './tab-strip-overflow-navigation'
+import type { useTabStripDragScrollHandlers } from './tab-strip-drag-scroll'
+import type { TabBarProps } from './tab-bar-props'
+import type { TabBarRuntimeModel } from './use-tab-bar-runtime-model'
+import type { TabBarCreateMenuController } from './use-tab-bar-create-menu-controller'
+import type { TabBarItemProjection } from './use-tab-bar-item-projection'
+import type { TabBarItem } from './tab-bar-item-model'
+import { renderTabBarItems } from './tab-bar-item-surface'
+import { renderTabBarStaticCreateMenu } from './tab-bar-static-create-menu'
+
+export function renderTabBarSurface({
+  props,
+  runtime,
+  createMenu,
+  itemProjection,
+  tabStripNavigation,
+  tabStripDragScroll,
+  togglePinned
+}: {
+  props: TabBarProps
+  runtime: TabBarRuntimeModel
+  createMenu: TabBarCreateMenuController
+  itemProjection: TabBarItemProjection
+  tabStripNavigation: ReturnType<typeof useTabStripOverflowNavigation>
+  tabStripDragScroll: ReturnType<typeof useTabStripDragScrollHandlers>
+  togglePinned: (item: TabBarItem) => void
+}): React.JSX.Element {
+  const {
+    worktreeId,
+    terminalOnly = false,
+    showAgentLaunchItems = true,
+    onNewTerminalTab,
+    onOpenEntry,
+    tabStripChrome = 'default'
+  } = props
+  const {
+    resolvedGroupId,
+    mobileEmulatorEnabled,
+    managedBrowserCreationEnabled,
+    mobileEmulatorCreationEnabled,
+    workspaceHasSimulatorTab,
+    showMobileEmulatorIntroCallout,
+    windowsTerminalCapabilities,
+    defaultWindowsPowerShellImplementation,
+    agentLaunchOptions,
+    newTerminalShortcut,
+    newBrowserShortcut,
+    newSimulatorShortcut,
+    newFileShortcut,
+    openMarkdownShortcut
+  } = runtime
+  const {
+    newTabMenuOpen,
+    setNewTabMenuOpen,
+    setCreateMenuQuery,
+    createMenuOptions,
+    windowsShellEntries,
+    handleSelectCreateMenuOption,
+    launchAgentFromNewTabEntry,
+    runPendingNewTabMenuFocusAfterClose,
+    clearPendingNewTabMenuFocusOnUnmount,
+    queueNewActiveTerminalFocusAfterNewTabMenuClose,
+    queueTerminalTabFocusAfterNewTabMenuClose,
+    queueFocusAfterNewTabMenuClose,
+    showStaticCreateMenuItems
+  } = createMenu
+  const { orderedItems, sortableIds, dropIndicatorByVisibleId } = itemProjection
+  const { tabStripRef, tabStripOverflowState, scrollTabStrip } = tabStripNavigation
+  const includeTopTabBorder = tabStripChrome !== 'floating-panel'
+  const renderedItems = renderTabBarItems({
+    items: orderedItems,
+    props,
+    runtime,
+    dropIndicatorByVisibleId,
+    includeTopTabBorder,
+    togglePinned
+  })
+  const standardCreateMenuItems = renderTabBarStaticCreateMenu({
+    props,
+    terminalOnly,
+    mobileEmulatorEnabled,
+    managedBrowserCreationEnabled,
+    mobileEmulatorCreationEnabled,
+    workspaceHasSimulatorTab,
+    showMobileEmulatorIntroCallout,
+    windowsShellEntries,
+    defaultWindowsPowerShellImplementation,
+    pwshAvailable: windowsTerminalCapabilities.pwshAvailable,
+    newTerminalShortcut,
+    newBrowserShortcut,
+    newSimulatorShortcut,
+    newFileShortcut,
+    openMarkdownShortcut,
+    queueNewActiveTerminalFocusAfterNewTabMenuClose
+  })
+
+  return (
+    <div
+      ref={clearPendingNewTabMenuFocusOnUnmount}
+      className="flex items-stretch h-full overflow-hidden flex-1 min-w-0"
+      // Why: preload routes native OS drops by this marker — only the tab strip opens files in the editor, not terminal panes.
+      data-native-file-drop-target="editor"
+    >
+      {tabStripOverflowState.hasOverflow ? (
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <Button
+              variant="ghost"
+              size="icon-xs"
+              className="mx-0.5 my-auto h-6 w-5 text-muted-foreground hover:bg-accent/50 hover:text-foreground disabled:opacity-35"
+              style={{ WebkitAppRegion: 'no-drag' } as React.CSSProperties}
+              aria-label={translate(
+                'auto.components.tab.bar.TabBar.7a9b4af2af',
+                'Scroll tabs left'
+              )}
+              aria-disabled={!tabStripOverflowState.canScrollStart}
+              disabled={
+                !tabStripDragScroll.isTabDragActive && !tabStripOverflowState.canScrollStart
+              }
+              onClick={() => scrollTabStrip('start')}
+              onPointerEnter={tabStripDragScroll.onDragScrollStartEnter}
+              onPointerLeave={tabStripDragScroll.onDragScrollLeave}
+            >
+              <ChevronLeft className="size-3.5" />
+            </Button>
+          </TooltipTrigger>
+          <TooltipContent side="bottom" sideOffset={6}>
+            {translate('auto.components.tab.bar.TabBar.7a9b4af2af', 'Scroll tabs left')}
+          </TooltipContent>
+        </Tooltip>
+      ) : null}
+      {/* Why: no strategy stops dnd-kit animating siblings, so tabs stay anchored during drag; only the insertion bar moves. */}
+      <SortableContext items={sortableIds}>
+        {/* Why: no-drag lets tab interactions work inside the titlebar's drag region (outer container stays window-draggable). */}
+        <div
+          className="relative flex min-h-0 min-w-0 max-w-full flex-[0_1_auto]"
+          style={{ WebkitAppRegion: 'no-drag' } as React.CSSProperties}
+        >
+          <div
+            ref={tabStripRef}
+            // Why: only `border-r` here — a strip-level `border-l` would render a heavier L-corner than the first tab's own `border-l`.
+            className={[
+              'terminal-tab-strip flex h-full min-w-0 max-w-full flex-1 items-stretch overflow-x-auto overflow-y-hidden border-r border-border/70',
+              getTabStripScrollMaskClassName(tabStripOverflowState)
+            ]
+              .filter(Boolean)
+              .join(' ')}
+          >
+            {renderedItems}
+          </div>
+          <TabStripScrollIndicator metrics={tabStripOverflowState} />
+        </div>
+      </SortableContext>
+      {tabStripOverflowState.hasOverflow ? (
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <Button
+              variant="ghost"
+              size="icon-xs"
+              className="mx-0.5 my-auto h-6 w-5 text-muted-foreground hover:bg-accent/50 hover:text-foreground disabled:opacity-35"
+              style={{ WebkitAppRegion: 'no-drag' } as React.CSSProperties}
+              aria-label={translate(
+                'auto.components.tab.bar.TabBar.232e075b07',
+                'Scroll tabs right'
+              )}
+              aria-disabled={!tabStripOverflowState.canScrollEnd}
+              disabled={!tabStripDragScroll.isTabDragActive && !tabStripOverflowState.canScrollEnd}
+              onClick={() => scrollTabStrip('end')}
+              onPointerEnter={tabStripDragScroll.onDragScrollEndEnter}
+              onPointerLeave={tabStripDragScroll.onDragScrollLeave}
+            >
+              <ChevronRight className="size-3.5" />
+            </Button>
+          </TooltipTrigger>
+          <TooltipContent side="bottom" sideOffset={6}>
+            {translate('auto.components.tab.bar.TabBar.232e075b07', 'Scroll tabs right')}
+          </TooltipContent>
+        </Tooltip>
+      ) : null}
+      <DropdownMenu
+        open={newTabMenuOpen}
+        onOpenChange={setNewTabMenuOpen}
+        // Why: modal would disable body pointer events, making the Mobile Emulator "Hide" re-enable toast unclickable.
+        modal={false}
+      >
+        <DropdownMenuTrigger asChild>
+          <button
+            className="ml-2 my-auto flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-muted-foreground hover:bg-accent/50 hover:text-foreground"
+            style={{ WebkitAppRegion: 'no-drag' } as React.CSSProperties}
+            title={translate('auto.components.tab.bar.TabBar.b1a132357f', 'New tab')}
+            // Why: aria-label matches the tooltip so E2E can locate the "+" via getByRole('button', { name: 'New tab' }).
+            aria-label={translate('auto.components.tab.bar.TabBar.b1a132357f', 'New tab')}
+          >
+            <Plus className="w-3.5 h-3.5" />
+          </button>
+        </DropdownMenuTrigger>
+        <DropdownMenuContent
+          align="start"
+          sideOffset={6}
+          className="w-72 max-w-[calc(100vw-1rem)] rounded-[11px] border-border/80 p-1 shadow-[0_16px_36px_rgba(0,0,0,0.24)]"
+          onCloseAutoFocus={(event) => {
+            // Why: Radix restores focus to the "+" trigger on close, stealing it from the freshly-mounted terminal.
+            event.preventDefault()
+            runPendingNewTabMenuFocusAfterClose()
+          }}
+        >
+          {!terminalOnly && onOpenEntry ? (
+            <>
+              <TabBarCreateEntry
+                worktreeId={worktreeId}
+                groupId={resolvedGroupId}
+                menuOpen={newTabMenuOpen}
+                menuOptions={createMenuOptions}
+                agentOptions={agentLaunchOptions}
+                onLaunchAgent={launchAgentFromNewTabEntry}
+                onOpenDefaultTerminal={() => {
+                  queueNewActiveTerminalFocusAfterNewTabMenuClose()
+                  onNewTerminalTab()
+                }}
+                onOpenEntry={onOpenEntry}
+                onQueryChange={setCreateMenuQuery}
+                onQueueSwitchFocus={queueFocusAfterNewTabMenuClose}
+                onSelectMenuOption={handleSelectCreateMenuOption}
+                onDidOpenEntry={() => setNewTabMenuOpen(false)}
+              />
+              {showStaticCreateMenuItems ? <DropdownMenuSeparator /> : null}
+            </>
+          ) : null}
+          {showStaticCreateMenuItems ? standardCreateMenuItems : null}
+          {showStaticCreateMenuItems && showAgentLaunchItems ? (
+            <>
+              <DropdownMenuSeparator />
+              <QuickLaunchAgentMenuItems
+                worktreeId={worktreeId}
+                groupId={resolvedGroupId}
+                onFocusTerminal={queueTerminalTabFocusAfterNewTabMenuClose}
+              />
+            </>
+          ) : null}
+        </DropdownMenuContent>
+      </DropdownMenu>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/tab-bar/tab-bar-windows-shell-options.ts b/src/renderer/src/components/tab-bar/tab-bar-windows-shell-options.ts
new file mode 100644
index 00000000000..b691359d1b4
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-bar-windows-shell-options.ts
@@ -0,0 +1,64 @@
+import type { BuiltInWindowsTerminalShell } from '../../../../shared/windows-terminal-shell'
+import { WINDOWS_GIT_BASH_SHELL } from '../../../../shared/windows-terminal-shell'
+import { translate } from '@/i18n/i18n'
+import type { getProjectRuntimeShellMenuMode } from './use-tab-bar-runtime-model'
+
+export type WindowsShellMenuEntry = {
+  label: string
+  shell: BuiltInWindowsTerminalShell
+}
+
+export function buildWindowsShellMenuEntries({
+  showWindowsShellMenu,
+  hasShellLauncher,
+  projectRuntimeShellMenuMode,
+  defaultWindowsShell,
+  gitBashAvailable,
+  wslAvailable
+}: {
+  showWindowsShellMenu: boolean
+  hasShellLauncher: boolean
+  projectRuntimeShellMenuMode: ReturnType<typeof getProjectRuntimeShellMenuMode>
+  defaultWindowsShell: string
+  gitBashAvailable: boolean
+  wslAvailable: boolean
+}): WindowsShellMenuEntry[] | undefined {
+  if (!showWindowsShellMenu || !hasShellLauncher) {
+    return undefined
+  }
+  const includeHostShells = projectRuntimeShellMenuMode !== 'wsl'
+  const includeWslShell = projectRuntimeShellMenuMode !== 'host'
+  const allShells: WindowsShellMenuEntry[] = []
+  if (includeHostShells) {
+    allShells.push(
+      {
+        label: translate('auto.components.tab.bar.TabBar.2148f65e04', 'PowerShell'),
+        shell: 'powershell.exe'
+      },
+      {
+        label: translate('auto.components.tab.bar.TabBar.1a8af49530', 'CMD Prompt'),
+        shell: 'cmd.exe'
+      }
+    )
+    if (gitBashAvailable) {
+      allShells.push({
+        label: translate('auto.components.tab.bar.TabBar.efb33546ff', 'Git Bash'),
+        shell: WINDOWS_GIT_BASH_SHELL
+      })
+    }
+  }
+  if (includeWslShell && wslAvailable) {
+    allShells.push({
+      label: translate('auto.components.tab.bar.TabBar.d1afac112b', 'WSL'),
+      shell: 'wsl.exe'
+    })
+  }
+  if (allShells.length === 0) {
+    return undefined
+  }
+  const defaultEntry =
+    allShells.find((shell) => shell.shell === defaultWindowsShell) ?? allShells[0]
+  return [defaultEntry, ...allShells.filter((shell) => shell.shell !== defaultEntry.shell)].map(
+    (entry) => ({ label: entry.label, shell: entry.shell })
+  )
+}
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-action.test.ts b/src/renderer/src/components/tab-bar/tab-create-entry-action.test.ts
index 7807ccc7e44..880bb561db4 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-action.test.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-action.test.ts
@@ -10,10 +10,8 @@ const readyFiles = (files: string[]) => ({ files, loading: false, loadError: nul
 describe('openTabEntryWithOperations', () => {
   function makeOperations(overrides: Partial<TabEntryOperations> = {}): TabEntryOperations {
     return {
-      createBrowserTab: vi.fn() as TabEntryOperations['createBrowserTab'],
       createRuntimePath: vi.fn().mockResolvedValue(undefined),
-      createWebRuntimeSessionBrowserTab: vi.fn().mockResolvedValue(true),
-      isWebRuntimeSessionActive: vi.fn().mockReturnValue(false),
+      openWorkspaceBrowserTab: vi.fn().mockResolvedValue(undefined),
       openFile: vi.fn(),
       statRuntimePath: vi.fn().mockResolvedValue({ size: 1, isDirectory: false, mtime: 1 }),
       authorizeExternalPath: vi.fn().mockResolvedValue(undefined),
@@ -32,9 +30,9 @@ describe('openTabEntryWithOperations', () => {
       worktreeId: 'wt-1',
       worktreePath: '/repo'
     },
-    activeRuntimeEnvironmentId: null,
     allowAbsolutePaths: true,
-    localPlatform: 'posix' as const
+    localPlatform: 'posix' as const,
+    searchEngine: 'google' as const
   }
 
   it('stats existing files before opening and rejects directories', async () => {
@@ -182,51 +180,77 @@ describe('openTabEntryWithOperations', () => {
     expect(operations.openFile).toHaveBeenCalled()
   })
 
-  it('routes paired runtime browser creation through the web session API', async () => {
-    const operations = makeOperations({
-      isWebRuntimeSessionActive: vi.fn().mockReturnValue(true)
-    })
+  it('routes URL classifications through the workspace browser opener', async () => {
+    const operations = makeOperations()
 
     await openTabEntryWithOperations({
       ...baseArgs,
       query: 'https://example.com',
-      activeRuntimeEnvironmentId: 'runtime-1',
       operations
     })
 
-    expect(operations.createWebRuntimeSessionBrowserTab).toHaveBeenCalledWith({
-      worktreeId: 'wt-1',
-      environmentId: 'runtime-1',
+    expect(operations.openWorkspaceBrowserTab).toHaveBeenCalledWith({
+      workspaceId: 'wt-1',
       url: 'https://example.com/',
-      targetGroupId: 'group-1'
+      targetGroupId: 'group-1',
+      intent: { kind: 'url' }
     })
-    expect(operations.createBrowserTab).not.toHaveBeenCalled()
   })
 
-  it('falls back to a local browser tab when paired runtime browser creation fails', async () => {
-    const operations = makeOperations({
-      createWebRuntimeSessionBrowserTab: vi.fn().mockResolvedValue(false),
-      isWebRuntimeSessionActive: vi.fn().mockReturnValue(true)
-    })
+  it('builds a search URL from the selected immutable classification', async () => {
+    const operations = makeOperations()
 
     await openTabEntryWithOperations({
       ...baseArgs,
-      query: 'https://example.com',
-      activeRuntimeEnvironmentId: 'runtime-1',
+      query: 'different query',
+      classification: { kind: 'search', engine: 'duckduckgo', query: 'react hooks' },
       operations
     })
 
-    expect(operations.createWebRuntimeSessionBrowserTab).toHaveBeenCalledWith({
-      worktreeId: 'wt-1',
-      environmentId: 'runtime-1',
-      url: 'https://example.com/',
-      targetGroupId: 'group-1'
-    })
-    expect(operations.createBrowserTab).toHaveBeenCalledWith('wt-1', 'https://example.com/', {
-      activate: true,
-      browserRuntimeEnvironmentId: null,
+    expect(operations.openWorkspaceBrowserTab).toHaveBeenCalledWith({
+      workspaceId: 'wt-1',
+      url: 'https://duckduckgo.com/?q=react%20hooks',
       targetGroupId: 'group-1',
-      title: 'https://example.com/'
+      intent: { kind: 'search', engine: 'duckduckgo' }
+    })
+  })
+
+  it('uses plain Kagi search URLs and the fallback classifier engine', async () => {
+    const operations = makeOperations()
+
+    await openTabEntryWithOperations({
+      ...baseArgs,
+      query: 'private project',
+      searchEngine: 'kagi',
+      operations
+    })
+
+    expect(operations.openWorkspaceBrowserTab).toHaveBeenCalledWith({
+      workspaceId: 'wt-1',
+      url: 'https://kagi.com/search?q=private%20project',
+      targetGroupId: 'group-1',
+      intent: { kind: 'search', engine: 'kagi' }
+    })
+  })
+
+  it('uses a configured Kagi private-session link', async () => {
+    const operations = makeOperations()
+
+    await openTabEntryWithOperations({
+      ...baseArgs,
+      query: 'private project',
+      searchEngine: 'kagi',
+      searchUrlOptions: {
+        kagiSessionLink: 'https://kagi.com/search?token=secret'
+      },
+      operations
+    })
+
+    expect(operations.openWorkspaceBrowserTab).toHaveBeenCalledWith({
+      workspaceId: 'wt-1',
+      url: 'https://kagi.com/search?token=secret&q=private+project',
+      targetGroupId: 'group-1',
+      intent: { kind: 'search', engine: 'kagi' }
     })
   })
 
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-action.ts b/src/renderer/src/components/tab-bar/tab-create-entry-action.ts
index b01f6ac8db6..6c7ec6bbdb5 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-action.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-action.ts
@@ -6,14 +6,19 @@ import {
   statRuntimePath,
   type RuntimeFileOperationArgs
 } from '@/runtime/runtime-file-client'
-import {
-  createWebRuntimeSessionBrowserTab,
-  isWebRuntimeSessionActive
-} from '@/runtime/web-runtime-session'
 import { useAppStore } from '@/store'
 import type { OpenFile } from '@/store/slices/editor'
-import type { BrowserTab as BrowserTabState } from '../../../../shared/types'
+import {
+  buildSearchUrl,
+  DEFAULT_SEARCH_ENGINE,
+  type SearchEngine,
+  type SearchUrlOptions
+} from '../../../../shared/browser-url'
 import type { RuntimeFileListState } from '../quick-open-file-list'
+import {
+  openWorkspaceBrowserTab,
+  type OpenWorkspaceBrowserTabRequest
+} from '@/lib/workspace-browser-tab-open'
 import {
   classifyTabEntryQuery,
   TAB_ENTRY_ABSOLUTE_PATH_REMOTE_BLOCKED_MESSAGE,
@@ -54,19 +59,8 @@ export type TabCreateEntryArgs = {
 }
 
 export type TabEntryOperations = {
-  createBrowserTab: (
-    worktreeId: string,
-    url: string,
-    options?: {
-      activate?: boolean
-      browserRuntimeEnvironmentId?: string | null
-      targetGroupId?: string
-      title?: string
-    }
-  ) => BrowserTabState
   createRuntimePath: typeof createRuntimePath
-  createWebRuntimeSessionBrowserTab: typeof createWebRuntimeSessionBrowserTab
-  isWebRuntimeSessionActive: typeof isWebRuntimeSessionActive
+  openWorkspaceBrowserTab: typeof openWorkspaceBrowserTab
   openFile: (
     file: Omit<OpenFile, 'id' | 'isDirty'>,
     options?: { preview?: boolean; targetGroupId?: string }
@@ -83,9 +77,10 @@ type OpenTabEntryWithOperationsArgs = {
   groupId: string
   worktreePath: string
   runtimeContext: RuntimeFileOperationArgs
-  activeRuntimeEnvironmentId: string | null
   allowAbsolutePaths: boolean
   localPlatform: TabEntryLocalPlatform
+  searchEngine: SearchEngine
+  searchUrlOptions?: SearchUrlOptions
   classification?: TabEntryActionClassification
   operations: TabEntryOperations
 }
@@ -152,8 +147,38 @@ async function openExistingFile(args: {
   )
 }
 
+type NetworkTabEntryClassification = Extract<
+  TabEntryActionClassification,
+  { kind: 'explicit-url' | 'host-url' | 'search' }
+>
+
+function isNetworkTabEntry(
+  classification: TabEntryActionClassification
+): classification is NetworkTabEntryClassification {
+  return (
+    classification.kind === 'explicit-url' ||
+    classification.kind === 'host-url' ||
+    classification.kind === 'search'
+  )
+}
+
+function getNetworkTabRequest(
+  classification: NetworkTabEntryClassification,
+  { worktreeId, groupId }: Pick<TabCreateEntryArgs, 'worktreeId' | 'groupId'>,
+  searchUrlOptions?: SearchUrlOptions
+): OpenWorkspaceBrowserTabRequest {
+  const target = { workspaceId: worktreeId, targetGroupId: groupId }
+  if (classification.kind === 'search') {
+    return {
+      ...target,
+      url: buildSearchUrl(classification.query, classification.engine, searchUrlOptions),
+      intent: { kind: 'search', engine: classification.engine }
+    }
+  }
+  return { ...target, url: classification.url, intent: { kind: 'url' } }
+}
+
 export async function openTabEntryWithOperations({
-  activeRuntimeEnvironmentId,
   allowAbsolutePaths,
   classification: selectedClassification,
   fileList,
@@ -162,43 +187,22 @@ export async function openTabEntryWithOperations({
   operations,
   query,
   runtimeContext,
+  searchEngine,
+  searchUrlOptions,
   worktreeId,
   worktreePath
 }: OpenTabEntryWithOperationsArgs): Promise<void> {
-  const entryContext: TabEntryOptionsContext = { allowAbsolutePaths, localPlatform }
+  const entryContext: TabEntryOptionsContext = { allowAbsolutePaths, localPlatform, searchEngine }
   const classification =
     selectedClassification ?? classifyTabEntryQuery(query, fileList, entryContext)
   if (classification.kind === 'empty' || classification.kind === 'blocked') {
     throw new Error(classification.message)
   }
 
-  if (classification.kind === 'explicit-url' || classification.kind === 'host-url') {
-    const runtimeSessionActive = operations.isWebRuntimeSessionActive(activeRuntimeEnvironmentId)
-    if (runtimeSessionActive) {
-      const created = await operations.createWebRuntimeSessionBrowserTab({
-        worktreeId,
-        environmentId: activeRuntimeEnvironmentId,
-        url: classification.url,
-        targetGroupId: groupId
-      })
-      if (created) {
-        return
-      }
-      // Why: headless remote runtimes cannot host browser panes yet; a URL open
-      // should still give the user a usable client-local browser tab.
-      operations.createBrowserTab(worktreeId, classification.url, {
-        activate: true,
-        browserRuntimeEnvironmentId: null,
-        targetGroupId: groupId,
-        title: classification.url
-      })
-    } else {
-      operations.createBrowserTab(worktreeId, classification.url, {
-        activate: true,
-        targetGroupId: groupId,
-        title: classification.url
-      })
-    }
+  if (isNetworkTabEntry(classification)) {
+    await operations.openWorkspaceBrowserTab(
+      getNetworkTabRequest(classification, { worktreeId, groupId }, searchUrlOptions)
+    )
     return
   }
 
@@ -256,6 +260,12 @@ export async function openTabEntryWithOperations({
 
 export async function openTabBarEntry(args: TabCreateEntryArgs): Promise<void> {
   const state = useAppStore.getState()
+  const searchUrlOptions = { kagiSessionLink: state.browserKagiSessionLink }
+  if (args.classification && isNetworkTabEntry(args.classification)) {
+    await openWorkspaceBrowserTab(getNetworkTabRequest(args.classification, args, searchUrlOptions))
+    return
+  }
+  const searchEngine = state.browserDefaultSearchEngine ?? DEFAULT_SEARCH_ENGINE
   const worktree = state.getKnownWorktreeById(args.worktreeId)
   if (!worktree) {
     throw new Error('No active worktree.')
@@ -270,15 +280,14 @@ export async function openTabBarEntry(args: TabCreateEntryArgs): Promise<void> {
     groupId: args.groupId,
     worktreePath: worktree.path,
     runtimeContext,
-    activeRuntimeEnvironmentId: runtimeContext.settings?.activeRuntimeEnvironmentId?.trim() ?? null,
     allowAbsolutePaths,
     localPlatform,
+    searchEngine,
+    searchUrlOptions,
     classification: args.classification,
     operations: {
-      createBrowserTab: state.createBrowserTab,
       createRuntimePath,
-      createWebRuntimeSessionBrowserTab,
-      isWebRuntimeSessionActive,
+      openWorkspaceBrowserTab,
       openFile: state.openFile,
       statRuntimePath,
       authorizeExternalPath: window.api.fs.authorizeExternalPath,
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts
index 57708f00e8b..b93acba28aa 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts
@@ -70,6 +70,27 @@ describe('tab create entry classification', () => {
     }
   })
 
+  it('picks http for private IPv4 hosts and https for public ones', () => {
+    for (const input of ['192.168.1.5:5173', '10.0.0.2', '172.16.4.1:8080', '100.64.0.1']) {
+      expect(classifyTabEntryQuery(input, readyFiles([])), input).toMatchObject({
+        kind: 'host-url',
+        url: expect.stringMatching(/^http:\/\//)
+      })
+    }
+    for (const input of ['8.8.8.8', '1.1.1.1:8080']) {
+      expect(classifyTabEntryQuery(input, readyFiles([])), input).toMatchObject({
+        kind: 'host-url',
+        url: expect.stringMatching(/^https:\/\//)
+      })
+    }
+  })
+
+  it('blocks malformed bracketed IPv6 URL attempts', () => {
+    for (const input of ['[::1]:abc', '[::1]:99999', '[2001:db8::1]:nope/path']) {
+      expect(classifyTabEntryQuery(input, readyFiles([])), input).toMatchObject({ kind: 'blocked' })
+    }
+  })
+
   it('does not classify invalid numeric hosts as URLs', () => {
     expect(classifyTabEntryQuery('999.999.999.999', readyFiles([]))).toEqual({
       kind: 'new-file',
@@ -92,13 +113,10 @@ describe('tab create entry classification', () => {
     })
   })
 
-  it('blocks non-explicit URLs and file paths while list state is not ready', () => {
+  it('keeps safe URL actions available while the file list is not ready', () => {
     expect(
       classifyTabEntryQuery('example.com', { files: [], loading: true, loadError: null })
-    ).toEqual({
-      kind: 'blocked',
-      message: 'Loading files...'
-    })
+    ).toMatchObject({ kind: 'host-url', url: 'https://example.com/' })
     expect(
       classifyTabEntryQuery('https://example.com', { files: [], loading: true, loadError: null })
     ).toMatchObject({ kind: 'explicit-url' })
@@ -108,7 +126,7 @@ describe('tab create entry classification', () => {
         loading: false,
         loadError: 'scan failed'
       })
-    ).toEqual({ kind: 'blocked', message: 'scan failed' })
+    ).toMatchObject({ kind: 'host-url', url: 'https://example.com/' })
   })
 
   it('matches exact relative path before basename and fuzzy results', () => {
@@ -137,7 +155,8 @@ describe('tab create entry classification', () => {
       )
     ).toEqual([
       { kind: 'existing-file', matchKind: 'exact-basename', relativePath: 'src/index.ts' },
-      { kind: 'existing-file', matchKind: 'exact-basename', relativePath: 'docs/index.ts' }
+      { kind: 'existing-file', matchKind: 'exact-basename', relativePath: 'docs/index.ts' },
+      { kind: 'search', engine: 'google', query: 'index.ts' }
     ])
   })
 
@@ -148,10 +167,208 @@ describe('tab create entry classification', () => {
       )
     ).toEqual([
       { kind: 'new-file', relativePath: 'read.md' },
+      { kind: 'search', engine: 'google', query: 'read.md' },
       { kind: 'existing-file', matchKind: 'fuzzy', relativePath: 'README.md' }
     ])
   })
 
+  it('keeps single-token quick-open matches ahead of search, but not phrases', () => {
+    expect(
+      getTabEntryOptions('typescript', readyFiles(['docs/typescript-guide.md'])).map(
+        (option) => option.classification
+      )
+    ).toEqual([
+      {
+        kind: 'existing-file',
+        matchKind: 'fuzzy',
+        relativePath: 'docs/typescript-guide.md'
+      },
+      { kind: 'search', engine: 'google', query: 'typescript' },
+      { kind: 'new-file', relativePath: 'typescript' }
+    ])
+    expect(
+      getTabEntryOptions('type script', readyFiles(['docs/typescript-guide.md'])).map(
+        (option) => option.classification.kind
+      )
+    ).toEqual(['search', 'new-file'])
+  })
+
+  // Fuzzy matching is a subsequence scan, so a short token matches broadly.
+  it('keeps a search slot when fuzzy matches would fill the whole list', () => {
+    const files = [
+      'src/components/Button.tsx',
+      'src/lib/bootstrap-nav.ts',
+      'docs/build-notes.md',
+      'src/base/tone.ts',
+      'src/bin/tune.ts'
+    ]
+    expect(getTabEntryOptions('btn', readyFiles(files)).map((o) => o.classification.kind)).toEqual([
+      'existing-file',
+      'existing-file',
+      'existing-file',
+      'search'
+    ])
+    // A one-slot list still answers with the file, so Enter keeps quick-open.
+    expect(
+      getTabEntryOptions('btn', readyFiles(files), 1).map((o) => o.classification.kind)
+    ).toEqual(['existing-file'])
+  })
+
+  it('ranks search before ordinary create-file actions', () => {
+    expect(
+      getTabEntryOptions('typescript', readyFiles([])).map((option) => option.classification)
+    ).toEqual([
+      { kind: 'search', engine: 'google', query: 'typescript' },
+      { kind: 'new-file', relativePath: 'typescript' }
+    ])
+  })
+
+  it('keeps strong file syntax ahead of search without treating dotted phrases as files', () => {
+    expect(
+      getTabEntryOptions('README.md', readyFiles(['docs/README-old.md'])).map(
+        (option) => option.classification.kind
+      )
+    ).toEqual(['new-file', 'search', 'existing-file'])
+    for (const query of ['node.js tutorial', 'package.json docs', 'what is foo.bar']) {
+      expect(classifyTabEntryQuery(query, readyFiles([]))).toMatchObject({
+        kind: 'search',
+        query
+      })
+    }
+    for (const query of ['.env', '.gitignore']) {
+      expect(
+        getTabEntryOptions(query, readyFiles([])).map((option) => option.classification.kind)
+      ).toEqual(['new-file', 'search'])
+    }
+  })
+
+  it('searches natural-language colons while blocking explicit unsupported schemes', () => {
+    for (const query of ['error: cannot connect', 'node:fs docs', 'site:github.com react']) {
+      expect(classifyTabEntryQuery(query, readyFiles([]))).toMatchObject({ kind: 'search', query })
+    }
+    for (const query of ['ftp:example.com', 'ftp://example.com', 'custom:// bad input']) {
+      expect(classifyTabEntryQuery(query, readyFiles([]))).toMatchObject({ kind: 'blocked' })
+    }
+    expect(classifyTabEntryQuery('foo.ts:123', readyFiles([]))).toMatchObject({
+      kind: 'new-file',
+      relativePath: 'foo.ts:123'
+    })
+  })
+
+  it('blocks malformed explicit and host-like URLs unless an exact file exists', () => {
+    for (const query of ['https://', 'example.com:99999']) {
+      expect(classifyTabEntryQuery(query, readyFiles([]))).toMatchObject({ kind: 'blocked' })
+    }
+    expect(classifyTabEntryQuery('example.com:99999', readyFiles(['example.com:99999']))).toEqual({
+      kind: 'existing-file',
+      matchKind: 'exact-path',
+      relativePath: 'example.com:99999'
+    })
+  })
+
+  it('offers network actions alongside file-index status only when safe', () => {
+    const loading = { files: [], loading: true, loadError: null }
+    expect(
+      getTabEntryOptions('natural language', loading).map((option) => option.classification.kind)
+    ).toEqual(['search', 'blocked'])
+    expect(
+      getTabEntryOptions('example.com', loading).map((option) => option.classification.kind)
+    ).toEqual(['host-url', 'blocked'])
+    expect(
+      getTabEntryOptions('README.md', loading).map((option) => option.classification.kind)
+    ).toEqual(['blocked'])
+    expect(
+      getTabEntryOptions('example.com:99999', loading).map((option) => option.classification.kind)
+    ).toEqual(['blocked'])
+  })
+
+  it('keeps file matches for path prefixes that cannot be created', () => {
+    const files = ['src/main/index.ts', 'src/renderer/App.tsx']
+    // A trailing separator is an ordinary keystroke on the way to a nested path,
+    // so the matches it finds must survive the unusable-path verdict.
+    for (const query of ['src/', 'src/renderer/']) {
+      expect(
+        getTabEntryOptions(query, readyFiles(files)).map((option) => option.classification.kind),
+        query
+      ).toEqual(expect.arrayContaining(['existing-file']))
+    }
+    expect(getTabEntryOptions('src/', readyFiles([]))).toMatchObject([
+      { classification: { kind: 'blocked' } }
+    ])
+  })
+
+  it('reports the running scan for path-shaped text it cannot create yet', () => {
+    expect(
+      getTabEntryOptions('src/', { files: [], loading: true, loadError: null }).map(
+        (option) => option.id
+      )
+    ).toEqual(['loading'])
+  })
+
+  it('falls through to file and search actions for host-like text with a non-numeric port', () => {
+    expect(
+      getTabEntryOptions('docker.io:latest', readyFiles([])).map(
+        (option) => option.classification.kind
+      )
+    ).toEqual(['new-file', 'search'])
+    expect(
+      getTabEntryOptions('example.com:', readyFiles([])).map((option) => option.classification.kind)
+    ).toEqual(['new-file', 'search'])
+  })
+
+  it('never turns invalid paths into search actions', () => {
+    for (const query of ['../.env', 'foo//bar', 'foo/', 'C:relative.txt', 'src/\u0000file.ts']) {
+      expect(classifyTabEntryQuery(query, readyFiles([])), query).toMatchObject({ kind: 'blocked' })
+      expect(
+        classifyTabEntryQuery(query, { files: [], loading: true, loadError: null }),
+        query
+      ).toMatchObject({ kind: 'blocked' })
+    }
+  })
+
+  it('applies the action limit once and leaves index status outside it', () => {
+    expect(getTabEntryOptions('query', readyFiles([]), 0)).toEqual([])
+    expect(
+      getTabEntryOptions('query', { files: [], loading: true, loadError: null }, 0).map(
+        (option) => option.id
+      )
+    ).toEqual(['loading'])
+    expect(
+      getTabEntryOptions('query', readyFiles(['query.md']), 1).map(
+        (option) => option.classification.kind
+      )
+    ).toEqual(['existing-file'])
+    expect(
+      getTabEntryOptions('query text', readyFiles(['query.md']), 1).map(
+        (option) => option.classification.kind
+      )
+    ).toEqual(['search'])
+  })
+
+  it('forces search before URL, path, and file classification', () => {
+    for (const [input, expectedQuery] of [
+      ['?react hooks', 'react hooks'],
+      ['??foo', '?foo'],
+      ['?https://example.com', 'https://example.com'],
+      ['?/tmp/file.ts', '/tmp/file.ts']
+    ]) {
+      expect(classifyTabEntryQuery(input, readyFiles(['/tmp/file.ts']))).toEqual({
+        kind: 'search',
+        engine: 'google',
+        query: expectedQuery
+      })
+    }
+    expect(classifyTabEntryQuery('?', readyFiles([]))).toMatchObject({ kind: 'empty' })
+  })
+
+  it('retains the configured engine without building a URL', () => {
+    expect(classifyTabEntryQuery('search me', readyFiles([]), { searchEngine: 'kagi' })).toEqual({
+      kind: 'search',
+      engine: 'kagi',
+      query: 'search me'
+    })
+  })
+
   it('blocks oversized pasted file-entry queries before reading listed files', () => {
     const oversizedQuery = `src/${'secret-tab-create'.repeat(QUICK_OPEN_QUERY_MAX_BYTES)}.ts`
     const fileList = {
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.ts b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.ts
index 48983433ca2..a36ce7c8609 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.ts
@@ -1,7 +1,9 @@
-import { isQuickOpenQueryTooLarge, prepareQuickOpenFiles } from '../quick-open-search'
+import { getPreparedQuickOpenFiles, isQuickOpenQueryTooLarge } from '../quick-open-search'
 import type { RuntimeFileListState } from '../quick-open-file-list'
 import { translate } from '@/i18n/i18n'
+import { DEFAULT_SEARCH_ENGINE, type SearchEngine } from '../../../../shared/browser-url'
 import { findExistingFileMatches, isLikelyNewFileIntent } from './tab-create-entry-file-matches'
+import { parseForcedSearchQuery } from './tab-create-entry-forced-search'
 import {
   isTabEntryAbsolutePathLike,
   type TabEntryLocalPlatform,
@@ -19,6 +21,7 @@ export {
 export type TabEntryOptionsContext = {
   allowAbsolutePaths?: boolean
   localPlatform?: TabEntryLocalPlatform
+  searchEngine?: SearchEngine
 }
 
 export const TAB_ENTRY_ABSOLUTE_PATH_REMOTE_BLOCKED_MESSAGE =
@@ -33,6 +36,7 @@ export type TabEntryClassification =
       relativePath: string
     }
   | { kind: 'host-url'; url: string }
+  | { kind: 'search'; engine: SearchEngine; query: string }
   | { kind: 'new-file'; relativePath: string }
   | { kind: 'absolute-file'; filePath: string }
   | { kind: 'blocked'; message: string }
@@ -57,22 +61,78 @@ function tabEntryActionOptionId(classification: TabEntryActionClassification): s
     case 'explicit-url':
     case 'host-url':
       return `${classification.kind}:${classification.url}`
+    case 'search':
+      return `search:${classification.query}`
   }
 }
 
+function emptyOption(): TabEntryOption {
+  return {
+    id: 'empty',
+    classification: {
+      kind: 'empty',
+      message: translate(
+        'auto.components.tab.bar.tab.create.entry.classifier.c41f8d20b7',
+        'Search open tabs, files, URLs, agents…'
+      )
+    }
+  }
+}
+
+function blockedOption(id: string, message: string): TabEntryOption {
+  return { id, classification: { kind: 'blocked', message } }
+}
+
+function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
+
+function invalidPathOption(error: unknown): TabEntryOption {
+  return blockedOption('invalid-path', errorMessage(error))
+}
+
+function fileListStatusOption(fileList: RuntimeFileListState): TabEntryOption | null {
+  if (fileList.loading) {
+    return blockedOption(
+      'loading',
+      translate(
+        'auto.components.tab.bar.tab.create.entry.classifier.097a982ee0',
+        'Loading files...'
+      )
+    )
+  }
+  return fileList.loadError ? blockedOption('load-error', fileList.loadError) : null
+}
+
+function clampActionLimit(limit: number): number {
+  return Number.isFinite(limit) ? Math.max(0, Math.floor(limit)) : 0
+}
+
+function toOptions(
+  classifications: TabEntryActionClassification[],
+  limit: number,
+  status?: TabEntryOption | null
+): TabEntryOption[] {
+  const options: TabEntryOption[] = classifications
+    .slice(0, clampActionLimit(limit))
+    .map((classification) => ({
+      id: tabEntryActionOptionId(classification),
+      classification
+    }))
+  if (status) {
+    options.push(status)
+  }
+  return options
+}
+
 export function classifyTabEntryQuery(
   query: string,
   fileList: RuntimeFileListState,
   context: TabEntryOptionsContext = {}
 ): TabEntryClassification {
   return (
-    getTabEntryOptions(query, fileList, 1, context)[0]?.classification ?? {
-      kind: 'empty',
-      message: translate(
-        'auto.components.tab.bar.tab.create.entry.classifier.5553b283ce',
-        'Enter a URL or file path.'
-      )
-    }
+    getTabEntryOptions(query, fileList, 1, context)[0]?.classification ??
+    emptyOption().classification
   )
 }
 
@@ -84,164 +144,126 @@ export function getTabEntryOptions(
 ): TabEntryOption[] {
   if (isQuickOpenQueryTooLarge(query)) {
     return [
-      {
-        id: 'query-too-large',
-        classification: {
-          kind: 'blocked',
-          message: translate(
-            'auto.components.tab.bar.tab.create.entry.classifier.queryTooLarge',
-            'Search text is too large.'
-          )
-        }
-      }
+      blockedOption(
+        'query-too-large',
+        translate(
+          'auto.components.tab.bar.tab.create.entry.classifier.queryTooLarge',
+          'Search text is too large.'
+        )
+      )
     ]
   }
 
-  const trimmed = query.trim()
+  const parsedSearch = parseForcedSearchQuery(query)
+  const trimmed = parsedSearch.query
+  const engine = context.searchEngine ?? DEFAULT_SEARCH_ENGINE
+  const search: TabEntryActionClassification = { kind: 'search', engine, query: trimmed }
+  if (parsedSearch.forced) {
+    return trimmed ? toOptions([search], limit) : [emptyOption()]
+  }
   if (!trimmed) {
-    return [
-      {
-        id: 'empty',
-        classification: {
-          kind: 'empty',
-          message: translate(
-            'auto.components.tab.bar.tab.create.entry.classifier.c41f8d20b7',
-            'Search open tabs, files, URLs, agents…'
-          )
-        }
-      }
-    ]
+    return [emptyOption()]
   }
 
   if (isTabEntryAbsolutePathLike(trimmed)) {
     if (!context.allowAbsolutePaths) {
       return [
-        {
-          id: 'absolute-path-blocked',
-          classification: {
-            kind: 'blocked',
-            message: translate(
-              'auto.components.tab.bar.tab.create.entry.classifier.absolutePathRemoteBlocked',
-              'Absolute paths require a local workspace.'
-            )
-          }
-        }
+        blockedOption(
+          'absolute-path-blocked',
+          translate(
+            'auto.components.tab.bar.tab.create.entry.classifier.absolutePathRemoteBlocked',
+            'Absolute paths require a local workspace.'
+          )
+        )
       ]
     }
     try {
       const filePath = validateNewTabEntryAbsolutePath(trimmed, context.localPlatform)
-      return [
-        {
-          id: `absolute-file:${filePath}`,
-          classification: { kind: 'absolute-file', filePath }
-        }
-      ]
+      return toOptions([{ kind: 'absolute-file', filePath }], limit)
     } catch (error) {
-      return [
-        {
-          id: 'invalid-absolute-path',
-          classification: {
-            kind: 'blocked',
-            message: error instanceof Error ? error.message : String(error)
-          }
-        }
-      ]
+      return [blockedOption('invalid-absolute-path', errorMessage(error))]
     }
   }
 
   const explicitUrl = classifyExplicitUrl(trimmed)
   if (explicitUrl) {
-    return [
-      {
-        id: explicitUrl.kind === 'blocked' ? 'invalid-url' : `url:${explicitUrl.url}`,
-        classification: explicitUrl
-      }
-    ]
+    return explicitUrl.kind === 'blocked'
+      ? [blockedOption('invalid-url', explicitUrl.message)]
+      : toOptions([explicitUrl], limit)
   }
 
-  if (fileList.loading) {
-    return [
-      {
-        id: 'loading',
-        classification: {
-          kind: 'blocked',
-          message: translate(
-            'auto.components.tab.bar.tab.create.entry.classifier.097a982ee0',
-            'Loading files...'
-          )
-        }
-      }
-    ]
+  const hostUrl = classifyHostUrl(trimmed)
+  let newFile: TabEntryActionClassification | null = null
+  let pathError: unknown = null
+  try {
+    newFile = { kind: 'new-file', relativePath: validateNewTabEntryRelativePath(trimmed) }
+  } catch (error) {
+    pathError = error
   }
-  if (fileList.loadError) {
-    return [{ id: 'load-error', classification: { kind: 'blocked', message: fileList.loadError } }]
+
+  const fileStatus = fileListStatusOption(fileList)
+  if (fileStatus) {
+    if (hostUrl?.kind === 'blocked') {
+      return [fileStatus]
+    }
+    if (hostUrl?.kind === 'host-url') {
+      return toOptions([hostUrl], limit, fileStatus)
+    }
+    // Why: path-shaped text waits on the scan whether or not it is creatable, so
+    // "src/" reports the scan instead of flashing a path error it will not keep.
+    if (isLikelyNewFileIntent(trimmed)) {
+      return [fileStatus]
+    }
+    if (pathError) {
+      return [invalidPathOption(pathError)]
+    }
+    return toOptions([search], limit, fileStatus)
   }
+
+  const actionLimit = clampActionLimit(limit)
   const existingFiles = findExistingFileMatches(
     trimmed,
-    prepareQuickOpenFiles(fileList.files),
-    Math.max(limit, 1)
+    getPreparedQuickOpenFiles(fileList.files),
+    Math.max(actionLimit, 1)
   )
   const exactExistingFiles = existingFiles.filter((file) => file.matchKind !== 'fuzzy')
   const fuzzyExistingFiles = existingFiles.filter((file) => file.matchKind === 'fuzzy')
 
-  let newFile: TabEntryActionClassification | null = null
-  try {
-    newFile = { kind: 'new-file', relativePath: validateNewTabEntryRelativePath(trimmed) }
-  } catch {
-    newFile = null
-  }
-
-  const hostUrl = classifyHostUrl(trimmed)
-
-  const options: TabEntryActionClassification[] = []
   if (exactExistingFiles.length > 0) {
-    options.push(...exactExistingFiles)
-    if (hostUrl) {
+    const options: TabEntryActionClassification[] = [...exactExistingFiles]
+    if (hostUrl?.kind === 'host-url') {
       options.push(hostUrl)
+    } else if (!hostUrl && newFile) {
+      options.push(search)
     }
-  } else if (hostUrl) {
-    options.push(hostUrl)
-    options.push(...fuzzyExistingFiles)
-  } else if (newFile && isLikelyNewFileIntent(trimmed)) {
-    options.push(newFile, ...fuzzyExistingFiles)
-  } else {
-    options.push(...fuzzyExistingFiles)
-    if (newFile) {
-      options.push(newFile)
-    }
+    return toOptions(options, actionLimit)
   }
-
-  if (options.length > 0) {
-    return options.slice(0, limit).map((classification) => ({
-      id: tabEntryActionOptionId(classification),
-      classification
-    }))
+  if (hostUrl?.kind === 'blocked') {
+    return [blockedOption('invalid-url', hostUrl.message)]
   }
-
-  try {
-    validateNewTabEntryRelativePath(trimmed)
-  } catch (error) {
-    return [
-      {
-        id: 'invalid-path',
-        classification: {
-          kind: 'blocked',
-          message: error instanceof Error ? error.message : String(error)
-        }
-      }
-    ]
+  if (hostUrl?.kind === 'host-url') {
+    return toOptions([hostUrl, ...fuzzyExistingFiles], actionLimit)
   }
-
-  return [
-    {
-      id: 'blocked',
-      classification: {
-        kind: 'blocked',
-        message: translate(
-          'auto.components.tab.bar.tab.create.entry.classifier.42e6262ae9',
-          'No action available.'
-        )
-      }
-    }
-  ]
+  if (pathError || !newFile) {
+    // Why: an unusable path is still a live quick-open prefix — "src/" cannot be
+    // created, but it matches real files, and dropping them turns every typed
+    // separator into an error row mid-keystroke.
+    return fuzzyExistingFiles.length > 0
+      ? toOptions(fuzzyExistingFiles, actionLimit)
+      : [invalidPathOption(pathError)]
+  }
+  if (isLikelyNewFileIntent(trimmed)) {
+    return toOptions([newFile, search, ...fuzzyExistingFiles], actionLimit)
+  }
+  if (/\s/.test(trimmed)) {
+    return toOptions([search, ...fuzzyExistingFiles, newFile], actionLimit)
+  }
+  // Why: a single token is still a quick-open attempt ("btn" → Button.tsx), so
+  // only phrases promote web search over fuzzy matches. Fuzzy matching is a
+  // subsequence scan that fills every slot in a real repo, so hold one back —
+  // otherwise search silently disappears from the list it should always offer.
+  return toOptions(
+    [...fuzzyExistingFiles.slice(0, Math.max(actionLimit - 1, 1)), search, newFile],
+    actionLimit
+  )
 }
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-copy.ts b/src/renderer/src/components/tab-bar/tab-create-entry-copy.ts
new file mode 100644
index 00000000000..c90771cc540
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-copy.ts
@@ -0,0 +1,12 @@
+import { translate } from '@/i18n/i18n'
+
+export function getTabEntryOmniboxPlaceholder(): string {
+  return translate(
+    'auto.components.tab.bar.TabBarCreateEntry.0e5b7a3f16',
+    'Search open tabs, files, URLs, agents…'
+  )
+}
+
+export function getTabEntryChooseActionMessage(): string {
+  return translate('auto.components.tab.bar.TabBarCreateEntry.chooseAction', 'Choose an action.')
+}
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-empty-options.ts b/src/renderer/src/components/tab-bar/tab-create-entry-empty-options.ts
new file mode 100644
index 00000000000..e6d4c0726cf
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-empty-options.ts
@@ -0,0 +1,7 @@
+import type { OpenTabSearchResult } from './open-tab-search'
+import type { TabAgentLaunchOption } from './tab-agent-launch-options'
+import type { TabCreateMenuOption } from './tab-create-menu-options'
+
+export const EMPTY_AGENT_OPTIONS: readonly TabAgentLaunchOption[] = []
+export const EMPTY_MENU_OPTIONS: readonly TabCreateMenuOption[] = []
+export const EMPTY_TAB_RESULTS: readonly OpenTabSearchResult[] = []
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.ts b/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.ts
index fbbb30c4977..25d30cb9ce6 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.ts
@@ -18,8 +18,22 @@ function hasFilenameExtension(query: string): boolean {
   return /(?:^|[\\/])[^\\/]+\.[^\\/]+$/.test(query.trim())
 }
 
+// Why: multi-word text without path or filename syntax cannot overtake ranking
+// as a file match, so callers may treat its search ranking as already final.
+export function isUnambiguousSearchQuery(query: string): boolean {
+  const trimmed = query.trim()
+  return /\s/.test(trimmed) && !hasPathSeparator(trimmed) && !hasFilenameExtension(trimmed)
+}
+
 export function isLikelyNewFileIntent(query: string): boolean {
-  return hasPathSeparator(query) || hasFilenameExtension(query)
+  const trimmed = query.trim()
+  if (hasPathSeparator(trimmed)) {
+    return true
+  }
+  if (/\s/.test(trimmed)) {
+    return false
+  }
+  return hasFilenameExtension(trimmed) || /^\.[^.].*$/.test(trimmed)
 }
 
 function dedupeMatches(matches: ExistingFileMatch[]): ExistingFileMatch[] {
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-forced-search.test.ts b/src/renderer/src/components/tab-bar/tab-create-entry-forced-search.test.ts
new file mode 100644
index 00000000000..89df7221f8d
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-forced-search.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { parseForcedSearchQuery } from './tab-create-entry-forced-search'
+
+describe('parseForcedSearchQuery', () => {
+  it.each([
+    ['react', { forced: false, query: 'react' }],
+    [' react ', { forced: false, query: 'react' }],
+    [' ?react', { forced: false, query: '?react' }],
+    ['?react hooks', { forced: true, query: 'react hooks' }],
+    ['??foo', { forced: true, query: '?foo' }],
+    ['?https://x.dev', { forced: true, query: 'https://x.dev' }],
+    ['?', { forced: true, query: '' }],
+    ['?   ', { forced: true, query: '' }]
+  ])('parses %j', (input, expected) => {
+    expect(parseForcedSearchQuery(input)).toEqual(expected)
+  })
+})
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-forced-search.ts b/src/renderer/src/components/tab-bar/tab-create-entry-forced-search.ts
new file mode 100644
index 00000000000..3849436164b
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-forced-search.ts
@@ -0,0 +1,8 @@
+export type ForcedSearchQuery = { forced: false; query: string } | { forced: true; query: string }
+
+export function parseForcedSearchQuery(input: string): ForcedSearchQuery {
+  if (!input.startsWith('?')) {
+    return { forced: false, query: input.trim() }
+  }
+  return { forced: true, query: input.slice(1).trim() }
+}
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-keyboard-focus.ts b/src/renderer/src/components/tab-bar/tab-create-entry-keyboard-focus.ts
new file mode 100644
index 00000000000..399ff3027bc
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-keyboard-focus.ts
@@ -0,0 +1,18 @@
+export function focusTabEntryMenuItemAtEdge(
+  fromElement: HTMLElement,
+  edge: 'first' | 'last'
+): boolean {
+  const menu = fromElement.closest('[role="menu"]')
+  if (!menu) {
+    return false
+  }
+  const items = menu.querySelectorAll<HTMLElement>(
+    '[role="menuitem"]:not([data-disabled]):not([aria-disabled="true"])'
+  )
+  const target = edge === 'first' ? items[0] : items.item(items.length - 1)
+  if (!target) {
+    return false
+  }
+  target.focus()
+  return true
+}
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-network-selection.ts b/src/renderer/src/components/tab-bar/tab-create-entry-network-selection.ts
new file mode 100644
index 00000000000..c1de43c2975
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-network-selection.ts
@@ -0,0 +1,68 @@
+import { useEffect, useRef } from 'react'
+import { getActiveOptionId, type ActiveOption } from './tab-create-entry-active-option'
+import { isUnambiguousSearchQuery } from './tab-create-entry-file-matches'
+
+type NetworkSelectionArgs = {
+  activeOptions: ActiveOption[]
+  fileIndexFailed: boolean
+  fileIndexReady: boolean
+  forcedSearch: boolean
+  menuOpen: boolean
+  pinnedOptionId: string | null
+  query: string
+}
+
+export function useNetworkSafeTabEntrySelection({
+  activeOptions,
+  fileIndexFailed,
+  fileIndexReady,
+  forcedSearch,
+  menuOpen,
+  pinnedOptionId,
+  query
+}: NetworkSelectionArgs): {
+  activeSelectedIndex: number | null
+  selectedActiveOption: ActiveOption | undefined
+} {
+  const pinnedOptionIndex = pinnedOptionId
+    ? activeOptions.findIndex((option) => getActiveOptionId(option) === pinnedOptionId)
+    : -1
+  const rankedOption = pinnedOptionIndex < 0 ? activeOptions[0] : undefined
+  const rankedClassification =
+    rankedOption?.kind === 'entry' ? rankedOption.option.classification : null
+  const rankedNetworkAction =
+    !forcedSearch &&
+    (rankedClassification?.kind === 'search' || rankedClassification?.kind === 'host-url')
+  // Why: a still-scanning index can promote a file match later, so hold Enter
+  // unless the scan can no longer change the ranking — it failed outright, or
+  // the text is a phrase that would never rank as a file.
+  const networkRankingSettled =
+    fileIndexReady ||
+    fileIndexFailed ||
+    (rankedClassification?.kind === 'search' &&
+      isUnambiguousSearchQuery(rankedClassification.query))
+  const rankingKey = `${menuOpen}:${query}`
+  const hasRankedOption = rankedOption !== undefined
+  // Why: once a query ranked a local action first, a later re-index that promotes
+  // a network row must not arm Enter under the user's fingers — the text they
+  // aimed at a file would silently leave for a search engine. Retyping clears it.
+  const blockedNetworkRankingRef = useRef<string | null>(null)
+  useEffect(() => {
+    if (fileIndexReady && hasRankedOption && !rankedNetworkAction) {
+      blockedNetworkRankingRef.current = rankingKey
+    }
+  }, [fileIndexReady, hasRankedOption, rankedNetworkAction, rankingKey])
+  const networkActionAllowed =
+    networkRankingSettled && blockedNetworkRankingRef.current !== rankingKey
+  const activeSelectedIndex =
+    pinnedOptionIndex >= 0
+      ? pinnedOptionIndex
+      : activeOptions.length === 0 || (rankedNetworkAction && !networkActionAllowed)
+        ? null
+        : 0
+  return {
+    activeSelectedIndex,
+    selectedActiveOption:
+      activeSelectedIndex === null ? undefined : activeOptions[activeSelectedIndex]
+  }
+}
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-props.ts b/src/renderer/src/components/tab-bar/tab-create-entry-props.ts
new file mode 100644
index 00000000000..56a4bca3abc
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-props.ts
@@ -0,0 +1,20 @@
+import type { TuiAgent } from '../../../../shared/types'
+import type { TabCreateEntryArgs } from './tab-create-entry-action'
+import type { TabAgentLaunchOption } from './tab-agent-launch-options'
+import type { TabCreateMenuOption } from './tab-create-menu-options'
+
+export type TabBarCreateEntryProps = {
+  agentOptions?: readonly TabAgentLaunchOption[]
+  groupId: string
+  menuOpen: boolean
+  menuOptions?: readonly TabCreateMenuOption[]
+  onDidOpenEntry?: () => void
+  onLaunchAgent?: (agent: TuiAgent) => void
+  onOpenDefaultTerminal?: () => void
+  onOpenEntry?: (args: TabCreateEntryArgs) => Promise<void>
+  onQueryChange?: (query: string) => void
+  /** Runs after the menu closes, so the tab jumped to actually takes focus. */
+  onQueueSwitchFocus?: (focus: () => void) => void
+  onSelectMenuOption?: (option: TabCreateMenuOption) => void
+  worktreeId: string
+}
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-url-classification.ts b/src/renderer/src/components/tab-bar/tab-create-entry-url-classification.ts
index 375e5d71764..67194fbecbf 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-url-classification.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-url-classification.ts
@@ -16,72 +16,138 @@ const HOST_FILE_EXTENSIONS = new Set([
   'yml'
 ])
 
-const LOCALHOST_WITH_PORT_PATTERN = /^localhost(?::\d{1,5})?$/i
-const IPV4_WITH_PORT_PATTERN =
-  /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?::\d{1,5})?$/
-const DOMAIN_WITH_PORT_PATTERN =
-  /^(?=.{1,253}(?::\d{1,5})?$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}(?::\d{1,5})?$/i
+const IPV4_PATTERN =
+  /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/
+const DOMAIN_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/i
+const HTTP_SCHEME_PATTERN = /^https?:\/\//i
+const BRACKETED_IPV6_ATTEMPT_PATTERN = /^\[[0-9a-f:]+\](?::[^/?#]*)?(?:[/?#].*)?$/i
+const SCHEME_PREFIX_PATTERN = /^[a-z][a-z0-9+.-]*:/i
+const SCHEME_WITH_SLASHES_PATTERN = /^[a-z][a-z0-9+.-]*:\/\//i
 
 export type ExplicitUrlClassification =
   | { kind: 'blocked'; message: string }
   | { kind: 'explicit-url'; url: string }
 
-export type HostUrlClassification = { kind: 'host-url'; url: string }
+export type HostUrlClassification =
+  | { kind: 'blocked'; message: string }
+  | { kind: 'host-url'; url: string }
 
-export function classifyExplicitUrl(query: string): ExplicitUrlClassification | null {
-  // Local dev inputs are handled by host-url classification so users can
-  // enter localhost/IP addresses without an explicit scheme.
-  if (classifySchemeLessLocalDevAddress(query)) {
-    return null
+function invalidUrl(): { kind: 'blocked'; message: string } {
+  return {
+    kind: 'blocked',
+    message: translate(
+      'auto.components.tab.bar.tab.create.entry.classifier.90eb94dc48',
+      'Enter an http:// or https:// URL.'
+    )
   }
-  let url: URL
+}
+
+function parseHttpUrl(query: string): ExplicitUrlClassification {
   try {
-    url = new URL(query)
+    const url = new URL(query)
+    return (url.protocol === 'http:' || url.protocol === 'https:') && url.hostname
+      ? { kind: 'explicit-url', url: url.href }
+      : invalidUrl()
   } catch {
-    return null
+    return invalidUrl()
   }
-  if ((url.protocol !== 'http:' && url.protocol !== 'https:') || !url.hostname) {
-    return {
-      kind: 'blocked',
-      message: translate(
-        'auto.components.tab.bar.tab.create.entry.classifier.90eb94dc48',
-        'Enter an http:// or https:// URL.'
-      )
-    }
-  }
-  return { kind: 'explicit-url', url: url.href }
 }
 
-function classifyLocalDevUrl(query: string): HostUrlClassification | null {
-  const url = classifySchemeLessLocalDevAddress(query)
-  return url?.hostname ? { kind: 'host-url', url: url.href } : null
-}
-
-function classifyHostLikeUrl(query: string): HostUrlClassification | null {
-  if (/[\\/]/.test(query) || /\s/.test(query)) {
+function splitHostCandidate(query: string): { host: string; port: string | null } | null {
+  if (/[\\/\s?#]/.test(query)) {
     return null
   }
-  const extension = query.split(':')[0]?.split('.').pop()?.toLowerCase() ?? ''
+  const colonIndex = query.indexOf(':')
+  const host = colonIndex === -1 ? query : query.slice(0, colonIndex)
+  const port = colonIndex === -1 ? null : query.slice(colonIndex + 1)
+  const extension = host.split('.').pop()?.toLowerCase() ?? ''
   if (HOST_FILE_EXTENSIONS.has(extension)) {
     return null
   }
   if (
-    !LOCALHOST_WITH_PORT_PATTERN.test(query) &&
-    !IPV4_WITH_PORT_PATTERN.test(query) &&
-    !DOMAIN_WITH_PORT_PATTERN.test(query)
+    host.toLowerCase() !== 'localhost' &&
+    !IPV4_PATTERN.test(host) &&
+    !DOMAIN_PATTERN.test(host)
   ) {
     return null
   }
-  try {
-    const url = new URL(`https://${query}`)
-    return url.hostname ? { kind: 'host-url', url: url.href } : null
-  } catch {
+  return { host, port }
+}
+
+// Why: a bare LAN/dev address almost never serves TLS, but a public IP still
+// deserves https — plaintext there would be a downgrade, and IPs get no HSTS.
+function isPrivateIpv4(host: string): boolean {
+  if (!IPV4_PATTERN.test(host)) {
+    return false
+  }
+  const [first = 0, second = 0] = host.split('.').map(Number)
+  return (
+    first === 0 ||
+    first === 10 ||
+    first === 127 ||
+    (first === 100 && second >= 64 && second <= 127) || // CGNAT, incl. Tailscale
+    (first === 172 && second >= 16 && second <= 31) ||
+    (first === 169 && second === 254) ||
+    (first === 192 && second === 168)
+  )
+}
+
+function hasSourceExtensionBeforeColon(query: string): boolean {
+  const colonIndex = query.indexOf(':')
+  if (colonIndex === -1) {
+    return false
+  }
+  const extension = query.slice(0, colonIndex).split('.').pop()?.toLowerCase() ?? ''
+  return HOST_FILE_EXTENSIONS.has(extension)
+}
+
+export function classifyExplicitUrl(query: string): ExplicitUrlClassification | null {
+  if (HTTP_SCHEME_PATTERN.test(query)) {
+    return parseHttpUrl(query)
+  }
+  if (SCHEME_WITH_SLASHES_PATTERN.test(query)) {
+    return invalidUrl()
+  }
+  if (classifySchemeLessLocalDevAddress(query)) {
     return null
   }
+  if (splitHostCandidate(query)) {
+    return null
+  }
+  if (hasSourceExtensionBeforeColon(query)) {
+    return null
+  }
+  if (!SCHEME_PREFIX_PATTERN.test(query)) {
+    return null
+  }
+  if (/\s/.test(query)) {
+    return null
+  }
+  return invalidUrl()
 }
 
 export function classifyHostUrl(query: string): HostUrlClassification | null {
-  // Try exact local-dev forms first so localhost keeps http:// parity with
-  // the previous inline classifier before falling back to public hostnames.
-  return classifyLocalDevUrl(query) ?? classifyHostLikeUrl(query)
+  const candidate = splitHostCandidate(query)
+  if (!candidate) {
+    const localDevUrl = classifySchemeLessLocalDevAddress(query)
+    if (localDevUrl?.hostname) {
+      return { kind: 'host-url', url: localDevUrl.href }
+    }
+    return BRACKETED_IPV6_ATTEMPT_PATTERN.test(query) ? invalidUrl() : null
+  }
+  if (candidate.port !== null && !/^\d+$/.test(candidate.port)) {
+    // Why: "docker.io:latest" reads as a tag, not a URL attempt — fall through so
+    // file matches and search still get offered instead of blocking every row.
+    return null
+  }
+  try {
+    const scheme =
+      candidate.host.toLowerCase() === 'localhost' || isPrivateIpv4(candidate.host)
+        ? 'http'
+        : 'https'
+    const url = new URL(`${scheme}://${query}`)
+    return url.hostname ? { kind: 'host-url', url: url.href } : invalidUrl()
+  } catch {
+    return invalidUrl()
+  }
 }
diff --git a/src/renderer/src/components/tab-bar/tab-create-menu-options.test.ts b/src/renderer/src/components/tab-bar/tab-create-menu-options.test.ts
index 42ed5f2abf1..d11662c880b 100644
--- a/src/renderer/src/components/tab-bar/tab-create-menu-options.test.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-menu-options.test.ts
@@ -53,6 +53,25 @@ describe('tab create menu options', () => {
     ).toEqual(['new-browser'])
   })
 
+  it('keeps terminal and markdown results when client-impossible actions are omitted', () => {
+    const options = buildTabCreateMenuOptions({
+      terminalOnly: false,
+      hasNewBrowser: false,
+      hasNewMarkdown: true,
+      hasOpenMarkdown: true,
+      hasSimulator: false,
+      simulatorIsGoTo: false
+    })
+
+    expect(options.map((option) => option.kind)).toEqual([
+      'new-terminal',
+      'new-markdown',
+      'open-markdown'
+    ])
+    expect(findMatchingTabCreateMenuOptions('browser', options)).toEqual([])
+    expect(findMatchingTabCreateMenuOptions('mobile emulator', options)).toEqual([])
+  })
+
   it('preserves default Windows shell order for tied terminal matches', () => {
     const options = buildTabCreateMenuOptions({
       terminalOnly: false,
diff --git a/src/renderer/src/components/tab-bar/tab-title-tooltip.test.tsx b/src/renderer/src/components/tab-bar/tab-title-tooltip.test.tsx
index e69e9ea18a3..8105e0f3263 100644
--- a/src/renderer/src/components/tab-bar/tab-title-tooltip.test.tsx
+++ b/src/renderer/src/components/tab-bar/tab-title-tooltip.test.tsx
@@ -188,11 +188,13 @@ function textSpanHtml(markup: string, text: string): string {
 
 function expectTabContainerWidth(markup: string, root: string): void {
   const container = firstOpeningTag(markup)
-  const widthClasses = 'min-w-[88px] max-w-[280px] flex-[1_1_180px] min-[1280px]:flex-[1_1_220px]'
+  // Why: pinned literally — a definite `w-*` is what stops live title updates from resizing
+  // every tab, so asserting against the constant would let that guarantee be edited away.
+  const widthClasses = 'w-[180px] min-w-[88px] min-[1280px]:w-[220px]'
   expect(container).toContain(widthClasses)
+  expect(root).not.toContain('w-[180px]')
   expect(root).not.toContain('min-w-[88px]')
-  expect(root).not.toContain('max-w-[280px]')
-  expect(root).not.toContain('flex-[1_1_180px]')
+  expect(root).not.toContain('min-[1280px]:w-[220px]')
 }
 
 function expectTooltipContent(markup: string, text: string): void {
diff --git a/src/renderer/src/components/tab-bar/tab-width-rules.ts b/src/renderer/src/components/tab-bar/tab-width-rules.ts
index 9001b6d780f..c96fe099650 100644
--- a/src/renderer/src/components/tab-bar/tab-width-rules.ts
+++ b/src/renderer/src/components/tab-bar/tab-width-rules.ts
@@ -1,6 +1,5 @@
-// Why: tab strips should reveal as much title as space allows, then shrink to
-// a readable floor before horizontal overflow takes over.
-export const TAB_CONTAINER_WIDTH_CLASSES =
-  'min-w-[88px] max-w-[280px] flex-[1_1_180px] min-[1280px]:flex-[1_1_220px]'
+// Why: the strip shrink-wraps its tabs, so a content-derived width lets one live title update
+// resize every tab; a definite width pins them and flex-shrink still narrows to the floor.
+export const TAB_CONTAINER_WIDTH_CLASSES = 'w-[180px] min-w-[88px] min-[1280px]:w-[220px]'
 
 export const TAB_LABEL_WIDTH_CLASSES = 'min-w-0 flex-1 truncate'
diff --git a/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts b/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts
index 26525128517..abdcc584881 100644
--- a/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts
+++ b/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts
@@ -223,8 +223,8 @@ export function terminalTabHasUnreadActivity({
   unreadAgentCompletionPanes
 }: {
   terminalTabId: string
-  unreadTerminalTabs: Record<string, true | boolean | undefined>
-  unreadAgentCompletionPanes: Record<string, true | boolean | undefined>
+  unreadTerminalTabs: Record<string, boolean | undefined>
+  unreadAgentCompletionPanes: Record<string, boolean | undefined>
 }): boolean {
   return (
     unreadTerminalTabs[terminalTabId] === true ||
@@ -234,7 +234,7 @@ export function terminalTabHasUnreadActivity({
 
 /** Match pane-level unread completion markers to their owning terminal tab. */
 export function hasUnreadAgentCompletionForTerminalTab(
-  unreadAgentCompletionPanes: Record<string, true | boolean | undefined> | undefined,
+  unreadAgentCompletionPanes: Record<string, boolean | undefined> | undefined,
   tabId: string
 ): boolean {
   for (const [paneKey, unread] of Object.entries(unreadAgentCompletionPanes ?? {})) {
diff --git a/src/renderer/src/components/tab-bar/use-tab-bar-create-menu-controller.ts b/src/renderer/src/components/tab-bar/use-tab-bar-create-menu-controller.ts
new file mode 100644
index 00000000000..7eb28f2bcc8
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/use-tab-bar-create-menu-controller.ts
@@ -0,0 +1,299 @@
+import { useEffect, useMemo, useRef, useState } from 'react'
+import { toast } from 'sonner'
+import type { TuiAgent } from '../../../../shared/types'
+import { translate } from '@/i18n/i18n'
+import { focusTerminalTabSurface } from '@/lib/focus-terminal-tab-surface'
+import { launchAgentInNewTab } from '@/lib/launch-agent-in-new-tab'
+import type { WindowsTerminalCapabilities } from '@/lib/windows-terminal-capabilities'
+import { useAppStore } from '../../store'
+import type { TabAgentLaunchOption } from './tab-agent-launch-options'
+import { buildTabCreateMenuOptions, type TabCreateMenuOption } from './tab-create-menu-options'
+import { resolveWindowsShellLaunchTarget } from './windows-shell-launch'
+import {
+  buildWindowsShellMenuEntries,
+  type WindowsShellMenuEntry
+} from './tab-bar-windows-shell-options'
+import type {
+  getProjectRuntimeShellMenuMode,
+  resolveWindowsPowerShellImplementationSetting
+} from './use-tab-bar-runtime-model'
+
+const NEW_TAB_MENU_TERMINAL_FOCUS_RETRY_MS = 50
+const NEW_TAB_MENU_TERMINAL_FOCUS_TIMEOUT_MS = 5000
+
+export type TabBarCreateMenuController = {
+  newTabMenuOpen: boolean
+  setNewTabMenuOpen: (open: boolean) => void
+  setCreateMenuQuery: (query: string) => void
+  createMenuOptions: TabCreateMenuOption[]
+  windowsShellEntries: WindowsShellMenuEntry[] | undefined
+  handleSelectCreateMenuOption: (option: TabCreateMenuOption) => void
+  launchAgentFromNewTabEntry: (agent: TuiAgent) => void
+  runPendingNewTabMenuFocusAfterClose: () => void
+  clearPendingNewTabMenuFocusOnUnmount: (node: HTMLDivElement | null) => void
+  queueNewActiveTerminalFocusAfterNewTabMenuClose: () => void
+  queueTerminalTabFocusAfterNewTabMenuClose: (tabId: string) => void
+  queueFocusAfterNewTabMenuClose: (focus: () => void) => void
+  showStaticCreateMenuItems: boolean
+}
+
+export function useTabBarCreateMenuController({
+  worktreeId,
+  resolvedGroupId,
+  terminalOnly,
+  mobileEmulatorEnabled,
+  managedBrowserCreationEnabled,
+  mobileEmulatorCreationEnabled,
+  workspaceHasSimulatorTab,
+  showWindowsShellMenu,
+  projectRuntimeShellMenuMode,
+  defaultWindowsShell,
+  defaultWindowsPowerShellImplementation,
+  windowsTerminalCapabilities,
+  agentLaunchOptions,
+  onNewTerminalTab,
+  onNewTerminalWithShell,
+  onNewBrowserTab,
+  onNewSimulatorTab,
+  onNewFileTab,
+  onOpenFileTab
+}: {
+  worktreeId: string
+  resolvedGroupId: string
+  terminalOnly: boolean
+  mobileEmulatorEnabled: boolean
+  managedBrowserCreationEnabled: boolean
+  mobileEmulatorCreationEnabled: boolean
+  workspaceHasSimulatorTab: boolean
+  showWindowsShellMenu: boolean
+  projectRuntimeShellMenuMode: ReturnType<typeof getProjectRuntimeShellMenuMode>
+  defaultWindowsShell: string
+  defaultWindowsPowerShellImplementation: ReturnType<
+    typeof resolveWindowsPowerShellImplementationSetting
+  >
+  windowsTerminalCapabilities: WindowsTerminalCapabilities
+  agentLaunchOptions: TabAgentLaunchOption[]
+  onNewTerminalTab: () => void
+  onNewTerminalWithShell?: (shell: string) => void
+  onNewBrowserTab: () => void
+  onNewSimulatorTab?: () => void
+  onNewFileTab?: () => void
+  onOpenFileTab?: () => void
+}): TabBarCreateMenuController {
+  // Why: <webview> clicks are out-of-process, so Radix's document-pointerdown outside-click check misses them; use window blur.
+  const [newTabMenuOpen, setNewTabMenuOpen] = useState(false)
+  const [createMenuQuery, setCreateMenuQuery] = useState('')
+  const pendingNewTabMenuFocusRef = useRef<(() => void) | null>(null)
+  const pendingNewTabMenuFocusAnimationRef = useRef<number | null>(null)
+  const pendingNewTabMenuFocusRetryRef = useRef<number | null>(null)
+  const clearPendingNewTabMenuFocusAnimation = (): void => {
+    if (pendingNewTabMenuFocusAnimationRef.current === null) {
+      return
+    }
+    cancelAnimationFrame(pendingNewTabMenuFocusAnimationRef.current)
+    pendingNewTabMenuFocusAnimationRef.current = null
+  }
+  const clearPendingNewTabMenuFocusRetry = (): void => {
+    if (pendingNewTabMenuFocusRetryRef.current === null) {
+      return
+    }
+    window.clearTimeout(pendingNewTabMenuFocusRetryRef.current)
+    pendingNewTabMenuFocusRetryRef.current = null
+  }
+  const focusNewActiveTerminalWhenReady = (
+    previousActiveTabId: string | null,
+    expiresAt: number
+  ): void => {
+    const state = useAppStore.getState()
+    if (
+      (state.activeTabType === 'terminal' || state.activeTabType === 'simulator') &&
+      state.activeTabId &&
+      state.activeTabId !== previousActiveTabId
+    ) {
+      focusTerminalTabSurface(state.activeTabId)
+      return
+    }
+    if (Date.now() >= expiresAt) {
+      return
+    }
+    pendingNewTabMenuFocusRetryRef.current = window.setTimeout(() => {
+      pendingNewTabMenuFocusRetryRef.current = null
+      focusNewActiveTerminalWhenReady(previousActiveTabId, expiresAt)
+    }, NEW_TAB_MENU_TERMINAL_FOCUS_RETRY_MS)
+  }
+  const queueNewActiveTerminalFocusAfterNewTabMenuClose = (): void => {
+    const previousActiveTabId = useAppStore.getState().activeTabId
+    pendingNewTabMenuFocusRef.current = () => {
+      // Why: paired web/SSH tab creation is async; await the host snapshot's new terminal instead of the pre-existing active tab.
+      focusNewActiveTerminalWhenReady(
+        previousActiveTabId,
+        Date.now() + NEW_TAB_MENU_TERMINAL_FOCUS_TIMEOUT_MS
+      )
+    }
+  }
+  const queueTerminalTabFocusAfterNewTabMenuClose = (tabId: string): void => {
+    pendingNewTabMenuFocusRef.current = () => focusTerminalTabSurface(tabId)
+  }
+  const queueFocusAfterNewTabMenuClose = (focus: () => void): void => {
+    pendingNewTabMenuFocusRef.current = focus
+  }
+  const windowsShellEntries = useMemo(() => {
+    return buildWindowsShellMenuEntries({
+      showWindowsShellMenu,
+      hasShellLauncher: Boolean(onNewTerminalWithShell),
+      projectRuntimeShellMenuMode,
+      defaultWindowsShell,
+      gitBashAvailable: windowsTerminalCapabilities.gitBashAvailable,
+      wslAvailable: windowsTerminalCapabilities.wslAvailable
+    })
+  }, [
+    defaultWindowsShell,
+    onNewTerminalWithShell,
+    projectRuntimeShellMenuMode,
+    showWindowsShellMenu,
+    windowsTerminalCapabilities.gitBashAvailable,
+    windowsTerminalCapabilities.wslAvailable
+  ])
+  const createMenuOptions = useMemo(
+    () =>
+      buildTabCreateMenuOptions({
+        terminalOnly,
+        windowsShellEntries,
+        hasNewBrowser: !terminalOnly && managedBrowserCreationEnabled,
+        hasNewMarkdown: !terminalOnly && Boolean(onNewFileTab),
+        hasOpenMarkdown: !terminalOnly && Boolean(onOpenFileTab),
+        hasSimulator:
+          !terminalOnly &&
+          mobileEmulatorEnabled &&
+          mobileEmulatorCreationEnabled &&
+          Boolean(onNewSimulatorTab),
+        simulatorIsGoTo: workspaceHasSimulatorTab
+      }),
+    [
+      mobileEmulatorEnabled,
+      managedBrowserCreationEnabled,
+      mobileEmulatorCreationEnabled,
+      onNewFileTab,
+      onNewSimulatorTab,
+      onOpenFileTab,
+      terminalOnly,
+      windowsShellEntries,
+      workspaceHasSimulatorTab
+    ]
+  )
+  const handleSelectCreateMenuOption = (option: TabCreateMenuOption): void => {
+    switch (option.kind) {
+      case 'new-terminal':
+        queueNewActiveTerminalFocusAfterNewTabMenuClose()
+        onNewTerminalTab()
+        break
+      case 'new-terminal-shell':
+        if (!onNewTerminalWithShell || !option.shell) {
+          break
+        }
+        queueNewActiveTerminalFocusAfterNewTabMenuClose()
+        onNewTerminalWithShell(
+          resolveWindowsShellLaunchTarget(
+            option.shell,
+            defaultWindowsPowerShellImplementation,
+            windowsTerminalCapabilities.pwshAvailable
+          )
+        )
+        break
+      case 'new-browser':
+        onNewBrowserTab()
+        break
+      case 'new-markdown':
+        onNewFileTab?.()
+        break
+      case 'open-markdown':
+        onOpenFileTab?.()
+        break
+      case 'new-simulator':
+      case 'go-to-simulator':
+        onNewSimulatorTab?.()
+        break
+    }
+  }
+  const launchAgentFromNewTabEntry = (agent: TuiAgent): void => {
+    const option = agentLaunchOptions.find((candidate) => candidate.agent === agent)
+    const result = launchAgentInNewTab({
+      agent,
+      worktreeId,
+      groupId: resolvedGroupId,
+      launchSource: 'tab_bar_quick_launch'
+    })
+    if (!result) {
+      toast.error(
+        translate(
+          'auto.components.tab.bar.TabBar.ab589350e5',
+          'Could not build launch command for {{value0}}.',
+          { value0: option?.label ?? agent }
+        )
+      )
+      return
+    }
+    if (result.tabId) {
+      queueTerminalTabFocusAfterNewTabMenuClose(result.tabId)
+      return
+    }
+    queueNewActiveTerminalFocusAfterNewTabMenuClose()
+  }
+  const runPendingNewTabMenuFocusAfterClose = (): void => {
+    const pendingFocus = pendingNewTabMenuFocusRef.current
+    pendingNewTabMenuFocusRef.current = null
+    clearPendingNewTabMenuFocusAnimation()
+    clearPendingNewTabMenuFocusRetry()
+    if (pendingFocus) {
+      pendingNewTabMenuFocusAnimationRef.current = requestAnimationFrame(() => {
+        pendingNewTabMenuFocusAnimationRef.current = null
+        pendingFocus()
+      })
+    }
+  }
+  const clearPendingNewTabMenuFocusOnUnmountRef = useRef<
+    ((node: HTMLDivElement | null) => void) | null
+  >(null)
+  if (clearPendingNewTabMenuFocusOnUnmountRef.current === null) {
+    clearPendingNewTabMenuFocusOnUnmountRef.current = (node: HTMLDivElement | null): void => {
+      if (node !== null) {
+        return
+      }
+      // Why: cancel the delayed focus handoff via this root ref cleanup, avoiding an otherwise cleanup-only React Effect.
+      clearPendingNewTabMenuFocusAnimation()
+      clearPendingNewTabMenuFocusRetry()
+    }
+  }
+  const clearPendingNewTabMenuFocusOnUnmount = clearPendingNewTabMenuFocusOnUnmountRef.current
+
+  useEffect(() => {
+    if (!newTabMenuOpen) {
+      return
+    }
+    const dismiss = (): void => setNewTabMenuOpen(false)
+    window.addEventListener('blur', dismiss)
+    return () => window.removeEventListener('blur', dismiss)
+  }, [newTabMenuOpen])
+
+  useEffect(() => {
+    if (!newTabMenuOpen) {
+      setCreateMenuQuery('')
+    }
+  }, [newTabMenuOpen])
+
+  return {
+    newTabMenuOpen,
+    setNewTabMenuOpen,
+    setCreateMenuQuery,
+    createMenuOptions,
+    windowsShellEntries,
+    handleSelectCreateMenuOption,
+    launchAgentFromNewTabEntry,
+    runPendingNewTabMenuFocusAfterClose,
+    clearPendingNewTabMenuFocusOnUnmount,
+    queueNewActiveTerminalFocusAfterNewTabMenuClose,
+    queueTerminalTabFocusAfterNewTabMenuClose,
+    queueFocusAfterNewTabMenuClose,
+    showStaticCreateMenuItems: createMenuQuery.trim().length === 0
+  }
+}
diff --git a/src/renderer/src/components/tab-bar/use-tab-bar-item-projection.ts b/src/renderer/src/components/tab-bar/use-tab-bar-item-projection.ts
new file mode 100644
index 00000000000..0137c1f7cd7
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/use-tab-bar-item-projection.ts
@@ -0,0 +1,139 @@
+import { useMemo } from 'react'
+import type { GitFileStatus, Tab } from '../../../../shared/types'
+import type { TabBarProps } from './tab-bar-props'
+import {
+  buildOrderedTabItems,
+  buildTabDropIndicators,
+  buildTabStripLayoutKey,
+  findActiveVisibleTabId,
+  type TabBarItem
+} from './tab-bar-item-model'
+import type { DropIndicator } from './drop-indicator'
+
+export type TabBarItemProjection = {
+  orderedItems: TabBarItem[]
+  sortableIds: string[]
+  dropIndicatorByVisibleId: Map<string, DropIndicator>
+  activeVisibleTabId: string | null
+  tabStripLayoutKey: string
+}
+
+export function useTabBarItemProjection({
+  props,
+  resolvedGroupId,
+  unifiedTabs,
+  unifiedTabByVisibleId,
+  generatedTabTitlesEnabled,
+  statusByRelativePath
+}: {
+  props: TabBarProps
+  resolvedGroupId: string
+  unifiedTabs: readonly Tab[]
+  unifiedTabByVisibleId: Map<string, Tab>
+  generatedTabTitlesEnabled: boolean
+  statusByRelativePath: Map<string, GitFileStatus>
+}): TabBarItemProjection {
+  const {
+    tabs,
+    editorFiles,
+    browserTabs,
+    tabBarOrder,
+    hoveredTabInsertion,
+    activeTabId,
+    activeFileId,
+    activeBrowserTabId,
+    activeSimulatorTabId,
+    activeTabType,
+    expandedPaneByTabId
+  } = props
+  const terminalMap = useMemo(() => new Map(tabs.map((tab) => [tab.id, tab])), [tabs])
+  const editorMap = useMemo(
+    () => new Map((editorFiles ?? []).map((file) => [file.tabId ?? file.id, file])),
+    [editorFiles]
+  )
+  const browserMap = useMemo(
+    () => new Map((browserTabs ?? []).map((tab) => [tab.id, tab])),
+    [browserTabs]
+  )
+  const terminalIds = useMemo(() => tabs.map((tab) => tab.id), [tabs])
+  const editorFileIds = useMemo(
+    () => editorFiles?.map((file) => file.tabId ?? file.id) ?? [],
+    [editorFiles]
+  )
+  const browserTabIds = useMemo(() => browserTabs?.map((tab) => tab.id) ?? [], [browserTabs])
+  const simulatorTabIds = useMemo(
+    () =>
+      unifiedTabs
+        .filter((tab) => tab.groupId === resolvedGroupId && tab.contentType === 'simulator')
+        .map((tab) => tab.id),
+    [unifiedTabs, resolvedGroupId]
+  )
+  const orderedItems = useMemo(
+    () =>
+      buildOrderedTabItems({
+        tabBarOrder,
+        terminalIds,
+        editorFileIds,
+        browserTabIds,
+        simulatorTabIds,
+        terminalMap,
+        editorMap,
+        browserMap,
+        unifiedTabByVisibleId
+      }),
+    [
+      tabBarOrder,
+      terminalIds,
+      editorFileIds,
+      browserTabIds,
+      simulatorTabIds,
+      terminalMap,
+      editorMap,
+      browserMap,
+      unifiedTabByVisibleId
+    ]
+  )
+  const sortableIds = useMemo(() => orderedItems.map((item) => item.id), [orderedItems])
+  const activeIndicator =
+    hoveredTabInsertion?.groupId === resolvedGroupId ? hoveredTabInsertion : null
+  const dropIndicatorByVisibleId = useMemo(
+    () => buildTabDropIndicators(orderedItems, activeIndicator),
+    [activeIndicator, orderedItems]
+  )
+  const activeVisibleTabId = useMemo(
+    () =>
+      findActiveVisibleTabId(orderedItems, {
+        activeTabId,
+        activeFileId,
+        activeBrowserTabId,
+        activeSimulatorTabId,
+        activeTabType
+      }),
+    [
+      activeBrowserTabId,
+      activeFileId,
+      activeSimulatorTabId,
+      activeTabId,
+      activeTabType,
+      orderedItems
+    ]
+  )
+  const tabStripLayoutKey = useMemo(
+    () =>
+      buildTabStripLayoutKey(
+        orderedItems,
+        generatedTabTitlesEnabled,
+        expandedPaneByTabId,
+        statusByRelativePath
+      ),
+    [expandedPaneByTabId, generatedTabTitlesEnabled, orderedItems, statusByRelativePath]
+  )
+
+  return {
+    orderedItems,
+    sortableIds,
+    dropIndicatorByVisibleId,
+    activeVisibleTabId,
+    tabStripLayoutKey
+  }
+}
diff --git a/src/renderer/src/components/tab-bar/use-tab-bar-runtime-model.ts b/src/renderer/src/components/tab-bar/use-tab-bar-runtime-model.ts
new file mode 100644
index 00000000000..4515de2a071
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/use-tab-bar-runtime-model.ts
@@ -0,0 +1,275 @@
+import { useMemo } from 'react'
+import { useShallow } from 'zustand/react/shallow'
+import type { GitFileStatus, GlobalSettings, Tab, TuiAgent } from '../../../../shared/types'
+import type { ProjectExecutionRuntimeResolution } from '../../../../shared/project-execution-runtime'
+import { useAppStore } from '../../store'
+import { buildStatusMap } from '../right-sidebar/status-display'
+import { useDetectedAgents } from '@/hooks/useDetectedAgents'
+import { useAgentDetectionTargetForWorktree } from '@/hooks/useAgentDetectionTarget'
+import { getConnectionIdFromState } from '@/lib/connection-context'
+import { getLocalProjectExecutionRuntimeContext } from '@/lib/local-preflight-context'
+import { isNativeChatTranscriptLocalReadable } from '@/lib/native-chat-transcript-readability'
+import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import { getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
+import { useOptionalShortcutLabel, useShortcutLabel } from '@/hooks/useShortcutLabel'
+import {
+  getWindowsTerminalCapabilityOwnerKey,
+  useWindowsTerminalCapabilities,
+  type WindowsTerminalCapabilities
+} from '@/lib/windows-terminal-capabilities'
+import { shouldShowMobileEmulatorTabIntro } from '../emulator-pane/mobile-emulator-tab-intro-visibility'
+import {
+  selectTabBarAgentProjections,
+  type TabBarAgentProjections
+} from './tab-agent-types-by-tab-id'
+import { buildTabAgentLaunchOptions, orderTabLaunchAgents } from './tab-agent-launch-options'
+import type { TabAgentLaunchOption } from './tab-agent-launch-options'
+import { shouldShowWindowsShellMenu } from './windows-shell-menu-visibility'
+import { createUnifiedTabLookup } from './tab-bar-item-model'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
+
+const isWindows = navigator.userAgent.includes('Windows')
+export const isMacOs = navigator.userAgent.includes('Mac')
+type AppStoreState = ReturnType<typeof useAppStore.getState>
+type GitStatusEntries = AppStoreState['gitStatusByWorktree'][string]
+const EMPTY_GIT_STATUS_ENTRIES: GitStatusEntries = []
+const EMPTY_AGENT_CMD_OVERRIDES: Partial<Record<TuiAgent, string>> = {}
+const EMPTY_UNIFIED_TABS: readonly Tab[] = []
+
+export function getProjectRuntimeShellMenuMode(
+  projectRuntime: ProjectExecutionRuntimeResolution | undefined
+): 'host' | 'wsl' | null {
+  if (!projectRuntime) {
+    return null
+  }
+  if (projectRuntime.status === 'repair-required') {
+    return 'wsl'
+  }
+  return projectRuntime.runtime.kind === 'wsl' ? 'wsl' : 'host'
+}
+
+export function resolveWindowsPowerShellImplementationSetting(settings: GlobalSettings | null) {
+  return settings?.terminalWindowsPowerShellImplementation ?? 'auto'
+}
+
+export type TabBarRuntimeModel = {
+  newTerminalShortcut: string
+  newBrowserShortcut: string
+  newSimulatorShortcut: string
+  newFileShortcut: string
+  openMarkdownShortcut: string | null
+  generatedTabTitlesEnabled: boolean
+  mobileEmulatorEnabled: boolean
+  showMobileEmulatorIntroCallout: boolean
+  unifiedTabs: readonly Tab[]
+  pinTab: (tabId: string) => void
+  unpinTab: (tabId: string) => void
+  defaultWindowsShell: string
+  defaultWindowsPowerShellImplementation: ReturnType<
+    typeof resolveWindowsPowerShellImplementationSetting
+  >
+  agentLaunchOptions: TabAgentLaunchOption[]
+  windowsTerminalCapabilities: WindowsTerminalCapabilities
+  showWindowsShellMenu: boolean
+  projectRuntimeShellMenuMode: ReturnType<typeof getProjectRuntimeShellMenuMode>
+  resolvedGroupId: string
+  statusByRelativePath: Map<string, GitFileStatus>
+  unifiedTabByVisibleId: Map<string, Tab>
+  workspaceHasSimulatorTab: boolean
+  toggleTabViewMode: (tabId: string) => void
+  nativeChatTranscriptIsLocalReadable: boolean
+  managedBrowserCreationEnabled: boolean
+  mobileEmulatorCreationEnabled: boolean
+} & TabBarAgentProjections
+
+export function useTabBarRuntimeModel({
+  worktreeId,
+  groupId
+}: {
+  worktreeId: string
+  groupId?: string
+}): TabBarRuntimeModel {
+  const newTerminalShortcut = useShortcutLabel('tab.newTerminal')
+  const newBrowserShortcut = useShortcutLabel('tab.newBrowser')
+  const newSimulatorShortcut = useShortcutLabel('tab.newSimulator')
+  const newFileShortcut = useShortcutLabel('tab.newMarkdown')
+  const openMarkdownShortcut = useOptionalShortcutLabel('tab.openMarkdown')
+  const generatedTabTitlesEnabled = useAppStore((s) => s.settings?.tabAutoGenerateTitle === true)
+  const mobileEmulatorEnabled = useAppStore((s) => s.settings?.mobileEmulatorEnabled !== false)
+  const persistedUIReady = useAppStore((s) => s.persistedUIReady)
+  const mobileEmulatorTabIntroDismissed = useAppStore((s) => s.mobileEmulatorTabIntroDismissed)
+  const showMobileEmulatorIntroCallout = shouldShowMobileEmulatorTabIntro({
+    persistedUIReady,
+    mobileEmulatorTabIntroDismissed,
+    mobileEmulatorEnabled,
+    isMacOs
+  })
+  const gitStatusEntries = useAppStore(
+    (s) => s.gitStatusByWorktree[worktreeId] ?? EMPTY_GIT_STATUS_ENTRIES
+  )
+  const unifiedTabs = useAppStore((s) => s.unifiedTabsByWorktree[worktreeId] ?? EMPTY_UNIFIED_TABS)
+  const pinTab = useAppStore((s) => s.pinTab)
+  const unpinTab = useAppStore((s) => s.unpinTab)
+  const activeGroupIdForWorktree = useAppStore((s) => s.activeGroupIdByWorktree[worktreeId])
+  const defaultWindowsShell = useAppStore(
+    (s) => s.settings?.terminalWindowsShell ?? 'powershell.exe'
+  )
+  const defaultWindowsPowerShellImplementation = useAppStore((s) =>
+    resolveWindowsPowerShellImplementationSetting(s.settings)
+  )
+  const activeRepoId = useAppStore((s) => s.activeRepoId)
+  const activeWorktreeId = useAppStore((s) => s.activeWorktreeId)
+  const projects = useAppStore((s) => s.projects)
+  const repos = useAppStore((s) => s.repos)
+  const settings = useAppStore((s) => s.settings)
+  const worktreesByRepo = useAppStore((s) => s.worktreesByRepo)
+  // Why: use the worktree's owning host so offered Windows shells match the host that actually runs the terminal.
+  const activeRuntimeEnvironmentId = useAppStore(
+    (s) => getRuntimeEnvironmentIdForWorktree(s, worktreeId)?.trim() || null
+  )
+  // Why: retained tab strips rerun selectors on every store write; reuse canonical indexes, don't flatten both slices here.
+  const worktreeConnectionId = useAppStore(
+    (s) => getConnectionIdFromState(s, worktreeId)?.trim() || null
+  )
+  const worktreeRemotePlatform = useAppStore((s) => {
+    if (!worktreeConnectionId) {
+      return null
+    }
+    return s.sshConnectionStates.get(worktreeConnectionId)?.remotePlatform ?? null
+  })
+  const defaultAgent = useAppStore((s) => s.settings?.defaultTuiAgent)
+  const agentCmdOverrides = useAppStore(
+    (s) => s.settings?.agentCmdOverrides ?? EMPTY_AGENT_CMD_OVERRIDES
+  )
+  const agentDetectionTarget = useAgentDetectionTargetForWorktree(worktreeId)
+  const { detectedIds } = useDetectedAgents(agentDetectionTarget)
+  const agentLaunchOptions = useMemo(
+    () =>
+      buildTabAgentLaunchOptions(
+        orderTabLaunchAgents(defaultAgent, detectedIds ?? []),
+        agentCmdOverrides
+      ),
+    [agentCmdOverrides, defaultAgent, detectedIds]
+  )
+  const isWebClient = (globalThis as { __ORCA_WEB_CLIENT__?: boolean }).__ORCA_WEB_CLIENT__ === true
+  const windowsTerminalCapabilityOwnerKey = getWindowsTerminalCapabilityOwnerKey(
+    activeRuntimeEnvironmentId,
+    worktreeConnectionId
+  )
+  const runtimeTarget = useMemo(
+    () => getActiveRuntimeTarget({ activeRuntimeEnvironmentId }),
+    [activeRuntimeEnvironmentId]
+  )
+  const shouldProbeWindowsShellCapabilities =
+    isWindows ||
+    Boolean(activeRuntimeEnvironmentId?.trim()) ||
+    isWebClient ||
+    Boolean(worktreeConnectionId)
+  const windowsTerminalCapabilities = useWindowsTerminalCapabilities(
+    shouldProbeWindowsShellCapabilities,
+    false,
+    windowsTerminalCapabilityOwnerKey,
+    runtimeTarget,
+    worktreeConnectionId
+  )
+  const shellMenuHostPlatform = worktreeConnectionId
+    ? (worktreeRemotePlatform ?? windowsTerminalCapabilities.hostPlatform)
+    : windowsTerminalCapabilities.hostPlatform
+  const showWindowsShellMenu = shouldShowWindowsShellMenu({
+    activeRuntimeEnvironmentId,
+    hostPlatform: shellMenuHostPlatform,
+    isWindowsClient: isWindows,
+    worktreeHasRemoteConnection: Boolean(worktreeConnectionId)
+  })
+  const localProjectRuntime = useMemo(() => {
+    if (!showWindowsShellMenu || activeRuntimeEnvironmentId?.trim() || worktreeConnectionId) {
+      return undefined
+    }
+    return getLocalProjectExecutionRuntimeContext(
+      { activeRepoId, activeWorktreeId, projects, repos, settings, worktreesByRepo },
+      worktreeId,
+      'win32',
+      {
+        wslAvailable: windowsTerminalCapabilities.isLoading
+          ? undefined
+          : windowsTerminalCapabilities.wslAvailable,
+        availableWslDistros: windowsTerminalCapabilities.isLoading
+          ? null
+          : windowsTerminalCapabilities.wslDistros
+      }
+    )
+  }, [
+    activeRepoId,
+    activeRuntimeEnvironmentId,
+    activeWorktreeId,
+    projects,
+    repos,
+    settings,
+    showWindowsShellMenu,
+    worktreeConnectionId,
+    windowsTerminalCapabilities.isLoading,
+    windowsTerminalCapabilities.wslAvailable,
+    windowsTerminalCapabilities.wslDistros,
+    worktreeId,
+    worktreesByRepo
+  ])
+  const projectRuntimeShellMenuMode = getProjectRuntimeShellMenuMode(localProjectRuntime)
+  const resolvedGroupId = groupId ?? activeGroupIdForWorktree ?? worktreeId
+  const statusByRelativePath = useMemo(() => buildStatusMap(gitStatusEntries), [gitStatusEntries])
+  const unifiedTabByVisibleId = useMemo(
+    () => createUnifiedTabLookup(unifiedTabs, resolvedGroupId),
+    [resolvedGroupId, unifiedTabs]
+  )
+  const workspaceHasSimulatorTab = useMemo(
+    () => unifiedTabs.some((tab) => tab.contentType === 'simulator'),
+    [unifiedTabs]
+  )
+  const [managedBrowserCreationEnabled, mobileEmulatorCreationEnabled] = useAppStore(
+    useShallow((state) => {
+      const policy = getClientCreationActionPolicy(state, worktreeId)
+      return [
+        policy['managed-browser'].state === 'enabled',
+        policy['mobile-emulator'].state === 'enabled'
+      ] as const
+    })
+  )
+  // Why: tab-wide launch/title hints are safe only before split; gate the view-mode toggle to the active leaf's agent.
+  const toggleTabViewMode = useAppStore((s) => s.toggleTabViewMode)
+  // Why: every retained TabBar observes the same hot maps; one feature-gated selector shares their projections.
+  const { nativeChatEnabled, tabAgentTypesByTabId, nativeChatTabWideFallbackUnsafeTabsById } =
+    useAppStore(useShallow(selectTabBarAgentProjections))
+  const nativeChatTranscriptIsLocalReadable = useAppStore((s) =>
+    isNativeChatTranscriptLocalReadable(getConnectionIdFromState(s, worktreeId))
+  )
+
+  return {
+    newTerminalShortcut,
+    newBrowserShortcut,
+    newSimulatorShortcut,
+    newFileShortcut,
+    openMarkdownShortcut,
+    generatedTabTitlesEnabled,
+    mobileEmulatorEnabled,
+    showMobileEmulatorIntroCallout,
+    unifiedTabs,
+    pinTab,
+    unpinTab,
+    defaultWindowsShell,
+    defaultWindowsPowerShellImplementation,
+    agentLaunchOptions,
+    windowsTerminalCapabilities,
+    showWindowsShellMenu,
+    projectRuntimeShellMenuMode,
+    resolvedGroupId,
+    statusByRelativePath,
+    unifiedTabByVisibleId,
+    workspaceHasSimulatorTab,
+    toggleTabViewMode,
+    nativeChatEnabled,
+    tabAgentTypesByTabId,
+    nativeChatTabWideFallbackUnsafeTabsById,
+    nativeChatTranscriptIsLocalReadable,
+    managedBrowserCreationEnabled,
+    mobileEmulatorCreationEnabled
+  }
+}
diff --git a/src/renderer/src/components/tab-group/TabGroupPanel.tsx b/src/renderer/src/components/tab-group/TabGroupPanel.tsx
index 07d8a86ccaf..06b083e1da0 100644
--- a/src/renderer/src/components/tab-group/TabGroupPanel.tsx
+++ b/src/renderer/src/components/tab-group/TabGroupPanel.tsx
@@ -25,6 +25,7 @@ const EditorPanel = lazy(() => import('../editor/EditorPanel'))
 export default function TabGroupPanel({
   groupId,
   worktreeId,
+  isVisible,
   isFocused,
   hasSplitGroups,
   touchesRightEdge,
@@ -40,6 +41,7 @@ export default function TabGroupPanel({
 }: {
   groupId: string
   worktreeId: string
+  isVisible: boolean
   isFocused: boolean
   hasSplitGroups: boolean
   touchesRightEdge: boolean
@@ -324,7 +326,12 @@ export default function TabGroupPanel({
                   </div>
                 }
               >
-                <EditorPanel activeFileId={activeTab.entityId} activeViewStateId={activeTab.id} />
+                <EditorPanel
+                  activeFileId={activeTab.entityId}
+                  activeViewStateId={activeTab.id}
+                  isVisible={isVisible}
+                  isCmdSaveOwner={isFocused}
+                />
               </Suspense>
             </div>
           )}
diff --git a/src/renderer/src/components/tab-group/TabGroupSplitLayout.test.ts b/src/renderer/src/components/tab-group/TabGroupSplitLayout.test.ts
index 20613d7a2a1..b0cadf8c4b0 100644
--- a/src/renderer/src/components/tab-group/TabGroupSplitLayout.test.ts
+++ b/src/renderer/src/components/tab-group/TabGroupSplitLayout.test.ts
@@ -100,6 +100,7 @@ describe('TabGroupSplitLayout', () => {
     return tabGroupPanelElement.props as {
       groupId: string
       worktreeId: string
+      isVisible: boolean
       isFocused: boolean
       hasSplitGroups: boolean
       reserveClosedExplorerToggleSpace: boolean
@@ -112,6 +113,7 @@ describe('TabGroupSplitLayout', () => {
       expect.objectContaining({
         groupId: 'group-1',
         worktreeId: 'wt-1',
+        isVisible: false,
         isFocused: false,
         hasSplitGroups: false,
         reserveClosedExplorerToggleSpace: true,
@@ -125,6 +127,7 @@ describe('TabGroupSplitLayout', () => {
       expect.objectContaining({
         groupId: 'group-1',
         worktreeId: 'wt-1',
+        isVisible: true,
         isFocused: true,
         hasSplitGroups: false,
         reserveClosedExplorerToggleSpace: true,
diff --git a/src/renderer/src/components/tab-group/TabGroupSplitLayout.tsx b/src/renderer/src/components/tab-group/TabGroupSplitLayout.tsx
index b467e582218..9a97ae673e4 100644
--- a/src/renderer/src/components/tab-group/TabGroupSplitLayout.tsx
+++ b/src/renderer/src/components/tab-group/TabGroupSplitLayout.tsx
@@ -182,6 +182,7 @@ function SplitNode({
       <TabGroupPanel
         groupId={node.groupId}
         worktreeId={worktreeId}
+        isVisible={isWorktreeActive}
         // Why: hidden worktrees stay mounted so their PTYs and split layouts
         // survive worktree switches, but only the visible worktree may own the
         // global terminal shortcuts. If an offscreen group's pane stays
diff --git a/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts b/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts
index f493f2e5807..d2dcdcb965b 100644
--- a/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts
+++ b/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts
@@ -1,5 +1,6 @@
 /* eslint-disable max-lines -- Why: keeps group-scoped activation, close, split, and tab-order rules together with the TabGroupPanel surface. */
 import { useCallback, useMemo } from 'react'
+import { toast } from 'sonner'
 import { useShallow } from 'zustand/react/shallow'
 import type { OpenFile } from '@/store/slices/editor'
 import type {
@@ -28,6 +29,7 @@ import { ensureSimulatorTab, getSimulatorTabForWorktree } from '@/lib/ensure-sim
 import { buildDuplicatedBrowserTabOptions } from '@/lib/duplicate-browser-tab-options'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { browserWorkspaceHasRemoteOwner } from '@/runtime/remote-browser-tab-ownership'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 export function recordTerminalTabGroupSplit(createdTerminal: TerminalTab | null | undefined): void {
   if (!createdTerminal) {
@@ -585,7 +587,9 @@ export function useTabGroupWorkspaceModel({
       closeToLeft,
       createSplitGroup,
       newBrowserTab: () => {
-        void openNewBrowserTabInActiveWorkspace(groupId)
+        void openNewBrowserTabInActiveWorkspace(groupId).catch((error) => {
+          toast.error(error instanceof Error ? error.message : String(error))
+        })
       },
       newSimulatorTab: worktreeState.mobileEmulatorEnabled
         ? () => {
@@ -597,6 +601,8 @@ export function useTabGroupWorkspaceModel({
             void openMobileEmulatorTab(worktreeId, {
               placement: 'rightSplit',
               targetGroupId: groupId
+            }).catch((error) => {
+              toast.error(error instanceof Error ? error.message : String(error))
             })
           }
         : undefined,
@@ -612,23 +618,36 @@ export function useTabGroupWorkspaceModel({
             return
           }
           const runtimeEnvironmentId = getRuntimeEnvironmentIdForWorktree(state, worktreeId)
+          const browserAvailability = getClientCreationActionPolicy(state, worktreeId)[
+            'managed-browser'
+          ]
+          if (browserAvailability.state !== 'enabled') {
+            throw new Error(browserAvailability.reason)
+          }
           if (
-            browserWorkspaceHasRemoteOwner(state, source.id, runtimeEnvironmentId) &&
-            (await createWebRuntimeSessionBrowserTab({
+            browserAvailability.provider === 'paired-runtime' &&
+            browserWorkspaceHasRemoteOwner(state, source.id, runtimeEnvironmentId)
+          ) {
+            const created = await createWebRuntimeSessionBrowserTab({
               worktreeId,
               environmentId: runtimeEnvironmentId,
               url: source.url,
               profileId: source.sessionProfileId,
               targetGroupId: groupId
-            }))
-          ) {
-            return
+            })
+            if (created) {
+              return
+            }
+            throw new Error('The paired runtime could not duplicate the managed browser tab.')
           }
           createBrowserTab(worktreeId, source.url, {
             ...buildDuplicatedBrowserTabOptions(source),
+            ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {}),
             targetGroupId: groupId
           })
-        })()
+        })().catch((error) => {
+          toast.error(error instanceof Error ? error.message : String(error))
+        })
       },
       // Why: target the owning group explicitly; the "+" menu can fire from an unfocused panel without updating global group focus.
       newFileTab: async () => {
diff --git a/src/renderer/src/components/task-page-github-work-item-authority-refresh.ts b/src/renderer/src/components/task-page-github-work-item-authority-refresh.ts
index 6a047760195..3f11b3b93b1 100644
--- a/src/renderer/src/components/task-page-github-work-item-authority-refresh.ts
+++ b/src/renderer/src/components/task-page-github-work-item-authority-refresh.ts
@@ -50,7 +50,7 @@ export function getTaskPageGitHubRevalidatableAuthorityItemKeys(
   const quiet = getQuietRevalidateState(queryKey)
   for (const itemKey of getTaskPageGitHubConfirmedAuthorityItemKeys()) {
     const separator = itemKey.indexOf('\0')
-    if (separator < 0) {
+    if (separator === -1) {
       continue
     }
     const repoId = itemKey.slice(0, separator)
diff --git a/src/renderer/src/components/task-page-github-work-item-mutation-composition.ts b/src/renderer/src/components/task-page-github-work-item-mutation-composition.ts
index 970e777ecd3..25616c3c059 100644
--- a/src/renderer/src/components/task-page-github-work-item-mutation-composition.ts
+++ b/src/renderer/src/components/task-page-github-work-item-mutation-composition.ts
@@ -53,7 +53,7 @@ export function pendingListOpsForFamily(
       }
       const login = pending.listOp.logins[0]
       const lastIndex = acc.findIndex((op) => op.logins.length === 1 && op.logins[0] === login)
-      if (lastIndex >= 0) {
+      if (lastIndex !== -1) {
         acc[lastIndex] = pending.listOp
       } else {
         acc.push(pending.listOp)
diff --git a/src/renderer/src/components/task-page-github-work-item-mutation-registry.ts b/src/renderer/src/components/task-page-github-work-item-mutation-registry.ts
index 58428e8746e..bfd575ea4ab 100644
--- a/src/renderer/src/components/task-page-github-work-item-mutation-registry.ts
+++ b/src/renderer/src/components/task-page-github-work-item-mutation-registry.ts
@@ -65,7 +65,7 @@ export function getTaskPageGitHubConfirmedAuthorityItemKeys(): ReadonlySet<strin
   for (const itemKey of itemSourceScopeByItemKey.keys()) {
     const separator = itemKey.indexOf('\0')
     if (
-      separator >= 0 &&
+      separator !== -1 &&
       hasConfirmedAuthorityForItem(itemKey.slice(0, separator), itemKey.slice(separator + 1))
     ) {
       keys.add(itemKey)
diff --git a/src/renderer/src/components/task-page-github-work-item-quiet-revalidate.ts b/src/renderer/src/components/task-page-github-work-item-quiet-revalidate.ts
index 6c33605b569..5895eb28f85 100644
--- a/src/renderer/src/components/task-page-github-work-item-quiet-revalidate.ts
+++ b/src/renderer/src/components/task-page-github-work-item-quiet-revalidate.ts
@@ -99,7 +99,7 @@ export function settleQuietSearchRevalidate(args: {
     }
     const separator = itemKey.indexOf('\0')
     if (
-      separator >= 0 &&
+      separator !== -1 &&
       !hasPendingTaskPageGitHubOpsForItem(itemKey.slice(0, separator), itemKey.slice(separator + 1))
     ) {
       clearConfirmedAuthorityForItem(itemKey.slice(0, separator), itemKey.slice(separator + 1))
@@ -111,7 +111,7 @@ export function settleQuietSearchRevalidate(args: {
       continue
     }
     const sep = itemKey.indexOf('\0')
-    if (sep < 0) {
+    if (sep === -1) {
       continue
     }
     const repoId = itemKey.slice(0, sep)
@@ -134,7 +134,7 @@ export function settleQuietSearchRevalidate(args: {
       continue
     }
     const sep = itemKey.indexOf('\0')
-    if (sep < 0) {
+    if (sep === -1) {
       continue
     }
     if (
diff --git a/src/renderer/src/components/task-page-linear-in-orca-issues.ts b/src/renderer/src/components/task-page-linear-in-orca-issues.ts
index 3db29f31846..38f1dbe4802 100644
--- a/src/renderer/src/components/task-page-linear-in-orca-issues.ts
+++ b/src/renderer/src/components/task-page-linear-in-orca-issues.ts
@@ -101,7 +101,7 @@ export function collectLinkedLinearIssueRefsFromWorktrees(
         (candidate.sourceContext ? getTaskSourceCacheScope(candidate.sourceContext) : '') ===
           sourceScope
     )
-    if ((workspaceId || organizationUrlKey) && unscopedIndex >= 0) {
+    if ((workspaceId || organizationUrlKey) && unscopedIndex !== -1) {
       existing[unscopedIndex] = ref
     } else if (!workspaceId && !organizationUrlKey) {
       const hasSameSourceScope = existing.some(
diff --git a/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts b/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts
index bd9aedd375c..67d2cadd3b9 100644
--- a/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts
+++ b/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts
@@ -1,16 +1,44 @@
-import { describe, expect, it } from 'vitest'
+// @vitest-environment happy-dom
+
+import React from 'react'
+import { cleanup, render, waitFor } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const environmentMocks = vi.hoisted(() => ({
+  resolveFooter: vi.fn()
+}))
+
+vi.mock('@/lib/client-environment-info', () => ({
+  resolveClientEnvironmentFooter: environmentMocks.resolveFooter
+}))
+
 import {
+  TerminalErrorToast,
   humanizeTerminalError,
+  isExplainedTerminalError,
   isSshReconnectOwnedTerminalError,
   shouldOfferDaemonRestart,
   stripSshReconnectOwnedErrorLines
 } from './TerminalErrorToast'
 
+beforeEach(() => {
+  environmentMocks.resolveFooter.mockReset()
+  environmentMocks.resolveFooter.mockResolvedValue(
+    ['---', 'Orca: 1.4.178-rc.2', 'OS: darwin 25.0.0 (arm64)', 'Shell: /bin/zsh'].join('\n')
+  )
+})
+
+afterEach(() => {
+  cleanup()
+})
+
 const SSH_FAILURE =
   "SSH connection failed: Error invoking remote method 'ssh:connect': Error: Relay package for linux-x64 not found locally."
 // Relay loss reaches reportError already IPC-wrapped, so the marker is mid-string.
 const RELAY_LOST =
   "Error invoking remote method 'pty:attach': Error: SSH connection lost, reconnecting..."
+const LEGACY_HOST_GONE =
+  "Error invoking remote method 'pty:spawn': Error: connect ENOENT \\\\?\\pipe\\orca-terminal-host-v30-14cb7f94b511"
 
 describe('isSshReconnectOwnedTerminalError', () => {
   it('matches raw ssh:connect failures and inactive-host messages', () => {
@@ -53,6 +81,75 @@ describe('humanizeTerminalError', () => {
   it('leaves other errors untouched', () => {
     expect(humanizeTerminalError('Paste failed.')).toBe('Paste failed.')
   })
+
+  it('replaces the terminal-host-gone code with copy that explains the loss', () => {
+    const humanized = humanizeTerminalError('terminal_host_gone')
+    expect(humanized).not.toContain('terminal_host_gone')
+    expect(humanized).toContain('Open a new terminal to continue')
+  })
+
+  it('humanizes an IPC-wrapped terminal-host-gone error', () => {
+    const prefix = "Error invoking remote method 'pty:spawn': Error: ("
+    const humanized = humanizeTerminalError(`${prefix}terminal_host_gone).`)
+    expect(humanized).not.toContain('terminal_host_gone')
+    expect(humanized).toContain(`${prefix}The terminal daemon`)
+    expect(humanized).toMatch(/\)\.$/)
+  })
+
+  it('humanizes a legacy host raw named-pipe error', () => {
+    const humanized = humanizeTerminalError(LEGACY_HOST_GONE)
+    expect(humanized).not.toContain('connect ENOENT')
+    expect(humanized).not.toContain('orca-terminal-host-v30')
+    expect(humanized).toContain('Open a new terminal to continue')
+  })
+
+  it('only replaces exact host-gone markers in aggregated errors', () => {
+    const humanized = humanizeTerminalError('terminal_host_gone\nterminal_host_gone_extra')
+    expect(humanized).toContain('Open a new terminal to continue')
+    expect(humanized).toContain('\nterminal_host_gone_extra')
+  })
+
+  it.each(['ENOENT', 'ECONNREFUSED'])(
+    'does not combine a %s connection failure with a host endpoint on another line',
+    (code) => {
+      const aggregated =
+        `connect ${code} \\\\?\\pipe\\unrelated\n` + 'orca-terminal-host-v30-14cb7f94b511'
+      expect(isExplainedTerminalError(aggregated)).toBe(false)
+      expect(humanizeTerminalError(aggregated)).toBe(aggregated)
+    }
+  )
+})
+
+describe('isExplainedTerminalError', () => {
+  it('suppresses the issue link for a provably dead terminal host', () => {
+    expect(isExplainedTerminalError('terminal_host_gone')).toBe(true)
+    expect(
+      isExplainedTerminalError(
+        "Error invoking remote method 'pty:spawn': Error: terminal_host_gone"
+      )
+    ).toBe(true)
+    expect(isExplainedTerminalError(LEGACY_HOST_GONE)).toBe(true)
+    expect(
+      isExplainedTerminalError('connect ECONNREFUSED /tmp/orca-terminal-host-v30-14cb7f94b511.sock')
+    ).toBe(true)
+  })
+
+  it('keeps the issue link for errors Orca cannot explain', () => {
+    expect(isExplainedTerminalError('Paste failed.')).toBe(false)
+    expect(isExplainedTerminalError('node-pty: open_slave failed: EMFILE')).toBe(false)
+    expect(isExplainedTerminalError('terminal_gone')).toBe(false)
+    expect(isExplainedTerminalError('terminal_host_gone_extra')).toBe(false)
+    expect(isExplainedTerminalError('aterminal_host_gone.')).toBe(false)
+    expect(isExplainedTerminalError('0terminal_host_gone.')).toBe(false)
+    expect(isExplainedTerminalError('_terminal_host_gone.')).toBe(false)
+    expect(isExplainedTerminalError('open ENOENT \\\\?\\pipe\\orca-terminal-host-v30-dead')).toBe(
+      false
+    )
+    expect(
+      isExplainedTerminalError('connect ETIMEDOUT \\\\?\\pipe\\orca-terminal-host-v30-dead')
+    ).toBe(false)
+    expect(isExplainedTerminalError('connect ENOENT \\\\?\\pipe\\unrelated')).toBe(false)
+  })
 })
 
 describe('stripSshReconnectOwnedErrorLines', () => {
@@ -108,3 +205,47 @@ describe('shouldOfferDaemonRestart', () => {
     expect(shouldOfferDaemonRestart('node-pty: open_slave failed: EMFILE (errno 24)')).toBe(false)
   })
 })
+
+describe('TerminalErrorToast environment footer', () => {
+  it('appends client environment details to local errors', async () => {
+    const view = render(
+      React.createElement(TerminalErrorToast, {
+        error: 'Paste failed.',
+        onDismiss: vi.fn()
+      })
+    )
+
+    await waitFor(() => expect(view.container.textContent).toContain('Orca: 1.4.178-rc.2'))
+  })
+
+  it('does not retain a prior async footer when the next error already has one', async () => {
+    const view = render(
+      React.createElement(TerminalErrorToast, {
+        error: 'First failure.',
+        onDismiss: vi.fn()
+      })
+    )
+    await waitFor(() => expect(view.container.textContent).toContain('Orca: 1.4.178-rc.2'))
+
+    view.rerender(
+      React.createElement(TerminalErrorToast, {
+        error: 'Second failure.\n\n---\nOrca: embedded\nOS: linux 6.8 (x64)',
+        onDismiss: vi.fn()
+      })
+    )
+
+    expect(view.container.textContent).toContain('Orca: embedded')
+    expect(view.container.textContent).not.toContain('Orca: 1.4.178-rc.2')
+  })
+
+  it('omits client details for every SSH reconnect-owned error', async () => {
+    render(
+      React.createElement(TerminalErrorToast, {
+        error: SSH_FAILURE,
+        onDismiss: vi.fn()
+      })
+    )
+
+    await waitFor(() => expect(environmentMocks.resolveFooter).not.toHaveBeenCalled())
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx b/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx
index 99a00e54f9a..3c65a1b56f5 100644
--- a/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx
@@ -1,4 +1,8 @@
+import { useEffect, useState } from 'react'
 import { translate } from '@/i18n/i18n'
+import { resolveClientEnvironmentFooter } from '@/lib/client-environment-info'
+import { hasClientEnvironmentFooter } from '../../../../shared/client-environment-info'
+
 const SSH_PREFIX = 'SSH connection is not active'
 // Produced by pty-connection.ts reportError() when a PTY reattach can't reach its SSH host.
 const SSH_CONNECT_FAILURE_PREFIX = 'SSH connection failed'
@@ -14,9 +18,16 @@ const STALE_DAEMON_CWD_MARKERS = [
 ]
 // Thrown by ipc/pty.ts when a persisted pane owner can't be proven alive or dead (STA-3536).
 const PANE_OWNER_UNVERIFIED_MARKER = 'terminal_pane_owner_unverified'
+// Why one source: the test and replace forms must match the same token, and a lone /g regex carries
+// lastIndex state across .test() calls. Capture the leading boundary so replacement can restore it.
+const TERMINAL_HOST_GONE_SOURCE = '(^|[^a-z0-9_])terminal_host_gone(?=$|[^a-z0-9_])'
+const TERMINAL_HOST_GONE_PATTERN = new RegExp(TERMINAL_HOST_GONE_SOURCE)
+const TERMINAL_HOST_GONE_REPLACE_PATTERN = new RegExp(TERMINAL_HOST_GONE_SOURCE, 'g')
+const LEGACY_TERMINAL_HOST_GONE_PATTERN =
+  /(^|[^a-z])connect (?:ENOENT|ECONNREFUSED) [^\r\n]*orca-terminal-host-v[^\r\n]*/i
 
 function isSshError(error: string): boolean {
-  return error.startsWith(SSH_PREFIX) || error.includes(SSH_RELAY_LOST_MARKER)
+  return isSshReconnectOwnedTerminalError(error)
 }
 
 /** A single error line the SSH reconnect banner already covers — hide instead of stacking under/over it. */
@@ -44,18 +55,46 @@ export function shouldOfferDaemonRestart(error: string): boolean {
   )
 }
 
-/** Swaps the raw pane-owner-unverified code for copy a user can act on. */
-export function humanizeTerminalError(error: string): string {
-  if (!error.includes(PANE_OWNER_UNVERIFIED_MARKER)) {
-    return error
-  }
-  return error.replace(
-    PANE_OWNER_UNVERIFIED_MARKER,
-    translate(
-      'auto.components.terminal.pane.TerminalErrorToast.7ee11bc0db',
-      "Orca couldn't confirm whether this terminal's previous session is still running, so it left the session untouched. Reopen this pane to retry."
+export function isExplainedTerminalError(error: string): boolean {
+  return error
+    .split('\n')
+    .some(
+      (line) =>
+        TERMINAL_HOST_GONE_PATTERN.test(line) || LEGACY_TERMINAL_HOST_GONE_PATTERN.test(line)
     )
+}
+
+/** Swaps raw daemon-boundary codes for copy a user can act on. */
+export function humanizeTerminalError(error: string): string {
+  let humanized = error
+  if (humanized.includes(PANE_OWNER_UNVERIFIED_MARKER)) {
+    humanized = humanized.replace(
+      PANE_OWNER_UNVERIFIED_MARKER,
+      translate(
+        'auto.components.terminal.pane.TerminalErrorToast.7ee11bc0db',
+        "Orca couldn't confirm whether this terminal's previous session is still running, so it left the session untouched. Reopen this pane to retry."
+      )
+    )
+  }
+  if (!isExplainedTerminalError(humanized)) {
+    return humanized
+  }
+  const explanation = translate(
+    'auto.components.terminal.pane.TerminalErrorToast.e16012e31e',
+    'The terminal daemon that owned this session exited, so the session and its scrollback could not be recovered. Open a new terminal to continue.'
   )
+  return humanized
+    .split('\n')
+    .map((line) =>
+      line
+        .replace(TERMINAL_HOST_GONE_REPLACE_PATTERN, (_match, prefix: string) =>
+          prefix.concat(explanation)
+        )
+        .replace(LEGACY_TERMINAL_HOST_GONE_PATTERN, (_match, prefix: string) =>
+          prefix.concat(explanation)
+        )
+    )
+    .join('\n')
 }
 
 export function TerminalErrorToast({
@@ -69,7 +108,31 @@ export function TerminalErrorToast({
 }): React.JSX.Element {
   const ssh = isSshError(error)
   const showDaemonRestart = !ssh && onRestartDaemon && shouldOfferDaemonRestart(error)
+  // Restart cannot recover a session after its owning daemon exits.
+  const showIssueLink = !ssh && !showDaemonRestart && !isExplainedTerminalError(error)
   const displayError = humanizeTerminalError(error)
+  const [environmentFooter, setEnvironmentFooter] = useState<{
+    error: string
+    footer: string
+  } | null>(null)
+
+  // Why: a select-all copy should carry details loaded asynchronously from preload.
+  useEffect(() => {
+    if (ssh || hasClientEnvironmentFooter(displayError)) {
+      return
+    }
+    let cancelled = false
+    void resolveClientEnvironmentFooter().then((footer) => {
+      if (!cancelled) {
+        setEnvironmentFooter({ error: displayError, footer })
+      }
+    })
+    return () => {
+      cancelled = true
+    }
+  }, [displayError, ssh])
+
+  const footer = environmentFooter?.error === displayError ? environmentFooter.footer : ''
 
   return (
     <div
@@ -101,7 +164,7 @@ export function TerminalErrorToast({
                 'Restart the terminal daemon from here to clear stale daemon state.'
               )}
             </>
-          ) : !ssh ? (
+          ) : showIssueLink ? (
             <>
               {'\n'}
               {translate(
@@ -120,6 +183,7 @@ export function TerminalErrorToast({
               .
             </>
           ) : null}
+          {!ssh && footer ? `\n\n${footer}` : null}
         </span>
         {showDaemonRestart ? (
           <button
diff --git a/src/renderer/src/components/terminal-pane/TerminalLinkActionPopover.test.tsx b/src/renderer/src/components/terminal-pane/TerminalLinkActionPopover.test.tsx
index 197f5da8269..e4fab4bedb4 100644
--- a/src/renderer/src/components/terminal-pane/TerminalLinkActionPopover.test.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalLinkActionPopover.test.tsx
@@ -1,13 +1,20 @@
 // @vitest-environment happy-dom
 import type { ReactNode } from 'react'
-import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { BROWSER_TERMINAL_LINK_ACTIONS_SETTINGS_TARGET_ID } from '@/lib/settings-navigation-types'
 import type { TerminalLinkActionRequest } from './terminal-link-action-request'
 
 const mocks = vi.hoisted(() => ({
   openSettingsPage: vi.fn(),
-  openSettingsTarget: vi.fn()
+  openSettingsTarget: vi.fn(),
+  toastError: vi.fn(),
+  toastSuccess: vi.fn(),
+  writeClipboardText: vi.fn()
+}))
+
+vi.mock('sonner', () => ({
+  toast: { error: mocks.toastError, success: mocks.toastSuccess }
 }))
 
 vi.mock('@/store', () => ({
@@ -141,6 +148,102 @@ describe('TerminalLinkActionPopover', () => {
     ).toBeTruthy()
   })
 
+  it('copies the resolved URL without closing the popover', async () => {
+    vi.stubGlobal('navigator', { userAgent: 'Macintosh' })
+    Object.assign(window, { api: { ui: { writeClipboardText: mocks.writeClipboardText } } })
+    mocks.writeClipboardText.mockResolvedValue(undefined)
+    const onClose = vi.fn()
+    const focusTerminal = vi.fn()
+    const request: TerminalLinkActionRequest = {
+      paneId: 1,
+      anchorX: 100,
+      anchorY: 200,
+      destination: 'https://example.com/hidden-destination',
+      kind: 'url',
+      primary: { label: 'Open link', run: vi.fn() },
+      focusTerminal
+    }
+
+    render(<TerminalLinkActionPopover request={request} onClose={onClose} />)
+    fireEvent.click(screen.getByRole('button', { name: 'Copy link' }))
+
+    await waitFor(() => expect(mocks.writeClipboardText).toHaveBeenCalledWith(request.destination))
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Copied' })).toBeTruthy())
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Copied link')
+    expect(onClose).not.toHaveBeenCalled()
+    expect(focusTerminal).not.toHaveBeenCalled()
+  })
+
+  it('ignores duplicate copy clicks while the clipboard write is in flight', async () => {
+    vi.stubGlobal('navigator', { userAgent: 'Macintosh' })
+    Object.assign(window, { api: { ui: { writeClipboardText: mocks.writeClipboardText } } })
+    let resolveWrite: (() => void) | undefined
+    mocks.writeClipboardText.mockReturnValue(
+      new Promise<void>((resolve) => {
+        resolveWrite = resolve
+      })
+    )
+    const request: TerminalLinkActionRequest = {
+      paneId: 1,
+      anchorX: 100,
+      anchorY: 200,
+      destination: 'https://example.com/hidden-destination',
+      kind: 'url',
+      primary: { label: 'Open link', run: vi.fn() },
+      focusTerminal: vi.fn()
+    }
+
+    render(<TerminalLinkActionPopover request={request} onClose={vi.fn()} />)
+    const copyButton = screen.getByRole('button', { name: 'Copy link' })
+    fireEvent.click(copyButton)
+    fireEvent.click(copyButton)
+
+    expect(mocks.writeClipboardText).toHaveBeenCalledOnce()
+    resolveWrite?.()
+    await waitFor(() => expect(mocks.toastSuccess).toHaveBeenCalledOnce())
+    fireEvent.click(copyButton)
+    await waitFor(() => expect(mocks.writeClipboardText).toHaveBeenCalledTimes(2))
+  })
+
+  it('shows a failure toast when copying fails', async () => {
+    vi.stubGlobal('navigator', { userAgent: 'Macintosh' })
+    Object.assign(window, { api: { ui: { writeClipboardText: mocks.writeClipboardText } } })
+    mocks.writeClipboardText.mockRejectedValue(new Error('denied'))
+    const request: TerminalLinkActionRequest = {
+      paneId: 1,
+      anchorX: 100,
+      anchorY: 200,
+      destination: 'https://example.com/hidden-destination',
+      kind: 'url',
+      primary: { label: 'Open link', run: vi.fn() },
+      focusTerminal: vi.fn()
+    }
+
+    render(<TerminalLinkActionPopover request={request} onClose={vi.fn()} />)
+    fireEvent.click(screen.getByRole('button', { name: 'Copy link' }))
+
+    await waitFor(() => expect(mocks.toastError).toHaveBeenCalledWith('Failed to copy link'))
+    fireEvent.click(screen.getByRole('button', { name: 'Copy link' }))
+    await waitFor(() => expect(mocks.writeClipboardText).toHaveBeenCalledTimes(2))
+  })
+
+  it('does not offer copy link for non-URL destinations', () => {
+    vi.stubGlobal('navigator', { userAgent: 'Macintosh' })
+    const request: TerminalLinkActionRequest = {
+      paneId: 1,
+      anchorX: 100,
+      anchorY: 200,
+      destination: '/tmp/example.ts',
+      kind: 'file',
+      primary: { label: 'Open file', run: vi.fn() },
+      focusTerminal: vi.fn()
+    }
+
+    render(<TerminalLinkActionPopover request={request} onClose={vi.fn()} />)
+
+    expect(screen.queryByRole('button', { name: 'Copy link' })).toBeNull()
+  })
+
   it('opens the terminal link setting from the compact settings button', () => {
     vi.stubGlobal('navigator', { userAgent: 'Macintosh' })
     const onClose = vi.fn()
diff --git a/src/renderer/src/components/terminal-pane/TerminalLinkActionPopover.tsx b/src/renderer/src/components/terminal-pane/TerminalLinkActionPopover.tsx
index c313edb545a..4eab243241a 100644
--- a/src/renderer/src/components/terminal-pane/TerminalLinkActionPopover.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalLinkActionPopover.tsx
@@ -1,9 +1,11 @@
-import { useMemo } from 'react'
-import { ExternalLink, Globe, Settings } from 'lucide-react'
+import { useMemo, useRef } from 'react'
+import { Check, Copy, ExternalLink, Globe, Settings } from 'lucide-react'
+import { toast } from 'sonner'
 import { ShortcutKeyCombo } from '@/components/ShortcutKeyCombo'
 import { Button } from '@/components/ui/button'
 import { Popover, PopoverAnchor, PopoverContent } from '@/components/ui/popover'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { useClipboardTextCopyFeedback } from '@/hooks/use-clipboard-text-copy-feedback'
 import { translate } from '@/i18n/i18n'
 import { BROWSER_TERMINAL_LINK_ACTIONS_SETTINGS_TARGET_ID } from '@/lib/settings-navigation-types'
 import { useAppStore } from '@/store'
@@ -48,6 +50,9 @@ export function TerminalLinkActionPopover({
 }: TerminalLinkActionPopoverProps): React.JSX.Element {
   const openSettingsPage = useAppStore((state) => state.openSettingsPage)
   const openSettingsTarget = useAppStore((state) => state.openSettingsTarget)
+  const copyableDestination = request?.kind === 'url' ? request.destination : ''
+  const { copyText, status: copyStatus } = useClipboardTextCopyFeedback(copyableDestination)
+  const copyInFlightRef = useRef(false)
   const virtualRef = useMemo(
     () => ({
       current: {
@@ -67,6 +72,36 @@ export function TerminalLinkActionPopover({
     'auto.components.terminal.pane.TerminalLinkActionPopover.terminalLinkSettings',
     'Terminal link settings'
   )
+  const copyLabel =
+    copyStatus === 'copied'
+      ? translate('auto.components.terminal.pane.TerminalLinkActionPopover.copied', 'Copied')
+      : translate('auto.components.terminal.pane.TerminalLinkActionPopover.copyLink', 'Copy link')
+
+  const copyDestination = async (): Promise<void> => {
+    if (copyInFlightRef.current) {
+      return
+    }
+    copyInFlightRef.current = true
+    try {
+      if (await copyText()) {
+        toast.success(
+          translate(
+            'auto.components.terminal.pane.TerminalLinkActionPopover.copiedLink',
+            'Copied link'
+          )
+        )
+        return
+      }
+      toast.error(
+        translate(
+          'auto.components.terminal.pane.TerminalLinkActionPopover.copyLinkFailed',
+          'Failed to copy link'
+        )
+      )
+    } finally {
+      copyInFlightRef.current = false
+    }
+  }
 
   const openTerminalLinkSettings = (): void => {
     onClose()
@@ -104,6 +139,24 @@ export function TerminalLinkActionPopover({
             >
               {request.destination}
             </span>
+            {request.kind === 'url' ? (
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <Button
+                    aria-label={copyLabel}
+                    className="text-muted-foreground"
+                    size="icon-xs"
+                    variant="ghost"
+                    onClick={() => void copyDestination()}
+                  >
+                    {copyStatus === 'copied' ? <Check /> : <Copy />}
+                  </Button>
+                </TooltipTrigger>
+                <TooltipContent side="top" sideOffset={4}>
+                  {copyLabel}
+                </TooltipContent>
+              </Tooltip>
+            ) : null}
             <Tooltip>
               <TooltipTrigger asChild>
                 <Button
diff --git a/src/renderer/src/components/terminal-pane/TerminalPane.tsx b/src/renderer/src/components/terminal-pane/TerminalPane.tsx
index 28d36689bcf..323a3dc497e 100644
--- a/src/renderer/src/components/terminal-pane/TerminalPane.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalPane.tsx
@@ -32,16 +32,8 @@ import TerminalSearch from '@/components/TerminalSearch'
 import type { PtyTransport } from './pty-transport'
 import type { PtyTransportRecoveryState } from './pty-transport-types'
 import { fitPanes, isWindowsUserAgent } from './pane-helpers'
-import { getConnectionId, getConnectionIdFromState } from '@/lib/connection-context'
-import {
-  getExplicitRuntimeEnvironmentIdForWorktree,
-  getRuntimeEnvironmentIdForWorktree
-} from '@/lib/worktree-runtime-owner'
-import {
-  selectRuntimeAwareSshStatus,
-  selectRuntimeAwareSshTargetLabel,
-  selectRuntimeAwareSshTargetRemoved
-} from '@/store/slices/runtime-environment-ssh'
+import { getConnectionId } from '@/lib/connection-context'
+import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { hydrateRuntimeEnvironmentSshState } from '@/runtime/runtime-environment-ssh-state'
 import { handleInternalTerminalFileDrop } from './terminal-drop-handler'
 import { recordTerminalUserInputForLeaf } from './terminal-input-activity'
@@ -123,7 +115,6 @@ import {
   resolveNativeChatLeafRoute,
   type NativeChatLeafRoute
 } from '../native-chat/native-chat-leaf-routing'
-import { isNativeChatTranscriptLocalReadable } from '@/lib/native-chat-transcript-readability'
 import { resolvePaneKeyForManager } from '@/lib/pane-manager/pane-key-resolution'
 import { safeFit, safeFitAndThen } from '@/lib/pane-manager/pane-tree-ops'
 import { clearTerminalScrollbackAndFollowOutput } from '@/lib/pane-manager/terminal-scrollback-clear'
@@ -169,18 +160,17 @@ import {
 import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
 import {
   getRepoExecutionHostId,
-  isRuntimeOwnedSshTargetId,
   LOCAL_EXECUTION_HOST_ID,
   type ExecutionHostId
 } from '../../../../shared/execution-host'
 import { getRepoIdFromWorktreeId } from '../../../../shared/worktree-id'
-import { useRepoById } from '@/store/selectors'
+import { useProjectHostSetupProjection, useRepoById } from '@/store/selectors'
 import { refitAndRefreshAllTerminalPanes } from '@/lib/pane-manager/pane-manager-registry'
 import {
   getTerminalQuickCommandScope,
-  isTerminalQuickCommandComplete,
-  terminalQuickCommandMatchesRepo
+  isTerminalQuickCommandComplete
 } from '../../../../shared/terminal-quick-commands'
+import { terminalQuickCommandMatchesWorkspaceProject } from '@/lib/terminal-quick-command-project-scope'
 import {
   createTerminalQuickCommandDraft,
   TerminalQuickCommandDialog
@@ -243,6 +233,7 @@ import {
   getCachedUnifiedTerminalTabForWorktree
 } from './terminal-unified-tab-lookup'
 import { resolveNativeChatLeafTitleAgent } from './native-chat-leaf-title-agent'
+import { selectTerminalPaneHostState } from './terminal-pane-host-state'
 import {
   isXtermHelperTextarea,
   releaseTerminalFocusForOutsidePointerDown,
@@ -349,37 +340,14 @@ function TerminalPane(
   const isRendererVisible = isVisible && isWorktreeActive
   const isVisibleRef = useRef(isRendererVisible)
   isVisibleRef.current = isRendererVisible
-  const sshReconnectTargetId = useAppStore((store) => {
-    const connectionId = getConnectionIdFromState(store, worktreeId)
-    // Why: runtime-owned SSH targets are internal plumbing users can't connect to, so a reconnect prompt would mislead.
-    if (!connectionId || isRuntimeOwnedSshTargetId(connectionId)) {
-      return null
-    }
-    return connectionId
-  })
-  const nativeChatTranscriptIsLocalReadable = useAppStore((store) =>
-    isNativeChatTranscriptLocalReadable(getConnectionIdFromState(store, worktreeId))
-  )
-  // Which machine's SSH store this target belongs to: a remote server's per-environment bucket, or null for this machine's local SSH maps.
-  const sshReconnectEnvironmentId = useAppStore((store) =>
-    sshReconnectTargetId ? getExplicitRuntimeEnvironmentIdForWorktree(store, worktreeId) : null
-  )
-  const sshReconnectStatus = useAppStore((store) =>
-    sshReconnectTargetId
-      ? selectRuntimeAwareSshStatus(store, sshReconnectEnvironmentId, sshReconnectTargetId)
-      : null
-  )
-  const sshReconnectTargetLabel = useAppStore((store) =>
-    sshReconnectTargetId
-      ? selectRuntimeAwareSshTargetLabel(store, sshReconnectEnvironmentId, sshReconnectTargetId)
-      : ''
-  )
-  // Why: a ghost target (removed from its host) can only fail reconnect, so the overlay offers Remove instead of Connect.
-  const sshReconnectTargetRemoved = useAppStore((store) =>
-    sshReconnectTargetId
-      ? selectRuntimeAwareSshTargetRemoved(store, sshReconnectEnvironmentId, sshReconnectTargetId)
-      : false
-  )
+  const {
+    nativeChatTranscriptIsLocalReadable,
+    sshReconnectEnvironmentId,
+    sshReconnectStatus,
+    sshReconnectTargetId,
+    sshReconnectTargetLabel,
+    sshReconnectTargetRemoved
+  } = useAppStore(useShallow((store) => selectTerminalPaneHostState(store, worktreeId)))
   useEffect(() => {
     if (!sshReconnectEnvironmentId) {
       return
@@ -819,6 +787,7 @@ function TerminalPane(
   const quickCommandRepoId =
     worktreeId === FLOATING_TERMINAL_WORKTREE_ID ? null : getRepoIdFromWorktreeId(worktreeId)
   const quickCommandRepo = useRepoById(quickCommandRepoId)
+  const projectHostSetupProjection = useProjectHostSetupProjection()
   const quickCommandRepoLabel = quickCommandRepo
     ? quickCommandRepo.displayName || quickCommandRepo.path
     : quickCommandRepoId
@@ -1593,6 +1562,7 @@ function TerminalPane(
         worktreeId,
         cwd,
         startup: CODEX_ACCOUNT_RESTART_STARTUP,
+        mountFollowsTerminalPark: false,
         paneTransportsRef,
         paneMode2031Ref,
         paneKittyKeyboardModesRef,
@@ -2550,6 +2520,7 @@ function TerminalPane(
     rightClickToPaste
   })
   const {
+    executionHostId: quickCommandExecutionHostId,
     hosts: quickCommandHosts,
     refreshRemoteHost: refreshQuickCommandRemoteHost,
     remoteHostLoadFailed: quickCommandHostLoadFailed,
@@ -2568,12 +2539,23 @@ function TerminalPane(
           repoCommands: commands.filter((command) => {
             const scope = getTerminalQuickCommandScope(command)
             return (
-              scope.type === 'repo' && terminalQuickCommandMatchesRepo(command, quickCommandRepoId)
+              scope.type === 'repo' &&
+              terminalQuickCommandMatchesWorkspaceProject(command, {
+                commandHostId: host.hostId,
+                projectHostSetups: projectHostSetupProjection.setups,
+                targetHostId: quickCommandExecutionHostId,
+                targetRepoId: quickCommandRepoId
+              })
             )
           })
         }
       }),
-    [quickCommandHosts, quickCommandRepoId]
+    [
+      projectHostSetupProjection.setups,
+      quickCommandExecutionHostId,
+      quickCommandHosts,
+      quickCommandRepoId
+    ]
   )
   useEffect(() => {
     if (contextMenu.open) {
@@ -3052,6 +3034,7 @@ function TerminalPane(
             <div className="absolute inset-0 z-10 flex min-h-0 min-w-0 bg-background">
               <NativeChatView
                 terminalTabId={tabId}
+                isVisible={isRendererVisible}
                 paneKey={makePaneKey(tabId, chatPane.leafId)}
                 targetPtyId={chatPanePtyId}
                 launchAgent={chatPaneLaunchAgent}
diff --git a/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx b/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx
index 5dbc1482af9..2196f7ed094 100644
--- a/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx
@@ -100,11 +100,24 @@ const TerminalPaneOverlayLayer = memo(function TerminalPaneOverlayLayer({
     return entries
   }, [groupActiveTabById, unifiedTabs])
 
+  const activeTerminalTabId = useMemo(() => {
+    if (!activeGroupId) {
+      return null
+    }
+    for (const [terminalTabId, assignment] of assignments) {
+      if (assignment.groupId === activeGroupId && assignment.isActiveInGroup) {
+        return terminalTabId
+      }
+    }
+    return null
+  }, [activeGroupId, assignments])
+
   const parkedTerminalTabIds = useTerminalTabColdParking({
     worktreeId,
     terminalTabs,
     assignments,
     isWorktreeActive,
+    activeTerminalTabId,
     coldParkTerminalPanes,
     isForceParked,
     shouldMeasureHiddenWorktree,
diff --git a/src/renderer/src/components/terminal-pane/agent-process-inspection-queue.ts b/src/renderer/src/components/terminal-pane/agent-process-inspection-queue.ts
index 797407b69a3..5c581ddc652 100644
--- a/src/renderer/src/components/terminal-pane/agent-process-inspection-queue.ts
+++ b/src/renderer/src/components/terminal-pane/agent-process-inspection-queue.ts
@@ -45,7 +45,7 @@ function pumpInspectionQueue(): void {
 
   const priorityIndex = inspectionQueue.findIndex((task) => task.priority === 'pending-title')
   const next =
-    priorityIndex >= 0 ? inspectionQueue.splice(priorityIndex, 1)[0] : inspectionQueue.shift()
+    priorityIndex !== -1 ? inspectionQueue.splice(priorityIndex, 1)[0] : inspectionQueue.shift()
   if (!next) {
     return
   }
diff --git a/src/renderer/src/components/terminal-pane/deferred-reattach-live-data-queue.test.ts b/src/renderer/src/components/terminal-pane/deferred-reattach-live-data-queue.test.ts
new file mode 100644
index 00000000000..539348edf8b
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/deferred-reattach-live-data-queue.test.ts
@@ -0,0 +1,336 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  DeferredReattachLiveDataQueue,
+  MAX_DEFERRED_REATTACH_LIVE_CHARS,
+  MAX_DEFERRED_REATTACH_LIVE_CHUNKS,
+  type DeferredReattachLiveDataChunk
+} from './deferred-reattach-live-data-queue'
+
+function createChunk(
+  data: string,
+  streamGeneration = 1,
+  options: Omit<DeferredReattachLiveDataChunk, 'data' | 'streamGeneration'> = {
+    ptyId: 'pty-1'
+  }
+): DeferredReattachLiveDataChunk {
+  return { data, streamGeneration, ...options }
+}
+
+function releaseTransferred(chunks: DeferredReattachLiveDataChunk[]): void {
+  for (const chunk of chunks) {
+    chunk.ackCredit?.()
+  }
+}
+
+class ReferenceDeferredQueue {
+  private chunks: DeferredReattachLiveDataChunk[] = []
+  private retainedChars = 0
+
+  enqueue(chunk: DeferredReattachLiveDataChunk): void {
+    this.chunks = this.chunks.filter((queued) => {
+      const keep = queued.streamGeneration === chunk.streamGeneration
+      if (!keep) {
+        queued.ackCredit?.()
+      }
+      return keep
+    })
+    this.retainedChars = this.chunks.reduce((total, queued) => total + queued.data.length, 0)
+    const oversized = chunk.data.length > MAX_DEFERRED_REATTACH_LIVE_CHARS
+    this.chunks.push({
+      ...chunk,
+      data: oversized ? chunk.data.slice(-MAX_DEFERRED_REATTACH_LIVE_CHARS) : chunk.data
+    })
+    this.retainedChars += this.chunks.at(-1)?.data.length ?? 0
+
+    let dropped = oversized
+    while (
+      this.chunks.length > 1 &&
+      (this.chunks.length > MAX_DEFERRED_REATTACH_LIVE_CHUNKS ||
+        this.retainedChars > MAX_DEFERRED_REATTACH_LIVE_CHARS)
+    ) {
+      const removed = this.chunks.shift()
+      this.retainedChars -= removed?.data.length ?? 0
+      removed?.ackCredit?.()
+      dropped = true
+    }
+    if (dropped && this.chunks[0]) {
+      this.chunks[0].meta = { ...this.chunks[0].meta, droppedOutput: true }
+    }
+  }
+
+  takeAll(): DeferredReattachLiveDataChunk[] {
+    const chunks = this.chunks
+    this.chunks = []
+    this.retainedChars = 0
+    return chunks
+  }
+
+  discard(): void {
+    for (const chunk of this.takeAll()) {
+      chunk.ackCredit?.()
+    }
+  }
+}
+
+function normalizedChunks(chunks: DeferredReattachLiveDataChunk[]): unknown[] {
+  return chunks.map(({ ackCredit: _ackCredit, ...chunk }) => chunk)
+}
+
+function createSeededRandom(seed: number): () => number {
+  let state = seed >>> 0
+  return () => {
+    state ^= state << 13
+    state ^= state >>> 17
+    state ^= state << 5
+    return state >>> 0
+  }
+}
+
+describe('deferred reattach live data queue', () => {
+  it('does not rescan or shift the live queue while saturated', () => {
+    const originalFilter = Array.prototype.filter
+    const originalReduce = Array.prototype.reduce
+    const originalShift = Array.prototype.shift
+    const queue = new DeferredReattachLiveDataQueue()
+
+    try {
+      for (const method of ['filter', 'reduce', 'shift'] as const) {
+        Object.defineProperty(Array.prototype, method, {
+          configurable: true,
+          writable: true,
+          value() {
+            throw new Error(`Array.${method} should not run on enqueue`)
+          }
+        })
+      }
+      for (let index = 0; index < MAX_DEFERRED_REATTACH_LIVE_CHUNKS * 2; index += 1) {
+        queue.enqueue(createChunk('x'.repeat(512)))
+      }
+    } finally {
+      Object.defineProperties(Array.prototype, {
+        filter: { configurable: true, writable: true, value: originalFilter },
+        reduce: { configurable: true, writable: true, value: originalReduce },
+        shift: { configurable: true, writable: true, value: originalShift }
+      })
+    }
+
+    expect(queue.takeAll()).toHaveLength(MAX_DEFERRED_REATTACH_LIVE_CHUNKS)
+  })
+
+  it('evicts whole chunks only after the count and character boundaries are exceeded', () => {
+    const countQueue = new DeferredReattachLiveDataQueue()
+    const countAcks = Array.from({ length: MAX_DEFERRED_REATTACH_LIVE_CHUNKS + 1 }, () => vi.fn())
+    for (let index = 0; index < MAX_DEFERRED_REATTACH_LIVE_CHUNKS; index += 1) {
+      countQueue.enqueue(
+        createChunk('', 1, { ptyId: 'pty-1', meta: { seq: index }, ackCredit: countAcks[index] })
+      )
+    }
+
+    expect(countQueue.getStorageForTest().retainedChunks).toBe(MAX_DEFERRED_REATTACH_LIVE_CHUNKS)
+    expect(countAcks.every((ack) => ack.mock.calls.length === 0)).toBe(true)
+    countQueue.enqueue(
+      createChunk('', 1, {
+        ptyId: 'pty-1',
+        meta: { seq: MAX_DEFERRED_REATTACH_LIVE_CHUNKS },
+        ackCredit: countAcks.at(-1)
+      })
+    )
+
+    const counted = countQueue.takeAll()
+    expect(countAcks[0]).toHaveBeenCalledOnce()
+    expect(counted).toHaveLength(MAX_DEFERRED_REATTACH_LIVE_CHUNKS)
+    expect(counted[0]?.meta).toEqual({ seq: 1, droppedOutput: true })
+    expect(counted.at(-1)?.meta?.seq).toBe(MAX_DEFERRED_REATTACH_LIVE_CHUNKS)
+    releaseTransferred(counted)
+    expect(countAcks.every((ack) => ack.mock.calls.length === 1)).toBe(true)
+
+    const charQueue = new DeferredReattachLiveDataQueue()
+    const fullAck = vi.fn()
+    const tailAck = vi.fn()
+    charQueue.enqueue(
+      createChunk('a'.repeat(MAX_DEFERRED_REATTACH_LIVE_CHARS), 1, {
+        ptyId: 'pty-1',
+        ackCredit: fullAck
+      })
+    )
+    expect(charQueue.getStorageForTest().retainedChars).toBe(MAX_DEFERRED_REATTACH_LIVE_CHARS)
+    charQueue.enqueue(createChunk('tail', 1, { ptyId: 'pty-1', ackCredit: tailAck }))
+
+    const characterBounded = charQueue.takeAll()
+    expect(fullAck).toHaveBeenCalledOnce()
+    expect(characterBounded.map((chunk) => chunk.data)).toEqual(['tail'])
+    expect(characterBounded[0]?.meta).toEqual({ droppedOutput: true })
+    expect(tailAck).not.toHaveBeenCalled()
+    releaseTransferred(characterBounded)
+    expect(tailAck).toHaveBeenCalledOnce()
+  })
+
+  it('keeps the exact oversized tail and preserves metadata under the gap marker', () => {
+    const queue = new DeferredReattachLiveDataQueue()
+    const ackCredit = vi.fn()
+    const meta = { seq: 9, rawLength: MAX_DEFERRED_REATTACH_LIVE_CHARS + 1, background: true }
+    queue.enqueue(
+      createChunk(`P${'T'.repeat(MAX_DEFERRED_REATTACH_LIVE_CHARS)}`, 3, {
+        ptyId: 'pty-3',
+        meta,
+        ackCredit
+      })
+    )
+
+    const retained = queue.takeAll()
+    expect(retained).toHaveLength(1)
+    expect(retained[0]?.data).toBe('T'.repeat(MAX_DEFERRED_REATTACH_LIVE_CHARS))
+    expect(retained[0]?.meta).toEqual({ ...meta, droppedOutput: true })
+    expect(meta).not.toHaveProperty('droppedOutput')
+    expect(ackCredit).not.toHaveBeenCalled()
+    releaseTransferred(retained)
+    expect(ackCredit).toHaveBeenCalledOnce()
+  })
+
+  it('releases a replaced generation exactly once without carrying its gap marker forward', () => {
+    const queue = new DeferredReattachLiveDataQueue()
+    const firstAck = vi.fn()
+    const secondAck = vi.fn()
+    const thirdAck = vi.fn()
+    const replacementAck = vi.fn()
+    queue.enqueue(createChunk('a'.repeat(300 * 1024), 4, { ptyId: 'old', ackCredit: firstAck }))
+    queue.enqueue(createChunk('b'.repeat(300 * 1024), 4, { ptyId: 'old', ackCredit: secondAck }))
+    queue.enqueue(createChunk('c', 4, { ptyId: 'old', ackCredit: thirdAck }))
+
+    expect(firstAck).toHaveBeenCalledOnce()
+    queue.enqueue(
+      createChunk('replacement', 5, {
+        ptyId: 'new',
+        meta: { seq: 5, transformed: true },
+        ackCredit: replacementAck
+      })
+    )
+
+    const replacement = queue.takeAll()
+    expect(firstAck).toHaveBeenCalledOnce()
+    expect(secondAck).toHaveBeenCalledOnce()
+    expect(thirdAck).toHaveBeenCalledTimes(1)
+    expect(replacement).toHaveLength(1)
+    expect(replacement[0]?.data).toBe('replacement')
+    expect(replacement[0]?.meta).toEqual({ seq: 5, transformed: true })
+    expect(replacementAck).not.toHaveBeenCalled()
+    releaseTransferred(replacement)
+    expect(replacementAck).toHaveBeenCalledOnce()
+  })
+
+  it('compacts a cleared prefix repeatedly while settling every credit once', () => {
+    const queue = new DeferredReattachLiveDataQueue()
+    const acks = Array.from({ length: 513 }, () => vi.fn())
+    const fullChunk = 'x'.repeat(MAX_DEFERRED_REATTACH_LIVE_CHARS)
+    for (let index = 0; index < acks.length; index += 1) {
+      queue.enqueue(
+        createChunk(fullChunk, 1, {
+          ptyId: 'pty-1',
+          ackCredit: acks[index]
+        })
+      )
+      const storage = queue.getStorageForTest()
+      expect(storage.retainedChunks).toBe(1)
+      expect(storage.retainedChars).toBe(MAX_DEFERRED_REATTACH_LIVE_CHARS)
+      expect(storage.backingLength).toBeLessThanOrEqual(64)
+    }
+
+    const retained = queue.takeAll()
+    expect(retained).toHaveLength(1)
+    releaseTransferred(retained)
+    expect(acks.every((ack) => ack.mock.calls.length === 1)).toBe(true)
+    expect(queue.getStorageForTest()).toEqual({
+      backingLength: 0,
+      head: 0,
+      retainedChars: 0,
+      retainedChunks: 0
+    })
+  })
+
+  it('transfers credits from takeAll but settles retained credits on discard', () => {
+    const queue = new DeferredReattachLiveDataQueue()
+    const transferredAcks = [vi.fn(), vi.fn()]
+    queue.enqueue(createChunk('first', 1, { ptyId: 'pty-1', ackCredit: transferredAcks[0] }))
+    queue.enqueue(createChunk('second', 1, { ptyId: 'pty-1', ackCredit: transferredAcks[1] }))
+
+    const transferred = queue.takeAll()
+    expect(transferred.map((chunk) => chunk.data)).toEqual(['first', 'second'])
+    expect(transferredAcks.every((ack) => ack.mock.calls.length === 0)).toBe(true)
+
+    const discardedAcks = [vi.fn(), vi.fn()]
+    queue.enqueue(createChunk('third', 2, { ptyId: 'pty-2', ackCredit: discardedAcks[0] }))
+    queue.enqueue(createChunk('fourth', 2, { ptyId: 'pty-2', ackCredit: discardedAcks[1] }))
+    queue.discard()
+    queue.discard()
+    expect(discardedAcks.every((ack) => ack.mock.calls.length === 1)).toBe(true)
+    expect(transferredAcks.every((ack) => ack.mock.calls.length === 0)).toBe(true)
+    releaseTransferred(transferred)
+    expect(transferredAcks.every((ack) => ack.mock.calls.length === 1)).toBe(true)
+  })
+
+  it('matches the previous algorithm across a seeded adversarial stream', () => {
+    const queue = new DeferredReattachLiveDataQueue()
+    const reference = new ReferenceDeferredQueue()
+    const random = createSeededRandom(0x5eedc0de)
+    const queueAcks = new Map<number, number>()
+    const referenceAcks = new Map<number, number>()
+    let generation = 1
+
+    const recordAck =
+      (acks: Map<number, number>, index: number): (() => void) =>
+      () => {
+        acks.set(index, (acks.get(index) ?? 0) + 1)
+      }
+    for (let index = 0; index < 5_000; index += 1) {
+      const value = random()
+      if (index > 0 && value % 997 === 0) {
+        generation += 1
+      }
+      const bucket = value % 100
+      const length =
+        index < 1_500
+          ? value % 3
+          : bucket < 70
+            ? value % 1_025
+            : bucket < 90
+              ? 4 * 1024
+              : bucket < 97
+                ? 64 * 1024
+                : bucket < 99
+                  ? 300 * 1024
+                  : MAX_DEFERRED_REATTACH_LIVE_CHARS + 1
+      const data = String.fromCharCode(65 + (index % 26)).repeat(length)
+      const base = {
+        data,
+        ptyId: `pty-${generation % 3}`,
+        streamGeneration: generation,
+        meta: {
+          seq: index,
+          rawLength: length,
+          ...(value % 7 === 0 ? { background: true } : {})
+        }
+      }
+      queue.enqueue({ ...base, ackCredit: recordAck(queueAcks, index) })
+      reference.enqueue({ ...base, ackCredit: recordAck(referenceAcks, index) })
+
+      if ((index + 1) % 1_000 !== 0) {
+        continue
+      }
+      if ((index + 1) % 2_000 === 0) {
+        queue.discard()
+        reference.discard()
+      } else {
+        const actual = queue.takeAll()
+        const expected = reference.takeAll()
+        expect(normalizedChunks(actual)).toEqual(normalizedChunks(expected))
+        releaseTransferred(actual)
+        releaseTransferred(expected)
+      }
+      expect(queueAcks).toEqual(referenceAcks)
+    }
+
+    expect(queueAcks).toEqual(referenceAcks)
+    expect([...queueAcks.values()].every((count) => count === 1)).toBe(true)
+    expect(queueAcks.size).toBe(5_000)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/deferred-reattach-live-data-queue.ts b/src/renderer/src/components/terminal-pane/deferred-reattach-live-data-queue.ts
new file mode 100644
index 00000000000..3045569b1e1
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/deferred-reattach-live-data-queue.ts
@@ -0,0 +1,111 @@
+import type { PtyDataMeta } from './pty-dispatcher'
+
+export const MAX_DEFERRED_REATTACH_LIVE_CHARS = 512 * 1024
+export const MAX_DEFERRED_REATTACH_LIVE_CHUNKS = 1_024
+
+const COMPACTION_MIN_HEAD = 64
+
+export type DeferredReattachLiveDataChunk = {
+  data: string
+  ptyId: string | null
+  streamGeneration: number
+  meta?: PtyDataMeta
+  ackCredit?: () => void
+}
+
+export type DeferredReattachLiveDataQueueStorage = {
+  backingLength: number
+  head: number
+  retainedChars: number
+  retainedChunks: number
+}
+
+export class DeferredReattachLiveDataQueue {
+  private chunks: (DeferredReattachLiveDataChunk | undefined)[] = []
+  private head = 0
+  private retainedChars = 0
+  private streamGeneration: number | null = null
+
+  enqueue(chunk: DeferredReattachLiveDataChunk): void {
+    if (this.streamGeneration !== null && this.streamGeneration !== chunk.streamGeneration) {
+      this.discard()
+    }
+    this.streamGeneration = chunk.streamGeneration
+
+    const oversized = chunk.data.length > MAX_DEFERRED_REATTACH_LIVE_CHARS
+    const queuedChunk = {
+      ...chunk,
+      data: oversized ? chunk.data.slice(-MAX_DEFERRED_REATTACH_LIVE_CHARS) : chunk.data
+    }
+    this.chunks.push(queuedChunk)
+    this.retainedChars += queuedChunk.data.length
+
+    let dropped = oversized
+    while (
+      this.retainedChunkCount > 1 &&
+      (this.retainedChunkCount > MAX_DEFERRED_REATTACH_LIVE_CHUNKS ||
+        this.retainedChars > MAX_DEFERRED_REATTACH_LIVE_CHARS)
+    ) {
+      const removed = this.chunks[this.head]
+      this.chunks[this.head] = undefined
+      this.head += 1
+      if (removed) {
+        this.retainedChars -= removed.data.length
+        removed.ackCredit?.()
+      }
+      dropped = true
+    }
+
+    const oldest = this.chunks[this.head]
+    if (dropped && oldest) {
+      oldest.meta = { ...oldest.meta, droppedOutput: true }
+    }
+    this.compact()
+  }
+
+  takeAll(): DeferredReattachLiveDataChunk[] {
+    const retained: DeferredReattachLiveDataChunk[] = []
+    for (let index = this.head; index < this.chunks.length; index += 1) {
+      const chunk = this.chunks[index]
+      if (chunk) {
+        retained.push(chunk)
+      }
+    }
+    this.reset()
+    return retained
+  }
+
+  discard(): void {
+    for (const chunk of this.takeAll()) {
+      chunk.ackCredit?.()
+    }
+  }
+
+  getStorageForTest(): DeferredReattachLiveDataQueueStorage {
+    return {
+      backingLength: this.chunks.length,
+      head: this.head,
+      retainedChars: this.retainedChars,
+      retainedChunks: this.retainedChunkCount
+    }
+  }
+
+  private get retainedChunkCount(): number {
+    return this.chunks.length - this.head
+  }
+
+  private compact(): void {
+    if (this.head < COMPACTION_MIN_HEAD || this.head * 2 < this.chunks.length) {
+      return
+    }
+    this.chunks = this.chunks.slice(this.head)
+    this.head = 0
+  }
+
+  private reset(): void {
+    this.chunks = []
+    this.head = 0
+    this.retainedChars = 0
+    this.streamGeneration = null
+  }
+}
diff --git a/src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts b/src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts
new file mode 100644
index 00000000000..a5e52d13e4b
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts
@@ -0,0 +1,487 @@
+/**
+ * Real-fish regression for #9993: Orca must never write `CSI ?997;Nn` into a PTY
+ * because fish armed DECSET 2031 around a prompt.
+ *
+ * fish toggles `?2031h ... ?2031l` in tty_handoff.rs every time it paints a prompt and
+ * withdraws before handing the tty to a child, so the arm window is ~1ms — shorter than
+ * a renderer IPC hop. Any reply lands after the withdrawal and is read by whatever owns
+ * the tty next: it paints as literal `?997;1n` at the prompt, or is swallowed by a child
+ * that reads stdin (npx / brew confirm prompts).
+ *
+ * The assertion is therefore about what a CHILD PROCESS READS, not what renders: a
+ * screen-level check passes while the child's stdin is still corrupted.
+ *
+ * Real production code under test: connectPanePty's live mode-2031 chunk observer. The
+ * mock transport writes whatever the renderer sends straight into the real fish PTY, so a
+ * reply-on-subscribe reaches the child exactly as it does in the app. DA1/CPR/OSC-10/11
+ * probes are answered by the harness because no real xterm is attached here — without
+ * them fish stalls ~10s on its DA1 wait and every timing claim becomes meaningless.
+ */
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import type * as React from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  fishRequirementViolation,
+  resolveFishBinary
+} from '../../../../shared/fish-binary-requirement'
+
+// Why a version floor and not just presence: DECSET 2031 arming lives in the Rust
+// tty_handoff introduced by the fish 4.0 rewrite. An older fish cannot produce the
+// subscribe at all, so the test would pass vacuously instead of guarding anything.
+const FISH = resolveFishBinary(4)
+const FISH_BIN = FISH.path
+const itWithFish = FISH.available ? it : it.skip
+
+const PROMPT_MARK = 'ORCA997> '
+const COLOR_SCHEME_REPORT_PREFIX = '\x1b[?997'
+const ARM_2031 = '\x1b[?2031h'
+const WITHDRAW_2031 = '\x1b[?2031l'
+const LEAF_1 = '11111111-1111-4111-8111-111111111111'
+
+type MutableState = Record<string, unknown>
+let mockStoreState: MutableState = {}
+let storeSubscribers: ((state: MutableState) => void)[] = []
+let transportFactoryQueue: unknown[] = []
+
+vi.mock('@/runtime/sync-runtime-graph', () => ({ scheduleRuntimeGraphSync: vi.fn() }))
+vi.mock('./terminal-webgl-atlas-recovery', () => ({
+  scheduleTerminalWebglAtlasRecovery: vi.fn()
+}))
+vi.mock('@/lib/codex-stale-pane-sweep', () => ({ notifyCodexPaneBoundForStaleSweep: vi.fn() }))
+vi.mock('sonner', () => ({ toast: { info: vi.fn() } }))
+vi.mock('./cache-timer-seeding', () => ({ shouldSeedCacheTimerOnInitialTitle: vi.fn(() => false) }))
+vi.mock('@/store', () => ({
+  useAppStore: {
+    getState: () => mockStoreState,
+    subscribe: (listener: (state: MutableState) => void) => {
+      storeSubscribers.push(listener)
+      return () => {
+        storeSubscribers = storeSubscribers.filter((candidate) => candidate !== listener)
+      }
+    }
+  }
+}))
+// Why: connectPanePty calls useNotificationDispatch's useCallback outside React.
+vi.mock('react', async (importOriginal) => ({
+  ...(await importOriginal<typeof React>()),
+  useCallback: <T>(fn: T): T => fn
+}))
+vi.mock('./pty-transport', () => ({
+  createIpcPtyTransport: vi.fn(() => {
+    const next = transportFactoryQueue.shift()
+    if (!next) {
+      throw new Error('No mock transport queued')
+    }
+    return next
+  })
+}))
+
+type ConnectCallbacks = { onData?: (data: string) => void }
+
+/** Mock transport whose renderer→PTY writes land in the real fish master fd. */
+function createPtyBackedTransport(write: (data: string) => void): {
+  transport: Record<string, unknown>
+  sent: string[]
+  emit: (data: string) => void
+} {
+  const sent: string[] = []
+  const captured: { current: ((data: string) => void) | null } = { current: null }
+  const send = (data: string): boolean => {
+    sent.push(data)
+    write(data)
+    return true
+  }
+  const transport = {
+    attach: vi.fn(),
+    connect: vi.fn(async ({ callbacks }: { callbacks?: ConnectCallbacks }) => {
+      captured.current = callbacks?.onData ?? null
+      return 'fish-pty'
+    }),
+    disconnect: vi.fn(),
+    sendInput: vi.fn(send),
+    sendInputImmediate: vi.fn(send),
+    sendInputAccepted: vi.fn(async (data: string) => send(data)),
+    isConnected: vi.fn(() => true),
+    claimViewport: vi.fn(() => true),
+    resize: vi.fn(() => true),
+    getPtyId: vi.fn(() => 'fish-pty'),
+    getConnectionId: vi.fn(() => null)
+  }
+  return { transport, sent, emit: (data: string) => captured.current?.(data) }
+}
+
+function createPane(paneId: number): Record<string, unknown> {
+  const activeBuffer = { type: 'normal' as const, viewportY: 0, baseY: 0, cursorY: 0, cursorX: 0 }
+  const container = new EventTarget()
+  Object.defineProperty(container, 'dataset', { configurable: true, value: {} })
+  return {
+    id: paneId,
+    leafId: LEAF_1,
+    stablePaneId: LEAF_1,
+    container,
+    fitAddon: { fit: vi.fn(), proposeDimensions: vi.fn(() => ({ cols: 120, rows: 30 })) },
+    terminal: {
+      cols: 120,
+      rows: 30,
+      element: {},
+      buffer: { active: activeBuffer },
+      modes: { bracketedPasteMode: false, sendFocusMode: false },
+      options: { scrollback: 5_000, theme: { foreground: '#eeeeee', background: '#111111' } },
+      write: vi.fn(),
+      resize: vi.fn(),
+      clear: vi.fn(),
+      scrollToBottom: vi.fn(),
+      paste: vi.fn(),
+      onData: vi.fn(() => ({ dispose: vi.fn() })),
+      onResize: vi.fn(() => ({ dispose: vi.fn() })),
+      onRender: vi.fn(() => ({ dispose: vi.fn() })),
+      onTitleChange: vi.fn(() => ({ dispose: vi.fn() })),
+      hasSelection: vi.fn(() => false),
+      parser: {
+        registerCsiHandler: vi.fn(() => ({ dispose: vi.fn() })),
+        registerOscHandler: vi.fn(() => ({ dispose: vi.fn() }))
+      }
+    }
+  }
+}
+
+function createDeps(): Record<string, unknown> {
+  return {
+    tabId: 'tab-1',
+    worktreeId: 'wt-1',
+    cwd: '/tmp/wt-1',
+    startup: null,
+    restoredLeafId: null,
+    restoredPtyIdByLeafId: {},
+    paneTransportsRef: { current: new Map() },
+    paneMode2031Ref: { current: new Map<number, boolean>() },
+    paneKittyKeyboardModesRef: { current: new Map() },
+    paneLastThemeModeRef: { current: new Map<number, 'dark' | 'light'>() },
+    replayingPanesRef: { current: new Map() },
+    isActiveRef: { current: true },
+    isVisibleRef: { current: true },
+    onPtyExitRef: { current: vi.fn() },
+    onAgentExitedRef: { current: vi.fn() },
+    onPtyErrorRef: { current: vi.fn() },
+    clearTabPtyId: vi.fn(),
+    consumeSuppressedPtyExit: vi.fn(() => false),
+    isPtyShutdownPending: vi.fn(() => false),
+    updateTabTitle: vi.fn(),
+    setRuntimePaneTitle: vi.fn(),
+    clearRuntimePaneTitle: vi.fn(),
+    updateTabPtyId: vi.fn(),
+    markWorktreeUnread: vi.fn(),
+    markTerminalTabUnread: vi.fn(),
+    markTerminalPaneUnread: vi.fn(),
+    clearWorktreeUnread: vi.fn(),
+    clearTerminalTabUnread: vi.fn(),
+    clearTerminalPaneUnread: vi.fn(),
+    dispatchNotification: vi.fn(),
+    onShowSessionRestoredBanner: vi.fn(),
+    setCacheTimerStartedAt: vi.fn(),
+    syncPanePtyLayoutBinding: vi.fn(),
+    clearExitedPanePtyLayoutBinding: vi.fn()
+  }
+}
+
+function createManager(pane: Record<string, unknown>): Record<string, unknown> {
+  return {
+    setPaneGpuRendering: vi.fn(),
+    markPaneHasComplexScriptOutput: vi.fn(),
+    rebuildPaneWebgl: vi.fn(),
+    hasWebglRenderer: vi.fn(() => false),
+    getPanes: vi.fn(() => [pane]),
+    closePane: vi.fn(),
+    getActivePane: vi.fn(() => pane),
+    getNumericIdForLeaf: vi.fn(() => 1),
+    setActivePane: vi.fn()
+  }
+}
+
+const sleep = (msValue: number): Promise<void> =>
+  new Promise((resolve) => setTimeout(resolve, msValue))
+
+const countOf = (haystack: string, needle: string): number => haystack.split(needle).length - 1
+
+async function waitUntil(predicate: () => boolean, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() < deadline) {
+    if (predicate()) {
+      return true
+    }
+    await sleep(10)
+  }
+  return false
+}
+
+describe('fish never receives a color-scheme report it did not query (#9993)', () => {
+  let configHome: string | null = null
+
+  // Always runs, so the CI lane cannot report green with the regression below skipped.
+  it('has the fish this suite needs when CI requires one', () => {
+    expect(fishRequirementViolation(FISH)).toBeNull()
+  })
+
+  beforeEach(() => {
+    vi.resetModules()
+    vi.clearAllMocks()
+    transportFactoryQueue = []
+    storeSubscribers = []
+    mockStoreState = {
+      activeWorktreeId: 'wt-1',
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: 'fish-pty' }] },
+      ptyIdsByTabId: { 'tab-1': ['fish-pty'] },
+      terminalLayoutsByTabId: {
+        'tab-1': {
+          root: { type: 'leaf', leafId: LEAF_1 },
+          activeLeafId: LEAF_1,
+          expandedLeafId: null,
+          ptyIdsByLeafId: { [LEAF_1]: 'fish-pty' }
+        }
+      },
+      unreadTerminalTabs: {},
+      deleteStateByWorktreeId: {},
+      worktreesByRepo: { repo1: [{ id: 'wt-1', repoId: 'repo1', path: '/tmp/wt-1' }] },
+      runtimeStatusByEnvironmentId: new Map(),
+      repos: [{ id: 'repo1', connectionId: null }],
+      projects: [],
+      sshConnectionStates: new Map(),
+      transientClearedAgentStatusConnectionIds: {},
+      cacheTimerByKey: {},
+      // Dark app mode: a pre-fix reply is `CSI ?997;1n`, the exact payload issue #9993 reports.
+      settings: {
+        theme: 'dark',
+        promptCacheTimerEnabled: true,
+        terminalMainSideEffectAuthority: false
+      },
+      codexRestartNoticeByPtyId: {},
+      deferredSshReconnectTargets: [],
+      deferredSshSessionIdsByTabId: {},
+      removeDeferredSshReconnectTarget: vi.fn(),
+      removeDeferredSshSessionId: vi.fn(),
+      consumePendingColdRestore: vi.fn(() => null),
+      consumePendingSnapshot: vi.fn(() => null),
+      runtimePaneTitlesByTabId: {},
+      agentStatusByPaneKey: {},
+      retainedAgentsByPaneKey: {},
+      paneForegroundAgentByPaneKey: {},
+      sleepingAgentSessionsByPaneKey: {},
+      suppressedPtyExitIds: {},
+      agentLaunchConfigByPaneKey: {},
+      getAgentLaunchConfigForStatusEntry: vi.fn(),
+      getAgentLaunchConfigForStatusMetadata: vi.fn(),
+      clearSleepingAgentSession: vi.fn(),
+      registerAgentLaunchConfig: vi.fn(),
+      clearAgentLaunchConfig: vi.fn(),
+      markWorktreeUnread: vi.fn(),
+      observeTerminalGitHubPullRequestLink: vi.fn(),
+      recordTerminalInput: vi.fn(),
+      setAgentStatus: vi.fn(),
+      removeAgentStatus: vi.fn(),
+      dropAgentStatus: vi.fn(),
+      retireAgentPaneAuthority: vi.fn(),
+      setPaneForegroundAgent: vi.fn(),
+      clearPaneForegroundAgent: vi.fn(),
+      markTerminalTabUnread: vi.fn(),
+      markTerminalPaneUnread: vi.fn(),
+      markAgentCompletionPaneUnread: vi.fn()
+    }
+    ;(globalThis as unknown as { window: unknown }).window = {
+      api: {
+        pty: {
+          kill: vi.fn(),
+          signal: vi.fn(),
+          listSessions: vi.fn().mockResolvedValue([]),
+          hasPty: vi.fn().mockResolvedValue(true),
+          getSize: vi.fn().mockResolvedValue(null),
+          reportGeometry: vi.fn(),
+          getMainBufferSnapshot: vi.fn().mockResolvedValue(null),
+          getForegroundProcess: vi.fn().mockResolvedValue(null),
+          inspectProcess: vi.fn().mockResolvedValue(null),
+          confirmForegroundProcess: vi.fn().mockResolvedValue(null),
+          hasChildProcesses: vi.fn().mockResolvedValue(false),
+          write: vi.fn(),
+          writeAccepted: vi.fn().mockResolvedValue(true),
+          setHiddenRendererPty: vi.fn(),
+          setPtyDeliveryInterest: vi.fn(),
+          ackColdRestore: vi.fn(),
+          onClearBufferRequest: vi.fn(() => vi.fn()),
+          onSerializeBufferRequest: vi.fn(() => vi.fn()),
+          sendSerializedBuffer: vi.fn(),
+          declarePendingPaneSerializer: vi.fn().mockResolvedValue(1),
+          settlePaneSerializer: vi.fn().mockResolvedValue(undefined),
+          clearPendingPaneSerializer: vi.fn().mockResolvedValue(undefined),
+          reportRendererSerializerReady: vi.fn().mockResolvedValue(undefined)
+        },
+        platform: { get: vi.fn(() => ({ platform: process.platform, osRelease: '' })) },
+        notifications: {
+          dispatch: vi.fn().mockResolvedValue({ delivered: true }),
+          playSound: vi.fn().mockResolvedValue({ played: true })
+        },
+        runtime: { restoreTerminalFit: vi.fn().mockResolvedValue({ restored: true }) },
+        agentStatus: { inferInterrupt: vi.fn().mockResolvedValue(false) }
+      },
+      dispatchEvent: vi.fn(),
+      addEventListener: vi.fn(),
+      removeEventListener: vi.fn()
+    }
+    globalThis.requestAnimationFrame = vi.fn((callback: FrameRequestCallback) => {
+      callback(0)
+      return 1
+    })
+    globalThis.cancelAnimationFrame = vi.fn()
+  })
+
+  afterEach(() => {
+    delete (globalThis as { requestAnimationFrame?: unknown }).requestAnimationFrame
+    delete (globalThis as { cancelAnimationFrame?: unknown }).cancelAnimationFrame
+    delete (globalThis as { window?: unknown }).window
+    if (configHome) {
+      rmSync(configHome, { recursive: true, force: true })
+      configHome = null
+    }
+  })
+
+  itWithFish(
+    'writes no CSI 997 while fish arms mode 2031 around its prompt, so a child reads clean stdin',
+    async () => {
+      const { connectPanePty } = await import('./pty-connection')
+      const nodePty = await import('node-pty')
+
+      configHome = mkdtempSync(path.join(tmpdir(), 'orca-fish-2031-'))
+      mkdirSync(path.join(configHome, 'fish'), { recursive: true })
+      // Plain prompt, no user config: fish core toggles DEC 2031 regardless of the prompt.
+      writeFileSync(
+        path.join(configHome, 'fish/config.fish'),
+        [
+          'set -g fish_greeting ""',
+          `function fish_prompt; printf '${PROMPT_MARK}'; end`,
+          'function fish_right_prompt; end',
+          ''
+        ].join('\n')
+      )
+      // Echoes the first stdin LINE back escaped, so leaked control bytes are visible on
+      // screen. Why a line and not the first chunk: leaked replies carry no newline, so a
+      // once('data') child reports them alone whenever they arrive in their own read —
+      // which is what the issue's own `sys.stdin.readline()` repro measures.
+      const childScript = path.join(configHome, 'read-stdin.mjs')
+      writeFileSync(
+        childScript,
+        "let buffered = ''\n" +
+          "process.stdin.on('data', (d) => {\n" +
+          "  buffered += d.toString('utf8')\n" +
+          "  if (!buffered.includes('\\n')) return\n" +
+          "  process.stdout.write('CHILD-READ:' + JSON.stringify(buffered) + '\\n')\n" +
+          '  process.exit(0)\n' +
+          '})\n'
+      )
+
+      const term = nodePty.spawn(FISH_BIN as string, ['-l', '-i'], {
+        name: 'xterm-256color',
+        cols: 120,
+        rows: 30,
+        cwd: configHome,
+        env: {
+          PATH: process.env.PATH ?? '/usr/bin:/bin',
+          HOME: configHome,
+          TERM: 'xterm-256color',
+          COLORTERM: 'truecolor',
+          LANG: 'en_US.UTF-8',
+          XDG_CONFIG_HOME: configHome,
+          XDG_DATA_HOME: path.join(configHome, 'data'),
+          ORCA_NODE_BIN: process.execPath,
+          ORCA_CHILD_SCRIPT: childScript
+        }
+      })
+
+      let rendered = ''
+      const { transport, sent, emit } = createPtyBackedTransport((data) => term.write(data))
+      transportFactoryQueue.push(transport)
+
+      // Why answered here: no real xterm is attached, and fish blocks its first prompt ~10s
+      // on DA1 and re-probes every prompt. These are harness bytes, never renderer output.
+      term.onData((chunk) => {
+        rendered += chunk
+        if (chunk.includes('\x1b[0c') || chunk.includes('\x1b[c')) {
+          term.write('\x1b[?62;4;6;22c')
+        }
+        if (chunk.includes('\x1b[6n')) {
+          term.write('\x1b[1;1R')
+        }
+        if (chunk.includes('\x1b]10;?') || chunk.includes('\x1b]11;?')) {
+          term.write('\x1b]11;rgb:1e1e/1e1e/1e1e\x1b\\')
+        }
+        emit(chunk)
+      })
+
+      let exited = false
+      term.onExit(() => {
+        exited = true
+      })
+
+      try {
+        const pane = createPane(1)
+        const deps = createDeps()
+        const binding = connectPanePty(pane as never, createManager(pane) as never, deps as never)
+
+        expect(await waitUntil(() => rendered.includes(PROMPT_MARK), 15_000)).toBe(true)
+        // The arm is the settle signal.
+        expect(await waitUntil(() => rendered.includes(ARM_2031), 5_000)).toBe(true)
+        // Vacuity guard: the renderer observer must actually have seen the subscribe,
+        // otherwise "sent nothing" is trivially true. Checked here and not at the end,
+        // because the last decision races between fish's subscribe and its withdrawal.
+        const paneMode2031 = (deps as { paneMode2031Ref: { current: Map<number, boolean> } })
+          .paneMode2031Ref.current
+        expect(await waitUntil(() => paneMode2031.get(1) === true, 5_000)).toBe(true)
+
+        // Type-ahead is the deterministic leak shape: queue the child command while an
+        // external command still owns the tty, so fish repaints the prompt (`?2031h`) and
+        // consumes the buffered line in the same breath — handoff lands sub-millisecond
+        // after the subscribe, inside any reply's flight time.
+        term.write('sleep 0.4\r')
+        // Withdrawal #1: `sleep` owns the tty now, so the next line is typed ahead.
+        expect(await waitUntil(() => countOf(rendered, WITHDRAW_2031) >= 1, 5_000)).toBe(true)
+        term.write('"$ORCA_NODE_BIN" "$ORCA_CHILD_SCRIPT"\r')
+        // Withdrawal #2: fish re-armed for the prompt and handed the tty to the child.
+        expect(await waitUntil(() => countOf(rendered, WITHDRAW_2031) >= 2, 5_000)).toBe(true)
+
+        const renderedBeforeChildInput = rendered.length
+        // Canonical mode buffers this in the tty, so it queues behind anything already
+        // written there — including a reply the renderer sent during the handoff.
+        term.write('hello\r')
+        expect(
+          await waitUntil(
+            () => rendered.slice(renderedBeforeChildInput).includes('CHILD-READ:'),
+            10_000
+          )
+        ).toBe(true)
+
+        const childRead =
+          rendered.slice(renderedBeforeChildInput).match(/CHILD-READ:[^\r\n]*/)?.[0] ?? ''
+        // The merge-blocking assertion: the child's STDIN, not the screen. A rendered-output
+        // check passes while npx/brew confirm prompts still eat the bytes.
+        // Scope note: the harness' own DA1/CPR/OSC-11 answers can still land here — that is
+        // the separate probe-reply family (fish asks for those; nobody asked for 997).
+        expect(childRead).not.toContain('997')
+        expect(childRead).toContain('hello')
+        // Nothing the renderer sent was a color-scheme report, on any path.
+        expect(sent.filter((data) => data.includes(COLOR_SCHEME_REPORT_PREFIX))).toEqual([])
+        // And fish never echoed one back as literal prompt text.
+        expect(rendered).not.toContain('997;1n')
+
+        binding.dispose()
+      } finally {
+        term.write('exit\r')
+        await waitUntil(() => exited, 3_000)
+        try {
+          term.kill()
+        } catch {
+          // already gone
+        }
+      }
+    },
+    30_000
+  )
+})
diff --git a/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts b/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts
index 93349254955..1a9653d15c8 100644
--- a/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts
+++ b/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts
@@ -108,19 +108,19 @@ describe('startParkedTerminalByteWatcher', () => {
 
   async function startWatcher(
     overrides: Partial<ParkedTerminalByteWatcherOptions> = {}
-  ): Promise<{ dispose: () => void; sendInput: ReturnType<typeof vi.fn> }> {
+  ): Promise<{ dispose: () => void; ptyWrite: ReturnType<typeof vi.fn> }> {
     const { startParkedTerminalByteWatcher } = await import('./parked-terminal-byte-watcher')
-    const sendInput = vi.fn()
+    const ptyWrite = vi.fn()
+    ;(window as unknown as { api: { pty: Record<string, unknown> } }).api.pty.write = ptyWrite
     const dispose = startParkedTerminalByteWatcher({
       ptyId: PTY_ID,
       tabId: TAB_ID,
       worktreeId: WORKTREE_ID,
       leafId: LEAF_ID,
       paneId: PANE_ID,
-      sendInput,
       ...overrides
     })
-    return { dispose, sendInput }
+    return { dispose, ptyWrite }
   }
 
   beforeEach(() => {
@@ -360,31 +360,20 @@ describe('startParkedTerminalByteWatcher', () => {
     dispose()
   })
 
-  it('answers a DECSET 2031 subscribe split across chunks via sendInput', async () => {
-    const { dispose, sendInput } = await startWatcher()
+  // Regression pin (#9993): DECSET 2031 subscribes to future color changes — it is not a
+  // query (that is CSI ?996n). A parked tab has no view to answer with and any reply lands
+  // after fish withdrew the mode, painting `?997;1n` at the prompt.
+  it('never writes a color-scheme reply for a DECSET 2031 subscribe', async () => {
+    const { dispose, ptyWrite } = await startWatcher()
 
     emit('\x1b[?20')
-    expect(sendInput).not.toHaveBeenCalled()
-
     emit('31h')
-    expect(sendInput).toHaveBeenCalledTimes(1)
-    // theme=system + prefers-dark → dark reply per terminal-color-scheme-protocol.
-    expect(sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
-
     emit('\x1b[?2031l')
-    expect(sendInput).toHaveBeenCalledTimes(1)
+
+    expect(ptyWrite).not.toHaveBeenCalled()
     dispose()
   })
 
-  it('stops answering DECSET 2031 after dispose', async () => {
-    const { dispose, sendInput } = await startWatcher()
-
-    dispose()
-    emit('\x1b[?2031h')
-
-    expect(sendInput).not.toHaveBeenCalled()
-  })
-
   it('observes GitHub PR links across chunk boundaries', async () => {
     const { dispose } = await startWatcher()
 
@@ -608,8 +597,7 @@ describe('startParkedTerminalByteWatcher', () => {
   //
   // With the kill switch on, the watcher must not register byte parsers —
   // main is the single byte parser and the watcher's policy block consumes
-  // pty:sideEffect facts instead. The byte sidecar stays ONLY for the 2031
-  // reply (query authority never moves to main); PR links arrive as facts.
+  // pty:sideEffect facts instead; PR links arrive as facts.
   describe('with main side-effect authority on', () => {
     function enableMainAuthority(): void {
       mockStoreState.settings = {
@@ -875,19 +863,15 @@ describe('startParkedTerminalByteWatcher', () => {
       dispose()
     })
 
-    it('answers DECSET 2031 from the main 2031-subscribe fact, never the byte scan', async () => {
-      // Why: with the hidden-delivery gate on (default), parked PTY bytes are
-      // dropped in main — the fact is the only 2031 signal, and the byte
-      // sidecar must NOT exist (its registration would re-enable delivery).
+    it('stays silent on a main 2031-subscribe fact', async () => {
+      // Regression pin (#9993): the fact records a subscription for theme-flip
+      // pushes; a parked watcher must never answer it.
       enableMainAuthority()
-      const { dispose, sendInput } = await startWatcher()
+      const { dispose, ptyWrite } = await startWatcher()
 
       emit('\x1b[?2031h')
-      expect(sendInput).not.toHaveBeenCalled()
-
       await dispatchFacts([{ kind: '2031-subscribe' }])
-      expect(sendInput).toHaveBeenCalledTimes(1)
-      expect(sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
+      expect(ptyWrite).not.toHaveBeenCalled()
 
       // Why: pr-link facts arrive on the channel; byte-scanning here too
       // would observe every link twice.
@@ -912,7 +896,7 @@ describe('startParkedTerminalByteWatcher', () => {
       expect(setHiddenRendererPty).toHaveBeenLastCalledWith(PTY_ID, false)
     })
 
-    it('keeps the byte 2031 responder and no hidden bit when the gate kill switch is off', async () => {
+    it('sets no hidden bit and stays silent on 2031 when the gate kill switch is off', async () => {
       enableMainAuthority()
       mockStoreState.settings = {
         ...mockStoreState.settings,
@@ -922,20 +906,14 @@ describe('startParkedTerminalByteWatcher', () => {
       ;(
         window as unknown as { api: { pty: Record<string, unknown> } }
       ).api.pty.setHiddenRendererPty = setHiddenRendererPty
-      const { dispose, sendInput } = await startWatcher()
+      const { dispose, ptyWrite } = await startWatcher()
 
-      // Gate off — bytes keep flowing, so the split-chunk byte scan answers.
+      // Gate off — bytes keep flowing, and they still elicit nothing (#9993).
       emit('\x1b[?20')
-      expect(sendInput).not.toHaveBeenCalled()
       emit('31h')
-      expect(sendInput).toHaveBeenCalledTimes(1)
-      expect(sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
-
-      // Why: a 2031-subscribe fact must not double-fire the reply in byte
-      // mode — exactly one responder owns the answer at any time.
       await dispatchFacts([{ kind: '2031-subscribe' }])
-      expect(sendInput).toHaveBeenCalledTimes(1)
 
+      expect(ptyWrite).not.toHaveBeenCalled()
       expect(setHiddenRendererPty).not.toHaveBeenCalled()
       dispose()
     })
diff --git a/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.ts b/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.ts
index 42dff141d34..8d24cfca7f7 100644
--- a/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.ts
+++ b/src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.ts
@@ -5,12 +5,7 @@
 import { isClaudeAgent } from '../../../../shared/agent-detection'
 import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { useAppStore } from '@/store'
-import {
-  mode2031SequenceFor,
-  resolveTerminalColorSchemeMode
-} from '../../../../shared/terminal-color-scheme-protocol'
 import { createTerminalGitHubPRLinkDetector } from '../../../../shared/terminal-github-pr-link-detector'
-import { getSystemPrefersDark } from '@/lib/terminal-theme'
 import {
   AGENT_TASK_COMPLETE_NOTIFICATION_GRACE_MS,
   isAgentTaskCompleteOsNotificationEnabledFromState,
@@ -22,7 +17,6 @@ import {
   createParkedTerminalCommandStatusPolicy,
   readInFlightCommandCodeTurn
 } from './parked-terminal-command-status'
-import { startParkedTerminalMode2031Responder } from './parked-terminal-mode2031-responder'
 import { subscribeToPtyData } from './pty-data-sidecar-subscriptions'
 import { createPtyOutputProcessor } from './pty-transport'
 import { isRendererHiddenPtyDeliveryGateEnabled } from './terminal-hidden-delivery-gate'
@@ -61,8 +55,6 @@ export type ParkedTerminalByteWatcherOptions = {
   initialTitle?: string
   /** Pull main's title-only snapshot when a watcher starts before its pane ever mounted (ordinary park cycles already have a title). */
   restoreTitleOnRegister?: boolean
-  /** Out-of-band reply channel to the PTY (mode-2031 color-scheme answers). */
-  sendInput: (data: string) => void
 }
 
 const parkedWatcherDisposersByPtyId = new Map<string, () => void>()
@@ -70,7 +62,7 @@ const parkedWatcherDisposersByPtyId = new Map<string, () => void>()
 export function startParkedTerminalByteWatcher(
   options: ParkedTerminalByteWatcherOptions
 ): () => void {
-  const { ptyId, tabId, worktreeId, paneId, sendInput } = options
+  const { ptyId, tabId, worktreeId, paneId } = options
   const remoteRuntimePty = isRemoteRuntimePtyId(ptyId)
   const drivesTabTitle = options.drivesTabTitle ?? true
   const paneKey = makePaneKey(tabId, options.leafId)
@@ -213,16 +205,9 @@ export function startParkedTerminalByteWatcher(
       runtimeEnvironmentId: null
     })
   const factSideEffectAuthority = mainSideEffectAuthority || remoteRuntimePty
-  // Why: decided once at watcher start — it picks which 2031 responder (byte sidecar vs fact reply) exists, so it must never flip per chunk.
   const hiddenDeliveryGateActive =
     mainSideEffectAuthority &&
     isRendererHiddenPtyDeliveryGateEnabled(useAppStore.getState().settings)
-  const factOwnsMode2031 = hiddenDeliveryGateActive || remoteRuntimePty
-
-  const sendMode2031Reply = (): void => {
-    const settings = useAppStore.getState().settings
-    sendInput(mode2031SequenceFor(resolveTerminalColorSchemeMode(settings, getSystemPrefersDark())))
-  }
 
   // Why (byte-parser mode only): reuse the transport's output processor to keep exact live-path parsing semantics.
   // initialAgentTitle: an agent already working at park time still produces a working→idle transition.
@@ -261,20 +246,13 @@ export function startParkedTerminalByteWatcher(
           onCommandCodeWorking: commandStatusPolicy.onCommandCodeWorking,
           onCommandCodeDone: commandStatusPolicy.onCommandCodeDone,
           onPrLink: (link) =>
-            useAppStore.getState().observeTerminalGitHubPullRequestLink(worktreeId, link),
-          // Why (gate mode only): the 2031 subscribe arrives as a fact, but the reply stays here — query authority stays with the view/watcher (invariant 6).
-          ...(factOwnsMode2031 ? { onMode2031Subscribe: sendMode2031Reply } : {})
+            useAppStore.getState().observeTerminalGitHubPullRequestLink(worktreeId, link)
         },
         // Why: activation-deferred tabs can start a watcher before any pane restored the title; ordinary parked tabs avoid this IPC.
         restoreTitleOnRegister: options.restoreTitleOnRegister === true
       })
     : null
 
-  // Why: no xterm answers DECSET 2031 while parked; with the gate ON, the responder's sidecar would force-feed bytes to the gated PTY, so skip it.
-  const stopMode2031Responder = factOwnsMode2031
-    ? null
-    : startParkedTerminalMode2031Responder({ ptyId, sendInput })
-
   // Why: parked tabs are the canonical hidden view — mark the PTY gated so main stops renderer byte delivery.
   const releaseHiddenDeliveryClaim = hiddenDeliveryGateActive
     ? acquireHiddenRendererPtyDeliveryClaim(ptyId)
@@ -308,7 +286,6 @@ export function startParkedTerminalByteWatcher(
     processor?.disposePendingSideEffectGauge()
     // Why: unhide BEFORE the reveal remount registers pane handlers, so main resumes delivery and emits the restore marker the pane consumes.
     releaseHiddenDeliveryClaim?.()
-    stopMode2031Responder?.()
     unsubscribeByteParsers?.()
     unregisterFactConsumer?.()
     // Why: clears tracker/timer/detector state so the watcher can't fire after the revealed pane's live parsers take over.
diff --git a/src/renderer/src/components/terminal-pane/parked-terminal-mode2031-responder.test.ts b/src/renderer/src/components/terminal-pane/parked-terminal-mode2031-responder.test.ts
deleted file mode 100644
index c619790fdb1..00000000000
--- a/src/renderer/src/components/terminal-pane/parked-terminal-mode2031-responder.test.ts
+++ /dev/null
@@ -1,124 +0,0 @@
-// Why: a parked tab has no xterm, so this byte sidecar is the only thing that
-// answers DECSET 2031. fish toggles 2031 on and off around every prompt, so
-// answering the sticky "an h appeared" flag writes `?997;1n` into a shell that
-// already handed the tty to a child (#9993).
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-const ESC = '\x1b'
-const PTY_ID = 'pty-parked-2031'
-
-// One fish prompt cycle: subscribe, paint, hand off the tty.
-const FISH_PROMPT_HANDOFF = `${ESC}[?2031h${ESC}[0m~/orca ${ESC}[32m❯${ESC}[0m ${ESC}[?2031l`
-
-let sidecarWatcher: ((data: string) => void) | null = null
-const unsubscribe = vi.fn()
-
-vi.mock('./pty-data-sidecar-subscriptions', () => ({
-  subscribeToPtyData: (_ptyId: string, watcher: (data: string) => void) => {
-    sidecarWatcher = watcher
-    return unsubscribe
-  }
-}))
-
-vi.mock('@/store', () => ({
-  useAppStore: {
-    getState: () => ({ settings: { theme: 'dark' as const } })
-  }
-}))
-
-vi.mock('@/lib/terminal-theme', () => ({
-  getSystemPrefersDark: () => true
-}))
-
-const { startParkedTerminalMode2031Responder } =
-  await import('./parked-terminal-mode2031-responder')
-
-function startResponder(): { sendInput: ReturnType<typeof vi.fn>; feed: (data: string) => void } {
-  const sendInput = vi.fn()
-  startParkedTerminalMode2031Responder({ ptyId: PTY_ID, sendInput })
-  return {
-    sendInput,
-    feed: (data: string) => sidecarWatcher?.(data)
-  }
-}
-
-beforeEach(() => {
-  sidecarWatcher = null
-  vi.clearAllMocks()
-})
-
-describe('parked-tab DECSET 2031 responder honors the chunk-final state (#9993)', () => {
-  it('does not reply to a subscribe the same chunk withdrew', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(FISH_PROMPT_HANDOFF)
-
-    expect(sendInput).not.toHaveBeenCalled()
-  })
-
-  it('replies once to a TUI that subscribes and keeps listening', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(`${ESC}[?2031h`)
-
-    expect(sendInput).toHaveBeenCalledTimes(1)
-    expect(sendInput).toHaveBeenCalledWith(`${ESC}[?997;1n`)
-  })
-
-  it('stays silent across a run of fish prompts', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(FISH_PROMPT_HANDOFF)
-    feed(FISH_PROMPT_HANDOFF)
-    feed(FISH_PROMPT_HANDOFF)
-
-    expect(sendInput).not.toHaveBeenCalled()
-  })
-
-  it('replies when a TUI subscribes after a prompt cycle in the same chunk', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(`${FISH_PROMPT_HANDOFF}${ESC}[?2031h`)
-
-    expect(sendInput).toHaveBeenCalledTimes(1)
-  })
-
-  it('still answers a subscribe split across two chunks', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(`${ESC}[?20`)
-    feed('31h')
-
-    expect(sendInput).toHaveBeenCalledTimes(1)
-  })
-
-  it('does not reply when the withdrawal is split across two chunks', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(`${ESC}[?2031h prompt ${ESC}[?20`)
-    expect(sendInput).not.toHaveBeenCalled()
-    feed('31l')
-
-    expect(sendInput).not.toHaveBeenCalled()
-  })
-
-  it('does not reply when an unrelated private mode appends a split withdrawal', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(`${ESC}[?2031h prompt ${ESC}[?25`)
-    expect(sendInput).not.toHaveBeenCalled()
-    feed(';2031l')
-
-    expect(sendInput).not.toHaveBeenCalled()
-  })
-
-  it('replies after an ambiguous tail resolves to another mode', () => {
-    const { sendInput, feed } = startResponder()
-
-    feed(`${ESC}[?2031h drawing ${ESC}[?20`)
-    expect(sendInput).not.toHaveBeenCalled()
-    feed('25h')
-
-    expect(sendInput).toHaveBeenCalledTimes(1)
-  })
-})
diff --git a/src/renderer/src/components/terminal-pane/parked-terminal-mode2031-responder.ts b/src/renderer/src/components/terminal-pane/parked-terminal-mode2031-responder.ts
deleted file mode 100644
index 4c2ca568de9..00000000000
--- a/src/renderer/src/components/terminal-pane/parked-terminal-mode2031-responder.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-/**
- * DECSET 2031 color-scheme responder for parked terminals (byte-scan mode).
- *
- * Why a dedicated byte sidecar: no xterm exists while a tab is parked, so
- * nothing answers a TUI's mode-2031 theme subscription. Query authority stays
- * with the view/watcher (model/view contract invariant 6), so this reply can
- * never move to main. Phase 4: this subscribeToPtyData registration doubles
- * as a delivery-interest signal, so it is only used while the hidden-delivery
- * gate is OFF — gated parked PTYs answer from the main tracker's
- * '2031-subscribe' fact instead (parked-terminal-byte-watcher.ts).
- *
- * Survives Phase 6 (skip-grammar deletion): mounted switch-off hidden panes
- * answer 2031 from xterm once the background queue drains, but a PARKED tab
- * has no xterm in any switch-off mode, and the '2031-subscribe' fact is only
- * consumed while the gate is ON — this sidecar stays the only answerer here.
- */
-import {
-  INITIAL_MODE_2031_REPLY_SCAN_STATE,
-  mode2031SequenceFor,
-  resolveTerminalColorSchemeMode,
-  scanMode2031ReplyDecision
-} from '../../../../shared/terminal-color-scheme-protocol'
-import { useAppStore } from '@/store'
-import { getSystemPrefersDark } from '@/lib/terminal-theme'
-import { subscribeToPtyData } from './pty-data-sidecar-subscriptions'
-
-export type ParkedTerminalMode2031ResponderOptions = {
-  ptyId: string
-  /** Out-of-band reply channel to the PTY (mode-2031 color-scheme answers). */
-  sendInput: (data: string) => void
-}
-
-export function startParkedTerminalMode2031Responder(
-  options: ParkedTerminalMode2031ResponderOptions
-): () => void {
-  const { ptyId, sendInput } = options
-  let scanState = INITIAL_MODE_2031_REPLY_SCAN_STATE
-  return subscribeToPtyData(ptyId, (data) => {
-    const result = scanMode2031ReplyDecision(scanState, data)
-    scanState = result.state
-    if (result.decision !== 'subscribed') {
-      return
-    }
-    // Why: reply with the resolved theme so TUIs that subscribe while parked
-    // still learn it before the pane is ever revealed.
-    const settings = useAppStore.getState().settings
-    sendInput(mode2031SequenceFor(resolveTerminalColorSchemeMode(settings, getSystemPrefersDark())))
-  })
-}
diff --git a/src/renderer/src/components/terminal-pane/pty-buffer-serializer.ts b/src/renderer/src/components/terminal-pane/pty-buffer-serializer.ts
index c32ea0aafaf..8fc1df0985c 100644
--- a/src/renderer/src/components/terminal-pane/pty-buffer-serializer.ts
+++ b/src/renderer/src/components/terminal-pane/pty-buffer-serializer.ts
@@ -16,6 +16,10 @@ export type SerializedBuffer = {
   rows: number
   seq?: number
   lastTitle?: string
+  /** Kitty flags this pane's mirror could PROVE at `seq`. Published only from
+   *  the tracker's snapshotFlags, so an old host's unknown state is never
+   *  republished as a known `0`. */
+  kittyKeyboardFlags?: number
 }
 
 export type SerializeFn = (
@@ -152,6 +156,11 @@ function ensureSerializerListener(): void {
         if (result.seq !== undefined) {
           payload.seq = result.seq
         }
+        // Why gated on seq: flags describe a boundary, and an unsequenced
+        // snapshot has none for a consumer to reconcile live bytes against.
+        if (result.seq !== undefined && result.kittyKeyboardFlags !== undefined) {
+          payload.kittyKeyboardFlags = result.kittyKeyboardFlags
+        }
         if (lastTitle !== undefined) {
           payload.lastTitle = lastTitle
         } else if (result.lastTitle !== undefined) {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-types.ts b/src/renderer/src/components/terminal-pane/pty-connection-types.ts
index 50a5946e770..b2b5163ac93 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-types.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-types.ts
@@ -48,6 +48,9 @@ export type PtyConnectionDeps = {
   } | null
   restoredLeafId?: string | null
   restoredPtyIdByLeafId?: Record<string, string>
+  /** Park intent sampled at render time, before the host disposes the tab's
+   *  watchers; consumed once the restored layout has been replayed. */
+  mountFollowsTerminalPark: boolean
   paneTransportsRef: React.RefObject<Map<number, PtyTransport>>
   paneMode2031Ref: React.RefObject<Map<number, boolean>>
   /** Per-pane mirror of the kitty keyboard flags the pane's application
@@ -98,10 +101,9 @@ export type PtyConnectionDeps = {
   setCacheTimerStartedAt: (key: string, ts: number | null) => void
   syncPanePtyLayoutBinding: (paneId: number, ptyId: string | null) => void
   clearExitedPanePtyLayoutBinding: (paneId: number, exitedPtyId: string) => void
-  /** Records a DECSET 2031 subscription answered from main's
-   *  '2031-subscribe' fact, mirroring the xterm CSI handler's registry write
-   *  (paneMode2031 + last replied theme) so later theme flips push CSI 997.
-   *  The reply itself is sent by the fact handler — query authority stays
-   *  with the view (model/view contract invariant 6). */
-  recordPaneMode2031Subscription?: (paneId: number, repliedMode: 'dark' | 'light') => void
+  deferPtyInput?: (paneId: number, data: string, forward: (data: string) => void) => void
+  /** Records a DECSET 2031 subscription seen through main's '2031-subscribe'
+   *  fact (paneMode2031 + the mode at subscribe time) so later theme flips push
+   *  CSI 997. Subscribing itself is silent — see #9993. */
+  recordPaneMode2031Subscription?: (paneId: number, subscribedMode: 'dark' | 'light') => void
 }
diff --git a/src/renderer/src/components/terminal-pane/pty-connection.test.ts b/src/renderer/src/components/terminal-pane/pty-connection.test.ts
index 5f3f0ef2f02..e73521d1ca3 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection.test.ts
@@ -31,6 +31,13 @@ import {
 } from '@/lib/agent-startup-delayed-delivery'
 import type { PaneForegroundAgentEntry } from '@/store/slices/pane-foreground-agent'
 
+const { resetAndRefreshAllTerminalWebglAtlases, scheduleTerminalWebglAtlasRecovery } = vi.hoisted(
+  () => ({
+    resetAndRefreshAllTerminalWebglAtlases: vi.fn(),
+    scheduleTerminalWebglAtlasRecovery: vi.fn()
+  })
+)
+
 // Repro command:
 //   pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts -t "OpenTUI-style small ANSI redraw"
 
@@ -55,18 +62,6 @@ async function drainFakeTimerWork(limit = 20): Promise<void> {
   vi.clearAllTimers()
 }
 
-// Why: a reveal remount reads the still-live park watcher entry at connect time to
-// tell itself apart from an in-place reattach; the host disposes it a beat later.
-async function parkTabForReveal(tabId: string, ptyId: string, worktreeId = 'wt-1'): Promise<void> {
-  const { parkedWatchersByTabId } = await import('./terminal-parked-watcher-registry')
-  parkedWatchersByTabId.set(tabId, {
-    worktreeId,
-    tabPtyId: ptyId,
-    paneIdByPtyId: new Map([[ptyId, 1]]),
-    disposersByPtyId: new Map([[ptyId, () => {}]])
-  })
-}
-
 async function drainPendingTimeouts(pendingTimeouts: (() => void)[], limit = 100): Promise<void> {
   let iterations = 0
   while (pendingTimeouts.length > 0) {
@@ -146,6 +141,7 @@ type StoreState = {
       title?: string
       launchAgent?: string
       shellOverride?: string
+      forceHostRuntime?: boolean
       generation?: number
     }[]
   >
@@ -330,11 +326,11 @@ type MockTransport = {
   getPtyId: ReturnType<typeof vi.fn>
   getConnectionId: ReturnType<typeof vi.fn>
   serializeBuffer?: ReturnType<typeof vi.fn>
+  serializeBufferOutcome?: ReturnType<typeof vi.fn>
 }
 
 const scheduleRuntimeGraphSync = vi.fn()
 const shouldSeedCacheTimerOnInitialTitle = vi.fn(() => false)
-const scheduleTerminalWebglAtlasRecovery = vi.fn()
 
 let mockStoreState: StoreState
 let transportFactoryQueue: MockTransport[] = []
@@ -345,6 +341,15 @@ vi.mock('@/runtime/sync-runtime-graph', () => ({
   scheduleRuntimeGraphSync
 }))
 
+vi.mock('@/lib/pane-manager/pane-manager-registry', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  resetAndRefreshAllTerminalWebglAtlases
+}))
+
+vi.mock('./terminal-webgl-atlas-recovery', () => ({
+  scheduleTerminalWebglAtlasRecovery
+}))
+
 vi.mock('@/store', () => ({
   useAppStore: {
     getState: () => mockStoreState,
@@ -357,16 +362,18 @@ vi.mock('@/store', () => ({
   }
 }))
 
-vi.mock('./terminal-webgl-atlas-recovery', () => ({
-  scheduleTerminalWebglAtlasRecovery
-}))
-
 function notifyStoreSubscribers(): void {
   for (const listener of storeSubscribers.slice()) {
     listener(mockStoreState)
   }
 }
 
+function expectNoGlobalAtlasRecovery(): void {
+  // Why: the removed output path requested recovery 200ms before its global reset ran.
+  expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
+  expect(resetAndRefreshAllTerminalWebglAtlases).not.toHaveBeenCalled()
+}
+
 vi.mock('@/lib/agent-status', async (importOriginal) => {
   const actual = await importOriginal<Record<string, unknown>>()
   const isGeminiTerminalTitle = actual.isGeminiTerminalTitle as (title: string) => boolean
@@ -606,6 +613,7 @@ function createDeps(overrides: Record<string, unknown> = {}) {
     startup: null,
     restoredLeafId: null,
     restoredPtyIdByLeafId: {},
+    mountFollowsTerminalPark: false,
     paneTransportsRef: { current: new Map() },
     paneMode2031Ref: { current: new Map() },
     paneKittyKeyboardModesRef: { current: new Map() },
@@ -2299,6 +2307,27 @@ describe('connectPanePty', () => {
     })
   })
 
+  it('keeps an explicit host fallback out of the project runtime', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport()
+    transportFactoryQueue.push(transport)
+    mockStoreState = {
+      ...mockStoreState,
+      tabsByWorktree: {
+        'wt-1': [{ id: 'tab-1', ptyId: null, forceHostRuntime: true }]
+      },
+      settings: {
+        ...mockStoreState.settings,
+        localWindowsRuntimeDefault: { kind: 'wsl', distro: 'Ubuntu' }
+      }
+    }
+
+    connectPanePty(createPane(1) as never, createManager(1) as never, createDeps() as never)
+    await flushAsyncTicks()
+
+    expect(createdTransportOptions[0]?.projectRuntime).toBeUndefined()
+  })
+
   it('observes live terminal GitHub PR URLs before agent completion', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport()
@@ -3109,6 +3138,39 @@ describe('connectPanePty', () => {
     expect(pane.terminal.write).toHaveBeenCalledWith(redraw, expect.any(Function))
   })
 
+  it('routes terminal input through deferPtyInput so the host can withhold it', async () => {
+    // Regression: inlining forwardPtyInput into onData dropped this hop, silently disabling link-click mouse suppression.
+    const { connectPanePty } = await import('./pty-connection')
+    const pane = createPane(1)
+    const transport = createMockTransport('pty-1')
+    transportFactoryQueue.push(transport)
+    const deferPtyInput = vi.fn()
+
+    connectPanePty(pane as never, createManager(1) as never, createDeps({ deferPtyInput }) as never)
+    await flushAsyncTicks()
+    sendTerminalInputThroughPane(pane, 'a')
+
+    expect(deferPtyInput).toHaveBeenCalledWith(1, 'a', expect.any(Function))
+    expect(transport.sendInput).not.toHaveBeenCalled()
+
+    const forward = deferPtyInput.mock.calls[0]?.[2] as (data: string) => void
+    forward('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a')
+  })
+
+  it('forwards terminal input directly when the host supplies no deferPtyInput', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const pane = createPane(1)
+    const transport = createMockTransport('pty-1')
+    transportFactoryQueue.push(transport)
+
+    connectPanePty(pane as never, createManager(1) as never, createDeps() as never)
+    await flushAsyncTicks()
+    sendTerminalInputThroughPane(pane, 'a')
+
+    expect(transport.sendInput).toHaveBeenCalledWith('a')
+  })
+
   it('does not let OpenTUI-style small ANSI redraw bursts monopolize foreground writes', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const pane = createPane(1)
@@ -8677,6 +8739,212 @@ describe('connectPanePty', () => {
     )
   })
 
+  it('drops a too-wide daemon alt frame and keeps the scrollback prefix', async () => {
+    // Why: fixed-grid alt rows clip at a narrower viewport until the owner repaints.
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('tab-pty')
+    transport.connect.mockImplementation(async ({ sessionId }: { sessionId?: string }) => {
+      if (sessionId) {
+        return {
+          id: sessionId,
+          snapshot: 'PREFIX-SCROLLBACK' + 'ALT-FRAME-BODY',
+          snapshotPrefixAnsi: 'PREFIX-SCROLLBACK',
+          snapshotFrameAnsi: 'ALT-FRAME-BODY',
+          snapshotFrameRestoreAnsi: 'RESTORE-LIVE-STATE',
+          snapshotCols: 200,
+          snapshotRows: 50,
+          isAlternateScreen: true
+        }
+      }
+      return null
+    })
+    transportFactoryQueue.push(transport)
+    mockStoreState = {
+      ...mockStoreState,
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: 'tab-pty' }] }
+    } as StoreState
+
+    const pane = createPane(1)
+    pane.fitAddon.proposeDimensions = vi.fn(() => ({ cols: 120, rows: 40 }))
+    const manager = createManager(1)
+    const deps = createDeps({
+      restoredLeafId: LEAF_1,
+      restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' }
+    })
+
+    connectPanePty(pane as never, manager as never, deps as never)
+    await flushAsyncTicks(20)
+
+    const writes = (pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0])
+    expect(writes.join('')).toContain('PREFIX-SCROLLBACK')
+    expect(writes.join('')).toContain('RESTORE-LIVE-STATE')
+    expect(writes.join('')).not.toContain('ALT-FRAME-BODY')
+  })
+
+  it('keeps a daemon alt frame at its capture grid while the target grid is unknown', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('tab-pty')
+    transport.connect.mockImplementation(async ({ sessionId }: { sessionId?: string }) =>
+      sessionId
+        ? {
+            id: sessionId,
+            snapshot: 'PREFIX-SCROLLBACK' + 'ALT-FRAME-BODY',
+            snapshotPrefixAnsi: 'PREFIX-SCROLLBACK',
+            snapshotFrameAnsi: 'ALT-FRAME-BODY',
+            snapshotFrameRestoreAnsi: 'RESTORE-LIVE-STATE',
+            snapshotCols: 120,
+            snapshotRows: 40,
+            isAlternateScreen: true
+          }
+        : null
+    )
+    transportFactoryQueue.push(transport)
+    mockStoreState = {
+      ...mockStoreState,
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: 'tab-pty' }] }
+    } as StoreState
+
+    const pane = createPane(1)
+    pane.container.getBoundingClientRect = vi.fn(() => createRect(0, 0))
+    pane.fitAddon.proposeDimensions = vi.fn(() => ({ cols: 1, rows: 1 }))
+    connectPanePty(
+      pane as never,
+      createManager(1) as never,
+      createDeps({
+        restoredLeafId: LEAF_1,
+        restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' }
+      }) as never
+    )
+    await flushAsyncTicks(20)
+
+    const writes = (pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0])
+    expect(writes.join('')).toContain('PREFIX-SCROLLBACK')
+    expect(writes.join('')).toContain('ALT-FRAME-BODY')
+    expect(writes.filter((write) => write.includes('ALT-FRAME-BODY'))).toHaveLength(1)
+  })
+
+  it('falls back to the merged daemon snapshot when split metadata is incomplete', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('tab-pty')
+    transport.connect.mockImplementation(async ({ sessionId }: { sessionId?: string }) =>
+      sessionId
+        ? {
+            id: sessionId,
+            snapshot: 'LEGACY-MERGED-SNAPSHOT',
+            snapshotPrefixAnsi: 'INCOMPLETE-PREFIX',
+            snapshotFrameRestoreAnsi: 'RESTORE-LIVE-STATE',
+            snapshotCols: 200,
+            snapshotRows: 50,
+            isAlternateScreen: true
+          }
+        : null
+    )
+    transportFactoryQueue.push(transport)
+    mockStoreState = {
+      ...mockStoreState,
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: 'tab-pty' }] }
+    } as StoreState
+
+    const pane = createPane(1)
+    pane.fitAddon.proposeDimensions = vi.fn(() => ({ cols: 120, rows: 40 }))
+    connectPanePty(
+      pane as never,
+      createManager(1) as never,
+      createDeps({
+        restoredLeafId: LEAF_1,
+        restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' }
+      }) as never
+    )
+    await flushAsyncTicks(20)
+
+    const writes = (pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0])
+    expect(writes.join('')).toContain('LEGACY-MERGED-SNAPSHOT')
+    expect(writes.join('')).not.toContain('INCOMPLETE-PREFIX')
+  })
+
+  it('keeps a daemon alt frame when the pane is not narrower than the capture', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('tab-pty')
+    transport.connect.mockImplementation(async ({ sessionId }: { sessionId?: string }) => {
+      if (sessionId) {
+        return {
+          id: sessionId,
+          snapshot: 'PREFIX-SCROLLBACK' + 'ALT-FRAME-BODY',
+          snapshotPrefixAnsi: 'PREFIX-SCROLLBACK',
+          snapshotFrameAnsi: 'ALT-FRAME-BODY',
+          snapshotFrameRestoreAnsi: 'RESTORE-LIVE-STATE',
+          snapshotCols: 120,
+          snapshotRows: 40,
+          isAlternateScreen: true
+        }
+      }
+      return null
+    })
+    transportFactoryQueue.push(transport)
+    mockStoreState = {
+      ...mockStoreState,
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: 'tab-pty' }] }
+    } as StoreState
+
+    const pane = createPane(1)
+    pane.fitAddon.proposeDimensions = vi.fn(() => ({ cols: 120, rows: 40 }))
+    const manager = createManager(1)
+    const deps = createDeps({
+      restoredLeafId: LEAF_1,
+      restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' }
+    })
+
+    connectPanePty(pane as never, manager as never, deps as never)
+    await flushAsyncTicks(20)
+
+    expect(
+      (pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0]).join('')
+    ).toContain('ALT-FRAME-BODY')
+  })
+
+  it('drops a too-wide daemon alt frame on cold restore and keeps its history', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('tab-pty')
+    transport.connect.mockImplementation(async ({ sessionId }: { sessionId?: string }) => {
+      if (sessionId) {
+        return {
+          id: sessionId,
+          snapshot: 'PREFIX-SCROLLBACK' + 'ALT-FRAME-BODY',
+          snapshotPrefixAnsi: 'PREFIX-SCROLLBACK',
+          snapshotFrameAnsi: 'ALT-FRAME-BODY',
+          snapshotFrameRestoreAnsi: 'RESTORE-LIVE-STATE',
+          snapshotCols: 200,
+          snapshotRows: 50,
+          isAlternateScreen: true,
+          coldRestore: { scrollback: 'x', cwd: '/tmp' }
+        }
+      }
+      return null
+    })
+    transportFactoryQueue.push(transport)
+    mockStoreState = {
+      ...mockStoreState,
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: 'tab-pty' }] }
+    } as StoreState
+
+    const pane = createPane(1)
+    pane.fitAddon.proposeDimensions = vi.fn(() => ({ cols: 120, rows: 40 }))
+    const manager = createManager(1)
+    const deps = createDeps({
+      restoredLeafId: LEAF_1,
+      restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' }
+    })
+
+    connectPanePty(pane as never, manager as never, deps as never)
+    await flushAsyncTicks(20)
+
+    const writes = (pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0])
+    expect(writes.join('')).toContain('PREFIX-SCROLLBACK')
+    expect(writes.join('')).toContain('RESTORE-LIVE-STATE')
+    expect(writes.join('')).not.toContain('ALT-FRAME-BODY')
+    expect(writes).toContain(POST_REPLAY_MODE_RESET)
+  })
+
   it('resizes the pane to the snapshot grid before replaying daemon snapshot bytes (bug #7279)', async () => {
     // Why: the daemon serializes soft-wrapped lines flat, so reattach must resize xterm to the snapshot grid before writing, or rows rewrap wrong.
     const { connectPanePty } = await import('./pty-connection')
@@ -11377,11 +11645,12 @@ describe('connectPanePty', () => {
     expect(mockStoreState.sleepingAgentSessionsByPaneKey[paneKey]).toBeDefined()
   })
 
-  it('does not write the restored banner through xterm bytes for sidebar-resumed startup commands', async () => {
+  it('forwards one sidebar resume spawn without writing the restored banner through xterm', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('pty-1')
     transportFactoryQueue.push(transport)
     const pane = createPane(1)
+    const providerSession = { key: 'session_id', id: 'codex-session-1' } as const
 
     connectPanePty(
       pane as never,
@@ -11389,6 +11658,7 @@ describe('connectPanePty', () => {
       createDeps({
         startup: {
           command: "codex 'resume' 'codex-session-1'",
+          resumeProviderSession: providerSession,
           showSessionRestoredBanner: true
         }
       }) as never
@@ -11404,7 +11674,11 @@ describe('connectPanePty', () => {
       expect.stringContaining('--- session restored ---'),
       expect.any(Function)
     )
-    expect(createdTransportOptions[0]?.command).toBe("codex 'resume' 'codex-session-1'")
+    expect(transport.connect).toHaveBeenCalledTimes(1)
+    expect(createdTransportOptions[0]).toMatchObject({
+      command: "codex 'resume' 'codex-session-1'",
+      resumeProviderSession: providerSession
+    })
   })
 
   it('does not consume the sleeping record when daemon reattach returns a live snapshot', async () => {
@@ -11994,14 +12268,13 @@ describe('connectPanePty', () => {
       dataCallback('startup probe output\r\n')
       expect(setHiddenRendererPty).toHaveBeenCalledWith('pty-id', true)
 
-      // The fact stays the sole 2031 responder for gate-managed PTYs.
+      // The fact records the subscription for gate-managed PTYs; it never answers it (#9993).
       factsHandler._dispatchTerminalSideEffectBatchForTest({
         ptyId: 'pty-id',
         seq: 8,
         facts: [{ kind: '2031-subscribe' }]
       })
-      expect(transport.sendInput).toHaveBeenCalledTimes(1)
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
+      expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
     })
 
     it('latches model restore from the out-of-band marker and restores on reveal', async () => {
@@ -12037,7 +12310,8 @@ describe('connectPanePty', () => {
       )
     })
 
-    it('answers each 2031-subscribe fact exactly once, before any hidden mark exists', async () => {
+    it('never answers a 2031-subscribe fact, hidden or visible', async () => {
+      // Regression pin (#9993): a subscribe arms future notifications, it is not a query.
       enableMainAuthority()
       const deps = createDeps({ isVisibleRef: { current: false } })
       const { transport } = await connectHiddenPane(deps)
@@ -12048,27 +12322,23 @@ describe('connectPanePty', () => {
       transportOptions.onPtySpawn?.('pty-id')
       const factsHandler = await import('./terminal-side-effect-facts-handler')
 
-      // Why: the fact can outrun the hidden mark (codex startup race) and must still reply — ownership is structural, not mark-dependent.
       factsHandler._dispatchTerminalSideEffectBatchForTest({
         ptyId: 'pty-id',
         seq: 12,
         facts: [{ kind: '2031-subscribe' }]
       })
-      expect(transport.sendInput).toHaveBeenCalledTimes(1)
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
-
-      // Why: a visible gated pane still answers via the fact — the lifecycle suppresses xterm's CSI reply for gate-managed panes.
       ;(deps.isVisibleRef as { current: boolean }).current = true
       factsHandler._dispatchTerminalSideEffectBatchForTest({
         ptyId: 'pty-id',
         seq: 24,
         facts: [{ kind: '2031-subscribe' }]
       })
-      expect(transport.sendInput).toHaveBeenCalledTimes(2)
-      expect(transport.sendInput).toHaveBeenLastCalledWith('\x1b[?997;1n')
+
+      expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
+      expect(transport.sendInputImmediate).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
     })
 
-    it('registers the fact-answered 2031 subscription for later theme flips', async () => {
+    it('registers the fact-observed 2031 subscription for later theme flips', async () => {
       enableMainAuthority()
       const recordPaneMode2031Subscription = vi.fn()
       const deps = createDeps({
@@ -12088,16 +12358,16 @@ describe('connectPanePty', () => {
         facts: [{ kind: '2031-subscribe' }]
       })
 
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
       // Why: without the registry write, maybePushMode2031Flip won't push CSI 997 after a theme change, so the TUI keeps a stale theme.
       expect(recordPaneMode2031Subscription).toHaveBeenCalledWith(1, 'dark')
+      expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
     })
 
     it('retires the fact-registered subscription when the TUI withdraws it', async () => {
       // The counterpart to the test above. A gated pane never sees the withdrawal bytes
-      // (main drops them) and both the chunk scanner and xterm's CSI handler are disabled
-      // for it, so this fact is the only observer that can retire the subscription. Left
-      // registered, the next theme flip pushes CSI 997 at the shell that replaced the TUI.
+      // (main drops them) and the chunk scanner is disabled for it, so this fact is the only
+      // observer that can retire the subscription. Left registered, the next theme flip
+      // pushes CSI 997 at the shell that replaced the TUI.
       enableMainAuthority()
       const paneMode2031Ref = { current: new Map<number, boolean>() }
       const paneLastThemeModeRef = { current: new Map<number, 'dark' | 'light'>() }
@@ -12106,9 +12376,9 @@ describe('connectPanePty', () => {
         paneMode2031Ref,
         paneLastThemeModeRef,
         // Exactly what use-terminal-pane-lifecycle wires up for this callback.
-        recordPaneMode2031Subscription: (paneId: number, repliedMode: 'dark' | 'light') => {
+        recordPaneMode2031Subscription: (paneId: number, subscribedMode: 'dark' | 'light') => {
           paneMode2031Ref.current.set(paneId, true)
-          paneLastThemeModeRef.current.set(paneId, repliedMode)
+          paneLastThemeModeRef.current.set(paneId, subscribedMode)
         }
       })
       await connectHiddenPane(deps)
@@ -12135,8 +12405,7 @@ describe('connectPanePty', () => {
     })
 
     it('leaves the chunk scanner silent on a gate-managed PTY', async () => {
-      // Main's '2031-subscribe' fact already answers these; a chunk-boundary reply here
-      // would answer the same subscribe a second time.
+      // Main's '2031-subscribe' fact already records these; nothing on this path replies.
       enableMainAuthority()
       const deps = createDeps({ isVisibleRef: { current: false } })
       const { transport, dataCallback } = await connectHiddenPane(deps)
@@ -12496,6 +12765,7 @@ describe('connectPanePty', () => {
         dataCallback: (data: string, meta?: { seq?: number; rawLength?: number }) => void
         getMainBufferSnapshot: ReturnType<typeof vi.fn>
         transport: MockTransport
+        deps: ReturnType<typeof createDeps>
       }> {
         enableMainAuthority()
         const deps = createDeps({ isVisibleRef: { current: true } })
@@ -12527,7 +12797,7 @@ describe('connectPanePty', () => {
           expect.any(Function)
         )
         pane.terminal.write.mockClear()
-        return { pane, dataCallback, getMainBufferSnapshot, transport }
+        return { pane, dataCallback, getMainBufferSnapshot, transport, deps }
       }
 
       function writtenData(pane: ReturnType<typeof createPane>): string {
@@ -12548,24 +12818,25 @@ describe('connectPanePty', () => {
         expect(writtenData(pane)).toContain('NEW')
       })
 
-      it('answers a 2031 subscribe on a chunk the restored snapshot drops as duplicate', async () => {
-        // Why the scan runs before reconciliation: the snapshot restore replays bytes
-        // into xterm without answering queries, so this live delivery is the only
-        // chance to reply. Dropping the chunk as a duplicate must not drop the query.
-        // Gate off so the chunk scanner (not main's fact) owns this pane's reply.
+      it('records a 2031 subscribe on a chunk the restored snapshot drops as duplicate', async () => {
+        // Why the scan runs before reconciliation: the snapshot restore replays bytes into
+        // xterm without tracking modes, so this live delivery is the only chance to observe
+        // the subscription. Dropping the chunk as a duplicate must not drop that.
+        // Gate off so the chunk scanner (not main's fact) owns this pane's registry.
         enableMainAuthority()
         mockStoreState.settings = {
           ...mockStoreState.settings,
           terminalHiddenDeliveryGate: false
         } as StoreState['settings']
-        const { pane, dataCallback, transport } = await restoreVisiblePaneToBaseline()
+        const { pane, dataCallback, transport, deps } = await restoreVisiblePaneToBaseline()
         transport.sendInput.mockClear()
 
         dataCallback(`SUB\x1b[?2031h`, { seq: 60, rawLength: 11 })
         await flushAsyncTicks(8)
 
         expect(writtenData(pane)).not.toContain('SUB')
-        expect(transport.sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
+        expect(deps.paneMode2031Ref.current.get(1)).toBe(true)
+        expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
       })
 
       it('slices a partial overlap when raw and clean lengths match', async () => {
@@ -12705,7 +12976,7 @@ describe('connectPanePty', () => {
     })
   })
 
-  it('defers hidden synchronized-output atlas recovery until reveal', async () => {
+  it('keeps hidden synchronized output off the global atlas recovery path', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('pty-id')
     const capturedDataCallback: { current: ((data: string) => void) | null } = { current: null }
@@ -12741,17 +13012,15 @@ describe('connectPanePty', () => {
       vi.advanceTimersByTime(50)
 
       expect(writes).toEqual([`${startChunk}${plainRowChunk}${endChunk}`])
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
 
       parseCallbacks[0]?.()
-
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
+      expectNoGlobalAtlasRecovery()
     } finally {
       vi.useRealTimers()
     }
   })
 
-  it('defers split hidden synchronized-output markers until reveal', async () => {
+  it('keeps split hidden synchronized output off the global atlas recovery path', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('pty-id')
     const capturedDataCallback: { current: ((data: string) => void) | null } = { current: null }
@@ -12783,11 +13052,9 @@ describe('connectPanePty', () => {
       vi.advanceTimersByTime(50)
 
       expect(writes.join('')).toBe('\x1b[?2026hbody row\r\ntail\x1b[?2026l')
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
 
       parseCallbacks[0]?.()
-
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
+      expectNoGlobalAtlasRecovery()
     } finally {
       vi.useRealTimers()
     }
@@ -12825,14 +13092,13 @@ describe('connectPanePty', () => {
       for (const callback of parseCallbacks) {
         callback()
       }
-
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
+      expectNoGlobalAtlasRecovery()
     } finally {
       vi.useRealTimers()
     }
   })
 
-  it('defers hidden high-confidence TUI redraw recovery until reveal', async () => {
+  it('keeps hidden TUI redraw output off the global atlas recovery path', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('pty-id')
     const capturedDataCallback: { current: ((data: string) => void) | null } = { current: null }
@@ -12859,17 +13125,15 @@ describe('connectPanePty', () => {
       capturedDataCallback.current?.('\x1b[2J\x1b[Hredrawn hidden table\x1b[K')
 
       vi.advanceTimersByTime(50)
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
 
       parseCallbacks[0]?.()
-
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
+      expectNoGlobalAtlasRecovery()
     } finally {
       vi.useRealTimers()
     }
   })
 
-  it('advances hidden rewrite state without scheduling atlas recovery', async () => {
+  it('keeps hidden rewrite frames on the pane-local output path', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('pty-id')
     const capturedDataCallback: { current: ((data: string) => void) | null } = { current: null }
@@ -12897,26 +13161,22 @@ describe('connectPanePty', () => {
       vi.advanceTimersByTime(50)
       expect(writes).toEqual(['prompt rewrite\r'])
       parseCallbacks.shift()?.()
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
 
       capturedDataCallback.current?.('\x1b[?2026hredraw frame\x1b[?2026l')
       vi.advanceTimersByTime(50)
       expect(writes).toEqual(['prompt rewrite\r', '\x1b[?2026hredraw frame\x1b[?2026l'])
       parseCallbacks.shift()?.()
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
-      scheduleTerminalWebglAtlasRecovery.mockClear()
 
       capturedDataCallback.current?.('plain after frame')
       vi.advanceTimersByTime(50)
       parseCallbacks.shift()?.()
-
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
+      expectNoGlobalAtlasRecovery()
     } finally {
       vi.useRealTimers()
     }
   })
 
-  it('resets hidden synchronized state when hidden renderer output is skipped', async () => {
+  it('keeps output after a skipped hidden alternate-screen frame pane-local', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('pty-id')
     const capturedDataCallback: {
@@ -12946,8 +13206,6 @@ describe('connectPanePty', () => {
       capturedDataCallback.current?.('\x1b[?2026h')
       vi.advanceTimersByTime(50)
       parseCallbacks.shift()?.()
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
-      scheduleTerminalWebglAtlasRecovery.mockClear()
       writes.length = 0
 
       isVisibleRef.current = true
@@ -12962,7 +13220,7 @@ describe('connectPanePty', () => {
       parseCallbacks.shift()?.()
 
       expect(writes).toEqual(['plain after skipped close\r\n'])
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
+      expectNoGlobalAtlasRecovery()
     } finally {
       vi.useRealTimers()
     }
@@ -13259,7 +13517,7 @@ describe('connectPanePty', () => {
     binding.dispose()
   })
 
-  it('answers a mode 2031 subscribe once, from the raw chunk boundary', async () => {
+  it('records a mode 2031 subscribe from the raw chunk boundary without answering', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('pty-id')
     const capturedDataCallback: { current: ((data: string) => void) | null } = { current: null }
@@ -13289,8 +13547,8 @@ describe('connectPanePty', () => {
 
       // Why the scanner and not xterm's CSI handler: xterm batches PTY chunks into one
       // parse, so only this layer knows the chunk ended still subscribed (#9993).
-      expect(transport.sendInput).toHaveBeenCalledTimes(1)
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[?997;2n')
+      expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
+      expect(transport.sendInputImmediate).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
       // The bytes still reach xterm so the emulator tracks the mode itself.
       expect(pane.terminal.write).toHaveBeenCalledWith('\x1b[?2031h')
     } finally {
@@ -13300,12 +13558,12 @@ describe('connectPanePty', () => {
     binding.dispose()
   })
 
-  // Why these three: fish 4.7.1 enables and disables 2031 around *every* prompt with no
-  // opt-out, so back-to-back chunks each carrying a toggle are the normal case, not an edge
-  // case. Each chunk owes exactly one decision, and xterm cannot make it — it parses several
-  // chunks in one synchronous batch, so a reply deferred to the parser is either dropped or
-  // answered against a subscription a later chunk already withdrew (#9993).
-  describe('mode 2031 replies are decided per raw PTY chunk', () => {
+  // Why: fish 4.7.1 enables and disables 2031 around *every* prompt with no opt-out, so
+  // back-to-back chunks each carrying a toggle are the normal case. Subscribing is never
+  // answered (#9993) — these pin that silence plus the per-chunk subscription bookkeeping
+  // that theme-flip pushes depend on. xterm cannot do that bookkeeping: it parses several
+  // chunks in one synchronous batch and only sees the net result.
+  describe('mode 2031 subscriptions are tracked per raw PTY chunk, never answered', () => {
     async function connectVisiblePane(): Promise<{
       transport: ReturnType<typeof createMockTransport>
       deps: ReturnType<typeof createDeps>
@@ -13344,56 +13602,60 @@ describe('connectPanePty', () => {
     const replies = (transport: { sendInput: { mock: { calls: unknown[][] } } }): unknown[] =>
       transport.sendInput.mock.calls.flat().filter((arg) => String(arg).includes('997'))
 
-    it('answers a chunk that ends subscribed even when the next chunk withdraws', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
-      // Two separate PTY chunks. xterm would parse both in one batch and see only the net
-      // result; the first chunk still owes a reply.
+    it('registers a chunk that ends subscribed, then retires it when the next withdraws', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
+      // Two separate PTY chunks. xterm would parse both in one batch and see only the net result.
       emit('\x1b[?2031h')
+      expect(deps.paneMode2031Ref.current.get(1)).toBe(true)
       emit('\x1b[?2031l')
-      expect(replies(transport)).toEqual(['\x1b[?997;2n'])
+      expect(deps.paneMode2031Ref.current.get(1)).toBeUndefined()
+      expect(replies(transport)).toEqual([])
       dispose()
     })
 
-    it('answers each chunk that ends subscribed', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+    it('re-registers a chunk that withdraws and subscribes again', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       emit('\x1b[?2031h')
       emit('\x1b[?2031l\x1b[?2031h')
-      expect(replies(transport)).toHaveLength(2)
+      expect(deps.paneMode2031Ref.current.get(1)).toBe(true)
+      expect(replies(transport)).toEqual([])
       dispose()
     })
 
-    it('stays silent when one chunk both subscribes and withdraws', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
-      // The fish prompt case: the subscription is gone before the program could read a reply.
+    it('registers nothing when one chunk both subscribes and withdraws', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
+      // The fish prompt case: the subscription is gone before the program could read anything.
       emit('\x1b[?2031h prompt \x1b[?2031l')
+      expect(deps.paneMode2031Ref.current.get(1)).toBeUndefined()
       expect(replies(transport)).toEqual([])
       dispose()
     })
 
-    it('stays silent when the withdrawal is split across two chunks', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+    it('registers nothing when the withdrawal is split across two chunks', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       emit('\x1b[?2031h prompt \x1b[?20')
-      expect(replies(transport)).toEqual([])
       emit('31l')
+      expect(deps.paneMode2031Ref.current.get(1)).toBeUndefined()
       expect(replies(transport)).toEqual([])
       dispose()
     })
 
-    it('stays silent when an unrelated private mode appends a split withdrawal', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+    it('registers nothing when an unrelated private mode appends a split withdrawal', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       emit('\x1b[?2031h prompt \x1b[?25')
-      expect(replies(transport)).toEqual([])
       emit(';2031l')
+      expect(deps.paneMode2031Ref.current.get(1)).toBeUndefined()
       expect(replies(transport)).toEqual([])
       dispose()
     })
 
-    it('answers after an ambiguous tail resolves to another mode', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+    it('registers the subscription once an ambiguous tail resolves to another mode', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       emit('\x1b[?2031h drawing \x1b[?20')
-      expect(replies(transport)).toEqual([])
+      expect(deps.paneMode2031Ref.current.get(1)).toBeUndefined()
       emit('25h')
-      expect(replies(transport)).toEqual(['\x1b[?997;2n'])
+      expect(deps.paneMode2031Ref.current.get(1)).toBe(true)
+      expect(replies(transport)).toEqual([])
       dispose()
     })
 
@@ -13417,19 +13679,21 @@ describe('connectPanePty', () => {
       dispose()
     })
 
-    it('answers once when a TUI subscribes at the end of a fish prompt chunk', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+    it('registers a TUI that subscribes at the end of a fish prompt chunk', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       emit(`${FISH_PROMPT_HANDOFF}\x1b[?2031h`)
-      expect(replies(transport)).toHaveLength(1)
+      expect(deps.paneMode2031Ref.current.get(1)).toBe(true)
+      expect(replies(transport)).toEqual([])
       dispose()
     })
 
-    it('answers a subscribe whose withdrawal never arrives', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+    it('keeps a subscription whose withdrawal never arrives', async () => {
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       // A real TUI: subscribe now, unsubscribe minutes later on exit.
       emit('\x1b[?2031h')
       emit('painting the ui')
-      expect(replies(transport)).toHaveLength(1)
+      expect(deps.paneMode2031Ref.current.get(1)).toBe(true)
+      expect(replies(transport)).toEqual([])
       dispose()
     })
 
@@ -13446,7 +13710,7 @@ describe('connectPanePty', () => {
     })
 
     it('discards a half-read escape prefix when the pane swaps PTYs', async () => {
-      const { transport, emit, dispose } = await connectVisiblePane()
+      const { transport, deps, emit, dispose } = await connectVisiblePane()
       // Why: the tail is a byte range from the old stream. Splicing it onto the first
       // chunk of a replacement PTY fabricates a subscribe no program ever sent.
       transport.serializeBuffer = vi.fn().mockResolvedValue(null)
@@ -13457,12 +13721,13 @@ describe('connectPanePty', () => {
 
       emit('31h')
 
+      expect(deps.paneMode2031Ref.current.get(1)).toBeUndefined()
       expect(replies(transport)).toEqual([])
       dispose()
     })
   })
 
-  it('answers hidden Codex mode 2031 subscribes split across becoming visible', async () => {
+  it('records hidden Codex mode 2031 subscribes split across becoming visible', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('pty-id')
     const capturedDataCallback: { current: ((data: string) => void) | null } = { current: null }
@@ -13497,8 +13762,9 @@ describe('connectPanePty', () => {
     isVisibleRef.current = true
     capturedDataCallback.current?.('31h')
 
-    expect(transport.sendInputImmediate).toHaveBeenCalledWith('\x1b[?997;2n')
+    expect(transport.sendInputImmediate).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
     expect(paneMode2031Ref.current.get(1)).toBe(true)
+    // Seeded so the next appearance re-apply only pushes on a real color-mode flip.
     expect(paneLastThemeModeRef.current.get(1)).toBe('light')
     expect(pane.terminal.write).not.toHaveBeenCalledWith('31h', expect.any(Function))
 
@@ -14047,7 +14313,7 @@ describe('connectPanePty', () => {
       await flushAsyncTicks(20)
 
       expect(getMainBufferSnapshot).toHaveBeenCalled()
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[?997;1n')
+      expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
       expect(pane.terminal.write).toHaveBeenCalledWith(
         expect.stringContaining('healed from snapshot'),
         expect.any(Function)
@@ -14745,7 +15011,8 @@ describe('connectPanePty', () => {
       undefined,
       { connectionId: null }
     )
-    expect(transport.sendInput).toHaveBeenCalledWith(expect.stringContaining('\x1b['))
+    // Remote gated panes record the subscription from the fact and answer nothing (#9993).
+    expect(transport.sendInput).not.toHaveBeenCalledWith(expect.stringMatching(/\?997/))
     expect(recordPaneMode2031Subscription).toHaveBeenCalledWith(1, expect.any(String))
     deps.paneMode2031Ref.current.set(1, true)
     deps.paneLastThemeModeRef.current.set(1, 'dark')
@@ -14903,6 +15170,63 @@ describe('connectPanePty', () => {
     disposable.dispose()
   })
 
+  it('preserves the painted normal buffer when a successful hidden restore has no image', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('remote:env-1@@terminal-1')
+    const capturedDataCallback: {
+      current: ((data: string, meta?: { seq?: number; rawLength?: number }) => void) | null
+    } = { current: null }
+    const hidden = 'x'.repeat(2 * 1024 * 1024 + 1)
+    const live = 'visible remote output\r\n'
+    transport.serializeBuffer = vi.fn()
+    transport.serializeBufferOutcome = vi.fn().mockResolvedValue({
+      availability: { kind: 'snapshot' },
+      snapshot: {
+        data: '',
+        scrollbackAnsi: '',
+        cols: 120,
+        rows: 40,
+        seq: hidden.length + live.length,
+        source: 'headless'
+      }
+    })
+    transport.connect.mockImplementation(async ({ callbacks }: { callbacks: ConnectCallbacks }) => {
+      capturedDataCallback.current = callbacks.onData ?? null
+      return 'remote:env-1@@terminal-1'
+    })
+    transportFactoryQueue.push(transport)
+    const pane = createPane(1)
+    const deps = createDeps({ isVisibleRef: { current: false } })
+    const disposable = connectPanePty(pane as never, createManager(1) as never, deps as never)
+    await flushAsyncTicks(6)
+    const writeStart = pane.terminal.write.mock.calls.length
+
+    capturedDataCallback.current?.(hidden, { seq: hidden.length, rawLength: hidden.length })
+    ;(deps.isVisibleRef as { current: boolean }).current = true
+    capturedDataCallback.current?.(live, {
+      seq: hidden.length + live.length,
+      rawLength: live.length
+    })
+    await flushAsyncTicks(20)
+
+    const restoreWrites = pane.terminal.write.mock.calls
+      .slice(writeStart)
+      .map(([data]) => String(data))
+    const paintedFrame = Array.from({ length: 8 }, (_, index) => `painted-frame-${index + 1}`).join(
+      '\r\n'
+    )
+    const actual = await renderHeadlessTerminalState([paintedFrame, ...restoreWrites], 120, 4)
+    const expected = await renderHeadlessTerminalState(
+      [paintedFrame, ...restoreWrites.filter((data) => data === live)],
+      120,
+      4
+    )
+    expect(actual).toEqual(expected)
+    expect(transport.serializeBufferOutcome).toHaveBeenCalledTimes(1)
+    expect(transport.serializeBuffer).not.toHaveBeenCalled()
+    disposable.dispose()
+  })
+
   it('defers inactive split-pane plain hidden output restore until the pane returns', async () => {
     const { resetHiddenOutputRestoreSchedulerForTests } =
       await import('./hidden-output-restore-scheduler')
@@ -15203,6 +15527,61 @@ describe('connectPanePty', () => {
     disposable.dispose()
   })
 
+  it('keeps a hidden-output alt frame at the capture grid below the fit floor', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('pty-id')
+    let onData: ConnectCallbacks['onData']
+    transport.connect.mockImplementation(async ({ callbacks }: { callbacks: ConnectCallbacks }) => {
+      onData = callbacks.onData
+      return 'pty-id'
+    })
+    transportFactoryQueue.push(transport)
+    const getMainBufferSnapshot = window.api.pty.getMainBufferSnapshot as unknown as ReturnType<
+      typeof vi.fn
+    >
+    const hidden = 'x'.repeat(2 * 1024 * 1024 + 1)
+    getMainBufferSnapshot.mockResolvedValue({
+      data: 'TOO-WIDE-ALT-FRAME',
+      frameRestoreAnsi: '\x1b[?1004h\x1b[?25l',
+      cols: 120,
+      rows: 40,
+      seq: hidden.length + 1,
+      alternateScreen: true,
+      scrollbackAnsi: 'preserved history'
+    })
+    const pane = createPane(1)
+    pane.terminal.cols = 80
+    pane.terminal.rows = 24
+    const writes: string[] = []
+    pane.terminal.write = vi.fn((data: string, callback?: () => void) => {
+      writes.push(data)
+      callback?.()
+    })
+    pane.container.getBoundingClientRect = vi.fn(() => createRect(4, 3))
+    const deps = createDeps({ isVisibleRef: { current: false } })
+    const binding = connectPanePty(pane as never, createManager(1) as never, deps as never)
+    await flushAsyncTicks(6)
+    onData?.(hidden, { seq: hidden.length, rawLength: hidden.length })
+    const { _dispatchPtyModelRestoreNeededForTest } = await import('./pty-model-restore-channel')
+    _dispatchPtyModelRestoreNeededForTest({
+      id: 'pty-id',
+      reason: 'hidden-drop',
+      markerSeq: hidden.length + 1
+    })
+    ;(deps.isVisibleRef as { current: boolean }).current = true
+    const { requestTerminalBacklogRecovery } =
+      await import('@/lib/pane-manager/pane-terminal-output-scheduler')
+    requestTerminalBacklogRecovery(pane.terminal as never)
+    await flushAsyncTicks(20)
+
+    expect(writes.join('')).toContain('TOO-WIDE-ALT-FRAME')
+    expect(writes.join('')).toContain('preserved history')
+    expect(writes.filter((write) => write.includes('TOO-WIDE-ALT-FRAME'))).toHaveLength(1)
+    expect(pane.terminal.resize).toHaveBeenCalledWith(120, 40)
+    expect(transport.resize).not.toHaveBeenCalled()
+    binding.dispose()
+  })
+
   it('drains foreground output after a renderer-sourced hidden-backlog snapshot without seq', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport('pty-id')
@@ -17160,7 +17539,6 @@ describe('connectPanePty', () => {
 
     expect(manager.markPaneHasComplexScriptOutput).not.toHaveBeenCalled()
     expect(refresh).toHaveBeenCalledWith(0, 39, true)
-    expect(scheduleTerminalWebglAtlasRecovery).toHaveBeenCalledTimes(1)
   })
 
   it('forces a viewport refresh for foreground CJK output without CSI', async () => {
@@ -17189,10 +17567,9 @@ describe('connectPanePty', () => {
     capturedDataCallback.current?.('没改什么(护城河)\r\n')
 
     expect(refresh).toHaveBeenCalledWith(0, 39, true)
-    expect(scheduleTerminalWebglAtlasRecovery).toHaveBeenCalledTimes(1)
   })
 
-  it('schedules WebGL atlas recovery after renderer-risk foreground output parses', async () => {
+  it('refreshes renderer-risk output without clearing the shared glyph atlas', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport()
     const capturedDataCallback: { current: ((data: string) => void) | null } = { current: null }
@@ -17217,15 +17594,13 @@ describe('connectPanePty', () => {
     await flushAsyncTicks(6)
 
     capturedDataCallback.current?.('没改什么(护城河)\r\n')
-
-    expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
     expect(refresh).not.toHaveBeenCalled()
     parseCallback?.()
     expect(refresh).toHaveBeenCalledWith(0, 39, true)
-    expect(scheduleTerminalWebglAtlasRecovery).toHaveBeenCalledTimes(1)
+    expectNoGlobalAtlasRecovery()
   })
 
-  it('schedules WebGL atlas recovery for Vim-style foreground alternate-screen redraws', async () => {
+  it('refreshes alternate-screen redraws without clearing the shared glyph atlas', async () => {
     const restoreNavigator = temporarilySetNavigatorUserAgent('Mozilla/5.0 (Macintosh)')
     try {
       const { connectPanePty } = await import('./pty-connection')
@@ -17257,17 +17632,15 @@ describe('connectPanePty', () => {
       capturedDataCallback.current?.(
         '\x1b[2J\x1b[H{"name":"eepo"}\r\n\x1b[2;1H{"name":"expo"}\x1b[K'
       )
-
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
       parseCallback?.()
       expect(refresh).toHaveBeenCalledWith(0, 39, true)
-      expect(scheduleTerminalWebglAtlasRecovery).toHaveBeenCalledTimes(1)
+      expectNoGlobalAtlasRecovery()
     } finally {
       restoreNavigator()
     }
   })
 
-  it('schedules WebGL atlas recovery when a foreground rewrite enters alternate screen', async () => {
+  it('refreshes a foreground rewrite entering alternate screen without an atlas clear', async () => {
     const restoreNavigator = temporarilySetNavigatorUserAgent('Mozilla/5.0 (Macintosh)')
     try {
       const { connectPanePty } = await import('./pty-connection')
@@ -17296,19 +17669,17 @@ describe('connectPanePty', () => {
       await flushAsyncTicks(6)
 
       capturedDataCallback.current?.('\x1b[?1049h\x1b[2J\x1b[HVim package.json')
-
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
       // Why: xterm switches to the alternate buffer while parsing; the write callback observes the post-parse state.
       ;(pane.terminal.buffer.active as { type: 'normal' | 'alternate' }).type = 'alternate'
       parseCallback?.()
       expect(refresh).toHaveBeenCalledWith(0, 39, true)
-      expect(scheduleTerminalWebglAtlasRecovery).toHaveBeenCalledTimes(1)
+      expectNoGlobalAtlasRecovery()
     } finally {
       restoreNavigator()
     }
   })
 
-  it('schedules WebGL atlas recovery when the alternate-screen enter sequence splits across chunks', async () => {
+  it('avoids atlas clears when alternate-screen entry splits across chunks', async () => {
     const restoreNavigator = temporarilySetNavigatorUserAgent('Mozilla/5.0 (Macintosh)')
     try {
       const { connectPanePty } = await import('./pty-connection')
@@ -17339,18 +17710,18 @@ describe('connectPanePty', () => {
       // Why: PTY reads split CSI sequences at arbitrary byte boundaries, so the enter sequence can straddle two onData chunks.
       capturedDataCallback.current?.('\x1b[?104')
       parseCallback?.()
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
 
       capturedDataCallback.current?.('9h\x1b[2J\x1b[H~\x1b[K')
       ;(pane.terminal.buffer.active as { type: 'normal' | 'alternate' }).type = 'alternate'
       parseCallback?.()
-      expect(scheduleTerminalWebglAtlasRecovery).toHaveBeenCalledTimes(1)
+      expect(refresh).toHaveBeenCalledWith(0, 39, true)
+      expectNoGlobalAtlasRecovery()
     } finally {
       restoreNavigator()
     }
   })
 
-  it('schedules WebGL atlas recovery when a foreground rewrite leaves alternate screen', async () => {
+  it('avoids atlas clears when a foreground rewrite leaves alternate screen', async () => {
     const restoreNavigator = temporarilySetNavigatorUserAgent('Mozilla/5.0 (Macintosh)')
     try {
       const { connectPanePty } = await import('./pty-connection')
@@ -17379,17 +17750,17 @@ describe('connectPanePty', () => {
       connectPanePty(pane as never, createManager(1) as never, createDeps() as never)
       await flushAsyncTicks(6)
 
-      // Vim's final frame restores the normal buffer in one chunk; the atlas must still rebuild even though the post-parse buffer reads normal.
       capturedDataCallback.current?.('\x1b[34;1H\x1b[K\x1b[34;1H\x1b[?1049l\x1b[?25h')
       ;(pane.terminal.buffer.active as { type: 'normal' | 'alternate' }).type = 'normal'
       parseCallback?.()
-      expect(scheduleTerminalWebglAtlasRecovery).toHaveBeenCalledTimes(1)
+      expect(refresh).toHaveBeenCalledWith(0, 39, true)
+      expectNoGlobalAtlasRecovery()
     } finally {
       restoreNavigator()
     }
   })
 
-  it('schedules WebGL atlas recovery when one chunk enters and exits alternate screen', async () => {
+  it('avoids atlas clears when one chunk enters and exits alternate screen', async () => {
     const restoreNavigator = temporarilySetNavigatorUserAgent('Mozilla/5.0 (Macintosh)')
     try {
       const { connectPanePty } = await import('./pty-connection')
@@ -17404,15 +17775,6 @@ describe('connectPanePty', () => {
       transportFactoryQueue.push(transport)
 
       const pane = createPane(1)
-      let bufferChangeListener: (() => void) | undefined
-      ;(
-        pane.terminal.buffer as {
-          onBufferChange?: (listener: () => void) => { dispose: () => void }
-        }
-      ).onBufferChange = (listener) => {
-        bufferChangeListener = listener
-        return { dispose: vi.fn() }
-      }
       const refresh = vi.fn()
       let parseCallback: (() => void) | undefined
       const terminal = pane.terminal as typeof pane.terminal & {
@@ -17426,18 +17788,16 @@ describe('connectPanePty', () => {
       connectPanePty(pane as never, createManager(1) as never, createDeps() as never)
       await flushAsyncTicks(6)
 
-      // A coalesced flush can parse enter -> draw -> exit in one write (buffer nets back to 'normal'); the switch count still marks it alternate-screen work.
       capturedDataCallback.current?.('\x1b[?1049h\x1b[2J\x1b[Hpager frame\x1b[K\x1b[?1049l')
-      bufferChangeListener?.()
-      bufferChangeListener?.()
       parseCallback?.()
-      expect(scheduleTerminalWebglAtlasRecovery).toHaveBeenCalledTimes(1)
+      expect(refresh).toHaveBeenCalledWith(0, 39, true)
+      expectNoGlobalAtlasRecovery()
     } finally {
       restoreNavigator()
     }
   })
 
-  it('schedules WebGL atlas recovery for real captured Vim redraw chunks split mid-sequence', async () => {
+  it('avoids atlas clears for captured redraw chunks split mid-sequence', async () => {
     const restoreNavigator = temporarilySetNavigatorUserAgent('Mozilla/5.0 (Macintosh)')
     try {
       const { connectPanePty } = await import('./pty-connection')
@@ -17469,13 +17829,13 @@ describe('connectPanePty', () => {
       // Captured from a real vim session: a 1024-byte PTY read boundary cuts the cursor move \x1b[30;5H into "\x1b[30" + ";5H".
       capturedDataCallback.current?.('"rules": {\x1b[29;15H\x1b[K\x1b[30')
       parseCallback?.()
-      expect(scheduleTerminalWebglAtlasRecovery).toHaveBeenCalledTimes(1)
 
       capturedDataCallback.current?.(
         ';5H  "js-combine-iterations": "off"\r\n    }\x1b[31;6H\x1b[K\x1b[33;1H\x1b[?25h'
       )
       parseCallback?.()
-      expect(scheduleTerminalWebglAtlasRecovery).toHaveBeenCalledTimes(2)
+      expect(refresh).toHaveBeenCalled()
+      expectNoGlobalAtlasRecovery()
     } finally {
       restoreNavigator()
     }
@@ -17513,7 +17873,7 @@ describe('connectPanePty', () => {
 
       parseCallback?.()
       expect(refresh).toHaveBeenCalledWith(0, 39, true)
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
+      expectNoGlobalAtlasRecovery()
     } finally {
       restoreNavigator()
     }
@@ -17543,10 +17903,8 @@ describe('connectPanePty', () => {
       await flushAsyncTicks(6)
 
       capturedDataCallback.current?.('\x1b[?2026hplain claude frame\x1b[?2026l')
-
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
       parseCallback?.()
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
+      expectNoGlobalAtlasRecovery()
     } finally {
       restoreNavigator()
     }
@@ -17583,7 +17941,6 @@ describe('connectPanePty', () => {
 
     expect(manager.markPaneHasComplexScriptOutput).not.toHaveBeenCalled()
     expect(refresh).toHaveBeenCalledWith(0, 39, true)
-    expect(scheduleTerminalWebglAtlasRecovery).toHaveBeenCalledTimes(1)
   })
 
   it('forces a viewport refresh when the foreground CSI introducer is split across PTY chunks', async () => {
@@ -17617,7 +17974,6 @@ describe('connectPanePty', () => {
 
     expect(manager.markPaneHasComplexScriptOutput).not.toHaveBeenCalled()
     expect(refresh).toHaveBeenCalledWith(0, 39, true)
-    expect(scheduleTerminalWebglAtlasRecovery).toHaveBeenCalledTimes(1)
   })
 
   it('does not keep forcing viewport refresh after completed background redraws', async () => {
@@ -17647,11 +18003,9 @@ describe('connectPanePty', () => {
     expect(refresh).toHaveBeenCalledWith(0, 39, true)
 
     refresh.mockClear()
-    scheduleTerminalWebglAtlasRecovery.mockClear()
     capturedDataCallback.current?.('plain follow-up output\r\n')
 
     expect(refresh).not.toHaveBeenCalled()
-    expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
   })
 
   it('forces a viewport refresh for native Windows CJK foreground output after terminal input', async () => {
@@ -17762,7 +18116,6 @@ describe('connectPanePty', () => {
       capturedDataCallback.current?.('abc 123 ✓')
 
       expect(refresh).not.toHaveBeenCalled()
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
     } finally {
       restoreNavigator()
     }
@@ -17841,7 +18194,6 @@ describe('connectPanePty', () => {
       capturedDataCallback.current?.('abc 123 ✓')
 
       expect(refresh).not.toHaveBeenCalled()
-      expect(scheduleTerminalWebglAtlasRecovery).not.toHaveBeenCalled()
     } finally {
       restoreNavigator()
     }
@@ -21108,7 +21460,7 @@ describe('connectPanePty', () => {
     expect(api.pty.signal).toHaveBeenCalledWith('leaf-session', 'SIGWINCH')
   })
 
-  it('paints a parked SSH model before the remote connection settles', async () => {
+  it('keeps a too-wide parked SSH alt frame while no live process can repaint it', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const sshPtyId = toAppSshPtyId('conn-1', 'relay-pty-1')
     const sshConnect = createDeferred<SshConnectionState | null>()
@@ -21117,12 +21469,13 @@ describe('connectPanePty', () => {
     vi.mocked(window.api.ssh.connect).mockReturnValue(sshConnect.promise)
     vi.mocked(window.api.pty.getMainBufferSnapshot).mockResolvedValue({
       data: 'PARKED-SSH-PAINTED-WITHOUT-NETWORK\r\n',
-      cols: 101,
+      cols: 140,
       rows: 31,
       seq: 123,
-      source: 'headless'
+      source: 'headless',
+      alternateScreen: true,
+      scrollbackAnsi: 'PARKED-SSH-SCROLLBACK\r\n'
     })
-    await parkTabForReveal('tab-1', sshPtyId)
     mockStoreState = {
       ...mockStoreState,
       tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: sshPtyId }] },
@@ -21134,11 +21487,13 @@ describe('connectPanePty', () => {
     }
 
     const pane = createPane(1)
+    pane.fitAddon.proposeDimensions = vi.fn(() => ({ cols: 80, rows: 24 }))
     const { writes } = captureCallbackTerminalWrites(pane)
     const binding = connectPanePty(
       pane as never,
       createManager(1) as never,
       createDeps({
+        mountFollowsTerminalPark: true,
         restoredLeafId: LEAF_1,
         restoredPtyIdByLeafId: { [LEAF_1]: sshPtyId }
       }) as never
@@ -21147,6 +21502,7 @@ describe('connectPanePty', () => {
 
     expect(window.api.ssh.connect).toHaveBeenCalledWith({ targetId: 'conn-1' })
     expect(window.api.pty.getMainBufferSnapshot).toHaveBeenCalledOnce()
+    // No live SSH process can repaint this preconnect frame after a SIGWINCH.
     expect(writes.join('')).toContain('PARKED-SSH-PAINTED-WITHOUT-NETWORK')
     expect(transport.connect).not.toHaveBeenCalled()
 
@@ -21183,7 +21539,6 @@ describe('connectPanePty', () => {
     transportFactoryQueue.push(createMockTransport())
     vi.mocked(window.api.pty.getMainBufferSnapshot).mockReturnValue(snapshot.promise)
     vi.mocked(window.api.ssh.connect).mockReturnValue(sshConnect.promise)
-    await parkTabForReveal('tab-1', sshPtyId)
     mockStoreState = {
       ...mockStoreState,
       tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: sshPtyId, generation: 7 }] },
@@ -21210,6 +21565,7 @@ describe('connectPanePty', () => {
       pane as never,
       createManager(1) as never,
       createDeps({
+        mountFollowsTerminalPark: true,
         restoredLeafId: LEAF_1,
         restoredPtyIdByLeafId: { [LEAF_1]: sshPtyId }
       }) as never
@@ -21262,7 +21618,6 @@ describe('connectPanePty', () => {
       seq: 125,
       source: 'headless'
     })
-    await parkTabForReveal('tab-1', foreignPtyId)
     mockStoreState = {
       ...mockStoreState,
       tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: foreignPtyId }] },
@@ -21279,6 +21634,7 @@ describe('connectPanePty', () => {
       pane as never,
       createManager(1) as never,
       createDeps({
+        mountFollowsTerminalPark: true,
         restoredLeafId: LEAF_1,
         restoredPtyIdByLeafId: { [LEAF_1]: foreignPtyId }
       }) as never
@@ -21314,7 +21670,6 @@ describe('connectPanePty', () => {
     })
     transportFactoryQueue.push(transport)
     vi.mocked(window.api.pty.getMainBufferSnapshot).mockReturnValue(snapshot.promise)
-    await parkTabForReveal('tab-1', sshPtyId)
     mockStoreState = {
       ...mockStoreState,
       tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: sshPtyId }] },
@@ -21331,6 +21686,7 @@ describe('connectPanePty', () => {
       pane as never,
       createManager(1) as never,
       createDeps({
+        mountFollowsTerminalPark: true,
         restoredLeafId: LEAF_1,
         restoredPtyIdByLeafId: { [LEAF_1]: sshPtyId }
       }) as never
@@ -21368,7 +21724,6 @@ describe('connectPanePty', () => {
       source: 'headless'
     })
     transportFactoryQueue.push(transport)
-    await parkTabForReveal('tab-1', remotePtyId)
     mockStoreState = {
       ...mockStoreState,
       runtimeStatusByEnvironmentId: new Map([
@@ -21384,7 +21739,7 @@ describe('connectPanePty', () => {
 
     const pane = createPane(1)
     const { parseCallbacks, writes } = captureCallbackTerminalWrites(pane)
-    const deps = createDeps()
+    const deps = createDeps({ mountFollowsTerminalPark: true })
 
     connectPanePty(pane as never, createManager(1) as never, deps as never)
     for (let step = 0; step < 30; step += 1) {
@@ -21399,7 +21754,7 @@ describe('connectPanePty', () => {
     expect(transport.getPtyId).toHaveReturnedWith(remotePtyId)
   })
 
-  it('restores a local main-model snapshot after a contentless park reattach', async () => {
+  it('keeps a parked main-model alt frame at its capture grid while hidden', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const localPtyId = 'global-floating-terminal@@terminal-1'
     const transport = createMockTransport(localPtyId)
@@ -21410,13 +21765,15 @@ describe('connectPanePty', () => {
     transportFactoryQueue.push(transport)
     const getMainBufferSnapshot = vi.mocked(window.api.pty.getMainBufferSnapshot)
     getMainBufferSnapshot.mockResolvedValue({
-      data: 'FLOATING-PARK-RESTORE-OK\r\n',
+      data: 'FLOATING-PARK-ALT-FRAME',
+      frameRestoreAnsi: '\x1b[?25l',
       cols: 113,
       rows: 32,
       seq: 558,
-      source: 'headless'
+      source: 'headless',
+      alternateScreen: true,
+      scrollbackAnsi: 'FLOATING-PARK-HISTORY\r\n'
     })
-    await parkTabForReveal('tab-1', localPtyId, 'global-floating-terminal')
     mockStoreState = {
       ...mockStoreState,
       tabsByWorktree: {
@@ -21434,8 +21791,10 @@ describe('connectPanePty', () => {
     }
 
     const pane = createPane(1)
+    pane.container.getBoundingClientRect = vi.fn(() => createRect(0, 0))
     const { parseCallbacks, writes } = captureCallbackTerminalWrites(pane)
     const deps = createDeps({
+      mountFollowsTerminalPark: true,
       worktreeId: 'global-floating-terminal',
       restoredLeafId: LEAF_1,
       restoredPtyIdByLeafId: { [LEAF_1]: localPtyId }
@@ -21452,7 +21811,55 @@ describe('connectPanePty', () => {
       expect.objectContaining({ sessionId: localPtyId })
     )
     expect(deps.syncPanePtyLayoutBinding).toHaveBeenCalledWith(1, localPtyId)
-    expect(writes.join('')).toContain('FLOATING-PARK-RESTORE-OK')
+    expect(writes.join('')).toContain('FLOATING-PARK-HISTORY')
+    expect(writes.join('')).toContain('FLOATING-PARK-ALT-FRAME')
+    expect(writes.filter((write) => write.includes('FLOATING-PARK-ALT-FRAME'))).toHaveLength(1)
+    expect(pane.terminal.resize).toHaveBeenCalledWith(113, 32)
+  })
+
+  it('restores a parked SSH alt frame after StrictMode watcher disposal', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const sshPtyId = toAppSshPtyId('conn-1', 'relay-pty-static-alt')
+    const transport = createMockTransport(sshPtyId)
+    transport.connect.mockImplementation(async () => {
+      transport.getPtyId.mockReturnValue(sshPtyId)
+      return { id: sshPtyId, isReattach: true, replay: '' }
+    })
+    transportFactoryQueue.push(transport)
+    vi.mocked(window.api.pty.getMainBufferSnapshot).mockResolvedValue({
+      data: '\x1b[0m\x1b[?1049h\x1b[HSTATIC-SSH-ALT-FRAME',
+      frameRestoreAnsi: '\x1b[0m\x1b[?1049h\x1b[?6l\x1b[1;21H',
+      cols: 100,
+      rows: 30,
+      seq: 512,
+      source: 'headless',
+      alternateScreen: true,
+      scrollbackAnsi: 'PRESERVED-SSH-HISTORY\r\n'
+    })
+    mockStoreState = {
+      ...mockStoreState,
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-1', ptyId: null }] },
+      repos: [{ id: 'repo1', connectionId: 'conn-1' }],
+      deferredSshReconnectTargets: ['conn-1'],
+      deferredSshSessionIdsByTabId: { 'tab-1': sshPtyId }
+    }
+
+    const pane = createPane(1)
+    const { parseCallbacks, writes } = captureCallbackTerminalWrites(pane)
+    const deps = createDeps({
+      mountFollowsTerminalPark: true,
+      restoredLeafId: LEAF_1,
+      restoredPtyIdByLeafId: { [LEAF_1]: sshPtyId }
+    })
+    connectPanePty(pane as never, createManager(1) as never, deps as never)
+    for (let step = 0; step < 30; step += 1) {
+      parseCallbacks.shift()?.()
+      await flushAsyncTicks(2)
+    }
+
+    expect(window.api.pty.getMainBufferSnapshot).toHaveBeenCalledOnce()
+    expect(writes.join('')).toContain('PRESERVED-SSH-HISTORY')
+    expect(writes.filter((write) => write.includes('STATIC-SSH-ALT-FRAME'))).toHaveLength(1)
   })
 
   it('falls back to relay replay when the SSH model snapshot stalls', async () => {
@@ -21466,9 +21873,7 @@ describe('connectPanePty', () => {
     })
     transportFactoryQueue.push(transport)
     vi.mocked(window.api.pty.getMainBufferSnapshot).mockReturnValue(new Promise(() => {}))
-    // Why parked: only a reveal remount probes main's model — the pane reads the
-    // still-live park watcher entry at connect time to tell the two apart.
-    await parkTabForReveal('tab-1', sshPtyId)
+    // Why parked: only a reveal remount probes main's model.
 
     mockStoreState = {
       ...mockStoreState,
@@ -21481,6 +21886,7 @@ describe('connectPanePty', () => {
     const pane = createPane(1)
     const { writes } = captureCallbackTerminalWrites(pane)
     const deps = createDeps({
+      mountFollowsTerminalPark: true,
       restoredLeafId: LEAF_1,
       restoredPtyIdByLeafId: { [LEAF_1]: sshPtyId }
     })
@@ -22806,6 +23212,159 @@ describe('connectPanePty', () => {
     }
   })
 
+  it('resets stale keyboard state when a batched done→working→done burst lands as one publication', async () => {
+    const restoreUserAgent = temporarilySetNavigatorUserAgent(
+      'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
+    )
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport()
+    transportFactoryQueue.push(transport)
+
+    try {
+      const paneKey = makePaneKey('tab-1', LEAF_1)
+      const firstDoneAt = Date.now()
+      mockStoreState.agentStatusByPaneKey[paneKey] = {
+        state: 'done',
+        prompt: 'first turn',
+        updatedAt: firstDoneAt,
+        stateStartedAt: firstDoneAt,
+        agentType: 'codex',
+        paneKey,
+        stateHistory: [{ state: 'working', prompt: 'first turn', startedAt: firstDoneAt - 5_000 }]
+      }
+      const pane = createPane(1)
+      const manager = createManager(1)
+      const deps = createDeps()
+
+      connectPanePty(pane as never, manager as never, deps as never)
+      expect(pane.terminal.write).not.toHaveBeenCalled()
+
+      // The burst's intermediate `working` never publishes, so the entry stays `done` end-to-end;
+      // only the stateHistory row proves a second turn ran and re-armed the kitty protocol.
+      const secondDoneAt = firstDoneAt + 10_000
+      mockStoreState.agentStatusByPaneKey[paneKey] = {
+        state: 'done',
+        prompt: 'second turn',
+        updatedAt: secondDoneAt,
+        stateStartedAt: secondDoneAt,
+        agentType: 'codex',
+        paneKey,
+        stateHistory: [
+          { state: 'working', prompt: 'first turn', startedAt: firstDoneAt - 5_000 },
+          { state: 'done', prompt: 'first turn', startedAt: firstDoneAt },
+          { state: 'working', prompt: 'second turn', startedAt: secondDoneAt - 2_000 }
+        ]
+      }
+      notifyStoreSubscribers()
+
+      expect(pane.terminal.write).toHaveBeenCalledWith(
+        `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
+        expect.any(Function)
+      )
+    } finally {
+      restoreUserAgent()
+    }
+  })
+
+  it('resets stale keyboard state when a batched burst ends on working after a completed turn', async () => {
+    const restoreUserAgent = temporarilySetNavigatorUserAgent(
+      'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
+    )
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport()
+    transportFactoryQueue.push(transport)
+
+    try {
+      const paneKey = makePaneKey('tab-1', LEAF_1)
+      const startedAt = Date.now()
+      mockStoreState.agentStatusByPaneKey[paneKey] = {
+        state: 'working',
+        prompt: 'ship it',
+        updatedAt: startedAt,
+        stateStartedAt: startedAt,
+        agentType: 'codex',
+        paneKey,
+        stateHistory: []
+      }
+      const pane = createPane(1)
+      const manager = createManager(1)
+      const deps = createDeps()
+
+      connectPanePty(pane as never, manager as never, deps as never)
+      notifyStoreSubscribers()
+      expect(pane.terminal.write).not.toHaveBeenCalled()
+
+      mockStoreState.agentStatusByPaneKey[paneKey] = {
+        state: 'working',
+        prompt: 'follow-up',
+        updatedAt: startedAt + 8_000,
+        stateStartedAt: startedAt + 8_000,
+        agentType: 'codex',
+        paneKey,
+        stateHistory: [
+          { state: 'working', prompt: 'ship it', startedAt },
+          { state: 'done', prompt: 'ship it', startedAt: startedAt + 4_000 }
+        ]
+      }
+      notifyStoreSubscribers()
+
+      expect(pane.terminal.write).toHaveBeenCalledWith(
+        `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
+        expect.any(Function)
+      )
+    } finally {
+      restoreUserAgent()
+    }
+  })
+
+  it('keeps native Windows same-turn done repaints from re-resetting keyboard state', async () => {
+    const restoreUserAgent = temporarilySetNavigatorUserAgent(
+      'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
+    )
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport()
+    transportFactoryQueue.push(transport)
+
+    try {
+      const paneKey = makePaneKey('tab-1', LEAF_1)
+      const doneAt = Date.now()
+      const pane = createPane(1)
+      const manager = createManager(1)
+      const deps = createDeps()
+
+      connectPanePty(pane as never, manager as never, deps as never)
+
+      mockStoreState.agentStatusByPaneKey[paneKey] = {
+        state: 'done',
+        prompt: 'ship it',
+        updatedAt: doneAt,
+        stateStartedAt: doneAt,
+        agentType: 'codex',
+        paneKey,
+        stateHistory: []
+      }
+      notifyStoreSubscribers()
+      const writesAfterDone = (pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.length
+
+      mockStoreState.agentStatusByPaneKey[paneKey] = {
+        state: 'done',
+        prompt: 'ship it',
+        updatedAt: doneAt + 1_000,
+        stateStartedAt: doneAt,
+        agentType: 'codex',
+        paneKey,
+        stateHistory: []
+      }
+      notifyStoreSubscribers()
+
+      expect((pane.terminal.write as ReturnType<typeof vi.fn>).mock.calls.length).toBe(
+        writesAfterDone
+      )
+    } finally {
+      restoreUserAgent()
+    }
+  })
+
   it('drops native Windows Codex focus reports while a history resume is idle', async () => {
     const restoreUserAgent = temporarilySetNavigatorUserAgent(
       'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
diff --git a/src/renderer/src/components/terminal-pane/pty-connection.ts b/src/renderer/src/components/terminal-pane/pty-connection.ts
index 98868cbe2e6..907a8af9696 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection.ts
@@ -17,6 +17,7 @@ import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
 import { isEphemeralSetupTerminalWorktreeId } from '../../../../shared/ephemeral-setup-terminal-worktree-id'
 import { TERMINAL_PAIRED_PARKING_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
 import { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
+import { parseTerminalKittyKeyboardFlags } from '../../../../shared/terminal-kitty-keyboard-flags'
 import { isRuntimeOwnedSshTargetId, parseExecutionHostId } from '../../../../shared/execution-host'
 import { createTerminalZeroDimensionsMessage } from '../../../../shared/terminal-zero-dimensions-diagnostic'
 import { isWorktreeRemovalFenceError } from '../../../../shared/worktree-removal-fence-error'
@@ -36,7 +37,7 @@ import {
 } from '@/lib/pane-manager/terminal-delivery-credit'
 import { serializeWithAbsoluteCursor } from '../../../../shared/terminal-serialize-absolute-cursor'
 import { isTerminalQueryReply } from '../../../../shared/terminal-query-reply'
-import type { PtyBufferSnapshot, PtyConnectResult } from './pty-transport'
+import type { PtyBufferSnapshot, PtyConnectResult, PtyReplayDataMeta } from './pty-transport'
 import type { IpcPtyTransportOptions, PtyTransportRecoveryState } from './pty-transport-types'
 import { createIpcPtyTransport } from './pty-transport'
 import { createRemoteRuntimePtyTransport } from './remote-runtime-pty-transport'
@@ -131,7 +132,6 @@ import { createShellReadyMarkerScanState, scanForShellReadyMarker } from './shel
 import { getSystemPrefersDark } from '@/lib/terminal-theme'
 import {
   INITIAL_MODE_2031_REPLY_SCAN_STATE,
-  mode2031SequenceFor,
   resolveTerminalColorSchemeMode,
   scanMode2031ReplyDecision
 } from '../../../../shared/terminal-color-scheme-protocol'
@@ -236,8 +236,11 @@ import { createCommandCodeOutputStatusDetector } from '../../../../shared/comman
 import { createCodexBackfillErrorDetector } from './codex-backfill-error-detector'
 import type { PtyDataMeta } from './pty-dispatcher'
 import { getEagerPtyBufferHandle } from './pty-dispatcher'
+import {
+  DeferredReattachLiveDataQueue,
+  MAX_DEFERRED_REATTACH_LIVE_CHARS
+} from './deferred-reattach-live-data-queue'
 import { createTerminalGitHubPRLinkDetector } from '../../../../shared/terminal-github-pr-link-detector'
-import { scheduleTerminalWebglAtlasRecovery } from './terminal-webgl-atlas-recovery'
 import {
   CONPTY_DA1_RESPONSE,
   DEFAULT_DA1_RESPONSE,
@@ -260,7 +263,9 @@ import { resolveHiddenRestoreScrollbackRows } from './terminal-hidden-restore-sc
 import {
   buildMainModelSnapshotReplayWrites,
   hasPositiveTerminalDimensions,
-  resolvePositiveTerminalDimensions
+  readProposedTerminalCols,
+  resolvePositiveTerminalDimensions,
+  shouldSkipAltFrameForWidthMismatch
 } from './terminal-snapshot-replay-paint'
 import {
   decideSshReattachPaintSource,
@@ -275,7 +280,6 @@ import {
   setCommandCodeDoneSettleExecutor
 } from './command-code-done-settle'
 import { canCommandCodeOutputOwnPane } from './command-code-output-ownership'
-import { isTerminalTabParked } from './terminal-parked-watcher-registry'
 import {
   getExecutionHostIdForWorktree,
   getSettingsForWorktreeRuntimeOwner
@@ -524,11 +528,10 @@ const e2eTerminalHiddenSnapshotOverrides = new Map<string, E2eTerminalHiddenSnap
 
 // Why: the per-chunk hidden-skip grammar is deleted (Phase 6) — hidden bytes
 // either never reach the renderer (delivery gate) or ride the background
-// scheduler queue. Only the mode-2031 fact-reply counter still has a producer.
+// scheduler queue.
 type E2eTerminalPtyOutputDebugSnapshot = {
   hiddenRendererSkipCount: number
   hiddenRendererSkippedChars: number
-  hiddenRendererMode2031ReplyCount: number
 }
 
 type E2eTerminalPtyOutputDebugApi = {
@@ -561,14 +564,12 @@ type ColdRestoreAgentResumeStartup = PendingStartupCommand & {
 
 const e2eTerminalPtyOutputDebugState: E2eTerminalPtyOutputDebugSnapshot = {
   hiddenRendererSkipCount: 0,
-  hiddenRendererSkippedChars: 0,
-  hiddenRendererMode2031ReplyCount: 0
+  hiddenRendererSkippedChars: 0
 }
 
 function resetE2eTerminalPtyOutputDebug(): void {
   e2eTerminalPtyOutputDebugState.hiddenRendererSkipCount = 0
   e2eTerminalPtyOutputDebugState.hiddenRendererSkippedChars = 0
-  e2eTerminalPtyOutputDebugState.hiddenRendererMode2031ReplyCount = 0
 }
 
 function exposeE2eTerminalPtyOutputDebug(): void {
@@ -591,14 +592,6 @@ function recordHiddenRendererSkip(chars: number): void {
   e2eTerminalPtyOutputDebugState.hiddenRendererSkippedChars += chars
 }
 
-function recordHiddenMode2031Reply(): void {
-  if (!e2eConfig.exposeStore) {
-    return
-  }
-  exposeE2eTerminalPtyOutputDebug()
-  e2eTerminalPtyOutputDebugState.hiddenRendererMode2031ReplyCount += 1
-}
-
 function exposeE2eTerminalPtyDataInjection(): void {
   if (!e2eConfig.exposeStore || typeof window === 'undefined') {
     return
@@ -1088,6 +1081,25 @@ function isSetupSplitGeometryReady(
   )
 }
 
+/** Start time of the newest completed turn, counting turns already folded into history.
+ *  Why: batched publications coalesce done→working→done into a single store notification,
+ *  so the done EDGE survives only in stateHistory; comparing `state` alone misses it. */
+function resolveLatestAgentDoneStartedAt(entry: AgentStatusEntry | undefined): number | undefined {
+  if (!entry) {
+    return undefined
+  }
+  if (entry.state === 'done') {
+    return entry.stateStartedAt
+  }
+  const history = entry.stateHistory ?? []
+  for (let index = history.length - 1; index >= 0; index -= 1) {
+    if (history[index].state === 'done') {
+      return history[index].startedAt
+    }
+  }
+  return undefined
+}
+
 /**
  * Establishes a binding between a terminal pane and its corresponding PTY stream,
  * managing input, output, title synchronization, and agent status tracking.
@@ -1102,10 +1114,7 @@ export function connectPanePty(
   // settles after remount must not remount its already-replaced successor.
   const terminalRecoveryGeneration = captureTerminalPaneRecoveryGeneration(deps.tabId)
   const terminalRecoveryInstance = registerTerminalPaneRecoveryInstance(deps.tabId)
-  // Why sampled here: the host disposes this tab's park watcher in the effect
-  // that follows this mount, so connect time is the only moment a pane can tell
-  // a reveal remount from an in-place reattach.
-  let mountFollowsTerminalPark = isTerminalTabParked(deps.tabId)
+  let mountFollowsTerminalPark = deps.mountFollowsTerminalPark
   let authoritativeReattachGeneration = 0
   exposeE2eTerminalPtyOutputDebug()
   let disposed = false
@@ -3605,10 +3614,10 @@ export function connectPanePty(
   const shouldApplyNativeWindowsRewriteRefresh = isNativeWindowsConpty
   const shouldApplyWindowsRendererUnicodeRefresh = CLIENT_PLATFORM === 'win32'
   const shouldProtectNativeWindowsSynchronizedOutput = isNativeWindowsConpty
-  let lastAgentStatusState = state.agentStatusByPaneKey[cacheKey]?.state
   let unsubscribeWindowsDoneTerminalModeReset: (() => void) | null = null
   if (isNativeWindowsConpty) {
     const initialAgentStatus = state.agentStatusByPaneKey[cacheKey]
+    let lastAgentDoneStartedAt = resolveLatestAgentDoneStartedAt(initialAgentStatus)
     if (
       !initialAgentStatus &&
       paneStartup?.telemetry?.launch_source === 'sidebar' &&
@@ -3627,13 +3636,18 @@ export function connectPanePty(
       const nextAgentStatusState = nextAgentStatus?.state
       if (nextAgentStatusState === 'done') {
         setFocusReportSuppressionForAgentCompletion(undefined, nextAgentStatus.agentType)
-        if (lastAgentStatusState !== 'done') {
-          queueAgentIdleTerminalModeReset()
-        }
       } else if (nextAgentStatusState) {
         suppressNativeWindowsIdleCodexFocusReports = false
       }
-      lastAgentStatusState = nextAgentStatusState
+      const nextAgentDoneStartedAt = resolveLatestAgentDoneStartedAt(nextAgentStatus)
+      // Why: a NEW completed turn — same-state `done` pings keep stateStartedAt, so they no-op.
+      if (
+        nextAgentDoneStartedAt !== undefined &&
+        nextAgentDoneStartedAt !== lastAgentDoneStartedAt
+      ) {
+        queueAgentIdleTerminalModeReset()
+      }
+      lastAgentDoneStartedAt = nextAgentDoneStartedAt
     })
   }
 
@@ -3641,7 +3655,7 @@ export function connectPanePty(
     ? getCachedWindowsTerminalCapabilities()
     : null
   const projectRuntime =
-    !connectionId && runtimeEnvironmentId === null
+    !tab?.forceHostRuntime && !connectionId && runtimeEnvironmentId === null
       ? getLocalProjectExecutionRuntimeContext(state, deps.worktreeId, undefined, {
           wslAvailable: localWindowsTerminalCapabilities?.wslAvailable,
           availableWslDistros: localWindowsTerminalCapabilities?.wslDistros ?? null
@@ -3716,13 +3730,13 @@ export function connectPanePty(
   })
   // Why: Phase-4 hidden-delivery gate — only meaningful under main authority
   // (renderer byte parsers need bytes otherwise). Decided once at pane
-  // creation: it picks the mode-2031 answer path (fact reply vs byte scan),
-  // which must have exactly one owner.
+  // creation: it picks which path records a mode-2031 subscription (main's
+  // fact vs the byte scan), which must have exactly one owner.
   const hiddenDeliveryGateActive =
     mainSideEffectAuthority && isRendererHiddenPtyDeliveryGateEnabled(state.settings)
   // Why: structural per-PTY gate predicate (authority on + gate on + bytes
   // transit local main, which implies snapshot-backed). Shared by the hidden
-  // mark sync and mode-2031 reply ownership so reply ownership can never
+  // mark sync and mode-2031 subscription recording so the recorder can never
   // disagree with what main may drop — and never depends on the racy hidden
   // mark (a fact can outrun the pty:data task that sets it).
   const isHiddenDeliveryGateManagedPty = (ptyId: string | null): ptyId is string =>
@@ -3745,21 +3759,10 @@ export function connectPanePty(
   const hadExistingPaneTransportAtConnect = deps.paneTransportsRef.current.size > 0
   let lastTerminalInputAt = Number.NEGATIVE_INFINITY
   let hasReceivedPtyOutput = false
-  let deferredReattachLiveData:
-    | {
-        data: string
-        ptyId: string | null
-        streamGeneration: number
-        meta?: PtyDataMeta
-        ackCredit?: () => void
-      }[]
-    | null = null
-  let deferredReattachLiveDataChars = 0
+  let deferredReattachLiveData: DeferredReattachLiveDataQueue | null = null
   let reattachLiveDataDeferralDepth = 0
   let deferredReattachLiveDataOwners = new Map<number, { failed: boolean }>()
   let transportStreamGeneration = 0
-  const MAX_DEFERRED_REATTACH_LIVE_CHARS = 512 * 1024
-  const MAX_DEFERRED_REATTACH_LIVE_CHUNKS = 1_024
   const markTerminalInputSent = (): void => {
     lastTerminalInputAt = performance.now()
     // Why: input must probe a wedged xterm even when the PTY produces no renderer output.
@@ -3884,13 +3887,10 @@ export function connectPanePty(
   // desktop silent while the elected mobile xterm owns query replies.
   const sendDesktopQueryReplyImmediate = (data: string): boolean =>
     canSendDesktopQueryReply() && transport.sendInputImmediate(data)
-  // Why (gate mode only): for gate-managed PTYs this fact is the SOLE 2031
-  // responder — visible, hidden, marked or not. Conditioning the reply on the
-  // hidden mark double-fired (mark set + bytes delivered live via interest →
-  // fact AND xterm both replied) or dropped the reply entirely (fact outran
-  // the pty:data task that set the mark). The xterm-side CSI reply and the
-  // skipped-byte scan are disabled for these panes (same structural
-  // predicate), so exactly one reply goes out.
+  // Why (gate mode only): gate-managed PTYs never see the subscribe bytes, so this fact is
+  // their only cue to record the subscription — without the registry entry a later theme
+  // flip never pushes the CSI 997 update and the TUI keeps a stale theme after reveal.
+  // Record-only: a subscribe is not a query (see observeLiveMode2031Chunk, #9993).
   const handleHiddenMode2031SubscribeFact = (): void => {
     const ptyId = transport.getPtyId()
     if (disposed || (!isHiddenDeliveryGateManagedPty(ptyId) && remoteOutputGatedPtyId !== ptyId)) {
@@ -3900,22 +3900,14 @@ export function connectPanePty(
       useAppStore.getState().settings,
       getSystemPrefersDark()
     )
-    // Why immediate: a mode-2031 query reply must beat the remote input debounce
-    // or it can miss the querying program's read window (#7329).
-    sendDesktopQueryReplyImmediate(mode2031SequenceFor(mode))
-    // Why: register the subscription exactly like the xterm CSI handler
-    // would — without the registry entry, later theme flips never push the
-    // CSI 997 update and the TUI keeps a stale theme after reveal.
     deps.recordPaneMode2031Subscription?.(pane.id, mode)
-    recordHiddenMode2031Reply()
   }
   // Why (gate mode only): the counterpart to the subscribe fact. These panes never
-  // receive the withdrawal bytes — main drops them before delivery — and both the
-  // chunk scanner and the xterm CSI handler are disabled for them, so this fact is
-  // the ONLY observer that can retire the subscription. Without it a TUI that exits
-  // while hidden leaves paneMode2031 set, and the next theme flip pushes CSI 997
-  // into the shell that replaced it (#9993 via maybePushMode2031Flip). No reply is
-  // sent: a withdrawal is not a query.
+  // receive the withdrawal bytes — main drops them before delivery — and the chunk
+  // scanner is disabled for them, so this fact is the ONLY observer that can retire
+  // the subscription. Without it a TUI that exits while hidden leaves paneMode2031
+  // set, and the next theme flip pushes CSI 997 into the shell that replaced it
+  // (#9993 via maybePushMode2031Flip).
   const handleHiddenMode2031UnsubscribeFact = (): void => {
     const ptyId = transport.getPtyId()
     if (disposed || (!isHiddenDeliveryGateManagedPty(ptyId) && remoteOutputGatedPtyId !== ptyId)) {
@@ -4084,7 +4076,7 @@ export function connectPanePty(
     }
   )
 
-  const onDataDisposable = pane.terminal.onData((data) => {
+  const forwardPtyInput = (data: string): void => {
     // Why: xterm auto-replies to embedded query sequences (DA1, DECRQM,
     // OSC 10/11, focus, CPR) via onData. When we replay recorded PTY bytes
     // into xterm for scrollback/cold-restore/snapshot, those queries would
@@ -4219,6 +4211,13 @@ export function connectPanePty(
       clearPendingTerminalInputIntent()
       requestRecoveryForUndeliverableInput()
     }
+  }
+  const onDataDisposable = pane.terminal.onData((data) => {
+    if (deps.deferPtyInput) {
+      deps.deferPtyInput(pane.id, data, forwardPtyInput)
+      return
+    }
+    forwardPtyInput(data)
   })
   const imeCompositionRouteDisposable = installTerminalImeCompositionRoute({
     terminalElement: pane.terminal.element,
@@ -4281,14 +4280,6 @@ export function connectPanePty(
     forwardPtyResize(cols, rows)
   })
 
-  // Why: a rewrite chunk can enter AND exit the alternate screen in one parse
-  // (fast-quitting TUI), netting buffer.active.type back to 'normal'; counting
-  // switches keeps those redraws visible to the atlas-recovery check.
-  let alternateScreenBufferSwitches = 0
-  const onBufferChangeDisposable = pane.terminal.buffer.onBufferChange?.(() => {
-    alternateScreenBufferSwitches += 1
-  })
-
   // Why: renderer resize forwarding is fire-and-forget. A visible pane can
   // finish with xterm at the right grid while the PTY silently kept an older
   // grid, so Codex keeps composing against stale columns. Fit first so xterm's
@@ -4756,12 +4747,21 @@ export function connectPanePty(
                 : serializeWithAbsoluteCursor(pane.serializeAddon, pane.terminal, {
                     scrollback: opts?.scrollbackRows
                   })
+            const orderedSeq = rendererOrderedPtyId === ptyId ? rendererOrderedSeq : null
+            // Why snapshotFlags and not `flags`: this pane may itself have
+            // consumed an old-host snapshot that proved nothing, and its
+            // conservative `0` fallback must not be republished downstream as
+            // a host-proven inactive protocol.
+            const provenKittyFlags = kittyKeyboardModes.hasProvenBaseline
+              ? kittyKeyboardModes.snapshotFlags
+              : undefined
             return {
               data,
               cols: pane.terminal.cols,
               rows: pane.terminal.rows,
-              ...(rendererOrderedPtyId === ptyId && rendererOrderedSeq !== null
-                ? { seq: rendererOrderedSeq }
+              ...(orderedSeq !== null ? { seq: orderedSeq } : {}),
+              ...(orderedSeq !== null && provenKittyFlags !== undefined
+                ? { kittyKeyboardFlags: provenKittyFlags }
                 : {})
             }
           } catch {
@@ -5521,96 +5521,6 @@ export function connectPanePty(
       return prefersRefresh
     }
 
-    function resetHiddenRendererRiskState(ptyId: string | null = null): void {
-      hiddenRiskPtyId = ptyId
-      hiddenSynchronizedOutputActive = false
-      hiddenSynchronizedOutputMarkerTail = ''
-      hiddenRewriteChunkEndedWithCarriageReturn = false
-      hiddenRewriteCsiScanTail = ''
-    }
-
-    function ensureHiddenRendererRiskStateForCurrentPty(): void {
-      const ptyId = transport.getPtyId()
-      if (hiddenRiskPtyId === ptyId) {
-        return
-      }
-      resetHiddenRendererRiskState(ptyId)
-    }
-
-    function resetSkippedHiddenRendererRiskState(): void {
-      // Why: skipped/backlog bytes were not parsed by xterm; reset any live hidden
-      // frame instead of letting dropped DEC starts make later plain bytes risky.
-      resetHiddenRendererRiskState(transport.getPtyId())
-    }
-
-    function hiddenSynchronizedOutputTouchesParsedFrame(data: string): boolean {
-      const scanData = hiddenSynchronizedOutputMarkerTail
-        ? `${hiddenSynchronizedOutputMarkerTail}${data}`
-        : data
-      const currentChunkStartIndex = scanData.length - data.length
-      let active = hiddenSynchronizedOutputActive
-      let touchesParsedFrame = active && data.length > 0
-      let offset = 0
-
-      while (offset < scanData.length) {
-        const startIndex = scanData.indexOf(SYNCHRONIZED_OUTPUT_START_SEQUENCE, offset)
-        const endIndex = scanData.indexOf(SYNCHRONIZED_OUTPUT_END_SEQUENCE, offset)
-        if (startIndex === -1 && endIndex === -1) {
-          break
-        }
-        if (endIndex !== -1 && (startIndex === -1 || endIndex < startIndex)) {
-          if (
-            active &&
-            endIndex + SYNCHRONIZED_OUTPUT_END_SEQUENCE.length > currentChunkStartIndex
-          ) {
-            touchesParsedFrame = true
-          }
-          active = false
-          offset = endIndex + SYNCHRONIZED_OUTPUT_END_SEQUENCE.length
-          continue
-        }
-        if (startIndex !== -1) {
-          active = true
-          if (startIndex + SYNCHRONIZED_OUTPUT_START_SEQUENCE.length > currentChunkStartIndex) {
-            touchesParsedFrame = true
-          }
-          offset = startIndex + SYNCHRONIZED_OUTPUT_START_SEQUENCE.length
-          continue
-        }
-      }
-
-      if (active && data.length > 0) {
-        touchesParsedFrame = true
-      }
-      hiddenSynchronizedOutputActive = active
-      hiddenSynchronizedOutputMarkerTail = scanData.slice(-SYNCHRONIZED_OUTPUT_MARKER_TAIL_CHARS)
-      return touchesParsedFrame
-    }
-
-    function hiddenTuiRedrawOutputPrefersAtlasRecovery(data: string): boolean {
-      if (!data) {
-        return false
-      }
-      const scanData = hiddenRewriteCsiScanTail ? `${hiddenRewriteCsiScanTail}${data}` : data
-      const decision = terminalRewriteOutputRenderRefreshDecision(data, {
-        previousChunkEndsWithCarriageReturn: hiddenRewriteChunkEndedWithCarriageReturn,
-        previousRewriteCsiScanTail: hiddenRewriteCsiScanTail
-      })
-      hiddenRewriteChunkEndedWithCarriageReturn = decision.nextChunkEndsWithCarriageReturn
-      hiddenRewriteCsiScanTail = decision.nextRewriteCsiScanTail
-      return decision.prefersRenderRefresh || containsCursorPositionSequence(scanData)
-    }
-
-    function hiddenOutputNeedsAtlasRecoveryAfterParse(data: string): boolean {
-      if (!data) {
-        return false
-      }
-      ensureHiddenRendererRiskStateForCurrentPty()
-      const synchronizedOutputTouchesParsedFrame = hiddenSynchronizedOutputTouchesParsedFrame(data)
-      const tuiRedrawOutputPrefersAtlasRecovery = hiddenTuiRedrawOutputPrefersAtlasRecovery(data)
-      return synchronizedOutputTouchesParsedFrame || tuiRedrawOutputPrefersAtlasRecovery
-    }
-
     // The replay path uses the guard so xterm auto-replies to embedded query
     // sequences don't leak into the shell. xterm.write() buffers internally
     // regardless of DOM visibility and the guard stays engaged via the
@@ -5743,6 +5653,8 @@ export function connectPanePty(
       generation: number
       streamGeneration: number
       pendingEscapeTailAnsi?: string
+      kittyKeyboardFlags?: number
+      snapshotSeq?: number
     }
 
     let pendingReplayData: PendingReplayData | null = null
@@ -5796,7 +5708,7 @@ export function connectPanePty(
         // negotiation; the mirror must re-arm from them after a reload. Replay
         // semantics: relay reconnects redeliver the same window, so pushes
         // apply as sets to keep the mirrored stack from accumulating frames.
-        kittyKeyboardModes.scanReplay(data)
+        applySnapshotKittyKeyboardModes(data, payload)
         await writeReplayDataAsync(data)
         if (!isCurrentPayload()) {
           continue
@@ -5872,7 +5784,7 @@ export function connectPanePty(
     }
     const replayDataCallback = (
       data: string,
-      meta: { clearBeforeReplay?: boolean; pendingEscapeTailAnsi?: string } = {},
+      meta: PtyReplayDataMeta = {},
       streamGeneration = transportStreamGeneration
     ): void => {
       pendingReplayData = {
@@ -5881,7 +5793,15 @@ export function connectPanePty(
         ptyId: transport.getPtyId(),
         generation: (replayPayloadGeneration += 1),
         streamGeneration,
-        ...(meta.pendingEscapeTailAnsi ? { pendingEscapeTailAnsi: meta.pendingEscapeTailAnsi } : {})
+        ...(meta.pendingEscapeTailAnsi
+          ? { pendingEscapeTailAnsi: meta.pendingEscapeTailAnsi }
+          : {}),
+        ...(meta.kittyKeyboardFlags !== undefined && meta.snapshotSeq !== undefined
+          ? {
+              kittyKeyboardFlags: meta.kittyKeyboardFlags,
+              snapshotSeq: meta.snapshotSeq
+            }
+          : {})
       }
       scheduleReplayDataDrain()
     }
@@ -5913,10 +5833,7 @@ export function connectPanePty(
               dataCallback(data, meta, generation)
             }
           },
-          onReplayData: (
-            data: string,
-            meta?: { clearBeforeReplay?: boolean; pendingEscapeTailAnsi?: string }
-          ): void => {
+          onReplayData: (data: string, meta?: PtyReplayDataMeta): void => {
             if (isCurrent()) {
               replayDataCallback(data, meta, generation)
             }
@@ -6048,11 +5965,6 @@ export function connectPanePty(
     const shouldSnapshotHiddenCodexOutput = shouldKeepHiddenStartupRendererQueriesLive(paneStartup)
     let hiddenStartupRendererQueryPending = ''
     let hiddenRendererStateDirty = false
-    let hiddenRiskPtyId: string | null = null
-    let hiddenSynchronizedOutputActive = false
-    let hiddenSynchronizedOutputMarkerTail = ''
-    let hiddenRewriteChunkEndedWithCarriageReturn = false
-    let hiddenRewriteCsiScanTail = ''
     let rendererOrderedPtyId: string | null = null
     let rendererOrderedSeq: number | null = null
     let rendererChannelSeqPtyId: string | null = null
@@ -6416,25 +6328,9 @@ export function connectPanePty(
       return decision.prefersRenderRefresh
     }
 
-    // Why: Vim-style rewrites leave stale WebGL glyphs until the atlas rebuilds; alt-screen membership is only authoritative post-parse (enter/exit can split chunks), so capture pre-parse and decide at parse completion.
-    function alternateScreenRewriteAtlasRecoveryOnParsed(): () => void {
-      const wasAlternateScreenBuffer = pane.terminal.buffer.active.type === 'alternate'
-      const switchesBeforeParse = alternateScreenBufferSwitches
-      return () => {
-        if (
-          wasAlternateScreenBuffer ||
-          alternateScreenBufferSwitches !== switchesBeforeParse ||
-          pane.terminal.buffer.active.type === 'alternate'
-        ) {
-          scheduleTerminalWebglAtlasRecovery()
-        }
-      }
-    }
-
     function shouldForceForegroundRenderRefresh(data: string): {
       refresh: boolean
       inPlaceRewrite: boolean
-      recoverWebglAtlasAfterParse: boolean
     } {
       const rewriteOutputPrefersRenderRefresh = foregroundRewriteOutputPrefersRenderRefresh(data)
       const recentInput =
@@ -6442,13 +6338,12 @@ export function connectPanePty(
       if (foregroundRendererRiskOutputPrefersRenderRefresh(data)) {
         return {
           refresh: true,
-          inPlaceRewrite: rewriteOutputPrefersRenderRefresh,
-          recoverWebglAtlasAfterParse: true
+          inPlaceRewrite: rewriteOutputPrefersRenderRefresh
         }
       }
       if (rewriteOutputPrefersRenderRefresh) {
         // Why: xterm's buffer is right but in-place redraw cells stay stale in the renderer until a repaint (resize fixes it).
-        return { refresh: true, inPlaceRewrite: true, recoverWebglAtlasAfterParse: false }
+        return { refresh: true, inPlaceRewrite: true }
       }
       if (
         windowsEastAsianOutputPrefersRenderRefresh(data, {
@@ -6459,26 +6354,25 @@ export function connectPanePty(
         })
       ) {
         // Why: CJK/Korean from Microsoft Pinyin commits and native ConPTY output can leave stale wide-glyph cells in the Windows DOM renderer.
-        return { refresh: true, inPlaceRewrite: false, recoverWebglAtlasAfterParse: false }
+        return { refresh: true, inPlaceRewrite: false }
       }
       return {
         refresh:
           shouldApplyNativeWindowsRewriteRefresh &&
           containsNonAsciiOutput(data) &&
           containsWindowsRewriteControl(data),
-        inPlaceRewrite: false,
-        recoverWebglAtlasAfterParse: false
+        inPlaceRewrite: false
       }
     }
 
+    // Why record-only: DECSET 2031 subscribes to future color changes, it is not a query —
+    // the protocol's query is `CSI ?996n`. fish arms 2031 for the ~1ms it paints a prompt, so
+    // any reply lands after the withdrawal and paints `?997;1n` as literal text (#9993).
     // Why here and not in xterm's CSI handler: xterm batches several PTY chunks into one
-    // synchronous parse, so a handler cannot tell where a chunk ended. fish enables and
-    // disables 2031 around every prompt, so answering a subscribe the same chunk withdraws
-    // pushes `?997;1n` into the prompt or a child's stdin as literal text (#9993). One raw
-    // chunk in, one order-aware decision out.
+    // synchronous parse, so a handler cannot tell where a chunk ended. One raw chunk in,
+    // one order-aware final state out.
     function observeLiveMode2031Chunk(data: string): void {
-      // Main's '2031-subscribe' fact is the sole responder for gate-managed PTYs; a second
-      // reply from here would answer one subscribe twice.
+      // Gate-managed PTYs never see these bytes; main's '2031-subscribe' fact records them.
       if (isHiddenDeliveryGateManagedPty(transport.getPtyId())) {
         return
       }
@@ -6492,13 +6386,13 @@ export function connectPanePty(
         return
       }
       const settings = useAppStore.getState().settings
-      const mode = resolveTerminalColorSchemeMode(settings, getSystemPrefersDark())
-      // Why immediate: the reply must land inside the program's read window, and hidden
-      // snapshot-backed panes skip xterm.write for PTY bytes entirely.
+      // Why seed the mode: maybePushMode2031Flip only pushes on a change, so an unseeded
+      // subscription would read as a flip on the next unrelated appearance re-apply.
       deps.paneMode2031Ref.current.set(pane.id, true)
-      sendDesktopQueryReplyImmediate(mode2031SequenceFor(mode))
-      deps.paneLastThemeModeRef.current.set(pane.id, mode)
-      recordHiddenMode2031Reply()
+      deps.paneLastThemeModeRef.current.set(
+        pane.id,
+        resolveTerminalColorSchemeMode(settings, getSystemPrefersDark())
+      )
     }
 
     // Why installed here: the handler observes CSI 3 J inside xterm's parse, so a
@@ -6516,7 +6410,6 @@ export function connectPanePty(
       kittyKeyboardModes.scan(data)
       if (foreground) {
         resetHiddenOutputRestoreIfPtyChanged()
-        resetHiddenRendererRiskState()
       }
       const parseHiddenStartupOutput =
         !foreground &&
@@ -6546,21 +6439,7 @@ export function connectPanePty(
       }
       const renderRefreshDecision = foregroundOutput
         ? shouldForceForegroundRenderRefresh(data)
-        : { refresh: false, inPlaceRewrite: false, recoverWebglAtlasAfterParse: false }
-      if (!foregroundOutput) {
-        // Advance hidden rewrite state; reveal owns atlas recovery.
-        void hiddenOutputNeedsAtlasRecoveryAfterParse(data)
-      }
-      const recoverWebglAtlasAfterParse =
-        foreground && renderRefreshDecision.recoverWebglAtlasAfterParse
-      // Why: atlas recovery must repaint from the parsed xterm buffer, not a pre-write snapshot a late TUI redraw can stale.
-      const onParsedAtlasRecovery = foreground
-        ? recoverWebglAtlasAfterParse
-          ? scheduleTerminalWebglAtlasRecovery
-          : renderRefreshDecision.inPlaceRewrite
-            ? alternateScreenRewriteAtlasRecoveryOnParsed()
-            : undefined
-        : undefined
+        : { refresh: false, inPlaceRewrite: false }
       const foregroundRenderRefreshNeeded = renderRefreshDecision.refresh
       // Why: Claude Code's in-place prompt redraws on Windows ConPTY can paint one frame late; a follow-up repaint fixes the column desync without a resize.
       const nativeWindowsInPlaceRewriteFollowup = nativeWindowsRewriteNeedsFollowupRenderRefresh({
@@ -6600,7 +6479,6 @@ export function connectPanePty(
           nativeWindowsCursorRestore || nativeWindowsInPlaceRewriteFollowup,
         // Why: xterm already queued a WebGL frame parsing this chunk; merge the repair into it instead of rendering the grid twice.
         shouldRefreshForegroundSynchronously,
-        onParsed: onParsedAtlasRecovery,
         stripTransientCursorShows: shouldProtectNativeWindowsSynchronizedOutput && foreground,
         coalesceForeground: synchronizedForegroundOutput && synchronizedOutputEnded,
         holdForeground: synchronizedForegroundOutput && nextSynchronizedForegroundOutputActive
@@ -6618,7 +6496,6 @@ export function connectPanePty(
     }
 
     function markHiddenOutputRestoreNeeded(): void {
-      resetSkippedHiddenRendererRiskState()
       const ptyId = transport.getPtyId()
       if (!canUseHiddenOutputSnapshot(ptyId)) {
         return
@@ -6929,6 +6806,43 @@ export function connectPanePty(
       }
     }
 
+    /**
+     * Apply an authoritative snapshot to the pane's kitty mirror in the order:
+     * unproven reset, replay-semantics scan of the snapshot
+     * bytes (so screen selection lands first), then the owner's proven flags.
+     *
+     * Why the reset only happens when the owner proved something: an old host
+     * omits the field, and downgrading a mirror that is already tracking live
+     * output would lose correct state instead of preserving it.
+     */
+    function applySnapshotKittyKeyboardModes(
+      snapshotData: string,
+      snapshot: { kittyKeyboardFlags?: number; snapshotSeq?: number }
+    ): void {
+      const proven =
+        snapshot.snapshotSeq === undefined
+          ? undefined
+          : parseTerminalKittyKeyboardFlags(snapshot.kittyKeyboardFlags)
+      if (proven === undefined) {
+        // Why the demotion: a mirror grounded in this PTY's stream keeps its
+        // state, but a constructor-fresh tracker (window reload) holds a
+        // known-zero that was never proven for the reattached PTY — demote it
+        // so the serializer cannot republish it downstream as host-proven
+        // inactive.
+        if (!kittyKeyboardModes.hasProvenBaseline) {
+          kittyKeyboardModes.resetForSnapshot()
+        }
+        kittyKeyboardModes.scanReplay(snapshotData)
+        return
+      }
+      kittyKeyboardModes.resetForSnapshot()
+      kittyKeyboardModes.scanReplay(snapshotData)
+      kittyKeyboardModes.restoreSnapshotFlags(proven)
+      // Why in the same critical section: without the baseline a quiet pane
+      // could not publish a coherent snapshot until unrelated output arrived.
+      recordRendererOrderedSeq({ seq: snapshot.snapshotSeq })
+    }
+
     function recordRendererOrderedSeq(meta?: Pick<PtyDataMeta, 'seq'>): void {
       if (typeof meta?.seq !== 'number') {
         return
@@ -7174,7 +7088,6 @@ export function connectPanePty(
       hiddenOutputRestoreScheduled = false
       hiddenStartupRendererQueryPending = ''
       hiddenRendererStateDirty = false
-      resetHiddenRendererRiskState()
       cancelScheduledHiddenOutputRestore(pane.terminal)
       clearHiddenOutputRestoreDeferredRetryTimer()
       clearHiddenOutputRestoreForegroundDeadlineTimer()
@@ -7249,7 +7162,6 @@ export function connectPanePty(
       hiddenOutputRestoreLocalGateAttempts = 0
       hiddenStartupRendererQueryPending = ''
       hiddenRendererStateDirty = false
-      resetHiddenRendererRiskState()
       hiddenOutputRestoreNeeded = false
       hiddenOutputRestorePtyId = null
       hiddenOutputRestoreReplayingSnapshot = null
@@ -7300,7 +7212,6 @@ export function connectPanePty(
 
     function skipBackgroundAlternateScreenOutput(data: string): void {
       writeHiddenStartupRendererQueries(data)
-      resetSkippedHiddenRendererRiskState()
       hiddenRendererStateDirty = true
       recordHiddenRendererSkip(data.length)
       const ptyId = transport.getPtyId()
@@ -7340,6 +7251,7 @@ export function connectPanePty(
 
     async function applyMainBufferSnapshot(snapshot: {
       data: string
+      frameRestoreAnsi?: string
       cols: number
       rows: number
       seq?: number
@@ -7347,6 +7259,7 @@ export function connectPanePty(
       alternateScreen?: boolean
       scrollbackAnsi?: string
       pendingEscapeTailAnsi?: string
+      kittyKeyboardFlags?: number
     }): Promise<void> {
       const restorePtyId = transport.getPtyId()
       const restoreGeneration = hiddenOutputRestoreGeneration
@@ -7363,6 +7276,7 @@ export function connectPanePty(
       const colsBeforeReplay = pane.terminal.cols
       const rowsBeforeReplay = pane.terminal.rows
       const hasSnapshotDimensions = hasPositiveTerminalDimensions(snapshot.cols, snapshot.rows)
+      let skippedAltFrame = false
       try {
         await structuralReplayCoordinator.run(
           async () => {
@@ -7396,11 +7310,29 @@ export function connectPanePty(
                 suppressStructuralReplayPtyResize = false
               }
             }
+            // Why here and not from the writes below: the mirror tracks what the
+            // APPLICATION negotiated, so it must see the snapshot's own bytes
+            // before adopting the flags main proved for this boundary.
+            applySnapshotKittyKeyboardModes(`${snapshot.scrollbackAnsi ?? ''}${snapshot.data}`, {
+              kittyKeyboardFlags: snapshot.kittyKeyboardFlags,
+              snapshotSeq: snapshot.seq
+            })
             // Why shared: the SSH reattach model paint inlines the same
             // choreography (coordinator nesting would deadlock there); one
             // builder keeps the alt-screen branches from drifting.
-            for (const replayChunk of buildMainModelSnapshotReplayWrites(snapshot)) {
-              writeReplayData(replayChunk)
+            skippedAltFrame =
+              snapshot.alternateScreen === true &&
+              snapshot.frameRestoreAnsi !== undefined &&
+              shouldSkipAltFrameForWidthMismatch(snapshot.cols, readProposedTerminalCols(pane))
+            // Why: an imageless success is not proof the pane is empty; normal replay clears screen and scrollback.
+            const snapshotCarriesNoImage =
+              snapshot.alternateScreen !== true && snapshot.data === '' && !snapshot.scrollbackAnsi
+            if (!snapshotCarriesNoImage) {
+              for (const replayChunk of buildMainModelSnapshotReplayWrites(snapshot, {
+                skipAltFrame: skippedAltFrame
+              })) {
+                writeReplayData(replayChunk)
+              }
             }
             // Why: live agents own ?25l/?1004h; a forced ?1004l here would silence focus events until restart (agents enable focus reporting only at startup).
             writeReplayData(
@@ -7414,7 +7346,6 @@ export function connectPanePty(
             }
             hiddenRendererStateDirty = false
             recordRendererOrderedSeq(snapshot)
-            resetHiddenRendererRiskState()
             recordTerminalOutput(pane.terminal)
             await waitForTerminalReplayWritesParsed(pane.terminal)
           },
@@ -7434,7 +7365,14 @@ export function connectPanePty(
                 return
               }
               const currentPtyId = transport.getPtyId()
-              if (!currentPtyId || getFitOverrideForPty(currentPtyId)) {
+              if (!currentPtyId) {
+                return
+              }
+              if (getFitOverrideForPty(currentPtyId)) {
+                safeFit(pane)
+                if (skippedAltFrame && !isRemoteRuntimePtyId(currentPtyId)) {
+                  window.api.pty.signal(currentPtyId, 'SIGWINCH')
+                }
                 return
               }
               const fit = safeFitAndThen(
@@ -7448,6 +7386,10 @@ export function connectPanePty(
                     ? pane.terminal.cols !== snapshot.cols || pane.terminal.rows !== snapshot.rows
                     : pane.terminal.cols !== colsBeforeReplay ||
                       pane.terminal.rows !== rowsBeforeReplay
+                  if (skippedAltFrame) {
+                    pulseVisibleLocalPtySizeForTuiRepaint(currentPtyId)
+                    return
+                  }
                   if (replayChangedDimensions && isRendererPtyResizeAuthoritative()) {
                     transport.resize(pane.terminal.cols, pane.terminal.rows)
                     if (!isRemoteRuntimePtyId(currentPtyId)) {
@@ -7456,7 +7398,13 @@ export function connectPanePty(
                     }
                   }
                 },
-                { shouldContinue: isCurrentRestore, retryIfUnmeasurable: true }
+                {
+                  shouldContinue: isCurrentRestore,
+                  retryIfUnmeasurable: true,
+                  // A skipped frame is blank until this fit pushes the final
+                  // grid/SIGWINCH, so carry the continuation through reveal.
+                  deferIfHidden: true
+                }
               )
               pendingHiddenSnapshotFit = fit
               try {
@@ -7758,47 +7706,14 @@ export function connectPanePty(
         return
       }
       if (deferredReattachLiveData !== null) {
-        // Why: a replacement stream must not inherit bytes or a gap marker from the replay owner it superseded.
-        deferredReattachLiveData = deferredReattachLiveData.filter((chunk) => {
-          const keep = chunk.streamGeneration === streamGeneration
-          if (!keep) {
-            chunk.ackCredit?.()
-          }
-          return keep
-        })
-        deferredReattachLiveDataChars = deferredReattachLiveData.reduce(
-          (total, chunk) => total + chunk.data.length,
-          0
-        )
-        const oversized = data.length > MAX_DEFERRED_REATTACH_LIVE_CHARS
-        const deferredData = oversized ? data.slice(-MAX_DEFERRED_REATTACH_LIVE_CHARS) : data
         const ackCredit = takeCurrentTerminalDeliveryCredit()
-        deferredReattachLiveData.push({
-          data: deferredData,
+        deferredReattachLiveData.enqueue({
+          data,
           ptyId: transport.getPtyId(),
           streamGeneration,
           ...(meta ? { meta } : {}),
           ...(ackCredit ? { ackCredit } : {})
         })
-        deferredReattachLiveDataChars += deferredData.length
-        // Why: one huge IPC frame would bypass the queue's memory bound; mark a stream gap so snapshot recovery replaces it, not a partial ANSI frame.
-        let dropped = oversized
-        while (
-          deferredReattachLiveData.length > 1 &&
-          (deferredReattachLiveData.length > MAX_DEFERRED_REATTACH_LIVE_CHUNKS ||
-            deferredReattachLiveDataChars > MAX_DEFERRED_REATTACH_LIVE_CHARS)
-        ) {
-          const removed = deferredReattachLiveData.shift()
-          deferredReattachLiveDataChars -= removed?.data.length ?? 0
-          removed?.ackCredit?.()
-          dropped = true
-        }
-        if (dropped && deferredReattachLiveData[0]) {
-          deferredReattachLiveData[0].meta = {
-            ...deferredReattachLiveData[0].meta,
-            droppedOutput: true
-          }
-        }
         return
       }
       if (data.length > 0) {
@@ -7935,7 +7850,6 @@ export function connectPanePty(
           queueLiveChunkDuringRestore(orderedRendererData, rendererMeta)
           requestHiddenOutputRestoreIfNeeded()
         } else if (hiddenOutputRestoreInFlight) {
-          resetSkippedHiddenRendererRiskState()
           hiddenOutputRestoreNeeded = true
           hiddenOutputRestoreFreshSnapshotNeeded = true
         }
@@ -7964,8 +7878,7 @@ export function connectPanePty(
     const beginReattachLiveDataDeferral = (ownerGeneration = transportStreamGeneration): void => {
       reattachLiveDataDeferralDepth += 1
       if (reattachLiveDataDeferralDepth === 1) {
-        deferredReattachLiveData = []
-        deferredReattachLiveDataChars = 0
+        deferredReattachLiveData = new DeferredReattachLiveDataQueue()
         deferredReattachLiveDataOwners = new Map()
       }
       if (!deferredReattachLiveDataOwners.has(ownerGeneration)) {
@@ -7998,19 +7911,17 @@ export function connectPanePty(
       if (reattachLiveDataDeferralDepth > 0) {
         return
       }
-      const chunks = deferredReattachLiveData
+      const queue = deferredReattachLiveData
       deferredReattachLiveData = null
-      deferredReattachLiveDataChars = 0
       const currentPtyId = transport.getPtyId()
       const currentGeneration = transportStreamGeneration
       const currentOwner = deferredReattachLiveDataOwners.get(currentGeneration)
       deferredReattachLiveDataOwners = new Map()
-      if (disposed || !chunks) {
-        for (const chunk of chunks ?? []) {
-          chunk.ackCredit?.()
-        }
+      if (disposed || !queue) {
+        queue?.discard()
         return
       }
+      const chunks = queue.takeAll()
       // Why: paint the authoritative replay first, then admit deferred live chunks so the replay clear can't erase newer output.
       let deliveredDeferredChunks = 0
       for (const chunk of chunks) {
@@ -8132,7 +8043,11 @@ export function connectPanePty(
                   suppressStructuralReplayPtyResize = false
                 }
               }
-              kittyKeyboardModes.scanReplay(modelData)
+              applySnapshotKittyKeyboardModes(modelData, {
+                kittyKeyboardFlags: snapshot.kittyKeyboardFlags,
+                snapshotSeq: snapshot.seq
+              })
+              // Why keep a too-wide frame: preconnect SSH has no live repaint owner or post-restore fit.
               for (const replayChunk of buildMainModelSnapshotReplayWrites(snapshot)) {
                 writeReplayData(replayChunk)
               }
@@ -8321,7 +8236,18 @@ export function connectPanePty(
           return
         }
         if (connectResult?.snapshot) {
-          rememberReattachPayloadAgentSignal(connectResult.snapshot, { fullScreenReplay: true })
+          const snapshotPrefixAnsi = connectResult.snapshotPrefixAnsi
+          const snapshotFrameAnsi = connectResult.snapshotFrameAnsi
+          const snapshotFrameRestoreAnsi = connectResult.snapshotFrameRestoreAnsi
+          const hasSplitDaemonAltFrame =
+            typeof snapshotPrefixAnsi === 'string' &&
+            snapshotPrefixAnsi.length > 0 &&
+            typeof snapshotFrameAnsi === 'string' &&
+            snapshotFrameAnsi.length > 0
+          const daemonSnapshotReplay = hasSplitDaemonAltFrame
+            ? snapshotPrefixAnsi + snapshotFrameAnsi
+            : connectResult.snapshot
+          rememberReattachPayloadAgentSignal(daemonSnapshotReplay, { fullScreenReplay: true })
           // Why: replay at the snapshot's own dimensions to avoid rewrapping soft-wrapped rows at a different column count (#7279); suppress the PTY forward so this layout-only resize doesn't SIGWINCH the remote TUI.
           const snapshotDimensions = resolvePositiveTerminalDimensions(
             connectResult.snapshotCols,
@@ -8341,12 +8267,28 @@ export function connectPanePty(
           }
           writeReplayData('\x1b[2J\x1b[3J\x1b[H')
           // Why: re-arm the kitty keyboard mirror from the snapshot preamble so Option chords keep their encoding after a window reload.
-          kittyKeyboardModes.scanReplay(connectResult.snapshot)
-          writeReplayData(connectResult.snapshot)
-          // Snapshot reattach keeps a live session, so drop only renderer-owned state instead of the broader mode reset — unless this is a cold restore, whose owner is gone.
+          applySnapshotKittyKeyboardModes(daemonSnapshotReplay, {
+            kittyKeyboardFlags: connectResult.snapshotKittyKeyboardFlags,
+            snapshotSeq: connectResult.snapshotSeq
+          })
+          // A narrower fit clips the fixed-grid alt frame; drop it and let SIGWINCH repaint.
+          // A dead-owner restore keeps history plus its restored-session treatment;
+          // a frozen foreign-width frame would look live when no owner remains.
+          const daemonAltFrameSkippable =
+            hasSplitDaemonAltFrame &&
+            typeof snapshotFrameRestoreAnsi === 'string' &&
+            shouldSkipAltFrameForWidthMismatch(
+              connectResult.snapshotCols,
+              readProposedTerminalCols(pane)
+            )
+          writeReplayData(
+            daemonAltFrameSkippable
+              ? snapshotPrefixAnsi + snapshotFrameRestoreAnsi
+              : daemonSnapshotReplay
+          )
           writeReplayData(
             reattachReplayResetSequence(
-              connectResult.snapshot,
+              daemonSnapshotReplay,
               Boolean(connectResult.coldRestore),
               connectResult.isAlternateScreen
             )
@@ -8395,12 +8337,20 @@ export function connectPanePty(
                 suppressStructuralReplayPtyResize = false
               }
             }
-            kittyKeyboardModes.scanReplay(modelData)
+            applySnapshotKittyKeyboardModes(modelData, {
+              kittyKeyboardFlags: modelSnapshot.kittyKeyboardFlags,
+              snapshotSeq: modelSnapshot.seq
+            })
             // Why shared: park+reveal of an alt-screen TUI needs the same
             // ?1049l/?1049h rebuild as applyMainBufferSnapshot (main strips
             // the ?1049h marker when splitting scrollbackAnsi) — inlined here
             // because nesting structuralReplayCoordinator would deadlock.
-            for (const replayChunk of buildMainModelSnapshotReplayWrites(modelSnapshot)) {
+            for (const replayChunk of buildMainModelSnapshotReplayWrites(modelSnapshot, {
+              skipAltFrame: shouldSkipAltFrameForWidthMismatch(
+                modelCols,
+                readProposedTerminalCols(pane)
+              )
+            })) {
               writeReplayData(replayChunk)
             }
             writeReplayData(
@@ -8426,6 +8376,11 @@ export function connectPanePty(
             // Relay replay may overlap xterm's pre-disconnect content; clear first to avoid duplication.
             writeReplayData('\x1b[2J\x1b[3J\x1b[H')
             // Why: raw relay replay may contain the app's own kitty pushes; re-arm with set semantics so redelivery can't grow the stack.
+            // A constructor-fresh mirror (window reload) first demotes to unproven:
+            // the replay window proves nothing about negotiations that predate it.
+            if (!kittyKeyboardModes.hasProvenBaseline) {
+              kittyKeyboardModes.resetForSnapshot()
+            }
             kittyKeyboardModes.scanReplay(connectResult.replay)
             writeReplayData(connectResult.replay)
             writeReplayData(
@@ -9402,11 +9357,9 @@ export function connectPanePty(
       }
       directSshPaneRetrySettlementTimers.clear()
       // Why: a stalled xterm replay may never reach its finally; release live-frame credit when this renderer no longer owns the stream.
-      for (const chunk of deferredReattachLiveData ?? []) {
-        chunk.ackCredit?.()
-      }
+      const queue = deferredReattachLiveData
       deferredReattachLiveData = null
-      deferredReattachLiveDataChars = 0
+      queue?.discard()
       reattachLiveDataDeferralDepth = 0
       deferredReattachLiveDataOwners = new Map()
       cancelPendingSafeFitContinuations(pane)
@@ -9506,7 +9459,6 @@ export function connectPanePty(
       userInputActivityDisposable?.dispose()
       terminalCapabilityRepliesDisposable.dispose()
       onResizeDisposable.dispose()
-      onBufferChangeDisposable?.dispose()
       pane.container.removeEventListener(PANE_PTY_RESIZE_HOLD_FLUSH_EVENT, onHeldPtyResizeFlush)
       geometryReportObserver?.disconnect()
       if (pendingGeometryReportRaf !== null) {
diff --git a/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts b/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts
index 2bcd4ed6172..251eb04b91c 100644
--- a/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts
@@ -1,5 +1,8 @@
 import { describe, expect, it, vi } from 'vitest'
+import { Terminal } from '@xterm/headless'
 import {
+  PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES,
+  PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLY_CODE_UNITS,
   TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS,
   createPtyInputWriteQueue
 } from './pty-input-write-queue'
@@ -7,9 +10,14 @@ import {
   TERMINAL_INPUT_CHUNK_MAX_BYTES,
   TERMINAL_INPUT_MAX_BYTES
 } from '../../../../shared/terminal-input'
+import { CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS } from '../../../../shared/clipboard-text'
 import { mode2031SequenceFor } from '../../../../shared/terminal-color-scheme-protocol'
 import { PtyStartupIngress, type PtyIngressEmission } from '../../../../shared/pty-startup-ingress'
-import { extractOnlyCookedEchoSafeQueryReplies } from '../../../../shared/terminal-query-reply'
+import {
+  extractOnlyCookedEchoSafeQueryReplies,
+  needsCookedEchoSafeQueryReply
+} from '../../../../shared/terminal-query-reply'
+import { installTerminalCapabilityReplyHandlers } from './terminal-capability-replies'
 
 const WHEEL_UP_REPORT = '\x1b[<64;60;20M'
 
@@ -27,6 +35,44 @@ function createRecordingQueue(options: { writable?: () => boolean } = {}): {
   return { writes, queue }
 }
 
+function createParkedQueue(): {
+  writes: WriteRecord[]
+  pendingYields: (() => void)[]
+  queue: ReturnType<typeof createPtyInputWriteQueue>
+} {
+  const writes: WriteRecord[] = []
+  const pendingYields: (() => void)[] = []
+  const queue = createPtyInputWriteQueue({
+    isWritable: () => true,
+    write: (id, data) => writes.push({ id, data }),
+    yieldBetweenWrites: () =>
+      new Promise<void>((resolve) => {
+        pendingYields.push(resolve)
+      })
+  })
+  return { writes, pendingYields, queue }
+}
+
+async function releaseNextWrite(
+  writes: WriteRecord[],
+  pendingYields: (() => void)[]
+): Promise<void> {
+  const before = writes.length
+  const release = pendingYields.shift()
+  expect(release).toBeDefined()
+  release?.()
+  await Promise.resolve()
+  expect(writes.length).toBeGreaterThan(before)
+}
+
+function writeTerminal(term: Terminal, data: string): Promise<void> {
+  return new Promise((resolve) => term.write(data, resolve))
+}
+
+function extractReplyWrites(writes: WriteRecord[]): string[] {
+  return writes.flatMap((write) => extractOnlyCookedEchoSafeQueryReplies(write.data) ?? [])
+}
+
 describe('pty input write queue', () => {
   it('coalesces a dense burst of wheel reports instead of one write per macrotask turn', async () => {
     const { writes, queue } = createRecordingQueue()
@@ -136,26 +182,21 @@ describe('pty input write queue', () => {
     const { writes, queue } = createRecordingQueue()
     const reply = mode2031SequenceFor('dark')
 
-    expect(queue.enqueue('pty-1', reply)).toBe(true)
-    expect(queue.enqueue('pty-1', reply)).toBe(true)
+    expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
+    expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
     await queue.waitForDrain()
 
-    // Atomic writes so each host intercept sees a single extractable reply —
-    // not one coalesced `?997;1n?997;1n` payload.
     expect(writes).toEqual([
       { id: 'pty-1', data: reply },
       { id: 'pty-1', data: reply }
     ])
-    expect(writes).toHaveLength(2)
-    expect(writes[0]?.data).toBe(reply)
-    expect(writes[1]?.data).toBe(reply)
   })
 
   it('does not coalesce a color-scheme reply with a following keystroke', async () => {
     const { writes, queue } = createRecordingQueue()
     const reply = mode2031SequenceFor('dark')
 
-    queue.enqueue('pty-1', reply)
+    queue.enqueueQueryReply('pty-1', reply)
     queue.enqueue('pty-1', 'y')
     await queue.waitForDrain()
 
@@ -165,8 +206,271 @@ describe('pty input write queue', () => {
     ])
   })
 
+  it('bounds an OSC 10/11 reply flood and drains a following keystroke', async () => {
+    const { writes, pendingYields, queue } = createParkedQueue()
+    const replies: string[] = []
+    let allAccepted = true
+
+    for (let index = 0; index < 10_000; index += 1) {
+      const color = index.toString(16).padStart(4, '0')
+      const reply = `\x1b]${index % 2 === 0 ? 10 : 11};rgb:${color}/0000/0000\x1b\\`
+      replies.push(reply)
+      allAccepted = queue.enqueueQueryReply('pty-1', reply) && allAccepted
+    }
+    expect(allAccepted).toBe(true)
+    expect(queue.enqueue('pty-1', 'k')).toBe(true)
+
+    await Promise.resolve()
+    expect(pendingYields).toHaveLength(1)
+    for (let turn = 0; turn < PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES; turn += 1) {
+      await releaseNextWrite(writes, pendingYields)
+    }
+    await queue.waitForDrain()
+
+    const replyWrites = writes.filter((write) => write.data.startsWith('\x1b]'))
+    expect(replyWrites.map((write) => write.data)).toEqual([
+      replies[0],
+      ...replies.slice(-PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES)
+    ])
+    expect(replyWrites.every((write) => needsCookedEchoSafeQueryReply(write.data))).toBe(true)
+    expect(writes.at(-1)?.data).toBe('k')
+  })
+
+  it('drops the oldest reply-only payload when the reply text budget fills', async () => {
+    const reply = (slot: 10 | 11, marker: string): string =>
+      `\x1b]${slot};${marker.repeat(1_400)}\x1b\\`
+    const first = reply(10, '1')
+    const dropped = reply(11, '2')
+    const second = reply(10, '3')
+    const third = reply(11, '4')
+    const { writes, pendingYields, queue } = createParkedQueue()
+
+    expect(second.length * 2).toBeLessThanOrEqual(
+      PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLY_CODE_UNITS
+    )
+    expect(second.length * 3).toBeGreaterThan(PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLY_CODE_UNITS)
+    queue.enqueueQueryReply('pty-1', first)
+    queue.enqueueQueryReply('pty-1', dropped)
+    queue.enqueue('pty-1', 'x')
+    queue.enqueueQueryReply('pty-1', second)
+    queue.enqueueQueryReply('pty-1', third)
+    queue.enqueue('pty-1', 'k')
+
+    await Promise.resolve()
+    expect(pendingYields).toHaveLength(1)
+    for (let turn = 0; turn < 3; turn += 1) {
+      await releaseNextWrite(writes, pendingYields)
+    }
+    await queue.waitForDrain()
+
+    expect(writes).toEqual([
+      { id: 'pty-1', data: first },
+      { id: 'pty-1', data: 'x' },
+      { id: 'pty-1', data: second },
+      { id: 'pty-1', data: third },
+      { id: 'pty-1', data: 'k' }
+    ])
+  })
+
+  it('bounds replies generated by a real xterm OSC query flood', async () => {
+    const term = new Terminal({ cols: 80, rows: 24, allowProposedApi: true })
+    term.options.theme = { foreground: '#2e3434', background: '#ffffff' }
+    const { writes, queue } = createRecordingQueue()
+    const generated: string[] = []
+    const disposable = installTerminalCapabilityReplyHandlers({
+      terminal: {
+        cols: term.cols,
+        rows: term.rows,
+        element: undefined,
+        options: term.options
+      },
+      parser: term.parser,
+      sendInput: (data) => {
+        generated.push(data)
+        return queue.enqueueQueryReply('pty-1', data)
+      },
+      isReplaying: () => false
+    })
+
+    try {
+      await writeTerminal(term, '\x1b]10;?;?\x1b\\'.repeat(34))
+      await queue.waitForDrain()
+
+      const foreground = '\x1b]10;rgb:2e2e/3434/3434\x1b\\'
+      const background = '\x1b]11;rgb:ffff/ffff/ffff\x1b\\'
+      expect(generated).toEqual(Array.from({ length: 34 }, () => [foreground, background]).flat())
+      expect(extractReplyWrites(writes)).toEqual([
+        foreground,
+        ...generated.slice(-PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES)
+      ])
+    } finally {
+      disposable.dispose()
+      term.dispose()
+    }
+  })
+
+  it('rejects one reply larger than the total reply retention budget', async () => {
+    const { writes, queue } = createRecordingQueue()
+    const prefix = '\x1b]10;'
+    const suffix = '\x1b\\'
+    const input = `${prefix}${'x'.repeat(
+      TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS + 1 - prefix.length - suffix.length
+    )}${suffix}`
+
+    expect(input).toHaveLength(TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS + 1)
+    expect(queue.enqueueQueryReply('pty-1', input)).toBe(false)
+    await queue.waitForDrain()
+
+    expect(writes).toEqual([])
+  })
+
+  it('preserves an ordinary backlog while bounding later replies', async () => {
+    const { writes, queue } = createRecordingQueue()
+    const ordinary = Array.from({ length: 10_000 }, (_, index) => String(index % 10))
+    const replies = Array.from({ length: 10_000 }, (_, index) => `\x1b[?${index};1n`)
+
+    for (const input of ordinary) {
+      expect(queue.enqueue('pty-1', input)).toBe(true)
+    }
+    for (const reply of replies) {
+      expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
+    }
+    await queue.waitForDrain()
+
+    expect(writes.map((write) => write.data).join('')).toBe(
+      [...ordinary, ...replies.slice(-PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES)].join('')
+    )
+    expect(extractReplyWrites(writes)).toEqual(
+      replies.slice(-PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES)
+    )
+  })
+
+  it('never sheds reply-shaped bytes sent through the ordinary input path', async () => {
+    const { writes, queue } = createRecordingQueue()
+    const ordinary = '\x1b]10;user-ordinary-marker\x1b\\'
+    const replies = Array.from({ length: 10_000 }, (_, index) => `\x1b[?${index};1n`)
+
+    expect(queue.enqueueQueryReply('pty-1', '\x1b[?10000;1n')).toBe(true)
+    expect(queue.enqueue('pty-1', ordinary)).toBe(true)
+    for (const reply of replies) {
+      expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
+    }
+    await queue.waitForDrain()
+
+    expect(writes.map((write) => write.data).join('')).toContain(ordinary)
+  })
+
+  it('contains drain failures and rejects input until queue reuse', async () => {
+    const failure = new Error('write failed')
+    const writes: WriteRecord[] = []
+    let shouldThrow = true
+    const onDrainFailure = vi.fn()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const queue = createPtyInputWriteQueue({
+      isWritable: () => true,
+      write: (id, data) => {
+        if (shouldThrow) {
+          throw failure
+        }
+        writes.push({ id, data })
+      },
+      onDrainFailure
+    })
+
+    try {
+      expect(queue.enqueue('pty-1', 'stale')).toBe(true)
+      expect(queue.enqueue('pty-1', 'also-stale')).toBe(false)
+      await expect(queue.waitForDrain()).resolves.toBeUndefined()
+
+      shouldThrow = false
+      expect(queue.enqueue('pty-1', 'still-stale')).toBe(false)
+      queue.clear()
+      expect(queue.enqueue('pty-1', 'fresh')).toBe(true)
+      await queue.waitForDrain()
+
+      expect(writes).toEqual([{ id: 'pty-1', data: 'fresh' }])
+      expect(warn).toHaveBeenCalledWith('[pty-input-write-queue] drain failed:', failure)
+      expect(onDrainFailure).toHaveBeenCalledOnce()
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  it('reports the pty id that failed so a rebound owner can ignore the drain failure', async () => {
+    const failure = new Error('yield failed')
+    const onDrainFailure = vi.fn()
+    let rejectYield: ((error: Error) => void) | undefined
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const queue = createPtyInputWriteQueue({
+      isWritable: () => true,
+      write: () => undefined,
+      yieldBetweenWrites: () =>
+        new Promise<void>((_resolve, reject) => {
+          rejectYield = reject
+        }),
+      onDrainFailure
+    })
+
+    try {
+      expect(queue.enqueue('pty-1', 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2))).toBe(true)
+      expect(rejectYield).toBeDefined()
+      rejectYield?.(failure)
+      await queue.waitForDrain()
+
+      expect(onDrainFailure).toHaveBeenCalledExactlyOnceWith('pty-1')
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  it('keeps a pending reply small enough that one drain step writes and removes it', () => {
+    // Larger replies would span chunks, so admitReply could evict a half-written entry.
+    expect(PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLY_CODE_UNITS * 3).toBeLessThanOrEqual(
+      TERMINAL_INPUT_CHUNK_MAX_BYTES
+    )
+  })
+
+  it('does not let a stale drain failure clear input queued after reuse', async () => {
+    const failure = new Error('stale yield failed')
+    const writes: WriteRecord[] = []
+    let rejectYield: ((error: Error) => void) | undefined
+    let rejectNextYield = true
+    const onDrainFailure = vi.fn()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const queue = createPtyInputWriteQueue({
+      isWritable: () => true,
+      write: (id, data) => writes.push({ id, data }),
+      yieldBetweenWrites: () => {
+        if (!rejectNextYield) {
+          return Promise.resolve()
+        }
+        return new Promise<void>((_resolve, reject) => {
+          rejectYield = reject
+        })
+      },
+      onDrainFailure
+    })
+
+    try {
+      expect(queue.enqueue('pty-1', 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2))).toBe(true)
+      expect(rejectYield).toBeDefined()
+      queue.clear()
+      rejectNextYield = false
+      expect(queue.enqueue('pty-2', 'fresh')).toBe(true)
+      rejectYield?.(failure)
+      await queue.waitForDrain()
+
+      expect(writes.at(-1)).toEqual({ id: 'pty-2', data: 'fresh' })
+      expect(warn).toHaveBeenCalledWith('[pty-input-write-queue] drain failed:', failure)
+      expect(onDrainFailure).not.toHaveBeenCalled()
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
   it('dual mode-2031 enqueues through the real queue never paint 997 under host echo-safe write', async () => {
-    // Issue path: xterm onData + mode-2031 scan each enqueue mode2031SequenceFor.
+    // Two 997s can still coalesce in one write: a fast theme flip, or an old client that
+    // still answers 2031 subscribes (#9993 made this host silent, mixed versions have not).
     // Drive the real write queue → host intercept (extract + answerLiveQueryReply)
     // → ingress echo strip, and assert no `997;1n` emission at the confirm prompt.
     vi.useFakeTimers()
@@ -198,8 +502,8 @@ describe('pty input write queue', () => {
       write: hostWrite
     })
 
-    expect(queue.enqueue('pty-1', reply)).toBe(true)
-    expect(queue.enqueue('pty-1', reply)).toBe(true)
+    expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
+    expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
     await queue.waitForDrain()
     await vi.advanceTimersByTimeAsync(0)
 
@@ -243,4 +547,37 @@ describe('pty input write queue', () => {
     expect(writes.length).toBe(1)
     expect(writes.map((write) => write.data).join('')).not.toContain('tail')
   })
+
+  it('clear() fences an in-flight validation before queue reuse', async () => {
+    vi.useFakeTimers()
+    const { writes, queue } = createRecordingQueue()
+    const stale = 'é'.repeat(CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS + 1)
+
+    try {
+      expect(queue.enqueue('pty-1', stale)).toBe(true)
+      queue.clear()
+      expect(queue.enqueue('pty-1', 'fresh')).toBe(true)
+
+      await vi.runAllTimersAsync()
+      await queue.waitForDrain()
+
+      expect(writes).toEqual([{ id: 'pty-1', data: 'fresh' }])
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('clear() resets reply capacity for later input', async () => {
+    const { writes, queue } = createRecordingQueue()
+    const reply = mode2031SequenceFor('dark')
+
+    for (let index = 0; index <= PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES; index += 1) {
+      expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
+    }
+    queue.clear()
+    expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
+    await queue.waitForDrain()
+
+    expect(extractReplyWrites(writes)).toEqual([reply, reply])
+  })
 })
diff --git a/src/renderer/src/components/terminal-pane/pty-input-write-queue.ts b/src/renderer/src/components/terminal-pane/pty-input-write-queue.ts
index d98465c252a..5e815b01dfc 100644
--- a/src/renderer/src/components/terminal-pane/pty-input-write-queue.ts
+++ b/src/renderer/src/components/terminal-pane/pty-input-write-queue.ts
@@ -9,10 +9,18 @@ import { needsCookedEchoSafeQueryReply } from '../../../../shared/terminal-query
 // 16KB TERMINAL_INPUT_CHUNK_MAX_BYTES cap without paying byte measurement on
 // the hot input path.
 export const TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS = 4096
+// Match host delivery's reply ceiling while keeping all retained reply text under one PTY chunk.
+export const PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES = 64
+// Keep ≤ TERMINAL_INPUT_CHUNK_MAX_BYTES/3 so a reply is written and dropped in one drain step:
+// admitReply evicts the head, and a half-written entry would truncate. Guarded by a unit test.
+export const PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLY_CODE_UNITS =
+  TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS
 
 type PendingPtyInputWrite = {
+  sequence: number
   id: string
   text: string
+  replyOnly: boolean
   tooLarge: boolean | Promise<boolean>
   chunks?: Iterator<string>
   nextChunk?: string
@@ -20,6 +28,7 @@ type PendingPtyInputWrite = {
 
 export type PtyInputWriteQueue = {
   enqueue: (id: string, data: string) => boolean
+  enqueueQueryReply: (id: string, data: string) => boolean
   waitForDrain: () => Promise<void>
   clear: () => void
 }
@@ -28,90 +37,209 @@ export type PtyInputWriteQueueDeps = {
   isWritable: (id: string) => boolean
   write: (id: string, data: string) => void
   yieldBetweenWrites?: () => Promise<void>
+  onDrainFailure?: (id: string) => void
 }
 
-function isCoalescibleText(text: string): boolean {
+function isCoalescibleInput(input: PendingPtyInputWrite): boolean {
   // Echo-risk replies stay atomic so host classifiers cannot miss them (#13137).
-  return (
-    text.length <= TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS && !needsCookedEchoSafeQueryReply(text)
-  )
+  return input.text.length <= TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS && !input.replyOnly
 }
 
 export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInputWriteQueue {
   const yieldBetweenWrites = deps.yieldBetweenWrites ?? yieldToEventLoop
-  let pending: PendingPtyInputWrite[] = []
+  let pendingOrdinary: (PendingPtyInputWrite | undefined)[] = []
+  let pendingOrdinaryHead = 0
+  let pendingReplies: (PendingPtyInputWrite | undefined)[] = []
+  let pendingReplyHead = 0
+  let pendingReplyCount = 0
+  let pendingReplyCodeUnits = 0
+  let nextSequence = 0
+  let generation = 0
+  let failedGeneration: number | null = null
   let drainPromise: Promise<void> | null = null
 
+  function compactOrdinary(): void {
+    if (pendingOrdinaryHead === pendingOrdinary.length) {
+      pendingOrdinary = []
+      pendingOrdinaryHead = 0
+    } else if (pendingOrdinaryHead >= 1024 && pendingOrdinaryHead * 2 >= pendingOrdinary.length) {
+      pendingOrdinary = pendingOrdinary.slice(pendingOrdinaryHead)
+      pendingOrdinaryHead = 0
+    }
+  }
+
+  function compactReplies(): void {
+    if (pendingReplyHead === pendingReplies.length) {
+      pendingReplies = []
+      pendingReplyHead = 0
+    } else if (pendingReplyHead >= 1024 && pendingReplyHead * 2 >= pendingReplies.length) {
+      pendingReplies = pendingReplies.slice(pendingReplyHead)
+      pendingReplyHead = 0
+    }
+  }
+
+  function resetSequenceIfEmpty(): void {
+    if (pendingOrdinary.length === 0 && pendingReplies.length === 0) {
+      nextSequence = 0
+    }
+  }
+
+  function firstPending(): PendingPtyInputWrite | undefined {
+    const ordinary = pendingOrdinary[pendingOrdinaryHead]
+    const reply = pendingReplies[pendingReplyHead]
+    if (!ordinary) {
+      return reply
+    }
+    if (!reply) {
+      return ordinary
+    }
+    return ordinary.sequence < reply.sequence ? ordinary : reply
+  }
+
+  function shiftOrdinary(): PendingPtyInputWrite | undefined {
+    const removed = pendingOrdinary[pendingOrdinaryHead]
+    pendingOrdinary[pendingOrdinaryHead] = undefined
+    pendingOrdinaryHead += 1
+    compactOrdinary()
+    resetSequenceIfEmpty()
+    return removed
+  }
+
+  function shiftReply(): PendingPtyInputWrite | undefined {
+    const removed = pendingReplies[pendingReplyHead]
+    pendingReplies[pendingReplyHead] = undefined
+    pendingReplyHead += 1
+    if (removed) {
+      pendingReplyCount -= 1
+      pendingReplyCodeUnits -= removed.text.length
+    }
+    compactReplies()
+    resetSequenceIfEmpty()
+    return removed
+  }
+
+  function removePending(item: PendingPtyInputWrite): void {
+    if (item.replyOnly) {
+      shiftReply()
+    } else {
+      shiftOrdinary()
+    }
+  }
+
+  function admitReply(text: string): boolean {
+    if (text.length > PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLY_CODE_UNITS) {
+      return false
+    }
+    while (
+      pendingReplyCount >= PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES ||
+      pendingReplyCodeUnits + text.length > PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLY_CODE_UNITS
+    ) {
+      if (!shiftReply()) {
+        return false
+      }
+    }
+    return true
+  }
+
+  function clearPending(): void {
+    pendingOrdinary = []
+    pendingOrdinaryHead = 0
+    pendingReplies = []
+    pendingReplyHead = 0
+    pendingReplyCount = 0
+    pendingReplyCodeUnits = 0
+    nextSequence = 0
+  }
+
   async function drain(): Promise<void> {
-    while (pending.length > 0) {
-      const next = pending[0]
-      if (!next) {
-        pending.shift()
-        continue
-      }
-      if (!deps.isWritable(next.id)) {
-        pending.shift()
-        continue
-      }
-      if (next.tooLarge !== false) {
-        next.tooLarge = await Promise.resolve(next.tooLarge).catch(() => true)
-        if (next.tooLarge) {
-          pending.shift()
-          continue
-        }
+    let failureGeneration = generation
+    // Why: the drain yields, so the owner may rebind before the failure surfaces; report the id that actually failed.
+    let failingId: string | null = null
+    try {
+      let next: PendingPtyInputWrite | undefined
+      while ((next = firstPending())) {
+        failureGeneration = generation
+        failingId = next.id
         if (!deps.isWritable(next.id)) {
-          pending.shift()
+          removePending(next)
           continue
         }
-      }
-      // Why: dense input streams (SGR wheel reports during trackpad momentum,
-      // key auto-repeat) enqueue one tiny item per event. Writing one item per
-      // macrotask turn lets Chromium's nested-timer clamp pace the drain at
-      // ≥4ms per item, so a fast gesture's reports reach the PTY seconds after
-      // the gesture ended and the TUI visibly replays them one by one.
-      // Coalescing consecutive validated small items into a single write keeps
-      // the PTY byte stream identical while draining the backlog in one turn.
-      if (next.chunks === undefined && isCoalescibleText(next.text)) {
-        let payload = next.text
-        pending.shift()
-        while (pending.length > 0) {
-          const peek = pending[0]
-          if (
-            !peek ||
-            peek.id !== next.id ||
-            peek.tooLarge !== false ||
-            peek.chunks !== undefined ||
-            !isCoalescibleText(peek.text) ||
-            payload.length + peek.text.length > TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS
-          ) {
-            break
+        if (next.tooLarge !== false) {
+          next.tooLarge = await Promise.resolve(next.tooLarge).catch(() => true)
+          if (firstPending() !== next) {
+            continue
+          }
+          if (next.tooLarge) {
+            removePending(next)
+            continue
+          }
+          if (!deps.isWritable(next.id)) {
+            removePending(next)
+            continue
           }
-          payload += peek.text
-          pending.shift()
         }
-        deps.write(next.id, payload)
-        if (pending.length > 0) {
+        // Why: dense input streams (SGR wheel reports during trackpad momentum,
+        // key auto-repeat) enqueue one tiny item per event. Writing one item per
+        // macrotask turn lets Chromium's nested-timer clamp pace the drain at
+        // ≥4ms per item, so a fast gesture's reports reach the PTY seconds after
+        // the gesture ended and the TUI visibly replays them one by one.
+        // Coalescing consecutive validated small items into a single write keeps
+        // the PTY byte stream identical while draining the backlog in one turn.
+        if (next.chunks === undefined && isCoalescibleInput(next)) {
+          let payload = next.text
+          removePending(next)
+          let peek: PendingPtyInputWrite | undefined
+          while ((peek = firstPending())) {
+            if (
+              peek.id !== next.id ||
+              peek.tooLarge !== false ||
+              peek.chunks !== undefined ||
+              !isCoalescibleInput(peek) ||
+              payload.length + peek.text.length > TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS
+            ) {
+              break
+            }
+            payload += peek.text
+            removePending(peek)
+          }
+          deps.write(next.id, payload)
+          if (firstPending()) {
+            await yieldBetweenWrites()
+          }
+          continue
+        }
+        next.chunks ??= iterateTerminalInputChunks(next.text)
+        const chunk =
+          next.nextChunk === undefined ? next.chunks.next() : { done: false, value: next.nextChunk }
+        next.nextChunk = undefined
+        if (chunk.done) {
+          removePending(next)
+          continue
+        }
+        deps.write(next.id, chunk.value)
+        const following = next.chunks.next()
+        if (following.done) {
+          removePending(next)
+        } else {
+          next.nextChunk = following.value
+        }
+        if (firstPending()) {
           await yieldBetweenWrites()
         }
-        continue
       }
-      next.chunks ??= iterateTerminalInputChunks(next.text)
-      const chunk =
-        next.nextChunk === undefined ? next.chunks.next() : { done: false, value: next.nextChunk }
-      next.nextChunk = undefined
-      if (chunk.done) {
-        pending.shift()
-        continue
+    } catch (error) {
+      const failureIsCurrent = generation === failureGeneration
+      if (failureIsCurrent) {
+        clearPending()
+        failedGeneration = generation
       }
-      deps.write(next.id, chunk.value)
-      const following = next.chunks.next()
-      if (following.done) {
-        pending.shift()
-      } else {
-        next.nextChunk = following.value
-      }
-      if (pending.length > 0) {
-        await yieldBetweenWrites()
+      console.warn('[pty-input-write-queue] drain failed:', error)
+      if (failureIsCurrent && failingId !== null) {
+        try {
+          deps.onDrainFailure?.(failingId)
+        } catch (recoveryError) {
+          console.warn('[pty-input-write-queue] failure handler failed:', recoveryError)
+        }
       }
     }
   }
@@ -120,27 +248,51 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
     if (drainPromise) {
       return
     }
-    drainPromise = drain().finally(() => {
+    const finishDrain = (): void => {
       drainPromise = null
-      if (pending.length > 0) {
+      if (firstPending()) {
         scheduleDrain()
       }
-    })
+    }
+    drainPromise = drain().finally(finishDrain)
+  }
+
+  function enqueueInput(id: string, data: string, queryReply: boolean): boolean {
+    try {
+      if (failedGeneration === generation) {
+        return false
+      }
+      const replyOnly = queryReply && needsCookedEchoSafeQueryReply(data)
+      if (replyOnly && !admitReply(data)) {
+        return false
+      }
+      const tooLarge = replyOnly ? false : isTerminalInputTooLargeWithDeferredMeasurement(data)
+      if (tooLarge === true) {
+        return false
+      }
+      const item = { sequence: nextSequence, id, text: data, replyOnly, tooLarge }
+      nextSequence += 1
+      if (replyOnly) {
+        pendingReplies.push(item)
+        pendingReplyCount += 1
+        pendingReplyCodeUnits += data.length
+      } else {
+        pendingOrdinary.push(item)
+      }
+      scheduleDrain()
+      return true
+    } catch {
+      return false
+    }
   }
 
   return {
     enqueue(id: string, data: string): boolean {
-      try {
-        const tooLarge = isTerminalInputTooLargeWithDeferredMeasurement(data)
-        if (tooLarge === true) {
-          return false
-        }
-        pending.push({ id, text: data, tooLarge })
-        scheduleDrain()
-        return true
-      } catch {
-        return false
-      }
+      return enqueueInput(id, data, false)
+    },
+
+    enqueueQueryReply(id: string, data: string): boolean {
+      return enqueueInput(id, data, true)
     },
 
     async waitForDrain(): Promise<void> {
@@ -150,7 +302,9 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
     },
 
     clear(): void {
-      pending = []
+      generation += 1
+      failedGeneration = null
+      clearPending()
     }
   }
 }
diff --git a/src/renderer/src/components/terminal-pane/pty-shutdown-data-suspension.test.ts b/src/renderer/src/components/terminal-pane/pty-shutdown-data-suspension.test.ts
index 45846d08143..fcaf70e0a5a 100644
--- a/src/renderer/src/components/terminal-pane/pty-shutdown-data-suspension.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-shutdown-data-suspension.test.ts
@@ -3,12 +3,16 @@ import {
   bufferPtyShutdownData,
   bufferPtyShutdownReplayData,
   drainRolledBackPtyShutdownData,
+  isPtyDataHandlerShutdownPending,
   ptyDataHandlers,
+  ptyDataSidecars,
   ptyReplayHandlers,
   ptyShutdownLifecycleHandlers,
   ptyTeardownHandlers,
   unregisterPtyDataHandlers
 } from './pty-shutdown-data-suspension'
+import { bufferPreHandlerPtyData } from './pty-pre-handler-buffer'
+import { PtyShutdownOutputQueue } from './pty-shutdown-output-queue'
 
 it('does not remove handlers installed by a remount while sleep is pending', () => {
   const ptyId = 'pty-shutdown-remount'
@@ -33,16 +37,45 @@ it('does not remove handlers installed by a remount while sleep is pending', ()
 it('replays rollback output in its original replay and live arrival order', () => {
   const ptyId = 'pty-shutdown-output-order'
   const delivered: string[] = []
+  const meta = { seq: 9, rawLength: 3, transformed: true }
+  const sidecar = vi.fn((data: string) => delivered.push(`sidecar:${data}`))
   ptyDataHandlers.set(ptyId, (data) => delivered.push(`data:${data}`))
   ptyReplayHandlers.set(ptyId, (data) => delivered.push(`replay:${data}`))
+  ptyDataSidecars.set(ptyId, new Set([sidecar]))
 
   const [snapshot] = unregisterPtyDataHandlers([ptyId])
   bufferPtyShutdownReplayData(ptyId, 'old')
-  bufferPtyShutdownData(ptyId, 'new')
+  bufferPtyShutdownData(ptyId, 'new', meta)
   snapshot.rollback()
 
-  expect(delivered).toEqual(['replay:old', 'data:new'])
+  expect(delivered).toEqual(['replay:old', 'data:new', 'sidecar:new'])
+  expect(sidecar).toHaveBeenCalledOnce()
   ptyDataHandlers.delete(ptyId)
+  ptyDataSidecars.delete(ptyId)
+  ptyReplayHandlers.delete(ptyId)
+})
+
+it('drains pre-handler data before ordered shutdown output', () => {
+  const ptyId = 'pty-shutdown-pre-handler-order'
+  const delivered: string[] = []
+  const preHandlerMeta = { seq: 1, rawLength: 3 }
+  const shutdownMeta = { seq: 2, rawLength: 4, background: true }
+  const dataHandler = vi.fn((data: string) => delivered.push(`data:${data}`))
+  ptyDataHandlers.set(ptyId, dataHandler)
+  ptyReplayHandlers.set(ptyId, (data) => delivered.push(`replay:${data}`))
+  ptyDataSidecars.set(ptyId, new Set([(data) => delivered.push(`sidecar:${data}`)]))
+
+  const [snapshot] = unregisterPtyDataHandlers([ptyId])
+  bufferPreHandlerPtyData(ptyId, 'pre', preHandlerMeta)
+  bufferPtyShutdownReplayData(ptyId, 'old')
+  bufferPtyShutdownData(ptyId, 'live', shutdownMeta)
+  snapshot.rollback()
+
+  expect(delivered).toEqual(['data:pre', 'sidecar:pre', 'replay:old', 'data:live', 'sidecar:live'])
+  expect(dataHandler).toHaveBeenNthCalledWith(1, 'pre', preHandlerMeta)
+  expect(dataHandler).toHaveBeenNthCalledWith(2, 'live', shutdownMeta)
+  ptyDataHandlers.delete(ptyId)
+  ptyDataSidecars.delete(ptyId)
   ptyReplayHandlers.delete(ptyId)
 })
 
@@ -50,27 +83,65 @@ it('retains ordered rollback output across detach and another pending shutdown',
   const ptyId = 'pty-shutdown-detached-overlap'
   const originalData = vi.fn()
   const originalReplay = vi.fn()
+  const drain = vi.spyOn(PtyShutdownOutputQueue.prototype, 'drain')
+  const encode = vi.spyOn(TextEncoder.prototype, 'encode')
   ptyDataHandlers.set(ptyId, originalData)
   ptyReplayHandlers.set(ptyId, originalReplay)
 
   const [first] = unregisterPtyDataHandlers([ptyId])
   ptyDataHandlers.delete(ptyId)
   ptyReplayHandlers.delete(ptyId)
-  bufferPtyShutdownData(ptyId, 'live-first')
+  const meta = { seq: 3, rawLength: 10, transformed: true }
+  bufferPtyShutdownData(ptyId, 'live-first', meta)
   bufferPtyShutdownReplayData(ptyId, 'replay-second')
   first.rollback()
+  expect(drain).not.toHaveBeenCalled()
 
   const [second] = unregisterPtyDataHandlers([ptyId])
+  expect(encode).not.toHaveBeenCalled()
   const delivered: string[] = []
-  ptyDataHandlers.set(ptyId, (data) => delivered.push(`data:${data}`))
+  const replacementData = vi.fn((data: string) => delivered.push(`data:${data}`))
+  ptyDataHandlers.set(ptyId, replacementData)
   ptyReplayHandlers.set(ptyId, (data) => delivered.push(`replay:${data}`))
   drainRolledBackPtyShutdownData(ptyId)
   expect(delivered).toEqual([])
+  expect(drain).not.toHaveBeenCalled()
 
   second.rollback()
   expect(delivered).toEqual(['data:live-first', 'replay:replay-second'])
+  expect(replacementData).toHaveBeenCalledWith('live-first', meta)
+  expect(drain).toHaveBeenCalledOnce()
+  drain.mockRestore()
+  encode.mockRestore()
   ptyDataHandlers.delete(ptyId)
   ptyReplayHandlers.delete(ptyId)
   ptyTeardownHandlers.delete(ptyId)
   ptyShutdownLifecycleHandlers.delete(ptyId)
 })
+
+it('detaches the delivered batch from a reentrant shutdown queue', () => {
+  const ptyId = 'pty-shutdown-reentrant-delivery'
+  const delivered: string[] = []
+  let reentrantSnapshot: ReturnType<typeof unregisterPtyDataHandlers>[number] | undefined
+  ptyDataHandlers.set(ptyId, (data) => {
+    delivered.push(data)
+    if (data === 'old-first') {
+      reentrantSnapshot = unregisterPtyDataHandlers([ptyId])[0]
+      bufferPtyShutdownData(ptyId, 'new-pending')
+    }
+  })
+  ptyReplayHandlers.set(ptyId, vi.fn())
+
+  const [first] = unregisterPtyDataHandlers([ptyId])
+  bufferPtyShutdownData(ptyId, 'old-first')
+  bufferPtyShutdownData(ptyId, 'old-second')
+  first.rollback()
+
+  expect(delivered).toEqual(['old-first', 'old-second'])
+  expect(isPtyDataHandlerShutdownPending(ptyId)).toBe(true)
+  reentrantSnapshot?.rollback()
+  expect(delivered).toEqual(['old-first', 'old-second', 'new-pending'])
+  expect(isPtyDataHandlerShutdownPending(ptyId)).toBe(false)
+  ptyDataHandlers.delete(ptyId)
+  ptyReplayHandlers.delete(ptyId)
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-shutdown-data-suspension.ts b/src/renderer/src/components/terminal-pane/pty-shutdown-data-suspension.ts
index 0bc654bfe8e..508ea88b2be 100644
--- a/src/renderer/src/components/terminal-pane/pty-shutdown-data-suspension.ts
+++ b/src/renderer/src/components/terminal-pane/pty-shutdown-data-suspension.ts
@@ -1,7 +1,6 @@
-import { TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT } from '../../../../shared/terminal-scrollback-limits'
-import { clampUtf8Tail } from './pty-eager-buffer-clamp'
 import { clearPreHandlerPtyState, drainPreHandlerPtyData } from './pty-pre-handler-buffer'
 import type { PtyDataMeta } from './pty-dispatcher'
+import { PtyShutdownOutputQueue, type PtyShutdownOutputEvent } from './pty-shutdown-output-queue'
 
 export const ptyDataHandlers = new Map<string, (data: string, meta?: PtyDataMeta) => void>()
 export const ptyDataSidecars = new Map<string, Set<(data: string) => void>>()
@@ -25,8 +24,7 @@ export type PtyDataHandlerShutdownSnapshot = {
 type PendingPtyHandlerShutdown = {
   owners: number
   committed: boolean
-  bufferedBytes: number
-  events: PtyShutdownOutputEvent[]
+  outputQueue: PtyShutdownOutputQueue
   dataHandler?: (data: string, meta?: PtyDataMeta) => void
   replayHandler?: (data: string) => void
   teardownHandler?: () => void
@@ -34,13 +32,8 @@ type PendingPtyHandlerShutdown = {
 }
 
 const pendingPtyHandlerShutdowns = new Map<string, PendingPtyHandlerShutdown>()
-type PtyShutdownOutputEvent =
-  | { kind: 'data'; data: string; meta?: PtyDataMeta }
-  | { kind: 'replay'; data: string }
-
-const rolledBackShutdownEvents = new Map<string, PtyShutdownOutputEvent[]>()
+const rolledBackShutdownEvents = new Map<string, PtyShutdownOutputQueue>()
 const ROLLED_BACK_SHUTDOWN_REPLAY_MAX_PTYS = 64
-const shutdownBufferTextEncoder = new TextEncoder()
 
 /** Suspend delivery until every overlapping shutdown owner commits or rolls back. */
 export function unregisterPtyDataHandlers(ptyIds: string[]): PtyDataHandlerShutdownSnapshot[] {
@@ -50,16 +43,12 @@ export function unregisterPtyDataHandlers(ptyIds: string[]): PtyDataHandlerShutd
     if (pending) {
       pending.owners += 1
     } else {
-      const retainedEvents = rolledBackShutdownEvents.get(id) ?? []
+      const outputQueue = rolledBackShutdownEvents.get(id) ?? new PtyShutdownOutputQueue()
       rolledBackShutdownEvents.delete(id)
       pending = {
         owners: 1,
         committed: false,
-        bufferedBytes: retainedEvents.reduce(
-          (total, event) => total + shutdownBufferTextEncoder.encode(event.data).byteLength,
-          0
-        ),
-        events: retainedEvents,
+        outputQueue,
         dataHandler: ptyDataHandlers.get(id),
         replayHandler: ptyReplayHandlers.get(id),
         teardownHandler: ptyTeardownHandlers.get(id),
@@ -113,17 +102,7 @@ function bufferPtyShutdownOutput(ptyId: string, event: PtyShutdownOutputEvent):
   if (!pending) {
     return false
   }
-  const clamped = clampUtf8Tail(event.data, TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT)
-  pending.events.push({ ...event, data: clamped.data })
-  pending.bufferedBytes += clamped.bytes
-  while (
-    pending.bufferedBytes > TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT &&
-    pending.events.length > 1
-  ) {
-    pending.bufferedBytes -= shutdownBufferTextEncoder.encode(
-      pending.events.shift()?.data ?? ''
-    ).byteLength
-  }
+  pending.outputQueue.enqueue(event)
   return true
 }
 
@@ -131,14 +110,14 @@ export function drainRolledBackPtyShutdownData(ptyId: string): void {
   if (pendingPtyHandlerShutdowns.has(ptyId)) {
     return
   }
-  const events = rolledBackShutdownEvents.get(ptyId)
+  const outputQueue = rolledBackShutdownEvents.get(ptyId)
   const dataHandler = ptyDataHandlers.get(ptyId)
   const replayHandler = ptyReplayHandlers.get(ptyId)
-  if (!events || !dataHandler || !replayHandler) {
+  if (!outputQueue || !dataHandler || !replayHandler) {
     return
   }
   rolledBackShutdownEvents.delete(ptyId)
-  deliverShutdownEvents(ptyId, events, dataHandler, replayHandler)
+  outputQueue.drain((event) => deliverShutdownEvent(ptyId, event, dataHandler, replayHandler))
 }
 
 function settlePtyDataHandlerShutdown(ptyId: string, committed: boolean): void {
@@ -154,6 +133,7 @@ function settlePtyDataHandlerShutdown(ptyId: string, committed: boolean): void {
   pendingPtyHandlerShutdowns.delete(ptyId)
   if (pending.committed) {
     rolledBackShutdownEvents.delete(ptyId)
+    pending.outputQueue.discard()
     pending.lifecycleHandler?.commit()
     deleteCapturedHandler(ptyDataHandlers, ptyId, pending.dataHandler)
     deleteCapturedHandler(ptyReplayHandlers, ptyId, pending.replayHandler)
@@ -173,10 +153,12 @@ function settlePtyDataHandlerShutdown(ptyId: string, committed: boolean): void {
   const dataHandler = ptyDataHandlers.get(ptyId)
   const replayHandler = ptyReplayHandlers.get(ptyId)
   if (dataHandler && replayHandler) {
-    deliverShutdownEvents(ptyId, pending.events, dataHandler, replayHandler)
-  } else if (pending.events.length > 0) {
+    pending.outputQueue.drain((event) =>
+      deliverShutdownEvent(ptyId, event, dataHandler, replayHandler)
+    )
+  } else if (pending.outputQueue.length > 0) {
     // Why: a hidden pane can detach during the RPC; retain rollback output until both ordered channels reattach.
-    rolledBackShutdownEvents.set(ptyId, pending.events)
+    rolledBackShutdownEvents.set(ptyId, pending.outputQueue)
     while (rolledBackShutdownEvents.size > ROLLED_BACK_SHUTDOWN_REPLAY_MAX_PTYS) {
       const oldestPtyId = rolledBackShutdownEvents.keys().next().value
       if (typeof oldestPtyId !== 'string') {
@@ -197,20 +179,18 @@ function deleteCapturedHandler<T>(
   }
 }
 
-function deliverShutdownEvents(
+function deliverShutdownEvent(
   ptyId: string,
-  events: readonly PtyShutdownOutputEvent[],
+  event: PtyShutdownOutputEvent,
   dataHandler: (data: string, meta?: PtyDataMeta) => void,
   replayHandler: (data: string) => void
 ): void {
-  for (const event of events) {
-    if (event.kind === 'replay') {
-      replayHandler(event.data)
-      continue
-    }
-    dataHandler(event.data, event.meta)
-    for (const sidecar of Array.from(ptyDataSidecars.get(ptyId) ?? [])) {
-      sidecar(event.data)
-    }
+  if (event.kind === 'replay') {
+    replayHandler(event.data)
+    return
+  }
+  dataHandler(event.data, event.meta)
+  for (const sidecar of Array.from(ptyDataSidecars.get(ptyId) ?? [])) {
+    sidecar(event.data)
   }
 }
diff --git a/src/renderer/src/components/terminal-pane/pty-shutdown-output-queue.test.ts b/src/renderer/src/components/terminal-pane/pty-shutdown-output-queue.test.ts
new file mode 100644
index 00000000000..b2d835e4258
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-shutdown-output-queue.test.ts
@@ -0,0 +1,290 @@
+import { describe, expect, it } from 'vitest'
+import { TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT } from '../../../../shared/terminal-scrollback-limits'
+import { clampUtf8Tail } from './pty-eager-buffer-clamp'
+import { PtyShutdownOutputQueue, type PtyShutdownOutputEvent } from './pty-shutdown-output-queue'
+
+const BYTE_LIMIT = TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT
+const CHUNK_SIZE = 64
+
+class ReferenceShutdownOutputQueue {
+  private events: PtyShutdownOutputEvent[] = []
+  private retainedBytes = 0
+  private readonly encoder = new TextEncoder()
+
+  enqueue(event: PtyShutdownOutputEvent): void {
+    const clamped = clampUtf8Tail(event.data, BYTE_LIMIT)
+    this.events.push({ ...event, data: clamped.data })
+    this.retainedBytes += clamped.bytes
+    while (this.retainedBytes > BYTE_LIMIT && this.events.length > 1) {
+      this.retainedBytes -= this.encoder.encode(this.events.shift()?.data ?? '').byteLength
+    }
+  }
+
+  takeAll(): PtyShutdownOutputEvent[] {
+    const events = this.events
+    this.events = []
+    this.retainedBytes = 0
+    return events
+  }
+}
+
+function createSeededRandom(seed: number): () => number {
+  let state = seed >>> 0
+  return () => {
+    state ^= state << 13
+    state ^= state >>> 17
+    state ^= state << 5
+    return state >>> 0
+  }
+}
+
+function createDifferentialData(value: number): string {
+  const bucket = value % 100
+  if (bucket < 8) {
+    return ''
+  }
+  if (bucket < 48) {
+    return String.fromCharCode(65 + (value % 26)).repeat(value % 513)
+  }
+  if (bucket < 70) {
+    return '界'.repeat(value % 257)
+  }
+  if (bucket < 88) {
+    return '😀'.repeat(value % 129)
+  }
+  if (bucket < 96) {
+    return `\ud800${'x'.repeat(value % 511)}`
+  }
+  return String.fromCharCode(65 + (value % 26)).repeat(64 * 1024)
+}
+
+describe('PTY shutdown output queue', () => {
+  it('does not shift or re-encode retained events while saturated', () => {
+    const originalShift = Array.prototype.shift
+    const originalEncode = TextEncoder.prototype.encode
+    const queue = new PtyShutdownOutputQueue()
+
+    try {
+      Object.defineProperties(Array.prototype, {
+        shift: {
+          configurable: true,
+          writable: true,
+          value() {
+            throw new Error('Array.shift should not run on enqueue')
+          }
+        }
+      })
+      Object.defineProperties(TextEncoder.prototype, {
+        encode: {
+          configurable: true,
+          writable: true,
+          value() {
+            throw new Error('TextEncoder.encode should not run on enqueue')
+          }
+        }
+      })
+      for (let index = 0; index < 1_536; index += 1) {
+        queue.enqueue({ kind: 'data', data: 'x'.repeat(1_024), meta: { seq: index } })
+      }
+    } finally {
+      Object.defineProperties(Array.prototype, {
+        shift: { configurable: true, writable: true, value: originalShift }
+      })
+      Object.defineProperties(TextEncoder.prototype, {
+        encode: { configurable: true, writable: true, value: originalEncode }
+      })
+    }
+
+    expect(queue.takeAll()).toHaveLength(512)
+  })
+
+  it('keeps exact UTF-8 boundaries, Unicode tails, and metadata identity', () => {
+    const boundaryQueue = new PtyShutdownOutputQueue()
+    const emptyMeta = { rawLength: 9, transformed: true, droppedOutput: true }
+    boundaryQueue.enqueue({ kind: 'replay', data: 'a'.repeat(BYTE_LIMIT) })
+    boundaryQueue.enqueue({ kind: 'data', data: '', meta: emptyMeta })
+    expect(boundaryQueue.getStorageForTest()).toMatchObject({
+      retainedBytes: BYTE_LIMIT,
+      retainedEvents: 2
+    })
+    boundaryQueue.enqueue({ kind: 'replay', data: 'b' })
+
+    const boundary = boundaryQueue.takeAll()
+    expect(boundary).toEqual([
+      { kind: 'data', data: '', meta: emptyMeta },
+      { kind: 'replay', data: 'b' }
+    ])
+    expect(boundary[0]?.kind === 'data' ? boundary[0].meta : undefined).toBe(emptyMeta)
+
+    const unicodeQueue = new PtyShutdownOutputQueue()
+    const emojiTail = '😀'.repeat(BYTE_LIMIT / 4)
+    const unicodeMeta = { seq: 7, rawLength: emojiTail.length + 1, background: true }
+    unicodeQueue.enqueue({ kind: 'data', data: `P${emojiTail}`, meta: unicodeMeta })
+    const [unicode] = unicodeQueue.takeAll()
+    expect(unicode?.data).toBe(emojiTail)
+    expect(unicode?.kind === 'data' ? unicode.meta : undefined).toBe(unicodeMeta)
+
+    const loneSurrogateQueue = new PtyShutdownOutputQueue()
+    const loneSurrogateTail = `\ud800${'z'.repeat(BYTE_LIMIT - 3)}`
+    loneSurrogateQueue.enqueue({ kind: 'replay', data: `P${loneSurrogateTail}` })
+    expect(loneSurrogateQueue.takeAll()[0]?.data).toBe(loneSurrogateTail)
+  })
+
+  it('evicts whole oldest events without merging replay and live boundaries', () => {
+    const queue = new PtyShutdownOutputQueue()
+    const meta = { seq: 42, rawLength: BYTE_LIMIT - 3, transformed: true }
+    queue.enqueue({ kind: 'replay', data: 'old' })
+    queue.enqueue({ kind: 'data', data: 'x'.repeat(BYTE_LIMIT - 3), meta })
+    queue.enqueue({ kind: 'replay', data: 'new' })
+
+    const retained = queue.takeAll()
+    expect(retained).toEqual([
+      { kind: 'data', data: 'x'.repeat(BYTE_LIMIT - 3), meta },
+      { kind: 'replay', data: 'new' }
+    ])
+    expect(retained[0]?.kind === 'data' ? retained[0].meta : undefined).toBe(meta)
+  })
+
+  it('retains zero-byte event boundaries without imposing a count cap', () => {
+    const queue = new PtyShutdownOutputQueue()
+    for (let index = 0; index < 4_097; index += 1) {
+      queue.enqueue({ kind: 'data', data: '', meta: { seq: index, transformed: true } })
+    }
+
+    expect(queue.getStorageForTest()).toMatchObject({
+      retainedBytes: 0,
+      retainedEvents: 4_097
+    })
+    const retained = queue.takeAll()
+    expect(retained).toHaveLength(4_097)
+    expect(retained[0]).toEqual({ kind: 'data', data: '', meta: { seq: 0, transformed: true } })
+    expect(retained.at(-1)).toEqual({
+      kind: 'data',
+      data: '',
+      meta: { seq: 4_096, transformed: true }
+    })
+  })
+
+  it('repeatedly compacts cleared prefixes and resets transferred storage', () => {
+    const queue = new PtyShutdownOutputQueue()
+    const fullEvent = '界'.repeat(Math.floor(BYTE_LIMIT / 3))
+    for (let index = 0; index < 513; index += 1) {
+      queue.enqueue({ kind: 'replay', data: fullEvent })
+      const storage = queue.getStorageForTest()
+      expect(storage.retainedEvents).toBe(1)
+      expect(storage.retainedBytes).toBe(BYTE_LIMIT - 2)
+      expect(storage.backingLength).toBeLessThanOrEqual(CHUNK_SIZE)
+      expect(storage.byteBackingLength).toBeLessThanOrEqual(CHUNK_SIZE)
+    }
+
+    expect(queue.takeAll()).toEqual([{ kind: 'replay', data: fullEvent }])
+    expect(queue.getStorageForTest()).toEqual({
+      backingLength: 0,
+      byteBackingLength: 0,
+      chunkBackingLength: 0,
+      head: 0,
+      headChunk: 0,
+      retainedBytes: 0,
+      retainedEvents: 0
+    })
+
+    queue.enqueue({ kind: 'data', data: 'discarded' })
+    queue.discard()
+    expect(queue.takeAll()).toEqual([])
+  })
+
+  it('releases dead backing storage under release-scale one-byte churn', () => {
+    const queue = new PtyShutdownOutputQueue()
+    for (let index = 0; index < BYTE_LIMIT + CHUNK_SIZE * 3 + 17; index += 1) {
+      queue.enqueue({ kind: 'replay', data: 'x' })
+    }
+
+    const storage = queue.getStorageForTest()
+    expect(storage.retainedEvents).toBe(BYTE_LIMIT)
+    expect(storage.retainedBytes).toBe(BYTE_LIMIT)
+    expect(storage.backingLength - storage.retainedEvents).toBeLessThan(CHUNK_SIZE)
+    expect(storage.byteBackingLength).toBe(0)
+    expect(storage.head).toBeLessThan(CHUNK_SIZE)
+    expect(storage.headChunk).toBeLessThan(storage.chunkBackingLength)
+  })
+
+  it('repeatedly compacts the consumed chunk cursor', () => {
+    const queue = new PtyShutdownOutputQueue()
+    const data = 'x'.repeat(BYTE_LIMIT / CHUNK_SIZE)
+    for (let index = 0; index < CHUNK_SIZE; index += 1) {
+      queue.enqueue({ kind: 'replay', data })
+    }
+
+    for (let cycle = 0; cycle < 3; cycle += 1) {
+      for (let index = 0; index < CHUNK_SIZE * CHUNK_SIZE; index += 1) {
+        queue.enqueue({ kind: 'replay', data })
+      }
+      expect(queue.getStorageForTest()).toEqual({
+        backingLength: CHUNK_SIZE,
+        byteBackingLength: 0,
+        chunkBackingLength: 1,
+        head: 0,
+        headChunk: 0,
+        retainedBytes: BYTE_LIMIT,
+        retainedEvents: CHUNK_SIZE
+      })
+    }
+  })
+
+  it('recounts a returned Unicode event after mutation and re-enqueue', () => {
+    const queue = new PtyShutdownOutputQueue()
+    const reference = new ReferenceShutdownOutputQueue()
+    const unicode: PtyShutdownOutputEvent = { kind: 'replay', data: '界' }
+    queue.enqueue(unicode)
+    reference.enqueue(unicode)
+    const returned = queue.takeAll()[0]
+    const referenceReturned = reference.takeAll()[0]
+    if (!returned || !referenceReturned) {
+      throw new Error('Expected queued events')
+    }
+    returned.data = 'x'
+    referenceReturned.data = 'x'
+    queue.enqueue(returned)
+    reference.enqueue(referenceReturned)
+    const newest: PtyShutdownOutputEvent = { kind: 'data', data: 'y'.repeat(BYTE_LIMIT) }
+    queue.enqueue(newest)
+    reference.enqueue(newest)
+    expect(queue.getStorageForTest().retainedBytes).toBe(BYTE_LIMIT)
+    const overflow: PtyShutdownOutputEvent = { kind: 'replay', data: 'z' }
+    queue.enqueue(overflow)
+    reference.enqueue(overflow)
+
+    expect(queue.takeAll()).toEqual(reference.takeAll())
+  })
+
+  it('matches the previous algorithm across a seeded adversarial stream', () => {
+    const queue = new PtyShutdownOutputQueue()
+    const reference = new ReferenceShutdownOutputQueue()
+    const random = createSeededRandom(0x15c0ffee)
+
+    for (let index = 0; index < 5_000; index += 1) {
+      const value = random()
+      const data = createDifferentialData(value)
+      const event: PtyShutdownOutputEvent =
+        value % 3 === 0
+          ? { kind: 'replay', data }
+          : {
+              kind: 'data',
+              data,
+              meta: {
+                seq: index,
+                rawLength: data.length + (value % 5),
+                transformed: value % 2 === 0,
+                ...(value % 7 === 0 ? { background: true } : {}),
+                ...(value % 97 === 0 ? { droppedOutput: true } : {})
+              }
+            }
+      queue.enqueue(event)
+      reference.enqueue(event)
+
+      if ((index + 1) % 1_000 === 0) {
+        expect(queue.takeAll()).toEqual(reference.takeAll())
+      }
+    }
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-shutdown-output-queue.ts b/src/renderer/src/components/terminal-pane/pty-shutdown-output-queue.ts
new file mode 100644
index 00000000000..b54b787309f
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-shutdown-output-queue.ts
@@ -0,0 +1,149 @@
+import { TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT } from '../../../../shared/terminal-scrollback-limits'
+import { clampUtf8Tail } from './pty-eager-buffer-clamp'
+import type { PtyDataMeta } from './pty-dispatcher'
+
+const EVENT_CHUNK_SIZE = 64
+const COMPACTION_MIN_HEAD_CHUNKS = 64
+
+export type PtyShutdownOutputEvent =
+  | { kind: 'data'; data: string; meta?: PtyDataMeta }
+  | { kind: 'replay'; data: string }
+
+type PtyShutdownOutputChunk = {
+  events: (PtyShutdownOutputEvent | undefined)[]
+  eventBytes?: Uint32Array
+}
+
+export type PtyShutdownOutputQueueStorage = {
+  backingLength: number
+  byteBackingLength: number
+  chunkBackingLength: number
+  head: number
+  headChunk: number
+  retainedBytes: number
+  retainedEvents: number
+}
+
+export class PtyShutdownOutputQueue {
+  private chunks: (PtyShutdownOutputChunk | undefined)[] = []
+  private headChunk = 0
+  private headOffset = 0
+  private retainedBytes = 0
+  private retainedEvents = 0
+
+  enqueue(event: PtyShutdownOutputEvent): void {
+    const clamped = clampUtf8Tail(event.data, TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT)
+    let tail = this.chunks.at(-1)
+    if (!tail || tail.events.length >= EVENT_CHUNK_SIZE) {
+      tail = { events: [] }
+      this.chunks.push(tail)
+    }
+    const tailOffset = tail.events.length
+    tail.events.push({ ...event, data: clamped.data })
+    if (clamped.bytes !== clamped.data.length) {
+      tail.eventBytes ??= new Uint32Array(EVENT_CHUNK_SIZE)
+      tail.eventBytes[tailOffset] = clamped.bytes
+    }
+    this.retainedBytes += clamped.bytes
+    this.retainedEvents += 1
+
+    while (this.length > 1 && this.retainedBytes > TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT) {
+      this.evictOldest()
+    }
+  }
+
+  takeAll(): PtyShutdownOutputEvent[] {
+    const events: PtyShutdownOutputEvent[] = []
+    this.drain((event) => events.push(event))
+    return events
+  }
+
+  drain(consumer: (event: PtyShutdownOutputEvent) => void): void {
+    const chunks = this.chunks
+    const headChunk = this.headChunk
+    const headOffset = this.headOffset
+    this.reset()
+    for (let chunkIndex = headChunk; chunkIndex < chunks.length; chunkIndex += 1) {
+      const chunk = chunks[chunkIndex]
+      if (!chunk) {
+        continue
+      }
+      const start = chunkIndex === headChunk ? headOffset : 0
+      for (let eventIndex = start; eventIndex < chunk.events.length; eventIndex += 1) {
+        const event = chunk.events[eventIndex]
+        if (event) {
+          consumer(event)
+        }
+      }
+    }
+  }
+
+  discard(): void {
+    this.reset()
+  }
+
+  get length(): number {
+    return this.retainedEvents
+  }
+
+  getStorageForTest(): PtyShutdownOutputQueueStorage {
+    let backingLength = 0
+    let byteBackingLength = 0
+    for (const chunk of this.chunks) {
+      if (chunk) {
+        backingLength += chunk.events.length
+        byteBackingLength += chunk.eventBytes?.length ?? 0
+      }
+    }
+    return {
+      backingLength,
+      byteBackingLength,
+      chunkBackingLength: this.chunks.length,
+      head: this.headOffset,
+      headChunk: this.headChunk,
+      retainedBytes: this.retainedBytes,
+      retainedEvents: this.length
+    }
+  }
+
+  private evictOldest(): void {
+    const chunk = this.chunks[this.headChunk]
+    if (!chunk) {
+      throw new Error('Missing PTY shutdown output queue chunk')
+    }
+    const event = chunk.events[this.headOffset]
+    if (!event) {
+      throw new Error('Missing PTY shutdown output queue event')
+    }
+    this.retainedBytes -= chunk.eventBytes?.[this.headOffset] || event.data.length
+    chunk.events[this.headOffset] = undefined
+    if (chunk.eventBytes) {
+      chunk.eventBytes[this.headOffset] = 0
+    }
+    this.headOffset += 1
+    this.retainedEvents -= 1
+    if (this.headOffset < chunk.events.length) {
+      return
+    }
+    this.chunks[this.headChunk] = undefined
+    this.headChunk += 1
+    this.headOffset = 0
+    this.compactChunks()
+  }
+
+  private compactChunks(): void {
+    if (this.headChunk < COMPACTION_MIN_HEAD_CHUNKS || this.headChunk * 2 < this.chunks.length) {
+      return
+    }
+    this.chunks = this.chunks.slice(this.headChunk)
+    this.headChunk = 0
+  }
+
+  private reset(): void {
+    this.chunks = []
+    this.headChunk = 0
+    this.headOffset = 0
+    this.retainedBytes = 0
+    this.retainedEvents = 0
+  }
+}
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-types.ts b/src/renderer/src/components/terminal-pane/pty-transport-types.ts
index 8c82e7584a1..fadc7bd0feb 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-types.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-types.ts
@@ -18,6 +18,8 @@ import type { RemoteRuntimeSnapshotOutcome } from '../../runtime/remote-runtime-
 
 export type PtyBufferSnapshot = {
   data: string
+  /** Live state that can be restored without an alternate-screen frame. */
+  frameRestoreAnsi?: string
   cols: number
   rows: number
   seq?: number
@@ -39,6 +41,21 @@ export type PtyBufferSnapshot = {
    *  before post-snapshot live chunks — so the continuation completes it
    *  exactly as live instead of rendering literal (Bug E / #7329). */
   pendingEscapeTailAnsi?: string
+  /** Effective kitty flags the owner of this image proved at `seq`. Absent
+   *  means unknown; never rewrite that silence into a known `0`. */
+  kittyKeyboardFlags?: number
+}
+
+/** Metadata for one authoritative replay payload. */
+export type PtyReplayDataMeta = {
+  clearBeforeReplay?: boolean
+  pendingEscapeTailAnsi?: string
+  /** Kitty flags the snapshot's owner PROVED at `snapshotSeq`. Absent means
+   *  unknown; the pane tracker must stay unproven rather than assume zero. */
+  kittyKeyboardFlags?: number
+  /** The boundary `kittyKeyboardFlags` describes, recorded as the renderer's
+   *  ordered high-water so a quiet pane can still publish a coherent snapshot. */
+  snapshotSeq?: number
 }
 
 export type LocalPtySessionMetadata = {
@@ -59,6 +76,17 @@ export type PtyConnectResult = {
   snapshot?: string
   snapshotCols?: number
   snapshotRows?: number
+  /** Normal-buffer history and mode preamble before an alternate-screen frame. */
+  snapshotPrefixAnsi?: string
+  /** Visual alternate-screen frame. Both fields are absent on older hosts. */
+  snapshotFrameAnsi?: string
+  /** Live state to append when omitting `snapshotFrameAnsi`. */
+  snapshotFrameRestoreAnsi?: string
+  /** Kitty keyboard flags the daemon snapshot proved, paired with the renderer-
+   *  domain `snapshotSeq` main reconciled for the same attach boundary. Absent
+   *  means unknown, never a proven inactive protocol. */
+  snapshotKittyKeyboardFlags?: number
+  snapshotSeq?: number
   isAlternateScreen?: boolean
   sessionExpired?: boolean
   coldRestore?: { scrollback: string; cwd: string; cols?: number; rows?: number }
@@ -78,10 +106,7 @@ type PtyCallbacks = {
   onConnect?: () => void
   onDisconnect?: () => void
   onData?: (data: string, meta?: PtyDataMeta) => void
-  onReplayData?: (
-    data: string,
-    meta?: { clearBeforeReplay?: boolean; pendingEscapeTailAnsi?: string }
-  ) => void
+  onReplayData?: (data: string, meta?: PtyReplayDataMeta) => void
   onStatus?: (shell: string) => void
   onError?: (message: string, errors?: string[]) => void
   onExit?: (code: number) => void
diff --git a/src/renderer/src/components/terminal-pane/pty-transport.test.ts b/src/renderer/src/components/terminal-pane/pty-transport.test.ts
index 6bbba35a4be..14ff327146e 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport.test.ts
@@ -14,6 +14,7 @@ import {
   TERMINAL_INPUT_MAX_BYTES
 } from '../../../../shared/terminal-input'
 import { CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS } from '../../../../shared/clipboard-text'
+import { PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES } from './pty-input-write-queue'
 
 describe('createIpcPtyTransport', () => {
   const originalWindow = (globalThis as { window?: typeof window }).window
@@ -107,6 +108,29 @@ describe('createIpcPtyTransport', () => {
     transport.disconnect()
   })
 
+  it('routes a thrown renderer write to the owning transport recovery callback', async () => {
+    const failure = new Error('ipc write failed')
+    vi.mocked(window.api.pty.write).mockImplementation(() => {
+      throw failure
+    })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+
+    try {
+      const { createIpcPtyTransport } = await import('./pty-transport')
+      const recovery = vi.fn()
+      const transport = createIpcPtyTransport({})
+      await transport.connect({ url: '', callbacks: { onWriteUnavailable: recovery } })
+
+      expect(transport.sendInput('input')).toBe(true)
+      expect(transport.sendInput('later-input')).toBe(false)
+
+      expect(recovery).toHaveBeenCalledOnce()
+      expect(warn).toHaveBeenCalledWith('[pty-input-write-queue] drain failed:', failure)
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
   it('does not create a second kill authority when a mounted pane detaches', async () => {
     const { createIpcPtyTransport } = await import('./pty-transport')
     const kill = window.api.pty.kill as unknown as ReturnType<typeof vi.fn>
@@ -1132,6 +1156,36 @@ describe('createIpcPtyTransport', () => {
     }
   })
 
+  it('bounds immediate cooked replies without shedding ordinary-path lookalikes', async () => {
+    vi.useFakeTimers()
+    try {
+      const { createIpcPtyTransport } = await import('./pty-transport')
+      const transport = createIpcPtyTransport({})
+      const first = '\x1b[?10000;1n'
+      const ordinary = '\x1b]10;user-ordinary-marker\x1b\\'
+      const replies = Array.from({ length: 10_000 }, (_, index) => `\x1b[?${index};1n`)
+
+      await transport.connect({ url: '', callbacks: {} })
+      expect(transport.sendInputImmediate(first)).toBe(true)
+      expect(transport.sendInput(ordinary)).toBe(true)
+      for (const reply of replies) {
+        expect(transport.sendInputImmediate(reply)).toBe(true)
+      }
+
+      await vi.runAllTimersAsync()
+
+      expect(vi.mocked(window.api.pty.write).mock.calls).toEqual([
+        ['pty-1', first],
+        ['pty-1', ordinary],
+        ...replies
+          .slice(-PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES)
+          .map((reply) => ['pty-1', reply])
+      ])
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('yields while validating accepted large local IPC terminal input before renderer-to-main writes', async () => {
     vi.useFakeTimers()
     try {
@@ -1709,7 +1763,7 @@ describe('createIpcPtyTransport', () => {
     expect(writeMock).not.toHaveBeenCalled()
   })
 
-  it('preserves snapshot dimensions when reattaching', async () => {
+  it('preserves snapshot dimensions and split alt-frame strings when reattaching', async () => {
     const { createIpcPtyTransport } = await import('./pty-transport')
     const spawnMock = vi.fn().mockResolvedValue({
       id: 'pty-reattach',
@@ -1717,7 +1771,10 @@ describe('createIpcPtyTransport', () => {
       launchAgent: 'droid',
       snapshot: 'snapshot data',
       snapshotCols: 132,
-      snapshotRows: 43
+      snapshotRows: 43,
+      snapshotPrefixAnsi: 'history and modes',
+      snapshotFrameAnsi: 'visual frame',
+      snapshotFrameRestoreAnsi: 'live state'
     })
 
     ;(globalThis as { window: typeof window }).window = {
@@ -1757,6 +1814,9 @@ describe('createIpcPtyTransport', () => {
       snapshot: 'snapshot data',
       snapshotCols: 132,
       snapshotRows: 43,
+      snapshotPrefixAnsi: 'history and modes',
+      snapshotFrameAnsi: 'visual frame',
+      snapshotFrameRestoreAnsi: 'live state',
       isAlternateScreen: undefined,
       coldRestore: undefined,
       replay: undefined,
diff --git a/src/renderer/src/components/terminal-pane/pty-transport.ts b/src/renderer/src/components/terminal-pane/pty-transport.ts
index edba63981cc..96199cb3aa2 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport.ts
@@ -66,6 +66,7 @@ export type {
   LocalPtySessionMetadata,
   PtyBufferSnapshot,
   PtyConnectResult,
+  PtyReplayDataMeta,
   PtyTransport
 } from './pty-transport-types'
 export { extractLastOscTitle } from '../../../../shared/agent-detection'
@@ -104,6 +105,9 @@ type ProcessPtyOutputOptions = {
   clearBeforeReplay?: boolean
   // Why: a mid-escape tail; the replay consumer writes it LAST (after the post-replay reset) so the next live chunk completes it, not renders it literally (#7329).
   pendingEscapeTailAnsi?: string
+  /** Kitty flags the snapshot owner proved at `snapshotSeq`. */
+  kittyKeyboardFlags?: number
+  snapshotSeq?: number
 }
 
 type PendingPtySideEffect = {
@@ -496,7 +500,13 @@ export function createPtyOutputProcessor({
         ...(options.clearBeforeReplay === false ? { clearBeforeReplay: false } : {}),
         ...(options.pendingEscapeTailAnsi
           ? { pendingEscapeTailAnsi: options.pendingEscapeTailAnsi }
-          : {})
+          : {}),
+        // Why forwarded together: the flags are only valid for the boundary the
+        // image describes, so they never travel without their sequence.
+        ...(options.kittyKeyboardFlags !== undefined
+          ? { kittyKeyboardFlags: options.kittyKeyboardFlags }
+          : {}),
+        ...(options.snapshotSeq !== undefined ? { snapshotSeq: options.snapshotSeq } : {})
       }
       // Why: preserve the bare-data call shape when there's no replay metadata, so eager-buffer replay (which passes none) is unchanged.
       if (Object.keys(replayMeta).length > 0) {
@@ -577,9 +587,17 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
   let ptyId: string | null = null
   // Why: replayed eager-buffer data (often from a prior app session) must not fire fresh bells, unread marks, or notifications on reconnect.
   let suppressAttentionEvents = false
+  let storedCallbacks: Parameters<PtyTransport['connect']>[0]['callbacks'] = {}
   const inputWriteQueue = createPtyInputWriteQueue({
     isWritable: (id) => connected && ptyId === id,
-    write: (id, data) => window.api.pty.write(id, data)
+    write: (id, data) => window.api.pty.write(id, data),
+    // Guard like the registered writeUnavailable handler: a rebind during the async drain
+    // must not tell the new pane that its write failed.
+    onDrainFailure: (id) => {
+      if (ptyId === id) {
+        storedCallbacks.onWriteUnavailable?.()
+      }
+    }
   })
   const outputProcessor = createPtyOutputProcessor({
     onTitleChange,
@@ -593,8 +611,6 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
     onAgentExited,
     onAgentStatus
   })
-  let storedCallbacks: Parameters<PtyTransport['connect']>[0]['callbacks'] = {}
-
   // Why: a new pane can attach to the same ptyId before the old instance's detach() runs; track owned handlers so unregister never deletes the live one.
   const ownedDataAndReplayHandlers = new Map<
     string,
@@ -887,6 +903,15 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
             snapshot: spawnResult.snapshot,
             snapshotCols: spawnResult.snapshotCols,
             snapshotRows: spawnResult.snapshotRows,
+            ...(spawnResult.snapshotPrefixAnsi !== undefined
+              ? { snapshotPrefixAnsi: spawnResult.snapshotPrefixAnsi }
+              : {}),
+            ...(spawnResult.snapshotFrameAnsi !== undefined
+              ? { snapshotFrameAnsi: spawnResult.snapshotFrameAnsi }
+              : {}),
+            ...(spawnResult.snapshotFrameRestoreAnsi !== undefined
+              ? { snapshotFrameRestoreAnsi: spawnResult.snapshotFrameRestoreAnsi }
+              : {}),
             isAlternateScreen: spawnResult.isAlternateScreen,
             sessionExpired: spawnResult.sessionExpired,
             coldRestore: spawnResult.coldRestore,
@@ -1051,7 +1076,7 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
       if (!connected || !ptyId) {
         return false
       }
-      return inputWriteQueue.enqueue(ptyId, data)
+      return inputWriteQueue.enqueueQueryReply(ptyId, data)
     },
 
     ...(connectionId
diff --git a/src/renderer/src/components/terminal-pane/remote-hidden-output-restore-outcomes.test.ts b/src/renderer/src/components/terminal-pane/remote-hidden-output-restore-outcomes.test.ts
index 47bc5af02e2..0c9b286703c 100644
--- a/src/renderer/src/components/terminal-pane/remote-hidden-output-restore-outcomes.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-hidden-output-restore-outcomes.test.ts
@@ -63,7 +63,6 @@ type MockTransport = {
 
 const scheduleRuntimeGraphSync = vi.fn()
 const shouldSeedCacheTimerOnInitialTitle = vi.fn(() => false)
-const scheduleTerminalWebglAtlasRecovery = vi.fn()
 const toastInfo = vi.fn()
 const notifyCodexPaneBoundForStaleSweep = vi.fn()
 
@@ -88,10 +87,6 @@ vi.mock('@/store', () => ({
   }
 }))
 
-vi.mock('./terminal-webgl-atlas-recovery', () => ({
-  scheduleTerminalWebglAtlasRecovery
-}))
-
 vi.mock('@/lib/agent-status', async (importOriginal) => {
   const actual = await importOriginal<Record<string, unknown>>()
   const isGeminiTerminalTitle = actual.isGeminiTerminalTitle as (title: string) => boolean
diff --git a/src/renderer/src/components/terminal-pane/remote-hidden-output-restore-unavailable-banner.repro.test.ts b/src/renderer/src/components/terminal-pane/remote-hidden-output-restore-unavailable-banner.repro.test.ts
index 3ce3f3ad193..ea6f69c1ab7 100644
--- a/src/renderer/src/components/terminal-pane/remote-hidden-output-restore-unavailable-banner.repro.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-hidden-output-restore-unavailable-banner.repro.test.ts
@@ -85,7 +85,6 @@ type MockTransport = {
 
 const scheduleRuntimeGraphSync = vi.fn()
 const shouldSeedCacheTimerOnInitialTitle = vi.fn(() => false)
-const scheduleTerminalWebglAtlasRecovery = vi.fn()
 const toastInfo = vi.fn()
 const notifyCodexPaneBoundForStaleSweep = vi.fn()
 
@@ -110,10 +109,6 @@ vi.mock('@/store', () => ({
   }
 }))
 
-vi.mock('./terminal-webgl-atlas-recovery', () => ({
-  scheduleTerminalWebglAtlasRecovery
-}))
-
 vi.mock('@/lib/agent-status', async (importOriginal) => {
   const actual = await importOriginal<Record<string, unknown>>()
   const isGeminiTerminalTitle = actual.isGeminiTerminalTitle as (title: string) => boolean
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
index d34bd384511..8908b39c63c 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
@@ -1768,6 +1768,14 @@ export function createRemoteRuntimePtyTransport(
               suppressAttentionEvents: true,
               ...(meta?.pendingEscapeTailAnsi
                 ? { pendingEscapeTailAnsi: meta.pendingEscapeTailAnsi }
+                : {}),
+              // Why both or neither: the host's flags describe this image's own
+              // boundary, so an unsequenced snapshot proves nothing.
+              ...(meta?.kittyKeyboardFlags !== undefined && meta.seq !== undefined
+                ? {
+                    kittyKeyboardFlags: meta.kittyKeyboardFlags,
+                    snapshotSeq: meta.seq
+                  }
                 : {})
             })
           }
diff --git a/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts b/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts
index 1b7c36a0a1f..959b4a9a7e4 100644
--- a/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-agent-session-fork.ts
@@ -36,9 +36,7 @@ function buildForkWorkspaceName(sourceName: string): string {
 }
 
 function resolveTuiAgent(value: string | null | undefined): TuiAgent | null {
-  return value && Object.prototype.hasOwnProperty.call(TUI_AGENT_CONFIG, value)
-    ? (value as TuiAgent)
-    : null
+  return value && Object.hasOwn(TUI_AGENT_CONFIG, value) ? (value as TuiAgent) : null
 }
 
 function getUsableForkBase(
diff --git a/src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx b/src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx
new file mode 100644
index 00000000000..902c3254557
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx
@@ -0,0 +1,342 @@
+/** @vitest-environment happy-dom */
+import { act, StrictMode } from 'react'
+import type * as ReactModule from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Tab, TabGroup, TerminalTab } from '../../../../shared/types'
+
+;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+
+const harness = vi.hoisted(() => ({
+  worktreeId: 'repo::/cold-park-pre-gate',
+  discardMemoCaches: false,
+  coverageCalls: 0,
+  syncCalls: 0,
+  slotRenders: 0,
+  renderedParkedSets: [] as string[][]
+}))
+
+vi.mock('react', async () => {
+  const actual = await vi.importActual<typeof ReactModule>('react')
+  return {
+    ...actual,
+    useMemo: ((calculate, dependencies) =>
+      harness.discardMemoCaches
+        ? calculate()
+        : actual.useMemo(calculate, dependencies)) as typeof actual.useMemo
+  }
+})
+
+vi.mock('../../store', async () => {
+  const { create } = await import('zustand')
+  const useAppStore = create(() => ({
+    activeGroupIdByWorktree: {} as Record<string, string | undefined>,
+    groupsByWorktree: {} as Record<string, TabGroup[]>,
+    pendingStartupByTabId: {} as Record<string, unknown>,
+    ptyIdsByTabId: {} as Record<string, string[]>,
+    runtimeStatusByEnvironmentId: new Map<string, unknown>(),
+    runtimePaneTitlesByTabId: {} as Record<string, Record<number, string>>,
+    settings: {} as Record<string, unknown>,
+    sleepingAgentSessionsByPaneKey: {} as Record<string, unknown>,
+    tabsByWorktree: {} as Record<string, TerminalTab[]>,
+    terminalLayoutsByTabId: {} as Record<string, unknown>,
+    unifiedTabsByWorktree: {} as Record<string, Tab[]>,
+    consumeSuppressedPtyExit: () => false,
+    focusGroup: () => {},
+    reconcileWorktreeTabModel: () => ({ renderableTabCount: 2 }),
+    setActiveWorktree: () => {}
+  }))
+  return { useAppStore }
+})
+
+vi.mock('../native-chat/use-native-chat-toggle-shortcut', () => ({
+  useNativeChatToggleShortcut: () => {}
+}))
+
+vi.mock('./TerminalOverlaySlot', () => ({
+  TerminalOverlaySlot: () => {
+    harness.slotRenders += 1
+    return null
+  }
+}))
+
+vi.mock('./terminal-parked-tab-watchers', async () => {
+  const { useAppStore } = await import('../../store')
+  return {
+    canWatcherCoverParkedTerminalTab: () => {
+      harness.coverageCalls += 1
+      return harness.coverageCalls % 2 === 1
+    },
+    disposeParkedTerminalWatchersForWorktree: () => {},
+    syncParkedTerminalTabWatchers: (args: {
+      worktreeId: string
+      parkedTabIds: ReadonlySet<string>
+    }) => {
+      harness.syncCalls += 1
+      harness.renderedParkedSets.push([...args.parkedTabIds].sort())
+      if (args.parkedTabIds.size === 0) {
+        return
+      }
+      ;(
+        useAppStore as unknown as {
+          setState: (update: (state: ParkingStoreState) => Partial<ParkingStoreState>) => void
+        }
+      ).setState((state) => ({
+        tabsByWorktree: {
+          ...state.tabsByWorktree,
+          [args.worktreeId]: state.tabsByWorktree[args.worktreeId].map((tab) => ({
+            ...tab,
+            title: `${tab.id}-${harness.syncCalls}`
+          }))
+        },
+        unifiedTabsByWorktree: {
+          ...state.unifiedTabsByWorktree,
+          [args.worktreeId]: state.unifiedTabsByWorktree[args.worktreeId].map((tab) => ({
+            ...tab,
+            label: `${tab.entityId}-${harness.syncCalls}`
+          }))
+        }
+      }))
+    }
+  }
+})
+
+vi.mock('./terminal-parking-e2e-overrides', () => ({
+  getTerminalParkingPolicyOverrides: () => ({ coldParkDelayMs: 0, hotRetainMs: 0 })
+}))
+
+vi.mock('@/lib/crash-breadcrumb-recorder', () => ({
+  recordRendererCrashBreadcrumb: vi.fn()
+}))
+
+import { useAppStore } from '../../store'
+import TerminalPaneOverlayLayer from './TerminalPaneOverlayLayer'
+
+const TAB_IDS = ['tab-a', 'tab-b'] as const
+const GROUP_ID = 'group-a'
+
+type ParkingStoreState = {
+  groupsByWorktree: Record<string, TabGroup[]>
+  tabsByWorktree: Record<string, TerminalTab[]>
+  unifiedTabsByWorktree: Record<string, Tab[]>
+}
+
+const parkingStore = useAppStore as unknown as {
+  getState: () => ParkingStoreState
+  setState: (partial: Record<string, unknown>) => void
+}
+
+function terminalTab(id: string): TerminalTab {
+  return {
+    id,
+    worktreeId: harness.worktreeId,
+    ptyId: `${harness.worktreeId}@@session-${id}`,
+    title: id,
+    generation: 0
+  } as TerminalTab
+}
+
+function unifiedTerminalTab(id: string): Tab {
+  return {
+    id: `unified-${id}`,
+    entityId: id,
+    worktreeId: harness.worktreeId,
+    groupId: GROUP_ID,
+    contentType: 'terminal',
+    label: id,
+    customLabel: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 0
+  }
+}
+
+function renderProductionLayer(root: Root, coldParkTerminalPanes = true): unknown {
+  const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
+  let thrown: unknown = null
+  try {
+    act(() => {
+      root.render(
+        <StrictMode>
+          <TerminalPaneOverlayLayer
+            worktreeId={harness.worktreeId}
+            worktreePath="cold-park-pre-gate"
+            isWorktreeActive={false}
+            coldParkTerminalPanes={coldParkTerminalPanes}
+          />
+        </StrictMode>
+      )
+    })
+  } catch (error) {
+    thrown = error
+  }
+  consoleError.mockRestore()
+  return thrown
+}
+
+describe('TerminalPaneOverlayLayer cold-park pre-gate loop', () => {
+  let container: HTMLDivElement
+  let root: Root | undefined
+
+  beforeEach(() => {
+    harness.discardMemoCaches = false
+    harness.coverageCalls = 0
+    harness.syncCalls = 0
+    harness.slotRenders = 0
+    harness.renderedParkedSets.length = 0
+    const tabs = TAB_IDS.map(terminalTab)
+    const unifiedTabs = TAB_IDS.map(unifiedTerminalTab)
+    parkingStore.setState({
+      activeGroupIdByWorktree: { [harness.worktreeId]: GROUP_ID },
+      groupsByWorktree: {
+        [harness.worktreeId]: [
+          {
+            id: GROUP_ID,
+            worktreeId: harness.worktreeId,
+            activeTabId: unifiedTabs[0].id,
+            tabOrder: unifiedTabs.map((tab) => tab.id),
+            recentTabIds: [unifiedTabs[0].id]
+          }
+        ]
+      },
+      tabsByWorktree: { [harness.worktreeId]: tabs },
+      unifiedTabsByWorktree: { [harness.worktreeId]: unifiedTabs }
+    })
+    container = document.createElement('div')
+    document.body.appendChild(container)
+  })
+
+  afterEach(() => {
+    try {
+      act(() => root?.unmount())
+    } catch {
+      // A failed initial commit leaves no mounted tree to clean up.
+    }
+    root = undefined
+    container.remove()
+  })
+
+  it('settles title publications without suppressing PTY rechecks', () => {
+    root = createRoot(container)
+    const thrown = renderProductionLayer(root)
+
+    expect(thrown).toBeNull()
+    expect(harness.coverageCalls).toBe(2)
+    expect(harness.syncCalls).toBeLessThan(10)
+    expect(harness.renderedParkedSets).not.toHaveLength(0)
+    expect(new Set(harness.renderedParkedSets.map((ids) => ids.join(',')))).toEqual(
+      new Set([TAB_IDS.join(',')])
+    )
+    expect(harness.slotRenders).toBe(0)
+
+    const settledSyncCalls = harness.syncCalls
+    const state = parkingStore.getState()
+    act(() => {
+      parkingStore.setState({
+        tabsByWorktree: {
+          ...state.tabsByWorktree,
+          [harness.worktreeId]: state.tabsByWorktree[harness.worktreeId].map((tab) =>
+            tab.id === TAB_IDS[1] ? { ...tab, ptyId: `${tab.ptyId}-replacement` } : tab
+          )
+        }
+      })
+    })
+
+    expect(harness.coverageCalls).toBe(3)
+    expect(harness.syncCalls).toBeGreaterThan(settledSyncCalls)
+    expect(new Set(harness.renderedParkedSets.map((ids) => ids.join(',')))).toEqual(
+      new Set([TAB_IDS.join(',')])
+    )
+    expect(harness.slotRenders).toBe(0)
+
+    const beforePendingSpawnSyncCalls = harness.syncCalls
+    const pendingSpawnState = parkingStore.getState()
+    act(() => {
+      parkingStore.setState({
+        tabsByWorktree: {
+          ...pendingSpawnState.tabsByWorktree,
+          [harness.worktreeId]: pendingSpawnState.tabsByWorktree[harness.worktreeId].map((tab) =>
+            tab.id === TAB_IDS[1] ? { ...tab, pendingActivationSpawn: 1 } : tab
+          )
+        }
+      })
+    })
+    expect(harness.syncCalls).toBeGreaterThan(beforePendingSpawnSyncCalls)
+
+    const beforeTabOrderSyncCalls = harness.syncCalls
+    const tabOrderState = parkingStore.getState()
+    act(() => {
+      parkingStore.setState({
+        tabsByWorktree: {
+          ...tabOrderState.tabsByWorktree,
+          [harness.worktreeId]: tabOrderState.tabsByWorktree[harness.worktreeId].toReversed()
+        }
+      })
+    })
+    expect(harness.syncCalls).toBeGreaterThan(beforeTabOrderSyncCalls)
+
+    const beforeActiveTabChangeSyncCalls = harness.syncCalls
+    const activeTabState = parkingStore.getState()
+    act(() => {
+      parkingStore.setState({
+        groupsByWorktree: {
+          ...activeTabState.groupsByWorktree,
+          [harness.worktreeId]: activeTabState.groupsByWorktree[harness.worktreeId].map(
+            (group) => ({
+              ...group,
+              activeTabId: `unified-${TAB_IDS[1]}`
+            })
+          )
+        }
+      })
+    })
+    expect(harness.syncCalls).toBeGreaterThan(beforeActiveTabChangeSyncCalls)
+
+    const beforeGroupChangeSyncCalls = harness.syncCalls
+    const groupState = parkingStore.getState()
+    const nextGroupId = 'group-b'
+    act(() => {
+      parkingStore.setState({
+        groupsByWorktree: {
+          ...groupState.groupsByWorktree,
+          [harness.worktreeId]: [
+            ...groupState.groupsByWorktree[harness.worktreeId],
+            {
+              id: nextGroupId,
+              worktreeId: harness.worktreeId,
+              activeTabId: `unified-${TAB_IDS[1]}`,
+              tabOrder: [`unified-${TAB_IDS[1]}`],
+              recentTabIds: [`unified-${TAB_IDS[1]}`]
+            }
+          ]
+        },
+        unifiedTabsByWorktree: {
+          ...groupState.unifiedTabsByWorktree,
+          [harness.worktreeId]: groupState.unifiedTabsByWorktree[harness.worktreeId].map((tab) =>
+            tab.entityId === TAB_IDS[1] ? { ...tab, groupId: nextGroupId } : tab
+          )
+        }
+      })
+    })
+    expect(harness.syncCalls).toBeGreaterThan(beforeGroupChangeSyncCalls)
+
+    expect(renderProductionLayer(root, false)).toBeNull()
+    expect(harness.slotRenders).toBeGreaterThan(0)
+
+    expect(renderProductionLayer(root)).toBeNull()
+    expect(harness.renderedParkedSets.at(-1)).toEqual([...TAB_IDS])
+  })
+
+  it('settles equivalent publications after memo cache discard', () => {
+    harness.discardMemoCaches = true
+    root = createRoot(container)
+
+    const thrown = renderProductionLayer(root)
+
+    expect(thrown).toBeNull()
+    expect(harness.syncCalls).toBeLessThan(10)
+    expect(new Set(harness.renderedParkedSets.map((ids) => ids.join(',')))).toEqual(
+      new Set([TAB_IDS.join(',')])
+    )
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx b/src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx
index 97cb2db3428..08fadd307fe 100644
--- a/src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx
+++ b/src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx
@@ -31,6 +31,7 @@ vi.mock('../../store', async () => {
   const { create } = await import('zustand')
   const useAppStore = create(() => ({
     pendingStartupByTabId: {} as Record<string, unknown>,
+    ptyIdsByTabId: {} as Record<string, string[]>,
     runtimeStatusByEnvironmentId: new Map<string, unknown>(),
     settings: {} as Record<string, unknown>,
     terminalLayoutsByTabId: {} as Record<string, unknown>,
@@ -153,6 +154,7 @@ function OverlayHost(): React.JSX.Element | null {
     terminalTabs,
     assignments: EMPTY_ASSIGNMENTS,
     isWorktreeActive: false,
+    activeTerminalTabId: null,
     coldParkTerminalPanes: false,
     shouldMeasureHiddenWorktree: false,
     activityTerminalPortals: EMPTY_PORTALS,
diff --git a/src/renderer/src/components/terminal-pane/terminal-file-link-actions.test.ts b/src/renderer/src/components/terminal-pane/terminal-file-link-actions.test.ts
index 56332ab01aa..c75aad5ae12 100644
--- a/src/renderer/src/components/terminal-pane/terminal-file-link-actions.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-file-link-actions.test.ts
@@ -40,6 +40,7 @@ function context(request: ReturnType<typeof vi.fn>): TerminalLinkActionContext {
   return {
     paneId: 3,
     pointerGesture: { canRequestAction: () => true, dispose: vi.fn() },
+    claimPtyMouse: vi.fn(() => true),
     request: request as TerminalLinkActionContext['request'],
     focusTerminal: vi.fn()
   }
diff --git a/src/renderer/src/components/terminal-pane/terminal-file-open-routing.ts b/src/renderer/src/components/terminal-pane/terminal-file-open-routing.ts
index a0fd4840586..cd8fa2722dc 100644
--- a/src/renderer/src/components/terminal-pane/terminal-file-open-routing.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-file-open-routing.ts
@@ -58,16 +58,22 @@ export function mapTerminalFilePath(
   worktreePath: string,
   wslDistro?: string | null
 ): string {
-  const distro = wslDistro?.trim() || parseWslUncPath(worktreePath)?.distro
-  if (!distro || !filePath.startsWith('/') || filePath.startsWith('//')) {
+  const distro =
+    wslDistro === null ? null : wslDistro?.trim() || parseWslUncPath(worktreePath)?.distro
+  if (!distro || !filePath.startsWith('/')) {
+    return filePath
+  }
+  // Why: only a proven local WSL pane may reinterpret this POSIX-looking path; SSH/runtime paths stay literal.
+  const alreadyUnc = parseWslUncPath(filePath)
+  if (alreadyUnc) {
+    return toWindowsWslPath(alreadyUnc.linuxPath, alreadyUnc.distro)
+  }
+  if (filePath.startsWith('//')) {
     return filePath
   }
   // Why: /mnt/<drive> is a Windows drive mounted into WSL — reach it directly
   // instead of routing a native file back through the 9P share.
-  if (/^\/mnt\/[a-z](\/|$)/.test(filePath)) {
-    return toWindowsWslPath(filePath, distro)
-  }
-  return `//wsl.localhost/${distro}${filePath}`
+  return toWindowsWslPath(filePath, distro)
 }
 
 // Why: remote-runtime panes print the remote host's POSIX paths; the local WSL
@@ -75,8 +81,8 @@ export function mapTerminalFilePath(
 export function terminalLinkWslDistro(
   wslDistro: string | null | undefined,
   runtimeEnvironmentId: string | null | undefined
-): string | null {
-  return runtimeEnvironmentId ? null : (wslDistro ?? null)
+): string | null | undefined {
+  return runtimeEnvironmentId ? null : wslDistro
 }
 
 export function shouldOpenTerminalFileWithSystemDefault(
diff --git a/src/renderer/src/components/terminal-pane/terminal-handle-links.test.ts b/src/renderer/src/components/terminal-pane/terminal-handle-links.test.ts
index 3c042a12d24..ae9c5e0e4cc 100644
--- a/src/renderer/src/components/terminal-pane/terminal-handle-links.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-handle-links.test.ts
@@ -311,6 +311,7 @@ describe('createTerminalHandleLinkProvider', () => {
     const links = await collectLinks([makeBufferLine('Worker: term_worker')], 1, null, {
       paneId: 4,
       pointerGesture: { canRequestAction: () => true, dispose: vi.fn() },
+      claimPtyMouse: vi.fn(() => true),
       request,
       focusTerminal: vi.fn()
     })
diff --git a/src/renderer/src/components/terminal-pane/terminal-hidden-delivery-gate.ts b/src/renderer/src/components/terminal-pane/terminal-hidden-delivery-gate.ts
index 367c42afe78..0950b05508e 100644
--- a/src/renderer/src/components/terminal-pane/terminal-hidden-delivery-gate.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-hidden-delivery-gate.ts
@@ -4,7 +4,7 @@
  * The gate only operates when main holds side-effect authority for the PTY
  * (see isMainTerminalSideEffectAuthorityForPty) AND the gate-specific kill
  * switch is on. Callers decide once at pane/watcher creation — the decision
- * picks which mode-2031 responder is registered (byte sidecar vs fact reply),
+ * picks which observer records mode-2031 subscriptions (byte scan vs fact),
  * so it must never flip per chunk.
  */
 import type { GlobalSettings } from '../../../../shared/types'
diff --git a/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts b/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts
index 823ce3dd867..a93c28ddc01 100644
--- a/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts
@@ -585,6 +585,43 @@ describe('selectColdParkedTerminalTabs', () => {
     expect(selected).toEqual(new Set())
   })
 
+  // Why: view switches stamp every tab together, so UUID order cannot express recency.
+  it('resolves an identical-hiddenSinceMs tie by activation order, not by tab id', () => {
+    const hiddenSinceMs = nowMs - TERMINAL_TAB_HOT_RETAIN_MS
+    const selected = selectColdParkedTerminalTabs({
+      worktreeId: 'wt-1',
+      terminalTabs: [
+        { ...localTab('tab-aaa', hiddenSinceMs), lastActivatedSeq: 1 },
+        { ...localTab('tab-zzz', hiddenSinceMs), lastActivatedSeq: 2 }
+      ],
+      pendingStartupByTabId: {},
+      parkingEnabled: true,
+      nowMs,
+      hotRetainLimit: 0
+    })
+
+    expect(selected).toEqual(new Set(['tab-aaa']))
+  })
+
+  // Why: the cap and exemption must share one recency ranking.
+  it('keeps the most recently activated tab warm when the cap evicts a tie', () => {
+    const hiddenSinceMs = nowMs - TERMINAL_TAB_HOT_RETAIN_MS + 1
+    const selected = selectColdParkedTerminalTabs({
+      worktreeId: 'wt-1',
+      terminalTabs: [
+        { ...localTab('tab-aaa', hiddenSinceMs), lastActivatedSeq: 1 },
+        { ...localTab('tab-bbb', hiddenSinceMs), lastActivatedSeq: 3 },
+        { ...localTab('tab-ccc', hiddenSinceMs), lastActivatedSeq: 2 }
+      ],
+      pendingStartupByTabId: {},
+      parkingEnabled: true,
+      nowMs,
+      hotRetainLimit: 2
+    })
+
+    expect(selected).toEqual(new Set(['tab-aaa']))
+  })
+
   it('selects nothing when the settings kill switch disables parking', () => {
     const selected = selectColdParkedTerminalTabs({
       worktreeId: 'wt-1',
diff --git a/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.ts b/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.ts
index 2aab92ac592..2efcff11f4d 100644
--- a/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.ts
@@ -49,6 +49,8 @@ export type TerminalTabColdParkCandidate = ColdParkableTerminalTab & {
   isVisible: boolean
   hasActivityTerminalPortal: boolean
   hiddenSinceMs: number | null
+  /** Higher means activated more recently; breaks same-pass hidden-time ties. */
+  lastActivatedSeq?: number
 }
 
 function getPendingActivationSpawnCount(value: boolean | number | undefined): number {
@@ -198,21 +200,33 @@ export function canParkTerminalTabRenderer(args: {
   return isParkRestorableTerminalPty(tab.ptyId, args.worktreeId, args.restorePolicy)
 }
 
-export type ColdParkRetainCandidate = { id: string; hiddenSinceMs: number }
+export type ColdParkRetainCandidate = {
+  id: string
+  hiddenSinceMs: number
+  lastActivatedSeq?: number
+}
+
+// Why: a view switch stamps every owned tab at once, so activation order must
+// break the routine hidden-time tie before the deterministic UUID fallback.
+function compareColdParkRecencyDesc(
+  a: ColdParkRetainCandidate,
+  b: ColdParkRetainCandidate
+): number {
+  if (a.hiddenSinceMs !== b.hiddenSinceMs) {
+    return b.hiddenSinceMs - a.hiddenSinceMs
+  }
+  const activationDelta = (b.lastActivatedSeq ?? -1) - (a.lastActivatedSeq ?? -1)
+  return activationDelta === 0 ? a.id.localeCompare(b.id) : activationDelta
+}
 
 // Why: the single most-recently-hidden candidate is the view the user just
 // switched away from; keeping it warm regardless of the TTL or cap means
 // switching back after any absence (a meeting, coffee) is always instant, the
-// remount cost users actually notice. Ties break by id for determinism.
+// remount cost users actually notice.
 function selectLastActiveRetainedId(candidates: ColdParkRetainCandidate[]): string | null {
   let lastActive: ColdParkRetainCandidate | null = null
   for (const candidate of candidates) {
-    if (
-      lastActive === null ||
-      candidate.hiddenSinceMs > lastActive.hiddenSinceMs ||
-      (candidate.hiddenSinceMs === lastActive.hiddenSinceMs &&
-        candidate.id.localeCompare(lastActive.id) < 0)
-    ) {
+    if (lastActive === null || compareColdParkRecencyDesc(candidate, lastActive) < 0) {
       lastActive = candidate
     }
   }
@@ -221,8 +235,7 @@ function selectLastActiveRetainedId(candidates: ColdParkRetainCandidate[]): stri
 
 // Why: hot-retain keeps the most recently hidden ids warm up to the limit;
 // ids hidden past hotRetainMs or beyond the limit cold-park. The last-active
-// id is exempt from both so returning to it never pays a remount. Ties sort by
-// id so the selection is deterministic.
+// id is exempt from both so returning to it never pays a remount.
 export function selectIdsBeyondHotRetain(
   candidates: ColdParkRetainCandidate[],
   args: { nowMs: number; hotRetainMs: number; hotRetainLimit: number }
@@ -240,10 +253,7 @@ export function selectIdsBeyondHotRetain(
       retainedCandidates.push(candidate)
     }
   }
-  retainedCandidates.sort((a, b) => {
-    const recencyDelta = b.hiddenSinceMs - a.hiddenSinceMs
-    return recencyDelta === 0 ? a.id.localeCompare(b.id) : recencyDelta
-  })
+  retainedCandidates.sort(compareColdParkRecencyDesc)
   // Why: the last-active id already holds one slot in the warm working set, so
   // the cap counts it out — the remaining candidates fill hotRetainLimit-1.
   const remainingLimit = lastActiveId === null ? args.hotRetainLimit : args.hotRetainLimit - 1
@@ -322,7 +332,11 @@ export function selectColdParkedTerminalTabs(
     ) {
       continue
     }
-    candidates.push({ id: tab.id, hiddenSinceMs: tab.hiddenSinceMs })
+    candidates.push({
+      id: tab.id,
+      hiddenSinceMs: tab.hiddenSinceMs,
+      lastActivatedSeq: tab.lastActivatedSeq
+    })
   }
   return selectIdsBeyondHotRetain(candidates, {
     nowMs: args.nowMs,
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-kitty-commit-encoding.ts b/src/renderer/src/components/terminal-pane/terminal-ime-kitty-commit-encoding.ts
index c47b77f53fa..df4d015fb6b 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-kitty-commit-encoding.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-kitty-commit-encoding.ts
@@ -10,12 +10,17 @@ import { KittyKeyboard } from '@xterm/xterm/src/common/input/KittyKeyboard'
  */
 const KITTY_REPORT_ALL_KEYS_AS_ESCAPE_CODES = 0b1000
 
+/** `report_event_types`. The only flag that makes a printable press owe a release. */
+const KITTY_REPORT_EVENT_TYPES = 0b0010
+
 /**
- * `KittyKeyboardEventType.PRESS` / `.REPEAT`. Inlined because the upstream enum is a
- * `const enum`, which does not survive an import across module boundaries.
+ * `KittyKeyboardEventType.PRESS` / `.REPEAT` / `.RELEASE`. Inlined because the
+ * upstream enum is a `const enum`, which does not survive an import across
+ * module boundaries.
  */
 const KITTY_EVENT_TYPE_PRESS = 1
 const KITTY_EVENT_TYPE_REPEAT = 2
+const KITTY_EVENT_TYPE_RELEASE = 3
 
 const kittyKeyboardEncoder = new KittyKeyboard()
 
@@ -28,17 +33,70 @@ export type ImeCommitKeyPress = {
   repeat?: boolean
 }
 
+/**
+ * The matching physical release, read from the actual `keyup`.
+ *
+ * Why not reuse the press's fields: macOS lets Shift come up first, and the
+ * browser then reports the printable keyup with the UNSHIFTED `key` and
+ * `shiftKey: false`. Encoding that release from the press's shifted fields
+ * would report a modifier the app no longer holds.
+ */
+export type ImeReleaseKeyEvent = {
+  key: string
+  code?: string
+  shiftKey: boolean
+  ctrlKey?: boolean
+  altKey?: boolean
+  metaKey?: boolean
+}
+
+/**
+ * Opaque proof that a delivered press/repeat owes a release report, carrying
+ * the flags read at commit time. Only `encodeImeReleaseForKitty` interprets it:
+ * the forwarder must never re-test event-type bits or rebuild CSI-u itself.
+ */
+export type ImeCommitReleaseObligation = { readonly flags: number }
+
+export type ImeCommitKittyEncoding = {
+  /** CSI-u press/repeat report, or null when the commit goes out as raw text. */
+  report: string | null
+  /** Non-null when the commit-time flags requested press/repeat/release events. */
+  release: ImeCommitReleaseObligation | null
+}
+
+function evaluateKittyReport(
+  press: { key: string; code?: string; shiftKey: boolean },
+  modifiers: { ctrlKey?: boolean; altKey?: boolean; metaKey?: boolean },
+  kittyKeyboardFlags: number,
+  eventType: number
+): string | null {
+  const encoded = kittyKeyboardEncoder.evaluate(
+    {
+      type: eventType === KITTY_EVENT_TYPE_RELEASE ? 'keyup' : 'keydown',
+      key: press.key,
+      code: press.code ?? '',
+      keyCode: 0,
+      shiftKey: press.shiftKey,
+      altKey: modifiers.altKey === true,
+      ctrlKey: modifiers.ctrlKey === true,
+      metaKey: modifiers.metaKey === true
+    },
+    kittyKeyboardFlags,
+    eventType
+  )
+  return encoded.key ?? null
+}
+
 /**
  * A pane that negotiated bit 3 asked for every printable key as a CSI-u report,
  * so writing IME-committed text raw hands it the legacy byte stream it declined.
  * Re-encode the press that produced the commit instead.
  *
- * The gate is bit 3 ALONE. "Kitty is active" and `flags !== 0` are both wrong:
- * a pane negotiating only disambiguation or event types still expects printable
- * keys as text, and encoding there would drop every substituted character.
- *
- * Returns null when the commit should be written raw, which is every case except
- * bit 3.
+ * The gate is bit 3 ALONE for the press. "Kitty is active" and `flags !== 0` are
+ * both wrong: a pane negotiating only disambiguation or event types still
+ * expects printable keys as text, and encoding there would drop every
+ * substituted character. Bit 1 (`report_event_types`) is independent — it makes
+ * even a raw-text commit owe exactly one release report.
  *
  * Known limit: the report carries the *physical* key's codepoint, not the
  * committed glyph — bit 3 is the app declaring it does not want text, and bit 4
@@ -46,31 +104,65 @@ export type ImeCommitKeyPress = {
  * derives that text field from the same `key` it derives the keycode from, so
  * carrying the committed glyph under bit 4 needs an encoder change, not a flag.
  */
-export function encodeImeCommitAsKittyReport(
+export function encodeImeCommitForKitty(
   press: ImeCommitKeyPress | null,
   kittyKeyboardFlags: number
+): ImeCommitKittyEncoding {
+  if (!press) {
+    return { report: null, release: null }
+  }
+  const report =
+    (kittyKeyboardFlags & KITTY_REPORT_ALL_KEYS_AS_ESCAPE_CODES) === 0
+      ? null
+      : evaluateKittyReport(
+          press,
+          // Why: the forwarder only claims presses with no control chord, so the
+          // modifier fields are known-false rather than read from a live event.
+          {},
+          kittyKeyboardFlags,
+          // Why: a held key emits repeated keydowns, and the protocol reports those as REPEAT.
+          // Defaulting them all to PRESS would make one held key look like N separate strikes to
+          // an app that counts presses or filters repeats.
+          press.repeat === true ? KITTY_EVENT_TYPE_REPEAT : KITTY_EVENT_TYPE_PRESS
+        )
+  return {
+    report,
+    release:
+      (kittyKeyboardFlags & KITTY_REPORT_EVENT_TYPES) === 0 ? null : { flags: kittyKeyboardFlags }
+  }
+}
+
+/**
+ * Resolve a press's release obligation against the physical `keyup` that
+ * actually settled it. Returns null when no release report is owed anymore.
+ */
+export function encodeImeReleaseForKitty(
+  obligation: ImeCommitReleaseObligation,
+  release: ImeReleaseKeyEvent,
+  context: {
+    /** The claimed press's identity, for keyups whose `key` an input source rewrote. */
+    press?: { key: string; code?: string }
+    /** The pane's flags at RELEASE time, deciding whether a release is still wanted. */
+    currentKittyKeyboardFlags: number
+  }
 ): string | null {
-  if ((kittyKeyboardFlags & KITTY_REPORT_ALL_KEYS_AS_ESCAPE_CODES) === 0 || !press) {
+  // Why the current-flags gate: the app can pop kitty mode between commit and
+  // keyup (a TUI quitting on the pressed key). xterm suppresses releases the
+  // moment `report_event_types` is gone — match it so the successor process
+  // never receives CSI-u bytes it did not negotiate. The report itself still
+  // encodes under the commit-time flags so the press/release pair stays
+  // consistent.
+  if ((context.currentKittyKeyboardFlags & KITTY_REPORT_EVENT_TYPES) === 0) {
     return null
   }
-  // Why: the forwarder only claims presses with no control chord, so the
-  // modifier fields are known-false rather than read from a live event.
-  const encoded = kittyKeyboardEncoder.evaluate(
-    {
-      type: 'keydown',
-      key: press.key,
-      code: press.code ?? '',
-      keyCode: 0,
-      shiftKey: press.shiftKey,
-      altKey: false,
-      ctrlKey: false,
-      metaKey: false
-    },
-    kittyKeyboardFlags,
-    // Why: a held key emits repeated keydowns, and the protocol reports those as REPEAT.
-    // Defaulting them all to PRESS would make one held key look like N separate strikes to
-    // an app that counts presses or filters repeats.
-    press.repeat === true ? KITTY_EVENT_TYPE_REPEAT : KITTY_EVENT_TYPE_PRESS
-  )
-  return encoded.key ?? null
+  // Why the key fallback: an input source can rewrite the keyup's `key`
+  // ('Process' after a source switch mid-hold) while `code` still matches the
+  // press; xterm's evaluate finds no encodable key there and would silently
+  // drop the release, leaving the app with the key held forever. The keyup's
+  // own single-char `key` wins (Shift-up-first correctly reports unshifted).
+  const releaseKey =
+    release.key.length === 1 || context.press === undefined
+      ? release
+      : { ...release, key: context.press.key, code: context.press.code ?? release.code }
+  return evaluateKittyReport(releaseKey, release, obligation.flags, KITTY_EVENT_TYPE_RELEASE)
 }
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.ts b/src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.ts
index 5594bcb3cbe..525a8d2b12a 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.ts
@@ -118,7 +118,7 @@ function isPlainAsciiDigitKey(event: XtermBypassEvent): boolean {
 /** Tracks legacy desktop Linux IME candidate-selection event sequences. */
 export function createTerminalImeLinuxCandidateState(
   now: () => number = () => Date.now(),
-  pendingPlainLetterKeydownsByCode: Set<string> = new Set()
+  pendingPlainLetterKeydownsByCode = new Set<string>()
 ): TerminalImeLinuxCandidateState {
   let candidateDigitUntil = 0
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts b/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts
index 2894df2e2be..ef758edf22a 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts
@@ -180,10 +180,10 @@ describe('installTerminalImeNativeTextForwarder', () => {
       )
       dispatchInsertText(textarea, 'á')
 
-      // The keypress is what must be suppressed (it would double-send the ASCII 'a').
-      // The keyup is not: 'á' reached the pty, so the app is owed the matching release.
+      // The keypress must be suppressed (it would double-send the ASCII 'a'), and so must the
+      // keyup — the forwarder owns the whole claimed lifecycle and emits any owed release itself.
       expect(forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: 'a', code: 'KeyA' }))).toBe(
-        false
+        true
       )
       expect(sendInput).toHaveBeenCalledExactlyOnceWith('á')
     })
@@ -273,13 +273,15 @@ describe('installTerminalImeNativeTextForwarder', () => {
     })
 
     // An app that negotiated kitty `report_event_types` expects a release for every press it
-    // received. The claim now takes every printable keydown, so swallowing the keyup
-    // unconditionally would drop the release for ordinary typing and leave keys stuck down.
-    it('lets the keyup through once the press has reached the pty, so its release still fires', () => {
+    // received, but xterm's own kitty state is defensively reset while the application tracker
+    // stays active — so the forwarder keeps the keyup and encodes the release from the flags it
+    // read at commit time rather than delegating either decision to xterm.
+    it('keeps the keyup inside the forwarder once the press has reached the pty', () => {
       const { forwarder, sendInput } = install()
       expect(forwarder.claimKeyEvent(keyEvent({ key: ',' }))).toBe(true)
       dispatchInsertText(textarea, '，')
-      expect(forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: ',' }))).toBe(false)
+      expect(forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: ',' }))).toBe(true)
+      // Flags default to 0 here: no event types negotiated, so no release is owed.
       expect(sendInput).toHaveBeenCalledExactlyOnceWith('，')
     })
 
@@ -292,6 +294,35 @@ describe('installTerminalImeNativeTextForwarder', () => {
       expect(sendInput).not.toHaveBeenCalled()
     })
 
+    it('keeps the claim armed across a bare modifier keydown before the commit lands', () => {
+      // Fast typing: ',' is pressed and released, then Shift goes down for the
+      // NEXT character while the text system is still delivering '，'.
+      const { forwarder, sendInput } = install()
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',' }))).toBe(true)
+      expect(forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: ',' }))).toBe(true)
+      expect(
+        forwarder.claimKeyEvent(keyEvent({ key: 'Shift', code: 'ShiftLeft', shiftKey: true }))
+      ).toBe(false)
+      dispatchInsertText(textarea, '，')
+      expect(sendInput).toHaveBeenCalledExactlyOnceWith('，')
+    })
+
+    it('lets a chorded keyup reach xterm after a fresh chorded press of the same key', () => {
+      const { forwarder, sendInput } = install()
+      // A claimed press whose input never arrived and whose keyup was swallowed
+      // elsewhere leaves a tombstone behind.
+      expect(forwarder.claimKeyEvent(keyEvent({ key: 'n', code: 'KeyN' }))).toBe(true)
+      expect(forwarder.claimKeyEvent(keyEvent({ key: 'x', code: 'KeyX' }))).toBe(true)
+      // Ctrl+N is xterm's press; its keyup must not be eaten by the stale tombstone.
+      expect(forwarder.claimKeyEvent(keyEvent({ key: 'n', code: 'KeyN', ctrlKey: true }))).toBe(
+        false
+      )
+      expect(
+        forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: 'n', code: 'KeyN', ctrlKey: true }))
+      ).toBe(false)
+      expect(sendInput).not.toHaveBeenCalled()
+    })
+
     it('releases the claim on blur', () => {
       const { forwarder, sendInput } = install()
       forwarder.claimKeyEvent(keyEvent({ key: ',' }))
@@ -396,6 +427,55 @@ describe('installTerminalImeNativeTextForwarder', () => {
       expect(sendInput).not.toHaveBeenCalled()
     })
 
+    it('emits the owed release before a same-key re-claim when the input event never came', () => {
+      const { forwarder, sendInput } = installWithFlags(() => 0b1010)
+      // The first press delivers and owes a release.
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',' }))).toBe(true)
+      dispatchInsertText(textarea, '，')
+      // An auto-repeat claim whose text the input source swallows absorbs the
+      // eventual keyup; the next fresh press must settle that owed release
+      // instead of deleting the record that holds it.
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',', repeat: true }))).toBe(true)
+      expect(forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: ',' }))).toBe(true)
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',' }))).toBe(true)
+      expect(sendInput.mock.calls.map((call) => call[0])).toEqual(['\x1b[44u', '\x1b[44;1:3u'])
+    })
+
+    it('settles an owed release before a fresh same-key press after a lost keyup', () => {
+      const { forwarder, sendInput } = installWithFlags(() => 0b1010)
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',', code: 'Comma' }))).toBe(true)
+      dispatchInsertText(textarea, '，')
+
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',', code: 'Comma' }))).toBe(true)
+      expect(sendInput.mock.calls.map((call) => call[0])).toEqual(['\x1b[44u', '\x1b[44;1:3u'])
+    })
+
+    it('suppresses the owed release when the app popped kitty mode before the keyup', () => {
+      // A TUI that quits on the pressed key pops its negotiation before the
+      // keyup; a CSI-u release would land in the successor shell as junk.
+      let flags = 0b1010
+      const { forwarder, sendInput } = installWithFlags(() => flags)
+      expect(forwarder.claimKeyEvent(keyEvent({ key: 'q', code: 'KeyQ' }))).toBe(true)
+      dispatchInsertText(textarea, 'q')
+      flags = 0
+      expect(forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: 'q', code: 'KeyQ' }))).toBe(
+        true
+      )
+      expect(sendInput).toHaveBeenCalledExactlyOnceWith('\x1b[113u')
+    })
+
+    it('encodes the release from the press when an input source rewrote the keyup key', () => {
+      const { forwarder, sendInput } = installWithFlags(() => 0b1010)
+      expect(forwarder.claimKeyEvent(keyEvent({ key: ',' }))).toBe(true)
+      dispatchInsertText(textarea, '，')
+      // Chromium reports 'Process' for IME-owned keys after a source switch
+      // mid-hold; `code` still identifies the physical press.
+      expect(
+        forwarder.claimKeyEvent(keyEvent({ type: 'keyup', key: 'Process', code: 'Comma' }))
+      ).toBe(true)
+      expect(sendInput.mock.calls.map((call) => call[0])).toEqual(['\x1b[44u', '\x1b[44;1:3u'])
+    })
+
     it('writes the commit raw when the caller tracks no flags at all', () => {
       // The preview bridge installs the forwarder with no pane to negotiate with.
       const sendInput = vi.fn()
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.ts b/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.ts
index c200e3c04e7..e077a5df3d9 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.ts
@@ -1,5 +1,10 @@
 import type { IDisposable } from '@xterm/xterm'
-import { encodeImeCommitAsKittyReport } from './terminal-ime-kitty-commit-encoding'
+import {
+  encodeImeCommitForKitty,
+  encodeImeReleaseForKitty,
+  type ImeCommitReleaseObligation,
+  type ImeReleaseKeyEvent
+} from './terminal-ime-kitty-commit-encoding'
 
 // Why: a plain printable keydown never produces terminal bytes. Bytes for
 // printable characters come only from the `input` event, which on macOS *is*
@@ -18,6 +23,38 @@ type ClaimedKeyPress = {
   repeat?: boolean
 }
 
+/** A claimed press waiting for its `insertText`, plus an early keyup if one already landed. */
+type PendingCommit = {
+  press: ClaimedKeyPress
+  /** Non-null when `keyup` preceded `insertText` — an order some macOS IMEs use. */
+  keyup: ImeReleaseKeyEvent | null
+}
+
+/**
+ * What a claimed physical key still owes once its commit settled. A non-null
+ * `obligation` is an encoder-owned release report; a null one is a tombstone
+ * that only keeps the matching keyup away from xterm for a press the app
+ * never received.
+ */
+type ClaimedKeyRecord = {
+  key: string
+  code?: string
+  obligation: ImeCommitReleaseObligation | null
+}
+
+// Bare modifier keydowns produce no terminal bytes and legitimately interleave
+// between a claimed press and its commit (Shift pressed for the NEXT character
+// before the text system delivers this one's `insertText`).
+const MODIFIER_KEYDOWN_KEYS = new Set([
+  'Shift',
+  'Control',
+  'Alt',
+  'Meta',
+  'CapsLock',
+  'AltGraph',
+  'Fn'
+])
+
 export type ImeNativeTextKeyEvent = {
   type: string
   key: string
@@ -76,13 +113,21 @@ function isNativeTextKeydown(event: ImeNativeTextKeyEvent, compositionActive: bo
   )
 }
 
-function matchesClaimedPress(event: ImeNativeTextKeyEvent, claimedPress: ClaimedKeyPress): boolean {
+function matchesClaimedPress(
+  event: ImeNativeTextKeyEvent,
+  claimedPress: { key: string; code?: string }
+): boolean {
   if (event.code && claimedPress.code) {
     return event.code === claimedPress.code
   }
   return event.key === claimedPress.key
 }
 
+/** Different held keys coexist, so records are keyed by physical identity. */
+function claimedKeyId(press: { key: string; code?: string }): string {
+  return press.code ?? press.key
+}
+
 export function installTerminalImeNativeTextForwarder(args: {
   terminalElement: HTMLElement | null | undefined
   isComposing: () => boolean
@@ -102,11 +147,64 @@ export function installTerminalImeNativeTextForwarder(args: {
   }
 
   const terminalElement = args.terminalElement
-  let pendingForward = false
   let compositionTransactionPending = false
-  let claimedPress: ClaimedKeyPress | null = null
-  /** Whether the claimed press actually reached the pty, which decides if its release does. */
-  let forwardedPressBytes = false
+  let pendingCommit: PendingCommit | null = null
+  // Why keyed rather than a single slot: rollover and auto-repeat can leave one
+  // key still held while the next one commits, and each held key owes its own
+  // single release.
+  const claimedKeyRecords = new Map<string, ClaimedKeyRecord>()
+
+  const findClaimedRecordId = (event: ImeNativeTextKeyEvent): string | null => {
+    const direct = claimedKeyId(event)
+    if (claimedKeyRecords.has(direct)) {
+      return direct
+    }
+    for (const [id, record] of claimedKeyRecords) {
+      if (matchesClaimedPress(event, record)) {
+        return id
+      }
+    }
+    return null
+  }
+
+  /** Emits at most one release for a claimed press; xterm emits none for it. */
+  const settleRelease = (recordId: string, release: ImeReleaseKeyEvent): void => {
+    const record = claimedKeyRecords.get(recordId)
+    claimedKeyRecords.delete(recordId)
+    if (!record?.obligation) {
+      return
+    }
+    const report = encodeImeReleaseForKitty(record.obligation, release, {
+      press: { key: record.key, code: record.code },
+      currentKittyKeyboardFlags: args.getKittyKeyboardFlags?.() ?? 0
+    })
+    if (report) {
+      args.sendInput(report)
+    }
+  }
+
+  /**
+   * Move a claimed press out of awaiting-commit state. A fresh obligation is
+   * upserted; a repeat or cancellation that produced none must not erase one an
+   * earlier delivered press already owed.
+   */
+  const settleCommit = (
+    commit: PendingCommit,
+    obligation: ImeCommitReleaseObligation | null
+  ): void => {
+    const recordId = claimedKeyId(commit.press)
+    const existing = claimedKeyRecords.get(recordId)
+    if (obligation || !existing) {
+      claimedKeyRecords.set(recordId, {
+        key: commit.press.key,
+        code: commit.press.code,
+        obligation: obligation ?? existing?.obligation ?? null
+      })
+    }
+    if (commit.keyup) {
+      settleRelease(recordId, commit.keyup)
+    }
+  }
 
   const markCompositionTransactionAccepted = (): void => {
     compositionTransactionPending = true
@@ -118,44 +216,85 @@ export function installTerminalImeNativeTextForwarder(args: {
 
   const claimKeyEvent = (event: ImeNativeTextKeyEvent): boolean => {
     if (event.type === 'keydown') {
+      if (pendingCommit && matchesClaimedPress(event, pendingCommit.press)) {
+        // The same key pressed again while its claim still awaits `input`:
+        // settle first so an absorbed early keyup's owed release is emitted
+        // rather than silently overwritten.
+        settleCommit(pendingCommit, null)
+        pendingCommit = null
+      } else if (pendingCommit && !MODIFIER_KEYDOWN_KEYS.has(event.key)) {
+        // Why: retiring here is also what drops a stale claim whose input event
+        // never arrived (the input source swallowed the key) — no timer needed.
+        // It leaves a tombstone so the stale press's keyup still cannot reach
+        // xterm, which never saw its keydown. Bare modifier keydowns are
+        // exempt: they precede a still-inbound commit during fast typing and
+        // must not retire the claim it belongs to.
+        settleCommit(pendingCommit, null)
+        pendingCommit = null
+      }
+      if (event.repeat !== true) {
+        // Why: a fresh same-key press proves the prior press ended; settle its owed release first.
+        const staleRecordId = findClaimedRecordId(event)
+        if (staleRecordId !== null) {
+          settleRelease(staleRecordId, {
+            key: event.key,
+            code: event.code,
+            shiftKey: event.shiftKey === true,
+            ctrlKey: event.ctrlKey,
+            altKey: event.altKey,
+            metaKey: event.metaKey
+          })
+        }
+      }
       if (!isNativeTextKeydown(event, args.isComposing())) {
         return false
       }
-      // Why: re-arming here is also what drops a stale claim whose input event
-      // never arrived (the input source swallowed the key) — no timer needed.
-      pendingForward = true
-      forwardedPressBytes = false
-      claimedPress = {
-        key: event.key,
-        code: event.code,
-        shiftKey: event.shiftKey === true,
-        repeat: event.repeat === true
+      pendingCommit = {
+        press: {
+          key: event.key,
+          code: event.code,
+          shiftKey: event.shiftKey === true,
+          repeat: event.repeat === true
+        },
+        keyup: null
       }
       return true
     }
-    if (!claimedPress) {
-      return false
-    }
-    if (event.ctrlKey || event.altKey || event.metaKey || event.isComposing === true) {
-      return false
-    }
     if (event.type === 'keyup') {
-      if (!matchesClaimedPress(event, claimedPress)) {
+      if (pendingCommit && matchesClaimedPress(event, pendingCommit.press)) {
+        // Copy the release's own fields: the commit has not happened yet, and
+        // the encoder needs the modifier state as of the actual release.
+        pendingCommit.keyup = {
+          key: event.key,
+          code: event.code,
+          shiftKey: event.shiftKey === true,
+          ctrlKey: event.ctrlKey,
+          altKey: event.altKey,
+          metaKey: event.metaKey
+        }
+        return true
+      }
+      const recordId = findClaimedRecordId(event)
+      if (recordId === null) {
         return false
       }
-      const pressReachedThePty = forwardedPressBytes
-      claimedPress = null
-      forwardedPressBytes = false
-      // Why: a release report describes a press the app received. Suppress it only when
-      // this press put nothing on the wire — swallowed by the input source, or owned by a
-      // composition transaction. Suppressing unconditionally would drop the kitty release
-      // for ordinary typing, because the structural claim takes every printable keydown
-      // rather than the short punctuation list the previous design claimed.
-      return !pressReachedThePty
+      // Why the forwarder owns this instead of returning false: xterm's kitty
+      // state is defensively reset while the application tracker stays active,
+      // so delegating the release would either lose it or emit it under flags
+      // the app never negotiated.
+      settleRelease(recordId, {
+        key: event.key,
+        code: event.code,
+        shiftKey: event.shiftKey === true,
+        ctrlKey: event.ctrlKey,
+        altKey: event.altKey,
+        metaKey: event.metaKey
+      })
+      return true
     }
     // Keep the keydown's armed state but still bypass xterm so it does not
     // double-send printable text before our input forward runs.
-    return event.type === 'keypress'
+    return event.type === 'keypress' && pendingCommit !== null
   }
 
   const forwardCommittedText = (event: Event): void => {
@@ -165,24 +304,33 @@ export function installTerminalImeNativeTextForwarder(args: {
     // Why: an accepted composition transaction already owns its commit; letting
     // it through here would send the text a second time.
     if (compositionTransactionPending && event.inputType === 'insertText') {
-      pendingForward = false
+      if (pendingCommit) {
+        settleCommit(pendingCommit, null)
+        pendingCommit = null
+      }
       event.stopImmediatePropagation()
       return
     }
-    if (!pendingForward) {
+    const commit = pendingCommit
+    if (!commit) {
       return
     }
-    pendingForward = false
+    pendingCommit = null
     if (event.inputType !== 'insertText') {
+      // A non-text input takes the press over; it delivered nothing, so only the
+      // keyup suppression survives.
+      settleCommit(commit, null)
       return
     }
     if (event.data) {
-      const kittyReport = encodeImeCommitAsKittyReport(
-        claimedPress,
-        args.getKittyKeyboardFlags?.() ?? 0
-      )
-      args.sendInput(kittyReport ?? event.data)
-      forwardedPressBytes = true
+      // Read the mutable flags EXACTLY once, here: kitty state can change
+      // between keydown and commit, and the release must describe the same
+      // negotiation the press was encoded under.
+      const encoding = encodeImeCommitForKitty(commit.press, args.getKittyKeyboardFlags?.() ?? 0)
+      args.sendInput(encoding.report ?? event.data)
+      settleCommit(commit, encoding.release)
+    } else {
+      settleCommit(commit, null)
     }
     event.stopImmediatePropagation()
     // Clear the helper textarea so the committed text doesn't accumulate.
@@ -191,11 +339,13 @@ export function installTerminalImeNativeTextForwarder(args: {
     }
   }
 
+  // Blur and disposal drop every record without synthesizing bytes: the app
+  // stops receiving this element's keys entirely, so an invented release would
+  // describe a press it can no longer correlate.
   const cancelPending = (): void => {
-    pendingForward = false
-    forwardedPressBytes = false
     compositionTransactionPending = false
-    claimedPress = null
+    pendingCommit = null
+    claimedKeyRecords.clear()
   }
 
   terminalElement.addEventListener(
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts b/src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts
index 267c7a61093..d23d2858eb6 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts
@@ -195,10 +195,8 @@ describe('input-source text substitution reaches the terminal', () => {
   describe.each([
     ['none', 0],
     ['disambiguate', 1],
-    ['event types', 2],
     ['alternate keys', 4],
     ['disambiguate + alternate keys', 5],
-    ['disambiguate + event types + alternate keys', 7],
     // Bit 4 asks for associated text, which only decorates a report bit 3 would already have
     // produced — on its own it does not turn a printable key into one.
     ['associated text', 16]
@@ -208,13 +206,23 @@ describe('input-source text substitution reaches the terminal', () => {
     })
   })
 
+  // Bit 1 (`report_event_types`) is orthogonal to bit 3: the press stays raw substituted text,
+  // but the app asked to be told when the key came back up, and the forwarder owns that keyup.
+  describe.each([
+    ['event types', 2],
+    ['disambiguate + event types + alternate keys', 7]
+  ])('with kitty flags %s (%d) negotiated', (_name, flags) => {
+    it('sends the substituted character raw followed by one CSI-u release', () => {
+      expect(type([COMMA], flags)).toBe('，\x1b[44;1:3u')
+    })
+  })
+
   // Bit 3 is `report_all_keys_as_escape_codes`: the app asked for every printable key as a CSI-u
   // report, so committing raw UTF-8 hands it a byte stream it declined. Re-encode the press that
   // produced the commit. This is not CJK-specific — it is every printable key in such a pane.
   describe.each([
     ['all keys as escape codes', 8],
-    ['all keys + disambiguate', 9],
-    ['all keys + disambiguate + event types + alternate keys', 15]
+    ['all keys + disambiguate', 9]
   ])('with kitty flags %s (%d) negotiated', (_name, flags) => {
     it('sends a CSI-u report for the physical key instead of the substituted character', () => {
       // `,` is the physical Comma key; U+002C is 44. The committed `，` is deliberately absent —
@@ -224,6 +232,10 @@ describe('input-source text substitution reaches the terminal', () => {
     })
   })
 
+  it('pairs the CSI-u press with exactly one release when event types are also negotiated', () => {
+    expect(type([COMMA], 15)).toBe('\x1b[44u\x1b[44;1:3u')
+  })
+
   it('reports the physical key as the associated text under bit 3 + bit 4, not the substitution', () => {
     // Pins the limit named in terminal-ime-kitty-commit-encoding.ts: bit 4 is where the committed
     // glyph U+FF0C (65292) would ride, and 44 shows up in that slot instead. Closing that needs the
diff --git a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts
index d43702057f1..7ca537b014d 100644
--- a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts
@@ -44,7 +44,7 @@ function omitLeafRecord(
   source: Record<string, string> | undefined,
   leafId: string
 ): Record<string, string> | undefined {
-  if (!source || !Object.prototype.hasOwnProperty.call(source, leafId)) {
+  if (!source || !Object.hasOwn(source, leafId)) {
     return source
   }
   const next = { ...source }
diff --git a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts
index bd780e89495..9f21c39056b 100644
--- a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts
@@ -51,7 +51,7 @@ function remapLeafRecord(
 
 function collectLeafCounts(
   node: TerminalPaneLayoutNode,
-  counts: Map<string, number> = new Map()
+  counts = new Map<string, number>()
 ): Map<string, number> {
   if (node.type === 'leaf') {
     counts.set(node.leafId, (counts.get(node.leafId) ?? 0) + 1)
@@ -73,7 +73,7 @@ function hasLeafPtyBinding(
   ptyIdsByLeafId: Record<string, string> | undefined,
   leafId: string
 ): boolean {
-  return ptyIdsByLeafId ? Object.prototype.hasOwnProperty.call(ptyIdsByLeafId, leafId) : false
+  return ptyIdsByLeafId ? Object.hasOwn(ptyIdsByLeafId, leafId) : false
 }
 
 export function resolveRootlessTerminalLayoutLeafId(
diff --git a/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts b/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts
index f0742328240..4c44c3e6ead 100644
--- a/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts
@@ -105,7 +105,7 @@ function coalesceLeafRecord(
       continue
     }
     const retainedLeafId = resolveRetainedLeafId(removedLeafId, retainedLeafIdByRemovedLeafId)
-    if (!Object.prototype.hasOwnProperty.call(retained, retainedLeafId)) {
+    if (!Object.hasOwn(retained, retainedLeafId)) {
       retained[retainedLeafId] = value
     }
   }
@@ -113,7 +113,7 @@ function coalesceLeafRecord(
 }
 
 function hasLeafRecordValue(source: Record<string, string> | undefined, leafId: string): boolean {
-  return Boolean(source && Object.prototype.hasOwnProperty.call(source, leafId))
+  return Boolean(source && Object.hasOwn(source, leafId))
 }
 
 function coalesceScrollbackRecords(
@@ -225,7 +225,7 @@ function resolveOwnedActiveLeafId(
   ptyIdsByLeafId: Record<string, string> | undefined
 ): string | null {
   const hasBinding = (leafId: string): boolean =>
-    Boolean(ptyIdsByLeafId && Object.prototype.hasOwnProperty.call(ptyIdsByLeafId, leafId))
+    Boolean(ptyIdsByLeafId && Object.hasOwn(ptyIdsByLeafId, leafId))
   if (rootLeafIds.length === 0) {
     const boundLeafIds = Object.keys(ptyIdsByLeafId ?? {})
     if (activeLeafId) {
diff --git a/src/renderer/src/components/terminal-pane/terminal-link-action-request.ts b/src/renderer/src/components/terminal-pane/terminal-link-action-request.ts
index 653ab34597a..108a670939b 100644
--- a/src/renderer/src/components/terminal-pane/terminal-link-action-request.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-link-action-request.ts
@@ -25,6 +25,7 @@ export type TerminalLinkActionRequester = (request: TerminalLinkActionRequest) =
 export type TerminalLinkActionContext = {
   paneId: number
   pointerGesture: TerminalLinkPointerGesture
+  claimPtyMouse: () => boolean
   request: TerminalLinkActionRequester
   focusTerminal: () => void
 }
@@ -55,6 +56,9 @@ export function requestTerminalLinkAction(
     return false
   }
 
+  if (!context.claimPtyMouse()) {
+    return false
+  }
   event.preventDefault()
   context.request({
     ...details,
diff --git a/src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts b/src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts
index 00cdcd3c687..8350ec17fec 100644
--- a/src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts
@@ -1,7 +1,11 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { registerHttpLinkStoreAccessor } from '@/lib/http-link-routing'
+import {
+  registerHttpLinkStoreAccessor,
+  registerRuntimeHttpLinkBrowserOpener
+} from '@/lib/http-link-routing'
 import {
   closeTerminalLinkActionRequest,
+  requestTerminalLinkAction,
   type TerminalLinkActionContext,
   type TerminalLinkActionRequest
 } from './terminal-link-action-request'
@@ -11,6 +15,7 @@ import { handleTerminalHttpLink } from './terminal-url-link-hit-testing'
 const openUrl = vi.fn()
 const createBrowserTab = vi.fn()
 const setActiveWorktree = vi.fn()
+const openRuntimeBrowserTab = vi.fn(() => Promise.resolve())
 
 function plainEvent(): MouseEvent {
   return {
@@ -29,6 +34,7 @@ function actionContext(request = vi.fn()): TerminalLinkActionContext {
   return {
     paneId: 7,
     pointerGesture: { canRequestAction: () => true, dispose: vi.fn() },
+    claimPtyMouse: vi.fn(() => true),
     request,
     focusTerminal: vi.fn()
   }
@@ -42,9 +48,11 @@ beforeEach(() => {
     setActiveWorktree,
     createBrowserTab
   }))
+  registerRuntimeHttpLinkBrowserOpener(openRuntimeBrowserTab)
 })
 
 afterEach(() => {
+  registerRuntimeHttpLinkBrowserOpener(null)
   vi.clearAllMocks()
   vi.unstubAllGlobals()
 })
@@ -58,6 +66,54 @@ describe('terminal link action routing', () => {
     expect(closeTerminalLinkActionRequest(first, first)).toBeNull()
   })
 
+  it('claims PTY mouse ownership only after the pointer gesture is eligible', () => {
+    const claimPtyMouse = vi.fn(() => true)
+    const request = vi.fn()
+    const context = actionContext(request)
+    context.claimPtyMouse = claimPtyMouse
+
+    expect(
+      requestTerminalLinkAction(plainEvent(), context, {
+        destination: 'https://example.com',
+        kind: 'url',
+        primary: { label: 'Open', run: vi.fn() }
+      })
+    ).toBe(true)
+    expect(claimPtyMouse).toHaveBeenCalledOnce()
+    expect(claimPtyMouse.mock.invocationCallOrder[0]).toBeLessThan(
+      request.mock.invocationCallOrder[0]
+    )
+  })
+
+  it('leaves PTY mouse ownership with an ineligible pointer gesture', () => {
+    const context = actionContext()
+    context.pointerGesture.canRequestAction = () => false
+
+    expect(
+      requestTerminalLinkAction(plainEvent(), context, {
+        destination: 'https://example.com',
+        kind: 'url',
+        primary: { label: 'Open', run: vi.fn() }
+      })
+    ).toBe(false)
+    expect(context.claimPtyMouse).not.toHaveBeenCalled()
+    expect(context.request).not.toHaveBeenCalled()
+  })
+
+  it('leaves the action closed when the child already owns the gesture', () => {
+    const context = actionContext()
+    context.claimPtyMouse = vi.fn(() => false)
+
+    expect(
+      requestTerminalLinkAction(plainEvent(), context, {
+        destination: 'https://example.com',
+        kind: 'url',
+        primary: { label: 'Open', run: vi.fn() }
+      })
+    ).toBe(false)
+    expect(context.request).not.toHaveBeenCalled()
+  })
+
   it('offers system browser first and Orca second when system browser is the default', () => {
     const request = vi.fn()
     const event = plainEvent()
@@ -131,6 +187,28 @@ describe('terminal link action routing', () => {
     expect(request.mock.calls[0][0].alternate).toBeUndefined()
   })
 
+  it('routes an explicit Orca Browser action to the owning runtime', () => {
+    const request = vi.fn()
+
+    handleTerminalHttpLink('https://example.com/path', plainEvent(), {
+      worktreeId: 'wt-1',
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' },
+      linkActionContext: actionContext(request),
+      actionDestinations: { primary: 'system', alternate: 'orca' }
+    })
+
+    request.mock.calls[0][0].primary.run()
+    expect(openUrl).toHaveBeenCalledWith('https://example.com/path')
+    request.mock.calls[0][0].alternate.run()
+    expect(openRuntimeBrowserTab).toHaveBeenCalledWith({
+      workspaceId: 'wt-1',
+      url: 'https://example.com/path',
+      intent: { kind: 'url' },
+      expectedRuntimeEnvironmentId: 'env-1'
+    })
+    expect(createBrowserTab).not.toHaveBeenCalled()
+  })
+
   it('uses Shift+modifier for the alternate local destination', () => {
     const event = { ...plainEvent(), metaKey: true, shiftKey: true }
 
@@ -145,6 +223,19 @@ describe('terminal link action routing', () => {
     expect(openUrl).not.toHaveBeenCalled()
   })
 
+  it('keeps Shift+modifier on the only capability-backed destination', () => {
+    const event = { ...plainEvent(), metaKey: true, shiftKey: true }
+
+    handleTerminalHttpLink('https://example.com/path', event, {
+      worktreeId: 'wt-1',
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' },
+      actionDestinations: { primary: 'system' }
+    })
+
+    expect(openUrl).toHaveBeenCalledWith('https://example.com/path')
+    expect(openRuntimeBrowserTab).not.toHaveBeenCalled()
+  })
+
   it('exposes the actual hidden OSC 8 destination', () => {
     const request = vi.fn()
     const destination = 'https://example.com'
diff --git a/src/renderer/src/components/terminal-pane/terminal-link-handlers.test.ts b/src/renderer/src/components/terminal-pane/terminal-link-handlers.test.ts
index 74574dea02a..6f9c0e12536 100644
--- a/src/renderer/src/components/terminal-pane/terminal-link-handlers.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-link-handlers.test.ts
@@ -778,24 +778,25 @@ describe('handleOscLink', () => {
       {
         ...deps,
         startupCwd: '/root/workspace/myrepo',
-        worktreePath: '\\\\wsl.localhost\\Ubuntu\\home\\repo'
+        worktreePath: '\\\\wsl.localhost\\Ubuntu\\home\\repo',
+        wslDistro: 'Ubuntu'
       }
     )
     await flushAsyncWork()
     await flushDoubleRaf()
 
     expect(authorizeExternalPathMock).toHaveBeenCalledWith({
-      targetPath: '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md'
+      targetPath: '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md'
     })
     expect(openFileMock).toHaveBeenCalledWith(
       expect.objectContaining({
-        filePath: '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md'
+        filePath: '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md'
       }),
       { forceContentReload: true }
     )
     expect(setPendingEditorRevealMock).toHaveBeenNthCalledWith(2, {
-      filePath: '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md',
-      fileId: '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md',
+      filePath: '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md',
+      fileId: '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md',
       line: 5,
       column: 3,
       matchLength: 0
@@ -810,24 +811,25 @@ describe('handleOscLink', () => {
       { metaKey: false, ctrlKey: true },
       {
         ...deps,
-        worktreePath: '\\\\wsl.localhost\\Ubuntu\\home\\repo'
+        worktreePath: '\\\\wsl.localhost\\Ubuntu\\home\\repo',
+        wslDistro: 'Ubuntu'
       }
     )
     await flushAsyncWork()
     await flushDoubleRaf()
 
     expect(authorizeExternalPathMock).toHaveBeenCalledWith({
-      targetPath: '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md'
+      targetPath: '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md'
     })
     expect(openFileMock).toHaveBeenCalledWith(
       expect.objectContaining({
-        filePath: '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md'
+        filePath: '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md'
       }),
       { forceContentReload: true }
     )
     expect(setPendingEditorRevealMock).toHaveBeenNthCalledWith(2, {
-      filePath: '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md',
-      fileId: '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md',
+      filePath: '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md',
+      fileId: '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md',
       line: 5,
       column: 3,
       matchLength: 0
@@ -952,6 +954,24 @@ describe('handleOscLink', () => {
     )
   })
 
+  it('keeps WSL-looking paths literal for a direct SSH pane', async () => {
+    setPlatform('Windows')
+    vi.mocked(getConnectionId).mockReturnValue('ssh-1')
+    const literalPath = '//wsl.localhost/Ubuntu/repo/file.ts'
+
+    openDetectedFilePath(literalPath, null, null, {
+      worktreeId: 'wt-1',
+      worktreePath: '//wsl.localhost/Ubuntu/repo',
+      wslDistro: null
+    })
+    await flushAsyncWork()
+
+    expect(statMock).toHaveBeenCalledWith({ filePath: literalPath, connectionId: 'ssh-1' })
+    expect(openFileMock).toHaveBeenCalledWith(expect.objectContaining({ filePath: literalPath }), {
+      forceContentReload: true
+    })
+  })
+
   it('pins SSH links outside the worktree to their target host', async () => {
     setPlatform('Macintosh')
     vi.mocked(getConnectionId).mockReturnValue('ssh-1')
@@ -994,6 +1014,12 @@ describe('handleOscLink', () => {
     })
     await flushAsyncWork()
 
+    expect(openFileMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        filePath: '//wsl.localhost/ubuntu/home/Alice/repo/src/main.ts'
+      }),
+      { forceContentReload: true }
+    )
     expect(openFileMock).toHaveBeenCalledWith(
       expect.not.objectContaining({ externalSshTargetId: expect.anything() }),
       { forceContentReload: true }
@@ -1665,8 +1691,9 @@ describe('createFilePathLinkProvider range bounds', () => {
         worktreeId: 'wt-1',
         worktreePath: '\\\\wsl.localhost\\Ubuntu\\home\\repo',
         runtimeEnvironmentId: null,
+        wslDistro: 'Ubuntu',
         pathExistsCache: new Map([
-          ['active\0//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md', true]
+          ['active\0\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md', true]
         ])
       }
     )
@@ -1675,17 +1702,17 @@ describe('createFilePathLinkProvider range bounds', () => {
 
     expect(opened).toBe(true)
     expect(statMock).toHaveBeenCalledWith({
-      filePath: '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md'
+      filePath: '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md'
     })
     expect(openFileMock).toHaveBeenCalledWith(
       expect.objectContaining({
-        filePath: '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md'
+        filePath: '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md'
       }),
       { forceContentReload: true }
     )
     expect(setPendingEditorRevealMock).toHaveBeenNthCalledWith(2, {
-      filePath: '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md',
-      fileId: '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md',
+      filePath: '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md',
+      fileId: '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md',
       line: 5,
       column: 3,
       matchLength: 0
@@ -1873,14 +1900,14 @@ describe('createFilePathLinkProvider range bounds', () => {
     ['modern', '\\\\wsl.localhost\\Ubuntu\\home\\repo'],
     ['legacy', '\\\\wsl$\\Ubuntu\\home\\repo']
   ])('maps POSIX terminal links for a %s WSL worktree', async (_label, worktreePath) => {
-    const mappedPath = '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md'
+    const mappedPath = '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md'
     vi.mocked(window.api.shell.pathExists).mockImplementation(
       async (pathValue) => pathValue === mappedPath
     )
     const { provider, linkTooltip } = createProviderSetup(
       [makeBufferLine('/root/workspace/myrepo/README.md:5:3')],
       new Map(),
-      { worktreePath, startupCwd: '/root/workspace/myrepo' }
+      { worktreePath, wslDistro: 'Ubuntu', startupCwd: '/root/workspace/myrepo' }
     )
 
     const links = await new Promise<ILink[]>((resolve) => {
@@ -1912,12 +1939,13 @@ describe('createFilePathLinkProvider range bounds', () => {
   })
 
   it('resolves relative POSIX terminal links against the pane cwd before mapping', async () => {
-    const mappedPath = '//wsl.localhost/Ubuntu/root/workspace/myrepo/README.md'
+    const mappedPath = '\\\\wsl.localhost\\Ubuntu\\root\\workspace\\myrepo\\README.md'
     vi.mocked(window.api.shell.pathExists).mockImplementation(
       async (pathValue) => pathValue === mappedPath
     )
     const { provider } = createProviderSetup([makeBufferLine('README.md:5')], new Map(), {
       worktreePath: '\\\\wsl.localhost\\Ubuntu\\home\\repo',
+      wslDistro: 'Ubuntu',
       startupCwd: '/stale',
       getPaneLinkCwd: () => '/root/workspace/myrepo'
     })
@@ -1930,13 +1958,22 @@ describe('createFilePathLinkProvider range bounds', () => {
     expect(window.api.shell.pathExists).toHaveBeenCalledWith(mappedPath)
   })
 
-  it('preserves existing UNC and native paths', () => {
+  it('canonicalizes WSL UNC to the Windows backslash form', () => {
     expect(
       mapTerminalFilePath('//wsl.localhost/Ubuntu/root/file.md', '\\\\wsl.localhost\\Ubuntu\\repo')
-    ).toBe('//wsl.localhost/Ubuntu/root/file.md')
+    ).toBe('\\\\wsl.localhost\\Ubuntu\\root\\file.md')
+    expect(
+      mapTerminalFilePath(
+        '\\\\wsl.localhost\\Ubuntu\\root\\file.md',
+        '\\\\wsl.localhost\\Ubuntu\\repo'
+      )
+    ).toBe('\\\\wsl.localhost\\Ubuntu\\root\\file.md')
     expect(
       mapTerminalFilePath('\\\\server\\share\\file.md', '\\\\wsl.localhost\\Ubuntu\\repo')
     ).toBe('\\\\server\\share\\file.md')
+    expect(mapTerminalFilePath('//server/share/file.md', '\\\\wsl.localhost\\Ubuntu\\repo')).toBe(
+      '//server/share/file.md'
+    )
     expect(mapTerminalFilePath('C:/repo/file.md', '\\\\wsl.localhost\\Ubuntu\\repo')).toBe(
       'C:/repo/file.md'
     )
@@ -1947,9 +1984,22 @@ describe('createFilePathLinkProvider range bounds', () => {
     expect(mapTerminalFilePath('/mnt/c/repo/file.md', '/Users/a/repo')).toBe('/mnt/c/repo/file.md')
   })
 
+  it('keeps WSL-looking paths literal without a local WSL owner', () => {
+    expect(mapTerminalFilePath('//wsl.localhost/Ubuntu/repo/file.md', '/remote/repo')).toBe(
+      '//wsl.localhost/Ubuntu/repo/file.md'
+    )
+    expect(
+      mapTerminalFilePath(
+        '//wsl.localhost/Ubuntu/repo/file.md',
+        '\\\\wsl.localhost\\Ubuntu\\repo',
+        null
+      )
+    ).toBe('//wsl.localhost/Ubuntu/repo/file.md')
+  })
+
   it('maps POSIX paths with the pane WSL distro when the worktree is on a Windows drive', () => {
     expect(mapTerminalFilePath('/home/alice/notes.md', 'C:\\repo', 'Ubuntu')).toBe(
-      '//wsl.localhost/Ubuntu/home/alice/notes.md'
+      '\\\\wsl.localhost\\Ubuntu\\home\\alice\\notes.md'
     )
     expect(mapTerminalFilePath('/mnt/c/repo/README.md', 'C:\\repo', 'Ubuntu')).toBe(
       'C:\\repo\\README.md'
diff --git a/src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts b/src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts
index 801eec81c98..514f36aad6d 100644
--- a/src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts
@@ -1,5 +1,9 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { getTerminalUrlOpenHint, terminalUrlOpenHintOptionsFor } from './terminal-link-open-hints'
+import {
+  getTerminalUrlOpenHint,
+  terminalHttpLinkActionDestinationsFor,
+  terminalUrlOpenHintOptionsFor
+} from './terminal-link-open-hints'
 
 function stubPlatform(isMac: boolean): void {
   vi.stubGlobal('navigator', { userAgent: isMac ? 'Mac OS X' : 'Windows NT 10.0' })
@@ -138,4 +142,42 @@ describe('terminalUrlOpenHintOptionsFor', () => {
     expect(options.modifierInverts).toBe(true)
     expect(getTerminalUrlOpenHint(options)).toContain('to open in Orca')
   })
+
+  it('keeps inversion for a runtime pane when its host can open an Orca browser', () => {
+    const options = terminalUrlOpenHintOptionsFor(
+      {
+        openLinksInApp: false,
+        openLinksInAppModifierInverts: true
+      },
+      { kind: 'runtime', runtimeEnvironmentId: 'env-1' },
+      true
+    )
+
+    expect(options.modifierInverts).toBe(true)
+  })
+})
+
+describe('terminalHttpLinkActionDestinationsFor', () => {
+  it('offers both destinations for a capable runtime and follows the preference', () => {
+    const owner = { kind: 'runtime', runtimeEnvironmentId: 'env-1' } as const
+
+    expect(terminalHttpLinkActionDestinationsFor({ openLinksInApp: true }, owner, true)).toEqual({
+      primary: 'orca',
+      alternate: 'system'
+    })
+    expect(terminalHttpLinkActionDestinationsFor({ openLinksInApp: false }, owner, true)).toEqual({
+      primary: 'system',
+      alternate: 'orca'
+    })
+  })
+
+  it.each([
+    ['incapable runtime', { kind: 'runtime', runtimeEnvironmentId: 'env-1' } as const],
+    ['SSH', { kind: 'ssh', connectionId: 'ssh-1' } as const],
+    ['unknown owner', { kind: 'unknown' } as const]
+  ])('offers only the system browser for an %s', (_label, owner) => {
+    expect(terminalHttpLinkActionDestinationsFor({ openLinksInApp: true }, owner, false)).toEqual({
+      primary: 'system'
+    })
+  })
 })
diff --git a/src/renderer/src/components/terminal-pane/terminal-link-open-hints.ts b/src/renderer/src/components/terminal-pane/terminal-link-open-hints.ts
index e1a5f4ff81f..7820f28341f 100644
--- a/src/renderer/src/components/terminal-pane/terminal-link-open-hints.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-link-open-hints.ts
@@ -1,4 +1,5 @@
 import type { HttpLinkSourceOwner } from '@/lib/http-link-routing'
+import type { TerminalHttpLinkActionDestinations } from './terminal-url-link-hit-testing'
 
 export function isMacPlatform(): boolean {
   return navigator.userAgent.includes('Mac')
@@ -36,10 +37,22 @@ export type TerminalUrlOpenHintOptions = {
   showActions?: boolean
 }
 
-// Why: openHttpLink only routes to Orca when the source is local, so a remote pane
-// pins every link to the system browser and inverting cannot reach Orca there. The
-// clicked pane's owner decides that, not the global active runtime — a workspace-bound
-// remote pane is remote even when no runtime is globally active.
+export function terminalHttpLinkActionDestinationsFor(
+  settings: { openLinksInApp?: boolean } | null | undefined,
+  sourceOwner: HttpLinkSourceOwner,
+  canOpenRuntimeBrowser: boolean
+): TerminalHttpLinkActionDestinations {
+  const canOpenInOrca =
+    sourceOwner.kind === 'local' || (sourceOwner.kind === 'runtime' && canOpenRuntimeBrowser)
+  if (!canOpenInOrca) {
+    return { primary: 'system' }
+  }
+  return settings?.openLinksInApp === true
+    ? { primary: 'orca', alternate: 'system' }
+    : { primary: 'system', alternate: 'orca' }
+}
+
+// Why: only a capability-verified runtime can advertise the in-app destination.
 export function terminalUrlOpenHintOptionsFor(
   settings:
     | {
@@ -49,14 +62,15 @@ export function terminalUrlOpenHintOptionsFor(
       }
     | null
     | undefined,
-  sourceOwner?: HttpLinkSourceOwner
+  sourceOwner?: HttpLinkSourceOwner,
+  canOpenRuntimeBrowser = false
 ): TerminalUrlOpenHintOptions {
-  const sourceIsLocal = sourceOwner
-    ? sourceOwner.kind === 'local'
+  const sourceCanOpenInOrca = sourceOwner
+    ? sourceOwner.kind === 'local' || (sourceOwner.kind === 'runtime' && canOpenRuntimeBrowser)
     : !settings?.activeRuntimeEnvironmentId?.trim()
   return {
     openLinksInApp: settings?.openLinksInApp === true,
-    modifierInverts: settings?.openLinksInAppModifierInverts === true && sourceIsLocal
+    modifierInverts: settings?.openLinksInAppModifierInverts === true && sourceCanOpenInOrca
   }
 }
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-link-pty-mouse-suppression.test.ts b/src/renderer/src/components/terminal-pane/terminal-link-pty-mouse-suppression.test.ts
new file mode 100644
index 00000000000..97ff91ef8e3
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-link-pty-mouse-suppression.test.ts
@@ -0,0 +1,271 @@
+// @vitest-environment happy-dom
+import type { Terminal } from '@xterm/xterm'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { installTerminalLinkPtyMouseSuppression } from './terminal-link-pty-mouse-suppression'
+
+const activeSuppressions = new Set<ReturnType<typeof installTerminalLinkPtyMouseSuppression>>()
+
+function createSuppression(
+  deferPlain = true,
+  shouldContinueDeferring: (event: MouseEvent) => boolean = () => true
+): {
+  element: HTMLDivElement
+  suppression: ReturnType<typeof installTerminalLinkPtyMouseSuppression>
+} {
+  const element = document.createElement('div')
+  document.body.append(element)
+  const terminal = {
+    element,
+    options: { mouseEventsRequireAlt: false }
+  } as unknown as Terminal
+  const suppression = installTerminalLinkPtyMouseSuppression(
+    terminal,
+    () => true,
+    () => deferPlain,
+    shouldContinueDeferring
+  )
+  activeSuppressions.add(suppression)
+  return { element, suppression }
+}
+
+function mouseEvent(
+  type: 'mousedown' | 'mousemove' | 'mouseup',
+  init: MouseEventInit = {}
+): MouseEvent {
+  return new MouseEvent(type, { bubbles: true, button: 0, ...init })
+}
+
+async function settleGesture(element: HTMLElement): Promise<void> {
+  element.dispatchEvent(mouseEvent('mouseup'))
+  element.click()
+  await new Promise((resolve) => setTimeout(resolve, 0))
+}
+
+afterEach(() => {
+  for (const suppression of activeSuppressions) {
+    suppression.dispose()
+  }
+  activeSuppressions.clear()
+  document.body.replaceChildren()
+  vi.restoreAllMocks()
+})
+
+describe('terminal link PTY mouse suppression', () => {
+  it('drops deferred mouse input when the completed action claims it', async () => {
+    const { element, suppression } = createSuppression()
+    const forwarded: string[] = []
+    const forward = (data: string): void => {
+      forwarded.push(data)
+    }
+    element.addEventListener('mousedown', () => suppression.handlePtyInput('\x1b[<0;1;1M', forward))
+    element.addEventListener('mouseup', () => {
+      suppression.handlePtyInput('\x1b[<0;1;1m', forward)
+      suppression.claimAction()
+    })
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+    await settleGesture(element)
+
+    expect(forwarded).toEqual([])
+  })
+
+  it('flushes deferred mouse input when the completed gesture stays child-owned', async () => {
+    const { element, suppression } = createSuppression()
+    const forwarded: string[] = []
+    const forward = (data: string): void => {
+      forwarded.push(data)
+    }
+    element.addEventListener('mousedown', () => suppression.handlePtyInput('\x1b[<0;1;1M', forward))
+    element.addEventListener('mouseup', () => suppression.handlePtyInput('\x1b[<0;1;1m', forward))
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+    await settleGesture(element)
+
+    expect(forwarded).toEqual(['\x1b[<0;1;1M', '\x1b[<0;1;1m'])
+  })
+
+  it('forwards plain mouse input immediately when actions are disabled', () => {
+    const { element, suppression } = createSuppression(false)
+    const forwarded: string[] = []
+    element.addEventListener('mousedown', () =>
+      suppression.handlePtyInput('\x1b[M !!', (data) => forwarded.push(data))
+    )
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+
+    expect(forwarded).toEqual(['\x1b[M !!'])
+  })
+
+  it('flushes a dragged mouse sequence in order', async () => {
+    const { element, suppression } = createSuppression()
+    const forwarded: string[] = []
+    const forward = (data: string): void => {
+      forwarded.push(data)
+    }
+    element.addEventListener('mousedown', () => suppression.handlePtyInput('\x1b[<0;1;1M', forward))
+    document.addEventListener(
+      'mousemove',
+      () => suppression.handlePtyInput('\x1b[<32;2;2M', forward),
+      { once: true }
+    )
+    document.addEventListener(
+      'mouseup',
+      () => suppression.handlePtyInput('\x1b[<0;2;2m', forward),
+      { once: true }
+    )
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+    element.dispatchEvent(mouseEvent('mousemove', { buttons: 1, clientX: 10 }))
+    await settleGesture(element)
+
+    expect(forwarded).toEqual(['\x1b[<0;1;1M', '\x1b[<32;2;2M', '\x1b[<0;2;2m'])
+  })
+
+  it('releases a drag as soon as pointer eligibility is lost', () => {
+    const { element, suppression } = createSuppression(true, (event) => event.clientX < 5)
+    const forwarded: string[] = []
+    const forward = (data: string): void => {
+      forwarded.push(data)
+    }
+    element.addEventListener('mousedown', () => suppression.handlePtyInput('\x1b[<0;1;1M', forward))
+    document.addEventListener(
+      'mousemove',
+      () => suppression.handlePtyInput('\x1b[<32;2;2M', forward),
+      { once: true }
+    )
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+    element.dispatchEvent(mouseEvent('mousemove', { buttons: 1, clientX: 10 }))
+
+    expect(forwarded).toEqual(['\x1b[<0;1;1M', '\x1b[<32;2;2M'])
+  })
+
+  it('forwards keyboard input outside mouse dispatch while a click is pending', async () => {
+    const { element, suppression } = createSuppression()
+    const forwarded: string[] = []
+    const forward = (data: string): void => {
+      forwarded.push(data)
+    }
+    element.addEventListener('mousedown', () => suppression.handlePtyInput('\x1b[<0;1;1M', forward))
+    document.addEventListener(
+      'mouseup',
+      () => suppression.handlePtyInput('\x1b[<0;1;1m', forward),
+      { once: true }
+    )
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+    suppression.handlePtyInput('key', forward)
+    await settleGesture(element)
+
+    expect(forwarded).toEqual(['key', '\x1b[<0;1;1M', '\x1b[<0;1;1m'])
+  })
+
+  it('flushes pending child input on blur', () => {
+    const { element, suppression } = createSuppression()
+    const forwarded: string[] = []
+    element.addEventListener('mousedown', () =>
+      suppression.handlePtyInput('\x1b[<0;1;1M', (data) => forwarded.push(data))
+    )
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+    window.dispatchEvent(new Event('blur'))
+
+    expect(forwarded).toEqual(['\x1b[<0;1;1M'])
+  })
+
+  it('flushes pending child input when disposed', () => {
+    const { element, suppression } = createSuppression()
+    const forwarded: string[] = []
+    element.addEventListener('mousedown', () =>
+      suppression.handlePtyInput('\x1b[<0;1;1M', (data) => forwarded.push(data))
+    )
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+    suppression.dispose()
+
+    expect(forwarded).toEqual(['\x1b[<0;1;1M'])
+  })
+
+  it('flushes an abandoned transaction before starting another gesture', () => {
+    const { element, suppression } = createSuppression()
+    const forwarded: string[] = []
+    element.addEventListener('mousedown', () =>
+      suppression.handlePtyInput('\x1b[<0;1;1M', (data) => forwarded.push(data))
+    )
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+    element.dispatchEvent(mouseEvent('mousedown'))
+
+    expect(forwarded).toEqual(['\x1b[<0;1;1M'])
+  })
+
+  it('installs global listeners only while a deferred gesture is active', async () => {
+    const documentAdd = vi.spyOn(document, 'addEventListener')
+    const windowAdd = vi.spyOn(window, 'addEventListener')
+    const { element } = createSuppression()
+
+    expect(documentAdd).not.toHaveBeenCalled()
+    expect(windowAdd).not.toHaveBeenCalled()
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+
+    expect(documentAdd).toHaveBeenCalledWith('mousemove', expect.any(Function), { capture: true })
+    expect(windowAdd).toHaveBeenCalledWith('mouseup', expect.any(Function))
+
+    await settleGesture(element)
+    documentAdd.mockClear()
+    windowAdd.mockClear()
+    window.dispatchEvent(new Event('blur'))
+
+    expect(documentAdd).not.toHaveBeenCalled()
+    expect(windowAdd).not.toHaveBeenCalled()
+  })
+
+  it('fails open to the child when a deferred frame stream exceeds its budget', () => {
+    const { element, suppression } = createSuppression()
+    const forwarded: string[] = []
+    const expected = Array.from({ length: 100 }, (_, index) => `\x1b[<32;${index};1M`)
+    element.addEventListener('mousedown', () => {
+      for (const frame of expected) {
+        suppression.handlePtyInput(frame, (data) => forwarded.push(data))
+      }
+    })
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+
+    expect(forwarded).toEqual(expected)
+    expect(suppression.claimAction()).toBe(false)
+  })
+
+  it('forwards non-mouse focus reports during a claimed mouse gesture', async () => {
+    const { element, suppression } = createSuppression()
+    const forwarded: string[] = []
+    const forward = (data: string): void => {
+      forwarded.push(data)
+    }
+    element.addEventListener('mousedown', () => {
+      suppression.handlePtyInput('\x1b[<0;1;1M', forward)
+      suppression.handlePtyInput('\x1b[I', forward)
+    })
+    element.addEventListener('mouseup', () => suppression.claimAction())
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+    await settleGesture(element)
+
+    expect(forwarded).toEqual(['\x1b[I'])
+  })
+
+  it('flushes a pending press when the pointer leaves the document', () => {
+    const { element, suppression } = createSuppression()
+    const forwarded: string[] = []
+    element.addEventListener('mousedown', () =>
+      suppression.handlePtyInput('\x1b[<0;1;1M', (data) => forwarded.push(data))
+    )
+
+    element.dispatchEvent(mouseEvent('mousedown'))
+    document.dispatchEvent(new MouseEvent('mouseleave'))
+
+    expect(forwarded).toEqual(['\x1b[<0;1;1M'])
+    expect(suppression.claimAction()).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-link-pty-mouse-suppression.ts b/src/renderer/src/components/terminal-pane/terminal-link-pty-mouse-suppression.ts
index a325056759b..70cd81cf1e4 100644
--- a/src/renderer/src/components/terminal-pane/terminal-link-pty-mouse-suppression.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-link-pty-mouse-suppression.ts
@@ -1,17 +1,45 @@
 import type { IDisposable, Terminal } from '@xterm/xterm'
-import { isTerminalLinkDirectActivation } from './terminal-link-activation'
+import {
+  isTerminalLinkActionActivation,
+  isTerminalLinkDirectActivation
+} from './terminal-link-activation'
 
 const CAPTURE_LISTENER_OPTIONS = { capture: true } as const
+const MAX_DEFERRED_PTY_INPUT_FRAMES = 64
+
+type DeferredPtyInput = {
+  data: string
+  forward: (data: string) => void
+}
+
+export type TerminalLinkPtyMouseSuppression = IDisposable & {
+  claimAction: () => boolean
+  handlePtyInput: (data: string, forward: (data: string) => void) => void
+}
+
+function isXtermMouseReport(data: string): boolean {
+  return (
+    (data.startsWith('\x1b[M') && data.length === 6) ||
+    (data.startsWith('\x1b[<') && /^\d+;\d+;\d+[Mm]$/.test(data.slice(3)))
+  )
+}
 
 export function installTerminalLinkPtyMouseSuppression(
   terminal: Terminal,
-  shouldSuppressMouseEvent: (event: MouseEvent) => boolean
-): IDisposable {
+  shouldSuppressMouseEvent: (event: MouseEvent) => boolean,
+  shouldDeferPlainMouseEvent: (event: MouseEvent) => boolean = () => false,
+  shouldContinueDeferring: (event: MouseEvent) => boolean = () => true
+): TerminalLinkPtyMouseSuppression {
   const terminalElement = terminal.element
   const ownerDocument = terminalElement?.ownerDocument
   const ownerWindow = ownerDocument?.defaultView
   let previousMouseEventsRequireAlt: boolean | null = null
   let restoreQueued = false
+  let deferredPtyInput: DeferredPtyInput[] | null = null
+  let capturesPtyInput = false
+  let actionClaimed = false
+  let deferredInputFallbackTimer: number | null = null
+  let deferredListenersInstalled = false
 
   const restore = (): void => {
     restoreQueued = false
@@ -30,7 +58,34 @@ export function installTerminalLinkPtyMouseSuppression(
     restoreQueued = true
     queueMicrotask(restore)
   }
+  const finishDeferredInput = (): void => {
+    if (deferredInputFallbackTimer !== null) {
+      ownerWindow?.clearTimeout(deferredInputFallbackTimer)
+      deferredInputFallbackTimer = null
+    }
+    const deferred = deferredPtyInput
+    const shouldForward = deferred !== null && !actionClaimed
+    deferredPtyInput = null
+    capturesPtyInput = false
+    actionClaimed = false
+    removeDeferredListeners()
+    if (shouldForward) {
+      for (const input of deferred) {
+        input.forward(input.data)
+      }
+    }
+  }
+  const captureCurrentMouseEvent = (): void => {
+    capturesPtyInput = true
+  }
   const handleMouseDown = (event: MouseEvent): void => {
+    if (isTerminalLinkActionActivation(event) && shouldDeferPlainMouseEvent(event)) {
+      finishDeferredInput()
+      deferredPtyInput = []
+      addDeferredListeners()
+      captureCurrentMouseEvent()
+      return
+    }
     if (!isTerminalLinkDirectActivation(event) || !shouldSuppressMouseEvent(event)) {
       return
     }
@@ -41,11 +96,96 @@ export function installTerminalLinkPtyMouseSuppression(
     ownerDocument?.addEventListener('mouseup', queueRestore)
     ownerWindow?.addEventListener('blur', restore)
   }
+  const handleDeferredMouseEvent = (): void => {
+    if (deferredPtyInput !== null) {
+      captureCurrentMouseEvent()
+    }
+  }
+  const releaseIneligibleDrag = (event: MouseEvent): void => {
+    if (deferredPtyInput !== null && !shouldContinueDeferring(event)) {
+      finishDeferredInput()
+    }
+  }
+  const releaseCurrentMouseEvent = (): void => {
+    capturesPtyInput = false
+  }
+  const queueDeferredInputFallback = (): void => {
+    if (deferredPtyInput !== null) {
+      if (deferredInputFallbackTimer !== null) {
+        ownerWindow?.clearTimeout(deferredInputFallbackTimer)
+      }
+      deferredInputFallbackTimer = ownerWindow?.setTimeout(finishDeferredInput, 0) ?? null
+    }
+  }
+  const handleBlur = (): void => {
+    finishDeferredInput()
+    restore()
+  }
+  const addDeferredListeners = (): void => {
+    if (deferredListenersInstalled) {
+      return
+    }
+    deferredListenersInstalled = true
+    ownerDocument?.addEventListener('mousemove', handleDeferredMouseEvent, CAPTURE_LISTENER_OPTIONS)
+    ownerDocument?.addEventListener('mousemove', releaseIneligibleDrag)
+    ownerDocument?.addEventListener('mouseup', handleDeferredMouseEvent, CAPTURE_LISTENER_OPTIONS)
+    ownerDocument?.addEventListener('mouseleave', finishDeferredInput)
+    ownerWindow?.addEventListener('mousedown', releaseCurrentMouseEvent)
+    ownerWindow?.addEventListener('mousemove', releaseCurrentMouseEvent)
+    ownerWindow?.addEventListener('mouseup', releaseCurrentMouseEvent)
+    ownerWindow?.addEventListener('mouseup', queueDeferredInputFallback)
+    ownerWindow?.addEventListener('click', queueDeferredInputFallback)
+    ownerWindow?.addEventListener('blur', handleBlur)
+  }
+  const removeDeferredListeners = (): void => {
+    if (!deferredListenersInstalled) {
+      return
+    }
+    deferredListenersInstalled = false
+    ownerDocument?.removeEventListener(
+      'mousemove',
+      handleDeferredMouseEvent,
+      CAPTURE_LISTENER_OPTIONS
+    )
+    ownerDocument?.removeEventListener('mousemove', releaseIneligibleDrag)
+    ownerDocument?.removeEventListener(
+      'mouseup',
+      handleDeferredMouseEvent,
+      CAPTURE_LISTENER_OPTIONS
+    )
+    ownerDocument?.removeEventListener('mouseleave', finishDeferredInput)
+    ownerWindow?.removeEventListener('mousedown', releaseCurrentMouseEvent)
+    ownerWindow?.removeEventListener('mousemove', releaseCurrentMouseEvent)
+    ownerWindow?.removeEventListener('mouseup', releaseCurrentMouseEvent)
+    ownerWindow?.removeEventListener('mouseup', queueDeferredInputFallback)
+    ownerWindow?.removeEventListener('click', queueDeferredInputFallback)
+    ownerWindow?.removeEventListener('blur', handleBlur)
+  }
 
   terminalElement?.addEventListener('mousedown', handleMouseDown, CAPTURE_LISTENER_OPTIONS)
   terminalElement?.addEventListener('mouseup', queueRestore, CAPTURE_LISTENER_OPTIONS)
   return {
+    claimAction: () => {
+      if (deferredPtyInput === null) {
+        return false
+      }
+      actionClaimed = true
+      return true
+    },
+    handlePtyInput: (data, forward) => {
+      if (deferredPtyInput !== null && capturesPtyInput && isXtermMouseReport(data)) {
+        if (deferredPtyInput.length >= MAX_DEFERRED_PTY_INPUT_FRAMES) {
+          finishDeferredInput()
+          forward(data)
+          return
+        }
+        deferredPtyInput.push({ data, forward })
+        return
+      }
+      forward(data)
+    },
     dispose: () => {
+      finishDeferredInput()
       restore()
       terminalElement?.removeEventListener('mousedown', handleMouseDown, CAPTURE_LISTENER_OPTIONS)
       terminalElement?.removeEventListener('mouseup', queueRestore, CAPTURE_LISTENER_OPTIONS)
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts b/src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts
new file mode 100644
index 00000000000..90825f42980
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts
@@ -0,0 +1,134 @@
+import { describe, expect, it } from 'vitest'
+import type { AppState } from '@/store/types'
+import { selectTerminalPaneHostState } from './terminal-pane-host-state'
+
+function makeState(overrides: Record<string, unknown>): AppState {
+  return {
+    activeWorktreeId: null,
+    detectedWorktreesByRepo: {},
+    folderWorkspaces: [],
+    projectGroups: [],
+    removedSshTargetLabels: new Map(),
+    repos: [],
+    runtimeStatusByEnvironmentId: new Map(),
+    sshConnectionStates: new Map(),
+    sshStateByEnvironment: new Map(),
+    sshTargetLabels: new Map(),
+    sshTargetsHydrated: true,
+    worktreesByRepo: {},
+    ...overrides
+  } as unknown as AppState
+}
+
+describe('selectTerminalPaneHostState', () => {
+  it('resolves local and direct SSH workspaces without changing reconnect semantics', () => {
+    const localState = makeState({
+      repos: [{ id: 'repo-local' }],
+      worktreesByRepo: {
+        'repo-local': [{ id: 'wt-local', repoId: 'repo-local' }]
+      }
+    })
+
+    expect(selectTerminalPaneHostState(localState, 'wt-local')).toEqual({
+      nativeChatTranscriptIsLocalReadable: true,
+      sshReconnectEnvironmentId: null,
+      sshReconnectStatus: null,
+      sshReconnectTargetId: null,
+      sshReconnectTargetLabel: '',
+      sshReconnectTargetRemoved: false
+    })
+
+    const sshState = makeState({
+      repos: [{ id: 'repo-ssh', connectionId: 'ssh-a' }],
+      sshConnectionStates: new Map([
+        ['ssh-a', { targetId: 'ssh-a', status: 'connected', error: null, reconnectAttempt: 0 }]
+      ]),
+      sshTargetLabels: new Map([['ssh-a', 'devbox']]),
+      worktreesByRepo: {
+        'repo-ssh': [{ id: 'wt-ssh', repoId: 'repo-ssh' }]
+      }
+    })
+
+    expect(selectTerminalPaneHostState(sshState, 'wt-ssh')).toEqual({
+      nativeChatTranscriptIsLocalReadable: false,
+      sshReconnectEnvironmentId: null,
+      sshReconnectStatus: 'connected',
+      sshReconnectTargetId: 'ssh-a',
+      sshReconnectTargetLabel: 'devbox',
+      sshReconnectTargetRemoved: false
+    })
+  })
+
+  it('reads nested SSH state from the worktree owner runtime', () => {
+    const state = makeState({
+      repos: [
+        {
+          id: 'repo-runtime',
+          connectionId: 'ssh-nested',
+          executionHostId: 'runtime:env-a'
+        }
+      ],
+      runtimeStatusByEnvironmentId: new Map([
+        ['env-a', { status: { runtimeId: 'runtime-a' }, checkedAt: 1 }]
+      ]),
+      sshStateByEnvironment: new Map([
+        [
+          'env-a',
+          {
+            connectionStates: new Map([
+              [
+                'ssh-nested',
+                {
+                  targetId: 'ssh-nested',
+                  status: 'disconnected',
+                  error: null,
+                  reconnectAttempt: 0
+                }
+              ]
+            ]),
+            targetLabels: new Map([['ssh-nested', 'build box']]),
+            removedTargetLabels: new Map(),
+            targetsHydrated: true
+          }
+        ]
+      ]),
+      worktreesByRepo: {
+        'repo-runtime': [
+          {
+            id: 'wt-runtime',
+            repoId: 'repo-runtime',
+            hostId: 'runtime:env-a',
+            runtimeOwnerEnvironmentId: 'env-a'
+          }
+        ]
+      }
+    })
+
+    expect(selectTerminalPaneHostState(state, 'wt-runtime')).toEqual({
+      nativeChatTranscriptIsLocalReadable: false,
+      sshReconnectEnvironmentId: 'env-a',
+      sshReconnectStatus: 'disconnected',
+      sshReconnectTargetId: 'ssh-nested',
+      sshReconnectTargetLabel: 'build box',
+      sshReconnectTargetRemoved: false
+    })
+  })
+
+  it('keeps runtime-owned SSH plumbing out of reconnect UI', () => {
+    const state = makeState({
+      repos: [{ id: 'repo-ephemeral', connectionId: 'runtime-ssh-vm-a' }],
+      worktreesByRepo: {
+        'repo-ephemeral': [{ id: 'wt-ephemeral', repoId: 'repo-ephemeral' }]
+      }
+    })
+
+    expect(selectTerminalPaneHostState(state, 'wt-ephemeral')).toEqual({
+      nativeChatTranscriptIsLocalReadable: true,
+      sshReconnectEnvironmentId: null,
+      sshReconnectStatus: null,
+      sshReconnectTargetId: null,
+      sshReconnectTargetLabel: '',
+      sshReconnectTargetRemoved: false
+    })
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-host-state.ts b/src/renderer/src/components/terminal-pane/terminal-pane-host-state.ts
new file mode 100644
index 00000000000..17a7e1a354c
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-host-state.ts
@@ -0,0 +1,61 @@
+import type { AppState } from '@/store/types'
+import { getConnectionIdFromState } from '@/lib/connection-context'
+import { getExplicitRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import { isNativeChatTranscriptLocalReadable } from '@/lib/native-chat-transcript-readability'
+import {
+  selectRuntimeAwareSshStatus,
+  selectRuntimeAwareSshTargetLabel,
+  selectRuntimeAwareSshTargetRemoved
+} from '@/store/slices/runtime-environment-ssh'
+import { isRuntimeOwnedSshTargetId } from '../../../../shared/execution-host'
+
+export type TerminalPaneHostState = {
+  nativeChatTranscriptIsLocalReadable: boolean
+  sshReconnectEnvironmentId: string | null
+  sshReconnectStatus: ReturnType<typeof selectRuntimeAwareSshStatus>
+  sshReconnectTargetId: string | null
+  sshReconnectTargetLabel: string
+  sshReconnectTargetRemoved: boolean
+}
+
+export function selectTerminalPaneHostState(
+  state: AppState,
+  worktreeId: string
+): TerminalPaneHostState {
+  const connectionId = getConnectionIdFromState(state, worktreeId)
+  const nativeChatTranscriptIsLocalReadableResult =
+    isNativeChatTranscriptLocalReadable(connectionId)
+  const sshReconnectTargetId =
+    connectionId && !isRuntimeOwnedSshTargetId(connectionId) ? connectionId : null
+  if (!sshReconnectTargetId) {
+    return {
+      nativeChatTranscriptIsLocalReadable: nativeChatTranscriptIsLocalReadableResult,
+      sshReconnectEnvironmentId: null,
+      sshReconnectStatus: null,
+      sshReconnectTargetId: null,
+      sshReconnectTargetLabel: '',
+      sshReconnectTargetRemoved: false
+    }
+  }
+  const sshReconnectEnvironmentId = getExplicitRuntimeEnvironmentIdForWorktree(state, worktreeId)
+  return {
+    nativeChatTranscriptIsLocalReadable: nativeChatTranscriptIsLocalReadableResult,
+    sshReconnectEnvironmentId,
+    sshReconnectStatus: selectRuntimeAwareSshStatus(
+      state,
+      sshReconnectEnvironmentId,
+      sshReconnectTargetId
+    ),
+    sshReconnectTargetId,
+    sshReconnectTargetLabel: selectRuntimeAwareSshTargetLabel(
+      state,
+      sshReconnectEnvironmentId,
+      sshReconnectTargetId
+    ),
+    sshReconnectTargetRemoved: selectRuntimeAwareSshTargetRemoved(
+      state,
+      sshReconnectEnvironmentId,
+      sshReconnectTargetId
+    )
+  }
+}
diff --git a/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts b/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts
index 4c091456e32..fb0bf470004 100644
--- a/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts
@@ -1,5 +1,5 @@
 import { isTerminalLeafId } from '../../../../shared/stable-pane-id'
-import { isRemoteRuntimePtyId, sendRuntimePtyInput } from '@/runtime/runtime-terminal-inspection'
+import { isRemoteRuntimePtyId } from '@/runtime/runtime-terminal-inspection'
 import { useAppStore } from '@/store'
 import { closeTerminalTab } from '../terminal/terminal-tab-actions'
 import { startParkedTerminalByteWatcher } from './parked-terminal-byte-watcher'
@@ -82,10 +82,7 @@ export function startParkedPtyWatcher(args: {
     paneId: pane.paneId,
     drivesTabTitle: pane.drivesTabTitle,
     ...(initialTitle !== undefined ? { initialTitle } : {}),
-    ...(restoreTitleOnRegister ? { restoreTitleOnRegister: true } : {}),
-    sendInput: (data) => {
-      sendRuntimePtyInput(useAppStore.getState().settings, ptyId, data)
-    }
+    ...(restoreTitleOnRegister ? { restoreTitleOnRegister: true } : {})
   })
   const unsubscribeExit = isRemoteRuntimePtyId(ptyId)
     ? () => {}
diff --git a/src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts b/src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts
index 2e9b3a52ef2..a129f033176 100644
--- a/src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts
@@ -206,14 +206,6 @@ describe('terminal-parked-tab-watchers', () => {
     expect(startedWatchers[0].options.restoreTitleOnRegister).toBe(true)
   })
 
-  it('routes watcher sendInput to window.api.pty.write for the watched PTY', () => {
-    capturePanes([{ ptyId: PTY_ID, paneId: 1, leafId: LEAF_ID, drivesTabTitle: true }])
-    syncParked()
-
-    startedWatchers[0].options.sendInput('\x1b[?2031;1$y')
-    expect(ptyWrite).toHaveBeenCalledWith(PTY_ID, '\x1b[?2031;1$y')
-  })
-
   it('skips legacy non-UUID leaf ids instead of throwing in makePaneKey', () => {
     capturePanes([
       { ptyId: PTY_ID, paneId: 1, leafId: 'legacy-leaf-1', drivesTabTitle: true },
diff --git a/src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.ts b/src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.ts
index 1f4b522040a..b2fb9b3de07 100644
--- a/src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.ts
@@ -58,10 +58,10 @@ export function terminalWatcherLiveWorkspaceIds(workspaceIds: Iterable<string>):
 }
 
 /**
- * Whether this tab is parked right now — the reveal remount's own mount effect
- * runs before the host effect that disposes the watcher (child effects first),
- * so a pane reading this at connect time can tell a park-reveal from an
- * in-place reattach. Empty entries are pinned-close tombstones, not live parks.
+ * Whether this tab is parked right now — the reveal remount renders before the
+ * host effect that disposes the watcher, so a pane reading this at render time
+ * can tell a park-reveal from an in-place reattach. Empty entries are
+ * pinned-close tombstones, not live parks.
  */
 export function isTerminalTabParked(tabId: string): boolean {
   return (parkedWatchersByTabId.get(tabId)?.disposersByPtyId.size ?? 0) > 0
diff --git a/src/renderer/src/components/terminal-pane/terminal-paste-chunks.ts b/src/renderer/src/components/terminal-pane/terminal-paste-chunks.ts
index 394259d3923..a67e2e6f4ca 100644
--- a/src/renderer/src/components/terminal-pane/terminal-paste-chunks.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-paste-chunks.ts
@@ -1,6 +1,10 @@
 import { BRACKETED_PASTE_END, BRACKETED_PASTE_START } from './terminal-bracketed-paste'
 import { TERMINAL_PASTE_CHUNK_MAX_BYTES } from './terminal-paste-limits'
 import type { TerminalPastePlan } from './terminal-paste-coordinator'
+import {
+  getUtf8ByteLengthForCodePoint,
+  readUtf8CodePointAt
+} from '../../../../shared/utf8-byte-limits'
 
 const TERMINAL_PASTE_ESCAPE_CODE_POINT = 0x1b
 const TERMINAL_PASTE_INERT_ESCAPE_CODE_POINT = 0x241b
@@ -37,7 +41,7 @@ function* iterateTextByUtf8Bytes(
   let chunk = ''
   let chunkBytes = 0
   for (let index = 0; index < text.length; index += 1) {
-    const codePoint = text.codePointAt(index) ?? 0
+    const codePoint = readUtf8CodePointAt(text, index)
     const codeUnitLength = codePoint > 0xffff ? 2 : 1
     // Why: iterator normalization avoids a full-size copy and keeps CRLF atomic across chunks.
     if (
@@ -58,7 +62,7 @@ function* iterateTextByUtf8Bytes(
       : normalizedCodePoint === codePoint
         ? text.slice(index, index + codeUnitLength)
         : '\r'
-    const nextBytes = utf8BytesForCodePoint(
+    const nextBytes = getUtf8ByteLengthForCodePoint(
       sanitizedEscape ? TERMINAL_PASTE_INERT_ESCAPE_CODE_POINT : normalizedCodePoint
     )
     if (chunk && chunkBytes + nextBytes > maxBytes) {
@@ -80,16 +84,3 @@ function* iterateTextByUtf8Bytes(
     yield chunk
   }
 }
-
-function utf8BytesForCodePoint(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
diff --git a/src/renderer/src/components/terminal-pane/terminal-paste-diagnostics.ts b/src/renderer/src/components/terminal-pane/terminal-paste-diagnostics.ts
index b32decb98ff..9c89536db50 100644
--- a/src/renderer/src/components/terminal-pane/terminal-paste-diagnostics.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-paste-diagnostics.ts
@@ -29,7 +29,7 @@ export function createRedactedPasteExecutionDiagnostic({
   chunksWritten: number
   durationMs: number
   plan: TerminalPastePlan
-  reason?: TerminalPasteExecutionReason | string
+  reason?: TerminalPasteExecutionReason | (string & {})
   status: TerminalPasteExecutionResult['status']
 }): string {
   return [
diff --git a/src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts b/src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts
index 0113ea31a3d..01896238c05 100644
--- a/src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts
@@ -1,6 +1,9 @@
 import type { IBufferLine, Terminal } from '@xterm/xterm'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { registerHttpLinkStoreAccessor } from '@/lib/http-link-routing'
+import {
+  registerHttpLinkStoreAccessor,
+  registerRuntimeHttpLinkBrowserOpener
+} from '@/lib/http-link-routing'
 import { handleOscLink } from './terminal-osc-link-routing'
 import { handleTerminalWebLinkClick } from './terminal-web-link-click'
 import { installHttpLinkClickFallback } from './terminal-url-link-hit-testing'
@@ -12,6 +15,7 @@ const ROWS = 24
 const openUrlMock = vi.fn()
 const setActiveWorktreeMock = vi.fn()
 const createBrowserTabMock = vi.fn()
+const openRuntimeBrowserTabMock = vi.fn(() => Promise.resolve())
 const runtimeSourceOwner = { kind: 'runtime', runtimeEnvironmentId: 'env-1' } as const
 const sshSourceOwner = { kind: 'ssh', connectionId: 'ssh-1' } as const
 
@@ -104,26 +108,34 @@ beforeEach(() => {
     setActiveWorktree: setActiveWorktreeMock,
     createBrowserTab: createBrowserTabMock
   }))
+  registerRuntimeHttpLinkBrowserOpener(openRuntimeBrowserTabMock)
 })
 
 afterEach(() => {
+  registerRuntimeHttpLinkBrowserOpener(null)
   vi.unstubAllGlobals()
 })
 
 describe('terminal HTTP links on a runtime-hosted pane', () => {
   const baseDeps = { worktreeId: 'wt-1', worktreePath: '/tmp', startupCwd: '/tmp' }
 
-  it('sends an OSC 8 hyperlink to the system browser', () => {
+  it('opens an OSC 8 hyperlink on the owning runtime', () => {
     expect(handleOscLink(URL, clickEvent(), { ...baseDeps, sourceOwner: runtimeSourceOwner })).toBe(
       true
     )
 
-    expect(openUrlMock).toHaveBeenCalledWith(URL)
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledWith({
+      workspaceId: 'wt-1',
+      url: URL,
+      intent: { kind: 'url' },
+      expectedRuntimeEnvironmentId: 'env-1'
+    })
+    expect(openUrlMock).not.toHaveBeenCalled()
     expect(createBrowserTabMock).not.toHaveBeenCalled()
     expect(setActiveWorktreeMock).not.toHaveBeenCalled()
   })
 
-  it('sends a WebLinksAddon click to the system browser', () => {
+  it('opens a WebLinksAddon click on the owning runtime', () => {
     const { terminal } = makeTerminal()
 
     expect(
@@ -134,11 +146,14 @@ describe('terminal HTTP links on a runtime-hosted pane', () => {
       })
     ).toBe(true)
 
-    expect(openUrlMock).toHaveBeenCalledWith(URL)
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledWith(
+      expect.objectContaining({ expectedRuntimeEnvironmentId: 'env-1', url: URL })
+    )
+    expect(openUrlMock).not.toHaveBeenCalled()
     expect(createBrowserTabMock).not.toHaveBeenCalled()
   })
 
-  it('sends a click-fallback activation to the system browser', () => {
+  it('opens a click-fallback activation on the owning runtime', () => {
     const { terminal, registrations } = makeTerminal()
     const disposable = installHttpLinkClickFallback(terminal, {
       worktreeId: 'wt-1',
@@ -149,12 +164,15 @@ describe('terminal HTTP links on a runtime-hosted pane', () => {
       ([name, _listener, options]) => name === 'mouseup' && options === undefined
     )?.[1](clickEvent())
 
-    expect(openUrlMock).toHaveBeenCalledWith(URL)
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledWith(
+      expect.objectContaining({ expectedRuntimeEnvironmentId: 'env-1', url: URL })
+    )
+    expect(openUrlMock).not.toHaveBeenCalled()
     expect(createBrowserTabMock).not.toHaveBeenCalled()
     disposable.dispose()
   })
 
-  it('never prompts for the in-app routing preference it could not honor', () => {
+  it('uses the persisted routing preference without prompting again', () => {
     const requestOpenLinksInAppPreference = vi.fn(() => Promise.resolve(true))
 
     handleOscLink(URL, clickEvent(), {
@@ -164,7 +182,8 @@ describe('terminal HTTP links on a runtime-hosted pane', () => {
     })
 
     expect(requestOpenLinksInAppPreference).not.toHaveBeenCalled()
-    expect(openUrlMock).toHaveBeenCalledWith(URL)
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledOnce()
+    expect(openUrlMock).not.toHaveBeenCalled()
   })
 })
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.ts b/src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.ts
index 546af83987b..578a4147375 100644
--- a/src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.ts
@@ -86,8 +86,8 @@ export type TerminalSideEffectFactConsumerCallbacks = {
   onCommandCodeWorking?: (prompt: string) => void
   onCommandCodeDone?: (prompt: string) => void
   /** DECSET 2031 subscribe observed by main's tracker. Registered only by
-   *  hidden-delivery-gated consumers (their bytes never arrive); the theme
-   *  reply is sent renderer-side — query authority stays with the view. */
+   *  hidden-delivery-gated consumers (their bytes never arrive); it records the
+   *  subscription for later theme-flip pushes, it does not answer. */
   onMode2031Subscribe?: () => void
   /** DECSET 2031 withdrawal observed by main's tracker. Clears the pane's
    *  subscription registry so later theme flips stop pushing CSI 997. */
diff --git a/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.test.ts b/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.test.ts
index ccae12ee863..042f6bed3d8 100644
--- a/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.test.ts
@@ -1,10 +1,16 @@
 import { describe, expect, it } from 'vitest'
+import { Terminal } from '@xterm/headless'
 import {
   buildMainModelSnapshotReplayWrites,
   hasPositiveTerminalDimensions,
-  resolvePositiveTerminalDimensions
+  resolvePositiveTerminalDimensions,
+  shouldSkipAltFrameForWidthMismatch
 } from './terminal-snapshot-replay-paint'
 
+function writeTerminal(terminal: Terminal, data: string): Promise<void> {
+  return new Promise((resolve) => terminal.write(data, resolve))
+}
+
 describe('hasPositiveTerminalDimensions', () => {
   it('accepts only finite positive numeric pairs', () => {
     expect(hasPositiveTerminalDimensions(80, 24)).toBe(true)
@@ -66,3 +72,121 @@ describe('buildMainModelSnapshotReplayWrites', () => {
     ).toEqual(['\x1b[0m\x1b[?1049h\x1b[2J\x1b[H', 'alt-frame'])
   })
 })
+
+describe('shouldSkipAltFrameForWidthMismatch', () => {
+  it('skips only when the snapshot is WIDER than the target', () => {
+    expect(shouldSkipAltFrameForWidthMismatch(135, 128)).toBe(true)
+    expect(shouldSkipAltFrameForWidthMismatch(129, 128)).toBe(true)
+    expect(shouldSkipAltFrameForWidthMismatch(128, 128)).toBe(false)
+    expect(shouldSkipAltFrameForWidthMismatch(100, 120)).toBe(false)
+  })
+
+  it('never skips when a width is missing or nonsensical', () => {
+    // Why: an unknown width must not cost the user their restored frame.
+    expect(shouldSkipAltFrameForWidthMismatch(undefined, 128)).toBe(false)
+    expect(shouldSkipAltFrameForWidthMismatch(135, undefined)).toBe(false)
+    expect(shouldSkipAltFrameForWidthMismatch(0, 128)).toBe(false)
+    expect(shouldSkipAltFrameForWidthMismatch(Number.NaN, 128)).toBe(false)
+    expect(shouldSkipAltFrameForWidthMismatch(Number.POSITIVE_INFINITY, 128)).toBe(false)
+  })
+})
+
+describe('buildMainModelSnapshotReplayWrites alt-frame skip', () => {
+  it('restores the exact capture-grid alt frame while the target grid is unknown', async () => {
+    const terminal = new Terminal({ cols: 12, rows: 5, scrollback: 20 })
+    const snapshot = {
+      data: '\x1b[1;1HTOP---------\x1b[2;1HMIDDLE------\x1b[3;1HBOTTOM------',
+      frameRestoreAnsi: '\x1b[?25l',
+      alternateScreen: true,
+      scrollbackAnsi: 'history'
+    }
+
+    try {
+      const skipAltFrame = shouldSkipAltFrameForWidthMismatch(12, undefined)
+      for (const chunk of buildMainModelSnapshotReplayWrites(snapshot, { skipAltFrame })) {
+        await writeTerminal(terminal, chunk)
+      }
+
+      expect(
+        Array.from({ length: 3 }, (_, row) =>
+          terminal.buffer.active.getLine(row)?.translateToString(true)
+        )
+      ).toEqual(['TOP---------', 'MIDDLE------', 'BOTTOM------'])
+      expect(terminal.buffer.normal.getLine(0)?.translateToString(true)).toBe('history')
+    } finally {
+      terminal.dispose()
+    }
+  })
+
+  it('keeps normal history and a clean alt grid through the real resize path', async () => {
+    const terminal = new Terminal({ cols: 12, rows: 5, scrollback: 20 })
+    const snapshot = {
+      data: '\x1b[1;1HWIDE-FRAME',
+      frameRestoreAnsi: '\x1b[?25l',
+      alternateScreen: true,
+      scrollbackAnsi: 'log'
+    }
+
+    try {
+      for (const chunk of buildMainModelSnapshotReplayWrites(snapshot, { skipAltFrame: true })) {
+        await writeTerminal(terminal, chunk)
+      }
+      terminal.resize(4, 5)
+
+      expect(terminal.buffer.active.type).toBe('alternate')
+      expect(terminal.buffer.active.getLine(0)?.translateToString(true)).toBe('')
+      expect(terminal.buffer.normal.getLine(0)?.translateToString(true)).toBe('log')
+    } finally {
+      terminal.dispose()
+    }
+  })
+
+  it('drops only the frame paint, keeping scrollback and the alt-buffer choreography', () => {
+    expect(
+      buildMainModelSnapshotReplayWrites(
+        {
+          data: 'mode-prefixalt-frame',
+          frameRestoreAnsi: 'complete-live-state',
+          alternateScreen: true,
+          scrollbackAnsi: 'normal-history'
+        },
+        { skipAltFrame: true }
+      )
+    ).toEqual([
+      '\x1b[?1049l\x1b[2J\x1b[3J\x1b[H',
+      'normal-history',
+      '\x1b[0m\x1b[?1049h\x1b[2J\x1b[H',
+      'complete-live-state'
+    ])
+  })
+
+  it('still enters a cleared alt screen when skipping without split scrollback', () => {
+    // Why the clear still runs: the caller's SIGWINCH must land on a clean
+    // screen the application repaints, not the stale pre-park frame.
+    expect(
+      buildMainModelSnapshotReplayWrites(
+        {
+          data: 'mode-prefixalt-frame',
+          frameRestoreAnsi: 'complete-live-state',
+          alternateScreen: true
+        },
+        { skipAltFrame: true }
+      )
+    ).toEqual(['\x1b[0m\x1b[?1049h\x1b[2J\x1b[H', 'complete-live-state'])
+  })
+
+  it('keeps composed data when an older producer omits the mode boundary', () => {
+    expect(
+      buildMainModelSnapshotReplayWrites(
+        { data: 'legacy-modes-and-frame', alternateScreen: true },
+        { skipAltFrame: true }
+      )
+    ).toEqual(['\x1b[0m\x1b[?1049h\x1b[2J\x1b[H', 'legacy-modes-and-frame'])
+  })
+
+  it('never drops a normal-buffer snapshot, whose rows reflow correctly', () => {
+    expect(
+      buildMainModelSnapshotReplayWrites({ data: 'shell-output' }, { skipAltFrame: true })
+    ).toEqual(['\x1b[2J\x1b[3J\x1b[H', 'shell-output'])
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.ts b/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.ts
index b17bdd5435a..aa41ff6d645 100644
--- a/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.ts
@@ -1,3 +1,6 @@
+import type { ManagedPane } from '@/lib/pane-manager/pane-manager-types'
+import { readProposedPaneFitDimensions } from '@/lib/pane-manager/pane-fit'
+
 /**
  * Shared guards and write choreography for painting a main-model snapshot into
  * a (possibly fresh) xterm. One source for the reattach/hidden-restore paint
@@ -28,23 +31,64 @@ export function resolvePositiveTerminalDimensions(
     : null
 }
 
+/**
+ * The column count the post-replay fit will land on. Why not terminal.cols: a
+ * pane that has not been fitted yet still reads xterm's 80-column default, so
+ * comparing against it would drop frames whose width actually matches the
+ * container. Returns undefined when the pane cannot be measured, so replay can
+ * retain the frame at its capture grid until a final fit exists.
+ */
+export function readProposedTerminalCols(pane: ManagedPane): number | undefined {
+  return readProposedPaneFitDimensions(pane)?.cols
+}
+
+export function shouldSkipAltFrameForWidthMismatch(
+  snapshotCols: number | undefined,
+  targetCols: number | undefined
+): boolean {
+  if (typeof snapshotCols !== 'number' || !Number.isFinite(snapshotCols) || snapshotCols <= 0) {
+    return false
+  }
+  if (typeof targetCols !== 'number' || !Number.isFinite(targetCols) || targetCols <= 0) {
+    // Keep the frame at its capture grid until a real fit can replace that grid.
+    return false
+  }
+  // Fixed-grid alt rows clip at narrower columns; normal history remains reflowable.
+  return snapshotCols > targetCols
+}
+
 /**
  * Ordered replay writes for a main-model snapshot, including the alt-screen
  * choreography: main strips the `?1049h` marker when splitting scrollbackAnsi
  * from an alt frame, so the restorer owns the transition — rebuild the normal
  * buffer while on it, then paint the alt frame clean. Callers write these
  * before their post-replay reset/escape-tail sequences.
+ *
+ * `skipAltFrame` drops only the frame paint, never the buffer choreography or
+ * scrollback or mode rehydration: the alt buffer is still entered and cleared
+ * so the caller's SIGWINCH lands on a clean screen the application repaints.
  */
-export function buildMainModelSnapshotReplayWrites(snapshot: {
-  data: string
-  alternateScreen?: boolean
-  scrollbackAnsi?: string
-}): string[] {
+export function buildMainModelSnapshotReplayWrites(
+  snapshot: {
+    data: string
+    /** Live state that can be restored without an alternate-screen frame. */
+    frameRestoreAnsi?: string
+    alternateScreen?: boolean
+    scrollbackAnsi?: string
+  },
+  options: { skipAltFrame?: boolean } = {}
+): string[] {
   if (!snapshot.alternateScreen) {
     // Why: \x1b[3J wipes xterm scrollback; safe here because a normal-buffer
     // snapshot carries its own history in data (mirrors pty-transport.ts).
     return ['\x1b[2J\x1b[3J\x1b[H', snapshot.data]
   }
+  // Older snapshot producers do not expose the mode/frame boundary. Keep their
+  // composed data rather than dropping terminal modes together with the frame.
+  const altFrame =
+    options.skipAltFrame && snapshot.frameRestoreAnsi !== undefined
+      ? [snapshot.frameRestoreAnsi]
+      : [snapshot.data]
   if (snapshot.scrollbackAnsi !== undefined) {
     // Why: main serializes normal + alt buffers separately; rebuild normal
     // while active, then return to a clean alt frame.
@@ -52,11 +96,11 @@ export function buildMainModelSnapshotReplayWrites(snapshot: {
       '\x1b[?1049l\x1b[2J\x1b[3J\x1b[H',
       snapshot.scrollbackAnsi,
       '\x1b[0m\x1b[?1049h\x1b[2J\x1b[H',
-      snapshot.data
+      ...altFrame
     ]
   }
   // Why: the snapshot's ?1049h no-ops when already on alt screen and skips
   // blank cells; clear the alt buffer so the pre-hide frame can't bleed
   // through blank cells (spares normal-buffer scrollback).
-  return ['\x1b[0m\x1b[?1049h\x1b[2J\x1b[H', snapshot.data]
+  return ['\x1b[0m\x1b[?1049h\x1b[2J\x1b[H', ...altFrame]
 }
diff --git a/src/renderer/src/components/terminal-pane/terminal-tab-activation-order.ts b/src/renderer/src/components/terminal-pane/terminal-tab-activation-order.ts
new file mode 100644
index 00000000000..2f4096b1142
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-tab-activation-order.ts
@@ -0,0 +1,35 @@
+/** Ranks tabs hidden in the same pass by the user's activation order. */
+export type TerminalTabActivationOrder = {
+  recordActiveTabId(activeTabId: string | null): void
+  getActivationSeq(tabId: string): number | undefined
+  retainTabIds(liveTabIds: ReadonlySet<string>): void
+}
+
+export function createTerminalTabActivationOrder(): TerminalTabActivationOrder {
+  const activationSeqByTabId = new Map<string, number>()
+  let previousActiveTabId: string | null = null
+  let nextActivationSeq = 0
+
+  return {
+    recordActiveTabId(activeTabId) {
+      if (activeTabId !== null && activeTabId !== previousActiveTabId) {
+        activationSeqByTabId.set(activeTabId, nextActivationSeq)
+        nextActivationSeq += 1
+      }
+      previousActiveTabId = activeTabId
+    },
+    getActivationSeq(tabId) {
+      return activationSeqByTabId.get(tabId)
+    },
+    retainTabIds(liveTabIds) {
+      if (previousActiveTabId !== null && !liveTabIds.has(previousActiveTabId)) {
+        previousActiveTabId = null
+      }
+      for (const tabId of Array.from(activationSeqByTabId.keys())) {
+        if (!liveTabIds.has(tabId)) {
+          activationSeqByTabId.delete(tabId)
+        }
+      }
+    }
+  }
+}
diff --git a/src/renderer/src/components/terminal-pane/terminal-tab-park-candidates.ts b/src/renderer/src/components/terminal-pane/terminal-tab-park-candidates.ts
new file mode 100644
index 00000000000..cb0e357b280
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-tab-park-candidates.ts
@@ -0,0 +1,43 @@
+/** Builds the stateful per-tab cold-park candidate list. */
+import type { TerminalTab } from '../../../../shared/types'
+import type { TerminalTabColdParkCandidate } from './terminal-hidden-view-parking'
+import type { TerminalTabActivationOrder } from './terminal-tab-activation-order'
+
+export function buildTerminalTabColdParkCandidates(args: {
+  terminalTabs: readonly TerminalTab[]
+  assignments: ReadonlyMap<string, { isActiveInGroup: boolean }>
+  isWorktreeActive: boolean
+  activeTerminalTabId: string | null
+  portalTabIds: ReadonlySet<string>
+  shouldMeasureHiddenWorktree: boolean
+  hiddenSinceByTabId: Map<string, number>
+  activationOrder: TerminalTabActivationOrder
+  nowMs: number
+}): TerminalTabColdParkCandidate[] {
+  args.activationOrder.recordActiveTabId(args.isWorktreeActive ? args.activeTerminalTabId : null)
+  const visibleTabIds = new Set<string>()
+  for (const terminalTab of args.terminalTabs) {
+    if (args.isWorktreeActive && args.assignments.get(terminalTab.id)?.isActiveInGroup === true) {
+      visibleTabIds.add(terminalTab.id)
+    }
+  }
+  return args.terminalTabs.map((terminalTab) => {
+    const isVisible = visibleTabIds.has(terminalTab.id)
+    const hasActivityTerminalPortal = args.portalTabIds.has(terminalTab.id)
+    // Why: measure probes need mounted panes without restarting the park clock.
+    if (isVisible || hasActivityTerminalPortal) {
+      args.hiddenSinceByTabId.delete(terminalTab.id)
+    } else if (!args.shouldMeasureHiddenWorktree && !args.hiddenSinceByTabId.has(terminalTab.id)) {
+      args.hiddenSinceByTabId.set(terminalTab.id, args.nowMs)
+    }
+    return {
+      id: terminalTab.id,
+      ptyId: terminalTab.ptyId,
+      pendingActivationSpawn: terminalTab.pendingActivationSpawn,
+      isVisible,
+      hasActivityTerminalPortal,
+      hiddenSinceMs: args.hiddenSinceByTabId.get(terminalTab.id) ?? null,
+      lastActivatedSeq: args.activationOrder.getActivationSeq(terminalTab.id)
+    }
+  })
+}
diff --git a/src/renderer/src/components/terminal-pane/terminal-url-link-click.test.ts b/src/renderer/src/components/terminal-pane/terminal-url-link-click.test.ts
index 0461474dedd..c654363d4c8 100644
--- a/src/renderer/src/components/terminal-pane/terminal-url-link-click.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-url-link-click.test.ts
@@ -494,6 +494,7 @@ describe('hard-wrapped terminal HTTP clicks', () => {
       getLinkActionContext: () => ({
         paneId: 1,
         pointerGesture: { canRequestAction: () => true, dispose: vi.fn() },
+        claimPtyMouse: vi.fn(() => true),
         request,
         focusTerminal: vi.fn()
       })
diff --git a/src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.ts b/src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.ts
index c28ae97824c..fad5301c804 100644
--- a/src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.ts
@@ -4,7 +4,10 @@ import { buildEdgeWrappedHttpLogicalLineCandidates } from './edge-wrapped-termin
 import { buildHardWrappedHttpLogicalLineCandidates } from './hard-wrapped-terminal-http-links'
 import { dedupeLogicalLines } from './terminal-file-link-hit-testing'
 import { isTerminalHttpLinkActivation } from './terminal-http-link-activation'
-import { installTerminalLinkPtyMouseSuppression } from './terminal-link-pty-mouse-suppression'
+import {
+  installTerminalLinkPtyMouseSuppression,
+  type TerminalLinkPtyMouseSuppression
+} from './terminal-link-pty-mouse-suppression'
 import { getTerminalBufferPositionForMouseEvent } from './terminal-mouse-buffer-position'
 import { extractTerminalHttpLinks } from './terminal-http-url-extraction'
 import { buildWrappedLogicalLine, rangeForParsedFileLink } from './wrapped-terminal-link-ranges'
@@ -39,6 +42,10 @@ type UrlLinkClickFallbackDeps = {
   getActionDestinations?: () => TerminalHttpLinkActionDestinations
 }
 
+export type HttpLinkClickFallbackBinding = IDisposable & {
+  ptyMouseSuppression: TerminalLinkPtyMouseSuppression
+}
+
 export type TerminalHttpLinkDestination = 'orca' | 'system'
 
 export type TerminalHttpLinkActionDestinations = {
@@ -65,7 +72,7 @@ export function handleTerminalHttpLink(
 ): boolean {
   if (isTerminalHttpLinkActivation(event)) {
     const forceDestination = event?.shiftKey
-      ? deps.actionDestinations?.alternate
+      ? (deps.actionDestinations?.alternate ?? deps.actionDestinations?.primary)
       : deps.actionDestinations?.primary
     openTerminalHttpLink(url, {
       ...deps,
@@ -154,8 +161,8 @@ export function findHttpLinkAtTerminalMouseEvent(
 export function installHttpLinkClickFallback(
   terminal: Terminal,
   deps: UrlLinkClickFallbackDeps
-): IDisposable {
-  const ptyMouseSuppression = installTerminalLinkPtyMouseSuppression(terminal, (event) => {
+): HttpLinkClickFallbackBinding {
+  const isLinkMouseEvent = (event: MouseEvent): boolean => {
     if (isTerminalLinkifierHoverActive(terminal)) {
       return true
     }
@@ -163,7 +170,16 @@ export function installHttpLinkClickFallback(
     return Boolean(
       position && findHttpLinkAtBufferPosition(terminal.buffer.active, position, terminal.cols)
     )
-  })
+  }
+  const ptyMouseSuppression = installTerminalLinkPtyMouseSuppression(
+    terminal,
+    isLinkMouseEvent,
+    (event) => {
+      const context = deps.getLinkActionContext?.()
+      return Boolean(context?.pointerGesture.canRequestAction(event) && isLinkMouseEvent(event))
+    },
+    (event) => Boolean(deps.getLinkActionContext?.()?.pointerGesture.canRequestAction(event))
+  )
   const handleMouseUp = (event: MouseEvent): void => {
     if (!isDesktopHttpLinkFallbackActivation(event)) {
       return
@@ -190,6 +206,7 @@ export function installHttpLinkClickFallback(
   const terminalElement = terminal.element
   terminalElement?.addEventListener('mouseup', handleMouseUp)
   return {
+    ptyMouseSuppression,
     dispose: () => {
       ptyMouseSuppression.dispose()
       terminalElement?.removeEventListener('mouseup', handleMouseUp)
@@ -256,11 +273,11 @@ function rangeContainsBufferPosition(
 }
 
 export function openTerminalHttpLink(url: string, deps: UrlLinkHitTestDeps): void {
-  // Why: Orca browser tabs are local-only, so a link clicked in a runtime-hosted
-  // pane must be classified by its pane's host, not the global active runtime.
+  // Why: pane ownership beats the global active runtime for both local and remote routes.
   const sourceOwner = deps.sourceOwner ?? { kind: 'local' }
   if (deps.forceDestination) {
     openHttpLink(url, {
+      allowRuntimeInApp: true,
       worktreeId: deps.worktreeId,
       forceInApp: deps.forceDestination === 'orca',
       forceSystemBrowser: deps.forceDestination === 'system',
@@ -271,16 +288,20 @@ export function openTerminalHttpLink(url: string, deps: UrlLinkHitTestDeps): voi
   if (deps.modifierHeld) {
     // Why: the modifier states a destination outright, so it also skips the
     // one-time routing prompt; openHttpLink resolves which destination it means.
-    openHttpLink(url, { worktreeId: deps.worktreeId, modifierHeld: true, sourceOwner })
+    openHttpLink(url, {
+      allowRuntimeInApp: true,
+      worktreeId: deps.worktreeId,
+      modifierHeld: true,
+      sourceOwner
+    })
     return
   }
 
-  // Why: a runtime-hosted link can only reach the system browser, so prompting
-  // would persist an in-app preference this click cannot honor.
+  // Why: remote panes use the persisted routing preference and never prompt the viewing client.
   const preferenceDecision =
     sourceOwner.kind === 'local' ? deps.requestOpenLinksInAppPreference?.(url) : null
   if (preferenceDecision === null || preferenceDecision === undefined) {
-    openHttpLink(url, { worktreeId: deps.worktreeId, sourceOwner })
+    openHttpLink(url, { allowRuntimeInApp: true, worktreeId: deps.worktreeId, sourceOwner })
     return
   }
 
@@ -290,12 +311,18 @@ export function openTerminalHttpLink(url: string, deps: UrlLinkHitTestDeps): voi
   void Promise.resolve(preferenceDecision)
     .then((openInOrca) => {
       openHttpLink(url, {
+        allowRuntimeInApp: true,
         worktreeId: deps.worktreeId,
         forceSystemBrowser: !openInOrca,
         sourceOwner
       })
     })
     .catch(() => {
-      openHttpLink(url, { worktreeId: deps.worktreeId, forceSystemBrowser: true, sourceOwner })
+      openHttpLink(url, {
+        allowRuntimeInApp: true,
+        worktreeId: deps.worktreeId,
+        forceSystemBrowser: true,
+        sourceOwner
+      })
     })
 }
diff --git a/src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts b/src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts
index 441e532dd2e..3b198054861 100644
--- a/src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts
@@ -23,8 +23,6 @@ vi.mock('./pane-helpers', () => ({
 }))
 const scheduleTabRevealWebglAtlasRecovery = vi.fn()
 vi.mock('./terminal-webgl-atlas-recovery', () => ({
-  // Why: the light-tab reveal must recover the atlas immediately, decoupled from
-  // the terminal-output debounce (which a background stream could otherwise defer).
   scheduleTabRevealWebglAtlasRecovery: () => scheduleTabRevealWebglAtlasRecovery()
 }))
 const flushDeferredPaneMetricOptionsIfMeasurable = vi.fn((_pane: unknown) => false)
@@ -90,8 +88,6 @@ describe('resumeTerminalVisibility reveal repaint', () => {
 
     expect(manager.scheduleRevealRepaint).toHaveBeenCalledTimes(1)
     expect(manager.resumeRendering).not.toHaveBeenCalled()
-    // Reveal recovery is immediate (not the terminal-output debounce), so a
-    // background stream in another pane cannot defer this tab's atlas rebuild.
     expect(scheduleTabRevealWebglAtlasRecovery).toHaveBeenCalledTimes(1)
   })
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-visibility-resume.ts b/src/renderer/src/components/terminal-pane/terminal-visibility-resume.ts
index 0933bbd47bd..ee86edeba18 100644
--- a/src/renderer/src/components/terminal-pane/terminal-visibility-resume.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-visibility-resume.ts
@@ -88,9 +88,7 @@ export function resumeTerminalVisibility({
       // overlay's delayed geometry fit. Still request hidden-output recovery:
       // agent TUIs can suppress hidden bytes until the pane is foregrounded.
       requestLightTabBacklogRecovery(manager)
-      // Why: reveal recovery must be immediate, not the terminal-output debounce
-      // — a background agent streaming in another pane must not defer this tab's
-      // atlas rebuild.
+      // Why: reveal is the lifecycle boundary that owns hidden renderer repair.
       scheduleTabRevealWebglAtlasRecovery()
       if (flushedDeferredMetrics) {
         // Why: the light path normally skips fitting, but flushed metrics changed
@@ -133,8 +131,7 @@ export function hideTerminalVisibility({
     captureViewportPositions(false)
   }
   if (!isWorktreeActive && (wasVisible || surfaceBecameHidden)) {
-    // Suspend WebGL when going hidden. xterm.write() continues to land in the
-    // DOM-renderer fallback terminal; the suspend is purely a GPU resource decision.
+    // xterm.write() keeps updating the hidden buffer; suspension only changes renderer lifetime.
     manager.suspendRendering()
     return { hiddenReason: 'surface', renderingSuspended: true }
   }
diff --git a/src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery-rate.test.ts b/src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery-rate.test.ts
deleted file mode 100644
index 4add011e474..00000000000
--- a/src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery-rate.test.ts
+++ /dev/null
@@ -1,220 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import {
-  registerLivePaneManager,
-  unregisterLivePaneManager
-} from '@/lib/pane-manager/pane-manager-registry'
-import { setTerminalWebglDiagnosticRecorder } from '../../../../shared/terminal-webgl-diagnostics'
-import {
-  resetTerminalWebglAtlasRecoveryBudgetForTesting,
-  scheduleImagePasteWebglAtlasRecovery,
-  scheduleTabRevealWebglAtlasRecovery,
-  scheduleTerminalWebglAtlasRecovery,
-  TERMINAL_OUTPUT_RECOVERY_QUIET_MS
-} from './terminal-webgl-atlas-recovery'
-
-describe('terminal WebGL atlas recovery rate', () => {
-  const managers: { resetWebglTextureAtlases(): void }[] = []
-
-  function registerManager() {
-    const manager = {
-      resetWebglTextureAtlases: vi.fn(),
-      refreshAllPanes: vi.fn(),
-      scheduleRevealPresent: vi.fn()
-    }
-    registerLivePaneManager(manager)
-    managers.push(manager)
-    return manager
-  }
-
-  function useImmediateAnimationFrames(): void {
-    vi.stubGlobal(
-      'requestAnimationFrame',
-      vi.fn((callback: FrameRequestCallback) => {
-        callback(0)
-        return 1
-      })
-    )
-  }
-
-  afterEach(() => {
-    for (const manager of managers.splice(0)) {
-      unregisterLivePaneManager(manager)
-    }
-    setTerminalWebglDiagnosticRecorder(null)
-    resetTerminalWebglAtlasRecoveryBudgetForTesting()
-    vi.clearAllTimers()
-    vi.useRealTimers()
-    vi.unstubAllGlobals()
-  })
-
-  it('caps atlas wipes under a sustained redraw cadence', () => {
-    vi.useFakeTimers()
-    vi.setSystemTime(0)
-    useImmediateAnimationFrames()
-    const wipeTimes: number[] = []
-    const manager = {
-      resetWebglTextureAtlases: vi.fn(() => wipeTimes.push(Date.now())),
-      refreshAllPanes: vi.fn(),
-      scheduleRevealPresent: vi.fn()
-    }
-    registerLivePaneManager(manager)
-    managers.push(manager)
-
-    for (let elapsed = 0; elapsed < 300_000; elapsed += 300) {
-      scheduleTerminalWebglAtlasRecovery()
-      vi.advanceTimersByTime(300)
-    }
-
-    expect(wipeTimes.length).toBeGreaterThan(1)
-    const gaps = wipeTimes.slice(1).map((at, index) => at - wipeTimes[index]!)
-    expect(wipeTimes.length).toBeLessThanOrEqual(75)
-    expect(Math.max(...gaps)).toBeLessThanOrEqual(6_500)
-    expect(Date.now() - wipeTimes.at(-1)!).toBeLessThanOrEqual(6_500)
-
-    const streamEndedAt = Date.now()
-    const wipesBeforeTailRepair = wipeTimes.length
-    vi.advanceTimersByTime(6_500)
-    expect(wipeTimes).toHaveLength(wipesBeforeTailRepair + 1)
-    expect(wipeTimes.at(-1)! - streamEndedAt).toBeLessThanOrEqual(6_500)
-  })
-
-  it('cancels pending settle and deferred repair timers when recovery state resets', () => {
-    vi.useFakeTimers()
-    vi.setSystemTime(0)
-    useImmediateAnimationFrames()
-    const manager = registerManager()
-
-    scheduleTerminalWebglAtlasRecovery()
-    resetTerminalWebglAtlasRecoveryBudgetForTesting()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-
-    expect(manager.resetWebglTextureAtlases).not.toHaveBeenCalled()
-    expect(manager.scheduleRevealPresent).not.toHaveBeenCalled()
-
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    resetTerminalWebglAtlasRecoveryBudgetForTesting()
-    vi.advanceTimersByTime(3_000)
-
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledOnce()
-    expect(manager.scheduleRevealPresent).toHaveBeenCalledOnce()
-  })
-
-  it('presents a suppressed wipe and cancels its repair while output resumes', () => {
-    vi.useFakeTimers()
-    vi.setSystemTime(0)
-    useImmediateAnimationFrames()
-    const manager = registerManager()
-
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledOnce()
-    expect(manager.scheduleRevealPresent).toHaveBeenCalledOnce()
-
-    for (let elapsed = 0; elapsed < 3_000; elapsed += 50) {
-      scheduleTerminalWebglAtlasRecovery()
-      vi.advanceTimersByTime(50)
-    }
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledOnce()
-
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(2)
-  })
-
-  it('repairs the final suppressed settle when the budget becomes available', () => {
-    vi.useFakeTimers()
-    vi.setSystemTime(0)
-    useImmediateAnimationFrames()
-    const manager = registerManager()
-
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    vi.advanceTimersByTime(2_799)
-
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledOnce()
-    vi.advanceTimersByTime(1)
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(2)
-  })
-
-  it('reports suppressed reset counts on the next permitted wipe', () => {
-    vi.useFakeTimers()
-    vi.setSystemTime(0)
-    useImmediateAnimationFrames()
-    registerManager()
-    const diagnostics: { kind: string; detail?: Record<string, unknown> }[] = []
-    setTerminalWebglDiagnosticRecorder((kind, detail) => diagnostics.push({ kind, detail }))
-
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    vi.advanceTimersByTime(2_600)
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-
-    expect(diagnostics.filter(({ kind }) => kind === 'webgl-atlas-reset-rate')).toEqual([
-      {
-        kind: 'webgl-atlas-reset-rate',
-        detail: {
-          reason: 'terminal-output',
-          attemptsSinceLastReset: 1,
-          atlasResetsSuppressed: 0,
-          intervalMs: 0
-        }
-      },
-      {
-        kind: 'webgl-atlas-reset-rate',
-        detail: {
-          reason: 'terminal-output',
-          attemptsSinceLastReset: 2,
-          atlasResetsSuppressed: 1,
-          intervalMs: 3_000
-        }
-      }
-    ])
-  })
-
-  it('recovers when the wall clock steps backwards', () => {
-    vi.useFakeTimers()
-    vi.setSystemTime(600_000)
-    useImmediateAnimationFrames()
-    const manager = registerManager()
-
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    vi.setSystemTime(60_000)
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(2)
-  })
-
-  it('keeps one-shot paste and reveal recovery outside the streaming budget', () => {
-    vi.useFakeTimers()
-    vi.setSystemTime(0)
-    useImmediateAnimationFrames()
-    const manager = registerManager()
-
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    scheduleTerminalWebglAtlasRecovery()
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    manager.resetWebglTextureAtlases.mockClear()
-
-    scheduleTabRevealWebglAtlasRecovery()
-    vi.advanceTimersByTime(500)
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(3)
-
-    manager.resetWebglTextureAtlases.mockClear()
-    scheduleImagePasteWebglAtlasRecovery()
-    vi.advanceTimersByTime(500)
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(3)
-  })
-})
diff --git a/src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts b/src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts
index 69d5df93f3d..80013abb860 100644
--- a/src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts
@@ -3,13 +3,10 @@ import {
   registerLivePaneManager,
   unregisterLivePaneManager
 } from '@/lib/pane-manager/pane-manager-registry'
-import {
-  resetTerminalWebglAtlasRecoveryBudgetForTesting,
-  scheduleImagePasteWebglAtlasRecovery,
-  scheduleTabRevealWebglAtlasRecovery,
-  scheduleTerminalWebglAtlasRecovery,
-  TERMINAL_OUTPUT_RECOVERY_QUIET_MS
-} from './terminal-webgl-atlas-recovery'
+import * as terminalWebglAtlasRecovery from './terminal-webgl-atlas-recovery'
+
+const { scheduleImagePasteWebglAtlasRecovery, scheduleTabRevealWebglAtlasRecovery } =
+  terminalWebglAtlasRecovery
 
 describe('terminal WebGL atlas recovery', () => {
   const registeredManagers: { resetWebglTextureAtlases(): void }[] = []
@@ -33,12 +30,15 @@ describe('terminal WebGL atlas recovery', () => {
     for (const manager of registeredManagers.splice(0)) {
       unregisterLivePaneManager(manager)
     }
-    resetTerminalWebglAtlasRecoveryBudgetForTesting()
     vi.clearAllTimers()
     vi.useRealTimers()
     vi.unstubAllGlobals()
   })
 
+  it('limits atlas recovery to explicit renderer lifecycle events', () => {
+    expect(terminalWebglAtlasRecovery).not.toHaveProperty('scheduleTerminalWebglAtlasRecovery')
+  })
+
   it('clears atlases and refreshes panes through the post-paste redraw window', () => {
     vi.useFakeTimers()
     const rafCallbacks: FrameRequestCallback[] = []
@@ -152,10 +152,7 @@ describe('terminal WebGL atlas recovery', () => {
     expect(manager.refreshAllPanes).not.toHaveBeenCalled()
   })
 
-  it('recovers immediately on a tab reveal, not through the streaming debounce', () => {
-    // Regression guard (STA-1365 review): reveal recovery must stay immediate so a
-    // background agent streaming in another pane cannot defer a revealed tab's
-    // atlas rebuild. It shares the paste path's immediate burst, not the debounce.
+  it('recovers immediately on a tab reveal', () => {
     vi.useFakeTimers()
     const rafCallbacks: FrameRequestCallback[] = []
     vi.stubGlobal(
@@ -168,7 +165,6 @@ describe('terminal WebGL atlas recovery', () => {
     const manager = registerManager()
 
     scheduleTabRevealWebglAtlasRecovery()
-    // First burst leg fires on the next frame — no 200ms debounce wait.
     rafCallbacks[0]?.(0)
     expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(1)
     expect(manager.refreshAllPanes).toHaveBeenCalledTimes(1)
@@ -177,142 +173,4 @@ describe('terminal WebGL atlas recovery', () => {
     expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(3)
     expect(manager.refreshAllPanes).toHaveBeenCalledTimes(3)
   })
-
-  it('does not recover mid-stream while terminal output keeps arriving', () => {
-    // Regression (STA-1365): an alternate-screen TUI requests atlas recovery on
-    // every redraw frame. Recovering mid-stream clears the shared glyph atlas and
-    // repaints every pane several times a second, which reads as a flicker. The
-    // debounce must swallow a sustained stream entirely until it goes quiet.
-    vi.useFakeTimers()
-    vi.stubGlobal(
-      'requestAnimationFrame',
-      vi.fn((callback: FrameRequestCallback) => {
-        callback(0)
-        return 1
-      })
-    )
-    const manager = registerManager()
-
-    // Simulate ~1s of continuous streaming: a redraw chunk every 50ms, each
-    // shorter than the quiet window, so the debounce keeps resetting.
-    for (let elapsed = 0; elapsed < 1000; elapsed += 50) {
-      scheduleTerminalWebglAtlasRecovery()
-      vi.advanceTimersByTime(50)
-    }
-
-    expect(manager.resetWebglTextureAtlases).not.toHaveBeenCalled()
-    expect(manager.refreshAllPanes).not.toHaveBeenCalled()
-  })
-
-  it('recovers exactly once after terminal output settles, not a 3-stage burst', () => {
-    // Brennan-approved single-recovery decision: the streaming settle fires one
-    // clear+refresh, not the rAF+120+500 burst, so a clear can only ever land
-    // after 200ms of global quiet. Advancing past the burst delays must add no
-    // further fires on the streaming path.
-    vi.useFakeTimers()
-    vi.stubGlobal(
-      'requestAnimationFrame',
-      vi.fn((callback: FrameRequestCallback) => {
-        callback(0)
-        return 1
-      })
-    )
-    const manager = registerManager()
-
-    scheduleTerminalWebglAtlasRecovery()
-    scheduleTerminalWebglAtlasRecovery()
-    scheduleTerminalWebglAtlasRecovery()
-
-    // Still nothing before the quiet window elapses.
-    vi.advanceTimersByTime(199)
-    expect(manager.resetWebglTextureAtlases).not.toHaveBeenCalled()
-
-    // Quiet window elapsed → exactly one clear+refresh for the coalesced stream.
-    vi.advanceTimersByTime(1)
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(1)
-    expect(manager.refreshAllPanes).toHaveBeenCalledTimes(1)
-
-    // The 120ms/500ms burst legs must NOT fire on the streaming path.
-    vi.advanceTimersByTime(120)
-    vi.advanceTimersByTime(380)
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(1)
-    expect(manager.refreshAllPanes).toHaveBeenCalledTimes(1)
-  })
-
-  it('does not clear mid-stream when a settle is followed by resumed streaming', () => {
-    // Cancelable invariant (STA-1365): a stream that pauses just over the quiet
-    // window lets the settle fire its single recovery during the gap, but the
-    // resumed chunks must not trigger any further clear while they keep arriving
-    // <200ms apart — the re-arm cancels the only pending handle (the debounce
-    // timer), so no clear lands mid-resumed-stream.
-    vi.useFakeTimers()
-    vi.stubGlobal(
-      'requestAnimationFrame',
-      vi.fn((callback: FrameRequestCallback) => {
-        callback(0)
-        return 1
-      })
-    )
-    const manager = registerManager()
-
-    // Initial stream, then a gap just over the quiet window → one settle recovery.
-    for (let elapsed = 0; elapsed < 300; elapsed += 50) {
-      scheduleTerminalWebglAtlasRecovery()
-      vi.advanceTimersByTime(50)
-    }
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(1)
-    expect(manager.refreshAllPanes).toHaveBeenCalledTimes(1)
-
-    // Resume streaming: fire-count must stay pinned while chunks keep arriving.
-    for (let elapsed = 0; elapsed < 1000; elapsed += 50) {
-      scheduleTerminalWebglAtlasRecovery()
-      vi.advanceTimersByTime(50)
-      expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(1)
-      expect(manager.refreshAllPanes).toHaveBeenCalledTimes(1)
-    }
-  })
-
-  it('coalesces the terminal-output callers onto one shared timer while paste stays immediate', () => {
-    // Cross-caller single-timer invariant: the terminal-output re-arm sites
-    // (foreground and hidden-output PTY writes) funnel through
-    // scheduleTerminalWebglAtlasRecovery and re-arm the one module-global debounce
-    // timer, so a single continuous stream (even a hidden one) keeps the recovery
-    // deferred for everyone. Image paste and tab reveal use their own immediate
-    // burst and are not coupled to the shared debounce timer.
-    vi.useFakeTimers()
-    const rafCallbacks: FrameRequestCallback[] = []
-    vi.stubGlobal(
-      'requestAnimationFrame',
-      vi.fn((callback: FrameRequestCallback) => {
-        rafCallbacks.push(callback)
-        return rafCallbacks.length
-      })
-    )
-    const manager = registerManager()
-
-    // The terminal-output re-arm sites (foreground / hidden-output) both funnel
-    // through this one function; none may fire mid-stream.
-    for (let elapsed = 0; elapsed < 600; elapsed += 50) {
-      scheduleTerminalWebglAtlasRecovery()
-      vi.advanceTimersByTime(50)
-    }
-    expect(manager.resetWebglTextureAtlases).not.toHaveBeenCalled()
-
-    // Global quiet → exactly one coalesced recovery for the whole shared stream.
-    vi.advanceTimersByTime(TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(1)
-    expect(manager.refreshAllPanes).toHaveBeenCalledTimes(1)
-
-    // Paste is independent: its own immediate 3-stage burst, not the shared timer.
-    manager.resetWebglTextureAtlases.mockClear()
-    manager.refreshAllPanes.mockClear()
-    scheduleImagePasteWebglAtlasRecovery()
-    rafCallbacks.at(-1)?.(0)
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(1)
-    vi.advanceTimersByTime(120)
-    vi.advanceTimersByTime(380)
-    expect(manager.resetWebglTextureAtlases).toHaveBeenCalledTimes(3)
-    expect(manager.refreshAllPanes).toHaveBeenCalledTimes(3)
-  })
 })
diff --git a/src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.ts b/src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.ts
index d7d54dc0995..72dc08e46c1 100644
--- a/src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.ts
@@ -1,29 +1,7 @@
-import {
-  presentAllTerminalPanesWithoutAtlasClear,
-  resetAndRefreshAllTerminalWebglAtlases
-} from '@/lib/pane-manager/pane-manager-registry'
-import { recordTerminalWebglDiagnostic } from '../../../../shared/terminal-webgl-diagnostics'
+import { resetAndRefreshAllTerminalWebglAtlases } from '@/lib/pane-manager/pane-manager-registry'
 
 const ATLAS_RECOVERY_DELAYS_MS = [120, 500]
 
-// Why: a streaming TUI requests output atlas recovery every frame; recovering
-// mid-stream clears the shared atlas and repaints every pane, which flickers
-// (STA-1365). Wait for output to go quiet so recovery runs once, on settle.
-export const TERMINAL_OUTPUT_RECOVERY_QUIET_MS = 200
-
-// Bound reset storms while preserving prompt recovery and steady repair attempts.
-const TERMINAL_OUTPUT_RECOVERY_MIN_INTERVAL_MS = 3_000
-const TERMINAL_OUTPUT_RECOVERY_BURST_WIPES = 10
-const TERMINAL_OUTPUT_RECOVERY_REFILL_INTERVAL_MS = 6_000
-
-let terminalOutputRecoveryDebounceTimer: ReturnType<typeof setTimeout> | null = null
-let terminalOutputRecoveryRetryTimer: ReturnType<typeof setTimeout> | null = null
-let terminalOutputRecoveryWipeTokens = TERMINAL_OUTPUT_RECOVERY_BURST_WIPES
-let terminalOutputRecoveryTokensRefilledAt: number | null = null
-let terminalOutputRecoveryLastWipeAt: number | null = null
-let terminalOutputRecoveryAttemptsSinceLastWipe = 0
-let terminalOutputRecoverySuppressedSinceLastWipe = 0
-
 function scheduleNextFrame(callback: () => void): void {
   if (typeof globalThis.requestAnimationFrame === 'function') {
     globalThis.requestAnimationFrame(callback)
@@ -42,14 +20,6 @@ function resetAtlasesAndRefreshPanes(reason: string): void {
   }
 }
 
-function presentPanesWithoutAtlasClear(): void {
-  try {
-    presentAllTerminalPanesWithoutAtlasClear()
-  } catch {
-    /* ignore - terminal pane may have unmounted after scheduling recovery */
-  }
-}
-
 function scheduleAtlasRecoveryBurst(reason: string): void {
   scheduleNextFrame(() => resetAtlasesAndRefreshPanes(reason))
   for (const delayMs of ATLAS_RECOVERY_DELAYS_MS) {
@@ -65,113 +35,7 @@ export function scheduleImagePasteWebglAtlasRecovery(): void {
 }
 
 export function scheduleTabRevealWebglAtlasRecovery(): void {
-  // Why: a tab reveal is one-shot, so recover immediately — decoupled from the
-  // streaming debounce so a background stream can't defer a revealed tab's rebuild.
+  // Why: a tab reveal is an explicit renderer lifecycle boundary where hidden
+  // GPU state can be stale; ordinary PTY output must not clear the shared atlas.
   scheduleAtlasRecoveryBurst('tab-reveal')
 }
-
-export function scheduleTerminalWebglAtlasRecovery(): void {
-  // Why: terminal-output recovery (foreground + hidden PTY writes). Trailing-edge
-  // debounce so a clear only ever runs after 200ms of quiet — never mid-stream;
-  // a resumed stream cancels the pending timer, so a pause-then-resume can't leak.
-  if (terminalOutputRecoveryDebounceTimer != null) {
-    globalThis.clearTimeout(terminalOutputRecoveryDebounceTimer)
-  }
-  if (terminalOutputRecoveryRetryTimer != null) {
-    globalThis.clearTimeout(terminalOutputRecoveryRetryTimer)
-    terminalOutputRecoveryRetryTimer = null
-  }
-  terminalOutputRecoveryDebounceTimer = globalThis.setTimeout(() => {
-    terminalOutputRecoveryDebounceTimer = null
-    terminalOutputRecoveryAttemptsSinceLastWipe += 1
-    const decision = consumeTerminalOutputRecoveryWipeBudget()
-    if (!decision.allowed) {
-      terminalOutputRecoverySuppressedSinceLastWipe += 1
-      presentPanesWithoutAtlasClear()
-      scheduleTerminalOutputRecoveryRetry(decision.retryAfterMs)
-      return
-    }
-    resetTerminalOutputAtlases(decision.intervalMs)
-  }, TERMINAL_OUTPUT_RECOVERY_QUIET_MS)
-}
-
-function scheduleTerminalOutputRecoveryRetry(delayMs: number): void {
-  terminalOutputRecoveryRetryTimer = globalThis.setTimeout(() => {
-    terminalOutputRecoveryRetryTimer = null
-    const decision = consumeTerminalOutputRecoveryWipeBudget()
-    if (!decision.allowed) {
-      scheduleTerminalOutputRecoveryRetry(decision.retryAfterMs)
-      return
-    }
-    resetTerminalOutputAtlases(decision.intervalMs)
-  }, delayMs)
-}
-
-function resetTerminalOutputAtlases(intervalMs: number): void {
-  recordTerminalWebglDiagnostic('webgl-atlas-reset-rate', {
-    reason: 'terminal-output',
-    attemptsSinceLastReset: terminalOutputRecoveryAttemptsSinceLastWipe,
-    atlasResetsSuppressed: terminalOutputRecoverySuppressedSinceLastWipe,
-    intervalMs
-  })
-  terminalOutputRecoveryAttemptsSinceLastWipe = 0
-  terminalOutputRecoverySuppressedSinceLastWipe = 0
-  resetAtlasesAndRefreshPanes('terminal-output')
-}
-
-export function resetTerminalWebglAtlasRecoveryBudgetForTesting(): void {
-  if (terminalOutputRecoveryDebounceTimer != null) {
-    globalThis.clearTimeout(terminalOutputRecoveryDebounceTimer)
-  }
-  terminalOutputRecoveryDebounceTimer = null
-  if (terminalOutputRecoveryRetryTimer != null) {
-    globalThis.clearTimeout(terminalOutputRecoveryRetryTimer)
-  }
-  terminalOutputRecoveryRetryTimer = null
-  terminalOutputRecoveryWipeTokens = TERMINAL_OUTPUT_RECOVERY_BURST_WIPES
-  terminalOutputRecoveryTokensRefilledAt = null
-  terminalOutputRecoveryLastWipeAt = null
-  terminalOutputRecoveryAttemptsSinceLastWipe = 0
-  terminalOutputRecoverySuppressedSinceLastWipe = 0
-}
-
-function refillTerminalOutputRecoveryWipeTokens(now: number): void {
-  const elapsedMs = now - (terminalOutputRecoveryTokensRefilledAt ?? now)
-  terminalOutputRecoveryTokensRefilledAt = now
-  // Sleep, NTP, and remote clock corrections must not wedge recovery.
-  if (elapsedMs < 0) {
-    terminalOutputRecoveryWipeTokens = TERMINAL_OUTPUT_RECOVERY_BURST_WIPES
-    terminalOutputRecoveryLastWipeAt = null
-    return
-  }
-  terminalOutputRecoveryWipeTokens = Math.min(
-    TERMINAL_OUTPUT_RECOVERY_BURST_WIPES,
-    terminalOutputRecoveryWipeTokens + elapsedMs / TERMINAL_OUTPUT_RECOVERY_REFILL_INTERVAL_MS
-  )
-}
-
-function consumeTerminalOutputRecoveryWipeBudget(): {
-  allowed: boolean
-  intervalMs: number
-  retryAfterMs: number
-} {
-  const now = Date.now()
-  refillTerminalOutputRecoveryWipeTokens(now)
-  const intervalMs =
-    terminalOutputRecoveryLastWipeAt == null ? 0 : now - terminalOutputRecoveryLastWipeAt
-  const intervalBudgetMs =
-    terminalOutputRecoveryLastWipeAt == null
-      ? 0
-      : Math.max(0, TERMINAL_OUTPUT_RECOVERY_MIN_INTERVAL_MS - intervalMs)
-  const tokenBudgetMs =
-    terminalOutputRecoveryWipeTokens >= 1
-      ? 0
-      : (1 - terminalOutputRecoveryWipeTokens) * TERMINAL_OUTPUT_RECOVERY_REFILL_INTERVAL_MS
-  const retryAfterMs = Math.ceil(Math.max(intervalBudgetMs, tokenBudgetMs))
-  if (retryAfterMs > 0) {
-    return { allowed: false, intervalMs, retryAfterMs }
-  }
-  terminalOutputRecoveryWipeTokens -= 1
-  terminalOutputRecoveryLastWipeAt = now
-  return { allowed: true, intervalMs, retryAfterMs: 0 }
-}
diff --git a/src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx b/src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx
new file mode 100644
index 00000000000..f3ea986601f
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx
@@ -0,0 +1,251 @@
+/** @vitest-environment happy-dom */
+import { act, StrictMode, useEffect } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalLayoutSnapshot, TerminalTab } from '../../../../shared/types'
+
+;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+
+const WORKTREE_ID = 'repo::/parked-watcher-sync'
+const TAB_ID = 'tab-1'
+const FIRST_LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const SECOND_LEAF_ID = '22222222-2222-4222-8222-222222222222'
+const FIRST_PTY_ID = `${WORKTREE_ID}@@session-1`
+const OLD_SECOND_PTY_ID = `${WORKTREE_ID}@@session-2`
+const NEW_SECOND_PTY_ID = `${WORKTREE_ID}@@session-3`
+
+const harness = vi.hoisted(() => ({
+  syncCalls: 0,
+  disposeCalls: 0,
+  reconciliationPtyReads: 0,
+  watchedPtyIds: new Set<string>()
+}))
+
+vi.mock('../../store', async () => {
+  const { create } = await import('zustand')
+  const useAppStore = create(() => ({
+    ptyIdsByTabId: {} as Record<string, string[]>,
+    runtimePaneTitlesByTabId: {} as Record<string, Record<number, string>>,
+    terminalLayoutsByTabId: {} as Record<string, TerminalLayoutSnapshot>
+  }))
+  return { useAppStore }
+})
+
+vi.mock('./terminal-parked-tab-watchers', async () => {
+  const { useAppStore } = await import('../../store')
+  return {
+    disposeParkedTerminalWatchersForWorktree: () => {
+      harness.disposeCalls += 1
+      harness.watchedPtyIds.clear()
+    },
+    syncParkedTerminalTabWatchers: (args: {
+      tabs: readonly TerminalTab[]
+      parkedTabIds: ReadonlySet<string>
+    }) => {
+      harness.syncCalls += 1
+      const state = useAppStore.getState()
+      harness.watchedPtyIds.clear()
+      for (const tab of args.tabs) {
+        if (!args.parkedTabIds.has(tab.id)) {
+          continue
+        }
+        const layoutPtyIds = Object.values(
+          state.terminalLayoutsByTabId[tab.id]?.ptyIdsByLeafId ?? {}
+        )
+        for (const ptyId of layoutPtyIds.length > 0 ? layoutPtyIds : [tab.ptyId]) {
+          if (ptyId) {
+            harness.watchedPtyIds.add(ptyId)
+          }
+        }
+      }
+    }
+  }
+})
+
+import { useAppStore } from '../../store'
+import { disposeParkedTerminalWatchersForWorktree } from './terminal-parked-tab-watchers'
+import {
+  captureParkedTerminalPaneCandidates,
+  capturedPanesByTabId
+} from './terminal-parked-watcher-registry'
+import { useParkedTerminalWatcherSynchronization } from './use-parked-terminal-watcher-synchronization'
+
+const terminalTabs = [{ id: TAB_ID, ptyId: FIRST_PTY_ID }] as TerminalTab[]
+const parkedTabIds = new Set([TAB_ID])
+const EMPTY_PARKED_TAB_IDS = new Set<string>()
+const firstUnparkedTabs = ['tab-a', 'tab-b', 'tab-c'].map(
+  (id) => ({ id, ptyId: `${WORKTREE_ID}@@${id}` }) as TerminalTab
+)
+const secondUnparkedTabs = ['tab-d', 'tab-e', 'tab-f'].map(
+  (id) => ({ id, ptyId: `${WORKTREE_ID}@@${id}` }) as TerminalTab
+)
+
+function splitLayout(secondPtyId: string): TerminalLayoutSnapshot {
+  return {
+    root: {
+      type: 'split',
+      direction: 'vertical',
+      first: { type: 'leaf', leafId: FIRST_LEAF_ID },
+      second: { type: 'leaf', leafId: SECOND_LEAF_ID }
+    },
+    activeLeafId: FIRST_LEAF_ID,
+    expandedLeafId: null,
+    ptyIdsByLeafId: {
+      [FIRST_LEAF_ID]: FIRST_PTY_ID,
+      [SECOND_LEAF_ID]: secondPtyId
+    }
+  }
+}
+
+function WatcherSynchronizationHarness(): null {
+  useParkedTerminalWatcherSynchronization({
+    worktreeId: WORKTREE_ID,
+    terminalTabs,
+    inputsKey: JSON.stringify([[TAB_ID, FIRST_PTY_ID, null]]),
+    assignmentsKey: JSON.stringify([[TAB_ID, 'group-1', false]]),
+    parkedTabIds
+  })
+  // Models the pre-fix sibling disposal effect that StrictMode replays after synchronization.
+  useEffect(() => () => disposeParkedTerminalWatchersForWorktree(WORKTREE_ID), [])
+  return null
+}
+
+function UnparkedWatcherSynchronizationHarness({
+  worktreeId,
+  tabs
+}: {
+  worktreeId: string
+  tabs: readonly TerminalTab[]
+}): null {
+  useParkedTerminalWatcherSynchronization({
+    worktreeId,
+    terminalTabs: tabs,
+    inputsKey: worktreeId,
+    assignmentsKey: worktreeId,
+    parkedTabIds: EMPTY_PARKED_TAB_IDS
+  })
+  return null
+}
+
+describe('parked terminal watcher synchronization', () => {
+  let container: HTMLDivElement
+  let root: Root | undefined
+
+  beforeEach(() => {
+    harness.syncCalls = 0
+    harness.disposeCalls = 0
+    harness.reconciliationPtyReads = 0
+    harness.watchedPtyIds.clear()
+    useAppStore.setState({
+      ptyIdsByTabId: { [TAB_ID]: [FIRST_PTY_ID, OLD_SECOND_PTY_ID] },
+      runtimePaneTitlesByTabId: { [TAB_ID]: { 1: 'active', 2: 'split' } },
+      terminalLayoutsByTabId: { [TAB_ID]: splitLayout(OLD_SECOND_PTY_ID) }
+    })
+    container = document.createElement('div')
+    document.body.appendChild(container)
+  })
+
+  afterEach(() => {
+    act(() => root?.unmount())
+    root = undefined
+    capturedPanesByTabId.delete(TAB_ID)
+    container.remove()
+  })
+
+  it('reinstates parked watchers after StrictMode effect replay cleanup', () => {
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <StrictMode>
+          <WatcherSynchronizationHarness />
+        </StrictMode>
+      )
+    })
+
+    expect(harness.disposeCalls).toBeGreaterThanOrEqual(1)
+    expect(harness.syncCalls).toBe(2)
+    expect(harness.watchedPtyIds).toEqual(new Set([FIRST_PTY_ID, OLD_SECOND_PTY_ID]))
+  })
+
+  it('resynchronizes a parked split when only its detached PTY and layout change', () => {
+    root = createRoot(container)
+    act(() => {
+      root?.render(<WatcherSynchronizationHarness />)
+    })
+    expect(harness.watchedPtyIds).toContain(OLD_SECOND_PTY_ID)
+
+    act(() => {
+      useAppStore.setState({
+        ptyIdsByTabId: { [TAB_ID]: [FIRST_PTY_ID, NEW_SECOND_PTY_ID] },
+        terminalLayoutsByTabId: { [TAB_ID]: splitLayout(NEW_SECOND_PTY_ID) }
+      })
+    })
+
+    expect(harness.syncCalls).toBe(2)
+    expect(harness.watchedPtyIds).toEqual(new Set([FIRST_PTY_ID, NEW_SECOND_PTY_ID]))
+
+    act(() => {
+      useAppStore.setState({
+        runtimePaneTitlesByTabId: { [TAB_ID]: { 1: '⠋ active', 2: 'new split title' } }
+      })
+    })
+    expect(harness.syncCalls).toBe(2)
+
+    act(() => {
+      useAppStore.setState({
+        terminalLayoutsByTabId: {
+          [TAB_ID]: { ...splitLayout(NEW_SECOND_PTY_ID), activeLeafId: SECOND_LEAF_ID }
+        }
+      })
+    })
+    expect(harness.syncCalls).toBe(3)
+
+    captureParkedTerminalPaneCandidates(TAB_ID, WORKTREE_ID, [
+      { ptyId: FIRST_PTY_ID, paneId: 10, leafId: FIRST_LEAF_ID, drivesTabTitle: false },
+      { ptyId: NEW_SECOND_PTY_ID, paneId: 11, leafId: SECOND_LEAF_ID, drivesTabTitle: true }
+    ])
+    act(() => {
+      root?.render(<WatcherSynchronizationHarness />)
+    })
+    expect(harness.syncCalls).toBe(4)
+  })
+
+  it('does not scan unparked worktrees on an unrelated store write', () => {
+    const capturedPaneGet = vi.spyOn(capturedPanesByTabId, 'get')
+    const ptyIdsByTabId = new Proxy({} as Record<string, string[]>, {
+      get(target, property, receiver) {
+        if (typeof property === 'string') {
+          harness.reconciliationPtyReads += 1
+        }
+        return Reflect.get(target, property, receiver)
+      }
+    })
+    useAppStore.setState({ ptyIdsByTabId })
+    root = createRoot(container)
+    act(() => {
+      root?.render(
+        <>
+          <UnparkedWatcherSynchronizationHarness
+            worktreeId="repo::/unparked-a"
+            tabs={firstUnparkedTabs}
+          />
+          <UnparkedWatcherSynchronizationHarness
+            worktreeId="repo::/unparked-b"
+            tabs={secondUnparkedTabs}
+          />
+        </>
+      )
+    })
+    harness.reconciliationPtyReads = 0
+    const syncCallsAfterMount = harness.syncCalls
+
+    act(() => {
+      useAppStore.setState({ sortEpoch: 1 })
+    })
+
+    expect(harness.reconciliationPtyReads).toBe(0)
+    expect(capturedPaneGet).not.toHaveBeenCalled()
+    expect(harness.syncCalls).toBe(syncCallsAfterMount)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.ts b/src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.ts
new file mode 100644
index 00000000000..1ee7ba8c2d0
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.ts
@@ -0,0 +1,167 @@
+import { useEffect, useRef } from 'react'
+import { useShallow } from 'zustand/react/shallow'
+import type { TerminalLayoutSnapshot, TerminalTab } from '../../../../shared/types'
+import { useAppStore } from '../../store'
+import {
+  disposeParkedTerminalWatchersForWorktree,
+  syncParkedTerminalTabWatchers
+} from './terminal-parked-tab-watchers'
+import { capturedPanesByTabId } from './terminal-parked-watcher-registry'
+
+type TerminalParkingAssignment = {
+  groupId: string
+  isActiveInGroup: boolean
+}
+
+const EMPTY_PTY_IDS: readonly string[] = []
+
+type WatcherReconciliationStoreInputs = readonly (
+  | readonly string[]
+  | TerminalLayoutSnapshot
+  | string
+  | null
+)[]
+
+const EMPTY_WATCHER_RECONCILIATION_INPUTS: WatcherReconciliationStoreInputs = Object.freeze([])
+
+export function getTerminalParkingInputsKey(terminalTabs: readonly TerminalTab[]): string {
+  return JSON.stringify(terminalTabs.map((tab) => [tab.id, tab.ptyId, tab.pendingActivationSpawn]))
+}
+
+export function getTerminalParkingAssignmentsKey(
+  assignments: ReadonlyMap<string, TerminalParkingAssignment>
+): string {
+  return JSON.stringify(
+    Array.from(assignments, ([tabId, assignment]) => [
+      tabId,
+      assignment.groupId,
+      assignment.isActiveInGroup
+    ])
+  )
+}
+
+function getWatcherSynchronizationKey(args: {
+  worktreeId: string
+  inputsKey: string
+  assignmentsKey: string
+  parkedTabIds: ReadonlySet<string>
+  activationDeferredMountTabIds?: ReadonlySet<string> | null
+  reconciliationKey: string
+}): string {
+  return JSON.stringify([
+    args.worktreeId,
+    args.inputsKey,
+    args.assignmentsKey,
+    Array.from(args.parkedTabIds),
+    Array.from(args.activationDeferredMountTabIds ?? []).sort(),
+    args.reconciliationKey
+  ])
+}
+
+function getCapturedPaneKey(terminalTabs: readonly TerminalTab[]): unknown[] {
+  return terminalTabs.map((tab) => {
+    const capture = capturedPanesByTabId.get(tab.id)
+    return [
+      tab.id,
+      capture?.worktreeId ?? null,
+      capture?.panes.map((pane) => [pane.ptyId, pane.paneId, pane.leafId, pane.drivesTabTitle]) ??
+        []
+    ]
+  })
+}
+
+function getWatcherReconciliationKey(
+  terminalTabs: readonly TerminalTab[],
+  inputs: WatcherReconciliationStoreInputs
+): string {
+  if (inputs.length === 0) {
+    return ''
+  }
+  const tabs = terminalTabs.map((tab, index) => {
+    const offset = index * 3
+    const ptyIds = inputs[offset] as readonly string[]
+    const layout = inputs[offset + 1] as TerminalLayoutSnapshot | null
+    const titleSlotKey = inputs[offset + 2] as string
+    return [
+      tab.id,
+      ptyIds,
+      layout?.root ?? null,
+      layout?.activeLeafId ?? null,
+      layout?.ptyIdsByLeafId ?? null,
+      titleSlotKey
+    ]
+  })
+  return JSON.stringify([tabs, getCapturedPaneKey(terminalTabs)])
+}
+
+export function useParkedTerminalWatcherSynchronization(args: {
+  worktreeId: string
+  terminalTabs: readonly TerminalTab[]
+  inputsKey: string
+  assignmentsKey: string
+  parkedTabIds: ReadonlySet<string>
+  activationDeferredMountTabIds?: ReadonlySet<string> | null
+}): void {
+  const {
+    worktreeId,
+    terminalTabs,
+    inputsKey,
+    assignmentsKey,
+    parkedTabIds,
+    activationDeferredMountTabIds
+  } = args
+  const reconciliationStoreInputs = useAppStore(
+    useShallow((state) =>
+      // Why: an empty committed park set has no live watcher state for store writes to reconcile.
+      parkedTabIds.size === 0
+        ? EMPTY_WATCHER_RECONCILIATION_INPUTS
+        : terminalTabs.flatMap((tab) => [
+            state.ptyIdsByTabId[tab.id] ?? EMPTY_PTY_IDS,
+            state.terminalLayoutsByTabId[tab.id] ?? null,
+            Object.keys(state.runtimePaneTitlesByTabId[tab.id] ?? {}).join(',')
+          ])
+    )
+  ) as WatcherReconciliationStoreInputs
+  const reconciliationKey = getWatcherReconciliationKey(terminalTabs, reconciliationStoreInputs)
+  const synchronizationKey = getWatcherSynchronizationKey({ ...args, reconciliationKey })
+  const synchronizationKeyRef = useRef<string | null>(null)
+
+  useEffect(
+    () => () => {
+      synchronizationKeyRef.current = null
+      disposeParkedTerminalWatchersForWorktree(worktreeId)
+    },
+    [worktreeId]
+  )
+
+  useEffect(() => {
+    if (synchronizationKeyRef.current === synchronizationKey) {
+      return
+    }
+    syncParkedTerminalTabWatchers({
+      worktreeId,
+      tabs: terminalTabs,
+      parkedTabIds,
+      // Why: activation-deferred tabs have no prior pane-owned title slot.
+      restoreTitleOnStartTabIds: activationDeferredMountTabIds ?? undefined
+    })
+    // Why: capture cleanup mutates the registry during commit; store its post-commit key.
+    synchronizationKeyRef.current = getWatcherSynchronizationKey({
+      worktreeId,
+      inputsKey,
+      assignmentsKey,
+      parkedTabIds,
+      activationDeferredMountTabIds,
+      reconciliationKey: getWatcherReconciliationKey(terminalTabs, reconciliationStoreInputs)
+    })
+  }, [
+    activationDeferredMountTabIds,
+    assignmentsKey,
+    inputsKey,
+    parkedTabIds,
+    reconciliationStoreInputs,
+    synchronizationKey,
+    terminalTabs,
+    worktreeId
+  ])
+}
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.ts
index f9a6e544193..9e9a63a94f2 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects.ts
@@ -168,18 +168,18 @@ export function useTerminalPaneGlobalEffects({
       hiddenReasonRef.current = null
       applyPendingFollowOutputRequests()
       return
-    } else {
-      const hiddenState = hideTerminalVisibility({
-        manager,
-        wasVisible,
-        wasWorktreeActive,
-        isWorktreeActive,
-        hasCompletedVisibleResume: hasCompletedVisibleResumeRef.current,
-        captureViewportPositions
-      })
-      renderingSuspendedByVisibilityRef.current = hiddenState.renderingSuspended
-      hiddenReasonRef.current = hiddenState.hiddenReason
     }
+    const hiddenState = hideTerminalVisibility({
+      manager,
+      wasVisible,
+      wasWorktreeActive,
+      isWorktreeActive,
+      hasCompletedVisibleResume: hasCompletedVisibleResumeRef.current,
+      captureViewportPositions
+    })
+    renderingSuspendedByVisibilityRef.current = hiddenState.renderingSuspended
+    hiddenReasonRef.current = hiddenState.hiddenReason
+
     wasVisibleRef.current = false
     wasWorktreeActiveRef.current = isWorktreeActive
     // eslint-disable-next-line react-hooks/exhaustive-deps
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts
index 74e53a0b6be..bc0582ca9fe 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts
@@ -9,6 +9,7 @@ import {
   resolvePaneLinkCwd,
   resolvePaneSeedCwd,
   resolveQueuedInitialCwd,
+  replayLayoutWithOneShotParkIntent,
   resetTerminalKeyboardProtocolAfterInterrupt,
   retireMountedTerminalPaneSurface,
   shouldDetachPaneTransportOnUnmount,
@@ -248,6 +249,35 @@ describe('splitPaneWithOneShotStartup', () => {
   })
 })
 
+describe('replayLayoutWithOneShotParkIntent', () => {
+  it('exposes park intent to replayed panes and clears it before later splits', () => {
+    const deps = { mountFollowsTerminalPark: true }
+    const observedByReplayedPane: boolean[] = []
+
+    const restored = replayLayoutWithOneShotParkIntent(deps, () => {
+      observedByReplayedPane.push(deps.mountFollowsTerminalPark)
+      return 'restored-panes'
+    })
+
+    expect(restored).toBe('restored-panes')
+    expect(observedByReplayedPane).toEqual([true])
+    // A split after replay reads the same deps object, so it must see ordinary reconnect semantics.
+    expect(deps.mountFollowsTerminalPark).toBe(false)
+  })
+
+  it('clears park intent even when layout replay throws', () => {
+    const deps = { mountFollowsTerminalPark: true }
+
+    expect(() =>
+      replayLayoutWithOneShotParkIntent(deps, () => {
+        throw new Error('replay failed')
+      })
+    ).toThrow('replay failed')
+
+    expect(deps.mountFollowsTerminalPark).toBe(false)
+  })
+})
+
 describe('applyTerminalScrollbackRowsToMountedPanes', () => {
   it('updates mounted pane xterm scrollback options only when needed', () => {
     const firstOptions = { scrollback: 1_000 }
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts
index 1b666e20a80..31928913df5 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts
@@ -32,7 +32,10 @@ import {
   getTerminalUrlOpenHint,
   installFilePathLinkClickFallback
 } from './terminal-link-handlers'
-import { terminalUrlOpenHintOptionsFor } from './terminal-link-open-hints'
+import {
+  terminalHttpLinkActionDestinationsFor,
+  terminalUrlOpenHintOptionsFor
+} from './terminal-link-open-hints'
 import { createTerminalHandleLinkProvider } from './terminal-handle-links'
 import type { LinkHandlerDeps } from './terminal-link-handlers'
 import { handleOscLink } from './terminal-osc-link-routing'
@@ -53,6 +56,7 @@ import {
   type HttpLinkSourceOwner
 } from '@/lib/http-link-routing'
 import { resolveTerminalHttpLinkSourceOwner } from './terminal-http-link-source-owner'
+import { canOpenWorkspaceBrowserTabOnRuntime } from '@/lib/workspace-browser-tab-open'
 import type {
   GlobalSettings,
   SetupSplitDirection,
@@ -126,6 +130,7 @@ import { markTerminalPinnedViewport } from '@/lib/pane-manager/terminal-scroll-i
 import { syncTerminalScrollIntentSoon } from '@/lib/pane-manager/terminal-scroll-intent-settle'
 import { registerRuntimeTerminalTab, scheduleRuntimeGraphSync } from '@/runtime/sync-runtime-graph'
 import { captureParkedTerminalPaneCandidates } from './terminal-parked-tab-watchers'
+import { useTerminalParkMountIntent } from './use-terminal-park-mount-intent'
 import { e2eConfig } from '@/lib/e2e-config'
 import {
   PRIMARY_SELECTION_MAX_LENGTH,
@@ -479,6 +484,19 @@ export function splitPaneWithOneShotStartup<TPane>(
   }
 }
 
+/** Scopes `deps.mountFollowsTerminalPark` to the restored-layout replay. */
+export function replayLayoutWithOneShotParkIntent<TRestored>(
+  deps: { mountFollowsTerminalPark: boolean },
+  replayLayout: () => TRestored
+): TRestored {
+  // Why: only panes reconstructed by this replay belong to the park reveal; later splits must use ordinary reconnect semantics.
+  try {
+    return replayLayout()
+  } finally {
+    deps.mountFollowsTerminalPark = false
+  }
+}
+
 export function shouldDetachPaneTransportOnUnmount(args: {
   tabStillExists: boolean
   tabId: string
@@ -661,6 +679,7 @@ export function useTerminalPaneLifecycle({
   const systemPrefersDarkRef = useRef(systemPrefersDark)
   systemPrefersDarkRef.current = systemPrefersDark
   const previousVisibleForReconcileRef = useRef<TerminalPaneVisibilitySnapshot | null>(null)
+  const mountFollowsTerminalPark = useTerminalParkMountIntent(tabId)
   const linkProviderDisposablesRef = useRef(new Map<number, IDisposable>())
   const terminalHandleLinkDisposablesRef = useRef(new Map<number, IDisposable>())
   const linkifierClickPrimingDisposablesRef = useRef(new Map<number, IDisposable>())
@@ -668,7 +687,9 @@ export function useTerminalPaneLifecycle({
     new Map<number, ReturnType<typeof installTerminalLinkPointerGesture>>()
   )
   const fileLinkClickFallbackDisposablesRef = useRef(new Map<number, IDisposable>())
-  const httpLinkClickFallbackDisposablesRef = useRef(new Map<number, IDisposable>())
+  const httpLinkClickFallbackDisposablesRef = useRef(
+    new Map<number, ReturnType<typeof installHttpLinkClickFallback>>()
+  )
   // Why: read settingsRef at fire time so toggling "copy on select" applies without recreating panes.
   const selectionDisposablesRef = useRef(new Map<number, IDisposable>())
   const selectionCaptureTimersRef = useRef(new Map<number, number>())
@@ -740,15 +761,24 @@ export function useTerminalPaneLifecycle({
       resolvePaneLinkCwd(paneCwdRef.current, paneId, startupCwd)
     const getHttpLinkSourceOwnerForPane = (paneId: number) =>
       resolveTerminalHttpLinkSourceOwner(paneTransportsRef.current.get(paneId))
+    const canOpenRuntimeBrowserForPane = (paneId: number): boolean => {
+      const sourceOwner = getHttpLinkSourceOwnerForPane(paneId)
+      return (
+        sourceOwner.kind === 'runtime' &&
+        canOpenWorkspaceBrowserTabOnRuntime(
+          useAppStore.getState(),
+          worktreeId,
+          sourceOwner.runtimeEnvironmentId
+        )
+      )
+    }
     const getHttpLinkActionDestinations = (paneId: number): TerminalHttpLinkActionDestinations => {
       const sourceOwner = getHttpLinkSourceOwnerForPane(paneId)
-      if (sourceOwner.kind !== 'local') {
-        return { primary: 'system' }
-      }
-      const options = terminalUrlOpenHintOptionsFor(settingsRef.current, sourceOwner)
-      return options.openLinksInApp
-        ? { primary: 'orca', alternate: 'system' }
-        : { primary: 'system', alternate: 'orca' }
+      return terminalHttpLinkActionDestinationsFor(
+        settingsRef.current,
+        sourceOwner,
+        canOpenRuntimeBrowserForPane(paneId)
+      )
     }
     const getLinkActionContext = (paneId: number): TerminalLinkActionContext | null => {
       if (settingsRef.current?.terminalLinkActionPopoverEnabled === false) {
@@ -756,12 +786,14 @@ export function useTerminalPaneLifecycle({
       }
       const pane = managerRef.current?.getPanes().find((candidate) => candidate.id === paneId)
       const pointerGesture = linkPointerGestures.get(paneId)
-      if (!pane || !pointerGesture) {
+      const ptyMouseSuppression = httpLinkClickFallbackDisposables.get(paneId)?.ptyMouseSuppression
+      if (!pane || !pointerGesture || !ptyMouseSuppression) {
         return null
       }
       return {
         paneId,
         pointerGesture,
+        claimPtyMouse: ptyMouseSuppression.claimAction,
         request: requestTerminalLinkAction,
         focusTerminal: () => pane.terminal.focus()
       }
@@ -837,6 +869,7 @@ export function useTerminalPaneLifecycle({
       worktreeId,
       cwd: startupCwd,
       startup: startupWithSetupSplitWait,
+      mountFollowsTerminalPark,
       paneTransportsRef,
       paneMode2031Ref,
       paneKittyKeyboardModesRef,
@@ -867,10 +900,18 @@ export function useTerminalPaneLifecycle({
       setCacheTimerStartedAt,
       syncPanePtyLayoutBinding,
       clearExitedPanePtyLayoutBinding,
-      // Why: record the main-answered 2031 subscribe in the CSI handler's registries, else theme flips never push CSI 997.
-      recordPaneMode2031Subscription: (paneId: number, repliedMode: 'dark' | 'light') => {
+      deferPtyInput: (paneId, data, forward) => {
+        const suppression = httpLinkClickFallbackDisposables.get(paneId)?.ptyMouseSuppression
+        if (!suppression) {
+          forward(data)
+          return
+        }
+        suppression.handlePtyInput(data, forward)
+      },
+      // Why: record the fact-observed 2031 subscribe in the pane registries, else theme flips never push CSI 997.
+      recordPaneMode2031Subscription: (paneId: number, subscribedMode: 'dark' | 'light') => {
         paneMode2031Ref.current.set(paneId, true)
-        paneLastThemeModeRef.current.set(paneId, repliedMode)
+        paneLastThemeModeRef.current.set(paneId, subscribedMode)
       },
       restoredPtyIdByLeafId: initialLayoutRef.current.ptyIdsByLeafId ?? {}
     }
@@ -889,7 +930,8 @@ export function useTerminalPaneLifecycle({
       getTerminalUrlOpenHint({
         ...terminalUrlOpenHintOptionsFor(
           settingsRef.current,
-          getHttpLinkSourceOwnerForPane(paneId)
+          getHttpLinkSourceOwnerForPane(paneId),
+          canOpenRuntimeBrowserForPane(paneId)
         ),
         showActions: settingsRef.current?.terminalLinkActionPopoverEnabled !== false
       })
@@ -1549,7 +1591,9 @@ export function useTerminalPaneLifecycle({
       window.__paneManagers = window.__paneManagers ?? new Map()
       window.__paneManagers.set(tabId, manager)
     }
-    const restoredPaneByLeafId = replayTerminalLayout(manager, initialLayoutRef.current, isActive)
+    const restoredPaneByLeafId = replayLayoutWithOneShotParkIntent(ptyDeps, () =>
+      replayTerminalLayout(manager, initialLayoutRef.current, isActive)
+    )
 
     const restoredBuffers = initialLayoutRef.current.buffersByLeafId
     restoreScrollbackBuffers(
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.react185.test.tsx b/src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.react185.test.tsx
new file mode 100644
index 00000000000..7ab3ac8ae30
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.react185.test.tsx
@@ -0,0 +1,76 @@
+/** @vitest-environment happy-dom */
+import { StrictMode, act, useEffect } from 'react'
+import { createRoot } from 'react-dom/client'
+import { afterEach, describe, expect, it } from 'vitest'
+import { disposeParkedTabWatchers, parkedWatchersByTabId } from './terminal-parked-watcher-registry'
+import { useTerminalParkMountIntent } from './use-terminal-park-mount-intent'
+
+;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+
+const TAB_ID = 'strict-park-reveal'
+const observations: boolean[] = []
+
+function Child(): null {
+  const mountFollowsTerminalPark = useTerminalParkMountIntent(TAB_ID)
+  useEffect(() => {
+    observations.push(mountFollowsTerminalPark)
+  }, [mountFollowsTerminalPark])
+  return null
+}
+
+function Parent() {
+  useEffect(() => {
+    disposeParkedTabWatchers(TAB_ID)
+  }, [])
+  return <Child />
+}
+
+function parkTab(): void {
+  parkedWatchersByTabId.set(TAB_ID, {
+    worktreeId: 'wt-1',
+    tabPtyId: 'pty-1',
+    paneIdByPtyId: new Map([['pty-1', 1]]),
+    disposersByPtyId: new Map([['pty-1', () => {}]])
+  })
+}
+
+afterEach(() => {
+  observations.length = 0
+  disposeParkedTabWatchers(TAB_ID)
+})
+
+describe('useTerminalParkMountIntent', () => {
+  it('survives StrictMode effect replay after the parent disposes the watcher', () => {
+    parkTab()
+    const container = document.createElement('div')
+    const root = createRoot(container)
+
+    act(() => {
+      root.render(
+        <StrictMode>
+          <Parent />
+        </StrictMode>
+      )
+    })
+
+    expect(observations).toEqual([true, true])
+    act(() => root.unmount())
+  })
+
+  // Why: the lifecycle effect re-runs on cwd changes for the same component
+  // instance, so intent cached per instance would resupply a stale park reveal.
+  it('re-reads park intent when the same instance re-renders after disposal', () => {
+    parkTab()
+    const container = document.createElement('div')
+    const root = createRoot(container)
+
+    act(() => root.render(<Child />))
+    expect(observations).toEqual([true])
+
+    disposeParkedTabWatchers(TAB_ID)
+    act(() => root.render(<Child />))
+
+    expect(observations).toEqual([true, false])
+    act(() => root.unmount())
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.ts b/src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.ts
new file mode 100644
index 00000000000..dba51fcc8ea
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.ts
@@ -0,0 +1,9 @@
+import { isTerminalTabParked } from './terminal-parked-watcher-registry'
+
+// Why render time: the host effect that disposes the watcher runs after every
+// child render, so reading here — not at connect time — is what lets a reveal
+// remount still see the park. Caching it per instance would instead resupply a
+// stale reveal on later same-instance effect re-runs (cwd change).
+export function useTerminalParkMountIntent(tabId: string): boolean {
+  return isTerminalTabParked(tabId)
+}
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts b/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts
index 888f82237ee..783ff7af574 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts
@@ -6,7 +6,9 @@ import type { TerminalTab } from '../../../../shared/types'
 const mocks = vi.hoisted(() => ({
   storeState: {
     pendingStartupByTabId: {} as Record<string, unknown>,
+    ptyIdsByTabId: {} as Record<string, string[]>,
     runtimeStatusByEnvironmentId: new Map(),
+    runtimePaneTitlesByTabId: {} as Record<string, Record<number, string>>,
     settings: {} as Record<string, unknown>,
     terminalLayoutsByTabId: {} as Record<string, { ptyIdsByLeafId?: Record<string, string> }>,
     sleepingAgentSessionsByPaneKey: {} as Record<
@@ -72,6 +74,7 @@ function hookArgs(shouldMeasureHiddenWorktree: boolean) {
     terminalTabs: [terminalTab('tab-1'), terminalTab('tab-2')],
     assignments: new Map<string, { groupId: string; isActiveInGroup: boolean }>(),
     isWorktreeActive: false,
+    activeTerminalTabId: null as string | null,
     coldParkTerminalPanes: false,
     shouldMeasureHiddenWorktree,
     activityTerminalPortals: [],
@@ -95,6 +98,86 @@ describe('useTerminalTabColdParking measure-clock contract', () => {
     mocks.storeState.runtimeStatusByEnvironmentId = new Map()
   })
 
+  // Why: leaving a worktree gives every tab the same hidden time.
+  it('exempts the tab the worktree was left on when every tab hides in one pass', () => {
+    const assignments = new Map([
+      ['tab-1', { groupId: 'group-1', isActiveInGroup: false }],
+      ['tab-2', { groupId: 'group-1', isActiveInGroup: true }]
+    ])
+    const { result, rerender } = renderHook(
+      (args: ReturnType<typeof hookArgs> & { isWorktreeActive: boolean }) =>
+        useTerminalTabColdParking(args),
+      {
+        initialProps: {
+          ...hookArgs(false),
+          assignments,
+          isWorktreeActive: true,
+          activeTerminalTabId: 'tab-2'
+        }
+      }
+    )
+    expect(result.current.size).toBe(0)
+
+    act(() => {
+      rerender({
+        ...hookArgs(false),
+        assignments,
+        isWorktreeActive: false,
+        activeTerminalTabId: 'tab-2'
+      })
+    })
+    act(() => {
+      vi.advanceTimersByTime(TERMINAL_TAB_HOT_RETAIN_MS + 1)
+    })
+
+    expect(result.current).toEqual(new Set(['tab-1']))
+  })
+
+  it('records focused split changes when the visible tab set does not change', () => {
+    const assignments = new Map([
+      ['tab-1', { groupId: 'group-1', isActiveInGroup: true }],
+      ['tab-2', { groupId: 'group-2', isActiveInGroup: true }]
+    ])
+    const { result, rerender } = renderHook(
+      (
+        args: ReturnType<typeof hookArgs> & {
+          activeTerminalTabId: string | null
+          isWorktreeActive: boolean
+        }
+      ) => useTerminalTabColdParking(args),
+      {
+        initialProps: {
+          ...hookArgs(false),
+          assignments,
+          isWorktreeActive: true,
+          activeTerminalTabId: 'tab-1'
+        }
+      }
+    )
+
+    act(() => {
+      rerender({
+        ...hookArgs(false),
+        assignments,
+        isWorktreeActive: true,
+        activeTerminalTabId: 'tab-2'
+      })
+    })
+    act(() => {
+      rerender({
+        ...hookArgs(false),
+        assignments,
+        isWorktreeActive: false,
+        activeTerminalTabId: 'tab-2'
+      })
+    })
+    act(() => {
+      vi.advanceTimersByTime(TERMINAL_TAB_HOT_RETAIN_MS + 1)
+    })
+
+    expect(result.current).toEqual(new Set(['tab-1']))
+  })
+
   it('parks paired-runtime tabs only when their exact host advertises restore', () => {
     const environmentId = 'paired-env'
     const remoteArgs = {
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts b/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts
index 6a7a0e1a498..94df8daf738 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts
@@ -17,8 +17,7 @@ import { getTerminalTabColdParkRecheckDelayMs } from './terminal-cold-park-reche
 import {
   TERMINAL_TAB_COLD_PARK_DELAY_MS,
   selectPairedRuntimeParkingEnvironmentIds,
-  selectColdParkedTerminalTabs,
-  type TerminalTabColdParkCandidate
+  selectColdParkedTerminalTabs
 } from './terminal-hidden-view-parking'
 import {
   recordParkVerdictFlips,
@@ -31,11 +30,14 @@ import {
   selectEvictionExemptTerminalTabLayoutKey
 } from './terminal-eviction-exempt-tabs'
 import { selectSleepingRecordParkExemptTabIds } from './sleeping-record-park-exemption'
+import { canWatcherCoverParkedTerminalTab } from './terminal-parked-tab-watchers'
+import { createTerminalTabActivationOrder } from './terminal-tab-activation-order'
+import { buildTerminalTabColdParkCandidates } from './terminal-tab-park-candidates'
 import {
-  canWatcherCoverParkedTerminalTab,
-  disposeParkedTerminalWatchersForWorktree,
-  syncParkedTerminalTabWatchers
-} from './terminal-parked-tab-watchers'
+  getTerminalParkingAssignmentsKey,
+  getTerminalParkingInputsKey,
+  useParkedTerminalWatcherSynchronization
+} from './use-parked-terminal-watcher-synchronization'
 
 type TerminalOverlayTabAssignment = {
   groupId: string
@@ -61,6 +63,7 @@ export function useTerminalTabColdParking(args: {
   terminalTabs: readonly TerminalTab[]
   assignments: ReadonlyMap<string, TerminalOverlayTabAssignment>
   isWorktreeActive: boolean
+  activeTerminalTabId: string | null
   /** Worktree-level park verdict from Terminal.tsx. */
   coldParkTerminalPanes: boolean
   /** Retention-budget force-park (C1 slice B): unlike ordinary parks, the
@@ -80,12 +83,21 @@ export function useTerminalTabColdParking(args: {
     terminalTabs,
     assignments,
     isWorktreeActive,
+    activeTerminalTabId,
     coldParkTerminalPanes,
     isForceParked = false,
     shouldMeasureHiddenWorktree,
     activityTerminalPortals,
     activationDeferredMountTabIds
   } = args
+  const terminalParkingInputsKey = getTerminalParkingInputsKey(terminalTabs)
+  const terminalParkingAssignmentsKey = getTerminalParkingAssignmentsKey(assignments)
+  const terminalParkingTabsDependency = coldParkTerminalPanes
+    ? terminalParkingInputsKey
+    : terminalTabs
+  const terminalParkingAssignmentsDependency = coldParkTerminalPanes
+    ? terminalParkingAssignmentsKey
+    : assignments
   const pendingStartupByTabId = useAppStore((state) => state.pendingStartupByTabId)
   const terminalParkingEnabled = useAppStore(
     (state) => state.settings?.terminalHiddenViewParking !== false
@@ -106,6 +118,8 @@ export function useTerminalTabColdParking(args: {
     [sleepingAgentSessionsByPaneKey, worktreeId]
   )
   const terminalTabHiddenSinceRef = useRef(new Map<string, number>())
+  // Why: view switches hide every tab at once, so the park clock cannot rank them.
+  const terminalTabActivationOrderRef = useRef(createTerminalTabActivationOrder())
   // Why (shared measure-clock contract with Terminal.tsx): tab hiddenSince
   // survives a background-measure window so per-tab park deadlines stay in
   // sync with the worktree retention/TTL clock, and a post-measure cool-down
@@ -152,6 +166,7 @@ export function useTerminalTabColdParking(args: {
         terminalTabHiddenSinceRef.current.delete(tabId)
       }
     }
+    terminalTabActivationOrderRef.current.retainTabIds(currentTerminalTabIds)
 
     // Why: measure end starts the re-park cool-down (worktree measure-clock
     // contract) — hiddenSince is preserved through the window, so without the
@@ -171,30 +186,16 @@ export function useTerminalTabColdParking(args: {
       measureParkCooldownUntilRef.current = null
     }
 
-    const candidates: TerminalTabColdParkCandidate[] = terminalTabs.map((terminalTab) => {
-      const assignment = assignments.get(terminalTab.id)
-      const isVisible = Boolean(isWorktreeActive && assignment && assignment.isActiveInGroup)
-      const hasActivityTerminalPortal = portalTabIds.has(terminalTab.id)
-      // Why measuring preserves the clock: the startup probe still needs
-      // mounted panes (selection + render veto below), but deleting
-      // hiddenSince would restart the hysteresis AND desync per-tab deadlines
-      // from the worktree retention/TTL clock on every ~3s probe.
-      if (isVisible || hasActivityTerminalPortal) {
-        terminalTabHiddenSinceRef.current.delete(terminalTab.id)
-      } else if (
-        !shouldMeasureHiddenWorktree &&
-        !terminalTabHiddenSinceRef.current.has(terminalTab.id)
-      ) {
-        terminalTabHiddenSinceRef.current.set(terminalTab.id, nowMs)
-      }
-      return {
-        id: terminalTab.id,
-        ptyId: terminalTab.ptyId,
-        pendingActivationSpawn: terminalTab.pendingActivationSpawn,
-        isVisible,
-        hasActivityTerminalPortal,
-        hiddenSinceMs: terminalTabHiddenSinceRef.current.get(terminalTab.id) ?? null
-      }
+    const candidates = buildTerminalTabColdParkCandidates({
+      terminalTabs,
+      assignments,
+      isWorktreeActive,
+      activeTerminalTabId,
+      portalTabIds,
+      shouldMeasureHiddenWorktree,
+      hiddenSinceByTabId: terminalTabHiddenSinceRef.current,
+      activationOrder: terminalTabActivationOrderRef.current,
+      nowMs
     })
 
     const nextColdParkedTerminalTabIds = selectColdParkedTerminalTabs({
@@ -247,17 +248,19 @@ export function useTerminalTabColdParking(args: {
         timers.set(tabId, timer)
       }
     }
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- semantic keys own the tab and assignment dependencies.
   }, [
     activityTerminalPortals,
-    assignments,
+    activeTerminalTabId,
     isWorktreeActive,
     pendingStartupByTabId,
-    pairedRuntimeParkingEnvironmentIds,
+    runtimeStatusByEnvironmentId,
     shouldMeasureHiddenWorktree,
     terminalParkingEnabled,
     terminalSshParkingEnabled,
     terminalTabParkingRevision,
-    terminalTabs,
+    terminalParkingAssignmentsDependency,
+    terminalParkingTabsDependency,
     worktreeId
   ])
 
@@ -357,18 +360,14 @@ export function useTerminalTabColdParking(args: {
   // panes — watcher disposal therefore lands before any PTY data IPC can
   // reach a freshly remounted pane, and watcher start lands after the parked
   // pane's unmount capture.
-  useEffect(() => {
-    syncParkedTerminalTabWatchers({
-      worktreeId,
-      tabs: terminalTabs,
-      parkedTabIds: parkedTerminalTabIds,
-      // Why: activation-deferred tabs have no prior pane-owned title slot;
-      // pull main's title-only snapshot when their watcher starts.
-      restoreTitleOnStartTabIds: activationDeferredMountTabIds ?? undefined
-    })
-  }, [activationDeferredMountTabIds, parkedTerminalTabIds, terminalTabs, worktreeId])
-
-  useEffect(() => () => disposeParkedTerminalWatchersForWorktree(worktreeId), [worktreeId])
+  useParkedTerminalWatcherSynchronization({
+    worktreeId,
+    terminalTabs,
+    assignmentsKey: terminalParkingAssignmentsKey,
+    inputsKey: terminalParkingInputsKey,
+    parkedTabIds: parkedTerminalTabIds,
+    activationDeferredMountTabIds
+  })
 
   return parkedTerminalTabIds
 }
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAdvancedSection.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAdvancedSection.tsx
index 646c81dd100..af196b2c628 100644
--- a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAdvancedSection.tsx
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAdvancedSection.tsx
@@ -7,11 +7,12 @@ import { Button } from '@/components/ui/button'
 import { cn } from '@/lib/utils'
 import { translate } from '@/i18n/i18n'
 import { TerminalQuickCommandAppendEnterSwitch } from './TerminalQuickCommandAppendEnterSwitch'
+import { TerminalQuickCommandCollapsibleRow } from './TerminalQuickCommandCollapsibleRow'
 import { TerminalQuickCommandScopeField } from './TerminalQuickCommandScopeField'
 
 type TerminalQuickCommandAdvancedSectionProps = {
   draft: TerminalQuickCommand
-  repos: Pick<Repo, 'id' | 'displayName' | 'path' | 'badgeColor'>[]
+  repos: readonly Pick<Repo, 'id' | 'displayName' | 'path' | 'badgeColor'>[]
   advancedOpen: boolean
   selectedScope: ReturnType<typeof getTerminalQuickCommandScope>
   selectedRepoId: string
@@ -50,42 +51,26 @@ export function TerminalQuickCommandAdvancedSection({
         <ChevronDown className={cn('size-4 transition-transform', advancedOpen && 'rotate-180')} />
       </Button>
 
-      <div
-        className={cn(
-          'grid overflow-hidden transition-[grid-template-rows] duration-200 ease-out',
-          advancedOpen ? 'grid-rows-[1fr]' : 'grid-rows-[0fr]'
-        )}
-        aria-hidden={!advancedOpen}
-      >
-        <div className="min-h-0">
-          <div
-            className={cn(
-              'space-y-4 px-1 pt-1 pb-1 transition-[opacity,transform] duration-150 ease-out',
-              advancedOpen
-                ? 'translate-y-0 opacity-100 delay-200'
-                : '-translate-y-1 opacity-0 delay-0'
-            )}
-          >
-            {!isTerminalAgentQuickCommand(draft) ? (
-              <TerminalQuickCommandAppendEnterSwitch
-                appendEnter={draft.appendEnter}
-                onToggle={toggleAppendEnter}
-              />
-            ) : null}
-            <TerminalQuickCommandScopeField
-              repos={repos}
-              selectedScope={selectedScope}
-              selectedRepoId={selectedRepoId}
-              selectedRepoMissing={selectedRepoMissing}
-              lastRepoScopeId={lastRepoScopeIdRef.current}
-              rememberRepoScopeId={(repoId) => {
-                lastRepoScopeIdRef.current = repoId
-              }}
-              setDraft={setDraft}
-            />
-          </div>
-        </div>
-      </div>
+      <TerminalQuickCommandCollapsibleRow open={advancedOpen} className="space-y-4 px-1 pt-2 pb-1">
+        <TerminalQuickCommandScopeField
+          repos={repos}
+          selectedScope={selectedScope}
+          selectedRepoId={selectedRepoId}
+          selectedRepoMissing={selectedRepoMissing}
+          lastRepoScopeId={lastRepoScopeIdRef.current}
+          rememberRepoScopeId={(repoId) => {
+            lastRepoScopeIdRef.current = repoId
+          }}
+          setDraft={setDraft}
+        />
+        {!isTerminalAgentQuickCommand(draft) ? (
+          <TerminalQuickCommandAppendEnterSwitch
+            appendEnter={draft.appendEnter}
+            disabled={!advancedOpen}
+            onToggle={toggleAppendEnter}
+          />
+        ) : null}
+      </TerminalQuickCommandCollapsibleRow>
     </div>
   )
 }
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAppendEnterSwitch.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAppendEnterSwitch.tsx
index 4450562729e..73f69ebf5d8 100644
--- a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAppendEnterSwitch.tsx
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandAppendEnterSwitch.tsx
@@ -3,11 +3,13 @@ import { Switch } from '@/components/ui/switch'
 type TerminalQuickCommandAppendEnterSwitchProps = {
   appendEnter: boolean
   onToggle: () => void
+  disabled?: boolean
 }
 
 export function TerminalQuickCommandAppendEnterSwitch({
   appendEnter,
-  onToggle
+  onToggle,
+  disabled = false
 }: TerminalQuickCommandAppendEnterSwitchProps): React.JSX.Element {
   return (
     <div className="flex items-start justify-between gap-4">
@@ -27,6 +29,7 @@ export function TerminalQuickCommandAppendEnterSwitch({
       </div>
       <Switch
         checked={appendEnter}
+        disabled={disabled}
         aria-label={translate(
           'auto.components.terminal.quick.commands.TerminalQuickCommandAppendEnterSwitch.e4e5fed3b3',
           'Toggle append Enter'
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandCollapsibleRow.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandCollapsibleRow.tsx
new file mode 100644
index 00000000000..ab09a287b6a
--- /dev/null
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandCollapsibleRow.tsx
@@ -0,0 +1,38 @@
+import type { ReactNode } from 'react'
+import { cn } from '@/lib/utils'
+
+type TerminalQuickCommandCollapsibleRowProps = {
+  open: boolean
+  className?: string
+  children: ReactNode
+}
+
+/** Why: switching action adds/removes fields; animating the rows keeps the
+ *  dialog from snapping between content heights. */
+export function TerminalQuickCommandCollapsibleRow({
+  open,
+  className,
+  children
+}: TerminalQuickCommandCollapsibleRowProps): React.JSX.Element {
+  return (
+    <div
+      className={cn(
+        'grid overflow-hidden transition-[grid-template-rows] duration-200 ease-out',
+        open ? 'grid-rows-[1fr]' : 'grid-rows-[0fr]'
+      )}
+      aria-hidden={!open}
+    >
+      <div className="min-h-0">
+        <div
+          className={cn(
+            'transition-[opacity,transform] duration-150 ease-out',
+            open ? 'translate-y-0 opacity-100 delay-200' : '-translate-y-1 opacity-0 delay-0',
+            className
+          )}
+        >
+          {children}
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandContentSection.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandContentSection.tsx
index 34035a6233f..19967b0daba 100644
--- a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandContentSection.tsx
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandContentSection.tsx
@@ -12,9 +12,11 @@ import {
   SelectTrigger,
   SelectValue
 } from '@/components/ui/select'
+import { Textarea } from '@/components/ui/textarea'
 import { AgentIcon } from '@/lib/agent-catalog'
 import { cn } from '@/lib/utils'
 import { translate } from '@/i18n/i18n'
+import { TerminalQuickCommandCollapsibleRow } from './TerminalQuickCommandCollapsibleRow'
 import { getTerminalQuickCommandAgentOptions } from './terminal-quick-command-agent-options'
 import type { TerminalQuickCommandDialogDraftMemory } from './terminal-quick-command-dialog-draft'
 
@@ -37,85 +39,66 @@ export function TerminalQuickCommandContentSection({
 }: TerminalQuickCommandContentSectionProps): React.JSX.Element {
   return (
     <div>
-      {/* Why: action changes add/remove agent-only fields; animating rows here
-          keeps the fixed dialog from snapping between content heights. */}
-      <div
-        className={cn(
-          'grid overflow-hidden transition-[grid-template-rows] duration-200 ease-out',
-          isAgentAction ? 'grid-rows-[1fr]' : 'grid-rows-[0fr]'
-        )}
-        aria-hidden={!isAgentAction}
-      >
-        <div className="min-h-0">
-          <div
-            className={cn(
-              'space-y-2 px-1 pt-1 pb-4 transition-[opacity,transform] duration-150 ease-out',
-              isAgentAction
-                ? 'translate-y-0 opacity-100 delay-200'
-                : '-translate-y-1 opacity-0 delay-0'
-            )}
-          >
-            <Label>
-              {translate(
-                'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.0adba8fa0c',
-                'Agent'
+      <TerminalQuickCommandCollapsibleRow open={isAgentAction} className="space-y-2 px-1 pt-1 pb-4">
+        <Label>
+          {translate(
+            'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.0adba8fa0c',
+            'Agent'
+          )}
+        </Label>
+        <Select
+          value={selectedAgent}
+          disabled={!isAgentAction}
+          onValueChange={(agent) => {
+            const nextAgent = agent as TuiAgent
+            draftMemoryRef.current = {
+              ...draftMemoryRef.current,
+              agent: nextAgent
+            }
+            setDraft((current) =>
+              isTerminalAgentQuickCommand(current) ? { ...current, agent: nextAgent } : current
+            )
+          }}
+        >
+          <SelectTrigger>
+            <SelectValue
+              placeholder={translate(
+                'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.346d409ab2',
+                'Choose agent'
               )}
-            </Label>
-            <Select
-              value={selectedAgent}
-              disabled={!isAgentAction}
-              onValueChange={(agent) => {
-                const nextAgent = agent as TuiAgent
-                draftMemoryRef.current = {
-                  ...draftMemoryRef.current,
-                  agent: nextAgent
-                }
-                setDraft((current) =>
-                  isTerminalAgentQuickCommand(current) ? { ...current, agent: nextAgent } : current
-                )
-              }}
-            >
-              <SelectTrigger>
-                <SelectValue
-                  placeholder={translate(
-                    'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.346d409ab2',
-                    'Choose agent'
-                  )}
-                />
-              </SelectTrigger>
-              <SelectContent
-                position="popper"
-                side="bottom"
-                align="start"
-                sideOffset={4}
-                className="max-h-[min(20rem,var(--radix-select-content-available-height))] w-[--radix-select-trigger-width]"
-              >
-                {QUICK_COMMAND_AGENT_OPTIONS.map((entry) => {
-                  const supported = supportsTerminalAgentQuickCommand(entry.id)
-                  return (
-                    <SelectItem key={entry.id} value={entry.id} disabled={!supported}>
-                      <span className="flex min-w-0 items-center gap-2">
-                        <AgentIcon agent={entry.id} size={16} />
-                        <span className="flex min-w-0 flex-col">
-                          <span className="truncate">{entry.label}</span>
-                          {!supported ? (
-                            <span className="truncate text-xs text-muted-foreground">
-                              {translate(
-                                'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.026cfb232a',
-                                'Does not support prompt commands'
-                              )}
-                            </span>
-                          ) : null}
+            />
+          </SelectTrigger>
+          <SelectContent
+            position="popper"
+            side="bottom"
+            align="start"
+            sideOffset={4}
+            className="max-h-[min(20rem,var(--radix-select-content-available-height))] w-[--radix-select-trigger-width]"
+          >
+            {QUICK_COMMAND_AGENT_OPTIONS.map((entry) => {
+              const supported = supportsTerminalAgentQuickCommand(entry.id)
+              return (
+                <SelectItem key={entry.id} value={entry.id} disabled={!supported}>
+                  <span className="flex min-w-0 items-center gap-2">
+                    <AgentIcon agent={entry.id} size={16} />
+                    <span className="flex min-w-0 flex-col">
+                      <span className="truncate">{entry.label}</span>
+                      {!supported ? (
+                        <span className="truncate text-xs text-muted-foreground">
+                          {translate(
+                            'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.026cfb232a',
+                            'Does not support prompt commands'
+                          )}
                         </span>
-                      </span>
-                    </SelectItem>
-                  )
-                })}
-              </SelectContent>
-            </Select>
-          </div>
-        </div>
-      </div>
+                      ) : null}
+                    </span>
+                  </span>
+                </SelectItem>
+              )
+            })}
+          </SelectContent>
+        </Select>
+      </TerminalQuickCommandCollapsibleRow>
 
       <div className="space-y-2">
         <Label>
@@ -129,7 +112,7 @@ export function TerminalQuickCommandContentSection({
                 'Command Text'
               )}
         </Label>
-        <textarea
+        <Textarea
           value={isTerminalAgentQuickCommand(draft) ? draft.prompt : draft.command}
           onChange={(event) => {
             const text = event.target.value
@@ -159,44 +142,31 @@ export function TerminalQuickCommandContentSection({
                   'npm run dev'
                 )
           }
-          rows={4}
+          rows={8}
+          spellCheck={isAgentAction}
           className={cn(
-            'min-h-24 w-full resize-y rounded-md border border-input bg-transparent px-3 py-2 text-sm shadow-xs outline-none transition-[color,box-shadow] focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50',
+            'max-h-[40vh] min-h-40 resize-y text-sm leading-relaxed',
             !isAgentAction && 'font-mono'
           )}
         />
       </div>
 
-      <div
-        className={cn(
-          'grid overflow-hidden transition-[grid-template-rows] duration-200 ease-out',
-          isAgentAction ? 'grid-rows-[1fr]' : 'grid-rows-[0fr]'
-        )}
-        aria-hidden={!isAgentAction}
+      <TerminalQuickCommandCollapsibleRow
+        open={isAgentAction}
+        className="px-1 pt-2 text-xs text-muted-foreground"
       >
-        <div className="min-h-0">
-          <p
-            className={cn(
-              'px-1 pt-2 text-xs text-muted-foreground transition-[opacity,transform] duration-150 ease-out',
-              isAgentAction
-                ? 'translate-y-0 opacity-100 delay-200'
-                : '-translate-y-1 opacity-0 delay-0'
-            )}
-          >
-            {translate(
-              'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.e604bd40d6',
-              'Supports skills, file paths, and built-in commands like'
-            )}{' '}
-            <code className="rounded bg-muted px-1 font-mono text-[11px]">
-              {translate(
-                'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.97e96cc027',
-                '/goal'
-              )}
-            </code>
-            .
-          </p>
-        </div>
-      </div>
+        {translate(
+          'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.e604bd40d6',
+          'Supports skills, file paths, and built-in commands like'
+        )}{' '}
+        <code className="rounded bg-muted px-1 font-mono text-[11px]">
+          {translate(
+            'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.97e96cc027',
+            '/goal'
+          )}
+        </code>
+        .
+      </TerminalQuickCommandCollapsibleRow>
     </div>
   )
 }
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialog.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialog.tsx
index 59bce894d19..1c9c615d72d 100644
--- a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialog.tsx
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialog.tsx
@@ -39,7 +39,10 @@ type TerminalQuickCommandDialogProps = {
   open: boolean
   mode: TerminalQuickCommandDialogMode
   command: TerminalQuickCommand
-  repos?: Pick<Repo, 'id' | 'displayName' | 'path' | 'badgeColor'>[]
+  repos?: readonly Pick<Repo, 'id' | 'displayName' | 'path' | 'badgeColor'>[]
+  /** Settings has no ambient workspace to imply scope from, so it opens the
+   *  Advanced section up front. In-workspace entry points leave it collapsed. */
+  defaultAdvancedOpen?: boolean
   onOpenChange: (open: boolean) => void
   onSave: (command: TerminalQuickCommand) => void
 }
@@ -63,6 +66,7 @@ export function TerminalQuickCommandDialog({
   mode,
   command,
   repos = EMPTY_REPOS,
+  defaultAdvancedOpen = false,
   onOpenChange,
   onSave
 }: TerminalQuickCommandDialogProps): React.JSX.Element {
@@ -76,7 +80,7 @@ export function TerminalQuickCommandDialog({
   const lastRepoScopeIdRef = useRef<string | null>(
     initialScope.type === 'repo' ? initialScope.repoId : null
   )
-  const [advancedOpen, setAdvancedOpen] = useState(false)
+  const [advancedOpen, setAdvancedOpen] = useState(defaultAdvancedOpen)
   const selectedAction = getTerminalQuickCommandAction(draft)
   const selectedScope = getTerminalQuickCommandScope(draft)
   const isAgentAction = isTerminalAgentQuickCommand(draft)
@@ -95,7 +99,7 @@ export function TerminalQuickCommandDialog({
     draftMemoryRef.current = createTerminalQuickCommandDialogDraftMemory(command, fallbackAgent)
     const commandScope = getTerminalQuickCommandScope(command)
     lastRepoScopeIdRef.current = commandScope.type === 'repo' ? commandScope.repoId : null
-    setAdvancedOpen(false)
+    setAdvancedOpen(defaultAdvancedOpen)
     setDraft({ ...command })
   }
 
@@ -164,9 +168,12 @@ export function TerminalQuickCommandDialog({
 
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="max-w-md sm:max-w-md" showCloseButton={false}>
+      <DialogContent
+        className="max-h-[min(88vh,54rem)] grid-rows-[auto_minmax(0,1fr)_auto] sm:max-w-xl"
+        showCloseButton={false}
+      >
         <DialogHeader>
-          <DialogTitle className="text-sm">
+          <DialogTitle>
             {mode === 'edit'
               ? translate(
                   'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.f9b184fc16',
@@ -177,7 +184,7 @@ export function TerminalQuickCommandDialog({
                   'Add Quick Command'
                 )}
           </DialogTitle>
-          <DialogDescription className="text-xs">
+          <DialogDescription>
             {translate(
               'auto.components.terminal.quick.commands.TerminalQuickCommandDialog.ed04233b3e',
               'Save terminal commands or agent prompts for quick access.'
@@ -185,8 +192,11 @@ export function TerminalQuickCommandDialog({
           </DialogDescription>
         </DialogHeader>
 
+        {/* Why -mx-3/px-3: overflow clips at the padding box, so the padding has
+            to cover the widest negative margin inside (Advanced's -ml-2) plus a
+            focus ring. The matching negative margin keeps children aligned. */}
         <div
-          className="space-y-4"
+          className="-mx-3 min-h-0 space-y-4 overflow-y-auto px-3 py-1 scrollbar-sleek"
           onKeyDown={(event) => {
             if (isScreenSubmitShortcut(event) && canSave) {
               event.preventDefault()
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialogFooter.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialogFooter.tsx
index 6bcd65fd7b7..d2f98bef2c7 100644
--- a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialogFooter.tsx
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialogFooter.tsx
@@ -1,5 +1,7 @@
 import { Button } from '@/components/ui/button'
 import { DialogFooter } from '@/components/ui/dialog'
+import { ShortcutKeyCombo } from '@/components/ShortcutKeyCombo'
+import { getScreenSubmitModifierLabel } from '@/lib/screen-submit-shortcut'
 import { translate } from '@/i18n/i18n'
 
 type TerminalQuickCommandDialogFooterProps = {
@@ -16,7 +18,7 @@ export function TerminalQuickCommandDialogFooter({
   onSave
 }: TerminalQuickCommandDialogFooterProps): React.JSX.Element {
   return (
-    <DialogFooter>
+    <DialogFooter className="sm:items-center">
       <Button type="button" variant="outline" onClick={onCancel}>
         {translate(
           'auto.components.terminal.quick.commands.TerminalQuickCommandDialogFooter.28370f16b9',
@@ -37,7 +39,11 @@ export function TerminalQuickCommandDialogFooter({
           'auto.components.terminal.quick.commands.TerminalQuickCommandDialogFooter.2e2b958dfc',
           'Save'
         )}
-        <span className="ml-1 text-[10px] opacity-60">{submitShortcutLabel}</span>
+        <ShortcutKeyCombo
+          keys={[getScreenSubmitModifierLabel(), 'Enter']}
+          className="ml-1"
+          keyCapClassName="border-primary-foreground/25 bg-primary-foreground/15 text-primary-foreground/80 shadow-none"
+        />
       </Button>
     </DialogFooter>
   )
diff --git a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandScopeField.tsx b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandScopeField.tsx
index fe09ee6acb4..58cd0ea8fd2 100644
--- a/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandScopeField.tsx
+++ b/src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandScopeField.tsx
@@ -18,7 +18,7 @@ import { QUICK_COMMAND_TOGGLE_ITEM_CLASS } from './terminal-quick-command-toggle
 import { translate } from '@/i18n/i18n'
 
 type TerminalQuickCommandScopeFieldProps = {
-  repos: Pick<Repo, 'id' | 'displayName' | 'path' | 'badgeColor'>[]
+  repos: readonly Pick<Repo, 'id' | 'displayName' | 'path' | 'badgeColor'>[]
   selectedScope: TerminalQuickCommandScope
   selectedRepoId: string
   selectedRepoMissing: boolean
@@ -32,7 +32,7 @@ function getRepoLabel(repo: Pick<Repo, 'displayName' | 'path'>): string {
 }
 
 export function getQuickCommandProjectScopeRepoId(
-  repos: Pick<Repo, 'id'>[],
+  repos: readonly Pick<Repo, 'id'>[],
   lastRepoScopeId: string | null
 ): string | null {
   return lastRepoScopeId ?? repos[0]?.id ?? null
diff --git a/src/renderer/src/components/terminal/terminal-tab-actions.test.ts b/src/renderer/src/components/terminal/terminal-tab-actions.test.ts
index a8747ec81ff..4b7557ba057 100644
--- a/src/renderer/src/components/terminal/terminal-tab-actions.test.ts
+++ b/src/renderer/src/components/terminal/terminal-tab-actions.test.ts
@@ -183,6 +183,57 @@ describe('closeTerminalTab', () => {
     isWebTerminalSurfaceTabIdMock.mockReturnValue(false)
   })
 
+  it('retires exact resume authority when explicit cleanup arrives after the tab disappeared', () => {
+    const closeTab = vi.fn()
+    const onClosed = vi.fn()
+    getStateMock.mockReturnValue({
+      tabsByWorktree: {},
+      unifiedTabsByWorktree: {},
+      closeTab
+    })
+
+    closeTerminalTab('retired-worker-tab', {
+      hostCloseReason: 'cleanup',
+      localPtyTeardownOwnedExternally: true,
+      onClosed
+    })
+
+    expect(closeTab).toHaveBeenCalledWith('retired-worker-tab', {
+      reason: 'cleanup',
+      localPtyTeardownOwnedExternally: true
+    })
+    expect(onClosed).toHaveBeenCalledOnce()
+  })
+
+  it('retires exact resume authority when a user close arrives after the tab disappeared', () => {
+    const closeTab = vi.fn()
+    getStateMock.mockReturnValue({
+      tabsByWorktree: {},
+      unifiedTabsByWorktree: {},
+      closeTab
+    })
+
+    closeTerminalTab('retired-worker-tab')
+
+    expect(closeTab).toHaveBeenCalledWith('retired-worker-tab', { reason: 'user' })
+  })
+
+  it.each([
+    ['local PTY exit', { reason: 'pty-exit' as const }],
+    ['paired host PTY exit', { hostCloseReason: 'pty-exit' as const }]
+  ])('preserves missing-tab recovery authority for %s', (_label, options) => {
+    const closeTab = vi.fn()
+    getStateMock.mockReturnValue({
+      tabsByWorktree: {},
+      unifiedTabsByWorktree: {},
+      closeTab
+    })
+
+    closeTerminalTab('unexpectedly-lost-tab', options)
+
+    expect(closeTab).not.toHaveBeenCalled()
+  })
+
   it('delegates host-backed terminal closes to the paired runtime', () => {
     const closeTab = vi.fn()
     isWebRuntimeSessionActiveMock.mockReturnValue(true)
diff --git a/src/renderer/src/components/terminal/terminal-tab-actions.ts b/src/renderer/src/components/terminal/terminal-tab-actions.ts
index 55934e7ae88..8216696d217 100644
--- a/src/renderer/src/components/terminal/terminal-tab-actions.ts
+++ b/src/renderer/src/components/terminal/terminal-tab-actions.ts
@@ -65,6 +65,19 @@ export function closeTerminalTab(
   )
   const target = resolveTerminalCloseTarget(state, tabId, precomputedCloseState)
   if (!target) {
+    const closeReason = options?.reason ?? options?.hostCloseReason ?? 'user'
+    if (closeReason !== 'pty-exit') {
+      // Why: late explicit cleanup must still revoke tab-scoped resume authority after PTY exit removed the row.
+      state.closeTab(tabId, {
+        reason: closeReason,
+        ...(options?.localPtyTeardownOwnedExternally
+          ? { localPtyTeardownOwnedExternally: true }
+          : {}),
+        ...(options?.precomputedRetirementPlan
+          ? { precomputedRetirementPlan: options.precomputedRetirementPlan }
+          : {})
+      })
+    }
     options?.onClosed?.()
     return
   }
diff --git a/src/renderer/src/components/ui/checkbox.tsx b/src/renderer/src/components/ui/checkbox.tsx
index b5ae01c3da6..2e9e53e55e7 100644
--- a/src/renderer/src/components/ui/checkbox.tsx
+++ b/src/renderer/src/components/ui/checkbox.tsx
@@ -1,15 +1,20 @@
 'use client'
 
 import * as React from 'react'
-import { CheckIcon } from 'lucide-react'
+import { CheckIcon, MinusIcon } from 'lucide-react'
 import { Checkbox as CheckboxPrimitive } from 'radix-ui'
 
 import { cn } from '@/lib/utils'
 
-function Checkbox({ className, ...props }: React.ComponentProps<typeof CheckboxPrimitive.Root>) {
+function Checkbox({
+  className,
+  checked,
+  ...props
+}: React.ComponentProps<typeof CheckboxPrimitive.Root>) {
   return (
     <CheckboxPrimitive.Root
       data-slot="checkbox"
+      checked={checked}
       className={cn(
         'peer size-4 shrink-0 rounded-[4px] border border-border bg-background shadow-xs outline-none transition-shadow focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:border-primary data-[state=checked]:bg-primary data-[state=checked]:text-primary-foreground',
         className
@@ -20,7 +25,11 @@ function Checkbox({ className, ...props }: React.ComponentProps<typeof CheckboxP
         data-slot="checkbox-indicator"
         className="flex items-center justify-center text-current"
       >
-        <CheckIcon className="size-3.5" />
+        {checked === 'indeterminate' ? (
+          <MinusIcon className="size-3.5" />
+        ) : (
+          <CheckIcon className="size-3.5" />
+        )}
       </CheckboxPrimitive.Indicator>
     </CheckboxPrimitive.Root>
   )
diff --git a/src/renderer/src/components/ui/repo-multi-combobox.tsx b/src/renderer/src/components/ui/repo-multi-combobox.tsx
index 6334f74179e..f3dfef437d0 100644
--- a/src/renderer/src/components/ui/repo-multi-combobox.tsx
+++ b/src/renderer/src/components/ui/repo-multi-combobox.tsx
@@ -16,7 +16,7 @@ import RepoBadgeLabel from '@/components/repo/RepoBadgeLabel'
 import { translate } from '@/i18n/i18n'
 
 type RepoMultiComboboxProps = {
-  repos: Repo[]
+  repos: readonly Repo[]
   /** Currently selected repo ids. The component enforces `selected.size >= 1`
    *  by disabling the last-selected checkbox. */
   selected: ReadonlySet<string>
@@ -32,7 +32,10 @@ type RepoMultiComboboxProps = {
   triggerClassName?: string
 }
 
-function renderTriggerLabel(repos: Repo[], selected: ReadonlySet<string>): React.JSX.Element {
+function renderTriggerLabel(
+  repos: readonly Repo[],
+  selected: ReadonlySet<string>
+): React.JSX.Element {
   if (repos.length === 0) {
     return (
       <span className="text-muted-foreground">
diff --git a/src/renderer/src/components/ui/team-multi-combobox.test.ts b/src/renderer/src/components/ui/team-multi-combobox.test.ts
deleted file mode 100644
index 9f231371c29..00000000000
--- a/src/renderer/src/components/ui/team-multi-combobox.test.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import type { LinearTeam } from '../../../../shared/types'
-import {
-  TEAM_MULTI_COMBOBOX_QUERY_MAX_BYTES,
-  filterTeamMultiComboboxTeams,
-  isTeamMultiComboboxQueryTooLarge
-} from './team-multi-combobox'
-
-function team(overrides: Partial<LinearTeam>): LinearTeam {
-  return {
-    id: 'team-1',
-    key: 'ENG',
-    name: 'Engineering',
-    workspaceId: 'workspace-1',
-    workspaceName: 'Workspace',
-    ...overrides
-  }
-}
-
-describe('filterTeamMultiComboboxTeams', () => {
-  it('returns all teams for empty queries', () => {
-    const teams = [team({ id: 'eng' }), team({ id: 'ops', key: 'OPS', name: 'Operations' })]
-
-    expect(filterTeamMultiComboboxTeams(teams, '')).toBe(teams)
-    expect(filterTeamMultiComboboxTeams(teams, '   ')).toBe(teams)
-  })
-
-  it('matches team names and keys case-insensitively', () => {
-    const teams = [team({ id: 'eng' }), team({ id: 'ops', key: 'OPS', name: 'Operations' })]
-
-    expect(filterTeamMultiComboboxTeams(teams, 'ops')).toEqual([teams[1]])
-    expect(filterTeamMultiComboboxTeams(teams, 'ENGINEER')).toEqual([teams[0]])
-  })
-
-  it('rejects oversized pasted queries before reading teams', () => {
-    const oversizedQuery = 'secret-team-combobox'.repeat(TEAM_MULTI_COMBOBOX_QUERY_MAX_BYTES)
-    const teams = [
-      {
-        id: 'secret',
-        workspaceId: 'workspace-1',
-        get name(): string {
-          throw new Error('oversized team combobox queries must not scan names')
-        },
-        get key(): string {
-          throw new Error('oversized team combobox queries must not scan keys')
-        }
-      }
-    ] as LinearTeam[]
-
-    expect(isTeamMultiComboboxQueryTooLarge(oversizedQuery)).toBe(true)
-    expect(filterTeamMultiComboboxTeams(teams, oversizedQuery)).toEqual([])
-  })
-
-  it('rejects oversized whitespace before trimming', () => {
-    const teams = [team({ id: 'eng' })]
-
-    expect(
-      filterTeamMultiComboboxTeams(teams, ' '.repeat(TEAM_MULTI_COMBOBOX_QUERY_MAX_BYTES + 1))
-    ).toEqual([])
-  })
-})
diff --git a/src/renderer/src/components/ui/team-multi-combobox.tsx b/src/renderer/src/components/ui/team-multi-combobox.tsx
deleted file mode 100644
index e1795c4801a..00000000000
--- a/src/renderer/src/components/ui/team-multi-combobox.tsx
+++ /dev/null
@@ -1,220 +0,0 @@
-import React, { useCallback, useMemo, useState } from 'react'
-import { Check, ChevronsUpDown } from 'lucide-react'
-import { Button } from '@/components/ui/button'
-import {
-  Command,
-  CommandEmpty,
-  CommandInput,
-  CommandItem,
-  CommandList
-} from '@/components/ui/command'
-import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
-import { cn } from '@/lib/utils'
-import type { LinearTeam } from '../../../../shared/types'
-import { isClipboardTextByteLengthOverLimit } from '../../../../shared/clipboard-text'
-import { translate } from '@/i18n/i18n'
-
-type TeamMultiComboboxProps = {
-  teams: LinearTeam[]
-  selected: ReadonlySet<string>
-  onChange: (next: ReadonlySet<string>) => void
-  onSelectAll: () => void
-  triggerClassName?: string
-}
-
-export const TEAM_MULTI_COMBOBOX_QUERY_MAX_BYTES = 2 * 1024
-
-export function isTeamMultiComboboxQueryTooLarge(
-  query: string,
-  maxBytes = TEAM_MULTI_COMBOBOX_QUERY_MAX_BYTES
-): boolean {
-  return isClipboardTextByteLengthOverLimit(query, maxBytes)
-}
-
-export function filterTeamMultiComboboxTeams(
-  teams: readonly LinearTeam[],
-  query: string
-): readonly LinearTeam[] {
-  if (isTeamMultiComboboxQueryTooLarge(query)) {
-    return []
-  }
-  const trimmedQuery = query.trim()
-  if (!trimmedQuery) {
-    return teams
-  }
-  const lower = trimmedQuery.toLowerCase()
-  return teams.filter(
-    (team) => team.name.toLowerCase().includes(lower) || team.key.toLowerCase().includes(lower)
-  )
-}
-
-function renderTriggerLabel(teams: LinearTeam[], selected: ReadonlySet<string>): React.JSX.Element {
-  if (teams.length === 0) {
-    return (
-      <span className="inline-flex min-w-0 items-center gap-1.5">
-        {translate('auto.components.ui.team.multi.combobox.301f2a796e', 'All teams')}
-      </span>
-    )
-  }
-  if (selected.size === teams.length) {
-    return (
-      <span className="inline-flex min-w-0 items-center gap-1.5">
-        {translate('auto.components.ui.team.multi.combobox.301f2a796e', 'All teams')}
-      </span>
-    )
-  }
-  const selectedTeams = teams.filter((t) => selected.has(t.id))
-  const [first, second, ...rest] = selectedTeams
-  return (
-    <span className="inline-flex min-w-0 items-center gap-1.5 truncate">
-      {first ? <span>{first.key}</span> : null}
-      {second ? <span className="text-muted-foreground">, {second.key}</span> : null}
-      {rest.length > 0 ? <span className="text-muted-foreground">+{rest.length}</span> : null}
-    </span>
-  )
-}
-
-export default function TeamMultiCombobox({
-  teams,
-  selected,
-  onChange,
-  onSelectAll,
-  triggerClassName
-}: TeamMultiComboboxProps): React.JSX.Element {
-  const [open, setOpen] = useState(false)
-  const [query, setQuery] = useState('')
-  const [commandValue, setCommandValue] = useState('')
-
-  const filteredTeams = useMemo(() => filterTeamMultiComboboxTeams(teams, query), [teams, query])
-
-  const allSelected = selected.size === teams.length && teams.length > 0
-
-  const handleOpenChange = useCallback((nextOpen: boolean) => {
-    setOpen(nextOpen)
-    if (!nextOpen) {
-      setQuery('')
-    }
-  }, [])
-
-  const toggle = useCallback(
-    (teamId: string) => {
-      const next = new Set(selected)
-      if (next.has(teamId)) {
-        if (next.size <= 1) {
-          return
-        }
-        next.delete(teamId)
-      } else {
-        next.add(teamId)
-      }
-      onChange(next)
-    },
-    [onChange, selected]
-  )
-
-  const handleSelectAll = useCallback(() => {
-    if (allSelected) {
-      const first = teams[0]
-      if (!first) {
-        return
-      }
-      onChange(new Set([first.id]))
-      return
-    }
-    onSelectAll()
-  }, [allSelected, onChange, onSelectAll, teams])
-
-  return (
-    <Popover open={open} onOpenChange={handleOpenChange}>
-      <PopoverTrigger asChild>
-        <Button
-          type="button"
-          variant="outline"
-          role="combobox"
-          aria-expanded={open}
-          className={cn('h-8 w-full justify-between px-3 text-xs font-normal', triggerClassName)}
-        >
-          {renderTriggerLabel(teams, selected)}
-          <ChevronsUpDown className="size-3.5 opacity-50" />
-        </Button>
-      </PopoverTrigger>
-      <PopoverContent
-        align="start"
-        // Why: team filter triggers can collapse in narrow toolbars; the menu
-        // needs room for names and keys while still fitting small viewports.
-        className="w-[min(320px,calc(100vw-1rem))] min-w-[var(--radix-popover-trigger-width)] p-0"
-      >
-        <Command shouldFilter={false} value={commandValue} onValueChange={setCommandValue}>
-          <CommandInput
-            autoFocus
-            placeholder={translate(
-              'auto.components.ui.team.multi.combobox.18ec58881e',
-              'Search teams...'
-            )}
-            value={query}
-            onValueChange={setQuery}
-            className="text-xs"
-          />
-          <div className="border-b border-border">
-            <button
-              type="button"
-              onClick={handleSelectAll}
-              onMouseDown={(event) => event.preventDefault()}
-              onMouseEnter={() => setCommandValue('')}
-              className={cn(
-                'flex w-full items-center gap-2 px-3 py-1.5 text-left text-xs text-foreground transition-colors hover:bg-accent hover:text-accent-foreground',
-                allSelected && 'opacity-80'
-              )}
-            >
-              <Check
-                className={cn(
-                  'size-3 text-muted-foreground',
-                  allSelected ? 'opacity-70' : 'opacity-0'
-                )}
-              />
-              <span>
-                {translate('auto.components.ui.team.multi.combobox.301f2a796e', 'All teams')}
-              </span>
-            </button>
-          </div>
-          <CommandList>
-            <CommandEmpty>
-              {translate(
-                'auto.components.ui.team.multi.combobox.de83523bf9',
-                'No teams match your search.'
-              )}
-            </CommandEmpty>
-            {filteredTeams.map((team) => {
-              const isSelected = selected.has(team.id)
-              const isLastSelected = isSelected && selected.size <= 1
-              return (
-                <CommandItem
-                  key={team.id}
-                  value={team.id}
-                  onSelect={() => toggle(team.id)}
-                  disabled={isLastSelected}
-                  className="items-center gap-2 px-3 py-1.5 text-xs"
-                >
-                  <Check
-                    className={cn(
-                      'size-3 text-muted-foreground',
-                      isSelected ? 'opacity-70' : 'opacity-0'
-                    )}
-                  />
-                  <div className="min-w-0 flex-1">
-                    <span className="inline-flex max-w-full items-center gap-1.5 text-xs">
-                      <span className="min-w-0 truncate">{team.name}</span>
-                      <span className="shrink-0 rounded bg-muted px-1 py-0.5 text-[9px] font-medium leading-none text-muted-foreground">
-                        {team.key}
-                      </span>
-                    </span>
-                  </div>
-                </CommandItem>
-              )
-            })}
-          </CommandList>
-        </Command>
-      </PopoverContent>
-    </Popover>
-  )
-}
diff --git a/src/renderer/src/components/ui/textarea.tsx b/src/renderer/src/components/ui/textarea.tsx
new file mode 100644
index 00000000000..5e78f5555ef
--- /dev/null
+++ b/src/renderer/src/components/ui/textarea.tsx
@@ -0,0 +1,28 @@
+import * as React from 'react'
+
+import { cn } from '@/lib/utils'
+
+const Textarea = React.forwardRef<HTMLTextAreaElement, React.ComponentProps<'textarea'>>(
+  ({ className, ...props }, ref) => {
+    return (
+      <textarea
+        ref={ref}
+        data-slot="textarea"
+        // Why scrollbar-sleek here: a textarea scrolls without an overflow class,
+        // so it escapes the scrollbar lint rule and paints Chromium's default
+        // light scrollbar on dark surfaces.
+        className={cn(
+          'scrollbar-sleek min-h-16 w-full min-w-0 rounded-md border border-input bg-transparent px-3 py-2 text-base shadow-xs transition-[color,box-shadow] outline-none placeholder:text-muted-foreground/60 disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 md:text-sm dark:bg-input/30',
+          'focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50',
+          'aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40',
+          className
+        )}
+        {...props}
+      />
+    )
+  }
+)
+
+Textarea.displayName = 'Textarea'
+
+export { Textarea }
diff --git a/src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.mount-gating.test.tsx b/src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.mount-gating.test.tsx
new file mode 100644
index 00000000000..7887b7978fc
--- /dev/null
+++ b/src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.mount-gating.test.tsx
@@ -0,0 +1,332 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useAppStore } from '@/store'
+import type { AppState } from '@/store/types'
+import { readStoreListenerCount } from '@/store/store-listener-census'
+import type {
+  WorkspaceCleanupCandidate,
+  WorkspaceCleanupScanResult
+} from '../../../../shared/workspace-cleanup'
+import type * as WorkspaceCleanupPresentation from './workspace-cleanup-presentation'
+import WorkspaceCleanupDialog from './WorkspaceCleanupDialog'
+import { NOW, makeCandidate, makeState } from './workspace-cleanup-presentation-fixtures'
+
+const contentProbe = vi.hoisted(() => ({
+  mounts: vi.fn(),
+  projections: vi.fn(),
+  renders: vi.fn(),
+  storeNotifications: vi.fn(),
+  unmounts: vi.fn()
+}))
+
+const toastProbe = vi.hoisted(() => ({
+  error: vi.fn(),
+  info: vi.fn(),
+  message: vi.fn(),
+  success: vi.fn(),
+  warning: vi.fn()
+}))
+
+vi.mock('sonner', () => ({ toast: toastProbe }))
+
+vi.mock('./workspace-cleanup-presentation', async (importOriginal) => {
+  const actual = await importOriginal<typeof WorkspaceCleanupPresentation>()
+  return {
+    ...actual,
+    filterWorkspaceCleanupCandidates: (
+      ...args: Parameters<typeof actual.filterWorkspaceCleanupCandidates>
+    ) => {
+      contentProbe.projections()
+      return actual.filterWorkspaceCleanupCandidates(...args)
+    },
+    getWorkspaceCleanupReviewInfo: (
+      ...args: Parameters<typeof actual.getWorkspaceCleanupReviewInfo>
+    ) => {
+      contentProbe.projections()
+      return actual.getWorkspaceCleanupReviewInfo(...args)
+    },
+    sortWorkspaceCleanupCandidates: (
+      ...args: Parameters<typeof actual.sortWorkspaceCleanupCandidates>
+    ) => {
+      contentProbe.projections()
+      return actual.sortWorkspaceCleanupCandidates(...args)
+    }
+  }
+})
+
+vi.mock('@/components/ui/dialog', async () => {
+  const React = await import('react')
+  const Passthrough = ({ children }: { children: React.ReactNode }) => <>{children}</>
+  const DialogContent = () => {
+    contentProbe.renders()
+    React.useEffect(() => {
+      contentProbe.mounts()
+      const unsubscribe = useAppStore.subscribe(() => contentProbe.storeNotifications())
+      return () => {
+        contentProbe.unmounts()
+        unsubscribe()
+      }
+    }, [])
+    // Why: render while closed so the marker measures Orca's content gate, not Radix's portal gate.
+    return <div data-workspace-cleanup-heavy-content="true" />
+  }
+  return {
+    Dialog: Passthrough,
+    DialogContent,
+    DialogDescription: Passthrough,
+    DialogFooter: Passthrough,
+    DialogHeader: Passthrough,
+    DialogTitle: Passthrough
+  }
+})
+
+type Deferred<T> = {
+  promise: Promise<T>
+  resolve: (value: T) => void
+}
+
+const initialAppState = useAppStore.getInitialState()
+const fixtureState = makeState()
+const initialCandidate = makeCandidate()
+const initialScan = makeScan(1, initialCandidate)
+let testContainer: HTMLDivElement
+let testRoot: Root
+
+function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((resolvePromise) => {
+    resolve = resolvePromise
+  })
+  return { promise, resolve }
+}
+
+function makeScan(index: number, candidate: WorkspaceCleanupCandidate): WorkspaceCleanupScanResult {
+  return {
+    scannedAt: NOW + index,
+    candidates: [candidate],
+    errors: []
+  }
+}
+
+function makeChurnCandidate(index: number): WorkspaceCleanupCandidate {
+  return makeCandidate({
+    worktreeId: `repo-1::/repo/background-${index}`,
+    displayName: `background-${index}`,
+    path: `/repo/background-${index}`,
+    fingerprint: `background-${index}`
+  })
+}
+
+function activeContentSubscriptions(): number {
+  return contentProbe.mounts.mock.calls.length - contentProbe.unmounts.mock.calls.length
+}
+
+function requireStoreListenerCount(): number {
+  const count = readStoreListenerCount()
+  expect(count).not.toBeNull()
+  return count ?? 0
+}
+
+async function flushEffects(): Promise<void> {
+  await act(async () => {
+    await Promise.resolve()
+    await Promise.resolve()
+  })
+}
+
+async function renderDialog(): Promise<void> {
+  await act(async () => testRoot.render(<WorkspaceCleanupDialog />))
+  await flushEffects()
+}
+
+async function openDialog(): Promise<void> {
+  await act(async () => useAppStore.getState().openModal('workspace-cleanup'))
+  await flushEffects()
+}
+
+async function closeDialog(): Promise<void> {
+  await act(async () => useAppStore.getState().closeModal())
+  await flushEffects()
+}
+
+async function publishScanProgress(index: number): Promise<void> {
+  const scan = makeScan(index, makeChurnCandidate(index))
+  await act(async () => {
+    useAppStore.setState({
+      workspaceCleanupScan: scan,
+      workspaceCleanupProgress: {
+        ...scan,
+        scanId: `scan-${index}`,
+        scannedWorktreeCount: 1,
+        totalWorktreeCount: 1
+      }
+    })
+  })
+}
+
+async function publishReviewChurn(index: number): Promise<void> {
+  await act(async () => {
+    useAppStore.setState({
+      hostedReviewCache: {
+        [`background-${index}`]: { data: null, fetchedAt: NOW + index }
+      }
+    })
+  })
+}
+
+async function publishDeleteChurn(index: number): Promise<void> {
+  const candidate = makeChurnCandidate(index)
+  await act(async () => {
+    useAppStore.setState({
+      deleteStateByWorktreeId: {
+        [candidate.worktreeId]: {
+          isDeleting: true,
+          phase: 'queued',
+          error: null,
+          canForceDelete: false,
+          forceDeleteReason: null
+        }
+      }
+    })
+  })
+}
+
+function seedStore(
+  scanWorkspaceCleanup: AppState['scanWorkspaceCleanup'] = vi.fn(async () => initialScan)
+): void {
+  useAppStore.setState(initialAppState, true)
+  useAppStore.setState({
+    activeModal: 'none',
+    repos: fixtureState.repos,
+    worktreesByRepo: fixtureState.worktreesByRepo,
+    hostedReviewCache: {},
+    deleteStateByWorktreeId: {},
+    workspaceCleanupScan: initialScan,
+    workspaceCleanupProgress: null,
+    workspaceCleanupLoading: false,
+    workspaceCleanupError: null,
+    scanWorkspaceCleanup
+  })
+}
+
+describe('WorkspaceCleanupDialog mount gating', () => {
+  beforeEach(() => {
+    globalThis.IS_REACT_ACT_ENVIRONMENT = true
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    Object.values(contentProbe).forEach((probe) => probe.mockClear())
+    Object.values(toastProbe).forEach((probe) => probe.mockClear())
+    seedStore()
+    testContainer = document.createElement('div')
+    document.body.appendChild(testContainer)
+    testRoot = createRoot(testContainer)
+  })
+
+  afterEach(async () => {
+    await act(async () => testRoot.unmount())
+    document.body.replaceChildren()
+    useAppStore.setState(initialAppState, true)
+    vi.clearAllTimers()
+    vi.useRealTimers()
+  })
+
+  it('keeps heavy content through 299 ms, then drops its projections and subscriptions', async () => {
+    const listenerBaseline = requireStoreListenerCount()
+    await renderDialog()
+    const shellListenerCount = requireStoreListenerCount()
+
+    expect(shellListenerCount).toBe(listenerBaseline + 1)
+    expect(testContainer.querySelector('[data-workspace-cleanup-heavy-content]')).toBeNull()
+    expect(activeContentSubscriptions()).toBe(0)
+
+    await openDialog()
+    const openListenerCount = requireStoreListenerCount()
+
+    expect(testContainer.querySelector('[data-workspace-cleanup-heavy-content]')).not.toBeNull()
+    expect(activeContentSubscriptions()).toBe(1)
+    expect(openListenerCount).toBeGreaterThan(shellListenerCount)
+
+    await closeDialog()
+    await act(async () => vi.advanceTimersByTimeAsync(299))
+
+    expect(testContainer.querySelector('[data-workspace-cleanup-heavy-content]')).not.toBeNull()
+    expect(activeContentSubscriptions()).toBe(1)
+
+    const lingeringProjectionCount = contentProbe.projections.mock.calls.length
+    const lingeringNotificationCount = contentProbe.storeNotifications.mock.calls.length
+    await publishScanProgress(2)
+    await publishReviewChurn(2)
+    await publishDeleteChurn(2)
+
+    expect(contentProbe.projections.mock.calls.length).toBeGreaterThan(lingeringProjectionCount)
+    expect(contentProbe.storeNotifications.mock.calls.length).toBeGreaterThan(
+      lingeringNotificationCount
+    )
+
+    await act(async () => vi.advanceTimersByTimeAsync(1))
+
+    expect(testContainer.querySelector('[data-workspace-cleanup-heavy-content]')).toBeNull()
+    expect(activeContentSubscriptions()).toBe(0)
+    expect(requireStoreListenerCount()).toBe(shellListenerCount)
+
+    const hiddenProjectionCount = contentProbe.projections.mock.calls.length
+    const hiddenRenderCount = contentProbe.renders.mock.calls.length
+    const hiddenNotificationCount = contentProbe.storeNotifications.mock.calls.length
+    for (let index = 3; index < 103; index += 1) {
+      await publishScanProgress(index)
+      await publishReviewChurn(index)
+      await publishDeleteChurn(index)
+    }
+
+    expect(contentProbe.projections).toHaveBeenCalledTimes(hiddenProjectionCount)
+    expect(contentProbe.renders).toHaveBeenCalledTimes(hiddenRenderCount)
+    expect(contentProbe.storeNotifications).toHaveBeenCalledTimes(hiddenNotificationCount)
+  })
+
+  it('cancels the pending content unmount when reopened during the linger', async () => {
+    await renderDialog()
+    await openDialog()
+    await closeDialog()
+    await act(async () => vi.advanceTimersByTimeAsync(299))
+    await openDialog()
+    await act(async () => vi.advanceTimersByTimeAsync(1_000))
+
+    expect(testContainer.querySelector('[data-workspace-cleanup-heavy-content]')).not.toBeNull()
+    expect(activeContentSubscriptions()).toBe(1)
+
+    const projectionCount = contentProbe.projections.mock.calls.length
+    await publishScanProgress(4)
+    expect(contentProbe.projections.mock.calls.length).toBeGreaterThan(projectionCount)
+  })
+
+  it('toasts when an open-time scan settles after the closed content unmounts', async () => {
+    const pendingScan = deferred<WorkspaceCleanupScanResult>()
+    const scanWorkspaceCleanup = vi.fn(() => pendingScan.promise)
+    seedStore(scanWorkspaceCleanup)
+    await renderDialog()
+    await openDialog()
+
+    expect(scanWorkspaceCleanup).toHaveBeenCalledTimes(1)
+
+    await closeDialog()
+    await act(async () => vi.advanceTimersByTimeAsync(300))
+    expect(testContainer.querySelector('[data-workspace-cleanup-heavy-content]')).toBeNull()
+
+    const completedScan = makeScan(5, makeChurnCandidate(5))
+    await act(async () => {
+      pendingScan.resolve(completedScan)
+      await pendingScan.promise
+      await Promise.resolve()
+    })
+    await flushEffects()
+
+    expect(toastProbe.success).toHaveBeenCalledWith(
+      'Inactive workspace scan ready',
+      expect.objectContaining({
+        action: expect.objectContaining({ label: 'Review' })
+      })
+    )
+  })
+})
diff --git a/src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.tsx b/src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.tsx
index 0c870ee4485..586618d521b 100644
--- a/src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.tsx
+++ b/src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.tsx
@@ -1,7 +1,7 @@
 /* eslint-disable max-lines -- Why: the cleanup dialog keeps scan status,
    filters, row actions, localized review copy, and force-aware confirmation
    in one modal flow. */
-import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import React, { useCallback, useEffect, useMemo, useState } from 'react'
 import {
   AlertTriangle,
   Info,
@@ -12,7 +12,6 @@ import {
   Trash2,
   X
 } from 'lucide-react'
-import { toast } from 'sonner'
 import { useShallow } from 'zustand/react/shallow'
 import {
   Dialog,
@@ -41,7 +40,6 @@ import { Progress } from '@/components/ui/progress'
 import RepoMultiCombobox from '@/components/ui/repo-multi-combobox'
 import { ScrollArea } from '@/components/ui/scroll-area'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
-import { useMountedRef } from '@/hooks/useMountedRef'
 import { useAppStore } from '@/store'
 import { cn } from '@/lib/utils'
 import { activateAndRevealWorktree } from '@/lib/worktree-activation'
@@ -65,10 +63,7 @@ import {
   type WorkspaceCleanupSortKey,
   type WorkspaceCleanupTimeFilter
 } from './workspace-cleanup-presentation'
-import {
-  startWorkspaceCleanupBackgroundRemoval,
-  type WorkspaceCleanupRemovalProgress
-} from './workspace-cleanup-background-removal'
+import type { WorkspaceCleanupRemovalProgress } from './workspace-cleanup-background-removal'
 import { countEstimatedInactiveWorkspaces } from './inactive-workspace-estimate'
 import { CandidateRow, type WorkspaceCleanupDeletionPhase } from './workspace-cleanup-candidate-row'
 import { WorkspaceCleanupCandidateList } from './workspace-cleanup-candidate-list'
@@ -85,16 +80,14 @@ import {
   type WorkspaceCleanupView,
   type WorkspaceCleanupViewCounts
 } from './workspace-cleanup-view-selection'
-import { filterWorkspaceCleanupRemovalCandidates } from './workspace-cleanup-removal-candidates'
+import {
+  DEFAULT_WORKSPACE_CLEANUP_FILTERS,
+  useWorkspaceCleanupDialogSession,
+  type WorkspaceCleanupDialogSession
+} from './workspace-cleanup-dialog-session'
 import { translate } from '@/i18n/i18n'
 
-const DEFAULT_FILTERS: WorkspaceCleanupFilters = {
-  query: '',
-  time: 'all',
-  review: 'all',
-  git: 'all',
-  context: 'all'
-}
+const WORKSPACE_CLEANUP_CLOSE_LINGER_MS = 300
 
 const EMPTY_REVIEW_INFO: WorkspaceCleanupReviewInfo = {
   hasReview: false,
@@ -176,13 +169,67 @@ function formatScanErrorReason(message: string | undefined): string {
   return message.replace(/\.$/, '')
 }
 
-export default function WorkspaceCleanupDialog(): React.JSX.Element {
-  const activeModal = useAppStore((s) => s.activeModal)
-  const openModal = useAppStore((s) => s.openModal)
-  const closeModal = useAppStore((s) => s.closeModal)
+export default function WorkspaceCleanupDialog(): React.JSX.Element | null {
+  // Why: scans and removals outlive the modal; only the subscribed projection tree may unmount.
+  const session = useWorkspaceCleanupDialogSession()
+  const [lingering, setLingering] = useState(session.open)
+  useEffect(() => {
+    if (session.open) {
+      setLingering(true)
+      return
+    }
+    const timer = window.setTimeout(() => setLingering(false), WORKSPACE_CLEANUP_CLOSE_LINGER_MS)
+    return () => window.clearTimeout(timer)
+  }, [session.open])
+
+  if (!session.open && !lingering) {
+    return null
+  }
+  return <WorkspaceCleanupDialogContent session={session} />
+}
+
+function WorkspaceCleanupDialogContent({
+  session
+}: {
+  session: WorkspaceCleanupDialogSession
+}): React.JSX.Element {
+  const {
+    open,
+    loading,
+    selectedIds,
+    setSelectedIds,
+    expandedRowIds,
+    setExpandedRowIds,
+    activeView,
+    setActiveView,
+    confirming,
+    confirmCandidates,
+    removalProgress,
+    removalInFlight,
+    rowFailures,
+    repoSelection,
+    setRepoSelection,
+    filters,
+    setFilters,
+    sortKey,
+    setSortKey,
+    sortDirection,
+    setSortDirection,
+    selectedDefaultsScanAtRef,
+    removalInFlightRef,
+    close: closeModal,
+    markCandidateViewed,
+    restoreDismissals: resetDismissals,
+    startScan: startWorkspaceCleanupScan,
+    ignoreCandidate,
+    applyScanDefaults,
+    openConfirmRemove,
+    cancelConfirmRemove,
+    backToWorkspaceCleanupList,
+    confirmRemove
+  } = session
   const scan = useAppStore((s) => s.workspaceCleanupScan)
   const scanProgress = useAppStore((s) => s.workspaceCleanupProgress)
-  const loading = useAppStore((s) => s.workspaceCleanupLoading)
   const error = useAppStore((s) => s.workspaceCleanupError)
   const repos = useAppStore((s) => s.repos)
   const reviewStateInputs = useAppStore(
@@ -193,13 +240,6 @@ export default function WorkspaceCleanupDialog(): React.JSX.Element {
       settings: s.settings
     }))
   )
-  const scanWorkspaceCleanup = useAppStore((s) => s.scanWorkspaceCleanup)
-  const markCandidateViewed = useAppStore((s) => s.markWorkspaceCleanupCandidateViewed)
-  const dismissCandidates = useAppStore((s) => s.dismissWorkspaceCleanupCandidates)
-  const resetDismissals = useAppStore((s) => s.resetWorkspaceCleanupDismissals)
-  const removeCandidates = useAppStore((s) => s.removeWorkspaceCleanupCandidates)
-  const markWorktreesQueuedForDeletion = useAppStore((s) => s.markWorktreesQueuedForDeletion)
-  const clearWorktreeDeleteState = useAppStore((s) => s.clearWorktreeDeleteState)
   const deletionPhaseByWorktreeId = useAppStore(
     useShallow((s) => {
       const phases: Record<string, WorkspaceCleanupDeletionPhase> = {}
@@ -216,127 +256,16 @@ export default function WorkspaceCleanupDialog(): React.JSX.Element {
     [deletionPhaseByWorktreeId]
   )
 
-  const open = activeModal === 'workspace-cleanup'
-  const openRef = useRef(open)
-  const [selectedIds, setSelectedIds] = useState<Set<string>>(() => new Set())
-  const [expandedRowIds, setExpandedRowIds] = useState<Set<string>>(() => new Set())
   const [rowsScrollElement, setRowsScrollElement] = useState<HTMLDivElement | null>(null)
-  const [activeView, setActiveView] = useState<WorkspaceCleanupView>('ready')
-  const [confirming, setConfirming] = useState(false)
-  const [confirmCandidates, setConfirmCandidates] = useState<WorkspaceCleanupCandidate[]>([])
-  const [removalProgress, setRemovalProgress] = useState<WorkspaceCleanupRemovalProgress | null>(
-    null
-  )
-  // Why: `removalProgress` only arrives once the batch reports, so rendering
-  // needs its own in-flight flag; removalInFlightRef stays the synchronous guard.
-  const [removalInFlight, setRemovalInFlight] = useState(false)
-  const [rowFailures, setRowFailures] = useState<Record<string, string>>({})
-  const [repoSelection, setRepoSelection] = useState<ReadonlySet<string>>(() => new Set())
-  const [filters, setFilters] = useState<WorkspaceCleanupFilters>(DEFAULT_FILTERS)
-  const [sortKey, setSortKey] = useState<WorkspaceCleanupSortKey>('activity')
-  const [sortDirection, setSortDirection] = useState<WorkspaceCleanupSortDirection>('asc')
-  const selectedDefaultsScanAtRef = useRef<number | null>(null)
-  const autoScanAttemptedForOpenRef = useRef(false)
-  const latestReadyToastScanAtRef = useRef<number | null>(null)
-  const wasOpenRef = useRef(false)
-  const removalInFlightRef = useRef(false)
-  // Why: the dialog stays mounted across cleanup runs, so late settlements from
-  // an earlier batch must not mutate a newer batch's row/selection state.
-  const removalBatchIdRef = useRef(0)
-  const mountedRef = useMountedRef()
   const eligibleRepos = useMemo(() => repos.filter((repo) => isGitRepoKind(repo)), [repos])
   const eligibleRepoIds = useMemo(() => eligibleRepos.map((repo) => repo.id), [eligibleRepos])
 
-  useEffect(() => {
-    openRef.current = open
-  }, [open])
-
-  const startWorkspaceCleanupScan = useCallback(
-    (options: { notifyWhenReady?: boolean } = {}) => {
-      setRowFailures({})
-      void scanWorkspaceCleanup()
-        .then((result) => {
-          if (!mountedRef.current || !options.notifyWhenReady || openRef.current) {
-            return
-          }
-          if (latestReadyToastScanAtRef.current === result.scannedAt) {
-            return
-          }
-          latestReadyToastScanAtRef.current = result.scannedAt
-          const suggestedCount = result.candidates.filter(
-            (candidate) => candidate.selectedByDefault
-          ).length
-          toast.success(
-            translate(
-              'auto.components.workspace.cleanup.WorkspaceCleanupDialog.0e2d235c63',
-              'Inactive workspace scan ready'
-            ),
-            {
-              description: formatWorkspaceCleanupReadyToastDescription(
-                result.candidates.length,
-                suggestedCount
-              ),
-              action: {
-                label: translate(
-                  'auto.components.workspace.cleanup.WorkspaceCleanupDialog.4a35c08764',
-                  'Review'
-                ),
-                onClick: () => openModal('workspace-cleanup')
-              }
-            }
-          )
-        })
-        .catch((err: unknown) => {
-          if (mountedRef.current) {
-            toast.error(
-              translate(
-                'auto.components.workspace.cleanup.WorkspaceCleanupDialog.662b8ec3f8',
-                'Workspace cleanup scan failed'
-              ),
-              {
-                description: err instanceof Error ? err.message : String(err)
-              }
-            )
-          }
-        })
-    },
-    [mountedRef, openModal, scanWorkspaceCleanup]
-  )
-
-  useEffect(() => {
-    if (!open) {
-      wasOpenRef.current = false
-      autoScanAttemptedForOpenRef.current = false
-      return
-    }
-    if (!wasOpenRef.current) {
-      wasOpenRef.current = true
-      autoScanAttemptedForOpenRef.current = false
-      if (!removalInFlightRef.current) {
-        setActiveView('ready')
-        setConfirming(false)
-        setRowFailures({})
-        setFilters(DEFAULT_FILTERS)
-        setSortKey('activity')
-        setSortDirection('asc')
-        setSelectedIds(new Set())
-      }
-    }
-    // Why: reopening mid-batch keeps the deletion progress view; a broad scan
-    // started here would be discarded by the removal's scan invalidation, so
-    // skip it while a removal batch is running (matches the reset guard above).
-    if (!loading && !autoScanAttemptedForOpenRef.current && !removalInFlightRef.current) {
-      autoScanAttemptedForOpenRef.current = true
-      startWorkspaceCleanupScan({ notifyWhenReady: true })
-    }
-  }, [loading, open, startWorkspaceCleanupScan])
-
   useEffect(() => {
     if (!open) {
       return
     }
     setRepoSelection(new Set(eligibleRepoIds))
-  }, [eligibleRepoIds, open])
+  }, [eligibleRepoIds, open, setRepoSelection])
 
   const candidates = useMemo(() => scan?.candidates ?? [], [scan?.candidates])
   const reviewInfoByWorktreeId = useMemo(() => {
@@ -400,13 +329,8 @@ export default function WorkspaceCleanupDialog(): React.JSX.Element {
       return
     }
     selectedDefaultsScanAtRef.current = scan.scannedAt
-    if (removalInFlightRef.current) {
-      return
-    }
-    setSelectedIds(getDefaultSelectedWorkspaceCleanupIds(scan.candidates, deletingWorktreeIds))
-    setConfirming(false)
-    setRowFailures({})
-  }, [deletingWorktreeIds, loading, scan])
+    applyScanDefaults(scan.candidates, deletingWorktreeIds)
+  }, [applyScanDefaults, deletingWorktreeIds, loading, scan, selectedDefaultsScanAtRef])
 
   const visibleCandidates = useMemo(() => {
     const rows = filteredCandidates.filter((candidate) => !candidate.blockers.includes('dismissed'))
@@ -501,7 +425,7 @@ export default function WorkspaceCleanupDialog(): React.JSX.Element {
       )
       return next.size === current.size ? current : next
     })
-  }, [activeRowIds, confirming, deletingWorktreeIds, open])
+  }, [activeRowIds, confirming, deletingWorktreeIds, open, setSelectedIds])
 
   const handleOpenChange = useCallback(
     (nextOpen: boolean) => {
@@ -516,54 +440,19 @@ export default function WorkspaceCleanupDialog(): React.JSX.Element {
     startWorkspaceCleanupScan({ notifyWhenReady: true })
   }, [startWorkspaceCleanupScan])
 
-  const ignoreCandidate = useCallback(
-    (candidate: WorkspaceCleanupCandidate) => {
-      void dismissCandidates([candidate])
-        .then(() => {
-          if (mountedRef.current) {
-            setSelectedIds((current) => {
-              const next = new Set(current)
-              next.delete(candidate.worktreeId)
-              return next
-            })
-          }
-        })
-        .catch((err: unknown) => {
-          if (mountedRef.current) {
-            toast.error(
-              translate(
-                'auto.components.workspace.cleanup.WorkspaceCleanupDialog.7f451a3e2c',
-                'Could not ignore cleanup suggestion'
-              ),
-              {
-                description: err instanceof Error ? err.message : String(err)
-              }
-            )
-          }
-        })
+  const toggleExpandedRow = useCallback(
+    (worktreeId: string) => {
+      setExpandedRowIds((current) => toggleSetMember(current, worktreeId))
     },
-    [dismissCandidates, mountedRef]
+    [setExpandedRowIds]
   )
 
-  const toggleExpandedRow = useCallback((worktreeId: string) => {
-    setExpandedRowIds((current) => toggleSetMember(current, worktreeId))
-  }, [])
-
-  const toggleSelectedRow = useCallback((worktreeId: string) => {
-    setSelectedIds((current) => toggleSetMember(current, worktreeId))
-  }, [])
-
-  const openConfirmRemove = useCallback((candidates: readonly WorkspaceCleanupCandidate[]) => {
-    const nextCandidates = filterWorkspaceCleanupRemovalCandidates(
-      candidates,
-      useAppStore.getState().deleteStateByWorktreeId
-    )
-    if (nextCandidates.length === 0) {
-      return
-    }
-    setConfirmCandidates(nextCandidates)
-    setConfirming(true)
-  }, [])
+  const toggleSelectedRow = useCallback(
+    (worktreeId: string) => {
+      setSelectedIds((current) => toggleSetMember(current, worktreeId))
+    },
+    [setSelectedIds]
+  )
 
   // Why: stable per-row handlers so React.memo keeps unchanged CandidateRow
   // instances from re-rendering on scan stream-in and selection changes.
@@ -575,7 +464,7 @@ export default function WorkspaceCleanupDialog(): React.JSX.Element {
       setSelectedIds(new Set([candidate.worktreeId]))
       openConfirmRemove([candidate])
     },
-    [loading, openConfirmRemove]
+    [loading, openConfirmRemove, removalInFlightRef, setSelectedIds]
   )
 
   const handleViewCandidate = useCallback(
@@ -587,143 +476,6 @@ export default function WorkspaceCleanupDialog(): React.JSX.Element {
     [closeModal, markCandidateViewed]
   )
 
-  const cancelConfirmRemove = useCallback(() => {
-    if (removalProgress) {
-      closeModal()
-      return
-    }
-    setConfirming(false)
-    setConfirmCandidates([])
-  }, [closeModal, removalProgress])
-
-  // Why: the header X reads as "leave this screen", not "abandon the dialog". The batch
-  // keeps running in the background either way, and the list shows each row's progress.
-  // Diverges from cancelConfirmRemove, which closes the dialog mid-batch: here
-  // removalProgress stays set until the batch settles, so re-entry is still blocked.
-  const backToWorkspaceCleanupList = useCallback(() => {
-    setConfirming(false)
-    setConfirmCandidates([])
-  }, [])
-
-  const clearQueuedDeleteState = useCallback(
-    (worktreeId: string) => {
-      const deleteState = useAppStore.getState().deleteStateByWorktreeId[worktreeId]
-      // Why: candidates that fail before removal starts would otherwise stay
-      // marked "Queued for deletion" in the sidebar; rows already in the
-      // 'deleting' phase or failed with an error keep their own state.
-      if (deleteState?.isDeleting && deleteState.error === null && deleteState.phase === 'queued') {
-        clearWorktreeDeleteState(worktreeId)
-      }
-    },
-    [clearWorktreeDeleteState]
-  )
-
-  const deselectRemovedIds = useCallback((removedIds: readonly string[]) => {
-    if (removedIds.length === 0) {
-      return
-    }
-    setSelectedIds((current) => {
-      const next = new Set(current)
-      for (const id of removedIds) {
-        next.delete(id)
-      }
-      return next
-    })
-  }, [])
-
-  const confirmRemove = useCallback(() => {
-    if (confirmCandidates.length === 0 || removalInFlightRef.current) {
-      return
-    }
-    const removableCandidates = filterWorkspaceCleanupRemovalCandidates(
-      confirmCandidates,
-      useAppStore.getState().deleteStateByWorktreeId
-    )
-    if (removableCandidates.length === 0) {
-      setConfirming(false)
-      setConfirmCandidates([])
-      return
-    }
-    removalInFlightRef.current = true
-    setRemovalInFlight(true)
-    removalBatchIdRef.current += 1
-    const removalBatchId = removalBatchIdRef.current
-    // Why: a hung late settlement retains these callbacks for the renderer's
-    // lifetime; capture only ids so it cannot pin the candidate objects.
-    const removableWorktreeIds = removableCandidates.map((candidate) => candidate.worktreeId)
-    setRowFailures({})
-    markWorktreesQueuedForDeletion(removableWorktreeIds)
-    startWorkspaceCleanupBackgroundRemoval({
-      candidates: removableCandidates,
-      removeCandidates,
-      onProgress: (progress) => {
-        if (mountedRef.current) {
-          setRemovalProgress(progress)
-        }
-      },
-      onRowFailed: (failure) => {
-        clearQueuedDeleteState(failure.worktreeId)
-      },
-      onResult: (result) => {
-        const nextFailures: Record<string, string> = {}
-        for (const failure of result.failures) {
-          nextFailures[failure.worktreeId] = failure.message
-          clearQueuedDeleteState(failure.worktreeId)
-        }
-        if (mountedRef.current) {
-          setRowFailures(nextFailures)
-          deselectRemovedIds(result.removedIds)
-          setRemovalProgress(null)
-          setRemovalInFlight(false)
-          setConfirming(false)
-          setConfirmCandidates([])
-        }
-        removalInFlightRef.current = false
-      },
-      onLateResult: (result) => {
-        for (const failure of result.failures) {
-          // Why: a late failure can come from a hung preflight whose row never
-          // reached 'deleting'; clear its queued overlay like every other path.
-          clearQueuedDeleteState(failure.worktreeId)
-        }
-        if (!mountedRef.current || removalBatchIdRef.current !== removalBatchId) {
-          return
-        }
-        setRowFailures((current) => {
-          const next = { ...current }
-          for (const id of result.removedIds) {
-            delete next[id]
-          }
-          for (const failure of result.failures) {
-            next[failure.worktreeId] = failure.message
-          }
-          return next
-        })
-        deselectRemovedIds(result.removedIds)
-      },
-      onError: () => {
-        for (const worktreeId of removableWorktreeIds) {
-          clearWorktreeDeleteState(worktreeId)
-        }
-        if (mountedRef.current) {
-          setRemovalProgress(null)
-          setRemovalInFlight(false)
-          setConfirming(false)
-          setConfirmCandidates([])
-        }
-        removalInFlightRef.current = false
-      }
-    })
-  }, [
-    clearQueuedDeleteState,
-    clearWorktreeDeleteState,
-    confirmCandidates,
-    deselectRemovedIds,
-    markWorktreesQueuedForDeletion,
-    mountedRef,
-    removeCandidates
-  ])
-
   const selectedCount = selectedCandidates.length
 
   return (
@@ -961,7 +713,7 @@ export default function WorkspaceCleanupDialog(): React.JSX.Element {
                           'auto.components.workspace.cleanup.WorkspaceCleanupDialog.e94b1f8bb4',
                           'Clear filters'
                         )}
-                        onAction={() => setFilters(DEFAULT_FILTERS)}
+                        onAction={() => setFilters(DEFAULT_WORKSPACE_CLEANUP_FILTERS)}
                       />
                     ) : null}
                     {!loading &&
@@ -1551,31 +1303,6 @@ function hasActiveWorkspaceCleanupPanelControls(
   )
 }
 
-function getDefaultSelectedWorkspaceCleanupIds(
-  candidates: readonly WorkspaceCleanupCandidate[],
-  deletingWorktreeIds: ReadonlySet<string> = new Set()
-): Set<string> {
-  return new Set(
-    candidates
-      .filter(
-        (candidate) => candidate.selectedByDefault && !deletingWorktreeIds.has(candidate.worktreeId)
-      )
-      .map((candidate) => candidate.worktreeId)
-  )
-}
-
-function formatWorkspaceCleanupReadyToastDescription(
-  inactiveCount: number,
-  suggestedCount: number
-): string {
-  if (inactiveCount === 0) {
-    return 'No inactive workspaces found.'
-  }
-  const inactiveNoun = inactiveCount === 1 ? 'workspace' : 'workspaces'
-  const suggestedNoun = suggestedCount === 1 ? 'suggestion' : 'suggestions'
-  return `${inactiveCount} inactive ${inactiveNoun} found, with ${suggestedCount} cleanup ${suggestedNoun}.`
-}
-
 function formatWorkspaceCleanupRemovalProgress(progress: WorkspaceCleanupRemovalProgress): string {
   const deletedText = translate(
     'auto.components.workspace.cleanup.WorkspaceCleanupDialog.4c2990886e',
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.test.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.test.ts
index 9b785d3ed71..2503a9a68fc 100644
--- a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.test.ts
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.test.ts
@@ -14,6 +14,12 @@ vi.mock('sonner', () => ({
   }
 }))
 
+vi.mock('../sidebar/preserved-branch-batch-toast', () => ({
+  showPreservedBranchBatchToast: vi.fn()
+}))
+
+import { showPreservedBranchBatchToast } from '../sidebar/preserved-branch-batch-toast'
+
 async function settleBackgroundRemoval(): Promise<void> {
   for (let index = 0; index < 10; index += 1) {
     await Promise.resolve()
@@ -131,6 +137,54 @@ describe('startWorkspaceCleanupBackgroundRemoval', () => {
     })
   })
 
+  it('reports all preserved branches in one cleanup result', async () => {
+    const first = makeCandidate()
+    const second = makeCandidate({
+      worktreeId: 'repo-1::/repo/beta',
+      displayName: 'beta',
+      branch: 'beta',
+      path: '/repo/beta'
+    })
+    const firstBranch = {
+      worktreeId: first.worktreeId,
+      branchName: 'feature/alpha',
+      expectedHead: 'alpha-head'
+    }
+    const secondBranch = {
+      worktreeId: second.worktreeId,
+      branchName: 'feature/beta',
+      expectedHead: 'beta-head'
+    }
+    const onResult = vi.fn()
+
+    startWorkspaceCleanupBackgroundRemoval({
+      candidates: [first, second],
+      removeCandidates: vi
+        .fn()
+        .mockResolvedValueOnce({
+          removedIds: [first.worktreeId],
+          failures: [],
+          preservedBranches: [firstBranch]
+        })
+        .mockResolvedValueOnce({
+          removedIds: [second.worktreeId],
+          failures: [],
+          preservedBranches: [secondBranch]
+        }),
+      onProgress: vi.fn(),
+      onResult
+    })
+    await settleBackgroundRemoval()
+
+    expect(onResult).toHaveBeenCalledWith({
+      removedIds: [first.worktreeId, second.worktreeId],
+      failures: [],
+      preservedBranches: [firstBranch, secondBranch]
+    })
+    expect(showPreservedBranchBatchToast).toHaveBeenCalledWith(2, [firstBranch, secondBranch])
+    expect(toast.success).not.toHaveBeenCalledWith('Removed workspaces: 2')
+  })
+
   it('removes nested candidates before their parent workspace', async () => {
     const parent = makeCandidate({
       worktreeId: 'repo-1::/repo/parent',
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.ts
index d9a04bf8af7..2384e4749b7 100644
--- a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.ts
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.ts
@@ -75,6 +75,7 @@ export function startWorkspaceCleanupBackgroundRemoval({
   const count = candidates.length
   const removedIds: string[] = []
   const failures: WorkspaceCleanupFailure[] = []
+  const preservedBranches: NonNullable<WorkspaceCleanupRemoveResult['preservedBranches']> = []
   const failedCandidates: WorkspaceCleanupCandidate[] = []
   const lateSettlementTrackers: WorkspaceCleanupLateSettlementTracker[] = []
   // Why: rows past the removal deadline are still removing; their skip fallout
@@ -200,6 +201,7 @@ export function startWorkspaceCleanupBackgroundRemoval({
               pendingSettlementFailures.delete(timeoutFailure)
               provisionallyBlocked.delete(candidate)
               removedIds.push(...lateResult.removedIds)
+              preservedBranches.push(...(lateResult.preservedBranches ?? []))
               reportFailures(lateResult.failures)
               if (lateResult.failures.length === 0) {
                 removeArrayEntry(failedCandidates, candidate)
@@ -212,6 +214,7 @@ export function startWorkspaceCleanupBackgroundRemoval({
         }
         const result = outcome.result
         removedIds.push(...result.removedIds)
+        preservedBranches.push(...(result.preservedBranches ?? []))
         reportFailures(result.failures)
         if (result.failures.length > 0) {
           failedCandidates.push(candidate)
@@ -244,7 +247,11 @@ export function startWorkspaceCleanupBackgroundRemoval({
         }
       })
     )
-    const result = { removedIds, failures }
+    const result: WorkspaceCleanupRemoveResult = {
+      removedIds,
+      failures,
+      ...(preservedBranches.length > 0 ? { preservedBranches } : {})
+    }
     try {
       onResult?.(result)
     } catch (callbackError) {
@@ -282,7 +289,7 @@ function reportLateWorkspaceCleanupResult(
 
 function removeArrayEntry<T>(entries: T[], entry: T): void {
   const index = entries.indexOf(entry)
-  if (index >= 0) {
+  if (index !== -1) {
     entries.splice(index, 1)
   }
 }
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-dialog-session.test.tsx b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-dialog-session.test.tsx
new file mode 100644
index 00000000000..ae35cbc9b6d
--- /dev/null
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-dialog-session.test.tsx
@@ -0,0 +1,175 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { WorkspaceCleanupScanResult } from '../../../../shared/workspace-cleanup'
+import { useAppStore } from '@/store'
+import type { WorkspaceCleanupRemoveResult } from '@/store/slices/workspace-cleanup'
+import {
+  useWorkspaceCleanupDialogSession,
+  type WorkspaceCleanupDialogSession
+} from './workspace-cleanup-dialog-session'
+import { makeCandidate } from './workspace-cleanup-presentation-fixtures'
+
+const toastMocks = vi.hoisted(() => ({
+  error: vi.fn(),
+  info: vi.fn(),
+  success: vi.fn()
+}))
+
+vi.mock('sonner', () => ({ toast: toastMocks }))
+
+const initialAppState = useAppStore.getInitialState()
+let container: HTMLDivElement
+let root: Root
+let currentSession: WorkspaceCleanupDialogSession | null
+
+function deferred<T>(): {
+  promise: Promise<T>
+  resolve: (value: T) => void
+} {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((innerResolve) => {
+    resolve = innerResolve
+  })
+  return { promise, resolve }
+}
+
+function Probe(): null {
+  currentSession = useWorkspaceCleanupDialogSession()
+  return null
+}
+
+function session(): WorkspaceCleanupDialogSession {
+  if (!currentSession) {
+    throw new Error('Workspace cleanup session probe is not mounted')
+  }
+  return currentSession
+}
+
+async function renderProbe(): Promise<void> {
+  await act(async () => root.render(<Probe />))
+}
+
+describe('useWorkspaceCleanupDialogSession', () => {
+  beforeEach(() => {
+    globalThis.IS_REACT_ACT_ENVIRONMENT = true
+    vi.clearAllMocks()
+    useAppStore.setState(initialAppState, true)
+    useAppStore.setState({
+      activeModal: 'workspace-cleanup',
+      workspaceCleanupLoading: false,
+      deleteStateByWorktreeId: {}
+    })
+    currentSession = null
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+  })
+
+  afterEach(async () => {
+    await act(async () => root.unmount())
+    container.remove()
+    currentSession = null
+    useAppStore.setState(initialAppState, true)
+  })
+
+  it('offers to reopen when a scan finishes after the dialog closes', async () => {
+    const candidate = makeCandidate()
+    const scan = deferred<WorkspaceCleanupScanResult>()
+    const scanWorkspaceCleanup = vi.fn(() => scan.promise)
+    useAppStore.setState({ scanWorkspaceCleanup })
+
+    await renderProbe()
+    expect(scanWorkspaceCleanup).toHaveBeenCalledOnce()
+
+    await act(async () => useAppStore.getState().closeModal())
+    expect(session().open).toBe(false)
+
+    await act(async () => {
+      scan.resolve({ scannedAt: 42, candidates: [candidate], errors: [] })
+      await scan.promise
+    })
+
+    expect(toastMocks.success).toHaveBeenCalledWith(
+      'Inactive workspace scan ready',
+      expect.objectContaining({
+        description: '1 inactive workspace found, with 1 cleanup suggestion.',
+        action: expect.objectContaining({ label: 'Review' })
+      })
+    )
+    const options = toastMocks.success.mock.lastCall?.[1] as {
+      action?: { onClick: () => void }
+    }
+
+    await act(async () => options.action?.onClick())
+
+    expect(useAppStore.getState().activeModal).toBe('workspace-cleanup')
+    expect(session().open).toBe(true)
+  })
+
+  it('keeps a deferred removal alive and visible across close and reopen', async () => {
+    const candidate = makeCandidate()
+    const removal = deferred<WorkspaceCleanupRemoveResult>()
+    const removeWorkspaceCleanupCandidates = vi.fn(() => removal.promise)
+    const scanWorkspaceCleanup = vi.fn().mockResolvedValue({
+      scannedAt: 41,
+      candidates: [candidate],
+      errors: []
+    } satisfies WorkspaceCleanupScanResult)
+    useAppStore.setState({ removeWorkspaceCleanupCandidates, scanWorkspaceCleanup })
+    await renderProbe()
+
+    await act(async () => session().openConfirmRemove([candidate]))
+    await act(async () => session().confirmRemove())
+
+    expect(removeWorkspaceCleanupCandidates).toHaveBeenCalledWith([candidate.worktreeId], {
+      approvedCandidates: [candidate]
+    })
+    expect(session()).toMatchObject({
+      open: true,
+      confirming: true,
+      removalInFlight: true,
+      removalProgress: {
+        totalCount: 1,
+        processedCount: 0,
+        removedCount: 0,
+        failedCount: 0
+      }
+    })
+
+    await act(async () => session().close())
+
+    expect(session()).toMatchObject({
+      open: false,
+      confirming: true,
+      removalInFlight: true
+    })
+    expect(session().removalProgress?.processedCount).toBe(0)
+
+    await act(async () => useAppStore.getState().openModal('workspace-cleanup'))
+
+    expect(session()).toMatchObject({
+      open: true,
+      confirming: true,
+      removalInFlight: true
+    })
+    expect(session().removalProgress?.processedCount).toBe(0)
+    expect(scanWorkspaceCleanup).toHaveBeenCalledOnce()
+
+    await act(async () => {
+      removal.resolve({ removedIds: [candidate.worktreeId], failures: [] })
+      await removal.promise
+      await Promise.resolve()
+    })
+
+    expect(session()).toMatchObject({
+      open: true,
+      confirming: false,
+      confirmCandidates: [],
+      removalInFlight: false,
+      removalProgress: null
+    })
+  })
+})
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-dialog-session.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-dialog-session.ts
new file mode 100644
index 00000000000..670e73fa4dc
--- /dev/null
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-dialog-session.ts
@@ -0,0 +1,205 @@
+import {
+  useCallback,
+  useEffect,
+  useRef,
+  useState,
+  type Dispatch,
+  type RefObject,
+  type SetStateAction
+} from 'react'
+import { toast } from 'sonner'
+import { useShallow } from 'zustand/react/shallow'
+import type { WorkspaceCleanupCandidate } from '../../../../shared/workspace-cleanup'
+import { useMountedRef } from '@/hooks/useMountedRef'
+import { translate } from '@/i18n/i18n'
+import { useAppStore } from '@/store'
+import {
+  useWorkspaceCleanupRemovalSession,
+  type WorkspaceCleanupRemovalSession
+} from './workspace-cleanup-removal-session'
+import { useWorkspaceCleanupScanSession } from './workspace-cleanup-scan-session'
+import type {
+  WorkspaceCleanupFilters,
+  WorkspaceCleanupSortDirection,
+  WorkspaceCleanupSortKey
+} from './workspace-cleanup-presentation'
+import type { WorkspaceCleanupView } from './workspace-cleanup-view-selection'
+
+export const DEFAULT_WORKSPACE_CLEANUP_FILTERS: WorkspaceCleanupFilters = {
+  query: '',
+  time: 'all',
+  review: 'all',
+  git: 'all',
+  context: 'all'
+}
+
+type WorkspaceCleanupStateSetter<T> = Dispatch<SetStateAction<T>>
+type PublicRemovalSession = Omit<
+  WorkspaceCleanupRemovalSession,
+  'clearRowFailures' | 'resetForOpen'
+>
+
+export type WorkspaceCleanupDialogSession = PublicRemovalSession & {
+  open: boolean
+  loading: boolean
+  selectedIds: Set<string>
+  setSelectedIds: WorkspaceCleanupStateSetter<Set<string>>
+  expandedRowIds: Set<string>
+  setExpandedRowIds: WorkspaceCleanupStateSetter<Set<string>>
+  activeView: WorkspaceCleanupView
+  setActiveView: WorkspaceCleanupStateSetter<WorkspaceCleanupView>
+  repoSelection: ReadonlySet<string>
+  setRepoSelection: WorkspaceCleanupStateSetter<ReadonlySet<string>>
+  filters: WorkspaceCleanupFilters
+  setFilters: WorkspaceCleanupStateSetter<WorkspaceCleanupFilters>
+  sortKey: WorkspaceCleanupSortKey
+  setSortKey: WorkspaceCleanupStateSetter<WorkspaceCleanupSortKey>
+  sortDirection: WorkspaceCleanupSortDirection
+  setSortDirection: WorkspaceCleanupStateSetter<WorkspaceCleanupSortDirection>
+  selectedDefaultsScanAtRef: RefObject<number | null>
+  close: () => void
+  markCandidateViewed: (candidate: WorkspaceCleanupCandidate) => void
+  restoreDismissals: () => void
+  startScan: (options?: { notifyWhenReady?: boolean }) => void
+  ignoreCandidate: (candidate: WorkspaceCleanupCandidate) => void
+}
+
+export function useWorkspaceCleanupDialogSession(): WorkspaceCleanupDialogSession {
+  const {
+    open,
+    loading,
+    openModal,
+    closeModal,
+    scanWorkspaceCleanup,
+    markCandidateViewed,
+    dismissCandidates,
+    resetDismissals,
+    removeCandidates,
+    markWorktreesQueuedForDeletion,
+    clearWorktreeDeleteState
+  } = useAppStore(
+    useShallow((state) => ({
+      open: state.activeModal === 'workspace-cleanup',
+      loading: state.workspaceCleanupLoading,
+      openModal: state.openModal,
+      closeModal: state.closeModal,
+      scanWorkspaceCleanup: state.scanWorkspaceCleanup,
+      markCandidateViewed: state.markWorkspaceCleanupCandidateViewed,
+      dismissCandidates: state.dismissWorkspaceCleanupCandidates,
+      resetDismissals: state.resetWorkspaceCleanupDismissals,
+      removeCandidates: state.removeWorkspaceCleanupCandidates,
+      markWorktreesQueuedForDeletion: state.markWorktreesQueuedForDeletion,
+      clearWorktreeDeleteState: state.clearWorktreeDeleteState
+    }))
+  )
+  const [selectedIds, setSelectedIds] = useState<Set<string>>(() => new Set())
+  const [expandedRowIds, setExpandedRowIds] = useState<Set<string>>(() => new Set())
+  const [activeView, setActiveView] = useState<WorkspaceCleanupView>('ready')
+  const [repoSelection, setRepoSelection] = useState<ReadonlySet<string>>(() => new Set())
+  const [filters, setFilters] = useState<WorkspaceCleanupFilters>(DEFAULT_WORKSPACE_CLEANUP_FILTERS)
+  const [sortKey, setSortKey] = useState<WorkspaceCleanupSortKey>('activity')
+  const [sortDirection, setSortDirection] = useState<WorkspaceCleanupSortDirection>('asc')
+  const selectedDefaultsScanAtRef = useRef<number | null>(null)
+  const autoScanAttemptedForOpenRef = useRef(false)
+  const wasOpenRef = useRef(false)
+  const mountedRef = useMountedRef()
+  const removal = useWorkspaceCleanupRemovalSession({
+    mountedRef,
+    setSelectedIds,
+    closeModal,
+    removeCandidates,
+    markWorktreesQueuedForDeletion,
+    clearWorktreeDeleteState
+  })
+  const { clearRowFailures, resetForOpen, ...publicRemoval } = removal
+  const startScan = useWorkspaceCleanupScanSession({
+    open,
+    mountedRef,
+    openModal,
+    scanWorkspaceCleanup,
+    clearRowFailures
+  })
+
+  useEffect(() => {
+    if (!open) {
+      wasOpenRef.current = false
+      autoScanAttemptedForOpenRef.current = false
+      return
+    }
+    if (!wasOpenRef.current) {
+      wasOpenRef.current = true
+      autoScanAttemptedForOpenRef.current = false
+      if (!removal.removalInFlightRef.current) {
+        setActiveView('ready')
+        setFilters(DEFAULT_WORKSPACE_CLEANUP_FILTERS)
+        setSortKey('activity')
+        setSortDirection('asc')
+        resetForOpen()
+      }
+    }
+    // Why: reopening mid-batch must preserve progress and avoid a scan the removal would invalidate.
+    if (!loading && !autoScanAttemptedForOpenRef.current && !removal.removalInFlightRef.current) {
+      autoScanAttemptedForOpenRef.current = true
+      startScan({ notifyWhenReady: true })
+    }
+  }, [loading, open, removal.removalInFlightRef, resetForOpen, startScan])
+
+  const ignoreCandidate = useCallback(
+    (candidate: WorkspaceCleanupCandidate) => {
+      void dismissCandidates([candidate])
+        .then(() => {
+          if (!mountedRef.current) {
+            return
+          }
+          setSelectedIds((current) => {
+            const next = new Set(current)
+            next.delete(candidate.worktreeId)
+            return next
+          })
+        })
+        .catch((error: unknown) => {
+          if (!mountedRef.current) {
+            return
+          }
+          toast.error(
+            translate(
+              'auto.components.workspace.cleanup.WorkspaceCleanupDialog.7f451a3e2c',
+              'Could not ignore cleanup suggestion'
+            ),
+            { description: error instanceof Error ? error.message : String(error) }
+          )
+        })
+    },
+    [dismissCandidates, mountedRef]
+  )
+
+  const restoreDismissals = useCallback(() => {
+    void resetDismissals()
+  }, [resetDismissals])
+
+  return {
+    open,
+    loading,
+    selectedIds,
+    setSelectedIds,
+    expandedRowIds,
+    setExpandedRowIds,
+    activeView,
+    setActiveView,
+    repoSelection,
+    setRepoSelection,
+    filters,
+    setFilters,
+    sortKey,
+    setSortKey,
+    sortDirection,
+    setSortDirection,
+    selectedDefaultsScanAtRef,
+    close: closeModal,
+    markCandidateViewed,
+    restoreDismissals,
+    startScan,
+    ignoreCandidate,
+    ...publicRemoval
+  }
+}
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-post-batch-late-settlement.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-post-batch-late-settlement.ts
index 6239da304b2..280aabd6790 100644
--- a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-post-batch-late-settlement.ts
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-post-batch-late-settlement.ts
@@ -253,7 +253,7 @@ function releaseSettledPostBatchState(state: PostBatchLateSettlementState): void
 
 function removeArrayEntry<T>(entries: T[], entry: T): void {
   const index = entries.indexOf(entry)
-  if (index >= 0) {
+  if (index !== -1) {
     entries.splice(index, 1)
   }
 }
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-session.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-session.ts
new file mode 100644
index 00000000000..e202ac8bfe5
--- /dev/null
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-session.ts
@@ -0,0 +1,265 @@
+import {
+  useCallback,
+  useRef,
+  useState,
+  type Dispatch,
+  type RefObject,
+  type SetStateAction
+} from 'react'
+import type { WorkspaceCleanupCandidate } from '../../../../shared/workspace-cleanup'
+import type { AppState } from '@/store/types'
+import { useAppStore } from '@/store'
+import {
+  startWorkspaceCleanupBackgroundRemoval,
+  type WorkspaceCleanupRemovalProgress
+} from './workspace-cleanup-background-removal'
+import { filterWorkspaceCleanupRemovalCandidates } from './workspace-cleanup-removal-candidates'
+
+type WorkspaceCleanupSelectedIdsSetter = Dispatch<SetStateAction<Set<string>>>
+
+export type WorkspaceCleanupRemovalSession = {
+  confirming: boolean
+  confirmCandidates: WorkspaceCleanupCandidate[]
+  removalProgress: WorkspaceCleanupRemovalProgress | null
+  removalInFlight: boolean
+  rowFailures: Record<string, string>
+  removalInFlightRef: RefObject<boolean>
+  clearRowFailures: () => void
+  resetForOpen: () => void
+  applyScanDefaults: (
+    candidates: readonly WorkspaceCleanupCandidate[],
+    deletingWorktreeIds: ReadonlySet<string>
+  ) => void
+  openConfirmRemove: (candidates: readonly WorkspaceCleanupCandidate[]) => void
+  cancelConfirmRemove: () => void
+  backToWorkspaceCleanupList: () => void
+  confirmRemove: () => void
+}
+
+export function useWorkspaceCleanupRemovalSession({
+  mountedRef,
+  setSelectedIds,
+  closeModal,
+  removeCandidates,
+  markWorktreesQueuedForDeletion,
+  clearWorktreeDeleteState
+}: {
+  mountedRef: RefObject<boolean>
+  setSelectedIds: WorkspaceCleanupSelectedIdsSetter
+  closeModal: AppState['closeModal']
+  removeCandidates: AppState['removeWorkspaceCleanupCandidates']
+  markWorktreesQueuedForDeletion: AppState['markWorktreesQueuedForDeletion']
+  clearWorktreeDeleteState: AppState['clearWorktreeDeleteState']
+}): WorkspaceCleanupRemovalSession {
+  const [confirming, setConfirming] = useState(false)
+  const [confirmCandidates, setConfirmCandidates] = useState<WorkspaceCleanupCandidate[]>([])
+  const [removalProgress, setRemovalProgress] = useState<WorkspaceCleanupRemovalProgress | null>(
+    null
+  )
+  // Why: progress arrives after the click; the ref synchronously rejects a second batch.
+  const [removalInFlight, setRemovalInFlight] = useState(false)
+  const [rowFailures, setRowFailures] = useState<Record<string, string>>({})
+  const removalInFlightRef = useRef(false)
+  // Why: an older batch's late settlement must not mutate a newer batch's UI.
+  const removalBatchIdRef = useRef(0)
+
+  const clearRowFailures = useCallback(() => setRowFailures({}), [])
+
+  const resetForOpen = useCallback(() => {
+    setConfirming(false)
+    setRowFailures({})
+    setSelectedIds(new Set())
+  }, [setSelectedIds])
+
+  const applyScanDefaults = useCallback(
+    (
+      candidates: readonly WorkspaceCleanupCandidate[],
+      deletingWorktreeIds: ReadonlySet<string>
+    ) => {
+      if (removalInFlightRef.current) {
+        return
+      }
+      setSelectedIds(getDefaultSelectedWorkspaceCleanupIds(candidates, deletingWorktreeIds))
+      setConfirming(false)
+      setRowFailures({})
+    },
+    [setSelectedIds]
+  )
+
+  const openConfirmRemove = useCallback((candidates: readonly WorkspaceCleanupCandidate[]) => {
+    const nextCandidates = filterWorkspaceCleanupRemovalCandidates(
+      candidates,
+      useAppStore.getState().deleteStateByWorktreeId
+    )
+    if (nextCandidates.length === 0) {
+      return
+    }
+    setConfirmCandidates(nextCandidates)
+    setConfirming(true)
+  }, [])
+
+  const cancelConfirmRemove = useCallback(() => {
+    if (removalProgress) {
+      closeModal()
+      return
+    }
+    setConfirming(false)
+    setConfirmCandidates([])
+  }, [closeModal, removalProgress])
+
+  // Why: Back exposes per-row progress without cancelling the batch; Close dismisses the modal.
+  const backToWorkspaceCleanupList = useCallback(() => {
+    setConfirming(false)
+    setConfirmCandidates([])
+  }, [])
+
+  const clearQueuedDeleteState = useCallback(
+    (worktreeId: string) => {
+      const deleteState = useAppStore.getState().deleteStateByWorktreeId[worktreeId]
+      // Why: rows that fail before removal starts must not stay queued in the sidebar.
+      if (deleteState?.isDeleting && deleteState.error === null && deleteState.phase === 'queued') {
+        clearWorktreeDeleteState(worktreeId)
+      }
+    },
+    [clearWorktreeDeleteState]
+  )
+
+  const deselectRemovedIds = useCallback(
+    (removedIds: readonly string[]) => {
+      if (removedIds.length === 0) {
+        return
+      }
+      setSelectedIds((current) => {
+        const next = new Set(current)
+        for (const id of removedIds) {
+          next.delete(id)
+        }
+        return next
+      })
+    },
+    [setSelectedIds]
+  )
+
+  const confirmRemove = useCallback(() => {
+    if (confirmCandidates.length === 0 || removalInFlightRef.current) {
+      return
+    }
+    const removableCandidates = filterWorkspaceCleanupRemovalCandidates(
+      confirmCandidates,
+      useAppStore.getState().deleteStateByWorktreeId
+    )
+    if (removableCandidates.length === 0) {
+      setConfirming(false)
+      setConfirmCandidates([])
+      return
+    }
+    removalInFlightRef.current = true
+    setRemovalInFlight(true)
+    removalBatchIdRef.current += 1
+    const removalBatchId = removalBatchIdRef.current
+    // Why: hung late settlements retain callbacks, so capture ids instead of candidate objects.
+    const removableWorktreeIds = removableCandidates.map((candidate) => candidate.worktreeId)
+    setRowFailures({})
+    markWorktreesQueuedForDeletion(removableWorktreeIds)
+    startWorkspaceCleanupBackgroundRemoval({
+      candidates: removableCandidates,
+      removeCandidates,
+      onProgress: (progress) => {
+        if (mountedRef.current) {
+          setRemovalProgress(progress)
+        }
+      },
+      onRowFailed: (failure) => {
+        clearQueuedDeleteState(failure.worktreeId)
+      },
+      onResult: (result) => {
+        const nextFailures: Record<string, string> = {}
+        for (const failure of result.failures) {
+          nextFailures[failure.worktreeId] = failure.message
+          clearQueuedDeleteState(failure.worktreeId)
+        }
+        if (mountedRef.current) {
+          setRowFailures(nextFailures)
+          deselectRemovedIds(result.removedIds)
+          setRemovalProgress(null)
+          setRemovalInFlight(false)
+          setConfirming(false)
+          setConfirmCandidates([])
+        }
+        removalInFlightRef.current = false
+      },
+      onLateResult: (result) => {
+        for (const failure of result.failures) {
+          // Why: a late preflight failure can leave a row that never started stuck as queued.
+          clearQueuedDeleteState(failure.worktreeId)
+        }
+        if (!mountedRef.current || removalBatchIdRef.current !== removalBatchId) {
+          return
+        }
+        setRowFailures((current) => {
+          const next = { ...current }
+          for (const id of result.removedIds) {
+            delete next[id]
+          }
+          for (const failure of result.failures) {
+            next[failure.worktreeId] = failure.message
+          }
+          return next
+        })
+        deselectRemovedIds(result.removedIds)
+      },
+      onError: () => {
+        // Why: the batch driver is gone, so nothing will settle these rows later; clear
+        // unconditionally (not just queued ones) or a hung 'deleting' row stays stuck in
+        // the sidebar and filterWorkspaceCleanupRemovalCandidates blocks every retry.
+        for (const worktreeId of removableWorktreeIds) {
+          clearWorktreeDeleteState(worktreeId)
+        }
+        if (mountedRef.current) {
+          setRemovalProgress(null)
+          setRemovalInFlight(false)
+          setConfirming(false)
+          setConfirmCandidates([])
+        }
+        removalInFlightRef.current = false
+      }
+    })
+  }, [
+    clearQueuedDeleteState,
+    clearWorktreeDeleteState,
+    confirmCandidates,
+    deselectRemovedIds,
+    markWorktreesQueuedForDeletion,
+    mountedRef,
+    removeCandidates
+  ])
+
+  return {
+    confirming,
+    confirmCandidates,
+    removalProgress,
+    removalInFlight,
+    rowFailures,
+    removalInFlightRef,
+    clearRowFailures,
+    resetForOpen,
+    applyScanDefaults,
+    openConfirmRemove,
+    cancelConfirmRemove,
+    backToWorkspaceCleanupList,
+    confirmRemove
+  }
+}
+
+function getDefaultSelectedWorkspaceCleanupIds(
+  candidates: readonly WorkspaceCleanupCandidate[],
+  deletingWorktreeIds: ReadonlySet<string>
+): Set<string> {
+  return new Set(
+    candidates
+      .filter(
+        (candidate) => candidate.selectedByDefault && !deletingWorktreeIds.has(candidate.worktreeId)
+      )
+      .map((candidate) => candidate.worktreeId)
+  )
+}
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-toasts.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-toasts.ts
index 74197632016..93604bc9f63 100644
--- a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-toasts.ts
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-toasts.ts
@@ -4,12 +4,15 @@ import type {
   WorkspaceCleanupRemoveResult
 } from '@/store/slices/workspace-cleanup'
 import { translate } from '@/i18n/i18n'
+import { showPreservedBranchBatchToast } from '../sidebar/preserved-branch-batch-toast'
 
 export function showWorkspaceCleanupRemovalResultToasts(
   result: WorkspaceCleanupRemoveResult,
   pendingSettlementFailures?: ReadonlySet<WorkspaceCleanupFailure>
 ): void {
-  if (result.removedIds.length > 0) {
+  if (result.preservedBranches && result.preservedBranches.length > 0) {
+    showPreservedBranchBatchToast(result.removedIds.length, result.preservedBranches)
+  } else if (result.removedIds.length > 0) {
     toast.success(
       translate(
         'auto.components.workspace.cleanup.backgroundRemoval.removed',
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-scan-session.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-scan-session.ts
new file mode 100644
index 00000000000..fc4cd59b1fd
--- /dev/null
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-scan-session.ts
@@ -0,0 +1,88 @@
+import { useCallback, useEffect, useRef, type RefObject } from 'react'
+import { toast } from 'sonner'
+import type { AppState } from '@/store/types'
+import { translate } from '@/i18n/i18n'
+
+export function useWorkspaceCleanupScanSession({
+  open,
+  mountedRef,
+  openModal,
+  scanWorkspaceCleanup,
+  clearRowFailures
+}: {
+  open: boolean
+  mountedRef: RefObject<boolean>
+  openModal: AppState['openModal']
+  scanWorkspaceCleanup: AppState['scanWorkspaceCleanup']
+  clearRowFailures: () => void
+}): (options?: { notifyWhenReady?: boolean }) => void {
+  const openRef = useRef(open)
+  const latestReadyToastScanAtRef = useRef<number | null>(null)
+
+  useEffect(() => {
+    openRef.current = open
+  }, [open])
+
+  return useCallback(
+    (options: { notifyWhenReady?: boolean } = {}) => {
+      clearRowFailures()
+      void scanWorkspaceCleanup()
+        .then((result) => {
+          if (!mountedRef.current || !options.notifyWhenReady || openRef.current) {
+            return
+          }
+          if (latestReadyToastScanAtRef.current === result.scannedAt) {
+            return
+          }
+          latestReadyToastScanAtRef.current = result.scannedAt
+          const suggestedCount = result.candidates.filter(
+            (candidate) => candidate.selectedByDefault
+          ).length
+          toast.success(
+            translate(
+              'auto.components.workspace.cleanup.WorkspaceCleanupDialog.0e2d235c63',
+              'Inactive workspace scan ready'
+            ),
+            {
+              description: formatWorkspaceCleanupReadyToastDescription(
+                result.candidates.length,
+                suggestedCount
+              ),
+              action: {
+                label: translate(
+                  'auto.components.workspace.cleanup.WorkspaceCleanupDialog.4a35c08764',
+                  'Review'
+                ),
+                onClick: () => openModal('workspace-cleanup')
+              }
+            }
+          )
+        })
+        .catch((error: unknown) => {
+          if (!mountedRef.current) {
+            return
+          }
+          toast.error(
+            translate(
+              'auto.components.workspace.cleanup.WorkspaceCleanupDialog.662b8ec3f8',
+              'Workspace cleanup scan failed'
+            ),
+            { description: error instanceof Error ? error.message : String(error) }
+          )
+        })
+    },
+    [clearRowFailures, mountedRef, openModal, scanWorkspaceCleanup]
+  )
+}
+
+function formatWorkspaceCleanupReadyToastDescription(
+  inactiveCount: number,
+  suggestedCount: number
+): string {
+  if (inactiveCount === 0) {
+    return 'No inactive workspaces found.'
+  }
+  const inactiveNoun = inactiveCount === 1 ? 'workspace' : 'workspaces'
+  const suggestedNoun = suggestedCount === 1 ? 'suggestion' : 'suggestions'
+  return `${inactiveCount} inactive ${inactiveNoun} found, with ${suggestedCount} cleanup ${suggestedNoun}.`
+}
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-skipped-ancestor-reclassification.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-skipped-ancestor-reclassification.ts
index e2bfd7a4c3c..cb301b557e2 100644
--- a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-skipped-ancestor-reclassification.ts
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-skipped-ancestor-reclassification.ts
@@ -65,7 +65,7 @@ export function reclassifySkippedWorkspaceCleanupAncestors({
 
 function removeArrayEntry<T>(entries: T[], entry: T): void {
   const index = entries.indexOf(entry)
-  if (index >= 0) {
+  if (index !== -1) {
     entries.splice(index, 1)
   }
 }
diff --git a/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.test.tsx b/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.test.tsx
new file mode 100644
index 00000000000..524707485f6
--- /dev/null
+++ b/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.test.tsx
@@ -0,0 +1,59 @@
+// @vitest-environment happy-dom
+
+import { useRef } from 'react'
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { WorkspaceEmojiSuggestionPopover } from './WorkspaceEmojiSuggestionPopover'
+import type { WorkspaceEmojiSuggestion } from '@/lib/workspace-emoji-shortcodes'
+
+Element.prototype.scrollIntoView ??= () => {}
+
+const SUGGESTIONS: WorkspaceEmojiSuggestion[] = [
+  { shortcode: 'smile', emoji: '😄' },
+  { shortcode: 'smiley', emoji: '😃' },
+  { shortcode: 'smirk', emoji: '😏' }
+]
+
+function PopoverHarness({ commandValue }: { commandValue: string }): React.JSX.Element {
+  const anchorRef = useRef<HTMLInputElement>(null)
+
+  return (
+    <div>
+      <input ref={anchorRef} aria-label="Workspace name" readOnly value=":smi" />
+      <WorkspaceEmojiSuggestionPopover
+        anchorRef={anchorRef}
+        commandValue={commandValue}
+        heading="Emoji"
+        onCommandValueChange={() => {}}
+        onOpenChange={() => {}}
+        onSelect={() => {}}
+        open
+        suggestions={SUGGESTIONS}
+      />
+    </div>
+  )
+}
+
+describe('WorkspaceEmojiSuggestionPopover', () => {
+  let scrollIntoView: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    scrollIntoView = vi.spyOn(Element.prototype, 'scrollIntoView').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    scrollIntoView.mockRestore()
+    cleanup()
+  })
+
+  it('scrolls the externally selected suggestion into view', async () => {
+    const { rerender } = render(<PopoverHarness commandValue="emoji:smile" />)
+    await screen.findByText(':smirk:')
+    scrollIntoView.mockClear()
+
+    rerender(<PopoverHarness commandValue="emoji:smirk" />)
+
+    const scrolled = scrollIntoView.mock.instances as unknown as Element[]
+    expect(scrolled.some((node) => node.getAttribute('data-value') === 'emoji:smirk')).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.tsx b/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.tsx
index 7497f080a75..b54c6fcb205 100644
--- a/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.tsx
+++ b/src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.tsx
@@ -1,4 +1,4 @@
-import type { ComponentProps, RefObject } from 'react'
+import { useEffect, useRef, type ComponentProps, type RefObject } from 'react'
 import { Command, CommandGroup, CommandItem, CommandList } from '@/components/ui/command'
 import { Popover, PopoverAnchor, PopoverContent } from '@/components/ui/popover'
 import { cn } from '@/lib/utils'
@@ -31,6 +31,28 @@ export function WorkspaceEmojiSuggestionPopover({
   side = 'top',
   suggestions
 }: WorkspaceEmojiSuggestionPopoverProps): React.JSX.Element {
+  const listRef = useRef<HTMLDivElement>(null)
+
+  // cmdk only auto-scrolls when it owns the arrow keys; here selection is driven from the input.
+  useEffect(() => {
+    if (!open || !commandValue) {
+      return
+    }
+    const item = Array.from(
+      listRef.current?.querySelectorAll<HTMLElement>('[cmdk-item=""]') ?? []
+    ).find((node) => node.getAttribute('data-value') === commandValue)
+    if (!item) {
+      return
+    }
+    if (item.parentElement?.firstElementChild === item) {
+      item
+        .closest('[cmdk-group=""]')
+        ?.querySelector('[cmdk-group-heading=""]')
+        ?.scrollIntoView({ block: 'nearest' })
+    }
+    item.scrollIntoView({ block: 'nearest' })
+  }, [commandValue, open, suggestions])
+
   return (
     <Popover open={open} onOpenChange={onOpenChange}>
       <PopoverAnchor virtualRef={anchorRef as RefObject<HTMLInputElement>} />
@@ -64,7 +86,7 @@ export function WorkspaceEmojiSuggestionPopover({
           shouldFilter={false}
           className="bg-transparent"
         >
-          <CommandList className="!max-h-none min-h-0 flex-1 scrollbar-sleek">
+          <CommandList ref={listRef} className="!max-h-none min-h-0 flex-1 scrollbar-sleek">
             <CommandGroup heading={heading} className="p-1">
               {suggestions.map((suggestion) => (
                 <CommandItem
diff --git a/src/renderer/src/hooks/direct-ssh-reconnect-coordinator-stabilization.ts b/src/renderer/src/hooks/direct-ssh-reconnect-coordinator-stabilization.ts
index 9924e55d70b..f20ea1e4a30 100644
--- a/src/renderer/src/hooks/direct-ssh-reconnect-coordinator-stabilization.ts
+++ b/src/renderer/src/hooks/direct-ssh-reconnect-coordinator-stabilization.ts
@@ -5,7 +5,7 @@ export type DirectSshReconnectTargetState = {
   authority: DirectSshAuthority
   installedAt: number
   dampUntil: number | null
-  timer: DirectSshReconnectTimer | null
+  timer: DirectSshReconnectTimer
 }
 
 export function createDirectSshReconnectTargetState(
diff --git a/src/renderer/src/hooks/ipc-events-test-harness.ts b/src/renderer/src/hooks/ipc-events-test-harness.ts
index 8bd4eea5fca..e2226460a7b 100644
--- a/src/renderer/src/hooks/ipc-events-test-harness.ts
+++ b/src/renderer/src/hooks/ipc-events-test-harness.ts
@@ -125,6 +125,7 @@ export type IpcEventsHarness = {
   /** Fire a main-process digit chord (zero-based index). */
   jumpToWorktreeIndex: (index: number) => void
   jumpToTabIndex: (index: number) => void
+  navigationUpdate: (event: { browserPageId: string; url: string; title: string }) => void
   /** Standard (non-palette) target of a workspace digit chord. */
   activateAndRevealWorkspace: ReturnType<typeof vi.fn>
 }
@@ -146,6 +147,9 @@ export async function loadIpcEventsHarness(
   const activateAndRevealWorkspace = vi.fn()
   let createTerminalListener: ((request: CreateTerminalRequest) => void) | null = null
   let requestTerminalCreateListener: ((request: RequestTerminalCreateRequest) => void) | null = null
+  let navigationUpdateListener:
+    | ((event: { browserPageId: string; url: string; title: string }) => void)
+    | null = null
   const indexJumpListeners = new Map<string, (index: number) => void>()
 
   vi.resetModules()
@@ -243,6 +247,14 @@ export async function loadIpcEventsHarness(
           onStatus: () => () => {},
           onClearDismissal: () => () => {}
         },
+        browser: createApiNamespaceStub({
+          onNavigationUpdate: (
+            listener: (event: { browserPageId: string; url: string; title: string }) => void
+          ) => {
+            navigationUpdateListener = listener
+            return () => {}
+          }
+        }),
         mobile: createApiNamespaceStub({
           consumePendingUnpairedDeviceAuthFailure: () => Promise.resolve(false)
         }),
@@ -270,6 +282,12 @@ export async function loadIpcEventsHarness(
     replyTerminalCreate,
     jumpToWorktreeIndex: (index) => fireIndexJump(indexJumpListeners, 'worktree', index),
     jumpToTabIndex: (index) => fireIndexJump(indexJumpListeners, 'tab', index),
+    navigationUpdate: (event) => {
+      if (typeof navigationUpdateListener !== 'function') {
+        throw new Error('Expected the browser navigation listener to be registered')
+      }
+      navigationUpdateListener(event)
+    },
     activateAndRevealWorkspace
   }
 }
diff --git a/src/renderer/src/hooks/runtime-project-refresh-scheduler.test.ts b/src/renderer/src/hooks/runtime-project-refresh-scheduler.test.ts
index 8b20968441c..ae4b3c1b295 100644
--- a/src/renderer/src/hooks/runtime-project-refresh-scheduler.test.ts
+++ b/src/renderer/src/hooks/runtime-project-refresh-scheduler.test.ts
@@ -1,11 +1,12 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   createRuntimeProjectRefreshScheduler,
-  refreshRuntimeProjectWorktrees
+  refreshRuntimeProjectWorktrees,
+  refreshRuntimeProjectWorktreesAndLineage
 } from './runtime-project-refresh-scheduler'
 
 describe('refreshRuntimeProjectWorktrees', () => {
-  it('pins same-ID repo refreshes to the event runtime', async () => {
+  it('deduplicates same-host repo IDs and pins the refresh to the event runtime', async () => {
     const fetchWorktrees = vi.fn().mockResolvedValue(true)
 
     await refreshRuntimeProjectWorktrees(
@@ -14,14 +15,56 @@ describe('refreshRuntimeProjectWorktrees', () => {
       fetchWorktrees
     )
 
+    expect(fetchWorktrees).toHaveBeenCalledTimes(1)
+    expect(fetchWorktrees).toHaveBeenCalledWith('same-repo', {
+      executionHostId: 'runtime:env-1',
+      suppressRemoteLineageRefresh: true
+    })
+  })
+
+  it('runs one final host lineage refresh after a repo failure', async () => {
+    const error = new Error('repo refresh failed')
+    const fetchWorktrees = vi.fn().mockResolvedValueOnce(true).mockRejectedValueOnce(error)
+    const fetchWorktreeLineage = vi.fn().mockResolvedValue(undefined)
+
+    await expect(
+      refreshRuntimeProjectWorktreesAndLineage(
+        'env-1',
+        [{ id: 'repo-1' }, { id: 'repo-2' }],
+        fetchWorktrees,
+        fetchWorktreeLineage
+      )
+    ).rejects.toThrow('Failed to refresh 1 runtime project worktree(s): repo-2')
+
     expect(fetchWorktrees).toHaveBeenCalledTimes(2)
-    expect(fetchWorktrees).toHaveBeenNthCalledWith(1, 'same-repo', {
-      executionHostId: 'runtime:env-1'
-    })
-    expect(fetchWorktrees).toHaveBeenNthCalledWith(2, 'same-repo', {
+    expect(fetchWorktreeLineage).toHaveBeenCalledTimes(1)
+    expect(fetchWorktreeLineage).toHaveBeenCalledWith({
       executionHostId: 'runtime:env-1'
     })
   })
+
+  it('retains both repo and final lineage failures', async () => {
+    const repoError = new Error('repo refresh failed')
+    const lineageError = new Error('lineage refresh failed')
+    const fetchWorktrees = vi.fn().mockRejectedValue(repoError)
+    const fetchWorktreeLineage = vi.fn().mockRejectedValue(lineageError)
+
+    const rejection = await refreshRuntimeProjectWorktreesAndLineage(
+      'env-1',
+      [{ id: 'repo-1' }],
+      fetchWorktrees,
+      fetchWorktreeLineage
+    ).catch((error: unknown) => error)
+
+    expect(rejection).toBeInstanceOf(AggregateError)
+    expect((rejection as AggregateError).errors).toEqual([
+      expect.objectContaining({
+        message: 'Failed to refresh 1 runtime project worktree(s): repo-1',
+        errors: [repoError]
+      }),
+      lineageError
+    ])
+  })
 })
 
 describe('createRuntimeProjectRefreshScheduler', () => {
diff --git a/src/renderer/src/hooks/runtime-project-refresh-scheduler.ts b/src/renderer/src/hooks/runtime-project-refresh-scheduler.ts
index e02305d20eb..047f00a7163 100644
--- a/src/renderer/src/hooks/runtime-project-refresh-scheduler.ts
+++ b/src/renderer/src/hooks/runtime-project-refresh-scheduler.ts
@@ -29,24 +29,31 @@ export async function refreshRuntimeProjectWorktrees(
   repos: readonly { id: string }[],
   fetchWorktrees: (
     repoId: string,
-    options: { executionHostId: ExecutionHostId }
+    options: {
+      executionHostId: ExecutionHostId
+      suppressRemoteLineageRefresh: true
+    }
   ) => Promise<unknown>,
   concurrency = DEFAULT_REFRESH_CONCURRENCY
 ): Promise<void> {
   let nextIndex = 0
   const failures: { repoId: string; error: unknown }[] = []
-  const workerCount = Math.min(concurrency, repos.length)
+  const repoIds = [...new Set(repos.map((repo) => repo.id))]
+  const workerCount = Math.min(concurrency, repoIds.length)
   const executionHostId = toRuntimeExecutionHostId(environmentId)
 
   // Why: one coalesced event can represent many repos; bound probes without dropping host identity.
   await Promise.all(
     Array.from({ length: workerCount }, async () => {
-      while (nextIndex < repos.length) {
+      while (nextIndex < repoIds.length) {
         const index = nextIndex
         nextIndex += 1
-        const repoId = repos[index].id
+        const repoId = repoIds[index]
         try {
-          await fetchWorktrees(repoId, { executionHostId })
+          await fetchWorktrees(repoId, {
+            executionHostId,
+            suppressRemoteLineageRefresh: true
+          })
         } catch (error) {
           failures.push({ repoId, error })
         }
@@ -63,6 +70,36 @@ export async function refreshRuntimeProjectWorktrees(
   }
 }
 
+export async function refreshRuntimeProjectWorktreesAndLineage(
+  environmentId: string,
+  repos: readonly { id: string }[],
+  fetchWorktrees: Parameters<typeof refreshRuntimeProjectWorktrees>[2],
+  fetchWorktreeLineage: (options: { executionHostId: ExecutionHostId }) => Promise<unknown>
+): Promise<void> {
+  const executionHostId = toRuntimeExecutionHostId(environmentId)
+  let worktreeFailure: { error: unknown } | null = null
+  try {
+    await refreshRuntimeProjectWorktrees(environmentId, repos, fetchWorktrees)
+  } catch (error) {
+    worktreeFailure = { error }
+  }
+  // Why: a failed repo refresh must not strand the host-wide lineage snapshot.
+  try {
+    await fetchWorktreeLineage({ executionHostId })
+  } catch (lineageError) {
+    if (!worktreeFailure) {
+      throw lineageError
+    }
+    throw new AggregateError(
+      [worktreeFailure.error, lineageError],
+      'Failed to refresh runtime project worktrees and lineage'
+    )
+  }
+  if (worktreeFailure) {
+    throw worktreeFailure.error
+  }
+}
+
 export function createRuntimeProjectRefreshScheduler(
   deps: RuntimeProjectRefreshSchedulerDeps
 ): RuntimeProjectRefreshScheduler {
diff --git a/src/renderer/src/hooks/use-clipboard-text-copy-feedback.test.ts b/src/renderer/src/hooks/use-clipboard-text-copy-feedback.test.ts
new file mode 100644
index 00000000000..3473bf4c3ce
--- /dev/null
+++ b/src/renderer/src/hooks/use-clipboard-text-copy-feedback.test.ts
@@ -0,0 +1,113 @@
+// @vitest-environment happy-dom
+
+import { act, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useClipboardTextCopyFeedback } from './use-clipboard-text-copy-feedback'
+
+let writeClipboardText: ReturnType<typeof vi.fn>
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  writeClipboardText = vi.fn().mockResolvedValue(undefined)
+  Object.assign(window, { api: { ui: { writeClipboardText } } })
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('useClipboardTextCopyFeedback', () => {
+  it('copies non-empty text and reports success', async () => {
+    const { result } = renderHook(() => useClipboardTextCopyFeedback('git status'))
+
+    expect(result.current.canCopy).toBe(true)
+
+    let ok = false
+    await act(async () => {
+      ok = await result.current.copyText()
+    })
+
+    expect(ok).toBe(true)
+    expect(writeClipboardText).toHaveBeenCalledWith('git status')
+    expect(result.current.status).toBe('copied')
+
+    act(() => {
+      vi.advanceTimersByTime(1500)
+    })
+    expect(result.current.status).toBe('idle')
+  })
+
+  it('does not write whitespace-only text', async () => {
+    const { result } = renderHook(() => useClipboardTextCopyFeedback('   '))
+
+    expect(result.current.canCopy).toBe(false)
+
+    let ok = true
+    await act(async () => {
+      ok = await result.current.copyText()
+    })
+
+    expect(ok).toBe(false)
+    expect(writeClipboardText).not.toHaveBeenCalled()
+    expect(result.current.status).toBe('idle')
+  })
+
+  it('reports failure without leaving a success state', async () => {
+    writeClipboardText.mockRejectedValueOnce(new Error('denied'))
+    const { result } = renderHook(() => useClipboardTextCopyFeedback('git status'))
+
+    let ok = true
+    await act(async () => {
+      ok = await result.current.copyText()
+    })
+
+    expect(ok).toBe(false)
+    expect(result.current.status).toBe('failed')
+
+    act(() => {
+      vi.advanceTimersByTime(1500)
+    })
+    expect(result.current.status).toBe('idle')
+  })
+
+  it('drops feedback when the text changes', async () => {
+    const { result, rerender } = renderHook(
+      ({ text }: { text: string }) => useClipboardTextCopyFeedback(text),
+      { initialProps: { text: 'git status' } }
+    )
+
+    await act(async () => {
+      await result.current.copyText()
+    })
+    expect(result.current.status).toBe('copied')
+
+    rerender({ text: 'git diff' })
+    expect(result.current.status).toBe('idle')
+  })
+
+  it('does not set state after unmount', async () => {
+    let resolveWrite: (() => void) | null = null
+    writeClipboardText.mockImplementation(
+      () =>
+        new Promise<void>((resolve) => {
+          resolveWrite = resolve
+        })
+    )
+
+    const { result, unmount } = renderHook(() => useClipboardTextCopyFeedback('git status'))
+
+    let copyPromise: Promise<boolean> | null = null
+    act(() => {
+      copyPromise = result.current.copyText()
+    })
+
+    unmount()
+    await act(async () => {
+      resolveWrite?.()
+      await copyPromise
+    })
+
+    // Unmounted: no throw from setState; promise still resolves true for the write.
+    await expect(copyPromise).resolves.toBe(true)
+  })
+})
diff --git a/src/renderer/src/hooks/use-clipboard-text-copy-feedback.ts b/src/renderer/src/hooks/use-clipboard-text-copy-feedback.ts
new file mode 100644
index 00000000000..8f6554cecf5
--- /dev/null
+++ b/src/renderer/src/hooks/use-clipboard-text-copy-feedback.ts
@@ -0,0 +1,83 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+
+export type ClipboardTextCopyStatus = 'idle' | 'copied' | 'failed'
+
+const FEEDBACK_MS = 1500
+
+type Feedback = {
+  text: string
+  status: Exclude<ClipboardTextCopyStatus, 'idle'>
+}
+
+/**
+ * Clipboard write with brief success/failure feedback. Guards setState after
+ * unmount (clipboard IPC can resolve after the menu/row is gone).
+ */
+export function useClipboardTextCopyFeedback(text: string): {
+  canCopy: boolean
+  copyText: () => Promise<boolean>
+  status: ClipboardTextCopyStatus
+} {
+  // Why: key feedback to the copied body so a prop change drops stale labels
+  // without setState-in-effect (react-doctor no-adjust-state-on-prop-change).
+  const [feedback, setFeedback] = useState<Feedback | null>(null)
+  const isMountedRef = useRef(true)
+  const resetTimerRef = useRef<number | null>(null)
+  const canCopy = text.trim().length > 0
+  const status: ClipboardTextCopyStatus =
+    feedback != null && feedback.text === text ? feedback.status : 'idle'
+
+  const clearResetTimer = useCallback((): void => {
+    if (resetTimerRef.current !== null) {
+      window.clearTimeout(resetTimerRef.current)
+      resetTimerRef.current = null
+    }
+  }, [])
+
+  useEffect(() => {
+    isMountedRef.current = true
+    return () => {
+      isMountedRef.current = false
+      clearResetTimer()
+    }
+  }, [clearResetTimer])
+
+  // Drop any pending reset timer when the body changes; display status is already idle.
+  useEffect(() => {
+    clearResetTimer()
+  }, [clearResetTimer, text])
+
+  const scheduleReset = useCallback((): void => {
+    clearResetTimer()
+    resetTimerRef.current = window.setTimeout(() => {
+      resetTimerRef.current = null
+      if (isMountedRef.current) {
+        setFeedback(null)
+      }
+    }, FEEDBACK_MS)
+  }, [clearResetTimer])
+
+  const copyText = useCallback(async (): Promise<boolean> => {
+    if (!canCopy) {
+      return false
+    }
+    try {
+      await window.api.ui.writeClipboardText(text)
+      if (!isMountedRef.current) {
+        return true
+      }
+      setFeedback({ text, status: 'copied' })
+      scheduleReset()
+      return true
+    } catch {
+      if (!isMountedRef.current) {
+        return false
+      }
+      setFeedback({ text, status: 'failed' })
+      scheduleReset()
+      return false
+    }
+  }, [canCopy, scheduleReset, text])
+
+  return { canCopy, copyText, status }
+}
diff --git a/src/renderer/src/hooks/use-window-stream-visibility.test.ts b/src/renderer/src/hooks/use-window-stream-visibility.test.ts
new file mode 100644
index 00000000000..a9d3e838db0
--- /dev/null
+++ b/src/renderer/src/hooks/use-window-stream-visibility.test.ts
@@ -0,0 +1,67 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { resetStaleDocumentVisibilityForTesting } from '@/components/terminal-pane/stale-document-visibility'
+import { useWindowStreamVisible, WINDOW_STREAM_PARK_DELAY_MS } from './use-window-stream-visibility'
+
+function setDocumentVisibility(state: 'visible' | 'hidden'): void {
+  Object.defineProperty(document, 'visibilityState', {
+    configurable: true,
+    get: () => state
+  })
+  document.dispatchEvent(new Event('visibilitychange'))
+}
+
+describe('useWindowStreamVisible', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    setDocumentVisibility('visible')
+  })
+
+  afterEach(() => {
+    cleanup()
+    setDocumentVisibility('visible')
+    resetStaleDocumentVisibilityForTesting()
+    vi.useRealTimers()
+    vi.restoreAllMocks()
+  })
+
+  it('parks only after the grace period elapses', async () => {
+    const hook = renderHook(() => useWindowStreamVisible())
+    expect(hook.result.current).toBe(true)
+
+    await act(async () => setDocumentVisibility('hidden'))
+    await act(async () => vi.advanceTimersByTime(WINDOW_STREAM_PARK_DELAY_MS - 1))
+    expect(hook.result.current).toBe(true)
+
+    await act(async () => vi.advanceTimersByTime(1))
+    expect(hook.result.current).toBe(false)
+  })
+
+  // Pins the `|| isDocumentVisibilityProvenStale()` term: dropping it wedges every stream pane
+  // hidden forever whenever macOS stops reporting occlusion changes.
+  it('treats a wedged hidden document as visible once user input disproves it', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const hook = renderHook(() => useWindowStreamVisible())
+
+    await act(async () => setDocumentVisibility('hidden'))
+    await act(async () => vi.advanceTimersByTime(WINDOW_STREAM_PARK_DELAY_MS))
+    expect(hook.result.current).toBe(false)
+
+    await act(async () => {
+      document.dispatchEvent(new KeyboardEvent('keydown', { key: 'a' }))
+    })
+    expect(document.visibilityState).toBe('hidden')
+    expect(hook.result.current).toBe(true)
+  })
+
+  it('does not report visible while mounted into a hidden window', async () => {
+    setDocumentVisibility('hidden')
+    const hook = renderHook(() => useWindowStreamVisible())
+    expect(hook.result.current).toBe(false)
+
+    await act(async () => setDocumentVisibility('visible'))
+    expect(hook.result.current).toBe(true)
+  })
+})
diff --git a/src/renderer/src/hooks/use-window-stream-visibility.ts b/src/renderer/src/hooks/use-window-stream-visibility.ts
new file mode 100644
index 00000000000..6037e2e230e
--- /dev/null
+++ b/src/renderer/src/hooks/use-window-stream-visibility.ts
@@ -0,0 +1,29 @@
+import { useEffect, useState, useSyncExternalStore } from 'react'
+import {
+  getWindowParkVisible,
+  subscribeWindowParkVisibility,
+  WINDOW_HIDE_PARK_GRACE_MS
+} from '@/lib/window-park-visibility'
+
+// Avoid renegotiating expensive streams during a quick app-switch round trip.
+export const WINDOW_STREAM_PARK_DELAY_MS = WINDOW_HIDE_PARK_GRACE_MS
+
+export function useWindowStreamVisible(parkDelayMs = WINDOW_STREAM_PARK_DELAY_MS): boolean {
+  const rawVisible = useSyncExternalStore(
+    subscribeWindowParkVisibility,
+    getWindowParkVisible,
+    getWindowParkVisible
+  )
+  const [effectiveVisible, setEffectiveVisible] = useState(rawVisible)
+
+  useEffect(() => {
+    if (rawVisible) {
+      setEffectiveVisible(true)
+      return
+    }
+    const timer = window.setTimeout(() => setEffectiveVisible(false), parkDelayMs)
+    return () => window.clearTimeout(timer)
+  }, [parkDelayMs, rawVisible])
+
+  return effectiveVisible
+}
diff --git a/src/renderer/src/hooks/useAgentDetectionTarget.test.ts b/src/renderer/src/hooks/useAgentDetectionTarget.test.ts
index 8d0cc61f716..22ad26ae016 100644
--- a/src/renderer/src/hooks/useAgentDetectionTarget.test.ts
+++ b/src/renderer/src/hooks/useAgentDetectionTarget.test.ts
@@ -1,16 +1,20 @@
 import { describe, expect, it } from 'vitest'
+import type { FolderWorkspace, ProjectGroup, Repo } from '../../../shared/types'
 import { folderWorkspaceKey } from '../../../shared/workspace-scope'
 import { getAgentDetectionTargetKeyForWorktree } from './useAgentDetectionTarget'
 
 describe('getAgentDetectionTargetKeyForWorktree', () => {
   it('uses an explicit runtime owner without scanning ambiguous child SSH repos', () => {
     let projectGroupReads = 0
-    const repos = Array.from({ length: 100 }, (_, index) => {
-      const repo = {
+    const repos: readonly Repo[] = Array.from({ length: 100 }, (_, index) => {
+      const repo: Repo = {
         id: `repo-${index}`,
         connectionId: `ssh-${index}`,
         executionHostId: `ssh:ssh-${index}`,
-        path: `/workspace/repo-${index}`
+        path: `/workspace/repo-${index}`,
+        displayName: `repo-${index}`,
+        badgeColor: 'blue',
+        addedAt: 1
       }
       Object.defineProperty(repo, 'projectGroupId', {
         enumerable: true,
@@ -28,14 +32,14 @@ describe('getAgentDetectionTargetKeyForWorktree', () => {
           id: 'runtime-folder',
           projectGroupId: 'runtime-group',
           folderPath: '/workspace'
-        }
+        } as FolderWorkspace
       ],
       projectGroups: [
         {
           id: 'runtime-group',
           connectionId: null,
           executionHostId: 'runtime:owner-env'
-        }
+        } as ProjectGroup
       ],
       repos,
       worktreesByRepo: {}
diff --git a/src/renderer/src/hooks/useAutomationDispatchEvents.test.ts b/src/renderer/src/hooks/useAutomationDispatchEvents.test.ts
index 46585b0091c..557663a8a25 100644
--- a/src/renderer/src/hooks/useAutomationDispatchEvents.test.ts
+++ b/src/renderer/src/hooks/useAutomationDispatchEvents.test.ts
@@ -5,6 +5,7 @@ const mockLaunchAgentBackgroundSession = vi.fn()
 const mockLaunchWorktreeBackgroundTerminals = vi.fn()
 const mockFindReusableAutomationSession = vi.fn()
 const mockObserveExistingAutomationSession = vi.fn()
+const mockSubmitPromptToAgentPty = vi.fn()
 const mockCreateWorktree = vi.fn()
 const mockMarkDispatchResult = vi.fn()
 const mockOnDispatchRequested = vi.fn()
@@ -14,6 +15,11 @@ const mockReleaseTerminalOwnership = vi.fn()
 const mockSshNeedsPassphrasePrompt = vi.fn()
 const mockSshGetState = vi.fn()
 const mockSshConnect = vi.fn()
+let latestStoreSubscriber: (() => void) | null = null
+const mockStoreSubscribe = vi.fn((listener: () => void) => {
+  latestStoreSubscriber = listener
+  return () => {}
+})
 
 const setupLaunch = {
   runnerScriptPath: '/tmp/setup.sh',
@@ -124,7 +130,9 @@ vi.mock('@/lib/launch-worktree-background-terminals', () => ({
   launchWorktreeBackgroundTerminals: mockLaunchWorktreeBackgroundTerminals
 }))
 
-vi.mock('@/lib/agent-paste-draft', () => ({}))
+vi.mock('@/lib/agent-paste-draft', () => ({
+  submitPromptToAgentPty: mockSubmitPromptToAgentPty
+}))
 
 vi.mock('@/lib/automation-session-reuse', () => ({
   findReusableAutomationSession: mockFindReusableAutomationSession
@@ -137,9 +145,20 @@ vi.mock('@/lib/automation-session-observer', () => ({
 vi.mock('@/components/automations/automation-run-output-snapshot', () => ({
   createAutomationRunOutputSnapshotBuffer: () => ({
     append: vi.fn(),
-    snapshot: () => ''
+    snapshot: () => null
   }),
-  selectAutomationRunOutputSnapshot: () => null
+  selectAutomationRunOutputSnapshot: (
+    assistantMessage: string | null | undefined,
+    terminalSnapshot: unknown
+  ) =>
+    assistantMessage
+      ? {
+          format: 'plain_text',
+          content: assistantMessage,
+          capturedAt: 1,
+          truncated: false
+        }
+      : terminalSnapshot
 }))
 
 vi.mock('@/i18n/i18n', () => ({
@@ -153,7 +172,7 @@ vi.mock('@/lib/browser-uuid', () => ({
 vi.mock('@/store', () => ({
   useAppStore: {
     getState: () => state,
-    subscribe: vi.fn(() => () => {})
+    subscribe: mockStoreSubscribe
   }
 }))
 
@@ -171,6 +190,7 @@ describe('useAutomationDispatchEvents setup launch', () => {
     state.projectGroups = []
     state.worktreesByRepo = {}
     state.agentStatusByPaneKey = {}
+    latestStoreSubscriber = null
     state.allWorktrees.mockReturnValue([])
     state.getKnownWorktreeById.mockReturnValue(undefined)
     mockCreateWorktree.mockResolvedValue({ worktree: createdWorktree, setup: setupLaunch })
@@ -189,6 +209,7 @@ describe('useAutomationDispatchEvents setup launch', () => {
     mockSshNeedsPassphrasePrompt.mockResolvedValue(false)
     mockSshGetState.mockResolvedValue({ status: 'connected' })
     mockSshConnect.mockResolvedValue({ status: 'connected' })
+    mockSubmitPromptToAgentPty.mockResolvedValue(true)
     vi.stubGlobal('window', {
       api: {
         automations: {
@@ -581,6 +602,132 @@ describe('useAutomationDispatchEvents setup launch', () => {
     await vi.waitFor(() => expect(mockFinalizeTerminalOwnership).toHaveBeenCalledOnce())
   })
 
+  it('persists assistant output from a batched working→done→working transition', async () => {
+    const paneKey = 'agent-tab:7c6fb4e5-3bf1-4ff4-8259-03f7ae81c40d'
+
+    await registerAndDispatch()
+    const transitionStartedAt = Date.now() + 1
+    state.agentStatusByPaneKey = {
+      [paneKey]: {
+        paneKey,
+        state: 'working',
+        prompt: 'second turn',
+        agentType: 'claude',
+        updatedAt: transitionStartedAt + 2,
+        stateStartedAt: transitionStartedAt + 2,
+        lastCompletedAssistantMessage: 'Summary.\n\nDetails.',
+        stateHistory: [
+          { state: 'working', prompt: 'first turn', startedAt: transitionStartedAt },
+          { state: 'done', prompt: 'first turn', startedAt: transitionStartedAt + 1 }
+        ]
+      }
+    }
+    if (!latestStoreSubscriber) {
+      throw new Error('agent status observer was not registered')
+    }
+    latestStoreSubscriber()
+
+    await vi.waitFor(() => expect(mockFinalizeTerminalOwnership).toHaveBeenCalledOnce())
+    expect(mockMarkDispatchResult).toHaveBeenCalledWith(
+      expect.objectContaining({
+        runId: 'run-1',
+        status: 'completed',
+        outputSnapshot: {
+          format: 'plain_text',
+          content: 'Summary.\n\nDetails.',
+          capturedAt: 1,
+          truncated: false
+        }
+      })
+    )
+  })
+
+  it('does not let later working authorize an earlier historical done on rescan', async () => {
+    const paneKey = 'agent-tab:7c6fb4e5-3bf1-4ff4-8259-03f7ae81c40d'
+    mockFindReusableAutomationSession.mockReturnValue({
+      tabId: 'agent-tab',
+      paneKey,
+      ptyId: 'agent-pty'
+    })
+    mockObserveExistingAutomationSession.mockResolvedValue(() => {})
+
+    await registerAndDispatch(makeAutomation({ reuseSession: true }))
+    const transitionStartedAt = Date.now() + 1
+    state.agentStatusByPaneKey = {
+      [paneKey]: {
+        paneKey,
+        state: 'working',
+        prompt: 'new turn',
+        agentType: 'claude',
+        updatedAt: transitionStartedAt + 1,
+        stateStartedAt: transitionStartedAt + 1,
+        stateHistory: [{ state: 'done', prompt: 'old turn', startedAt: transitionStartedAt }]
+      }
+    }
+    if (!latestStoreSubscriber) {
+      throw new Error('agent status observer was not registered')
+    }
+
+    latestStoreSubscriber()
+    latestStoreSubscriber()
+    await Promise.resolve()
+
+    expect(mockMarkDispatchResult).not.toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'completed' })
+    )
+  })
+
+  // Why: transport loss, PTY exit and cap eviction all drop and recreate the live
+  // entry with an empty stateHistory. The working edge is only in the observer's
+  // own bookkeeping by then, so it must survive a zero-overlap rescan.
+  it('completes a reuse-session run when the entry is recreated with no history', async () => {
+    const paneKey = 'agent-tab:7c6fb4e5-3bf1-4ff4-8259-03f7ae81c40d'
+    mockFindReusableAutomationSession.mockReturnValue({
+      tabId: 'agent-tab',
+      paneKey,
+      ptyId: 'agent-pty'
+    })
+    mockObserveExistingAutomationSession.mockResolvedValue(() => {})
+
+    await registerAndDispatch(makeAutomation({ reuseSession: true }))
+    const workingStartedAt = Date.now() + 1
+    state.agentStatusByPaneKey = {
+      [paneKey]: {
+        paneKey,
+        state: 'working',
+        prompt: 'turn',
+        agentType: 'claude',
+        updatedAt: workingStartedAt,
+        stateStartedAt: workingStartedAt,
+        stateHistory: [{ state: 'working', prompt: 'turn', startedAt: workingStartedAt }]
+      }
+    }
+    if (!latestStoreSubscriber) {
+      throw new Error('agent status observer was not registered')
+    }
+    latestStoreSubscriber()
+    await Promise.resolve()
+
+    // The entry is dropped and recreated: same pane, now done, history gone.
+    state.agentStatusByPaneKey = {
+      [paneKey]: {
+        paneKey,
+        state: 'done',
+        prompt: 'turn',
+        agentType: 'claude',
+        updatedAt: workingStartedAt + 2,
+        stateStartedAt: workingStartedAt + 2,
+        stateHistory: []
+      }
+    }
+    latestStoreSubscriber()
+    await Promise.resolve()
+
+    expect(mockMarkDispatchResult).toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'completed' })
+    )
+  })
+
   it('consumes duplicate done and zero-exit completion through one finalizer', async () => {
     let launchArgs: {
       onAgentStatus?: (payload: { state: string }) => void
diff --git a/src/renderer/src/hooks/useAutomationDispatchEvents.ts b/src/renderer/src/hooks/useAutomationDispatchEvents.ts
index f4ae2067688..a7741ec959e 100644
--- a/src/renderer/src/hooks/useAutomationDispatchEvents.ts
+++ b/src/renderer/src/hooks/useAutomationDispatchEvents.ts
@@ -32,6 +32,7 @@ import {
 } from '../../../shared/execution-host'
 import { parseWorkspaceKey } from '../../../shared/workspace-scope'
 import { getFolderWorkspaceConnectionId } from '@/lib/folder-workspace-connection'
+import type { AgentStateHistoryEntry } from '../../../shared/agent-status-types'
 
 const AUTOMATIONS_CHANGED_EVENT = 'orca:automations-changed'
 const activeReuseDispatchTabIds = new Set<string>()
@@ -54,6 +55,37 @@ function buildAutomationWorkspaceName(runTitle: string, scheduledFor: number): s
   return `auto-${slug || 'run'}-${stamp}`
 }
 
+function agentStateHistoryEntriesEqual(
+  left: AgentStateHistoryEntry,
+  right: AgentStateHistoryEntry
+): boolean {
+  return (
+    left.state === right.state &&
+    left.prompt === right.prompt &&
+    left.startedAt === right.startedAt &&
+    left.interrupted === right.interrupted
+  )
+}
+
+function getAgentStateHistoryOverlap(
+  previous: AgentStateHistoryEntry[],
+  current: AgentStateHistoryEntry[]
+): number {
+  for (let overlap = Math.min(previous.length, current.length); overlap > 0; overlap -= 1) {
+    const previousOffset = previous.length - overlap
+    if (
+      current
+        .slice(0, overlap)
+        .every((entry, index) =>
+          agentStateHistoryEntriesEqual(entry, previous[previousOffset + index])
+        )
+    ) {
+      return overlap
+    }
+  }
+  return 0
+}
+
 export function useAutomationDispatchEvents(): void {
   useEffect(() => {
     const unsubscribe = window.api.automations.onDispatchRequested(
@@ -405,12 +437,41 @@ export function useAutomationDispatchEvents(): void {
             options?: { requireWorkingAfterStart?: boolean }
           ): void => {
             let sawWorkingAfterStart = false
+            let observedStateHistory: AgentStateHistoryEntry[] = []
             const checkCurrentStatus = (): void => {
               const { agentStatusByPaneKey } = useAppStore.getState()
               for (const [paneKey, entry] of Object.entries(agentStatusByPaneKey)) {
                 if (paneKey !== targetPaneKey || entry.updatedAt < startedAfter) {
                   continue
                 }
+                const historyOverlap = getAgentStateHistoryOverlap(
+                  observedStateHistory,
+                  entry.stateHistory
+                )
+                // Why: sawWorkingAfterStart stays monotonic — a recreated entry
+                // (transport loss, PTY exit, cap eviction) arrives with an empty
+                // stateHistory, so clearing it here would strand reuseSession runs
+                // with nothing left to re-derive the working edge from.
+                for (const historicalState of entry.stateHistory.slice(historyOverlap)) {
+                  if (historicalState.startedAt < startedAfter) {
+                    continue
+                  }
+                  if (historicalState.state === 'working') {
+                    sawWorkingAfterStart = true
+                  }
+                  if (
+                    historicalState.state === 'done' &&
+                    (!options?.requireWorkingAfterStart || sawWorkingAfterStart)
+                  ) {
+                    // Why: this `done` already rolled out of the live entry, so its output
+                    // survives only in the entry-level completed slot.
+                    latestAssistantMessage =
+                      entry.lastCompletedAssistantMessage?.trim() || latestAssistantMessage
+                    handleAgentDone()
+                    return
+                  }
+                }
+                observedStateHistory = [...entry.stateHistory]
                 if (entry.state === 'working') {
                   sawWorkingAfterStart = true
                 }
diff --git a/src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts b/src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts
index 635399b63d8..a7f5aa4d0d1 100644
--- a/src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts
+++ b/src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts
@@ -636,6 +636,19 @@ describe('useComposerState host-context boundaries', () => {
     expect(section).toContain('setCreateError({')
   })
 
+  it('uses submit-time smart metadata for both folder launch mode and startup content', () => {
+    const section = sourceBetween(
+      HOOK_SOURCE,
+      'const submitFolderTarget',
+      'const submit = useCallback'
+    )
+    expect(section).toContain(
+      'const submitLinkedWorkItem = smartGitHubMetadata?.linkedWorkItem ?? linkedWorkItem'
+    )
+    expect(section).toContain('resolveFolderWorkspaceLaunchDraft(submitLinkedWorkItem, note)')
+    expect(section).toContain('linkedWorkItem: submitLinkedWorkItem')
+  })
+
   it('gates every submit path on the derived source intent', () => {
     // Why: derived from name+mode, so the submitted name and the gate can never disagree.
     expect(HOOK_SOURCE).toContain(
diff --git a/src/renderer/src/hooks/useComposerState.ts b/src/renderer/src/hooks/useComposerState.ts
index 35f403c8e09..b5cdcd01503 100644
--- a/src/renderer/src/hooks/useComposerState.ts
+++ b/src/renderer/src/hooks/useComposerState.ts
@@ -23,7 +23,7 @@ import { buildAgentDraftLaunchPlan, buildAgentStartupPlan } from '@/lib/tui-agen
 import { filterEnabledTuiAgents, isTuiAgentEnabled } from '../../../shared/tui-agent-selection'
 import { repoIsRemote } from '../../../shared/agent-launch-remote'
 import { resolveLocalWindowsAgentStartupShell } from '../../../shared/windows-terminal-shell'
-import { resolveNativeChatLaunchSessionOptions } from '@/components/native-chat/native-chat-session-option-enrichment'
+import { resolveInitialNativeChatSessionOptions } from '@/components/native-chat/native-chat-launch-session-options'
 import { seedNativeChatAppliedSessionOptions } from '@/components/native-chat/native-chat-session-option-cache'
 import {
   resolveTuiAgentLaunchArgs,
@@ -146,7 +146,11 @@ import {
   toLinearLinkedWorkItem
 } from '@/components/sidebar/folder-workspace-composer-helpers'
 import { useFolderWorkspaceComposerPathStatus } from '@/components/sidebar/folder-workspace-composer-path-status'
-import { submitFolderWorkspaceCreate } from '@/components/sidebar/folder-workspace-composer-submit'
+import {
+  resolveFolderWorkspaceLaunchDraft,
+  submitFolderWorkspaceCreate
+} from '@/components/sidebar/folder-workspace-composer-submit'
+import { isNativeChatTranscriptLocalReadable } from '@/lib/native-chat-transcript-readability'
 import { buildExecutionHostRegistry } from '../../../shared/execution-host-registry'
 import {
   getRepoExecutionHostId,
@@ -3440,6 +3444,7 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
         const smartGitHubResolution = smartGitHubSettlement.value
         const smartGitHubMetadata =
           smartGitHubResolution.kind === 'none' ? null : smartGitHubResolution
+        const submitLinkedWorkItem = smartGitHubMetadata?.linkedWorkItem ?? linkedWorkItem
         const agent =
           requestedAgent && isTuiAgentEnabled(requestedAgent, disabledTuiAgents)
             ? requestedAgent
@@ -3447,11 +3452,15 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
         if (isSubmissionCancelled()) {
           return
         }
+        const folderLaunchDraftText =
+          agent && submitLinkedWorkItem
+            ? resolveFolderWorkspaceLaunchDraft(submitLinkedWorkItem, note)
+            : null
         const folderWorkspaceCreated = await submitFolderWorkspaceCreate({
           projectGroup: selectedProjectGroup,
           name: smartGitHubMetadata?.workspaceName ?? name,
           lastAutoName: lastAutoNameRef.current,
-          linkedWorkItem: smartGitHubMetadata?.linkedWorkItem ?? linkedWorkItem,
+          linkedWorkItem: submitLinkedWorkItem,
           linkedTaskSourceContext: taskSourceContext,
           note,
           quickAgent: agent,
@@ -3462,7 +3471,21 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
             : undefined,
           agentEnv: agent ? resolveTuiAgentLaunchEnv(agent, settings?.agentDefaultEnv) : undefined,
           sessionOptions: agent
-            ? resolveNativeChatLaunchSessionOptions(settings?.nativeChatSessionOptions, agent)
+            ? resolveInitialNativeChatSessionOptions(
+                {
+                  experimentalNativeChat: settings?.experimentalNativeChat,
+                  openAgentTabsInChatByDefault: settings?.openAgentTabsInChatByDefault,
+                  nativeChatSessionOptions: settings?.nativeChatSessionOptions
+                },
+                {
+                  agent,
+                  ...(folderLaunchDraftText
+                    ? { promptDelivery: 'draft' as const, launchDraftText: folderLaunchDraftText }
+                    : {}),
+                  nativeChatTranscriptIsLocalReadable:
+                    isNativeChatTranscriptLocalReadable(folderTargetConnectionId)
+                }
+              )
             : undefined,
           terminalWindowsShell: settings?.terminalWindowsShell,
           isRemote: folderTargetIsRemote,
@@ -3509,6 +3532,7 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
       createFolderWorkspace,
       disabledTuiAgents,
       folderCreateDisabled,
+      folderTargetConnectionId,
       folderTargetIsRemote,
       folderTargetRuntimeEnvironmentId,
       folderSourceRepos.length,
@@ -3524,7 +3548,9 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
       settings?.agentDefaultArgs,
       settings?.agentDefaultEnv,
       settings?.autoRenameBranchFromWork,
+      settings?.experimentalNativeChat,
       settings?.nativeChatSessionOptions,
+      settings?.openAgentTabsInChatByDefault,
       settings?.terminalWindowsShell,
       taskSourceContext,
       telemetrySource
@@ -3768,9 +3794,18 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
         cmdOverrides: settings?.agentCmdOverrides ?? {},
         agentArgs: resolveTuiAgentLaunchArgs(tuiAgent, settings?.agentDefaultArgs),
         agentEnv: resolveTuiAgentLaunchEnv(tuiAgent, settings?.agentDefaultEnv),
-        sessionOptions: resolveNativeChatLaunchSessionOptions(
-          settings?.nativeChatSessionOptions,
-          tuiAgent
+        sessionOptions: resolveInitialNativeChatSessionOptions(
+          {
+            experimentalNativeChat: settings?.experimentalNativeChat,
+            openAgentTabsInChatByDefault: settings?.openAgentTabsInChatByDefault,
+            nativeChatSessionOptions: settings?.nativeChatSessionOptions
+          },
+          {
+            agent: tuiAgent,
+            nativeChatTranscriptIsLocalReadable: isNativeChatTranscriptLocalReadable(
+              selectedRepo.connectionId
+            )
+          }
         ),
         platform: selectedRepoAgentLaunchPlatform,
         shell: selectedRepoStartupShell,
@@ -3980,7 +4015,9 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
     settings?.agentDefaultArgs,
     settings?.agentDefaultEnv,
     settings?.autoRenameBranchFromWork,
+    settings?.experimentalNativeChat,
     settings?.nativeChatSessionOptions,
+    settings?.openAgentTabsInChatByDefault,
     smartNameMode,
     setSidebarOpen,
     setupDecision,
@@ -4314,6 +4351,25 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
         const promptLinkedWorkItem = agent === null ? null : submitLinkedWorkItem
         const { prompt: quickPrompt, draftPrompt: quickDraftPrompt } =
           resolveQuickCreateLinkedWorkItemPrompt(promptLinkedWorkItem, trimmedNote)
+        const quickSessionOptions =
+          agent === null
+            ? undefined
+            : resolveInitialNativeChatSessionOptions(
+                {
+                  experimentalNativeChat: settings?.experimentalNativeChat,
+                  openAgentTabsInChatByDefault: settings?.openAgentTabsInChatByDefault,
+                  nativeChatSessionOptions: settings?.nativeChatSessionOptions
+                },
+                {
+                  agent,
+                  ...(quickDraftPrompt
+                    ? { promptDelivery: 'draft' as const, launchDraftText: quickDraftPrompt }
+                    : {}),
+                  nativeChatTranscriptIsLocalReadable: isNativeChatTranscriptLocalReadable(
+                    selectedRepo.connectionId
+                  )
+                }
+              )
         const draftLaunchPlan =
           agent === null || !quickDraftPrompt
             ? null
@@ -4323,10 +4379,7 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
                 cmdOverrides: settings?.agentCmdOverrides ?? {},
                 agentArgs: resolveTuiAgentLaunchArgs(agent, settings?.agentDefaultArgs),
                 agentEnv: resolveTuiAgentLaunchEnv(agent, settings?.agentDefaultEnv),
-                sessionOptions: resolveNativeChatLaunchSessionOptions(
-                  settings?.nativeChatSessionOptions,
-                  agent
-                ),
+                sessionOptions: quickSessionOptions,
                 platform: selectedRepoAgentLaunchPlatform,
                 shell: selectedRepoStartupShell,
                 isRemote: selectedRepoIsRemote
@@ -4355,10 +4408,7 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
             cmdOverrides: settings?.agentCmdOverrides ?? {},
             agentArgs: resolveTuiAgentLaunchArgs(agent, settings?.agentDefaultArgs),
             agentEnv: resolveTuiAgentLaunchEnv(agent, settings?.agentDefaultEnv),
-            sessionOptions: resolveNativeChatLaunchSessionOptions(
-              settings?.nativeChatSessionOptions,
-              agent
-            ),
+            sessionOptions: quickSessionOptions,
             platform: selectedRepoAgentLaunchPlatform,
             shell: selectedRepoStartupShell,
             isRemote: selectedRepoIsRemote,
@@ -4562,7 +4612,9 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
       settings?.agentDefaultArgs,
       settings?.agentDefaultEnv,
       settings?.autoRenameBranchFromWork,
+      settings?.experimentalNativeChat,
       settings?.nativeChatSessionOptions,
+      settings?.openAgentTabsInChatByDefault,
       smartNameMode,
       sourceIntentBlocksCreate,
       disabledTuiAgents,
diff --git a/src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts b/src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts
new file mode 100644
index 00000000000..cfcb973d968
--- /dev/null
+++ b/src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts
@@ -0,0 +1,129 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as EditorAutosaveModule from '@/components/editor/editor-autosave'
+import type * as CrossPlatformPathModule from '../../../shared/cross-platform-path'
+import type { FsChangedPayload } from '../../../shared/types'
+
+const pathOperationCounts = vi.hoisted(() => ({
+  aliasComparisons: 0,
+  normalizations: 0,
+  identities: 0
+}))
+
+vi.mock('@/store', () => ({ useAppStore: { getState: vi.fn() } }))
+vi.mock('@/components/editor/editor-autosave', async (importOriginal) => {
+  const actual = await importOriginal<typeof EditorAutosaveModule>()
+  return { ...actual, notifyEditorExternalFileChange: vi.fn() }
+})
+vi.mock('../../../shared/cross-platform-path', async (importOriginal) => {
+  type PathModuleWithIdentity = typeof CrossPlatformPathModule & {
+    getLocalWindowsWslPathIdentity?: (value: string) => unknown
+  }
+  const actual = await importOriginal<PathModuleWithIdentity>()
+  return {
+    ...actual,
+    normalizeRuntimePathForComparison: (value: string) => {
+      pathOperationCounts.normalizations++
+      return actual.normalizeRuntimePathForComparison(value)
+    },
+    areLocalWindowsWslPathAliases: (left: string, right: string) => {
+      pathOperationCounts.aliasComparisons++
+      return actual.areLocalWindowsWslPathAliases(left, right)
+    },
+    ...(actual.getLocalWindowsWslPathIdentity
+      ? {
+          getLocalWindowsWslPathIdentity: (value: string) => {
+            pathOperationCounts.identities++
+            return actual.getLocalWindowsWslPathIdentity!(value)
+          }
+        }
+      : {})
+  }
+})
+
+import { useAppStore } from '@/store'
+import {
+  getOpenFilesForExternalFileChange,
+  notifyEditorExternalFileChange
+} from '@/components/editor/editor-autosave'
+import { createExternalWatchEventHandler } from './useEditorExternalWatch'
+
+const EVENT_COUNT = 5_000
+const OPEN_FILE_COUNT = 100
+const payloadWorktreePath = '\\\\wsl.localhost\\Ubuntu\\workspace\\repo'
+
+describe('external watcher path matching complexity', () => {
+  beforeEach(() => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    vi.clearAllMocks()
+    pathOperationCounts.aliasComparisons = 0
+    pathOperationCounts.normalizations = 0
+    pathOperationCounts.identities = 0
+    vi.stubGlobal('window', { dispatchEvent: vi.fn() })
+    vi.stubGlobal('navigator', { userAgent: 'Windows' })
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    vi.unstubAllGlobals()
+  })
+
+  it('bounds a maximum-sized opposite-alias batch by events plus open files', () => {
+    const openFiles = Array.from({ length: OPEN_FILE_COUNT }, (_, index) => ({
+      id: `//wsl.localhost/Ubuntu/workspace/repo/file-${index}.ts`,
+      filePath: `//wsl.localhost/Ubuntu/workspace/repo/file-${index}.ts`,
+      relativePath: `file-${index}.ts`,
+      worktreeId: 'wt-wsl',
+      mode: 'edit' as const,
+      isDirty: false
+    }))
+    const initialOpenFiles = [
+      ...openFiles,
+      {
+        id: 'combined-diff',
+        filePath: payloadWorktreePath,
+        relativePath: '',
+        worktreeId: 'wt-wsl',
+        mode: 'diff' as const,
+        diffSource: 'combined-uncommitted' as const,
+        isDirty: false
+      }
+    ]
+    vi.mocked(useAppStore.getState).mockReturnValue({
+      openFiles: initialOpenFiles,
+      setExternalMutation: vi.fn()
+    } as never)
+    const payload: FsChangedPayload = {
+      worktreePath: payloadWorktreePath,
+      events: Array.from({ length: EVENT_COUNT }, (_, index) => ({
+        kind: 'update' as const,
+        absolutePath: `\\\\wsl.localhost\\Ubuntu\\workspace\\repo\\file-${index}.ts`
+      }))
+    }
+    const { handleFsChanged, dispose } = createExternalWatchEventHandler(() => ({
+      worktreeId: 'wt-wsl',
+      worktreePath: payload.worktreePath,
+      connectionId: undefined,
+      runtimeEnvironmentId: null,
+      allowLocalWindowsWslAliases: true
+    }))
+
+    const startedAt = process.hrtime.bigint()
+    handleFsChanged(payload)
+    const elapsedMs = Number(process.hrtime.bigint() - startedAt) / 1_000_000
+    vi.advanceTimersByTime(100)
+    expect(notifyEditorExternalFileChange).toHaveBeenCalledTimes(EVENT_COUNT)
+    // Why: a tab/store update during debounce must rebuild the index once, not rescan per event.
+    const currentOpenFiles = initialOpenFiles.map((file) => ({ ...file }))
+    for (const [notification] of vi.mocked(notifyEditorExternalFileChange).mock.calls) {
+      getOpenFilesForExternalFileChange(currentOpenFiles as never, notification)
+    }
+    const pathOperations =
+      pathOperationCounts.aliasComparisons +
+      pathOperationCounts.normalizations +
+      pathOperationCounts.identities
+
+    console.info('STA-3942 watcher oracle', { ...pathOperationCounts, pathOperations, elapsedMs })
+    expect(pathOperations).toBeLessThanOrEqual(3 * (EVENT_COUNT + initialOpenFiles.length))
+    dispose()
+  })
+})
diff --git a/src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts b/src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts
index b2367e33721..dcb5d6f8254 100644
--- a/src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts
+++ b/src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts
@@ -104,6 +104,162 @@ describe('getEditorExternalWatchTargets', () => {
     ])
   })
 
+  it('enables WSL aliases for a proven-local Windows drive watcher', () => {
+    const repo = makeRepo('repo-local-drive', null, 'local')
+    const worktree = makeWorktree(repo.id, 'wt-local-drive')
+    worktree.path = 'C:\\repo'
+    worktree.hostId = 'local'
+    const state = makeState({ repo, worktree, openFiles: [makeOpenFile(worktree.id)] })
+    state.repos = [makeRepo(repo.id, 'ssh-1', 'ssh:ssh-1'), repo]
+
+    expect(getEditorExternalWatchTargets(state).targets).toEqual([
+      {
+        worktreeId: 'wt-local-drive',
+        worktreePath: 'C:\\repo',
+        connectionId: undefined,
+        runtimeEnvironmentId: null,
+        allowLocalWindowsWslAliases: true
+      }
+    ])
+  })
+
+  it('does not infer a local alias owner while repo metadata is missing', () => {
+    const repo = makeRepo('repo-unresolved', null, 'local')
+    const worktree = makeWorktree(repo.id, 'wt-unresolved')
+    worktree.path = 'C:\\repo'
+    worktree.hostId = 'local'
+    const state = makeState({ repo, worktree, openFiles: [makeOpenFile(worktree.id)] })
+    state.repos = []
+
+    expect(getEditorExternalWatchTargets(state).targets).toEqual([
+      {
+        worktreeId: 'wt-unresolved',
+        worktreePath: 'C:\\repo',
+        connectionId: undefined,
+        runtimeEnvironmentId: null
+      }
+    ])
+  })
+
+  it.each(['worktree', 'repo'] as const)(
+    'does not grant local aliases while the %s host stamp is missing',
+    (stampOwner) => {
+      const repo = makeRepo('repo-missing-host', null, 'local')
+      const worktree = makeWorktree(repo.id, 'wt-missing-host')
+      worktree.path = 'C:\\repo'
+      worktree.hostId = 'local'
+      if (stampOwner === 'worktree') {
+        worktree.hostId = undefined
+      } else {
+        repo.executionHostId = undefined
+      }
+
+      const target = getEditorExternalWatchTargets(
+        makeState({ repo, worktree, openFiles: [makeOpenFile(worktree.id)] })
+      ).targets[0]
+
+      expect(target).not.toHaveProperty('allowLocalWindowsWslAliases')
+    }
+  )
+
+  it.each(['worktree', 'repo'] as const)(
+    'does not grant local aliases for an unknown %s host stamp',
+    (stampOwner) => {
+      const repo = makeRepo('repo-unknown-host')
+      const worktree = makeWorktree(repo.id, 'wt-unknown-host')
+      worktree.path = 'C:\\repo'
+      worktree.hostId = 'local'
+      repo.executionHostId = 'local'
+      if (stampOwner === 'worktree') {
+        worktree.hostId = 'future:host' as never
+      } else {
+        repo.executionHostId = 'future:host' as never
+      }
+
+      const target = getEditorExternalWatchTargets(
+        makeState({ repo, worktree, openFiles: [makeOpenFile(worktree.id)] })
+      ).targets[0]
+
+      expect(target).not.toHaveProperty('allowLocalWindowsWslAliases')
+    }
+  )
+
+  it('enables WSL aliases for a proven-local folder workspace', () => {
+    const repo = makeRepo('unused', null, 'local')
+    const worktree = makeWorktree(repo.id)
+    const folderWorkspaceId = 'folder-local'
+    const workspaceKey = `folder:${folderWorkspaceId}`
+    const state = makeState({
+      repo,
+      worktree,
+      openFiles: [makeOpenFile(workspaceKey)]
+    })
+    state.folderWorkspaces = [
+      {
+        id: folderWorkspaceId,
+        projectGroupId: 'group-local',
+        folderPath: 'C:\\folder',
+        executionHostId: 'local'
+      } as EditorExternalWatchTargetState['folderWorkspaces'][number]
+    ]
+    state.projectGroups = [
+      {
+        id: 'group-local',
+        executionHostId: 'runtime:env-1'
+      } as EditorExternalWatchTargetState['projectGroups'][number],
+      {
+        id: 'group-local',
+        executionHostId: 'local'
+      } as EditorExternalWatchTargetState['projectGroups'][number]
+    ]
+
+    expect(getEditorExternalWatchTargets(state).targets).toEqual([
+      {
+        worktreeId: workspaceKey,
+        worktreePath: 'C:\\folder',
+        connectionId: undefined,
+        runtimeEnvironmentId: null,
+        allowLocalWindowsWslAliases: true
+      }
+    ])
+  })
+
+  it.each(['ssh', 'missing-group'] as const)(
+    'does not grant local aliases for a %s folder workspace owner',
+    (ownerCase) => {
+      const repo = makeRepo('unused', null, 'local')
+      const worktree = makeWorktree(repo.id)
+      const folderWorkspaceId = `folder-${ownerCase}`
+      const workspaceKey = `folder:${folderWorkspaceId}`
+      const state = makeState({
+        repo,
+        worktree,
+        openFiles: [makeOpenFile(workspaceKey)]
+      })
+      state.folderWorkspaces = [
+        {
+          id: folderWorkspaceId,
+          projectGroupId: `group-${ownerCase}`,
+          folderPath: 'C:\\folder',
+          executionHostId: ownerCase === 'ssh' ? 'ssh:target-1' : 'local'
+        } as EditorExternalWatchTargetState['folderWorkspaces'][number]
+      ]
+      state.projectGroups =
+        ownerCase === 'ssh'
+          ? [
+              {
+                id: 'group-ssh',
+                executionHostId: 'ssh:target-1'
+              } as EditorExternalWatchTargetState['projectGroups'][number]
+            ]
+          : []
+
+      expect(getEditorExternalWatchTargets(state).targets[0]).not.toHaveProperty(
+        'allowLocalWindowsWslAliases'
+      )
+    }
+  )
+
   it('does not watch the active worktree while the sidebar is hidden', () => {
     const repo = makeRepo('repo-active')
     const worktree = makeWorktree(repo.id, 'wt-active')
@@ -241,6 +397,32 @@ describe('getEditorExternalWatchTargets', () => {
     ])
   })
 
+  it('keeps a paired runtime SSH Source Control watcher routed through its runtime repo', () => {
+    const repo = makeRepo('repo-paired', null, 'runtime:env-1')
+    const worktree = makeWorktree(repo.id, 'wt-paired')
+    worktree.hostId = 'ssh:private-target'
+    worktree.runtimeOwnerEnvironmentId = 'env-1'
+
+    expect(
+      getEditorExternalWatchTargets(
+        makeState({
+          repo,
+          worktree,
+          activeWorktreeId: worktree.id,
+          rightSidebarOpen: true,
+          rightSidebarTab: 'source-control'
+        })
+      ).targets
+    ).toEqual([
+      {
+        worktreeId: 'wt-paired',
+        worktreePath: '/repo-paired/worktree',
+        connectionId: undefined,
+        runtimeEnvironmentId: 'env-1'
+      }
+    ])
+  })
+
   it('rebuilds ownerless targets when an SSH connection id hydrates', () => {
     const localRepo = makeRepo('repo-remote', null)
     const remoteRepo = makeRepo('repo-remote', 'ssh-1')
diff --git a/src/renderer/src/hooks/useEditorExternalWatch-wsl-repro.test.ts b/src/renderer/src/hooks/useEditorExternalWatch-wsl-repro.test.ts
new file mode 100644
index 00000000000..256632dfd58
--- /dev/null
+++ b/src/renderer/src/hooks/useEditorExternalWatch-wsl-repro.test.ts
@@ -0,0 +1,188 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as EditorAutosaveModule from '@/components/editor/editor-autosave'
+import type { FsChangedPayload } from '../../../shared/types'
+
+vi.mock('@/store', () => ({ useAppStore: { getState: vi.fn() } }))
+vi.mock('@/components/editor/editor-autosave', async (importOriginal) => {
+  const actual = await importOriginal<typeof EditorAutosaveModule>()
+  return { ...actual, notifyEditorExternalFileChange: vi.fn() }
+})
+
+import { useAppStore } from '@/store'
+import { notifyEditorExternalFileChange } from '@/components/editor/editor-autosave'
+import { createExternalWatchEventHandler } from './useEditorExternalWatch'
+
+const worktreePath = '\\\\wsl.localhost\\Ubuntu\\workspace\\repo'
+const restoredPath = '//wsl.localhost/Ubuntu/workspace/repo/file.ts'
+
+function payload(): FsChangedPayload {
+  return {
+    worktreePath,
+    events: [
+      { kind: 'update', absolutePath: '\\\\wsl.localhost\\Ubuntu\\workspace\\repo\\file.ts' }
+    ]
+  }
+}
+
+describe('WSL watcher stale-refresh reproduction', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.clearAllMocks()
+    vi.stubGlobal('window', { dispatchEvent: vi.fn() })
+    vi.stubGlobal('navigator', { userAgent: 'Windows' })
+    vi.mocked(useAppStore.getState).mockReturnValue({
+      openFiles: [
+        {
+          id: restoredPath,
+          filePath: restoredPath,
+          relativePath: 'file.ts',
+          worktreeId: 'wt-wsl',
+          mode: 'edit',
+          isDirty: false
+        }
+      ],
+      setExternalMutation: vi.fn()
+    } as never)
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    vi.unstubAllGlobals()
+  })
+
+  it('reloads a restored forward-UNC tab from a local backslash watcher event', () => {
+    const { handleFsChanged, dispose } = createExternalWatchEventHandler(() => ({
+      worktreeId: 'wt-wsl',
+      worktreePath,
+      connectionId: undefined,
+      runtimeEnvironmentId: null,
+      allowLocalWindowsWslAliases: true
+    }))
+
+    handleFsChanged(payload())
+    vi.advanceTimersByTime(100)
+
+    expect(notifyEditorExternalFileChange).toHaveBeenCalledWith({
+      worktreeId: 'wt-wsl',
+      worktreePath,
+      relativePath: 'file.ts',
+      runtimeEnvironmentId: null,
+      allowLocalWindowsWslAliases: true
+    })
+    dispose()
+  })
+
+  it('keeps update aliases distinct for an SSH watcher', () => {
+    const { handleFsChanged, dispose } = createExternalWatchEventHandler(() => ({
+      worktreeId: 'wt-wsl',
+      worktreePath,
+      connectionId: 'ssh-1',
+      runtimeEnvironmentId: null
+    }))
+
+    handleFsChanged(payload())
+    vi.advanceTimersByTime(100)
+
+    expect(notifyEditorExternalFileChange).not.toHaveBeenCalled()
+    dispose()
+  })
+
+  it('keeps the same aliases distinct on a POSIX desktop', () => {
+    vi.stubGlobal('navigator', { userAgent: 'Linux' })
+    const { handleFsChanged, dispose } = createExternalWatchEventHandler(() => ({
+      worktreeId: 'wt-wsl',
+      worktreePath,
+      connectionId: undefined,
+      runtimeEnvironmentId: null,
+      allowLocalWindowsWslAliases: true
+    }))
+
+    handleFsChanged(payload())
+    vi.advanceTimersByTime(100)
+
+    expect(notifyEditorExternalFileChange).not.toHaveBeenCalled()
+    dispose()
+  })
+
+  it('reloads a restored /mnt drive alias from a native-drive watcher event', () => {
+    const driveRoot = 'C:\\workspace\\repo'
+    const mountedPath = '//wsl.localhost/Ubuntu/mnt/c/workspace/repo/file.ts'
+    vi.mocked(useAppStore.getState).mockReturnValue({
+      openFiles: [
+        {
+          id: mountedPath,
+          filePath: mountedPath,
+          relativePath: 'file.ts',
+          worktreeId: 'wt-wsl',
+          mode: 'edit',
+          isDirty: false
+        }
+      ],
+      setExternalMutation: vi.fn()
+    } as never)
+    const { handleFsChanged, dispose } = createExternalWatchEventHandler(() => ({
+      worktreeId: 'wt-wsl',
+      worktreePath: driveRoot,
+      connectionId: undefined,
+      runtimeEnvironmentId: null,
+      allowLocalWindowsWslAliases: true
+    }))
+
+    handleFsChanged({
+      worktreePath: driveRoot,
+      events: [{ kind: 'update', absolutePath: 'C:\\workspace\\repo\\file.ts' }]
+    })
+    vi.advanceTimersByTime(100)
+
+    expect(notifyEditorExternalFileChange).toHaveBeenCalledWith({
+      worktreeId: 'wt-wsl',
+      worktreePath: driveRoot,
+      relativePath: 'file.ts',
+      runtimeEnvironmentId: null,
+      allowLocalWindowsWslAliases: true
+    })
+    dispose()
+  })
+
+  it('tombstones and restores a /mnt alias from native-drive watcher events', () => {
+    const driveRoot = 'C:\\workspace\\repo'
+    const mountedPath = '//wsl.localhost/Ubuntu/mnt/c/workspace/repo/file.ts'
+    const file = {
+      id: mountedPath,
+      filePath: mountedPath,
+      relativePath: 'file.ts',
+      worktreeId: 'wt-wsl',
+      mode: 'edit' as const,
+      isDirty: false,
+      externalMutation: null as 'deleted' | null
+    }
+    const setExternalMutation = vi.fn((_id: string, mutation: 'deleted' | null) => {
+      file.externalMutation = mutation
+    })
+    vi.mocked(useAppStore.getState).mockReturnValue({
+      openFiles: [file],
+      setExternalMutation
+    } as never)
+    const { handleFsChanged, dispose } = createExternalWatchEventHandler(() => ({
+      worktreeId: 'wt-wsl',
+      worktreePath: driveRoot,
+      connectionId: undefined,
+      runtimeEnvironmentId: null,
+      allowLocalWindowsWslAliases: true
+    }))
+
+    handleFsChanged({
+      worktreePath: driveRoot,
+      events: [{ kind: 'delete', absolutePath: 'C:\\workspace\\repo\\file.ts' }]
+    })
+    vi.advanceTimersByTime(100)
+    expect(setExternalMutation).toHaveBeenCalledWith(mountedPath, 'deleted')
+
+    handleFsChanged({
+      worktreePath: driveRoot,
+      events: [{ kind: 'create', absolutePath: 'C:\\workspace\\repo\\file.ts' }]
+    })
+    expect(setExternalMutation).toHaveBeenLastCalledWith(mountedPath, null)
+    dispose()
+  })
+})
diff --git a/src/renderer/src/hooks/useEditorExternalWatch.test.ts b/src/renderer/src/hooks/useEditorExternalWatch.test.ts
index 747babef0e1..891bbc35e4e 100644
--- a/src/renderer/src/hooks/useEditorExternalWatch.test.ts
+++ b/src/renderer/src/hooks/useEditorExternalWatch.test.ts
@@ -287,7 +287,8 @@ describe('createExternalWatchEventHandler tombstone coalescing', () => {
       filePath: 'C:\\Repo\\notes.md',
       relativePath: 'notes.md',
       mode: 'edit' as const,
-      isDirty: false
+      isDirty: false,
+      runtimeEnvironmentId: 'env-1'
     }
     vi.mocked(useAppStore.getState).mockReturnValue({
       openFiles: [file],
@@ -324,7 +325,8 @@ describe('createExternalWatchEventHandler tombstone coalescing', () => {
       filePath: '//Server/Share/Repo/notes.md',
       relativePath: 'notes.md',
       mode: 'edit' as const,
-      isDirty: false
+      isDirty: false,
+      runtimeEnvironmentId: 'env-1'
     }
     vi.mocked(useAppStore.getState).mockReturnValue({
       openFiles: [file],
diff --git a/src/renderer/src/hooks/useEditorExternalWatch.ts b/src/renderer/src/hooks/useEditorExternalWatch.ts
index 1b4ff62a44d..c07f9bd25c1 100644
--- a/src/renderer/src/hooks/useEditorExternalWatch.ts
+++ b/src/renderer/src/hooks/useEditorExternalWatch.ts
@@ -2,15 +2,17 @@
 import { useEffect, useRef } from 'react'
 import { useAppStore, type AppState } from '@/store'
 import { basename, joinPath } from '@/lib/path'
-import { getExternalFileChangeRelativePath } from '@/components/right-sidebar/useFileExplorerWatch'
-import { normalizeRuntimePathForComparison } from '../../../shared/cross-platform-path'
+import {
+  isWindowsAbsolutePathLike,
+  normalizeRuntimePathForComparison
+} from '../../../shared/cross-platform-path'
 import {
   canAutoSaveOpenFile,
   getOpenFilesForExternalFileChange,
   isExternalReloadableEditorTab,
-  isWorkingTreeCombinedDiffTab,
   notifyEditorExternalFileChange
 } from '@/components/editor/editor-autosave'
+import { indexEditorExternalWatchBatchPaths } from '@/components/editor/editor-external-watch-path-index'
 import {
   clearSelfWrite,
   getRecentSelfWrite,
@@ -34,6 +36,9 @@ import { markFileChangedOnDisk } from '@/components/editor/editor-changed-on-dis
 import { getDiskBaselineSignature } from '@/components/editor/diff-content-signature'
 import { parseWorkspaceKey } from '../../../shared/workspace-scope'
 import { getFolderWorkspaceConnectionId } from '@/lib/folder-workspace-connection'
+import { isLocalWindowsDesktopClient } from '@/lib/desktop-window-chrome'
+import { parseExecutionHostId } from '../../../shared/execution-host'
+import { findRepoForHost } from '@/store/slices/repo-host-identity'
 
 // Why: atomic writes burst same-path events; one reload dispatch each fans out into N EditorPanel rebuilds that can wedge the renderer (issue #826), so debounce per (worktreeId+path).
 const EXTERNAL_RELOAD_DEBOUNCE_MS = 75
@@ -71,6 +76,7 @@ type WatchedTarget = {
   worktreePath: string
   connectionId: string | undefined
   runtimeEnvironmentId: string | null
+  allowLocalWindowsWslAliases?: true
 }
 
 type ExternalWatchNotification = {
@@ -78,6 +84,53 @@ type ExternalWatchNotification = {
   worktreePath: string
   relativePath: string
   runtimeEnvironmentId: string | null
+  allowLocalWindowsWslAliases?: true
+  indexedOpenFiles?: {
+    matches: (openFiles: OpenFile[]) => OpenFile[]
+  }
+}
+
+function localWslAliasOption(
+  target: Pick<WatchedTarget, 'allowLocalWindowsWslAliases'>
+): Pick<ExternalWatchNotification, 'allowLocalWindowsWslAliases'> {
+  return isLocalWindowsDesktopClient() && target.allowLocalWindowsWslAliases === true
+    ? { allowLocalWindowsWslAliases: true }
+    : {}
+}
+
+function isLocalHostStamp(value: string | null | undefined): boolean {
+  return parseExecutionHostId(value)?.kind === 'local'
+}
+
+function canWatchLocalWindowsWslAliases(args: {
+  worktreePath: string
+  runtimeEnvironmentId: string | null
+  connectionId: string | null | undefined
+  worktree: AppState['worktreesByRepo'][string][number] | undefined
+  repo: AppState['repos'][number] | undefined
+  folderWorkspace: AppState['folderWorkspaces'][number] | undefined
+  projectGroup: AppState['projectGroups'][number] | undefined
+}): boolean {
+  if (
+    args.runtimeEnvironmentId !== null ||
+    args.connectionId !== null ||
+    !isWindowsAbsolutePathLike(args.worktreePath)
+  ) {
+    return false
+  }
+  if (args.worktree) {
+    return (
+      !!args.repo &&
+      !args.worktree.runtimeOwnerEnvironmentId?.trim() &&
+      isLocalHostStamp(args.worktree.hostId) &&
+      isLocalHostStamp(args.repo.executionHostId)
+    )
+  }
+  return (
+    !!args.folderWorkspace &&
+    isLocalHostStamp(args.folderWorkspace.executionHostId) &&
+    isLocalHostStamp(args.projectGroup?.executionHostId)
+  )
 }
 
 type WatchedTargetsSnapshot = {
@@ -117,7 +170,7 @@ let cachedWatchedTargetsSnapshot: WatchedTargetsSnapshot = { targets: [], target
 
 export function getWatchedTargetKey(target: WatchedTarget): string {
   // Why: include connectionId so a local placeholder watch is replaced by the real SSH watch once an SSH worktree's provider metadata hydrates.
-  return `${target.worktreeId}::${target.worktreePath}::${target.connectionId ?? 'local'}::${target.runtimeEnvironmentId ?? 'client'}`
+  return `${target.worktreeId}::${target.worktreePath}::${target.connectionId ?? 'local'}::${target.runtimeEnvironmentId ?? 'client'}::${target.allowLocalWindowsWslAliases === true ? 'wsl-aliases' : 'literal'}`
 }
 
 function openFileRuntimeOwner(file: Pick<OpenFile, 'runtimeEnvironmentId'>): string | null {
@@ -160,8 +213,13 @@ export function getEditorExternalWatchTargets(
   const activeWorktree = activeWorktreeId
     ? findWorktreeById(state.worktreesByRepo, activeWorktreeId)
     : undefined
+  const activeWorktreeHost = parseExecutionHostId(activeWorktree?.hostId)
   const activeRepo = activeWorktree
-    ? state.repos.find((repo) => repo.id === activeWorktree.repoId)
+    ? activeWorktreeHost?.kind === 'local'
+      ? (findRepoForHost(state.repos, activeWorktree.repoId, {
+          hostId: activeWorktreeHost.id
+        }) ?? undefined)
+      : state.repos.find((repo) => repo.id === activeWorktree.repoId)
     : undefined
   const sourceControlCanConsumeWatch =
     !!activeWorktreeId &&
@@ -201,10 +259,25 @@ export function getEditorExternalWatchTargets(
     if (!wt && !folderWorkspace) {
       continue
     }
-    const repo = wt ? state.repos.find((r) => r.id === wt.repoId) : undefined
+    const worktreeHost = parseExecutionHostId(wt?.hostId)
+    const repo = wt
+      ? worktreeHost?.kind === 'local'
+        ? (findRepoForHost(state.repos, wt.repoId, { hostId: worktreeHost.id }) ?? undefined)
+        : state.repos.find((r) => r.id === wt.repoId)
+      : undefined
+    const folderHostId = parseExecutionHostId(folderWorkspace?.executionHostId)?.id
+    const projectGroup = folderWorkspace
+      ? state.projectGroups.find(
+          (group) =>
+            group.id === folderWorkspace.projectGroupId &&
+            parseExecutionHostId(group.executionHostId)?.id === folderHostId
+        )
+      : undefined
     const connectionId = folderWorkspace
       ? getFolderWorkspaceConnectionId(state, folderWorkspace.id)
-      : repo?.connectionId
+      : repo
+        ? (repo.connectionId ?? null)
+        : undefined
     if (connectionId === undefined && folderWorkspace) {
       continue
     }
@@ -216,7 +289,18 @@ export function getEditorExternalWatchTargets(
         worktreeId: id,
         worktreePath: wt?.path ?? folderWorkspace!.folderPath,
         connectionId: connectionId ?? undefined,
-        runtimeEnvironmentId: owner
+        runtimeEnvironmentId: owner,
+        ...(canWatchLocalWindowsWslAliases({
+          worktreePath: wt?.path ?? folderWorkspace!.folderPath,
+          runtimeEnvironmentId: owner,
+          connectionId,
+          worktree: wt,
+          repo,
+          folderWorkspace,
+          projectGroup
+        })
+          ? { allowLocalWindowsWslAliases: true as const }
+          : {})
       }
       nextTargets.push(target)
       parts.push(getWatchedTargetKey(target))
@@ -422,17 +506,16 @@ export function createExternalWatchEventHandler(
       )
     }
 
-    // Why: collect create/update paths first to cancel any pending same-path delete — this absorbs the macOS atomic-write delete→create split across two payloads.
-    const createOrUpdatePaths = new Set<string>()
-    for (const evt of payload.events) {
-      if (evt.isDirectory === true) {
-        continue
-      }
-      if (evt.kind === 'create' || evt.kind === 'update') {
-        createOrUpdatePaths.add(normalizeRuntimePathForComparison(evt.absolutePath))
-      }
-    }
-    for (const createdPath of createOrUpdatePaths) {
+    // Why: one batch index keeps local WSL alias normalization out of event×tab loops.
+    const openFilesAtStart = useAppStore.getState().openFiles
+    const batchPaths = indexEditorExternalWatchBatchPaths(payload, openFilesAtStart, {
+      worktreeId: target.worktreeId,
+      worktreePath: target.worktreePath,
+      runtimeEnvironmentId: target.runtimeEnvironmentId,
+      ...localWslAliasOption(target)
+    })
+    const createOrUpdatePaths = batchPaths.createOrUpdatePaths
+    for (const createdPath of createOrUpdatePaths.keys()) {
       const key = pendingKey(target.worktreeId, target.runtimeEnvironmentId, createdPath)
       const existing = pendingDeletes.get(key)
       if (existing) {
@@ -442,24 +525,16 @@ export function createExternalWatchEventHandler(
     }
 
     // Why: mark editor tabs deleted/renamed instead of closing them so the user keeps in-memory content; a paired create means rename, a lone delete is hard.
-    // Why: snapshot openFiles once so the delete/rename helpers share a consistent view without N store reads per payload.
-    const openFilesAtStart = useAppStore.getState().openFiles
-    const deletedOpenEditorIdsRaw = collectDeletedOpenEditorIds(
-      payload,
-      target.worktreeId,
-      target.runtimeEnvironmentId,
-      openFilesAtStart
-    )
+    // Why: snapshot openFiles once so delete, rename, and update matching share one indexed view.
+    const deletedOpenEditorsRaw = batchPaths.deletedOpenEditors
     // Only pay the per-id lookup to suppress a move's own source-delete while a move is live; else the batch stays O(deletes).
-    const deletedOpenEditorIds = hasActiveEditorPathMoves()
-      ? deletedOpenEditorIdsRaw.filter((fileId) => {
-          const file = openFilesAtStart.find((f) => f.id === fileId)
-          return (
-            !file ||
+    const deletedOpenEditors = hasActiveEditorPathMoves()
+      ? deletedOpenEditorsRaw.filter(
+          ({ file }) =>
             !isActiveMoveSourcePath(target.worktreeId, target.runtimeEnvironmentId, file.filePath)
-          )
-        })
-      : deletedOpenEditorIdsRaw
+        )
+      : deletedOpenEditorsRaw
+    const deletedOpenEditorIds = deletedOpenEditors.map(({ file }) => file.id)
     // Why: correlate creates to deletes by basename to avoid mislabelling unrelated create+delete pairs as "renamed"; default to 'deleted' when we can't correlate.
     const hasPairedCreate =
       deletedOpenEditorIds.length > 0 &&
@@ -473,18 +548,9 @@ export function createExternalWatchEventHandler(
         }
       } else {
         // Why: defer the 'deleted' tombstone so a follow-up same-path create in the next payload can cancel it (macOS atomic write).
-        const deletePathByFileId = buildDeletePathByFileId(
-          payload,
-          target.worktreeId,
-          target.runtimeEnvironmentId,
-          deletedOpenEditorIds,
-          openFilesAtStart
-        )
-        for (const fileId of deletedOpenEditorIds) {
-          const absolutePath = deletePathByFileId.get(fileId)
-          if (!absolutePath) {
-            continue
-          }
+        for (const { file, normalizedDeletePath } of deletedOpenEditors) {
+          const fileId = file.id
+          const absolutePath = normalizedDeletePath
           const key = pendingKey(target.worktreeId, target.runtimeEnvironmentId, absolutePath)
           const existing = pendingDeletes.get(key)
           if (existing) {
@@ -514,68 +580,48 @@ export function createExternalWatchEventHandler(
           openFileRuntimeOwner(file) === target.runtimeEnvironmentId &&
           (file.mode === 'edit' || file.mode === 'markdown-preview') &&
           (file.externalMutation === 'deleted' || file.externalMutation === 'renamed') &&
-          createOrUpdatePaths.has(normalizeRuntimePathForComparison(file.filePath))
+          batchPaths.matchesCreateOrUpdate(file)
         ) {
           state.setExternalMutation(file.id, null)
         }
       }
     }
 
-    const changedFiles = new Set<string>()
+    let overflowed = false
     for (const evt of payload.events) {
       if (evt.kind === 'overflow') {
         // Why: overflow omits per-path info, so conservatively clear stale tombstones or a file that reappeared during the overrun stays struck through.
         for (const notification of getOverflowExternalReloadTargets(target)) {
           scheduleDebouncedExternalReload(notification)
         }
-        // Why: `break` not `return` — changedFiles is empty so the rest early-returns anyway, and this is more robust to code added after the loop.
+        overflowed = true
         break
       }
-
-      if (evt.kind === 'update' && evt.isDirectory === true) {
-        continue
-      }
-
-      if (evt.kind === 'delete') {
-        // Why: deletes are tombstoned above; feeding them into reload would read the ENOENT path and replace in-memory content with an error, losing the user's view.
-        continue
-      }
-
-      const relativePath = getExternalFileChangeRelativePath(
-        target.worktreePath,
-        evt.absolutePath,
-        evt.isDirectory
-      )
-      if (relativePath) {
-        changedFiles.add(relativePath)
-      }
     }
 
-    if (changedFiles.size === 0) {
+    if (overflowed || batchPaths.changes.length === 0) {
       return
     }
 
-    // Why: read openFiles once per payload to avoid N store reads on large batches; consumers skip dirty tabs so external writes don't destroy unsaved work.
-    const openFilesSnapshot = useAppStore.getState().openFiles
-    // Why: the combined "Changes" tab is per-worktree not per-path, so compute it once instead of rescanning openFiles per changed file in a large batched payload.
-    const hasCombinedDiffConsumer = openFilesSnapshot.some(
-      (f) =>
-        f.worktreeId === target.worktreeId &&
-        openFileRuntimeOwner(f) === target.runtimeEnvironmentId &&
-        isWorkingTreeCombinedDiffTab(f)
-    )
-    for (const relativePath of changedFiles) {
+    for (const change of batchPaths.changes) {
+      const relativePath = change.relativePath
+      const matching = batchPaths.matchingOpenFiles(change)
       const notification = {
         worktreeId: target.worktreeId,
         worktreePath: target.worktreePath,
         relativePath,
-        runtimeEnvironmentId: target.runtimeEnvironmentId
+        runtimeEnvironmentId: target.runtimeEnvironmentId,
+        ...localWslAliasOption(target)
       }
-      const absolutePath = joinPath(notification.worktreePath, notification.relativePath)
-      const matching = getOpenFilesForExternalFileChange(openFilesSnapshot, notification)
+      Object.defineProperty(notification, 'indexedOpenFiles', {
+        value: {
+          matches: (openFiles: OpenFile[]) => batchPaths.matchingOpenFiles(change, openFiles)
+        }
+      })
+      const absolutePath = change.absolutePath
       if (matching.length === 0) {
         // Why: combined-diff tab has no in-memory content to clobber and guards its own reload, so notify it directly without self-write suppression.
-        if (hasCombinedDiffConsumer) {
+        if (batchPaths.hasCombinedDiffConsumer) {
           scheduleDebouncedExternalReload(notification)
         }
         continue
@@ -604,7 +650,7 @@ export function createExternalWatchEventHandler(
           scheduleChangedOnDiskMark(target, notification, dirtyIds)
         }
         if (dirtyMatches.length === matching.length) {
-          if (hasCombinedDiffConsumer) {
+          if (batchPaths.hasCombinedDiffConsumer) {
             scheduleDebouncedExternalReload(notification)
           }
           continue
@@ -885,7 +931,9 @@ function hasCleanExternalReloadTarget(notification: ExternalWatchNotification):
 
 export function getOverflowExternalReloadTargets(
   target: Pick<WatchedTarget, 'worktreeId' | 'worktreePath'> & {
+    connectionId?: string
     runtimeEnvironmentId?: string | null
+    allowLocalWindowsWslAliases?: true
   }
 ): ExternalWatchNotification[] {
   const state = useAppStore.getState()
@@ -908,78 +956,16 @@ export function getOverflowExternalReloadTargets(
       worktreeId: target.worktreeId,
       worktreePath: target.worktreePath,
       relativePath: file.relativePath,
-      runtimeEnvironmentId: target.runtimeEnvironmentId ?? null
+      runtimeEnvironmentId: target.runtimeEnvironmentId ?? null,
+      ...localWslAliasOption({
+        allowLocalWindowsWslAliases: target.allowLocalWindowsWslAliases
+      })
     })
   }
 
   return notifications
 }
 
-function buildDeletePathByFileId(
-  payload: FsChangedPayload,
-  worktreeId: string,
-  runtimeEnvironmentId: string | null,
-  deletedOpenEditorIds: string[],
-  openFiles: OpenFile[]
-): Map<string, string> {
-  const deletePaths = new Set<string>()
-  for (const evt of payload.events) {
-    if (evt.kind === 'delete') {
-      deletePaths.add(normalizeRuntimePathForComparison(evt.absolutePath))
-    }
-  }
-  const result = new Map<string, string>()
-  if (deletePaths.size === 0) {
-    return result
-  }
-  const deletedIdSet = new Set(deletedOpenEditorIds)
-  for (const file of openFiles) {
-    if (
-      !deletedIdSet.has(file.id) ||
-      file.worktreeId !== worktreeId ||
-      openFileRuntimeOwner(file) !== runtimeEnvironmentId
-    ) {
-      continue
-    }
-    const normalized = normalizeRuntimePathForComparison(file.filePath)
-    if (deletePaths.has(normalized)) {
-      result.set(file.id, normalized)
-    }
-  }
-  return result
-}
-
-function collectDeletedOpenEditorIds(
-  payload: FsChangedPayload,
-  worktreeId: string,
-  runtimeEnvironmentId: string | null,
-  openFiles: OpenFile[]
-): string[] {
-  const deletePaths = new Set<string>()
-  for (const evt of payload.events) {
-    if (evt.kind === 'delete') {
-      deletePaths.add(normalizeRuntimePathForComparison(evt.absolutePath))
-    }
-  }
-  if (deletePaths.size === 0) {
-    return []
-  }
-  const result: string[] = []
-  for (const file of openFiles) {
-    if (
-      file.worktreeId !== worktreeId ||
-      openFileRuntimeOwner(file) !== runtimeEnvironmentId ||
-      (file.mode !== 'edit' && file.mode !== 'markdown-preview')
-    ) {
-      continue
-    }
-    if (deletePaths.has(normalizeRuntimePathForComparison(file.filePath))) {
-      result.push(file.id)
-    }
-  }
-  return result
-}
-
 /**
  * Returns true if the batched payload contains at least one file-create event
  * whose basename matches a deleted open editor file.
diff --git a/src/renderer/src/hooks/useGitHubSlugMetadata.ts b/src/renderer/src/hooks/useGitHubSlugMetadata.ts
index 4635fe85250..3da1c66787d 100644
--- a/src/renderer/src/hooks/useGitHubSlugMetadata.ts
+++ b/src/renderer/src/hooks/useGitHubSlugMetadata.ts
@@ -1,31 +1,13 @@
-// Why: when the dialog opens for a Project row whose repo differs from the
-// active workspace, label/assignee lookups must target the row's repo via
-// slug-addressed IPCs (`listLabelsBySlug` / `listAssignableUsersBySlug`),
-// not via the workspace path. These hooks live in their own module so the
-// existing repoPath-keyed hooks stay focused on the local-workspace flow
-// and so this file remains under the lint line cap.
-/* oxlint-disable react-doctor/no-adjust-state-on-prop-change -- Why: slug metadata hooks clear stale rows and track loading while async provider cache requests are in flight. */
-import { useEffect, useRef, useState } from 'react'
 import { callRuntimeRpc, getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
 import type { GitHubAssignableUser, GlobalSettings } from '../../../shared/types'
 import type {
   ListAssignableUsersBySlugResult,
   ListLabelsBySlugResult
 } from '../../../shared/github-project-types'
-import {
-  clearMetadataRequestStore,
-  createMetadataRequestStore,
-  getFreshMetadata,
-  loadMetadata
-} from './metadata-request-cache'
+import { clearMetadataRequestStore, createMetadataRequestStore } from './metadata-request-cache'
 import { githubRepoIdentityKey } from '../../../shared/github-repository-identity-key'
 import { githubProjectHost } from '../../../shared/github-project-identity'
-
-type MetadataState<T> = {
-  data: T
-  loading: boolean
-  error: string | null
-}
+import { useMetadataListRequest, type MetadataListState } from './useMetadataListRequest'
 
 const slugLabelStore = createMetadataRequestStore<string[]>()
 const slugAssigneeStore = createMetadataRequestStore<GitHubAssignableUser[]>()
@@ -40,86 +22,41 @@ export function useRepoLabelsBySlug(
   repo: string | null,
   settings?: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null,
   host?: string
-): MetadataState<string[]> {
-  const [state, setState] = useState<MetadataState<string[]>>({
-    data: [],
-    loading: false,
-    error: null
-  })
-  const activeKeyRef = useRef<string | null>(null)
-  // Why: parent selectors can pass a fresh settings object each render; keying
-  // the effect on the primitive env id keeps a failure's setState from re-running
-  // the effect and re-issuing the fetch in a render-paced loop (same class as
-  // the seedKey stabilization below).
+): MetadataListState<string> {
   const activeRuntimeEnvironmentId = settings?.activeRuntimeEnvironmentId ?? null
+  const target = getActiveRuntimeTarget({ activeRuntimeEnvironmentId })
+  const selectedOwner = owner ?? ''
+  const selectedRepo = repo ?? ''
+  const repositoryKey = owner && repo ? githubRepoIdentityKey({ owner, repo, host }) : null
+  const cacheKey =
+    repositoryKey && target.kind === 'environment'
+      ? `runtime:${target.environmentId}:${repositoryKey}`
+      : repositoryKey
 
-  useEffect(() => {
-    if (!owner || !repo) {
-      return
-    }
-    const target = getActiveRuntimeTarget({ activeRuntimeEnvironmentId })
-    const repositoryKey = githubRepoIdentityKey({ owner, repo, host })
-    const key =
-      target.kind === 'environment'
-        ? `runtime:${target.environmentId}:${repositoryKey}`
-        : repositoryKey
-
-    const cached = getFreshMetadata(slugLabelStore, key)
-    if (cached) {
-      if (activeKeyRef.current !== key) {
-        setState({ data: cached.data, loading: false, error: null })
-      }
-      activeKeyRef.current = key
-      return
-    }
-
-    if (activeKeyRef.current === key) {
-      return
-    }
-    activeKeyRef.current = key
-    const requestKey = key
-    setState((s) => ({
-      ...s,
-      data: s.data.length ? ([] as typeof s.data) : s.data,
-      loading: true,
-      error: null
-    }))
-    loadMetadata(slugLabelStore, key, () =>
+  return useMetadataListRequest({
+    cacheKey,
+    store: slugLabelStore,
+    errorFallback: 'Failed to load labels',
+    load: () =>
       (target.kind === 'environment'
         ? callRuntimeRpc<ListLabelsBySlugResult>(
             target,
             'github.project.listLabelsBySlug',
-            { owner, repo, host: githubProjectHost(host) },
+            { owner: selectedOwner, repo: selectedRepo, host: githubProjectHost(host) },
             { timeoutMs: 30_000 }
           )
-        : window.api.gh.listLabelsBySlug({ owner, repo, host: githubProjectHost(host) })
+        : window.api.gh.listLabelsBySlug({
+            owner: selectedOwner,
+            repo: selectedRepo,
+            host: githubProjectHost(host)
+          })
       ).then((res) => {
         if (!res.ok) {
           throw new Error(res.error.message)
         }
         return res.labels
       })
-    )
-      .then((data) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        setState({ data, loading: false, error: null })
-      })
-      .catch((err) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        activeKeyRef.current = null
-        setState((s) => ({
-          ...s,
-          loading: false,
-          error: err instanceof Error ? err.message : 'Failed to load labels'
-        }))
-      })
-  }, [owner, repo, host, activeRuntimeEnvironmentId])
-
-  return state
+  })
 }
 
 export function useRepoAssigneesBySlug(
@@ -128,61 +65,30 @@ export function useRepoAssigneesBySlug(
   seedLogins?: string[],
   settings?: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null,
   host?: string
-): MetadataState<GitHubAssignableUser[]> {
-  const [state, setState] = useState<MetadataState<GitHubAssignableUser[]>>({
-    data: [],
-    loading: false,
-    error: null
-  })
-  const activeKeyRef = useRef<string | null>(null)
-  // Why: seedLogins is a new array reference each parent render. Stabilize on
-  // the joined-string identity so the effect doesn't re-fire on every render
-  // — this is the assignee popover refetch-storm fix.
+): MetadataListState<GitHubAssignableUser> {
   const seedKey = (seedLogins ?? []).slice().sort().join(',')
-  // Why: see useRepoLabelsBySlug — primitive env id keeps failure setState from
-  // re-arming the effect through a fresh settings object identity.
   const activeRuntimeEnvironmentId = settings?.activeRuntimeEnvironmentId ?? null
+  const target = getActiveRuntimeTarget({ activeRuntimeEnvironmentId })
+  const selectedOwner = owner ?? ''
+  const selectedRepo = repo ?? ''
+  const repositoryKey = owner && repo ? githubRepoIdentityKey({ owner, repo, host }) : null
+  const cacheKey = repositoryKey
+    ? target.kind === 'environment'
+      ? `runtime:${target.environmentId}:${repositoryKey}#${seedKey}`
+      : `${repositoryKey}#${seedKey}`
+    : null
+  const args = {
+    owner: selectedOwner,
+    repo: selectedRepo,
+    host: githubProjectHost(host),
+    ...(seedKey ? { seedLogins: seedKey.split(',') } : {})
+  }
 
-  useEffect(() => {
-    if (!owner || !repo) {
-      return
-    }
-    const target = getActiveRuntimeTarget({ activeRuntimeEnvironmentId })
-    const repositoryKey = githubRepoIdentityKey({ owner, repo, host })
-    const key =
-      target.kind === 'environment'
-        ? `runtime:${target.environmentId}:${repositoryKey}#${seedKey}`
-        : `${repositoryKey}#${seedKey}`
-
-    const cached = getFreshMetadata(slugAssigneeStore, key)
-    if (cached) {
-      // Why: see useRepoLabelsBySlug — avoid cached no-op writes when only
-      // the settings object identity changed.
-      if (activeKeyRef.current !== key) {
-        setState({ data: cached.data, loading: false, error: null })
-      }
-      activeKeyRef.current = key
-      return
-    }
-
-    if (activeKeyRef.current === key) {
-      return
-    }
-    activeKeyRef.current = key
-    const requestKey = key
-    setState((s) => ({
-      ...s,
-      data: s.data.length ? ([] as typeof s.data) : s.data,
-      loading: true,
-      error: null
-    }))
-    const args = {
-      owner,
-      repo,
-      host: githubProjectHost(host),
-      ...(seedKey ? { seedLogins: seedKey.split(',') } : {})
-    }
-    loadMetadata(slugAssigneeStore, key, () =>
+  return useMetadataListRequest({
+    cacheKey,
+    store: slugAssigneeStore,
+    errorFallback: 'Failed to load assignees',
+    load: () =>
       (target.kind === 'environment'
         ? callRuntimeRpc<ListAssignableUsersBySlugResult>(
             target,
@@ -197,25 +103,5 @@ export function useRepoAssigneesBySlug(
         }
         return res.users
       })
-    )
-      .then((data) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        setState({ data, loading: false, error: null })
-      })
-      .catch((err) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        activeKeyRef.current = null
-        setState((s) => ({
-          ...s,
-          loading: false,
-          error: err instanceof Error ? err.message : 'Failed to load assignees'
-        }))
-      })
-  }, [owner, repo, host, seedKey, activeRuntimeEnvironmentId])
-
-  return state
+  })
 }
diff --git a/src/renderer/src/hooks/useIpcEvents.test.ts b/src/renderer/src/hooks/useIpcEvents.test.ts
index 9bb09bc0cb8..7210afaba8b 100644
--- a/src/renderer/src/hooks/useIpcEvents.test.ts
+++ b/src/renderer/src/hooks/useIpcEvents.test.ts
@@ -22,11 +22,21 @@ import {
   makeWorktree,
   TEST_REPO
 } from '../store/slices/store-test-helpers'
+import type {
+  AgentStatusBatchTransaction,
+  AgentStatusBatchUpdate,
+  AgentStatusUpdate
+} from '../store/slices/agent-status'
+import type { AppState } from '../store/types'
 import type { SleepingAgentLaunchConfig } from '../../../shared/agent-session-resume'
-import type { AgentStatusClearIpcPayload } from '../../../shared/agent-status-types'
-import type { TuiAgent } from '../../../shared/types'
+import type {
+  AgentStatusClearIpcPayload,
+  MigrationUnsupportedPtyEntry
+} from '../../../shared/agent-status-types'
+import type { TerminalPaneLayoutNode, TuiAgent } from '../../../shared/types'
 import type * as CmdJRowIndexJump from '@/lib/cmd-j-row-index-jump'
 import { makePaneKey } from '../../../shared/stable-pane-id'
+import { folderWorkspaceKey } from '../../../shared/workspace-scope'
 import { YOLO_TUI_AGENT_ARGS } from '../../../shared/tui-agent-permissions'
 import {
   FLOATING_WORKSPACE_GUEST_CLOSE_EVENT,
@@ -108,6 +118,45 @@ describe('getRuntimeProjectRefreshEnvironmentIds', () => {
   })
 })
 
+describe('browser navigation updates', () => {
+  it('commits CDP navigation URLs to the render-time cache before updating the store', async () => {
+    let liveUrlDuringStoreWrite: string | null = null
+    let readLiveUrl = (_browserPageId: string): string | null => null
+    const setBrowserPageUrl = vi.fn((browserPageId: string) => {
+      liveUrlDuringStoreWrite = readLiveUrl(browserPageId)
+    })
+    const updateBrowserPageState = vi.fn()
+    const storeState = createHarnessStoreState({
+      tabsByWorktree: {},
+      setBrowserPageUrl,
+      updateBrowserPageState
+    })
+    const harness = await loadIpcEventsHarness(storeState)
+    const { clearLiveBrowserUrl, getLiveBrowserUrl } =
+      await import('@/components/browser-pane/browser-runtime')
+    readLiveUrl = getLiveBrowserUrl
+    harness.useIpcEvents()
+
+    harness.navigationUpdate({
+      browserPageId: 'page-1',
+      url: 'https://kagi.com/search?token=secret&q=next',
+      title: 'Next'
+    })
+
+    expect(liveUrlDuringStoreWrite).toBe('https://kagi.com/search?q=next')
+    expect(getLiveBrowserUrl('page-1')).toBe('https://kagi.com/search?q=next')
+    expect(setBrowserPageUrl).toHaveBeenCalledWith(
+      'page-1',
+      'https://kagi.com/search?token=secret&q=next'
+    )
+    expect(updateBrowserPageState).toHaveBeenCalledWith('page-1', {
+      title: 'Next',
+      loading: false
+    })
+    clearLiveBrowserUrl('page-1')
+  })
+})
+
 function expectWorktreeRouting(worktreeId: string): unknown {
   return expect.objectContaining({ worktreeId })
 }
@@ -4932,7 +4981,8 @@ describe('useIpcEvents CLI-created worktree activation', () => {
     await new Promise((resolve) => setTimeout(resolve, 0))
 
     expect(fetchWorktrees).toHaveBeenCalledWith('repo-1', {
-      executionHostId: 'runtime:env-1'
+      executionHostId: 'runtime:env-1',
+      suppressRemoteLineageRefresh: true
     })
     expect(fetchWorktreeLineage).toHaveBeenCalledWith({
       executionHostId: 'runtime:env-1'
@@ -4960,6 +5010,7 @@ describe('useIpcEvents agent status snapshot integration', () => {
     terminalHandle?: string
     launchToken?: string
     providerSession?: { key: 'session_id'; id: string }
+    providerSessionOnly?: boolean
     orchestration?: {
       taskId?: string
       dispatchId?: string
@@ -4990,11 +5041,72 @@ describe('useIpcEvents agent status snapshot integration', () => {
     driver: { kind: 'mobile'; clientId: string }
   }) => void
 
+  function applyMockAgentStatusUpdate(state: StoreLike, update: AgentStatusBatchUpdate): boolean {
+    const statuses = state.agentStatusByPaneKey as Record<
+      string,
+      | ({ agentType?: string; state?: string; updatedAt?: number } & Record<string, unknown>)
+      | undefined
+    >
+    const existing = statuses[update.paneKey]
+    const updatedAt = update.timing?.updatedAt
+    if (
+      existing?.updatedAt !== undefined &&
+      updatedAt !== undefined &&
+      updatedAt < existing.updatedAt
+    ) {
+      return false
+    }
+    const next = { ...statuses }
+    if (update.kind === 'providerSession') {
+      delete next[update.paneKey]
+    } else {
+      next[update.paneKey] = {
+        ...existing,
+        ...update.payload,
+        updatedAt,
+        providerSession: update.metadata?.providerSession
+      }
+    }
+    state.agentStatusByPaneKey = next
+    return true
+  }
+
+  function installMockAgentStatusTransaction(state: StoreLike): void {
+    state.transactAgentStatuses = <Result>(
+      operation: (transaction: AgentStatusBatchTransaction) => Result
+    ): Result => {
+      const stagedState = {
+        ...state,
+        agentStatusByPaneKey: {
+          ...(state.agentStatusByPaneKey as Record<string, unknown>)
+        }
+      }
+      const attemptedUpdates: AgentStatusBatchUpdate[] = []
+      const effects: (() => void)[] = []
+      const result = operation({
+        getState: () => stagedState as AppState,
+        apply: (update) => {
+          attemptedUpdates.push(update)
+          return applyMockAgentStatusUpdate(stagedState, update)
+        },
+        afterCommit: (effect) => effects.push(effect)
+      })
+      const setStatuses = state.setAgentStatuses as (
+        updates: readonly AgentStatusBatchUpdate[]
+      ) => readonly boolean[]
+      setStatuses(attemptedUpdates)
+      for (const effect of effects) {
+        effect()
+      }
+      return result
+    }
+  }
+
   function buildStoreState(overrides: StoreLike): StoreLike {
     // Why: copy the defensive set of getState() fields the hook touches during
     // mount so individual tests only need to override workspaceSessionReady,
     // tabsByWorktree, and setAgentStatus.
-    return {
+    const state: StoreLike = {
       setUpdateStatus: vi.fn(),
       fetchRepos: vi.fn(),
       fetchWorktrees: vi.fn(),
@@ -5024,9 +5136,12 @@ describe('useIpcEvents agent status snapshot integration', () => {
       removeSshCredentialRequest: vi.fn(),
       clearTabPtyId: vi.fn(),
       updateTabTitle: vi.fn(),
+      updateTabTitles: vi.fn(),
       runtimePaneTitlesByTabId: {},
       terminalLayoutsByTabId: {},
       agentStatusByPaneKey: {},
+      setAgentStatuses: vi.fn(() => []),
+      recordAgentProviderSession: vi.fn(),
       clearTransientAgentStatuses: vi.fn(),
       getAgentLaunchConfigForStatusMetadata: vi.fn(() => undefined),
       recentlyClosedAgentStatusTabIds: {},
@@ -5038,6 +5153,45 @@ describe('useIpcEvents agent status snapshot integration', () => {
       settings: { terminalFontSize: 13 },
       ...overrides
     }
+    if (!('updateTabTitles' in overrides)) {
+      state.updateTabTitles = vi.fn((updates: readonly { tabId: string; title: string }[]) => {
+        const updateTitle = state.updateTabTitle as AppState['updateTabTitle']
+        for (const { tabId, title } of updates) {
+          updateTitle(tabId, title)
+        }
+      })
+    }
+    if (!('setAgentStatuses' in overrides)) {
+      state.setAgentStatuses = vi.fn((updates: readonly AgentStatusBatchUpdate[]) =>
+        updates.map((update) => {
+          if (update.kind === 'providerSession') {
+            const recordProviderSession =
+              state.recordAgentProviderSession as AppState['recordAgentProviderSession']
+            recordProviderSession(
+              update.paneKey,
+              update.agent,
+              update.providerSession,
+              update.timing,
+              update.routing,
+              update.metadata
+            )
+          } else {
+            const setStatus = state.setAgentStatus as AppState['setAgentStatus']
+            setStatus(
+              update.paneKey,
+              update.payload,
+              update.terminalTitle,
+              update.timing,
+              update.routing,
+              update.metadata
+            )
+          }
+          return true
+        })
+      )
+    }
+    installMockAgentStatusTransaction(state)
+    return state
   }
 
   function buildWindowApi(args: {
@@ -5047,6 +5201,7 @@ describe('useIpcEvents agent status snapshot integration', () => {
       cb: (data: { paneKey: string; resolution: 'adopted' | 'exited' }) => void
     ) => () => void
     getSnapshot?: () => Promise<AgentStatusSetData[]>
+    getMigrationUnsupportedSnapshot?: () => Promise<MigrationUnsupportedPtyEntry[]>
     drop?: (paneKey: string) => void
     remoteWorkspace?: Record<string, unknown>
     runtime?: Record<string, unknown>
@@ -5160,6 +5315,9 @@ describe('useIpcEvents agent status snapshot integration', () => {
           onLegacyWorkerTerminalRecovery:
             args.onLegacyWorkerTerminalRecovery ?? vi.fn(() => () => {}),
           getSnapshot: args.getSnapshot ?? vi.fn(() => Promise.resolve([])),
+          ...(args.getMigrationUnsupportedSnapshot
+            ? { getMigrationUnsupportedSnapshot: args.getMigrationUnsupportedSnapshot }
+            : {}),
           drop: args.drop ?? vi.fn()
         },
         remoteWorkspace: args.remoteWorkspace
@@ -6096,6 +6254,7 @@ describe('useIpcEvents agent status snapshot integration', () => {
       tabsByWorktree: {},
       workspaceSessionReady: false
     })
+    const setAgentStatuses = vi.mocked(storeState.setAgentStatuses as AppState['setAgentStatuses'])
 
     stubReactSyncEffect()
     vi.doMock('../store', () => ({
@@ -6161,6 +6320,8 @@ describe('useIpcEvents agent status snapshot integration', () => {
     await Promise.resolve()
 
     expect(setAgentStatus).toHaveBeenCalledTimes(1)
+    expect(setAgentStatuses).toHaveBeenCalledTimes(1)
+    expect(setAgentStatuses.mock.calls[0]?.[0]).toHaveLength(1)
     expect(setAgentStatus).toHaveBeenCalledWith(
       FUTURE_PANE_KEY,
       expect.objectContaining({ state: 'working', prompt: 'p', agentType: 'claude' }),
@@ -6171,18 +6332,582 @@ describe('useIpcEvents agent status snapshot integration', () => {
     )
   })
 
+  it('applies a large snapshot with one status and two bounded title publications', async () => {
+    const paneCount = 100
+    const snapshot: AgentStatusSetData[] = []
+    const worktrees: AppState['worktreesByRepo'][string] = []
+    const tabsByWorktree: AppState['tabsByWorktree'] = {}
+    const terminalLayoutsByTabId: AppState['terminalLayoutsByTabId'] = {}
+    for (let index = 0; index < paneCount; index += 1) {
+      const worktreeId = `wt-snapshot-${index}`
+      const tabId = `tab-snapshot-${index}`
+      const leafId = `00000000-0000-4000-8000-${String(index).padStart(12, '0')}`
+      const paneKey = makePaneKey(tabId, leafId)
+      worktrees.push(makeWorktree({ id: worktreeId, repoId: TEST_REPO.id }))
+      tabsByWorktree[worktreeId] = [
+        makeTab({ id: tabId, worktreeId, title: 'Pi', ptyId: `pty-${index}` })
+      ]
+      terminalLayoutsByTabId[tabId] = {
+        root: { type: 'leaf', leafId },
+        activeLeafId: leafId,
+        expandedLeafId: null
+      }
+      snapshot.push({
+        paneKey,
+        worktreeId,
+        state: 'waiting',
+        prompt: `remote prompt ${index}`,
+        agentType: 'pi',
+        receivedAt: 1_700_000_000_000 + index,
+        stateStartedAt: 1_700_000_000_000 + index
+      })
+    }
+    let resolveSnapshot: ((entries: AgentStatusSetData[]) => void) | undefined
+    const getSnapshot = vi.fn(
+      () =>
+        new Promise<AgentStatusSetData[]>((resolve) => {
+          resolveSnapshot = resolve
+        })
+    )
+    const store = createTestStore()
+    store.setState({
+      workspaceSessionReady: true,
+      repos: [TEST_REPO],
+      worktreesByRepo: { [TEST_REPO.id]: worktrees },
+      tabsByWorktree,
+      terminalLayoutsByTabId,
+      activeWorktreeId: worktrees[0]?.id ?? null,
+      settings: {
+        ...store.getState().settings,
+        tabAutoGenerateTitle: true,
+        terminalFontSize: 13
+      }
+    } as Partial<AppState>)
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: store.subscribe,
+        getState: store.getState,
+        setState: store.setState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        getSnapshot,
+        onSet: () => () => {}
+      })
+    )
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+    await Promise.resolve()
+    let relevantPublications = 0
+    const unsubscribe = store.subscribe((state, previousState) => {
+      if (
+        state.agentStatusByPaneKey !== previousState.agentStatusByPaneKey ||
+        state.tabsByWorktree !== previousState.tabsByWorktree
+      ) {
+        relevantPublications += 1
+      }
+    })
+    resolveSnapshot?.(snapshot)
+
+    await vi.waitFor(() => {
+      expect(Object.keys(store.getState().agentStatusByPaneKey)).toHaveLength(paneCount)
+      expect(store.getState().tabsByWorktree['wt-snapshot-99']?.[0]?.title).toBe(
+        'Pi - action required'
+      )
+      expect(store.getState().tabsByWorktree['wt-snapshot-99']?.[0]?.generatedTitle).toBeTruthy()
+    })
+
+    expect(relevantPublications).toBe(3)
+    unsubscribe()
+  })
+
+  it('indexes one 100-pane tab and its split tree once per snapshot', async () => {
+    const paneCount = 100
+    const tabId = 'tab-indexed-snapshot'
+    const worktreeId = 'wt-indexed-snapshot'
+    const leafIds = Array.from(
+      { length: paneCount },
+      (_, index) => `00000000-0000-4000-8001-${String(index).padStart(12, '0')}`
+    )
+    let leafIdLookupCount = 0
+    const leaves = leafIds.map((leafId) => {
+      const leaf = { type: 'leaf' } as TerminalPaneLayoutNode
+      Object.defineProperty(leaf, 'leafId', {
+        enumerable: true,
+        get: () => {
+          leafIdLookupCount += 1
+          return leafId
+        }
+      })
+      return leaf
+    })
+    const root = leaves
+      .slice(1)
+      .reduce<TerminalPaneLayoutNode>(
+        (tree, leaf) => ({ type: 'split', direction: 'vertical', first: tree, second: leaf }),
+        leaves[0]!
+      )
+    let tabIdLookupCount = 0
+    const tab = makeTab({ id: tabId, worktreeId, title: 'Workspace', ptyId: 'pty-indexed' })
+    Object.defineProperty(tab, 'id', {
+      enumerable: true,
+      get: () => {
+        tabIdLookupCount += 1
+        return tabId
+      }
+    })
+    const snapshot = leafIds.map(
+      (leafId, index): AgentStatusSetData => ({
+        paneKey: makePaneKey(tabId, leafId),
+        worktreeId,
+        state: 'working',
+        prompt: `indexed prompt ${index}`,
+        agentType: 'claude',
+        receivedAt: 1_700_000_000_000 + index,
+        stateStartedAt: 1_700_000_000_000 + index
+      })
+    )
+    let resolveSnapshot!: (entries: AgentStatusSetData[]) => void
+    const getSnapshot = vi.fn(
+      () =>
+        new Promise<AgentStatusSetData[]>((resolve) => {
+          resolveSnapshot = resolve
+        })
+    )
+    const store = createTestStore()
+    store.setState({
+      workspaceSessionReady: true,
+      repos: [TEST_REPO],
+      worktreesByRepo: {
+        [TEST_REPO.id]: [makeWorktree({ id: worktreeId, repoId: TEST_REPO.id })]
+      },
+      tabsByWorktree: { [worktreeId]: [tab] },
+      terminalLayoutsByTabId: {
+        [tabId]: {
+          root,
+          activeLeafId: leafIds[0]!,
+          expandedLeafId: null
+        }
+      },
+      setGeneratedTabTitlesFromAgentPrompts: vi.fn(),
+      settings: { ...store.getState().settings, terminalFontSize: 13 }
+    } as Partial<AppState>)
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: store.subscribe,
+        getState: store.getState,
+        setState: store.setState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal('window', buildWindowApi({ getSnapshot, onSet: () => () => {} }))
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+    await Promise.resolve()
+    tabIdLookupCount = 0
+    leafIdLookupCount = 0
+    resolveSnapshot(snapshot)
+
+    await vi.waitFor(() => {
+      expect(Object.keys(store.getState().agentStatusByPaneKey)).toHaveLength(paneCount)
+    })
+    expect(tabIdLookupCount).toBe(1)
+    expect(leafIdLookupCount).toBe(paneCount)
+  })
+
+  it('indexes 100 distinct tab owners once per snapshot', async () => {
+    const paneCount = 100
+    const worktreeId = 'wt-indexed-tabs'
+    const tabs: AppState['tabsByWorktree'][string] = []
+    const snapshot: AgentStatusSetData[] = []
+    const unsupportedSnapshot: MigrationUnsupportedPtyEntry[] = []
+    let tabIdLookupCount = 0
+    for (let index = 0; index < paneCount; index += 1) {
+      const tabId = `tab-indexed-${index}`
+      const leafId = `00000000-0000-4000-8003-${String(index).padStart(12, '0')}`
+      const tab = makeTab({
+        id: tabId,
+        worktreeId,
+        title: 'Workspace',
+        ptyId: `pty-indexed-${index}`
+      })
+      Object.defineProperty(tab, 'id', {
+        enumerable: true,
+        get: () => {
+          tabIdLookupCount += 1
+          return tabId
+        }
+      })
+      tabs.push(tab)
+      snapshot.push({
+        paneKey: makePaneKey(tabId, leafId),
+        worktreeId,
+        state: 'working',
+        prompt: `indexed tab prompt ${index}`,
+        agentType: 'claude',
+        receivedAt: 1_700_000_000_500 + index,
+        stateStartedAt: 1_700_000_000_500 + index
+      })
+      unsupportedSnapshot.push({
+        ptyId: `pty-indexed-${index}`,
+        worktreeId,
+        tabId,
+        leafId,
+        paneKey: makePaneKey(tabId, leafId),
+        reason: 'legacy-numeric-pane-key',
+        source: 'local',
+        updatedAt: 1_700_000_000_500 + index
+      })
+    }
+    let resolveSnapshot!: (entries: AgentStatusSetData[]) => void
+    const getSnapshot = vi.fn(
+      () =>
+        new Promise<AgentStatusSetData[]>((resolve) => {
+          resolveSnapshot = resolve
+        })
+    )
+    let resolveUnsupportedSnapshot!: (entries: MigrationUnsupportedPtyEntry[]) => void
+    const getMigrationUnsupportedSnapshot = vi.fn(
+      () =>
+        new Promise<MigrationUnsupportedPtyEntry[]>((resolve) => {
+          resolveUnsupportedSnapshot = resolve
+        })
+    )
+    const store = createTestStore()
+    store.setState({
+      workspaceSessionReady: true,
+      repos: [TEST_REPO],
+      worktreesByRepo: {
+        [TEST_REPO.id]: [makeWorktree({ id: worktreeId, repoId: TEST_REPO.id })]
+      },
+      tabsByWorktree: { [worktreeId]: tabs },
+      terminalLayoutsByTabId: {},
+      setGeneratedTabTitlesFromAgentPrompts: vi.fn(),
+      settings: {
+        ...store.getState().settings,
+        terminalFontSize: 13,
+        tabAutoGenerateTitle: false
+      }
+    } as Partial<AppState>)
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: store.subscribe,
+        getState: store.getState,
+        setState: store.setState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        getSnapshot,
+        getMigrationUnsupportedSnapshot,
+        onSet: () => () => {}
+      })
+    )
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+    await Promise.resolve()
+    tabIdLookupCount = 0
+    resolveSnapshot(snapshot)
+
+    await vi.waitFor(() => {
+      expect(Object.keys(store.getState().agentStatusByPaneKey)).toHaveLength(paneCount)
+    })
+    expect(tabIdLookupCount).toBe(paneCount)
+    expect(getMigrationUnsupportedSnapshot).toHaveBeenCalledTimes(1)
+
+    tabIdLookupCount = 0
+    resolveUnsupportedSnapshot(unsupportedSnapshot)
+    await vi.waitFor(() => {
+      expect(Object.keys(store.getState().migrationUnsupportedByPtyId)).toHaveLength(paneCount)
+    })
+    expect(tabIdLookupCount).toBe(paneCount)
+  })
+
+  it('preserves inactive, SSH, and folder routing parity in one batch', async () => {
+    type RoutingCase = {
+      tabId: string
+      leafId: string
+      ownerId: string
+      payloadWorktreeId: string
+      connectionId?: string
+      rootless?: boolean
+      expected: boolean
+    }
+    const folderId = 'folder-routing'
+    const folderKey = folderWorkspaceKey(folderId)
+    const cases: RoutingCase[] = [
+      {
+        tabId: 'tab-routing-inactive',
+        leafId: '00000000-0000-4000-8002-000000000001',
+        ownerId: 'wt-routing-local',
+        payloadWorktreeId: 'wt-routing-local',
+        rootless: true,
+        expected: true
+      },
+      {
+        tabId: 'tab-routing-ssh-match',
+        leafId: '00000000-0000-4000-8002-000000000002',
+        ownerId: 'wt-routing-ssh',
+        payloadWorktreeId: 'wt-routing-ssh',
+        connectionId: 'ssh-live',
+        expected: true
+      },
+      {
+        tabId: 'tab-routing-ssh-mismatch',
+        leafId: '00000000-0000-4000-8002-000000000003',
+        ownerId: 'wt-routing-ssh',
+        payloadWorktreeId: 'wt-routing-ssh',
+        connectionId: 'ssh-stale',
+        expected: false
+      },
+      {
+        tabId: 'tab-routing-hydrating',
+        leafId: '00000000-0000-4000-8002-000000000004',
+        ownerId: 'wt-routing-hydrating',
+        payloadWorktreeId: 'wt-routing-hydrating',
+        connectionId: 'ssh-hydrating',
+        expected: true
+      },
+      {
+        tabId: 'tab-routing-hydrating-mismatch',
+        leafId: '00000000-0000-4000-8002-000000000005',
+        ownerId: 'wt-routing-hydrating',
+        payloadWorktreeId: 'wt-routing-other',
+        connectionId: 'ssh-hydrating',
+        expected: false
+      },
+      {
+        tabId: 'tab-routing-folder',
+        leafId: '00000000-0000-4000-8002-000000000006',
+        ownerId: folderKey,
+        payloadWorktreeId: folderKey,
+        connectionId: 'ssh-folder-stale',
+        expected: true
+      }
+    ]
+    const tabsByWorktree: AppState['tabsByWorktree'] = {}
+    const terminalLayoutsByTabId: AppState['terminalLayoutsByTabId'] = {}
+    for (const entry of cases) {
+      ;(tabsByWorktree[entry.ownerId] ??= []).push(
+        makeTab({
+          id: entry.tabId,
+          worktreeId: entry.ownerId,
+          title: 'Workspace',
+          ptyId: `pty-${entry.tabId}`
+        })
+      )
+      terminalLayoutsByTabId[entry.tabId] = {
+        root: entry.rootless ? null : { type: 'leaf', leafId: entry.leafId },
+        activeLeafId: entry.rootless ? null : entry.leafId,
+        expandedLeafId: null
+      }
+    }
+    const snapshot = cases.map(
+      (entry, index): AgentStatusSetData => ({
+        paneKey: makePaneKey(entry.tabId, entry.leafId),
+        worktreeId: entry.payloadWorktreeId,
+        ...(entry.connectionId ? { connectionId: entry.connectionId } : {}),
+        state: 'working',
+        prompt: `routing case ${index}`,
+        agentType: 'claude',
+        receivedAt: 1_700_000_001_000 + index,
+        stateStartedAt: 1_700_000_001_000 + index
+      })
+    )
+    const localRepo = { ...TEST_REPO, id: 'repo-routing-local', connectionId: null }
+    const sshRepo = { ...TEST_REPO, id: 'repo-routing-ssh', connectionId: 'ssh-live' }
+    const store = createTestStore()
+    store.setState({
+      workspaceSessionReady: true,
+      repos: [localRepo, sshRepo],
+      worktreesByRepo: {
+        [localRepo.id]: [makeWorktree({ id: 'wt-routing-local', repoId: localRepo.id })],
+        [sshRepo.id]: [makeWorktree({ id: 'wt-routing-ssh', repoId: sshRepo.id })]
+      },
+      folderWorkspaces: [
+        {
+          id: folderId,
+          projectGroupId: 'group-routing',
+          name: 'Folder routing',
+          folderPath: '/folder-routing',
+          connectionId: 'ssh-folder-live',
+          linkedTask: null,
+          comment: '',
+          isArchived: false,
+          isUnread: false,
+          isPinned: false,
+          sortOrder: 0,
+          lastActivityAt: 0,
+          createdAt: 0,
+          updatedAt: 0
+        }
+      ],
+      tabsByWorktree,
+      terminalLayoutsByTabId,
+      activeWorktreeId: null,
+      settings: { ...store.getState().settings, terminalFontSize: 13 }
+    } as Partial<AppState>)
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: store.subscribe,
+        getState: store.getState,
+        setState: store.setState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({ getSnapshot: vi.fn().mockResolvedValue(snapshot), onSet: () => () => {} })
+    )
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+
+    await vi.waitFor(() => {
+      expect(
+        cases
+          .filter((entry) => entry.expected)
+          .every(
+            (entry) => store.getState().agentStatusByPaneKey[makePaneKey(entry.tabId, entry.leafId)]
+          )
+      ).toBe(true)
+    })
+    for (const entry of cases) {
+      expect(
+        store.getState().agentStatusByPaneKey[makePaneKey(entry.tabId, entry.leafId)] !== undefined
+      ).toBe(entry.expected)
+    }
+  })
+
+  it('projects ordered tab titles across panes in an inactive split snapshot', async () => {
+    const tabId = 'tab-inactive-split'
+    const worktreeId = 'wt-inactive-split'
+    const waitingPaneKey = makePaneKey(tabId, '00000000-0000-4000-8000-000000000001')
+    const donePaneKey = makePaneKey(tabId, '00000000-0000-4000-8000-000000000002')
+    const getSnapshot = vi.fn().mockResolvedValue([
+      {
+        paneKey: waitingPaneKey,
+        worktreeId,
+        state: 'waiting',
+        prompt: 'waiting turn',
+        agentType: 'pi',
+        receivedAt: 1_700_000_000_000,
+        stateStartedAt: 1_700_000_000_000
+      },
+      {
+        paneKey: donePaneKey,
+        worktreeId,
+        state: 'done',
+        prompt: 'completed turn',
+        agentType: 'pi',
+        receivedAt: 1_700_000_000_001,
+        stateStartedAt: 1_700_000_000_001
+      }
+    ] satisfies AgentStatusSetData[])
+    const store = createTestStore()
+    store.setState({
+      workspaceSessionReady: true,
+      repos: [TEST_REPO],
+      worktreesByRepo: {
+        [TEST_REPO.id]: [makeWorktree({ id: worktreeId, repoId: TEST_REPO.id })]
+      },
+      tabsByWorktree: {
+        [worktreeId]: [makeTab({ id: tabId, worktreeId, title: 'My Project' })]
+      },
+      terminalLayoutsByTabId: {
+        [tabId]: {
+          root: null,
+          activeLeafId: null,
+          expandedLeafId: null,
+          ptyIdsByLeafId: {}
+        }
+      },
+      activeWorktreeId: null,
+      settings: { ...store.getState().settings, terminalFontSize: 13 }
+    } as Partial<AppState>)
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: store.subscribe,
+        getState: store.getState,
+        setState: store.setState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        getSnapshot,
+        onSet: () => () => {}
+      })
+    )
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+
+    await vi.waitFor(() => {
+      expect(store.getState().agentStatusByPaneKey[waitingPaneKey]?.state).toBe('waiting')
+      expect(store.getState().agentStatusByPaneKey[donePaneKey]?.state).toBe('done')
+      expect(store.getState().tabsByWorktree[worktreeId]?.[0]?.title).toBe('Pi ready')
+    })
+  })
+
   it('applies a burst leading-edge first, then coalesces the rest into one deferred batch', async () => {
     // Why: each live status event is its own IPC task, so N events used to pay
     // N full render passes (STA-3328 mechanism 2). The leading event must stay
     // synchronous (zero added latency); followers within the burst window must
     // apply together on one later task, in arrival order.
     vi.useFakeTimers()
-    const setAgentStatus = vi.fn()
+    let storeState: StoreLike
+    let publicationCount = 0
+    const applyStatus = (paneKey: string, payload: unknown): void => {
+      storeState.agentStatusByPaneKey = {
+        ...(storeState.agentStatusByPaneKey as Record<string, unknown>),
+        [paneKey]: payload
+      }
+    }
+    const setAgentStatus = vi.fn((paneKey: string, payload: unknown) => {
+      applyStatus(paneKey, payload)
+      publicationCount += 1
+    })
+    const setAgentStatuses = vi.fn((updates: readonly AgentStatusBatchUpdate[]) => {
+      for (const update of updates) {
+        if (update.kind === 'providerSession') {
+          const next = { ...(storeState.agentStatusByPaneKey as Record<string, unknown>) }
+          delete next[update.paneKey]
+          storeState.agentStatusByPaneKey = next
+        } else {
+          applyStatus(update.paneKey, update.payload)
+        }
+      }
+      publicationCount += 1
+      return updates.map(() => true)
+    })
+    const recordAgentProviderSession = vi.fn()
     const onSetListenerRef: { current: ((data: AgentStatusSetData) => void) | null } = {
       current: null
     }
-    const storeState: StoreLike = buildStoreState({
+    storeState = buildStoreState({
       setAgentStatus,
+      setAgentStatuses,
+      recordAgentProviderSession,
       workspaceSessionReady: true,
       tabsByWorktree: {
         'wt-1': [{ id: 'tab-future', ptyId: 'pty-1', worktreeId: 'wt-1', title: 'Future Tab' }]
@@ -6195,7 +6920,6 @@ describe('useIpcEvents agent status snapshot integration', () => {
         }
       }
     })
-
     stubReactSyncEffect()
     vi.doMock('../store', () => ({
       useAppStore: {
@@ -6233,15 +6957,275 @@ describe('useIpcEvents agent status snapshot integration', () => {
 
       emit(1_700_000_000_000, 'first')
       expect(setAgentStatus).toHaveBeenCalledTimes(1)
+      expect(publicationCount).toBe(1)
 
       emit(1_700_000_000_001, 'second')
       emit(1_700_000_000_002, 'third')
+      onSetListenerRef.current({
+        paneKey: FUTURE_PANE_KEY,
+        state: 'working',
+        prompt: 'provider identity',
+        agentType: 'pi',
+        providerSession: { key: 'session_id', id: 'pi-session' },
+        providerSessionOnly: true,
+        receivedAt: 1_700_000_000_003,
+        stateStartedAt: 1_700_000_000_003
+      })
       expect(setAgentStatus).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses).not.toHaveBeenCalled()
 
       vi.advanceTimersByTime(40)
-      expect(setAgentStatus).toHaveBeenCalledTimes(3)
-      expect(setAgentStatus.mock.calls[1][1]).toEqual(expect.objectContaining({ prompt: 'second' }))
-      expect(setAgentStatus.mock.calls[2][1]).toEqual(expect.objectContaining({ prompt: 'third' }))
+      expect(setAgentStatus).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses.mock.calls[0][0]).toEqual([
+        expect.objectContaining({
+          paneKey: FUTURE_PANE_KEY,
+          payload: expect.objectContaining({ prompt: 'second' })
+        }),
+        expect.objectContaining({
+          paneKey: FUTURE_PANE_KEY,
+          payload: expect.objectContaining({ prompt: 'third' })
+        }),
+        expect.objectContaining({
+          kind: 'providerSession',
+          paneKey: FUTURE_PANE_KEY,
+          agent: 'pi',
+          providerSession: { key: 'session_id', id: 'pi-session' }
+        })
+      ])
+      expect(recordAgentProviderSession).not.toHaveBeenCalled()
+      expect(publicationCount).toBe(2)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('keeps a live event enqueued by a synchronous batch subscriber for the next flush', async () => {
+    vi.useFakeTimers()
+    const setAgentStatus = vi.fn()
+    const onSetListenerRef: { current: ((data: AgentStatusSetData) => void) | null } = {
+      current: null
+    }
+    let reentered = false
+    const setAgentStatuses = vi.fn((updates: readonly AgentStatusUpdate[]) => {
+      if (!reentered) {
+        reentered = true
+        onSetListenerRef.current?.({
+          paneKey: FUTURE_PANE_KEY,
+          state: 'working',
+          prompt: 'reentered',
+          agentType: 'claude',
+          receivedAt: 1_700_000_000_002,
+          stateStartedAt: 1_700_000_000_002
+        })
+      }
+      return updates.map(() => true)
+    })
+    const storeState = buildStoreState({
+      setAgentStatus,
+      setAgentStatuses,
+      workspaceSessionReady: true,
+      tabsByWorktree: {
+        'wt-1': [{ id: 'tab-future', ptyId: 'pty-1', worktreeId: 'wt-1', title: 'Future Tab' }]
+      },
+      terminalLayoutsByTabId: {
+        'tab-future': {
+          root: { type: 'leaf', leafId: FUTURE_LEAF_ID },
+          activeLeafId: FUTURE_LEAF_ID,
+          expandedLeafId: null
+        }
+      }
+    })
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: vi.fn(() => () => {}),
+        getState: () => storeState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        onSet: (callback) => {
+          onSetListenerRef.current = callback
+          return () => {}
+        }
+      })
+    )
+
+    try {
+      const { useIpcEvents } = await import('./useIpcEvents')
+      useIpcEvents()
+      if (!onSetListenerRef.current) {
+        throw new Error('Expected agentStatus.onSet listener to be registered')
+      }
+
+      onSetListenerRef.current({
+        paneKey: FUTURE_PANE_KEY,
+        state: 'working',
+        prompt: 'leading',
+        agentType: 'claude',
+        receivedAt: 1_700_000_000_000,
+        stateStartedAt: 1_700_000_000_000
+      })
+      onSetListenerRef.current({
+        paneKey: FUTURE_PANE_KEY,
+        state: 'working',
+        prompt: 'queued',
+        agentType: 'claude',
+        receivedAt: 1_700_000_000_001,
+        stateStartedAt: 1_700_000_000_001
+      })
+
+      vi.advanceTimersByTime(40)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses.mock.calls[0][0][0].payload.prompt).toBe('queued')
+
+      vi.advanceTimersByTime(40)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(2)
+      expect(setAgentStatuses.mock.calls[1][0][0].payload.prompt).toBe('reentered')
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('projects synthetic pane titles across ordered same-pane batch updates', async () => {
+    vi.useFakeTimers()
+    let storeState: StoreLike
+    const applyStatusUpdate = (update: AgentStatusUpdate): void => {
+      storeState.agentStatusByPaneKey = {
+        ...(storeState.agentStatusByPaneKey as Record<string, unknown>),
+        [update.paneKey]: {
+          ...update.payload,
+          updatedAt: update.timing?.updatedAt,
+          providerSession: update.metadata?.providerSession
+        }
+      }
+    }
+    const setAgentStatus = vi.fn(
+      (
+        paneKey: string,
+        payload: AgentStatusUpdate['payload'],
+        terminalTitle?: string,
+        timing?: AgentStatusUpdate['timing'],
+        routing?: AgentStatusUpdate['routing'],
+        metadata?: AgentStatusUpdate['metadata']
+      ) => applyStatusUpdate({ paneKey, payload, terminalTitle, timing, routing, metadata })
+    )
+    const setAgentStatuses = vi.fn((updates: readonly AgentStatusUpdate[]) => {
+      return updates.map((update) => {
+        const existing = (
+          storeState.agentStatusByPaneKey as Record<string, { updatedAt?: number } | undefined>
+        )[update.paneKey]
+        if (
+          existing?.updatedAt !== undefined &&
+          update.timing?.updatedAt !== undefined &&
+          update.timing.updatedAt < existing.updatedAt
+        ) {
+          return false
+        }
+        applyStatusUpdate(update)
+        return true
+      })
+    })
+    const updateTabTitle = vi.fn()
+    const observeAgentHookCompletionForNotification = vi.fn()
+    const onSetListenerRef: { current: ((data: AgentStatusSetData) => void) | null } = {
+      current: null
+    }
+    storeState = buildStoreState({
+      setAgentStatus,
+      setAgentStatuses,
+      updateTabTitle,
+      workspaceSessionReady: true,
+      tabsByWorktree: {
+        'wt-1': [{ id: 'tab-future', ptyId: 'pty-1', worktreeId: 'wt-1', title: 'Codex' }]
+      },
+      terminalLayoutsByTabId: {
+        'tab-future': {
+          root: { type: 'leaf', leafId: FUTURE_LEAF_ID },
+          activeLeafId: FUTURE_LEAF_ID,
+          expandedLeafId: null
+        }
+      }
+    })
+    const updateTabTitles = vi.mocked(storeState.updateTabTitles as AppState['updateTabTitles'])
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: vi.fn(() => () => {}),
+        getState: () => storeState
+      }
+    }))
+    vi.doMock('./agent-hook-completion-notifications', () => ({
+      observeAgentHookCompletionForNotification,
+      resetAgentHookCompletionNotificationCoordinators: vi.fn(),
+      syncAgentHookCompletionNotificationsForStoreUpdate: vi.fn()
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        onSet: (callback) => {
+          onSetListenerRef.current = callback
+          return () => {}
+        }
+      })
+    )
+
+    try {
+      const { useIpcEvents } = await import('./useIpcEvents')
+      useIpcEvents()
+      const onSet = onSetListenerRef.current
+      if (!onSet) {
+        throw new Error('Expected agentStatus.onSet listener to be registered')
+      }
+      const emit = (
+        receivedAt: number,
+        state: AgentStatusSetData['state'],
+        agentType?: string
+      ): void => {
+        onSet({
+          paneKey: FUTURE_PANE_KEY,
+          state,
+          prompt: state,
+          agentType,
+          receivedAt,
+          stateStartedAt: receivedAt
+        })
+      }
+
+      emit(1_700_000_000_000, 'working', 'pi')
+      emit(1_700_000_000_001, 'waiting', 'pi')
+      emit(1_700_000_000_002, 'waiting', 'pi')
+      emit(1_700_000_000_003, 'done', 'pi')
+      emit(1_700_000_000_002, 'waiting', 'pi')
+      vi.advanceTimersByTime(40)
+
+      expect(setAgentStatus).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses.mock.calls[0][0]).toEqual([
+        expect.objectContaining({
+          payload: expect.objectContaining({ agentType: 'pi', state: 'waiting' }),
+          terminalTitle: 'Pi - action required'
+        }),
+        expect.objectContaining({
+          payload: expect.objectContaining({ agentType: 'pi', state: 'waiting' }),
+          terminalTitle: 'Pi - action required'
+        }),
+        expect.objectContaining({
+          payload: expect.objectContaining({ agentType: 'pi', state: 'done' }),
+          terminalTitle: 'Pi ready'
+        })
+      ])
+      expect(setAgentStatuses.mock.results[0].value).toEqual([true, true, true])
+      expect(updateTabTitle).toHaveBeenCalledOnce()
+      expect(updateTabTitle).toHaveBeenCalledWith('tab-future', 'Pi ready')
+      expect(updateTabTitles).toHaveBeenCalledTimes(1)
+      expect(observeAgentHookCompletionForNotification).toHaveBeenCalledTimes(4)
     } finally {
       vi.useRealTimers()
     }
@@ -6250,19 +7234,32 @@ describe('useIpcEvents agent status snapshot integration', () => {
   it('preserves queued set-clear order for working removal and done retention', async () => {
     vi.useFakeTimers()
     let storeState: StoreLike
+    const applyStatusUpdate = (
+      paneKey: string,
+      payload: { state: string },
+      timing: { updatedAt?: number } | undefined
+    ): void => {
+      storeState.agentStatusByPaneKey = {
+        ...(storeState.agentStatusByPaneKey as Record<string, unknown>),
+        [paneKey]: { ...payload, updatedAt: timing?.updatedAt }
+      }
+    }
     const setAgentStatus = vi.fn(
       (
         paneKey: string,
         payload: { state: string },
         _title: unknown,
-        timing: { updatedAt: number }
+        timing: { updatedAt?: number } | undefined
       ) => {
-        storeState.agentStatusByPaneKey = {
-          ...(storeState.agentStatusByPaneKey as Record<string, unknown>),
-          [paneKey]: { ...payload, updatedAt: timing.updatedAt }
-        }
+        applyStatusUpdate(paneKey, payload, timing)
       }
     )
+    const setAgentStatuses = vi.fn((updates: readonly AgentStatusUpdate[]) => {
+      for (const update of updates) {
+        applyStatusUpdate(update.paneKey, update.payload, update.timing)
+      }
+      return updates.map(() => true)
+    })
     const removeAgentStatus = vi.fn((paneKey: string) => {
       const next = { ...(storeState.agentStatusByPaneKey as Record<string, unknown>) }
       delete next[paneKey]
@@ -6276,6 +7273,7 @@ describe('useIpcEvents agent status snapshot integration', () => {
     }
     storeState = buildStoreState({
       setAgentStatus,
+      setAgentStatuses,
       removeAgentStatus,
       workspaceSessionReady: true,
       tabsByWorktree: {
@@ -6345,23 +7343,28 @@ describe('useIpcEvents agent status snapshot integration', () => {
       expect(storeState.agentStatusByPaneKey).toEqual({})
 
       vi.advanceTimersByTime(40)
-      expect(setAgentStatus).toHaveBeenCalledTimes(2)
+      expect(setAgentStatus).toHaveBeenCalledTimes(1)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(1)
       expect(storeState.agentStatusByPaneKey).toEqual({})
 
       emit(1_700_000_000_002, 'task')
       emit(1_700_000_000_003, 'task', 'done')
-      expect(setAgentStatus).toHaveBeenCalledTimes(3)
+      expect(setAgentStatus).toHaveBeenCalledTimes(2)
 
       onClearListenerRef.current({ paneKey: FUTURE_PANE_KEY })
 
-      expect(setAgentStatus).toHaveBeenCalledTimes(4)
-      expect(setAgentStatus.mock.calls[3][1]).toEqual(expect.objectContaining({ state: 'done' }))
+      expect(setAgentStatus).toHaveBeenCalledTimes(2)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(2)
+      expect(setAgentStatuses.mock.calls[1][0][0]).toEqual(
+        expect.objectContaining({ payload: expect.objectContaining({ state: 'done' }) })
+      )
       expect(removeAgentStatus).toHaveBeenCalledTimes(1)
       expect(storeState.agentStatusByPaneKey).toEqual({
         [FUTURE_PANE_KEY]: expect.objectContaining({ state: 'done' })
       })
       vi.advanceTimersByTime(40)
-      expect(setAgentStatus).toHaveBeenCalledTimes(4)
+      expect(setAgentStatus).toHaveBeenCalledTimes(2)
+      expect(setAgentStatuses).toHaveBeenCalledTimes(2)
     } finally {
       vi.useRealTimers()
     }
@@ -6465,6 +7468,93 @@ describe('useIpcEvents agent status snapshot integration', () => {
     expect(setAgentStatusCalls).toBe(1)
   })
 
+  // Why: the pending queue is spliced before the fold, so a throwing fold would drop every
+  // buffered event permanently. Before batching the queue was only replaced after the loop,
+  // so a throw left it intact — keep that.
+  it('keeps pending statuses queued when the retry fold throws', async () => {
+    const subscribeListenerRef: { current: StoreSubscribeListener | null } = { current: null }
+    const onSetListenerRef: { current: ((data: AgentStatusSetData) => void) | null } = {
+      current: null
+    }
+    let shouldThrow = true
+    const setAgentStatuses = vi.fn((updates: readonly AgentStatusUpdate[]) => {
+      if (shouldThrow) {
+        shouldThrow = false
+        throw new Error('fold blew up')
+      }
+      return updates.map(() => true)
+    })
+    const storeState: StoreLike = buildStoreState({
+      setAgentStatus: vi.fn(),
+      setAgentStatuses,
+      workspaceSessionReady: true,
+      settings: { terminalFontSize: 13, notifications: { enabled: false } },
+      // Pane does not exist yet -> the incoming event is buffered as pending.
+      tabsByWorktree: {},
+      terminalLayoutsByTabId: {}
+    })
+    const notify = (): void => subscribeListenerRef.current?.(storeState, storeState)
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: vi.fn((listener: StoreSubscribeListener) => {
+          subscribeListenerRef.current = listener
+          return () => {
+            subscribeListenerRef.current = null
+          }
+        }),
+        getState: () => storeState
+      }
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        onSet: (cb) => {
+          onSetListenerRef.current = cb
+          return () => {}
+        }
+      })
+    )
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+    await Promise.resolve()
+    if (typeof onSetListenerRef.current !== 'function') {
+      throw new Error('Expected agentStatus.onSet listener to be registered')
+    }
+
+    onSetListenerRef.current({
+      paneKey: FUTURE_PANE_KEY,
+      state: 'working',
+      prompt: 'buffered',
+      agentType: 'claude',
+      receivedAt: 1_700_000_000_100,
+      stateStartedAt: 1_700_000_000_100
+    })
+
+    // Tab hydrates, so the next store update flushes the pending event — and throws.
+    storeState.tabsByWorktree = {
+      'wt-1': [{ id: 'tab-future', ptyId: 'pty-1', worktreeId: 'wt-1', title: 'Future Tab' }]
+    }
+    storeState.terminalLayoutsByTabId = {
+      'tab-future': {
+        root: { type: 'leaf', leafId: FUTURE_LEAF_ID },
+        activeLeafId: FUTURE_LEAF_ID,
+        expandedLeafId: null
+      }
+    }
+    expect(() => notify()).toThrow('fold blew up')
+
+    // The event must still be queued, so the next flush replays it.
+    notify()
+    const replayedAfterThrow = setAgentStatuses.mock.calls
+      .slice(1)
+      .flatMap((call) => call[0].map((update) => update.payload.prompt))
+    expect(replayedAfterThrow).toContain('buffered')
+  })
+
   it('applies ready push events for an unmounted inactive terminal tab', async () => {
     const setAgentStatus = vi.fn()
     const onSetListenerRef: { current: ((data: AgentStatusSetData) => void) | null } = {
@@ -7688,6 +8778,9 @@ describe('useIpcEvents agent status snapshot integration', () => {
         }
       }
     })
+    const setAgentStatusBatch = vi.mocked(
+      storeState.setAgentStatuses as AppState['setAgentStatuses']
+    )
 
     stubReactSyncEffect()
     vi.doMock('../store', () => ({
@@ -7759,6 +8852,8 @@ describe('useIpcEvents agent status snapshot integration', () => {
     subscribeListenerRef.current(storeState, previousStoreState)
 
     expect(setAgentStatus).toHaveBeenCalledTimes(2)
+    expect(setAgentStatusBatch).toHaveBeenCalledTimes(1)
+    expect(setAgentStatusBatch.mock.calls[0]?.[0]).toHaveLength(2)
     expect(setAgentStatus).toHaveBeenNthCalledWith(
       1,
       FUTURE_PANE_KEY,
@@ -9080,6 +10175,113 @@ describe('useIpcEvents agent status snapshot integration', () => {
   })
 })
 
+describe('runtime host catalog refresh on reposChanged', () => {
+  // Why: the host emits one reposChanged for project-group and folder-workspace edits
+  // too, so a repos-only refresh leaves those catalogs stale on every paired client.
+  it('refetches the runtime host project group and folder workspace catalogs', async () => {
+    vi.resetModules()
+    vi.useFakeTimers()
+    try {
+      const calls: string[] = []
+      const fetchRuntimeEnvironmentRepos = vi.fn(() => {
+        calls.push('repos')
+        return Promise.resolve([])
+      })
+      const fetchProjectGroups = vi.fn(() => {
+        calls.push('project-groups')
+        return Promise.resolve()
+      })
+      const fetchFolderWorkspaces = vi.fn(() => {
+        calls.push('folder-workspaces')
+        return Promise.resolve()
+      })
+      const state = {
+        settings: { activeRuntimeEnvironmentId: 'env-1' as string | null },
+        repos: [],
+        worktreesByRepo: {},
+        folderWorkspaces: [],
+        projectGroups: [],
+        runtimeEnvironments: [],
+        runtimeStatusByEnvironmentId: new Map(),
+        tabsByWorktree: {},
+        ptyIdsByTabId: {},
+        remountTerminalTabForRecovery: vi.fn(),
+        markEnvironmentSshStateStale: vi.fn(),
+        fetchRepos: vi.fn(() => Promise.resolve()),
+        fetchRuntimeEnvironmentRepos,
+        fetchProjectGroups,
+        fetchFolderWorkspaces,
+        fetchWorktrees: vi.fn(() => Promise.resolve()),
+        fetchWorktreeLineage: vi.fn(() => Promise.resolve())
+      }
+
+      vi.doMock('react', async () => {
+        const actual = await vi.importActual<typeof ReactModule>('react')
+        return { ...actual, useEffect: (effect: () => void | (() => void)) => void effect() }
+      })
+      vi.doMock('../store', () => ({
+        useAppStore: { subscribe: vi.fn(() => () => {}), getState: () => state }
+      }))
+      const noopListener = (): (() => void) => () => {}
+      const autoStubNamespace = new Proxy(
+        {},
+        {
+          get:
+            () =>
+            (...args: unknown[]) => {
+              if (typeof args[0] === 'function') {
+                return noopListener()
+              }
+              return new Promise(() => {})
+            }
+        }
+      )
+      let runtimeOnResponse: ((response: unknown) => void) | undefined
+      const api = new Proxy(
+        {
+          runtimeEnvironments: {
+            subscribe: async (_args: unknown, callbacks: { onResponse: (r: unknown) => void }) => {
+              runtimeOnResponse = callbacks.onResponse
+              return { unsubscribe: vi.fn(), sendBinary: vi.fn() }
+            }
+          }
+        } as Record<string, unknown>,
+        { get: (target, prop: string) => target[prop] ?? autoStubNamespace }
+      )
+      vi.stubGlobal('window', { api })
+
+      const { useIpcEvents } = await import('./useIpcEvents')
+      useIpcEvents()
+      // Seeded discovery for the connected runtime; drains the scheduler's debounce.
+      await vi.advanceTimersByTimeAsync(300)
+
+      const runtimeOwner = { runtimeEnvironmentId: 'env-1' }
+      expect(fetchProjectGroups).toHaveBeenCalledWith(runtimeOwner)
+      expect(fetchFolderWorkspaces).toHaveBeenCalledWith(runtimeOwner)
+      // Folder workspaces resolve their owning group from projectGroups, so groups must land first.
+      expect(calls).toEqual(['repos', 'project-groups', 'folder-workspaces'])
+
+      calls.length = 0
+      fetchProjectGroups.mockClear()
+      fetchFolderWorkspaces.mockClear()
+      if (!runtimeOnResponse) {
+        throw new Error('Expected runtime client event callbacks')
+      }
+      // Past the scheduler's min interval so the event schedules on the debounce alone.
+      await vi.advanceTimersByTimeAsync(5_000)
+      runtimeOnResponse({ ok: true, result: { type: 'reposChanged' } })
+      await vi.advanceTimersByTimeAsync(300)
+
+      expect(fetchProjectGroups).toHaveBeenCalledWith(runtimeOwner)
+      expect(fetchFolderWorkspaces).toHaveBeenCalledWith(runtimeOwner)
+      expect(calls).toEqual(['repos', 'project-groups', 'folder-workspaces'])
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
+
+
 describe('repo catalog refresh on repos:changed', () => {
   it('skips remote catalog RPCs when refreshing local rows under a runtime', async () => {
     vi.resetModules()
diff --git a/src/renderer/src/hooks/useIpcEvents.ts b/src/renderer/src/hooks/useIpcEvents.ts
index 9a44c511ba4..85fd5757722 100644
--- a/src/renderer/src/hooks/useIpcEvents.ts
+++ b/src/renderer/src/hooks/useIpcEvents.ts
@@ -86,6 +86,7 @@ import {
   setDriverForBrowserPage
 } from '@/lib/pane-manager/browser-mobile-driver-state'
 import { destroyPersistentWebview } from '@/components/browser-pane/webview-registry'
+import { rememberLiveBrowserUrl } from '@/components/browser-pane/browser-runtime'
 import {
   acquireBrowserAutomationVisibility,
   releaseBrowserAutomationVisibility
@@ -100,11 +101,12 @@ import { dispatchTerminalSideEffectBatch } from '@/components/terminal-pane/term
 import { subscribeToUnpairedDeviceAuthNotification } from './unpaired-device-auth-notification'
 import {
   applyRuntimeEnvironmentSshStateChanged,
-  hydrateRuntimeEnvironmentSshState
+  hydrateRuntimeEnvironmentSshState,
+  refreshRuntimeEnvironmentSshTargetMetadata
 } from '@/runtime/runtime-environment-ssh-state'
 import {
   createRuntimeProjectRefreshScheduler,
-  refreshRuntimeProjectWorktrees
+  refreshRuntimeProjectWorktreesAndLineage
 } from './runtime-project-refresh-scheduler'
 import { createRuntimeClientEventsSync } from './runtime-client-events-sync'
 import { detectLanguage } from '@/lib/language-detect'
@@ -126,7 +128,6 @@ import type { AppState } from '../store/types'
 import { guardPinnedTabClose, resolvePinnedTabLabel } from '../store/pinned-tab-close-guard'
 import {
   closeWebRuntimeSessionTab,
-  createWebRuntimeSessionBrowserTab,
   createWebRuntimeSessionTerminal,
   isWebRuntimeSessionActive
 } from '@/runtime/web-runtime-session'
@@ -152,10 +153,17 @@ import { shouldSuppressCodexAutoApprovalStatus } from '@/components/terminal-pan
 import { showTerminalShortcutCaptureNotification } from '@/lib/terminal-shortcut-capture-notification'
 import { resolveAgentStatusTerminalTitle } from '@/lib/agent-status-terminal-title'
 import { titleHasAgentName } from '../../../shared/agent-detection'
+import { isDecorativeAgentTitleFrameChange } from '../../../shared/agent-decorative-title-signature'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { resolveTerminalWorktreeRoute } from '@/lib/terminal-worktree-route'
 import { resolveAgentPaneAuthorityKey } from '@/store/slices/agent-pane-authority'
+import type {
+  AgentStatusBatchTransaction,
+  AgentStatusBatchUpdate,
+  AgentStatusUpdate
+} from '@/store/slices/agent-status'
 import { translate } from '@/i18n/i18n'
+import { redactKagiSessionToken } from '../../../shared/browser-url'
 import { closeTerminalTab } from '@/components/terminal/terminal-tab-actions'
 import { initialAgentTabViewModeProps } from '@/lib/native-chat-initial-view-mode'
 import { getConnectionIdFromState } from '@/lib/connection-context'
@@ -759,6 +767,27 @@ export function useIpcEvents(): void {
       replay: boolean
     }
     type AgentStatusApplyResult = 'applied' | 'pending' | 'dropped'
+    type ProjectedAgentTabTitles = {
+      title: string | undefined
+      identityTitle: string | undefined
+    }
+    type AgentStatusBatchContext = {
+      transaction: AgentStatusBatchTransaction
+      routingIndex: AgentStatusPaneRoutingIndex
+      projectedTitlesByTabId: Map<string, ProjectedAgentTabTitles>
+      tabTitlesByTabId: Map<string, string>
+      notificationEffects: (() => void)[]
+    }
+    type AgentStatusBatchEvent = {
+      data: AgentStatusIpcPayload
+      replay?: boolean
+      retry?: boolean
+    }
+    type AgentStatusApplyOptions = {
+      replay?: boolean
+      retry?: boolean
+      batch?: AgentStatusBatchContext
+    }
     const pendingAgentStatusEvents: PendingAgentStatusEvent[] = []
     const transientClearWatermarkByConnectionId = new Map<string, number>()
     let agentStatusEffectDisposed = false
@@ -798,7 +827,10 @@ export function useIpcEvents(): void {
         options?.forceLocalOwner
           ? { forceLocalOwner: true }
           : options?.executionHostId
-            ? { executionHostId: options.executionHostId }
+            ? {
+                executionHostId: options.executionHostId,
+                suppressRemoteLineageRefresh: true
+              }
             : undefined
       )
       await useAppStore
@@ -902,15 +934,20 @@ export function useIpcEvents(): void {
 
     const runtimeProjectRefreshScheduler = createRuntimeProjectRefreshScheduler({
       refresh: async (environmentId) => {
-        // Why: refresh the env's SSH bucket on (re)connect so a pre-drop snapshot can't keep a reconnect overlay stale.
-        void hydrateRuntimeEnvironmentSshState(environmentId, { force: true }).catch(() => {})
+        // Why: project events can reveal target CRUD, but known target states already arrive by push.
+        void refreshRuntimeEnvironmentSshTargetMetadata(environmentId).catch(() => {})
         const repos = await useAppStore.getState().fetchRuntimeEnvironmentRepos(environmentId)
-        await refreshRuntimeProjectWorktrees(environmentId, repos, (repoId, options) =>
-          useAppStore.getState().fetchWorktrees(repoId, options)
+        // Why: the host emits one reposChanged for group/folder-workspace edits too, so those
+        // catalogs go stale without this; groups first because folder workspaces resolve owners from them.
+        const runtimeOwner = { runtimeEnvironmentId: environmentId }
+        await useAppStore.getState().fetchProjectGroups(runtimeOwner)
+        await useAppStore.getState().fetchFolderWorkspaces(runtimeOwner)
+        await refreshRuntimeProjectWorktreesAndLineage(
+          environmentId,
+          repos,
+          (repoId, options) => useAppStore.getState().fetchWorktrees(repoId, options),
+          (options) => useAppStore.getState().fetchWorktreeLineage(options)
         )
-        await useAppStore.getState().fetchWorktreeLineage({
-          executionHostId: toRuntimeExecutionHostId(environmentId)
-        })
       },
       onError: (error) => {
         console.error('Failed to refresh runtime projects:', error)
@@ -2087,6 +2124,7 @@ export function useIpcEvents(): void {
           return
         }
         const store = useAppStore.getState()
+        rememberLiveBrowserUrl(browserPageId, redactKagiSessionToken(url))
         store.setBrowserPageUrl(browserPageId, url)
         store.updateBrowserPageState(browserPageId, { title, loading: false })
       })
@@ -2141,35 +2179,23 @@ export function useIpcEvents(): void {
       window.api.ui.onNewBrowserTab(() => {
         const store = useAppStore.getState()
         if (isFloatingWorkspacePanelFocused()) {
-          void createFloatingWorkspaceBrowserTab(store)
+          void createFloatingWorkspaceBrowserTab(store).catch((error) => {
+            toast.error(error instanceof Error ? error.message : String(error))
+          })
           return
         }
         const worktreeId = store.activeWorktreeId
-        if (worktreeId) {
-          const environmentId = getWorktreeRuntimeEnvironmentId(worktreeId)
-          if (environmentId) {
-            if (!isWebRuntimeSessionActive(environmentId)) {
-              store.createBrowserTab(worktreeId, store.browserDefaultUrl ?? 'about:blank', {
-                title: translate('auto.hooks.useIpcEvents.f6300deb8b', 'New Browser Tab'),
-                focusAddressBar: true
-              })
-              return
-            }
-            void (async () => {
-              // Why: paired web tabs are host-owned; on RPC failure leave local state so the next host snapshot stays authoritative.
-              await createWebRuntimeSessionBrowserTab({
-                worktreeId,
-                environmentId,
-                url: store.browserDefaultUrl ?? 'about:blank'
-              })
-            })()
-            return
-          }
-          store.createBrowserTab(worktreeId, store.browserDefaultUrl ?? 'about:blank', {
-            title: translate('auto.hooks.useIpcEvents.f6300deb8b', 'New Browser Tab'),
-            focusAddressBar: true
-          })
+        if (!worktreeId) {
+          return
         }
+        const targetGroupId =
+          store.activeGroupIdByWorktree[worktreeId] ?? store.groupsByWorktree[worktreeId]?.[0]?.id
+        if (!targetGroupId) {
+          return
+        }
+        void store.openNewBrowserTabInActiveWorkspace(targetGroupId).catch((error) => {
+          toast.error(error instanceof Error ? error.message : String(error))
+        })
       })
     )
 
@@ -2211,7 +2237,9 @@ export function useIpcEvents(): void {
       if (!worktreeId) {
         return
       }
-      void openMobileEmulatorTab(worktreeId, { placement: 'rightSplit' })
+      void openMobileEmulatorTab(worktreeId, { placement: 'rightSplit' }).catch((error) => {
+        toast.error(error instanceof Error ? error.message : String(error))
+      })
     })
     if (unsubscribeNewSimulatorTab) {
       unsubs.push(unsubscribeNewSimulatorTab)
@@ -3066,18 +3094,25 @@ export function useIpcEvents(): void {
       isFlushingAgentStatuses = true
       try {
         const now = Date.now()
-        const remaining: PendingAgentStatusEvent[] = []
-        for (const event of pendingAgentStatusEvents) {
-          if (now - event.firstSeenAt > PENDING_AGENT_STATUS_TTL_MS) {
-            continue
-          }
-          const result = applyAgentStatus(event.data, { retry: true, replay: event.replay })
-          if (result === 'pending') {
-            remaining.push(event)
+        const candidates = pendingAgentStatusEvents
+          .splice(0)
+          .filter((event) => now - event.firstSeenAt <= PENDING_AGENT_STATUS_TTL_MS)
+        let results: AgentStatusApplyResult[]
+        try {
+          results = applyAgentStatusBatch(
+            candidates.map((event) => ({ data: event.data, replay: event.replay, retry: true }))
+          )
+        } catch (err) {
+          // Why: the queue was already spliced, so a throwing fold would drop the whole
+          // burst and strand every pane in it. Requeue ahead of newer arrivals and retry.
+          pendingAgentStatusEvents.unshift(...candidates)
+          throw err
+        }
+        for (let index = 0; index < candidates.length; index += 1) {
+          if (results[index] === 'pending') {
+            pendingAgentStatusEvents.push(candidates[index])
           }
         }
-        pendingAgentStatusEvents.length = 0
-        pendingAgentStatusEvents.push(...remaining)
         if (pendingAgentStatusEvents.length === 0 && pendingAgentStatusRetryTimer !== null) {
           globalThis.clearTimeout(pendingAgentStatusRetryTimer)
           pendingAgentStatusRetryTimer = null
@@ -3090,9 +3125,9 @@ export function useIpcEvents(): void {
 
     const applyAgentStatus = (
       data: AgentStatusIpcPayload,
-      options?: { replay?: boolean; retry?: boolean }
+      options?: AgentStatusApplyOptions
     ): AgentStatusApplyResult => {
-      const store = useAppStore.getState()
+      const store = options?.batch?.transaction.getState() ?? useAppStore.getState()
       if (!store.workspaceSessionReady) {
         return 'dropped'
       }
@@ -3125,12 +3160,25 @@ export function useIpcEvents(): void {
         identityTitle,
         repoConnectionId,
         repoConnectionResolved,
-        owningWorktreeId
-      } = resolvePaneKey(store, paneKey)
+        owningWorktreeId,
+        titleUsesTabTitle
+      } = options?.batch
+        ? resolvePaneKeyFromRoutingIndex(options.batch.routingIndex, paneKey)
+        : resolvePaneKey(store, paneKey)
+      const projectedTitles =
+        titleUsesTabTitle && ownerTabId
+          ? options?.batch?.projectedTitlesByTabId.get(ownerTabId)
+          : undefined
+      if (projectedTitles) {
+        title = projectedTitles.title
+        identityTitle = projectedTitles.identityTitle
+      }
       if (!exists && data.worktreeId && hasRuntimeBackedWorktreeAttribution(data)) {
         // Why: orchestration worker hooks may carry worktree attribution before this renderer has a tab for the pane.
         // Require runtime identity too — worktreeId-only snapshots can be stale rows from closed/remounted panes.
-        const fallbackOwnership = resolveWorktreeConnection(store, data.worktreeId)
+        const fallbackOwnership = options?.batch
+          ? resolveWorktreeConnectionFromRoutingIndex(options.batch.routingIndex, data.worktreeId)
+          : resolveWorktreeConnection(store, data.worktreeId)
         if (fallbackOwnership.worktreeExists) {
           owningWorktreeId = data.worktreeId
           repoConnectionId = fallbackOwnership.repoConnectionId
@@ -3168,7 +3216,7 @@ export function useIpcEvents(): void {
           }
         }
       }
-      // Why: drop in-flight events stamped with a dead connection's id after SSH disconnect/reconnect — see docs/design/agent-status-over-ssh.md §5.
+      // Why: drop in-flight events stamped with a dead connection's id after SSH disconnect/reconnect.
       // Why: startup snapshot replay can beat SSH repo hydration; accept when worktreeId matches the tab until repo ownership resolves.
       // Why: WSL relay stamps a `wsl:<distro>` connectionId but the pane is a local repo (ownership null); normalize so the strict check below doesn't drop it.
       const ownershipConnectionId = isWslHookRelayConnectionId(data.connectionId)
@@ -3204,18 +3252,30 @@ export function useIpcEvents(): void {
         if (!data.providerSession || data.agentType !== 'pi') {
           return 'dropped'
         }
-        store.recordAgentProviderSession(
+        const providerSessionUpdate: AgentStatusBatchUpdate = {
+          kind: 'providerSession',
           paneKey,
-          'pi',
-          data.providerSession,
-          { updatedAt: data.receivedAt },
-          {
+          agent: 'pi',
+          providerSession: data.providerSession,
+          timing: { updatedAt: data.receivedAt },
+          routing: {
             tabId: ownerTabId,
             worktreeId: data.worktreeId ?? owningWorktreeId,
             // Why: persist the WSL-normalized ownership id, not raw relay provenance; a `wsl:*` connectionId would misroute later resumes.
             ...(ownershipConnectionId !== undefined ? { connectionId: ownershipConnectionId } : {})
           },
-          data.launchToken ? { launchToken: data.launchToken } : undefined
+          metadata: data.launchToken ? { launchToken: data.launchToken } : undefined
+        }
+        if (options?.batch) {
+          return options.batch.transaction.apply(providerSessionUpdate) ? 'applied' : 'dropped'
+        }
+        store.recordAgentProviderSession(
+          providerSessionUpdate.paneKey,
+          providerSessionUpdate.agent,
+          providerSessionUpdate.providerSession,
+          providerSessionUpdate.timing,
+          providerSessionUpdate.routing,
+          providerSessionUpdate.metadata
         )
         return 'applied'
       }
@@ -3268,39 +3328,75 @@ export function useIpcEvents(): void {
       }
       const terminalTitle = resolveAgentStatusTerminalTitle(statusPayload, title)
       const statusWorktreeId = data.worktreeId ?? owningWorktreeId
-      store.setAgentStatus(
+      const update: AgentStatusUpdate = {
         paneKey,
-        statusPayloadWithProvenance,
+        payload: statusPayloadWithProvenance,
         terminalTitle,
-        {
+        timing: {
           updatedAt: data.receivedAt,
           stateStartedAt: data.stateStartedAt
         },
-        {
+        routing: {
           tabId: ownerTabId,
           worktreeId: statusWorktreeId,
           terminalHandle: data.terminalHandle,
           ...(ownershipConnectionId !== undefined ? { connectionId: ownershipConnectionId } : {})
         },
-        data.providerSession || data.launchToken
-          ? {
-              ...(data.providerSession ? { providerSession: data.providerSession } : {}),
-              ...(data.launchToken ? { launchToken: data.launchToken } : {})
+        metadata:
+          data.providerSession || data.launchToken
+            ? {
+                ...(data.providerSession ? { providerSession: data.providerSession } : {}),
+                ...(data.launchToken ? { launchToken: data.launchToken } : {})
+              }
+            : undefined
+      }
+      const applyPostCommitNotification = (): void => {
+        if (options?.replay !== true && statusWorktreeId) {
+          // Why: local Codex/Claude hooks arrive via this main-process IPC path, not the PTY OSC fallback, so task-complete notifications must observe accepted hook state here too.
+          const notificationPayload =
+            typeof data.stateStartedAt === 'number'
+              ? { ...resolvedPayload, stateStartedAt: data.stateStartedAt }
+              : resolvedPayload
+          observeAgentHookCompletionForNotification({
+            paneKey,
+            worktreeId: statusWorktreeId,
+            payload: notificationPayload
+          })
+        }
+      }
+      if (options?.batch) {
+        if (!options.batch.transaction.apply(update)) {
+          return 'dropped'
+        }
+        options.batch.notificationEffects.push(applyPostCommitNotification)
+        if (
+          terminalTitle &&
+          shouldApplyResolvedAgentTerminalTitleToTab(store, paneKey, title, terminalTitle)
+        ) {
+          const tabId = parsePaneKey(paneKey)?.tabId
+          if (tabId) {
+            options.batch.tabTitlesByTabId.set(tabId, terminalTitle)
+            if (titleUsesTabTitle) {
+              const titleChanges =
+                !title || !isDecorativeAgentTitleFrameChange(title, terminalTitle)
+              options.batch.projectedTitlesByTabId.set(tabId, {
+                title: titleChanges ? terminalTitle : title,
+                identityTitle: titleChanges ? terminalTitle : identityTitle
+              })
             }
-          : undefined
-      )
-      applyResolvedAgentTerminalTitleToTab(store, paneKey, title, terminalTitle)
-      if (options?.replay !== true && statusWorktreeId) {
-        // Why: local Codex/Claude hooks arrive via this main-process IPC path, not the PTY OSC fallback, so task-complete notifications must observe accepted hook state here too.
-        const notificationPayload =
-          typeof data.stateStartedAt === 'number'
-            ? { ...resolvedPayload, stateStartedAt: data.stateStartedAt }
-            : resolvedPayload
-        observeAgentHookCompletionForNotification({
-          paneKey,
-          worktreeId: statusWorktreeId,
-          payload: notificationPayload
-        })
+          }
+        }
+      } else {
+        store.setAgentStatus(
+          update.paneKey,
+          update.payload,
+          update.terminalTitle,
+          update.timing,
+          update.routing,
+          update.metadata
+        )
+        applyResolvedAgentTerminalTitleToTab(useAppStore.getState(), paneKey, title, terminalTitle)
+        applyPostCommitNotification()
       }
       return 'applied'
     }
@@ -3331,9 +3427,7 @@ export function useIpcEvents(): void {
           if (!current.workspaceSessionReady) {
             return
           }
-          for (const entry of entries) {
-            applyAgentStatus(entry, { replay: true })
-          }
+          applyAgentStatusBatch(entries.map((data) => ({ data, replay: true })))
           const getMigrationUnsupportedSnapshot =
             window.api.agentStatus.getMigrationUnsupportedSnapshot
           if (typeof getMigrationUnsupportedSnapshot !== 'function') {
@@ -3347,8 +3441,12 @@ export function useIpcEvents(): void {
             if (!unsupportedStore.workspaceSessionReady) {
               return
             }
+            const unsupportedRoutingIndex = createAgentStatusPaneRoutingIndex(unsupportedStore)
             for (const entry of unsupportedEntries) {
-              if (entry.paneKey && resolvePaneKey(unsupportedStore, entry.paneKey).exists) {
+              if (
+                entry.paneKey &&
+                resolvePaneKeyFromRoutingIndex(unsupportedRoutingIndex, entry.paneKey).exists
+              ) {
                 unsupportedStore.setMigrationUnsupportedPty(entry)
               }
             }
@@ -3360,19 +3458,51 @@ export function useIpcEvents(): void {
         })
     }
 
+    function applyAgentStatusBatch(
+      events: readonly AgentStatusBatchEvent[]
+    ): AgentStatusApplyResult[] {
+      if (events.length === 0) {
+        return []
+      }
+      return useAppStore.getState().transactAgentStatuses((transaction) => {
+        const batch: AgentStatusBatchContext = {
+          transaction,
+          routingIndex: createAgentStatusPaneRoutingIndex(transaction.getState()),
+          projectedTitlesByTabId: new Map(),
+          tabTitlesByTabId: new Map(),
+          notificationEffects: []
+        }
+        const results = events.map(({ data, replay, retry }) =>
+          applyAgentStatus(data, { batch, replay, retry })
+        )
+        if (batch.tabTitlesByTabId.size > 0) {
+          transaction.afterCommit(() => {
+            useAppStore
+              .getState()
+              .updateTabTitles(
+                [...batch.tabTitlesByTabId].map(([tabId, title]) => ({ tabId, title }))
+              )
+          })
+        }
+        for (const effect of batch.notificationEffects) {
+          transaction.afterCommit(effect)
+        }
+        return results
+      })
+    }
+
+    function applyLiveAgentStatusBatch(batch: readonly AgentStatusIpcPayload[]): boolean {
+      return applyAgentStatusBatch(batch.map((data) => ({ data }))).some(
+        (result) => result === 'applied'
+      )
+    }
+
     function flushLiveAgentStatusBurst(): void {
       liveAgentStatusBurstTimer = null
       lastLiveAgentStatusApplyAt = Date.now()
-      // Why: splice before applying — applyAgentStatus can synchronously
-      // re-enter the queue via subscribers, and it must not see this batch.
+      // Why: splice before publishing — synchronous Zustand subscribers can enqueue the next burst.
       const batch = liveAgentStatusBurstQueue.splice(0)
-      let anyApplied = false
-      for (const data of batch) {
-        if (applyAgentStatus(data) === 'applied') {
-          anyApplied = true
-        }
-      }
-      if (!anyApplied) {
+      if (!applyLiveAgentStatusBatch(batch)) {
         lastLiveAgentStatusApplyAt = 0
       }
     }
@@ -3389,9 +3519,7 @@ export function useIpcEvents(): void {
       }
       liveAgentStatusBurstQueue.length = 0
       liveAgentStatusBurstQueue.push(...remaining)
-      for (const queued of queuedForPane) {
-        applyAgentStatus(queued)
-      }
+      applyLiveAgentStatusBatch(queuedForPane)
     }
 
     function enqueueLiveAgentStatus(data: AgentStatusIpcPayload): void {
@@ -3710,25 +3838,194 @@ function applyResolvedAgentTerminalTitleToTab(
   previousTitle: string | undefined,
   nextTitle: string | undefined
 ): void {
-  if (!nextTitle || nextTitle === previousTitle) {
+  if (
+    !nextTitle ||
+    !shouldApplyResolvedAgentTerminalTitleToTab(store, paneKey, previousTitle, nextTitle)
+  ) {
     return
   }
   const parsed = parsePaneKey(paneKey)
   if (!parsed) {
     return
   }
-  const layout = store.terminalLayoutsByTabId?.[parsed.tabId]
-  if (layout?.root && layout.activeLeafId && layout.activeLeafId !== parsed.leafId) {
-    return
-  }
   // Why: hook completion can arrive while the pane transport is unmounted; keep the tab label synced to the resolved state title.
   store.updateTabTitle(parsed.tabId, nextTitle)
 }
 
+function shouldApplyResolvedAgentTerminalTitleToTab(
+  store: ReturnType<typeof useAppStore.getState>,
+  paneKey: string,
+  previousTitle: string | undefined,
+  nextTitle: string | undefined
+): boolean {
+  if (!nextTitle || nextTitle === previousTitle) {
+    return false
+  }
+  const parsed = parsePaneKey(paneKey)
+  if (!parsed) {
+    return false
+  }
+  const layout = store.terminalLayoutsByTabId?.[parsed.tabId]
+  if (layout?.root && layout.activeLeafId && layout.activeLeafId !== parsed.leafId) {
+    return false
+  }
+  return true
+}
+
+type AgentStatusPaneResolution = {
+  exists: boolean
+  title: string | undefined
+  identityTitle: string | undefined
+  repoConnectionId: string | null
+  repoConnectionResolved: boolean
+  owningWorktreeId: string | undefined
+  titleUsesTabTitle: boolean
+}
+
+type AgentStatusWorktreeConnectionResolution = {
+  worktreeExists: boolean
+  repoConnectionId: string | null
+  repoConnectionResolved: boolean
+}
+
+type IndexedAgentStatusTab = {
+  title: string | undefined
+  unifiedLabel: string | undefined
+  owningWorktreeId: string
+}
+
+type AgentStatusPaneRoutingIndex = {
+  tabsById: Map<string, IndexedAgentStatusTab>
+  layoutsByTabId: AppState['terminalLayoutsByTabId']
+  leafIdsByRoot: WeakMap<TerminalPaneLayoutNode, Set<string>>
+  worktreesById: ReturnType<typeof getWorktreeMapFromState>
+  reposById: ReturnType<typeof getRepoMapFromState>
+}
+
+function createUnifiedTerminalLabelIndex(
+  entries: AppState['unifiedTabsByWorktree'][string] | undefined
+): Map<string, string | undefined> {
+  const labelsByTabId = new Map<string, string | undefined>()
+  for (const entry of entries ?? []) {
+    if (entry.contentType !== 'terminal' || labelsByTabId.has(entry.entityId)) {
+      continue
+    }
+    const rawLabel = entry.label?.trim()
+    labelsByTabId.set(entry.entityId, rawLabel && rawLabel.length > 0 ? rawLabel : undefined)
+  }
+  return labelsByTabId
+}
+
+function createAgentStatusPaneRoutingIndex(
+  store: ReturnType<typeof useAppStore.getState>
+): AgentStatusPaneRoutingIndex {
+  const tabsById = new Map<string, IndexedAgentStatusTab>()
+  for (const [worktreeId, tabs] of Object.entries(store.tabsByWorktree)) {
+    const unifiedLabelsByTabId = createUnifiedTerminalLabelIndex(
+      store.unifiedTabsByWorktree?.[worktreeId]
+    )
+    for (const tab of tabs) {
+      const tabId = tab.id
+      if (!tabsById.has(tabId)) {
+        tabsById.set(tabId, {
+          title: tab.title,
+          unifiedLabel: unifiedLabelsByTabId.get(tabId),
+          owningWorktreeId: worktreeId
+        })
+      }
+    }
+  }
+  return {
+    tabsById,
+    layoutsByTabId: store.terminalLayoutsByTabId,
+    leafIdsByRoot: new WeakMap(),
+    worktreesById: getWorktreeMapFromState(store),
+    reposById: getRepoMapFromState(store)
+  }
+}
+
+function resolveWorktreeConnectionFromRoutingIndex(
+  index: AgentStatusPaneRoutingIndex,
+  worktreeId: string
+): AgentStatusWorktreeConnectionResolution {
+  const worktree = index.worktreesById.get(worktreeId)
+  if (!worktree) {
+    return { worktreeExists: false, repoConnectionId: null, repoConnectionResolved: false }
+  }
+  const repo = index.reposById.get(worktree.repoId)
+  return {
+    worktreeExists: true,
+    repoConnectionId: repo?.connectionId ?? null,
+    repoConnectionResolved: repo !== undefined
+  }
+}
+
+function resolvePaneKeyFromRoutingIndex(
+  index: AgentStatusPaneRoutingIndex,
+  paneKey: string
+): AgentStatusPaneResolution {
+  const parsed = parsePaneKey(paneKey)
+  if (!parsed) {
+    return {
+      exists: false,
+      title: undefined,
+      identityTitle: undefined,
+      repoConnectionId: null,
+      repoConnectionResolved: false,
+      owningWorktreeId: undefined,
+      titleUsesTabTitle: false
+    }
+  }
+  const { tabId, leafId } = parsed
+  const tab = index.tabsById.get(tabId)
+  if (!tab) {
+    return {
+      exists: false,
+      title: undefined,
+      identityTitle: undefined,
+      repoConnectionId: null,
+      repoConnectionResolved: false,
+      owningWorktreeId: undefined,
+      titleUsesTabTitle: false
+    }
+  }
+  const connection = resolveWorktreeConnectionFromRoutingIndex(index, tab.owningWorktreeId)
+  const layout = index.layoutsByTabId?.[tabId]
+  if (layout?.root) {
+    let leafIds = index.leafIdsByRoot.get(layout.root)
+    if (!leafIds) {
+      leafIds = new Set(collectLeafIdsInOrder(layout.root))
+      index.leafIdsByRoot.set(layout.root, leafIds)
+    }
+    if (!leafIds.has(leafId)) {
+      return {
+        exists: false,
+        title: undefined,
+        identityTitle: undefined,
+        repoConnectionId: connection.repoConnectionId,
+        repoConnectionResolved: connection.repoConnectionResolved,
+        owningWorktreeId: tab.owningWorktreeId,
+        titleUsesTabTitle: false
+      }
+    }
+  }
+  const rawPaneTitle = layout?.titlesByLeafId?.[leafId]
+  const paneTitle = rawPaneTitle && rawPaneTitle.length > 0 ? rawPaneTitle : undefined
+  return {
+    exists: true,
+    title: paneTitle ?? tab.title,
+    identityTitle: paneTitle ?? tab.unifiedLabel ?? tab.title,
+    repoConnectionId: connection.repoConnectionId,
+    repoConnectionResolved: connection.repoConnectionResolved,
+    owningWorktreeId: tab.owningWorktreeId,
+    titleUsesTabTitle: paneTitle === undefined
+  }
+}
+
 /** Resolve a paneKey (tabId:leafId) to liveness, current title, owning worktree,
  *  and the owning repo's connectionId. Used for agent-type inference and to drop
- *  status updates for torn-down tabs or dead connections
- *  (see docs/design/agent-status-over-ssh.md §5). */
+ *  status updates for torn-down tabs or dead connections (an SSH reconnect retires the
+ *  old connectionId, so events still in flight under it must not land). */
 function resolvePaneKey(
   store: ReturnType<typeof useAppStore.getState>,
   paneKey: string
@@ -3739,6 +4036,7 @@ function resolvePaneKey(
   repoConnectionId: string | null
   repoConnectionResolved: boolean
   owningWorktreeId: string | undefined
+  titleUsesTabTitle: boolean
 } {
   const parsed = parsePaneKey(paneKey)
   if (!parsed) {
@@ -3748,7 +4046,8 @@ function resolvePaneKey(
       identityTitle: undefined,
       repoConnectionId: null,
       repoConnectionResolved: false,
-      owningWorktreeId: undefined
+      owningWorktreeId: undefined,
+      titleUsesTabTitle: false
     }
   }
   const { tabId, leafId } = parsed
@@ -3794,7 +4093,8 @@ function resolvePaneKey(
       identityTitle: undefined,
       repoConnectionId,
       repoConnectionResolved,
-      owningWorktreeId
+      owningWorktreeId,
+      titleUsesTabTitle: false
     }
   }
   // Why: an empty layout snapshot from a worktree switch (tab/PTY still live) counts as missing metadata; a non-empty layout lacking the leaf still means closed.
@@ -3806,7 +4106,8 @@ function resolvePaneKey(
       identityTitle: undefined,
       repoConnectionId,
       repoConnectionResolved,
-      owningWorktreeId
+      owningWorktreeId,
+      titleUsesTabTitle: false
     }
   }
   // Why: inactive worktrees can have a durable tab and live PTY while the layout is unmounted; hook state must still land there.
@@ -3820,7 +4121,8 @@ function resolvePaneKey(
     identityTitle: paneTitle ?? unifiedTabLabel ?? tabTitle,
     repoConnectionId,
     repoConnectionResolved,
-    owningWorktreeId
+    owningWorktreeId,
+    titleUsesTabTitle: paneTitle === undefined
   }
 }
 
diff --git a/src/renderer/src/hooks/useIssueMetadata.test.tsx b/src/renderer/src/hooks/useIssueMetadata.test.tsx
index c0b79d220d6..c633d543daa 100644
--- a/src/renderer/src/hooks/useIssueMetadata.test.tsx
+++ b/src/renderer/src/hooks/useIssueMetadata.test.tsx
@@ -5,6 +5,7 @@ import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   clearLinearMetadataCache,
+  useRepoLabels,
   useTeamLabels,
   useTeamMembers,
   useTeamStates,
@@ -17,6 +18,9 @@ const linearMocks = vi.hoisted(() => ({
   linearTeamMembers: vi.fn()
 }))
 
+const runtimeMocks = vi.hoisted(() => ({ callRuntimeRpc: vi.fn() }))
+const githubMocks = vi.hoisted(() => ({ listLabels: vi.fn() }))
+
 vi.mock('@/runtime/runtime-linear-client', () => ({
   linearTeamStates: linearMocks.linearTeamStates,
   linearTeamLabels: linearMocks.linearTeamLabels,
@@ -24,7 +28,7 @@ vi.mock('@/runtime/runtime-linear-client', () => ({
 }))
 
 vi.mock('@/runtime/runtime-rpc-client', () => ({
-  callRuntimeRpc: vi.fn(),
+  callRuntimeRpc: runtimeMocks.callRuntimeRpc,
   getActiveRuntimeTarget: (settings?: { activeRuntimeEnvironmentId?: string | null } | null) =>
     settings?.activeRuntimeEnvironmentId
       ? { kind: 'environment', environmentId: settings.activeRuntimeEnvironmentId }
@@ -33,6 +37,13 @@ vi.mock('@/runtime/runtime-rpc-client', () => ({
 
 const roots: Root[] = []
 
+function installWindowApi(): void {
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: { gh: { listLabels: githubMocks.listLabels } }
+  })
+}
+
 async function flushEffects(): Promise<void> {
   await act(async () => {
     await Promise.resolve()
@@ -50,12 +61,15 @@ function renderProbe(element: React.ReactNode): void {
   })
 }
 
-describe('useIssueMetadata Linear hooks', () => {
+describe('useIssueMetadata hooks', () => {
   beforeEach(() => {
     clearLinearMetadataCache()
     linearMocks.linearTeamStates.mockReset()
     linearMocks.linearTeamLabels.mockReset()
     linearMocks.linearTeamMembers.mockReset()
+    runtimeMocks.callRuntimeRpc.mockReset()
+    githubMocks.listLabels.mockReset()
+    installWindowApi()
   })
 
   afterEach(() => {
@@ -65,6 +79,51 @@ describe('useIssueMetadata Linear hooks', () => {
     document.body.replaceChildren()
   })
 
+  it('routes repo-id-only folder metadata through local IPC', async () => {
+    let labels: string[] = []
+    githubMocks.listLabels.mockResolvedValue(['folder'])
+
+    function LabelsProbe(): null {
+      labels = useRepoLabels(null, 'folder-repo-id').data
+      return null
+    }
+
+    renderProbe(<LabelsProbe />)
+    await flushEffects()
+
+    expect(labels).toEqual(['folder'])
+    expect(githubMocks.listLabels).toHaveBeenCalledExactlyOnceWith({
+      repoPath: '',
+      repoId: 'folder-repo-id'
+    })
+    expect(runtimeMocks.callRuntimeRpc).not.toHaveBeenCalled()
+  })
+
+  it('prefers an explicit remote environment and repo id', async () => {
+    let labels: string[] = []
+    runtimeMocks.callRuntimeRpc.mockResolvedValue(['remote'])
+
+    function LabelsProbe(): null {
+      labels = useRepoLabels('/local/repo', 'remote-repo-id', {
+        runtimeEnvironmentId: ' env-explicit ',
+        activeRuntimeEnvironmentId: 'env-active'
+      }).data
+      return null
+    }
+
+    renderProbe(<LabelsProbe />)
+    await flushEffects()
+
+    expect(labels).toEqual(['remote'])
+    expect(runtimeMocks.callRuntimeRpc).toHaveBeenCalledExactlyOnceWith(
+      { kind: 'environment', environmentId: 'env-explicit' },
+      'github.listLabels',
+      { repo: 'remote-repo-id' },
+      { timeoutMs: 15_000 }
+    )
+    expect(githubMocks.listLabels).not.toHaveBeenCalled()
+  })
+
   it('does not loop when cached team-state metadata is read with a fresh settings object', async () => {
     let renders = 0
     let states: unknown[] = []
diff --git a/src/renderer/src/hooks/useIssueMetadata.ts b/src/renderer/src/hooks/useIssueMetadata.ts
index b694c5491dc..8d8a44599ef 100644
--- a/src/renderer/src/hooks/useIssueMetadata.ts
+++ b/src/renderer/src/hooks/useIssueMetadata.ts
@@ -1,6 +1,3 @@
-/* eslint-disable max-lines -- Why: repo metadata hooks share TTL caches and
-Linear/GitHub cache invalidation entrypoints used by the issue dialog. */
-/* oxlint-disable react-doctor/no-adjust-state-on-prop-change -- Why: issue metadata hooks clear stale rows and track loading while async provider cache requests are in flight. */
 import { useEffect, useMemo, useRef, useState } from 'react'
 import { callRuntimeRpc, getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
 import {
@@ -24,20 +21,13 @@ import {
   loadMetadata,
   type MetadataRequestStore
 } from './metadata-request-cache'
-
-type MetadataState<T> = {
-  data: T
-  loading: boolean
-  error: string | null
-}
+import { useMetadataListRequest, type MetadataListState } from './useMetadataListRequest'
 
 type GitHubMetadataOptions = {
   runtimeEnvironmentId?: string | null
   activeRuntimeEnvironmentId?: string | null
 }
 
-// ─── GitHub ────────────────────────────────────────────────
-
 const ghLabelStore = createMetadataRequestStore<string[]>()
 const ghAssigneeStore = createMetadataRequestStore<GitHubAssignableUser[]>()
 
@@ -45,44 +35,22 @@ export function useRepoLabels(
   repoPath: string | null,
   repoId?: string | null,
   options?: GitHubMetadataOptions
-): MetadataState<string[]> {
-  const [state, setState] = useState<MetadataState<string[]>>({
-    data: [],
-    loading: false,
-    error: null
-  })
-  const activeKeyRef = useRef<string | null>(null)
+): MetadataListState<string> {
+  const runtimeEnvironmentId =
+    options?.runtimeEnvironmentId?.trim() || options?.activeRuntimeEnvironmentId?.trim() || null
+  const repoSelector = repoId ?? repoPath ?? ''
+  const cacheKey =
+    repoPath || repoId
+      ? runtimeEnvironmentId
+        ? `runtime:${runtimeEnvironmentId}:${repoSelector}`
+        : repoSelector
+      : null
 
-  useEffect(() => {
-    if (!repoPath && !repoId) {
-      return
-    }
-    const runtimeEnvironmentId =
-      options?.runtimeEnvironmentId?.trim() || options?.activeRuntimeEnvironmentId?.trim() || null
-    const repoSelector = repoId ?? repoPath ?? ''
-    // Why: SSH/runtime metadata must not reuse host-path cache entries; the same
-    // repo id may resolve through a different credential/runtime boundary.
-    const cacheKey = runtimeEnvironmentId
-      ? `runtime:${runtimeEnvironmentId}:${repoSelector}`
-      : repoSelector
-    const cached = getFreshMetadata(ghLabelStore, cacheKey)
-    if (cached) {
-      if (activeKeyRef.current !== cacheKey) {
-        setState({ data: cached.data, loading: false, error: null })
-        activeKeyRef.current = cacheKey
-      }
-      return
-    }
-
-    activeKeyRef.current = cacheKey
-    const requestKey = cacheKey
-    setState((s) => ({
-      ...s,
-      data: s.data.length ? ([] as typeof s.data) : s.data,
-      loading: true,
-      error: null
-    }))
-    loadMetadata(ghLabelStore, cacheKey, () =>
+  return useMetadataListRequest({
+    cacheKey,
+    store: ghLabelStore,
+    errorFallback: 'Failed to load labels',
+    load: () =>
       runtimeEnvironmentId
         ? callRuntimeRpc<string[]>(
             { kind: 'environment', environmentId: runtimeEnvironmentId },
@@ -93,71 +61,29 @@ export function useRepoLabels(
         : window.api.gh
             .listLabels({ repoPath: repoPath ?? '', repoId: repoId ?? undefined })
             .then((labels) => labels as string[])
-    )
-      .then((data) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        setState({ data, loading: false, error: null })
-      })
-      .catch((err) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        activeKeyRef.current = null
-        setState((s) => ({
-          ...s,
-          loading: false,
-          error: err instanceof Error ? err.message : 'Failed to load labels'
-        }))
-      })
-  }, [repoPath, repoId, options?.runtimeEnvironmentId, options?.activeRuntimeEnvironmentId])
-
-  return state
+  })
 }
 
 export function useRepoAssignees(
   repoPath: string | null,
   repoId?: string | null,
   options?: GitHubMetadataOptions
-): MetadataState<GitHubAssignableUser[]> {
-  const [state, setState] = useState<MetadataState<GitHubAssignableUser[]>>({
-    data: [],
-    loading: false,
-    error: null
-  })
-  const activeKeyRef = useRef<string | null>(null)
+): MetadataListState<GitHubAssignableUser> {
+  const runtimeEnvironmentId =
+    options?.runtimeEnvironmentId?.trim() || options?.activeRuntimeEnvironmentId?.trim() || null
+  const repoSelector = repoId ?? repoPath ?? ''
+  const cacheKey =
+    repoPath || repoId
+      ? runtimeEnvironmentId
+        ? `runtime:${runtimeEnvironmentId}:${repoSelector}`
+        : repoSelector
+      : null
 
-  useEffect(() => {
-    if (!repoPath && !repoId) {
-      return
-    }
-    const runtimeEnvironmentId =
-      options?.runtimeEnvironmentId?.trim() || options?.activeRuntimeEnvironmentId?.trim() || null
-    const repoSelector = repoId ?? repoPath ?? ''
-    // Why: SSH/runtime metadata must not reuse host-path cache entries; the same
-    // repo id may resolve through a different credential/runtime boundary.
-    const cacheKey = runtimeEnvironmentId
-      ? `runtime:${runtimeEnvironmentId}:${repoSelector}`
-      : repoSelector
-    const cached = getFreshMetadata(ghAssigneeStore, cacheKey)
-    if (cached) {
-      if (activeKeyRef.current !== cacheKey) {
-        setState({ data: cached.data, loading: false, error: null })
-        activeKeyRef.current = cacheKey
-      }
-      return
-    }
-
-    activeKeyRef.current = cacheKey
-    const requestKey = cacheKey
-    setState((s) => ({
-      ...s,
-      data: s.data.length ? ([] as typeof s.data) : s.data,
-      loading: true,
-      error: null
-    }))
-    loadMetadata(ghAssigneeStore, cacheKey, () =>
+  return useMetadataListRequest({
+    cacheKey,
+    store: ghAssigneeStore,
+    errorFallback: 'Failed to load assignees',
+    load: () =>
       runtimeEnvironmentId
         ? callRuntimeRpc<GitHubAssignableUser[]>(
             { kind: 'environment', environmentId: runtimeEnvironmentId },
@@ -168,31 +94,9 @@ export function useRepoAssignees(
         : window.api.gh
             .listAssignableUsers({ repoPath: repoPath ?? '', repoId: repoId ?? undefined })
             .then((users) => users as GitHubAssignableUser[])
-    )
-      .then((data) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        setState({ data, loading: false, error: null })
-      })
-      .catch((err) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        activeKeyRef.current = null
-        setState((s) => ({
-          ...s,
-          loading: false,
-          error: err instanceof Error ? err.message : 'Failed to load assignees'
-        }))
-      })
-  }, [repoPath, repoId, options?.runtimeEnvironmentId, options?.activeRuntimeEnvironmentId])
-
-  return state
+  })
 }
 
-// ─── Linear ────────────────────────────────────────────────
-
 const linearStateStore = createMetadataRequestStore<LinearWorkflowState[]>()
 const linearLabelStore = createMetadataRequestStore<LinearLabel[]>()
 const linearMemberStore = createMetadataRequestStore<LinearMember[]>()
@@ -221,205 +125,44 @@ export function useTeamStates(
   teamId: string | null,
   settings?: RuntimeLinearSettings,
   workspaceId?: string | null
-): MetadataState<LinearWorkflowState[]> {
-  const [state, setState] = useState<MetadataState<LinearWorkflowState[]>>({
-    data: [],
-    loading: false,
-    error: null
+): MetadataListState<LinearWorkflowState> {
+  const selectedTeamId = teamId ?? ''
+  return useMetadataListRequest({
+    cacheKey: selectedTeamId ? linearMetadataCacheKey(selectedTeamId, settings, workspaceId) : null,
+    store: linearStateStore,
+    load: () => loadTeamStates(settings, selectedTeamId, workspaceId),
+    errorFallback: 'Failed to load states'
   })
-  const activeKeyRef = useRef<string | null>(null)
-  // Why: parents can pass a fresh settings object each render; keying the effect
-  // on the derived cache key keeps a failure's setState from re-arming the fetch
-  // in a render-paced loop. The ref carries the latest settings for the call.
-  const settingsRef = useRef(settings)
-  settingsRef.current = settings
-  const cacheKey = teamId ? linearMetadataCacheKey(teamId, settings, workspaceId) : null
-
-  useEffect(() => {
-    if (!teamId || !cacheKey) {
-      return
-    }
-
-    const cached = getFreshMetadata(linearStateStore, cacheKey)
-    if (cached) {
-      if (activeKeyRef.current !== cacheKey) {
-        setState({ data: cached.data, loading: false, error: null })
-        activeKeyRef.current = cacheKey
-      }
-      return
-    }
-
-    activeKeyRef.current = cacheKey
-    const requestKey = cacheKey
-    setState((s) => ({
-      ...s,
-      data: s.data.length ? ([] as typeof s.data) : s.data,
-      loading: true,
-      error: null
-    }))
-    loadMetadata(linearStateStore, cacheKey, () =>
-      linearTeamStates(settingsRef.current, teamId, workspaceId).then(
-        (states) => states as LinearWorkflowState[]
-      )
-    )
-      .then((data) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        setState({ data, loading: false, error: null })
-      })
-      .catch((err) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        activeKeyRef.current = null
-        setState((s) => ({
-          ...s,
-          loading: false,
-          error: err instanceof Error ? err.message : 'Failed to load states'
-        }))
-      })
-  }, [cacheKey, teamId, workspaceId])
-
-  return state
 }
 
 export function useTeamLabels(
   teamId: string | null,
   settings?: RuntimeLinearSettings,
   workspaceId?: string | null
-): MetadataState<LinearLabel[]> {
-  const [state, setState] = useState<MetadataState<LinearLabel[]>>({
-    data: [],
-    loading: false,
-    error: null
+): MetadataListState<LinearLabel> {
+  const selectedTeamId = teamId ?? ''
+  return useMetadataListRequest({
+    cacheKey: selectedTeamId ? linearMetadataCacheKey(selectedTeamId, settings, workspaceId) : null,
+    store: linearLabelStore,
+    load: () => loadTeamLabels(settings, selectedTeamId, workspaceId),
+    errorFallback: 'Failed to load labels'
   })
-  const activeKeyRef = useRef<string | null>(null)
-  // Why: see useTeamStates — cache-key deps + latest-settings ref stop the
-  // failure-setState render loop.
-  const settingsRef = useRef(settings)
-  settingsRef.current = settings
-  const cacheKey = teamId ? linearMetadataCacheKey(teamId, settings, workspaceId) : null
-
-  useEffect(() => {
-    if (!teamId || !cacheKey) {
-      return
-    }
-
-    const cached = getFreshMetadata(linearLabelStore, cacheKey)
-    if (cached) {
-      if (activeKeyRef.current !== cacheKey) {
-        setState({ data: cached.data, loading: false, error: null })
-        activeKeyRef.current = cacheKey
-      }
-      return
-    }
-
-    activeKeyRef.current = cacheKey
-    const requestKey = cacheKey
-    setState((s) => ({
-      ...s,
-      data: s.data.length ? ([] as typeof s.data) : s.data,
-      loading: true,
-      error: null
-    }))
-    loadMetadata(linearLabelStore, cacheKey, () =>
-      linearTeamLabels(settingsRef.current, teamId, workspaceId).then(
-        (labels) => labels as LinearLabel[]
-      )
-    )
-      .then((data) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        setState({ data, loading: false, error: null })
-      })
-      .catch((err) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        activeKeyRef.current = null
-        setState((s) => ({
-          ...s,
-          loading: false,
-          error: err instanceof Error ? err.message : 'Failed to load labels'
-        }))
-      })
-  }, [cacheKey, teamId, workspaceId])
-
-  return state
 }
 
 export function useTeamMembers(
   teamId: string | null,
   settings?: RuntimeLinearSettings,
   workspaceId?: string | null
-): MetadataState<LinearMember[]> {
-  const [state, setState] = useState<MetadataState<LinearMember[]>>({
-    data: [],
-    loading: false,
-    error: null
+): MetadataListState<LinearMember> {
+  const selectedTeamId = teamId ?? ''
+  return useMetadataListRequest({
+    cacheKey: selectedTeamId ? linearMetadataCacheKey(selectedTeamId, settings, workspaceId) : null,
+    store: linearMemberStore,
+    load: () => loadTeamMembers(settings, selectedTeamId, workspaceId),
+    errorFallback: 'Failed to load members'
   })
-  const activeKeyRef = useRef<string | null>(null)
-  // Why: see useTeamStates — cache-key deps + latest-settings ref stop the
-  // failure-setState render loop.
-  const settingsRef = useRef(settings)
-  settingsRef.current = settings
-  const cacheKey = teamId ? linearMetadataCacheKey(teamId, settings, workspaceId) : null
-
-  useEffect(() => {
-    if (!teamId || !cacheKey) {
-      return
-    }
-
-    const cached = getFreshMetadata(linearMemberStore, cacheKey)
-    if (cached) {
-      if (activeKeyRef.current !== cacheKey) {
-        setState({ data: cached.data, loading: false, error: null })
-        activeKeyRef.current = cacheKey
-      }
-      return
-    }
-
-    activeKeyRef.current = cacheKey
-    const requestKey = cacheKey
-    setState((s) => ({
-      ...s,
-      data: s.data.length ? ([] as typeof s.data) : s.data,
-      loading: true,
-      error: null
-    }))
-    loadMetadata(linearMemberStore, cacheKey, () =>
-      linearTeamMembers(settingsRef.current, teamId, workspaceId).then(
-        (members) => members as LinearMember[]
-      )
-    )
-      .then((data) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        setState({ data, loading: false, error: null })
-      })
-      .catch((err) => {
-        if (activeKeyRef.current !== requestKey) {
-          return
-        }
-        activeKeyRef.current = null
-        setState((s) => ({
-          ...s,
-          loading: false,
-          error: err instanceof Error ? err.message : 'Failed to load members'
-        }))
-      })
-  }, [cacheKey, teamId, workspaceId])
-
-  return state
 }
 
-/**
- * Load Linear team metadata for every selected team and union by id (#8739).
- * Reuses the same per-team cache stores as the single-team hooks.
- */
 function useTeamsMetadataList<T extends { id: string }>(
   teamIds: readonly string[],
   settings: RuntimeLinearSettings | undefined,
@@ -431,8 +174,8 @@ function useTeamsMetadataList<T extends { id: string }>(
     workspaceId: string | null | undefined
   ) => Promise<T[]>,
   errorFallback: string
-): MetadataState<T[]> {
-  const [state, setState] = useState<MetadataState<T[]>>({
+): MetadataListState<T> {
+  const [state, setState] = useState<MetadataListState<T>>({
     data: [],
     loading: false,
     error: null
@@ -448,7 +191,6 @@ function useTeamsMetadataList<T extends { id: string }>(
     [teamIdsKey]
   )
 
-  // Why: recompute each render (like useTeamStates cacheKey) so runtime target changes re-key.
   const requestKey =
     stableTeamIds.length === 0
       ? null
@@ -464,22 +206,12 @@ function useTeamsMetadataList<T extends { id: string }>(
     }
 
     activeKeyRef.current = requestKey
-    const capturedKey = requestKey
-    const teams = stableTeamIds
-
-    // Fast path: every team still fresh in cache → union synchronously.
-    const cachedGroups: T[][] = []
-    let allCached = true
-    for (const teamId of teams) {
-      const cacheKey = linearMetadataCacheKey(teamId, settingsRef.current, workspaceId)
-      const cached = getFreshMetadata(store, cacheKey)
-      if (!cached) {
-        allCached = false
-        break
-      }
-      cachedGroups.push(cached.data)
-    }
-    if (allCached) {
+    const cachedGroups = stableTeamIds.map(
+      (teamId) =>
+        getFreshMetadata(store, linearMetadataCacheKey(teamId, settingsRef.current, workspaceId))
+          ?.data
+    )
+    if (cachedGroups.every((group): group is T[] => group !== undefined)) {
       setState({ data: unionLinearMetadataById(cachedGroups), loading: false, error: null })
       return
     }
@@ -492,7 +224,7 @@ function useTeamsMetadataList<T extends { id: string }>(
     }))
 
     void Promise.all(
-      teams.map((teamId) => {
+      stableTeamIds.map((teamId) => {
         const cacheKey = linearMetadataCacheKey(teamId, settingsRef.current, workspaceId)
         return loadMetadata(store, cacheKey, () =>
           loadTeam(settingsRef.current, teamId, workspaceId)
@@ -500,7 +232,7 @@ function useTeamsMetadataList<T extends { id: string }>(
       })
     )
       .then((groups) => {
-        if (activeKeyRef.current !== capturedKey) {
+        if (activeKeyRef.current !== requestKey) {
           return
         }
         setState({
@@ -510,7 +242,7 @@ function useTeamsMetadataList<T extends { id: string }>(
         })
       })
       .catch((err) => {
-        if (activeKeyRef.current !== capturedKey) {
+        if (activeKeyRef.current !== requestKey) {
           return
         }
         activeKeyRef.current = null
@@ -546,12 +278,11 @@ const loadTeamMembers = (
 ): Promise<LinearMember[]> =>
   linearTeamMembers(settings, teamId, workspaceId).then((members) => members as LinearMember[])
 
-/** Union of workflow states for every selected Linear team (multi-team filters). */
 export function useTeamsStates(
   teamIds: readonly string[],
   settings?: RuntimeLinearSettings,
   workspaceId?: string | null
-): MetadataState<LinearWorkflowState[]> {
+): MetadataListState<LinearWorkflowState> {
   return useTeamsMetadataList(
     teamIds,
     settings,
@@ -562,12 +293,11 @@ export function useTeamsStates(
   )
 }
 
-/** Union of labels for every selected Linear team (multi-team filters). */
 export function useTeamsLabels(
   teamIds: readonly string[],
   settings?: RuntimeLinearSettings,
   workspaceId?: string | null
-): MetadataState<LinearLabel[]> {
+): MetadataListState<LinearLabel> {
   return useTeamsMetadataList(
     teamIds,
     settings,
@@ -578,12 +308,11 @@ export function useTeamsLabels(
   )
 }
 
-/** Union of members for every selected Linear team (multi-team filters). */
 export function useTeamsMembers(
   teamIds: readonly string[],
   settings?: RuntimeLinearSettings,
   workspaceId?: string | null
-): MetadataState<LinearMember[]> {
+): MetadataListState<LinearMember> {
   return useTeamsMetadataList(
     teamIds,
     settings,
diff --git a/src/renderer/src/hooks/useMetadataListRequest.test.tsx b/src/renderer/src/hooks/useMetadataListRequest.test.tsx
new file mode 100644
index 00000000000..3e0c6a68055
--- /dev/null
+++ b/src/renderer/src/hooks/useMetadataListRequest.test.tsx
@@ -0,0 +1,68 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, describe, expect, it } from 'vitest'
+import { createMetadataRequestStore } from './metadata-request-cache'
+import { useMetadataListRequest } from './useMetadataListRequest'
+
+function deferred<T>(): { promise: Promise<T>; resolve: (value: T) => void } {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((settle) => {
+    resolve = settle
+  })
+  return { promise, resolve }
+}
+
+afterEach(cleanup)
+
+describe('useMetadataListRequest', () => {
+  it('treats only null as disabled', async () => {
+    const store = createMetadataRequestStore<string[]>()
+    let loads = 0
+    const view = renderHook(() =>
+      useMetadataListRequest({
+        cacheKey: '',
+        store,
+        errorFallback: 'Failed to load metadata',
+        load: async () => {
+          loads += 1
+          return ['loaded']
+        }
+      })
+    )
+
+    await act(() => Promise.resolve())
+    expect(loads).toBe(1)
+    expect(view.result.current.data).toEqual(['loaded'])
+  })
+
+  it('ignores stale responses and retains the result while disabled', async () => {
+    const store = createMetadataRequestStore<string[]>()
+    const first = deferred<string[]>()
+    const second = deferred<string[]>()
+    const view = renderHook(
+      ({ cacheKey }: { cacheKey: string | null }) =>
+        useMetadataListRequest({
+          cacheKey,
+          store,
+          errorFallback: 'Failed to load metadata',
+          load: () => (cacheKey === 'first' ? first.promise : second.promise)
+        }),
+      { initialProps: { cacheKey: 'first' as string | null } }
+    )
+
+    view.rerender({ cacheKey: 'second' })
+    await act(async () => {
+      second.resolve(['second'])
+      await second.promise
+    })
+    expect(view.result.current.data).toEqual(['second'])
+
+    view.rerender({ cacheKey: null })
+    await act(async () => {
+      first.resolve(['first'])
+      await first.promise
+    })
+    expect(view.result.current).toEqual({ data: ['second'], loading: false, error: null })
+  })
+})
diff --git a/src/renderer/src/hooks/useMetadataListRequest.ts b/src/renderer/src/hooks/useMetadataListRequest.ts
new file mode 100644
index 00000000000..186b620d6cd
--- /dev/null
+++ b/src/renderer/src/hooks/useMetadataListRequest.ts
@@ -0,0 +1,72 @@
+import { useEffect, useEffectEvent, useRef, useState } from 'react'
+import { getFreshMetadata, loadMetadata, type MetadataRequestStore } from './metadata-request-cache'
+
+export type MetadataListState<T> = {
+  data: T[]
+  loading: boolean
+  error: string | null
+}
+
+type MetadataListRequest<T> = {
+  cacheKey: string | null
+  store: MetadataRequestStore<T[]>
+  load: () => Promise<T[]>
+  errorFallback: string
+}
+
+export function useMetadataListRequest<T>({
+  cacheKey,
+  store,
+  load,
+  errorFallback
+}: MetadataListRequest<T>): MetadataListState<T> {
+  const [state, setState] = useState<MetadataListState<T>>({
+    data: [],
+    loading: false,
+    error: null
+  })
+  const activeKeyRef = useRef<string | null>(null)
+  const loadLatest = useEffectEvent(load)
+
+  useEffect(() => {
+    if (cacheKey === null) {
+      return
+    }
+
+    const cached = getFreshMetadata(store, cacheKey)
+    if (cached) {
+      if (activeKeyRef.current !== cacheKey) {
+        setState({ data: cached.data, loading: false, error: null })
+      }
+      activeKeyRef.current = cacheKey
+      return
+    }
+    activeKeyRef.current = cacheKey
+    const requestKey = cacheKey
+    setState((current) => ({
+      ...current,
+      data: current.data.length ? [] : current.data,
+      loading: true,
+      error: null
+    }))
+    void loadMetadata(store, cacheKey, () => loadLatest())
+      .then((data) => {
+        if (activeKeyRef.current === requestKey) {
+          setState({ data, loading: false, error: null })
+        }
+      })
+      .catch((error: unknown) => {
+        if (activeKeyRef.current !== requestKey) {
+          return
+        }
+        activeKeyRef.current = null
+        setState((current) => ({
+          ...current,
+          loading: false,
+          error: error instanceof Error ? error.message : errorFallback
+        }))
+      })
+  }, [cacheKey, errorFallback, store])
+
+  return state
+}
diff --git a/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts b/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts
index 498568d1515..6008db31856 100644
--- a/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts
+++ b/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts
@@ -128,7 +128,13 @@ describe('settings navigation metadata', () => {
   })
 
   it('keeps desktop-only Settings panes out of web metadata', () => {
-    const webIds = ids({ isWebClient: true })
+    const webSections = buildSettingsNavigationMetadata({
+      isMac: false,
+      isWindows: false,
+      isWebClient: true,
+      repos: [repo]
+    })
+    const webIds = webSections.map((section) => section.id)
 
     expect(webIds).not.toContain('browser')
     expect(webIds).not.toContain('ssh')
@@ -138,6 +144,33 @@ describe('settings navigation metadata', () => {
     expect(webIds).not.toContain('advanced')
     expect(webIds).toContain('servers')
     expect(webIds).toContain('repo-repo-1')
+    const floatingWorkspace = webSections.find((section) => section.id === 'floating-workspace')
+    expect(floatingWorkspace?.description).toBe('Global terminal and markdown tabs.')
+    expect(floatingWorkspace?.searchEntries.flatMap((entry) => entry.keywords)).not.toContain(
+      'browser'
+    )
+    const shortcuts = webSections.find((section) => section.id === 'shortcuts')
+    expect(shortcuts?.searchEntries.map((entry) => entry.title)).not.toContain('New browser tab')
+    expect(shortcuts?.searchEntries.map((entry) => entry.title)).not.toContain(
+      'New mobile emulator tab'
+    )
+  })
+
+  it('keeps the Browser shortcut searchable for a capable web runtime', () => {
+    const sections = buildSettingsNavigationMetadata({
+      isMac: false,
+      isWindows: false,
+      isWebClient: true,
+      managedBrowserCreationEnabled: true,
+      mobileEmulatorCreationEnabled: false,
+      repos: [repo]
+    })
+    const shortcutTitles = sections
+      .find((section) => section.id === 'shortcuts')
+      ?.searchEntries.map((entry) => entry.title)
+
+    expect(shortcutTitles).toContain('New browser tab')
+    expect(shortcutTitles).not.toContain('New mobile emulator tab')
   })
 
   it('does not mark installable AI capabilities as beta in the sidebar metadata', () => {
diff --git a/src/renderer/src/hooks/useSettingsNavigationMetadata.ts b/src/renderer/src/hooks/useSettingsNavigationMetadata.ts
index 364d525298b..fab65dc5387 100644
--- a/src/renderer/src/hooks/useSettingsNavigationMetadata.ts
+++ b/src/renderer/src/hooks/useSettingsNavigationMetadata.ts
@@ -1,6 +1,7 @@
 /* oxlint-disable max-lines */
 import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useShallow } from 'zustand/react/shallow'
 // Why: this registry mirrors the Settings sidebar in one neutral module so
 // Cmd+J and Settings visibility cannot drift. Keep it free of Settings pane UI
 // imports; the boundary is enforced by a focused architecture test.
@@ -90,6 +91,7 @@ import { useWindowsTerminalCapabilityOwnerKey } from './useWindowsTerminalCapabi
 import { getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
 import { useLinearProviderConnected } from '@/hooks/useLinearProviderConnected'
 import { translate } from '@/i18n/i18n'
+import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
 
 export { isWebClientLocation } from '@/lib/web-client-location'
 
@@ -124,6 +126,8 @@ export function buildSettingsNavigationMetadata({
   isLocalWindowsHost = isWindows,
   isWindowsTerminalHost = isWindows,
   isWebClient,
+  managedBrowserCreationEnabled = !isWebClient,
+  mobileEmulatorCreationEnabled = !isWebClient,
   isDev = import.meta.env.DEV,
   isLinearConnected = false,
   repos
@@ -133,6 +137,8 @@ export function buildSettingsNavigationMetadata({
   isLocalWindowsHost?: boolean
   isWindowsTerminalHost?: boolean
   isWebClient: boolean
+  managedBrowserCreationEnabled?: boolean
+  mobileEmulatorCreationEnabled?: boolean
   isDev?: boolean
   isLinearConnected?: boolean
   repos: readonly Repo[]
@@ -437,12 +443,19 @@ export function buildSettingsNavigationMetadata({
     {
       id: 'floating-workspace',
       title: translate('auto.hooks.useSettingsNavigationMetadata.65b19f5bde', 'Floating Workspace'),
-      description: translate(
-        'auto.hooks.useSettingsNavigationMetadata.2d0659f6f0',
-        'Global terminal, browser, and markdown tabs.'
-      ),
+      description: showDesktopOnlySettings
+        ? translate(
+            'auto.hooks.useSettingsNavigationMetadata.2d0659f6f0',
+            'Global terminal, browser, and markdown tabs.'
+          )
+        : translate(
+            'auto.hooks.useSettingsNavigationMetadata.floatingWorkspaceWebDescription',
+            'Global terminal and markdown tabs.'
+          ),
       icon: PanelsTopLeft,
-      searchEntries: getFloatingWorkspaceSearchEntries(),
+      searchEntries: getFloatingWorkspaceSearchEntries({
+        includeBrowser: showDesktopOnlySettings
+      }),
       group: 'workflows'
     },
     {
@@ -497,7 +510,10 @@ export function buildSettingsNavigationMetadata({
         'Keyboard shortcuts for common actions.'
       ),
       icon: Keyboard,
-      searchEntries: getShortcutsPaneSearchEntries(),
+      searchEntries: getShortcutsPaneSearchEntries({
+        includeManagedBrowser: managedBrowserCreationEnabled,
+        includeMobileEmulator: mobileEmulatorCreationEnabled
+      }),
       group: 'interface'
     },
     {
@@ -669,6 +685,15 @@ export function useSettingsNavigationMetadata(): SettingsNavSection[] {
   const activeLocale = i18n.language
   const repos = useAppStore((state) => state.repos)
   const settings = useAppStore((state) => state.settings)
+  const [managedBrowserCreationEnabled, mobileEmulatorCreationEnabled] = useAppStore(
+    useShallow((state) => {
+      const policy = getClientCreationActionPolicy(state, state.activeWorktreeId)
+      return [
+        policy['managed-browser'].state === 'enabled',
+        policy['mobile-emulator'].state === 'enabled'
+      ] as const
+    })
+  )
   const isMac = isMacUserAgent()
   const isWindows = isWindowsUserAgent()
   const isWebClient = isWebClientLocation()
@@ -711,6 +736,8 @@ export function useSettingsNavigationMetadata(): SettingsNavSection[] {
         isLocalWindowsHost,
         isWindowsTerminalHost,
         isWebClient,
+        managedBrowserCreationEnabled,
+        mobileEmulatorCreationEnabled,
         isDev: import.meta.env.DEV,
         isLinearConnected,
         repos
@@ -722,6 +749,8 @@ export function useSettingsNavigationMetadata(): SettingsNavSection[] {
       isLocalWindowsHost,
       isWindowsTerminalHost,
       isWebClient,
+      managedBrowserCreationEnabled,
+      mobileEmulatorCreationEnabled,
       isLinearConnected,
       repos,
       activeLocale
diff --git a/src/renderer/src/hooks/useUnreadDockBadge.test.ts b/src/renderer/src/hooks/useUnreadDockBadge.test.ts
index 484b2ed2085..ff269b7a716 100644
--- a/src/renderer/src/hooks/useUnreadDockBadge.test.ts
+++ b/src/renderer/src/hooks/useUnreadDockBadge.test.ts
@@ -63,6 +63,12 @@ describe('useUnreadDockBadge', () => {
     expect(setUnreadDockBadgeCount).toHaveBeenCalledWith(0)
   })
 
+  it('no-ops when the preload API is unavailable', () => {
+    vi.stubGlobal('window', {})
+
+    expect(() => clearUnreadDockBadgeCount()).not.toThrow()
+  })
+
   it('does not rescan workspaces for unrelated remote activity or parent renders', () => {
     const worktrees = Array.from({ length: 100 }, (_, index) =>
       makeWorktree({ id: `repo::worktree-${index}`, repoId: 'repo' })
diff --git a/src/renderer/src/hooks/useUnreadDockBadge.ts b/src/renderer/src/hooks/useUnreadDockBadge.ts
index 9aa8bbef482..268ffb35858 100644
--- a/src/renderer/src/hooks/useUnreadDockBadge.ts
+++ b/src/renderer/src/hooks/useUnreadDockBadge.ts
@@ -4,7 +4,11 @@ import { getUnreadBadgeCount } from '@/lib/unread-badge-count'
 import { useAppStore } from '@/store'
 
 function setUnreadDockBadgeCountBestEffort(count: number): void {
-  void window.api.app.setUnreadDockBadgeCount(count).catch(() => {
+  const setBadge = window.api?.app?.setUnreadDockBadgeCount
+  if (!setBadge) {
+    return
+  }
+  void setBadge(count).catch(() => {
     // Dock sync is best-effort chrome; stale badge state should not affect app use.
   })
 }
diff --git a/src/renderer/src/i18n/hosted-review-localized-copy.ts b/src/renderer/src/i18n/hosted-review-localized-copy.ts
index be6a6b7ad6a..2071d8aa82e 100644
--- a/src/renderer/src/i18n/hosted-review-localized-copy.ts
+++ b/src/renderer/src/i18n/hosted-review-localized-copy.ts
@@ -47,6 +47,14 @@ export function localizedHostedReviewCopy(
       providerName: 'Gitea'
     }
   }
+  if (provider === 'bitbucket') {
+    return {
+      shortLabel: translate('auto.i18n.hostedReview.copy.f0a4b8c2d1', 'PR'),
+      reviewLabel: translate('auto.i18n.hostedReview.copy.e9f3a7b1c0', 'pull request'),
+      titleLabel: translate('auto.i18n.hostedReview.copy.d8e2f6a0b9', 'Pull Request'),
+      providerName: 'Bitbucket'
+    }
+  }
   return {
     shortLabel: translate('auto.i18n.hostedReview.copy.f0a4b8c2d1', 'PR'),
     reviewLabel: translate('auto.i18n.hostedReview.copy.e9f3a7b1c0', 'pull request'),
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json
index 1aaead6e8f0..2c98b1b7ca0 100644
--- a/src/renderer/src/i18n/locales/en.json
+++ b/src/renderer/src/i18n/locales/en.json
@@ -34,6 +34,9 @@
       "failed": "The browser page stopped unexpectedly. Retry to restore it."
     }
   },
+  "githubChecks": {
+    "retrying": "Retrying…"
+  },
   "settings": {
     "appearance": {
       "language": {
@@ -251,7 +254,8 @@
           "51f15c37d3": "Cannot open directory: {{value0}}",
           "f2e00db373": "File not found: {{value0}}",
           "checkRunDetailsUnavailable": "No details are available for this check.",
-          "checkRunDetailsLoadFailed": "Failed to load check details."
+          "checkRunDetailsLoadFailed": "Failed to load check details.",
+          "checkRunDetailsRepoUnavailable": "Repository details are unavailable for this check."
         },
         "github": {
           "f129c42773": "GitHub did not return the new comment.",
@@ -640,6 +644,14 @@
               "64555d0014": "No base branch found"
             }
           }
+        },
+        "browser": {
+          "tab": {
+            "open": {
+              "urlFailed": "Unable to open URL.",
+              "searchFailed": "Unable to search with {{value0}}."
+            }
+          }
         }
       },
       "worktree": {
@@ -744,7 +756,8 @@
           "import": {
             "toast": {
               "restartFallbackUnavailableNone": "None of the {{value0}} cookies could be loaded, and the restart fallback was unavailable. The previous cookies for this profile were replaced. Try the import again.",
-              "restartFallbackUnavailablePartial": "Imported {{value0}} of {{value1}} cookies. The rest could not be loaded, and the restart fallback was unavailable. Try the import again."
+              "restartFallbackUnavailablePartial": "Imported {{value0}} of {{value1}} cookies. The rest could not be loaded, and the restart fallback was unavailable. Try the import again.",
+              "googleCookiesSkipped": "Google cookies were not imported. Open a browser in Orca on {{value0}} with this profile, then sign into Google."
             }
           }
         }
@@ -897,7 +910,8 @@
         "artifactsTitle": "Artifacts",
         "artifactsDescription": "Share HTML and Markdown files with your team and manage their public links.",
         "automationsTitle": "Automations",
-        "automationsDescription": "Schedule agent work and choose whether Automations appears in the sidebar."
+        "automationsDescription": "Schedule agent work and choose whether Automations appears in the sidebar.",
+        "floatingWorkspaceWebDescription": "Global terminal and markdown tabs."
       },
       "useAppMenuPaste": {
         "pasteTooLarge": "Paste is too large."
@@ -913,6 +927,10 @@
       }
     },
     "components": {
+      "BrowserCookieImportDisclosure": {
+        "title": "Google logins aren't imported",
+        "description": "Sign in to Google directly in Orca."
+      },
       "CodexRestartChip": {
         "a4c8e1b2f7": "Codex is still signed in as {{value0}}",
         "c72a5fb234": "Restart",
@@ -1125,7 +1143,10 @@
           "activity": "Activity",
           "noActivity": "No activity yet."
         },
-        "checkActionRequiredHint": "This check needs a manual action on GitHub (for example, approving the workflow run) before merging is unblocked."
+        "checkActionRequiredHint": "This check needs a manual action on GitHub (for example, approving the workflow run) before merging is unblocked.",
+        "e15a8b77ef": "No inline details are available for this check.",
+        "e45324fbed": "Failed to load check details.",
+        "dcb3c546fe": "Retry"
       },
       "GitLabItemDialog": {
         "65e784c1f1": "Reopen",
@@ -1614,7 +1635,10 @@
         "8ff5ae8866": "Assignees",
         "82c87eceb9": "Edit assignees",
         "1ff5d979df": "No one assigned",
-        "checkActionRequiredHint": "This check needs a manual action on GitHub (for example, approving the workflow run) before merging is unblocked."
+        "checkActionRequiredHint": "This check needs a manual action on GitHub (for example, approving the workflow run) before merging is unblocked.",
+        "6b1d5ee3e4": "No inline details are available for this check.",
+        "e04c027d98": "Failed to load check details.",
+        "5df7c41d2a": "Retry"
       },
       "QuickOpen": {
         "1dbd3f59ff": "Move",
@@ -2709,15 +2733,6 @@
         },
         "sheet": {
           "1189e9fe0a": "Close"
-        },
-        "team": {
-          "multi": {
-            "combobox": {
-              "de83523bf9": "No teams match your search.",
-              "301f2a796e": "All teams",
-              "18ec58881e": "Search teams..."
-            }
-          }
         }
       },
       "terminal": {
@@ -2836,7 +2851,8 @@
             "a7e2fd2699": "file an issue",
             "5c8ce20be6": "If this persists, please",
             "cc6d997c65": "Restart the terminal daemon from here to clear stale daemon state.",
-            "7ee11bc0db": "Orca couldn't confirm whether this terminal's previous session is still running, so it left the session untouched. Reopen this pane to retry."
+            "7ee11bc0db": "Orca couldn't confirm whether this terminal's previous session is still running, so it left the session untouched. Reopen this pane to retry.",
+            "e16012e31e": "The terminal daemon that owned this session exited, so the session and its scrollback could not be recovered. Open a new terminal to continue."
           },
           "TerminalPane": {
             "ac112e9036": "Remove title",
@@ -2855,7 +2871,11 @@
             "openTaskTerminal": "Open task terminal",
             "systemBrowser": "System Browser",
             "orcaBrowser": "Orca Browser",
-            "terminalLinkSettings": "Terminal link settings"
+            "terminalLinkSettings": "Terminal link settings",
+            "copyLink": "Copy link",
+            "copied": "Copied",
+            "copiedLink": "Copied link",
+            "copyLinkFailed": "Failed to copy link"
           },
           "TerminalSessionStateSaveFailureDialog": {
             "6bee0c8f17": "Open Disk Space Analyzer",
@@ -3121,7 +3141,9 @@
             "2c38630a01": "Workspace no longer exists",
             "4f0d9a71c2": "Tab no longer exists",
             "d7d496a451": "Browser page no longer exists",
-            "7726ce9970": "Mobile emulator tab no longer exists"
+            "7726ce9970": "Mobile emulator tab no longer exists",
+            "chooseAction": "Choose an action.",
+            "searchProvider": "Search {{value0}}"
           },
           "TabBarQuickCommandsButton": {
             "a2c7a33831": "Command",
@@ -3141,7 +3163,12 @@
             "c781f992e4": "destructive",
             "be8f0ff166": "Delete",
             "f3a8c2d1e7": "Search quick commands...",
-            "b4e7f9a2c1": "No commands match"
+            "b4e7f9a2c1": "No commands match",
+            "8d525e5f15": "Copied",
+            "53b17a4b1b": "Couldn't copy",
+            "a9a564b7e7": "Copy {{value0}}",
+            "69a1441a21": "Nothing to copy",
+            "192a4616a5": "Quick command actions"
           },
           "shell": {
             "icons": {
@@ -3638,7 +3665,7 @@
           },
           "CaffeinateStatusSegment": {
             "on": "On",
-            "auto": "Auto",
+            "auto": "Agent",
             "off": "Off",
             "active": "Active",
             "inactive": "Inactive",
@@ -4535,7 +4562,9 @@
           "cliCreated": "Hide CLI-created",
           "detachedHead": "Hide detached HEAD",
           "keepDefaultBranch": "Except default branch",
-          "keepDefaultBranchAria": "Keep the default branch visible while hiding sleeping workspaces"
+          "keepDefaultBranchAria": "Keep the default branch visible while hiding sleeping workspaces",
+          "otherClients": "Hide other-client workspaces",
+          "otherClientsAria": "Hide workspaces created from other Orca clients on shared remote servers"
         },
         "sidebarHostOptions": {
           "3e102f111c": "All hosts",
@@ -4910,7 +4939,8 @@
               "ae57cbf6e4": "Failed to delete workspace",
               "7488ed8711": "View",
               "2b20ce87b3": "Force Delete",
-              "4f3876c0f5": "Force delete failed"
+              "4f3876c0f5": "Force delete failed",
+              "workspaceListChanged": "Workspace list changed"
             },
             "toast": {
               "1d0fa5c0a5": "Failed to delete workspace {{value0}}",
@@ -5333,6 +5363,48 @@
           "connectName": "Connect to SSH host {{value0}}",
           "authFailedTooltip": "{{value0}} · authentication failed",
           "failedTooltip": "{{value0}} · connection failed"
+        },
+        "preserved": {
+          "branch": {
+            "batch": {
+              "toast": {
+                "a3cdd9d9e6": "Git kept {{count}} local branches because they may contain unmerged commits. Kept branches do not retain workspace folders; their commits remain in the repository. Orca may continue freeing workspace disk space in the background.",
+                "a3cdd9d9e6_one": "Git kept {{count}} local branch because it may contain unmerged commits. Kept branches do not retain workspace folders; their commits remain in the repository. Orca may continue freeing workspace disk space in the background.",
+                "a3cdd9d9e6_other": "Git kept {{count}} local branches because they may contain unmerged commits. Kept branches do not retain workspace folders; their commits remain in the repository. Orca may continue freeing workspace disk space in the background.",
+                "6310412304": "Review {{count}} Branches",
+                "6310412304_one": "Review {{count}} Branch",
+                "6310412304_other": "Review {{count}} Branches",
+                "cea24c2b7d": "{{count}} workspaces removed",
+                "cea24c2b7d_one": "{{count}} workspace removed",
+                "cea24c2b7d_other": "{{count}} workspaces removed",
+                "0e0379f24a": "{{count}} branches kept",
+                "0e0379f24a_one": "{{count}} branch kept",
+                "0e0379f24a_other": "{{count}} branches kept",
+                "4cf75caab7": "{{value0}}, {{value1}}",
+                "e61d78054f": "Deleting local branches: {{value0}}",
+                "1e1a5f6763": "Local branches deleted: {{value0}}",
+                "43d9395605": "{{value0}} deleted, {{value1}} not deleted",
+                "d42f1f14e0": "Retry {{count}} Branches",
+                "d42f1f14e0_one": "Retry {{count}} Branch",
+                "d42f1f14e0_other": "Retry {{count}} Branches"
+              }
+            }
+          }
+        },
+        "PreservedBranchBatchReviewDialog": {
+          "c4bf8e7eaf": "Review kept branches",
+          "f21976c9a8": "Select the local branches you want to force delete. Unselected branches stay in their repositories.",
+          "38c947f7c5": "Select all",
+          "9602129d38": "{{value0}} of {{value1}} selected",
+          "ee39e872d5": "May be unmerged",
+          "676db406fd": "Head unavailable",
+          "285e1e4882": "Cancel",
+          "a0f9863597": "Force Delete {{count}} Branches",
+          "a0f9863597_one": "Force Delete {{count}} Branch",
+          "a0f9863597_other": "Force Delete {{count}} Branches"
+        },
+        "WorktreeListScrollToTopButton": {
+          "jumpToTop": "Jump to top"
         }
       },
       "shared": {
@@ -6714,6 +6786,12 @@
           "8bfdd23a88": "Help us figure out what to build next. Orca sends anonymous counts of which features you use and where things break.",
           "afec8b03be": "ci"
         },
+        "QuickCommandsList": {
+          "noSearchMatches": "No commands match this search."
+        },
+        "QuickCommandsToolbar": {
+          "searchLabel": "Search commands"
+        },
         "QuickCommandsPane": {
           "8764c6e9e4": "Remove {{value0}}",
           "7d90fd5299": "Edit {{value0}}",
@@ -6740,7 +6818,11 @@
           "f2bf411640": "Could not load commands from this host.",
           "7ecfee5b8e": "Retry",
           "601d6af51f": "Loading commands…",
-          "923ba89646": "Could not refresh commands from this host. Showing the last loaded commands."
+          "923ba89646": "Could not refresh commands from this host. Showing the last loaded commands.",
+          "8d525e5f15": "Copied",
+          "53b17a4b1b": "Couldn't copy",
+          "a9a564b7e7": "Copy {{value0}}",
+          "69a1441a21": "Nothing to copy"
         },
         "RecentTabOrderControl": {
           "3b17c81ede": "Tab strip order",
@@ -8681,7 +8763,9 @@
             "41ccade05c": "gh",
             "b79c21bd42": "github",
             "7166b9090c": "GitHub authentication via the gh CLI.",
-            "f16e41cc72": "GitHub Integration"
+            "f16e41cc72": "GitHub Integration",
+            "760e2446e0": "Bitbucket Cloud authentication with a saved API token or environment variables.",
+            "af5ae87847": "access token"
           }
         },
         "jira": {
@@ -9469,8 +9553,8 @@
           "95d3031db2": "Keeps this computer and display awake while agents are working. Lid-close behavior follows this device's power settings.",
           "a42f6fbdd8": "Keeps this computer and display awake while agents are working. Orca also asks this device to stay awake when the lid is closed, subject to its power policy.",
           "modeTitle": "Keep computer awake",
-          "modeDescriptionWindows": "Choose On, Auto while agents are working, or Off. Lid-close behavior follows this device's power settings.",
-          "modeDescriptionDefault": "Choose On, Auto while agents are working, or Off. Orca also asks this device to stay awake when the lid is closed, subject to its power policy."
+          "modeDescriptionWindows": "Choose On, Agent, or Off. Agent mode stays awake while agents are working; lid-close behavior follows this device's power settings.",
+          "modeDescriptionDefault": "Choose On, Agent, or Off. Agent mode stays awake while agents are working. Orca also asks this device to stay awake when the lid is closed, subject to its power policy."
         },
         "agent-status-hooks-copy": {
           "7707c15abb": "Agent status hooks",
@@ -10532,8 +10616,53 @@
         },
         "AgentAwakeSetting": {
           "on": "On",
-          "auto": "Auto",
+          "auto": "Agent",
           "off": "Off"
+        },
+        "bitbucket": {
+          "credentials": {
+            "dialog": {
+              "connectFailed": "Connection failed",
+              "title": "Connect Bitbucket",
+              "description": "Use a Bitbucket Cloud credential to browse pull requests and build statuses. Orca verifies it before saving.",
+              "remoteRuntime": "Bitbucket credentials saved here are stored on this local machine only. Set ORCA_BITBUCKET_* environment variables on the remote runtime instead.",
+              "environmentManaged": "Bitbucket is already configured through ORCA_BITBUCKET_* environment variables, which take precedence. Unset them to save a credential in Orca.",
+              "authModeLabel": "Bitbucket authentication method",
+              "modeBasic": "Email & API token",
+              "modeToken": "Access token",
+              "accessToken": "Access token",
+              "accessTokenPlaceholder": "Repository, project, or workspace access token",
+              "email": "Atlassian account email",
+              "emailPlaceholder": "you@example.com",
+              "apiToken": "API token",
+              "apiTokenPlaceholder": "Atlassian API token",
+              "baseUrl": "API base URL (optional)",
+              "baseUrlPlaceholder": "https://api.bitbucket.org/2.0",
+              "tokenHint": "Repository, project, and workspace access tokens are created from the matching Bitbucket settings page and need read access to pull requests.",
+              "basicHint": "Create an Atlassian API token for your account, then pair it with the email address that owns it.",
+              "docsLink": "Bitbucket API token docs",
+              "storageNote": "Stored on this machine with encrypted storage when the OS keychain is available. ORCA_BITBUCKET_* environment variables always take precedence over what you save here.",
+              "cancel": "Cancel",
+              "verifying": "Verifying...",
+              "connect": "Connect"
+            }
+          },
+          "integration": {
+            "card": {
+              "description": "Pull requests and build statuses for Bitbucket Cloud.",
+              "edit": "Edit credentials",
+              "connect": "Connect",
+              "accountUnknown": "Bitbucket Cloud",
+              "authModeToken": "Access token",
+              "authModeBasic": "Email & API token",
+              "disconnect": "Disconnect Bitbucket",
+              "envManaged": "Configured via environment variables. Unset the ORCA_BITBUCKET_* variables to manage this credential in Orca.",
+              "storedAuthFailed": "The saved Bitbucket credential could not authenticate. Edit it, or check that the token still has pull request access.",
+              "storedCredential": "Saved in Orca on this machine. ORCA_BITBUCKET_* environment variables take precedence when set.",
+              "notConfigured": "Connect a Bitbucket Cloud account with an Atlassian API token or an access token. ORCA_BITBUCKET_* environment variables work too and take precedence.",
+              "disconnectFailed": "Could not remove the saved Bitbucket credential."
+            }
+          }
         }
       },
       "right": {
@@ -10577,7 +10706,7 @@
             "653c105ecc": "More PR actions",
             "f316a8ca2b": "No unresolved comments selected.",
             "d00ebdc402": "Resolve {{value0}} Comments With AI",
-            "ed3f79c031": "Review the prompt before starting an agent. After the prompt is delivered, Orca replies to the selected comments and resolves host threads when possible.",
+            "5eb2163b6b": "Review the prompt before starting an agent. After the prompt is delivered, Orca resolves the selected host threads and replies to comments it cannot resolve.",
             "f273f2271c": "Started the agent. Marked {{value0}} resolved, replied to {{value1}}, skipped {{value2}}, failed {{value3}}.{{value4}}",
             "aa95b81a3a": "Started the agent. Marked {{value0}} resolved, replied to {{value1}}, skipped {{value2}}, failed {{value3}}.",
             "495b2f8c4b": "Started the agent, but could not resolve or reply on the selected comments.",
@@ -10592,6 +10721,7 @@
               "branch": "Sync Branch"
             },
             "7e4b2a19c0": "Could not resolve the GitHub PR to reply on.",
+            "430f1a62d4": "Could not resolve the selected thread on the host.",
             "updateReactionFailed": "Failed to update reaction."
           },
           "CreatePullRequestDialog": {
@@ -10668,7 +10798,8 @@
             "f9d7ca753d": "Copy Paths",
             "3161c4e425": "folder",
             "e887fa4b2e": "Open in Terminal",
-            "1d8e182c32": "View File"
+            "1d8e182c32": "View File",
+            "clipboardStagingUnavailable": "Could not copy the file because Orca's temporary storage is unavailable"
           },
           "FileExplorerToolbar": {
             "d238264654": "Show Git Ignored Files",
@@ -10713,7 +10844,13 @@
             "b25f63edd7": "open",
             "d2ca293f3d": "Working...",
             "ef064cb7c3": "default",
-            "59b4dccf70": "destructive"
+            "59b4dccf70": "destructive",
+            "9a41a687b7": "Queue through #{{pr}} · {{count}} PR",
+            "38a1bccb14": "Queue through #{{pr}} · {{count}} PRs",
+            "3de88351c5": "GitHub will add this pull request and every pull request below it to the merge queue.",
+            "a32fe6dba6": "GitHub will merge this pull request and every pull request below it in the stack.",
+            "73e0e1819d": "Queueing stack...",
+            "e555a41d32": "Merging stack..."
           },
           "PortsPanel": {
             "3ea4a02a8f": "Cancel",
@@ -11129,6 +11266,7 @@
                 "checksUnresolvedChip": "unresolved",
                 "checksUnresolvedStripHint": "These checks finished without a pass or fail verdict.",
                 "e15a8b77ef": "No inline details are available for this check.",
+                "dcb3c546fe": "Retry",
                 "679bf2093c": "Copy log excerpt",
                 "d713f500b2": "Log excerpt",
                 "a916648574": "Open details",
@@ -11195,7 +11333,7 @@
                 "actionRequiredHint": "This check needs a manual action on GitHub (for example, approving the workflow run) before merging is unblocked.",
                 "b3195cba33": "Unmark author as bot",
                 "f588b46a6c": "Mark author as bot",
-                "checkDetailsLoadFailed": "Failed to load check details."
+                "e45324fbed": "Failed to load check details."
               },
               "empty": {
                 "state": {
@@ -11623,6 +11761,17 @@
                   }
                 }
               }
+            },
+            "hosted": {
+              "review": {
+                "button": {
+                  "label": {
+                    "96ae7358e0": "Push & Create PR in stack",
+                    "8e8149a0bf": "Create draft PR in stack",
+                    "8df1a05952": "Create PR in stack"
+                  }
+                }
+              }
             }
           },
           "AiVaultPanel": {
@@ -11877,6 +12026,34 @@
                   "d9dd7c6687": "Couldn't refresh from GitHub. Showing the last known status."
                 }
               }
+            },
+            "pr": {
+              "stack": {
+                "confirmation": {
+                  "84f6f5b9eb": "Included: {{numbers}}. ",
+                  "541984b2eb": "Queue through #{{pr}}?",
+                  "4809f55cdb": "{{included}}GitHub will add {{count}} pull request to the merge queue together. The queue chooses the merge method and may merge them in separate groups.",
+                  "be8f2621be": "{{included}}GitHub will add {{count}} pull requests to the merge queue together. The queue chooses the merge method and may merge them in separate groups.",
+                  "92ca033e72": "Queue {{count}} PR",
+                  "478a527b15": "Queue {{count}} PRs",
+                  "1feef35ca4": "Merge through #{{pr}}?",
+                  "c3e036c99f": "{{included}}GitHub will merge {{count}} pull request atomically using {{method}}. If it cannot merge, nothing will be merged.",
+                  "369aba4b32": "{{included}}GitHub will merge {{count}} pull requests atomically using {{method}}. If any cannot merge, none will.",
+                  "493c78f521": "Merge {{count}} PR",
+                  "eb7051d268": "Merge {{count}} PRs"
+                },
+                "merge": {
+                  "55ae29b907": "Merge through #{{pr}} · {{count}} PR",
+                  "b8446f6ec2": "Merge through #{{pr}} · {{count}} PRs",
+                  "189d0ec614": "#{{pr}} is still a draft.",
+                  "640fb50d9c": "#{{pr}} is closed.",
+                  "46ffcbda75": "#{{pr}} has merge conflicts.",
+                  "6dabefd63e": "#{{pr}} has requested changes.",
+                  "2bb21fc326": "#{{pr}} still needs review approval.",
+                  "c23faf74df": "#{{pr}} must be updated.",
+                  "f561e80968": "#{{pr}} is blocked."
+                }
+              }
             }
           },
           "PluginPanel": {
@@ -11895,6 +12072,34 @@
             "mayBeSlower": "May be slower",
             "slowest": "Slowest",
             "unlimited": "Unlimited"
+          },
+          "GitHubPRStackMap": {
+            "3511405914": "closed",
+            "8a9bdc36c0": "merged",
+            "568c647ccd": "draft",
+            "bea9ade223": "conflicts",
+            "838aadf512": "checks failed",
+            "316039b5db": "checks pending",
+            "4b1e5ee9d3": "changes requested",
+            "9a17b5255c": "review needed",
+            "d3d97cf3f2": "approved",
+            "e6cb964305": "open",
+            "7737bd66be": "Collapse stack #{{value0}}",
+            "0c1645ebd0": "Expand stack #{{value0}}",
+            "e3ee2daa32": "Stack #{{value0}}",
+            "cb440931b7": "{{value0}} of {{value1}} · {{value2}}",
+            "525259fa17": "Stack details are temporarily unavailable."
+          },
+          "CreateHostedReviewBasePicker": {
+            "205ef284fa": "Base branch",
+            "bb4b41d563": "from {{value0}}",
+            "5a9315b61a": "No branches match “{{value0}}”. Press Enter to use it anyway.",
+            "da4d57c9c2": "Leave empty to use {{value0}}."
+          },
+          "CreateHostedReviewComposerFields": {
+            "90cabf6cfc": "Stack this PR above #{{value0}}",
+            "ff81473a57": "Creates a GitHub Stack or extends the parent's existing stack.",
+            "29732f2fb0": "new PR"
           }
         }
       },
@@ -11965,17 +12170,6 @@
           "yoloPermissionsInfo": "Agent permission info",
           "yoloPermissionsTooltip": "Skip permission checks for agents for less interruptions"
         },
-        "FeatureSetupChecklist": {
-          "77f74946f5": "Agents can message each other, take tasks, and coordinate handoffs.",
-          "399cf885c0": "Agent Orchestration",
-          "c5292c409d": "Agents can inspect app windows and operate local apps when you ask.",
-          "1ecfb490ac": "Computer Use",
-          "01426f3a23": "Agents can navigate sites, inspect pages, and work through browser tasks.",
-          "ea85d9e628": "Agent Browser Use",
-          "linearTicketsTitle": "Linear agent skill",
-          "linearTicketsDescription": "Agents can use linked Linear tasks for richer ticket-aware handoffs.",
-          "linearTicketsSetupSummary": "Recommended for Linear workspaces; does not affect Linear connection setup."
-        },
         "FeatureSetupInlineTerminal": {
           "789b59936e": "Press Enter to run the command and confirm npx if asked. You can also set this up later in Settings.",
           "47fc6cc6dc": "Skill setup command",
@@ -12061,37 +12255,6 @@
           "9f47f345a4": "It won't take long!",
           "e4726b2d50": "Skip onboarding?"
         },
-        "OnboardingTourStep": {
-          "3f9586c043": "Take the tour",
-          "60c5576353": "Exit tour"
-        },
-        "RepoStep": {
-          "e8fdb36338": "Scanning repositories. Click to stop.",
-          "b7c4da0504": "SSH? Set hosts up in Settings",
-          "c33b190ca3": "Host paths only",
-          "7b679207e4": "Workspace",
-          "24c7c8696c": "Clone into host path",
-          "7932e95f68": "Clone",
-          "955134915e": "git@github.com:org/repo.git",
-          "288d8444b7": "Paste an HTTPS or SSH URL.",
-          "132425a3e3": "Clone a repo",
-          "6558d50c69": "Want to import many repos at once? Select the parent folder.",
-          "831524961f": "Choose any local directory, git repo or not.",
-          "f4e9c8dcf8": "Browse for a folder",
-          "e8214aa632": "Open as Folder",
-          "3863747c56": "Add Git Project",
-          "2ebbc26343": "/home/user/project",
-          "466108ab89": "Enter a path that exists on the selected host.",
-          "8cab104e3c": "Open a project on this host",
-          "2d20200346": "Import repositories",
-          "27ca610db1": "Back",
-          "cecd6593fa": "Scanned folder:",
-          "c7af322fc3": "Stop scanning",
-          "c3d9d44ca2": "Stop scan",
-          "cf23006ba7": "Selected host",
-          "7ec3f48820": "/home/user",
-          "2e6438dd34": "{{value0}}Found {{value1}} {{value2}} in this folder."
-        },
         "ThemeStep": {
           "a4b254779d": "macOS Option key",
           "6c51398942": "Mouse",
@@ -12119,15 +12282,10 @@
         "use": {
           "onboarding": {
             "flow": {
-              "dce4bdce5b": "Could not open SSH settings",
-              "fd74e7558e": "Clone failed",
               "52acfbef51": "Could not save progress"
             }
           }
         },
-        "AgentFeatureSetupStep": {
-          "97dcdc010f": "Enable capabilities"
-        },
         "WindowsTerminalStep": {
           "powerShell": "PowerShell",
           "powerShellPwsh": "Uses PowerShell 7+ when available, with Windows PowerShell as fallback.",
@@ -12228,10 +12386,6 @@
             "jiraSelectBindFailed": "Couldn’t link this Jira issue. Pick the matching site or reconnect Jira, then try again.",
             "emoji": "Emoji"
           },
-          "ProjectHostSetupCombobox": {
-            "empty": "No hosts are ready for this project.",
-            "placeholder": "Choose host"
-          },
           "ProjectCombobox": {
             "empty": "No projects match your search.",
             "addProject": "Add a new project",
@@ -12633,43 +12787,6 @@
             "cda56c5915": "notes / launch-plan.md",
             "e16479c1c5": "[data-slash-menu] [data-slash-row].slash-active { background: rgba(24,24,27,0.07); box-shadow: inset 0 0 0 1px rgba(24,24,27,0.06); } [data-md-active-line][data-role=\"active\"] { color: rgb(113 113 122); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12.5px; } [data-md-active-line][data-role=\"h1\"] { color: inherit; font-family: inherit; font-size: 18px; font-weight: 700; letter-spacing: -0.01em; line-height: 1.2; margin-top: 6px; } [data-md-caret] { display: inline-block; width: 1.5px; height: 1em; background: currentColor; vertical-align: -2px; margin-left: 1px; animation: md-caret-blink 1.05s steps(1) infinite; } @keyframes md-caret-blink { 0%, 50% { opacity: 1 } 51%, 100% { opacity: 0 } } @keyframes md-block-in { from { opacity: 0; transform: translateY(-2px); } to { opacity: 1; transform: none; } } @keyframes md-cursor-ripple { 0% { transform: scale(0.4); opacity: 0.9; } 100% { transform: scale(1.4); opacity: 0; } } [data-clicking=\"1\"] [data-cursor-ripple] { animation: md-cursor-ripple 460ms ease-out forwards; }"
           },
-          "FeatureTourPreview": {
-            "1170621527": ">",
-            "304ad0dfc1": "Thinking...",
-            "ef8b164dd1": "review src/auth",
-            "952d3ddd9a": "session started",
-            "771d8881c2": "claude",
-            "6ed43cb0e0": "dashboard.spec.ts",
-            "24fedd5a52": "login.spec.ts",
-            "8279e9d95b": "Running 12 tests",
-            "6218a9014d": "pnpm playwright test",
-            "04d54d50ec": "orca · zsh",
-            "1aa8a9a24a": "Splittable terminal",
-            "2a7cfc82c8": "Linked to GH #1842",
-            "3822d8d14b": "fix/worktree-picker-truncates",
-            "d54aefe09e": "LIN-329",
-            "40bbd92ef4": "Start",
-            "c1f28c03b2": "Worktree picker truncates",
-            "fc0cc0b267": "GH #1842",
-            "0688842445": "GH #1799",
-            "bee6b4088d": "GitHub & Linear tasks",
-            "5171768676": "orchestrating 3 agents",
-            "cebc7769cd": "redesign auth flow",
-            "e44269e97d": "Agent orchestration",
-            "ec4a73f5e6": "PR 3/3",
-            "cfdfd4d6b4": "PR 2/3",
-            "b1f17bcc74": "PR 1/3",
-            "e38112b289": "refactor billing webhook",
-            "9c812e0d7c": "speed up CI pipeline",
-            "3c4adfd821": "fix login race condition",
-            "56a0271428": "Isolated workspaces",
-            "ef737dcee1": "GitHub & Linear tasks",
-            "ac51c061e2": "codex",
-            "47f16ecf34": "Ship several things at once. Each workspace keeps its branch, terminal, and agent activity together.",
-            "70aa182266": "Hand off a goal and walk away. A coordinator agent fans out and ships parallel PRs.",
-            "f10c14dd9d": "Skip the tab-switching. Pick from your GitHub or Linear backlog and start a workspace in one click.",
-            "5d6ee181b6": "Open any workspace to return to its terminal, then split panes for tests, logs, and agents."
-          },
           "FeatureWallBody": {
             "25ec5356d6": "Setup"
           },
@@ -12913,11 +13030,6 @@
               }
             }
           },
-          "FeatureTourWorkspaceCard": {
-            "a23ed9da7f": "codex",
-            "2f33dc932b": "claude",
-            "9220794f6a": "working"
-          },
           "ReviewAnimatedVisual": {
             "8df4d52b68": "pr-view",
             "8ab622e4d6": "notes"
@@ -14248,9 +14360,7 @@
           "33741dd973": "Back to runs"
         },
         "AutomationSchedulePicker": {
-          "22359b186a": "AM or PM",
           "9e677335b0": "Minute",
-          "6b802ecc99": "Hour",
           "d90981f766": "Time",
           "6b914c5fbb": "Day",
           "233b8c94b6": "Cadence",
@@ -14260,6 +14370,11 @@
           "837d902bba": "Weekly",
           "ddba78647e": "Custom cron"
         },
+        "AutomationTimeField": {
+          "39ec1383f6": "AM or PM",
+          "32a5e4e35e": "Minute",
+          "aa593eb5e2": "Hour"
+        },
         "AutomationSessionField": {
           "f3c76dce51": "Reuse",
           "c90888ee94": "Fresh",
@@ -14351,7 +14466,17 @@
           "usageUnavailable": "Usage unavailable",
           "noRunUsageYet": "No run usage yet",
           "noWorkspace": "No workspace",
-          "latestSavedOutput": "Latest saved output"
+          "latestSavedOutput": "Latest saved output",
+          "backToList": "All automations",
+          "tableName": "Name",
+          "tableProject": "Project",
+          "tableStatus": "Status",
+          "tableActions": "Actions",
+          "newAutomation": "New Automation",
+          "rowActions": "Automation actions"
+        },
+        "AutomationsPageSkeleton": {
+          "55527b7bcf": "Loading automations"
         },
         "CreateFromPicker": {
           "f061f49e3f": "Search repo branches...",
@@ -14468,9 +14593,12 @@
         "AutomationListSearchField": {
           "tooLong": "Search text is too long — list is unfiltered",
           "label": "Search automations",
-          "placeholder": "Search by name, project, or prompt",
+          "placeholder": "Search...",
           "tooLongShort": "Too long",
           "clear": "Clear search"
+        },
+        "AutomationListLocalRows": {
+          "c92c9463c6": "Automation actions"
         }
       },
       "agent": {
@@ -14732,80 +14860,6 @@
       },
       "orca": {
         "profiles": {
-          "switcher": {
-            "cloud": {
-              "unavailable": "Orca sign-in unavailable"
-            },
-            "account": "Account",
-            "reconnect": "Reconnect profile",
-            "connect": "Connect profile",
-            "organization": "Organization",
-            "create": {
-              "profile": {
-                "for": {
-                  "org": "Create profile for org"
-                }
-              }
-            },
-            "signout": "Sign out",
-            "16e3681072": "New local profile",
-            "e3b91a3d90": "Create an empty profile for separate projects and worktrees.",
-            "f322e1f4d6": "Profile name",
-            "cfa59f8ad1": "Create and Switch",
-            "b4f9d1125d": "Local",
-            "4815f7d163": "Switch profile",
-            "d00d853e2a": "Manage profiles",
-            "c106c674fe": "New local profile",
-            "org": {
-              "members": "Organization members"
-            },
-            "signInWaiting": "Waiting for sign-in…",
-            "signInAgain": "Sign in again",
-            "signIn": "Sign in to Orca",
-            "accountTitle": "Orca account",
-            "accountSignedIn": "Signed in",
-            "accountSignInRequired": "Sign-in required",
-            "accountSignedOut": "Signed out"
-          },
-          "management": {
-            "04e7bd2a23": "Transfer",
-            "128c7dfe64": "Copy to",
-            "df8b7d876b": "Move to",
-            "9aa26347b3": "Project moved",
-            "816ce624b6": "Project copied",
-            "2c45bda8d3": "Manage profiles",
-            "2db945e4a0": "Copy or move projects from the active profile to another local profile.",
-            "8668cb2946": "No projects in this profile.",
-            "93034915ab": "Create another profile before copying projects.",
-            "projectCountSingular": "{{count}} project",
-            "projectCountPlural": "{{count}} projects"
-          },
-          "project": {
-            "transfer": {
-              "confirm": {
-                "move": {
-                  "title": "Move project?",
-                  "description": "Move {{repoName}} to {{targetName}}. Orca removes it from {{activeProfileName}}, keeps files in place, and relaunches into {{targetName}}.",
-                  "action": "Move project"
-                },
-                "copy": {
-                  "title": "Copy project?",
-                  "description": "Copy {{repoName}} to {{targetName}}. Both profiles will point at the same files with separate Orca metadata.",
-                  "action": "Copy project"
-                },
-                "live": {
-                  "work": "Live work in this project"
-                },
-                "cancel": "Cancel",
-                "terminalSingular": "{{count}} live terminal tab",
-                "terminalPlural": "{{count}} live terminal tabs",
-                "agentSingular": "{{count}} active agent",
-                "agentPlural": "{{count}} active agents",
-                "browserSingular": "{{count}} browser workspace",
-                "browserPlural": "{{count}} browser workspaces"
-              }
-            }
-          },
           "signout": {
             "confirm": {
               "title": "Sign out of Orca?",
@@ -14813,79 +14867,6 @@
               "cancel": "Cancel",
               "action": "Sign out"
             }
-          },
-          "switch": {
-            "confirm": {
-              "target": "the selected profile",
-              "title": "Switch profiles?",
-              "description": "Switching to {{targetName}} will relaunch Orca and reload the workspace for {{activeProfileName}}.",
-              "live": {
-                "work": "Live work in this profile"
-              },
-              "cancel": "Cancel",
-              "switch": "Switch profile",
-              "terminalSingular": "{{count}} live terminal tab",
-              "terminalPlural": "{{count}} live terminal tabs",
-              "agentSingular": "{{count}} active agent",
-              "agentPlural": "{{count}} active agents",
-              "browserSingular": "{{count}} browser workspace",
-              "browserPlural": "{{count}} browser workspaces"
-            }
-          },
-          "org": {
-            "members": {
-              "role": {
-                "label": "Role",
-                "owner": "Owner",
-                "admin": "Admin",
-                "member": "Member"
-              },
-              "not": {
-                "signed": {
-                  "in": "They haven't signed in to Orca yet."
-                }
-              },
-              "remove": {
-                "confirm": "Remove",
-                "cancel": "Cancel",
-                "label": "Remove teammate"
-              },
-              "title": "Organization members",
-              "load": {
-                "error": "Couldn't load organization members."
-              },
-              "retry": "Try again",
-              "pending": {
-                "title": "Pending invites",
-                "revoke": "Revoke"
-              },
-              "invite": {
-                "title": "Invite",
-                "placeholder": "teammate@example.com",
-                "role": "Invite role",
-                "submit": "Send"
-              },
-              "error": {
-                "forbidden": "Your role can't do that.",
-                "conflict": "Already a member or invited.",
-                "remove": {
-                  "self": "You can't remove yourself."
-                },
-                "own": {
-                  "role": "You can't change your own role."
-                },
-                "not": {
-                  "found": "That teammate is no longer in this organization."
-                },
-                "reconnect": "Reconnect your profile to manage members.",
-                "unconfigured": "Organization management is unavailable in this build.",
-                "failed": "Something went wrong. Please try again."
-              },
-              "subtitle": {
-                "named": "People in {{orgName}} who can collaborate on Orca.",
-                "default": "People in your organization who can collaborate on Orca."
-              }
-            }
           }
         }
       },
@@ -15126,6 +15107,9 @@
         "loadFailed": "Failed to load the GitLab job log.",
         "emptyTrace": "No log is available for this GitLab job.",
         "timedOut": "Timed out loading the GitLab job log."
+      },
+      "githubCheckDetailsTimeout": {
+        "timedOut": "Timed out loading check details."
       }
     },
     "ssh": {
diff --git a/src/renderer/src/i18n/locales/es.json b/src/renderer/src/i18n/locales/es.json
index d84aa89b132..7d189faeb25 100644
--- a/src/renderer/src/i18n/locales/es.json
+++ b/src/renderer/src/i18n/locales/es.json
@@ -7,6 +7,9 @@
       "webDescription": "Vuelva a cargar el cliente web o vuelva a conectarse al servidor Orca vinculado."
     }
   },
+  "githubChecks": {
+    "retrying": "Reintentando…"
+  },
   "settings": {
     "appearance": {
       "language": {
@@ -560,6 +563,14 @@
               "64555d0014": "No se encontró ninguna rama base"
             }
           }
+        },
+        "browser": {
+          "tab": {
+            "open": {
+              "urlFailed": "No se pudo abrir la URL.",
+              "searchFailed": "No se pudo buscar con {{value0}}."
+            }
+          }
         }
       },
       "worktree": {
@@ -2604,15 +2615,6 @@
         },
         "sheet": {
           "1189e9fe0a": "Cerrar"
-        },
-        "team": {
-          "multi": {
-            "combobox": {
-              "de83523bf9": "Ningún equipo coincide con tu búsqueda.",
-              "301f2a796e": "Todos los equipos",
-              "18ec58881e": "Buscar equipos..."
-            }
-          }
         }
       },
       "terminal": {
@@ -2997,7 +2999,9 @@
             "2c38630a01": "El espacio de trabajo ya no existe",
             "4f0d9a71c2": "La pestaña ya no existe",
             "d7d496a451": "La página del navegador ya no existe",
-            "7726ce9970": "La pestaña del emulador móvil ya no existe"
+            "7726ce9970": "La pestaña del emulador móvil ya no existe",
+            "chooseAction": "Elige una acción.",
+            "searchProvider": "Buscar con {{value0}}"
           },
           "TabBarQuickCommandsButton": {
             "a2c7a33831": "Comando",
@@ -3017,7 +3021,12 @@
             "c781f992e4": "destructivo",
             "be8f0ff166": "Eliminar",
             "f3a8c2d1e7": "Buscar comandos rápidos...",
-            "b4e7f9a2c1": "No hay comandos coincidentes"
+            "b4e7f9a2c1": "No hay comandos coincidentes",
+            "8d525e5f15": "Copiado",
+            "53b17a4b1b": "No se pudo copiar",
+            "a9a564b7e7": "Copiar {{value0}}",
+            "69a1441a21": "Nada que copiar",
+            "192a4616a5": "Acciones del comando rápido"
           },
           "shell": {
             "icons": {
@@ -3991,7 +4000,7 @@
           "e643b30398": "Proyecto agregado en host SSH"
         },
         "AddRepoCreateStep": {
-          "0ae45b8238": "mi-proyecto",
+          "0ae45b8238": "my-project",
           "a8149a3a5a": "Nombre",
           "11fd2a7db8": "Repositorio Git",
           "5e97f0c4b9": "Proyecto creado",
@@ -6060,7 +6069,7 @@
           "a6c2816115": "y",
           "b8a7efb3f6": "ORCA_BITBUCKET_EMAIL",
           "8489c0aa49": "Bitbucket",
-          "e74de656ce": "inicio de sesión de autenticación glab",
+          "e74de656ce": "glab auth login",
           "05e5245af7": "La CLI de GitLab está instalada pero no autenticada. Ejecute este comando en una terminal:",
           "a83cac5726": "Instalar la CLI de GitLab",
           "35a3379372": "Instale la CLI de GitLab para habilitar solicitudes de fusión, problemas y canalizaciones.",
@@ -6068,7 +6077,7 @@
           "a3326f6f1b": "glabro",
           "027440e1cb": "Fusionar solicitudes, problemas, todos y canalizaciones a través de",
           "513abfe47d": "GitLab",
-          "51000487c4": "inicio de sesión de autenticación gh",
+          "51000487c4": "gh auth login",
           "09285e9fe6": "La CLI de GitHub está instalada pero no autenticada. Ejecute este comando en una terminal:",
           "399cf46867": "Instalar la CLI de GitHub",
           "c0c8575e05": "Instale la CLI de GitHub para habilitar solicitudes de extracción, problemas y comprobaciones.",
@@ -6423,7 +6432,11 @@
           "38d61927e6": "No hay comandos rápidos guardados.",
           "44923dd982": "destructivo",
           "ec1ed99e70": "Eliminar",
-          "d1d0976320": "Ninguno"
+          "d1d0976320": "Ninguno",
+          "8d525e5f15": "Copiado",
+          "53b17a4b1b": "No se pudo copiar",
+          "a9a564b7e7": "Copiar {{value0}}",
+          "69a1441a21": "Nada que copiar"
         },
         "RecentTabOrderControl": {
           "3b17c81ede": "Orden de la barra de pestañas",
@@ -6475,12 +6488,12 @@
           "07ba35bc68": "Revisa la indentación bajo `scripts:`. Las claves de hooks deben usar dos espacios y las líneas de comandos deben usar cuatro.",
           "787ca433ef": "Define solo las claves admitidas: `scripts`, `setup`, `archive` e `issueCommand`.",
           "ecc73d9125": "Compara tu archivo con la plantilla funcional de abajo y copia esa estructura si hace falta.",
-          "925f9e0dc4": "texto-primer plano",
+          "925f9e0dc4": "text-foreground",
           "0cc712b823": "El archivo de configuración principal existe en la raíz del repositorio, pero Orca aún no pudo analizar las definiciones de hooks admitidas.",
-          "c90b858573": "texto-ámbar-700 oscuro:texto-ámbar-300",
+          "c90b858573": "text-amber-700 dark:text-amber-300",
           "aba825233f": "El archivo contiene claves de configuración que esta versión de Orca no reconoce. Es posible que necesites actualizar Orca o revisar el archivo en busca de errores tipográficos.",
           "ca424ff135": "Los valores predeterminados compartidos de hooks y automatización de Issues están definidos en el repositorio y disponibles para todos los que lo usan.",
-          "32f417fe17": "texto-esmeralda-700 oscuro:texto-esmeralda-300",
+          "32f417fe17": "text-emerald-700 dark:text-emerald-300",
           "8bfe65fc60": "Usar comandos locales",
           "8d6c56bff8": "Ejecutar ambos",
           "0fa21e19ec": "Nombre del workspace, normalmente basado en el nombre de la rama.",
@@ -6524,7 +6537,7 @@
           "2b7d27b93c": "Usar {{value0}} como color del repositorio",
           "fde066a63b": "Las cargas PNG deben tener un tamaño de 256 KB o menos.",
           "cc1286e263": "Favicon",
-          "03ca1a4e9b": "ejemplo.com",
+          "03ca1a4e9b": "example.com",
           "381b4844fd": "Subir PNG",
           "7da623abcc": "Se usa de forma predeterminada: GitHub siempre proporciona uno, incluso cuando el propietario no configuró una imagen personalizada.",
           "39da8a10bf": "Usar avatar de GitHub",
@@ -10146,7 +10159,7 @@
             "653c105ecc": "Más acciones de PR",
             "f316a8ca2b": "No hay comentarios sin resolver seleccionados.",
             "d00ebdc402": "Resolver comentarios de {{value0}} con IA",
-            "ed3f79c031": "Revisa el prompt antes de iniciar un agente. Una vez entregado el prompt, Orca responde a los comentarios seleccionados y resuelve los hilos en el host cuando es posible.",
+            "5eb2163b6b": "Revisa el prompt antes de iniciar un agente. Una vez entregado el prompt, Orca resuelve los hilos seleccionados en el host y responde a los comentarios que no puede resolver.",
             "f273f2271c": "Agente iniciado. Marcados como resueltos: {{value0}}; respondidos: {{value1}}; omitidos: {{value2}}; con error: {{value3}}.{{value4}}",
             "aa95b81a3a": "Agente iniciado. Marcados como resueltos: {{value0}}; respondidos: {{value1}}; omitidos: {{value2}}; con error: {{value3}}.",
             "495b2f8c4b": "Agente iniciado, pero no se pudieron resolver ni responder los comentarios seleccionados.",
@@ -10160,7 +10173,8 @@
               "pending": "Syncing…",
               "branch": "Sync Branch"
             },
-            "7e4b2a19c0": "No se pudo resolver el PR de GitHub para responder."
+            "7e4b2a19c0": "No se pudo resolver el PR de GitHub para responder.",
+            "430f1a62d4": "No se pudo resolver el hilo seleccionado en el host."
           },
           "CreatePullRequestDialog": {
             "2bc1b4345e": "Cancelar",
@@ -10760,7 +10774,7 @@
                 "actionRequiredHint": "Este check requiere una acción manual en GitHub (por ejemplo, aprobar la ejecución del workflow) antes de que el merge quede desbloqueado.",
                 "b3195cba33": "Desmarcar autor como bot",
                 "f588b46a6c": "Marcar autor como bot",
-                "checkDetailsLoadFailed": "No se pudieron cargar los detalles del check."
+                "e45324fbed": "No se pudieron cargar los detalles del check."
               },
               "empty": {
                 "state": {
@@ -10951,7 +10965,7 @@
             "9fffaf17c1": "Alternar barra lateral derecha ({{value0}})",
             "b37ff4a89a": "puertos",
             "9f83375839": "cheques",
-            "6306b48afd": "control de fuente",
+            "6306b48afd": "source-control",
             "ef182dcb12": "buscar",
             "fc3095d2ed": "explorador",
             "aiVaultSessionHistory": "Agentes",
@@ -11493,17 +11507,6 @@
           "yoloPermissionsInfo": "Información de permisos del agente",
           "yoloPermissionsTooltip": "Omite las comprobaciones de permisos de los agentes para reducir interrupciones"
         },
-        "FeatureSetupChecklist": {
-          "77f74946f5": "Los agentes pueden enviarse mensajes entre sí, tomar tareas y coordinar handoffs.",
-          "399cf885c0": "Orquestación de agentes",
-          "c5292c409d": "Los agentes pueden inspeccionar ventanas de apps y operar apps locales cuando se lo pidas.",
-          "1ecfb490ac": "Uso de la computadora",
-          "01426f3a23": "Los agentes pueden navegar por sitios, inspeccionar páginas y trabajar en tareas del navegador.",
-          "ea85d9e628": "Uso del navegador por agentes",
-          "linearTicketsTitle": "Skill de agente de Linear",
-          "linearTicketsDescription": "Los agentes pueden usar tareas de Linear enlazadas para handoffs con más contexto de ticket.",
-          "linearTicketsSetupSummary": "Recomendado para espacios de trabajo de Linear; no afecta la configuración de conexión de Linear."
-        },
         "FeatureSetupInlineTerminal": {
           "789b59936e": "Pulsa Enter para ejecutar el comando y confirma npx si se te solicita. También puedes configurarlo más tarde en Configuración.",
           "47fc6cc6dc": "Comando de configuración de skills",
@@ -11589,37 +11592,6 @@
           "9f47f345a4": "¡No tardará mucho!",
           "e4726b2d50": "¿Saltar la incorporación?"
         },
-        "OnboardingTourStep": {
-          "3f9586c043": "Haz el recorrido",
-          "60c5576353": "Salir del recorrido"
-        },
-        "RepoStep": {
-          "e8fdb36338": "Escaneo de repositorios. Haga clic para detener.",
-          "b7c4da0504": "¿SSH? Configura hosts en Configuración",
-          "c33b190ca3": "Solo rutas del host",
-          "7b679207e4": "Espacio de trabajo",
-          "24c7c8696c": "Clonar en ruta del host",
-          "7932e95f68": "Clonar",
-          "955134915e": "git@github.com:org/repo.git",
-          "288d8444b7": "Pegue una URL HTTPS o SSH.",
-          "132425a3e3": "Clonar un repositorio",
-          "6558d50c69": "¿Quieres importar muchos repositorios a la vez? Seleccione la carpeta principal.",
-          "831524961f": "Elija cualquier directorio local, repositorio git o no.",
-          "f4e9c8dcf8": "Buscar una carpeta",
-          "e8214aa632": "Abrir como carpeta",
-          "3863747c56": "Agregar proyecto Git",
-          "2ebbc26343": "/home/user/project",
-          "466108ab89": "Introduce una ruta que exista en el host seleccionado.",
-          "8cab104e3c": "Abrir un proyecto en este host",
-          "2d20200346": "Importar repositorios",
-          "27ca610db1": "Atrás",
-          "cecd6593fa": "Carpeta escaneada:",
-          "c7af322fc3": "Dejar de escanear",
-          "c3d9d44ca2": "Detener escaneo",
-          "cf23006ba7": "Host seleccionado",
-          "7ec3f48820": "/home/user",
-          "2e6438dd34": "{{value0}}Se encontraron {{value1}} {{value2}} en esta carpeta."
-        },
         "ThemeStep": {
           "a4b254779d": "Tecla de opción de macOS",
           "6c51398942": "Ratón",
@@ -11647,15 +11619,10 @@
         "use": {
           "onboarding": {
             "flow": {
-              "dce4bdce5b": "No se pudo abrir la configuración de SSH",
-              "fd74e7558e": "Clon falló",
               "52acfbef51": "No se pudo guardar el progreso"
             }
           }
         },
-        "AgentFeatureSetupStep": {
-          "97dcdc010f": "Activar capacidades"
-        },
         "WindowsTerminalStep": {
           "powerShell": "PowerShell",
           "powerShellPwsh": "Usa PowerShell 7+ cuando está disponible, con Windows PowerShell como alternativa.",
@@ -11756,10 +11723,6 @@
             "jiraSelectBindFailed": "Couldn’t link this Jira issue. Pick the matching site or reconnect Jira, then try again.",
             "emoji": "Emoji"
           },
-          "ProjectHostSetupCombobox": {
-            "empty": "No hay hosts listos para este proyecto.",
-            "placeholder": "Elegir host"
-          },
           "ProjectCombobox": {
             "empty": "Ningún proyecto coincide con tu búsqueda.",
             "addProject": "Add a new project",
@@ -12135,43 +12098,6 @@
             "cda56c5915": "notes / launch-plan.md",
             "e16479c1c5": "[data-slash-menu] [data-slash-row].slash-active { background: rgba(24,24,27,0.07); box-shadow: inset 0 0 0 1px rgba(24,24,27,0.06); } [data-md-active-line][data-role=\"active\"] { color: rgb(113 113 122); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12.5px; } [data-md-active-line][data-role=\"h1\"] { color: inherit; font-family: inherit; font-size: 18px; font-weight: 700; letter-spacing: -0.01em; line-height: 1.2; margin-top: 6px; } [data-md-caret] { display: inline-block; width: 1.5px; height: 1em; background: currentColor; vertical-align: -2px; margin-left: 1px; animation: md-caret-blink 1.05s steps(1) infinite; } @keyframes md-caret-blink { 0%, 50% { opacity: 1 } 51%, 100% { opacity: 0 } } @keyframes md-block-in { from { opacity: 0; transform: translateY(-2px); } to { opacity: 1; transform: none; } } @keyframes md-cursor-ripple { 0% { transform: scale(0.4); opacity: 0.9; } 100% { transform: scale(1.4); opacity: 0; } } [data-clicking=\"1\"] [data-cursor-ripple] { animation: md-cursor-ripple 460ms ease-out forwards; }"
           },
-          "FeatureTourPreview": {
-            "1170621527": ">",
-            "304ad0dfc1": "Pensando...",
-            "ef8b164dd1": "revisar src/auth",
-            "952d3ddd9a": "sesión iniciada",
-            "771d8881c2": "claude",
-            "6ed43cb0e0": "dashboard.spec.ts",
-            "24fedd5a52": "login.spec.ts",
-            "8279e9d95b": "Ejecutando 12 pruebas",
-            "6218a9014d": "pnpm playwright test",
-            "04d54d50ec": "orca · zsh",
-            "1aa8a9a24a": "Terminal dividible",
-            "2a7cfc82c8": "Vinculado a GH #1842",
-            "3822d8d14b": "fix/worktree-picker-truncates",
-            "d54aefe09e": "LIN-329",
-            "40bbd92ef4": "Comenzar",
-            "c1f28c03b2": "El selector de worktree se trunca",
-            "fc0cc0b267": "GH #1842",
-            "0688842445": "GH #1799",
-            "bee6b4088d": "Tareas de GitHub y Linear",
-            "5171768676": "orquestando 3 agentes",
-            "cebc7769cd": "rediseñar el flujo de autenticación",
-            "e44269e97d": "Orquestación de agentes",
-            "ec4a73f5e6": "PR 3/3",
-            "cfdfd4d6b4": "PR 2/3",
-            "b1f17bcc74": "PR 1/3",
-            "e38112b289": "refactorizar el webhook de facturación",
-            "9c812e0d7c": "acelerar el proceso de CI",
-            "3c4adfd821": "arreglar la condición de carrera de inicio de sesión",
-            "56a0271428": "Espacios de trabajo aislados",
-            "ef737dcee1": "Tareas de GitHub y Linear",
-            "ac51c061e2": "codex",
-            "47f16ecf34": "Avanza en varias cosas a la vez. Cada workspace mantiene juntos su rama, terminal y actividad de agentes.",
-            "70aa182266": "Delega un objetivo y sigue con lo tuyo. Un agente coordinador se despliega y publica PRs en paralelo.",
-            "f10c14dd9d": "Evita cambiar de pestaña. Elige desde tu backlog de GitHub o Linear e inicia un workspace con un clic.",
-            "5d6ee181b6": "Abre cualquier workspace para volver a su terminal y luego divide paneles para tests, logs y agentes."
-          },
           "FeatureWallBody": {
             "25ec5356d6": "Configuración"
           },
@@ -12415,13 +12341,8 @@
               }
             }
           },
-          "FeatureTourWorkspaceCard": {
-            "a23ed9da7f": "codex",
-            "2f33dc932b": "claude",
-            "9220794f6a": "laboral"
-          },
           "ReviewAnimatedVisual": {
-            "8df4d52b68": "pr-vista",
+            "8df4d52b68": "pr-view",
             "8ab622e4d6": "notas"
           },
           "FeatureWallBrowserAction": {
@@ -12697,7 +12618,7 @@
           "19c45cfdc0": "Expandir todo",
           "982d14bfa5": "Abrir todos los cambios",
           "3d909843bb": "Abrir diff de rama",
-          "8368d256ec": "rama combinada",
+          "8368d256ec": "combined-branch",
           "8f68ad9ca9": "Mostrar {{value0}} AI {{value1}}",
           "724a13568d": "en {{value0}}",
           "6094135eec": "frente a {{value0}}",
@@ -12889,7 +12810,7 @@
           "8f4d2c1a9b": "Redimensionar tabla de contenido"
         },
         "MarkdownTemplatePicker": {
-          "22cd94426f": "sin título.md",
+          "22cd94426f": "untitled.md",
           "6e2e6c04ad": "Markdown en blanco",
           "df667919ca": "No hay plantillas que coincidan.",
           "22fd4890ad": "Buscar plantillas...",
@@ -13726,9 +13647,7 @@
           "33741dd973": "Volver a carreras"
         },
         "AutomationSchedulePicker": {
-          "22359b186a": "mañana o tarde",
           "9e677335b0": "Minuto",
-          "6b802ecc99": "Hora",
           "d90981f766": "Tiempo",
           "6b914c5fbb": "Día",
           "233b8c94b6": "Cadencia",
@@ -13738,6 +13657,11 @@
           "837d902bba": "Semanal",
           "ddba78647e": "Cron personalizado"
         },
+        "AutomationTimeField": {
+          "39ec1383f6": "mañana o tarde",
+          "32a5e4e35e": "Minuto",
+          "aa593eb5e2": "Hora"
+        },
         "AutomationSessionField": {
           "f3c76dce51": "Reutilizar",
           "c90888ee94": "Fresco",
@@ -13816,7 +13740,27 @@
           "a21f6c33ad": "Origen de automatización actualizado.",
           "53f06f0ad5": "Reintentar origen",
           "pendingAutomationMissing": "La automatización ya no está disponible.",
-          "pendingAutomationRunMissing": "El historial de ejecuciones ya no está disponible."
+          "pendingAutomationRunMissing": "El historial de ejecuciones ya no está disponible.",
+          "noSearchMatches": "Ninguna automatización coincide con tu búsqueda.",
+          "paused": "Pausada",
+          "runCount": "{{count}} ejecuciones",
+          "runCount_one": "{{count}} ejecución",
+          "runCount_other": "{{count}} ejecuciones",
+          "projectDefaultBaseRef": "predeterminado del proyecto",
+          "createFromBaseRef": "Crear desde {{baseRef}}",
+          "missingWorkspace": "Espacio de trabajo ausente",
+          "runUsageSummary": "{{cost}} est. · {{tokens}} tokens",
+          "usageUnavailable": "Uso no disponible",
+          "noRunUsageYet": "Aún no hay uso de ejecución",
+          "noWorkspace": "Sin espacio de trabajo",
+          "latestSavedOutput": "Última salida guardada",
+          "backToList": "Todas las automatizaciones",
+          "tableName": "Nombre",
+          "tableProject": "Proyecto",
+          "tableStatus": "Estado",
+          "tableActions": "Acciones",
+          "newAutomation": "Nueva automatización",
+          "rowActions": "Acciones de automatización"
         },
         "CreateFromPicker": {
           "f061f49e3f": "Buscar ramas del repositorio...",
@@ -13929,6 +13873,19 @@
           "5a7863909c": "Ejecutar la configuración para cada espacio de trabajo nuevo",
           "18f000ad4e": "Avanzado",
           "874b72195b": "Cuando esta automatización crea un workspace, lo prepara igual que al crear un worktree manualmente: ejecuta la configuración del proyecto y abre sus pestañas de terminal."
+        },
+        "AutomationsPageSkeleton": {
+          "55527b7bcf": "Cargando automatizaciones"
+        },
+        "AutomationListSearchField": {
+          "tooLong": "El texto de búsqueda es demasiado largo — la lista no está filtrada",
+          "label": "Buscar automatizaciones",
+          "placeholder": "Buscar...",
+          "tooLongShort": "Demasiado largo",
+          "clear": "Borrar búsqueda"
+        },
+        "AutomationListLocalRows": {
+          "c92c9463c6": "Acciones de automatización"
         }
       },
       "agent": {
@@ -14181,80 +14138,6 @@
       },
       "orca": {
         "profiles": {
-          "switcher": {
-            "cloud": {
-              "unavailable": "Inicio de sesión en Orca no disponible"
-            },
-            "account": "Cuenta",
-            "reconnect": "Reconectar perfil",
-            "connect": "Conectar perfil",
-            "organization": "Organización",
-            "create": {
-              "profile": {
-                "for": {
-                  "org": "Crear perfil para organización"
-                }
-              }
-            },
-            "signout": "Cerrar sesión",
-            "16e3681072": "Nuevo perfil local",
-            "e3b91a3d90": "Crear un perfil vacío para proyectos y worktrees separados.",
-            "f322e1f4d6": "Nombre del perfil",
-            "cfa59f8ad1": "Crear y cambiar",
-            "b4f9d1125d": "Local",
-            "4815f7d163": "Cambiar perfil",
-            "d00d853e2a": "Gestionar perfiles",
-            "c106c674fe": "Nuevo perfil local",
-            "org": {
-              "members": "Miembros de la organización"
-            },
-            "signInWaiting": "Esperando el inicio de sesión…",
-            "signInAgain": "Volver a iniciar sesión",
-            "signIn": "Iniciar sesión en Orca",
-            "accountTitle": "Cuenta de Orca",
-            "accountSignedIn": "Sesión iniciada",
-            "accountSignInRequired": "Inicio de sesión requerido",
-            "accountSignedOut": "Sesión cerrada"
-          },
-          "management": {
-            "04e7bd2a23": "Transferir",
-            "128c7dfe64": "Copiar a",
-            "df8b7d876b": "Mover a",
-            "9aa26347b3": "Proyecto movido",
-            "816ce624b6": "Proyecto copiado",
-            "2c45bda8d3": "Gestionar perfiles",
-            "2db945e4a0": "Copiar o mover proyectos del perfil activo a otro perfil local.",
-            "8668cb2946": "No hay proyectos en este perfil.",
-            "93034915ab": "Cree otro perfil antes de copiar proyectos.",
-            "projectCountSingular": "{{count}} proyecto",
-            "projectCountPlural": "{{count}} proyectos"
-          },
-          "project": {
-            "transfer": {
-              "confirm": {
-                "move": {
-                  "title": "¿Mover proyecto?",
-                  "description": "Mover {{repoName}} a {{targetName}}. Orca lo elimina de {{activeProfileName}}, mantiene los archivos en su lugar y relanza en {{targetName}}.",
-                  "action": "Mover proyecto"
-                },
-                "copy": {
-                  "title": "¿Copiar proyecto?",
-                  "description": "Copiar {{repoName}} a {{targetName}}. Ambos perfiles apuntarán a los mismos archivos con metadatos de Orca separados.",
-                  "action": "Copiar proyecto"
-                },
-                "live": {
-                  "work": "Trabajo activo en este proyecto"
-                },
-                "cancel": "Cancelar",
-                "terminalSingular": "{{count}} pestaña de terminal activa",
-                "terminalPlural": "{{count}} pestañas de terminal activas",
-                "agentSingular": "{{count}} agente activo",
-                "agentPlural": "{{count}} agentes activos",
-                "browserSingular": "{{count}} espacio de trabajo del navegador",
-                "browserPlural": "{{count}} espacios de trabajo del navegador"
-              }
-            }
-          },
           "signout": {
             "confirm": {
               "title": "¿Cerrar sesión en Orca?",
@@ -14262,79 +14145,6 @@
               "cancel": "Cancelar",
               "action": "Cerrar sesión"
             }
-          },
-          "switch": {
-            "confirm": {
-              "target": "el perfil seleccionado",
-              "title": "¿Cambiar perfiles?",
-              "description": "Cambiar a {{targetName}} relanzará Orca y recargará el espacio de trabajo de {{activeProfileName}}.",
-              "live": {
-                "work": "Trabajo activo en este perfil"
-              },
-              "cancel": "Cancelar",
-              "switch": "Cambiar perfil",
-              "terminalSingular": "{{count}} pestaña de terminal activa",
-              "terminalPlural": "{{count}} pestañas de terminal activas",
-              "agentSingular": "{{count}} agente activo",
-              "agentPlural": "{{count}} agentes activos",
-              "browserSingular": "{{count}} espacio de trabajo del navegador",
-              "browserPlural": "{{count}} espacios de trabajo del navegador"
-            }
-          },
-          "org": {
-            "members": {
-              "role": {
-                "label": "Rol",
-                "owner": "Propietario",
-                "admin": "Administrador",
-                "member": "Miembro"
-              },
-              "not": {
-                "signed": {
-                  "in": "Aún no han iniciado sesión en Orca."
-                }
-              },
-              "remove": {
-                "confirm": "Eliminar",
-                "cancel": "Cancelar",
-                "label": "Eliminar compañero"
-              },
-              "title": "Miembros de la organización",
-              "load": {
-                "error": "No se pudieron cargar los miembros de la organización."
-              },
-              "retry": "Intentar de nuevo",
-              "pending": {
-                "title": "Invitaciones pendientes",
-                "revoke": "Revocar"
-              },
-              "invite": {
-                "title": "Invitar",
-                "placeholder": "teammate@example.com",
-                "role": "Rol de invitación",
-                "submit": "Enviar"
-              },
-              "error": {
-                "forbidden": "Tu rol no puede hacer eso.",
-                "conflict": "Ya es miembro o fue invitado.",
-                "remove": {
-                  "self": "No puedes eliminarte a ti mismo."
-                },
-                "own": {
-                  "role": "No puedes cambiar tu propio rol."
-                },
-                "not": {
-                  "found": "Ese compañero ya no está en esta organización."
-                },
-                "reconnect": "Reconecta tu perfil para gestionar miembros.",
-                "unconfigured": "La gestión de organización no está disponible en esta compilación.",
-                "failed": "Algo salió mal. Por favor, intenta de nuevo."
-              },
-              "subtitle": {
-                "named": "Personas en {{orgName}} que pueden colaborar en Orca.",
-                "default": "Personas en tu organización que pueden colaborar en Orca."
-              }
-            }
           }
         }
       },
diff --git a/src/renderer/src/i18n/locales/ja.json b/src/renderer/src/i18n/locales/ja.json
index 76f154d39e8..2b9f42e51b1 100644
--- a/src/renderer/src/i18n/locales/ja.json
+++ b/src/renderer/src/i18n/locales/ja.json
@@ -7,6 +7,9 @@
       "webDescription": "Web クライアントを再試行するか、ペアリングされたランタイムに再接続します。"
     }
   },
+  "githubChecks": {
+    "retrying": "再試行中…"
+  },
   "settings": {
     "appearance": {
       "language": {
@@ -560,6 +563,14 @@
               "64555d0014": "ベースブランチが見つかりません"
             }
           }
+        },
+        "browser": {
+          "tab": {
+            "open": {
+              "urlFailed": "URLを開けませんでした。",
+              "searchFailed": "{{value0}} で検索できませんでした。"
+            }
+          }
         }
       },
       "worktree": {
@@ -2604,15 +2615,6 @@
         },
         "sheet": {
           "1189e9fe0a": "閉じる"
-        },
-        "team": {
-          "multi": {
-            "combobox": {
-              "de83523bf9": "検索に一致するチームはありません。",
-              "301f2a796e": "全チーム",
-              "18ec58881e": "チームを検索…"
-            }
-          }
         }
       },
       "terminal": {
@@ -2997,7 +2999,9 @@
             "2c38630a01": "ワークスペースは存在しません",
             "4f0d9a71c2": "タブは存在しません",
             "d7d496a451": "ブラウザページは存在しません",
-            "7726ce9970": "モバイルエミュレータのタブは存在しません"
+            "7726ce9970": "モバイルエミュレータのタブは存在しません",
+            "chooseAction": "アクションを選択してください。",
+            "searchProvider": "{{value0}} で検索"
           },
           "TabBarQuickCommandsButton": {
             "a2c7a33831": "コマンド",
@@ -3017,7 +3021,12 @@
             "c781f992e4": "破壊的な",
             "be8f0ff166": "削除",
             "f3a8c2d1e7": "クイックコマンドを検索…",
-            "b4e7f9a2c1": "一致するコマンドはありません"
+            "b4e7f9a2c1": "一致するコマンドはありません",
+            "8d525e5f15": "コピーしました",
+            "53b17a4b1b": "コピーできませんでした",
+            "a9a564b7e7": "{{value0}} をコピー",
+            "69a1441a21": "コピーする内容がありません",
+            "192a4616a5": "クイックコマンドの操作"
           },
           "shell": {
             "icons": {
@@ -6445,7 +6454,11 @@
           "38d61927e6": "保存されているクイックコマンドはありません。",
           "44923dd982": "破壊的な",
           "ec1ed99e70": "削除",
-          "d1d0976320": "なし"
+          "d1d0976320": "なし",
+          "8d525e5f15": "コピーしました",
+          "53b17a4b1b": "コピーできませんでした",
+          "a9a564b7e7": "{{value0}} をコピー",
+          "69a1441a21": "コピーする内容がありません"
         },
         "RecentTabOrderControl": {
           "3b17c81ede": "タブストリップの順序",
@@ -10146,7 +10159,7 @@
             "653c105ecc": "その他の PR 操作",
             "f316a8ca2b": "未解決のコメントが選択されていません。",
             "d00ebdc402": "{{value0}} のコメントを AI で解決",
-            "ed3f79c031": "Agent を開始する前にプロンプトを確認してください。プロンプトの送信後、Orca は選択したコメントに返信し、可能な場合はホスト上のスレッドを解決します。",
+            "5eb2163b6b": "Agent を開始する前にプロンプトを確認してください。プロンプトの送信後、Orca は選択したホスト上のスレッドを解決し、解決できないコメントには返信します。",
             "f273f2271c": "Agent を開始しました。{{value0}} 件を解決し、{{value1}} 件に返信し、{{value2}} 件をスキップし、{{value3}} 件の処理に失敗しました。{{value4}}",
             "aa95b81a3a": "Agent を開始しました。{{value0}} 件を解決し、{{value1}} 件に返信し、{{value2}} 件をスキップし、{{value3}} 件の処理に失敗しました。",
             "495b2f8c4b": "Agent を開始しましたが、選択したコメントの解決または返信ができませんでした。",
@@ -10160,7 +10173,8 @@
               "pending": "同期中…",
               "branch": "ブランチを同期"
             },
-            "7e4b2a19c0": "返信先の GitHub PR を特定できませんでした。"
+            "7e4b2a19c0": "返信先の GitHub PR を特定できませんでした。",
+            "430f1a62d4": "選択したスレッドをホスト上で解決できませんでした。"
           },
           "CreatePullRequestDialog": {
             "2bc1b4345e": "キャンセル",
@@ -10760,7 +10774,7 @@
                 "actionRequiredHint": "マージのブロックが解除されるまでに、このチェックには GitHub 上での手動操作（例: ワークフロー実行の承認）が必要です。",
                 "b3195cba33": "作成者のボット指定を解除",
                 "f588b46a6c": "作成者をボットとして指定",
-                "checkDetailsLoadFailed": "チェック詳細の読み込みに失敗しました。"
+                "e45324fbed": "チェック詳細の読み込みに失敗しました。"
               },
               "empty": {
                 "state": {
@@ -11493,17 +11507,6 @@
           "yoloPermissionsInfo": "Agent 権限情報",
           "yoloPermissionsTooltip": "Agent の権限チェックをスキップして割り込みを減らす"
         },
-        "FeatureSetupChecklist": {
-          "77f74946f5": "Agent は相互にメッセージを送信し、タスクを実行し、引き継ぎを調整できます。",
-          "399cf885c0": "Agent オーケストレーション",
-          "c5292c409d": "Agent は、要求に応じてアプリウィンドウを検査し、ローカルアプリを操作できます。",
-          "1ecfb490ac": "コンピュータ操作",
-          "01426f3a23": "Agent はサイトを移動し、ページを検査し、ブラウザのタスクを実行できます。",
-          "ea85d9e628": "Agent ブラウザの使用",
-          "linearTicketsTitle": "Linear Agent スキル",
-          "linearTicketsDescription": "Agent はリンクされた Linear タスクを使って、チケットを踏まえたより詳しい引き継ぎができます。",
-          "linearTicketsSetupSummary": "Linear ワークスペースに推奨。Linear 接続設定には影響しません。"
-        },
         "FeatureSetupInlineTerminal": {
           "789b59936e": "Enter キーを押してコマンドを実行し、要求されたら npx を確認します。これは、後で [設定] で設定することもできます。",
           "47fc6cc6dc": "スキルセットアップコマンド",
@@ -11589,37 +11592,6 @@
           "9f47f345a4": "それほど時間はかかりません！",
           "e4726b2d50": "オンボーディングをスキップしますか?"
         },
-        "OnboardingTourStep": {
-          "3f9586c043": "ツアーに参加する",
-          "60c5576353": "出口ツアー"
-        },
-        "RepoStep": {
-          "e8fdb36338": "リポジトリをスキャンしています。クリックして停止します。",
-          "b7c4da0504": "SSH? 「設定」でホストをセットアップする",
-          "c33b190ca3": "ホストパスのみ",
-          "7b679207e4": "ワークスペース",
-          "24c7c8696c": "ホストパスにクローンを作成します",
-          "7932e95f68": "クローン",
-          "955134915e": "git@github.com:org/repo.git",
-          "288d8444b7": "HTTPS または SSH URL を貼り付けます。",
-          "132425a3e3": "リポジトリのクローンを作成する",
-          "6558d50c69": "一度に多くのリポジトリをインポートしたいですか?親フォルダーを選択します。",
-          "831524961f": "git repo かどうかに関係なく、任意のローカルディレクトリを選択します。",
-          "f4e9c8dcf8": "フォルダーを参照する",
-          "e8214aa632": "フォルダーとして開く",
-          "3863747c56": "Git プロジェクトの追加",
-          "2ebbc26343": "/home/user/project",
-          "466108ab89": "ホスト上に存在するパスを入力します。",
-          "8cab104e3c": "ホストプロジェクトを開く",
-          "2d20200346": "リポジトリのインポート",
-          "27ca610db1": "戻る",
-          "cecd6593fa": "スキャンしたフォルダー:",
-          "c7af322fc3": "スキャンを停止する",
-          "c3d9d44ca2": "スキャンの停止",
-          "cf23006ba7": "選択したホスト",
-          "7ec3f48820": "/home/user",
-          "2e6438dd34": "{{value0}}このフォルダー内で {{value1}} {{value2}} が見つかりました。"
-        },
         "ThemeStep": {
           "a4b254779d": "macOS の Option キー",
           "6c51398942": "マウス",
@@ -11647,15 +11619,10 @@
         "use": {
           "onboarding": {
             "flow": {
-              "dce4bdce5b": "SSH 設定を開けませんでした",
-              "fd74e7558e": "クローン作成に失敗しました",
               "52acfbef51": "進行状況を保存できませんでした"
             }
           }
         },
-        "AgentFeatureSetupStep": {
-          "97dcdc010f": "CLI とスキルをインストール"
-        },
         "WindowsTerminalStep": {
           "powerShell": "PowerShell",
           "powerShellPwsh": "利用可能な場合は PowerShell 7+ を使い、代わりに Windows PowerShell を使用します。",
@@ -11756,10 +11723,6 @@
             "jiraSelectBindFailed": "この Jira Issue をリンクできませんでした。該当するサイトを選択するか Jira に再接続してから、もう一度お試しください。",
             "emoji": "絵文字"
           },
-          "ProjectHostSetupCombobox": {
-            "empty": "このプロジェクトで準備が整ったホストはありません。",
-            "placeholder": "ホストを選択"
-          },
           "ProjectCombobox": {
             "empty": "検索条件に一致するプロジェクトはありません。",
             "addProject": "新規プロジェクトを追加",
@@ -12135,43 +12098,6 @@
             "cda56c5915": "メモ / launch-plan.md",
             "e16479c1c5": "[data-slash-menu] [data-slash-row].slash-active { background: rgba(24,24,27,0.07); box-shadow: inset 0 0 0 1px rgba(24,24,27,0.06); } [data-md-active-line][data-role=\"active\"] { color: rgb(113 113 122); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12.5px; } [data-md-active-line][data-role=\"h1\"] { color: inherit; font-family: inherit; font-size: 18px; font-weight: 700; letter-spacing: -0.01em; line-height: 1.2; margin-top: 6px; } [data-md-caret] { display: inline-block; width: 1.5px; height: 1em; background: currentColor; vertical-align: -2px; margin-left: 1px; animation: md-caret-blink 1.05s steps(1) infinite; } @keyframes md-caret-blink { 0%, 50% { opacity: 1 } 51%, 100% { opacity: 0 } } @keyframes md-block-in { from { opacity: 0; transform: translateY(-2px); } to { opacity: 1; transform: none; } } @keyframes md-cursor-ripple { 0% { transform: scale(0.4); opacity: 0.9; } 100% { transform: scale(1.4); opacity: 0; } } [data-clicking=\"1\"] [data-cursor-ripple] { animation: md-cursor-ripple 460ms ease-out forwards; }"
           },
-          "FeatureTourPreview": {
-            "1170621527": ">",
-            "304ad0dfc1": "思考中…",
-            "ef8b164dd1": "review src/auth",
-            "952d3ddd9a": "セッションが開始されました",
-            "771d8881c2": "claude",
-            "6ed43cb0e0": "dashboard.spec.ts",
-            "24fedd5a52": "login.spec.ts",
-            "8279e9d95b": "12 個のテストを実行する",
-            "6218a9014d": "pnpm playwright test",
-            "04d54d50ec": "orca · zsh",
-            "1aa8a9a24a": "分割可能なターミナル",
-            "2a7cfc82c8": "GH #1842 にリンク",
-            "3822d8d14b": "fix/worktree-picker-truncates",
-            "d54aefe09e": "LIN-329",
-            "40bbd92ef4": "開始",
-            "c1f28c03b2": "ワークツリーピッカーが切り捨てる",
-            "fc0cc0b267": "GH #1842",
-            "0688842445": "GH #1799",
-            "bee6b4088d": "GitHub と Linear タスク",
-            "5171768676": "3 つの Agent を調整する",
-            "cebc7769cd": "認証フローを再設計する",
-            "e44269e97d": "Agent のオーケストレーション",
-            "ec4a73f5e6": "PR 3/3",
-            "cfdfd4d6b4": "PR 2/3",
-            "b1f17bcc74": "PR 1/3",
-            "e38112b289": "請求 Webhook をリファクタリングする",
-            "9c812e0d7c": "CIパイプラインを高速化する",
-            "3c4adfd821": "ログイン競合状態を修正",
-            "56a0271428": "隔離されたワークスペース",
-            "ef737dcee1": "GitHub と Linear タスク",
-            "ac51c061e2": "codex",
-            "47f16ecf34": "複数の作業を同時に進めましょう。各ワークスペースはブランチ、ターミナル、Agent の活動をまとめます。",
-            "70aa182266": "目標を任せて離れます。コーディネーター Agent が作業を分担し、並列で PR を出します。",
-            "f10c14dd9d": "タブ切り替えは不要。GitHub または Linear のバックログから選んで、ワンクリックでワークスペースを開始します。",
-            "5d6ee181b6": "ワークスペースを開いてターミナルに戻り、テスト、ログ、Agent 用にペインを分割します。"
-          },
           "FeatureWallBody": {
             "25ec5356d6": "設定"
           },
@@ -12415,11 +12341,6 @@
               }
             }
           },
-          "FeatureTourWorkspaceCard": {
-            "a23ed9da7f": "codex",
-            "2f33dc932b": "claude",
-            "9220794f6a": "実行中"
-          },
           "ReviewAnimatedVisual": {
             "8df4d52b68": "pr-view",
             "8ab622e4d6": "メモ"
@@ -13726,9 +13647,7 @@
           "33741dd973": "実行一覧に戻る"
         },
         "AutomationSchedulePicker": {
-          "22359b186a": "午前または午後",
           "9e677335b0": "分",
-          "6b802ecc99": "時間",
           "d90981f766": "時間",
           "6b914c5fbb": "日",
           "233b8c94b6": "ケイデンス",
@@ -13738,6 +13657,11 @@
           "837d902bba": "毎週",
           "ddba78647e": "カスタム cron"
         },
+        "AutomationTimeField": {
+          "39ec1383f6": "午前または午後",
+          "32a5e4e35e": "分",
+          "aa593eb5e2": "時間"
+        },
         "AutomationSessionField": {
           "f3c76dce51": "再利用",
           "c90888ee94": "新規",
@@ -13816,7 +13740,27 @@
           "a21f6c33ad": "オートメーションのソースを更新しました。",
           "53f06f0ad5": "ソースを再試行",
           "pendingAutomationMissing": "自動化は利用できなくなりました。",
-          "pendingAutomationRunMissing": "実行履歴は利用できなくなりました。"
+          "pendingAutomationRunMissing": "実行履歴は利用できなくなりました。",
+          "noSearchMatches": "検索に一致する自動化がありません。",
+          "paused": "一時停止中",
+          "runCount": "{{count}} 回の実行",
+          "runCount_one": "{{count}} 回の実行",
+          "runCount_other": "{{count}} 回の実行",
+          "projectDefaultBaseRef": "プロジェクトのデフォルト",
+          "createFromBaseRef": "{{baseRef}} から作成",
+          "missingWorkspace": "ワークスペースがありません",
+          "runUsageSummary": "約 {{cost}} · {{tokens}} tokens",
+          "usageUnavailable": "使用量を利用できません",
+          "noRunUsageYet": "まだ実行の使用量がありません",
+          "noWorkspace": "ワークスペースなし",
+          "latestSavedOutput": "最新の保存済み出力",
+          "backToList": "すべての自動化",
+          "tableName": "名前",
+          "tableProject": "プロジェクト",
+          "tableStatus": "ステータス",
+          "tableActions": "操作",
+          "newAutomation": "新しい自動化",
+          "rowActions": "自動化の操作"
         },
         "CreateFromPicker": {
           "f061f49e3f": "リポジトリブランチを検索…",
@@ -13929,6 +13873,19 @@
           "5a7863909c": "新規ワークスペースごとにセットアップを実行",
           "18f000ad4e": "詳細設定",
           "874b72195b": "このオートメーションがワークスペースを作成するときに、手動でワークツリーを作成する場合と同じ準備を行います。プロジェクトのセットアップを実行し、ターミナルタブを開きます。"
+        },
+        "AutomationsPageSkeleton": {
+          "55527b7bcf": "自動化を読み込み中"
+        },
+        "AutomationListSearchField": {
+          "tooLong": "検索テキストが長すぎます — リストは未フィルタです",
+          "label": "自動化を検索",
+          "placeholder": "検索...",
+          "tooLongShort": "長すぎます",
+          "clear": "検索をクリア"
+        },
+        "AutomationListLocalRows": {
+          "c92c9463c6": "自動化の操作"
         }
       },
       "agent": {
@@ -14181,80 +14138,6 @@
       },
       "orca": {
         "profiles": {
-          "switcher": {
-            "cloud": {
-              "unavailable": "Orca へのサインインは利用できません"
-            },
-            "reconnect": "プロファイルを再接続",
-            "connect": "プロファイルを接続",
-            "organization": "組織",
-            "create": {
-              "profile": {
-                "for": {
-                  "org": "組織用のプロファイルを作成"
-                }
-              }
-            },
-            "signout": "サインアウト",
-            "16e3681072": "新規ローカルプロファイル",
-            "e3b91a3d90": "プロジェクトとワークツリーを分けるための空のプロファイルを作成します。",
-            "f322e1f4d6": "プロファイル名",
-            "cfa59f8ad1": "作成して切り替え",
-            "b4f9d1125d": "ローカル",
-            "4815f7d163": "プロファイルを切り替え",
-            "d00d853e2a": "プロファイルを管理",
-            "c106c674fe": "新規ローカルプロファイル",
-            "account": "アカウント",
-            "org": {
-              "members": "組織メンバー"
-            },
-            "signInWaiting": "サインインを待機中…",
-            "signInAgain": "もう一度サインイン",
-            "signIn": "Orca にサインイン",
-            "accountTitle": "Orca アカウント",
-            "accountSignedIn": "サインイン済み",
-            "accountSignInRequired": "サインインが必要です",
-            "accountSignedOut": "サインアウト済み"
-          },
-          "management": {
-            "04e7bd2a23": "転送",
-            "128c7dfe64": "コピー先",
-            "df8b7d876b": "移動先",
-            "9aa26347b3": "プロジェクトを移動しました",
-            "816ce624b6": "プロジェクトをコピーしました",
-            "2c45bda8d3": "プロファイルを管理",
-            "2db945e4a0": "アクティブなプロファイルから別のローカルプロファイルへプロジェクトをコピーまたは移動します。",
-            "8668cb2946": "このプロファイルにはプロジェクトがありません。",
-            "93034915ab": "プロジェクトをコピーする前に、別のプロファイルを作成してください。",
-            "projectCountSingular": "{{count}} 件のプロジェクト",
-            "projectCountPlural": "{{count}} 件のプロジェクト"
-          },
-          "project": {
-            "transfer": {
-              "confirm": {
-                "move": {
-                  "title": "プロジェクトを移動しますか？",
-                  "description": "{{repoName}}を{{targetName}}に移動します。Orca は{{activeProfileName}}から削除し、ファイルはそのまま保持し、{{targetName}}に再起動します。",
-                  "action": "プロジェクトを移動"
-                },
-                "copy": {
-                  "title": "プロジェクトをコピーしますか？",
-                  "description": "{{repoName}}を{{targetName}}にコピーします。両方のプロファイルが同じファイルを別の Orca メタデータで参照します。",
-                  "action": "プロジェクトをコピー"
-                },
-                "live": {
-                  "work": "このプロジェクトのアクティブな作業"
-                },
-                "cancel": "キャンセル",
-                "terminalSingular": "{{count}}個のアクティブなターミナルタブ",
-                "terminalPlural": "{{count}}個のアクティブなターミナルタブ",
-                "agentSingular": "{{count}}個のアクティブな Agent",
-                "agentPlural": "{{count}}個のアクティブな Agent",
-                "browserSingular": "{{count}}個のブラウザワークスペース",
-                "browserPlural": "{{count}}個のブラウザワークスペース"
-              }
-            }
-          },
           "signout": {
             "confirm": {
               "title": "Orca からログアウトしますか？",
@@ -14262,79 +14145,6 @@
               "cancel": "キャンセル",
               "action": "サインアウト"
             }
-          },
-          "switch": {
-            "confirm": {
-              "target": "選択されたプロファイル",
-              "title": "プロファイルを切り替えますか？",
-              "description": "{{targetName}}に切り替えると、Orca が再起動され、{{activeProfileName}}のワークスペースが再読み込みされます。",
-              "live": {
-                "work": "このプロファイルのアクティブな作業"
-              },
-              "cancel": "キャンセル",
-              "switch": "プロファイルを切り替え",
-              "terminalSingular": "{{count}}個のアクティブなターミナルタブ",
-              "terminalPlural": "{{count}}個のアクティブなターミナルタブ",
-              "agentSingular": "{{count}}個のアクティブな Agent",
-              "agentPlural": "{{count}}個のアクティブな Agent",
-              "browserSingular": "{{count}}個のブラウザワークスペース",
-              "browserPlural": "{{count}}個のブラウザワークスペース"
-            }
-          },
-          "org": {
-            "members": {
-              "role": {
-                "label": "役割",
-                "owner": "オーナー",
-                "admin": "管理者",
-                "member": "メンバー"
-              },
-              "not": {
-                "signed": {
-                  "in": "まだ Orca にサインインしていません。"
-                }
-              },
-              "remove": {
-                "confirm": "削除",
-                "cancel": "キャンセル",
-                "label": "チームメンバーを削除"
-              },
-              "title": "組織メンバー",
-              "load": {
-                "error": "組織メンバーを読み込めませんでした。"
-              },
-              "retry": "再試行",
-              "pending": {
-                "title": "保留中の招待",
-                "revoke": "取り消し"
-              },
-              "invite": {
-                "title": "招待",
-                "placeholder": "teammate@example.com",
-                "role": "招待役割",
-                "submit": "送信"
-              },
-              "error": {
-                "forbidden": "この役割では実行できません。",
-                "conflict": "既にメンバーまたは招待済みです。",
-                "remove": {
-                  "self": "自分自身を削除することはできません。"
-                },
-                "own": {
-                  "role": "自分の役割を変更することはできません。"
-                },
-                "not": {
-                  "found": "そのチームメンバーはこの組織にいません。"
-                },
-                "reconnect": "メンバーを管理するには、プロファイルを再接続してください。",
-                "unconfigured": "このビルドでは組織管理が利用できません。",
-                "failed": "問題が発生しました。もう一度お試しください。"
-              },
-              "subtitle": {
-                "named": "{{orgName}} で Orca を共同利用できるメンバーです。",
-                "default": "組織内で Orca を共同利用できるメンバーです。"
-              }
-            }
           }
         }
       },
diff --git a/src/renderer/src/i18n/locales/ko.json b/src/renderer/src/i18n/locales/ko.json
index c86caa3e852..4a34c5639b0 100644
--- a/src/renderer/src/i18n/locales/ko.json
+++ b/src/renderer/src/i18n/locales/ko.json
@@ -7,6 +7,9 @@
       "webDescription": "웹 클라이언트를 다시 시도하거나 페어링된 런타임에 다시 연결하세요."
     }
   },
+  "githubChecks": {
+    "retrying": "재시도 중…"
+  },
   "settings": {
     "appearance": {
       "language": {
@@ -560,6 +563,14 @@
               "64555d0014": "기본 브랜치를 찾을 수 없습니다."
             }
           }
+        },
+        "browser": {
+          "tab": {
+            "open": {
+              "urlFailed": "URL을 열 수 없습니다.",
+              "searchFailed": "{{value0}}에서 검색할 수 없습니다."
+            }
+          }
         }
       },
       "worktree": {
@@ -2604,15 +2615,6 @@
         },
         "sheet": {
           "1189e9fe0a": "닫기"
-        },
-        "team": {
-          "multi": {
-            "combobox": {
-              "de83523bf9": "검색어와 일치하는 팀이 없습니다.",
-              "301f2a796e": "모든 팀",
-              "18ec58881e": "팀 검색..."
-            }
-          }
         }
       },
       "terminal": {
@@ -2774,7 +2776,7 @@
             "agent": {
               "row": {
                 "ad991ece5c": "Agent 창을 더 이상 사용할 수 없습니다.",
-                "090d607412": "오래된 agent 행-{{value0}}"
+                "090d607412": "stale-agent-row-{{value0}}"
               }
             }
           },
@@ -2997,7 +2999,9 @@
             "2c38630a01": "워크스페이스가 더 이상 존재하지 않습니다",
             "4f0d9a71c2": "탭이 더 이상 존재하지 않습니다",
             "d7d496a451": "브라우저 페이지가 더 이상 존재하지 않습니다",
-            "7726ce9970": "모바일 에뮬레이터 탭이 더 이상 존재하지 않습니다"
+            "7726ce9970": "모바일 에뮬레이터 탭이 더 이상 존재하지 않습니다",
+            "chooseAction": "작업을 선택하세요.",
+            "searchProvider": "{{value0}}에서 검색"
           },
           "TabBarQuickCommandsButton": {
             "a2c7a33831": "명령",
@@ -3017,7 +3021,12 @@
             "c781f992e4": "destructive",
             "be8f0ff166": "삭제",
             "f3a8c2d1e7": "빠른 명령 검색...",
-            "b4e7f9a2c1": "일치하는 명령 없음"
+            "b4e7f9a2c1": "일치하는 명령 없음",
+            "8d525e5f15": "복사됨",
+            "53b17a4b1b": "복사하지 못함",
+            "a9a564b7e7": "{{value0}} 복사",
+            "69a1441a21": "복사할 내용 없음",
+            "192a4616a5": "빠른 명령 작업"
           },
           "shell": {
             "icons": {
@@ -6053,7 +6062,7 @@
           "a3326f6f1b": "glab",
           "027440e1cb": "MR, 이슈, 할 일, 파이프라인을 다음 도구로 사용합니다.",
           "513abfe47d": "GitLab",
-          "51000487c4": "gh 인증 로그인",
+          "51000487c4": "gh auth login",
           "09285e9fe6": "GitHub CLI가 설치되어 있지만 인증되지 않았습니다. terminal에서 다음 명령을 실행하세요.",
           "399cf46867": "GitHub CLI 설치",
           "c0c8575e05": "PR, 이슈 및 검사를 활성화하려면 GitHub CLI를 설치하세요.",
@@ -6408,7 +6417,11 @@
           "38d61927e6": "저장된 빠른 명령이 없습니다.",
           "44923dd982": "파괴적인",
           "ec1ed99e70": "삭제",
-          "d1d0976320": "없음"
+          "d1d0976320": "없음",
+          "8d525e5f15": "복사됨",
+          "53b17a4b1b": "복사하지 못함",
+          "a9a564b7e7": "{{value0}} 복사",
+          "69a1441a21": "복사할 내용 없음"
         },
         "RecentTabOrderControl": {
           "3b17c81ede": "탭 스트립 순서",
@@ -8275,7 +8288,7 @@
             "compareAgainstUpstreamDescription": "소스 제어가 커밋된 변경 사항 비교에 기본으로 사용할 기준을 선택합니다. 브랜치 업스트림은 현재 브랜치를 자동으로 따라가며, 업스트림이 없으면 저장소 기본 브랜치로 돌아갑니다. 비교 기준은 해당 worktree의 Git 패널에서 worktree별로 변경할 수 있습니다. Pull Request 및 리베이스 대상은 변경되지 않습니다.",
             "compareBase": "비교 기준",
             "currentBranch": "현재 브랜치",
-            "upstream": "업스트림",
+            "upstream": "upstream",
             "localChanges": "로컬 변경 사항",
             "originMaster": "origin/master",
             "committedChanges": "커밋된 변경 사항",
@@ -10146,7 +10159,7 @@
             "653c105ecc": "더 많은 PR 작업",
             "f316a8ca2b": "선택한 해결되지 않은 댓글이 없습니다.",
             "d00ebdc402": "AI로 {{value0}} 댓글 해결",
-            "ed3f79c031": "에이전트를 시작하기 전에 프롬프트를 확인하세요. 프롬프트가 전달된 후 Orca가 선택한 댓글에 답글을 남기고 가능한 경우 호스트 스레드를 해결합니다.",
+            "5eb2163b6b": "에이전트를 시작하기 전에 프롬프트를 확인하세요. 프롬프트가 전달된 후 Orca가 선택한 호스트 스레드를 해결하고, 해결할 수 없는 댓글에는 답글을 남깁니다.",
             "f273f2271c": "agent를 시작했습니다. {{value0}}개 해결됨, {{value1}}개 답글, {{value2}}개 건너뜀, {{value3}}개 실패.{{value4}}",
             "aa95b81a3a": "agent를 시작했습니다. {{value0}}개 해결됨, {{value1}}개 답글, {{value2}}개 건너뜀, {{value3}}개 실패.",
             "495b2f8c4b": "agent를 시작했지만 선택한 댓글을 해결하거나 답글할 수 없습니다.",
@@ -10160,7 +10173,8 @@
               "pending": "Syncing…",
               "branch": "Sync Branch"
             },
-            "7e4b2a19c0": "답글을 게시할 GitHub PR을 확인하지 못했습니다."
+            "7e4b2a19c0": "답글을 게시할 GitHub PR을 확인하지 못했습니다.",
+            "430f1a62d4": "선택한 스레드를 호스트에서 해결하지 못했습니다."
           },
           "CreatePullRequestDialog": {
             "2bc1b4345e": "취소",
@@ -10760,7 +10774,7 @@
                 "actionRequiredHint": "이 검사는 병합 차단이 해제되기 전에 GitHub에서 수동 작업(예: 워크플로 실행 승인)이 필요합니다.",
                 "b3195cba33": "작성자의 봇 지정 해제",
                 "f588b46a6c": "작성자를 봇으로 지정",
-                "checkDetailsLoadFailed": "체크 세부 정보를 불러오지 못했습니다."
+                "e45324fbed": "체크 세부 정보를 불러오지 못했습니다."
               },
               "empty": {
                 "state": {
@@ -10951,7 +10965,7 @@
             "9fffaf17c1": "오른쪽 사이드바 표시/숨기기({{value0}})",
             "b37ff4a89a": "포트",
             "9f83375839": "검사",
-            "6306b48afd": "소스 제어",
+            "6306b48afd": "source-control",
             "ef182dcb12": "검색",
             "fc3095d2ed": "탐색기",
             "aiVaultSessionHistory": "에이전트",
@@ -11493,17 +11507,6 @@
           "yoloPermissionsInfo": "Agent 권한 정보",
           "yoloPermissionsTooltip": "중단을 줄이기 위해 agents 권한 확인을 건너뜁니다."
         },
-        "FeatureSetupChecklist": {
-          "77f74946f5": "Agents는 서로 메시지를 보내고, 작업을 수행하고, 핸드오프를 조정할 수 있습니다.",
-          "399cf885c0": "Agent 오케스트레이션",
-          "c5292c409d": "Agents는 요청 시 앱 창을 검사하고 로컬 앱을 작동할 수 있습니다.",
-          "1ecfb490ac": "컴퓨터 사용",
-          "01426f3a23": "Agents가 사이트를 탐색하고, 페이지를 검사하고, 브라우저 작업을 처리할 수 있습니다.",
-          "ea85d9e628": "Agent 브라우저 사용",
-          "linearTicketsTitle": "Linear agent 스킬",
-          "linearTicketsDescription": "Agents는 연결된 Linear 작업을 사용해 티켓 맥락을 반영한 더 풍부한 인계를 할 수 있습니다.",
-          "linearTicketsSetupSummary": "Linear 워크스페이스에 권장됩니다. Linear 연결 설정에는 영향을 주지 않습니다."
-        },
         "FeatureSetupInlineTerminal": {
           "789b59936e": "Enter를 눌러 명령을 실행하고 요청 시 npx를 확인합니다. 나중에 설정에서 설정할 수도 있습니다.",
           "47fc6cc6dc": "스킬 설정 명령어",
@@ -11589,37 +11592,6 @@
           "9f47f345a4": "오래 걸리지 않을 거예요!",
           "e4726b2d50": "온보딩을 건너뛰시겠습니까?"
         },
-        "OnboardingTourStep": {
-          "3f9586c043": "둘러보기",
-          "60c5576353": "투어 종료"
-        },
-        "RepoStep": {
-          "e8fdb36338": "repos를 스캔하는 중입니다. 중지하려면 클릭하세요.",
-          "b7c4da0504": "SSH? 설정에서 호스트를 설정하세요",
-          "c33b190ca3": "호스트 경로만",
-          "7b679207e4": "워크스페이스",
-          "24c7c8696c": "서버 경로로 복제",
-          "7932e95f68": "클론",
-          "955134915e": "git@github.com:org/repo.git",
-          "288d8444b7": "HTTPS 또는 SSH URL을 붙여넣습니다.",
-          "132425a3e3": "repo 복제",
-          "6558d50c69": "한 번에 여러 repos를 가져오고 싶으신가요? 상위 폴더를 선택하세요.",
-          "831524961f": "로컬 디렉터리(git repo 여부)를 선택하세요.",
-          "f4e9c8dcf8": "폴더 찾아보기",
-          "e8214aa632": "폴더로 열기",
-          "3863747c56": "Git 프로젝트 추가",
-          "2ebbc26343": "/home/user/project",
-          "466108ab89": "선택한 호스트에 존재하는 경로를 입력하세요.",
-          "8cab104e3c": "서버 프로젝트 열기",
-          "2d20200346": "repos 가져오기",
-          "27ca610db1": "뒤로",
-          "cecd6593fa": "스캔한 폴더:",
-          "c7af322fc3": "스캔 중지",
-          "c3d9d44ca2": "스캔 중지",
-          "cf23006ba7": "선택한 호스트",
-          "7ec3f48820": "/home/user",
-          "2e6438dd34": "{{value0}}이 폴더에서 {{value1}} {{value2}}을(를) 찾았습니다."
-        },
         "ThemeStep": {
           "a4b254779d": "macOS 옵션 키",
           "6c51398942": "마우스",
@@ -11647,15 +11619,10 @@
         "use": {
           "onboarding": {
             "flow": {
-              "dce4bdce5b": "SSH 설정을 열 수 없습니다.",
-              "fd74e7558e": "복제 실패",
               "52acfbef51": "진행 상황을 저장할 수 없습니다."
             }
           }
         },
-        "AgentFeatureSetupStep": {
-          "97dcdc010f": "기능 활성화"
-        },
         "WindowsTerminalStep": {
           "powerShell": "PowerShell",
           "powerShellPwsh": "사용할 수 있으면 PowerShell 7+를 사용하고, 없으면 Windows PowerShell을 사용합니다.",
@@ -11756,10 +11723,6 @@
             "jiraSelectBindFailed": "Couldn’t link this Jira issue. Pick the matching site or reconnect Jira, then try again.",
             "emoji": "Emoji"
           },
-          "ProjectHostSetupCombobox": {
-            "empty": "이 프로젝트에 준비된 호스트가 없습니다.",
-            "placeholder": "호스트 선택"
-          },
           "ProjectCombobox": {
             "empty": "검색과 일치하는 프로젝트가 없습니다.",
             "addProject": "새 프로젝트 추가",
@@ -12135,43 +12098,6 @@
             "cda56c5915": "메모 / launch-plan.md",
             "e16479c1c5": "[data-slash-menu] [data-slash-row].slash-active { background: rgba(24,24,27,0.07); box-shadow: inset 0 0 0 1px rgba(24,24,27,0.06); } [data-md-active-line][data-role=\"active\"] { color: rgb(113 113 122); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12.5px; } [data-md-active-line][data-role=\"h1\"] { color: inherit; font-family: inherit; font-size: 18px; font-weight: 700; letter-spacing: -0.01em; line-height: 1.2; margin-top: 6px; } [data-md-caret] { display: inline-block; width: 1.5px; height: 1em; background: currentColor; vertical-align: -2px; margin-left: 1px; animation: md-caret-blink 1.05s steps(1) infinite; } @keyframes md-caret-blink { 0%, 50% { opacity: 1 } 51%, 100% { opacity: 0 } } @keyframes md-block-in { from { opacity: 0; transform: translateY(-2px); } to { opacity: 1; transform: none; } } @keyframes md-cursor-ripple { 0% { transform: scale(0.4); opacity: 0.9; } 100% { transform: scale(1.4); opacity: 0; } } [data-clicking=\"1\"] [data-cursor-ripple] { animation: md-cursor-ripple 460ms ease-out forwards; }"
           },
-          "FeatureTourPreview": {
-            "1170621527": ">",
-            "304ad0dfc1": "생각 중...",
-            "ef8b164dd1": "src/auth 리뷰",
-            "952d3ddd9a": "세션이 시작되었습니다",
-            "771d8881c2": "claude",
-            "6ed43cb0e0": "dashboard.spec.ts",
-            "24fedd5a52": "login.spec.ts",
-            "8279e9d95b": "12개 테스트 실행",
-            "6218a9014d": "pnpm playwright test",
-            "04d54d50ec": "orca · zsh",
-            "1aa8a9a24a": "분할 가능한 terminal",
-            "2a7cfc82c8": "GH #1842와 연결됨",
-            "3822d8d14b": "fix/worktree-picker-truncates",
-            "d54aefe09e": "LIN-329",
-            "40bbd92ef4": "시작",
-            "c1f28c03b2": "작업 트리 선택 도구가 잘립니다.",
-            "fc0cc0b267": "GH #1842",
-            "0688842445": "GH #1799",
-            "bee6b4088d": "GitHub 및 Linear 작업",
-            "5171768676": "agents 3개 조율",
-            "cebc7769cd": "인증 흐름 재설계",
-            "e44269e97d": "Agent 오케스트레이션",
-            "ec4a73f5e6": "PR 3/3",
-            "cfdfd4d6b4": "PR 2/3",
-            "b1f17bcc74": "PR 1/3",
-            "e38112b289": "청구 웹훅 리팩터링",
-            "9c812e0d7c": "CI 파이프라인 속도 향상",
-            "3c4adfd821": "로그인 경쟁 조건 수정",
-            "56a0271428": "격리된 워크스페이스",
-            "ef737dcee1": "GitHub 및 Linear 작업",
-            "ac51c061e2": "codex",
-            "47f16ecf34": "여러 작업을 동시에 진행하세요. 각 워크스페이스는 브랜치, terminal, agent 활동을 함께 보관합니다.",
-            "70aa182266": "목표를 넘겨두고 자리를 비우세요. 코디네이터 agent가 작업을 나누어 병렬 PR을 만듭니다.",
-            "f10c14dd9d": "탭을 오갈 필요 없이 GitHub 또는 Linear 백로그에서 선택하고 한 번의 클릭으로 워크스페이스를 시작하세요.",
-            "5d6ee181b6": "워크스페이스를 열어 terminal로 돌아가고, 테스트와 로그, agents 용으로 패널을 나누세요."
-          },
           "FeatureWallBody": {
             "25ec5356d6": "설정"
           },
@@ -12198,7 +12124,7 @@
             "00078a6134": "설정에서 보기",
             "14327073cc": "저장",
             "88469e926b": "설정 스크립트",
-            "5c5b65044e": "pnpm 설치",
+            "5c5b65044e": "pnpm install",
             "a7463915b6": "설정 스크립트를 저장하지 못했습니다.",
             "6299297dac": "설정 스크립트가 저장되었습니다.",
             "f0bbf7da77": "사용해 보세요",
@@ -12415,11 +12341,6 @@
               }
             }
           },
-          "FeatureTourWorkspaceCard": {
-            "a23ed9da7f": "codex",
-            "2f33dc932b": "claude",
-            "9220794f6a": "작업 중"
-          },
           "ReviewAnimatedVisual": {
             "8df4d52b68": "pr-view",
             "8ab622e4d6": "메모"
@@ -12697,7 +12618,7 @@
           "19c45cfdc0": "모두 확장",
           "982d14bfa5": "commit 되지 않은 Diff 열기",
           "3d909843bb": "브랜치 diff 열기",
-          "8368d256ec": "결합 브랜치",
+          "8368d256ec": "combined-branch",
           "8f68ad9ca9": "{{value0}} AI {{value1}} 표시",
           "724a13568d": "{{value0}}에서",
           "6094135eec": "대 {{value0}}",
@@ -12889,7 +12810,7 @@
           "8f4d2c1a9b": "목차 크기 조절"
         },
         "MarkdownTemplatePicker": {
-          "22cd94426f": "제목없음.md",
+          "22cd94426f": "untitled.md",
           "6e2e6c04ad": "빈 Markdown",
           "df667919ca": "일치하는 템플릿이 없습니다.",
           "22fd4890ad": "템플릿 검색...",
@@ -13737,9 +13658,7 @@
           "33741dd973": "실행으로 돌아가기"
         },
         "AutomationSchedulePicker": {
-          "22359b186a": "오전 또는 오후",
           "9e677335b0": "분",
-          "6b802ecc99": "시간",
           "d90981f766": "시간",
           "6b914c5fbb": "요일",
           "233b8c94b6": "반복 주기",
@@ -13749,6 +13668,11 @@
           "837d902bba": "매주",
           "ddba78647e": "사용자 지정 cron"
         },
+        "AutomationTimeField": {
+          "39ec1383f6": "오전 또는 오후",
+          "32a5e4e35e": "분",
+          "aa593eb5e2": "시간"
+        },
         "AutomationSessionField": {
           "f3c76dce51": "재사용",
           "c90888ee94": "새로 시작",
@@ -13827,7 +13751,27 @@
           "a21f6c33ad": "자동화 소스를 새로 고쳤습니다.",
           "53f06f0ad5": "소스 다시 시도",
           "pendingAutomationMissing": "자동화를 더 이상 사용할 수 없습니다.",
-          "pendingAutomationRunMissing": "실행 기록을 더 이상 사용할 수 없습니다."
+          "pendingAutomationRunMissing": "실행 기록을 더 이상 사용할 수 없습니다.",
+          "noSearchMatches": "검색과 일치하는 자동화가 없습니다.",
+          "paused": "일시 중지됨",
+          "runCount": "실행 {{count}}회",
+          "runCount_one": "실행 {{count}}회",
+          "runCount_other": "실행 {{count}}회",
+          "projectDefaultBaseRef": "프로젝트 기본값",
+          "createFromBaseRef": "{{baseRef}}에서 만들기",
+          "missingWorkspace": "워크스페이스 없음",
+          "runUsageSummary": "약 {{cost}} · {{tokens}} tokens",
+          "usageUnavailable": "사용량을 사용할 수 없음",
+          "noRunUsageYet": "아직 실행 사용량 없음",
+          "noWorkspace": "워크스페이스 없음",
+          "latestSavedOutput": "최근 저장된 출력",
+          "backToList": "모든 자동화",
+          "tableName": "이름",
+          "tableProject": "프로젝트",
+          "tableStatus": "상태",
+          "tableActions": "작업",
+          "newAutomation": "새 자동화",
+          "rowActions": "자동화 작업"
         },
         "CreateFromPicker": {
           "f061f49e3f": "repo 브랜치 검색...",
@@ -13940,6 +13884,19 @@
           "5a7863909c": "새 워크스페이스마다 설정 실행",
           "18f000ad4e": "고급",
           "874b72195b": "이 자동화가 워크스페이스를 만들 때, 워크트리를 직접 만들 때와 같은 방식으로 준비합니다 — 프로젝트 설정을 실행하고 터미널 탭을 엽니다."
+        },
+        "AutomationsPageSkeleton": {
+          "55527b7bcf": "자동화 로딩 중"
+        },
+        "AutomationListSearchField": {
+          "tooLong": "검색 텍스트가 너무 깁니다 — 목록이 필터링되지 않음",
+          "label": "자동화 검색",
+          "placeholder": "검색...",
+          "tooLongShort": "너무 김",
+          "clear": "검색 지우기"
+        },
+        "AutomationListLocalRows": {
+          "c92c9463c6": "자동화 작업"
         }
       },
       "agent": {
@@ -14192,80 +14149,6 @@
       },
       "orca": {
         "profiles": {
-          "switcher": {
-            "cloud": {
-              "unavailable": "Orca 로그인 사용 불가"
-            },
-            "reconnect": "프로필 다시 연결",
-            "connect": "프로필 연결",
-            "organization": "조직",
-            "create": {
-              "profile": {
-                "for": {
-                  "org": "조직용 프로필 생성"
-                }
-              }
-            },
-            "signout": "로그아웃",
-            "16e3681072": "새 로컬 프로필",
-            "e3b91a3d90": "프로젝트와 워크트리를 분리할 빈 프로필을 만듭니다.",
-            "f322e1f4d6": "프로필 이름",
-            "cfa59f8ad1": "만들고 전환",
-            "b4f9d1125d": "로컬",
-            "4815f7d163": "프로필 전환",
-            "d00d853e2a": "프로필 관리",
-            "c106c674fe": "새 로컬 프로필",
-            "account": "계정",
-            "org": {
-              "members": "조직 구성원"
-            },
-            "signInWaiting": "로그인 대기 중…",
-            "signInAgain": "다시 로그인",
-            "signIn": "Orca에 로그인",
-            "accountTitle": "Orca 계정",
-            "accountSignedIn": "로그인됨",
-            "accountSignInRequired": "로그인 필요",
-            "accountSignedOut": "로그아웃됨"
-          },
-          "management": {
-            "04e7bd2a23": "전송",
-            "128c7dfe64": "복사 대상",
-            "df8b7d876b": "이동 대상",
-            "9aa26347b3": "프로젝트를 이동했습니다",
-            "816ce624b6": "프로젝트를 복사했습니다",
-            "2c45bda8d3": "프로필 관리",
-            "2db945e4a0": "활성 프로필의 프로젝트를 다른 로컬 프로필로 복사하거나 이동합니다.",
-            "8668cb2946": "이 프로필에는 프로젝트가 없습니다.",
-            "93034915ab": "프로젝트를 복사하려면 먼저 다른 프로필을 만드세요.",
-            "projectCountSingular": "{{count}}개의 프로젝트",
-            "projectCountPlural": "{{count}}개의 프로젝트"
-          },
-          "project": {
-            "transfer": {
-              "confirm": {
-                "move": {
-                  "title": "프로젝트를 이동하시겠습니까?",
-                  "description": "{{repoName}}을(를) {{targetName}}(으)로 이동합니다. Orca가 해당 프로젝트를 {{activeProfileName}}에서 제거한 뒤 파일은 유지하고 {{targetName}}(으)로 다시 시작합니다.",
-                  "action": "프로젝트 이동"
-                },
-                "copy": {
-                  "title": "프로젝트를 복사하시겠습니까?",
-                  "description": "{{repoName}}을(를) {{targetName}}(으)로 복사합니다. 두 프로필 모두 동일한 파일을 별도의 Orca 메타데이터와 함께 가리킵니다.",
-                  "action": "프로젝트 복사"
-                },
-                "live": {
-                  "work": "이 프로젝트의 활성 작업"
-                },
-                "cancel": "취소",
-                "terminalSingular": "활성 터미널 탭 {{count}}개",
-                "terminalPlural": "활성 터미널 탭 {{count}}개",
-                "agentSingular": "활성 에이전트 {{count}}개",
-                "agentPlural": "활성 에이전트 {{count}}개",
-                "browserSingular": "브라우저 작업 공간 {{count}}개",
-                "browserPlural": "브라우저 작업 공간 {{count}}개"
-              }
-            }
-          },
           "signout": {
             "confirm": {
               "title": "Orca에서 로그아웃할까요?",
@@ -14273,79 +14156,6 @@
               "cancel": "취소",
               "action": "로그아웃"
             }
-          },
-          "switch": {
-            "confirm": {
-              "target": "선택된 프로필",
-              "title": "프로필을 전환하시겠습니까?",
-              "description": "{{targetName}}(으)로 전환하면 Orca가 다시 시작되고 {{activeProfileName}}의 작업 공간이 다시 로드됩니다.",
-              "live": {
-                "work": "이 프로필의 활성 작업"
-              },
-              "cancel": "취소",
-              "switch": "프로필 전환",
-              "terminalSingular": "활성 터미널 탭 {{count}}개",
-              "terminalPlural": "활성 터미널 탭 {{count}}개",
-              "agentSingular": "활성 에이전트 {{count}}개",
-              "agentPlural": "활성 에이전트 {{count}}개",
-              "browserSingular": "브라우저 작업 공간 {{count}}개",
-              "browserPlural": "브라우저 작업 공간 {{count}}개"
-            }
-          },
-          "org": {
-            "members": {
-              "role": {
-                "label": "역할",
-                "owner": "소유자",
-                "admin": "관리자",
-                "member": "구성원"
-              },
-              "not": {
-                "signed": {
-                  "in": "아직 Orca에 로그인하지 않았습니다."
-                }
-              },
-              "remove": {
-                "confirm": "제거",
-                "cancel": "취소",
-                "label": "팀원 제거"
-              },
-              "title": "조직 구성원",
-              "load": {
-                "error": "조직 구성원을 로드할 수 없습니다."
-              },
-              "retry": "다시 시도",
-              "pending": {
-                "title": "대기 중인 초대",
-                "revoke": "취소"
-              },
-              "invite": {
-                "title": "초대",
-                "placeholder": "teammate@example.com",
-                "role": "초대 역할",
-                "submit": "보내기"
-              },
-              "error": {
-                "forbidden": "이 작업을 수행할 권한이 없습니다.",
-                "conflict": "이미 구성원이거나 초대되었습니다.",
-                "remove": {
-                  "self": "자신을 제거할 수 없습니다."
-                },
-                "own": {
-                  "role": "자신의 역할을 변경할 수 없습니다."
-                },
-                "not": {
-                  "found": "해당 팀원은 이 조직에 없습니다."
-                },
-                "reconnect": "구성원을 관리하려면 프로필을 다시 연결하세요.",
-                "unconfigured": "이 빌드에서 조직 관리를 사용할 수 없습니다.",
-                "failed": "문제가 발생했습니다. 다시 시도해 주세요."
-              },
-              "subtitle": {
-                "named": "{{orgName}}에서 Orca에 협업할 수 있는 사람들.",
-                "default": "조직에서 Orca에 협업할 수 있는 사람들."
-              }
-            }
           }
         }
       },
diff --git a/src/renderer/src/i18n/locales/zh.json b/src/renderer/src/i18n/locales/zh.json
index 62090dd10ea..8fa0cf2b3e1 100644
--- a/src/renderer/src/i18n/locales/zh.json
+++ b/src/renderer/src/i18n/locales/zh.json
@@ -7,6 +7,9 @@
       "webDescription": "重试 Web 客户端或重新连接到配对的运行时。"
     }
   },
+  "githubChecks": {
+    "retrying": "正在重试..."
+  },
   "settings": {
     "appearance": {
       "language": {
@@ -547,7 +550,7 @@
             "notification": {
               "b0536028c9": "打开快捷键",
               "141ad6c004": "处理终端快捷方式",
-              "0ab0cd001a": "大小 4 文本静音前景"
+              "0ab0cd001a": "size-4 text-muted-foreground"
             }
           }
         }
@@ -560,6 +563,14 @@
               "64555d0014": "未找到基础分支"
             }
           }
+        },
+        "browser": {
+          "tab": {
+            "open": {
+              "urlFailed": "无法打开网址。",
+              "searchFailed": "无法使用 {{value0}} 搜索。"
+            }
+          }
         }
       },
       "worktree": {
@@ -2212,7 +2223,7 @@
         "IssueSourceSelector": {
           "d6aeb2012b": "显示议题来自",
           "787c970baf": "议题来源",
-          "643d7e9496": "上游",
+          "643d7e9496": "upstream",
           "51d1608920": "origin",
           "cdc9bd64fa": "紧凑",
           "30b2c9df91": "上游"
@@ -2616,15 +2627,6 @@
         },
         "sheet": {
           "1189e9fe0a": "关闭"
-        },
-        "team": {
-          "multi": {
-            "combobox": {
-              "de83523bf9": "没有团队符合您的搜索。",
-              "301f2a796e": "所有团队",
-              "18ec58881e": "搜索团队..."
-            }
-          }
         }
       },
       "terminal": {
@@ -3009,7 +3011,9 @@
             "2c38630a01": "工作区已不存在",
             "4f0d9a71c2": "标签页已不存在",
             "d7d496a451": "浏览器页面已不存在",
-            "7726ce9970": "移动模拟器标签页已不存在"
+            "7726ce9970": "移动模拟器标签页已不存在",
+            "chooseAction": "请选择一项操作。",
+            "searchProvider": "使用 {{value0}} 搜索"
           },
           "TabBarQuickCommandsButton": {
             "a2c7a33831": "命令",
@@ -3029,7 +3033,12 @@
             "c781f992e4": "destructive",
             "be8f0ff166": "删除",
             "f3a8c2d1e7": "搜索快捷命令...",
-            "b4e7f9a2c1": "没有匹配的命令"
+            "b4e7f9a2c1": "没有匹配的命令",
+            "8d525e5f15": "已复制",
+            "53b17a4b1b": "无法复制",
+            "a9a564b7e7": "复制 {{value0}}",
+            "69a1441a21": "无可复制内容",
+            "192a4616a5": "快捷命令操作"
           },
           "shell": {
             "icons": {
@@ -3827,7 +3836,7 @@
           "c7f9b3f0c1": "关",
           "8b12c0850a": "保存",
           "de8fce5854": "取消",
-          "ddbcaef7be": "src/渲染器包/ui",
+          "ddbcaef7be": "src/renderer packages/ui",
           "0e9ad9c798": "目录",
           "064c1e2d12": "渲染器用户界面",
           "b3a500c623": "名称",
@@ -3984,7 +3993,7 @@
           "e643b30398": "添加了远程项目"
         },
         "AddRepoCreateStep": {
-          "0ae45b8238": "我的项目",
+          "0ae45b8238": "my-project",
           "a8149a3a5a": "名称",
           "11fd2a7db8": "Git 存储库",
           "5e97f0c4b9": "项目已创建",
@@ -5463,7 +5472,7 @@
           "0de9fda203": "放弃",
           "c71770c455": "{basePrompt}",
           "f19a56498d": ";您的分支前缀设置仍然适用。",
-          "800edb1e54": "修复登录流程",
+          "800edb1e54": "fix-login-flow",
           "5d569f5199": "。 Orca 仅生成最后一段，例如",
           "570817d126": "和",
           "56580dcf60": "。您还可以参考",
@@ -5487,7 +5496,7 @@
           "63121132c0": "放弃",
           "4416b25d29": "优先使用任务中的领域名词，避免工单 ID，并保持名称便于评审人理解。",
           "39278f4411": ";您的分支前缀设置仍然适用。",
-          "ebb942a2ec": "修复登录流程",
+          "ebb942a2ec": "fix-login-flow",
           "af2d9a2cc6": "。 Orca 仅生成最后一段，例如",
           "182d419b97": "内置分支名称提示",
           "2f5dc661fe": "附加到 Orca 的",
@@ -5506,7 +5515,7 @@
           "ade9a5bb03": ") 来确定结果范围。",
           "b468f46726": "upstream/main",
           "80f7c82303": "）或完整的参考（例如",
-          "915ad97875": "上游",
+          "915ad97875": "upstream",
           "a5c16712c1": "已检测多个遥控器。输入远程名称（例如",
           "9a14ec7400": "选择下面的一个基础分支",
           "086ce7f369": "跟随主分支 ({{value0}})",
@@ -6057,7 +6066,7 @@
           "a6c2816115": "和",
           "b8a7efb3f6": "ORCA_BITBUCKET_EMAIL",
           "8489c0aa49": "Bitbucket",
-          "e74de656ce": "glab 身份验证登录",
+          "e74de656ce": "glab auth login",
           "05e5245af7": "GitLab CLI 已安装但未经过身份验证。在终端中运行此命令：",
           "a83cac5726": "安装 GitLab CLI",
           "35a3379372": "安装 GitLab CLI 以启用合并请求、议题和管道。",
@@ -6065,7 +6074,7 @@
           "a3326f6f1b": "光亮的",
           "027440e1cb": "通过合并请求、议题、待办事项和管道",
           "513abfe47d": "GitLab",
-          "51000487c4": "gh 验证登录",
+          "51000487c4": "gh auth login",
           "09285e9fe6": "GitHub CLI 已安装但未经过身份验证。在终端中运行此命令：",
           "399cf46867": "安装 GitHub CLI",
           "c0c8575e05": "安装 GitHub CLI 以启用PR、议题和检查。",
@@ -6420,7 +6429,11 @@
           "38d61927e6": "没有保存快捷命令。",
           "44923dd982": "destructive",
           "ec1ed99e70": "删除",
-          "d1d0976320": "没有任何"
+          "d1d0976320": "没有任何",
+          "8d525e5f15": "已复制",
+          "53b17a4b1b": "无法复制",
+          "a9a564b7e7": "复制 {{value0}}",
+          "69a1441a21": "无可复制内容"
         },
         "RecentTabOrderControl": {
           "3b17c81ede": "标签条顺序",
@@ -6431,7 +6444,7 @@
         "RepositoryHooksSection": {
           "af49e2a19e": "该文件存在，但 Orca 找不到有效的“scripts”或“issueCommand”定义。",
           "3397879bee": "并且本地命令存在，选择哪个运行。",
-          "39da2ae12f": "Orca.yaml",
+          "39da2ae12f": "orca.yaml",
           "ac9038d2cc": "当两者",
           "32fec28f5b": "命令源",
           "bbbd6e0bc4": "命令源 & orca.yaml",
@@ -6472,12 +6485,12 @@
           "07ba35bc68": "检查 `scripts:` 下的缩进。钩子键应使用两个空格，命令行应使用四个空格。",
           "787ca433ef": "仅定义支持的键：`scripts`、`setup`、`archive` 和 `issueCommand`。",
           "ecc73d9125": "将你的文件与下面可用的模板进行比较，并在需要时复制该结构。",
-          "925f9e0dc4": "文本前景",
+          "925f9e0dc4": "text-foreground",
           "0cc712b823": "核心配置文件存在于仓库根目录中，但 Orca 尚无法解析支持的钩子定义。",
-          "c90b858573": "文本-​​Amber-700 深色：文本-Amber-300",
+          "c90b858573": "text-amber-700 dark:text-amber-300",
           "aba825233f": "该文件包含此版本的 Orca 无法识别的配置密钥。您可能需要更新 Orca，或检查文件是否有拼写错误。",
           "ca424ff135": "共享挂钩和议题自动化默认值在仓库中定义，可供所有使用它的人使用。",
-          "32f417fe17": "文本-​​emerald-700 深色：文本-emerald-300",
+          "32f417fe17": "text-emerald-700 dark:text-emerald-300",
           "8bfe65fc60": "使用本地命令",
           "8d6c56bff8": "运行两者",
           "0fa21e19ec": "工作区的名称，通常基于分支名称。",
@@ -6998,7 +7011,7 @@
           "a05bc9183f": "保存预设",
           "2d7d45e991": "取消",
           "c240a16f25": "使用仓库相对路径，例如packages/web 或apps/api。",
-          "fde7ff2cc3": "包/网络共享/ui",
+          "fde7ff2cc3": "packages/web shared/ui",
           "caf33029cc": "目录",
           "3b6f1abd3e": "例如仅限网络",
           "a6fcdd9e3c": "名称",
@@ -8287,7 +8300,7 @@
             "compareAgainstUpstreamDescription": "选择源代码管理在比较已提交变更时默认使用的基准。分支上游会自动跟随当前分支；如果没有上游，则回退到仓库默认分支。你仍然可以在对应 worktree 的 Git 面板中按 worktree 更改对比基准。Pull Request 和变基目标不会改变。",
             "compareBase": "对比基准",
             "currentBranch": "当前分支",
-            "upstream": "上游",
+            "upstream": "upstream",
             "localChanges": "本地变更",
             "originMaster": "origin/master",
             "committedChanges": "已提交的更改",
@@ -8413,7 +8426,7 @@
               "ac0a985873": "模拟器技能",
               "9353854ff3": "Orca 模拟器",
               "d4b7833894": "Orca CLI",
-              "84e5706975": "服务SIM卡",
+              "84e5706975": "serve-sim",
               "7c5a8a2bee": "Xcode",
               "bec7231663": "平板电脑",
               "49727355a3": "iPhone",
@@ -8613,7 +8626,7 @@
         "repository": {
           "search": {
             "bc7e504b8e": ".orca/issue-command",
-            "603c68b68c": "Orca.yaml",
+            "603c68b68c": "orca.yaml",
             "9dc60d7f6d": "GitHub",
             "ec70364df2": "工作流程",
             "66b584bd6c": "issue 命令",
@@ -10166,7 +10179,7 @@
             "653c105ecc": "更多 PR 操作",
             "f316a8ca2b": "未选择未解决的评论。",
             "d00ebdc402": "使用 AI 解决 {{value0}} 评论",
-            "ed3f79c031": "启动 agent 前请检查提示词。提示词送达后，Orca 会回复选中的评论，并在可能时解决主机上的讨论串。",
+            "5eb2163b6b": "启动 agent 前请检查提示词。提示词送达后，Orca 会解决选中的主机讨论串，并回复无法解决的评论。",
             "f273f2271c": "已启动智能体。已标记 {{value0}} 个为已解决，回复 {{value1}} 个，跳过 {{value2}} 个，失败 {{value3}} 个。{{value4}}",
             "aa95b81a3a": "已启动智能体。已标记 {{value0}} 个为已解决，回复 {{value1}} 个，跳过 {{value2}} 个，失败 {{value3}} 个。",
             "495b2f8c4b": "已启动智能体，但无法解决或回复选中的评论。",
@@ -10180,7 +10193,8 @@
               "pending": "Syncing…",
               "branch": "Sync Branch"
             },
-            "7e4b2a19c0": "无法确定要回复的 GitHub PR。"
+            "7e4b2a19c0": "无法确定要回复的 GitHub PR。",
+            "430f1a62d4": "无法在主机上解决选中的讨论串。"
           },
           "CreatePullRequestDialog": {
             "2bc1b4345e": "取消",
@@ -10780,7 +10794,7 @@
                 "actionRequiredHint": "此检查需要在 GitHub 上执行手动操作（例如批准工作流运行）后才能解除合并阻止。",
                 "b3195cba33": "取消将作者标记为机器人",
                 "f588b46a6c": "将作者标记为机器人",
-                "checkDetailsLoadFailed": "加载检查详细信息失败。"
+                "e45324fbed": "加载检查详细信息失败。"
               },
               "empty": {
                 "state": {
@@ -10971,7 +10985,7 @@
             "9fffaf17c1": "切换右侧边栏 ({{value0}})",
             "b37ff4a89a": "端口",
             "9f83375839": "检查",
-            "6306b48afd": "源代码控制",
+            "6306b48afd": "source-control",
             "ef182dcb12": "搜索",
             "fc3095d2ed": "资源管理器",
             "aiVaultSessionHistory": "智能体",
@@ -11513,17 +11527,6 @@
           "yoloPermissionsInfo": "智能体权限信息",
           "yoloPermissionsTooltip": "跳过智能体权限检查，减少打断"
         },
-        "FeatureSetupChecklist": {
-          "77f74946f5": "智能体可互相通信、领取任务并协调交接。",
-          "399cf885c0": "智能体编排",
-          "c5292c409d": "按你的要求，智能体可查看应用窗口并操作本地应用。",
-          "1ecfb490ac": "计算机控制",
-          "01426f3a23": "智能体可浏览网站、检查页面并完成浏览器任务。",
-          "ea85d9e628": "智能体浏览器操控",
-          "linearTicketsTitle": "Linear 智能体技能",
-          "linearTicketsDescription": "智能体可使用已链接的 Linear 任务，完成更了解 ticket 背景的交接。",
-          "linearTicketsSetupSummary": "推荐用于 Linear 工作区；不会影响 Linear 连接设置。"
-        },
         "FeatureSetupInlineTerminal": {
           "789b59936e": "按 Enter 运行命令并在询问时确认 npx。您也可以稍后在“设置”中进行设置。",
           "47fc6cc6dc": "技能设置命令",
@@ -11609,37 +11612,6 @@
           "9f47f345a4": "不会花很长时间的！",
           "e4726b2d50": "跳过入门引导？"
         },
-        "OnboardingTourStep": {
-          "3f9586c043": "开始导览",
-          "60c5576353": "退出导览"
-        },
-        "RepoStep": {
-          "e8fdb36338": "扫描存储库。单击停止。",
-          "b7c4da0504": "SSH？在“设置”中设置主机",
-          "c33b190ca3": "仅服务器路径",
-          "7b679207e4": "工作区",
-          "24c7c8696c": "克隆到服务器路径",
-          "7932e95f68": "克隆",
-          "955134915e": "git@github.com:org/repo.git",
-          "288d8444b7": "粘贴 HTTPS 或 SSH URL。",
-          "132425a3e3": "克隆一个仓库",
-          "6558d50c69": "想要一次导入多个仓库？选择父文件夹。",
-          "831524961f": "选择任何本地目录，无论是否为 git 仓库。",
-          "f4e9c8dcf8": "浏览文件夹",
-          "e8214aa632": "作为文件夹打开",
-          "3863747c56": "添加 Git 项目",
-          "2ebbc26343": "/home/user/project",
-          "466108ab89": "输入运行时服务器上存在的路径。",
-          "8cab104e3c": "打开服务器项目",
-          "2d20200346": "导入存储库",
-          "27ca610db1": "返回",
-          "cecd6593fa": "扫描的文件夹：",
-          "c7af322fc3": "停止扫描",
-          "c3d9d44ca2": "停止扫描",
-          "cf23006ba7": "运行时服务器",
-          "7ec3f48820": "/home/user",
-          "2e6438dd34": "{{value0}}在此文件夹中找到{{value1}} {{value2}}。"
-        },
         "ThemeStep": {
           "a4b254779d": "macOS Option 键",
           "6c51398942": "鼠标",
@@ -11667,15 +11639,10 @@
         "use": {
           "onboarding": {
             "flow": {
-              "dce4bdce5b": "无法打开 SSH 设置",
-              "fd74e7558e": "克隆失败",
               "52acfbef51": "无法保存进度"
             }
           }
         },
-        "AgentFeatureSetupStep": {
-          "97dcdc010f": "安装 CLI 和技能"
-        },
         "WindowsTerminalStep": {
           "powerShell": "PowerShell",
           "powerShellPwsh": "在可用时使用 PowerShell 7+，否则回退到 Windows PowerShell。",
@@ -11776,10 +11743,6 @@
             "jiraSelectBindFailed": "无法关联此 Jira 议题。请选择匹配的站点或重新连接 Jira，然后重试。",
             "emoji": "Emoji"
           },
-          "ProjectHostSetupCombobox": {
-            "empty": "此项目没有已就绪的主机。",
-            "placeholder": "选择主机"
-          },
           "ProjectCombobox": {
             "empty": "没有匹配搜索的项目。",
             "addProject": "添加新项目",
@@ -12106,7 +12069,7 @@
             "0f8481e1a7": "发送给 Claude",
             "3d2352f94b": "描述一下变化……",
             "d8856b604a": "div.pricing-grid > div.card.starter:nth-of-type(1) > a.cta",
-            "7da6eed7bf": "本地主机:3000",
+            "7da6eed7bf": "localhost:3000",
             "0a2bd01c02": "新浏览器选项卡",
             "04096318ab": "终端 1",
             "eb88125c6f": "✓ 已验证 — 免费试用仍然有效。",
@@ -12155,43 +12118,6 @@
             "cda56c5915": "笔记/launch-plan.md",
             "e16479c1c5": "[data-slash-menu] [data-slash-row].slash-active { background: rgba(24,24,27,0.07); box-shadow: inset 0 0 0 1px rgba(24,24,27,0.06); } [data-md-active-line][data-role=\"active\"] { color: rgb(113 113 122); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12.5px; } [data-md-active-line][data-role=\"h1\"] { color: inherit; font-family: inherit; font-size: 18px; font-weight: 700; letter-spacing: -0.01em; line-height: 1.2; margin-top: 6px; } [data-md-caret] { display: inline-block; width: 1.5px; height: 1em; background: currentColor; vertical-align: -2px; margin-left: 1px; animation: md-caret-blink 1.05s steps(1) infinite; } @keyframes md-caret-blink { 0%, 50% { opacity: 1 } 51%, 100% { opacity: 0 } } @keyframes md-block-in { from { opacity: 0; transform: translateY(-2px); } to { opacity: 1; transform: none; } } @keyframes md-cursor-ripple { 0% { transform: scale(0.4); opacity: 0.9; } 100% { transform: scale(1.4); opacity: 0; } } [data-clicking=\"1\"] [data-cursor-ripple] { animation: md-cursor-ripple 460ms ease-out forwards; }"
           },
-          "FeatureTourPreview": {
-            "1170621527": ">",
-            "304ad0dfc1": "思维...",
-            "ef8b164dd1": "审查 src/auth",
-            "952d3ddd9a": "会话开始",
-            "771d8881c2": "claude",
-            "6ed43cb0e0": "仪表板规格.ts",
-            "24fedd5a52": "登录规范",
-            "8279e9d95b": "运行 12 项测试",
-            "6218a9014d": "pnpm剧作家测试",
-            "04d54d50ec": "Orca·zsh",
-            "1aa8a9a24a": "可拆分终端",
-            "2a7cfc82c8": "链接到 GH #1842",
-            "3822d8d14b": "修复/worktree-picker-截断",
-            "d54aefe09e": "林-329",
-            "40bbd92ef4": "开始",
-            "c1f28c03b2": "工作树选择器截断",
-            "fc0cc0b267": "GH #1842",
-            "0688842445": "GH#1799",
-            "bee6b4088d": "GitHub 和 Linear 任务",
-            "5171768676": "协调3个智能体",
-            "cebc7769cd": "重新设计身份验证流程",
-            "e44269e97d": "智能体编排",
-            "ec4a73f5e6": "PR 3/3",
-            "cfdfd4d6b4": "PR 2/3",
-            "b1f17bcc74": "PR 1/3",
-            "e38112b289": "重构计费 Webhook",
-            "9c812e0d7c": "加速 CI 管道",
-            "3c4adfd821": "修复登录竞争条件",
-            "56a0271428": "独立的工作区",
-            "ef737dcee1": "GitHub 和 Linear 任务",
-            "ac51c061e2": "codex",
-            "47f16ecf34": "同时推进多项工作。每个工作区都会把分支、终端和智能体活动放在一起。",
-            "70aa182266": "交给一个目标后就可以离开。协调智能体会分发工作并并行交付 PR。",
-            "f10c14dd9d": "跳过来回切换标签页。从 GitHub 或 Linear 待办中挑选任务，一键启动工作区。",
-            "5d6ee181b6": "打开任意工作区即可回到它的终端，然后拆分窗格运行测试、日志和智能体。"
-          },
           "FeatureWallBody": {
             "25ec5356d6": "设置"
           },
@@ -12308,9 +12234,9 @@
             "623881d72e": "checkout.spec.ts",
             "5c5cbd783f": "（1.2秒）",
             "3261c6853b": "› 可以登录",
-            "defe550fe2": "登录规范",
+            "defe550fe2": "login.spec.ts",
             "0b20782e0f": "使用 4 名工作人员运行 12 项测试",
-            "4371cc9931": "pnpm剧作家测试",
+            "4371cc9931": "pnpm playwright test",
             "16877e038d": "向下拆分",
             "a2b114dad0": "向右拆分 ·",
             "0bc9ad0cd1": "同一窗格：",
@@ -12435,13 +12361,8 @@
               }
             }
           },
-          "FeatureTourWorkspaceCard": {
-            "a23ed9da7f": "codex",
-            "2f33dc932b": "claude",
-            "9220794f6a": "处理中"
-          },
           "ReviewAnimatedVisual": {
-            "8df4d52b68": "PR视图",
+            "8df4d52b68": "pr-view",
             "8ab622e4d6": "笔记"
           },
           "FeatureWallBrowserAction": {
@@ -12717,7 +12638,7 @@
           "19c45cfdc0": "全部展开",
           "982d14bfa5": "打开未提交的差异",
           "3d909843bb": "打开分支差异",
-          "8368d256ec": "组合分支",
+          "8368d256ec": "combined-branch",
           "8f68ad9ca9": "显示 {{value0}} AI {{value1}}",
           "724a13568d": "在 {{value0}}",
           "6094135eec": "与 {{value0}}",
@@ -12852,7 +12773,7 @@
           "10ed04a685": "笔记本单元在本机上从笔记本文件夹执行本地 Python。仅运行您信任的文件中的单元。",
           "9e06ae5d36": "运行笔记本代码？",
           "d6f37a640b": "空笔记本",
-          "8c3b21369a": "nb格式",
+          "8c3b21369a": "nbformat",
           "329764e9fc": "BETA",
           "15ec40a735": "保存笔记本",
           "07e7d96612": "细胞",
@@ -12909,7 +12830,7 @@
           "8f4d2c1a9b": "调整目录大小"
         },
         "MarkdownTemplatePicker": {
-          "22cd94426f": "无标题.md",
+          "22cd94426f": "untitled.md",
           "6e2e6c04ad": "空白 Markdown",
           "df667919ca": "没有匹配的模板。",
           "22fd4890ad": "搜索模板...",
@@ -13746,9 +13667,7 @@
           "33741dd973": "返回执行"
         },
         "AutomationSchedulePicker": {
-          "22359b186a": "上午或下午",
           "9e677335b0": "分钟",
-          "6b802ecc99": "小时",
           "d90981f766": "时间",
           "6b914c5fbb": "天",
           "233b8c94b6": "节奏",
@@ -13758,6 +13677,11 @@
           "837d902bba": "每周",
           "ddba78647e": "自定义 cron"
         },
+        "AutomationTimeField": {
+          "39ec1383f6": "上午或下午",
+          "32a5e4e35e": "分钟",
+          "aa593eb5e2": "小时"
+        },
         "AutomationSessionField": {
           "f3c76dce51": "重复利用",
           "c90888ee94": "新鲜的",
@@ -13836,7 +13760,27 @@
           "a21f6c33ad": "自动化来源已刷新。",
           "53f06f0ad5": "重试来源",
           "pendingAutomationMissing": "自动化已不可用。",
-          "pendingAutomationRunMissing": "运行历史已不可用。"
+          "pendingAutomationRunMissing": "运行历史已不可用。",
+          "noSearchMatches": "没有匹配的自动化。",
+          "paused": "已暂停",
+          "runCount": "{{count}} 次运行",
+          "runCount_one": "{{count}} 次运行",
+          "runCount_other": "{{count}} 次运行",
+          "projectDefaultBaseRef": "项目默认",
+          "createFromBaseRef": "从 {{baseRef}} 创建",
+          "missingWorkspace": "缺少工作区",
+          "runUsageSummary": "约 {{cost}} · {{tokens}} tokens",
+          "usageUnavailable": "用量不可用",
+          "noRunUsageYet": "尚无运行用量",
+          "noWorkspace": "无工作区",
+          "latestSavedOutput": "最近保存的输出",
+          "backToList": "全部自动化",
+          "tableName": "名称",
+          "tableProject": "项目",
+          "tableStatus": "状态",
+          "tableActions": "操作",
+          "newAutomation": "新建自动化",
+          "rowActions": "自动化操作"
         },
         "CreateFromPicker": {
           "f061f49e3f": "搜索仓库分支...",
@@ -13949,6 +13893,19 @@
           "5a7863909c": "为每个新工作区运行设置",
           "18f000ad4e": "高级",
           "874b72195b": "当此自动化创建工作区时，使用与手动创建工作树相同的方式准备——运行项目的设置并打开其终端标签页。"
+        },
+        "AutomationsPageSkeleton": {
+          "55527b7bcf": "正在加载自动化"
+        },
+        "AutomationListSearchField": {
+          "tooLong": "搜索文本过长 — 列表未筛选",
+          "label": "搜索自动化",
+          "placeholder": "搜索...",
+          "tooLongShort": "过长",
+          "clear": "清除搜索"
+        },
+        "AutomationListLocalRows": {
+          "c92c9463c6": "自动化操作"
         }
       },
       "agent": {
@@ -14201,80 +14158,6 @@
       },
       "orca": {
         "profiles": {
-          "switcher": {
-            "cloud": {
-              "unavailable": "Orca 登录不可用"
-            },
-            "reconnect": "重新连接配置文件",
-            "connect": "连接配置文件",
-            "organization": "组织",
-            "create": {
-              "profile": {
-                "for": {
-                  "org": "为组织创建配置文件"
-                }
-              }
-            },
-            "signout": "退出登录",
-            "16e3681072": "新建本地配置文件",
-            "e3b91a3d90": "创建一个空配置文件，用于分开管理项目和工作树。",
-            "f322e1f4d6": "配置文件名称",
-            "cfa59f8ad1": "创建并切换",
-            "b4f9d1125d": "本地",
-            "4815f7d163": "切换配置文件",
-            "d00d853e2a": "管理配置文件",
-            "c106c674fe": "新建本地配置文件",
-            "account": "帐户",
-            "org": {
-              "members": "组织成员"
-            },
-            "signInWaiting": "正在等待登录…",
-            "signInAgain": "重新登录",
-            "signIn": "登录 Orca",
-            "accountTitle": "Orca 帐户",
-            "accountSignedIn": "已登录",
-            "accountSignInRequired": "需要登录",
-            "accountSignedOut": "已退出登录"
-          },
-          "management": {
-            "04e7bd2a23": "转移",
-            "128c7dfe64": "复制到",
-            "df8b7d876b": "移动到",
-            "9aa26347b3": "项目已移动",
-            "816ce624b6": "项目已复制",
-            "2c45bda8d3": "管理配置文件",
-            "2db945e4a0": "将项目从当前配置文件复制或移动到另一个本地配置文件。",
-            "8668cb2946": "此配置文件中没有项目。",
-            "93034915ab": "复制项目前，请先创建另一个配置文件。",
-            "projectCountSingular": "{{count}} 个项目",
-            "projectCountPlural": "{{count}} 个项目"
-          },
-          "project": {
-            "transfer": {
-              "confirm": {
-                "move": {
-                  "title": "移动项目？",
-                  "description": "将 {{repoName}} 移动到 {{targetName}}。Orca 会将其从 {{activeProfileName}} 中移除，保留文件原位，并重新启动进入 {{targetName}}。",
-                  "action": "移动项目"
-                },
-                "copy": {
-                  "title": "复制项目？",
-                  "description": "将 {{repoName}} 复制到 {{targetName}}。两个配置文件将指向相同的文件，但使用各自独立的 Orca 元数据。",
-                  "action": "复制项目"
-                },
-                "live": {
-                  "work": "此项目中正在进行的工作"
-                },
-                "cancel": "取消",
-                "terminalSingular": "{{count}} 个正在运行的终端选项卡",
-                "terminalPlural": "{{count}} 个正在运行的终端选项卡",
-                "agentSingular": "{{count}} 个活动的智能体",
-                "agentPlural": "{{count}} 个活动的智能体",
-                "browserSingular": "{{count}} 个浏览器工作区",
-                "browserPlural": "{{count}} 个浏览器工作区"
-              }
-            }
-          },
           "signout": {
             "confirm": {
               "title": "退出 Orca？",
@@ -14282,79 +14165,6 @@
               "cancel": "取消",
               "action": "退出登录"
             }
-          },
-          "switch": {
-            "confirm": {
-              "target": "所选配置文件",
-              "title": "切换配置文件？",
-              "description": "切换到 {{targetName}} 将重新启动 Orca 并重新加载 {{activeProfileName}} 的工作区。",
-              "live": {
-                "work": "此配置文件中正在进行的工作"
-              },
-              "cancel": "取消",
-              "switch": "切换配置文件",
-              "terminalSingular": "{{count}} 个正在运行的终端选项卡",
-              "terminalPlural": "{{count}} 个正在运行的终端选项卡",
-              "agentSingular": "{{count}} 个活动的智能体",
-              "agentPlural": "{{count}} 个活动的智能体",
-              "browserSingular": "{{count}} 个浏览器工作区",
-              "browserPlural": "{{count}} 个浏览器工作区"
-            }
-          },
-          "org": {
-            "members": {
-              "role": {
-                "label": "角色",
-                "owner": "所有者",
-                "admin": "管理员",
-                "member": "成员"
-              },
-              "not": {
-                "signed": {
-                  "in": "他们尚未登录 Orca。"
-                }
-              },
-              "remove": {
-                "confirm": "移除",
-                "cancel": "取消",
-                "label": "移除成员"
-              },
-              "title": "组织成员",
-              "load": {
-                "error": "无法加载组织成员。"
-              },
-              "retry": "重试",
-              "pending": {
-                "title": "待处理的邀请",
-                "revoke": "撤销"
-              },
-              "invite": {
-                "title": "邀请",
-                "placeholder": "teammate@example.com",
-                "role": "邀请角色",
-                "submit": "发送"
-              },
-              "error": {
-                "forbidden": "你的角色无法执行此操作。",
-                "conflict": "已是成员或已被邀请。",
-                "remove": {
-                  "self": "无法移除你自己。"
-                },
-                "own": {
-                  "role": "无法更改你自己的角色。"
-                },
-                "not": {
-                  "found": "该成员已不在此组织中。"
-                },
-                "reconnect": "请重新连接你的配置文件以管理成员。",
-                "unconfigured": "此版本不支持组织管理。",
-                "failed": "出现问题。请重试。"
-              },
-              "subtitle": {
-                "named": "{{orgName}} 中可以协作使用 Orca 的成员。",
-                "default": "你的组织中可以协作使用 Orca 的成员。"
-              }
-            }
           }
         }
       },
diff --git a/src/renderer/src/i18n/technical-literal-catalog-values.test.ts b/src/renderer/src/i18n/technical-literal-catalog-values.test.ts
new file mode 100644
index 00000000000..5cf9963175b
--- /dev/null
+++ b/src/renderer/src/i18n/technical-literal-catalog-values.test.ts
@@ -0,0 +1,73 @@
+import { describe, expect, it } from 'vitest'
+
+import en from './locales/en.json'
+import es from './locales/es.json'
+import ko from './locales/ko.json'
+import zh from './locales/zh.json'
+
+const repairedEntries = [
+  ['es', 'auto.components.sidebar.AddRepoCreateStep.0ae45b8238'],
+  ['es', 'auto.components.settings.IntegrationsPane.e74de656ce'],
+  ['es', 'auto.components.settings.IntegrationsPane.51000487c4'],
+  ['es', 'auto.components.settings.RepositoryHooksSection.925f9e0dc4'],
+  ['es', 'auto.components.settings.RepositoryHooksSection.c90b858573'],
+  ['es', 'auto.components.settings.RepositoryHooksSection.32f417fe17'],
+  ['es', 'auto.components.settings.RepositoryIconPicker.03ca1a4e9b'],
+  ['es', 'auto.components.right.sidebar.index.6306b48afd'],
+  ['es', 'auto.components.feature.wall.ReviewAnimatedVisual.8df4d52b68'],
+  ['es', 'auto.components.editor.CombinedDiffViewer.8368d256ec'],
+  ['es', 'auto.components.editor.MarkdownTemplatePicker.22cd94426f'],
+  ['ko', 'auto.components.terminal.pane.stale.agent.row.090d607412'],
+  ['ko', 'auto.components.settings.IntegrationsPane.51000487c4'],
+  ['ko', 'auto.components.settings.git.search.upstream'],
+  ['ko', 'auto.components.right.sidebar.index.6306b48afd'],
+  ['ko', 'auto.components.feature.wall.FeatureWallSetupWorkflowActions.5c5b65044e'],
+  ['ko', 'auto.components.editor.CombinedDiffViewer.8368d256ec'],
+  ['ko', 'auto.components.editor.MarkdownTemplatePicker.22cd94426f'],
+  ['zh', 'auto.lib.terminal.shortcut.capture.notification.0ab0cd001a'],
+  ['zh', 'auto.components.github.IssueSourceSelector.643d7e9496'],
+  ['zh', 'auto.components.sparse.SparseCheckoutPresetSelect.ddbcaef7be'],
+  ['zh', 'auto.components.sidebar.AddRepoCreateStep.0ae45b8238'],
+  ['zh', 'auto.components.settings.AutoRenameBranchFromWorkSetting.800edb1e54'],
+  ['zh', 'auto.components.settings.AutoRenameBranchPromptEditor.ebb942a2ec'],
+  ['zh', 'auto.components.settings.BaseRefPicker.915ad97875'],
+  ['zh', 'auto.components.settings.IntegrationsPane.e74de656ce'],
+  ['zh', 'auto.components.settings.IntegrationsPane.51000487c4'],
+  ['zh', 'auto.components.settings.RepositoryHooksSection.39da2ae12f'],
+  ['zh', 'auto.components.settings.RepositoryHooksSection.925f9e0dc4'],
+  ['zh', 'auto.components.settings.RepositoryHooksSection.c90b858573'],
+  ['zh', 'auto.components.settings.RepositoryHooksSection.32f417fe17'],
+  ['zh', 'auto.components.settings.SparsePresetSettingsSection.fde7ff2cc3'],
+  ['zh', 'auto.components.settings.git.search.upstream'],
+  ['zh', 'auto.components.settings.mobile.emulator.search.84e5706975'],
+  ['zh', 'auto.components.settings.repository.search.603c68b68c'],
+  ['zh', 'auto.components.right.sidebar.index.6306b48afd'],
+  ['zh', 'auto.components.feature.wall.BrowserAnimatedVisual.7da6eed7bf'],
+  ['zh', 'auto.components.feature.wall.WorkbenchAnimatedVisual.defe550fe2'],
+  ['zh', 'auto.components.feature.wall.WorkbenchAnimatedVisual.4371cc9931'],
+  ['zh', 'auto.components.feature.wall.ReviewAnimatedVisual.8df4d52b68'],
+  ['zh', 'auto.components.editor.CombinedDiffViewer.8368d256ec'],
+  ['zh', 'auto.components.editor.IpynbViewer.8c3b21369a'],
+  ['zh', 'auto.components.editor.MarkdownTemplatePicker.22cd94426f']
+] as const
+
+const catalogs = { es, ko, zh } as const
+
+function readValue(catalog: object, key: string): unknown {
+  return key.split('.').reduce<unknown>((value, part) => {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+      return undefined
+    }
+    return (value as Record<string, unknown>)[part]
+  }, catalog)
+}
+
+describe('technical literal catalog repairs (#13121)', () => {
+  it('keeps every repaired value identical to English', () => {
+    expect(repairedEntries).toHaveLength(43)
+
+    for (const [locale, key] of repairedEntries) {
+      expect(readValue(catalogs[locale], key), `${locale}:${key}`).toBe(readValue(en, key))
+    }
+  })
+})
diff --git a/src/renderer/src/lib/agent-draft-paste-content.ts b/src/renderer/src/lib/agent-draft-paste-content.ts
index 9f31770be7e..526e717de27 100644
--- a/src/renderer/src/lib/agent-draft-paste-content.ts
+++ b/src/renderer/src/lib/agent-draft-paste-content.ts
@@ -1,5 +1,9 @@
 import { yieldToEventLoop } from '../../../shared/event-loop-yield'
 import type { GlobalSettings } from '../../../shared/types'
+import {
+  getUtf8ByteLengthForCodePoint,
+  readUtf8CodePointAt
+} from '../../../shared/utf8-byte-limits'
 import {
   BRACKETED_PASTE_END,
   BRACKETED_PASTE_START,
@@ -109,7 +113,7 @@ export function* iterateAgentDraftPasteContentChunks(
   let chunkBytes = 0
 
   for (let index = 0; index < terminalContent.length; index += 1) {
-    const codePoint = terminalContent.codePointAt(index) ?? 0
+    const codePoint = readUtf8CodePointAt(terminalContent, index)
     const codeUnitLength = codePoint > 0xffff ? 2 : 1
     const sanitizedEscape = codePoint === AGENT_DRAFT_PASTE_ESCAPE_CODE_POINT
     const sanitized = sanitizedEscape
@@ -149,7 +153,7 @@ function measureSanitizedUtf8ByteLength(
   let byteLength = 0
   const stopAfterBytes = options.stopAfterBytes
   for (let index = 0; index < content.length; index += 1) {
-    const codePoint = content.codePointAt(index) ?? 0
+    const codePoint = readUtf8CodePointAt(content, index)
     byteLength += getSanitizedUtf8ByteLengthForCodePoint(codePoint)
     if (Number.isFinite(stopAfterBytes) && byteLength > (stopAfterBytes ?? 0)) {
       return { byteLength, exceededLimit: true }
@@ -165,7 +169,7 @@ async function isSanitizedDraftPasteOverLimit(content: string, maxBytes: number)
   let byteLength = 0
   let nextYieldAt = AGENT_DRAFT_PASTE_PREFLIGHT_YIELD_CODE_UNITS
   for (let index = 0; index < content.length; index += 1) {
-    const codePoint = content.codePointAt(index) ?? 0
+    const codePoint = readUtf8CodePointAt(content, index)
     byteLength += getSanitizedUtf8ByteLengthForCodePoint(codePoint)
     if (byteLength > maxBytes) {
       return true
@@ -189,19 +193,6 @@ function getSanitizedUtf8ByteLengthForCodePoint(codePoint: number): number {
   )
 }
 
-function getUtf8ByteLengthForCodePoint(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
-
 async function writeAgentDraftPtyInput(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
diff --git a/src/renderer/src/lib/agent-hibernation-planner.ts b/src/renderer/src/lib/agent-hibernation-planner.ts
index 6920d18ed1e..f5631ffc8ed 100644
--- a/src/renderer/src/lib/agent-hibernation-planner.ts
+++ b/src/renderer/src/lib/agent-hibernation-planner.ts
@@ -267,10 +267,7 @@ export function planAgentHibernationCandidates(
     }
     if (
       runtimeLivenessRequiredWorktreeIds.has(worktreeId) &&
-      !Object.prototype.hasOwnProperty.call(
-        snapshot.runtimeLivePtyIdsByWorktreeId ?? {},
-        worktreeId
-      )
+      !Object.hasOwn(snapshot.runtimeLivePtyIdsByWorktreeId ?? {}, worktreeId)
     ) {
       continue
     }
diff --git a/src/renderer/src/lib/agent-send-title-status.test.ts b/src/renderer/src/lib/agent-send-title-status.test.ts
new file mode 100644
index 00000000000..befa6e33cb1
--- /dev/null
+++ b/src/renderer/src/lib/agent-send-title-status.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest'
+import { detectAgentSendTitleStatus } from './agent-send-title-status'
+
+describe('detectAgentSendTitleStatus', () => {
+  it.each([
+    'OC | Native session',
+    'OC | ✦ Gemini CLI',
+    'OC | ✋ review Gemini permission handling',
+    'ssh build-host | OC | Native session',
+    'user@host: ~/code | OC | Native session',
+    '▣ OC | Native session',
+    'OC |   Native session',
+    'OC |\tNative session'
+  ])('accepts OpenCode native idle title %j', (title) => {
+    expect(detectAgentSendTitleStatus(title)).toBe('idle')
+  })
+
+  it('preserves spinner working state for OpenCode', () => {
+    expect(detectAgentSendTitleStatus('⠋ OC | Native session')).toBe('working')
+    expect(detectAgentSendTitleStatus('ssh build-host | ⠋ OC | Native session')).toBe('working')
+  })
+
+  it.each(['OC |', 'OC |Native session', 'oc | Native session', 'OCTOPUS | Native session'])(
+    'rejects incomplete or lookalike OpenCode title %j',
+    (title) => {
+      expect(detectAgentSendTitleStatus(title)).toBeNull()
+    }
+  )
+
+  it('preserves non-OpenCode title behavior', () => {
+    expect(detectAgentSendTitleStatus('✦ Gemini CLI')).toBe('working')
+    expect(detectAgentSendTitleStatus('Codex ready')).toBe('idle')
+    expect(detectAgentSendTitleStatus('zsh')).toBeNull()
+  })
+})
diff --git a/src/renderer/src/lib/agent-send-title-status.ts b/src/renderer/src/lib/agent-send-title-status.ts
index 9ae50293693..4e03d70b174 100644
--- a/src/renderer/src/lib/agent-send-title-status.ts
+++ b/src/renderer/src/lib/agent-send-title-status.ts
@@ -1,4 +1,5 @@
 import type { AgentStatus } from './agent-status'
+import { isOpenCodeNativeTitle } from '../../../shared/opencode-terminal-title'
 import { classifyTitleActivity, resolveTitleActivityLabel } from '@/lib/pane-agent-evidence'
 
 const EXPLICIT_IDLE_SEND_TITLE_RE = /(^|\s)(ready|idle|done)(\s|$|[.!?])/i
@@ -24,6 +25,9 @@ export function detectAgentSendTitleStatus(title: string | null | undefined): Ag
 function isExplicitIdleSendTitle(title: string): boolean {
   return (
     EXPLICIT_IDLE_SEND_TITLE_RE.test(title) ||
+    // Why: this title-level filter exposes hookless OpenCode targets; the runtime
+    // still requires launch or foreground-process evidence before writing.
+    isOpenCodeNativeTitle(title) ||
     title.startsWith(CLAUDE_IDLE_PREFIX) ||
     title.startsWith('* ') ||
     title.includes(GEMINI_IDLE_PREFIX) ||
diff --git a/src/renderer/src/lib/agent-status.ts b/src/renderer/src/lib/agent-status.ts
index e49e3c002fa..11d966cb8bf 100644
--- a/src/renderer/src/lib/agent-status.ts
+++ b/src/renderer/src/lib/agent-status.ts
@@ -139,9 +139,7 @@ export function agentTypeToIconAgent(agentType: AgentType | null | undefined): T
   if (!agentType || agentType === 'unknown') {
     return null
   }
-  return Object.prototype.hasOwnProperty.call(ICONABLE_AGENT_TYPES, agentType)
-    ? (agentType as TuiAgent)
-    : null
+  return Object.hasOwn(ICONABLE_AGENT_TYPES, agentType) ? (agentType as TuiAgent) : null
 }
 
 // Why: shared resolver so all send paths stamp identical agent_kind on agent_prompt_sent telemetry.
diff --git a/src/renderer/src/lib/ai-vault-resume-command.ts b/src/renderer/src/lib/ai-vault-resume-command.ts
index e8d05f61140..92e826f83a9 100644
--- a/src/renderer/src/lib/ai-vault-resume-command.ts
+++ b/src/renderer/src/lib/ai-vault-resume-command.ts
@@ -241,10 +241,32 @@ function resolveAiVaultResumeShell(args: AiVaultResumeWorktreeArgs): AgentStartu
     state: args.state,
     worktreeId: args.worktreeId,
     platform,
-    isLocalSession
+    isLocalSession,
+    parsedByClientLoginShell: isLocalSession && runsOnClientLoginShell(args, platform)
   })
 }
 
+/**
+ * Whether the resume line is handed to THIS machine's login shell.
+ *
+ * Why not `isLocalSession`: that only says the session file was scanned locally
+ * (no executionHostId), which is still true when the worktree lives on an SSH
+ * or runtime host — the command then goes to that host's shell. The WSL case is
+ * caught by the platform mismatch (a WSL worktree resolves to 'linux' on win32).
+ */
+function runsOnClientLoginShell(
+  args: AiVaultResumeWorktreeArgs,
+  platform: NodeJS.Platform
+): boolean {
+  const executionHost = parseExecutionHostId(
+    getExecutionHostIdForWorktree(args.state, args.worktreeId ?? args.state.activeWorktreeId)
+  )
+  if (executionHost?.kind === 'ssh' || executionHost?.kind === 'runtime') {
+    return false
+  }
+  return platform === CLIENT_PLATFORM
+}
+
 export function getAiVaultAgentProviderSession(
   session: Pick<AiVaultSession, 'agent' | 'sessionId'> & { filePath?: string }
 ): AgentProviderSessionMetadata | null {
diff --git a/src/renderer/src/lib/ai-vault-resume-shell.test.ts b/src/renderer/src/lib/ai-vault-resume-shell.test.ts
new file mode 100644
index 00000000000..e2ab4b9a173
--- /dev/null
+++ b/src/renderer/src/lib/ai-vault-resume-shell.test.ts
@@ -0,0 +1,150 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { AppState } from '@/store/types'
+
+vi.mock('@/lib/new-workspace', () => ({
+  CLIENT_PLATFORM: 'darwin'
+}))
+
+const clientLoginShell = vi.hoisted(() => ({ value: '' }))
+
+vi.mock('@/lib/client-login-shell', () => ({
+  getClientLoginShell: () => clientLoginShell.value
+}))
+
+import { buildAiVaultResumeCopyCommandForWorktree } from './ai-vault-resume-command'
+import { resolveAiVaultResumeStartupShell } from './ai-vault-resume-shell'
+
+type ResumeShellState = Parameters<typeof buildAiVaultResumeCopyCommandForWorktree>[0]['state']
+
+function makeState(worktreeHostId?: string): ResumeShellState {
+  return {
+    activeRepoId: 'repo-1',
+    activeWorktreeId: 'repo-1::worktree-1',
+    folderWorkspaces: [],
+    projectGroups: [],
+    repos: [{ id: 'repo-1', path: '/home/alice/repo' }],
+    projects: [{ id: 'repo-1', sourceRepoIds: ['repo-1'] }],
+    settings: {
+      agentDefaultArgs: { codex: '' },
+      agentDefaultEnv: { codex: {} }
+    },
+    worktreesByRepo: {
+      'repo-1': [
+        {
+          id: 'repo-1::worktree-1',
+          repoId: 'repo-1',
+          path: '/home/alice/repo',
+          ...(worktreeHostId ? { hostId: worktreeHostId } : {})
+        }
+      ]
+    }
+  } as unknown as AppState
+}
+
+function withLoginShell<T>(shell: string, run: () => T): T {
+  clientLoginShell.value = shell
+  try {
+    return run()
+  } finally {
+    clientLoginShell.value = ''
+  }
+}
+
+describe('resolveAiVaultResumeStartupShell', () => {
+  it('reports the fish dialect for a local session under a fish login shell', () => {
+    expect(
+      withLoginShell('/opt/homebrew/bin/fish', () =>
+        resolveAiVaultResumeStartupShell({
+          state: makeState(),
+          worktreeId: 'repo-1::worktree-1',
+          platform: 'darwin',
+          isLocalSession: true,
+          parsedByClientLoginShell: true
+        })
+      )
+    ).toBe('fish')
+  })
+
+  it('stays on sh for zsh users', () => {
+    expect(
+      withLoginShell('/bin/zsh', () =>
+        resolveAiVaultResumeStartupShell({
+          state: makeState(),
+          worktreeId: 'repo-1::worktree-1',
+          platform: 'darwin',
+          isLocalSession: true,
+          parsedByClientLoginShell: true
+        })
+      )
+    ).toBe('posix')
+  })
+
+  it('stays on sh for a LOCAL session whose command a remote host parses', () => {
+    // The reachable case: a locally scanned session has no executionHostId, so
+    // isLocalSession stays true while the command is bound for an SSH host.
+    expect(
+      withLoginShell('/opt/homebrew/bin/fish', () =>
+        resolveAiVaultResumeStartupShell({
+          state: makeState(),
+          worktreeId: 'repo-1::worktree-1',
+          platform: 'linux',
+          isLocalSession: true,
+          parsedByClientLoginShell: false
+        })
+      )
+    ).toBe('posix')
+  })
+})
+
+describe('copied real-home Codex resume command', () => {
+  const session = {
+    agent: 'codex' as const,
+    sessionId: 'session one',
+    cwd: '/home/alice/repo',
+    codexHome: null
+  }
+
+  it('clears inherited Codex homes with fish syntax under a fish login shell', () => {
+    expect(
+      withLoginShell('/opt/homebrew/bin/fish', () =>
+        buildAiVaultResumeCopyCommandForWorktree({
+          state: makeState(),
+          worktreeId: 'repo-1::worktree-1',
+          session
+        })
+      )
+    ).toBe(
+      "set -e CODEX_HOME; set -e ORCA_CODEX_HOME; cd '/home/alice/repo' && codex 'resume' 'session one'"
+    )
+  })
+
+  it('keeps `unset` when a fish client targets an SSH worktree', () => {
+    // The session was scanned locally (no executionHostId), but the worktree lives
+    // on an SSH host: `set -e CODEX_HOME` would enable errexit there, not clear it.
+    expect(
+      withLoginShell('/opt/homebrew/bin/fish', () =>
+        buildAiVaultResumeCopyCommandForWorktree({
+          state: makeState('ssh:target-1'),
+          worktreeId: 'repo-1::worktree-1',
+          session
+        })
+      )
+    ).toBe(
+      "unset CODEX_HOME; unset ORCA_CODEX_HOME; cd '/home/alice/repo' && codex 'resume' 'session one'"
+    )
+  })
+
+  it('keeps `unset` for sh-family login shells', () => {
+    expect(
+      withLoginShell('/bin/bash', () =>
+        buildAiVaultResumeCopyCommandForWorktree({
+          state: makeState(),
+          worktreeId: 'repo-1::worktree-1',
+          session
+        })
+      )
+    ).toBe(
+      "unset CODEX_HOME; unset ORCA_CODEX_HOME; cd '/home/alice/repo' && codex 'resume' 'session one'"
+    )
+  })
+})
diff --git a/src/renderer/src/lib/ai-vault-resume-shell.ts b/src/renderer/src/lib/ai-vault-resume-shell.ts
index d1ab726484e..9b6214fb247 100644
--- a/src/renderer/src/lib/ai-vault-resume-shell.ts
+++ b/src/renderer/src/lib/ai-vault-resume-shell.ts
@@ -4,9 +4,11 @@ import { CLIENT_PLATFORM } from '@/lib/new-workspace'
 import { resolveLocalWindowsTerminalShellOverrideForTab } from '../../../shared/local-windows-terminal-runtime'
 import { resolveWindowsShellStartupFamily } from '../../../shared/windows-terminal-shell'
 import {
+  resolveLoginShellStartupDialect,
   resolveStartupShell,
   type AgentStartupShell
 } from '../../../shared/tui-agent-startup-shell'
+import { getClientLoginShell } from '@/lib/client-login-shell'
 import { parseWorkspaceKey } from '../../../shared/workspace-scope'
 import { parseWslUncPath } from '../../../shared/wsl-paths'
 
@@ -26,24 +28,35 @@ export function resolveAiVaultResumeStartupShell(args: {
   worktreeId?: string | null
   platform: NodeJS.Platform
   isLocalSession: boolean
+  /**
+   * True only when this machine's own login shell parses the command. A local
+   * session is NOT enough: a locally scanned session carries no executionHostId
+   * yet can target an SSH/runtime/WSL worktree, whose shell is unrelated.
+   */
+  parsedByClientLoginShell?: boolean
 }): AgentStartupShell {
-  const projectRuntime =
-    args.platform === 'win32' && args.isLocalSession
-      ? getLocalProjectExecutionRuntimeContext(args.state, args.worktreeId, CLIENT_PLATFORM)
-      : undefined
+  // Why: fish rejects `unset`, so the client's login shell decides the dialect —
+  // but only when it is the shell that reads the line; otherwise it stays sh.
+  if (args.platform !== 'win32') {
+    return args.parsedByClientLoginShell
+      ? resolveLoginShellStartupDialect(getClientLoginShell())
+      : 'posix'
+  }
+  const projectRuntime = args.isLocalSession
+    ? getLocalProjectExecutionRuntimeContext(args.state, args.worktreeId, CLIENT_PLATFORM)
+    : undefined
   const workspacePath = getAiVaultResumeWorkspacePath(
     args.state,
     args.worktreeId ?? args.state.activeWorktreeId
   )
-  const shellOverride =
-    args.platform === 'win32' && args.isLocalSession
-      ? resolveLocalWindowsTerminalShellOverrideForTab({
-          explicitShellOverride: undefined,
-          defaultWindowsShell: args.state.settings?.terminalWindowsShell,
-          isWslWorktree: Boolean(workspacePath && parseWslUncPath(workspacePath)),
-          projectRuntime
-        })
-      : undefined
+  const shellOverride = args.isLocalSession
+    ? resolveLocalWindowsTerminalShellOverrideForTab({
+        explicitShellOverride: undefined,
+        defaultWindowsShell: args.state.settings?.terminalWindowsShell,
+        isWslWorktree: Boolean(workspacePath && parseWslUncPath(workspacePath)),
+        projectRuntime
+      })
+    : undefined
   const shell = shellOverride ? resolveWindowsShellStartupFamily(shellOverride) : undefined
   return resolveStartupShell(args.platform, shell)
 }
diff --git a/src/renderer/src/lib/browser-cookie-import-toast.test.ts b/src/renderer/src/lib/browser-cookie-import-toast.test.ts
index a59c7a93f03..40f2800102e 100644
--- a/src/renderer/src/lib/browser-cookie-import-toast.test.ts
+++ b/src/renderer/src/lib/browser-cookie-import-toast.test.ts
@@ -35,7 +35,8 @@ describe('emitBrowserCookieImportToast', () => {
           failedCookies: 3
         }
       },
-      'Imported 3 cookies.'
+      'Imported 3 cookies.',
+      'Local Mac'
     )
 
     expect(warningToastMock).toHaveBeenCalledWith(
@@ -44,29 +45,67 @@ describe('emitBrowserCookieImportToast', () => {
     expect(successToastMock).not.toHaveBeenCalled()
   })
 
-  it('shows the localized partial-failure warning', () => {
-    emitBrowserCookieImportToast(
-      {
-        ...summary,
-        warning: {
-          code: 'restart-fallback-unavailable',
-          loadedCookies: 2,
-          failedCookies: 1
-        }
-      },
-      'Imported 3 cookies.'
-    )
-
-    expect(warningToastMock).toHaveBeenCalledWith(
-      'Imported 2 of 3 cookies. The rest could not be loaded, and the restart fallback was unavailable. Try the import again.'
-    )
-    expect(successToastMock).not.toHaveBeenCalled()
-  })
-
   it('shows success when the import has no warning', () => {
-    emitBrowserCookieImportToast(summary, 'Imported 3 cookies.')
+    emitBrowserCookieImportToast(summary, 'Imported 3 cookies.', 'Local Mac')
 
     expect(successToastMock).toHaveBeenCalledWith('Imported 3 cookies.')
     expect(warningToastMock).not.toHaveBeenCalled()
   })
+
+  it('shows separate host-specific Google guidance after success', () => {
+    emitBrowserCookieImportToast(
+      { ...summary, importedCookies: 2, skippedCookies: 1, googleCookiesSkipped: 1 },
+      'Imported 2 cookies.',
+      'Remote Mac'
+    )
+
+    expect(successToastMock).toHaveBeenCalledWith('Imported 2 cookies.')
+    expect(warningToastMock).toHaveBeenCalledWith(
+      'Google cookies were not imported. Open a browser in Orca on Remote Mac with this profile, then sign into Google.',
+      { duration: 12000 }
+    )
+    expect(successToastMock.mock.invocationCallOrder[0]).toBeLessThan(
+      warningToastMock.mock.invocationCallOrder[0]
+    )
+  })
+
+  it('does not infer a Google warning from generic skipped cookies', () => {
+    emitBrowserCookieImportToast(
+      { ...summary, importedCookies: 2, skippedCookies: 1 },
+      'Imported 2 cookies.',
+      'Local Mac'
+    )
+
+    expect(successToastMock).toHaveBeenCalledWith('Imported 2 cookies.')
+    expect(warningToastMock).not.toHaveBeenCalled()
+  })
+
+  it('keeps both applicable warnings when restart fallback is unavailable', () => {
+    emitBrowserCookieImportToast(
+      {
+        ...summary,
+        importedCookies: 1,
+        skippedCookies: 2,
+        googleCookiesSkipped: 1,
+        warning: {
+          code: 'restart-fallback-unavailable',
+          loadedCookies: 1,
+          failedCookies: 1
+        }
+      },
+      'Imported 1 cookie.',
+      'Remote Mac'
+    )
+
+    expect(successToastMock).not.toHaveBeenCalled()
+    expect(warningToastMock.mock.calls).toEqual([
+      [
+        'Imported 1 of 2 cookies. The rest could not be loaded, and the restart fallback was unavailable. Try the import again.'
+      ],
+      [
+        'Google cookies were not imported. Open a browser in Orca on Remote Mac with this profile, then sign into Google.',
+        { duration: 12000 }
+      ]
+    ])
+  })
 })
diff --git a/src/renderer/src/lib/browser-cookie-import-toast.ts b/src/renderer/src/lib/browser-cookie-import-toast.ts
index 4bdd031f83f..ced4c3cfdbd 100644
--- a/src/renderer/src/lib/browser-cookie-import-toast.ts
+++ b/src/renderer/src/lib/browser-cookie-import-toast.ts
@@ -24,16 +24,35 @@ function formatCookieImportWarning(warning: CookieImportWarning): string {
   }
 }
 
+function emitGoogleCookieImportWarning(
+  summary: BrowserCookieImportSummary,
+  executionHostLabel: string
+): void {
+  if (!summary.googleCookiesSkipped) {
+    return
+  }
+  toast.warning(
+    translate(
+      'auto.lib.browser.cookie.import.toast.googleCookiesSkipped',
+      'Google cookies were not imported. Open a browser in Orca on {{value0}} with this profile, then sign into Google.',
+      { value0: executionHostLabel }
+    ),
+    { duration: 12000 }
+  )
+}
+
 // Why: a degraded import returns ok:true with a warning, so every call site must route it to a
 // warning toast instead of reporting an unqualified success (#9355).
 export function emitBrowserCookieImportToast(
   summary: BrowserCookieImportSummary,
-  successMessage: string
+  successMessage: string,
+  executionHostLabel: string
 ): void {
   const warning = summary.warning
   if (warning) {
     toast.warning(formatCookieImportWarning(warning))
-    return
+  } else {
+    toast.success(successMessage)
   }
-  toast.success(successMessage)
+  emitGoogleCookieImportWarning(summary, executionHostLabel)
 }
diff --git a/src/renderer/src/lib/client-creation-action-policy.test.ts b/src/renderer/src/lib/client-creation-action-policy.test.ts
new file mode 100644
index 00000000000..b0edc2add67
--- /dev/null
+++ b/src/renderer/src/lib/client-creation-action-policy.test.ts
@@ -0,0 +1,210 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
+import type { RuntimeStatus } from '../../../shared/runtime-types'
+import { toRuntimeExecutionHostId, toSshExecutionHostId } from '../../../shared/execution-host'
+import { folderWorkspaceKey } from '../../../shared/workspace-scope'
+import {
+  FLOATING_BROWSER_UNAVAILABLE_MESSAGE,
+  LOCAL_BROWSER_UNAVAILABLE_MESSAGE,
+  MANAGED_BROWSER_UNAVAILABLE_MESSAGE,
+  MOBILE_EMULATOR_UNAVAILABLE_MESSAGE,
+  assertClientCreationActionAvailable,
+  assertManagedBrowserMaterializationAllowed,
+  getClientCreationActionPolicy,
+  resolveClientCreationActionPolicy
+} from './client-creation-action-policy'
+
+function runtimeStatus(capabilities?: string[]): RuntimeStatus {
+  return {
+    runtimeId: 'runtime-1',
+    rendererGraphEpoch: 1,
+    graphStatus: 'ready',
+    authoritativeWindowId: null,
+    liveTabCount: 0,
+    liveLeafCount: 0,
+    hostPlatform: 'darwin',
+    capabilities
+  }
+}
+
+afterEach(() => vi.unstubAllGlobals())
+
+describe('resolveClientCreationActionPolicy', () => {
+  it('preserves Electron creation behavior without negotiated runtime signals', () => {
+    expect(resolveClientCreationActionPolicy({ surface: 'electron', runtimeStatus: null })).toEqual(
+      {
+        'managed-browser': { state: 'enabled', provider: 'local-client' },
+        'mobile-emulator': { state: 'enabled', provider: 'local-client' }
+      }
+    )
+  })
+
+  it('selects the provider that the browser action path can actually consume', () => {
+    const desktopHost = runtimeStatus(['browser.screencast.v1'])
+    const npmHostWithoutDisplay = { ...runtimeStatus(), hostPlatform: 'linux' as const }
+    const npmHostWithDisplay = {
+      ...runtimeStatus(['browser.screencast.v1', 'browser.headless.v1']),
+      hostPlatform: 'linux' as const
+    }
+
+    expect(
+      resolveClientCreationActionPolicy({ surface: 'electron', runtimeStatus: desktopHost })
+    ).toEqual({
+      'managed-browser': { state: 'enabled', provider: 'paired-runtime' },
+      'mobile-emulator': { state: 'enabled', provider: 'local-client' }
+    })
+    expect(
+      resolveClientCreationActionPolicy({
+        surface: 'electron',
+        runtimeStatus: npmHostWithoutDisplay
+      })
+    ).toEqual({
+      'managed-browser': { state: 'enabled', provider: 'local-client' },
+      'mobile-emulator': { state: 'enabled', provider: 'local-client' }
+    })
+    expect(
+      resolveClientCreationActionPolicy({ surface: 'paired-web', runtimeStatus: desktopHost })
+    ).toEqual({
+      'managed-browser': { state: 'enabled', provider: 'paired-runtime' },
+      'mobile-emulator': { state: 'hidden', reason: MOBILE_EMULATOR_UNAVAILABLE_MESSAGE }
+    })
+    expect(
+      resolveClientCreationActionPolicy({
+        surface: 'paired-web',
+        runtimeStatus: npmHostWithoutDisplay
+      })
+    ).toEqual({
+      'managed-browser': { state: 'hidden', reason: MANAGED_BROWSER_UNAVAILABLE_MESSAGE },
+      'mobile-emulator': { state: 'hidden', reason: MOBILE_EMULATOR_UNAVAILABLE_MESSAGE }
+    })
+    expect(
+      resolveClientCreationActionPolicy({
+        surface: 'paired-web',
+        runtimeStatus: npmHostWithDisplay
+      })['managed-browser']
+    ).toEqual({ state: 'enabled', provider: 'paired-runtime' })
+  })
+
+  it('enables paired-web browser creation only with negotiated streaming support', () => {
+    expect(
+      resolveClientCreationActionPolicy({
+        surface: 'paired-web',
+        runtimeStatus: runtimeStatus(['browser.screencast.v1'])
+      })['managed-browser']
+    ).toEqual({ state: 'enabled', provider: 'paired-runtime' })
+
+    expect(
+      resolveClientCreationActionPolicy({
+        surface: 'paired-web',
+        runtimeStatus: runtimeStatus()
+      })['managed-browser']
+    ).toEqual({ state: 'hidden', reason: MANAGED_BROWSER_UNAVAILABLE_MESSAGE })
+  })
+
+  it('hides web-client floating browsers and mobile emulators as impossible surfaces', () => {
+    const policy = resolveClientCreationActionPolicy({
+      surface: 'paired-web',
+      runtimeStatus: runtimeStatus(['browser.screencast.v1', 'mobile.tasks.v1']),
+      floatingWorkspace: true
+    })
+
+    expect(policy['managed-browser']).toEqual({
+      state: 'hidden',
+      reason: FLOATING_BROWSER_UNAVAILABLE_MESSAGE
+    })
+    expect(policy['mobile-emulator']).toEqual({
+      state: 'hidden',
+      reason: MOBILE_EMULATOR_UNAVAILABLE_MESSAGE
+    })
+  })
+})
+
+describe('client creation action guards', () => {
+  it('fails closed for an older paired runtime and rejects local browser materialization', () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const state = {
+      settings: { activeRuntimeEnvironmentId: 'runtime-1' },
+      runtimeStatusByEnvironmentId: new Map([
+        ['runtime-1', { status: runtimeStatus(), checkedAt: 1 }]
+      ])
+    }
+
+    expect(getClientCreationActionPolicy(state as never, null)['managed-browser'].state).toBe(
+      'hidden'
+    )
+    expect(() =>
+      assertClientCreationActionAvailable(state as never, null, 'managed-browser')
+    ).toThrow(MANAGED_BROWSER_UNAVAILABLE_MESSAGE)
+    expect(() => assertManagedBrowserMaterializationAllowed(state as never, null)).toThrow(
+      LOCAL_BROWSER_UNAVAILABLE_MESSAGE
+    )
+  })
+
+  it('permits host-confirmed remote browser materialization in paired web', () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const state = {
+      runtimeStatusByEnvironmentId: new Map([
+        ['runtime-1', { status: runtimeStatus(['browser.screencast.v1']), checkedAt: 1 }]
+      ])
+    }
+    expect(() =>
+      assertManagedBrowserMaterializationAllowed(state as never, 'runtime-1')
+    ).not.toThrow()
+  })
+
+  it('treats the floating workspace as local even with an active capable runtime', () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const state = {
+      settings: { activeRuntimeEnvironmentId: 'runtime-1' },
+      runtimeStatusByEnvironmentId: new Map([
+        ['runtime-1', { status: runtimeStatus(['browser.screencast.v1']), checkedAt: 1 }]
+      ])
+    }
+
+    expect(
+      getClientCreationActionPolicy(state as never, FLOATING_TERMINAL_WORKTREE_ID)[
+        'managed-browser'
+      ]
+    ).toEqual({ state: 'hidden', reason: FLOATING_BROWSER_UNAVAILABLE_MESSAGE })
+  })
+
+  it('uses folder and SSH workspace ownership instead of the focused runtime', () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const capableStatus = runtimeStatus(['browser.screencast.v1'])
+    const state = {
+      settings: { activeRuntimeEnvironmentId: 'focused-runtime' },
+      folderWorkspaces: [
+        {
+          id: 'remote-folder',
+          projectGroupId: 'remote-group',
+          executionHostId: toRuntimeExecutionHostId('folder-owner')
+        }
+      ],
+      projectGroups: [
+        { id: 'remote-group', executionHostId: toRuntimeExecutionHostId('folder-owner') }
+      ],
+      worktreesByRepo: {
+        repo: [
+          {
+            id: 'ssh-worktree',
+            repoId: 'repo',
+            hostId: toSshExecutionHostId('ssh-owner')
+          }
+        ]
+      },
+      runtimeStatusByEnvironmentId: new Map([
+        ['folder-owner', { status: capableStatus, checkedAt: 1 }],
+        ['focused-runtime', { status: capableStatus, checkedAt: 1 }]
+      ])
+    }
+
+    expect(
+      getClientCreationActionPolicy(state as never, folderWorkspaceKey('remote-folder'))[
+        'managed-browser'
+      ]
+    ).toEqual({ state: 'enabled', provider: 'paired-runtime' })
+    expect(
+      getClientCreationActionPolicy(state as never, 'ssh-worktree')['managed-browser']
+    ).toEqual({ state: 'hidden', reason: MANAGED_BROWSER_UNAVAILABLE_MESSAGE })
+  })
+})
diff --git a/src/renderer/src/lib/client-creation-action-policy.ts b/src/renderer/src/lib/client-creation-action-policy.ts
new file mode 100644
index 00000000000..4f4b5388590
--- /dev/null
+++ b/src/renderer/src/lib/client-creation-action-policy.ts
@@ -0,0 +1,116 @@
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
+import { BROWSER_SCREENCAST_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import type { RuntimeStatus } from '../../../shared/runtime-types'
+import type { AppState } from '@/store/types'
+import { isPairedWebClientWindow } from './desktop-window-chrome'
+import { getRuntimeEnvironmentIdForWorktree } from './worktree-runtime-owner'
+
+export const MANAGED_BROWSER_UNAVAILABLE_MESSAGE =
+  "Managed browser tabs are unavailable because this web client's paired runtime does not support browser streaming."
+export const RUNTIME_BROWSER_UNAVAILABLE_MESSAGE =
+  'Managed browser tabs are unavailable because the paired runtime does not support browser streaming.'
+export const FLOATING_BROWSER_UNAVAILABLE_MESSAGE =
+  'Managed browser tabs are unavailable in the web client floating workspace.'
+export const LOCAL_BROWSER_UNAVAILABLE_MESSAGE =
+  'Managed browser tabs in the web client must be created by a capable paired runtime.'
+export const MOBILE_EMULATOR_UNAVAILABLE_MESSAGE =
+  'Mobile Emulator is unavailable in the web client.'
+
+export type ClientCreationAction = 'managed-browser' | 'mobile-emulator'
+export type ClientCreationActionProvider = 'local-client' | 'paired-runtime'
+
+export type ClientCreationActionAvailability =
+  | { state: 'enabled'; provider: ClientCreationActionProvider }
+  | { state: 'hidden'; reason: string }
+
+export type ClientCreationActionPolicy = Record<
+  ClientCreationAction,
+  ClientCreationActionAvailability
+>
+
+export function resolveClientCreationActionPolicy(args: {
+  surface: 'electron' | 'paired-web'
+  runtimeStatus: Pick<RuntimeStatus, 'capabilities' | 'hostPlatform'> | null
+  floatingWorkspace?: boolean
+}): ClientCreationActionPolicy {
+  const browserStreamingAvailable = args.runtimeStatus?.capabilities?.includes(
+    BROWSER_SCREENCAST_RUNTIME_CAPABILITY
+  )
+
+  if (args.surface === 'electron') {
+    return {
+      'managed-browser': {
+        state: 'enabled',
+        provider: browserStreamingAvailable ? 'paired-runtime' : 'local-client'
+      },
+      'mobile-emulator': { state: 'enabled', provider: 'local-client' }
+    }
+  }
+
+  return {
+    'managed-browser': args.floatingWorkspace
+      ? { state: 'hidden', reason: FLOATING_BROWSER_UNAVAILABLE_MESSAGE }
+      : browserStreamingAvailable
+        ? { state: 'enabled', provider: 'paired-runtime' }
+        : { state: 'hidden', reason: MANAGED_BROWSER_UNAVAILABLE_MESSAGE },
+    // The web preload cannot stream emulator frames, even when the host can run emulator tasks.
+    'mobile-emulator': { state: 'hidden', reason: MOBILE_EMULATOR_UNAVAILABLE_MESSAGE }
+  }
+}
+
+export function getClientCreationActionPolicy(
+  state: AppState,
+  worktreeId: string | null
+): ClientCreationActionPolicy {
+  const floatingWorkspace = worktreeId === FLOATING_TERMINAL_WORKTREE_ID
+  const runtimeEnvironmentId = floatingWorkspace
+    ? null
+    : worktreeId
+      ? getRuntimeEnvironmentIdForWorktree(state, worktreeId)
+      : (state.settings?.activeRuntimeEnvironmentId?.trim() ?? null)
+  const runtimeStatus = runtimeEnvironmentId
+    ? (state.runtimeStatusByEnvironmentId?.get(runtimeEnvironmentId)?.status ?? null)
+    : null
+
+  return resolveClientCreationActionPolicy({
+    surface: isPairedWebClientWindow() ? 'paired-web' : 'electron',
+    runtimeStatus,
+    floatingWorkspace
+  })
+}
+
+export function assertClientCreationActionAvailable(
+  state: AppState,
+  worktreeId: string | null,
+  action: ClientCreationAction
+): void {
+  const availability = getClientCreationActionPolicy(state, worktreeId)[action]
+  if (availability.state !== 'enabled') {
+    throw new Error(availability.reason)
+  }
+}
+
+export function assertRuntimeManagedBrowserCreationAvailable(
+  state: AppState,
+  runtimeEnvironmentId: string
+): void {
+  const capabilities =
+    state.runtimeStatusByEnvironmentId?.get(runtimeEnvironmentId)?.status?.capabilities
+  if (!capabilities?.includes(BROWSER_SCREENCAST_RUNTIME_CAPABILITY)) {
+    throw new Error(RUNTIME_BROWSER_UNAVAILABLE_MESSAGE)
+  }
+}
+
+export function assertManagedBrowserMaterializationAllowed(
+  state: AppState,
+  browserRuntimeEnvironmentId: string | null | undefined
+): void {
+  if (!isPairedWebClientWindow()) {
+    return
+  }
+  const runtimeEnvironmentId = browserRuntimeEnvironmentId?.trim()
+  if (!runtimeEnvironmentId) {
+    throw new Error(LOCAL_BROWSER_UNAVAILABLE_MESSAGE)
+  }
+  assertRuntimeManagedBrowserCreationAvailable(state, runtimeEnvironmentId)
+}
diff --git a/src/renderer/src/lib/client-environment-info.ts b/src/renderer/src/lib/client-environment-info.ts
new file mode 100644
index 00000000000..182538503c6
--- /dev/null
+++ b/src/renderer/src/lib/client-environment-info.ts
@@ -0,0 +1,50 @@
+import {
+  formatClientEnvironmentFooter,
+  type ClientEnvironmentInfo
+} from '../../../shared/client-environment-info'
+import { getRendererAppPlatform } from './renderer-app-platform'
+
+/** Resolve trusted desktop env details (or browser best-effort) for bug reports. */
+export async function resolveClientEnvironmentInfo(): Promise<ClientEnvironmentInfo> {
+  const platformInfo = resolvePlatformInfo()
+  const appVersion = await resolveAppVersion()
+  return {
+    appVersion,
+    platform: platformInfo?.platform ?? resolveFallbackPlatform(),
+    osRelease: platformInfo?.osRelease ?? '',
+    arch: platformInfo?.arch ?? '',
+    ...(platformInfo?.shell ? { shell: platformInfo.shell } : {})
+  }
+}
+
+function resolvePlatformInfo(): ReturnType<NonNullable<typeof window.api.platform>['get']> | null {
+  try {
+    return window.api?.platform?.get?.() ?? null
+  } catch {
+    return null
+  }
+}
+
+function resolveFallbackPlatform(): NodeJS.Platform | 'unknown' {
+  try {
+    return getRendererAppPlatform()
+  } catch {
+    return 'unknown'
+  }
+}
+
+export async function resolveClientEnvironmentFooter(): Promise<string> {
+  return formatClientEnvironmentFooter(await resolveClientEnvironmentInfo())
+}
+
+async function resolveAppVersion(): Promise<string> {
+  try {
+    const version = await window.api?.updater?.getVersion?.()
+    if (typeof version === 'string' && version.trim()) {
+      return version.trim()
+    }
+  } catch {
+    // Best-effort: feedback/error copy should still show OS details.
+  }
+  return 'unknown'
+}
diff --git a/src/renderer/src/lib/client-login-shell.ts b/src/renderer/src/lib/client-login-shell.ts
new file mode 100644
index 00000000000..b0e0cca1fb8
--- /dev/null
+++ b/src/renderer/src/lib/client-login-shell.ts
@@ -0,0 +1,15 @@
+/**
+ * Login shell (`$SHELL`) of the machine running this client, or '' when
+ * unknown (web build, preload unavailable).
+ *
+ * Why: commands Orca hands the user to paste — or types into a locally
+ * spawned pane — are parsed by that shell, and fish does not share the sh
+ * grammar for every construct.
+ */
+export function getClientLoginShell(): string {
+  try {
+    return window.api?.platform?.get?.().shell ?? ''
+  } catch {
+    return ''
+  }
+}
diff --git a/src/renderer/src/lib/comment-body-submit-state.ts b/src/renderer/src/lib/comment-body-submit-state.ts
index be3cc7ddb2e..460200d3e10 100644
--- a/src/renderer/src/lib/comment-body-submit-state.ts
+++ b/src/renderer/src/lib/comment-body-submit-state.ts
@@ -1,3 +1,8 @@
+import {
+  getUtf8ByteLengthForCodePoint,
+  readUtf8CodePointAt
+} from '../../../shared/utf8-byte-limits'
+
 export const COMMENT_BODY_NONBLANK_SCAN_MAX_BYTES = 64 * 1024
 
 export type CommentBodySubmitState =
@@ -7,19 +12,6 @@ export type CommentBodySubmitState =
 
 type CommentBodyPresence = 'empty' | 'present' | 'too-large-leading-whitespace'
 
-function getCodePointUtf8ByteLength(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
-
 function getCommentBodyPresence(
   body: string,
   maxScanBytes = COMMENT_BODY_NONBLANK_SCAN_MAX_BYTES
@@ -27,9 +19,9 @@ function getCommentBodyPresence(
   let scannedBytes = 0
 
   for (let index = 0; index < body.length; index += 1) {
-    const codePoint = body.codePointAt(index) ?? 0
+    const codePoint = readUtf8CodePointAt(body, index)
     const codeUnitLength = codePoint > 0xffff ? 2 : 1
-    scannedBytes += getCodePointUtf8ByteLength(codePoint)
+    scannedBytes += getUtf8ByteLengthForCodePoint(codePoint)
     if (scannedBytes > maxScanBytes) {
       return 'too-large-leading-whitespace'
     }
diff --git a/src/renderer/src/lib/crash-diagnostics.ts b/src/renderer/src/lib/crash-diagnostics.ts
index 95c9bfe213c..78d1daa76c6 100644
--- a/src/renderer/src/lib/crash-diagnostics.ts
+++ b/src/renderer/src/lib/crash-diagnostics.ts
@@ -74,7 +74,7 @@ function disposeRendererCrashDiagnostics(): void {
   rendererSurface = 'main'
 }
 
-if (typeof import.meta !== 'undefined' && import.meta.hot) {
+if (import.meta !== undefined && import.meta.hot) {
   // Why: Vite can replace this module without a full renderer reload. Remove
   // global diagnostics hooks so dev sessions do not accumulate listeners.
   import.meta.hot.dispose(disposeRendererCrashDiagnostics)
diff --git a/src/renderer/src/lib/desktop-window-chrome.ts b/src/renderer/src/lib/desktop-window-chrome.ts
index 849b4bf8420..59683f15518 100644
--- a/src/renderer/src/lib/desktop-window-chrome.ts
+++ b/src/renderer/src/lib/desktop-window-chrome.ts
@@ -7,6 +7,14 @@ export function isPairedWebClientWindow(): boolean {
   return (globalThis as { __ORCA_WEB_CLIENT__?: boolean }).__ORCA_WEB_CLIENT__ === true
 }
 
+export function isLocalWindowsDesktopClient(): boolean {
+  return (
+    !isPairedWebClientWindow() &&
+    typeof navigator !== 'undefined' &&
+    navigator.userAgent.includes('Windows')
+  )
+}
+
 export function shouldRenderDesktopWindowChrome({
   platform,
   isWebClient
diff --git a/src/renderer/src/lib/ensure-hooks-confirmed.test.ts b/src/renderer/src/lib/ensure-hooks-confirmed.test.ts
index 00b8621a35b..bbfbe637cb7 100644
--- a/src/renderer/src/lib/ensure-hooks-confirmed.test.ts
+++ b/src/renderer/src/lib/ensure-hooks-confirmed.test.ts
@@ -291,7 +291,10 @@ describe('ensureHooksConfirmed', () => {
       repos: [
         {
           id: 'repo-1',
+          path: '/repo-1',
           displayName: 'Repo One',
+          badgeColor: 'blue',
+          addedAt: 1,
           hookSettings: {
             mode: 'auto',
             commandSourcePolicy: 'local-only',
@@ -318,7 +321,10 @@ describe('ensureHooksConfirmed', () => {
       repos: [
         {
           id: 'repo-1',
+          path: '/repo-1',
           displayName: 'Repo One',
+          badgeColor: 'blue',
+          addedAt: 1,
           hookSettings: {
             mode: 'auto',
             scripts: { setup: 'echo local', archive: '' }
diff --git a/src/renderer/src/lib/feature-education-telemetry.ts b/src/renderer/src/lib/feature-education-telemetry.ts
index 29c07200267..d66fd213722 100644
--- a/src/renderer/src/lib/feature-education-telemetry.ts
+++ b/src/renderer/src/lib/feature-education-telemetry.ts
@@ -133,7 +133,7 @@ export function trackTerminalPaneSplit(args: {
 }
 
 export function readEmittedSetupGuideStepIds(): Set<FeatureWallSetupStepId> {
-  if (typeof globalThis.localStorage === 'undefined') {
+  if (globalThis.localStorage === undefined) {
     return new Set()
   }
   try {
@@ -150,7 +150,7 @@ export function readEmittedSetupGuideStepIds(): Set<FeatureWallSetupStepId> {
 }
 
 export function persistEmittedSetupGuideStepId(id: FeatureWallSetupStepId): void {
-  if (typeof globalThis.localStorage === 'undefined') {
+  if (globalThis.localStorage === undefined) {
     return
   }
   try {
@@ -170,7 +170,7 @@ export function reserveTerminalPaneSplitTelemetry(
   source: TerminalPaneSplitSource,
   direction: 'vertical' | 'horizontal'
 ): boolean {
-  if (typeof globalThis.localStorage === 'undefined') {
+  if (globalThis.localStorage === undefined) {
     return true
   }
   try {
diff --git a/src/renderer/src/lib/file-preview.test.ts b/src/renderer/src/lib/file-preview.test.ts
index bea6e40a3be..05f6e485d46 100644
--- a/src/renderer/src/lib/file-preview.test.ts
+++ b/src/renderer/src/lib/file-preview.test.ts
@@ -2,18 +2,33 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   REMOTE_FILE_BROWSER_UNSUPPORTED_MESSAGE,
   getWorkspaceFileBrowserOpenTarget,
-  openFileInBrowserTab
+  openFileInBrowserTab,
+  openFilePreviewToSide
 } from './file-preview'
 
 const mocks = vi.hoisted(() => ({
   createBrowserTab: vi.fn(),
+  createEmptySplitGroup: vi.fn(() => 'group-2'),
+  createWebRuntimeSessionBrowserTab: vi.fn(),
+  environmentId: null as string | null,
   connectionId: null as string | null
 }))
 
+vi.mock('@/lib/worktree-runtime-owner', () => ({
+  getRuntimeEnvironmentIdForWorktree: () => mocks.environmentId
+}))
+
+vi.mock('@/runtime/web-runtime-session', () => ({
+  createWebRuntimeSessionBrowserTab: mocks.createWebRuntimeSessionBrowserTab
+}))
+
 vi.mock('@/store', () => ({
   useAppStore: {
     getState: () => ({
       createBrowserTab: mocks.createBrowserTab,
+      createEmptySplitGroup: mocks.createEmptySplitGroup,
+      groupsByWorktree: {},
+      layoutByWorktree: {},
       repos: [{ id: 'repo-1', connectionId: mocks.connectionId }],
       worktreesByRepo: {
         'repo-1': [{ id: 'wt-1', repoId: 'repo-1' }]
@@ -24,6 +39,8 @@ vi.mock('@/store', () => ({
 
 beforeEach(() => {
   vi.clearAllMocks()
+  mocks.createWebRuntimeSessionBrowserTab.mockResolvedValue(true)
+  mocks.environmentId = null
   mocks.connectionId = null
 })
 
@@ -40,6 +57,44 @@ describe('openFileInBrowserTab', () => {
     })
   })
 
+  it('creates paired-runtime file browsers at the owning host', () => {
+    mocks.environmentId = 'runtime-1'
+
+    openFileInBrowserTab({ filePath: '/srv/repo/example.html', worktreeId: 'wt-1' })
+
+    expect(mocks.createWebRuntimeSessionBrowserTab).toHaveBeenCalledWith({
+      worktreeId: 'wt-1',
+      environmentId: 'runtime-1',
+      url: 'file:///srv/repo/example.html',
+      stagedTitle: 'example.html',
+      stagedFocusAddressBar: false
+    })
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('creates paired-runtime side previews in the requested split', () => {
+    mocks.environmentId = 'runtime-1'
+
+    openFilePreviewToSide({
+      language: 'html',
+      filePath: '/srv/repo/example.html',
+      worktreeId: 'wt-1',
+      sourceGroupId: 'group-1'
+    })
+
+    expect(mocks.createWebRuntimeSessionBrowserTab).toHaveBeenCalledWith({
+      worktreeId: 'wt-1',
+      environmentId: 'runtime-1',
+      url: 'file:///srv/repo/example.html',
+      clientTargetGroupId: 'group-2',
+      clientTargetGroupCreated: true,
+      focusOnCreate: false,
+      stagedTitle: 'example.html',
+      stagedFocusAddressBar: false
+    })
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
   it('returns unsupported for SSH worktrees without creating a local file URL tab', () => {
     mocks.connectionId = 'ssh-1'
 
diff --git a/src/renderer/src/lib/file-preview.ts b/src/renderer/src/lib/file-preview.ts
index fc23d680ad1..788012784a0 100644
--- a/src/renderer/src/lib/file-preview.ts
+++ b/src/renderer/src/lib/file-preview.ts
@@ -1,12 +1,23 @@
 import { toast } from 'sonner'
 import { absolutePathToFileUri } from '@/components/editor/markdown-internal-links'
 import { getConnectionId } from '@/lib/connection-context'
+import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import { createWebRuntimeSessionBrowserTab } from '@/runtime/web-runtime-session'
 import { useAppStore } from '@/store'
 import { findSiblingGroupId } from '@/store/slices/tabs'
 
 export type PreviewableLanguage = 'html'
 export const REMOTE_FILE_BROWSER_UNSUPPORTED_MESSAGE =
   'Open in Orca Browser is only available for local files.'
+const FILE_BROWSER_OPEN_FAILED_MESSAGE = 'Unable to open this file in Orca Browser.'
+
+function reportRemoteFileBrowserOpen(result: Promise<boolean>): void {
+  void result.then((created) => {
+    if (!created) {
+      toast.error(FILE_BROWSER_OPEN_FAILED_MESSAGE)
+    }
+  })
+}
 
 export type WorkspaceFileBrowserOpenTarget =
   | {
@@ -51,6 +62,19 @@ export function openFileInBrowserTab(params: {
   }
 
   const state = useAppStore.getState()
+  const environmentId = getRuntimeEnvironmentIdForWorktree(state, params.worktreeId)
+  if (environmentId) {
+    reportRemoteFileBrowserOpen(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: params.worktreeId,
+        environmentId,
+        url: target.url,
+        stagedTitle: target.title,
+        stagedFocusAddressBar: false
+      })
+    )
+    return target
+  }
 
   state.createBrowserTab(params.worktreeId, target.url, {
     title: target.title,
@@ -114,6 +138,23 @@ export function openFilePreviewToSide(params: {
     return
   }
 
+  const environmentId = getRuntimeEnvironmentIdForWorktree(state, worktreeId)
+  if (environmentId) {
+    reportRemoteFileBrowserOpen(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId,
+        environmentId,
+        url: target.url,
+        clientTargetGroupId: targetGroupId,
+        clientTargetGroupCreated: !existingSibling,
+        focusOnCreate: false,
+        stagedTitle: target.title,
+        stagedFocusAddressBar: false
+      })
+    )
+    return
+  }
+
   state.createBrowserTab(worktreeId, target.url, {
     title: target.title,
     targetGroupId,
diff --git a/src/renderer/src/lib/flatten-retained-slice.test.ts b/src/renderer/src/lib/flatten-retained-slice.test.ts
new file mode 100644
index 00000000000..2eedfc5c6ad
--- /dev/null
+++ b/src/renderer/src/lib/flatten-retained-slice.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest'
+
+import { flattenRetainedSlice } from './flatten-retained-slice'
+
+// Why 1 MB: comfortably above V8's SlicedString threshold, so a raw slice really does keep the
+// parent alive and the difference between flattened and not is unmistakable in heapUsed.
+const PARENT_CHARS = 1024 * 1024
+const TAIL_CHARS = 512
+const PARENTS = 8
+
+function collect(): number {
+  const gc = (globalThis as { gc?: () => void }).gc
+  if (!gc) {
+    throw new Error('global.gc unavailable - config/vitest.config.ts must pass --expose-gc')
+  }
+  gc()
+  gc()
+  return process.memoryUsage().heapUsed
+}
+
+// Distinct leading chars stop V8 sharing one backing store across the parents.
+function makeParent(index: number, filler: string): string {
+  return String.fromCharCode(0x41 + index) + filler.repeat(PARENT_CHARS - 1)
+}
+
+function retainedBytesForTails(filler: string, transform: (value: string) => string): number {
+  const parents = Array.from({ length: PARENTS }, (_unused, index) => makeParent(index, filler))
+  const baseline = collect()
+  const tails = parents.map((parent) => transform(parent.slice(parent.length - TAIL_CHARS)))
+  // Drop the parents; only the tails stay reachable.
+  parents.length = 0
+  const retained = collect() - baseline
+  expect(tails).toHaveLength(PARENTS)
+  expect(tails.every((tail) => tail.length === TAIL_CHARS)).toBe(true)
+  return retained
+}
+
+describe('flattenRetainedSlice', () => {
+  it('preserves content exactly', () => {
+    expect(flattenRetainedSlice('')).toBe('')
+    expect(flattenRetainedSlice('a')).toBe('a')
+    const source = 'hello world, 漢字, , \u{1f600}'
+    expect(flattenRetainedSlice(source.slice(3))).toBe(source.slice(3))
+  })
+
+  it.each([
+    ['one-byte', 'a'],
+    ['two-byte', '漢']
+  ])('drops the %s parent a raw slice would pin', (_label, filler) => {
+    const raw = retainedBytesForTails(filler, (value) => value)
+    const flattened = retainedBytesForTails(filler, flattenRetainedSlice)
+
+    // A raw slice pins all 8 parents; flattening must keep only the tails.
+    expect(raw).toBeGreaterThan(PARENTS * PARENT_CHARS * 0.5)
+    expect(flattened).toBeLessThan(PARENTS * PARENT_CHARS * 0.05)
+  })
+})
diff --git a/src/renderer/src/lib/flatten-retained-slice.ts b/src/renderer/src/lib/flatten-retained-slice.ts
new file mode 100644
index 00000000000..45585c3a75e
--- /dev/null
+++ b/src/renderer/src/lib/flatten-retained-slice.ts
@@ -0,0 +1,4 @@
+// V8 slices can retain their full parent; force a standalone copy for values that outlive it.
+export function flattenRetainedSlice(value: string): string {
+  return value.length === 0 ? value : `${value} `.slice(0, -1)
+}
diff --git a/src/renderer/src/lib/floating-workspace-tab-creation.ts b/src/renderer/src/lib/floating-workspace-tab-creation.ts
index d9b6e51b69b..58a22ad9320 100644
--- a/src/renderer/src/lib/floating-workspace-tab-creation.ts
+++ b/src/renderer/src/lib/floating-workspace-tab-creation.ts
@@ -6,6 +6,7 @@ import { detectLanguage } from './language-detect'
 import type { AppState } from '@/store/types'
 import { focusTerminalTabSurface } from './focus-terminal-tab-surface'
 import { translate } from '@/i18n/i18n'
+import { assertClientCreationActionAvailable } from './client-creation-action-policy'
 
 type FloatingWorkspaceTerminalStore = Pick<
   AppState,
@@ -38,6 +39,11 @@ export async function createFloatingWorkspaceTerminalTab(
 export async function createFloatingWorkspaceBrowserTab(
   store: FloatingWorkspaceBrowserStore
 ): Promise<BrowserTab | null> {
+  assertClientCreationActionAvailable(
+    store as AppState,
+    FLOATING_TERMINAL_WORKTREE_ID,
+    'managed-browser'
+  )
   const targetGroupId = store.activeGroupIdByWorktree[FLOATING_TERMINAL_WORKTREE_ID]
   const url = store.browserDefaultUrl ?? 'about:blank'
 
diff --git a/src/renderer/src/lib/folder-workspace-connection.ts b/src/renderer/src/lib/folder-workspace-connection.ts
index 4afb696d700..2c9376fc284 100644
--- a/src/renderer/src/lib/folder-workspace-connection.ts
+++ b/src/renderer/src/lib/folder-workspace-connection.ts
@@ -4,9 +4,9 @@ import { getProjectGroupSubtreeIds } from '../../../shared/project-groups'
 import { parseExecutionHostId } from '../../../shared/execution-host'
 
 export type FolderWorkspaceConnectionState = {
-  folderWorkspaces: FolderWorkspace[]
-  projectGroups: ProjectGroup[]
-  repos: Repo[]
+  folderWorkspaces: readonly FolderWorkspace[]
+  projectGroups: readonly ProjectGroup[]
+  repos: readonly Repo[]
 }
 
 function getFolderScopeCandidateRepos(args: {
diff --git a/src/renderer/src/lib/folder-workspace-runtime-owner.ts b/src/renderer/src/lib/folder-workspace-runtime-owner.ts
index 4bf99a1b780..fce08c49302 100644
--- a/src/renderer/src/lib/folder-workspace-runtime-owner.ts
+++ b/src/renderer/src/lib/folder-workspace-runtime-owner.ts
@@ -16,7 +16,7 @@ type RuntimeExecutionHost = Extract<ParsedExecutionHost, { kind: 'runtime' }>
 export type FolderWorkspaceRuntimeOwnerState = SingleRuntimeLegacyOwnerState & {
   folderWorkspaces?: readonly Pick<
     FolderWorkspace,
-    'id' | 'projectGroupId' | 'connectionId' | 'executionHostId'
+    'id' | 'projectGroupId' | 'connectionId' | 'executionHostId' | 'diffComments'
   >[]
   projectGroups?: readonly Pick<ProjectGroup, 'id' | 'connectionId' | 'executionHostId'>[]
   restoredRuntimeHostIdByWorkspaceSessionKey?: Record<string, ExecutionHostId>
@@ -41,7 +41,10 @@ export function findFolderWorkspaceOwner(
   state: FolderWorkspaceRuntimeOwnerState,
   folderWorkspaceId: string,
   executionHostId?: ExecutionHostId
-): Pick<FolderWorkspace, 'id' | 'projectGroupId' | 'connectionId' | 'executionHostId'> | null {
+): Pick<
+  FolderWorkspace,
+  'id' | 'projectGroupId' | 'connectionId' | 'executionHostId' | 'diffComments'
+> | null {
   return findIndexedFolderWorkspaceOwner(
     state.folderWorkspaces,
     folderWorkspaceId,
diff --git a/src/renderer/src/lib/github-work-item-background-create.test.ts b/src/renderer/src/lib/github-work-item-background-create.test.ts
deleted file mode 100644
index ef7adfdb2b9..00000000000
--- a/src/renderer/src/lib/github-work-item-background-create.test.ts
+++ /dev/null
@@ -1,878 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { WorktreeCreationRequest } from '@/lib/pending-worktree-creation'
-import type { RuntimeStatus } from '../../../shared/runtime-types'
-import type { GitHubWorkItem, Repo } from '../../../shared/types'
-import {
-  MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION,
-  RUNTIME_PROTOCOL_VERSION
-} from '../../../shared/protocol-version'
-
-vi.mock('@/lib/tui-agent-startup', () => ({
-  buildAgentDraftLaunchPlan: vi.fn(() => null),
-  buildAgentStartupPlan: vi.fn(() => ({
-    agent: 'codex',
-    launchCommand: 'codex',
-    expectedProcess: 'codex',
-    followupPrompt: null,
-    launchConfig: { kind: 'shell', command: 'codex' }
-  }))
-}))
-
-vi.mock('@/lib/telemetry', () => ({
-  tuiAgentToAgentKind: (agent: string) => agent
-}))
-
-import { buildAgentDraftLaunchPlan, buildAgentStartupPlan } from '@/lib/tui-agent-startup'
-import { createGitHubWorkItemWorkspaceInBackground } from './github-work-item-background-create'
-
-const repo: Repo = {
-  id: 'repo-1',
-  path: '/repo',
-  displayName: 'orca',
-  badgeColor: 'blue',
-  addedAt: 1
-}
-
-function makeRuntimeStatus(overrides: Partial<RuntimeStatus> = {}): RuntimeStatus {
-  return {
-    runtimeId: 'runtime-1',
-    rendererGraphEpoch: 1,
-    graphStatus: 'ready',
-    authoritativeWindowId: null,
-    liveTabCount: 0,
-    liveLeafCount: 0,
-    runtimeProtocolVersion: RUNTIME_PROTOCOL_VERSION,
-    minCompatibleRuntimeClientVersion: MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION,
-    ...overrides
-  }
-}
-
-function makeIssue(overrides: Partial<GitHubWorkItem> = {}): GitHubWorkItem {
-  return {
-    id: 'I_42',
-    repoId: 'repo-1',
-    type: 'issue',
-    number: 42,
-    title: 'Make issue workspace creation async',
-    url: 'https://github.com/stablyai/orca/issues/42',
-    state: 'open',
-    author: null,
-    labels: [],
-    assignees: [],
-    createdAt: '2026-06-22T00:00:00Z',
-    updatedAt: '2026-06-22T00:00:00Z',
-    commentsCount: 0,
-    ...overrides
-  } as GitHubWorkItem
-}
-
-function makeStore(overrides: Partial<ReturnType<typeof baseStore>> = {}) {
-  return { ...baseStore(), ...overrides }
-}
-
-function baseStore() {
-  return {
-    activeView: 'tasks' as const,
-    repos: [repo],
-    pendingWorktreeCreations: {},
-    sshConnectionStates: new Map(),
-    runtimeStatusByEnvironmentId: new Map(),
-    settings: {
-      activeRuntimeEnvironmentId: null,
-      defaultTuiAgent: 'codex' as const,
-      disabledTuiAgents: []
-    },
-    ensureDetectedAgents: vi.fn().mockResolvedValue([]),
-    ensureRemoteDetectedAgents: vi.fn().mockResolvedValue([]),
-    ensureRuntimeDetectedAgents: vi.fn().mockResolvedValue([])
-  }
-}
-
-function makeDeps(store = makeStore()) {
-  return {
-    getStore: () => store,
-    getActiveView: vi.fn(() => store.activeView),
-    hasPendingCreate: vi.fn(() => true),
-    isPendingCreateActive: vi.fn(() => true),
-    resolveSetupDecision: vi.fn().mockResolvedValue({ kind: 'decided', decision: 'inherit' }),
-    resolvePrStartPoint: vi.fn(),
-    confirmHooks: vi.fn().mockResolvedValue('run'),
-    readIssueCommand: vi.fn().mockResolvedValue({
-      effectiveContent: null,
-      localContent: null,
-      sharedContent: null,
-      localFilePath: '',
-      source: 'none'
-    }),
-    beginBackgroundCreate: vi.fn(() => 'creation-1'),
-    continueBackgroundCreate: vi.fn(() => true),
-    activatePendingCreate: vi.fn(),
-    removePendingCreate: vi.fn(),
-    setActiveView: vi.fn(),
-    toastError: vi.fn()
-  }
-}
-
-describe('createGitHubWorkItemWorkspaceInBackground', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-  })
-
-  it('starts a background issue workspace without opening the composer', async () => {
-    const deps = makeDeps()
-    const openModalFallback = vi.fn()
-
-    const result = await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        telemetrySource: 'sidebar',
-        openModalFallback
-      },
-      deps
-    )
-
-    expect(result).toEqual({ kind: 'background-started' })
-    expect(openModalFallback).not.toHaveBeenCalled()
-    expect(deps.beginBackgroundCreate).toHaveBeenCalledWith(
-      expect.objectContaining({
-        repoId: 'repo-1',
-        name: 'issue-42-make-issue-workspace',
-        displayName: 'Issue 42 Make Issue Workspace',
-        linkedIssue: 42,
-        telemetrySource: 'sidebar',
-        setupDecision: 'inherit',
-        agent: null
-      })
-    )
-    expect(deps.continueBackgroundCreate).toHaveBeenCalledWith(
-      'creation-1',
-      expect.objectContaining({
-        repoId: 'repo-1',
-        name: 'issue-42-make-issue-workspace',
-        displayName: 'Issue 42 Make Issue Workspace',
-        linkedIssue: 42,
-        telemetrySource: 'sidebar',
-        setupDecision: 'inherit',
-        agent: null,
-        startupPlan: null,
-        quickPrompt: '',
-        quickTelemetry: null
-      }),
-      { revealCreationSurface: false }
-    )
-  })
-
-  it('does not resolve a PR start point for a stale PR-typed issue URL', async () => {
-    const deps = makeDeps()
-
-    await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue({
-          type: 'pr',
-          number: 6933,
-          title: 'The board columns are displayed backwards',
-          url: 'https://github.com/stablyai/orca/issues/6933',
-          branchName: 'fix-issue-6933',
-          baseRefName: 'main',
-          isCrossRepository: true
-        }),
-        repoId: 'repo-1',
-        telemetrySource: 'sidebar',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    expect(deps.resolvePrStartPoint).not.toHaveBeenCalled()
-    const beginCalls = deps.beginBackgroundCreate.mock.calls as unknown as [
-      WorktreeCreationRequest
-    ][]
-    expect(beginCalls[0]?.[0].linkedIssue).toBe(6933)
-    expect(beginCalls[0]?.[0].linkedPR).toBeUndefined()
-    const continueCalls = deps.continueBackgroundCreate.mock.calls as unknown as [
-      string,
-      WorktreeCreationRequest
-    ][]
-    const request = continueCalls[0]?.[1]
-    expect(request?.linkedIssue).toBe(6933)
-    expect(request?.linkedPR).toBeUndefined()
-    expect(request?.baseBranch).toBeUndefined()
-    expect(request?.pushTarget).toBeUndefined()
-    expect(request?.branchNameOverride).toBeUndefined()
-    expect(request?.compareBaseRef).toBeUndefined()
-  })
-
-  it('shows the pending workspace before async preflight resolves', async () => {
-    let resolveSetupDecision: ((value: { kind: 'decided'; decision: 'inherit' }) => void) | null =
-      null
-    const deps = makeDeps()
-    deps.resolveSetupDecision.mockImplementation(
-      () =>
-        new Promise<{ kind: 'decided'; decision: 'inherit' }>((resolve) => {
-          resolveSetupDecision = resolve
-        })
-    )
-
-    const pending = createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    expect(deps.beginBackgroundCreate).toHaveBeenCalledTimes(1)
-    expect(deps.continueBackgroundCreate).not.toHaveBeenCalled()
-
-    expect(resolveSetupDecision).not.toBeNull()
-    resolveSetupDecision!({ kind: 'decided', decision: 'inherit' })
-    await pending
-
-    expect(deps.continueBackgroundCreate).toHaveBeenCalledTimes(1)
-  })
-
-  it('reuses an existing pending issue create instead of staging a duplicate', async () => {
-    const pendingRequest: WorktreeCreationRequest = {
-      repoId: 'repo-1',
-      name: 'issue-42-make-issue-workspace',
-      setupDecision: 'inherit',
-      linkedIssue: 42,
-      agent: null,
-      pendingFirstAgentMessageRename: false,
-      note: '',
-      startupPlan: null,
-      quickPrompt: '',
-      quickTelemetry: null
-    }
-    const deps = makeDeps(
-      makeStore({
-        pendingWorktreeCreations: {
-          'creation-existing': {
-            creationId: 'creation-existing',
-            phase: 'preparing',
-            status: 'creating',
-            indeterminate: false,
-            loaderVisible: true,
-            request: pendingRequest
-          }
-        }
-      })
-    )
-
-    const result = await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    expect(result).toEqual({ kind: 'background-started' })
-    expect(deps.activatePendingCreate).toHaveBeenCalledWith('creation-existing')
-    expect(deps.beginBackgroundCreate).not.toHaveBeenCalled()
-    expect(deps.resolveSetupDecision).not.toHaveBeenCalled()
-    expect(deps.continueBackgroundCreate).not.toHaveBeenCalled()
-  })
-
-  it('falls back without staging when the SSH repo is disconnected', async () => {
-    const sshRepo: Repo = {
-      ...repo,
-      connectionId: 'devbox'
-    }
-    const deps = makeDeps(
-      makeStore({
-        repos: [sshRepo],
-        sshConnectionStates: new Map([['devbox', { status: 'disconnected' }]])
-      })
-    )
-    const openModalFallback = vi.fn()
-
-    const result = await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback
-      },
-      deps
-    )
-
-    expect(result).toEqual({ kind: 'fallback', reason: 'host-unavailable' })
-    expect(openModalFallback).toHaveBeenCalledTimes(1)
-    expect(deps.beginBackgroundCreate).not.toHaveBeenCalled()
-    expect(deps.resolveSetupDecision).not.toHaveBeenCalled()
-    expect(deps.confirmHooks).not.toHaveBeenCalled()
-  })
-
-  it('falls back without staging when the runtime repo is unreachable', async () => {
-    const runtimeRepo: Repo = {
-      ...repo,
-      executionHostId: 'runtime:env-1'
-    }
-    const deps = makeDeps(
-      makeStore({
-        repos: [runtimeRepo],
-        runtimeStatusByEnvironmentId: new Map([['env-1', { status: null, checkedAt: 1 }]])
-      })
-    )
-    const openModalFallback = vi.fn()
-
-    const result = await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback
-      },
-      deps
-    )
-
-    expect(result).toEqual({ kind: 'fallback', reason: 'host-unavailable' })
-    expect(openModalFallback).toHaveBeenCalledTimes(1)
-    expect(deps.beginBackgroundCreate).not.toHaveBeenCalled()
-    expect(deps.resolveSetupDecision).not.toHaveBeenCalled()
-    expect(deps.confirmHooks).not.toHaveBeenCalled()
-    expect(deps.continueBackgroundCreate).not.toHaveBeenCalled()
-  })
-
-  it('falls back without staging when the runtime host platform is unknown', async () => {
-    const runtimeRepo: Repo = {
-      ...repo,
-      executionHostId: 'runtime:env-1'
-    }
-    const deps = makeDeps(
-      makeStore({
-        repos: [runtimeRepo],
-        runtimeStatusByEnvironmentId: new Map([
-          ['env-1', { status: makeRuntimeStatus({ runtimeId: 'runtime-env-1' }), checkedAt: 1 }]
-        ])
-      })
-    )
-    const openModalFallback = vi.fn()
-
-    const result = await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback
-      },
-      deps
-    )
-
-    expect(result).toEqual({ kind: 'fallback', reason: 'host-unavailable' })
-    expect(openModalFallback).toHaveBeenCalledTimes(1)
-    expect(deps.beginBackgroundCreate).not.toHaveBeenCalled()
-    expect(deps.resolveSetupDecision).not.toHaveBeenCalled()
-    expect(deps.confirmHooks).not.toHaveBeenCalled()
-    expect(deps.continueBackgroundCreate).not.toHaveBeenCalled()
-  })
-
-  it('uses the preferred quick agent when one is available', async () => {
-    const store = makeStore({
-      ensureDetectedAgents: vi.fn().mockResolvedValue(['codex'])
-    })
-    const deps = makeDeps(store)
-
-    await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    const continueCall = deps.continueBackgroundCreate.mock.calls[0] as unknown[] | undefined
-    expect(continueCall).toBeDefined()
-    const request = continueCall?.[1] as WorktreeCreationRequest
-    expect(request.agent).toBe('codex')
-    expect(request.startupPlan?.launchCommand).toBe('codex')
-    expect(request.startup).toBeUndefined()
-    expect(request.quickTelemetry).toEqual({
-      agent_kind: 'codex',
-      launch_source: 'new_workspace_composer',
-      request_kind: 'new'
-    })
-    expect(buildAgentStartupPlan).toHaveBeenCalled()
-  })
-
-  it('uses runtime-owned detection and indeterminate progress for runtime repos', async () => {
-    const runtimeRepo: Repo = {
-      ...repo,
-      executionHostId: 'runtime:env-1'
-    }
-    const store = makeStore({
-      repos: [runtimeRepo],
-      runtimeStatusByEnvironmentId: new Map([
-        [
-          'env-1',
-          {
-            status: makeRuntimeStatus({ runtimeId: 'runtime-env-1', hostPlatform: 'win32' }),
-            checkedAt: 1
-          }
-        ]
-      ]),
-      ensureDetectedAgents: vi.fn().mockResolvedValue([]),
-      ensureRemoteDetectedAgents: vi.fn().mockResolvedValue([]),
-      ensureRuntimeDetectedAgents: vi.fn().mockResolvedValue(['codex'])
-    })
-    const deps = makeDeps(store)
-
-    await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    expect(store.ensureRuntimeDetectedAgents).toHaveBeenCalledWith('env-1')
-    expect(store.ensureDetectedAgents).not.toHaveBeenCalled()
-    expect(store.ensureRemoteDetectedAgents).not.toHaveBeenCalled()
-    expect(deps.beginBackgroundCreate).toHaveBeenCalledWith(
-      expect.objectContaining({
-        worktreeCreateProgressMode: 'indeterminate',
-        workspaceRunContext: expect.objectContaining({
-          hostId: 'runtime:env-1',
-          repoId: 'repo-1'
-        })
-      })
-    )
-    const continueCall = deps.continueBackgroundCreate.mock.calls[0] as unknown[] | undefined
-    expect(continueCall).toBeDefined()
-    const request = continueCall?.[1] as WorktreeCreationRequest
-    expect(request.worktreeCreateProgressMode).toBe('indeterminate')
-    expect(request.agent).toBe('codex')
-    expect(buildAgentStartupPlan).toHaveBeenCalledWith(
-      expect.objectContaining({ platform: 'win32' })
-    )
-  })
-
-  it('falls back before creating when the selected agent startup plan cannot be built', async () => {
-    vi.mocked(buildAgentStartupPlan).mockReturnValueOnce(null)
-    const store = makeStore({
-      ensureDetectedAgents: vi.fn().mockResolvedValue(['codex'])
-    })
-    const deps = makeDeps(store)
-    const openModalFallback = vi.fn()
-
-    const result = await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback
-      },
-      deps
-    )
-
-    expect(result).toEqual({ kind: 'fallback', reason: 'agent-startup' })
-    expect(deps.toastError).toHaveBeenCalledWith('Could not build the agent launch command.')
-    expect(deps.removePendingCreate).toHaveBeenCalledWith('creation-1')
-    expect(deps.setActiveView).toHaveBeenCalledWith('tasks')
-    expect(openModalFallback).toHaveBeenCalledTimes(1)
-    expect(deps.continueBackgroundCreate).not.toHaveBeenCalled()
-  })
-
-  it('stops before opening the composer when the staged create is cancelled during setup preflight', async () => {
-    let resolveSetupDecision: ((value: { kind: 'needs-modal' }) => void) | null = null
-    const deps = makeDeps()
-    deps.resolveSetupDecision.mockImplementation(
-      () =>
-        new Promise<{ kind: 'needs-modal' }>((resolve) => {
-          resolveSetupDecision = resolve
-        })
-    )
-    const openModalFallback = vi.fn()
-
-    const pending = createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback
-      },
-      deps
-    )
-
-    deps.hasPendingCreate.mockReturnValue(false)
-    expect(resolveSetupDecision).not.toBeNull()
-    resolveSetupDecision!({ kind: 'needs-modal' })
-
-    expect(await pending).toEqual({ kind: 'background-started' })
-    expect(openModalFallback).not.toHaveBeenCalled()
-    expect(deps.removePendingCreate).not.toHaveBeenCalled()
-    expect(deps.continueBackgroundCreate).not.toHaveBeenCalled()
-  })
-
-  it('stops before hook trust and agent detection when the staged create is cancelled', async () => {
-    let resolveSetupDecision: ((value: { kind: 'decided'; decision: 'inherit' }) => void) | null =
-      null
-    const deps = makeDeps()
-    deps.resolveSetupDecision.mockImplementation(
-      () =>
-        new Promise<{ kind: 'decided'; decision: 'inherit' }>((resolve) => {
-          resolveSetupDecision = resolve
-        })
-    )
-
-    const pending = createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    deps.hasPendingCreate.mockReturnValue(false)
-    expect(resolveSetupDecision).not.toBeNull()
-    resolveSetupDecision!({ kind: 'decided', decision: 'inherit' })
-
-    expect(await pending).toEqual({ kind: 'background-started' })
-    expect(deps.confirmHooks).not.toHaveBeenCalled()
-    expect(deps.continueBackgroundCreate).not.toHaveBeenCalled()
-  })
-
-  it('falls back to the composer when setup policy requires an explicit choice', async () => {
-    const deps = makeDeps()
-    deps.resolveSetupDecision.mockResolvedValueOnce({ kind: 'needs-modal' })
-    const openModalFallback = vi.fn()
-
-    const result = await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback
-      },
-      deps
-    )
-
-    expect(result).toEqual({ kind: 'fallback', reason: 'setup-ask' })
-    expect(openModalFallback).toHaveBeenCalledTimes(1)
-    expect(deps.removePendingCreate).toHaveBeenCalledWith('creation-1')
-    expect(deps.setActiveView).toHaveBeenCalledWith('tasks')
-    expect(deps.continueBackgroundCreate).not.toHaveBeenCalled()
-  })
-
-  it('leaves the current view alone on fallback after the user leaves the staged create', async () => {
-    const deps = makeDeps()
-    deps.resolveSetupDecision.mockResolvedValueOnce({ kind: 'needs-modal' })
-    deps.isPendingCreateActive.mockReturnValueOnce(false)
-
-    await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    expect(deps.removePendingCreate).toHaveBeenCalledWith('creation-1')
-    expect(deps.setActiveView).not.toHaveBeenCalled()
-  })
-
-  it('falls back to the composer when PR start point cannot be resolved', async () => {
-    const deps = makeDeps()
-    deps.resolvePrStartPoint.mockRejectedValueOnce(new Error('No PR head'))
-    const openModalFallback = vi.fn()
-
-    const result = await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue({ type: 'pr', number: 7, url: 'https://github.com/stablyai/orca/pull/7' }),
-        repoId: 'repo-1',
-        openModalFallback
-      },
-      deps
-    )
-
-    expect(result).toEqual({ kind: 'fallback', reason: 'pr-start-point' })
-    expect(deps.toastError).toHaveBeenCalledWith('No PR head')
-    expect(openModalFallback).toHaveBeenCalledTimes(1)
-    expect(deps.removePendingCreate).toHaveBeenCalledWith('creation-1')
-    expect(deps.setActiveView).toHaveBeenCalledWith('tasks')
-    expect(deps.continueBackgroundCreate).not.toHaveBeenCalled()
-  })
-
-  it('includes resolved PR start-point data in the background request', async () => {
-    const deps = makeDeps()
-    deps.resolvePrStartPoint.mockResolvedValueOnce({
-      baseBranch: 'feature/from-pr',
-      pushTarget: { remote: 'origin', branch: 'feature/from-pr' },
-      branchNameOverride: 'feature/from-pr',
-      compareBaseRef: 'main'
-    })
-
-    await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue({
-          type: 'pr',
-          number: 6934,
-          url: 'https://github.com/stablyai/orca/pull/6934',
-          branchName: 'fix-issue-6933',
-          baseRefName: 'main',
-          isCrossRepository: true
-        }),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    expect(deps.resolvePrStartPoint).toHaveBeenCalledWith(
-      'repo-1',
-      6934,
-      expect.anything(),
-      expect.objectContaining({
-        type: 'pr',
-        number: 6934,
-        branchName: 'fix-issue-6933',
-        baseRefName: 'main',
-        isCrossRepository: true
-      })
-    )
-    expect(deps.continueBackgroundCreate).toHaveBeenCalledWith(
-      'creation-1',
-      expect.objectContaining({
-        linkedPR: 6934,
-        baseBranch: 'feature/from-pr',
-        pushTarget: { remote: 'origin', branch: 'feature/from-pr' },
-        branchNameOverride: 'feature/from-pr',
-        compareBaseRef: 'main'
-      }),
-      { revealCreationSurface: false }
-    )
-  })
-
-  it('prefers native draft startup when the agent supports it', async () => {
-    vi.mocked(buildAgentDraftLaunchPlan).mockReturnValueOnce({
-      agent: 'codex',
-      launchCommand: 'codex --prompt-file',
-      expectedProcess: 'codex',
-      launchConfig: { agentCommand: 'codex', agentArgs: '--prompt-file', agentEnv: {} }
-    })
-    const store = makeStore({
-      ensureDetectedAgents: vi.fn().mockResolvedValue(['codex'])
-    })
-    const deps = makeDeps(store)
-
-    await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    const continueCall = deps.continueBackgroundCreate.mock.calls[0] as unknown[] | undefined
-    expect(continueCall).toBeDefined()
-    const request = continueCall?.[1] as WorktreeCreationRequest
-    expect(request.startupPlan?.launchCommand).toBe('codex --prompt-file')
-    expect(request.startup?.command).toBe('codex --prompt-file')
-    expect(buildAgentStartupPlan).not.toHaveBeenCalled()
-  })
-
-  it('attaches the rendered issue command when the repo configured one and trust runs', async () => {
-    const deps = makeDeps()
-    deps.readIssueCommand.mockResolvedValueOnce({
-      effectiveContent: 'gh issue view {{issue}} --repo {{artifact_url}}',
-      localContent: null,
-      sharedContent: 'gh issue view {{issue}} --repo {{artifact_url}}',
-      localFilePath: '',
-      source: 'shared'
-    })
-
-    await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    expect(deps.confirmHooks).toHaveBeenCalledWith(expect.anything(), 'repo-1', 'setup')
-    expect(deps.confirmHooks).toHaveBeenCalledWith(expect.anything(), 'repo-1', 'issueCommand')
-    const continueCall = deps.continueBackgroundCreate.mock.calls[0] as unknown[] | undefined
-    expect(continueCall).toBeDefined()
-    const request = continueCall?.[1] as WorktreeCreationRequest
-    expect(request.issueCommand?.command).toBe(
-      'gh issue view 42 --repo https://github.com/stablyai/orca/issues/42'
-    )
-  })
-
-  it('omits the issue command when the repo configured none', async () => {
-    const deps = makeDeps()
-
-    await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    const continueCall = deps.continueBackgroundCreate.mock.calls[0] as unknown[] | undefined
-    expect(continueCall).toBeDefined()
-    const request = continueCall?.[1] as WorktreeCreationRequest
-    expect(request.issueCommand).toBeUndefined()
-    expect(deps.confirmHooks).not.toHaveBeenCalledWith(expect.anything(), 'repo-1', 'issueCommand')
-  })
-
-  it('skips the issue command when setup trust was declined', async () => {
-    const deps = makeDeps()
-    deps.readIssueCommand.mockResolvedValueOnce({
-      effectiveContent: 'echo {{issue}}',
-      localContent: 'echo {{issue}}',
-      sharedContent: null,
-      localFilePath: '/repo/.orca/issue-command',
-      source: 'local'
-    })
-    // Why: the setup confirmHooks call resolves 'skip', which mirrors the
-    // composer suppressing the issue command when setup trust is declined.
-    deps.confirmHooks.mockResolvedValue('skip')
-
-    await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    const continueCall = deps.continueBackgroundCreate.mock.calls[0] as unknown[] | undefined
-    expect(continueCall).toBeDefined()
-    const request = continueCall?.[1] as WorktreeCreationRequest
-    expect(request.issueCommand).toBeUndefined()
-    expect(deps.confirmHooks).not.toHaveBeenCalledWith(expect.anything(), 'repo-1', 'issueCommand')
-    // Why: a declined setup trust short-circuits before the (up-to-15s) read,
-    // so workspace creation is never stalled to fetch a command we will drop.
-    expect(deps.readIssueCommand).not.toHaveBeenCalled()
-  })
-
-  it('does not run the issue command for PR items', async () => {
-    const deps = makeDeps()
-    deps.resolvePrStartPoint.mockResolvedValueOnce({
-      baseBranch: 'feature/from-pr',
-      pushTarget: { remote: 'origin', branch: 'feature/from-pr' },
-      branchNameOverride: 'feature/from-pr',
-      compareBaseRef: 'main'
-    })
-    deps.readIssueCommand.mockResolvedValueOnce({
-      effectiveContent: 'echo {{issue}}',
-      localContent: 'echo {{issue}}',
-      sharedContent: null,
-      localFilePath: '/repo/.orca/issue-command',
-      source: 'local'
-    })
-
-    await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue({ type: 'pr', number: 7, url: 'https://github.com/stablyai/orca/pull/7' }),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    const continueCall = deps.continueBackgroundCreate.mock.calls[0] as unknown[] | undefined
-    expect(continueCall).toBeDefined()
-    const request = continueCall?.[1] as WorktreeCreationRequest
-    expect(request.issueCommand).toBeUndefined()
-    expect(deps.confirmHooks).not.toHaveBeenCalledWith(expect.anything(), 'repo-1', 'issueCommand')
-  })
-
-  it('fails closed when reading the issue command rejects', async () => {
-    const deps = makeDeps()
-    deps.readIssueCommand.mockRejectedValueOnce(new Error('runtime offline'))
-
-    const result = await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    expect(result).toEqual({ kind: 'background-started' })
-    const continueCall = deps.continueBackgroundCreate.mock.calls[0] as unknown[] | undefined
-    expect(continueCall).toBeDefined()
-    const request = continueCall?.[1] as WorktreeCreationRequest
-    expect(request.issueCommand).toBeUndefined()
-  })
-
-  it('re-reads the store for each trust check so mid-flow trust updates are honored', async () => {
-    const snapshots = [makeStore(), makeStore(), makeStore()]
-    let getStoreCall = 0
-    const deps = makeDeps(snapshots[0])
-    deps.getStore = vi.fn(
-      () => snapshots[Math.min(getStoreCall++, snapshots.length - 1)] ?? snapshots[0]
-    )
-    deps.readIssueCommand.mockResolvedValueOnce({
-      effectiveContent: 'echo {{issue}}',
-      localContent: null,
-      sharedContent: 'echo {{issue}}',
-      localFilePath: '',
-      source: 'shared'
-    })
-
-    await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    // Why: an "Always trust" stamped by the setup prompt only exists in a fresh
-    // snapshot. Each trust check must read the store at call time instead of
-    // reusing the snapshot captured when the flow began.
-    const setupCall = deps.confirmHooks.mock.calls.find((call) => call[2] === 'setup')
-    const issueCall = deps.confirmHooks.mock.calls.find((call) => call[2] === 'issueCommand')
-    expect(setupCall?.[0]).toBeDefined()
-    expect(issueCall?.[0]).toBeDefined()
-    expect(setupCall?.[0]).not.toBe(snapshots[0])
-    expect(issueCall?.[0]).not.toBe(snapshots[0])
-    expect(issueCall?.[0]).not.toBe(setupCall?.[0])
-  })
-
-  it('keeps the seeded agent prompt as the bare issue URL (not Complete <url>)', async () => {
-    const store = makeStore({
-      ensureDetectedAgents: vi.fn().mockResolvedValue(['codex'])
-    })
-    const deps = makeDeps(store)
-    deps.readIssueCommand.mockResolvedValueOnce({
-      effectiveContent: 'echo {{issue}}',
-      localContent: 'echo {{issue}}',
-      sharedContent: null,
-      localFilePath: '/repo/.orca/issue-command',
-      source: 'local'
-    })
-
-    await createGitHubWorkItemWorkspaceInBackground(
-      {
-        item: makeIssue(),
-        repoId: 'repo-1',
-        openModalFallback: vi.fn()
-      },
-      deps
-    )
-
-    const continueCall = deps.continueBackgroundCreate.mock.calls[0] as unknown[] | undefined
-    expect(continueCall).toBeDefined()
-    const request = continueCall?.[1] as WorktreeCreationRequest
-    // Why: Brennan's confirmed scope keeps the quick-start prompt the bare link;
-    // the issue command runs as a side-pane split, not as the agent prompt.
-    expect(request.startupPlan?.draftPrompt).toBe('https://github.com/stablyai/orca/issues/42')
-    expect(request.startupPlan?.draftPrompt ?? '').not.toContain('Complete')
-    expect(request.quickPrompt).not.toContain('Complete')
-    // The issue command itself still threads through as a side-pane split.
-    expect(request.issueCommand?.command).toBe('echo 42')
-  })
-})
diff --git a/src/renderer/src/lib/github-work-item-background-create.ts b/src/renderer/src/lib/github-work-item-background-create.ts
deleted file mode 100644
index 8f08c1b30cc..00000000000
--- a/src/renderer/src/lib/github-work-item-background-create.ts
+++ /dev/null
@@ -1,328 +0,0 @@
-import { toast } from 'sonner'
-
-import { useAppStore } from '@/store'
-import {
-  beginBackgroundWorktreePreparation,
-  continueBackgroundWorktreeCreation
-} from '@/lib/worktree-creation-flow'
-import {
-  buildGitHubWorkItemBackendStartup,
-  buildGitHubWorkItemStartupPlan,
-  buildInitialGitHubWorkItemRequest,
-  type GitHubWorkItemBackgroundStoreSnapshot,
-  resolvePreferredQuickAgentForGitHubWorkItem
-} from '@/lib/github-work-item-background-request'
-import type { WorktreeCreationRequest } from '@/lib/pending-worktree-creation'
-import {
-  resolveDirectPrStartPoint,
-  resolveDirectSetupDecision
-} from '@/lib/launch-work-item-direct-preflight'
-import { agentLaunchCommandErrorMessage } from '@/lib/launch-work-item-direct-messages'
-import { ensureHooksConfirmed } from '@/lib/ensure-hooks-confirmed'
-import { renderIssueCommandTemplate } from '@/lib/new-workspace'
-import { getSettingsForRepoRuntimeOwner } from '@/lib/repo-runtime-owner'
-import { readRuntimeIssueCommand } from '@/runtime/runtime-hooks-client'
-import { isGitRepoKind } from '../../../shared/repo-kind'
-import { getRepoExecutionHostId, parseExecutionHostId } from '../../../shared/execution-host'
-import { evaluateRuntimeCompat } from '../../../shared/protocol-compat'
-import {
-  MIN_COMPATIBLE_RUNTIME_SERVER_VERSION,
-  RUNTIME_PROTOCOL_VERSION
-} from '../../../shared/protocol-version'
-import type { GitHubWorkItem, SetupDecision, Repo } from '../../../shared/types'
-import type { TaskSourceContext, WorkspaceRunContext } from '../../../shared/task-source-context'
-import { resolveGitHubWorkItemIdentity } from '@/lib/github-work-item-identity'
-
-export type BackgroundGitHubWorkItemCreateResult =
-  | { kind: 'background-started' }
-  | { kind: 'error' }
-  | {
-      kind: 'fallback'
-      reason: 'repo-missing' | 'host-unavailable' | 'setup-ask' | 'pr-start-point' | 'agent-startup'
-    }
-
-type AppActiveView = ReturnType<typeof useAppStore.getState>['activeView']
-
-type BackgroundGitHubWorkItemCreateDeps = {
-  getStore: () => GitHubWorkItemBackgroundStoreSnapshot
-  getActiveView: () => AppActiveView
-  hasPendingCreate: (creationId: string) => boolean
-  isPendingCreateActive: (creationId: string) => boolean
-  resolveSetupDecision: typeof resolveDirectSetupDecision
-  resolvePrStartPoint: typeof resolveDirectPrStartPoint
-  confirmHooks: (
-    store: GitHubWorkItemBackgroundStoreSnapshot,
-    repoId: string,
-    scope: 'setup' | 'issueCommand'
-  ) => ReturnType<typeof ensureHooksConfirmed>
-  readIssueCommand: typeof readRuntimeIssueCommand
-  beginBackgroundCreate: typeof beginBackgroundWorktreePreparation
-  continueBackgroundCreate: typeof continueBackgroundWorktreeCreation
-  activatePendingCreate: (creationId: string) => void
-  removePendingCreate: (creationId: string) => void
-  setActiveView: (view: AppActiveView) => void
-  toastError: (message: string) => void
-}
-
-export type BackgroundGitHubWorkItemCreateArgs = {
-  item: GitHubWorkItem
-  repoId: string
-  taskSourceContext?: TaskSourceContext | null
-  workspaceRunContext?: WorkspaceRunContext | null
-  telemetrySource?: WorktreeCreationRequest['telemetrySource']
-  openModalFallback: () => void
-}
-
-const DEFAULT_DEPS: BackgroundGitHubWorkItemCreateDeps = {
-  getStore: () => useAppStore.getState(),
-  getActiveView: () => useAppStore.getState().activeView,
-  hasPendingCreate: (creationId) =>
-    useAppStore.getState().pendingWorktreeCreations[creationId] != null,
-  isPendingCreateActive: (creationId) =>
-    useAppStore.getState().activePendingCreationId === creationId,
-  resolveSetupDecision: resolveDirectSetupDecision,
-  resolvePrStartPoint: resolveDirectPrStartPoint,
-  confirmHooks: (store, repoId, scope: 'setup' | 'issueCommand') =>
-    ensureHooksConfirmed(store as ReturnType<typeof useAppStore.getState>, repoId, scope),
-  readIssueCommand: readRuntimeIssueCommand,
-  beginBackgroundCreate: beginBackgroundWorktreePreparation,
-  continueBackgroundCreate: continueBackgroundWorktreeCreation,
-  activatePendingCreate: (creationId) => {
-    const store = useAppStore.getState()
-    store.setActivePendingWorktreeCreation(creationId)
-    store.setActiveView('terminal')
-    store.setSidebarOpen(true)
-  },
-  removePendingCreate: (creationId) =>
-    useAppStore.getState().removePendingWorktreeCreation(creationId),
-  setActiveView: (view) => useAppStore.getState().setActiveView(view),
-  toastError: (message) => toast.error(message)
-}
-
-function findPendingGitHubWorkItemCreate(
-  store: GitHubWorkItemBackgroundStoreSnapshot,
-  request: WorktreeCreationRequest
-): string | null {
-  if (!request.linkedIssue && !request.linkedPR) {
-    return null
-  }
-  const match = Object.values(store.pendingWorktreeCreations).find((entry) => {
-    const pending = entry.request
-    return (
-      pending.repoId === request.repoId &&
-      pending.linkedIssue === request.linkedIssue &&
-      pending.linkedPR === request.linkedPR
-    )
-  })
-  return match?.creationId ?? null
-}
-
-function repoHostUnavailable(store: GitHubWorkItemBackgroundStoreSnapshot, repo: Repo): boolean {
-  const host = parseExecutionHostId(getRepoExecutionHostId(repo))
-  if (host?.kind === 'ssh') {
-    return store.sshConnectionStates.get(host.targetId)?.status !== 'connected'
-  }
-  if (host?.kind !== 'runtime') {
-    return false
-  }
-  const status = store.runtimeStatusByEnvironmentId.get(host.environmentId)?.status
-  if (!status) {
-    return true
-  }
-  if (!status.hostPlatform) {
-    return true
-  }
-  const compatibility = evaluateRuntimeCompat({
-    clientProtocolVersion: RUNTIME_PROTOCOL_VERSION,
-    minCompatibleServerProtocolVersion: MIN_COMPATIBLE_RUNTIME_SERVER_VERSION,
-    serverProtocolVersion: status.runtimeProtocolVersion ?? status.protocolVersion,
-    serverMinCompatibleClientProtocolVersion:
-      status.minCompatibleRuntimeClientVersion ?? status.minCompatibleMobileVersion
-  })
-  return compatibility.kind === 'blocked'
-}
-
-function abandonStagedCreate(
-  creationId: string,
-  restoreView: AppActiveView,
-  deps: BackgroundGitHubWorkItemCreateDeps
-): void {
-  // Why: fallback paths abandon the temporary creation surface, so return to the
-  // flow that launched it unless the user already activated something else.
-  const shouldRestoreView = deps.isPendingCreateActive(creationId)
-  deps.removePendingCreate(creationId)
-  if (shouldRestoreView) {
-    deps.setActiveView(restoreView)
-  }
-}
-
-export async function createGitHubWorkItemWorkspaceInBackground(
-  args: BackgroundGitHubWorkItemCreateArgs,
-  deps: BackgroundGitHubWorkItemCreateDeps = DEFAULT_DEPS
-): Promise<BackgroundGitHubWorkItemCreateResult> {
-  const store = deps.getStore()
-  const repo = store.repos.find((candidate) => candidate.id === args.repoId)
-  if (!repo) {
-    args.openModalFallback()
-    return { kind: 'fallback', reason: 'repo-missing' }
-  }
-
-  const initialRequest = buildInitialGitHubWorkItemRequest(args, repo)
-  const existingPendingCreateId = findPendingGitHubWorkItemCreate(store, initialRequest)
-  if (existingPendingCreateId) {
-    deps.activatePendingCreate(existingPendingCreateId)
-    return { kind: 'background-started' }
-  }
-  // Why: disconnected hosts make hook and agent probes fall back to skip/no-agent;
-  // keep the old composer gate so Retry cannot reuse degraded preflight values.
-  if (repoHostUnavailable(store, repo)) {
-    args.openModalFallback()
-    return { kind: 'fallback', reason: 'host-unavailable' }
-  }
-
-  const restoreView = deps.getActiveView()
-  const creationId = deps.beginBackgroundCreate(initialRequest)
-  const itemIdentity = resolveGitHubWorkItemIdentity(args.item)
-
-  try {
-    const repoOwnerSettings = getSettingsForRepoRuntimeOwner(store, args.repoId)
-    const setupResolution = await deps.resolveSetupDecision(args.repoId, repo, repoOwnerSettings)
-    // Why: once the staged row disappears, the user already cancelled or moved
-    // on, so every later preflight await must exit without reopening UI.
-    if (!deps.hasPendingCreate(creationId)) {
-      return { kind: 'background-started' }
-    }
-    if (setupResolution.kind === 'needs-modal') {
-      abandonStagedCreate(creationId, restoreView, deps)
-      args.openModalFallback()
-      return { kind: 'fallback', reason: 'setup-ask' }
-    }
-
-    let baseBranch: string | undefined
-    let pushTarget: WorktreeCreationRequest['pushTarget']
-    let branchNameOverride: string | undefined
-    let compareBaseRef: string | undefined
-    if (itemIdentity.type === 'pr' && itemIdentity.number) {
-      try {
-        const result = await deps.resolvePrStartPoint(
-          args.repoId,
-          itemIdentity.number,
-          repoOwnerSettings,
-          args.item
-        )
-        baseBranch = result.baseBranch
-        pushTarget = result.pushTarget
-        branchNameOverride = result.branchNameOverride
-        compareBaseRef = result.compareBaseRef
-        if (!deps.hasPendingCreate(creationId)) {
-          return { kind: 'background-started' }
-        }
-      } catch (error) {
-        if (!deps.hasPendingCreate(creationId)) {
-          return { kind: 'background-started' }
-        }
-        deps.toastError(error instanceof Error ? error.message : 'Unable to resolve pull request.')
-        abandonStagedCreate(creationId, restoreView, deps)
-        args.openModalFallback()
-        return { kind: 'fallback', reason: 'pr-start-point' }
-      }
-    }
-
-    // Why: trust prompts are serialized app-wide, so read the store fresh at
-    // each check — an "Always trust" stamped by an earlier prompt (including
-    // this flow's own setup prompt) must short-circuit instead of re-prompting.
-    const trustDecision = await deps.confirmHooks(deps.getStore(), args.repoId, 'setup')
-    if (!deps.hasPendingCreate(creationId)) {
-      return { kind: 'background-started' }
-    }
-    const setupDecision: SetupDecision =
-      trustDecision === 'skip' ? 'skip' : setupResolution.decision
-    const agent = await resolvePreferredQuickAgentForGitHubWorkItem(store, repo)
-    if (!deps.hasPendingCreate(creationId)) {
-      return { kind: 'background-started' }
-    }
-    const { startupPlan, quickPrompt, launchDraftPrompt, quickTelemetry } =
-      buildGitHubWorkItemStartupPlan({
-        agent,
-        item: args.item,
-        repo,
-        store
-      })
-    if (agent && !startupPlan) {
-      deps.toastError(agentLaunchCommandErrorMessage())
-      abandonStagedCreate(creationId, restoreView, deps)
-      args.openModalFallback()
-      return { kind: 'fallback', reason: 'agent-startup' }
-    }
-    const backendStartup = buildGitHubWorkItemBackendStartup(agent, startupPlan, quickTelemetry)
-
-    // Why: mirror the composer's trust-gated issue-command split. Only GitHub
-    // issues (numeric issue number) on git repos run it; PRs/Linear/folders never
-    // do. Reuse the setup trust decision: a 'skip' there also skips the command.
-    let issueCommand: WorktreeCreationRequest['issueCommand']
-    // Why: a declined setup trust also skips the issue command, so short-circuit
-    // before the (up-to-15s) read rather than reading just to drop the result.
-    if (
-      trustDecision !== 'skip' &&
-      isGitRepoKind(repo) &&
-      args.item.type === 'issue' &&
-      typeof args.item.number === 'number'
-    ) {
-      // Why: read failures fail closed (no command), so create still proceeds.
-      let effectiveContent = ''
-      try {
-        const issueCommandRead = await deps.readIssueCommand(repoOwnerSettings, args.repoId)
-        effectiveContent = (issueCommandRead.effectiveContent ?? '').trim()
-      } catch {
-        effectiveContent = ''
-      }
-      if (!deps.hasPendingCreate(creationId)) {
-        return { kind: 'background-started' }
-      }
-      if (effectiveContent.length > 0) {
-        const issueCommandTrust = await deps.confirmHooks(
-          deps.getStore(),
-          args.repoId,
-          'issueCommand'
-        )
-        if (!deps.hasPendingCreate(creationId)) {
-          return { kind: 'background-started' }
-        }
-        if (issueCommandTrust === 'run') {
-          issueCommand = {
-            command: renderIssueCommandTemplate(effectiveContent, {
-              issueNumber: args.item.number,
-              artifactUrl: args.item.url ?? null
-            })
-          }
-        }
-      }
-    }
-
-    const request: WorktreeCreationRequest = {
-      ...initialRequest,
-      ...(baseBranch ? { baseBranch } : {}),
-      ...(compareBaseRef ? { compareBaseRef } : {}),
-      setupDecision,
-      ...(pushTarget ? { pushTarget } : {}),
-      agent,
-      ...(branchNameOverride ? { branchNameOverride } : {}),
-      ...(backendStartup ? { startup: backendStartup } : {}),
-      ...(issueCommand ? { issueCommand } : {}),
-      startupPlan,
-      quickPrompt,
-      ...(launchDraftPrompt ? { launchDraftPrompt } : {}),
-      quickTelemetry
-    }
-
-    deps.continueBackgroundCreate(creationId, request, { revealCreationSurface: false })
-    return { kind: 'background-started' }
-  } catch (error) {
-    if (!deps.hasPendingCreate(creationId)) {
-      return { kind: 'background-started' }
-    }
-    abandonStagedCreate(creationId, restoreView, deps)
-    deps.toastError(error instanceof Error ? error.message : 'Unable to prepare workspace.')
-    return { kind: 'error' }
-  }
-}
diff --git a/src/renderer/src/lib/github-work-item-background-request.ts b/src/renderer/src/lib/github-work-item-background-request.ts
deleted file mode 100644
index 60ebed0477a..00000000000
--- a/src/renderer/src/lib/github-work-item-background-request.ts
+++ /dev/null
@@ -1,311 +0,0 @@
-import type { useAppStore } from '@/store'
-import {
-  buildAgentDraftLaunchPlan,
-  buildAgentStartupPlan,
-  type AgentStartupPlan
-} from '@/lib/tui-agent-startup'
-import { resolveQuickCreateLinkedWorkItemPrompt } from '@/lib/linked-work-item-context'
-import { pickQuickWorkspaceAgent } from '@/lib/quick-workspace-agent-selection'
-import type {
-  PendingWorktreeCreation,
-  WorktreeCreationRequest
-} from '@/lib/pending-worktree-creation'
-import { CLIENT_PLATFORM, getWorkspaceIntentName, getWorkspaceSeedName } from '@/lib/new-workspace'
-import { getLocalRepoProjectExecutionRuntimeContext } from '@/lib/local-preflight-context'
-import { resolveSourceControlLaunchPlatform } from '@/lib/source-control-launch-platform'
-import { repoIsRemote } from '../../../shared/agent-launch-remote'
-import { resolveGitHubWorkItemIdentity } from '@/lib/github-work-item-identity'
-import { buildGitHubWorkspaceSource } from '../../../shared/new-workspace/workspace-source'
-import {
-  resolveTuiAgentLaunchArgs,
-  resolveTuiAgentLaunchEnv
-} from '../../../shared/tui-agent-launch-defaults'
-import { tuiAgentToAgentKind } from '@/lib/telemetry'
-import type { GitHubWorkItem, GlobalSettings, Repo, TuiAgent } from '../../../shared/types'
-import type { TaskSourceContext, WorkspaceRunContext } from '../../../shared/task-source-context'
-import type { AgentStartedTelemetry } from '@/lib/worktree-activation'
-import { getRepoExecutionHostId, parseExecutionHostId } from '../../../shared/execution-host'
-import { projectHostSetupProjectionFromRepos } from '../../../shared/project-host-setup-projection'
-import { resolveLocalWindowsAgentStartupShell } from '../../../shared/windows-terminal-shell'
-
-export type GitHubWorkItemBackgroundStoreSnapshot = {
-  repos: readonly Repo[]
-  pendingWorktreeCreations: Record<string, PendingWorktreeCreation>
-  sshConnectionStates: ReturnType<typeof useAppStore.getState>['sshConnectionStates']
-  runtimeStatusByEnvironmentId: ReturnType<
-    typeof useAppStore.getState
-  >['runtimeStatusByEnvironmentId']
-  settings:
-    | Partial<
-        Pick<
-          GlobalSettings,
-          | 'activeRuntimeEnvironmentId'
-          | 'defaultTuiAgent'
-          | 'disabledTuiAgents'
-          | 'agentCmdOverrides'
-          | 'agentDefaultArgs'
-          | 'agentDefaultEnv'
-          | 'terminalWindowsShell'
-        >
-      >
-    | null
-    | undefined
-  ensureDetectedAgents: ReturnType<typeof useAppStore.getState>['ensureDetectedAgents']
-  ensureRemoteDetectedAgents: ReturnType<typeof useAppStore.getState>['ensureRemoteDetectedAgents']
-  ensureRuntimeDetectedAgents: ReturnType<
-    typeof useAppStore.getState
-  >['ensureRuntimeDetectedAgents']
-}
-
-export type BuildInitialGitHubWorkItemRequestArgs = {
-  item: GitHubWorkItem
-  repoId: string
-  taskSourceContext?: TaskSourceContext | null
-  workspaceRunContext?: WorkspaceRunContext | null
-  telemetrySource?: WorktreeCreationRequest['telemetrySource']
-}
-
-type QuickCreateLinkedWorkItemPromptResult = ReturnType<
-  typeof resolveQuickCreateLinkedWorkItemPrompt
->
-
-function resolveGitHubWorkItemPrompt(item: GitHubWorkItem): QuickCreateLinkedWorkItemPromptResult {
-  const resolver = resolveQuickCreateLinkedWorkItemPrompt as unknown as (
-    linkedWorkItem: GitHubWorkItem,
-    note: string,
-    opts?: { cliAvailable: boolean }
-  ) => QuickCreateLinkedWorkItemPromptResult
-  return resolver(item, '', { cliAvailable: false })
-}
-
-export function buildGitHubWorkItemBackendStartup(
-  agent: TuiAgent | null,
-  startupPlan: AgentStartupPlan | null,
-  quickTelemetry: AgentStartedTelemetry | null
-): WorktreeCreationRequest['startup'] {
-  // Why: draft/followup launches still need the renderer to finish terminal
-  // setup, so only self-contained startup plans can move into createWorktree.
-  if (!agent || !startupPlan || startupPlan.draftPrompt || startupPlan.followupPrompt) {
-    return undefined
-  }
-  return {
-    command: startupPlan.launchCommand,
-    ...(startupPlan.env ? { env: startupPlan.env } : {}),
-    launchConfig: startupPlan.launchConfig,
-    launchAgent: agent,
-    ...(startupPlan.startupCommandDelivery
-      ? { startupCommandDelivery: startupPlan.startupCommandDelivery }
-      : {}),
-    ...(quickTelemetry ? { telemetry: quickTelemetry } : {})
-  }
-}
-
-function getWorkspaceRunContextForRepo(
-  repo: Repo,
-  provided: WorkspaceRunContext | null | undefined
-): WorkspaceRunContext | null {
-  if (provided) {
-    return provided
-  }
-  const projection = projectHostSetupProjectionFromRepos([repo])
-  const project = projection.projects[0]
-  const setup = projection.setups[0]
-  if (!project || !setup) {
-    return null
-  }
-  return {
-    kind: 'workspace-run',
-    projectId: project.id,
-    hostId: getRepoExecutionHostId(repo),
-    projectHostSetupId: setup.id,
-    repoId: repo.id,
-    path: repo.path
-  }
-}
-
-export async function resolvePreferredQuickAgentForGitHubWorkItem(
-  store: GitHubWorkItemBackgroundStoreSnapshot,
-  repo: Repo
-): Promise<TuiAgent | null> {
-  const host = parseExecutionHostId(getRepoExecutionHostId(repo))
-  const detectedAgents =
-    host?.kind === 'ssh'
-      ? await store.ensureRemoteDetectedAgents(host.targetId)
-      : host?.kind === 'runtime'
-        ? await store.ensureRuntimeDetectedAgents(host.environmentId)
-        : await store.ensureDetectedAgents()
-  return pickQuickWorkspaceAgent(
-    store.settings?.defaultTuiAgent,
-    detectedAgents,
-    store.settings?.disabledTuiAgents
-  )
-}
-
-function resolveGitHubWorkItemLaunchPlatform(
-  store: GitHubWorkItemBackgroundStoreSnapshot,
-  repo: Repo
-): NodeJS.Platform {
-  const host = parseExecutionHostId(getRepoExecutionHostId(repo))
-  if (host?.kind === 'runtime') {
-    // Why: the background runtime path gates on hostPlatform before this point;
-    // POSIX is safer than client PowerShell if another caller violates that.
-    return (
-      store.runtimeStatusByEnvironmentId.get(host.environmentId)?.status?.hostPlatform ?? 'linux'
-    )
-  }
-  const projectRuntime = repo.connectionId
-    ? undefined
-    : getLocalRepoProjectExecutionRuntimeContext(
-        store as ReturnType<typeof useAppStore.getState>,
-        repo.id,
-        CLIENT_PLATFORM
-      )
-  return resolveSourceControlLaunchPlatform({
-    connectionId: repo.connectionId,
-    worktreePath: repo.path,
-    projectRuntime
-  })
-}
-
-export function buildGitHubWorkItemStartupPlan(args: {
-  agent: TuiAgent | null
-  item: GitHubWorkItem
-  repo: Repo
-  store: GitHubWorkItemBackgroundStoreSnapshot
-}): {
-  startupPlan: AgentStartupPlan | null
-  quickPrompt: string
-  /** Draft context (issue link) that reaches only the TUI input; callers thread
-   *  it onto the creation request so completion can seed the chat composer. */
-  launchDraftPrompt: string | null
-  quickTelemetry: AgentStartedTelemetry | null
-} {
-  const { agent, item, repo, store } = args
-  if (!agent) {
-    return { startupPlan: null, quickPrompt: '', launchDraftPrompt: null, quickTelemetry: null }
-  }
-  const { prompt: quickPrompt, draftPrompt } = resolveGitHubWorkItemPrompt(item)
-  // Why: runtime-owned repos launch on their owner host, not on the client
-  // desktop, so startup shell quoting must use the runtime platform.
-  const platform = resolveGitHubWorkItemLaunchPlatform(store, repo)
-  // Why: SSH remotes deploy the CLI shim as plain `orca`, so the Linux-only
-  // `orca-ide` rename must not be applied for remote launches.
-  const isRemote = repoIsRemote(repo)
-  const shell = resolveLocalWindowsAgentStartupShell({
-    platform,
-    isRemote,
-    terminalWindowsShell: store.settings?.terminalWindowsShell
-  })
-  const draftLaunchPlan = draftPrompt
-    ? buildAgentDraftLaunchPlan({
-        agent,
-        draft: draftPrompt,
-        cmdOverrides: store.settings?.agentCmdOverrides ?? {},
-        agentArgs: resolveTuiAgentLaunchArgs(agent, store.settings?.agentDefaultArgs),
-        agentEnv: resolveTuiAgentLaunchEnv(agent, store.settings?.agentDefaultEnv),
-        platform,
-        shell,
-        isRemote
-      })
-    : null
-  const startupPlan = draftLaunchPlan
-    ? {
-        agent: draftLaunchPlan.agent,
-        launchCommand: draftLaunchPlan.launchCommand,
-        expectedProcess: draftLaunchPlan.expectedProcess,
-        followupPrompt: null,
-        launchConfig: draftLaunchPlan.launchConfig,
-        ...(draftLaunchPlan.startupCommandDelivery
-          ? { startupCommandDelivery: draftLaunchPlan.startupCommandDelivery }
-          : {}),
-        ...(draftLaunchPlan.env ? { env: draftLaunchPlan.env } : {})
-      }
-    : buildAgentStartupPlan({
-        agent,
-        prompt: quickPrompt,
-        cmdOverrides: store.settings?.agentCmdOverrides ?? {},
-        agentArgs: resolveTuiAgentLaunchArgs(agent, store.settings?.agentDefaultArgs),
-        agentEnv: resolveTuiAgentLaunchEnv(agent, store.settings?.agentDefaultEnv),
-        platform,
-        shell,
-        isRemote,
-        allowEmptyPromptLaunch: true
-      })
-  if (startupPlan && draftPrompt && !draftLaunchPlan) {
-    startupPlan.draftPrompt = draftPrompt
-  }
-  return {
-    startupPlan,
-    quickPrompt,
-    launchDraftPrompt: draftPrompt || null,
-    quickTelemetry: {
-      agent_kind: tuiAgentToAgentKind(agent),
-      launch_source: 'new_workspace_composer',
-      request_kind: 'new'
-    }
-  }
-}
-
-function getGitHubWorkItemName(item: GitHubWorkItem): { seedName: string; displayName?: string } {
-  const identity = resolveGitHubWorkItemIdentity(item)
-  const intent =
-    identity.number !== null
-      ? getWorkspaceIntentName({
-          sourceText: item.title,
-          workItem: { type: identity.type, number: identity.number, title: item.title }
-        })
-      : null
-  return {
-    seedName: getWorkspaceSeedName({
-      explicitName: intent?.seedName ?? '',
-      prompt: '',
-      linkedIssueNumber: identity.type === 'issue' ? identity.number : null,
-      linkedPR: identity.type === 'pr' ? identity.number : null
-    }),
-    ...(intent?.displayName ? { displayName: intent.displayName } : {})
-  }
-}
-
-export function buildInitialGitHubWorkItemRequest(
-  args: BuildInitialGitHubWorkItemRequestArgs,
-  repo: Repo
-): WorktreeCreationRequest {
-  const { seedName, displayName } = getGitHubWorkItemName(args.item)
-  const workspaceRunContext = getWorkspaceRunContextForRepo(repo, args.workspaceRunContext)
-  const ownerHost = parseExecutionHostId(getRepoExecutionHostId(repo))
-  const identity = resolveGitHubWorkItemIdentity(args.item)
-  const linkedWorkItem =
-    identity.number !== null
-      ? buildGitHubWorkspaceSource({
-          type: identity.type,
-          number: identity.number,
-          title: args.item.title,
-          url: args.item.url,
-          repoId: args.repoId
-        })
-      : null
-  return {
-    repoId: args.repoId,
-    worktreeCreateProgressMode: ownerHost?.kind === 'local' ? 'stepped' : 'indeterminate',
-    ...(args.taskSourceContext ? { taskSourceContext: args.taskSourceContext } : {}),
-    ...(linkedWorkItem
-      ? {
-          linkedWorkItem,
-          ...(args.taskSourceContext ? { linkedTaskSourceContext: args.taskSourceContext } : {})
-        }
-      : {}),
-    ...(workspaceRunContext ? { workspaceRunContext } : {}),
-    name: seedName,
-    ...(displayName ? { displayName } : {}),
-    ...(identity.type === 'issue' && identity.number ? { linkedIssue: identity.number } : {}),
-    ...(identity.type === 'pr' && identity.number ? { linkedPR: identity.number } : {}),
-    ...(args.telemetrySource ? { telemetrySource: args.telemetrySource } : {}),
-    setupDecision: 'inherit',
-    agent: null,
-    pendingFirstAgentMessageRename: false,
-    note: '',
-    startupPlan: null,
-    quickPrompt: '',
-    quickTelemetry: null
-  }
-}
diff --git a/src/renderer/src/lib/http-link-modifier-routing.test.ts b/src/renderer/src/lib/http-link-modifier-routing.test.ts
index c7da95ae4c2..fb3be988a4f 100644
--- a/src/renderer/src/lib/http-link-modifier-routing.test.ts
+++ b/src/renderer/src/lib/http-link-modifier-routing.test.ts
@@ -2,6 +2,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   openHttpLink,
   registerHttpLinkStoreAccessor,
+  registerRuntimeHttpLinkBrowserOpener,
   resolveModifierRouting
 } from './http-link-routing'
 
@@ -58,6 +59,7 @@ describe('modifier routing across link source owners', () => {
   const openUrlMock = vi.fn()
   const setActiveWorktreeMock = vi.fn()
   const createBrowserTabMock = vi.fn()
+  const openRuntimeBrowserTabMock = vi.fn(() => Promise.resolve())
   const storeState = {
     settings: {} as {
       openLinksInApp?: boolean
@@ -71,10 +73,12 @@ describe('modifier routing across link source owners', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     registerHttpLinkStoreAccessor(() => storeState)
+    registerRuntimeHttpLinkBrowserOpener(openRuntimeBrowserTabMock)
     vi.stubGlobal('window', { api: { shell: { openUrl: openUrlMock } } })
   })
 
   afterEach(() => {
+    registerRuntimeHttpLinkBrowserOpener(null)
     vi.unstubAllGlobals()
   })
 
@@ -92,23 +96,40 @@ describe('modifier routing across link source owners', () => {
     })
   })
 
-  it('never lets a modifier pull a runtime-owned link into Orca', () => {
-    for (const inverts of [true, false]) {
-      vi.clearAllMocks()
-      storeState.settings = {
-        openLinksInApp: false,
-        openLinksInAppModifierInverts: inverts,
-        activeRuntimeEnvironmentId: null
-      }
-
-      openHttpLink('https://example.com/', {
-        worktreeId: 'wt-1',
-        modifierHeld: true,
-        sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
-      })
-
-      expect(openUrlMock).toHaveBeenCalledWith('https://example.com/')
-      expect(createBrowserTabMock).not.toHaveBeenCalled()
+  it('lets an inverting modifier reach Orca on the owning runtime', () => {
+    storeState.settings = {
+      openLinksInApp: false,
+      openLinksInAppModifierInverts: true,
+      activeRuntimeEnvironmentId: null
     }
+
+    openHttpLink('https://example.com/', {
+      allowRuntimeInApp: true,
+      worktreeId: 'wt-1',
+      modifierHeld: true,
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
+    })
+
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledWith(
+      expect.objectContaining({ expectedRuntimeEnvironmentId: 'env-1' })
+    )
+    expect(openUrlMock).not.toHaveBeenCalled()
+  })
+
+  it('keeps the legacy modifier on the system browser when inversion is off', () => {
+    storeState.settings = {
+      openLinksInApp: false,
+      openLinksInAppModifierInverts: false,
+      activeRuntimeEnvironmentId: null
+    }
+
+    openHttpLink('https://example.com/', {
+      worktreeId: 'wt-1',
+      modifierHeld: true,
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
+    })
+
+    expect(openUrlMock).toHaveBeenCalledWith('https://example.com/')
+    expect(openRuntimeBrowserTabMock).not.toHaveBeenCalled()
   })
 })
diff --git a/src/renderer/src/lib/http-link-routing.test.ts b/src/renderer/src/lib/http-link-routing.test.ts
index 64991900a25..1be44f90732 100644
--- a/src/renderer/src/lib/http-link-routing.test.ts
+++ b/src/renderer/src/lib/http-link-routing.test.ts
@@ -4,13 +4,19 @@ import type { WorkspacePortScanResult } from '../../../shared/workspace-ports'
 import {
   openHttpLink,
   registerHttpLinkStoreAccessor,
+  registerRuntimeHttpLinkBrowserOpener,
   resolveLocalhostHttpLinkDisplayUrl
 } from './http-link-routing'
 
+const toastErrorMock = vi.hoisted(() => vi.fn())
+
+vi.mock('sonner', () => ({ toast: { error: toastErrorMock } }))
+
 const openUrlMock = vi.fn()
 const registerLocalhostLabelMock = vi.fn()
 const setActiveWorktreeMock = vi.fn()
 const createBrowserTabMock = vi.fn()
+const openRuntimeBrowserTabMock = vi.fn(() => Promise.resolve())
 
 const storeState = {
   settings: undefined as
@@ -42,6 +48,7 @@ beforeEach(() => {
   storeState.settings = undefined
   storeState.workspacePortScansByKey = {}
   registerHttpLinkStoreAccessor(() => storeState)
+  registerRuntimeHttpLinkBrowserOpener(openRuntimeBrowserTabMock)
   vi.stubGlobal('window', {
     api: {
       shell: {
@@ -55,6 +62,7 @@ beforeEach(() => {
 })
 
 afterEach(() => {
+  registerRuntimeHttpLinkBrowserOpener(null)
   vi.unstubAllGlobals()
 })
 
@@ -155,10 +163,11 @@ describe('openHttpLink', () => {
     expect(openUrlMock).not.toHaveBeenCalled()
   })
 
-  it('routes explicit runtime and SSH document owners to the exact system URL', () => {
+  it('routes runtime and SSH document owners to their distinct destinations', () => {
     storeState.settings = { openLinksInApp: true, localhostWorktreeLabelsEnabled: true }
 
     openHttpLink('http://localhost:5180/runtime', {
+      allowRuntimeInApp: true,
       worktreeId: 'wt-1',
       sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
     })
@@ -167,25 +176,75 @@ describe('openHttpLink', () => {
       sourceOwner: { kind: 'ssh', connectionId: 'ssh-1' }
     })
 
-    expect(openUrlMock).toHaveBeenNthCalledWith(1, 'http://localhost:5180/runtime')
-    expect(openUrlMock).toHaveBeenNthCalledWith(2, 'http://localhost:5180/ssh')
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledWith({
+      workspaceId: 'wt-1',
+      url: 'http://localhost:5180/runtime',
+      intent: { kind: 'url' },
+      expectedRuntimeEnvironmentId: 'env-1'
+    })
+    expect(openUrlMock).toHaveBeenCalledWith('http://localhost:5180/ssh')
     expect(createBrowserTabMock).not.toHaveBeenCalled()
     expect(registerLocalhostLabelMock).not.toHaveBeenCalled()
   })
 
   // Why: runtimes bind per workspace, so activeRuntimeEnvironmentId is commonly
   // null while a pane is remote — ownership must come from the click source.
-  it('keeps a runtime-owned link out of Orca when no runtime is globally active', () => {
+  it('uses the pane runtime owner when no runtime is globally active', () => {
     storeState.settings = { openLinksInApp: true, activeRuntimeEnvironmentId: null }
 
+    openHttpLink('https://example.com/', {
+      allowRuntimeInApp: true,
+      worktreeId: 'wt-1',
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
+    })
+
+    expect(openRuntimeBrowserTabMock).toHaveBeenCalledWith(
+      expect.objectContaining({ expectedRuntimeEnvironmentId: 'env-1' })
+    )
+    expect(openUrlMock).not.toHaveBeenCalled()
+    expect(createBrowserTabMock).not.toHaveBeenCalled()
+    expect(setActiveWorktreeMock).not.toHaveBeenCalled()
+  })
+
+  it('fails closed instead of falling back to the client system browser', async () => {
+    storeState.settings = { openLinksInApp: true }
+    openRuntimeBrowserTabMock.mockRejectedValueOnce(new Error('runtime unavailable'))
+
+    openHttpLink('https://example.com/', {
+      allowRuntimeInApp: true,
+      worktreeId: 'wt-1',
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
+    })
+
+    await vi.waitFor(() => expect(openRuntimeBrowserTabMock).toHaveBeenCalledOnce())
+    expect(openUrlMock).not.toHaveBeenCalled()
+    expect(createBrowserTabMock).not.toHaveBeenCalled()
+    expect(toastErrorMock).toHaveBeenCalledWith('runtime unavailable')
+  })
+
+  it('keeps an explicit runtime system-browser action on the viewing client', () => {
+    storeState.settings = { openLinksInApp: true }
+
+    openHttpLink('https://example.com/', {
+      worktreeId: 'wt-1',
+      forceSystemBrowser: true,
+      sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
+    })
+
+    expect(openUrlMock).toHaveBeenCalledWith('https://example.com/')
+    expect(openRuntimeBrowserTabMock).not.toHaveBeenCalled()
+  })
+
+  it('keeps generic runtime-owned document links in the system browser', () => {
+    storeState.settings = { openLinksInApp: true }
+
     openHttpLink('https://example.com/', {
       worktreeId: 'wt-1',
       sourceOwner: { kind: 'runtime', runtimeEnvironmentId: 'env-1' }
     })
 
     expect(openUrlMock).toHaveBeenCalledWith('https://example.com/')
-    expect(createBrowserTabMock).not.toHaveBeenCalled()
-    expect(setActiveWorktreeMock).not.toHaveBeenCalled()
+    expect(openRuntimeBrowserTabMock).not.toHaveBeenCalled()
   })
 
   it('labels explicit local links from the local scan instead of a merged remote port', async () => {
diff --git a/src/renderer/src/lib/http-link-routing.ts b/src/renderer/src/lib/http-link-routing.ts
index 60f53457fc7..4b4a6a22a23 100644
--- a/src/renderer/src/lib/http-link-routing.ts
+++ b/src/renderer/src/lib/http-link-routing.ts
@@ -1,3 +1,4 @@
+import { translate } from '@/i18n/i18n'
 import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
 import {
   parseLoopbackUrlWithPort,
@@ -5,9 +6,12 @@ import {
 } from '../../../shared/localhost-worktree-labels'
 import type { GlobalSettings } from '../../../shared/types'
 import type { WorkspacePort, WorkspacePortScanResult } from '../../../shared/workspace-ports'
+import { toast } from 'sonner'
 
 export type OpenHttpLinkOptions = {
   worktreeId?: string | null
+  /** Terminal-only opt-in for routing a runtime-owned source through its managed browser. */
+  allowRuntimeInApp?: boolean
   /** Unconditional: always use the system browser regardless of settings. */
   forceSystemBrowser?: boolean
   /** Unconditional for local sources: open inside Orca regardless of settings. */
@@ -35,7 +39,7 @@ type StoreAccessor = () => {
   > | null
   setActiveWorktree: (worktreeId: string) => void
   createBrowserTab: (worktreeId: string, url: string, opts: { activate: boolean }) => unknown
-  repos?: LocalhostLinkRepo[]
+  repos?: readonly LocalhostLinkRepo[]
   projects?: LocalhostLinkProject[]
   worktreesByRepo?: Record<string, LocalhostLinkWorktree[]>
   allWorktrees?: () => LocalhostLinkWorktree[]
@@ -43,6 +47,15 @@ type StoreAccessor = () => {
   workspacePortScansByKey?: Record<string, WorkspacePortScanResult>
 }
 
+type RuntimeHttpLinkBrowserRequest = {
+  workspaceId: string
+  url: string
+  intent: { kind: 'url' }
+  expectedRuntimeEnvironmentId: string
+}
+
+type RuntimeHttpLinkBrowserOpener = (request: RuntimeHttpLinkBrowserRequest) => Promise<void>
+
 type LocalhostLinkRepo = {
   id: string
   displayName: string
@@ -61,11 +74,18 @@ type LocalhostLinkWorktree = {
 // the break, several renderer test files that load this module first see
 // `createEditorSlice` as undefined at store/index.ts initialization.
 let storeAccessor: StoreAccessor | null = null
+let runtimeHttpLinkBrowserOpener: RuntimeHttpLinkBrowserOpener | null = null
 
 export function registerHttpLinkStoreAccessor(fn: StoreAccessor): void {
   storeAccessor = fn
 }
 
+export function registerRuntimeHttpLinkBrowserOpener(
+  fn: RuntimeHttpLinkBrowserOpener | null
+): void {
+  runtimeHttpLinkBrowserOpener = fn
+}
+
 // Scope: http(s) URLs only. file: URIs and in-worktree markdown targets are
 // owned by resolveMarkdownLinkTarget and must stay on that path — this helper
 // is only invoked on target.kind === 'external' (and for the terminal's http
@@ -93,7 +113,14 @@ export function resolveModifierRouting(
 }
 
 export function openHttpLink(url: string, opts: OpenHttpLinkOptions = {}): void {
-  const { worktreeId, forceSystemBrowser, forceInApp, modifierHeld, sourceOwner } = opts
+  const {
+    worktreeId,
+    allowRuntimeInApp,
+    forceSystemBrowser,
+    forceInApp,
+    modifierHeld,
+    sourceOwner
+  } = opts
   if (sourceOwner?.kind === 'unknown') {
     return
   }
@@ -106,14 +133,31 @@ export function openHttpLink(url: string, opts: OpenHttpLinkOptions = {}): void
     openLinksInApp,
     state?.settings?.openLinksInAppModifierInverts === true
   )
-  const routeToOrca =
-    sourceIsLocal &&
+  const wantsOrca =
     !forceSystemBrowser &&
     !modifier.wantsSystemBrowser &&
     Boolean(worktreeId) &&
     (forceInApp || openLinksInApp || modifier.wantsOrca)
 
-  if (routeToOrca && worktreeId && state) {
+  if (wantsOrca && allowRuntimeInApp && worktreeId && sourceOwner?.kind === 'runtime') {
+    if (runtimeHttpLinkBrowserOpener) {
+      void runtimeHttpLinkBrowserOpener({
+        workspaceId: worktreeId,
+        url,
+        intent: { kind: 'url' },
+        expectedRuntimeEnvironmentId: sourceOwner.runtimeEnvironmentId
+      }).catch((error) => {
+        toast.error(
+          error instanceof Error
+            ? error.message
+            : translate('auto.lib.workspace.browser.tab.open.urlFailed', 'Unable to open URL.')
+        )
+      })
+    }
+    return
+  }
+
+  if (wantsOrca && sourceIsLocal && worktreeId && state) {
     // Why: http clicks from inside a worktree should not push a worktree-switch
     // history entry — the user isn't changing worktrees, they're opening a tab
     // in the one they're already in. activateAndRevealWorktree is reserved for
diff --git a/src/renderer/src/lib/input-quiet-scheduler.ts b/src/renderer/src/lib/input-quiet-scheduler.ts
index 7e251ee6813..66ed6c6d90f 100644
--- a/src/renderer/src/lib/input-quiet-scheduler.ts
+++ b/src/renderer/src/lib/input-quiet-scheduler.ts
@@ -2,6 +2,7 @@ type InputQuietScheduleOptions = {
   delayMs: number
   quietMs: number
   idleTimeoutMs: number
+  maxWaitMs?: number
 }
 
 const INPUT_QUIET_EVENTS: readonly (keyof WindowEventMap)[] = [
@@ -14,7 +15,7 @@ const INPUT_QUIET_EVENTS: readonly (keyof WindowEventMap)[] = [
 ]
 
 let listenersInstalled = false
-let lastInputAt = 0
+let lastInputAt = Number.NEGATIVE_INFINITY
 
 function now(): number {
   return typeof performance !== 'undefined' ? performance.now() : Date.now()
@@ -28,12 +29,22 @@ export function markInputQuietSchedulerInput(): void {
   recordInput()
 }
 
+export function resetInputQuietSchedulerForTest(): void {
+  lastInputAt = Number.NEGATIVE_INFINITY
+}
+
+export function hasInputBeenQuietFor(quietMs: number): boolean {
+  if (typeof window !== 'undefined') {
+    ensureInputQuietListeners(window)
+  }
+  return now() - lastInputAt >= quietMs
+}
+
 function ensureInputQuietListeners(targetWindow: Window): void {
   if (listenersInstalled) {
     return
   }
   listenersInstalled = true
-  lastInputAt = now()
   const options: AddEventListenerOptions = { capture: true, passive: true }
   for (const eventName of INPUT_QUIET_EVENTS) {
     targetWindow.addEventListener(eventName, recordInput, options)
@@ -63,7 +74,7 @@ function cancelIdleCallback(targetWindow: Window, idleId: number): void {
 
 export function scheduleAfterInputQuiet(
   callback: () => void,
-  { delayMs, quietMs, idleTimeoutMs }: InputQuietScheduleOptions
+  { delayMs, quietMs, idleTimeoutMs, maxWaitMs }: InputQuietScheduleOptions
 ): () => void {
   if (typeof window === 'undefined') {
     const fallbackTimer = setTimeout(callback, delayMs)
@@ -77,12 +88,34 @@ export function scheduleAfterInputQuiet(
   let delayTimer: number | null = null
   let quietTimer: number | null = null
   let idleId: number | null = null
+  let maxWaitTimer: number | null = null
+
+  const clearScheduledWork = (): void => {
+    if (delayTimer !== null) {
+      targetWindow.clearTimeout(delayTimer)
+      delayTimer = null
+    }
+    if (quietTimer !== null) {
+      targetWindow.clearTimeout(quietTimer)
+      quietTimer = null
+    }
+    if (idleId !== null) {
+      cancelIdleCallback(targetWindow, idleId)
+      idleId = null
+    }
+    if (maxWaitTimer !== null) {
+      targetWindow.clearTimeout(maxWaitTimer)
+      maxWaitTimer = null
+    }
+  }
 
   const run = (): void => {
-    idleId = null
-    if (!cancelled) {
-      callback()
+    if (cancelled) {
+      return
     }
+    clearScheduledWork()
+    cancelled = true
+    callback()
   }
 
   const checkQuietWindow = (): void => {
@@ -106,17 +139,12 @@ export function scheduleAfterInputQuiet(
     delayTimer = null
     checkQuietWindow()
   }, delayMs)
+  if (maxWaitMs !== undefined) {
+    maxWaitTimer = targetWindow.setTimeout(run, Math.max(0, maxWaitMs))
+  }
 
   return () => {
     cancelled = true
-    if (delayTimer !== null) {
-      targetWindow.clearTimeout(delayTimer)
-    }
-    if (quietTimer !== null) {
-      targetWindow.clearTimeout(quietTimer)
-    }
-    if (idleId !== null) {
-      cancelIdleCallback(targetWindow, idleId)
-    }
+    clearScheduledWork()
   }
 }
diff --git a/src/renderer/src/lib/launch-agent-in-new-tab.test.ts b/src/renderer/src/lib/launch-agent-in-new-tab.test.ts
index 97621ec1c87..38fb4f1d566 100644
--- a/src/renderer/src/lib/launch-agent-in-new-tab.test.ts
+++ b/src/renderer/src/lib/launch-agent-in-new-tab.test.ts
@@ -353,6 +353,75 @@ describe('launchAgentInNewTab', () => {
     })
   })
 
+  it('does not inject native-chat model preferences into terminal Quick Commands', async () => {
+    store.settings = {
+      agentCmdOverrides: {},
+      agentDefaultArgs: { codex: '--profile team' },
+      agentDefaultEnv: {},
+      activeRuntimeEnvironmentId: null,
+      experimentalNativeChat: true,
+      openAgentTabsInChatByDefault: false,
+      nativeChatSessionOptions: {
+        codex: {
+          model: 'gpt-5.2-codex',
+          valuesByModel: { 'gpt-5.2-codex': { effort: 'medium' } }
+        }
+      }
+    }
+    const { launchAgentInNewTab } = await import('./launch-agent-in-new-tab')
+
+    launchAgentInNewTab({
+      agent: 'codex',
+      worktreeId: 'wt-1',
+      prompt: 'Review this diff',
+      launchSource: 'quick_command',
+      quickCommandLabel: 'Review'
+    })
+
+    const launch = mockQueueTabStartupCommand.mock.calls[0]?.[1]
+    expect(launch.command).toContain("'--profile' 'team'")
+    expect(launch.command).not.toContain("'-m'")
+    expect(launch.command).not.toContain('model_reasoning_effort=')
+    expect(launch.sessionOptions).toBeUndefined()
+  })
+
+  it('applies native-chat model preferences to Quick Commands opened in chat', async () => {
+    store.settings = {
+      agentCmdOverrides: {},
+      agentDefaultArgs: {},
+      agentDefaultEnv: {},
+      activeRuntimeEnvironmentId: null,
+      experimentalNativeChat: true,
+      openAgentTabsInChatByDefault: true,
+      nativeChatSessionOptions: {
+        codex: {
+          model: 'gpt-5.2-codex',
+          valuesByModel: { 'gpt-5.2-codex': { effort: 'medium' } }
+        }
+      }
+    }
+    const { launchAgentInNewTab } = await import('./launch-agent-in-new-tab')
+
+    launchAgentInNewTab({
+      agent: 'codex',
+      worktreeId: 'wt-1',
+      prompt: 'Review this diff',
+      launchSource: 'quick_command',
+      quickCommandLabel: 'Review'
+    })
+
+    const launch = mockQueueTabStartupCommand.mock.calls[0]?.[1]
+    expect(launch.command).toContain("'-m' 'gpt-5.2-codex'")
+    expect(launch.command).toContain("'-c' 'model_reasoning_effort=medium'")
+    expect(launch.sessionOptions).toEqual({ model: 'gpt-5.2-codex', effort: 'medium' })
+    expect(mockCreateTab).toHaveBeenCalledWith(
+      'wt-1',
+      undefined,
+      undefined,
+      expect.objectContaining({ viewMode: 'chat' })
+    )
+  })
+
   it('preserves paired-host draft delivery and supported launch preferences', async () => {
     mockIsWebRuntimeSessionActive.mockReturnValue(true)
     store.settings = {
@@ -360,6 +429,8 @@ describe('launchAgentInNewTab', () => {
       agentDefaultArgs: {},
       agentDefaultEnv: {},
       activeRuntimeEnvironmentId: 'web-runtime',
+      experimentalNativeChat: true,
+      openAgentTabsInChatByDefault: true,
       nativeChatSessionOptions: {
         claude: {
           model: 'opus',
diff --git a/src/renderer/src/lib/launch-agent-in-new-tab.ts b/src/renderer/src/lib/launch-agent-in-new-tab.ts
index b9db088e8d1..58e36fd4a33 100644
--- a/src/renderer/src/lib/launch-agent-in-new-tab.ts
+++ b/src/renderer/src/lib/launch-agent-in-new-tab.ts
@@ -27,7 +27,7 @@ import { seedCommandCodeSubmittedPromptStatus } from '@/lib/command-code-prompt-
 import type { TuiAgent } from '../../../shared/types'
 import type { LaunchSource } from '../../../shared/telemetry-events'
 import { getConnectionIdFromState } from '@/lib/connection-context'
-import { resolveNativeChatLaunchSessionOptions } from '@/components/native-chat/native-chat-session-option-enrichment'
+import { resolveInitialNativeChatSessionOptions } from '@/components/native-chat/native-chat-launch-session-options'
 import { seedNativeChatAppliedSessionOptions } from '@/components/native-chat/native-chat-session-option-cache'
 
 export type LaunchAgentInNewTabArgs = {
@@ -107,6 +107,21 @@ export function launchAgentInNewTab(args: LaunchAgentInNewTabArgs): LaunchAgentI
       ? agentArgs
       : resolveTuiAgentLaunchArgs(agent, store.settings?.agentDefaultArgs)
   const agentEnv = resolveTuiAgentLaunchEnv(agent, store.settings?.agentDefaultEnv)
+  const trimmedPrompt = prompt?.trim() ?? ''
+  const hasPrompt = trimmedPrompt.length > 0
+  const isFollowupPath = TUI_AGENT_CONFIG[agent].promptInjectionMode === 'stdin-after-start'
+  // Why: the remote host can't infer this client's draft/default view choice, so decide it here for paired tabs too.
+  const viewModePromptDelivery =
+    hasPrompt && isFollowupPath && promptDelivery === 'auto-submit' ? 'draft' : promptDelivery
+  const initialViewModeOptions = {
+    agent,
+    promptDelivery: viewModePromptDelivery,
+    launchDraftText: trimmedPrompt,
+    nativeChatTranscriptIsLocalReadable: isNativeChatTranscriptLocalReadable(
+      getConnectionIdFromState(store, worktreeId)
+    )
+  }
+  const initialViewModeProps = initialAgentTabViewModeProps(store.settings, initialViewModeOptions)
   const startupPlanBase = {
     agent,
     cmdOverrides,
@@ -115,14 +130,8 @@ export function launchAgentInNewTab(args: LaunchAgentInNewTabArgs): LaunchAgentI
     isRemote,
     agentArgs: effectiveAgentArgs,
     agentEnv,
-    sessionOptions: resolveNativeChatLaunchSessionOptions(
-      store.settings?.nativeChatSessionOptions,
-      agent
-    )
+    sessionOptions: resolveInitialNativeChatSessionOptions(store.settings, initialViewModeOptions)
   }
-  const trimmedPrompt = prompt?.trim() ?? ''
-  const hasPrompt = trimmedPrompt.length > 0
-  const isFollowupPath = TUI_AGENT_CONFIG[agent].promptInjectionMode === 'stdin-after-start'
   const { startupPlan, pasteDraftAfterLaunch, submitPastedPrompt } = planLaunchAgentStartupPrompt({
     base: startupPlanBase,
     prompt: trimmedPrompt,
@@ -135,18 +144,6 @@ export function launchAgentInNewTab(args: LaunchAgentInNewTabArgs): LaunchAgentI
     return null
   }
 
-  // Why: the remote host can't infer this client's draft/default view choice, so decide it here for paired tabs too.
-  const viewModePromptDelivery =
-    hasPrompt && isFollowupPath && promptDelivery === 'auto-submit' ? 'draft' : promptDelivery
-  const initialViewModeProps = initialAgentTabViewModeProps(store.settings, {
-    agent,
-    promptDelivery: viewModePromptDelivery,
-    launchDraftText: trimmedPrompt,
-    nativeChatTranscriptIsLocalReadable: isNativeChatTranscriptLocalReadable(
-      getConnectionIdFromState(store, worktreeId)
-    )
-  })
-
   const runtimeEnvironmentId = getRuntimeEnvironmentIdForWorktree(store, worktreeId)
   if (isWebRuntimeSessionActive(runtimeEnvironmentId)) {
     const webHostDelivery = launchAgentInWebHostTab({
diff --git a/src/renderer/src/lib/launch-work-item-direct-agent.test.ts b/src/renderer/src/lib/launch-work-item-direct-agent.test.ts
index bf7f33aa9e9..3a834a67454 100644
--- a/src/renderer/src/lib/launch-work-item-direct-agent.test.ts
+++ b/src/renderer/src/lib/launch-work-item-direct-agent.test.ts
@@ -8,7 +8,10 @@ vi.mock('@/lib/telemetry', () => ({
 }))
 vi.mock('@/i18n/i18n', () => ({ translate: (_key: string, value: string) => value }))
 
-import { buildDirectWorkItemStartupOpts } from './launch-work-item-direct-agent'
+import {
+  buildDirectWorkItemAgentStartupPlan,
+  buildDirectWorkItemStartupOpts
+} from './launch-work-item-direct-agent'
 import type { AgentStartupPlan } from './tui-agent-startup'
 
 describe('buildDirectWorkItemStartupOpts', () => {
@@ -59,3 +62,49 @@ describe('buildDirectWorkItemStartupOpts', () => {
     expect(opts.startup?.launchDraftText).toBe('https://github.com/o/r/issues/12')
   })
 })
+
+const settings = {
+  agentCmdOverrides: {},
+  agentDefaultArgs: {},
+  agentDefaultEnv: {},
+  experimentalNativeChat: true,
+  nativeChatSessionOptions: {
+    codex: {
+      model: 'gpt-5.2-codex',
+      valuesByModel: { 'gpt-5.2-codex': { effort: 'medium' } }
+    }
+  }
+}
+
+describe('buildDirectWorkItemAgentStartupPlan', () => {
+  it('omits native-chat preferences when the new workspace opens in terminal mode', () => {
+    const result = buildDirectWorkItemAgentStartupPlan({
+      agent: 'codex',
+      draftContent: 'Review issue 42',
+      promptDelivery: 'draft',
+      settings: { ...settings, openAgentTabsInChatByDefault: false },
+      launchPlatform: 'darwin',
+      nativeChatTranscriptIsLocalReadable: true
+    })
+
+    expect(result.startupPlan?.launchCommand).not.toContain("'-m'")
+    expect(result.startupPlan?.sessionOptions).toBeUndefined()
+  })
+
+  it('applies native-chat preferences when the new workspace opens in chat', () => {
+    const result = buildDirectWorkItemAgentStartupPlan({
+      agent: 'codex',
+      draftContent: 'Review issue 42',
+      promptDelivery: 'draft',
+      settings: { ...settings, openAgentTabsInChatByDefault: true },
+      launchPlatform: 'darwin',
+      nativeChatTranscriptIsLocalReadable: true
+    })
+
+    expect(result.startupPlan?.launchCommand).toContain("'-m' 'gpt-5.2-codex'")
+    expect(result.startupPlan?.sessionOptions).toEqual({
+      model: 'gpt-5.2-codex',
+      effort: 'medium'
+    })
+  })
+})
diff --git a/src/renderer/src/lib/launch-work-item-direct-agent.ts b/src/renderer/src/lib/launch-work-item-direct-agent.ts
index c6efece61c9..467ef5065b6 100644
--- a/src/renderer/src/lib/launch-work-item-direct-agent.ts
+++ b/src/renderer/src/lib/launch-work-item-direct-agent.ts
@@ -16,7 +16,7 @@ import {
   resolveTuiAgentLaunchEnv
 } from '../../../shared/tui-agent-launch-defaults'
 import { translate } from '@/i18n/i18n'
-import { resolveNativeChatLaunchSessionOptions } from '@/components/native-chat/native-chat-session-option-enrichment'
+import { resolveInitialNativeChatSessionOptions } from '@/components/native-chat/native-chat-launch-session-options'
 import type { PersistedNativeChatSessionOptions } from '../../../shared/native-chat-session-options'
 
 export function buildDirectWorkItemAgentStartupPlan(args: {
@@ -29,11 +29,14 @@ export function buildDirectWorkItemAgentStartupPlan(args: {
         agentCmdOverrides?: Partial<Record<TuiAgent, string>>
         agentDefaultArgs?: Partial<Record<TuiAgent, string>>
         agentDefaultEnv?: Partial<Record<TuiAgent, Record<string, string>>>
+        experimentalNativeChat?: boolean
+        openAgentTabsInChatByDefault?: boolean
         nativeChatSessionOptions?: PersistedNativeChatSessionOptions
       }
     | null
     | undefined
   launchPlatform: NodeJS.Platform
+  nativeChatTranscriptIsLocalReadable?: boolean
   /** Why: SSH remotes deploy the CLI shim as plain `orca`, so the Linux-only
    * `orca-ide` rename must not be applied for remote launches. */
   isRemote?: boolean
@@ -51,10 +54,13 @@ export function buildDirectWorkItemAgentStartupPlan(args: {
       ? resolveTuiAgentLaunchArgs(args.agent, args.settings?.agentDefaultArgs)
       : args.agentArgs
   const effectiveAgentEnv = resolveTuiAgentLaunchEnv(args.agent, args.settings?.agentDefaultEnv)
-  const sessionOptions = resolveNativeChatLaunchSessionOptions(
-    args.settings?.nativeChatSessionOptions,
-    args.agent
-  )
+  const sessionOptions = resolveInitialNativeChatSessionOptions(args.settings, {
+    agent: args.agent,
+    ...(args.promptDelivery === 'draft'
+      ? { promptDelivery: 'draft' as const, launchDraftText: args.draftContent }
+      : {}),
+    nativeChatTranscriptIsLocalReadable: args.nativeChatTranscriptIsLocalReadable
+  })
   const draftLaunchPlan =
     args.promptDelivery === 'submit-after-ready'
       ? null
diff --git a/src/renderer/src/lib/launch-work-item-direct.ts b/src/renderer/src/lib/launch-work-item-direct.ts
index f9cc02e4a0e..6a0fa63a214 100644
--- a/src/renderer/src/lib/launch-work-item-direct.ts
+++ b/src/renderer/src/lib/launch-work-item-direct.ts
@@ -15,6 +15,7 @@ import {
 import { ensureHooksConfirmed } from '@/lib/ensure-hooks-confirmed'
 import { seedNativeChatLaunchDraftForAgentTab } from '@/lib/agent-launch-prompt-delivery'
 import { getConnectionId } from '@/lib/connection-context'
+import { isNativeChatTranscriptLocalReadable } from '@/lib/native-chat-transcript-readability'
 import type { GitPushTarget, SetupDecision, TuiAgent } from '../../../shared/types'
 import { getLinearIssueWorkspaceName } from '../../../shared/workspace-name'
 import { resolveGitHubWorkItemIdentity } from '@/lib/github-work-item-identity'
@@ -278,6 +279,8 @@ export async function launchWorkItemDirect(args: LaunchWorkItemDirectArgs): Prom
         promptDelivery,
         settings,
         launchPlatform,
+        nativeChatTranscriptIsLocalReadable:
+          isNativeChatTranscriptLocalReadable(launchConnectionId),
         // Why: SSH hosts run the plain `orca` shim, so the Linux-only `orca-ide`
         // rename must not be applied for remote launches.
         isRemote: typeof launchConnectionId === 'string'
diff --git a/src/renderer/src/lib/local-preflight-context-cache.test.ts b/src/renderer/src/lib/local-preflight-context-cache.test.ts
index 602aa0f302e..4a9cec27812 100644
--- a/src/renderer/src/lib/local-preflight-context-cache.test.ts
+++ b/src/renderer/src/lib/local-preflight-context-cache.test.ts
@@ -16,11 +16,15 @@ afterEach(() => {
   resetLocalPreflightContextCachesForTests()
 })
 
+function makeRepos(id: string, path: string): AppState['repos'] {
+  return [{ id, path, displayName: id, badgeColor: 'blue', addedAt: 1 }]
+}
+
 function makeWslState(distro: string): AppState {
   return {
     activeRepoId: 'repo-1',
     activeWorktreeId: null,
-    repos: [{ id: 'repo-1', path: `\\\\wsl.localhost\\${distro}\\home\\alice\\repo` }],
+    repos: makeRepos('repo-1', `\\\\wsl.localhost\\${distro}\\home\\alice\\repo`),
     worktreesByRepo: {}
   } as AppState
 }
@@ -29,7 +33,7 @@ function makeWindowsProjectState(projectId: string): AppState {
   return {
     activeRepoId: projectId,
     activeWorktreeId: null,
-    repos: [{ id: projectId, path: `C:\\Users\\alice\\${projectId}` }],
+    repos: makeRepos(projectId, `C:\\Users\\alice\\${projectId}`),
     settings: {},
     worktreesByRepo: {}
   } as AppState
diff --git a/src/renderer/src/lib/local-preflight-context.test.ts b/src/renderer/src/lib/local-preflight-context.test.ts
index b4f5417f8ce..b6d020f3a80 100644
--- a/src/renderer/src/lib/local-preflight-context.test.ts
+++ b/src/renderer/src/lib/local-preflight-context.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vitest'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
 import type { Repo, Worktree } from '../../../shared/types'
 import type { AppState } from '@/store/types'
 import {
@@ -11,26 +12,30 @@ import {
 } from './local-preflight-context'
 
 function makeState(args: {
-  repoPath?: string | null
+  repoPath?: string
   worktreePath?: string | null
   repo?: Partial<Repo>
   worktree?: Partial<Worktree>
 }): AppState {
   const repoId = 'repo-1'
   const worktreeId = `${repoId}::worktree-1`
+  const repos: AppState['repos'] =
+    args.repoPath === undefined
+      ? []
+      : [
+          {
+            id: repoId,
+            path: args.repoPath,
+            displayName: repoId,
+            badgeColor: 'blue',
+            addedAt: 1,
+            ...args.repo
+          }
+        ]
   return {
     activeRepoId: repoId,
     activeWorktreeId: args.worktreePath === undefined ? null : worktreeId,
-    repos:
-      args.repoPath === undefined
-        ? []
-        : [
-            {
-              id: repoId,
-              path: args.repoPath,
-              ...args.repo
-            }
-          ],
+    repos,
     worktreesByRepo:
       args.worktreePath === undefined
         ? {}
@@ -470,6 +475,38 @@ describe('local preflight context', () => {
     })
   })
 
+  it('does not assign the active project runtime to the floating workspace', () => {
+    const state = {
+      ...makeState({ repoPath: 'C:\\Users\\alice\\repo', worktreePath: 'C:\\Users\\alice\\repo' }),
+      projects: [{ id: 'repo-1', localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' } }]
+    } as unknown as AppState
+
+    expect(
+      getLocalProjectExecutionRuntimeContext(state, FLOATING_TERMINAL_WORKTREE_ID, 'win32')
+    ).toBeUndefined()
+  })
+
+  it('keeps the active project runtime fallback for a detected-only worktree', () => {
+    const state = {
+      ...makeState({ repoPath: 'C:\\Users\\alice\\repo' }),
+      detectedWorktreesByRepo: {
+        'repo-1': {
+          repoId: 'repo-1',
+          authoritative: true,
+          source: 'git',
+          worktrees: [{ id: 'repo-1::detected', repoId: 'repo-1', path: 'C:\\detected' }]
+        }
+      },
+      projects: [{ id: 'repo-1', localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' } }]
+    } as unknown as AppState
+
+    expect(
+      getLocalProjectExecutionRuntimeContext(state, 'repo-1::detected', 'win32')
+    ).toMatchObject({
+      runtime: { kind: 'wsl', distro: 'Ubuntu', projectId: 'repo-1' }
+    })
+  })
+
   it('resolves WSL UNC worktrees to their owning distro when the project inherits host default', () => {
     const state = makeState({
       repoPath: 'C:\\Users\\alice\\repo',
diff --git a/src/renderer/src/lib/local-preflight-context.ts b/src/renderer/src/lib/local-preflight-context.ts
index ddabde956e5..fc794535447 100644
--- a/src/renderer/src/lib/local-preflight-context.ts
+++ b/src/renderer/src/lib/local-preflight-context.ts
@@ -1,4 +1,5 @@
 import type { AppState } from '@/store/types'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants'
 import { parseWslUncPath } from '../../../shared/wsl-paths'
 import {
   deriveGlobalWindowsRuntimeDefaultFromLegacySettings,
@@ -39,10 +40,12 @@ type LocalProjectRuntimeWslContext = {
   availableWslDistros?: readonly string[] | null
 }
 
+/** Extracts a WSL distribution name from supported UNC path forms. */
 export function getWslDistroFromPath(path?: string | null): string | null {
   return path ? (parseWslUncPath(path)?.distro ?? null) : null
 }
 
+/** Resolves the owning local project's Windows runtime for project-scoped targets. */
 export function getLocalProjectExecutionRuntimeContext(
   state: LocalProjectRuntimeState,
   worktreeId?: string | null,
@@ -53,6 +56,9 @@ export function getLocalProjectExecutionRuntimeContext(
     return undefined
   }
 
+  if (worktreeId === FLOATING_TERMINAL_WORKTREE_ID) {
+    return undefined
+  }
   const worktree = getLocalWorktree(state, worktreeId)
   const repo = getLocalRuntimeRepoForWorktree(state, worktree)
   if (!isLocalRuntimeRepo(repo) || !isLocalRuntimeWorktree(worktree)) {
diff --git a/src/renderer/src/lib/markdown-document-templates.ts b/src/renderer/src/lib/markdown-document-templates.ts
index 1fadcd2613f..60414d481f0 100644
--- a/src/renderer/src/lib/markdown-document-templates.ts
+++ b/src/renderer/src/lib/markdown-document-templates.ts
@@ -126,7 +126,7 @@ export function applyMarkdownTemplatePlaceholders(
   }
 
   return content.replace(/\{\{\s*([a-zA-Z][a-zA-Z0-9_-]*)\s*\}\}/g, (match, key: string) => {
-    return Object.prototype.hasOwnProperty.call(replacements, key) ? replacements[key] : match
+    return Object.hasOwn(replacements, key) ? replacements[key] : match
   })
 }
 
diff --git a/src/renderer/src/lib/native-chat-telemetry.ts b/src/renderer/src/lib/native-chat-telemetry.ts
index 0d6f96584d2..1299204b6db 100644
--- a/src/renderer/src/lib/native-chat-telemetry.ts
+++ b/src/renderer/src/lib/native-chat-telemetry.ts
@@ -15,7 +15,7 @@ import type { TuiAgent } from '../../../shared/types'
  *  the broader `AgentType` string carried by the chat view. Narrowing to the
  *  closed `agent_kind` enum (with an `'other'` fallback) happens here so call
  *  sites never need an unsound `as TuiAgent` cast. */
-export type NativeChatTelemetryAgent = TuiAgent | string | null | undefined
+export type NativeChatTelemetryAgent = TuiAgent | (string & {}) | null | undefined
 
 // `launchAgent` is optional on terminal tabs (plain shells, manually-started
 // agents) and the chat view's `AgentType` may carry a string outside the
diff --git a/src/renderer/src/lib/notes-send-agent-targets.test.ts b/src/renderer/src/lib/notes-send-agent-targets.test.ts
index e7b4178df2b..0b24234c3bf 100644
--- a/src/renderer/src/lib/notes-send-agent-targets.test.ts
+++ b/src/renderer/src/lib/notes-send-agent-targets.test.ts
@@ -653,4 +653,51 @@ describe('notes send agent targets', () => {
       })
     ])
   })
+
+  // Why: OpenCode publishes `OC | <session>` and no status word, so a hookless
+  // OpenCode pane used to be invisible in the send menu no matter how live it was.
+  it('lists a manual OpenCode pane by its native session title', () => {
+    const targets = deriveNotesSendAgentTargets(
+      state({
+        tabsByWorktree: { [WORKTREE_ID]: [tab(MANUAL_TAB_ID, { title: 'Terminal 2' })] },
+        terminalLayoutsByTabId: { [MANUAL_TAB_ID]: leafLayout(LEAF_B, 'pty-b') },
+        runtimePaneTitlesByTabId: { [MANUAL_TAB_ID]: { 1: 'OC | Ad hoc build' } }
+      }),
+      WORKTREE_ID,
+      NOW
+    )
+
+    expect(targets).toEqual([
+      {
+        paneKey: makePaneKey(MANUAL_TAB_ID, LEAF_B),
+        tabId: MANUAL_TAB_ID,
+        leafId: LEAF_B,
+        agentType: 'opencode',
+        tabTitle: 'Terminal 2',
+        status: 'eligible'
+      }
+    ])
+  })
+
+  it('promotes a stale OpenCode status row from the native title hint', () => {
+    const paneKey = makePaneKey(LAUNCH_TAB_ID, LEAF_A)
+    const targets = deriveNotesSendAgentTargets(
+      state({
+        agentStatusByPaneKey: {
+          [paneKey]: entry(paneKey, 'done', OLD_STATUS_UPDATED_AT, { agentType: 'opencode' })
+        },
+        tabsByWorktree: {
+          [WORKTREE_ID]: [tab(LAUNCH_TAB_ID, { title: 'Terminal 1', launchAgent: 'opencode' })]
+        },
+        terminalLayoutsByTabId: { [LAUNCH_TAB_ID]: leafLayout(LEAF_A, 'pty-a') },
+        runtimePaneTitlesByTabId: { [LAUNCH_TAB_ID]: { 1: 'OC | Ad hoc build' } }
+      }),
+      WORKTREE_ID,
+      NOW
+    )
+
+    expect(targets).toEqual([
+      expect.objectContaining({ paneKey, agentType: 'opencode', status: 'eligible' })
+    ])
+  })
 })
diff --git a/src/renderer/src/lib/notes-send-agent-targets.ts b/src/renderer/src/lib/notes-send-agent-targets.ts
index 163907d99fc..3c2f6d412c4 100644
--- a/src/renderer/src/lib/notes-send-agent-targets.ts
+++ b/src/renderer/src/lib/notes-send-agent-targets.ts
@@ -59,10 +59,8 @@ function detectTitleHintPaneEvidence(
  * CLIs do not have that owner bit, so their runtime title is the only pre-hook
  * signal available.
  *
- * The title hint is gated on a recognized agent title (pane or tab) — the same
- * signal isTerminalRunningAgent checks — so a freshly spawned tab is only listed
- * once the runtime would actually accept the send. Without that gate, clicking a
- * still-booting pane fails with "not a recognized agent session".
+ * The title hint gates discoverability only. The runtime independently checks
+ * current hook/process evidence before any guarded write.
  */
 export function deriveNotesSendAgentTargets(
   state: NotesSendAgentTargetState,
@@ -129,9 +127,8 @@ function deriveTitleHintAgentTarget(
   const paneTitleResolution = resolveRuntimePaneTitleLeafResolution(layout, paneTitles, leafId)
   const titleEvidence = detectTitleHintPaneEvidence(paneTitleResolution, tab.title)
   if (!titleEvidence) {
-    // Why: launchAgent is set the instant Orca spawns the tab, but the runtime
-    // only accepts a send once the pane reads as an agent; manually started
-    // CLIs need the same title proof before appearing in the send menu.
+    // Why: launch metadata predates TUI identity; require a matching current title
+    // before listing either launched or manually started panes.
     return null
   }
   const disabledReason =
diff --git a/src/renderer/src/lib/onboarding-folder-agent-startup.ts b/src/renderer/src/lib/onboarding-folder-agent-startup.ts
index e8023746a42..55668937430 100644
--- a/src/renderer/src/lib/onboarding-folder-agent-startup.ts
+++ b/src/renderer/src/lib/onboarding-folder-agent-startup.ts
@@ -9,7 +9,7 @@ import type { AgentStartedTelemetry } from '@/lib/worktree-activation'
 import type { StartupCommandDelivery } from '../../../shared/codex-startup-delivery'
 import type { SleepingAgentLaunchConfig } from '../../../shared/agent-session-resume'
 import type { GlobalSettings, OnboardingState, TuiAgent } from '../../../shared/types'
-import { resolveNativeChatLaunchSessionOptions } from '@/components/native-chat/native-chat-session-option-enrichment'
+import { resolveInitialNativeChatSessionOptions } from '@/components/native-chat/native-chat-launch-session-options'
 import type { SessionOptionValue } from '../../../shared/native-chat-session-options'
 
 export type OnboardingFolderAgentStartup = {
@@ -30,7 +30,8 @@ function getClientPlatform(): NodeJS.Platform {
 }
 
 export function buildOnboardingFolderAgentStartup(
-  settings: GlobalSettings | null
+  settings: GlobalSettings | null,
+  nativeChatTranscriptIsLocalReadable = true
 ): OnboardingFolderAgentStartup | undefined {
   const agent = settings?.defaultTuiAgent
   if (
@@ -48,7 +49,10 @@ export function buildOnboardingFolderAgentStartup(
     cmdOverrides: settings.agentCmdOverrides ?? {},
     agentArgs: resolveTuiAgentLaunchArgs(agent, settings.agentDefaultArgs),
     agentEnv: resolveTuiAgentLaunchEnv(agent, settings.agentDefaultEnv),
-    sessionOptions: resolveNativeChatLaunchSessionOptions(settings.nativeChatSessionOptions, agent),
+    sessionOptions: resolveInitialNativeChatSessionOptions(settings, {
+      agent,
+      nativeChatTranscriptIsLocalReadable
+    }),
     platform: getClientPlatform(),
     allowEmptyPromptLaunch: true
   })
@@ -88,10 +92,11 @@ export function shouldSeedFolderAgentAfterDismissedOnboarding(
 export function buildDismissedOnboardingFolderAgentStartup(
   settings: GlobalSettings | null,
   onboarding: OnboardingState | null,
-  hasExistingProject: boolean
+  hasExistingProject: boolean,
+  nativeChatTranscriptIsLocalReadable = true
 ): OnboardingFolderAgentStartup | undefined {
   if (!shouldSeedFolderAgentAfterDismissedOnboarding(onboarding, hasExistingProject)) {
     return undefined
   }
-  return buildOnboardingFolderAgentStartup(settings)
+  return buildOnboardingFolderAgentStartup(settings, nativeChatTranscriptIsLocalReadable)
 }
diff --git a/src/renderer/src/lib/open-mobile-emulator-tab.test.ts b/src/renderer/src/lib/open-mobile-emulator-tab.test.ts
index a3d942785b1..578473b5f36 100644
--- a/src/renderer/src/lib/open-mobile-emulator-tab.test.ts
+++ b/src/renderer/src/lib/open-mobile-emulator-tab.test.ts
@@ -14,7 +14,11 @@ const mockStoreState = vi.hoisted(() => ({
   activeGroupIdByWorktree: { 'wt-1': 'group-1' } as Record<string, string>,
   groupsByWorktree: { 'wt-1': [{ id: 'group-1' }] } as Record<string, { id: string }[]>,
   unifiedTabsByWorktree: {} as Record<string, { id: string; contentType: string }[]>,
-  settings: { mobileEmulatorEnabled: true } as { mobileEmulatorEnabled?: boolean }
+  settings: { mobileEmulatorEnabled: true } as {
+    mobileEmulatorEnabled?: boolean
+    activeRuntimeEnvironmentId?: string | null
+  },
+  runtimeStatusByEnvironmentId: new Map()
 }))
 
 vi.mock('@/store', () => ({
@@ -68,6 +72,22 @@ describe('openMobileEmulatorTab', () => {
   afterEach(() => {
     cancelPendingSimulatorPaneShutdown('wt-1')
     vi.useRealTimers()
+    vi.unstubAllGlobals()
+  })
+
+  it('rejects web-client invocation before creating a tab or attaching', async () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    mockStoreState.settings = {
+      mobileEmulatorEnabled: true,
+      activeRuntimeEnvironmentId: 'runtime-1'
+    }
+
+    await expect(openMobileEmulatorTab('wt-1')).rejects.toThrow(
+      'Mobile Emulator is unavailable in the web client.'
+    )
+
+    expect(ensureSimulatorTab).not.toHaveBeenCalled()
+    expect(callRuntimeRpc).not.toHaveBeenCalled()
   })
 
   it('surfaces the simulator tab before attaching the emulator stream', async () => {
diff --git a/src/renderer/src/lib/open-mobile-emulator-tab.ts b/src/renderer/src/lib/open-mobile-emulator-tab.ts
index 45f565e0408..6991c42ef13 100644
--- a/src/renderer/src/lib/open-mobile-emulator-tab.ts
+++ b/src/renderer/src/lib/open-mobile-emulator-tab.ts
@@ -16,6 +16,7 @@ import {
   cancelPendingSimulatorPaneShutdown,
   shutdownManagedSimulatorIfNoPane
 } from './simulator-pane-shutdown-scheduler'
+import { assertClientCreationActionAvailable } from './client-creation-action-policy'
 
 type OpenMobileEmulatorTabOptions = {
   targetGroupId?: string
@@ -55,6 +56,7 @@ export async function openMobileEmulatorTab(
   options: OpenMobileEmulatorTabOptions = {}
 ): Promise<string | null> {
   const store = useAppStore.getState()
+  assertClientCreationActionAvailable(store, worktreeId, 'mobile-emulator')
   if (store.settings?.mobileEmulatorEnabled === false) {
     return null
   }
diff --git a/src/renderer/src/lib/pane-manager/pane-dom-creation.ts b/src/renderer/src/lib/pane-manager/pane-dom-creation.ts
index f383dfa3c53..d3b6b2b6ffd 100644
--- a/src/renderer/src/lib/pane-manager/pane-dom-creation.ts
+++ b/src/renderer/src/lib/pane-manager/pane-dom-creation.ts
@@ -121,6 +121,7 @@ export function createPaneDOM(
     gpuRenderingEnabled: ENABLE_WEBGL_RENDERER,
     webglAttachmentDeferred: false,
     webglDisabledAfterContextLoss: false,
+    webglRebuildDeferred: false,
     hasComplexScriptOutput: false,
     fitAddon,
     fitResizeObserver: null,
diff --git a/src/renderer/src/lib/pane-manager/pane-fit.test.ts b/src/renderer/src/lib/pane-manager/pane-fit.test.ts
index 70e7d20526d..aa97a9a1887 100644
--- a/src/renderer/src/lib/pane-manager/pane-fit.test.ts
+++ b/src/renderer/src/lib/pane-manager/pane-fit.test.ts
@@ -1,9 +1,10 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { recordRendererCrashBreadcrumb } from '@/lib/crash-breadcrumb-recorder'
 import type { ManagedPane, ManagedPaneInternal, ScrollState } from './pane-manager-types'
-import { safeFit, safeFitAndThen } from './pane-fit'
+import { readProposedPaneFitDimensions, safeFit, safeFitAndThen } from './pane-fit'
 import { applyOrDeferPaneMetricOptions } from './pane-metric-options-deferral'
 import { paneFitClientSizeChanged } from './pane-reveal-fit'
+import { setFitOverride } from './mobile-fit-overrides'
 
 vi.mock('@/lib/crash-breadcrumb-recorder', () => ({
   recordRendererCrashBreadcrumb: vi.fn()
@@ -502,4 +503,64 @@ describe('deferred metric flush inside safeFit', () => {
     expect(pane.terminal.options.fontSize).toBe(12)
     expect(pane.fitAddon.fit).toHaveBeenCalled()
   })
+
+  it('reports the post-metric grid used by the next safe fit', () => {
+    const terminal = { cols: 80, rows: 24, options: {} as Record<string, unknown> }
+    const pane = {
+      id: 12,
+      terminal,
+      container: {
+        dataset: {},
+        getBoundingClientRect: () => ({ width: 500, height: 300 })
+      },
+      fitAddon: {
+        fit: vi.fn(),
+        proposeDimensions: vi.fn(() =>
+          Number(terminal.options.fontSize ?? 10) >= 18
+            ? { cols: 20, rows: 10 }
+            : { cols: 40, rows: 20 }
+        )
+      }
+    } as unknown as ManagedPane
+    applyOrDeferPaneMetricOptions(pane, { fontSize: 18 }, false)
+
+    expect(readProposedPaneFitDimensions(pane)).toEqual({ cols: 20, rows: 10 })
+    expect(pane.terminal.options.fontSize).toBe(18)
+  })
+
+  it('reports an owner override even while the pane is unmeasurable', () => {
+    const resize = vi.fn()
+    const pane = {
+      terminal: { cols: 80, rows: 24, options: {}, resize },
+      container: {
+        dataset: { ptyId: 'pty-override' },
+        getBoundingClientRect: () => ({ width: 0, height: 0 })
+      },
+      fitAddon: { proposeDimensions: vi.fn() }
+    } as unknown as ManagedPane
+    setFitOverride('pty-override', 'mobile-fit', 49, 20)
+
+    try {
+      expect(readProposedPaneFitDimensions(pane)).toEqual({ cols: 49, rows: 20 })
+      expect(pane.fitAddon.proposeDimensions).not.toHaveBeenCalled()
+      expect(safeFit(pane)).toBe(false)
+      expect(resize).not.toHaveBeenCalled()
+    } finally {
+      setFitOverride('pty-override', 'desktop-fit', 0, 0)
+    }
+  })
+
+  it('flushes deferred metrics before reporting a measurable owner override', () => {
+    const pane = createMetricPane()
+    pane.container.dataset.ptyId = 'pty-metric-override'
+    applyOrDeferPaneMetricOptions(pane, { fontSize: 12 }, false)
+    setFitOverride('pty-metric-override', 'mobile-fit', 49, 20)
+
+    try {
+      expect(readProposedPaneFitDimensions(pane)).toEqual({ cols: 49, rows: 20 })
+      expect(pane.terminal.options.fontSize).toBe(12)
+    } finally {
+      setFitOverride('pty-metric-override', 'desktop-fit', 0, 0)
+    }
+  })
 })
diff --git a/src/renderer/src/lib/pane-manager/pane-fit.ts b/src/renderer/src/lib/pane-manager/pane-fit.ts
index c9807dbb10a..05e71b294dc 100644
--- a/src/renderer/src/lib/pane-manager/pane-fit.ts
+++ b/src/renderer/src/lib/pane-manager/pane-fit.ts
@@ -55,6 +55,28 @@ export type SafeFitContinuationHandle = {
 
 export { readFitClientSize } from './pane-fit-client-size'
 
+/** Returns the exact dimensions the next safe fit will use after any applicable
+ * deferred metrics. An owner override remains measurable while its pane is hidden. */
+export function readProposedPaneFitDimensions(
+  pane: ManagedPane
+): { cols: number; rows: number } | null {
+  const ptyId = pane.container?.dataset?.ptyId
+  const override = ptyId ? getFitOverrideForPty(ptyId) : null
+  const measurable = canMeasurePaneForFit(pane)
+  if (!measurable && !override) {
+    return null
+  }
+  // Re-check after the metric flush: larger cells can push a narrow pane below
+  // the fit floor even though it was measurable with the old metrics.
+  if (measurable && flushDeferredPaneMetricOptions(pane) && !canMeasurePaneForFit(pane)) {
+    return null
+  }
+  if (override) {
+    return { cols: override.cols, rows: override.rows }
+  }
+  return getProposedPaneDimensions(pane)
+}
+
 function canPreserveScrollIntentForFit(pane: ManagedPane): boolean {
   // Why: split reparent has its own delayed restore; restoring here can fight that timer.
   return !(
@@ -70,10 +92,7 @@ function performSafeFit(pane: ManagedPane): boolean {
     return false
   }
   // Why here: metric options deferred while the pane was unmeasurable must land
-  // before this fit reads dimensions, or the fit pins cols/rows to stale metrics.
-  // Why re-check: the gate above measured with the old cell size — a large font
-  // jump on a narrow pane can drop it under the floor, and fit() would then pin
-  // the PTY at the tiny grid that floor exists to prevent.
+  // before this fit reads dimensions, then the fit floor must be checked again.
   if (flushDeferredPaneMetricOptions(pane) && !canMeasurePaneForFit(pane)) {
     return false
   }
@@ -122,6 +141,7 @@ function performSafeFit(pane: ManagedPane): boolean {
     if (shouldRestoreScroll) {
       try {
         if (resumePendingFitScrollRestoreAfterFit(pane.terminal)) {
+          // Resume consumed the pending restore; the fallbacks below must not also run.
         } else if (pinnedScrollState) {
           const state: ScrollState = pinnedScrollState
           pinnedScrollState = null
diff --git a/src/renderer/src/lib/pane-manager/pane-identity-registry.ts b/src/renderer/src/lib/pane-manager/pane-identity-registry.ts
index 0c1951e979f..709ff30ec5f 100644
--- a/src/renderer/src/lib/pane-manager/pane-identity-registry.ts
+++ b/src/renderer/src/lib/pane-manager/pane-identity-registry.ts
@@ -3,9 +3,9 @@ import { mintStablePaneId } from './mint-stable-pane-id'
 import type { ManagedPaneInternal } from './pane-manager-types'
 
 export class PaneIdentityRegistry {
-  private leafIdByNumericId: Map<number, TerminalLeafId> = new Map()
-  private numericIdByLeafId: Map<TerminalLeafId, number> = new Map()
-  private publishedPaneIds: Set<number> = new Set()
+  private leafIdByNumericId = new Map<number, TerminalLeafId>()
+  private numericIdByLeafId = new Map<TerminalLeafId, number>()
+  private publishedPaneIds = new Set<number>()
 
   claimLeafId(leafIdHint?: string): TerminalLeafId {
     if (leafIdHint && isTerminalLeafId(leafIdHint) && !this.numericIdByLeafId.has(leafIdHint)) {
diff --git a/src/renderer/src/lib/pane-manager/pane-lifecycle.test.ts b/src/renderer/src/lib/pane-manager/pane-lifecycle.test.ts
index 701482d16bb..9cb442a2073 100644
--- a/src/renderer/src/lib/pane-manager/pane-lifecycle.test.ts
+++ b/src/renderer/src/lib/pane-manager/pane-lifecycle.test.ts
@@ -430,6 +430,19 @@ describe('attachLigatures', () => {
     expect(pane.terminal.refresh).toHaveBeenCalledWith(0, 23)
     expect(pane.ligaturesAddon).not.toBeNull()
   })
+
+  it('defers a retained WebGL rebuild while hidden', () => {
+    const pane = createPane()
+    const retainedAddon = { dispose: vi.fn() } as never
+    pane.webglAddon = retainedAddon
+    pane.webglAttachmentDeferred = true
+
+    attachLigatures(pane)
+
+    expect(pane.webglAddon).toBe(retainedAddon)
+    expect(pane.webglRebuildDeferred).toBe(true)
+    expect(pane.terminal.refresh).not.toHaveBeenCalled()
+  })
 })
 
 describe('openTerminal — addon and provider wiring', () => {
@@ -527,6 +540,12 @@ describe('openTerminal — addon and provider wiring', () => {
       deregisterCharacterJoiner: vi.fn((joinerId: number) => {
         events.push(`deregisterCharacterJoiner:${joinerId}`)
       }),
+      clearSelection: vi.fn(() => {
+        events.push('clearSelection')
+      }),
+      dispose: vi.fn(() => {
+        events.push('dispose')
+      }),
       unicode: unicodeProxy,
       buffer: { active: { cursorX: 0, cursorY: 0 } }
     } as unknown as ManagedPaneInternal['terminal']
@@ -607,6 +626,15 @@ describe('openTerminal — addon and provider wiring', () => {
     expect(pane.arabicShapingJoinerCleanup).toBeNull()
   })
 
+  it('clears selection before disposing a remounted pane', () => {
+    const { pane, events } = createOpenTerminalHarness()
+    openTerminal(pane)
+
+    disposePane(pane, new Map([[pane.id, pane]]))
+
+    expect(events.indexOf('clearSelection')).toBeLessThan(events.indexOf('dispose'))
+  })
+
   // Why: a link streamed under a stationary pointer must re-linkify on the next
   // move; openTerminal wires the hover-cache reset and disposePane must detach it.
   it('installs the streamed-output linkifier hover reset and disposes it', () => {
diff --git a/src/renderer/src/lib/pane-manager/pane-lifecycle.ts b/src/renderer/src/lib/pane-manager/pane-lifecycle.ts
index e5695207a57..3c89a6ec723 100644
--- a/src/renderer/src/lib/pane-manager/pane-lifecycle.ts
+++ b/src/renderer/src/lib/pane-manager/pane-lifecycle.ts
@@ -16,6 +16,7 @@ import {
 import { installTerminalLinkifierHoverResetOnWrite } from './terminal-linkifier-hover-reset-on-write'
 import { attachDomRendererFocusClassSync } from './pane-dom-focus-class-sync'
 import { attachWebgl, cancelPendingWebglRefresh, disposeWebgl } from './pane-webgl-renderer'
+import { rebuildAttachedWebgl } from './pane-webgl-reattach'
 import { configureLazyArabicShapingJoiner } from './terminal-arabic-shaping-joiner'
 import { TerminalLigaturesAddon } from './terminal-ligatures-addon'
 import { installTerminalImeCandidateAnchor } from './terminal-ime-candidate-anchor'
@@ -136,16 +137,15 @@ export function attachLigatures(pane: ManagedPaneInternal): void {
     pane.ligaturesAddon = ligaturesAddon
     // Why: ligatures can be enabled after rows already rendered, especially
     // from Settings. Force existing glyph runs to be recomputed immediately.
-    pane.terminal.refresh(0, pane.terminal.rows - 1)
+    if (!pane.webglAttachmentDeferred) {
+      pane.terminal.refresh(0, pane.terminal.rows - 1)
+    }
     // Why: the WebGL renderer builds its glyph texture atlas at activation
     // time, so `font-feature-settings` applied after WebGL loaded won't
     // reach the GPU-rendered cells until the atlas is rebuilt. The upstream
     // docs call this out explicitly — reactivating WebGL after ligatures
     // forces a fresh atlas that includes the ligated glyphs.
-    if (pane.webglAddon) {
-      disposeWebgl(pane)
-      attachWebgl(pane)
-    }
+    rebuildAttachedWebgl(pane)
   } catch (err) {
     console.warn('[terminal] ligatures addon failed to attach for pane', pane.id, err)
     pane.ligaturesAddon = null
@@ -162,10 +162,7 @@ export function setLigaturesEnabled(pane: ManagedPaneInternal, enabled: boolean)
     // Why: ligatures lived inside the WebGL atlas, so after disposing the
     // addon the atlas still holds the ligated glyphs. Rebuild it so text
     // renders as the non-ligated fallback immediately.
-    if (pane.webglAddon) {
-      disposeWebgl(pane)
-      attachWebgl(pane)
-    }
+    rebuildAttachedWebgl(pane)
   }
 }
 
@@ -254,6 +251,12 @@ export function disposePane(
   } catch {
     /* ignore */
   }
+  try {
+    // Drop renderer selection state before a recovery remount replaces the surface.
+    pane.terminal.clearSelection()
+  } catch {
+    /* ignore */
+  }
   try {
     pane.terminal.dispose()
   } catch {
diff --git a/src/renderer/src/lib/pane-manager/pane-manager-types.ts b/src/renderer/src/lib/pane-manager/pane-manager-types.ts
index 113f10af80d..34b42c4b591 100644
--- a/src/renderer/src/lib/pane-manager/pane-manager-types.ts
+++ b/src/renderer/src/lib/pane-manager/pane-manager-types.ts
@@ -142,6 +142,8 @@ export type ManagedPaneInternal = {
   gpuRenderingEnabled: boolean
   webglAttachmentDeferred: boolean
   webglDisabledAfterContextLoss: boolean
+  // Hidden retained renderers rebuild at the resume boundary, never behind the hidden surface.
+  webglRebuildDeferred?: boolean
   // Why per-pane: one pane's failed WebGL attach must not strand every other
   // pane on the DOM renderer until the next recovery boundary. Optional so
   // absent means "never failed"; only the attach failure path sets it.
diff --git a/src/renderer/src/lib/pane-manager/pane-manager.ts b/src/renderer/src/lib/pane-manager/pane-manager.ts
index 82d6f5b1ada..f6d59594d01 100644
--- a/src/renderer/src/lib/pane-manager/pane-manager.ts
+++ b/src/renderer/src/lib/pane-manager/pane-manager.ts
@@ -41,6 +41,7 @@ import {
 } from './pane-rendering-control'
 import type { TerminalLeafId } from '../../../../shared/stable-pane-id'
 import { registerLivePaneManager, unregisterLivePaneManager } from './pane-manager-registry'
+import { releaseHiddenWebglRetention } from './terminal-webgl-hidden-retention'
 import { schedulePaneRevealPresent, schedulePaneRevealRepaint } from './pane-reveal-repaint'
 import { fitRevealedPane } from './pane-reveal-fit'
 import { PaneIdentityRegistry } from './pane-identity-registry'
@@ -65,7 +66,7 @@ export type {
 
 export class PaneManager {
   private root: HTMLElement
-  private panes: Map<number, ManagedPaneInternal> = new Map()
+  private panes = new Map<number, ManagedPaneInternal>()
   private activePaneId: number | null = null
   private nextPaneId = FIRST_PANE_ID
   private options: PaneManagerOptions
@@ -391,12 +392,15 @@ export class PaneManager {
 
   suspendRendering(): void {
     this.renderingSuspended = true
-    suspendPaneRendering(this.panes.values())
+    suspendPaneRendering(this.panes.values(), {
+      owner: this,
+      livePanes: () => (this.destroyed ? [] : this.panes.values())
+    })
   }
 
   resumeRendering(): void {
     this.renderingSuspended = false
-    resumePaneRendering(this.panes.values())
+    resumePaneRendering(this.panes.values(), this)
   }
 
   movePane(sourcePaneId: number, targetPaneId: number, zone: DropZone): void {
@@ -410,6 +414,7 @@ export class PaneManager {
   destroy(): void {
     this.destroyed = true
     unregisterLivePaneManager(this)
+    releaseHiddenWebglRetention(this)
     cancelActivePaneDrag(this.dragState)
     this.cancelPendingPaneReparentFrames()
     for (const pane of this.panes.values()) {
diff --git a/src/renderer/src/lib/pane-manager/pane-rendering-control.ts b/src/renderer/src/lib/pane-manager/pane-rendering-control.ts
index 5477fd4f3b0..2c005f0ff05 100644
--- a/src/renderer/src/lib/pane-manager/pane-rendering-control.ts
+++ b/src/renderer/src/lib/pane-manager/pane-rendering-control.ts
@@ -4,10 +4,15 @@ import {
   attachWebgl,
   clearTerminalWebglAttachBackoff,
   disposeWebgl,
+  isPaneWebglContextLost,
   markComplexScriptOutput,
   resetWebglTextureAtlas
 } from './pane-webgl-renderer'
-import { reattachWebglIfNeeded } from './pane-webgl-reattach'
+import { rebuildAttachedWebgl, reattachWebglIfNeeded } from './pane-webgl-reattach'
+import {
+  releaseHiddenWebglRetention,
+  tryRetainHiddenPanesWebgl
+} from './terminal-webgl-hidden-retention'
 
 export function setPaneGpuRenderingState(
   panes: Map<number, ManagedPaneInternal>,
@@ -42,21 +47,51 @@ export function markPaneComplexScriptOutput(
   }
 }
 
-export function suspendPaneRendering(panes: Iterable<ManagedPaneInternal>): void {
-  for (const pane of panes) {
+export function suspendPaneRendering(
+  panes: Iterable<ManagedPaneInternal>,
+  retention?: { owner: object; livePanes: () => Iterable<ManagedPaneInternal> }
+): void {
+  const suspended = Array.from(panes)
+  for (const pane of suspended) {
     pane.webglAttachmentDeferred = true
+  }
+  // Keep recent hidden worktrees on live WebGL so switch-back never presents
+  // DOM-fallback frames; evicted/over-cap owners fall back to dispose.
+  if (retention && tryRetainHiddenPanesWebgl(retention.owner, retention.livePanes)) {
+    // Why: retained WebGL keeps xterm's focused cursor timer alive behind the hidden surface.
+    for (const pane of suspended) {
+      pane.terminal.blur()
+    }
+    return
+  }
+  for (const pane of suspended) {
     disposeWebgl(pane)
   }
 }
 
-export function resumePaneRendering(panes: Iterable<ManagedPaneInternal>): void {
+export function resumePaneRendering(
+  panes: Iterable<ManagedPaneInternal>,
+  retentionOwner?: object
+): void {
+  if (retentionOwner) {
+    releaseHiddenWebglRetention(retentionOwner)
+  }
   for (const pane of panes) {
     // Why: resume (worktree foreground, window wake) is the WebGL retry
     // boundary — Chromium may have restored the GPU process since a context
     // loss, and bounding retries to resume events cannot loop on live loss.
     clearTerminalWebglAttachBackoff(pane)
+    const rebuildDeferred = pane.webglRebuildDeferred === true
     pane.webglAttachmentDeferred = false
     pane.webglDisabledAfterContextLoss = false
+    pane.webglRebuildDeferred = false
+    if (pane.webglAddon && isPaneWebglContextLost(pane)) {
+      disposeWebgl(pane)
+    }
+    if (rebuildDeferred && pane.webglAddon) {
+      rebuildAttachedWebgl(pane)
+      continue
+    }
     reattachWebglIfNeeded(pane)
   }
 }
diff --git a/src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler.test.ts b/src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler.test.ts
index c3f0c4df330..2a9d7d023ac 100644
--- a/src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler.test.ts
+++ b/src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler.test.ts
@@ -1721,4 +1721,168 @@ describe('pane terminal output scheduler', () => {
     vi.advanceTimersByTime(100)
     expect(throwing.write).toHaveBeenCalledTimes(1)
   })
+
+  describe('queue memory retention (STA-3567)', () => {
+    // Why 2 MB: comfortably above BACKGROUND_CHUNK_CHARS (16 K), so every drain leaves a residual slice.
+    const CHUNK_CHARS = 2 * 1024 * 1024
+    const TERMINALS = 8
+
+    function collect(): number {
+      const gc = (globalThis as { gc?: () => void }).gc
+      if (!gc) {
+        throw new Error('global.gc unavailable - config/vitest.config.ts must pass --expose-gc')
+      }
+      gc()
+      gc()
+      return process.memoryUsage().heapUsed
+    }
+
+    it('releases chunks it has already drained past', async () => {
+      vi.useFakeTimers()
+      const { writeTerminalOutput } = await loadScheduler()
+
+      // Why many medium chunks: compactConsumedChunks only splices once chunkIndex reaches 64,
+      // so below that the drained slots stay in the array and must be cleared individually.
+      const CHUNKS_PER_TERMINAL = 40
+      const CHUNK = 48 * 1024
+      const SINKS = 4
+
+      let writtenChars = 0
+      const terminals = Array.from({ length: SINKS }, () => ({
+        write: (data: string, callback?: () => void) => {
+          writtenChars += data.length
+          callback?.()
+        }
+      }))
+
+      const baseline = collect()
+
+      for (const [index, terminal] of terminals.entries()) {
+        for (let chunk = 0; chunk < CHUNKS_PER_TERMINAL; chunk += 1) {
+          writeTerminalOutput(
+            terminal,
+            String.fromCharCode(65 + index) +
+              String.fromCharCode(48 + (chunk % 10)) +
+              'q'.repeat(CHUNK - 2),
+            { foreground: false, latencySensitive: false }
+          )
+        }
+      }
+
+      const debug = (
+        globalThis as {
+          __terminalOutputSchedulerDebug?: { snapshot: () => { queuedChars: number } }
+        }
+      ).__terminalOutputSchedulerDebug
+      if (!debug) {
+        throw new Error('scheduler debug API unavailable')
+      }
+
+      const TAIL_CHARS = 64 * 1024
+      let ticks = 0
+      while (debug.snapshot().queuedChars > TAIL_CHARS && ticks < 40000) {
+        vi.advanceTimersByTime(4)
+        ticks += 1
+      }
+
+      const queuedChars = debug.snapshot().queuedChars
+      const retainedBytes = collect() - baseline
+
+      // Sanity: the queues really drained down, and none hit the backlog cap.
+      expect(writtenChars).toBeGreaterThan(SINKS * CHUNKS_PER_TERMINAL * CHUNK * 0.9)
+      expect(queuedChars).toBeGreaterThan(0)
+      expect(queuedChars).toBeLessThanOrEqual(TAIL_CHARS)
+
+      // The defect: ~39 drained-past slots per terminal kept their strings alive uncharged.
+      expect(retainedBytes).toBeLessThan(2 * 1024 * 1024)
+    })
+
+    it('does not pin the parent when a producer enqueues a slice', async () => {
+      vi.useFakeTimers()
+      const { writeTerminalOutput } = await loadScheduler()
+
+      // Why a slice: agent-status-osc.ts and the restore-overlap trims hand the scheduler
+      // strings cut from a much larger buffer. The queue must own its copy rather than
+      // trusting every producer to flatten first (STA-3567 review round 2).
+      const KEEP_CHARS = 64 * 1024
+      const sinks = Array.from({ length: TERMINALS }, () => ({
+        write: (_data: string, callback?: () => void) => callback?.()
+      }))
+
+      const baseline = collect()
+
+      for (const [index, sink] of sinks.entries()) {
+        const parent = String.fromCharCode(65 + index) + 'q'.repeat(CHUNK_CHARS - 1)
+        writeTerminalOutput(sink, parent.slice(parent.length - KEEP_CHARS), {
+          foreground: false,
+          latencySensitive: false
+        })
+      }
+
+      const retainedBytes = collect() - baseline
+
+      // 8 x 64 KB of real payload must not keep 8 x 2 MB of parents alive.
+      expect(retainedBytes).toBeLessThan(4 * 1024 * 1024)
+    })
+
+    it('drops the parent chunk once only a small tail is still queued', async () => {
+      vi.useFakeTimers()
+      const { writeTerminalOutput } = await loadScheduler()
+
+      // Why a hand-rolled write: vi.fn() retains every argument in mock.calls, which would
+      // dominate the measurement with the very bytes the queue is supposed to have released.
+      let writtenChars = 0
+      const makeSink = (): { write: (data: string, callback?: () => void) => void } => ({
+        write: (data: string, callback?: () => void) => {
+          writtenChars += data.length
+          callback?.()
+        }
+      })
+      const terminals = Array.from({ length: TERMINALS }, makeSink)
+
+      // Why baseline BEFORE enqueueing: the queue owns a copy of every chunk, so a baseline
+      // taken after enqueue already contains the parents this test must prove get released,
+      // and the assertion would hold even with residual flattening disabled.
+      const baseline = collect()
+
+      for (const [index, terminal] of terminals.entries()) {
+        // Built and dropped inline so only the queue's own copy stays reachable.
+        writeTerminalOutput(
+          terminal,
+          String.fromCharCode(65 + index) + 'q'.repeat(CHUNK_CHARS - 1),
+          { foreground: false, latencySensitive: false }
+        )
+      }
+
+      const debug = (
+        globalThis as {
+          __terminalOutputSchedulerDebug?: { snapshot: () => { queuedChars: number } }
+        }
+      ).__terminalOutputSchedulerDebug
+      if (!debug) {
+        throw new Error('scheduler debug API unavailable')
+      }
+
+      // Why stop early: the leak is what a PARTIALLY drained queue pins. Draining to empty
+      // frees the chunks either way, so a full drain cannot observe the defect.
+      const TAIL_CHARS = 64 * 1024
+      let ticks = 0
+      while (debug.snapshot().queuedChars > TAIL_CHARS && ticks < 20000) {
+        vi.advanceTimersByTime(4)
+        ticks += 1
+      }
+
+      const queuedChars = debug.snapshot().queuedChars
+      const retainedBytes = collect() - baseline
+
+      // Sanity: nearly everything drained, but a real tail is still queued - otherwise
+      // there is no residual slice to hold a parent chunk and the measurement is meaningless.
+      expect(writtenChars).toBeGreaterThan(TERMINALS * CHUNK_CHARS * 0.9)
+      expect(queuedChars).toBeGreaterThan(0)
+      expect(queuedChars).toBeLessThanOrEqual(TAIL_CHARS)
+
+      // The defect: those few queued KB pinned 8 x 2 MB of chunks (~16 MB).
+      expect(retainedBytes).toBeLessThan(4 * 1024 * 1024)
+    })
+  })
 })
diff --git a/src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler.ts b/src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler.ts
index 8acb768e635..db826781812 100644
--- a/src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler.ts
+++ b/src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler.ts
@@ -7,6 +7,7 @@ import {
 } from './pane-terminal-foreground-render-settle'
 import { runGuardedWriteCompletionStep } from './xterm-write-callback-guard'
 import { recordRendererCrashBreadcrumb } from '@/lib/crash-breadcrumb-recorder'
+import { flattenRetainedSlice } from '@/lib/flatten-retained-slice'
 import {
   discardInFlightTerminalOutputAckCredits,
   registerTerminalOutputAckCredits
@@ -49,6 +50,8 @@ type WriteTerminalOutputOptions = {
 
 type QueueChunk = {
   data: string
+  // Tracks the backing data still reachable through this queue slot.
+  retainedChars: number
   foreground: boolean
   forceForegroundRefresh: boolean
   followupForegroundRefresh: boolean
@@ -631,6 +634,16 @@ function takeQueuedChunk(entry: QueueEntry, limit: number): QueuedWrite | null {
       data += chunk.data
       remaining -= chunk.data.length
       entry.queuedChars -= chunk.data.length
+      // Clear drained slots before the 64-chunk compaction can release them.
+      entry.chunks[entry.chunkIndex] = {
+        data: '',
+        retainedChars: 0,
+        foreground: chunk.foreground,
+        forceForegroundRefresh: false,
+        followupForegroundRefresh: false,
+        shouldRefreshForegroundSynchronously: ALWAYS_REFRESH_FOREGROUND_SYNCHRONOUSLY,
+        stripTransientCursorShows: false
+      }
       entry.chunkIndex += 1
       if (chunk.onParsed) {
         parsedCallbacks.push(chunk.onParsed)
@@ -642,9 +655,13 @@ function takeQueuedChunk(entry: QueueEntry, limit: number): QueuedWrite | null {
     }
 
     data += chunk.data.slice(0, remaining)
+    const residual = chunk.data.slice(remaining)
+    // Geometric flattening bounds retained parents while keeping total copy work linear.
+    const flatten = residual.length * 2 <= chunk.retainedChars
     entry.chunks[entry.chunkIndex] = {
       ...chunk,
-      data: chunk.data.slice(remaining)
+      data: flatten ? flattenRetainedSlice(residual) : residual,
+      retainedChars: flatten ? residual.length : chunk.retainedChars
     }
     entry.queuedChars -= remaining
     remaining = 0
@@ -719,8 +736,11 @@ function enqueueChunk(
     ackCredit?: () => void
   }
 ): void {
+  // Own queued data so producer slices cannot pin larger PTY or restore buffers.
+  const owned = flattenRetainedSlice(data)
   entry.chunks.push({
-    data,
+    data: owned,
+    retainedChars: owned.length,
     foreground: options?.foreground === true,
     forceForegroundRefresh: options?.forceForegroundRefresh === true,
     followupForegroundRefresh: options?.followupForegroundRefresh === true,
@@ -783,6 +803,7 @@ function replaceBacklogWithWarning(
   entry.chunks = [
     {
       data: warning,
+      retainedChars: warning.length,
       foreground: false,
       forceForegroundRefresh: false,
       followupForegroundRefresh: false,
diff --git a/src/renderer/src/lib/pane-manager/pane-tree-reparent-frame.test.ts b/src/renderer/src/lib/pane-manager/pane-tree-reparent-frame.test.ts
index 4dff8e4f964..caf3da45092 100644
--- a/src/renderer/src/lib/pane-manager/pane-tree-reparent-frame.test.ts
+++ b/src/renderer/src/lib/pane-manager/pane-tree-reparent-frame.test.ts
@@ -38,7 +38,7 @@ function createMockElement(className = ''): TestElement {
     },
     replaceChild: (nextChild: TestElement, oldChild: TestElement): TestElement => {
       const index = element.children.indexOf(oldChild)
-      if (index >= 0) {
+      if (index !== -1) {
         element.children[index] = nextChild
       } else {
         element.children.push(nextChild)
diff --git a/src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts b/src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts
index 785009ac605..128057e463d 100644
--- a/src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts
+++ b/src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts
@@ -1,8 +1,9 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { setTerminalWebglDiagnosticRecorder } from '../../../../shared/terminal-webgl-diagnostics'
 import type { ManagedPaneInternal } from './pane-manager-types'
-import { resumePaneRendering } from './pane-rendering-control'
+import { resumePaneRendering, suspendPaneRendering } from './pane-rendering-control'
 import { attachWebgl, resetTerminalWebglSuggestion } from './pane-webgl-renderer'
+import { rebuildAttachedWebgl } from './pane-webgl-reattach'
 
 function createPane(options: { loadAddon?: () => void } = {}): ManagedPaneInternal {
   const leafId = '11111111-1111-4111-8111-111111111111' as never
@@ -14,6 +15,7 @@ function createPane(options: { loadAddon?: () => void } = {}): ManagedPaneIntern
       cols: 80,
       rows: 24,
       refresh: vi.fn(),
+      blur: vi.fn(),
       loadAddon: vi.fn(options.loadAddon)
     } as never,
     container: {} as never,
@@ -112,6 +114,47 @@ describe('terminal WebGL context recovery', () => {
     expect(pane.webglAddon).not.toBeNull()
   })
 
+  it('defers retained replay rebuilds until rendering resumes', () => {
+    const owner = {}
+    const pane = createPane()
+    attachWebgl(pane)
+    const retainedAddon = pane.webglAddon
+    suspendPaneRendering([pane], { owner, livePanes: () => [pane] })
+
+    rebuildAttachedWebgl(pane)
+
+    expect(pane.webglAddon).toBe(retainedAddon)
+    expect(pane.webglRebuildDeferred).toBe(true)
+    expect(pane.terminal.loadAddon).toHaveBeenCalledTimes(1)
+
+    resumePaneRendering([pane], owner)
+
+    expect(pane.webglAddon).not.toBe(retainedAddon)
+    expect(pane.webglRebuildDeferred).toBe(false)
+    expect(pane.terminal.loadAddon).toHaveBeenCalledTimes(2)
+  })
+
+  it('replaces a retained context lost before xterm dispatches its loss event', () => {
+    const pane = createPane()
+    const dispose = vi.fn()
+    const lostAddon = {
+      dispose,
+      _renderer: {
+        _gl: {
+          getExtension: vi.fn(() => null),
+          isContextLost: vi.fn(() => true)
+        }
+      }
+    }
+    pane.webglAddon = lostAddon as never
+
+    resumePaneRendering([pane])
+
+    expect(dispose).toHaveBeenCalledTimes(1)
+    expect(pane.webglAddon).not.toBe(lostAddon)
+    expect(pane.terminal.loadAddon).toHaveBeenCalledTimes(1)
+  })
+
   it('re-latches when the retried context is lost again', () => {
     const pane = createPane()
 
diff --git a/src/renderer/src/lib/pane-manager/pane-webgl-reattach.ts b/src/renderer/src/lib/pane-manager/pane-webgl-reattach.ts
index 15018a1d185..98c5c10e079 100644
--- a/src/renderer/src/lib/pane-manager/pane-webgl-reattach.ts
+++ b/src/renderer/src/lib/pane-manager/pane-webgl-reattach.ts
@@ -11,6 +11,11 @@ export function rebuildAttachedWebgl(pane: ManagedPaneInternal): void {
   if (!pane.webglAddon || pane.webglDisabledAfterContextLoss) {
     return
   }
+  if (pane.webglAttachmentDeferred) {
+    pane.webglRebuildDeferred = true
+    return
+  }
+  pane.webglRebuildDeferred = false
   disposeWebgl(pane)
   // Why: the live addon just proved context creation works, so a stale attach
   // backoff from an earlier failure must not downgrade this pane to DOM.
diff --git a/src/renderer/src/lib/pane-manager/pane-webgl-renderer.ts b/src/renderer/src/lib/pane-manager/pane-webgl-renderer.ts
index a4248612fd2..f162052cebe 100644
--- a/src/renderer/src/lib/pane-manager/pane-webgl-renderer.ts
+++ b/src/renderer/src/lib/pane-manager/pane-webgl-renderer.ts
@@ -23,6 +23,7 @@ let suggestedRendererType: 'dom' | undefined
 
 type ReleasableWebglContext = {
   getExtension(name: 'WEBGL_lose_context'): WEBGL_lose_context | null
+  isContextLost?: () => boolean
 }
 
 type XtermWebglAddonInternals = {
@@ -74,6 +75,15 @@ export function cancelPendingWebglRefresh(pane: ManagedPaneInternal): void {
   pane.pendingWebglRefreshRafId = null
 }
 
+export function isPaneWebglContextLost(pane: ManagedPaneInternal): boolean {
+  try {
+    const renderer = (pane.webglAddon as unknown as XtermWebglAddonInternals | null)?._renderer
+    return renderer?._gl?.isContextLost?.() === true
+  } catch {
+    return true
+  }
+}
+
 export function disposeWebgl(
   pane: ManagedPaneInternal,
   options?: { refreshDimensions?: boolean }
diff --git a/src/renderer/src/lib/pane-manager/terminal-webgl-hidden-retention.test.ts b/src/renderer/src/lib/pane-manager/terminal-webgl-hidden-retention.test.ts
new file mode 100644
index 00000000000..cfe3fba4e37
--- /dev/null
+++ b/src/renderer/src/lib/pane-manager/terminal-webgl-hidden-retention.test.ts
@@ -0,0 +1,152 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ManagedPaneInternal } from './pane-manager-types'
+import { resumePaneRendering, suspendPaneRendering } from './pane-rendering-control'
+import {
+  releaseHiddenWebglRetention,
+  resetHiddenWebglRetentionForTest,
+  retainedHiddenWebglOwnerCountForTest,
+  tryRetainHiddenPanesWebgl
+} from './terminal-webgl-hidden-retention'
+
+function createPane(withAddon = true): ManagedPaneInternal {
+  return {
+    terminal: { blur: vi.fn() },
+    webglAddon: withAddon
+      ? ({ dispose: vi.fn() } as unknown as ManagedPaneInternal['webglAddon'])
+      : null,
+    webglAttachmentDeferred: false,
+    webglDisabledAfterContextLoss: false,
+    webglAttachFailedSinceRecovery: false,
+    gpuRenderingEnabled: true,
+    pendingWebglRefreshRafId: null
+  } as unknown as ManagedPaneInternal
+}
+
+function retentionFor(owner: object, panes: ManagedPaneInternal[]) {
+  return { owner, livePanes: () => panes }
+}
+
+describe('terminal-webgl-hidden-retention', () => {
+  beforeEach(() => {
+    resetHiddenWebglRetentionForTest()
+  })
+
+  it('suspend retains live WebGL addons and still defers attachment', () => {
+    const owner = {}
+    const panes = [createPane(), createPane()]
+    suspendPaneRendering(panes, retentionFor(owner, panes))
+    expect(panes.every((pane) => pane.webglAttachmentDeferred)).toBe(true)
+    expect(panes.every((pane) => pane.webglAddon != null)).toBe(true)
+    expect(panes.every((pane) => vi.mocked(pane.terminal.blur).mock.calls.length === 1)).toBe(true)
+    expect(retainedHiddenWebglOwnerCountForTest()).toBe(1)
+  })
+
+  it('suspend without retention context disposes addons (window-level callers unchanged)', () => {
+    const panes = [createPane()]
+    const addon = panes[0].webglAddon
+    suspendPaneRendering(panes)
+    expect(addon?.dispose).toHaveBeenCalled()
+    expect(panes[0].webglAddon).toBeNull()
+    expect(panes[0].terminal.blur).not.toHaveBeenCalled()
+  })
+
+  it('evicts the least-recently-hidden owner over the context cap', () => {
+    const ownerA = {}
+    const panesA = [createPane(), createPane(), createPane()]
+    const addonsA = panesA.map((pane) => pane.webglAddon)
+    suspendPaneRendering(panesA, retentionFor(ownerA, panesA))
+
+    const ownerB = {}
+    const panesB = [createPane(), createPane(), createPane()]
+    suspendPaneRendering(panesB, retentionFor(ownerB, panesB))
+
+    // A(3) + B(3) fits the cap of 6; C(2) forces A out.
+    const ownerC = {}
+    const panesC = [createPane(), createPane()]
+    suspendPaneRendering(panesC, retentionFor(ownerC, panesC))
+
+    expect(panesA.every((pane) => pane.webglAddon === null)).toBe(true)
+    for (const addon of addonsA) {
+      expect(addon?.dispose).toHaveBeenCalled()
+    }
+    expect(panesB.every((pane) => pane.webglAddon != null)).toBe(true)
+    expect(panesC.every((pane) => pane.webglAddon != null)).toBe(true)
+    expect(retainedHiddenWebglOwnerCountForTest()).toBe(2)
+  })
+
+  it('re-suspending an owner refreshes its LRU position', () => {
+    const ownerA = {}
+    const panesA = [createPane(), createPane(), createPane()]
+    suspendPaneRendering(panesA, retentionFor(ownerA, panesA))
+    const ownerB = {}
+    const panesB = [createPane(), createPane(), createPane()]
+    suspendPaneRendering(panesB, retentionFor(ownerB, panesB))
+
+    // Touch A again: B becomes the eviction candidate.
+    suspendPaneRendering(panesA, retentionFor(ownerA, panesA))
+    const ownerC = {}
+    const panesC = [createPane()]
+    suspendPaneRendering(panesC, retentionFor(ownerC, panesC))
+
+    expect(panesB.every((pane) => pane.webglAddon === null)).toBe(true)
+    expect(panesA.every((pane) => pane.webglAddon != null)).toBe(true)
+  })
+
+  it('does not retain when the owner has no live addons', () => {
+    const owner = {}
+    const panes = [createPane(false)]
+    suspendPaneRendering(panes, retentionFor(owner, panes))
+    expect(retainedHiddenWebglOwnerCountForTest()).toBe(0)
+  })
+
+  it('does not retain a single owner wider than the whole cap', () => {
+    const owner = {}
+    const panes = Array.from({ length: 7 }, () => createPane())
+    const addons = panes.map((pane) => pane.webglAddon)
+    suspendPaneRendering(panes, retentionFor(owner, panes))
+    expect(retainedHiddenWebglOwnerCountForTest()).toBe(0)
+    for (const addon of addons) {
+      expect(addon?.dispose).toHaveBeenCalled()
+    }
+  })
+
+  it('resume releases retention bookkeeping and keeps the live addon', () => {
+    const owner = {}
+    const panes = [createPane()]
+    suspendPaneRendering(panes, retentionFor(owner, panes))
+    resumePaneRendering(panes, owner)
+    expect(retainedHiddenWebglOwnerCountForTest()).toBe(0)
+    expect(panes[0].webglAddon).not.toBeNull()
+    expect(panes[0].webglAttachmentDeferred).toBe(false)
+    // Released owner no longer counts toward the cap: three more 3-pane owners fit.
+    const others = [{}, {}]
+    for (const other of others) {
+      const otherPanes = [createPane(), createPane(), createPane()]
+      suspendPaneRendering(otherPanes, retentionFor(other, otherPanes))
+      expect(otherPanes.every((pane) => pane.webglAddon != null)).toBe(true)
+    }
+  })
+
+  it('releaseHiddenWebglRetention never disposes addons (destroy path owns that)', () => {
+    const owner = {}
+    const panes = [createPane()]
+    expect(tryRetainHiddenPanesWebgl(owner, () => panes)).toBe(true)
+    releaseHiddenWebglRetention(owner)
+    expect(panes[0].webglAddon).not.toBeNull()
+    expect(retainedHiddenWebglOwnerCountForTest()).toBe(0)
+  })
+
+  it('eviction accounting survives addons disposed after retention (GPU toggle off)', () => {
+    const ownerA = {}
+    const panesA = [createPane(), createPane(), createPane(), createPane()]
+    suspendPaneRendering(panesA, retentionFor(ownerA, panesA))
+    // GPU-off path disposes retained addons directly.
+    for (const pane of panesA) {
+      pane.webglAddon = null
+    }
+    const ownerB = {}
+    const panesB = Array.from({ length: 6 }, () => createPane())
+    suspendPaneRendering(panesB, retentionFor(ownerB, panesB))
+    expect(panesB.every((pane) => pane.webglAddon != null)).toBe(true)
+  })
+})
diff --git a/src/renderer/src/lib/pane-manager/terminal-webgl-hidden-retention.ts b/src/renderer/src/lib/pane-manager/terminal-webgl-hidden-retention.ts
new file mode 100644
index 00000000000..e4ca8fa63b0
--- /dev/null
+++ b/src/renderer/src/lib/pane-manager/terminal-webgl-hidden-retention.ts
@@ -0,0 +1,81 @@
+import type { ManagedPaneInternal } from './pane-manager-types'
+import { disposeWebgl } from './pane-webgl-renderer'
+
+// Orca raises Blink's active-context ceiling to 128, but retained contexts
+// still consume GPU memory. Six keeps recent switch-backs on WebGL without
+// letting hidden worktrees grow that cost with the mounted-pane population.
+const MAX_RETAINED_HIDDEN_WEBGL_CONTEXTS = 6
+
+type RetainedHiddenEntry = {
+  owner: object
+  livePanes: () => Iterable<ManagedPaneInternal>
+}
+
+// LRU: oldest suspend first.
+const retainedEntries: RetainedHiddenEntry[] = []
+
+function liveContextCount(entry: RetainedHiddenEntry): number {
+  let count = 0
+  for (const pane of entry.livePanes()) {
+    if (pane.webglAddon) {
+      count += 1
+    }
+  }
+  return count
+}
+
+function disposeEntryContexts(entry: RetainedHiddenEntry): void {
+  for (const pane of entry.livePanes()) {
+    disposeWebgl(pane)
+  }
+}
+
+function removeEntry(owner: object): void {
+  const index = retainedEntries.findIndex((entry) => entry.owner === owner)
+  if (index !== -1) {
+    retainedEntries.splice(index, 1)
+  }
+}
+
+/**
+ * Try to keep the owner's live WebGL addons across a hide. Returns true when
+ * retained — the caller must then skip its dispose pass. Evicts (disposes)
+ * least-recently-hidden owners to stay under the context cap.
+ */
+export function tryRetainHiddenPanesWebgl(
+  owner: object,
+  livePanes: () => Iterable<ManagedPaneInternal>
+): boolean {
+  removeEntry(owner)
+  const entry: RetainedHiddenEntry = { owner, livePanes }
+  const ownCount = liveContextCount(entry)
+  // Nothing to retain (GPU off / first-mount hidden), or a single tab too wide
+  // for the cap — normal dispose keeps eviction from thrashing every other tab.
+  if (ownCount === 0 || ownCount > MAX_RETAINED_HIDDEN_WEBGL_CONTEXTS) {
+    return false
+  }
+  let total = ownCount
+  for (const other of retainedEntries) {
+    total += liveContextCount(other)
+  }
+  while (total > MAX_RETAINED_HIDDEN_WEBGL_CONTEXTS && retainedEntries.length > 0) {
+    const evicted = retainedEntries.shift()!
+    total -= liveContextCount(evicted)
+    disposeEntryContexts(evicted)
+  }
+  retainedEntries.push(entry)
+  return true
+}
+
+/** Drop retention bookkeeping on reveal/destroy; never disposes live addons. */
+export function releaseHiddenWebglRetention(owner: object): void {
+  removeEntry(owner)
+}
+
+export function retainedHiddenWebglOwnerCountForTest(): number {
+  return retainedEntries.length
+}
+
+export function resetHiddenWebglRetentionForTest(): void {
+  retainedEntries.length = 0
+}
diff --git a/src/renderer/src/lib/paste-payload-metadata.ts b/src/renderer/src/lib/paste-payload-metadata.ts
index be63b7bc558..f29894446b2 100644
--- a/src/renderer/src/lib/paste-payload-metadata.ts
+++ b/src/renderer/src/lib/paste-payload-metadata.ts
@@ -1,4 +1,8 @@
 import { yieldToEventLoop } from '../../../shared/event-loop-yield'
+import {
+  getUtf8ByteLengthForCodePoint,
+  readUtf8CodePointAt
+} from '../../../shared/utf8-byte-limits'
 
 export type PastePayloadMetadata = {
   byteLength: number
@@ -24,7 +28,7 @@ export function measurePastePayloadMetadata(
   let previousWasCarriageReturn = false
 
   for (let index = 0; index < text.length; index += 1) {
-    const codePoint = text.codePointAt(index) ?? 0
+    const codePoint = readUtf8CodePointAt(text, index)
     byteLength += getUtf8ByteLengthForCodePoint(codePoint)
     hasControlSequences ||= isPasteControlSequenceCodePoint(codePoint)
     if (codePoint === 0x0d) {
@@ -72,7 +76,7 @@ export async function measurePastePayloadMetadataWithYield(
   let previousWasCarriageReturn = false
 
   for (let index = 0; index < text.length; index += 1) {
-    const codePoint = text.codePointAt(index) ?? 0
+    const codePoint = readUtf8CodePointAt(text, index)
     byteLength += getUtf8ByteLengthForCodePoint(codePoint)
     hasControlSequences ||= isPasteControlSequenceCodePoint(codePoint)
     if (codePoint === 0x0d) {
@@ -109,7 +113,7 @@ export function countPastePayloadLines(text: string): number {
 
 export function hasPastePayloadControlSequence(text: string): boolean {
   for (let index = 0; index < text.length; index += 1) {
-    const codePoint = text.codePointAt(index) ?? 0
+    const codePoint = readUtf8CodePointAt(text, index)
     if (isPasteControlSequenceCodePoint(codePoint)) {
       return true
     }
@@ -138,16 +142,3 @@ function isPasteControlSequenceCodePoint(codePoint: number): boolean {
     codePoint === 0x7f
   )
 }
-
-function getUtf8ByteLengthForCodePoint(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
diff --git a/src/renderer/src/lib/pr-bot-author-overrides.ts b/src/renderer/src/lib/pr-bot-author-overrides.ts
index cf8ade2fea7..714dd0b6c01 100644
--- a/src/renderer/src/lib/pr-bot-author-overrides.ts
+++ b/src/renderer/src/lib/pr-bot-author-overrides.ts
@@ -2,8 +2,11 @@ import { useMemo } from 'react'
 import { toast } from 'sonner'
 import { translate } from '@/i18n/i18n'
 import { useAppStore } from '@/store'
-import { createBotAuthorOverrideSet, normalizePRCommentAuthorLogin } from './pr-comment-audience'
-import { MAX_PR_BOT_AUTHOR_OVERRIDES } from '../../../shared/pr-bot-author-overrides'
+import {
+  createBotAuthorOverrideSet,
+  MAX_PR_BOT_AUTHOR_OVERRIDES,
+  normalizePRCommentAuthorLogin
+} from '../../../shared/pr-bot-author-overrides'
 
 let overrideUpdateQueue = Promise.resolve()
 
diff --git a/src/renderer/src/lib/pr-comment-action-state.test.ts b/src/renderer/src/lib/pr-comment-action-state.test.ts
index 628d8c5ba2a..b3038076b87 100644
--- a/src/renderer/src/lib/pr-comment-action-state.test.ts
+++ b/src/renderer/src/lib/pr-comment-action-state.test.ts
@@ -1,11 +1,11 @@
 import { describe, expect, it } from 'vitest'
 import type { PRComment } from '../../../shared/types'
-import { groupPRComments } from './pr-comment-groups'
+import { groupPRComments, type PRCommentGroup } from '../../../shared/pr-comment-groups'
 import {
   getPRCommentGroupActionState,
   isPRCommentGroupQueueableForAI,
   partitionPRCommentGroupsForTriage,
-  sortPRCommentGroupsForTimeline
+  sortPRCommentGroupsByRecency
 } from './pr-comment-action-state'
 
 function comment(overrides: Partial<PRComment> & { id: number }): PRComment {
@@ -19,6 +19,10 @@ function comment(overrides: Partial<PRComment> & { id: number }): PRComment {
   }
 }
 
+function bodies(groups: readonly PRCommentGroup[]): string[] {
+  return groups.map((group) => (group.kind === 'standalone' ? group.comment.body : group.root.body))
+}
+
 describe('pr-comment-action-state', () => {
   it('classifies resolved, open review threads, and conversation comments', () => {
     const groups = groupPRComments([
@@ -57,15 +61,120 @@ describe('pr-comment-action-state', () => {
       comment({ id: 1, createdAt: '2026-06-16T10:00:00Z', body: 'first' }),
       comment({ id: 2, createdAt: '2026-06-16T11:00:00Z', body: 'second' })
     ])
-    const sorted = sortPRCommentGroupsForTimeline(groups)
+    const sorted = sortPRCommentGroupsByRecency(groups)
 
     expect(sorted.map((group) => getPRCommentGroupActionState(group))).toEqual([
       'conversation',
       'conversation',
       'conversation'
     ])
-    expect(
-      sorted.map((group) => (group.kind === 'standalone' ? group.comment.body : group.root.body))
-    ).toEqual(['first', 'second', 'third'])
+    expect(bodies(sorted)).toEqual(['first', 'second', 'third'])
+  })
+
+  it('sorts each triage section newest-first for grouped mode', () => {
+    const groups = groupPRComments([
+      comment({ id: 1, createdAt: '2026-06-16T10:00:00Z', body: 'first' }),
+      comment({ id: 2, createdAt: '2026-06-16T11:00:00Z', body: 'second' }),
+      comment({
+        id: 3,
+        createdAt: '2026-06-16T09:00:00Z',
+        body: 'older open',
+        threadId: 't-open-old',
+        path: 'src/a.ts',
+        isResolved: false
+      }),
+      comment({
+        id: 4,
+        createdAt: '2026-06-16T12:00:00Z',
+        body: 'newer open',
+        threadId: 't-open-new',
+        path: 'src/b.ts',
+        isResolved: false
+      })
+    ])
+    const partitioned = partitionPRCommentGroupsForTriage(
+      sortPRCommentGroupsByRecency(groups, 'newest-first')
+    )
+
+    expect(bodies(partitioned.conversation)).toEqual(['second', 'first'])
+    expect(bodies(partitioned.open)).toEqual(['newer open', 'older open'])
+    expect(partitioned.resolved).toEqual([])
+  })
+
+  it('ranks a stale thread by its newest reply under newest-first only', () => {
+    const groups = groupPRComments([
+      comment({
+        id: 1,
+        createdAt: '2026-06-13T09:00:00Z',
+        body: 'stale root',
+        threadId: 't-stale',
+        path: 'src/a.ts',
+        isResolved: false
+      }),
+      comment({
+        id: 2,
+        createdAt: '2026-06-16T12:00:00Z',
+        body: 'fresh reply',
+        threadId: 't-stale',
+        path: 'src/a.ts',
+        isResolved: false
+      }),
+      comment({ id: 3, createdAt: '2026-06-16T11:00:00Z', body: 'newer standalone' }),
+      comment({
+        id: 4,
+        createdAt: '2026-06-14T09:00:00Z',
+        body: 'mid root',
+        threadId: 't-mid',
+        path: 'src/b.ts',
+        isResolved: false
+      }),
+      comment({
+        id: 5,
+        createdAt: '2026-06-14T10:00:00Z',
+        body: 'mid reply',
+        threadId: 't-mid',
+        path: 'src/b.ts',
+        isResolved: false
+      })
+    ])
+
+    expect(bodies(sortPRCommentGroupsByRecency(groups, 'newest-first'))).toEqual([
+      'stale root',
+      'newer standalone',
+      'mid root'
+    ])
+    expect(bodies(sortPRCommentGroupsByRecency(groups))).toEqual([
+      'stale root',
+      'mid root',
+      'newer standalone'
+    ])
+  })
+
+  it('inverts the id tiebreaker numerically when groups share a timestamp', () => {
+    const groups = groupPRComments([
+      comment({ id: 9, createdAt: '2026-06-16T12:00:00Z', body: 'batch a' }),
+      comment({ id: 10, createdAt: '2026-06-16T12:00:00Z', body: 'batch b' })
+    ])
+
+    expect(bodies(sortPRCommentGroupsByRecency(groups))).toEqual(['batch a', 'batch b'])
+    expect(bodies(sortPRCommentGroupsByRecency(groups, 'newest-first'))).toEqual([
+      'batch b',
+      'batch a'
+    ])
+  })
+
+  it('sinks groups with an unparseable timestamp to the bottom in both orders', () => {
+    const groups = groupPRComments([
+      comment({ id: 1, createdAt: '', body: 'unknown time' }),
+      comment({ id: 2, createdAt: '2026-06-16T10:00:00Z', body: 'older' }),
+      comment({ id: 3, createdAt: '2026-06-16T11:00:00Z', body: 'newer' })
+    ])
+
+    expect(bodies(sortPRCommentGroupsByRecency(groups))).toEqual(['older', 'newer', 'unknown time'])
+    expect(bodies(sortPRCommentGroupsByRecency(groups, 'newest-first'))).toEqual([
+      'newer',
+      'older',
+      'unknown time'
+    ])
   })
 })
diff --git a/src/renderer/src/lib/pr-comment-action-state.ts b/src/renderer/src/lib/pr-comment-action-state.ts
index e75d7c09cba..2207141bd06 100644
--- a/src/renderer/src/lib/pr-comment-action-state.ts
+++ b/src/renderer/src/lib/pr-comment-action-state.ts
@@ -1,5 +1,5 @@
-import type { PRCommentGroup } from './pr-comment-groups'
-import { getPRCommentGroupId, getPRCommentGroupRoot } from './pr-comment-groups'
+import { getPRCommentGroupRoot, type PRCommentGroup } from '../../../shared/pr-comment-groups'
+import type { PRComment } from '../../../shared/types'
 
 /** How a comment group should read in the PR sidebar triage UI. */
 export type PRCommentGroupActionState = 'open' | 'conversation' | 'resolved'
@@ -42,17 +42,58 @@ export function partitionPRCommentGroupsForTriage(groups: readonly PRCommentGrou
   return { open, conversation, resolved }
 }
 
-function groupTimelineMs(group: PRCommentGroup): number {
-  const ts = Date.parse(getPRCommentGroupRoot(group).createdAt)
-  return Number.isNaN(ts) ? 0 : ts
+/** Null when the host sent an unparseable (often empty) `createdAt`. */
+function commentMs(comment: PRComment): number | null {
+  const ts = Date.parse(comment.createdAt)
+  return Number.isNaN(ts) ? null : ts
 }
 
-export function sortPRCommentGroupsForTimeline(
-  groups: readonly PRCommentGroup[]
+function groupStartMs(group: PRCommentGroup): number | null {
+  return commentMs(getPRCommentGroupRoot(group))
+}
+
+/** Newest comment anywhere in the group, so a fresh reply refreshes an old thread. */
+function groupLatestActivityMs(group: PRCommentGroup): number | null {
+  if (group.kind !== 'thread') {
+    return commentMs(group.comment)
+  }
+  return group.replies.reduce<number | null>((latest, reply) => {
+    const ts = commentMs(reply)
+    if (ts === null) {
+      return latest
+    }
+    return latest === null ? ts : Math.max(latest, ts)
+  }, commentMs(group.root))
+}
+
+/**
+ * Orders comment groups by time. The two orders use different keys, not just opposite
+ * directions: `newest-first` ranks by last activity anywhere in the thread, while
+ * `oldest-first` ranks by when the thread started. Groups whose timestamp is unknown
+ * sort last in both orders.
+ */
+export function sortPRCommentGroupsByRecency(
+  groups: readonly PRCommentGroup[],
+  order: 'oldest-first' | 'newest-first' = 'oldest-first'
 ): PRCommentGroup[] {
-  return [...groups].sort(
-    (left, right) =>
-      groupTimelineMs(left) - groupTimelineMs(right) ||
-      getPRCommentGroupId(left).localeCompare(getPRCommentGroupId(right))
-  )
+  const newestFirst = order === 'newest-first'
+  const multiplier = newestFirst ? -1 : 1
+  const timestampOf = newestFirst ? groupLatestActivityMs : groupStartMs
+  // Why: decorate first so each group parses its dates once, not once per comparison.
+  return groups
+    .map((group) => ({ group, ts: timestampOf(group), id: getPRCommentGroupRoot(group).id }))
+    .sort((left, right) => {
+      if (left.ts === null || right.ts === null) {
+        if (left.ts !== null) {
+          return -1
+        }
+        if (right.ts !== null) {
+          return 1
+        }
+        return multiplier * (left.id - right.id)
+      }
+      // Why: ids break the ties GitHub creates by stamping a whole review batch identically.
+      return multiplier * (left.ts - right.ts || left.id - right.id)
+    })
+    .map((entry) => entry.group)
 }
diff --git a/src/renderer/src/lib/pr-comment-audience-labels.ts b/src/renderer/src/lib/pr-comment-audience-labels.ts
new file mode 100644
index 00000000000..50e307cc1c7
--- /dev/null
+++ b/src/renderer/src/lib/pr-comment-audience-labels.ts
@@ -0,0 +1,22 @@
+import type { PRCommentAudienceFilter } from '../../../shared/pr-comment-audience'
+import { createLocalizedCatalog } from '@/i18n/localized-catalog'
+import { translate } from '@/i18n/i18n'
+
+export const getPrCommentAudienceFilters = createLocalizedCatalog(
+  (): { value: PRCommentAudienceFilter; label: string }[] => [
+    { value: 'all', label: translate('auto.lib.pr.comment.audience.27ce73211c', 'All') },
+    { value: 'human', label: translate('auto.lib.pr.comment.audience.a7150a17bc', 'Humans') },
+    { value: 'bot', label: translate('auto.lib.pr.comment.audience.64deee36a9', 'Bots') }
+  ]
+)
+
+export function getPRCommentAudienceEmptyLabel(filter: PRCommentAudienceFilter): string {
+  switch (filter) {
+    case 'bot':
+      return translate('auto.lib.pr.comment.audience.empty.bot', 'No bot comments.')
+    case 'human':
+      return translate('auto.lib.pr.comment.audience.empty.human', 'No human comments.')
+    case 'all':
+      return translate('auto.lib.pr.comment.audience.empty.all', 'No comments yet.')
+  }
+}
diff --git a/src/renderer/src/lib/pr-comment-audience.ts b/src/renderer/src/lib/pr-comment-audience.ts
deleted file mode 100644
index dc731095277..00000000000
--- a/src/renderer/src/lib/pr-comment-audience.ts
+++ /dev/null
@@ -1,109 +0,0 @@
-import type { PRComment } from '../../../shared/types'
-import {
-  createBotAuthorOverrideSet,
-  normalizePRCommentAuthorLogin
-} from '../../../shared/pr-bot-author-overrides'
-import { createLocalizedCatalog } from '@/i18n/localized-catalog'
-import { translate } from '@/i18n/i18n'
-
-export { createBotAuthorOverrideSet, normalizePRCommentAuthorLogin }
-
-export type PRCommentAudienceFilter = 'all' | 'human' | 'bot'
-
-export const getPrCommentAudienceFilters = createLocalizedCatalog(
-  (): { value: PRCommentAudienceFilter; label: string }[] => [
-    { value: 'all', label: translate('auto.lib.pr.comment.audience.27ce73211c', 'All') },
-    { value: 'human', label: translate('auto.lib.pr.comment.audience.a7150a17bc', 'Humans') },
-    { value: 'bot', label: translate('auto.lib.pr.comment.audience.64deee36a9', 'Bots') }
-  ]
-)
-
-const BOT_LOGIN_SUFFIX = '[bot]'
-const AUTOMATION_LOGIN_PATTERNS = [
-  /bot$/i,
-  /-bot$/i,
-  /\bbot\b/i,
-  /automation/i,
-  /actions/i,
-  /renovate/i,
-  /dependabot/i
-]
-// Why: some AI/code-review services use regular GitHub user accounts rather
-// than GitHub Apps, so GitHub metadata can report them as users. Keep this
-// central so the Tasks dialog and PR sidebar classify comments identically.
-const KNOWN_AUTOMATION_LOGIN_SUBSTRINGS = [
-  'chatgpt-codex-connector',
-  'codex-connector',
-  'qodo',
-  'coderabbit',
-  'codium',
-  'sonarcloud',
-  'sonarqube',
-  'sourcery-ai',
-  'deepsource',
-  'snyk',
-  'codecov',
-  'greptile',
-  'ellipsis',
-  'graphite-app',
-  'reviewer-gpt',
-  '-reviewer'
-]
-
-export function isBotPRComment(
-  comment: PRComment,
-  botAuthorOverrides?: ReadonlySet<string>
-): boolean {
-  const author = comment.author.trim()
-  const normalized = normalizePRCommentAuthorLogin(author)
-  if (botAuthorOverrides?.has(normalized)) {
-    return true
-  }
-  if (comment.isBot === true) {
-    return true
-  }
-  if (normalized.endsWith(BOT_LOGIN_SUFFIX)) {
-    return true
-  }
-  if (KNOWN_AUTOMATION_LOGIN_SUBSTRINGS.some((needle) => normalized.includes(needle))) {
-    return true
-  }
-  return AUTOMATION_LOGIN_PATTERNS.some((pattern) => pattern.test(author))
-}
-
-export function getPRCommentAudienceCounts(
-  comments: PRComment[],
-  botAuthorOverrides?: ReadonlySet<string>
-): Record<PRCommentAudienceFilter, number> {
-  const bot = comments.filter((comment) => isBotPRComment(comment, botAuthorOverrides)).length
-  return {
-    all: comments.length,
-    human: comments.length - bot,
-    bot
-  }
-}
-
-export function filterPRCommentsByAudience(
-  comments: PRComment[],
-  filter: PRCommentAudienceFilter,
-  botAuthorOverrides?: ReadonlySet<string>
-): PRComment[] {
-  if (filter === 'bot') {
-    return comments.filter((comment) => isBotPRComment(comment, botAuthorOverrides))
-  }
-  if (filter === 'human') {
-    return comments.filter((comment) => !isBotPRComment(comment, botAuthorOverrides))
-  }
-  return comments
-}
-
-export function getPRCommentAudienceEmptyLabel(filter: PRCommentAudienceFilter): string {
-  switch (filter) {
-    case 'bot':
-      return translate('auto.lib.pr.comment.audience.empty.bot', 'No bot comments.')
-    case 'human':
-      return translate('auto.lib.pr.comment.audience.empty.human', 'No human comments.')
-    case 'all':
-      return translate('auto.lib.pr.comment.audience.empty.all', 'No comments yet.')
-  }
-}
diff --git a/src/renderer/src/lib/pr-comment-groups.ts b/src/renderer/src/lib/pr-comment-groups.ts
deleted file mode 100644
index d9fcfddf2b3..00000000000
--- a/src/renderer/src/lib/pr-comment-groups.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-import type { PRComment } from '../../../shared/types'
-
-export const PR_COMMENT_RESOLVED_CONTAINER_CLASS = 'opacity-50'
-export const PR_COMMENT_RESOLVED_AUTHOR_CLASS = 'text-muted-foreground'
-export const PR_COMMENT_OPEN_AUTHOR_CLASS = 'text-foreground'
-
-export type PRCommentGroup =
-  | { kind: 'standalone'; comment: PRComment }
-  | { kind: 'thread'; threadId: string; root: PRComment; replies: PRComment[] }
-
-export function groupPRComments(comments: PRComment[]): PRCommentGroup[] {
-  const threadMap = new Map<string, { root: PRComment; replies: PRComment[] }>()
-  const groupsByFirstComment = new Map<PRComment, PRCommentGroup>()
-
-  for (const comment of comments) {
-    if (!comment.threadId) {
-      groupsByFirstComment.set(comment, { kind: 'standalone', comment })
-      continue
-    }
-    const existing = threadMap.get(comment.threadId)
-    if (existing) {
-      existing.replies.push(comment)
-      continue
-    }
-    threadMap.set(comment.threadId, { root: comment, replies: [] })
-  }
-
-  const emitted = new Set<string>()
-  const groups: PRCommentGroup[] = []
-  for (const comment of comments) {
-    if (!comment.threadId) {
-      const group = groupsByFirstComment.get(comment)
-      if (group) {
-        groups.push(group)
-      }
-      continue
-    }
-    if (emitted.has(comment.threadId)) {
-      continue
-    }
-    emitted.add(comment.threadId)
-    const thread = threadMap.get(comment.threadId)
-    if (thread) {
-      groups.push({ kind: 'thread', threadId: comment.threadId, ...thread })
-    }
-  }
-  return groups
-}
-
-export function getPRCommentGroupComments(group: PRCommentGroup): PRComment[] {
-  return group.kind === 'thread' ? [group.root, ...group.replies] : [group.comment]
-}
-
-export function getPRCommentGroupRoot(group: PRCommentGroup): PRComment {
-  return group.kind === 'thread' ? group.root : group.comment
-}
-
-export function getPRCommentGroupCount(group: PRCommentGroup): number {
-  return getPRCommentGroupComments(group).length
-}
-
-export function isResolvedPRCommentGroup(group: PRCommentGroup): boolean {
-  return getPRCommentGroupRoot(group).isResolved === true
-}
-
-export function getPRCommentGroupId(group: PRCommentGroup): string {
-  return group.kind === 'thread' ? `thread:${group.threadId}` : `comment:${group.comment.id}`
-}
diff --git a/src/renderer/src/lib/pr-comment-resolution-classes.ts b/src/renderer/src/lib/pr-comment-resolution-classes.ts
new file mode 100644
index 00000000000..2caa89efd1a
--- /dev/null
+++ b/src/renderer/src/lib/pr-comment-resolution-classes.ts
@@ -0,0 +1,3 @@
+export const PR_COMMENT_RESOLVED_CONTAINER_CLASS = 'opacity-50'
+export const PR_COMMENT_RESOLVED_AUTHOR_CLASS = 'text-muted-foreground'
+export const PR_COMMENT_OPEN_AUTHOR_CLASS = 'text-foreground'
diff --git a/src/renderer/src/lib/preserved-branch-cleanup.ts b/src/renderer/src/lib/preserved-branch-cleanup.ts
new file mode 100644
index 00000000000..b13830391aa
--- /dev/null
+++ b/src/renderer/src/lib/preserved-branch-cleanup.ts
@@ -0,0 +1,5 @@
+export {
+  preservedBranchCleanupKey,
+  preservedBranchCleanupScopeKey,
+  type PreservedBranchCleanup
+} from '../../../shared/preserved-branch-cleanup'
diff --git a/src/renderer/src/lib/primary-selection-paste.ts b/src/renderer/src/lib/primary-selection-paste.ts
index 93e237378d0..9dcf2c73097 100644
--- a/src/renderer/src/lib/primary-selection-paste.ts
+++ b/src/renderer/src/lib/primary-selection-paste.ts
@@ -1,4 +1,5 @@
 import { yieldToEventLoop } from '../../../shared/event-loop-yield'
+import { getUtf8ChunkEndIndex } from '../../../shared/utf8-byte-limits'
 import { isPrimarySelectionTextControl } from './primary-selection-capture'
 import {
   TEXT_CONTROL_PASTE_CHUNK_MAX_BYTES,
@@ -101,39 +102,6 @@ function isContentEditablePasteTargetAvailable(
   return target.isConnected && target.isContentEditable && (canContinue?.(target) ?? true)
 }
 
-function getCodePointUtf8ByteLength(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
-
-function getNextChunkBoundary(text: string, startIndex: number, maxBytes: number): number {
-  let byteLength = 0
-  let index = startIndex
-
-  while (index < text.length) {
-    const codePoint = text.codePointAt(index) ?? 0
-    const codeUnitLength = codePoint > 0xffff ? 2 : 1
-    const nextByteLength = getCodePointUtf8ByteLength(codePoint)
-
-    if (byteLength > 0 && byteLength + nextByteLength > maxBytes) {
-      break
-    }
-
-    byteLength += nextByteLength
-    index += codeUnitLength
-  }
-
-  return index
-}
-
 function getContentEditableInsertionRange(target: HTMLElement): Range | null {
   const selection = target.ownerDocument.getSelection()
   if (!selection || selection.rangeCount === 0) {
@@ -180,7 +148,7 @@ async function pasteLargeTextIntoContentEditable(
       }
       return false
     }
-    const nextIndex = getNextChunkBoundary(text, textIndex, chunkMaxBytes)
+    const nextIndex = getUtf8ChunkEndIndex(text, textIndex, chunkMaxBytes)
     range = insertContentEditableChunk(target, range, text.slice(textIndex, nextIndex))
     textIndex = nextIndex
     if (textIndex < text.length) {
diff --git a/src/renderer/src/lib/repo-search.ts b/src/renderer/src/lib/repo-search.ts
index 7c4faf192ea..5a223af6392 100644
--- a/src/renderer/src/lib/repo-search.ts
+++ b/src/renderer/src/lib/repo-search.ts
@@ -38,7 +38,7 @@ function matchScore(repo: Repo, query: string): number | null {
   return null
 }
 
-export function searchRepos(repos: Repo[], rawQuery: string): Repo[] {
+export function searchRepos(repos: readonly Repo[], rawQuery: string): readonly Repo[] {
   if (isRepoSearchQueryTooLarge(rawQuery)) {
     return []
   }
diff --git a/src/renderer/src/lib/repo-slug-index.ts b/src/renderer/src/lib/repo-slug-index.ts
index d48dbb869f3..442a29d6d62 100644
--- a/src/renderer/src/lib/repo-slug-index.ts
+++ b/src/renderer/src/lib/repo-slug-index.ts
@@ -126,7 +126,7 @@ async function resolveRepoSlug(
 }
 
 async function buildIndex(
-  repos: Repo[],
+  repos: readonly Repo[],
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined
 ): Promise<{ index: SlugIndex; upstreamIndex: SlugIndex; retryDelayMs: number | null }> {
   // Why: evict cached entries for repos that no longer exist in state so
diff --git a/src/renderer/src/lib/runtime-pane-title-leaf-id.ts b/src/renderer/src/lib/runtime-pane-title-leaf-id.ts
index 0847f1e3de2..c18e752e883 100644
--- a/src/renderer/src/lib/runtime-pane-title-leaf-id.ts
+++ b/src/renderer/src/lib/runtime-pane-title-leaf-id.ts
@@ -78,7 +78,7 @@ export function resolveRuntimePaneTitleLeafResolution(
   let hasMultiplePaneTitles = false
 
   for (const runtimePaneId in titlesByPaneId) {
-    if (!Object.prototype.hasOwnProperty.call(titlesByPaneId, runtimePaneId)) {
+    if (!Object.hasOwn(titlesByPaneId, runtimePaneId)) {
       continue
     }
 
diff --git a/src/renderer/src/lib/setup-script-prompt.ts b/src/renderer/src/lib/setup-script-prompt.ts
index f25b806d1ef..8bf56d13980 100644
--- a/src/renderer/src/lib/setup-script-prompt.ts
+++ b/src/renderer/src/lib/setup-script-prompt.ts
@@ -97,7 +97,7 @@ export function filterSetupScriptPromptDismissalsToValidRepos(
   const unambiguousIdentityByRepoId = new Map<string, string | null>()
   for (const identity of validRepoHostIdentities) {
     const separatorIndex = identity.indexOf('\0')
-    const repoId = separatorIndex >= 0 ? identity.slice(separatorIndex + 1) : identity
+    const repoId = separatorIndex !== -1 ? identity.slice(separatorIndex + 1) : identity
     unambiguousIdentityByRepoId.set(
       repoId,
       unambiguousIdentityByRepoId.has(repoId) ? null : identity
diff --git a/src/renderer/src/lib/simulator-pane-shutdown-scheduler.ts b/src/renderer/src/lib/simulator-pane-shutdown-scheduler.ts
index 722f322d80a..907ccee5093 100644
--- a/src/renderer/src/lib/simulator-pane-shutdown-scheduler.ts
+++ b/src/renderer/src/lib/simulator-pane-shutdown-scheduler.ts
@@ -9,7 +9,7 @@ type SimulatorTabReference = {
 
 type SimulatorPaneShutdownOptions = {
   getTabsForWorktree?: (worktreeId: string) => SimulatorTabReference[]
-  shutdownManagedSimulator?: (worktreeId: string) => Promise<unknown> | unknown
+  shutdownManagedSimulator?: (worktreeId: string) => unknown
 }
 
 type ScheduleSimulatorPaneShutdownOptions = SimulatorPaneShutdownOptions & {
diff --git a/src/renderer/src/lib/source-control-launch-agent-selection.ts b/src/renderer/src/lib/source-control-launch-agent-selection.ts
index e8c00812590..c72098c9481 100644
--- a/src/renderer/src/lib/source-control-launch-agent-selection.ts
+++ b/src/renderer/src/lib/source-control-launch-agent-selection.ts
@@ -110,7 +110,7 @@ function hasActionOverride(
   overrides: NormalizedRepoSourceControlAiOverrides['actionOverrides'] | undefined,
   actionId: SourceControlActionId
 ): boolean {
-  return Object.prototype.hasOwnProperty.call(overrides ?? {}, actionId)
+  return Object.hasOwn(overrides ?? {}, actionId)
 }
 
 function readRecipeOverrideFields(
@@ -120,13 +120,13 @@ function readRecipeOverrideFields(
     | undefined
 ): SourceControlActionRecipeOverrideField[] {
   const fields: SourceControlActionRecipeOverrideField[] = []
-  if (Object.prototype.hasOwnProperty.call(recipe ?? {}, 'agentId')) {
+  if (Object.hasOwn(recipe ?? {}, 'agentId')) {
     fields.push('agent')
   }
-  if (Object.prototype.hasOwnProperty.call(recipe ?? {}, 'commandInputTemplate')) {
+  if (Object.hasOwn(recipe ?? {}, 'commandInputTemplate')) {
     fields.push('commandTemplate')
   }
-  if (Object.prototype.hasOwnProperty.call(recipe ?? {}, 'agentArgs')) {
+  if (Object.hasOwn(recipe ?? {}, 'agentArgs')) {
     fields.push('agentArgs')
   }
   return fields
diff --git a/src/renderer/src/lib/terminal-contrast-correction.test.ts b/src/renderer/src/lib/terminal-contrast-correction.test.ts
index 7f5cd76cbfe..2197bdf903c 100644
--- a/src/renderer/src/lib/terminal-contrast-correction.test.ts
+++ b/src/renderer/src/lib/terminal-contrast-correction.test.ts
@@ -12,7 +12,7 @@ function contrastRatio(a: string, b: string): number {
     const n = Number.parseInt(hex.replace('#', ''), 16)
     const toLinear = (channel: number): number => {
       const c = channel / 255
-      return c <= 0.03928 ? c / 12.92 : Math.pow((c + 0.055) / 1.055, 2.4)
+      return c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4
     }
     const r = toLinear((n >> 16) & 0xff)
     const g = toLinear((n >> 8) & 0xff)
diff --git a/src/renderer/src/lib/terminal-layout-equality.ts b/src/renderer/src/lib/terminal-layout-equality.ts
index ce11907bed1..716482764e8 100644
--- a/src/renderer/src/lib/terminal-layout-equality.ts
+++ b/src/renderer/src/lib/terminal-layout-equality.ts
@@ -10,9 +10,7 @@ function sameStringRecord(
   const rightKeys = Object.keys(right)
   return (
     leftKeys.length === rightKeys.length &&
-    leftKeys.every(
-      (key) => Object.prototype.hasOwnProperty.call(right, key) && left[key] === right[key]
-    )
+    leftKeys.every((key) => Object.hasOwn(right, key) && left[key] === right[key])
   )
 }
 
diff --git a/src/renderer/src/lib/terminal-quick-command-project-scope.test.ts b/src/renderer/src/lib/terminal-quick-command-project-scope.test.ts
new file mode 100644
index 00000000000..bfde748ee85
--- /dev/null
+++ b/src/renderer/src/lib/terminal-quick-command-project-scope.test.ts
@@ -0,0 +1,179 @@
+import { describe, expect, it } from 'vitest'
+import type { ExecutionHostId } from '../../../shared/execution-host'
+import { projectHostSetupProjectionFromRepos } from '../../../shared/project-host-setup-projection'
+import type { ProjectHostSetup, Repo, TerminalQuickCommand } from '../../../shared/types'
+import { terminalQuickCommandMatchesWorkspaceProject } from './terminal-quick-command-project-scope'
+
+type ScopeSetup = Pick<ProjectHostSetup, 'hostId' | 'projectId' | 'repoId'>
+
+const LOCAL_REPO_ID = '32a0226d-9f33-42e8-8b7b-24867dea06d4'
+const WINDOWS_REPO_ID = 'a0a2b4a4-1bff-494c-b005-d77918abc6a7'
+
+function command(repoId: string): TerminalQuickCommand {
+  return {
+    id: 'test-orca',
+    label: 'Test Orca',
+    action: 'terminal-command',
+    command: 'pnpm test',
+    appendEnter: true,
+    scope: { type: 'repo', repoId }
+  }
+}
+
+function setup(
+  hostId: ExecutionHostId,
+  repoId: string,
+  projectId = 'github:stablyai/orca'
+): ScopeSetup {
+  return { hostId, projectId, repoId }
+}
+
+describe('terminalQuickCommandMatchesWorkspaceProject', () => {
+  it.each<ExecutionHostId>(['runtime:windows-2', 'ssh:windows-2'])(
+    'shows a local repo command in the same project on %s',
+    (targetHostId) => {
+      const projectHostSetups = [
+        setup('local', LOCAL_REPO_ID),
+        setup(targetHostId, WINDOWS_REPO_ID)
+      ]
+
+      expect(
+        terminalQuickCommandMatchesWorkspaceProject(command(LOCAL_REPO_ID), {
+          commandHostId: 'local',
+          projectHostSetups,
+          targetHostId,
+          targetRepoId: WINDOWS_REPO_ID
+        })
+      ).toBe(true)
+    }
+  )
+
+  it('matches the user topology from host-fetched repo catalogs', () => {
+    const repo = (id: string, path: string, executionHostId?: ExecutionHostId): Repo => ({
+      id,
+      path,
+      displayName: 'orca',
+      badgeColor: '#737373',
+      addedAt: 100,
+      kind: 'git',
+      gitRemoteIdentity: {
+        canonicalKey: 'github.com/stablyai/orca',
+        remoteName: 'origin',
+        remoteUrl: 'git@github.com:stablyai/orca.git'
+      },
+      ...(executionHostId ? { executionHostId } : {})
+    })
+    const projectHostSetups = projectHostSetupProjectionFromRepos([
+      repo(LOCAL_REPO_ID, '/Users/alice/orca'),
+      repo(WINDOWS_REPO_ID, 'C:\\Users\\alice\\orca', 'runtime:windows-2')
+    ]).setups
+
+    expect(
+      terminalQuickCommandMatchesWorkspaceProject(command(LOCAL_REPO_ID), {
+        commandHostId: 'local',
+        projectHostSetups,
+        targetHostId: 'runtime:windows-2',
+        targetRepoId: WINDOWS_REPO_ID
+      })
+    ).toBe(true)
+  })
+
+  it('does not show a repo command for a different known project', () => {
+    const projectHostSetups = [
+      setup('local', LOCAL_REPO_ID),
+      setup('runtime:windows-2', WINDOWS_REPO_ID, 'github:stablyai/other')
+    ]
+
+    expect(
+      terminalQuickCommandMatchesWorkspaceProject(command(LOCAL_REPO_ID), {
+        commandHostId: 'local',
+        projectHostSetups,
+        targetHostId: 'runtime:windows-2',
+        targetRepoId: WINDOWS_REPO_ID
+      })
+    ).toBe(false)
+  })
+
+  it('does not trust colliding cross-host repo ids when both projects are known', () => {
+    const projectHostSetups = [
+      setup('local', LOCAL_REPO_ID),
+      setup('runtime:windows-2', LOCAL_REPO_ID, 'github:stablyai/other')
+    ]
+
+    expect(
+      terminalQuickCommandMatchesWorkspaceProject(command(LOCAL_REPO_ID), {
+        commandHostId: 'local',
+        projectHostSetups,
+        targetHostId: 'runtime:windows-2',
+        targetRepoId: LOCAL_REPO_ID
+      })
+    ).toBe(false)
+  })
+
+  it('does not infer a missing target setup from another host repo id', () => {
+    const projectHostSetups = [setup('local', LOCAL_REPO_ID), setup('ssh:builder', WINDOWS_REPO_ID)]
+
+    expect(
+      terminalQuickCommandMatchesWorkspaceProject(command(LOCAL_REPO_ID), {
+        commandHostId: 'local',
+        projectHostSetups,
+        targetHostId: 'runtime:windows-2',
+        targetRepoId: WINDOWS_REPO_ID
+      })
+    ).toBe(false)
+  })
+
+  it('preserves exact repo-id matching when legacy project metadata is unavailable', () => {
+    expect(
+      terminalQuickCommandMatchesWorkspaceProject(command(LOCAL_REPO_ID), {
+        commandHostId: 'local',
+        projectHostSetups: [],
+        targetHostId: 'runtime:legacy',
+        targetRepoId: LOCAL_REPO_ID
+      })
+    ).toBe(true)
+  })
+
+  it('resolves a settings-owned command whose repo executes through SSH', () => {
+    const projectHostSetups = [
+      setup('ssh:builder', LOCAL_REPO_ID),
+      setup('runtime:windows-2', WINDOWS_REPO_ID)
+    ]
+
+    expect(
+      terminalQuickCommandMatchesWorkspaceProject(command(LOCAL_REPO_ID), {
+        commandHostId: 'local',
+        projectHostSetups,
+        targetHostId: 'runtime:windows-2',
+        targetRepoId: WINDOWS_REPO_ID
+      })
+    ).toBe(true)
+  })
+
+  it('keeps a remote-host repo command visible on its own repo', () => {
+    expect(
+      terminalQuickCommandMatchesWorkspaceProject(command(WINDOWS_REPO_ID), {
+        commandHostId: 'runtime:windows-2',
+        projectHostSetups: [],
+        targetHostId: 'runtime:windows-2',
+        targetRepoId: WINDOWS_REPO_ID
+      })
+    ).toBe(true)
+  })
+
+  it('keeps global commands visible without a repo and repo commands hidden', () => {
+    const globalCommand: TerminalQuickCommand = {
+      ...command(LOCAL_REPO_ID),
+      scope: { type: 'global' }
+    }
+    const context = {
+      commandHostId: 'local' as const,
+      projectHostSetups: [],
+      targetHostId: 'runtime:folder' as const,
+      targetRepoId: null
+    }
+
+    expect(terminalQuickCommandMatchesWorkspaceProject(globalCommand, context)).toBe(true)
+    expect(terminalQuickCommandMatchesWorkspaceProject(command(LOCAL_REPO_ID), context)).toBe(false)
+  })
+})
diff --git a/src/renderer/src/lib/terminal-quick-command-project-scope.ts b/src/renderer/src/lib/terminal-quick-command-project-scope.ts
new file mode 100644
index 00000000000..7b48a7b3ada
--- /dev/null
+++ b/src/renderer/src/lib/terminal-quick-command-project-scope.ts
@@ -0,0 +1,73 @@
+import type { ExecutionHostId } from '../../../shared/execution-host'
+import { getTerminalQuickCommandScope } from '../../../shared/terminal-quick-commands'
+import type { ProjectHostSetup, TerminalQuickCommand } from '../../../shared/types'
+
+type TerminalQuickCommandProjectContext = {
+  commandHostId: ExecutionHostId
+  projectHostSetups: readonly Pick<ProjectHostSetup, 'hostId' | 'projectId' | 'repoId'>[]
+  targetHostId: ExecutionHostId
+  targetRepoId: string | null
+}
+
+type ProjectResolution =
+  | { kind: 'resolved'; projectId: string }
+  | { kind: 'ambiguous' }
+  | { kind: 'unknown' }
+
+function resolveProject(
+  setups: TerminalQuickCommandProjectContext['projectHostSetups'],
+  hostId: ExecutionHostId,
+  repoId: string,
+  allowAnyHostFallback: boolean
+): ProjectResolution {
+  const hostMatches = setups.filter((setup) => setup.hostId === hostId && setup.repoId === repoId)
+  // Why: commands belong to a settings host, while its repo can execute through that host's SSH.
+  const candidates =
+    hostMatches.length > 0 || !allowAnyHostFallback
+      ? hostMatches
+      : setups.filter((s) => s.repoId === repoId)
+  const projectIds = new Set(candidates.map((setup) => setup.projectId))
+  if (projectIds.size === 0) {
+    return { kind: 'unknown' }
+  }
+  if (projectIds.size > 1) {
+    return { kind: 'ambiguous' }
+  }
+  return { kind: 'resolved', projectId: [...projectIds][0] }
+}
+
+export function terminalQuickCommandMatchesWorkspaceProject(
+  command: TerminalQuickCommand,
+  context: TerminalQuickCommandProjectContext
+): boolean {
+  const scope = getTerminalQuickCommandScope(command)
+  if (scope.type === 'global') {
+    return true
+  }
+  if (context.targetRepoId === null) {
+    return false
+  }
+  if (context.commandHostId === context.targetHostId && scope.repoId === context.targetRepoId) {
+    return true
+  }
+
+  const commandProject = resolveProject(
+    context.projectHostSetups,
+    context.commandHostId,
+    scope.repoId,
+    true
+  )
+  const targetProject = resolveProject(
+    context.projectHostSetups,
+    context.targetHostId,
+    context.targetRepoId,
+    false
+  )
+  if (commandProject.kind === 'ambiguous' || targetProject.kind === 'ambiguous') {
+    return false
+  }
+  if (commandProject.kind === 'resolved' && targetProject.kind === 'resolved') {
+    return commandProject.projectId === targetProject.projectId
+  }
+  return scope.repoId === context.targetRepoId
+}
diff --git a/src/renderer/src/lib/terminal-quick-command-search.ts b/src/renderer/src/lib/terminal-quick-command-search.ts
index 09027cbfd16..8530e915d07 100644
--- a/src/renderer/src/lib/terminal-quick-command-search.ts
+++ b/src/renderer/src/lib/terminal-quick-command-search.ts
@@ -93,11 +93,11 @@ function scoreCandidate(query: string, rawCandidate: string, baseScore: number):
     return baseScore + 50
   }
   const wordIndex = candidate.indexOf(` ${query}`)
-  if (wordIndex >= 0) {
+  if (wordIndex !== -1) {
     return baseScore + 100 + wordIndex
   }
   const index = candidate.indexOf(query)
-  if (index >= 0) {
+  if (index !== -1) {
     return baseScore + 200 + index
   }
   return NO_MATCH
diff --git a/src/renderer/src/lib/terminal-themes/shared.ts b/src/renderer/src/lib/terminal-themes/shared.ts
index 023213a6605..3d3ee17abba 100644
--- a/src/renderer/src/lib/terminal-themes/shared.ts
+++ b/src/renderer/src/lib/terminal-themes/shared.ts
@@ -7,7 +7,7 @@ export function mergeTerminalThemeCatalogs(
 
   for (const catalog of catalogs) {
     for (const [name, theme] of Object.entries(catalog)) {
-      if (Object.prototype.hasOwnProperty.call(merged, name)) {
+      if (Object.hasOwn(merged, name)) {
         throw new Error(`Duplicate terminal theme name: ${name}`)
       }
       merged[name] = theme
diff --git a/src/renderer/src/lib/terminal-title-contrast.ts b/src/renderer/src/lib/terminal-title-contrast.ts
index a54a4819092..38afe002ed2 100644
--- a/src/renderer/src/lib/terminal-title-contrast.ts
+++ b/src/renderer/src/lib/terminal-title-contrast.ts
@@ -183,7 +183,7 @@ function compositeRgb(foreground: RgbaColor, background: RgbaColor, alpha: numbe
 function relativeLuminance(rgb: Pick<RgbaColor, 'r' | 'g' | 'b'>): number {
   const toLinear = (channel: number): number => {
     const normalized = channel / 255
-    return normalized <= 0.03928 ? normalized / 12.92 : Math.pow((normalized + 0.055) / 1.055, 2.4)
+    return normalized <= 0.03928 ? normalized / 12.92 : ((normalized + 0.055) / 1.055) ** 2.4
   }
   return 0.2126 * toLinear(rgb.r) + 0.7152 * toLinear(rgb.g) + 0.0722 * toLinear(rgb.b)
 }
diff --git a/src/renderer/src/lib/text-control-paste.test.ts b/src/renderer/src/lib/text-control-paste.test.ts
index f5001465e36..942bd92c69b 100644
--- a/src/renderer/src/lib/text-control-paste.test.ts
+++ b/src/renderer/src/lib/text-control-paste.test.ts
@@ -3,7 +3,6 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { PASTE_PAYLOAD_CORPUS } from './paste-payload-corpus'
 import {
-  getTextControlPasteByteLength,
   measureTextControlPasteByteLength,
   pasteTextIntoTextControl,
   shouldHandleTextControlPaste
@@ -251,7 +250,7 @@ describe('text control paste', () => {
   })
 
   it('uses utf-8 byte thresholds for non-ascii text', () => {
-    expect(getTextControlPasteByteLength('a😀é')).toBe(7)
+    expect(measureTextControlPasteByteLength('a😀é').byteLength).toBe(7)
     expect(shouldHandleTextControlPaste('😀😀', { directMaxBytes: 7 })).toBe(true)
     expect(shouldHandleTextControlPaste('abc', { directMaxBytes: 7 })).toBe(false)
     expect(shouldHandleTextControlPaste('', { directMaxBytes: 0 })).toBe(false)
@@ -263,6 +262,8 @@ describe('text control paste', () => {
     })
 
     expect(measurement).toEqual({ byteLength: 8, exceededLimit: true })
-    expect(measurement.byteLength).toBeLessThan(getTextControlPasteByteLength('😀'.repeat(100)))
+    expect(measurement.byteLength).toBeLessThan(
+      measureTextControlPasteByteLength('😀'.repeat(100)).byteLength
+    )
   })
 })
diff --git a/src/renderer/src/lib/text-control-paste.ts b/src/renderer/src/lib/text-control-paste.ts
index a1733044a9f..a3a19028953 100644
--- a/src/renderer/src/lib/text-control-paste.ts
+++ b/src/renderer/src/lib/text-control-paste.ts
@@ -1,4 +1,5 @@
 import { yieldToEventLoop } from '../../../shared/event-loop-yield'
+import { getUtf8ChunkEndIndex } from '../../../shared/utf8-byte-limits'
 import {
   createTextControlCancelledResult,
   createTextControlPastedResult,
@@ -34,19 +35,6 @@ export type {
   TextControlPasteSource
 } from './text-control-paste-model'
 
-function getCodePointUtf8ByteLength(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
-
 export function measureTextControlPasteByteLength(
   text: string,
   options: { stopAfterBytes?: number } = {}
@@ -55,10 +43,6 @@ export function measureTextControlPasteByteLength(
   return { byteLength, exceededLimit }
 }
 
-export function getTextControlPasteByteLength(text: string): number {
-  return measureTextControlPasteByteLength(text).byteLength
-}
-
 export async function measureTextControlPasteByteLengthWithYield(
   text: string,
   options: {
@@ -129,26 +113,6 @@ export function shouldHandleTextControlPaste(
   return measurement.exceededLimit || measurement.byteLength > directMaxBytes
 }
 
-function getNextChunkBoundary(text: string, startIndex: number, maxBytes: number): number {
-  let byteLength = 0
-  let index = startIndex
-
-  while (index < text.length) {
-    const codePoint = text.codePointAt(index) ?? 0
-    const codeUnitLength = codePoint > 0xffff ? 2 : 1
-    const nextByteLength = getCodePointUtf8ByteLength(codePoint)
-
-    if (byteLength > 0 && byteLength + nextByteLength > maxBytes) {
-      break
-    }
-
-    byteLength += nextByteLength
-    index += codeUnitLength
-  }
-
-  return index
-}
-
 function dispatchTextControlInputEvent(
   target: HTMLInputElement | HTMLTextAreaElement,
   data: string | null,
@@ -283,7 +247,7 @@ export async function pasteTextIntoTextControl(
         })
       }
 
-      const nextIndex = getNextChunkBoundary(text, textIndex, chunkMaxBytes)
+      const nextIndex = getUtf8ChunkEndIndex(text, textIndex, chunkMaxBytes)
       const chunk = text.slice(textIndex, nextIndex)
       const caret = target.selectionStart ?? target.value.length
       target.setRangeText(chunk, caret, caret, 'end')
diff --git a/src/renderer/src/lib/ui-zoom.ts b/src/renderer/src/lib/ui-zoom.ts
index 7ab1a00e19f..eb1749f222c 100644
--- a/src/renderer/src/lib/ui-zoom.ts
+++ b/src/renderer/src/lib/ui-zoom.ts
@@ -6,7 +6,7 @@ const isMac = navigator.userAgent.includes('Mac')
  * and repositions the native macOS traffic lights to stay aligned.
  */
 export function applyUIZoom(level: number): void {
-  const zoomFactor = Math.pow(1.2, level)
+  const zoomFactor = 1.2 ** level
   window.api.ui.setZoomLevel(level)
   document.documentElement.style.setProperty('--ui-zoom-factor', String(zoomFactor))
   if (isMac) {
@@ -20,7 +20,7 @@ export function applyUIZoom(level: number): void {
  */
 export function syncZoomCSSVar(): void {
   const level = window.api.ui.getZoomLevel()
-  const zoomFactor = Math.pow(1.2, level)
+  const zoomFactor = 1.2 ** level
   document.documentElement.style.setProperty('--ui-zoom-factor', String(zoomFactor))
   if (isMac) {
     window.api.ui.syncTrafficLights(zoomFactor)
diff --git a/src/renderer/src/lib/use-tab-agent-opencode-native-title.test.ts b/src/renderer/src/lib/use-tab-agent-opencode-native-title.test.ts
index 0b30b90bbc1..abf724a67c1 100644
--- a/src/renderer/src/lib/use-tab-agent-opencode-native-title.test.ts
+++ b/src/renderer/src/lib/use-tab-agent-opencode-native-title.test.ts
@@ -23,7 +23,8 @@ const identityScenarios: [
 ][] = [
   ['live local', { isRemote: false }],
   ['inactive local split', { isRemote: false, siblingHookAgent: 'claude' }],
-  ['inactive SSH/tmux', { isRemote: true, title: 'tmux | OC | Greeting' }]
+  ['inactive SSH/tmux', { isRemote: true, title: 'tmux | OC | Greeting' }],
+  ['multi-token SSH wrapper', { isRemote: true, title: 'ssh build-host | OC | Greeting' }]
 ]
 
 function HookProbe({ tab }: { tab: TerminalTab }): null {
@@ -255,7 +256,6 @@ describe('OpenCode native title tab identity', () => {
     for (const title of [
       'OpenCode ready',
       'oc | Greeting',
-      'my session | OC | Greeting',
       '⠋ Fix foo | OC | Greeting',
       '✦ Gemini CLI',
       '⠋ Codex',
diff --git a/src/renderer/src/lib/window-park-visibility.ts b/src/renderer/src/lib/window-park-visibility.ts
new file mode 100644
index 00000000000..4f519ec96d3
--- /dev/null
+++ b/src/renderer/src/lib/window-park-visibility.ts
@@ -0,0 +1,35 @@
+import { isWindowVisible } from './window-visibility-interval'
+import {
+  isDocumentVisibilityProvenStale,
+  registerStaleDocumentVisibilityRecovery
+} from '@/components/terminal-pane/stale-document-visibility'
+
+// Why the stale-latch term is load-bearing: macOS can wedge document.visibilityState at 'hidden'
+// with no further visibilitychange, so a window the user is looking at would park its work
+// forever (same bug class as the field report of 78MB of terminal bytes dropped on visible ptys).
+export function getWindowParkVisible(): boolean {
+  return isWindowVisible() || isDocumentVisibilityProvenStale()
+}
+
+export function subscribeWindowParkVisibility(onChange: () => void): () => void {
+  // Why: the stale latch flips to proven-visible without emitting a visibilitychange, and
+  // registering it first lets its own visibilitychange handler clear the latch before `onChange`
+  // reads it.
+  const unregisterStaleRecovery = registerStaleDocumentVisibilityRecovery(onChange)
+  const canListenToVisibility =
+    typeof document !== 'undefined' && typeof document.addEventListener === 'function'
+  if (canListenToVisibility) {
+    document.addEventListener('visibilitychange', onChange)
+  }
+  return () => {
+    if (canListenToVisibility) {
+      document.removeEventListener('visibilitychange', onChange)
+    }
+    unregisterStaleRecovery()
+  }
+}
+
+// Why: every park site debounces this one signal against the same user behaviour — a quick
+// app-switch round trip — so the grace period is one number. Only the cost of resuming differs,
+// and sites that pay a steep one layer their own backoff on top of this base.
+export const WINDOW_HIDE_PARK_GRACE_MS = 500
diff --git a/src/renderer/src/lib/window-visibility-interval.ts b/src/renderer/src/lib/window-visibility-interval.ts
index bdd250d5c16..aa1337fc095 100644
--- a/src/renderer/src/lib/window-visibility-interval.ts
+++ b/src/renderer/src/lib/window-visibility-interval.ts
@@ -3,7 +3,7 @@ export type WindowVisibilityIntervalTimer = ReturnType<typeof setInterval>
 export function isWindowVisible(): boolean {
   return (
     typeof document === 'undefined' ||
-    typeof document.visibilityState === 'undefined' ||
+    document.visibilityState === undefined ||
     document.visibilityState === 'visible'
   )
 }
diff --git a/src/renderer/src/lib/workspace-browser-tab-open.test.ts b/src/renderer/src/lib/workspace-browser-tab-open.test.ts
new file mode 100644
index 00000000000..d414316b52f
--- /dev/null
+++ b/src/renderer/src/lib/workspace-browser-tab-open.test.ts
@@ -0,0 +1,256 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  LOCAL_EXECUTION_HOST_ID,
+  toRuntimeExecutionHostId,
+  toSshExecutionHostId
+} from '../../../shared/execution-host'
+import {
+  canOpenWorkspaceBrowserTabOnRuntime,
+  openWorkspaceBrowserTab
+} from './workspace-browser-tab-open'
+
+const mocks = vi.hoisted(() => ({
+  createRemote: vi.fn(),
+  getState: vi.fn(),
+  state: {} as Record<string, unknown>
+}))
+
+vi.mock('@/store', () => ({
+  useAppStore: { getState: () => mocks.getState() }
+}))
+
+vi.mock('@/runtime/web-runtime-session', () => ({
+  createWebRuntimeSessionBrowserTab: (...args: unknown[]) => mocks.createRemote(...args)
+}))
+
+const WORKSPACE_ID = 'repo-1::/repo/worktree'
+
+function ownerState(hostId?: string, runtimeOwnerEnvironmentId?: string): Record<string, unknown> {
+  return {
+    worktreesByRepo: {
+      'repo-1': [
+        {
+          id: WORKSPACE_ID,
+          repoId: 'repo-1',
+          ...(hostId ? { hostId } : {}),
+          ...(runtimeOwnerEnvironmentId ? { runtimeOwnerEnvironmentId } : {})
+        }
+      ]
+    }
+  }
+}
+
+function browserCapableRuntime(environmentId: string): Record<string, unknown> {
+  return {
+    runtimeStatusByEnvironmentId: new Map([
+      [environmentId, { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }]
+    ])
+  }
+}
+
+beforeEach(() => {
+  mocks.createRemote.mockReset().mockResolvedValue(true)
+  mocks.getState.mockReset().mockImplementation(() => mocks.state)
+  mocks.state = {}
+})
+
+describe('openWorkspaceBrowserTab', () => {
+  it('opens client-owned searches with a safe title and host-specific profile', async () => {
+    const createBrowserTab = vi.fn()
+    const sshHost = toSshExecutionHostId('ssh-target')
+    mocks.state = {
+      ...ownerState(sshHost),
+      createBrowserTab,
+      defaultBrowserSessionProfileId: 'focused-profile',
+      defaultBrowserSessionProfileIdByHostId: { [sshHost]: 'ssh-profile' }
+    }
+
+    await openWorkspaceBrowserTab({
+      workspaceId: WORKSPACE_ID,
+      targetGroupId: 'group-1',
+      url: 'https://www.google.com/search?q=private%20query',
+      intent: { kind: 'search', engine: 'google' }
+    })
+
+    expect(createBrowserTab).toHaveBeenCalledWith(
+      WORKSPACE_ID,
+      'https://www.google.com/search?q=private%20query',
+      {
+        activate: true,
+        browserRuntimeEnvironmentId: null,
+        focusAddressBar: false,
+        sessionProfileId: 'ssh-profile',
+        targetGroupId: 'group-1',
+        title: 'Search Google'
+      }
+    )
+    expect(mocks.createRemote).not.toHaveBeenCalled()
+  })
+
+  it('surfaces the opening workspace and titles runtime-owned URL tabs by target', async () => {
+    const createBrowserTab = vi.fn()
+    mocks.state = {
+      ...ownerState(toRuntimeExecutionHostId('hub-a')),
+      ...browserCapableRuntime('hub-a'),
+      createBrowserTab,
+      defaultBrowserSessionProfileId: 'client-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+
+    expect(canOpenWorkspaceBrowserTabOnRuntime(mocks.state as never, WORKSPACE_ID, 'hub-a')).toBe(
+      true
+    )
+
+    await openWorkspaceBrowserTab({
+      workspaceId: WORKSPACE_ID,
+      url: 'https://example.com/docs?token=secret',
+      intent: { kind: 'url' }
+    })
+
+    expect(mocks.createRemote).toHaveBeenCalledWith({
+      worktreeId: WORKSPACE_ID,
+      environmentId: 'hub-a',
+      url: 'https://example.com/docs?token=secret',
+      targetGroupId: undefined,
+      selectWorktree: true,
+      stagedTitle: 'example.com/docs',
+      stagedFocusAddressBar: false,
+      failureLogMode: 'operation-only'
+    })
+    expect(createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('fails closed instead of opening on a runtime other than the asserted owner', async () => {
+    mocks.state = {
+      ...ownerState(toRuntimeExecutionHostId('hub-b')),
+      ...browserCapableRuntime('hub-b'),
+      createBrowserTab: vi.fn(),
+      defaultBrowserSessionProfileId: 'client-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+
+    await expect(
+      openWorkspaceBrowserTab({
+        workspaceId: WORKSPACE_ID,
+        url: 'https://example.com/',
+        intent: { kind: 'url' },
+        expectedRuntimeEnvironmentId: 'hub-a'
+      })
+    ).rejects.toThrow('Unable to open URL.')
+    expect(mocks.createRemote).not.toHaveBeenCalled()
+    expect(mocks.state.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('does not fall back to a client browser for an incapable asserted runtime', async () => {
+    mocks.state = {
+      ...ownerState(toRuntimeExecutionHostId('hub-a')),
+      createBrowserTab: vi.fn(),
+      defaultBrowserSessionProfileId: 'client-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+
+    expect(canOpenWorkspaceBrowserTabOnRuntime(mocks.state as never, WORKSPACE_ID, 'hub-a')).toBe(
+      false
+    )
+    await expect(
+      openWorkspaceBrowserTab({
+        workspaceId: WORKSPACE_ID,
+        url: 'https://example.com/',
+        intent: { kind: 'url' },
+        expectedRuntimeEnvironmentId: 'hub-a'
+      })
+    ).rejects.toThrow('Unable to open URL.')
+    expect(mocks.createRemote).not.toHaveBeenCalled()
+    expect(mocks.state.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  // Two dev servers on one host must not share a tab title.
+  it('keeps the port in local-dev tab titles', async () => {
+    const createBrowserTab = vi.fn()
+    mocks.state = {
+      ...ownerState(LOCAL_EXECUTION_HOST_ID),
+      createBrowserTab,
+      defaultBrowserSessionProfileId: 'focused-profile',
+      defaultBrowserSessionProfileIdByHostId: {}
+    }
+
+    for (const url of ['http://localhost:3000/', 'http://localhost:5173/app']) {
+      await openWorkspaceBrowserTab({ workspaceId: WORKSPACE_ID, url, intent: { kind: 'url' } })
+    }
+
+    expect(createBrowserTab.mock.calls.map((call) => call[2].title)).toEqual([
+      'localhost:3000',
+      'localhost:5173/app'
+    ])
+  })
+
+  it('uses the desktop provider when the runtime cannot stream browsers', async () => {
+    const createBrowserTab = vi.fn()
+    const sshHost = toSshExecutionHostId('ssh-target')
+    mocks.state = {
+      ...ownerState(sshHost, 'hub-a'),
+      createBrowserTab,
+      defaultBrowserSessionProfileId: 'focused-profile',
+      defaultBrowserSessionProfileIdByHostId: { local: 'local-profile', [sshHost]: 'ssh-profile' }
+    }
+    mocks.createRemote.mockResolvedValue(false)
+
+    await openWorkspaceBrowserTab({
+      workspaceId: WORKSPACE_ID,
+      url: 'https://www.google.com/search?q=hooks',
+      intent: { kind: 'search', engine: 'google' }
+    })
+
+    expect(mocks.createRemote).not.toHaveBeenCalled()
+    expect(createBrowserTab).toHaveBeenCalledWith(
+      WORKSPACE_ID,
+      'https://www.google.com/search?q=hooks',
+      expect.objectContaining({ sessionProfileId: 'ssh-profile', title: 'Search Google' })
+    )
+  })
+
+  it('fails closed for invalid targets and unresolved owners, then falls back locally', async () => {
+    const secretUrl = 'https://example.com/?q=secret-value'
+    const request = {
+      workspaceId: WORKSPACE_ID,
+      url: secretUrl,
+      intent: { kind: 'search' as const, engine: 'kagi' as const }
+    }
+    mocks.state = {}
+    await expect(
+      openWorkspaceBrowserTab({
+        workspaceId: WORKSPACE_ID,
+        url: 'file:///secret',
+        intent: { kind: 'url' }
+      })
+    ).rejects.toThrow('Unable to open URL.')
+    expect(mocks.getState).not.toHaveBeenCalled()
+
+    // The friendly copy stays query-free; the diagnosable reason rides on cause.
+    await expect(openWorkspaceBrowserTab(request)).rejects.toMatchObject({
+      message: 'Unable to search with Kagi.',
+      cause: expect.objectContaining({ message: 'no active worktree route' })
+    })
+    expect(mocks.createRemote).not.toHaveBeenCalled()
+
+    for (const state of [
+      ownerState('not-a-host', 'hub-a'),
+      ownerState(toRuntimeExecutionHostId('hub-b'), 'hub-a')
+    ]) {
+      mocks.state = state
+      await expect(openWorkspaceBrowserTab(request)).rejects.toThrow('Unable to search with Kagi.')
+    }
+    expect(mocks.createRemote).not.toHaveBeenCalled()
+
+    mocks.state = {
+      ...ownerState(toRuntimeExecutionHostId('hub-a')),
+      ...browserCapableRuntime('hub-a'),
+      createBrowserTab: vi.fn(),
+      defaultBrowserSessionProfileId: 'focused-profile',
+      defaultBrowserSessionProfileIdByHostId: { local: 'local-profile' }
+    }
+    mocks.createRemote.mockResolvedValue(false)
+    await expect(openWorkspaceBrowserTab(request)).rejects.toThrow('Unable to search with Kagi.')
+    expect(mocks.state.createBrowserTab).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/lib/workspace-browser-tab-open.ts b/src/renderer/src/lib/workspace-browser-tab-open.ts
new file mode 100644
index 00000000000..0ef67b1cfce
--- /dev/null
+++ b/src/renderer/src/lib/workspace-browser-tab-open.ts
@@ -0,0 +1,215 @@
+import { translate } from '@/i18n/i18n'
+import { createWebRuntimeSessionBrowserTab } from '@/runtime/web-runtime-session'
+import { useAppStore } from '@/store'
+import type { AppState } from '@/store/types'
+import {
+  LOCAL_EXECUTION_HOST_ID,
+  parseExecutionHostId,
+  type ExecutionHostId
+} from '../../../shared/execution-host'
+import { SEARCH_ENGINE_LABELS, type SearchEngine } from '../../../shared/browser-url'
+import {
+  getClientCreationActionPolicy,
+  type ClientCreationActionAvailability
+} from './client-creation-action-policy'
+import { resolveWorktreeOperationRoute } from './worktree-operation-route'
+
+export type WorkspaceBrowserTabIntent = { kind: 'url' } | { kind: 'search'; engine: SearchEngine }
+
+export type OpenWorkspaceBrowserTabRequest = {
+  workspaceId: string
+  targetGroupId?: string
+  url: string
+  intent: WorkspaceBrowserTabIntent
+  expectedRuntimeEnvironmentId?: string
+}
+
+function isExpectedRuntimeBrowserRoute(
+  availability: ClientCreationActionAvailability,
+  route: ReturnType<typeof resolveWorktreeOperationRoute>,
+  expectedRuntimeEnvironmentId: string
+): boolean {
+  if (availability.state !== 'enabled' || availability.provider !== 'paired-runtime' || !route) {
+    return false
+  }
+  const environmentId = route.runtimeEnvironmentId?.trim() || null
+  if (environmentId !== expectedRuntimeEnvironmentId.trim()) {
+    return false
+  }
+  const host = parseExecutionHostId(route.executionHostId)
+  return (
+    !route.executionHostId ||
+    Boolean(host && (host.kind !== 'runtime' || host.environmentId === environmentId))
+  )
+}
+
+export function canOpenWorkspaceBrowserTabOnRuntime(
+  state: AppState,
+  workspaceId: string,
+  expectedRuntimeEnvironmentId: string
+): boolean {
+  const availability = getClientCreationActionPolicy(state, workspaceId)['managed-browser']
+  const route = resolveWorktreeOperationRoute(state, workspaceId)
+  return isExpectedRuntimeBrowserRoute(availability, route, expectedRuntimeEnvironmentId)
+}
+
+// Why: concurrent URL tabs are indistinguishable under a shared "Open URL"
+// label until the page title loads; the query string stays out so a typed URL
+// does not park credentials or tokens in persisted tab state.
+function urlTabTitle(url: string): string | null {
+  try {
+    // host, not hostname: localhost:3000 and localhost:5173 are different tabs.
+    const parsed = new URL(url)
+    return `${parsed.host}${parsed.pathname === '/' ? '' : parsed.pathname}`
+  } catch {
+    return null
+  }
+}
+
+function intentPresentation(
+  intent: WorkspaceBrowserTabIntent,
+  url: string
+): {
+  error: string
+  title: string
+} {
+  if (intent.kind === 'url') {
+    return {
+      error: translate('auto.lib.workspace.browser.tab.open.urlFailed', 'Unable to open URL.'),
+      title:
+        urlTabTitle(url) ??
+        translate('auto.components.tab.bar.TabBarCreateEntry.7cdf8ee0c8', 'Open URL')
+    }
+  }
+  const engine = SEARCH_ENGINE_LABELS[intent.engine]
+  return {
+    error: translate(
+      'auto.lib.workspace.browser.tab.open.searchFailed',
+      'Unable to search with {{value0}}.',
+      { value0: engine }
+    ),
+    title: translate(
+      'auto.components.tab.bar.TabBarCreateEntry.searchProvider',
+      'Search {{value0}}',
+      { value0: engine }
+    )
+  }
+}
+
+// Why: the UI string stays friendly and query-free, but the diagnosable reason
+// rides along as `cause` so a failed open is not indistinguishable in logs.
+function openFailure(message: string, reason: string, cause?: unknown): Error {
+  // Why: callers only surface `message`, so log the reason here or a failed open
+  // leaves no trace at all. The reason alone — never `cause` — keeps the typed
+  // URL and search query out of the console.
+  console.warn(`[workspace-browser-tab-open] ${reason}`)
+  return new Error(message, {
+    cause: new Error(reason, cause === undefined ? undefined : { cause })
+  })
+}
+
+function validateTarget(url: string): boolean {
+  try {
+    const parsed = new URL(url)
+    return (parsed.protocol === 'http:' || parsed.protocol === 'https:') && !!parsed.hostname
+  } catch {
+    return false
+  }
+}
+
+function createClientBrowserTab(
+  state: AppState,
+  request: OpenWorkspaceBrowserTabRequest,
+  hostId: ExecutionHostId,
+  presentation: { error: string; title: string }
+): void {
+  try {
+    state.createBrowserTab(request.workspaceId, request.url, {
+      activate: true,
+      browserRuntimeEnvironmentId: null,
+      focusAddressBar: false,
+      sessionProfileId:
+        state.defaultBrowserSessionProfileIdByHostId[hostId] ??
+        state.defaultBrowserSessionProfileId,
+      targetGroupId: request.targetGroupId,
+      title: presentation.title
+    })
+  } catch (error) {
+    throw openFailure(presentation.error, 'client tab creation rejected', error)
+  }
+}
+
+function assertManagedBrowserEnabled(
+  availability: ClientCreationActionAvailability,
+  presentation: { error: string }
+): asserts availability is Extract<ClientCreationActionAvailability, { state: 'enabled' }> {
+  if (availability.state !== 'enabled') {
+    throw openFailure(presentation.error, availability.reason)
+  }
+}
+
+export async function openWorkspaceBrowserTab(
+  request: OpenWorkspaceBrowserTabRequest
+): Promise<void> {
+  const presentation = intentPresentation(request.intent, request.url)
+  if (!validateTarget(request.url)) {
+    throw openFailure(presentation.error, 'target is not an http(s) URL')
+  }
+  const state = useAppStore.getState()
+  const availability = getClientCreationActionPolicy(state, request.workspaceId)['managed-browser']
+  assertManagedBrowserEnabled(availability, presentation)
+  const route = resolveWorktreeOperationRoute(state, request.workspaceId)
+  if (!route) {
+    throw openFailure(presentation.error, 'no active worktree route')
+  }
+  const environmentId = route.runtimeEnvironmentId?.trim() || null
+  const expectedEnvironmentId = request.expectedRuntimeEnvironmentId?.trim() || null
+  if (
+    expectedEnvironmentId &&
+    !isExpectedRuntimeBrowserRoute(availability, route, expectedEnvironmentId)
+  ) {
+    throw openFailure(presentation.error, 'asserted runtime cannot provide this managed browser')
+  }
+  const host = parseExecutionHostId(route.executionHostId)
+  if (!environmentId) {
+    if (!host || host.kind === 'runtime') {
+      throw openFailure(presentation.error, `unresolved client host: ${route.executionHostId}`)
+    }
+    createClientBrowserTab(state, request, host.id, presentation)
+    return
+  }
+  if (
+    route.executionHostId &&
+    (!host || (host.kind === 'runtime' && host.environmentId !== environmentId))
+  ) {
+    throw openFailure(
+      presentation.error,
+      `host ${route.executionHostId} does not own runtime ${environmentId}`
+    )
+  }
+  if (availability.provider === 'local-client') {
+    const localHostId = host && host.kind !== 'runtime' ? host.id : LOCAL_EXECUTION_HOST_ID
+    createClientBrowserTab(state, request, localHostId, presentation)
+    return
+  }
+  let created = false
+  try {
+    created = await createWebRuntimeSessionBrowserTab({
+      worktreeId: request.workspaceId,
+      environmentId,
+      url: request.url,
+      targetGroupId: request.targetGroupId,
+      // Why: the tab is opened from this workspace's tab bar, so surface that
+      // workspace — otherwise a background worktree looks like nothing happened.
+      selectWorktree: true,
+      stagedTitle: presentation.title,
+      stagedFocusAddressBar: false,
+      failureLogMode: 'operation-only'
+    })
+  } catch (error) {
+    throw openFailure(presentation.error, 'runtime browser tab creation failed', error)
+  }
+  if (!created) {
+    throw openFailure(presentation.error, 'runtime browser tab creation was unavailable')
+  }
+}
diff --git a/src/renderer/src/lib/workspace-emoji-shortcodes.ts b/src/renderer/src/lib/workspace-emoji-shortcodes.ts
index 23feeb735e0..29e06dc74c9 100644
--- a/src/renderer/src/lib/workspace-emoji-shortcodes.ts
+++ b/src/renderer/src/lib/workspace-emoji-shortcodes.ts
@@ -25,7 +25,7 @@ const MATCH_TIER = { exact: 0, prefix: 1, wordStart: 2, substring: 3 } as const
 
 function matchTier(shortcode: string, query: string): number | null {
   const index = shortcode.indexOf(query)
-  if (index < 0) {
+  if (index === -1) {
     return null
   }
   if (index === 0) {
diff --git a/src/renderer/src/lib/workspace-port-actions.ts b/src/renderer/src/lib/workspace-port-actions.ts
index 07643a186a8..a529bc2d31b 100644
--- a/src/renderer/src/lib/workspace-port-actions.ts
+++ b/src/renderer/src/lib/workspace-port-actions.ts
@@ -1,6 +1,7 @@
 import { activateAndRevealWorktree } from '@/lib/worktree-activation'
 import type { useAppStore } from '@/store'
 import {
+  assertRuntimeEnvironmentCapability,
   callRuntimeRpc,
   RuntimeRpcCallError,
   type RuntimeClientTarget
@@ -15,6 +16,8 @@ import type {
 import type { LocalhostWorktreeLabelRoute } from '../../../shared/localhost-worktree-labels'
 import { runWorkspacePortScanForTarget } from './workspace-port-scan-client'
 import { browserUrlForPort } from './workspace-port-urls'
+import { BROWSER_SCREENCAST_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import { RUNTIME_BROWSER_UNAVAILABLE_MESSAGE } from './client-creation-action-policy'
 
 export { addressForPort } from './workspace-port-urls'
 
@@ -124,13 +127,21 @@ export async function openWorkspacePortInBrowser(args: {
   activateAndRevealWorktree(worktreeId)
   if (args.runtimeTarget.kind === 'environment') {
     try {
+      await assertRuntimeEnvironmentCapability(
+        args.runtimeTarget.environmentId,
+        BROWSER_SCREENCAST_RUNTIME_CAPABILITY,
+        RUNTIME_BROWSER_UNAVAILABLE_MESSAGE
+      )
       const remotePage = await callRuntimeRpc<{ browserPageId: string }>(
         args.runtimeTarget,
         'browser.tabCreate',
         { worktree: toRuntimeWorktreeSelector(worktreeId), url },
         { timeoutMs: 30_000 }
       )
-      const tab = args.createBrowserTab(worktreeId, url, { activate: true })
+      const tab = args.createBrowserTab(worktreeId, url, {
+        activate: true,
+        browserRuntimeEnvironmentId: args.runtimeTarget.environmentId
+      })
       if (!tab.activePageId) {
         return { ok: false, reason: 'Failed to create a browser page.' }
       }
@@ -144,8 +155,13 @@ export async function openWorkspacePortInBrowser(args: {
       return { ok: false, reason: message || 'Failed to open remote browser.' }
     }
   }
-  args.createBrowserTab(worktreeId, url, { activate: true })
-  return { ok: true }
+  try {
+    args.createBrowserTab(worktreeId, url, { activate: true })
+    return { ok: true }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    return { ok: false, reason: message || 'Failed to open browser.' }
+  }
 }
 
 export async function refreshWorkspacePortScanAfterStop(args: {
diff --git a/src/renderer/src/lib/workspace-port-localhost-label-selector.ts b/src/renderer/src/lib/workspace-port-localhost-label-selector.ts
index ea21dcfed7f..8e996cf6690 100644
--- a/src/renderer/src/lib/workspace-port-localhost-label-selector.ts
+++ b/src/renderer/src/lib/workspace-port-localhost-label-selector.ts
@@ -9,8 +9,8 @@ import { localhostWorktreeLabelRouteForPort } from './workspace-port-localhost-l
 // this is the single source for both reactive and imperative call sites.
 type LocalhostLabelLookupState = {
   settings?: Pick<GlobalSettings, 'localhostWorktreeLabelsEnabled'> | null
-  repos?: Repo[]
-  projects?: Project[]
+  repos?: readonly Repo[]
+  projects?: readonly Project[]
   getKnownWorktreeById?: (worktreeId: string) => { projectId?: string | null } | null | undefined
 }
 
diff --git a/src/renderer/src/lib/worktree-runtime-owner-index.ts b/src/renderer/src/lib/worktree-runtime-owner-index.ts
index 8fc642cfddb..6a66d7e33f4 100644
--- a/src/renderer/src/lib/worktree-runtime-owner-index.ts
+++ b/src/renderer/src/lib/worktree-runtime-owner-index.ts
@@ -12,7 +12,7 @@ type DetectedWorktreeListing = { worktrees: readonly WorktreeOwnerRecord[] }
 type RepoOwnerRecord = Pick<Repo, 'id' | 'connectionId' | 'executionHostId'>
 type FolderWorkspaceOwnerRecord = Pick<
   FolderWorkspace,
-  'id' | 'projectGroupId' | 'connectionId' | 'executionHostId'
+  'id' | 'projectGroupId' | 'connectionId' | 'executionHostId' | 'diffComments'
 >
 type ProjectGroupOwnerRecord = Pick<ProjectGroup, 'id' | 'connectionId' | 'executionHostId'>
 
diff --git a/src/renderer/src/lib/worktree-status.ts b/src/renderer/src/lib/worktree-status.ts
index e12d197dda9..6f39d8c1e0b 100644
--- a/src/renderer/src/lib/worktree-status.ts
+++ b/src/renderer/src/lib/worktree-status.ts
@@ -2,7 +2,7 @@ import { resolveAgentTypeFromTerminalTitle } from '@/components/sidebar/worktree
 import { classifyTitleActivity } from '@/lib/pane-agent-evidence'
 import { tabHasLivePty } from '@/lib/tab-has-live-pty'
 import { resolveRuntimePaneTitleLeafIdFromRoot } from '@/lib/runtime-pane-title-leaf-id'
-import { containsBrailleSpinner } from '../../../shared/agent-title-core'
+import { containsAgentSpinnerGlyph } from '../../../shared/agent-title-core'
 import type {
   TerminalLayoutSnapshot,
   TerminalPaneLayoutNode,
@@ -106,7 +106,7 @@ function titleStatusIsAgentAttributable(title: string, launchAgent?: TuiAgent |
   // Why: a spinner proves activity but not identity (Claude's thinking title has no provider
   // token, #9040); the tab's launch identity supplies it, mirroring the row builder's spinner
   // fallback (#9647) so the dot and the sidebar row agree.
-  return containsBrailleSpinner(title) && Boolean(launchAgent)
+  return containsAgentSpinnerGlyph(title) && Boolean(launchAgent)
 }
 
 export function getWorktreeStatusLabel(status: WorktreeStatus): string {
diff --git a/src/renderer/src/runtime/github-check-details-timeout.test.ts b/src/renderer/src/runtime/github-check-details-timeout.test.ts
new file mode 100644
index 00000000000..a06c27d7012
--- /dev/null
+++ b/src/renderer/src/runtime/github-check-details-timeout.test.ts
@@ -0,0 +1,85 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  GITHUB_CHECK_DETAILS_TIMEOUT_MS,
+  withGitHubCheckDetailsTimeout
+} from './github-check-details-timeout'
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (key: string, fallback: string) =>
+    key === 'auto.runtime.githubCheckDetailsTimeout.timedOut' ? 'Localized timeout.' : fallback
+}))
+
+describe('withGitHubCheckDetailsTimeout', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('passes through a result and clears its deadline', async () => {
+    await expect(withGitHubCheckDetailsTimeout(() => Promise.resolve('details'))).resolves.toBe(
+      'details'
+    )
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('rejects a stalled renderer operation after the check-details budget', async () => {
+    let operationSignal: AbortSignal | undefined
+    const stalled = withGitHubCheckDetailsTimeout((signal) => {
+      operationSignal = signal
+      return new Promise(() => {})
+    })
+    const assertion = expect(stalled).rejects.toThrow('Localized timeout.')
+
+    await vi.advanceTimersByTimeAsync(GITHUB_CHECK_DETAILS_TIMEOUT_MS)
+
+    await assertion
+    expect(operationSignal?.aborted).toBe(true)
+  })
+
+  it('arms the renderer deadline before starting the operation', async () => {
+    let timerCountWhenStarted = 0
+
+    const result = withGitHubCheckDetailsTimeout(async () => {
+      timerCountWhenStarted = vi.getTimerCount()
+      return 'details'
+    })
+
+    await expect(result).resolves.toBe('details')
+    expect(timerCountWhenStarted).toBe(1)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('keeps the timeout error when abort-aware work rejects synchronously', async () => {
+    const stalled = withGitHubCheckDetailsTimeout(
+      (signal) =>
+        new Promise((_resolve, reject) => {
+          signal.addEventListener('abort', () => reject(new Error('operation aborted')), {
+            once: true
+          })
+        })
+    )
+    const assertion = expect(stalled).rejects.toThrow('Localized timeout.')
+
+    await vi.advanceTimersByTimeAsync(GITHUB_CHECK_DETAILS_TIMEOUT_MS)
+
+    await assertion
+  })
+
+  it.each([
+    'Timed out loading check details.',
+    "Error invoking remote method 'gh:prCheckDetails': Error: Timed out loading check details."
+  ])('normalizes host timeout errors: %s', async (message) => {
+    await expect(
+      withGitHubCheckDetailsTimeout(() => Promise.reject(new Error(message)))
+    ).rejects.toMatchObject({ message: 'Localized timeout.' })
+  })
+
+  it('preserves unrelated operation failures', async () => {
+    await expect(
+      withGitHubCheckDetailsTimeout(() => Promise.reject(new Error('authentication failed')))
+    ).rejects.toThrow('authentication failed')
+  })
+})
diff --git a/src/renderer/src/runtime/github-check-details-timeout.ts b/src/renderer/src/runtime/github-check-details-timeout.ts
new file mode 100644
index 00000000000..1ccaca60d6f
--- /dev/null
+++ b/src/renderer/src/runtime/github-check-details-timeout.ts
@@ -0,0 +1,40 @@
+import { translate } from '@/i18n/i18n'
+import {
+  GITHUB_CHECK_DETAILS_TIMEOUT_MESSAGE,
+  isGitHubCheckDetailsTimeout
+} from '../../../shared/github-check-details-deadline'
+
+export const GITHUB_CHECK_DETAILS_TIMEOUT_MS = 30_000
+
+function translatedTimeoutError(): Error {
+  return new Error(
+    translate(
+      'auto.runtime.githubCheckDetailsTimeout.timedOut',
+      GITHUB_CHECK_DETAILS_TIMEOUT_MESSAGE
+    )
+  )
+}
+
+/** Bound the renderer operation and cancel transports that support AbortSignal. */
+export async function withGitHubCheckDetailsTimeout<T>(
+  operation: (signal: AbortSignal) => Promise<T>
+): Promise<T> {
+  const controller = new AbortController()
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const timeout = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => {
+      reject(translatedTimeoutError())
+      controller.abort()
+    }, GITHUB_CHECK_DETAILS_TIMEOUT_MS)
+  })
+  try {
+    return await Promise.race([operation(controller.signal), timeout])
+  } catch (error) {
+    if (isGitHubCheckDetailsTimeout(error)) {
+      throw translatedTimeoutError()
+    }
+    throw error
+  } finally {
+    clearTimeout(timer)
+  }
+}
diff --git a/src/renderer/src/runtime/remote-runtime-terminal-multiplexer.ts b/src/renderer/src/runtime/remote-runtime-terminal-multiplexer.ts
index e153c1c75cb..183838fdc2f 100644
--- a/src/renderer/src/runtime/remote-runtime-terminal-multiplexer.ts
+++ b/src/renderer/src/runtime/remote-runtime-terminal-multiplexer.ts
@@ -14,6 +14,7 @@ import {
   parseTerminalSnapshotUnavailableReason,
   type TerminalSnapshotUnavailableReason
 } from '../../../shared/terminal-snapshot-unavailability'
+import { parseTerminalKittyKeyboardFlags } from '../../../shared/terminal-kitty-keyboard-flags'
 import { e2eConfig, e2eDisableRemoteTerminalStallRecovery } from '@/lib/e2e-config'
 import { recordRendererCrashBreadcrumb } from '@/lib/crash-breadcrumb-recorder'
 import { deliverTerminalDataWithDeferredCredit } from '@/lib/pane-manager/terminal-delivery-credit'
@@ -60,7 +61,14 @@ type TerminalMultiplexEvent =
 
 export type RemoteRuntimeMultiplexedTerminalCallbacks = {
   onData: (data: string, meta?: { seq?: number; rawLength?: number; transformed?: boolean }) => void
-  onSnapshot: (data: string, meta?: { pendingEscapeTailAnsi?: string }) => void
+  onSnapshot: (
+    data: string,
+    meta?: {
+      pendingEscapeTailAnsi?: string
+      seq?: number
+      kittyKeyboardFlags?: number
+    }
+  ) => void
   onSubscribed?: () => void
   onOutputPauseCapability?: () => void
   onEnd?: () => void
@@ -84,6 +92,10 @@ export type RemoteRuntimeSnapshotImage = {
   seq?: number
   source?: 'headless' | 'renderer'
   pendingEscapeTailAnsi?: string
+  /** Effective kitty flags the HOST proved at this image's own `seq`. Absent
+   *  from any host that predates the field — the pane tracker then stays
+   *  unproven and commits raw text instead of guessing zero. */
+  kittyKeyboardFlags?: number
 }
 
 /** Transient causes the host itself reported: a request reached it and it declined to serialize now. */
@@ -197,6 +209,7 @@ type RemoteRuntimeSnapshotInfo = {
   rows?: number
   seq?: number
   source?: 'headless' | 'renderer'
+  kittyKeyboardFlags?: number
   requestId?: number
   truncated?: boolean
   unavailable?: TerminalSnapshotUnavailableReason
@@ -879,13 +892,16 @@ class RemoteRuntimeTerminalMultiplexer {
               rows: info?.rows ?? 24,
               seq: info?.seq,
               source: info?.source,
+              kittyKeyboardFlags: info?.kittyKeyboardFlags,
               pendingEscapeTailAnsi: info?.pendingEscapeTailAnsi
             }
           })
           clearPendingSnapshotRequest(stream)
         } else if (target === 'initial') {
           stream.callbacks.onSnapshot(data ?? '', {
-            pendingEscapeTailAnsi: info?.pendingEscapeTailAnsi
+            pendingEscapeTailAnsi: info?.pendingEscapeTailAnsi,
+            seq: info?.seq,
+            kittyKeyboardFlags: info?.kittyKeyboardFlags
           })
         } else if (target === 'recovery') {
           // Why: a server-pushed recovery snapshot replaces terminal state
@@ -893,7 +909,9 @@ class RemoteRuntimeTerminalMultiplexer {
           // An empty snapshot is still applied so stale dropped output does
           // not linger on a terminal the model says is blank.
           stream.callbacks.onSnapshot(`\x1b[2J\x1b[3J\x1b[H${data ?? ''}`, {
-            pendingEscapeTailAnsi: info?.pendingEscapeTailAnsi
+            pendingEscapeTailAnsi: info?.pendingEscapeTailAnsi,
+            seq: info?.seq,
+            kittyKeyboardFlags: info?.kittyKeyboardFlags
           })
         }
       } else if (matchesPendingRequest) {
@@ -1529,6 +1547,7 @@ function decodeSnapshotInfo(
     truncated?: unknown
     unavailable?: unknown
     pendingEscapeTailAnsi?: unknown
+    kittyKeyboardFlags?: unknown
   }>(payload)
   if (!raw) {
     return null
@@ -1538,6 +1557,8 @@ function decodeSnapshotInfo(
     rows: typeof raw.rows === 'number' ? raw.rows : undefined,
     seq: typeof raw.seq === 'number' ? raw.seq : undefined,
     source: raw.source === 'headless' || raw.source === 'renderer' ? raw.source : undefined,
+    // Negative, fractional, and unsafe values are treated as absent, never clamped.
+    kittyKeyboardFlags: parseTerminalKittyKeyboardFlags(raw.kittyKeyboardFlags),
     requestId: typeof raw.requestId === 'number' ? raw.requestId : undefined,
     truncated: raw.truncated === true,
     unavailable: parseTerminalSnapshotUnavailableReason(raw.unavailable),
diff --git a/src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts b/src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts
new file mode 100644
index 00000000000..08213580ea8
--- /dev/null
+++ b/src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts
@@ -0,0 +1,184 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  TerminalStreamOpcode,
+  decodeTerminalStreamFrame,
+  decodeTerminalStreamJson,
+  encodeTerminalStreamFrame,
+  encodeTerminalStreamJson,
+  encodeTerminalStreamText
+} from '../../../shared/terminal-stream-protocol'
+import {
+  getRemoteRuntimeTerminalMultiplexer,
+  resetRemoteRuntimeTerminalMultiplexersForTests,
+  type RemoteRuntimeMultiplexedTerminal
+} from './remote-runtime-terminal-multiplexer'
+import { replaceRuntimeEnvironmentRevisions } from './runtime-environment-revision'
+
+// `kittyKeyboardFlags` is an additive optional field on the existing
+// SnapshotStart frame (Rule 1 of docs/reference/remote-wire-compatibility.md).
+// An old host omits it, and absence must stay unknown rather than be laundered
+// into "the host proved kitty is inactive".
+
+type SubscribeCallbacks = {
+  onResponse: (response: unknown) => void
+  onBinary?: (bytes: Uint8Array<ArrayBufferLike>) => void
+}
+
+type SnapshotStartMeta = { requestId?: number; kittyKeyboardFlags?: unknown }
+
+class KittyFlagsServer {
+  private streamId = 0
+  /** Meta the host attaches to its next SnapshotStart, initial and requested alike. */
+  nextMeta: SnapshotStartMeta = {}
+
+  constructor(private readonly toClient: (bytes: Uint8Array<ArrayBufferLike>) => void) {}
+
+  receive(bytes: Uint8Array<ArrayBufferLike>): void {
+    const frame = decodeTerminalStreamFrame(bytes)
+    if (!frame) {
+      return
+    }
+    if (frame.opcode === TerminalStreamOpcode.Subscribe) {
+      this.streamId = decodeTerminalStreamJson<{ streamId: number }>(frame.payload)?.streamId ?? 0
+      this.sendSnapshot('INITIAL', {})
+      return
+    }
+    if (frame.opcode !== TerminalStreamOpcode.SnapshotRequest) {
+      return
+    }
+    const requestId = decodeTerminalStreamJson<{ requestId?: number }>(frame.payload)?.requestId
+    this.sendSnapshot('REQUESTED', { ...this.nextMeta, requestId })
+  }
+
+  /** A host-pushed recovery snapshot, which arrives with no requestId. */
+  pushRecovery(meta: SnapshotStartMeta): void {
+    this.sendSnapshot('RECOVERED', meta)
+  }
+
+  private sendSnapshot(data: string, meta: SnapshotStartMeta): void {
+    this.send(
+      TerminalStreamOpcode.SnapshotStart,
+      encodeTerminalStreamJson({
+        cols: 80,
+        rows: 24,
+        seq: 7,
+        ...meta
+      })
+    )
+    this.send(TerminalStreamOpcode.SnapshotChunk, encodeTerminalStreamText(data))
+    this.send(TerminalStreamOpcode.SnapshotEnd, new Uint8Array())
+  }
+
+  private send(opcode: TerminalStreamOpcode, payload: Uint8Array): void {
+    this.toClient(
+      encodeTerminalStreamFrame({
+        opcode,
+        streamId: this.streamId,
+        seq: 0,
+        payload
+      })
+    )
+  }
+}
+
+describe('SnapshotStart kitty keyboard flags', () => {
+  let server: KittyFlagsServer
+  const snapshots: {
+    data: string
+    meta?: { seq?: number; kittyKeyboardFlags?: number }
+  }[] = []
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    snapshots.length = 0
+    resetRemoteRuntimeTerminalMultiplexersForTests()
+    replaceRuntimeEnvironmentRevisions([])
+    vi.stubGlobal('window', {
+      api: {
+        runtimeEnvironments: {
+          subscribe: vi.fn(async (_args: unknown, callbacks: SubscribeCallbacks) => {
+            server = new KittyFlagsServer((bytes) => callbacks.onBinary?.(bytes))
+            queueMicrotask(() => callbacks.onResponse({ ok: true, result: { type: 'ready' } }))
+            return {
+              unsubscribe: vi.fn(),
+              sendBinary: (bytes: Uint8Array<ArrayBufferLike>) => server.receive(bytes)
+            }
+          })
+        }
+      }
+    })
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  async function subscribeClient(): Promise<RemoteRuntimeMultiplexedTerminal> {
+    const stream = await getRemoteRuntimeTerminalMultiplexer('env-1').subscribeTerminal({
+      terminal: 'terminal-1',
+      client: { id: 'desktop-1', type: 'desktop' },
+      callbacks: {
+        onData: () => {},
+        onSnapshot: (data, meta) => {
+          snapshots.push({ data, meta })
+        }
+      }
+    })
+    await Promise.resolve()
+    await Promise.resolve()
+    return stream
+  }
+
+  it.each([
+    ['a proven inactive protocol', 0],
+    ['proven bit-3 flags', 8]
+  ])('decodes %s into the requested snapshot result', async (_name, flags) => {
+    const stream = await subscribeClient()
+    server.nextMeta = { kittyKeyboardFlags: flags }
+
+    const outcome = await stream.serializeBufferOutcome({
+      scrollbackRows: 100
+    })
+    expect(outcome.snapshot).toMatchObject({
+      seq: 7,
+      kittyKeyboardFlags: flags
+    })
+  })
+
+  it('carries the flags and their sequence onto a host-pushed recovery snapshot', async () => {
+    await subscribeClient()
+    expect(snapshots).toHaveLength(1)
+
+    server.pushRecovery({ kittyKeyboardFlags: 8 })
+    expect(snapshots[1]?.meta).toMatchObject({ seq: 7, kittyKeyboardFlags: 8 })
+  })
+
+  it.each([
+    ['negative', -1],
+    ['fractional', 1.5],
+    ['beyond safe integers', Number.MAX_SAFE_INTEGER + 2],
+    ['a string', '8'],
+    ['null', null]
+  ])('treats %s as absent rather than clamping it', async (_name, value) => {
+    const stream = await subscribeClient()
+    server.nextMeta = { kittyKeyboardFlags: value }
+
+    const outcome = await stream.serializeBufferOutcome({
+      scrollbackRows: 100
+    })
+    expect(outcome.snapshot?.kittyKeyboardFlags).toBeUndefined()
+  })
+
+  it('accepts an old host that omits the field without coercing it to zero', async () => {
+    const stream = await subscribeClient()
+    server.nextMeta = {}
+
+    const outcome = await stream.serializeBufferOutcome({
+      scrollbackRows: 100
+    })
+    expect(outcome.availability).toEqual({ kind: 'snapshot' })
+    expect(outcome.snapshot?.data).toBe('REQUESTED')
+    expect(outcome.snapshot?.kittyKeyboardFlags).toBeUndefined()
+    expect(snapshots[0]?.meta?.kittyKeyboardFlags).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/runtime/remote-server-parity.test.ts b/src/renderer/src/runtime/remote-server-parity.test.ts
index 8e9be06da0c..41318a7248e 100644
--- a/src/renderer/src/runtime/remote-server-parity.test.ts
+++ b/src/renderer/src/runtime/remote-server-parity.test.ts
@@ -304,7 +304,13 @@ describe('parity §11: remote browser create focuses the new browser tab', () =>
   it('honors focus intent for a newly created browser session tab', () => {
     const pageId = 'browser-page-1'
     const prior = stateWithLocalTerminals([localTerminal('host-tab-1', 0, true)])
-    recordWebSessionFocusIntent({ environmentId: ENV }, WT, pageId)
+    recordWebSessionFocusIntent(
+      { environmentId: ENV },
+      WT,
+      pageId,
+      undefined,
+      toWebTerminalSurfaceTabId('host-tab-1')
+    )
     const patch = applyWebSessionTabsSnapshot(
       prior,
       makeSnapshot([{ parentTab: 'host-tab-1', leaf: LEAF_A, active: false }], {
diff --git a/src/renderer/src/runtime/runtime-environment-ssh-state.test.ts b/src/renderer/src/runtime/runtime-environment-ssh-state.test.ts
index 46567c5343c..7efb1800084 100644
--- a/src/renderer/src/runtime/runtime-environment-ssh-state.test.ts
+++ b/src/renderer/src/runtime/runtime-environment-ssh-state.test.ts
@@ -5,6 +5,7 @@ import {
   applyRuntimeEnvironmentSshStateChanged,
   connectRuntimeEnvironmentSshTarget,
   hydrateRuntimeEnvironmentSshState,
+  refreshRuntimeEnvironmentSshTargetMetadata,
   resyncRuntimeEnvironmentSshTargets
 } from './runtime-environment-ssh-state'
 import { callRuntimeRpc } from './runtime-rpc-client'
@@ -119,6 +120,212 @@ describe('hydrateRuntimeEnvironmentSshState', () => {
     expect(callRuntimeRpcMock.mock.calls.length).toBeGreaterThan(callsAfterFirst)
   })
 
+  it('does not rerun when an ordinary refresh joins a forced hydration', async () => {
+    const envId = nextEnvId()
+    useAppStore
+      .getState()
+      .setEnvironmentSshTargetsMetadata(envId, [{ id: 'ssh-1', label: 'devbox' }])
+    let resolveTargets!: (value: { targets: { id: string; label: string }[] }) => void
+    const targetsPromise = new Promise<{ targets: { id: string; label: string }[] }>((resolve) => {
+      resolveTargets = resolve
+    })
+    callRuntimeRpcMock.mockImplementation((_target, method) => {
+      if (method === 'ssh.listTargetSummaries') {
+        return targetsPromise as never
+      }
+      if (method === 'ssh.listRemovedTargetLabels') {
+        return Promise.resolve({ labels: {} } as never)
+      }
+      return Promise.resolve({ state: connState('ssh-1') } as never)
+    })
+
+    const forced = hydrateRuntimeEnvironmentSshState(envId, { force: true })
+    const ordinary = hydrateRuntimeEnvironmentSshState(envId)
+    resolveTargets({ targets: [{ id: 'ssh-1', label: 'devbox' }] })
+    await Promise.all([forced, ordinary])
+
+    expect(
+      callRuntimeRpcMock.mock.calls.filter(([, method]) => method === 'ssh.listTargetSummaries')
+    ).toHaveLength(1)
+    expect(
+      callRuntimeRpcMock.mock.calls.filter(([, method]) => method === 'ssh.listRemovedTargetLabels')
+    ).toHaveLength(1)
+    expect(
+      callRuntimeRpcMock.mock.calls.filter(([, method]) => method === 'ssh.getState')
+    ).toHaveLength(1)
+  })
+
+  it('hydrates without force after the environment bucket is marked stale', async () => {
+    const envId = nextEnvId()
+    useAppStore
+      .getState()
+      .setEnvironmentSshTargetsMetadata(envId, [{ id: 'ssh-old', label: 'old box' }])
+    useAppStore.getState().markEnvironmentSshStateStale(envId)
+    installRpcResponses({
+      targets: [{ id: 'ssh-new', label: 'new box' }],
+      states: { 'ssh-new': connState('ssh-new') }
+    })
+
+    await hydrateRuntimeEnvironmentSshState(envId)
+
+    const bucket = useAppStore.getState().sshStateByEnvironment.get(envId)
+    expect(bucket?.targetsHydrated).toBe(true)
+    expect(bucket?.targetLabels.get('ssh-new')).toBe('new box')
+    expect(bucket?.connectionStates.get('ssh-new')?.status).toBe('connected')
+  })
+
+  it('refreshes only target summaries when hydrated metadata is unchanged', async () => {
+    const envId = nextEnvId()
+    installRpcResponses({
+      targets: [{ id: 'ssh-1', label: 'devbox' }],
+      states: { 'ssh-1': connState('ssh-1') }
+    })
+    await hydrateRuntimeEnvironmentSshState(envId)
+    callRuntimeRpcMock.mockClear()
+
+    await refreshRuntimeEnvironmentSshTargetMetadata(envId)
+
+    expect(callRuntimeRpcMock.mock.calls.map(([, method]) => method)).toEqual([
+      'ssh.listTargetSummaries'
+    ])
+  })
+
+  it('reads state for a labelled target the bucket never recorded a state for', async () => {
+    const envId = nextEnvId()
+    // A failed-connect resync can label a target without ever reading its state.
+    useAppStore
+      .getState()
+      .setEnvironmentSshTargetsMetadata(envId, [{ id: 'ssh-new', label: 'new box' }])
+    installRpcResponses({
+      targets: [{ id: 'ssh-new', label: 'new box' }],
+      states: { 'ssh-new': connState('ssh-new') }
+    })
+
+    await refreshRuntimeEnvironmentSshTargetMetadata(envId)
+
+    const bucket = useAppStore.getState().sshStateByEnvironment.get(envId)
+    expect(bucket?.connectionStates.get('ssh-new')?.status).toBe('connected')
+  })
+
+  it('prunes removed targets and fetches state only for newly discovered targets', async () => {
+    const envId = nextEnvId()
+    useAppStore.getState().setEnvironmentSshTargetsMetadata(envId, [
+      { id: 'ssh-keep', label: 'keep' },
+      { id: 'ssh-old', label: 'old' }
+    ])
+    useAppStore
+      .getState()
+      .setEnvironmentSshConnectionState(envId, 'ssh-keep', connState('ssh-keep'))
+    useAppStore.getState().setEnvironmentSshConnectionState(envId, 'ssh-old', connState('ssh-old'))
+    installRpcResponses({
+      targets: [
+        { id: 'ssh-keep', label: 'keep' },
+        { id: 'ssh-new', label: 'new' }
+      ],
+      labels: { 'ssh-old': 'old' },
+      states: { 'ssh-new': connState('ssh-new', 'connecting') }
+    })
+
+    await refreshRuntimeEnvironmentSshTargetMetadata(envId)
+
+    const bucket = useAppStore.getState().sshStateByEnvironment.get(envId)
+    expect(bucket?.targetLabels.has('ssh-old')).toBe(false)
+    expect(bucket?.connectionStates.has('ssh-old')).toBe(false)
+    expect(bucket?.removedTargetLabels.get('ssh-old')).toBe('old')
+    expect(bucket?.connectionStates.get('ssh-keep')?.status).toBe('connected')
+    expect(bucket?.connectionStates.get('ssh-new')?.status).toBe('connecting')
+    expect(callRuntimeRpcMock.mock.calls.filter(([, method]) => method === 'ssh.getState')).toEqual(
+      [
+        [
+          { kind: 'environment', environmentId: envId },
+          'ssh.getState',
+          { targetId: 'ssh-new' },
+          expect.anything()
+        ]
+      ]
+    )
+  })
+
+  it('reruns hydration when a new generation joins an older in-flight request', async () => {
+    const envId = nextEnvId()
+    let resolveOlderTargets!: (value: { targets: { id: string; label: string }[] }) => void
+    const olderTargets = new Promise<{ targets: { id: string; label: string }[] }>((resolve) => {
+      resolveOlderTargets = resolve
+    })
+    let targetListCallCount = 0
+    callRuntimeRpcMock.mockImplementation((_target, method, params) => {
+      if (method === 'ssh.listTargetSummaries') {
+        targetListCallCount += 1
+        return (
+          targetListCallCount === 1
+            ? olderTargets
+            : Promise.resolve({ targets: [{ id: 'ssh-new', label: 'new' }] })
+        ) as never
+      }
+      if (method === 'ssh.listRemovedTargetLabels') {
+        return Promise.resolve({ labels: {} } as never)
+      }
+      const targetId = (params as { targetId: string }).targetId
+      return Promise.resolve({ state: connState(targetId) } as never)
+    })
+
+    const olderHydration = hydrateRuntimeEnvironmentSshState(envId)
+    useAppStore.getState().markEnvironmentSshStateStale(envId)
+    const newerHydration = hydrateRuntimeEnvironmentSshState(envId)
+    resolveOlderTargets({ targets: [{ id: 'ssh-old', label: 'old' }] })
+    await Promise.all([olderHydration, newerHydration])
+
+    const bucket = useAppStore.getState().sshStateByEnvironment.get(envId)
+    expect(targetListCallCount).toBe(2)
+    expect(bucket?.targetsHydrated).toBe(true)
+    expect(bucket?.targetLabels.has('ssh-old')).toBe(false)
+    expect(bucket?.targetLabels.get('ssh-new')).toBe('new')
+    expect(bucket?.connectionStates.get('ssh-new')?.status).toBe('connected')
+  })
+
+  it('keeps a failed full refresh full when a metadata refresh queued behind it', async () => {
+    const envId = nextEnvId()
+    useAppStore
+      .getState()
+      .setEnvironmentSshTargetsMetadata(envId, [{ id: 'ssh-1', label: 'devbox' }])
+    useAppStore.getState().markEnvironmentSshStateStale(envId)
+    let rejectFirstTargets!: (error: Error) => void
+    const firstTargets = new Promise<never>((_resolve, reject) => {
+      rejectFirstTargets = reject
+    })
+    let targetListCallCount = 0
+    callRuntimeRpcMock.mockImplementation((_target, method) => {
+      if (method === 'ssh.listTargetSummaries') {
+        targetListCallCount += 1
+        return (
+          targetListCallCount === 1
+            ? firstTargets
+            : Promise.resolve({ targets: [{ id: 'ssh-1', label: 'devbox' }] })
+        ) as never
+      }
+      if (method === 'ssh.listRemovedTargetLabels') {
+        return Promise.resolve({ labels: {} } as never)
+      }
+      return Promise.resolve({ state: connState('ssh-1') } as never)
+    })
+
+    const forced = hydrateRuntimeEnvironmentSshState(envId, { force: true })
+    const metadata = refreshRuntimeEnvironmentSshTargetMetadata(envId)
+    rejectFirstTargets(new Error('transient target-list failure'))
+    await Promise.all([forced, metadata])
+
+    const bucket = useAppStore.getState().sshStateByEnvironment.get(envId)
+    expect(targetListCallCount).toBe(2)
+    expect(bucket?.targetsHydrated).toBe(true)
+    expect(bucket?.connectionStates.get('ssh-1')?.status).toBe('connected')
+    expect(callRuntimeRpcMock.mock.calls.map(([, method]) => method)).toEqual([
+      'ssh.listTargetSummaries',
+      'ssh.listTargetSummaries',
+      'ssh.listRemovedTargetLabels',
+      'ssh.getState'
+    ])
+  })
+
   it('leaves the bucket un-hydrated when the host lacks the ssh RPC methods', async () => {
     const envId = nextEnvId()
     installRpcResponses({ failListTargets: true })
@@ -368,4 +575,22 @@ describe('resyncRuntimeEnvironmentSshTargets', () => {
     expect(bucket?.targetLabels.get('ssh-live')).toBe('devbox')
     expect(bucket?.targetsHydrated).toBe(true)
   })
+
+  it('reads the connection state of a host re-added under a new target id', async () => {
+    const envId = nextEnvId()
+    useAppStore
+      .getState()
+      .setEnvironmentSshTargetsMetadata(envId, [{ id: 'ssh-old', label: 'devbox' }])
+    installRpcResponses({
+      targets: [{ id: 'ssh-new', label: 'devbox' }],
+      labels: { 'ssh-old': 'devbox' },
+      states: { 'ssh-new': connState('ssh-new') }
+    })
+
+    await resyncRuntimeEnvironmentSshTargets(envId)
+
+    const bucket = useAppStore.getState().sshStateByEnvironment.get(envId)
+    expect(bucket?.targetLabels.get('ssh-new')).toBe('devbox')
+    expect(bucket?.connectionStates.get('ssh-new')?.status).toBe('connected')
+  })
 })
diff --git a/src/renderer/src/runtime/runtime-environment-ssh-state.ts b/src/renderer/src/runtime/runtime-environment-ssh-state.ts
index 07051882292..333720a61a0 100644
--- a/src/renderer/src/runtime/runtime-environment-ssh-state.ts
+++ b/src/renderer/src/runtime/runtime-environment-ssh-state.ts
@@ -3,6 +3,7 @@ import type { SshConnectionState, SshTargetSummary } from '../../../shared/ssh-t
 import { callRuntimeRpc } from './runtime-rpc-client'
 import { getEnvironmentSshStateGeneration } from '@/store/slices/runtime-environment-ssh'
 import { admitSshConnectionState } from '../../../shared/ssh-retained-payload-admission'
+import { sshTargetLabelsEqual } from '@/store/slices/ssh-target-cleanup'
 
 /**
  * Mirrors a remote Orca server's own SSH targets into that environment's
@@ -44,7 +45,18 @@ async function syncEnvironmentSshTargetMetadata(
   generation: number
 ): Promise<SshTargetSummary[]> {
   const targets = await fetchEnvironmentSshTargets(environmentId)
+  if (generation !== getEnvironmentSshStateGeneration(environmentId)) {
+    return []
+  }
   useAppStore.getState().setEnvironmentSshTargetsMetadata(environmentId, targets, generation)
+  await syncEnvironmentRemovedSshTargetLabels(environmentId, generation)
+  return generation === getEnvironmentSshStateGeneration(environmentId) ? targets : []
+}
+
+async function syncEnvironmentRemovedSshTargetLabels(
+  environmentId: string,
+  generation: number
+): Promise<void> {
   try {
     const { labels } = await callRuntimeRpc<{ labels: Record<string, string> }>(
       environmentTarget(environmentId),
@@ -56,7 +68,6 @@ async function syncEnvironmentSshTargetMetadata(
   } catch {
     // Best-effort — a missing map just falls back to the raw target id.
   }
-  return targets
 }
 
 async function fetchEnvironmentSshConnectionStates(
@@ -65,6 +76,9 @@ async function fetchEnvironmentSshConnectionStates(
   generation: number
 ): Promise<void> {
   for (const target of targets) {
+    if (generation !== getEnvironmentSshStateGeneration(environmentId)) {
+      return
+    }
     try {
       const { state } = await callRuntimeRpc<{ state: SshConnectionState | null }>(
         environmentTarget(environmentId),
@@ -84,8 +98,21 @@ async function fetchEnvironmentSshConnectionStates(
   }
 }
 
-type HydrationEntry = { promise: Promise<void>; rerunRequested: boolean }
-const hydrationsInFlight = new Map<string, HydrationEntry>()
+type SshRefreshKind = 'metadata' | 'full'
+type SshRefreshEntry = {
+  promise: Promise<void>
+  generation: number
+  kind: SshRefreshKind
+  rerunKind: SshRefreshKind | null
+}
+const sshRefreshesInFlight = new Map<string, SshRefreshEntry>()
+
+function mergeSshRefreshKind(
+  current: SshRefreshKind | null,
+  requested: SshRefreshKind
+): SshRefreshKind {
+  return current === 'full' || requested === 'full' ? 'full' : 'metadata'
+}
 
 async function runEnvironmentSshHydration(environmentId: string): Promise<void> {
   const generation = getEnvironmentSshStateGeneration(environmentId)
@@ -93,6 +120,80 @@ async function runEnvironmentSshHydration(environmentId: string): Promise<void>
   await fetchEnvironmentSshConnectionStates(environmentId, targets, generation)
 }
 
+async function runEnvironmentSshTargetMetadataRefresh(environmentId: string): Promise<void> {
+  const generation = getEnvironmentSshStateGeneration(environmentId)
+  const bucket = useAppStore.getState().sshStateByEnvironment.get(environmentId)
+  const targets = await fetchEnvironmentSshTargets(environmentId)
+  if (generation !== getEnvironmentSshStateGeneration(environmentId)) {
+    return
+  }
+  const metadataChanged =
+    !bucket?.targetsHydrated || !sshTargetLabelsEqual(bucket.targetLabels, targets)
+  useAppStore.getState().setEnvironmentSshTargetsMetadata(environmentId, targets, generation)
+  const priorTargetIds = new Set(bucket?.targetLabels.keys() ?? [])
+  // Why: read states after the write — a resync racing this fetch can label a target that never had one read.
+  const knownStates = useAppStore
+    .getState()
+    .sshStateByEnvironment.get(environmentId)?.connectionStates
+  const needStateRead = targets.filter(
+    (target) => !priorTargetIds.has(target.id) || !knownStates?.has(target.id)
+  )
+  if (!metadataChanged) {
+    await fetchEnvironmentSshConnectionStates(environmentId, needStateRead, generation)
+    return
+  }
+  await syncEnvironmentRemovedSshTargetLabels(environmentId, generation)
+  await fetchEnvironmentSshConnectionStates(environmentId, needStateRead, generation)
+}
+
+function requestSshRefreshRerun(entry: SshRefreshEntry, kind: SshRefreshKind): void {
+  entry.rerunKind = mergeSshRefreshKind(entry.rerunKind, kind)
+}
+
+function startEnvironmentSshRefresh(
+  environmentId: string,
+  initialKind: SshRefreshKind
+): Promise<void> {
+  const entry: SshRefreshEntry = {
+    promise: Promise.resolve(),
+    generation: getEnvironmentSshStateGeneration(environmentId),
+    kind: initialKind,
+    rerunKind: null
+  }
+  entry.promise = (async () => {
+    let nextKind: SshRefreshKind | null = initialKind
+    let lastError: unknown = null
+    try {
+      while (nextKind) {
+        entry.kind = nextKind
+        entry.generation = getEnvironmentSshStateGeneration(environmentId)
+        entry.rerunKind = null
+        try {
+          await (entry.kind === 'full'
+            ? runEnvironmentSshHydration(environmentId)
+            : runEnvironmentSshTargetMetadataRefresh(environmentId))
+          lastError = null
+        } catch (error) {
+          lastError = error
+          if (entry.rerunKind) {
+            entry.rerunKind = mergeSshRefreshKind(entry.rerunKind, entry.kind)
+          }
+        }
+        nextKind = entry.rerunKind
+      }
+      if (lastError) {
+        throw lastError
+      }
+    } finally {
+      if (sshRefreshesInFlight.get(environmentId) === entry) {
+        sshRefreshesInFlight.delete(environmentId)
+      }
+    }
+  })()
+  sshRefreshesInFlight.set(environmentId, entry)
+  return entry.promise
+}
+
 /**
  * Fetches the environment's SSH targets, removal tombstones, and per-target
  * connection states into its bucket. Single-flight per environment; a `force`
@@ -107,10 +208,11 @@ export async function hydrateRuntimeEnvironmentSshState(
   environmentId: string,
   options: { force?: boolean } = {}
 ): Promise<void> {
-  const inFlight = hydrationsInFlight.get(environmentId)
+  const generation = getEnvironmentSshStateGeneration(environmentId)
+  const inFlight = sshRefreshesInFlight.get(environmentId)
   if (inFlight) {
-    if (options.force) {
-      inFlight.rerunRequested = true
+    if (options.force || inFlight.generation !== generation) {
+      requestSshRefreshRerun(inFlight, 'full')
     }
     return inFlight.promise
   }
@@ -118,28 +220,21 @@ export async function hydrateRuntimeEnvironmentSshState(
   if (!options.force && bucket?.targetsHydrated) {
     return
   }
-  const entry: HydrationEntry = { promise: Promise.resolve(), rerunRequested: false }
-  entry.promise = (async () => {
-    let lastError: unknown = null
-    try {
-      do {
-        entry.rerunRequested = false
-        try {
-          await runEnvironmentSshHydration(environmentId)
-          lastError = null
-        } catch (error) {
-          lastError = error
-        }
-      } while (entry.rerunRequested)
-      if (lastError) {
-        throw lastError
-      }
-    } finally {
-      hydrationsInFlight.delete(environmentId)
-    }
-  })()
-  hydrationsInFlight.set(environmentId, entry)
-  return entry.promise
+  return startEnvironmentSshRefresh(environmentId, 'full')
+}
+
+/** Refreshes target membership without re-reading every known target state. */
+export async function refreshRuntimeEnvironmentSshTargetMetadata(
+  environmentId: string
+): Promise<void> {
+  const generation = getEnvironmentSshStateGeneration(environmentId)
+  const inFlight = sshRefreshesInFlight.get(environmentId)
+  if (inFlight) {
+    requestSshRefreshRerun(inFlight, inFlight.generation === generation ? 'metadata' : 'full')
+    return inFlight.promise
+  }
+  const bucket = useAppStore.getState().sshStateByEnvironment.get(environmentId)
+  return startEnvironmentSshRefresh(environmentId, bucket?.targetsHydrated ? 'metadata' : 'full')
 }
 
 /**
@@ -196,10 +291,9 @@ export async function connectRuntimeEnvironmentSshTarget(
 }
 
 /** Resyncs the environment's target metadata after a failed connect so a
- * stale overlay converges to the ghost/re-adopted state (STA-1468). */
+ * stale overlay converges to the ghost/re-adopted state (STA-1468). Full
+ * hydration, not metadata alone: a host re-added under a new target id must
+ * land with a connection state or its chip and mutation gate stay dead. */
 export async function resyncRuntimeEnvironmentSshTargets(environmentId: string): Promise<void> {
-  await syncEnvironmentSshTargetMetadata(
-    environmentId,
-    getEnvironmentSshStateGeneration(environmentId)
-  )
+  await hydrateRuntimeEnvironmentSshState(environmentId, { force: true })
 }
diff --git a/src/renderer/src/runtime/runtime-file-search-bounds.ts b/src/renderer/src/runtime/runtime-file-search-bounds.ts
index 1301fbe83e4..b7823f783fd 100644
--- a/src/renderer/src/runtime/runtime-file-search-bounds.ts
+++ b/src/renderer/src/runtime/runtime-file-search-bounds.ts
@@ -1,4 +1,5 @@
 import type { SearchOptions, SearchResult } from '../../../shared/types'
+import { isUtf8ByteLengthWithinLimit } from '../../../shared/utf8-byte-limits'
 
 export const RUNTIME_FILE_SEARCH_TEXT_MAX_BYTES = 8 * 1024
 
@@ -8,35 +9,11 @@ export function createEmptyRuntimeFileSearchResult(): SearchResult {
   return { files: [], totalMatches: 0, truncated: false }
 }
 
-function getCodePointUtf8ByteLength(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
-
 export function isRuntimeFileSearchTextWithinLimit(
   text: string,
   maxBytes = RUNTIME_FILE_SEARCH_TEXT_MAX_BYTES
 ): boolean {
-  let byteLength = 0
-  for (let index = 0; index < text.length; index += 1) {
-    const codePoint = text.codePointAt(index) ?? 0
-    byteLength += getCodePointUtf8ByteLength(codePoint)
-    if (byteLength > maxBytes) {
-      return false
-    }
-    if (codePoint > 0xffff) {
-      index += 1
-    }
-  }
-  return true
+  return isUtf8ByteLengthWithinLimit(text, maxBytes)
 }
 
 export function getRuntimeFileSearchRejectedField(
diff --git a/src/renderer/src/runtime/runtime-provider-search-bounds.ts b/src/renderer/src/runtime/runtime-provider-search-bounds.ts
index d41441344c1..b231cca356d 100644
--- a/src/renderer/src/runtime/runtime-provider-search-bounds.ts
+++ b/src/renderer/src/runtime/runtime-provider-search-bounds.ts
@@ -1,17 +1,6 @@
-export const RUNTIME_PROVIDER_SEARCH_QUERY_MAX_BYTES = 8 * 1024
+import { isUtf8ByteLengthWithinLimit } from '../../../shared/utf8-byte-limits'
 
-function getCodePointUtf8ByteLength(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
+export const RUNTIME_PROVIDER_SEARCH_QUERY_MAX_BYTES = 8 * 1024
 
 export function isRuntimeProviderSearchQueryWithinLimit(
   query: string | null | undefined,
@@ -20,16 +9,5 @@ export function isRuntimeProviderSearchQueryWithinLimit(
   if (query === null || query === undefined) {
     return true
   }
-  let byteLength = 0
-  for (let index = 0; index < query.length; index += 1) {
-    const codePoint = query.codePointAt(index) ?? 0
-    byteLength += getCodePointUtf8ByteLength(codePoint)
-    if (byteLength > maxBytes) {
-      return false
-    }
-    if (codePoint > 0xffff) {
-      index += 1
-    }
-  }
-  return true
+  return isUtf8ByteLengthWithinLimit(query, maxBytes)
 }
diff --git a/src/renderer/src/runtime/runtime-repo-search-bounds.ts b/src/renderer/src/runtime/runtime-repo-search-bounds.ts
index 36480657568..9717f3fe906 100644
--- a/src/renderer/src/runtime/runtime-repo-search-bounds.ts
+++ b/src/renderer/src/runtime/runtime-repo-search-bounds.ts
@@ -1,32 +1,10 @@
-export const RUNTIME_REPO_REF_SEARCH_QUERY_MAX_BYTES = 2 * 1024
+import { isUtf8ByteLengthWithinLimit } from '../../../shared/utf8-byte-limits'
 
-function getCodePointUtf8ByteLength(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
+export const RUNTIME_REPO_REF_SEARCH_QUERY_MAX_BYTES = 2 * 1024
 
 export function isRuntimeRepoRefSearchQueryWithinLimit(
   query: string,
   maxBytes = RUNTIME_REPO_REF_SEARCH_QUERY_MAX_BYTES
 ): boolean {
-  let byteLength = 0
-  for (let index = 0; index < query.length; index += 1) {
-    const codePoint = query.codePointAt(index) ?? 0
-    byteLength += getCodePointUtf8ByteLength(codePoint)
-    if (byteLength > maxBytes) {
-      return false
-    }
-    if (codePoint > 0xffff) {
-      index += 1
-    }
-  }
-  return true
+  return isUtf8ByteLengthWithinLimit(query, maxBytes)
 }
diff --git a/src/renderer/src/runtime/web-runtime-session.test.ts b/src/renderer/src/runtime/web-runtime-session.test.ts
index 09f6dee870b..38a6efd7e58 100644
--- a/src/renderer/src/runtime/web-runtime-session.test.ts
+++ b/src/renderer/src/runtime/web-runtime-session.test.ts
@@ -34,12 +34,19 @@ import {
   resetWebAgentSessionHandoffsForTests
 } from './web-agent-session-handoff'
 import { toRuntimeExecutionHostId } from '../../../shared/execution-host'
+import {
+  isWebSessionBrowserPlacementGroupReserved,
+  resetWebSessionBrowserPlacementsForTests
+} from './web-session-browser-placement'
 
 const mocks = vi.hoisted(() => ({
   getState: vi.fn(),
   setState: vi.fn(),
+  subscribe: vi.fn(),
   setActiveWorktree: vi.fn(),
   createBrowserTab: vi.fn(),
+  closeEmptyGroup: vi.fn(),
+  moveUnifiedTabToGroup: vi.fn(),
   setRemoteBrowserPageHandle: vi.fn(),
   focusBrowserTabInWorktree: vi.fn(),
   applyFreshWebSessionTabsSnapshot: vi.fn(),
@@ -54,7 +61,8 @@ const mocks = vi.hoisted(() => ({
 vi.mock('../store', () => ({
   useAppStore: {
     getState: mocks.getState,
-    setState: mocks.setState
+    setState: mocks.setState,
+    subscribe: mocks.subscribe
   }
 }))
 
@@ -249,10 +257,28 @@ describe('createWebRuntimeSessionBrowserTab', () => {
       settings: {
         activeRuntimeEnvironmentId: ENVIRONMENT_ID
       },
+      runtimeStatusByEnvironmentId: new Map([
+        [ENVIRONMENT_ID, { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }]
+      ]),
       activeWorktreeId: WORKTREE_ID,
+      activeWorkspaceExecutionHostId: RUNTIME_EXECUTION_HOST_ID,
+      activeTabType: 'editor',
+      activeTabTypeByWorktree: { [WORKTREE_ID]: 'editor' },
+      activeFileIdByWorktree: { [WORKTREE_ID]: '/worktree/index.html' },
       browserPagesByWorkspace: {},
       remoteBrowserPageHandlesByPageId: {},
+      unifiedTabsByWorktree: {
+        [WORKTREE_ID]: [
+          {
+            id: 'local-editor-tab',
+            entityId: '/worktree/index.html',
+            contentType: 'editor'
+          }
+        ]
+      },
       createBrowserTab: mocks.createBrowserTab,
+      closeEmptyGroup: mocks.closeEmptyGroup,
+      moveUnifiedTabToGroup: mocks.moveUnifiedTabToGroup,
       setRemoteBrowserPageHandle: mocks.setRemoteBrowserPageHandle,
       focusBrowserTabInWorktree: mocks.focusBrowserTabInWorktree,
       setActiveWorktree: mocks.setActiveWorktree
@@ -263,11 +289,13 @@ describe('createWebRuntimeSessionBrowserTab', () => {
         activeWorktreeId: WORKTREE_ID
       })
     })
+    mocks.subscribe.mockReturnValue(vi.fn())
     mocks.createBrowserTab.mockReturnValue({
       id: 'local-browser-workspace-1',
       activePageId: 'local-page-1',
       pageIds: ['local-page-1']
     })
+    mocks.moveUnifiedTabToGroup.mockReturnValue(true)
     mocks.applyFreshWebSessionTabsSnapshot.mockReturnValue({ state: 'after' })
     mocks.resolveHostSessionTabIdForWebSessionTab.mockReturnValue(null)
     mocks.deliverLaunchPromptToAgentTab.mockResolvedValue(true)
@@ -276,11 +304,38 @@ describe('createWebRuntimeSessionBrowserTab', () => {
   afterEach(() => {
     vi.unstubAllGlobals()
     clearRuntimeCompatibilityCacheForTests()
+    resetWebSessionBrowserPlacementsForTests()
+    resetWebSessionFocusIntentForTests()
     vi.clearAllMocks()
   })
 
-  it('eagerly applies the host session snapshot after creating a remote browser tab', async () => {
+  it('rejects before RPC when the selected runtime does not advertise screencast', async () => {
+    mocks.getState.mockReturnValue({
+      settings: { activeRuntimeEnvironmentId: ENVIRONMENT_ID },
+      runtimeStatusByEnvironmentId: new Map([
+        [ENVIRONMENT_ID, { status: { capabilities: [] }, checkedAt: 1 }]
+      ])
+    })
+    const runtimeCall = vi.fn()
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        environmentId: ENVIRONMENT_ID
+      })
+    ).rejects.toThrow('does not support browser streaming')
+
+    expect(runtimeCall).not.toHaveBeenCalled()
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('applies an empty host snapshot without retaining delayed browser focus', async () => {
     const snapshot = makeSnapshot()
+    let resolveList!: (response: unknown) => void
+    const listResponse = new Promise((resolve) => {
+      resolveList = resolve
+    })
     const runtimeCall = vi
       .fn()
       .mockResolvedValueOnce({
@@ -288,11 +343,7 @@ describe('createWebRuntimeSessionBrowserTab', () => {
         ok: true,
         result: { browserPageId: 'remote-browser-page-1' }
       })
-      .mockResolvedValueOnce({
-        id: 'list',
-        ok: true,
-        result: snapshot
-      })
+      .mockReturnValueOnce(listResponse)
 
     vi.stubGlobal('window', {
       api: {
@@ -302,14 +353,19 @@ describe('createWebRuntimeSessionBrowserTab', () => {
       }
     })
 
-    await expect(
-      createWebRuntimeSessionBrowserTab({
-        worktreeId: WORKTREE_ID,
-        url: 'https://example.com/'
-      })
-    ).resolves.toBe(true)
+    const pendingCreate = createWebRuntimeSessionBrowserTab({
+      worktreeId: WORKTREE_ID,
+      url: 'https://example.com/'
+    })
 
     await vi.waitFor(() => expect(runtimeCall).toHaveBeenCalledTimes(2))
+    expect(mocks.subscribe).toHaveBeenCalledOnce()
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toEqual({
+      hostTabId: 'remote-browser-page-1',
+      expectedCurrentLocalTabId: 'local-editor-tab'
+    })
+    resolveList({ id: 'list', ok: true, result: snapshot })
+    await expect(pendingCreate).resolves.toBe(true)
     await vi.waitFor(() => expect(mocks.applyFreshWebSessionTabsSnapshot).toHaveBeenCalledTimes(1))
 
     expect(runtimeCall).toHaveBeenNthCalledWith(1, {
@@ -339,20 +395,355 @@ describe('createWebRuntimeSessionBrowserTab', () => {
       snapshot,
       ENVIRONMENT_ID
     )
-    expect(mocks.createBrowserTab).toHaveBeenCalledWith(WORKTREE_ID, 'https://example.com/', {
-      title: 'https://example.com/',
-      focusAddressBar: true,
-      browserRuntimeEnvironmentId: ENVIRONMENT_ID
+    expect(mocks.acceptReplayedWebSessionTabsSnapshot).toHaveBeenCalledWith(
+      ENVIRONMENT_ID,
+      WORKTREE_ID
+    )
+    expect(mocks.acceptReplayedWebSessionTabsSnapshot.mock.invocationCallOrder[0]).toBeLessThan(
+      mocks.applyFreshWebSessionTabsSnapshot.mock.invocationCallOrder[0]!
+    )
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toBeNull()
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('does not let a slow browser create replace a newer browser selection', async () => {
+    let resolveCreate!: (response: unknown) => void
+    const createResponse = new Promise((resolve) => {
+      resolveCreate = resolve
     })
-    expect(mocks.setRemoteBrowserPageHandle).toHaveBeenCalledWith('local-page-1', {
-      environmentId: ENVIRONMENT_ID,
-      remotePageId: 'remote-browser-page-1'
+    mocks.resolveHostSessionTabIdForWebSessionTab.mockReturnValue('newer-host-browser')
+    const runtimeCall = vi.fn(async (request: { method: string }) => {
+      if (request.method === 'browser.tabCreate') {
+        return createResponse
+      }
+      if (request.method === 'session.tabs.activate') {
+        return { id: 'activate', ok: true, result: {} }
+      }
+      return { id: 'list', ok: true, result: makeSnapshot() }
     })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    const pendingCreate = createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID })
+    await vi.waitFor(() =>
+      expect(
+        runtimeCall.mock.calls.some(([request]) => request.method === 'browser.tabCreate')
+      ).toBe(true)
+    )
+    await activateWebRuntimeSessionTab({
+      worktreeId: WORKTREE_ID,
+      tabId: 'newer-local-browser'
+    })
+    resolveCreate({
+      id: 'create',
+      ok: true,
+      result: { browserPageId: 'created-host-browser' }
+    })
+    await expect(pendingCreate).resolves.toBe(true)
+
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toEqual({
+      hostTabId: 'newer-host-browser'
+    })
+  })
+
+  it('does not focus a slow browser create after an editor A-B-A selection', async () => {
+    let resolveCreate!: (response: unknown) => void
+    const createResponse = new Promise((resolve) => {
+      resolveCreate = resolve
+    })
+    let state = mocks.getState()
+    let listener: ((next: typeof state, previous: typeof state) => void) | null = null
+    mocks.getState.mockImplementation(() => state)
+    mocks.subscribe.mockImplementation((nextListener) => {
+      listener = nextListener
+      return vi.fn()
+    })
+    const runtimeCall = vi.fn(async (request: { method: string }) => {
+      if (request.method === 'browser.tabCreate') {
+        return createResponse
+      }
+      return { id: 'list', ok: true, result: makeSnapshot() }
+    })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    const pendingCreate = createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID })
+    await vi.waitFor(() => expect(listener).not.toBeNull())
+    const editorBState = {
+      ...state,
+      activeFileIdByWorktree: { [WORKTREE_ID]: '/worktree/other.html' },
+      unifiedTabsByWorktree: {
+        [WORKTREE_ID]: [
+          ...state.unifiedTabsByWorktree[WORKTREE_ID],
+          {
+            id: 'other-editor-tab',
+            entityId: '/worktree/other.html',
+            contentType: 'editor'
+          }
+        ]
+      }
+    }
+    listener!(editorBState, state)
+    const editorAState = {
+      ...editorBState,
+      activeFileIdByWorktree: { [WORKTREE_ID]: '/worktree/index.html' }
+    }
+    listener!(editorAState, editorBState)
+    state = editorAState
+    resolveCreate({
+      id: 'create',
+      ok: true,
+      result: { browserPageId: 'created-host-browser' }
+    })
+    await expect(pendingCreate).resolves.toBe(true)
+
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toBeNull()
+  })
+
+  it('does not focus a browser after an editor A-B-A selection during reconciliation', async () => {
+    let resolveList!: (response: unknown) => void
+    const listResponse = new Promise((resolve) => {
+      resolveList = resolve
+    })
+    let state = mocks.getState()
+    let listener: ((next: typeof state, previous: typeof state) => void) | null = null
+    mocks.getState.mockImplementation(() => state)
+    mocks.subscribe.mockImplementation((nextListener) => {
+      listener = nextListener
+      return vi.fn()
+    })
+    const runtimeCall = vi
+      .fn()
+      .mockResolvedValueOnce({
+        id: 'create',
+        ok: true,
+        result: { browserPageId: 'created-host-browser' }
+      })
+      .mockReturnValueOnce(listResponse)
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    const pendingCreate = createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID })
+    await vi.waitFor(() => expect(runtimeCall).toHaveBeenCalledTimes(2))
+    const editorBState = {
+      ...state,
+      activeFileIdByWorktree: { [WORKTREE_ID]: '/worktree/other.html' },
+      unifiedTabsByWorktree: {
+        [WORKTREE_ID]: [
+          ...state.unifiedTabsByWorktree[WORKTREE_ID],
+          {
+            id: 'other-editor-tab',
+            entityId: '/worktree/other.html',
+            contentType: 'editor'
+          }
+        ]
+      }
+    }
+    listener!(editorBState, state)
+    const editorAState = {
+      ...editorBState,
+      activeFileIdByWorktree: { [WORKTREE_ID]: '/worktree/index.html' }
+    }
+    listener!(editorAState, editorBState)
+    state = editorAState
+    resolveList({ id: 'list', ok: true, result: makeSnapshot() })
+    await expect(pendingCreate).resolves.toBe(true)
+
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toBeNull()
+  })
+
+  it.each([
+    {
+      label: 'worktree',
+      leave: (state: Record<string, unknown>) => ({
+        ...state,
+        activeWorktreeId: 'repo::/other-worktree'
+      }),
+      returnToStart: (state: Record<string, unknown>) => ({
+        ...state,
+        activeWorktreeId: WORKTREE_ID
+      })
+    },
+    {
+      label: 'runtime owner',
+      leave: (state: Record<string, unknown>) => ({
+        ...state,
+        activeWorkspaceExecutionHostId: 'local'
+      }),
+      returnToStart: (state: Record<string, unknown>) => ({
+        ...state,
+        activeWorkspaceExecutionHostId: RUNTIME_EXECUTION_HOST_ID
+      })
+    }
+  ])(
+    'does not focus after leaving and returning to the $label during reconciliation',
+    async ({ leave, returnToStart }) => {
+      let resolveList!: (response: unknown) => void
+      const listResponse = new Promise((resolve) => {
+        resolveList = resolve
+      })
+      let state = mocks.getState()
+      let listener: ((next: typeof state, previous: typeof state) => void) | null = null
+      mocks.getState.mockImplementation(() => state)
+      mocks.subscribe.mockImplementation((nextListener) => {
+        listener = nextListener
+        return vi.fn()
+      })
+      const runtimeCall = vi
+        .fn()
+        .mockResolvedValueOnce({
+          id: 'create',
+          ok: true,
+          result: { browserPageId: 'created-host-browser' }
+        })
+        .mockReturnValueOnce(listResponse)
+      vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+      const pendingCreate = createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID })
+      await vi.waitFor(() => expect(runtimeCall).toHaveBeenCalledTimes(2))
+      const awayState = leave(state)
+      listener!(awayState, state)
+      const returnedState = returnToStart(awayState)
+      listener!(returnedState, awayState)
+      state = returnedState
+      resolveList({ id: 'list', ok: true, result: makeSnapshot() })
+      await expect(pendingCreate).resolves.toBe(true)
+
+      expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toBeNull()
+    }
+  )
+
+  it('does not retry a failed browser create', async () => {
+    const runtimeCall = vi.fn().mockResolvedValue({
+      id: 'create-lost',
+      ok: false,
+      error: { code: 'remote_runtime_unavailable', message: 'response lost' }
+    })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({ worktreeId: WORKTREE_ID, url: 'https://example.com/' })
+    ).resolves.toBe(false)
+
+    expect(runtimeCall).toHaveBeenCalledOnce()
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+  })
+
+  it('creates an unfocused browser while preserving its requested split', async () => {
+    mocks.getState.mockReturnValue({
+      settings: { activeRuntimeEnvironmentId: ENVIRONMENT_ID },
+      runtimeStatusByEnvironmentId: new Map([
+        [ENVIRONMENT_ID, { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }]
+      ]),
+      activeWorktreeId: WORKTREE_ID,
+      browserPagesByWorkspace: {
+        'host-browser-workspace': [
+          { id: 'host-browser-page', workspaceId: 'host-browser-workspace' }
+        ]
+      },
+      remoteBrowserPageHandlesByPageId: {
+        'host-browser-page': {
+          environmentId: ENVIRONMENT_ID,
+          remotePageId: 'remote-browser-page-1'
+        }
+      },
+      unifiedTabsByWorktree: { [WORKTREE_ID]: [] },
+      createBrowserTab: mocks.createBrowserTab,
+      closeEmptyGroup: mocks.closeEmptyGroup,
+      moveUnifiedTabToGroup: mocks.moveUnifiedTabToGroup,
+      setRemoteBrowserPageHandle: mocks.setRemoteBrowserPageHandle,
+      focusBrowserTabInWorktree: mocks.focusBrowserTabInWorktree,
+      setActiveWorktree: mocks.setActiveWorktree
+    })
+    const runtimeCall = vi
+      .fn()
+      .mockResolvedValueOnce({
+        id: 'create',
+        ok: true,
+        result: { browserPageId: 'remote-browser-page-1' }
+      })
+      .mockResolvedValueOnce({ id: 'list', ok: true, result: makeSnapshot() })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        environmentId: ENVIRONMENT_ID,
+        clientTargetGroupId: 'client-preview-group',
+        focusOnCreate: false
+      })
+    ).resolves.toBe(true)
+
+    expect(runtimeCall).toHaveBeenNthCalledWith(1, {
+      selector: ENVIRONMENT_ID,
+      method: 'browser.tabCreate',
+      params: {
+        worktree: `id:${WORKTREE_ID}`,
+        url: undefined,
+        profileId: undefined,
+        activate: false,
+        waitForRegistration: false
+      },
+      timeoutMs: 15_000
+    })
+    expect(mocks.subscribe).not.toHaveBeenCalled()
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toBeNull()
+    expect(mocks.acceptReplayedWebSessionTabsSnapshot).toHaveBeenCalledWith(
+      ENVIRONMENT_ID,
+      WORKTREE_ID
+    )
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        groupId: 'client-preview-group'
+      })
+    ).toBe(true)
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+    expect(mocks.closeEmptyGroup).not.toHaveBeenCalled()
+  })
+
+  it('releases and removes a newly-created split when host creation fails', async () => {
+    vi.stubGlobal('window', {
+      api: {
+        runtimeEnvironments: {
+          call: vi.fn().mockRejectedValue(new Error('offline'))
+        }
+      }
+    })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        environmentId: ENVIRONMENT_ID,
+        clientTargetGroupId: 'client-preview-group',
+        clientTargetGroupCreated: true
+      })
+    ).resolves.toBe(false)
+
+    expect(mocks.closeEmptyGroup).toHaveBeenCalledWith(WORKTREE_ID, 'client-preview-group')
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        groupId: 'client-preview-group'
+      })
+    ).toBe(false)
   })
 
   it('keeps the requested worktree selected while the browser snapshot catches up', async () => {
     const snapshot = makeSnapshot()
     const setStateResults: unknown[] = []
+    let focusState = {
+      ...mocks.getState(),
+      activeWorktreeId: 'landing',
+      activeWorkspaceExecutionHostId: 'local'
+    }
+    mocks.getState.mockImplementation(() => focusState)
+    mocks.setActiveWorktree.mockImplementation((worktreeId, executionHostId) => {
+      focusState = {
+        ...focusState,
+        activeWorktreeId: worktreeId,
+        activeWorkspaceExecutionHostId: executionHostId
+      }
+    })
     let mockState: Record<string, unknown> = { state: 'before-stage', activeWorktreeId: 'landing' }
     mocks.setState.mockImplementation((updater: (state: unknown) => unknown) => {
       const result = updater(mockState)
@@ -403,6 +794,45 @@ describe('createWebRuntimeSessionBrowserTab', () => {
     expect(setStateResults.at(-1)).toEqual({ state: 'after' })
   })
 
+  it('does not reselect an already active browser worktree on the same runtime', async () => {
+    mocks.getState.mockReturnValue({
+      settings: { activeRuntimeEnvironmentId: ENVIRONMENT_ID },
+      runtimeStatusByEnvironmentId: new Map([
+        [ENVIRONMENT_ID, { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }]
+      ]),
+      activeWorktreeId: WORKTREE_ID,
+      activeWorkspaceExecutionHostId: RUNTIME_EXECUTION_HOST_ID,
+      browserPagesByWorkspace: {},
+      remoteBrowserPageHandlesByPageId: {},
+      unifiedTabsByWorktree: {},
+      createBrowserTab: mocks.createBrowserTab,
+      closeEmptyGroup: mocks.closeEmptyGroup,
+      moveUnifiedTabToGroup: mocks.moveUnifiedTabToGroup,
+      setRemoteBrowserPageHandle: mocks.setRemoteBrowserPageHandle,
+      focusBrowserTabInWorktree: mocks.focusBrowserTabInWorktree,
+      setActiveWorktree: mocks.setActiveWorktree
+    })
+    const runtimeCall = vi
+      .fn()
+      .mockResolvedValueOnce({
+        id: 'create',
+        ok: true,
+        result: { browserPageId: 'remote-browser-page-1' }
+      })
+      .mockResolvedValueOnce({ id: 'list', ok: true, result: makeSnapshot() })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        environmentId: ENVIRONMENT_ID,
+        url: 'https://example.com/'
+      })
+    ).resolves.toBe(true)
+
+    expect(mocks.setActiveWorktree).not.toHaveBeenCalled()
+  })
+
   it('can create a browser tab without selecting the target worktree', async () => {
     const setStateResults: unknown[] = []
     mocks.setState.mockImplementation((updater: (state: unknown) => unknown) => {
@@ -451,6 +881,9 @@ describe('createWebRuntimeSessionBrowserTab', () => {
       settings: {
         activeRuntimeEnvironmentId: ENVIRONMENT_ID
       },
+      runtimeStatusByEnvironmentId: new Map([
+        [ENVIRONMENT_ID, { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }]
+      ]),
       activeWorktreeId,
       browserPagesByWorkspace: {},
       remoteBrowserPageHandlesByPageId: {},
@@ -530,6 +963,55 @@ describe('createWebRuntimeSessionBrowserTab', () => {
     await vi.waitFor(() => expect(mocks.applyFreshWebSessionTabsSnapshot).toHaveBeenCalledTimes(1))
     expect(mocks.setRemoteBrowserPageHandle).not.toHaveBeenCalled()
   })
+
+  it('keeps client presentation fields out of the RPC shape', async () => {
+    const runtimeCall = vi
+      .fn()
+      .mockResolvedValueOnce({
+        id: 'create',
+        ok: true,
+        result: { browserPageId: 'remote-browser-page-1' }
+      })
+      .mockResolvedValueOnce({ id: 'list', ok: true, result: makeSnapshot() })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        environmentId: ENVIRONMENT_ID,
+        url: 'https://example.com/?q=private',
+        selectWorktree: false,
+        stagedTitle: 'Search Google',
+        stagedFocusAddressBar: false
+      })
+    ).resolves.toBe(true)
+
+    expect(mocks.createBrowserTab).not.toHaveBeenCalled()
+    expect(runtimeCall.mock.calls[0][0].params).not.toHaveProperty('stagedTitle')
+  })
+
+  it('can log remote browser failure without retaining downstream details', async () => {
+    const consoleWarn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    vi.stubGlobal('window', {
+      api: {
+        runtimeEnvironments: {
+          call: vi.fn().mockRejectedValue(new Error('failed https://example.com/?q=private'))
+        }
+      }
+    })
+
+    await expect(
+      createWebRuntimeSessionBrowserTab({
+        worktreeId: WORKTREE_ID,
+        environmentId: ENVIRONMENT_ID,
+        url: 'https://example.com/?q=private',
+        failureLogMode: 'operation-only'
+      })
+    ).resolves.toBe(false)
+
+    expect(consoleWarn).toHaveBeenCalledWith('[web-runtime-session] failed to create browser tab')
+    expect(JSON.stringify(consoleWarn.mock.calls)).not.toContain('private')
+  })
 })
 
 describe('createWebRuntimeSessionTerminal', () => {
@@ -1353,6 +1835,7 @@ describe('moveWebRuntimeSessionTab', () => {
   })
 
   afterEach(() => {
+    resetWebSessionFocusIntentForTests()
     vi.unstubAllGlobals()
     vi.clearAllMocks()
   })
@@ -1556,6 +2039,7 @@ describe('web runtime session tab actions', () => {
   })
 
   afterEach(() => {
+    resetWebSessionFocusIntentForTests()
     vi.unstubAllGlobals()
     vi.clearAllMocks()
   })
@@ -1634,6 +2118,25 @@ describe('web runtime session tab actions', () => {
     expect(mocks.applyFreshWebSessionTabsSnapshot).toHaveBeenCalled()
   })
 
+  it('supersedes browser focus intent when a terminal is activated next', async () => {
+    mocks.resolveHostSessionTabIdForWebSessionTab.mockImplementation(
+      (_state, args: { tabId: string }) =>
+        args.tabId === 'local-browser-unified' ? 'host-browser-unified' : 'host-terminal'
+    )
+    const runtimeCall = vi.fn().mockResolvedValue({ id: 'activate', ok: true, result: {} })
+    vi.stubGlobal('window', { api: { runtimeEnvironments: { call: runtimeCall } } })
+
+    await activateWebRuntimeSessionTab({
+      worktreeId: WORKTREE_ID,
+      tabId: 'local-browser-unified'
+    })
+    await activateWebRuntimeSessionTab({ worktreeId: WORKTREE_ID, tabId: 'local-terminal' })
+
+    expect(peekWebSessionFocusIntent({ environmentId: ENVIRONMENT_ID }, WORKTREE_ID)).toEqual({
+      hostTabId: 'host-terminal'
+    })
+  })
+
   it('sends lifecycle and explicit user close reasons on the wire', async () => {
     const runtimeCall = vi
       .fn()
diff --git a/src/renderer/src/runtime/web-runtime-session.ts b/src/renderer/src/runtime/web-runtime-session.ts
index 7178aa21b5f..ad699fcf537 100644
--- a/src/renderer/src/runtime/web-runtime-session.ts
+++ b/src/renderer/src/runtime/web-runtime-session.ts
@@ -26,7 +26,7 @@ import type {
   RuntimeEnsureAgentSessionResult
 } from '../../../shared/agent-session-host-authority'
 import type { TerminalPaneLayoutNode, TuiAgent } from '../../../shared/types'
-import type { AppState } from '../store/types'
+import { createBrowserUuid } from '../lib/browser-uuid'
 import { getRuntimeEnvironmentIdForWorktree } from '../lib/worktree-runtime-owner'
 import { useAppStore } from '../store'
 import { unwrapRuntimeRpcResult } from './runtime-rpc-client'
@@ -36,7 +36,12 @@ import {
 } from './agent-session-create-operation'
 import { parseRemoteRuntimePtyId } from './runtime-terminal-stream'
 import { toRuntimeWorktreeSelector } from './runtime-worktree-selector'
-import { recordWebSessionFocusIntent } from './web-session-focus-intent'
+import {
+  clearWebSessionFocusIntentIfMatches,
+  peekWebSessionFocusIntent,
+  recordWebSessionFocusIntent,
+  resolveWebSessionVisibleTabId
+} from './web-session-focus-intent'
 import { clearWebSessionCloseIntent, recordWebSessionCloseIntent } from './web-session-close-intent'
 import {
   clearWebSessionReorderIntent,
@@ -61,6 +66,13 @@ import { translate } from '../i18n/i18n'
 import { getRuntimeEnvironmentRevision } from './runtime-environment-revision'
 import { parsePaneKey } from '../../../shared/stable-pane-id'
 import { toRuntimeExecutionHostId } from '../../../shared/execution-host'
+import {
+  forgetWebSessionBrowserPlacement,
+  isWebSessionBrowserPlacementGroupReserved,
+  moveWebSessionBrowserPlacement,
+  recordWebSessionBrowserPlacement
+} from './web-session-browser-placement'
+import { assertRuntimeManagedBrowserCreationAvailable } from '../lib/client-creation-action-policy'
 
 export {
   HOST_TERMINAL_SURFACE_SEPARATOR,
@@ -423,7 +435,13 @@ export async function createWebRuntimeSessionBrowserTab(args: {
   url?: string
   profileId?: string | null
   targetGroupId?: string
+  clientTargetGroupId?: string
+  clientTargetGroupCreated?: boolean
+  focusOnCreate?: boolean
   selectWorktree?: boolean
+  stagedTitle?: string
+  stagedFocusAddressBar?: boolean
+  failureLogMode?: 'details' | 'operation-only'
 }): Promise<boolean> {
   const environmentId =
     args.environmentId?.trim() ??
@@ -432,126 +450,167 @@ export async function createWebRuntimeSessionBrowserTab(args: {
   if (!environmentId || !isWebRuntimeSessionActive(environmentId)) {
     return false
   }
+  assertRuntimeManagedBrowserCreationAvailable(useAppStore.getState(), environmentId)
   const intentOwner = captureWebSessionIntentOwner(environmentId)
   const callEnvironment = captureRuntimeEnvironmentCall(environmentId, intentOwner.pairingRevision)
-
+  const shouldFocusOnCreate = args.focusOnCreate !== false
   const shouldSelectWorktree = args.selectWorktree !== false
-  const stagedFromWorktreeId = useAppStore.getState().activeWorktreeId
-  if (shouldSelectWorktree) {
-    selectWebRuntimeSessionWorktree(args.worktreeId, environmentId)
-  }
-  try {
-    const response = await callEnvironment({
-      method: 'browser.tabCreate',
-      params: {
-        worktree: toRuntimeWorktreeSelector(args.worktreeId),
-        url: args.url,
-        profileId: args.profileId ?? undefined,
-        // Why: user clicked "New Browser Tab", so mark it active in the snapshot, else the reconcile snaps back to a terminal.
-        activate: true,
-        // Why: place the new browser in the clicked split group so the host snapshot is authoritative for it (no left-snap).
-        ...(args.targetGroupId ? { targetGroupId: args.targetGroupId } : {}),
-        // Why: web clients need the local tab now; waiting for host webview registration makes the workspace appear to close.
-        waitForRegistration: false
-      },
-      timeoutMs: 15_000
-    })
-    const created = unwrapRuntimeRpcResult(response as RuntimeRpcResponse<BrowserTabCreateResult>)
-    // Why: record focus intent (tab id === browserPageId on a headless host) so the reconcile follows to the new browser tab.
-    if (matchesWebSessionIntentOwner(intentOwner)) {
-      recordWebSessionFocusIntent(intentOwner, args.worktreeId, created.browserPageId)
-    }
-    stageWebRuntimeBrowserTab({
+  const provisionalPageId = createBrowserUuid()
+  if (args.clientTargetGroupId) {
+    recordWebSessionBrowserPlacement({
       environmentId,
       worktreeId: args.worktreeId,
-      remotePageId: created.browserPageId,
-      url: args.url,
-      targetGroupId: args.targetGroupId,
-      restoreFocus:
-        shouldSelectWorktree &&
-        (stagedFromWorktreeId === args.worktreeId ||
-          useAppStore.getState().activeWorktreeId === args.worktreeId)
-    })
-    void refreshWebRuntimeSessionTabsSnapshot(environmentId, args.worktreeId, {
-      expectedEnvironmentPairingRevision: intentOwner.pairingRevision
+      remotePageId: provisionalPageId,
+      groupId: args.clientTargetGroupId
     })
+  }
+  if (shouldSelectWorktree) {
+    selectWebRuntimeSessionBrowserWorktree(args.worktreeId, environmentId)
+  }
+  const initialFocusState = shouldFocusOnCreate ? useAppStore.getState() : null
+  const expectedActiveWorktreeId = initialFocusState?.activeWorktreeId
+  const expectedActiveWorkspaceExecutionHostId = initialFocusState?.activeWorkspaceExecutionHostId
+  const expectedCurrentLocalTabId = initialFocusState
+    ? resolveWebSessionVisibleTabId(initialFocusState, args.worktreeId)
+    : null
+  let unsubscribeFocusGuard = (): void => {}
+  let guardedPageId = provisionalPageId
+  try {
+    if (shouldFocusOnCreate && matchesWebSessionIntentOwner(intentOwner)) {
+      recordWebSessionFocusIntent(
+        intentOwner,
+        args.worktreeId,
+        provisionalPageId,
+        undefined,
+        expectedCurrentLocalTabId
+      )
+      unsubscribeFocusGuard = useAppStore.subscribe((state, previousState) => {
+        if (
+          state.activeBrowserTabIdByWorktree === previousState.activeBrowserTabIdByWorktree &&
+          state.activeFileIdByWorktree === previousState.activeFileIdByWorktree &&
+          state.activeTabIdByWorktree === previousState.activeTabIdByWorktree &&
+          state.activeTabType === previousState.activeTabType &&
+          state.activeTabTypeByWorktree === previousState.activeTabTypeByWorktree &&
+          state.activeWorktreeId === previousState.activeWorktreeId &&
+          state.activeWorkspaceExecutionHostId === previousState.activeWorkspaceExecutionHostId &&
+          state.unifiedTabsByWorktree === previousState.unifiedTabsByWorktree
+        ) {
+          return
+        }
+        if (
+          state.activeWorktreeId === expectedActiveWorktreeId &&
+          state.activeWorkspaceExecutionHostId === expectedActiveWorkspaceExecutionHostId &&
+          resolveWebSessionVisibleTabId(state, args.worktreeId) === expectedCurrentLocalTabId
+        ) {
+          return
+        }
+        clearWebSessionFocusIntentIfMatches(intentOwner, args.worktreeId, guardedPageId)
+        unsubscribeFocusGuard()
+      })
+    }
+    const created = unwrapRuntimeRpcResult(
+      (await callEnvironment({
+        method: 'browser.tabCreate',
+        params: {
+          worktree: toRuntimeWorktreeSelector(args.worktreeId),
+          url: args.url,
+          profileId: args.profileId ?? undefined,
+          activate: shouldFocusOnCreate,
+          // Why: place the new browser in the clicked split group so the host snapshot is authoritative for it (no left-snap).
+          ...(args.targetGroupId ? { targetGroupId: args.targetGroupId } : {}),
+          // Why: web clients need the local tab now; waiting for host webview registration makes the workspace appear to close.
+          waitForRegistration: false
+        },
+        timeoutMs: 15_000
+      })) as RuntimeRpcResponse<BrowserTabCreateResult>
+    )
+    if (created.browserPageId !== provisionalPageId) {
+      moveWebSessionBrowserPlacement({
+        environmentId,
+        worktreeId: args.worktreeId,
+        fromRemotePageId: provisionalPageId,
+        toRemotePageId: created.browserPageId
+      })
+      const focusIntent = shouldFocusOnCreate
+        ? peekWebSessionFocusIntent(intentOwner, args.worktreeId)
+        : null
+      if (focusIntent?.hostTabId === provisionalPageId) {
+        recordWebSessionFocusIntent(
+          intentOwner,
+          args.worktreeId,
+          created.browserPageId,
+          undefined,
+          focusIntent.expectedCurrentLocalTabId
+        )
+      }
+      guardedPageId = created.browserPageId
+    }
+    try {
+      await refreshWebRuntimeSessionTabsSnapshot(environmentId, args.worktreeId, {
+        expectedEnvironmentPairingRevision: intentOwner.pairingRevision,
+        acceptCurrentSnapshot: true
+      })
+    } catch (error) {
+      console.warn(
+        '[web-runtime-session] browser created but reconciliation failed:',
+        error instanceof Error ? error.message : String(error)
+      )
+    }
+    const remainingFocusIntent = shouldFocusOnCreate
+      ? peekWebSessionFocusIntent(intentOwner, args.worktreeId)
+      : null
+    if (
+      remainingFocusIntent?.hostTabId === guardedPageId &&
+      remainingFocusIntent.expectedCurrentLocalTabId === expectedCurrentLocalTabId
+    ) {
+      clearWebSessionFocusIntentIfMatches(intentOwner, args.worktreeId, guardedPageId)
+    }
+    unsubscribeFocusGuard()
     return true
   } catch (error) {
-    console.warn(
-      '[web-runtime-session] failed to create browser tab:',
-      error instanceof Error ? error.message : String(error)
-    )
+    unsubscribeFocusGuard()
+    forgetWebSessionBrowserPlacement({
+      environmentId,
+      worktreeId: args.worktreeId,
+      remotePageId: provisionalPageId
+    })
+    if (shouldFocusOnCreate) {
+      clearWebSessionFocusIntentIfMatches(intentOwner, args.worktreeId, provisionalPageId)
+    }
+    if (args.clientTargetGroupId && args.clientTargetGroupCreated) {
+      const reserved = isWebSessionBrowserPlacementGroupReserved({
+        environmentId,
+        worktreeId: args.worktreeId,
+        groupId: args.clientTargetGroupId
+      })
+      if (!reserved) {
+        useAppStore.getState().closeEmptyGroup(args.worktreeId, args.clientTargetGroupId)
+      }
+    }
+    if (args.failureLogMode === 'operation-only') {
+      console.warn('[web-runtime-session] failed to create browser tab')
+    } else {
+      console.warn(
+        '[web-runtime-session] failed to create browser tab:',
+        error instanceof Error ? error.message : String(error)
+      )
+    }
     return false
   }
 }
 
-function stageWebRuntimeBrowserTab(args: {
-  environmentId: string
-  worktreeId: string
-  remotePageId: string
-  url?: string
-  targetGroupId?: string
-  restoreFocus?: boolean
-}): void {
-  const remotePageId = args.remotePageId.trim()
-  if (!remotePageId) {
-    return
-  }
-
-  const existing = findLocalBrowserPageForRemotePage(
-    useAppStore.getState(),
-    args.environmentId,
-    remotePageId
-  )
-  if (args.restoreFocus !== false) {
-    selectWebRuntimeSessionWorktree(args.worktreeId, args.environmentId)
-  }
-
-  if (existing) {
-    if (args.restoreFocus !== false) {
-      useAppStore
-        .getState()
-        .focusBrowserTabInWorktree(args.worktreeId, existing.pageId, { surfacePane: true })
-    }
-    return
-  }
-
-  const url = args.url?.trim() || 'about:blank'
-  // Why: the snapshot can arrive after React renders a fallback; stage the handle now so the worktree stays selected.
-  const browserTab = useAppStore.getState().createBrowserTab(args.worktreeId, url, {
-    title: url === 'about:blank' ? 'New Browser Tab' : url,
-    focusAddressBar: true,
-    browserRuntimeEnvironmentId: args.environmentId,
-    targetGroupId: args.targetGroupId
-  })
-  const pageId = browserTab.activePageId ?? browserTab.pageIds?.[0] ?? null
-  if (!pageId) {
-    return
-  }
-  useAppStore.getState().setRemoteBrowserPageHandle(pageId, {
-    environmentId: args.environmentId,
-    remotePageId
-  })
-}
-
 function selectWebRuntimeSessionWorktree(worktreeId: string, environmentId: string): void {
   useAppStore.getState().setActiveWorktree(worktreeId, toRuntimeExecutionHostId(environmentId))
 }
 
-function findLocalBrowserPageForRemotePage(
-  state: AppState,
-  environmentId: string,
-  remotePageId: string
-): { pageId: string } | null {
-  for (const pages of Object.values(state.browserPagesByWorkspace)) {
-    for (const page of pages) {
-      const handle = state.remoteBrowserPageHandlesByPageId[page.id]
-      if (handle?.environmentId === environmentId && handle.remotePageId === remotePageId) {
-        return { pageId: page.id }
-      }
-    }
+function selectWebRuntimeSessionBrowserWorktree(worktreeId: string, environmentId: string): void {
+  const state = useAppStore.getState()
+  if (
+    state.activeWorktreeId !== worktreeId ||
+    state.activeWorkspaceExecutionHostId !== toRuntimeExecutionHostId(environmentId)
+  ) {
+    state.setActiveWorktree(worktreeId, toRuntimeExecutionHostId(environmentId))
   }
-  return null
 }
 
 export async function refreshWebRuntimeSessionTabsSnapshot(
@@ -862,6 +921,7 @@ async function callWebRuntimeSessionTabMethod(
   const intentOwner = captureWebSessionIntentOwner(environmentId)
   const callEnvironment = captureRuntimeEnvironmentCall(environmentId, intentOwner.pairingRevision)
   const closeIntentTabIds = new Set<string>()
+  let activationHostTabId: string | null = null
 
   const isClose = method === 'session.tabs.close'
   const isLifecycleClose = isClose && args.reason !== 'user'
@@ -897,6 +957,9 @@ async function callWebRuntimeSessionTabMethod(
       // Why: suppress until the host confirms removal, else an in-flight pre-close snapshot flashes the tab back.
       closeIntentTabIds.add(hostTabId)
       recordWebSessionCloseIntent(intentOwner, args.worktreeId, hostTabId, Date.now())
+    } else {
+      activationHostTabId = hostTabId
+      recordWebSessionFocusIntent(intentOwner, args.worktreeId, hostTabId)
     }
     const response = await callEnvironment({
       // Why: old hosts cannot route this additive method, so a generation
@@ -945,6 +1008,9 @@ async function callWebRuntimeSessionTabMethod(
     }
     return true
   } catch (error) {
+    if (activationHostTabId) {
+      clearWebSessionFocusIntentIfMatches(intentOwner, args.worktreeId, activationHostTabId)
+    }
     for (const hostTabId of closeIntentTabIds) {
       clearWebSessionCloseIntent(intentOwner, args.worktreeId, hostTabId)
     }
diff --git a/src/renderer/src/runtime/web-session-browser-placement.test.ts b/src/renderer/src/runtime/web-session-browser-placement.test.ts
new file mode 100644
index 00000000000..97cf36da42d
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-browser-placement.test.ts
@@ -0,0 +1,162 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  clearWebSessionBrowserPlacementsForEnvironment,
+  clearWebSessionBrowserPlacementsForWorktree,
+  forgetWebSessionBrowserPlacement,
+  isWebSessionBrowserPlacementGroupReserved,
+  recordWebSessionBrowserPlacement,
+  resetWebSessionBrowserPlacementsForTests,
+  takeWebSessionBrowserPlacementGroup
+} from './web-session-browser-placement'
+
+const ENVIRONMENT_ID = 'environment-1'
+const WORKTREE_ID = 'worktree-1'
+
+afterEach(resetWebSessionBrowserPlacementsForTests)
+
+describe('web session browser placement', () => {
+  it('keeps a shared target group reserved until every pending page settles', () => {
+    for (const remotePageId of ['page-1', 'page-2']) {
+      recordWebSessionBrowserPlacement({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId,
+        groupId: 'preview-group'
+      })
+    }
+
+    forgetWebSessionBrowserPlacement({
+      environmentId: ENVIRONMENT_ID,
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-1'
+    })
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        groupId: 'preview-group'
+      })
+    ).toBe(true)
+
+    forgetWebSessionBrowserPlacement({
+      environmentId: ENVIRONMENT_ID,
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-2'
+    })
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        groupId: 'preview-group'
+      })
+    ).toBe(false)
+  })
+
+  it('bounds pending page placements', () => {
+    for (let index = 0; index < 129; index += 1) {
+      recordWebSessionBrowserPlacement({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: `page-${index}`,
+        groupId: `group-${index}`
+      })
+    }
+
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-0'
+      })
+    ).toBeUndefined()
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        groupId: 'group-0'
+      })
+    ).toBe(false)
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-128'
+      })
+    ).toBe('group-128')
+  })
+
+  it('refreshes existing entries at capacity without evicting another placement', () => {
+    for (let index = 0; index < 128; index += 1) {
+      recordWebSessionBrowserPlacement({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: `page-${index}`,
+        groupId: `group-${index}`
+      })
+    }
+
+    recordWebSessionBrowserPlacement({
+      environmentId: ENVIRONMENT_ID,
+      worktreeId: WORKTREE_ID,
+      remotePageId: 'page-127',
+      groupId: 'group-127'
+    })
+
+    expect(
+      isWebSessionBrowserPlacementGroupReserved({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        groupId: 'group-0'
+      })
+    ).toBe(true)
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-0'
+      })
+    ).toBe('group-0')
+  })
+
+  it('clears only the requested worktree or environment', () => {
+    for (const [environmentId, worktreeId, suffix] of [
+      [ENVIRONMENT_ID, WORKTREE_ID, 'target'],
+      [ENVIRONMENT_ID, 'worktree-2', 'sibling'],
+      ['environment-2', WORKTREE_ID, 'other-environment']
+    ] as const) {
+      recordWebSessionBrowserPlacement({
+        environmentId,
+        worktreeId,
+        remotePageId: `page-${suffix}`,
+        groupId: `group-${suffix}`
+      })
+    }
+
+    clearWebSessionBrowserPlacementsForWorktree(ENVIRONMENT_ID, WORKTREE_ID)
+
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-target'
+      })
+    ).toBeUndefined()
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: ENVIRONMENT_ID,
+        worktreeId: 'worktree-2',
+        remotePageId: 'page-sibling'
+      })
+    ).toBe('group-sibling')
+
+    clearWebSessionBrowserPlacementsForEnvironment('environment-2')
+
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: 'environment-2',
+        worktreeId: WORKTREE_ID,
+        remotePageId: 'page-other-environment'
+      })
+    ).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/runtime/web-session-browser-placement.ts b/src/renderer/src/runtime/web-session-browser-placement.ts
new file mode 100644
index 00000000000..7df0a95b7eb
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-browser-placement.ts
@@ -0,0 +1,104 @@
+const groupByPendingPage = new Map<string, string>()
+const MAX_PENDING_PLACEMENTS = 128
+
+function pageKey(environmentId: string, worktreeId: string, remotePageId: string): string {
+  return `${environmentId}\0${worktreeId}\0${remotePageId}`
+}
+
+function worktreePrefix(environmentId: string, worktreeId: string): string {
+  return `${environmentId}\0${worktreeId}\0`
+}
+
+export function recordWebSessionBrowserPlacement(args: {
+  environmentId: string
+  worktreeId: string
+  remotePageId: string
+  groupId: string
+}): void {
+  const key = pageKey(args.environmentId, args.worktreeId, args.remotePageId)
+  groupByPendingPage.delete(key)
+  if (groupByPendingPage.size >= MAX_PENDING_PLACEMENTS) {
+    const oldest = groupByPendingPage.keys().next().value
+    if (oldest !== undefined) {
+      groupByPendingPage.delete(oldest)
+    }
+  }
+  groupByPendingPage.set(key, args.groupId)
+}
+
+export function moveWebSessionBrowserPlacement(args: {
+  environmentId: string
+  worktreeId: string
+  fromRemotePageId: string
+  toRemotePageId: string
+}): void {
+  const fromKey = pageKey(args.environmentId, args.worktreeId, args.fromRemotePageId)
+  const groupId = groupByPendingPage.get(fromKey)
+  groupByPendingPage.delete(fromKey)
+  if (groupId) {
+    recordWebSessionBrowserPlacement({
+      environmentId: args.environmentId,
+      worktreeId: args.worktreeId,
+      remotePageId: args.toRemotePageId,
+      groupId
+    })
+  }
+}
+
+export function forgetWebSessionBrowserPlacement(args: {
+  environmentId: string
+  worktreeId: string
+  remotePageId: string
+}): void {
+  groupByPendingPage.delete(pageKey(args.environmentId, args.worktreeId, args.remotePageId))
+}
+
+export function takeWebSessionBrowserPlacementGroup(args: {
+  environmentId: string
+  worktreeId: string
+  remotePageId: string
+}): string | undefined {
+  const key = pageKey(args.environmentId, args.worktreeId, args.remotePageId)
+  const groupId = groupByPendingPage.get(key)
+  groupByPendingPage.delete(key)
+  return groupId
+}
+
+export function isWebSessionBrowserPlacementGroupReserved(args: {
+  environmentId: string
+  worktreeId: string
+  groupId: string
+}): boolean {
+  const prefix = worktreePrefix(args.environmentId, args.worktreeId)
+  for (const [key, groupId] of groupByPendingPage) {
+    if (key.startsWith(prefix) && groupId === args.groupId) {
+      return true
+    }
+  }
+  return false
+}
+
+export function clearWebSessionBrowserPlacementsForWorktree(
+  environmentId: string,
+  worktreeId: string
+): void {
+  const prefix = worktreePrefix(environmentId, worktreeId)
+  for (const key of groupByPendingPage.keys()) {
+    if (key.startsWith(prefix)) {
+      groupByPendingPage.delete(key)
+    }
+  }
+}
+
+export function clearWebSessionBrowserPlacementsForEnvironment(environmentId: string): void {
+  const prefix = `${environmentId}\0`
+  for (const key of groupByPendingPage.keys()) {
+    if (key.startsWith(prefix)) {
+      groupByPendingPage.delete(key)
+    }
+  }
+}
+
+export function resetWebSessionBrowserPlacementsForTests(): void {
+  groupByPendingPage.clear()
+}
diff --git a/src/renderer/src/runtime/web-session-focus-intent.ts b/src/renderer/src/runtime/web-session-focus-intent.ts
index 8ed33b8d15e..e185250372f 100644
--- a/src/renderer/src/runtime/web-session-focus-intent.ts
+++ b/src/renderer/src/runtime/web-session-focus-intent.ts
@@ -10,14 +10,50 @@
 // snapshots, unlike a transient per-snapshot flag).
 
 import { webSessionIntentOwnerKey, type WebSessionIntentOwner } from './web-session-intent-owner'
+import type { AppState } from '../store/types'
 
 export type WebSessionFocusIntent = {
   hostTabId: string
   leafId?: string
+  expectedCurrentLocalTabId?: string | null
 }
 
 const pendingFocusByOwnerAndWorktree = new Map<string, WebSessionFocusIntent>()
 
+type WebSessionVisibleTabState = Pick<
+  AppState,
+  | 'activeBrowserTabIdByWorktree'
+  | 'activeFileIdByWorktree'
+  | 'activeTabIdByWorktree'
+  | 'activeTabType'
+  | 'activeTabTypeByWorktree'
+  | 'activeWorktreeId'
+  | 'unifiedTabsByWorktree'
+>
+
+export function resolveWebSessionVisibleTabId(
+  state: WebSessionVisibleTabState,
+  worktreeId: string,
+  tabs = state.unifiedTabsByWorktree?.[worktreeId] ?? []
+): string | null {
+  const currentType =
+    state.activeTabTypeByWorktree?.[worktreeId] ??
+    (state.activeWorktreeId === worktreeId ? state.activeTabType : null)
+  if (currentType === 'terminal') {
+    const tabId = state.activeTabIdByWorktree?.[worktreeId]
+    return tabId && tabs.some((tab) => tab.id === tabId) ? tabId : null
+  }
+  const entityId =
+    currentType === 'browser'
+      ? state.activeBrowserTabIdByWorktree?.[worktreeId]
+      : currentType === 'editor'
+        ? state.activeFileIdByWorktree?.[worktreeId]
+        : null
+  return (
+    tabs.find((tab) => tab.contentType === currentType && tab.entityId === entityId)?.id ?? null
+  )
+}
+
 function focusIntentPartitionKey(owner: WebSessionIntentOwner, worktreeId: string): string {
   return `${webSessionIntentOwnerKey(owner)}\0${worktreeId}`
 }
@@ -26,7 +62,8 @@ export function recordWebSessionFocusIntent(
   owner: WebSessionIntentOwner,
   worktreeId: string,
   hostTabId: string,
-  leafId?: string
+  leafId?: string,
+  expectedCurrentLocalTabId?: string | null
 ): void {
   const trimmed = hostTabId.trim()
   if (!worktreeId || !trimmed) {
@@ -35,7 +72,8 @@ export function recordWebSessionFocusIntent(
   const trimmedLeafId = leafId?.trim()
   pendingFocusByOwnerAndWorktree.set(focusIntentPartitionKey(owner, worktreeId), {
     hostTabId: trimmed,
-    ...(trimmedLeafId ? { leafId: trimmedLeafId } : {})
+    ...(trimmedLeafId ? { leafId: trimmedLeafId } : {}),
+    ...(expectedCurrentLocalTabId !== undefined ? { expectedCurrentLocalTabId } : {})
   })
 }
 
@@ -50,6 +88,17 @@ export function clearWebSessionFocusIntent(owner: WebSessionIntentOwner, worktre
   pendingFocusByOwnerAndWorktree.delete(focusIntentPartitionKey(owner, worktreeId))
 }
 
+export function clearWebSessionFocusIntentIfMatches(
+  owner: WebSessionIntentOwner,
+  worktreeId: string,
+  hostTabId: string
+): void {
+  const key = focusIntentPartitionKey(owner, worktreeId)
+  if (pendingFocusByOwnerAndWorktree.get(key)?.hostTabId === hostTabId) {
+    pendingFocusByOwnerAndWorktree.delete(key)
+  }
+}
+
 export function clearWebSessionFocusIntentsForOwner(owner: WebSessionIntentOwner): void {
   const prefix = `${webSessionIntentOwnerKey(owner)}\0`
   for (const key of pendingFocusByOwnerAndWorktree.keys()) {
diff --git a/src/renderer/src/runtime/web-session-open-files-batch-equivalence.test.ts b/src/renderer/src/runtime/web-session-open-files-batch-equivalence.test.ts
new file mode 100644
index 00000000000..03433f7761e
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-open-files-batch-equivalence.test.ts
@@ -0,0 +1,214 @@
+/* Why: the batched open-file path reconciles against a slot-keyed draft instead of
+ * rebuilding the global array per snapshot. These seeded cases assert it stays
+ * indistinguishable from repeated single-snapshot reconciliation. */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types'
+import type { OpenFile } from '../store/slices/editor'
+import { resetWebSessionFocusIntentForTests } from './web-session-focus-intent'
+import { resetWebSessionCloseIntentForTests } from './web-session-close-intent'
+import { resetWebSessionReorderIntentForTests } from './web-session-reorder-intent'
+import { resetWebAgentSessionHandoffsForTests } from './web-agent-session-handoff'
+import {
+  applyWebSessionTabsSnapshot,
+  applyWebSessionTabsSnapshots,
+  resetWebSessionTabsSnapshotFreshnessForTests,
+  type WebSessionTabsSyncState
+} from './web-session-tabs-sync'
+
+vi.mock('../store', () => ({ useAppStore: { setState: vi.fn() } }))
+
+const ENV = 'web-env-1'
+const NOW = 1_700_000_000_000
+const WORKTREES = ['repo::/w0', 'repo::/w1', 'repo::/w2', 'repo::/bystander']
+const PATHS = ['/repo/a.ts', '/repo/b.ts', '/repo/c.ts', '/repo/d.ts']
+const ENVS: (string | null | undefined)[] = [ENV, 'other-env', null, undefined]
+
+/** Deterministic LCG so a failing case is reproducible from its seed. */
+function makeRandom(seed: number): () => number {
+  let value = seed >>> 0
+  return () => {
+    value = (value * 1664525 + 1013904223) >>> 0
+    return value / 0x100000000
+  }
+}
+
+function resetModuleState(): void {
+  resetWebSessionTabsSnapshotFreshnessForTests()
+  resetWebSessionFocusIntentForTests()
+  resetWebSessionCloseIntentForTests()
+  resetWebSessionReorderIntentForTests()
+  resetWebAgentSessionHandoffsForTests()
+}
+
+function baseState(overrides: Partial<WebSessionTabsSyncState>): WebSessionTabsSyncState {
+  return {
+    activeBrowserTabId: null,
+    activeBrowserTabIdByWorktree: {},
+    activeFileId: null,
+    activeFileIdByWorktree: {},
+    activeGroupIdByWorktree: {},
+    activeTabId: null,
+    activeTabIdByWorktree: {},
+    activeTabType: 'terminal',
+    activeTabTypeByWorktree: {},
+    activeWorktreeId: WORKTREES[0]!,
+    agentStatusByPaneKey: {},
+    agentStatusEpoch: 0,
+    browserCertificateFailuresByPageId: {},
+    browserPagesByWorkspace: {},
+    browserTabsByWorktree: {},
+    groupsByWorktree: {},
+    layoutByWorktree: {},
+    openFiles: [],
+    ptyIdsByTabId: {},
+    remoteBrowserPageHandlesByPageId: {},
+    tabBarOrderByWorktree: {},
+    tabsByWorktree: {},
+    terminalLayoutsByTabId: {},
+    unifiedTabsByWorktree: {},
+    unreadTerminalTabs: {},
+    sortEpoch: 0,
+    ...overrides
+  }
+}
+
+function pick<T>(random: () => number, items: readonly T[]): T {
+  return items[Math.floor(random() * items.length)]!
+}
+
+function makeCase(seed: number): {
+  state: WebSessionTabsSyncState
+  snapshots: RuntimeMobileSessionTabsResult[]
+} {
+  const random = makeRandom(seed)
+  const openFiles: OpenFile[] = []
+  const fileCount = Math.floor(random() * 9)
+  for (let i = 0; i < fileCount; i += 1) {
+    const path = pick(random, PATHS)
+    const isPreview = random() < 0.2
+    openFiles.push({
+      id: isPreview ? `markdown-preview::${path}` : path,
+      filePath: path,
+      relativePath: path.slice('/repo/'.length),
+      worktreeId: pick(random, WORKTREES),
+      language: 'typescript',
+      isDirty: random() < 0.5,
+      runtimeEnvironmentId: pick(random, ENVS),
+      mode: isPreview ? 'markdown-preview' : 'edit',
+      mirroredFromRuntimeSession: random() < 0.7,
+      // Why: the mirrored file overwrites every compared field, so only a preserved
+      // field like this can reveal which duplicate seeded it.
+      lastKnownDiskSignature: `sig-${seed}-${i}`
+    } as OpenFile)
+  }
+
+  const snapshots: RuntimeMobileSessionTabsResult[] = []
+  const snapshotCount = 1 + Math.floor(random() * 7)
+  for (let s = 0; s < snapshotCount; s += 1) {
+    const worktree = pick(random, WORKTREES)
+    const tabs: RuntimeMobileSessionTabsResult['tabs'] = []
+    const editorCount = Math.floor(random() * 4)
+    const usedPaths = new Set<string>()
+    for (let e = 0; e < editorCount; e += 1) {
+      const path = pick(random, PATHS)
+      if (usedPaths.has(path)) {
+        continue
+      }
+      usedPaths.add(path)
+      const relativePath = path.slice('/repo/'.length)
+      tabs.push(
+        random() < 0.25
+          ? ({
+              type: 'markdown',
+              id: `host-md-${s}-${e}`,
+              title: relativePath,
+              filePath: path,
+              relativePath,
+              language: 'markdown',
+              mode: 'markdown-preview',
+              isDirty: false,
+              isActive: e === 0,
+              sourceFileId: path,
+              sourceFilePath: path,
+              sourceRelativePath: relativePath,
+              documentVersion: `file:${path}`
+            } as RuntimeMobileSessionTabsResult['tabs'][number])
+          : ({
+              type: 'file',
+              id: `host-file-${s}-${e}`,
+              title: relativePath,
+              filePath: path,
+              relativePath,
+              language: 'typescript',
+              isDirty: random() < 0.5,
+              isActive: e === 0
+            } as RuntimeMobileSessionTabsResult['tabs'][number])
+      )
+    }
+    const activeTab = tabs[0]
+    snapshots.push({
+      worktree,
+      publicationEpoch: 'epoch-1',
+      snapshotVersion: s + 1,
+      activeGroupId: `host-group-${worktree}`,
+      activeTabId: activeTab?.id ?? null,
+      activeTabType: activeTab ? (activeTab.type === 'markdown' ? 'markdown' : 'file') : null,
+      tabs
+    })
+  }
+
+  const activeFile = openFiles[Math.floor(random() * Math.max(openFiles.length, 1))]
+  return {
+    state: baseState({
+      openFiles,
+      activeFileId: activeFile?.id ?? null,
+      activeFileIdByWorktree: activeFile ? { [activeFile.worktreeId]: activeFile.id } : {},
+      activeTabTypeByWorktree: activeFile ? { [activeFile.worktreeId]: 'editor' } : {},
+      activeWorktreeId: pick(random, WORKTREES)
+    }),
+    snapshots
+  }
+}
+
+describe('batched open-file reconciliation', () => {
+  beforeEach(() => {
+    resetModuleState()
+  })
+
+  it('matches repeated single-snapshot reconciliation for every seeded case', () => {
+    const divergences: string[] = []
+    for (let seed = 1; seed <= 400; seed += 1) {
+      const { state, snapshots } = makeCase(seed)
+      const stateCopy = structuredClone(state)
+
+      resetModuleState()
+      let sequential = state
+      for (const snapshot of snapshots) {
+        const patch = applyWebSessionTabsSnapshot(sequential, snapshot, ENV, NOW)
+        if (patch !== sequential) {
+          sequential = { ...sequential, ...patch }
+        }
+      }
+
+      resetModuleState()
+      const batched = {
+        ...state,
+        ...applyWebSessionTabsSnapshots(state, snapshots, ENV, NOW)
+      }
+
+      try {
+        expect(batched.openFiles).toEqual(sequential.openFiles)
+        expect(batched.activeFileId).toEqual(sequential.activeFileId)
+        expect(batched.activeFileIdByWorktree).toEqual(sequential.activeFileIdByWorktree)
+        expect(batched.activeTabTypeByWorktree).toEqual(sequential.activeTabTypeByWorktree)
+        expect(batched.unifiedTabsByWorktree).toEqual(sequential.unifiedTabsByWorktree)
+        expect(state).toEqual(stateCopy)
+      } catch (error) {
+        divergences.push(
+          `seed ${seed}: ${error instanceof Error ? error.message.split('\n')[0] : String(error)}`
+        )
+      }
+    }
+    expect(divergences).toEqual([])
+  })
+})
diff --git a/src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts b/src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts
new file mode 100644
index 00000000000..317065d7c81
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts
@@ -0,0 +1,389 @@
+import { beforeEach, describe, expect, it } from 'vitest'
+import { createStore } from 'zustand/vanilla'
+import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types'
+import { toWebTerminalSurfaceTabId } from '../../../shared/terminal-surface-id'
+import type { BrowserCertificateFailure } from '../../../shared/types'
+import {
+  applyWebSessionTabsSnapshot,
+  applyWebSessionTabsSnapshots,
+  applyFreshWebSessionTabsSnapshot,
+  resetWebSessionTabsSnapshotFreshnessForTests,
+  type WebSessionTabsSyncState
+} from './web-session-tabs-sync'
+
+const ENVIRONMENT_ID = 'web-env-1'
+const NOW = 1_700_000_000_000
+const WORKTREE_A = 'repo::/worktree-a'
+const WORKTREE_B = 'repo::/worktree-b'
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const HOST_TAB_ID = 'host-tab-1'
+const MIRRORED_TAB_ID = toWebTerminalSurfaceTabId(HOST_TAB_ID)
+
+const CERTIFICATE_FAILURE: BrowserCertificateFailure = {
+  challengeId: 'challenge-1',
+  browserPageId: 'host-browser-page-1',
+  errorCode: -202,
+  error: 'ERR_CERT_AUTHORITY_INVALID',
+  origin: 'https://localhost:3443',
+  displayHost: 'localhost:3443',
+  canProceed: true,
+  observedAt: 123
+}
+
+function makeState(overrides: Partial<WebSessionTabsSyncState> = {}): WebSessionTabsSyncState {
+  return {
+    activeBrowserTabId: null,
+    activeBrowserTabIdByWorktree: {},
+    activeFileId: null,
+    activeFileIdByWorktree: {},
+    activeGroupIdByWorktree: {},
+    activeTabId: null,
+    activeTabIdByWorktree: {},
+    activeTabType: 'terminal',
+    activeTabTypeByWorktree: {},
+    activeWorktreeId: null,
+    agentStatusByPaneKey: {},
+    agentStatusEpoch: 0,
+    browserCertificateFailuresByPageId: {},
+    browserPagesByWorkspace: {},
+    browserTabsByWorktree: {},
+    groupsByWorktree: {},
+    layoutByWorktree: {},
+    openFiles: [],
+    ptyIdsByTabId: {},
+    remoteBrowserPageHandlesByPageId: {},
+    tabBarOrderByWorktree: {},
+    tabsByWorktree: {},
+    terminalLayoutsByTabId: {},
+    unifiedTabsByWorktree: {},
+    unreadTerminalTabs: {},
+    sortEpoch: 0,
+    ...overrides
+  }
+}
+
+function makeSnapshot(
+  worktree: string,
+  tabs: RuntimeMobileSessionTabsResult['tabs'],
+  activeTabType: RuntimeMobileSessionTabsResult['activeTabType'] = 'terminal'
+): RuntimeMobileSessionTabsResult {
+  return {
+    worktree,
+    publicationEpoch: 'epoch-1',
+    snapshotVersion: 1,
+    activeGroupId: `group:${worktree}`,
+    activeTabId: tabs.find((tab) => tab.isActive)?.id ?? null,
+    activeTabType,
+    tabs
+  }
+}
+
+function makeTerminalSnapshot(
+  options: {
+    worktree?: string
+    title?: string
+    terminal?: string | null
+  } = {}
+): RuntimeMobileSessionTabsResult {
+  const worktree = options.worktree ?? WORKTREE_A
+  const terminal = options.terminal === undefined ? 'terminal-1' : options.terminal
+  return makeSnapshot(worktree, [
+    {
+      type: 'terminal',
+      id: `${HOST_TAB_ID}::${LEAF_ID}`,
+      parentTabId: HOST_TAB_ID,
+      leafId: LEAF_ID,
+      title: options.title ?? 'host shell',
+      isActive: true,
+      ...(terminal === null
+        ? { status: 'pending-handle' as const, terminal: null }
+        : { status: 'ready' as const, terminal })
+    }
+  ])
+}
+
+function makeBrowserSnapshot(
+  options: {
+    worktree?: string
+    pageId?: string
+    tabId?: string
+    workspaceId?: string
+    title?: string
+    url?: string
+    loading?: boolean
+    certificateFailure?: BrowserCertificateFailure | null
+  } = {}
+): RuntimeMobileSessionTabsResult {
+  const worktree = options.worktree ?? WORKTREE_A
+  const pageId = options.pageId ?? 'host-browser-page-1'
+  const certificateFailure =
+    options.certificateFailure === undefined
+      ? { ...CERTIFICATE_FAILURE, browserPageId: pageId }
+      : options.certificateFailure
+        ? { ...options.certificateFailure }
+        : null
+  return makeSnapshot(
+    worktree,
+    [
+      {
+        type: 'browser',
+        id: options.tabId ?? 'host-browser-tab',
+        browserWorkspaceId: options.workspaceId ?? 'host-browser-workspace',
+        browserPageId: pageId,
+        title: options.title ?? 'Example Domain',
+        url: options.url ?? 'https://example.com/',
+        loading: options.loading ?? false,
+        canGoBack: false,
+        canGoForward: false,
+        certificateFailure,
+        isActive: true
+      }
+    ],
+    'browser'
+  )
+}
+
+function applySnapshot(
+  state: WebSessionTabsSyncState,
+  snapshot: RuntimeMobileSessionTabsResult,
+  now = NOW
+): WebSessionTabsSyncState {
+  const patch = applyWebSessionTabsSnapshot(state, snapshot, ENVIRONMENT_ID, now)
+  return patch === state ? state : { ...state, ...patch }
+}
+
+describe('remote mirror resource identity', () => {
+  beforeEach(() => {
+    resetWebSessionTabsSnapshotFreshnessForTests()
+  })
+
+  it('keeps PTY arrays and layouts stable on an exact terminal replay', () => {
+    const state = applySnapshot(makeState(), makeTerminalSnapshot())
+    const ptyIds = state.ptyIdsByTabId
+    const layouts = state.terminalLayoutsByTabId
+
+    const replayed = applyWebSessionTabsSnapshot(
+      state,
+      makeTerminalSnapshot(),
+      ENVIRONMENT_ID,
+      NOW + 1
+    )
+
+    expect(replayed).toBe(state)
+    expect(state.ptyIdsByTabId).toBe(ptyIds)
+    expect(state.terminalLayoutsByTabId).toBe(layouts)
+  })
+
+  it('updates terminal metadata without replacing PTY arrays or layouts', () => {
+    const state = applySnapshot(makeState(), makeTerminalSnapshot())
+    const patch = applyWebSessionTabsSnapshot(
+      state,
+      makeTerminalSnapshot({ title: 'renamed shell' }),
+      ENVIRONMENT_ID,
+      NOW + 1
+    )
+    const next = { ...state, ...patch }
+
+    expect(next.tabsByWorktree[WORKTREE_A]?.[0]?.title).toBe('renamed shell')
+    expect(next.ptyIdsByTabId).toBe(state.ptyIdsByTabId)
+    expect(next.terminalLayoutsByTabId).toBe(state.terminalLayoutsByTabId)
+  })
+
+  it('clears unread state on replay without replacing PTY arrays or layouts', () => {
+    const hydrated = applySnapshot(makeState(), makeTerminalSnapshot())
+    const state = {
+      ...hydrated,
+      unreadTerminalTabs: { [MIRRORED_TAB_ID]: true as const }
+    }
+    const next = applySnapshot(state, makeTerminalSnapshot(), NOW + 1)
+
+    expect(next.unreadTerminalTabs).not.toHaveProperty(MIRRORED_TAB_ID)
+    expect(next.ptyIdsByTabId).toBe(state.ptyIdsByTabId)
+    expect(next.terminalLayoutsByTabId).toBe(state.terminalLayoutsByTabId)
+  })
+
+  it('replaces PTY arrays and layouts when the host rotates the handle', () => {
+    const state = applySnapshot(makeState(), makeTerminalSnapshot())
+    const next = applySnapshot(state, makeTerminalSnapshot({ terminal: 'terminal-2' }), NOW + 1)
+
+    expect(next.ptyIdsByTabId).not.toBe(state.ptyIdsByTabId)
+    expect(next.terminalLayoutsByTabId).not.toBe(state.terminalLayoutsByTabId)
+    expect(next.ptyIdsByTabId[MIRRORED_TAB_ID]).toEqual(['remote:web-env-1@@terminal-2'])
+    expect(next.terminalLayoutsByTabId[MIRRORED_TAB_ID]?.ptyIdsByLeafId).toEqual({
+      [LEAF_ID]: 'remote:web-env-1@@terminal-2'
+    })
+  })
+
+  it('removes the PTY key when a ready terminal becomes pending', () => {
+    const state = applySnapshot(makeState(), makeTerminalSnapshot())
+    const next = applySnapshot(state, makeTerminalSnapshot({ terminal: null }), NOW + 1)
+
+    expect(next.ptyIdsByTabId).not.toBe(state.ptyIdsByTabId)
+    expect(next.ptyIdsByTabId).not.toHaveProperty(MIRRORED_TAB_ID)
+    expect(next.terminalLayoutsByTabId[MIRRORED_TAB_ID]?.ptyIdsByLeafId).toEqual({})
+  })
+
+  it('cleans up terminal resources and unread state when the host omits the tab', () => {
+    const hydrated = applySnapshot(makeState(), makeTerminalSnapshot())
+    const state = {
+      ...hydrated,
+      unreadTerminalTabs: { [MIRRORED_TAB_ID]: true as const }
+    }
+    const next = applySnapshot(state, makeSnapshot(WORKTREE_A, [], null), NOW + 1)
+
+    expect(next.ptyIdsByTabId).not.toHaveProperty(MIRRORED_TAB_ID)
+    expect(next.terminalLayoutsByTabId).not.toHaveProperty(MIRRORED_TAB_ID)
+    expect(next.unreadTerminalTabs).not.toHaveProperty(MIRRORED_TAB_ID)
+  })
+
+  it('keeps browser pages, handles, and certificate failures stable on exact replay', () => {
+    const state = applySnapshot(makeState(), makeBrowserSnapshot())
+
+    const replayed = applyWebSessionTabsSnapshot(
+      state,
+      makeBrowserSnapshot(),
+      ENVIRONMENT_ID,
+      NOW + 1
+    )
+
+    expect(replayed).toBe(state)
+  })
+
+  it('updates browser metadata without replacing handles or certificate failures', () => {
+    const state = applySnapshot(makeState(), makeBrowserSnapshot())
+    const next = applySnapshot(
+      state,
+      makeBrowserSnapshot({
+        title: 'Changed title',
+        url: 'https://example.com/changed',
+        loading: true
+      }),
+      NOW + 1
+    )
+
+    expect(next.browserPagesByWorkspace).not.toBe(state.browserPagesByWorkspace)
+    expect(next.remoteBrowserPageHandlesByPageId).toBe(state.remoteBrowserPageHandlesByPageId)
+    expect(next.browserCertificateFailuresByPageId).toBe(state.browserCertificateFailuresByPageId)
+  })
+
+  it('clears a same-page certificate failure without replacing its page or handle', () => {
+    const state = applySnapshot(makeState(), makeBrowserSnapshot())
+    const next = applySnapshot(state, makeBrowserSnapshot({ certificateFailure: null }), NOW + 1)
+
+    expect(next.browserPagesByWorkspace).toBe(state.browserPagesByWorkspace)
+    expect(next.remoteBrowserPageHandlesByPageId).toBe(state.remoteBrowserPageHandlesByPageId)
+    expect(next.browserCertificateFailuresByPageId).not.toBe(
+      state.browserCertificateFailuresByPageId
+    )
+    expect(next.browserCertificateFailuresByPageId).not.toHaveProperty('host-browser-page-1')
+  })
+
+  it('cleans up replaced browser page handles and certificate failures', () => {
+    const state = applySnapshot(makeState(), makeBrowserSnapshot())
+    const next = applySnapshot(
+      state,
+      makeBrowserSnapshot({
+        pageId: 'host-browser-page-2',
+        certificateFailure: null
+      }),
+      NOW + 1
+    )
+
+    expect(next.browserPagesByWorkspace['host-browser-workspace']?.map((page) => page.id)).toEqual([
+      'host-browser-page-2'
+    ])
+    expect(next.remoteBrowserPageHandlesByPageId).not.toHaveProperty('host-browser-page-1')
+    expect(next.remoteBrowserPageHandlesByPageId['host-browser-page-2']).toEqual({
+      environmentId: ENVIRONMENT_ID,
+      remotePageId: 'host-browser-page-2'
+    })
+    expect(next.browserCertificateFailuresByPageId).not.toHaveProperty('host-browser-page-1')
+  })
+
+  it('keeps resource maps stable across an unchanged multi-worktree browser batch', () => {
+    const snapshots = [
+      makeBrowserSnapshot({ worktree: WORKTREE_A }),
+      makeBrowserSnapshot({
+        worktree: WORKTREE_B,
+        tabId: 'host-browser-tab-2',
+        workspaceId: 'host-browser-workspace-2',
+        pageId: 'host-browser-page-2'
+      })
+    ]
+    const initial = applyWebSessionTabsSnapshots(makeState(), snapshots, ENVIRONMENT_ID, NOW)
+    const state = { ...makeState(), ...initial }
+
+    const replayed = applyWebSessionTabsSnapshots(state, snapshots, ENVIRONMENT_ID, NOW + 1)
+
+    expect(replayed).toBe(state)
+  })
+
+  it('preserves unchanged browser resources when a sibling worktree replaces its page', () => {
+    const worktreeBSnapshot = makeBrowserSnapshot({
+      worktree: WORKTREE_B,
+      tabId: 'host-browser-tab-2',
+      workspaceId: 'host-browser-workspace-2',
+      pageId: 'host-browser-page-2'
+    })
+    const initial = applyWebSessionTabsSnapshots(
+      makeState(),
+      [makeBrowserSnapshot(), worktreeBSnapshot],
+      ENVIRONMENT_ID,
+      NOW
+    )
+    const state = { ...makeState(), ...initial }
+    const pages = state.browserPagesByWorkspace['host-browser-workspace-2']
+    const page = pages?.[0]
+    const handle = state.remoteBrowserPageHandlesByPageId['host-browser-page-2']
+    const certificate = state.browserCertificateFailuresByPageId['host-browser-page-2']
+
+    const patch = applyWebSessionTabsSnapshots(
+      state,
+      [
+        makeBrowserSnapshot({ pageId: 'host-browser-page-3', certificateFailure: null }),
+        worktreeBSnapshot
+      ],
+      ENVIRONMENT_ID,
+      NOW + 1
+    )
+    const next = { ...state, ...patch }
+
+    expect(next.browserPagesByWorkspace['host-browser-workspace-2']).toBe(pages)
+    expect(next.browserPagesByWorkspace['host-browser-workspace-2']?.[0]).toBe(page)
+    expect(next.remoteBrowserPageHandlesByPageId['host-browser-page-2']).toBe(handle)
+    expect(next.browserCertificateFailuresByPageId['host-browser-page-2']).toBe(certificate)
+  })
+
+  it('emits no store updates for 128 accepted identical resource frames', () => {
+    const terminal = makeTerminalSnapshot()
+    const browser = makeBrowserSnapshot()
+    const snapshot = {
+      ...browser,
+      tabs: [...terminal.tabs.map((tab) => ({ ...tab, isActive: false })), ...browser.tabs]
+    }
+    const store = createStore<WebSessionTabsSyncState>(() => makeState())
+    let notifications = 0
+    store.subscribe(() => {
+      notifications += 1
+    })
+    store.setState((state) =>
+      applyFreshWebSessionTabsSnapshot(state, snapshot, ENVIRONMENT_ID, NOW)
+    )
+    notifications = 0
+    const initial = store.getState()
+
+    for (let snapshotVersion = 2; snapshotVersion <= 129; snapshotVersion += 1) {
+      store.setState((state) =>
+        applyFreshWebSessionTabsSnapshot(
+          state,
+          { ...snapshot, snapshotVersion },
+          ENVIRONMENT_ID,
+          NOW + snapshotVersion
+        )
+      )
+    }
+
+    expect(notifications).toBe(0)
+    expect(store.getState()).toBe(initial)
+  })
+})
diff --git a/src/renderer/src/runtime/web-session-tabs-sync-remote-status-title-flap.test.ts b/src/renderer/src/runtime/web-session-tabs-sync-remote-status-title-flap.test.ts
index 412911617df..d33c6f80b5d 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync-remote-status-title-flap.test.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync-remote-status-title-flap.test.ts
@@ -59,8 +59,9 @@ import {
   resetRendererOwnedAgentStatusPanesForTests
 } from '../components/terminal-pane/renderer-owned-agent-status-registry'
 import {
-  applyFreshWebSessionTabsSnapshot,
-  resetWebSessionTabsSnapshotFreshnessForTests
+  applyWebSessionTabsSnapshot,
+  resetWebSessionTabsSnapshotFreshnessForTests,
+  shouldApplyWebSessionTabsSnapshot
 } from './web-session-tabs-sync'
 
 // Why: web-session-tabs-sync imports the app-level store singleton; this
@@ -148,9 +149,9 @@ function applyHostSnapshot(
   now: number
 ): void {
   const state = store.getState()
-  const patch = applyFreshWebSessionTabsSnapshot(state, snapshot, ENV, now)
   // The freshness gate must accept every republished frame (monotonic version).
-  expect(patch).not.toBe(state)
+  expect(shouldApplyWebSessionTabsSnapshot(snapshot, ENV)).toBe(true)
+  const patch = applyWebSessionTabsSnapshot(state, snapshot, ENV, now)
   store.setState(patch as Partial<AppState>)
 }
 
diff --git a/src/renderer/src/runtime/web-session-tabs-sync-visibility-collision.test.tsx b/src/renderer/src/runtime/web-session-tabs-sync-visibility-collision.test.tsx
new file mode 100644
index 00000000000..5b05ba2536d
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-tabs-sync-visibility-collision.test.tsx
@@ -0,0 +1,698 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { makePaneKey } from '../../../shared/stable-pane-id'
+import { toWebTerminalSurfaceTabId } from '../../../shared/terminal-surface-id'
+import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types'
+import { resetStaleDocumentVisibilityForTesting } from '@/components/terminal-pane/stale-document-visibility'
+import type * as WorktreeRuntimeOwnerModule from '@/lib/worktree-runtime-owner'
+import type * as WebRuntimeSessionModule from './web-runtime-session'
+
+const mocks = vi.hoisted(() => ({
+  createTerminal: vi.fn(),
+  getExplicitRuntimeEnvironmentIdForWorktree: vi.fn(),
+  recoverSnapshot: vi.fn(),
+  runtimeSessionMirrorEnvironmentKey: vi.fn()
+}))
+
+vi.mock('./use-runtime-session-mirror-environment-key', () => ({
+  useRuntimeSessionMirrorEnvironmentKey: mocks.runtimeSessionMirrorEnvironmentKey
+}))
+
+vi.mock('@/lib/worktree-runtime-owner', async (importOriginal) => {
+  const actual = await importOriginal<typeof WorktreeRuntimeOwnerModule>()
+  return {
+    ...actual,
+    getExplicitRuntimeEnvironmentIdForWorktree: mocks.getExplicitRuntimeEnvironmentIdForWorktree
+  }
+})
+
+vi.mock('./web-session-terminal-orphan-recovery', () => ({
+  recoverWebSessionTerminalOrphansBeforeApply: mocks.recoverSnapshot
+}))
+
+vi.mock('./web-runtime-session', async (importOriginal) => {
+  const actual = await importOriginal<typeof WebRuntimeSessionModule>()
+  return { ...actual, createWebRuntimeSessionTerminal: mocks.createTerminal }
+})
+
+import { useAppStore } from '@/store'
+import type { AppState } from '@/store/types'
+import { replaceRuntimeEnvironmentRevisions } from './runtime-environment-revision'
+import { toRemoteRuntimePtyId } from './runtime-terminal-stream'
+import { subscribeAcceptedWebSessionTerminalHandle } from './web-session-terminal-handle-events'
+import {
+  _getWebSessionTabsRecoveryTrackingCountsForTest,
+  _getWebSessionTabsTrackingCountsForTest,
+  resetWebSessionTabsSnapshotFreshnessForTests,
+  useWebSessionTabsSync,
+  WEB_SESSION_TABS_VISIBILITY_RESUME_STAGGER_MS
+} from './web-session-tabs-sync'
+import { WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS } from './window-visibility-subscription-parking'
+
+const ENV_A = 'env-a'
+const ENV_B = 'env-b'
+const WORKTREE = 'repo-a::worktree-a'
+const REVISION_A = 101
+const REVISION_B = 201
+const LEAF_A = '11111111-1111-4111-8111-111111111111'
+const LEAF_B = '22222222-2222-4222-8222-222222222222'
+const MIRROR_KEY = `${ENV_A}\u0001runtime-a\u00011\u0001${REVISION_A}\u0000${ENV_B}\u0001runtime-b\u00012\u0001${REVISION_B}`
+const initialState = useAppStore.getInitialState()
+
+type RuntimeSubscribe = typeof window.api.runtimeEnvironments.subscribe
+type RuntimeSubscription = {
+  request: Parameters<RuntimeSubscribe>[0]
+  callbacks: Parameters<RuntimeSubscribe>[1]
+  unsubscribe: ReturnType<typeof vi.fn>
+}
+
+type Deferred<T> = {
+  promise: Promise<T>
+  resolve: (value: T) => void
+}
+
+const subscriptions: RuntimeSubscription[] = []
+const runtimeCall = vi.fn(async () => ({
+  id: 'list-all',
+  ok: true as const,
+  result: { snapshots: [] },
+  _meta: { runtimeId: 'runtime-test' }
+}))
+const runtimeSubscribe = vi.fn<RuntimeSubscribe>(async (request, callbacks) => {
+  const unsubscribe = vi.fn()
+  subscriptions.push({ request, callbacks, unsubscribe })
+  return { unsubscribe, sendBinary: vi.fn() }
+})
+
+function createDeferred<T>(): Deferred<T> {
+  let resolve = (_value: T): void => {}
+  const promise = new Promise<T>((done) => {
+    resolve = done
+  })
+  return { promise, resolve }
+}
+
+function makeTerminalSnapshot(
+  idSuffix: string,
+  snapshotVersion = 1
+): RuntimeMobileSessionTabsResult {
+  const parentTabId = `host-tab${idSuffix}`
+  const leafId = idSuffix === '-a' ? LEAF_A : LEAF_B
+  return {
+    worktree: WORKTREE,
+    publicationEpoch: 'epoch-1',
+    snapshotVersion,
+    activeGroupId: `host-group${idSuffix}`,
+    activeTabId: `host-surface${idSuffix}`,
+    activeTabType: 'terminal',
+    tabs: [
+      {
+        type: 'terminal',
+        id: `host-surface${idSuffix}`,
+        parentTabId,
+        leafId,
+        title: `Terminal ${idSuffix}`,
+        status: 'ready',
+        terminal: `terminal${idSuffix}`,
+        isActive: true,
+        agentStatus: {
+          state: 'working',
+          prompt: 'build',
+          updatedAt: 100,
+          stateStartedAt: 90,
+          agentType: 'codex',
+          paneKey: `${parentTabId}:${leafId}`,
+          tabId: parentTabId,
+          worktreeId: WORKTREE,
+          stateHistory: []
+        }
+      }
+    ]
+  }
+}
+
+function makeEditorSnapshot(idSuffix: string): RuntimeMobileSessionTabsResult {
+  const filePath = `/repo${idSuffix}/README.md`
+  return {
+    worktree: WORKTREE,
+    publicationEpoch: 'epoch-1',
+    snapshotVersion: 1,
+    activeGroupId: `host-group${idSuffix}`,
+    activeTabId: `host-editor${idSuffix}`,
+    activeTabType: 'markdown',
+    tabs: [
+      {
+        type: 'markdown',
+        id: `host-editor${idSuffix}`,
+        title: `README ${idSuffix}`,
+        filePath,
+        relativePath: 'README.md',
+        language: 'markdown',
+        mode: 'edit',
+        isDirty: false,
+        isActive: true,
+        sourceFileId: filePath,
+        sourceFilePath: filePath,
+        sourceRelativePath: 'README.md',
+        documentVersion: `file:${filePath}`
+      }
+    ]
+  }
+}
+
+function setDocumentVisibility(state: 'visible' | 'hidden'): void {
+  Object.defineProperty(document, 'visibilityState', {
+    configurable: true,
+    get: () => state
+  })
+  document.dispatchEvent(new Event('visibilitychange'))
+}
+
+async function settle(): Promise<void> {
+  await Promise.resolve()
+  await Promise.resolve()
+  await Promise.resolve()
+}
+
+async function settleGlobalMirrorResumeStarts(): Promise<void> {
+  act(() => vi.advanceTimersByTime(WEB_SESSION_TABS_VISIBILITY_RESUME_STAGGER_MS))
+  await act(settle)
+}
+
+function findGlobalSubscription(environmentId: string, occurrence = 0): RuntimeSubscription {
+  const matches = subscriptions.filter(
+    ({ request }) =>
+      request.method === 'session.tabs.subscribeAll' && request.selector === environmentId
+  )
+  const subscription = matches[occurrence]
+  if (!subscription) {
+    throw new Error(`Missing global subscription ${occurrence} for ${environmentId}`)
+  }
+  return subscription
+}
+
+function findActiveSubscription(environmentId: string, occurrence = 0): RuntimeSubscription {
+  const matches = subscriptions.filter(
+    ({ request }) =>
+      request.method === 'session.tabs.subscribe' && request.selector === environmentId
+  )
+  const subscription = matches[occurrence]
+  if (!subscription) {
+    throw new Error(`Missing active subscription ${occurrence} for ${environmentId}`)
+  }
+  return subscription
+}
+
+async function publish(subscription: RuntimeSubscription, result: unknown): Promise<void> {
+  await act(async () => {
+    subscription.callbacks.onResponse({
+      id: 'subscription-event',
+      ok: true,
+      result,
+      _meta: { runtimeId: 'runtime-test' }
+    })
+    await settle()
+  })
+}
+
+function seedRemoteMirrorState(): void {
+  const runtimeEnvironments = [
+    { id: ENV_A, createdAt: 100, pairingRevision: REVISION_A },
+    { id: ENV_B, createdAt: 200, pairingRevision: REVISION_B }
+  ] as AppState['runtimeEnvironments']
+  replaceRuntimeEnvironmentRevisions(runtimeEnvironments)
+  useAppStore.setState(
+    {
+      ...initialState,
+      activeWorktreeId: WORKTREE,
+      workspaceSessionReady: true,
+      runtimeEnvironments,
+      runtimeStatusByEnvironmentId: new Map([
+        [ENV_A, { status: { runtimeId: 'runtime-a' }, connectionGeneration: 1 }],
+        [ENV_B, { status: { runtimeId: 'runtime-b' }, connectionGeneration: 2 }]
+      ]) as AppState['runtimeStatusByEnvironmentId']
+    },
+    true
+  )
+}
+
+describe('useWebSessionTabsSync visibility collision recovery', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    subscriptions.length = 0
+    runtimeCall.mockClear()
+    runtimeSubscribe.mockClear()
+    mocks.createTerminal.mockReset().mockResolvedValue(undefined)
+    mocks.recoverSnapshot.mockReset().mockImplementation(async (_state, snapshot) => snapshot)
+    mocks.getExplicitRuntimeEnvironmentIdForWorktree.mockReset().mockReturnValue(ENV_A)
+    mocks.runtimeSessionMirrorEnvironmentKey.mockReset().mockReturnValue(MIRROR_KEY)
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: { runtimeEnvironments: { call: runtimeCall, subscribe: runtimeSubscribe } }
+    })
+    setDocumentVisibility('visible')
+    resetWebSessionTabsSnapshotFreshnessForTests()
+    seedRemoteMirrorState()
+  })
+
+  afterEach(() => {
+    cleanup()
+    useAppStore.setState(initialState, true)
+    replaceRuntimeEnvironmentRevisions([])
+    resetWebSessionTabsSnapshotFreshnessForTests()
+    resetStaleDocumentVisibilityForTesting()
+    setDocumentVisibility('visible')
+    vi.useRealTimers()
+  })
+
+  it('resumes the active host before lexicographically earlier global mirrors', async () => {
+    mocks.getExplicitRuntimeEnvironmentIdForWorktree.mockReturnValue(ENV_B)
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await act(settle)
+    const globalSubscriptionCount = (environmentId: string): number =>
+      subscriptions.filter(
+        ({ request }) =>
+          request.method === 'session.tabs.subscribeAll' && request.selector === environmentId
+      ).length
+    expect(globalSubscriptionCount(ENV_B)).toBe(2)
+    expect(globalSubscriptionCount(ENV_A)).toBe(1)
+
+    act(() => vi.advanceTimersByTime(WEB_SESSION_TABS_VISIBILITY_RESUME_STAGGER_MS - 1))
+    expect(globalSubscriptionCount(ENV_A)).toBe(1)
+    act(() => vi.advanceTimersByTime(1))
+    await act(settle)
+    expect(globalSubscriptionCount(ENV_A)).toBe(2)
+    hook.unmount()
+  })
+
+  it('replays a surviving terminal host after a later omitted-host tombstone', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    await publish(findGlobalSubscription(ENV_A), {
+      type: 'snapshots',
+      snapshots: [makeTerminalSnapshot('-a')]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await settleGlobalMirrorResumeStarts()
+    await publish(findGlobalSubscription(ENV_B, 1), {
+      type: 'snapshots',
+      snapshots: [makeTerminalSnapshot('-b')]
+    })
+    await publish(findGlobalSubscription(ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+
+    const state = useAppStore.getState()
+    const tabId = toWebTerminalSurfaceTabId('host-tab-b')
+    const paneKey = makePaneKey(tabId, LEAF_B)
+    expect(state.tabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual([tabId])
+    expect(state.ptyIdsByTabId[tabId]).toEqual([toRemoteRuntimePtyId('terminal-b', ENV_B)])
+    expect(state.terminalLayoutsByTabId[tabId]?.activeLeafId).toBe(LEAF_B)
+    expect(state.unifiedTabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual([tabId])
+    expect(state.tabBarOrderByWorktree[WORKTREE]).toEqual([tabId])
+    expect(state.activeTabIdByWorktree[WORKTREE]).toBe(tabId)
+    expect(state.groupsByWorktree[WORKTREE]?.flatMap((group) => group.tabOrder)).toEqual([tabId])
+    expect(state.agentStatusByPaneKey[paneKey]?.state).toBe('working')
+    hook.unmount()
+  })
+
+  it('publishes terminal-handle evidence for an unchanged resume inventory', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const snapshot = makeTerminalSnapshot('-a')
+    await publish(findGlobalSubscription(ENV_A), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+    const tabsByWorktree = useAppStore.getState().tabsByWorktree
+    const listener = vi.fn()
+    const unsubscribe = subscribeAcceptedWebSessionTerminalHandle(
+      { environmentId: ENV_A, worktreeId: WORKTREE, hostTabId: 'host-tab-a', leafId: LEAF_A },
+      listener
+    )
+    mocks.recoverSnapshot.mockClear()
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await settleGlobalMirrorResumeStarts()
+    await publish(findGlobalSubscription(ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+
+    expect(mocks.recoverSnapshot).not.toHaveBeenCalled()
+    expect(useAppStore.getState().tabsByWorktree).toBe(tabsByWorktree)
+    expect(listener).toHaveBeenCalledWith({ surfacePresent: true, terminalHandle: 'terminal-a' })
+    unsubscribe()
+    hook.unmount()
+  })
+
+  it('replays a surviving editor host after a later omitted-host tombstone', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    await publish(findGlobalSubscription(ENV_A), {
+      type: 'snapshots',
+      snapshots: [makeEditorSnapshot('-a')]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await settleGlobalMirrorResumeStarts()
+    await publish(findGlobalSubscription(ENV_B, 1), {
+      type: 'snapshots',
+      snapshots: [makeEditorSnapshot('-b')]
+    })
+    await publish(findGlobalSubscription(ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+
+    const state = useAppStore.getState()
+    const fileId = '/repo-b/README.md'
+    expect(
+      state.openFiles
+        .filter((file) => file.worktreeId === WORKTREE)
+        .map((file) => [file.id, file.runtimeEnvironmentId])
+    ).toEqual([[fileId, ENV_B]])
+    expect(state.unifiedTabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual(['host-editor-b'])
+    expect(state.tabBarOrderByWorktree[WORKTREE]).toEqual(['host-editor-b'])
+    expect(state.activeFileIdByWorktree[WORKTREE]).toBe(fileId)
+    expect(state.groupsByWorktree[WORKTREE]?.flatMap((group) => group.tabOrder)).toEqual([
+      'host-editor-b'
+    ])
+    hook.unmount()
+  })
+
+  it('waits for a newer surviving-host frame before repairing shared state', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    await publish(findGlobalSubscription(ENV_A), {
+      type: 'snapshots',
+      snapshots: [makeTerminalSnapshot('-a')]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await settleGlobalMirrorResumeStarts()
+    await publish(findGlobalSubscription(ENV_B, 1), {
+      type: 'snapshots',
+      snapshots: [makeTerminalSnapshot('-b')]
+    })
+
+    const newerRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    mocks.recoverSnapshot.mockImplementationOnce(() => newerRecovery.promise)
+    await publish(findGlobalSubscription(ENV_B, 1), {
+      type: 'updated',
+      ...makeTerminalSnapshot('-b', 2)
+    })
+    await publish(findGlobalSubscription(ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+    const tabId = toWebTerminalSurfaceTabId('host-tab-b')
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual([tabId])
+    expect(_getWebSessionTabsTrackingCountsForTest().freshness).toBe(2)
+
+    newerRecovery.resolve(makeTerminalSnapshot('-b', 2))
+    await act(settle)
+
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual([tabId])
+    expect(_getWebSessionTabsTrackingCountsForTest().freshness).toBe(1)
+    hook.unmount()
+  })
+
+  it('fences an omitted host while its survivor inventory is unavailable', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    await publish(findGlobalSubscription(ENV_A), {
+      type: 'snapshots',
+      snapshots: [makeTerminalSnapshot('-a')]
+    })
+    await publish(findGlobalSubscription(ENV_B), {
+      type: 'snapshots',
+      snapshots: [makeTerminalSnapshot('-b')]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await settleGlobalMirrorResumeStarts()
+
+    const staleRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    const slowInventoryRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    mocks.recoverSnapshot
+      .mockImplementationOnce(() => staleRecovery.promise)
+      .mockImplementationOnce(() => slowInventoryRecovery.promise)
+    await publish(findGlobalSubscription(ENV_A, 1), {
+      type: 'updated',
+      ...makeTerminalSnapshot('-a', 2)
+    })
+    const unrelatedSnapshot = {
+      ...makeTerminalSnapshot('-a'),
+      worktree: 'repo-a::other-worktree'
+    }
+    await publish(findGlobalSubscription(ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: [unrelatedSnapshot]
+    })
+    const hostBTabId = toWebTerminalSurfaceTabId('host-tab-b')
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual([
+      hostBTabId
+    ])
+
+    staleRecovery.resolve(makeTerminalSnapshot('-a', 2))
+    await act(settle)
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual([
+      hostBTabId
+    ])
+
+    slowInventoryRecovery.resolve(unrelatedSnapshot)
+    await act(settle)
+    await publish(findGlobalSubscription(ENV_A, 1), {
+      type: 'updated',
+      ...makeTerminalSnapshot('-a', 3)
+    })
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual([
+      toWebTerminalSurfaceTabId('host-tab-a')
+    ])
+    hook.unmount()
+  })
+
+  it('caches semantic freshness instead of later receive order', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    await publish(findGlobalSubscription(ENV_A), {
+      type: 'snapshots',
+      snapshots: [makeTerminalSnapshot('-a')]
+    })
+    await publish(findGlobalSubscription(ENV_B), {
+      type: 'snapshots',
+      snapshots: [makeTerminalSnapshot('-b')]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await settleGlobalMirrorResumeStarts()
+
+    const newerRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    mocks.recoverSnapshot.mockImplementationOnce(() => newerRecovery.promise)
+    await publish(findActiveSubscription(ENV_A, 1), {
+      type: 'snapshot',
+      ...makeTerminalSnapshot('-a', 2)
+    })
+    await publish(findActiveSubscription(ENV_A, 1), {
+      type: 'snapshot',
+      ...makeTerminalSnapshot('-a')
+    })
+    newerRecovery.resolve(makeTerminalSnapshot('-a', 2))
+    await act(settle)
+
+    await publish(findGlobalSubscription(ENV_B, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+    expect(_getWebSessionTabsTrackingCountsForTest().freshness).toBe(1)
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual([
+      toWebTerminalSurfaceTabId('host-tab-a')
+    ])
+    hook.unmount()
+  })
+
+  it('keeps a newer recovered frame when its resume inventory finishes later', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    await publish(findGlobalSubscription(ENV_A), {
+      type: 'snapshots',
+      snapshots: [makeTerminalSnapshot('-a')]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await settleGlobalMirrorResumeStarts()
+
+    const slowInventory = createDeferred<RuntimeMobileSessionTabsResult>()
+    mocks.recoverSnapshot.mockImplementationOnce(() => slowInventory.promise)
+    await publish(findGlobalSubscription(ENV_B, 1), {
+      type: 'snapshots',
+      snapshots: [makeTerminalSnapshot('-b')]
+    })
+    await publish(findGlobalSubscription(ENV_B, 1), {
+      type: 'updated',
+      ...makeTerminalSnapshot('-b', 2)
+    })
+    await publish(findGlobalSubscription(ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+
+    slowInventory.resolve(makeTerminalSnapshot('-b'))
+    await act(settle)
+
+    const tabId = toWebTerminalSurfaceTabId('host-tab-b')
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual([tabId])
+    expect(_getWebSessionTabsTrackingCountsForTest().freshness).toBe(1)
+    hook.unmount()
+  })
+
+  it('keeps a post-inventory live frame ahead of an older pending recovery', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const snapshot = makeTerminalSnapshot('-a')
+    await publish(findGlobalSubscription(ENV_A), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await settleGlobalMirrorResumeStarts()
+
+    const slowActiveRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    mocks.recoverSnapshot.mockImplementationOnce(() => slowActiveRecovery.promise)
+    const pendingSnapshot = makeTerminalSnapshot('-b', 3)
+    await publish(findActiveSubscription(ENV_A, 1), {
+      type: 'snapshot',
+      ...pendingSnapshot
+    })
+    await publish(findGlobalSubscription(ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE]).toBeUndefined()
+    expect(_getWebSessionTabsRecoveryTrackingCountsForTest()).toEqual({
+      pendingRecoveries: 1,
+      removalFrames: 1
+    })
+    const liveSnapshot = makeTerminalSnapshot('-a', 2)
+    await publish(findActiveSubscription(ENV_A, 1), {
+      type: 'updated',
+      ...liveSnapshot
+    })
+    const liveTabId = toWebTerminalSurfaceTabId('host-tab-a')
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual([
+      liveTabId
+    ])
+
+    slowActiveRecovery.resolve(pendingSnapshot)
+    await act(settle)
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE]?.map((tab) => tab.id)).toEqual([
+      liveTabId
+    ])
+    expect(_getWebSessionTabsTrackingCountsForTest().freshness).toBe(1)
+    expect(_getWebSessionTabsRecoveryTrackingCountsForTest()).toEqual({
+      pendingRecoveries: 0,
+      removalFrames: 0
+    })
+    hook.unmount()
+  })
+
+  it('does not let old cleanup erase a new recovery generation', async () => {
+    const oldRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    mocks.recoverSnapshot.mockImplementationOnce(() => oldRecovery.promise)
+    const oldHook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const snapshot = makeTerminalSnapshot('-a')
+    await publish(findActiveSubscription(ENV_A), { type: 'snapshot', ...snapshot })
+    oldHook.unmount()
+
+    const newRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    mocks.recoverSnapshot.mockImplementationOnce(() => newRecovery.promise)
+    const newHook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    await publish(findActiveSubscription(ENV_A, 1), { type: 'snapshot', ...snapshot })
+    expect(_getWebSessionTabsRecoveryTrackingCountsForTest().pendingRecoveries).toBe(1)
+
+    oldRecovery.resolve(snapshot)
+    await act(settle)
+    expect(_getWebSessionTabsRecoveryTrackingCountsForTest().pendingRecoveries).toBe(1)
+
+    newRecovery.resolve(snapshot)
+    await act(settle)
+    expect(_getWebSessionTabsRecoveryTrackingCountsForTest().pendingRecoveries).toBe(0)
+    newHook.unmount()
+  })
+
+  it('tracks repeated same-worktree recoveries in constant map space', async () => {
+    const recoveries = [
+      createDeferred<RuntimeMobileSessionTabsResult>(),
+      createDeferred<RuntimeMobileSessionTabsResult>(),
+      createDeferred<RuntimeMobileSessionTabsResult>()
+    ]
+    for (const recovery of recoveries) {
+      mocks.recoverSnapshot.mockImplementationOnce(() => recovery.promise)
+    }
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const activeSubscription = findActiveSubscription(ENV_A)
+    for (const [index] of recoveries.entries()) {
+      await publish(activeSubscription, {
+        type: 'updated',
+        ...makeTerminalSnapshot(index === 0 ? '-a' : '-b', index + 1)
+      })
+    }
+    expect(_getWebSessionTabsRecoveryTrackingCountsForTest().pendingRecoveries).toBe(1)
+
+    for (const [index, recovery] of recoveries.entries()) {
+      recovery.resolve(makeTerminalSnapshot(index === 0 ? '-a' : '-b', index + 1))
+    }
+    await act(settle)
+    expect(_getWebSessionTabsRecoveryTrackingCountsForTest().pendingRecoveries).toBe(0)
+    hook.unmount()
+  })
+})
diff --git a/src/renderer/src/runtime/web-session-tabs-sync-window-visibility.test.tsx b/src/renderer/src/runtime/web-session-tabs-sync-window-visibility.test.tsx
new file mode 100644
index 00000000000..5885e536bcc
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-tabs-sync-window-visibility.test.tsx
@@ -0,0 +1,876 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { tagRuntimeSubscriptionReplayResponse } from '../../../shared/runtime-subscription-replay'
+import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types'
+import { resetStaleDocumentVisibilityForTesting } from '@/components/terminal-pane/stale-document-visibility'
+import type * as WorktreeRuntimeOwnerModule from '@/lib/worktree-runtime-owner'
+import type * as WebRuntimeSessionModule from './web-runtime-session'
+
+const mocks = vi.hoisted(() => ({
+  createTerminal: vi.fn(),
+  getExplicitRuntimeEnvironmentIdForWorktree: vi.fn(),
+  recoverSnapshot: vi.fn(),
+  runtimeSessionMirrorEnvironmentKey: vi.fn()
+}))
+
+vi.mock('./use-runtime-session-mirror-environment-key', () => ({
+  useRuntimeSessionMirrorEnvironmentKey: mocks.runtimeSessionMirrorEnvironmentKey
+}))
+
+vi.mock('@/lib/worktree-runtime-owner', async (importOriginal) => {
+  const actual = await importOriginal<typeof WorktreeRuntimeOwnerModule>()
+  return {
+    ...actual,
+    getExplicitRuntimeEnvironmentIdForWorktree: mocks.getExplicitRuntimeEnvironmentIdForWorktree
+  }
+})
+
+vi.mock('./web-session-terminal-orphan-recovery', () => ({
+  recoverWebSessionTerminalOrphansBeforeApply: mocks.recoverSnapshot
+}))
+
+vi.mock('./web-runtime-session', async (importOriginal) => {
+  const actual = await importOriginal<typeof WebRuntimeSessionModule>()
+  return { ...actual, createWebRuntimeSessionTerminal: mocks.createTerminal }
+})
+
+import { useAppStore } from '@/store'
+import type { AppState } from '@/store/types'
+import { replaceRuntimeEnvironmentRevisions } from './runtime-environment-revision'
+import {
+  acceptReplayedWebSessionTabsSnapshot,
+  _getWebSessionTabsRecoveryTrackingCountsForTest,
+  _getWebSessionTabsTrackingCountsForTest,
+  resetWebSessionTabsSnapshotFreshnessForTests,
+  useWebSessionTabsSync,
+  WEB_SESSION_TABS_VISIBILITY_RESUME_STAGGER_MS
+} from './web-session-tabs-sync'
+import {
+  WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_BACKOFF_LIMIT,
+  WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS
+} from './window-visibility-subscription-parking'
+
+const ENV_A = 'env-a'
+const ENV_B = 'env-b'
+const WORKTREE = 'repo-a::worktree-a'
+const REVISION_A = 101
+const REVISION_B = 201
+const MIRROR_KEY = `${ENV_A}\u0001runtime-a\u00011\u0001${REVISION_A}\u0000${ENV_B}\u0001runtime-b\u00012\u0001${REVISION_B}`
+const initialState = useAppStore.getInitialState()
+
+type RuntimeSubscribe = typeof window.api.runtimeEnvironments.subscribe
+type RuntimeSubscription = {
+  request: Parameters<RuntimeSubscribe>[0]
+  callbacks: Parameters<RuntimeSubscribe>[1]
+  unsubscribe: ReturnType<typeof vi.fn>
+}
+
+type Deferred<T> = {
+  promise: Promise<T>
+  resolve: (value: T) => void
+}
+
+const subscriptions: RuntimeSubscription[] = []
+const runtimeCall = vi.fn(async () => ({
+  id: 'list-all',
+  ok: true as const,
+  result: { snapshots: [] },
+  _meta: { runtimeId: 'runtime-test' }
+}))
+const runtimeSubscribe = vi.fn<RuntimeSubscribe>(async (request, callbacks) => {
+  const unsubscribe = vi.fn()
+  subscriptions.push({ request, callbacks, unsubscribe })
+  return { unsubscribe, sendBinary: vi.fn() }
+})
+
+function createDeferred<T>(): Deferred<T> {
+  let resolve = (_value: T): void => {}
+  const promise = new Promise<T>((done) => {
+    resolve = done
+  })
+  return { promise, resolve }
+}
+
+function makeEmptySnapshot(snapshotVersion = 1): RuntimeMobileSessionTabsResult {
+  return {
+    worktree: WORKTREE,
+    publicationEpoch: 'epoch-1',
+    snapshotVersion,
+    activeGroupId: 'host-group-1',
+    activeTabId: null,
+    activeTabType: null,
+    tabs: []
+  }
+}
+
+function makeBrowserSnapshot(idSuffix = ''): RuntimeMobileSessionTabsResult {
+  return {
+    ...makeEmptySnapshot(),
+    activeTabId: `host-browser-tab${idSuffix}`,
+    activeTabType: 'browser',
+    tabs: [
+      {
+        type: 'browser',
+        id: `host-browser-tab${idSuffix}`,
+        title: 'Remote browser',
+        browserWorkspaceId: `host-browser-workspace${idSuffix}`,
+        browserPageId: `host-browser-page${idSuffix}`,
+        url: 'https://example.com/',
+        loading: false,
+        canGoBack: false,
+        canGoForward: false,
+        isActive: true
+      }
+    ]
+  }
+}
+
+function setDocumentVisibility(state: 'visible' | 'hidden'): void {
+  Object.defineProperty(document, 'visibilityState', {
+    configurable: true,
+    get: () => state
+  })
+  document.dispatchEvent(new Event('visibilitychange'))
+}
+
+async function settle(): Promise<void> {
+  await Promise.resolve()
+  await Promise.resolve()
+  await Promise.resolve()
+}
+
+function findSubscription(
+  method: 'session.tabs.subscribeAll' | 'session.tabs.subscribe',
+  selector: string,
+  occurrence = 0
+): RuntimeSubscription {
+  const matches = subscriptions.filter(
+    ({ request }) => request.method === method && request.selector === selector
+  )
+  const subscription = matches[occurrence]
+  if (!subscription) {
+    throw new Error(`Missing ${method} subscription ${occurrence} for ${selector}`)
+  }
+  return subscription
+}
+
+async function publish(
+  subscription: RuntimeSubscription,
+  result: unknown,
+  replayed = false
+): Promise<void> {
+  await act(async () => {
+    const response = {
+      id: 'subscription-event',
+      ok: true as const,
+      result,
+      _meta: { runtimeId: 'runtime-test' }
+    }
+    subscription.callbacks.onResponse(
+      replayed ? tagRuntimeSubscriptionReplayResponse(response) : response
+    )
+    await settle()
+  })
+}
+
+function seedRemoteMirrorState(): void {
+  const runtimeEnvironments = [
+    { id: ENV_A, createdAt: 100, pairingRevision: REVISION_A },
+    { id: ENV_B, createdAt: 200, pairingRevision: REVISION_B }
+  ] as AppState['runtimeEnvironments']
+  replaceRuntimeEnvironmentRevisions(runtimeEnvironments)
+  useAppStore.setState(
+    {
+      ...initialState,
+      activeWorktreeId: WORKTREE,
+      workspaceSessionReady: true,
+      runtimeEnvironments,
+      runtimeStatusByEnvironmentId: new Map([
+        [ENV_A, { status: { runtimeId: 'runtime-a' }, connectionGeneration: 1 }],
+        [ENV_B, { status: { runtimeId: 'runtime-b' }, connectionGeneration: 2 }]
+      ]) as AppState['runtimeStatusByEnvironmentId']
+    },
+    true
+  )
+}
+
+describe('useWebSessionTabsSync window visibility', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    subscriptions.length = 0
+    runtimeCall.mockClear()
+    runtimeSubscribe.mockClear()
+    mocks.createTerminal.mockReset().mockResolvedValue(undefined)
+    mocks.recoverSnapshot.mockReset().mockImplementation(async (_state, snapshot) => snapshot)
+    mocks.getExplicitRuntimeEnvironmentIdForWorktree.mockReset().mockReturnValue(ENV_A)
+    mocks.runtimeSessionMirrorEnvironmentKey.mockReset().mockReturnValue(MIRROR_KEY)
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: { runtimeEnvironments: { call: runtimeCall, subscribe: runtimeSubscribe } }
+    })
+    setDocumentVisibility('visible')
+    resetWebSessionTabsSnapshotFreshnessForTests()
+    seedRemoteMirrorState()
+  })
+
+  afterEach(() => {
+    cleanup()
+    useAppStore.setState(initialState, true)
+    replaceRuntimeEnvironmentRevisions([])
+    resetWebSessionTabsSnapshotFreshnessForTests()
+    resetStaleDocumentVisibilityForTesting()
+    setDocumentVisibility('visible')
+    vi.useRealTimers()
+  })
+
+  it('parks every live mirror without repeating one-shot hydration', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+
+    expect(runtimeCall).toHaveBeenCalledTimes(2)
+    expect(runtimeSubscribe).toHaveBeenCalledTimes(3)
+    expect(subscriptions.map(({ request }) => request.method).sort()).toEqual([
+      'session.tabs.subscribe',
+      'session.tabs.subscribeAll',
+      'session.tabs.subscribeAll'
+    ])
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS - 1)
+    })
+    expect(subscriptions.every(({ unsubscribe }) => unsubscribe.mock.calls.length === 0)).toBe(true)
+
+    act(() => vi.advanceTimersByTime(1))
+    expect(subscriptions.every(({ unsubscribe }) => unsubscribe.mock.calls.length === 1)).toBe(true)
+
+    act(() => setDocumentVisibility('visible'))
+    act(() => vi.advanceTimersByTime(WEB_SESSION_TABS_VISIBILITY_RESUME_STAGGER_MS))
+    await act(settle)
+    expect(runtimeSubscribe).toHaveBeenCalledTimes(6)
+    expect(runtimeCall).toHaveBeenCalledTimes(2)
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS - 1)
+      setDocumentVisibility('visible')
+      vi.advanceTimersByTime(1)
+    })
+    expect(runtimeSubscribe).toHaveBeenCalledTimes(6)
+
+    hook.unmount()
+    expect(
+      subscriptions.slice(3).every(({ unsubscribe }) => unsubscribe.mock.calls.length === 1)
+    ).toBe(true)
+  })
+
+  it('skips recovery and store replay for an unchanged resume inventory', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const snapshot = makeBrowserSnapshot()
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+    const browserTabsByWorktree = useAppStore.getState().browserTabsByWorktree
+    mocks.recoverSnapshot.mockClear()
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+
+    expect(mocks.recoverSnapshot).not.toHaveBeenCalled()
+    expect(useAppStore.getState().browserTabsByWorktree).toBe(browserTabsByWorktree)
+
+    act(() => useAppStore.setState({ browserTabsByWorktree: {} }))
+    await publish(
+      findSubscription('session.tabs.subscribeAll', ENV_A, 1),
+      { type: 'snapshots', snapshots: [snapshot] },
+      true
+    )
+    expect(mocks.recoverSnapshot).toHaveBeenCalledOnce()
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toHaveLength(1)
+    hook.unmount()
+  })
+
+  it('replays an unchanged resume inventory while a repair replay is armed', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const snapshot = makeBrowserSnapshot()
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+    mocks.recoverSnapshot.mockClear()
+    acceptReplayedWebSessionTabsSnapshot(ENV_A, WORKTREE)
+    act(() => useAppStore.setState({ browserTabsByWorktree: {} }))
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+
+    expect(mocks.recoverSnapshot).toHaveBeenCalledOnce()
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toHaveLength(1)
+    hook.unmount()
+  })
+
+  it('starts hidden without remote IO and hydrates once on reveal', async () => {
+    setDocumentVisibility('hidden')
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+
+    expect(runtimeCall).not.toHaveBeenCalled()
+    expect(runtimeSubscribe).not.toHaveBeenCalled()
+
+    act(() => setDocumentVisibility('visible'))
+    act(() => vi.advanceTimersByTime(WEB_SESSION_TABS_VISIBILITY_RESUME_STAGGER_MS))
+    await act(settle)
+    expect(runtimeCall).toHaveBeenCalledTimes(2)
+    expect(runtimeSubscribe).toHaveBeenCalledTimes(3)
+    hook.unmount()
+  })
+
+  it('does not bootstrap twice when global snapshots race active resume', async () => {
+    const pendingCreate = createDeferred<unknown>()
+    mocks.createTerminal.mockReturnValue(pendingCreate.promise)
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const snapshot = makeEmptySnapshot()
+
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+    await publish(findSubscription('session.tabs.subscribe', ENV_A), {
+      type: 'snapshot',
+      ...snapshot
+    })
+    expect(mocks.createTerminal).toHaveBeenCalledTimes(1)
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+      vi.advanceTimersByTime(WEB_SESSION_TABS_VISIBILITY_RESUME_STAGGER_MS)
+    })
+    await act(settle)
+
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+    await publish(findSubscription('session.tabs.subscribe', ENV_A, 1), {
+      type: 'snapshot',
+      ...snapshot
+    })
+    expect(mocks.createTerminal).toHaveBeenCalledTimes(1)
+
+    pendingCreate.resolve(undefined)
+    await act(settle)
+    hook.unmount()
+  })
+
+  it('keeps a newer active snapshot when an older frame is received later', async () => {
+    const newerRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    const olderRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    mocks.recoverSnapshot
+      .mockImplementationOnce(() => newerRecovery.promise)
+      .mockImplementationOnce(() => olderRecovery.promise)
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const newerSnapshot = { ...makeBrowserSnapshot('-new'), snapshotVersion: 2 }
+    const olderSnapshot = makeBrowserSnapshot('-old')
+    const activeSubscription = findSubscription('session.tabs.subscribe', ENV_A)
+
+    await publish(activeSubscription, { type: 'snapshot', ...newerSnapshot })
+    await publish(activeSubscription, { type: 'snapshot', ...olderSnapshot })
+    newerRecovery.resolve(newerSnapshot)
+    await act(settle)
+    expect(useAppStore.getState().activeBrowserTabIdByWorktree[WORKTREE]).toBe(
+      'host-browser-workspace-new'
+    )
+
+    olderRecovery.resolve(olderSnapshot)
+    await act(settle)
+    expect(useAppStore.getState().activeBrowserTabIdByWorktree[WORKTREE]).toBe(
+      'host-browser-workspace-new'
+    )
+    hook.unmount()
+  })
+
+  it('removes an omitted mirror without waiting for an unrelated host inventory', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const snapshot = makeBrowserSnapshot()
+
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toHaveLength(1)
+    expect(_getWebSessionTabsTrackingCountsForTest().freshness).toBe(1)
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toBeUndefined()
+    expect(_getWebSessionTabsTrackingCountsForTest().freshness).toBe(0)
+    hook.unmount()
+  })
+
+  it('removes an omitted host before replaying a collision created while hidden', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [makeBrowserSnapshot('-a')]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+      vi.advanceTimersByTime(WEB_SESSION_TABS_VISIBILITY_RESUME_STAGGER_MS)
+    })
+    await act(settle)
+
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_B, 1), {
+      type: 'snapshots',
+      snapshots: [makeBrowserSnapshot('-b')]
+    })
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+
+    const handles = Object.values(useAppStore.getState().remoteBrowserPageHandlesByPageId)
+    expect(handles.some((handle) => handle.environmentId === ENV_A)).toBe(false)
+    expect(handles.some((handle) => handle.environmentId === ENV_B)).toBe(true)
+    expect(useAppStore.getState().activeBrowserTabIdByWorktree[WORKTREE]).toBe(
+      'host-browser-workspace-b'
+    )
+    expect(useAppStore.getState().tabBarOrderByWorktree[WORKTREE]).toEqual(['host-browser-tab-b'])
+    hook.unmount()
+  })
+
+  it('removes the remaining host mirror after a colliding host is removed', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [makeBrowserSnapshot('-a')]
+    })
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_B), {
+      type: 'snapshots',
+      snapshots: [makeBrowserSnapshot('-b')]
+    })
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_B), {
+      type: 'updated',
+      ...makeEmptySnapshot(2),
+      removed: true
+    })
+    expect(
+      Object.values(useAppStore.getState().remoteBrowserPageHandlesByPageId).some(
+        (handle) => handle.environmentId === ENV_A
+      )
+    ).toBe(true)
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+
+    expect(
+      Object.values(useAppStore.getState().remoteBrowserPageHandlesByPageId).some(
+        (handle) => handle.environmentId === ENV_A
+      )
+    ).toBe(false)
+    hook.unmount()
+  })
+
+  it('does not let a slow resume inventory remove a newer update', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const snapshot = makeBrowserSnapshot()
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await act(settle)
+    const slowOtherSnapshot = {
+      ...makeEmptySnapshot(),
+      worktree: 'repo-a::other-worktree'
+    }
+    const slowInventoryRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    const slowUpdateRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    mocks.recoverSnapshot
+      .mockImplementationOnce(() => slowInventoryRecovery.promise)
+      .mockImplementationOnce(() => slowUpdateRecovery.promise)
+    const resumedGlobal = findSubscription('session.tabs.subscribeAll', ENV_A, 1)
+    await publish(resumedGlobal, {
+      type: 'snapshots',
+      snapshots: [slowOtherSnapshot]
+    })
+    await publish(resumedGlobal, {
+      type: 'updated',
+      ...snapshot,
+      snapshotVersion: 2
+    })
+    slowInventoryRecovery.resolve(slowOtherSnapshot)
+    await act(settle)
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toHaveLength(1)
+    expect(_getWebSessionTabsTrackingCountsForTest().freshness).toBe(2)
+    slowUpdateRecovery.resolve({ ...snapshot, snapshotVersion: 2 })
+    await act(settle)
+    hook.unmount()
+  })
+
+  it('keeps a newer active snapshot received before the resume inventory', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const originalSnapshot = makeBrowserSnapshot('-old')
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [originalSnapshot]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await act(settle)
+
+    const newerSnapshot = { ...makeBrowserSnapshot('-new'), snapshotVersion: 2 }
+    await publish(findSubscription('session.tabs.subscribe', ENV_A, 1), {
+      type: 'snapshot',
+      ...newerSnapshot
+    })
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+
+    expect(useAppStore.getState().activeBrowserTabIdByWorktree[WORKTREE]).toBe(
+      'host-browser-workspace-new'
+    )
+    expect(_getWebSessionTabsTrackingCountsForTest().freshness).toBe(1)
+    hook.unmount()
+  })
+
+  it('reconciles a missed removal after the mirror effect restarts hidden', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const snapshot = makeBrowserSnapshot()
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+    expect(_getWebSessionTabsTrackingCountsForTest().freshness).toBe(1)
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    })
+    mocks.runtimeSessionMirrorEnvironmentKey.mockReturnValue(
+      MIRROR_KEY.replace('runtime-b\u00012', 'runtime-b\u00013')
+    )
+    hook.rerender()
+    await act(settle)
+    expect(runtimeSubscribe).toHaveBeenCalledTimes(3)
+
+    act(() => setDocumentVisibility('visible'))
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toBeUndefined()
+    expect(
+      Object.values(useAppStore.getState().remoteBrowserPageHandlesByPageId).some(
+        (handle) => handle.environmentId === ENV_A
+      )
+    ).toBe(false)
+    expect(_getWebSessionTabsTrackingCountsForTest().freshness).toBe(0)
+
+    await publish(findSubscription('session.tabs.subscribe', ENV_A, 1), {
+      type: 'snapshot',
+      ...snapshot
+    })
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toBeUndefined()
+    hook.unmount()
+  })
+
+  it('clears hidden tracking when its environment is no longer mirrored', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [makeBrowserSnapshot()]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    })
+    mocks.runtimeSessionMirrorEnvironmentKey.mockReturnValue(MIRROR_KEY.split('\u0000')[1])
+    hook.rerender()
+    await act(settle)
+
+    expect(_getWebSessionTabsTrackingCountsForTest().freshness).toBe(0)
+    act(() => setDocumentVisibility('visible'))
+    await act(settle)
+    expect(
+      subscriptions.filter(
+        ({ request }) =>
+          request.method === 'session.tabs.subscribeAll' && request.selector === ENV_A
+      )
+    ).toHaveLength(1)
+    hook.unmount()
+  })
+
+  it('ignores an older inventory completion after a newer inventory', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [makeBrowserSnapshot('-old')]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await act(settle)
+
+    const unrelatedSnapshot = {
+      ...makeEmptySnapshot(),
+      worktree: 'repo-a::other-worktree'
+    }
+    const olderInventoryRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    mocks.recoverSnapshot.mockImplementationOnce(() => olderInventoryRecovery.promise)
+    const resumedGlobal = findSubscription('session.tabs.subscribeAll', ENV_A, 1)
+    await publish(resumedGlobal, {
+      type: 'snapshots',
+      snapshots: [unrelatedSnapshot]
+    })
+    const newerSnapshot = { ...makeBrowserSnapshot('-new'), snapshotVersion: 2 }
+    await publish(resumedGlobal, {
+      type: 'snapshots',
+      snapshots: [newerSnapshot]
+    })
+
+    olderInventoryRecovery.resolve(unrelatedSnapshot)
+    await act(settle)
+    expect(useAppStore.getState().activeBrowserTabIdByWorktree[WORKTREE]).toBe(
+      'host-browser-workspace-new'
+    )
+    hook.unmount()
+  })
+
+  it.each([
+    { label: 'exact', snapshotVersion: 2 },
+    { label: 'older', snapshotVersion: 1 }
+  ])(
+    'lets an authoritative inventory beat a later $label active replay',
+    async ({ snapshotVersion }) => {
+      const hook = renderHook(() => useWebSessionTabsSync())
+      await act(settle)
+      const snapshot = { ...makeBrowserSnapshot(), snapshotVersion: 2 }
+      await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+        type: 'snapshots',
+        snapshots: [snapshot]
+      })
+
+      act(() => {
+        setDocumentVisibility('hidden')
+        vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+        setDocumentVisibility('visible')
+      })
+      await act(settle)
+
+      const unrelatedSnapshot = {
+        ...makeEmptySnapshot(),
+        worktree: 'repo-a::other-worktree'
+      }
+      const slowInventoryRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+      mocks.recoverSnapshot.mockImplementationOnce(() => slowInventoryRecovery.promise)
+      await publish(findSubscription('session.tabs.subscribeAll', ENV_A, 1), {
+        type: 'snapshots',
+        snapshots: [unrelatedSnapshot]
+      })
+      await publish(findSubscription('session.tabs.subscribe', ENV_A, 1), {
+        type: 'snapshot',
+        ...snapshot,
+        snapshotVersion
+      })
+
+      slowInventoryRecovery.resolve(unrelatedSnapshot)
+      await act(settle)
+      expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toBeUndefined()
+      hook.unmount()
+    }
+  )
+
+  it('keeps an omission authoritative after its resume batch completes', async () => {
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const snapshot = { ...makeBrowserSnapshot(), snapshotVersion: 2 }
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+      setDocumentVisibility('visible')
+    })
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+    await publish(findSubscription('session.tabs.subscribe', ENV_A, 1), {
+      type: 'snapshot',
+      ...snapshot
+    })
+
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toBeUndefined()
+
+    mocks.runtimeSessionMirrorEnvironmentKey.mockReturnValue(
+      MIRROR_KEY.replace('runtime-b\u00012', 'runtime-b\u00013')
+    )
+    hook.rerender()
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribe', ENV_A, 1), {
+      type: 'snapshot',
+      ...snapshot
+    })
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toBeUndefined()
+
+    act(() => {
+      setDocumentVisibility('hidden')
+      // A second park in the same install pays the widened park delay.
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS * 2)
+      setDocumentVisibility('visible')
+    })
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribe', ENV_A, 2), {
+      type: 'snapshot',
+      ...snapshot
+    })
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toBeUndefined()
+    hook.unmount()
+  })
+
+  it('drops an omission fence one generation after the inventory that set it', async () => {
+    const parkAndReveal = async (): Promise<void> => {
+      act(() => {
+        setDocumentVisibility('hidden')
+        vi.advanceTimersByTime(
+          WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS *
+            WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_BACKOFF_LIMIT
+        )
+        setDocumentVisibility('visible')
+      })
+      await act(settle)
+    }
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const snapshot = { ...makeBrowserSnapshot(), snapshotVersion: 2 }
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A), {
+      type: 'snapshots',
+      snapshots: [snapshot]
+    })
+
+    await parkAndReveal()
+    await publish(findSubscription('session.tabs.subscribeAll', ENV_A, 1), {
+      type: 'snapshots',
+      snapshots: []
+    })
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toBeUndefined()
+
+    await parkAndReveal()
+    await publish(findSubscription('session.tabs.subscribe', ENV_A, 2), {
+      type: 'snapshot',
+      ...snapshot
+    })
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toBeUndefined()
+
+    await parkAndReveal()
+    await publish(findSubscription('session.tabs.subscribe', ENV_A, 3), {
+      type: 'snapshot',
+      ...snapshot
+    })
+    expect(useAppStore.getState().browserTabsByWorktree[WORKTREE]).toHaveLength(1)
+    hook.unmount()
+  })
+
+  it('fences recovery that finishes after the stream is parked', async () => {
+    const deferredRecovery = createDeferred<RuntimeMobileSessionTabsResult>()
+    mocks.recoverSnapshot.mockImplementationOnce(() => deferredRecovery.promise)
+    const hook = renderHook(() => useWebSessionTabsSync())
+    await act(settle)
+    const snapshot = makeEmptySnapshot()
+
+    await publish(findSubscription('session.tabs.subscribe', ENV_A), {
+      type: 'snapshot',
+      ...snapshot
+    })
+    act(() => {
+      setDocumentVisibility('hidden')
+      vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    })
+    deferredRecovery.resolve(snapshot)
+    await act(settle)
+    expect(mocks.createTerminal).not.toHaveBeenCalled()
+
+    act(() => setDocumentVisibility('visible'))
+    await act(settle)
+    await publish(findSubscription('session.tabs.subscribe', ENV_A, 1), {
+      type: 'snapshot',
+      ...snapshot
+    })
+    expect(mocks.createTerminal).toHaveBeenCalledTimes(1)
+    hook.unmount()
+  })
+})
diff --git a/src/renderer/src/runtime/web-session-tabs-sync.test.ts b/src/renderer/src/runtime/web-session-tabs-sync.test.ts
index 01836b7955a..e830e027208 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync.test.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync.test.ts
@@ -20,13 +20,24 @@ import {
   recordWebSessionReorderIntent,
   resetWebSessionReorderIntentForTests
 } from './web-session-reorder-intent'
-import type { BrowserPage, BrowserWorkspace, Tab, TerminalTab } from '../../../shared/types'
+import type {
+  BrowserPage,
+  BrowserWorkspace,
+  Tab,
+  TabGroupLayoutNode,
+  TerminalTab
+} from '../../../shared/types'
 import type { OpenFile } from '../store/slices/editor'
 import {
   confirmWebAgentSessionHandoffAfterCreate,
   recordWebAgentSessionHandoff,
   resetWebAgentSessionHandoffsForTests
 } from './web-agent-session-handoff'
+import {
+  moveWebSessionBrowserPlacement,
+  recordWebSessionBrowserPlacement,
+  takeWebSessionBrowserPlacementGroup
+} from './web-session-browser-placement'
 import {
   _getWebSessionTabsTrackingCountsForTest,
   acceptReplayedWebSessionTabsSnapshot,
@@ -58,6 +69,16 @@ const SECOND_LEAF_ID = '22222222-2222-4222-8222-222222222222'
 const THIRD_LEAF_ID = '33333333-3333-4333-8333-333333333333'
 const HOST_SURFACE_ID = `host-tab-1::${LEAF_ID}`
 
+function layoutHasGroup(layout: TabGroupLayoutNode | undefined, groupId: string): boolean {
+  if (!layout) {
+    return false
+  }
+  if (layout.type === 'leaf') {
+    return layout.groupId === groupId
+  }
+  return layoutHasGroup(layout.first, groupId) || layoutHasGroup(layout.second, groupId)
+}
+
 function makeState(overrides: Partial<WebSessionTabsSyncState> = {}): WebSessionTabsSyncState {
   return {
     activeBrowserTabId: null,
@@ -643,7 +664,8 @@ describe('applyWebSessionTabsSnapshot', () => {
 
     expect(_getWebSessionTabsTrackingCountsForTest()).toEqual({
       freshness: 1,
-      hostMappings: 1
+      hostMappings: 1,
+      hostMappingWorktrees: 1
     })
 
     applyFreshWebSessionTabsSnapshot(
@@ -664,7 +686,8 @@ describe('applyWebSessionTabsSnapshot', () => {
 
     expect(_getWebSessionTabsTrackingCountsForTest()).toEqual({
       freshness: 0,
-      hostMappings: 0
+      hostMappings: 0,
+      hostMappingWorktrees: 0
     })
   })
 
@@ -720,17 +743,89 @@ describe('applyWebSessionTabsSnapshot', () => {
 
     expect(_getWebSessionTabsTrackingCountsForTest()).toEqual({
       freshness: 2,
-      hostMappings: 2
+      hostMappings: 2,
+      hostMappingWorktrees: 2
     })
 
     clearWebSessionTabsTrackingForEnvironment(ENV)
 
     expect(_getWebSessionTabsTrackingCountsForTest()).toEqual({
       freshness: 1,
-      hostMappings: 1
+      hostMappings: 1,
+      hostMappingWorktrees: 1
     })
   })
 
+  it('clears one worktree mapping without dropping a sibling in the same environment', () => {
+    // Why: POSIX paths may contain ':', so this sibling's worktree id is prefixed by WT's — the case a prefix scan wiped.
+    const secondWorktree = `${WT}:2`
+    const terminalSnapshot = makeSnapshot([
+      {
+        type: 'terminal',
+        id: HOST_SURFACE_ID,
+        title: 'host shell',
+        parentTabId: 'host-tab-1',
+        leafId: LEAF_ID,
+        isActive: true,
+        status: 'ready',
+        terminal: 'terminal-1'
+      }
+    ])
+    const secondSnapshot = makeSnapshot(
+      [
+        {
+          type: 'terminal',
+          id: `host-tab-2::${SECOND_LEAF_ID}`,
+          title: 'second shell',
+          parentTabId: 'host-tab-2',
+          leafId: SECOND_LEAF_ID,
+          isActive: true,
+          status: 'ready',
+          terminal: 'terminal-2'
+        }
+      ],
+      { worktree: secondWorktree }
+    )
+    applyFreshWebSessionTabsSnapshot(makeState(), terminalSnapshot, ENV, NOW)
+    applyFreshWebSessionTabsSnapshot(makeState(), secondSnapshot, ENV, NOW)
+
+    applyFreshWebSessionTabsSnapshot(
+      makeState(),
+      {
+        ...makeSnapshot([], {
+          publicationEpoch: 'removed-epoch',
+          snapshotVersion: 0,
+          activeGroupId: null,
+          activeTabId: null,
+          activeTabType: null
+        }),
+        removed: true
+      } as RuntimeMobileSessionTabsResult,
+      ENV,
+      NOW + 1
+    )
+
+    expect(_getWebSessionTabsTrackingCountsForTest()).toEqual({
+      freshness: 1,
+      hostMappings: 1,
+      hostMappingWorktrees: 1
+    })
+    expect(
+      resolveHostSessionTabIdForWebSessionTab(makeState(), {
+        environmentId: ENV,
+        worktreeId: WT,
+        tabId: toWebTerminalSurfaceTabId('host-tab-1')
+      })
+    ).toBeNull()
+    expect(
+      resolveHostSessionTabIdForWebSessionTab(makeState(), {
+        environmentId: ENV,
+        worktreeId: secondWorktree,
+        tabId: toWebTerminalSurfaceTabId('host-tab-2')
+      })
+    ).toBe('host-tab-2')
+  })
+
   it('keeps a provisional Claude tab when the host Claude surface is unrelated', () => {
     const staleLocalAgentTab: TerminalTab = {
       id: 'local-agent-tab',
@@ -2226,6 +2321,64 @@ describe('applyWebSessionTabsSnapshot', () => {
     expect(patch.sortEpoch).toBe((initialState.sortEpoch ?? 0) + 1)
   })
 
+  it('bumps sort epoch when a mirrored same-state done update becomes a completion', () => {
+    const hostPaneKey = makePaneKey('host-tab-1', LEAF_ID)
+    const initialSnapshot = makeSnapshot([
+      {
+        type: 'terminal',
+        id: HOST_SURFACE_ID,
+        title: 'Codex',
+        parentTabId: 'host-tab-1',
+        leafId: LEAF_ID,
+        isActive: true,
+        status: 'ready',
+        terminal: 'terminal-1',
+        agentStatus: {
+          state: 'done',
+          prompt: 'same prompt',
+          updatedAt: NOW - 1_000,
+          stateStartedAt: NOW - 2_000,
+          agentType: 'codex',
+          paneKey: hostPaneKey,
+          stateHistory: [],
+          interrupted: true
+        }
+      }
+    ])
+    const initialPatch = applyWebSessionTabsSnapshot(
+      makeState(),
+      initialSnapshot,
+      ENV,
+      NOW
+    ) as Partial<WebSessionTabsSyncState>
+    const initialState = { ...makeState(), ...initialPatch }
+
+    const patch = applyWebSessionTabsSnapshot(
+      initialState,
+      {
+        ...initialSnapshot,
+        snapshotVersion: 2,
+        tabs: initialSnapshot.tabs.map((tab) =>
+          tab.type === 'terminal' && tab.agentStatus
+            ? {
+                ...tab,
+                agentStatus: {
+                  ...tab.agentStatus,
+                  updatedAt: NOW,
+                  interrupted: undefined
+                }
+              }
+            : tab
+        )
+      },
+      ENV,
+      NOW
+    ) as Partial<WebSessionTabsSyncState>
+
+    expect(patch.agentStatusEpoch).toBe((initialState.agentStatusEpoch ?? 0) + 1)
+    expect(patch.sortEpoch).toBe((initialState.sortEpoch ?? 0) + 1)
+  })
+
   it('hydrates multiple initial host snapshots in one merged patch', () => {
     const secondWorktree = 'repo::/other-worktree'
     const patch = applyWebSessionTabsSnapshots(
@@ -2273,6 +2426,617 @@ describe('applyWebSessionTabsSnapshot', () => {
     )
   })
 
+  it('keeps an empty snapshot batch as an identity no-op', () => {
+    const state = makeState()
+    expect(applyWebSessionTabsSnapshots(state, [], ENV, NOW)).toBe(state)
+  })
+
+  it('matches sequential reconciliation across duplicate-worktree mixed snapshots', () => {
+    const secondWorktree = 'repo::/other-worktree'
+    const snapshots: RuntimeMobileSessionTabsResult[] = [
+      makeSnapshot([
+        {
+          type: 'terminal',
+          id: HOST_SURFACE_ID,
+          title: 'first agent',
+          parentTabId: 'host-tab-1',
+          leafId: LEAF_ID,
+          isActive: true,
+          status: 'ready',
+          terminal: 'terminal-1',
+          agentStatus: {
+            state: 'working',
+            prompt: 'first task',
+            updatedAt: NOW,
+            stateStartedAt: NOW,
+            agentType: 'codex',
+            paneKey: HOST_SURFACE_ID,
+            stateHistory: []
+          }
+        }
+      ]),
+      makeSnapshot(
+        [
+          {
+            type: 'browser',
+            id: 'host-browser-unified',
+            title: 'Example Domain',
+            browserWorkspaceId: 'host-browser-workspace',
+            browserPageId: 'host-browser-page',
+            url: 'https://example.com/',
+            loading: false,
+            canGoBack: false,
+            canGoForward: false,
+            isActive: true
+          }
+        ],
+        {
+          worktree: secondWorktree,
+          activeGroupId: 'host-group-2',
+          activeTabId: 'host-browser-unified',
+          activeTabType: 'browser'
+        }
+      ),
+      makeSnapshot([], {
+        snapshotVersion: 2,
+        activeGroupId: null,
+        activeTabId: null,
+        activeTabType: null
+      }),
+      makeSnapshot(
+        [
+          {
+            type: 'terminal',
+            id: `host-tab-3::${THIRD_LEAF_ID}`,
+            title: 'replacement agent',
+            parentTabId: 'host-tab-3',
+            leafId: THIRD_LEAF_ID,
+            isActive: true,
+            status: 'ready',
+            terminal: 'terminal-3',
+            agentStatus: {
+              state: 'waiting',
+              prompt: 'replacement question',
+              updatedAt: NOW + 1,
+              stateStartedAt: NOW + 1,
+              agentType: 'codex',
+              paneKey: `host-tab-3::${THIRD_LEAF_ID}`,
+              stateHistory: []
+            }
+          }
+        ],
+        { snapshotVersion: 3 }
+      ),
+      makeSnapshot(
+        [
+          {
+            type: 'markdown',
+            id: 'host-readme-unified',
+            title: 'README.md',
+            filePath: '/repo/README.md',
+            relativePath: 'README.md',
+            language: 'markdown',
+            mode: 'edit',
+            isDirty: false,
+            isActive: true,
+            sourceFileId: '/repo/README.md',
+            sourceFilePath: '/repo/README.md',
+            sourceRelativePath: 'README.md',
+            documentVersion: 'file:/repo/README.md'
+          }
+        ],
+        {
+          worktree: secondWorktree,
+          snapshotVersion: 2,
+          activeGroupId: 'host-group-2',
+          activeTabId: 'host-readme-unified',
+          activeTabType: 'markdown'
+        }
+      )
+    ]
+    const provisionalTab: TerminalTab = {
+      id: 'host-tab-1',
+      ptyId: null,
+      worktreeId: WT,
+      title: 'Codex',
+      defaultTitle: 'Codex',
+      customTitle: null,
+      color: null,
+      sortOrder: 0,
+      createdAt: NOW,
+      launchAgent: 'codex'
+    }
+    const initial = makeState({
+      activeWorktreeId: null,
+      tabsByWorktree: { [WT]: [provisionalTab] },
+      pendingStartupByTabId: {
+        [provisionalTab.id]: { command: 'codex' }
+      },
+      automaticAgentResumeClaimsByTabId: {
+        [provisionalTab.id]: {
+          worktreeId: WT,
+          launchAgent: 'codex',
+          providerSession: { key: 'session_id', id: 'session-a' }
+        }
+      }
+    })
+    const initialCopy = structuredClone(initial)
+    let sequential = initial
+    for (const snapshot of snapshots) {
+      const patch = applyWebSessionTabsSnapshot(sequential, snapshot, ENV, NOW)
+      if (patch !== sequential) {
+        sequential = { ...sequential, ...patch }
+      }
+    }
+
+    resetWebSessionTabsSnapshotFreshnessForTests()
+    const batchPatch = applyWebSessionTabsSnapshots(initial, snapshots, ENV, NOW)
+    const batched = { ...initial, ...batchPatch }
+
+    expect(batched).toEqual(sequential)
+    expect(initial).toEqual(initialCopy)
+  })
+
+  it('matches sequential open-file reconciliation across an editor-heavy batch', () => {
+    const secondWorktree = 'repo::/other-worktree'
+    const editorSurface = (
+      id: string,
+      path: string,
+      overrides: { isDirty?: boolean } = {}
+    ): RuntimeMobileSessionTabsResult['tabs'][number] =>
+      ({
+        type: 'file',
+        id,
+        title: pathPosix.basename(path),
+        filePath: path,
+        relativePath: path.replace(/^\/repo\//, ''),
+        language: 'typescript',
+        isDirty: overrides.isDirty ?? false,
+        isActive: true
+      }) as RuntimeMobileSessionTabsResult['tabs'][number]
+    const mirroredFile = (path: string, worktree: string): OpenFile =>
+      ({
+        id: path,
+        filePath: path,
+        relativePath: path.replace(/^\/repo\//, ''),
+        worktreeId: worktree,
+        language: 'typescript',
+        isDirty: false,
+        runtimeEnvironmentId: ENV,
+        mode: 'edit',
+        mirroredFromRuntimeSession: true
+      }) as OpenFile
+    const initial = makeState({
+      activeWorktreeId: WT,
+      activeFileId: '/repo/a.ts',
+      activeFileIdByWorktree: { [WT]: '/repo/a.ts' },
+      openFiles: [
+        // Why: a bystander worktree's files must keep their positions through the batch.
+        mirroredFile('/repo/bystander-1.ts', 'repo::/bystander'),
+        mirroredFile('/repo/a.ts', WT),
+        // Why: locally opened (not host-mirrored) files must survive a host omission.
+        {
+          ...mirroredFile('/repo/local-only.ts', WT),
+          mirroredFromRuntimeSession: false
+        } as OpenFile,
+        // Why: same (worktree, id) as a mirrored file but a different environment —
+        // the duplicate case that makes the first-wins lookup observable.
+        {
+          ...mirroredFile('/repo/a.ts', WT),
+          runtimeEnvironmentId: 'other-env'
+        } as OpenFile,
+        mirroredFile('/repo/dropped.ts', WT),
+        mirroredFile('/repo/bystander-2.ts', 'repo::/bystander'),
+        mirroredFile('/repo/second.ts', secondWorktree)
+      ]
+    })
+    const snapshots: RuntimeMobileSessionTabsResult[] = [
+      // Drops /repo/dropped.ts and flips a.ts dirty.
+      makeSnapshot([editorSurface('host-a', '/repo/a.ts', { isDirty: true })], {
+        activeTabId: 'host-a',
+        activeTabType: 'file'
+      }),
+      makeSnapshot([editorSurface('host-second', '/repo/second.ts')], {
+        worktree: secondWorktree,
+        activeGroupId: 'host-group-2',
+        activeTabId: 'host-second',
+        activeTabType: 'file'
+      }),
+      // Same worktree again: adds a file, so the batch must see snapshot 1's result.
+      makeSnapshot(
+        [
+          editorSurface('host-a', '/repo/a.ts', { isDirty: true }),
+          editorSurface('host-b', '/repo/b.ts')
+        ],
+        { snapshotVersion: 2, activeTabId: 'host-b', activeTabType: 'file' }
+      ),
+      // Host drops every editor for the second worktree.
+      makeSnapshot([], {
+        worktree: secondWorktree,
+        snapshotVersion: 2,
+        activeGroupId: null,
+        activeTabId: null,
+        activeTabType: null
+      })
+    ]
+    const initialCopy = structuredClone(initial)
+
+    let sequential = initial
+    for (const snapshot of snapshots) {
+      const patch = applyWebSessionTabsSnapshot(sequential, snapshot, ENV, NOW)
+      if (patch !== sequential) {
+        sequential = { ...sequential, ...patch }
+      }
+    }
+
+    resetWebSessionTabsSnapshotFreshnessForTests()
+    const batched = {
+      ...initial,
+      ...applyWebSessionTabsSnapshots(initial, snapshots, ENV, NOW)
+    }
+
+    expect(batched.openFiles).toEqual(sequential.openFiles)
+    expect(batched).toEqual(sequential)
+    expect(initial).toEqual(initialCopy)
+    // Pin the observable outcomes rather than only cross-checking the two paths.
+    expect(batched.openFiles.map((file) => file.id)).toEqual([
+      '/repo/bystander-1.ts',
+      '/repo/local-only.ts',
+      '/repo/a.ts',
+      '/repo/bystander-2.ts',
+      '/repo/a.ts',
+      '/repo/b.ts'
+    ])
+    expect(
+      batched.openFiles.find(
+        (file) => file.id === '/repo/a.ts' && file.runtimeEnvironmentId === 'other-env'
+      )
+    ).toBeDefined()
+    expect(batched.openFiles.some((file) => file.id === '/repo/dropped.ts')).toBe(false)
+    expect(batched.openFiles.some((file) => file.id === '/repo/second.ts')).toBe(false)
+  })
+
+  it('seeds a mirrored editor file from the first duplicate open file, as find() did', () => {
+    // Why: two entries share (worktree, id) and differ only in a field the mirrored
+    // file inherits, so which duplicate seeds the spread is observable.
+    const duplicate = (signature: string, environmentId: string | null): OpenFile =>
+      ({
+        id: '/repo/dup.ts',
+        filePath: '/repo/dup.ts',
+        relativePath: 'dup.ts',
+        worktreeId: WT,
+        language: 'typescript',
+        isDirty: false,
+        runtimeEnvironmentId: environmentId,
+        mode: 'edit',
+        mirroredFromRuntimeSession: true,
+        lastKnownDiskSignature: signature
+      }) as OpenFile
+    const snapshot = makeSnapshot(
+      [
+        {
+          type: 'file',
+          id: 'host-dup',
+          title: 'dup.ts',
+          filePath: '/repo/dup.ts',
+          relativePath: 'dup.ts',
+          language: 'typescript',
+          // Why: a compared field must differ, or the reconciled array is equal and
+          // the patch is suppressed before the inherited signature is observable.
+          isDirty: true,
+          isActive: true
+        } as RuntimeMobileSessionTabsResult['tabs'][number]
+      ],
+      { activeTabId: 'host-dup', activeTabType: 'file' }
+    )
+
+    for (const label of ['single', 'batch'] as const) {
+      resetWebSessionTabsSnapshotFreshnessForTests()
+      const state = makeState({
+        openFiles: [duplicate('winner', 'other-env'), duplicate('loser', ENV)]
+      })
+      const patch = (
+        label === 'single'
+          ? applyWebSessionTabsSnapshot(state, snapshot, ENV, NOW)
+          : applyWebSessionTabsSnapshots(state, [snapshot], ENV, NOW)
+      ) as Partial<WebSessionTabsSyncState>
+      const mirrored = patch.openFiles?.find(
+        (file) => file.id === '/repo/dup.ts' && file.runtimeEnvironmentId === ENV
+      )
+      expect(mirrored?.lastKnownDiskSignature, label).toBe('winner')
+    }
+  })
+
+  it('keeps the editor pane visible when the host republishes the active editor file', () => {
+    // Why: the active file is re-mirrored, so it leaves the surviving set as a
+    // replaced id and must come back as a mirrored id — otherwise focus falls
+    // through to the terminal on every reconnect.
+    const activeFile = {
+      id: '/repo/focused.ts',
+      filePath: '/repo/focused.ts',
+      relativePath: 'focused.ts',
+      worktreeId: WT,
+      language: 'typescript',
+      isDirty: false,
+      runtimeEnvironmentId: ENV,
+      mode: 'edit',
+      mirroredFromRuntimeSession: true
+    } as OpenFile
+    const snapshot = makeSnapshot(
+      [
+        {
+          type: 'terminal',
+          id: HOST_SURFACE_ID,
+          title: 'host shell',
+          parentTabId: 'host-tab-1',
+          leafId: LEAF_ID,
+          isActive: true,
+          status: 'ready',
+          terminal: 'terminal-1'
+        },
+        {
+          type: 'file',
+          id: 'host-focused',
+          title: 'focused.ts',
+          filePath: '/repo/focused.ts',
+          relativePath: 'focused.ts',
+          language: 'typescript',
+          isDirty: false,
+          isActive: false
+        } as RuntimeMobileSessionTabsResult['tabs'][number]
+      ],
+      { activeTabId: HOST_SURFACE_ID, activeTabType: 'terminal' }
+    )
+
+    for (const label of ['single', 'batch'] as const) {
+      resetWebSessionTabsSnapshotFreshnessForTests()
+      const state = makeState({
+        activeWorktreeId: WT,
+        activeFileId: activeFile.id,
+        activeFileIdByWorktree: { [WT]: activeFile.id },
+        activeTabTypeByWorktree: { [WT]: 'editor' },
+        activeTabType: 'editor',
+        openFiles: [activeFile]
+      })
+      const patch = (
+        label === 'single'
+          ? applyWebSessionTabsSnapshot(state, snapshot, ENV, NOW)
+          : applyWebSessionTabsSnapshots(state, [snapshot], ENV, NOW)
+      ) as Partial<WebSessionTabsSyncState>
+      const nextTabType = patch.activeTabTypeByWorktree?.[WT] ?? state.activeTabTypeByWorktree[WT]
+      expect(nextTabType, label).toBe('editor')
+      expect(patch.activeFileIdByWorktree?.[WT] ?? state.activeFileIdByWorktree[WT], label).toBe(
+        activeFile.id
+      )
+    }
+  })
+
+  it('rebuilds an open file the batch closed and reopened, as sequential does', () => {
+    // Why: a batch whose net effect is openFileEqual to its input must still adopt the
+    // rebuilt file. Deferring the equality check to the end of the batch would keep the
+    // pre-batch object and its per-file state (autosave gates, disk signature).
+    const beforeBatch = {
+      id: '/repo/a.ts',
+      filePath: '/repo/a.ts',
+      relativePath: 'a.ts',
+      worktreeId: WT,
+      language: 'typescript',
+      isDirty: false,
+      runtimeEnvironmentId: ENV,
+      mode: 'edit',
+      mirroredFromRuntimeSession: true,
+      lastKnownDiskSignature: 'stale-signature'
+    } as OpenFile
+    const editorSnapshot = (path: string, version: number): RuntimeMobileSessionTabsResult =>
+      makeSnapshot(
+        [
+          {
+            type: 'file',
+            id: `host-${path}`,
+            title: path,
+            filePath: path,
+            relativePath: path.slice('/repo/'.length),
+            language: 'typescript',
+            isDirty: false,
+            isActive: true
+          } as RuntimeMobileSessionTabsResult['tabs'][number]
+        ],
+        { snapshotVersion: version, activeTabId: `host-${path}`, activeTabType: 'file' }
+      )
+    // Closes a.ts, then reopens it — net content is equal, but the object is new.
+    const snapshots = [editorSnapshot('/repo/b.ts', 1), editorSnapshot('/repo/a.ts', 2)]
+    const state = makeState({ openFiles: [beforeBatch] })
+
+    resetWebSessionTabsSnapshotFreshnessForTests()
+    let sequential = state
+    for (const snapshot of snapshots) {
+      const patch = applyWebSessionTabsSnapshot(sequential, snapshot, ENV, NOW)
+      if (patch !== sequential) {
+        sequential = { ...sequential, ...patch }
+      }
+    }
+
+    resetWebSessionTabsSnapshotFreshnessForTests()
+    const batched = { ...state, ...applyWebSessionTabsSnapshots(state, snapshots, ENV, NOW) }
+
+    expect(batched.openFiles).toEqual(sequential.openFiles)
+    expect(batched.openFiles.map((file) => file.id)).toEqual(['/repo/a.ts'])
+    expect(batched.openFiles[0]?.lastKnownDiskSignature).toBeUndefined()
+  })
+
+  it('keeps the matching-environment duplicate when a batch rebuild is a no-op', () => {
+    // Why: the rebuilt file is seeded from the first (worktree, id) match, which here
+    // belongs to another environment. When the rebuild changes nothing, the original
+    // must survive rather than be swapped for a clone of the other environment's entry.
+    const duplicate = (environmentId: string, signature: string): OpenFile =>
+      ({
+        id: '/repo/b.ts',
+        filePath: '/repo/b.ts',
+        relativePath: 'b.ts',
+        worktreeId: WT,
+        language: 'typescript',
+        isDirty: false,
+        runtimeEnvironmentId: environmentId,
+        mode: 'edit',
+        mirroredFromRuntimeSession: true,
+        lastKnownDiskSignature: signature
+      }) as OpenFile
+    const state = makeState({
+      openFiles: [duplicate('other-env', 'sig-other-env'), duplicate(ENV, 'sig-this-env')]
+    })
+    const republish = makeSnapshot(
+      [
+        {
+          type: 'file',
+          id: 'host-b',
+          title: 'b.ts',
+          filePath: '/repo/b.ts',
+          relativePath: 'b.ts',
+          language: 'typescript',
+          isDirty: false,
+          isActive: true
+        } as RuntimeMobileSessionTabsResult['tabs'][number]
+      ],
+      { activeTabId: 'host-b', activeTabType: 'file' }
+    )
+    // A second worktree changes, so the batch cannot stay a whole-array no-op.
+    const otherWorktree = makeSnapshot(
+      [
+        {
+          type: 'file',
+          id: 'host-x',
+          title: 'x.ts',
+          filePath: '/other/x.ts',
+          relativePath: 'x.ts',
+          language: 'typescript',
+          isDirty: false,
+          isActive: true
+        } as RuntimeMobileSessionTabsResult['tabs'][number]
+      ],
+      {
+        worktree: 'repo::/other',
+        activeGroupId: 'host-group-other',
+        activeTabId: 'host-x',
+        activeTabType: 'file'
+      }
+    )
+    const snapshots = [republish, otherWorktree]
+
+    resetWebSessionTabsSnapshotFreshnessForTests()
+    let sequential = state
+    for (const snapshot of snapshots) {
+      const patch = applyWebSessionTabsSnapshot(sequential, snapshot, ENV, NOW)
+      if (patch !== sequential) {
+        sequential = { ...sequential, ...patch }
+      }
+    }
+
+    resetWebSessionTabsSnapshotFreshnessForTests()
+    const batched = { ...state, ...applyWebSessionTabsSnapshots(state, snapshots, ENV, NOW) }
+
+    expect(batched.openFiles).toEqual(sequential.openFiles)
+    expect(
+      batched.openFiles
+        .filter((file) => file.id === '/repo/b.ts')
+        .map((file) => file.lastKnownDiskSignature)
+    ).toEqual(['sig-other-env', 'sig-this-env'])
+  })
+
+  it('keeps another environment’s duplicate active when this environment culls the id', () => {
+    // Why: culling is scoped to the publishing environment. A same-id file owned by a
+    // different environment survives, so it must still count as the active editor.
+    const duplicate = (environmentId: string): OpenFile =>
+      ({
+        id: '/repo/shared.ts',
+        filePath: '/repo/shared.ts',
+        relativePath: 'shared.ts',
+        worktreeId: WT,
+        language: 'typescript',
+        isDirty: false,
+        runtimeEnvironmentId: environmentId,
+        mode: 'edit',
+        mirroredFromRuntimeSession: true
+      }) as OpenFile
+    // Publishes a terminal and no editors, so this environment culls /repo/shared.ts.
+    const snapshot = makeSnapshot([
+      {
+        type: 'terminal',
+        id: HOST_SURFACE_ID,
+        title: 'host shell',
+        parentTabId: 'host-tab-1',
+        leafId: LEAF_ID,
+        isActive: true,
+        status: 'ready',
+        terminal: 'terminal-1'
+      }
+    ])
+
+    for (const label of ['single', 'batch'] as const) {
+      resetWebSessionTabsSnapshotFreshnessForTests()
+      const state = makeState({
+        activeWorktreeId: WT,
+        activeFileId: '/repo/shared.ts',
+        activeFileIdByWorktree: { [WT]: '/repo/shared.ts' },
+        activeTabTypeByWorktree: { [WT]: 'editor' },
+        activeTabType: 'editor',
+        openFiles: [duplicate('other-env'), duplicate(ENV)]
+      })
+      const patch = (
+        label === 'single'
+          ? applyWebSessionTabsSnapshot(state, snapshot, ENV, NOW)
+          : applyWebSessionTabsSnapshots(state, [snapshot], ENV, NOW)
+      ) as Partial<WebSessionTabsSyncState>
+      const nextOpenFiles = patch.openFiles ?? state.openFiles
+      expect(
+        nextOpenFiles.map((file) => file.runtimeEnvironmentId),
+        label
+      ).toEqual(['other-env'])
+      expect(patch.activeTabTypeByWorktree?.[WT] ?? state.activeTabTypeByWorktree[WT], label).toBe(
+        'editor'
+      )
+    }
+  })
+
+  it('keeps a batch that only revisits unchanged open files off the patch', () => {
+    const unchanged: OpenFile = {
+      id: '/repo/steady.ts',
+      filePath: '/repo/steady.ts',
+      relativePath: 'steady.ts',
+      worktreeId: WT,
+      language: 'typescript',
+      isDirty: false,
+      runtimeEnvironmentId: ENV,
+      mode: 'edit',
+      mirroredFromRuntimeSession: true
+    } as OpenFile
+    const state = makeState({ openFiles: [unchanged] })
+    const snapshot = makeSnapshot(
+      [
+        {
+          type: 'file',
+          id: 'host-steady',
+          title: 'steady.ts',
+          filePath: '/repo/steady.ts',
+          relativePath: 'steady.ts',
+          language: 'typescript',
+          isDirty: false,
+          isActive: true
+        } as RuntimeMobileSessionTabsResult['tabs'][number]
+      ],
+      { activeTabId: 'host-steady', activeTabType: 'file' }
+    )
+
+    const patch = applyWebSessionTabsSnapshots(
+      state,
+      [snapshot],
+      ENV,
+      NOW
+    ) as Partial<WebSessionTabsSyncState>
+
+    expect(Object.hasOwn(patch, 'openFiles')).toBe(false)
+    expect(state.openFiles).toEqual([unchanged])
+  })
+
   it('replaces temporary web-created tabs once the host publishes the same PTY', () => {
     const localTab: TerminalTab = {
       id: 'local-web-tab',
@@ -2601,6 +3365,191 @@ describe('applyWebSessionTabsSnapshot', () => {
     expect(followed.groupsByWorktree?.[WT]?.[0]?.activeTabId).toBe(agentTabId)
   })
 
+  it('does not let stale browser intent override a newer terminal selection', () => {
+    const terminalId = toWebTerminalSurfaceTabId('host-terminal')
+    const terminalTab: Tab = {
+      id: terminalId,
+      entityId: terminalId,
+      groupId: 'host-group-1',
+      worktreeId: WT,
+      contentType: 'terminal',
+      label: 'shell',
+      customLabel: null,
+      color: null,
+      sortOrder: 0,
+      createdAt: NOW,
+      isPreview: false,
+      isPinned: false
+    }
+    recordWebSessionFocusIntent(
+      { environmentId: ENV },
+      WT,
+      'host-browser',
+      undefined,
+      'previous-local-tab'
+    )
+
+    const patch = applyWebSessionTabsSnapshot(
+      makeState({
+        activeTabId: terminalId,
+        activeTabIdByWorktree: { [WT]: terminalId },
+        activeTabType: 'terminal',
+        activeTabTypeByWorktree: { [WT]: 'terminal' },
+        tabsByWorktree: {
+          [WT]: [
+            {
+              id: terminalId,
+              ptyId: 'remote:web-env-1@@terminal-1',
+              worktreeId: WT,
+              title: 'shell',
+              customTitle: null,
+              color: null,
+              sortOrder: 0,
+              createdAt: NOW
+            }
+          ]
+        },
+        unifiedTabsByWorktree: { [WT]: [terminalTab] },
+        groupsByWorktree: {
+          [WT]: [
+            {
+              id: 'host-group-1',
+              worktreeId: WT,
+              activeTabId: terminalId,
+              tabOrder: [terminalId],
+              recentTabIds: [terminalId]
+            }
+          ]
+        }
+      }),
+      makeSnapshot(
+        [
+          {
+            type: 'terminal',
+            id: `host-terminal::${LEAF_ID}`,
+            title: 'shell',
+            parentTabId: 'host-terminal',
+            leafId: LEAF_ID,
+            isActive: false,
+            status: 'ready',
+            terminal: 'terminal-1'
+          },
+          {
+            type: 'browser',
+            id: 'host-browser',
+            title: 'Preview',
+            browserWorkspaceId: 'host-browser-workspace',
+            browserPageId: 'host-browser-page',
+            url: 'file:///repo/index.html',
+            loading: false,
+            canGoBack: false,
+            canGoForward: false,
+            isActive: true
+          }
+        ],
+        { activeTabId: 'host-browser', activeTabType: 'browser' }
+      ),
+      ENV,
+      NOW + 1
+    ) as Partial<WebSessionTabsSyncState>
+
+    expect(patch.activeTabType).toBeUndefined()
+    expect(patch.activeTabIdByWorktree?.[WT]).toBeUndefined()
+    expect(patch.groupsByWorktree?.[WT]?.[0]?.activeTabId).toBe(terminalId)
+  })
+
+  it('does not let stale browser intent override a newer editor selection', () => {
+    const fileId = '/repo/index.html'
+    const editorTab: Tab = {
+      id: 'local-editor',
+      entityId: fileId,
+      groupId: 'host-group-1',
+      worktreeId: WT,
+      contentType: 'editor',
+      label: 'index.html',
+      customLabel: null,
+      color: null,
+      sortOrder: 0,
+      createdAt: NOW,
+      isPreview: false,
+      isPinned: false
+    }
+    recordWebSessionFocusIntent(
+      { environmentId: ENV },
+      WT,
+      'host-browser',
+      undefined,
+      'previous-local-tab'
+    )
+
+    const patch = applyWebSessionTabsSnapshot(
+      makeState({
+        activeFileId: fileId,
+        activeFileIdByWorktree: { [WT]: fileId },
+        activeTabType: 'editor',
+        activeTabTypeByWorktree: { [WT]: 'editor' },
+        openFiles: [
+          {
+            id: fileId,
+            filePath: fileId,
+            relativePath: 'index.html',
+            worktreeId: WT,
+            language: 'html',
+            isDirty: false,
+            runtimeEnvironmentId: ENV,
+            mode: 'edit',
+            mirroredFromRuntimeSession: true
+          } as OpenFile
+        ],
+        unifiedTabsByWorktree: { [WT]: [editorTab] },
+        groupsByWorktree: {
+          [WT]: [
+            {
+              id: 'host-group-1',
+              worktreeId: WT,
+              activeTabId: editorTab.id,
+              tabOrder: [editorTab.id],
+              recentTabIds: [editorTab.id]
+            }
+          ]
+        }
+      }),
+      makeSnapshot(
+        [
+          {
+            type: 'file',
+            id: 'host-editor',
+            title: 'index.html',
+            filePath: fileId,
+            relativePath: 'index.html',
+            language: 'html',
+            isDirty: false,
+            isActive: false
+          },
+          {
+            type: 'browser',
+            id: 'host-browser',
+            title: 'Preview',
+            browserWorkspaceId: 'host-browser-workspace',
+            browserPageId: 'host-browser-page',
+            url: 'file:///repo/index.html',
+            loading: false,
+            canGoBack: false,
+            canGoForward: false,
+            isActive: true
+          }
+        ],
+        { activeTabId: 'host-browser', activeTabType: 'browser' }
+      ),
+      ENV,
+      NOW + 1
+    ) as Partial<WebSessionTabsSyncState>
+
+    expect(patch.activeTabType).toBeUndefined()
+    expect(patch.activeFileIdByWorktree?.[WT]).toBeUndefined()
+    expect(patch.groupsByWorktree?.[WT]?.[0]?.activeTabId).toBe('host-editor')
+  })
+
   it('focuses a caller-created terminal even when an older host leaves it inactive', () => {
     const existingTabId = toWebTerminalSurfaceTabId('host-tab-1')
     const newTabId = toWebTerminalSurfaceTabId('host-tab-2')
@@ -2877,28 +3826,30 @@ describe('applyWebSessionTabsSnapshot', () => {
       }
     }
 
+    const state = makeState({
+      activeTabId: mirroredTabId,
+      activeTabIdByWorktree: { [WT]: mirroredTabId },
+      activeTabType: 'terminal',
+      activeTabTypeByWorktree: { [WT]: 'terminal' },
+      tabsByWorktree: {
+        [WT]: [
+          {
+            id: mirroredTabId,
+            ptyId: 'remote:web-env-1@@terminal-2',
+            worktreeId: WT,
+            title: 'right pane',
+            customTitle: null,
+            color: null,
+            sortOrder: 0,
+            createdAt: NOW
+          }
+        ]
+      },
+      terminalLayoutsByTabId: { [mirroredTabId]: currentLayout }
+    })
+
     const patch = applyWebSessionTabsSnapshot(
-      makeState({
-        activeTabId: mirroredTabId,
-        activeTabIdByWorktree: { [WT]: mirroredTabId },
-        activeTabType: 'terminal',
-        activeTabTypeByWorktree: { [WT]: 'terminal' },
-        tabsByWorktree: {
-          [WT]: [
-            {
-              id: mirroredTabId,
-              ptyId: 'remote:web-env-1@@terminal-2',
-              worktreeId: WT,
-              title: 'right pane',
-              customTitle: null,
-              color: null,
-              sortOrder: 0,
-              createdAt: NOW
-            }
-          ]
-        },
-        terminalLayoutsByTabId: { [mirroredTabId]: currentLayout }
-      }),
+      state,
       makeSnapshot([
         {
           type: 'terminal',
@@ -2938,7 +3889,11 @@ describe('applyWebSessionTabsSnapshot', () => {
       ptyId: 'remote:web-env-1@@terminal-2',
       title: 'right pane'
     })
-    expect(patch.terminalLayoutsByTabId?.[mirroredTabId]?.activeLeafId).toBe(SECOND_LEAF_ID)
+    // No layout patch at all, and the effective layout keeps the local active leaf.
+    expect(patch.terminalLayoutsByTabId).toBeUndefined()
+    expect({ ...state, ...patch }.terminalLayoutsByTabId[mirroredTabId]?.activeLeafId).toBe(
+      SECOND_LEAF_ID
+    )
   })
 
   it('removes a null-pty pending activation tab when the host publishes the initial terminal', () => {
@@ -3162,6 +4117,316 @@ describe('applyWebSessionTabsSnapshot', () => {
     expect(patch.layoutByWorktree).toBeUndefined()
   })
 
+  it('keeps one remote browser in its client-owned side-preview group', () => {
+    const editorGroupId = 'client-editor-group'
+    const previewGroupId = 'client-preview-group'
+    recordWebSessionBrowserPlacement({
+      environmentId: ENV,
+      worktreeId: WT,
+      remotePageId: 'host-browser-page',
+      groupId: previewGroupId
+    })
+
+    const patch = applyWebSessionTabsSnapshot(
+      makeState({
+        groupsByWorktree: {
+          [WT]: [
+            {
+              id: editorGroupId,
+              worktreeId: WT,
+              activeTabId: 'local-editor',
+              tabOrder: ['local-editor']
+            },
+            {
+              id: previewGroupId,
+              worktreeId: WT,
+              activeTabId: null,
+              tabOrder: []
+            }
+          ]
+        },
+        layoutByWorktree: {
+          [WT]: {
+            type: 'split',
+            direction: 'horizontal',
+            first: { type: 'leaf', groupId: editorGroupId },
+            second: { type: 'leaf', groupId: previewGroupId },
+            ratio: 0.5
+          }
+        },
+        unifiedTabsByWorktree: {
+          [WT]: [
+            {
+              id: 'local-editor',
+              worktreeId: WT,
+              groupId: editorGroupId,
+              contentType: 'editor',
+              entityId: 'local-file',
+              label: 'example.html',
+              sortOrder: 0,
+              createdAt: NOW,
+              isPreview: false,
+              isPinned: false,
+              customLabel: null,
+              color: null
+            }
+          ]
+        }
+      }),
+      makeSnapshot(
+        [
+          {
+            type: 'browser',
+            id: 'host-browser-tab',
+            title: 'example.html',
+            browserWorkspaceId: 'host-browser-workspace',
+            browserPageId: 'host-browser-page',
+            url: 'file:///srv/repo/example.html',
+            loading: false,
+            canGoBack: false,
+            canGoForward: false,
+            isActive: true
+          }
+        ],
+        { activeTabId: 'host-browser-tab', activeTabType: 'browser' }
+      ),
+      ENV,
+      NOW
+    ) as Partial<WebSessionTabsSyncState>
+
+    const browserTab = patch.unifiedTabsByWorktree?.[WT]?.find(
+      (tab) => tab.contentType === 'browser'
+    )
+    expect(browserTab).toMatchObject({ id: 'host-browser-tab', groupId: previewGroupId })
+    expect(
+      patch.groupsByWorktree?.[WT]?.find((group) => group.id === previewGroupId)
+    ).toMatchObject({ activeTabId: 'host-browser-tab', tabOrder: ['host-browser-tab'] })
+    expect(patch.groupsByWorktree?.[WT]?.find((group) => group.id === editorGroupId)).toMatchObject(
+      { activeTabId: 'local-editor', tabOrder: ['local-editor'] }
+    )
+    expect(patch.browserTabsByWorktree?.[WT]).toHaveLength(1)
+  })
+
+  it('replays a pre-response browser snapshot after canonical placement and focus are known', () => {
+    const editorGroupId = 'client-editor-group'
+    const previewGroupId = 'client-preview-group'
+    const editorFileId = '/srv/repo/example.html'
+    const editorTab: Tab = {
+      id: 'host-editor',
+      worktreeId: WT,
+      groupId: editorGroupId,
+      contentType: 'editor',
+      entityId: editorFileId,
+      label: 'example.html',
+      sortOrder: 0,
+      createdAt: NOW,
+      isPreview: false,
+      isPinned: false,
+      customLabel: null,
+      color: null
+    }
+    const state = makeState({
+      activeFileId: editorFileId,
+      activeFileIdByWorktree: { [WT]: editorFileId },
+      activeTabType: 'editor',
+      activeTabTypeByWorktree: { [WT]: 'editor' },
+      activeGroupIdByWorktree: { [WT]: editorGroupId },
+      groupsByWorktree: {
+        [WT]: [
+          {
+            id: editorGroupId,
+            worktreeId: WT,
+            activeTabId: editorTab.id,
+            tabOrder: [editorTab.id]
+          },
+          {
+            id: previewGroupId,
+            worktreeId: WT,
+            activeTabId: null,
+            tabOrder: []
+          }
+        ]
+      },
+      layoutByWorktree: {
+        [WT]: {
+          type: 'split',
+          direction: 'horizontal',
+          first: { type: 'leaf', groupId: editorGroupId },
+          second: { type: 'leaf', groupId: previewGroupId },
+          ratio: 0.5
+        }
+      },
+      unifiedTabsByWorktree: { [WT]: [editorTab] }
+    })
+    const snapshot = makeSnapshot(
+      [
+        {
+          type: 'file',
+          id: 'host-editor',
+          title: 'example.html',
+          filePath: editorFileId,
+          relativePath: 'example.html',
+          language: 'html',
+          isDirty: false,
+          isActive: false
+        },
+        {
+          type: 'browser',
+          id: 'host-browser-tab',
+          title: 'example.html',
+          browserWorkspaceId: 'host-browser-workspace',
+          browserPageId: 'host-browser-page',
+          url: 'file:///srv/repo/example.html',
+          loading: false,
+          canGoBack: false,
+          canGoForward: false,
+          isActive: true
+        }
+      ],
+      { activeTabId: 'host-browser-tab', activeTabType: 'browser' }
+    )
+    recordWebSessionBrowserPlacement({
+      environmentId: ENV,
+      worktreeId: WT,
+      remotePageId: 'provisional-browser-page',
+      groupId: previewGroupId
+    })
+
+    const subscriptionPatch = applyFreshWebSessionTabsSnapshot(state, snapshot, ENV, NOW)
+    const afterSubscription = {
+      ...state,
+      ...(subscriptionPatch as Partial<WebSessionTabsSyncState>)
+    }
+    expect(afterSubscription.activeTabType).toBe('editor')
+    expect(
+      afterSubscription.unifiedTabsByWorktree[WT]?.find((tab) => tab.contentType === 'browser')
+        ?.groupId
+    ).not.toBe(previewGroupId)
+
+    moveWebSessionBrowserPlacement({
+      environmentId: ENV,
+      worktreeId: WT,
+      fromRemotePageId: 'provisional-browser-page',
+      toRemotePageId: 'host-browser-page'
+    })
+    recordWebSessionFocusIntent(
+      { environmentId: ENV },
+      WT,
+      'host-browser-page',
+      undefined,
+      editorTab.id
+    )
+    acceptReplayedWebSessionTabsSnapshot(ENV, WT)
+    const replayPatch = applyFreshWebSessionTabsSnapshot(
+      afterSubscription,
+      snapshot,
+      ENV,
+      NOW + 1
+    ) as Partial<WebSessionTabsSyncState>
+    const afterReplay = { ...afterSubscription, ...replayPatch }
+
+    expect(
+      afterReplay.unifiedTabsByWorktree[WT]?.find((tab) => tab.contentType === 'browser')
+    ).toMatchObject({ id: 'host-browser-tab', groupId: previewGroupId })
+    expect(
+      afterReplay.groupsByWorktree[WT]?.find((group) => group.id === previewGroupId)
+    ).toMatchObject({ activeTabId: 'host-browser-tab', tabOrder: ['host-browser-tab'] })
+    expect(afterReplay.activeBrowserTabIdByWorktree[WT]).toBe('host-browser-workspace')
+    expect(afterReplay.activeTabTypeByWorktree[WT]).toBe('browser')
+  })
+
+  it('keeps a reserved side-preview split across a pre-publication snapshot', () => {
+    const editorGroupId = 'client-editor-group'
+    const previewGroupId = 'client-preview-group'
+    const initialLayout: TabGroupLayoutNode = {
+      type: 'split',
+      direction: 'horizontal',
+      first: { type: 'leaf', groupId: editorGroupId },
+      second: { type: 'leaf', groupId: previewGroupId },
+      ratio: 0.5
+    }
+    recordWebSessionBrowserPlacement({
+      environmentId: ENV,
+      worktreeId: WT,
+      remotePageId: 'pending-browser-page',
+      groupId: previewGroupId
+    })
+
+    const patch = applyWebSessionTabsSnapshot(
+      makeState({
+        groupsByWorktree: {
+          [WT]: [
+            {
+              id: editorGroupId,
+              worktreeId: WT,
+              activeTabId: 'local-editor',
+              tabOrder: ['local-editor']
+            },
+            {
+              id: previewGroupId,
+              worktreeId: WT,
+              activeTabId: null,
+              tabOrder: []
+            }
+          ]
+        },
+        layoutByWorktree: { [WT]: initialLayout },
+        unifiedTabsByWorktree: {
+          [WT]: [
+            {
+              id: 'local-editor',
+              worktreeId: WT,
+              groupId: editorGroupId,
+              contentType: 'editor',
+              entityId: 'local-file',
+              label: 'example.html',
+              sortOrder: 0,
+              createdAt: NOW,
+              isPreview: false,
+              isPinned: false,
+              customLabel: null,
+              color: null
+            }
+          ]
+        }
+      }),
+      makeSnapshot([], {
+        activeTabType: null,
+        tabGroups: [{ id: editorGroupId, activeTabId: null, tabOrder: [], recentTabIds: [] }],
+        tabGroupLayout: { type: 'leaf', groupId: editorGroupId }
+      }),
+      ENV,
+      NOW
+    ) as Partial<WebSessionTabsSyncState>
+
+    expect(patch.groupsByWorktree?.[WT]?.map((group) => group.id)).toContain(previewGroupId)
+    expect(layoutHasGroup(patch.layoutByWorktree?.[WT] ?? initialLayout, previewGroupId)).toBe(true)
+  })
+
+  it('forgets client browser placement after the host removes the page', () => {
+    recordWebSessionBrowserPlacement({
+      environmentId: ENV,
+      worktreeId: WT,
+      remotePageId: 'host-browser-page',
+      groupId: 'client-preview-group'
+    })
+    takeWebSessionBrowserPlacementGroup({
+      environmentId: ENV,
+      worktreeId: WT,
+      remotePageId: 'host-browser-page'
+    })
+
+    applyWebSessionTabsSnapshot(makeState(), makeSnapshot([]), ENV, NOW)
+
+    expect(
+      takeWebSessionBrowserPlacementGroup({
+        environmentId: ENV,
+        worktreeId: WT,
+        remotePageId: 'host-browser-page'
+      })
+    ).toBeUndefined()
+  })
+
   it('creates a rendered web layout group when stale group records do not include it', () => {
     const visibleGroupId = 'visible-web-group'
     const hostOnlyGroupId = 'host-group-1'
@@ -3247,7 +4512,7 @@ describe('applyWebSessionTabsSnapshot', () => {
     const unifiedTab: Tab = {
       id: 'local-browser-unified',
       entityId: workspace.id,
-      groupId: 'host-group-1',
+      groupId: 'client-moved-group',
       worktreeId: WT,
       contentType: 'browser',
       label: 'New Tab',
@@ -3270,7 +4535,7 @@ describe('applyWebSessionTabsSnapshot', () => {
         groupsByWorktree: {
           [WT]: [
             {
-              id: 'host-group-1',
+              id: 'client-moved-group',
               worktreeId: WT,
               activeTabId: unifiedTab.id,
               tabOrder: [unifiedTab.id],
@@ -3315,10 +4580,9 @@ describe('applyWebSessionTabsSnapshot', () => {
         title: 'Example Domain'
       }
     ])
-    expect(patch.remoteBrowserPageHandlesByPageId?.[page.id]).toEqual({
-      environmentId: ENV,
-      remotePageId: 'host-browser-page'
-    })
+    expect(patch.unifiedTabsByWorktree?.[WT]?.[0]?.groupId).toBe('client-moved-group')
+    // Absent key, not a missing handle: the seeded { ENV, 'host-browser-page' } handle matched.
+    expect(patch.remoteBrowserPageHandlesByPageId).toBeUndefined()
     expect(patch.unifiedTabsByWorktree?.[WT]?.map((tab) => tab.id)).toEqual([
       'local-browser-unified'
     ])
diff --git a/src/renderer/src/runtime/web-session-tabs-sync.ts b/src/renderer/src/runtime/web-session-tabs-sync.ts
index 37ab1feedd2..d0ce2e2c6d5 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync.ts
@@ -1,5 +1,5 @@
 /* eslint-disable max-lines -- web session-tab sync reconciles terminal, unified-tab, group, and PTY maps atomically to avoid split-brain tab state */
-import { useEffect } from 'react'
+import { useEffect, useLayoutEffect, useRef } from 'react'
 import type { AppState } from '../store'
 import { useAppStore } from '../store'
 import type { RuntimeRpcResponse } from '../../../shared/runtime-rpc-envelope'
@@ -8,9 +8,11 @@ import {
   AGENT_STATUS_STALE_AFTER_MS,
   type AgentStatusEntry
 } from '../../../shared/agent-status-types'
+import { agentEntryCompletionAt } from '../../../shared/agent-completion-time'
 import { agentProviderSessionsEqual } from '../../../shared/agent-session-resume'
 import type {
   RuntimeMobileSessionTabsResult,
+  RuntimeMobileSessionTabsRemovedResult,
   RuntimeMobileSessionBrowserTab,
   RuntimeMobileSessionFileTab,
   RuntimeMobileSessionMarkdownTab,
@@ -52,7 +54,8 @@ import { toRuntimeWorktreeSelector } from './runtime-worktree-selector'
 import {
   clearWebSessionFocusIntent,
   clearWebSessionFocusIntentsForOwner,
-  peekWebSessionFocusIntent
+  peekWebSessionFocusIntent,
+  resolveWebSessionVisibleTabId
 } from './web-session-focus-intent'
 import {
   clearWebSessionCloseIntentsForOwner,
@@ -84,8 +87,20 @@ import {
 } from './web-agent-session-handoff'
 import { getRuntimeEnvironmentRevision } from './runtime-environment-revision'
 import { useRuntimeSessionMirrorEnvironmentKey } from './use-runtime-session-mirror-environment-key'
+import {
+  installWindowVisibilitySubscriptionParking,
+  type WindowVisibilitySubscriptionSpec
+} from './window-visibility-subscription-parking'
+import {
+  clearWebSessionBrowserPlacementsForEnvironment,
+  clearWebSessionBrowserPlacementsForWorktree,
+  isWebSessionBrowserPlacementGroupReserved,
+  resetWebSessionBrowserPlacementsForTests,
+  takeWebSessionBrowserPlacementGroup
+} from './web-session-browser-placement'
 
 const WEB_SESSION_GROUP_PREFIX = 'web-session-tabs:'
+export const WEB_SESSION_TABS_VISIBILITY_RESUME_STAGGER_MS = 100
 
 type SessionTabsStreamEvent =
   | (RuntimeMobileSessionTabsResult & { type: 'snapshot' | 'updated' })
@@ -101,10 +116,47 @@ type SnapshotFreshness = {
   snapshotVersion: number
 }
 
+type ReceivedSessionTabsSnapshot = SnapshotFreshness & {
+  receivedFrame: number
+}
+
+type SessionTabsRecoveryState = {
+  pendingCount: number
+}
+
+type SessionTabsRemovalFence = {
+  receivedFrame: number
+  recoveryState: SessionTabsRecoveryState
+  pendingCount: number
+}
+
+type TrackedWebSessionTabsWorktree = {
+  worktree: string
+  freshness: SnapshotFreshness
+}
+
+type VisibilityResumeOmission = {
+  baseline: SnapshotFreshness
+  environmentId: string
+  inventoryReceivedFrame: number
+  superseded: boolean
+  visibilityGeneration: number
+}
+
 const latestSessionTabsSnapshotByWorktree = new Map<string, SnapshotFreshness>()
 const replayableSessionTabsSnapshotByWorktree = new Map<string, SnapshotFreshness>()
+const latestReceivedSessionTabsSnapshotByWorktree = new Map<string, ReceivedSessionTabsSnapshot>()
+const latestSessionTabsRemovalFenceByWorktree = new Map<string, SessionTabsRemovalFence>()
+const sessionTabsRecoveryStateByWorktree = new Map<string, SessionTabsRecoveryState>()
+const trackedSessionTabsWorktreeIdsByEnvironment = new Map<string, Set<string>>()
+const sessionTabsEnvironmentsByWorktree = new Map<string, Set<string>>()
 const lastHostTerminalTabCountByWorktree = new Map<string, number>()
 const hostSessionTabIdByLocalKey = new Map<string, string>()
+const hostSessionTabMappingKeysByEnvironmentAndWorktree = new Map<
+  string,
+  Map<string, Set<string>>
+>()
+let receivedSessionTabsFrameSequence = 0
 
 type TerminalSurface = RuntimeMobileSessionTerminalClientTab
 type ReadyTerminalSurface = RuntimeMobileSessionTerminalClientTab & { status: 'ready' }
@@ -126,6 +178,7 @@ type MirroredBrowserTab = {
   remotePageId: string
   unifiedTab: Tab
   hostTabId: string
+  clientGroupId?: string
 }
 
 type MirroredEditorTab = {
@@ -165,6 +218,43 @@ export type WebSessionTabsSyncState = Pick<
 > &
   Partial<Pick<AppState, 'automaticAgentResumeClaimsByTabId' | 'pendingStartupByTabId'>>
 
+type WebSessionTabsBatchRecordKey =
+  | 'activeBrowserTabIdByWorktree'
+  | 'activeFileIdByWorktree'
+  | 'activeGroupIdByWorktree'
+  | 'activeTabIdByWorktree'
+  | 'activeTabTypeByWorktree'
+  | 'agentStatusByPaneKey'
+  | 'automaticAgentResumeClaimsByTabId'
+  | 'browserCertificateFailuresByPageId'
+  | 'browserPagesByWorkspace'
+  | 'browserTabsByWorktree'
+  | 'groupsByWorktree'
+  | 'layoutByWorktree'
+  | 'pendingStartupByTabId'
+  | 'ptyIdsByTabId'
+  | 'remoteBrowserPageHandlesByPageId'
+  | 'tabBarOrderByWorktree'
+  | 'tabsByWorktree'
+  | 'terminalLayoutsByTabId'
+  | 'unifiedTabsByWorktree'
+  | 'unreadTerminalTabs'
+
+/** Open files bucketed by worktree. A snapshot only reconciles its own worktree, so a
+ *  batch can decide there is nothing to do without walking every open file in the app.
+ *  `source` pins the array it describes; each rebuild updates it in place instead of
+ *  re-bucketing, so a batch never pays for the whole array twice. */
+type WebSessionOpenFilesIndex = {
+  source: readonly OpenFile[]
+  byWorktree: Map<string, OpenFile[]>
+}
+
+type WebSessionTabsBatchContext = {
+  agentPaneKeysByTabId: Map<string, Set<string>> | null
+  changedRecords: Set<WebSessionTabsBatchRecordKey>
+  openFilesIndex: WebSessionOpenFilesIndex | null
+}
+
 function isSessionTabsListAllResult(value: unknown): value is SessionTabsListAllResult {
   return (
     Boolean(value) &&
@@ -177,6 +267,218 @@ function sessionTabsFreshnessKey(environmentId: string, worktreeId: string): str
   return `${environmentId}:${worktreeId}`
 }
 
+function advancesSessionTabsFreshness(
+  snapshot: RuntimeMobileSessionTabsResult,
+  baseline: SnapshotFreshness
+): boolean {
+  return (
+    snapshot.publicationEpoch !== baseline.publicationEpoch ||
+    snapshot.snapshotVersion > baseline.snapshotVersion
+  )
+}
+
+function getTrackedWebSessionTabsWorktrees(environmentId: string): TrackedWebSessionTabsWorktree[] {
+  return [...(trackedSessionTabsWorktreeIdsByEnvironment.get(environmentId) ?? [])].flatMap(
+    (worktree) => {
+      const key = sessionTabsFreshnessKey(environmentId, worktree)
+      const freshness = latestSessionTabsSnapshotByWorktree.get(key)
+      return freshness
+        ? [
+            {
+              worktree,
+              freshness
+            }
+          ]
+        : []
+    }
+  )
+}
+
+function trackWebSessionTabsWorktree(environmentId: string, worktreeId: string): void {
+  const worktrees = trackedSessionTabsWorktreeIdsByEnvironment.get(environmentId) ?? new Set()
+  worktrees.add(worktreeId)
+  trackedSessionTabsWorktreeIdsByEnvironment.set(environmentId, worktrees)
+}
+
+function untrackWebSessionTabsWorktree(environmentId: string, worktreeId: string): void {
+  const worktrees = trackedSessionTabsWorktreeIdsByEnvironment.get(environmentId)
+  if (!worktrees) {
+    return
+  }
+  worktrees.delete(worktreeId)
+  if (worktrees.size === 0) {
+    trackedSessionTabsWorktreeIdsByEnvironment.delete(environmentId)
+  }
+}
+
+function recordReceivedWebSessionTabsSnapshot(
+  environmentId: string,
+  snapshot: RuntimeMobileSessionTabsResult
+): number {
+  const receivedFrame = (receivedSessionTabsFrameSequence += 1)
+  const key = sessionTabsFreshnessKey(environmentId, snapshot.worktree)
+  latestReceivedSessionTabsSnapshotByWorktree.set(key, {
+    receivedFrame,
+    publicationEpoch: snapshot.publicationEpoch,
+    snapshotVersion: snapshot.snapshotVersion
+  })
+  if ((snapshot as { removed?: unknown }).removed === true) {
+    recordReceivedWebSessionTabsRemoval(environmentId, snapshot.worktree, receivedFrame)
+  }
+  return receivedFrame
+}
+
+function recordReceivedWebSessionTabsInventory(): number {
+  return (receivedSessionTabsFrameSequence += 1)
+}
+
+function beginWebSessionTabsSnapshotRecovery(
+  environmentId: string,
+  worktreeId: string,
+  receivedFrame: number
+): () => void {
+  const key = sessionTabsFreshnessKey(environmentId, worktreeId)
+  const recoveryState = sessionTabsRecoveryStateByWorktree.get(key) ?? { pendingCount: 0 }
+  recoveryState.pendingCount += 1
+  sessionTabsRecoveryStateByWorktree.set(key, recoveryState)
+  let settled = false
+  return () => {
+    if (settled) {
+      return
+    }
+    settled = true
+    recoveryState.pendingCount -= 1
+    if (
+      recoveryState.pendingCount === 0 &&
+      sessionTabsRecoveryStateByWorktree.get(key) === recoveryState
+    ) {
+      sessionTabsRecoveryStateByWorktree.delete(key)
+    }
+    const removalFence = latestSessionTabsRemovalFenceByWorktree.get(key)
+    if (
+      removalFence?.recoveryState === recoveryState &&
+      receivedFrame < removalFence.receivedFrame
+    ) {
+      removalFence.pendingCount -= 1
+      if (removalFence.pendingCount === 0) {
+        latestSessionTabsRemovalFenceByWorktree.delete(key)
+      }
+    }
+  }
+}
+
+function recordReceivedWebSessionTabsRemoval(
+  environmentId: string,
+  worktreeId: string,
+  receivedFrame: number
+): void {
+  const key = sessionTabsFreshnessKey(environmentId, worktreeId)
+  const current = latestSessionTabsRemovalFenceByWorktree.get(key)
+  if (current && current.receivedFrame >= receivedFrame) {
+    return
+  }
+  const recoveryState = sessionTabsRecoveryStateByWorktree.get(key)
+  if (!recoveryState || recoveryState.pendingCount === 0) {
+    latestSessionTabsRemovalFenceByWorktree.delete(key)
+    return
+  }
+  latestSessionTabsRemovalFenceByWorktree.set(key, {
+    receivedFrame,
+    recoveryState,
+    pendingCount: recoveryState.pendingCount
+  })
+}
+
+function shouldApplyRecoveredWebSessionTabsSnapshot(
+  environmentId: string,
+  snapshot: RuntimeMobileSessionTabsResult,
+  receivedFrame: number
+): boolean {
+  const key = sessionTabsFreshnessKey(environmentId, snapshot.worktree)
+  const removalFrame = latestSessionTabsRemovalFenceByWorktree.get(key)?.receivedFrame
+  if (removalFrame !== undefined && receivedFrame < removalFrame) {
+    return false
+  }
+  const latest = latestReceivedSessionTabsSnapshotByWorktree.get(key)
+  if (!latest || latest.receivedFrame === receivedFrame) {
+    return latest !== undefined
+  }
+  if (latest.publicationEpoch !== snapshot.publicationEpoch) {
+    return receivedFrame > latest.receivedFrame
+  }
+  return snapshot.snapshotVersion >= latest.snapshotVersion
+}
+
+function isTrackedWebSessionTabsOmissionCurrent(
+  environmentId: string,
+  trackedWorktree: TrackedWebSessionTabsWorktree
+): boolean {
+  const key = sessionTabsFreshnessKey(environmentId, trackedWorktree.worktree)
+  const current = latestSessionTabsSnapshotByWorktree.get(key)
+  return (
+    current?.publicationEpoch === trackedWorktree.freshness.publicationEpoch &&
+    current.snapshotVersion === trackedWorktree.freshness.snapshotVersion
+  )
+}
+
+function recordAcceptedWebSessionTabsEnvironment(
+  environmentId: string,
+  snapshot: RuntimeMobileSessionTabsResult
+): void {
+  const environments = new Set(sessionTabsEnvironmentsByWorktree.get(snapshot.worktree) ?? [])
+  if (snapshot.tabs.length > 0) {
+    environments.add(environmentId)
+  } else {
+    environments.delete(environmentId)
+  }
+  if (environments.size > 0) {
+    sessionTabsEnvironmentsByWorktree.set(snapshot.worktree, environments)
+  } else {
+    sessionTabsEnvironmentsByWorktree.delete(snapshot.worktree)
+  }
+}
+
+function removeWebSessionTabsEnvironment(environmentId: string, worktreeId: string): void {
+  const environments = new Set(sessionTabsEnvironmentsByWorktree.get(worktreeId) ?? [])
+  environments.delete(environmentId)
+  if (environments.size > 0) {
+    sessionTabsEnvironmentsByWorktree.set(worktreeId, environments)
+  } else {
+    sessionTabsEnvironmentsByWorktree.delete(worktreeId)
+  }
+}
+
+// Why: omission means removal only because `listAllMobileSessionTabs` publishes every worktree it knows unfiltered; if a host ever
+// scopes that map, this turns live worktrees into tombstones, so the fence below is deliberately short-lived.
+function buildMissingWebSessionTabsRemovals(
+  environmentId: string,
+  trackedWorktrees: readonly TrackedWebSessionTabsWorktree[],
+  publishedWorktrees: ReadonlySet<string>
+): {
+  trackedWorktree: TrackedWebSessionTabsWorktree
+  snapshot: RuntimeMobileSessionTabsRemovedResult
+}[] {
+  return trackedWorktrees
+    .filter(
+      (trackedWorktree) =>
+        !publishedWorktrees.has(trackedWorktree.worktree) &&
+        isTrackedWebSessionTabsOmissionCurrent(environmentId, trackedWorktree)
+    )
+    .map((trackedWorktree) => ({
+      trackedWorktree,
+      snapshot: {
+        worktree: trackedWorktree.worktree,
+        publicationEpoch: 'visibility-inventory-removal',
+        snapshotVersion: 0,
+        removed: true,
+        activeGroupId: null,
+        activeTabId: null,
+        activeTabType: null,
+        tabs: []
+      }
+    }))
+}
+
 function rememberHostTerminalTabCount(
   environmentId: string,
   snapshot: RuntimeMobileSessionTabsResult
@@ -258,6 +560,8 @@ export function shouldApplyWebSessionTabsSnapshot(
     publicationEpoch: snapshot.publicationEpoch,
     snapshotVersion: snapshot.snapshotVersion
   })
+  trackWebSessionTabsWorktree(environmentId, snapshot.worktree)
+  recordAcceptedWebSessionTabsEnvironment(environmentId, snapshot)
   // Why: a mounted mirror that exhausted bounded polling needs fresh host evidence without subscribing to every store write.
   queueAcceptedWebSessionTerminalSnapshot(snapshot, environmentId)
   return true
@@ -329,17 +633,42 @@ export function shouldSyncAllRuntimeSessionTabs(args: {
 export function resetWebSessionTabsSnapshotFreshnessForTests(): void {
   latestSessionTabsSnapshotByWorktree.clear()
   replayableSessionTabsSnapshotByWorktree.clear()
+  latestReceivedSessionTabsSnapshotByWorktree.clear()
+  latestSessionTabsRemovalFenceByWorktree.clear()
+  sessionTabsRecoveryStateByWorktree.clear()
+  trackedSessionTabsWorktreeIdsByEnvironment.clear()
+  sessionTabsEnvironmentsByWorktree.clear()
+  receivedSessionTabsFrameSequence = 0
   lastHostTerminalTabCountByWorktree.clear()
   hostSessionTabIdByLocalKey.clear()
+  hostSessionTabMappingKeysByEnvironmentAndWorktree.clear()
+  resetWebSessionBrowserPlacementsForTests()
 }
 
 export function _getWebSessionTabsTrackingCountsForTest(): {
   freshness: number
   hostMappings: number
+  hostMappingWorktrees: number
 } {
+  let hostMappingWorktrees = 0
+  for (const mappingKeysByWorktree of hostSessionTabMappingKeysByEnvironmentAndWorktree.values()) {
+    hostMappingWorktrees += mappingKeysByWorktree.size
+  }
   return {
     freshness: latestSessionTabsSnapshotByWorktree.size,
-    hostMappings: hostSessionTabIdByLocalKey.size
+    hostMappings: hostSessionTabIdByLocalKey.size,
+    // Why: the mapping index is a parallel structure, so leak tests must see it drain alongside the flat map.
+    hostMappingWorktrees
+  }
+}
+
+export function _getWebSessionTabsRecoveryTrackingCountsForTest(): {
+  pendingRecoveries: number
+  removalFrames: number
+} {
+  return {
+    pendingRecoveries: sessionTabsRecoveryStateByWorktree.size,
+    removalFrames: latestSessionTabsRemovalFenceByWorktree.size
   }
 }
 
@@ -347,17 +676,16 @@ function clearWebSessionTabsTrackingForWorktree(environmentId: string, worktreeI
   const key = sessionTabsFreshnessKey(environmentId, worktreeId)
   latestSessionTabsSnapshotByWorktree.delete(key)
   replayableSessionTabsSnapshotByWorktree.delete(key)
+  latestReceivedSessionTabsSnapshotByWorktree.delete(key)
+  untrackWebSessionTabsWorktree(environmentId, worktreeId)
+  removeWebSessionTabsEnvironment(environmentId, worktreeId)
   lastHostTerminalTabCountByWorktree.delete(key)
   clearWebRuntimeWakeTerminalRespawnForWorktree(worktreeId)
   clearWebSessionReorderIntentsForWorktree({ environmentId }, worktreeId)
   clearWebSessionCloseIntentsForWorktree({ environmentId }, worktreeId)
   clearWebAgentSessionHandoffsForWorktree(environmentId, worktreeId)
-  const keyPrefix = `${environmentId}:${worktreeId}:`
-  for (const key of hostSessionTabIdByLocalKey.keys()) {
-    if (key.startsWith(keyPrefix)) {
-      hostSessionTabIdByLocalKey.delete(key)
-    }
-  }
+  clearHostSessionTabIdMappings(environmentId, worktreeId)
+  clearWebSessionBrowserPlacementsForWorktree(environmentId, worktreeId)
 }
 
 export function clearWebSessionTabsTrackingForEnvironment(environmentId: string): void {
@@ -376,17 +704,42 @@ export function clearWebSessionTabsTrackingForEnvironment(environmentId: string)
       replayableSessionTabsSnapshotByWorktree.delete(key)
     }
   }
+  for (const key of latestReceivedSessionTabsSnapshotByWorktree.keys()) {
+    if (key.startsWith(keyPrefix)) {
+      latestReceivedSessionTabsSnapshotByWorktree.delete(key)
+    }
+  }
+  for (const key of latestSessionTabsRemovalFenceByWorktree.keys()) {
+    if (key.startsWith(keyPrefix)) {
+      latestSessionTabsRemovalFenceByWorktree.delete(key)
+    }
+  }
+  for (const key of sessionTabsRecoveryStateByWorktree.keys()) {
+    if (key.startsWith(keyPrefix)) {
+      sessionTabsRecoveryStateByWorktree.delete(key)
+    }
+  }
+  trackedSessionTabsWorktreeIdsByEnvironment.delete(trimmedEnvironmentId)
+  for (const worktreeId of sessionTabsEnvironmentsByWorktree.keys()) {
+    removeWebSessionTabsEnvironment(trimmedEnvironmentId, worktreeId)
+  }
   for (const key of lastHostTerminalTabCountByWorktree.keys()) {
     if (key.startsWith(keyPrefix)) {
       lastHostTerminalTabCountByWorktree.delete(key)
     }
   }
-  for (const key of hostSessionTabIdByLocalKey.keys()) {
-    if (key.startsWith(keyPrefix)) {
-      hostSessionTabIdByLocalKey.delete(key)
+  const mappingKeysByWorktree =
+    hostSessionTabMappingKeysByEnvironmentAndWorktree.get(trimmedEnvironmentId)
+  if (mappingKeysByWorktree) {
+    for (const mappingKeys of mappingKeysByWorktree.values()) {
+      for (const mappingKey of mappingKeys) {
+        hostSessionTabIdByLocalKey.delete(mappingKey)
+      }
     }
+    hostSessionTabMappingKeysByEnvironmentAndWorktree.delete(trimmedEnvironmentId)
   }
   clearWebAgentSessionHandoffsForEnvironment(trimmedEnvironmentId)
+  clearWebSessionBrowserPlacementsForEnvironment(trimmedEnvironmentId)
   clearAllWebRuntimeWakeTerminalRespawn()
 }
 
@@ -398,6 +751,35 @@ function hostSessionTabMappingKey(args: {
   return `${args.environmentId}:${args.worktreeId}:${args.tabId}`
 }
 
+function clearHostSessionTabIdMappings(environmentId: string, worktreeId: string): void {
+  const mappingKeysByWorktree = hostSessionTabMappingKeysByEnvironmentAndWorktree.get(environmentId)
+  const mappingKeys = mappingKeysByWorktree?.get(worktreeId)
+  if (!mappingKeys) {
+    return
+  }
+  for (const mappingKey of mappingKeys) {
+    hostSessionTabIdByLocalKey.delete(mappingKey)
+  }
+  mappingKeysByWorktree?.delete(worktreeId)
+  if (mappingKeysByWorktree?.size === 0) {
+    hostSessionTabMappingKeysByEnvironmentAndWorktree.delete(environmentId)
+  }
+}
+
+function setHostSessionTabIdMapping(
+  args: { environmentId: string; worktreeId: string; tabId: string },
+  hostTabId: string
+): void {
+  const mappingKey = hostSessionTabMappingKey(args)
+  hostSessionTabIdByLocalKey.set(mappingKey, hostTabId)
+  const mappingKeysByWorktree =
+    hostSessionTabMappingKeysByEnvironmentAndWorktree.get(args.environmentId) ?? new Map()
+  const mappingKeys = mappingKeysByWorktree.get(args.worktreeId) ?? new Set<string>()
+  mappingKeys.add(mappingKey)
+  mappingKeysByWorktree.set(args.worktreeId, mappingKeys)
+  hostSessionTabMappingKeysByEnvironmentAndWorktree.set(args.environmentId, mappingKeysByWorktree)
+}
+
 export function resolveHostSessionTabIdForWebSessionTab(
   _state: WebSessionTabsSyncState,
   args: {
@@ -735,13 +1117,60 @@ function isFencedClientAgentStatus(
   return isClientOwnedAgentStatus(paneKey, existing) && isAgentStatusFresh(existing, now)
 }
 
+function batchAgentPaneKeysForTabs(
+  state: WebSessionTabsSyncState,
+  tabIds: ReadonlySet<string>,
+  batchContext?: WebSessionTabsBatchContext
+): string[] {
+  if (!batchContext) {
+    return Object.keys(state.agentStatusByPaneKey)
+  }
+  if (!batchContext.agentPaneKeysByTabId) {
+    batchContext.agentPaneKeysByTabId = new Map()
+    for (const paneKey of Object.keys(state.agentStatusByPaneKey)) {
+      const tabId = parsePaneKey(paneKey)?.tabId
+      if (!tabId) {
+        continue
+      }
+      const paneKeys = batchContext.agentPaneKeysByTabId.get(tabId) ?? new Set<string>()
+      paneKeys.add(paneKey)
+      batchContext.agentPaneKeysByTabId.set(tabId, paneKeys)
+    }
+  }
+  return [...tabIds].flatMap((tabId) => [...(batchContext.agentPaneKeysByTabId?.get(tabId) ?? [])])
+}
+
+function updateBatchAgentPaneKey(
+  paneKey: string,
+  present: boolean,
+  batchContext?: WebSessionTabsBatchContext
+): void {
+  const tabId = parsePaneKey(paneKey)?.tabId
+  const index = batchContext?.agentPaneKeysByTabId
+  if (!tabId || !index) {
+    return
+  }
+  if (present) {
+    const paneKeys = index.get(tabId) ?? new Set<string>()
+    paneKeys.add(paneKey)
+    index.set(tabId, paneKeys)
+    return
+  }
+  const paneKeys = index.get(tabId)
+  paneKeys?.delete(paneKey)
+  if (paneKeys?.size === 0) {
+    index.delete(tabId)
+  }
+}
+
 /** Generates a state patch for mirrored agent statuses, merging host entries with client overrides. */
 function buildMirroredAgentStatusPatch(
   state: WebSessionTabsSyncState,
   currentTerminalTabs: readonly TerminalTab[],
   terminalSurfaceTabs: readonly TerminalSurface[],
   mirroredTerminalTabs: readonly MirroredTerminalTab[],
-  now: number
+  now: number,
+  batchContext?: WebSessionTabsBatchContext
 ): Pick<WebSessionTabsSyncState, 'agentStatusByPaneKey' | 'agentStatusEpoch' | 'sortEpoch'> | null {
   const mirroredTabIds = new Set<string>()
   for (const tab of currentTerminalTabs) {
@@ -812,7 +1241,7 @@ function buildMirroredAgentStatusPatch(
   let aggregateRelevantChange = false
   let sortRelevantChange = false
 
-  for (const paneKey of Object.keys(state.agentStatusByPaneKey)) {
+  for (const paneKey of batchAgentPaneKeysForTabs(state, mirroredTabIds, batchContext)) {
     if (!isMirroredAgentPaneKeyForTabs(paneKey, mirroredTabIds)) {
       continue
     }
@@ -830,9 +1259,14 @@ function buildMirroredAgentStatusPatch(
       continue
     }
     if (nextAgentStatusByPaneKey === state.agentStatusByPaneKey) {
-      nextAgentStatusByPaneKey = { ...state.agentStatusByPaneKey }
+      nextAgentStatusByPaneKey = writableWebSessionTabsRecord(
+        state,
+        'agentStatusByPaneKey',
+        batchContext
+      )
     }
     delete nextAgentStatusByPaneKey[paneKey]
+    updateBatchAgentPaneKey(paneKey, false, batchContext)
     changed = true
     aggregateRelevantChange = true
     sortRelevantChange = true
@@ -844,20 +1278,30 @@ function buildMirroredAgentStatusPatch(
       continue
     }
     if (nextAgentStatusByPaneKey === state.agentStatusByPaneKey) {
-      nextAgentStatusByPaneKey = { ...state.agentStatusByPaneKey }
+      nextAgentStatusByPaneKey = writableWebSessionTabsRecord(
+        state,
+        'agentStatusByPaneKey',
+        batchContext
+      )
     }
     nextAgentStatusByPaneKey[paneKey] = entry
+    updateBatchAgentPaneKey(paneKey, true, batchContext)
     changed = true
     const entryAttributionChanged =
       existing?.worktreeId !== entry.worktreeId || existing?.tabId !== entry.tabId
     const entryFreshnessChanged =
       !!existing && isAgentStatusFresh(existing, now) !== isAgentStatusFresh(entry, now)
+    const doneAttentionChanged =
+      existing?.state === 'done' &&
+      entry.state === 'done' &&
+      agentEntryCompletionAt(existing) !== agentEntryCompletionAt(entry)
     const entrySortRelevantChange =
       !existing ||
       existing.state !== entry.state ||
       !isAgentStatusFresh(existing, now) ||
       entryFreshnessChanged ||
       entryAttributionChanged ||
+      doneAttentionChanged ||
       isMirroredCommandCodeTurnBump(existing, entry)
     aggregateRelevantChange = aggregateRelevantChange || entrySortRelevantChange
     sortRelevantChange = sortRelevantChange || entrySortRelevantChange
@@ -969,6 +1413,7 @@ function buildMirroredEditorTabs(
   snapshot: RuntimeMobileSessionTabsResult,
   environmentId: string,
   state: WebSessionTabsSyncState,
+  worktreeOpenFileById: ReadonlyMap<string, OpenFile>,
   hostGroupIdByTabId: ReadonlyMap<string, string>,
   fallbackGroupId: string,
   sortOffset: number,
@@ -976,9 +1421,7 @@ function buildMirroredEditorTabs(
 ): MirroredEditorTab[] {
   return snapshot.tabs.filter(isReadyEditorTab).map((tab, index) => {
     const fileId = localEditorFileId(tab)
-    const existingFile = state.openFiles.find(
-      (file) => file.worktreeId === snapshot.worktree && file.id === fileId
-    )
+    const existingFile = worktreeOpenFileById.get(fileId)
     const existingUnifiedTab = findExistingEditorUnifiedTab(
       state,
       snapshot.worktree,
@@ -1063,6 +1506,10 @@ function buildMirroredBrowserTabs(
   sortOffset: number,
   now: number
 ): MirroredBrowserTab[] {
+  const renderedGroupIds = collectLayoutGroupIds(state.layoutByWorktree[snapshot.worktree])
+  const clientGroupIds = new Set(
+    (state.groupsByWorktree[snapshot.worktree] ?? []).map((group) => group.id)
+  )
   return snapshot.tabs.filter(isReadyBrowserTab).map((tab, index) => {
     const existing = findBrowserWorkspaceForRemotePage(
       state,
@@ -1073,9 +1520,24 @@ function buildMirroredBrowserTabs(
     const workspaceId = existing?.workspace.id ?? tab.browserWorkspaceId
     const pageId = existing?.page.id ?? tab.browserPageId
     const createdAt = existing?.page.createdAt ?? now + sortOffset + index
-    const groupId = hostGroupIdByTabId.get(tab.id) ?? fallbackGroupId
+    const recordedClientGroupId = takeWebSessionBrowserPlacementGroup({
+      environmentId,
+      worktreeId: snapshot.worktree,
+      remotePageId: tab.browserPageId
+    })
+    const hostGroupId = hostGroupIdByTabId.get(tab.id) ?? fallbackGroupId
+    const existingClientGroupId =
+      existing?.unifiedTab?.groupId !== hostGroupId ? existing?.unifiedTab?.groupId : undefined
+    const preferredClientGroupId = recordedClientGroupId ?? existingClientGroupId
+    const clientGroupId =
+      preferredClientGroupId &&
+      clientGroupIds.has(preferredClientGroupId) &&
+      (renderedGroupIds.size === 0 || renderedGroupIds.has(preferredClientGroupId))
+        ? preferredClientGroupId
+        : undefined
+    const groupId = clientGroupId ?? hostGroupId
     const title = tab.title.trim() || 'Browser'
-    const page: BrowserPage = {
+    const nextPage: BrowserPage = {
       id: pageId,
       workspaceId,
       worktreeId: snapshot.worktree,
@@ -1090,6 +1552,9 @@ function buildMirroredBrowserTabs(
       browserRuntimeEnvironmentId: environmentId,
       viewportPresetId: existing?.page.viewportPresetId ?? null
     }
+    // Why: reuse hinges on browserPageEqual comparing workspaceId — the removed-workspace
+    // page-list cleanup gates on page.workspaceId matching this entry's workspace.id.
+    const page = existing && browserPageEqual(existing.page, nextPage) ? existing.page : nextPage
     const workspace: BrowserWorkspace = {
       id: workspaceId,
       worktreeId: snapshot.worktree,
@@ -1112,7 +1577,8 @@ function buildMirroredBrowserTabs(
       certificateFailure: tab.certificateFailure ?? null,
       remotePageId: tab.browserPageId,
       unifiedTab: buildBrowserUnifiedTab(workspace, tab, existing?.unifiedTab ?? null, groupId),
-      hostTabId: tab.id
+      hostTabId: tab.id,
+      ...(clientGroupId ? { clientGroupId } : {})
     }
   })
 }
@@ -1285,37 +1751,63 @@ function updateHostSessionTabIdMappings(args: {
   browserTabs: readonly MirroredBrowserTab[]
   editorTabs: readonly MirroredEditorTab[]
 }): void {
-  const keyPrefix = `${args.environmentId}:${args.worktreeId}:`
-  for (const key of hostSessionTabIdByLocalKey.keys()) {
-    if (key.startsWith(keyPrefix)) {
-      hostSessionTabIdByLocalKey.delete(key)
-    }
-  }
+  clearHostSessionTabIdMappings(args.environmentId, args.worktreeId)
 
   const mirroredTerminalIds = new Set(args.terminalTabs.map((tab) => tab.id))
   for (const surface of args.terminalSurfaces) {
     const localId = toWebTerminalSurfaceTabId(surface.parentTabId)
     if (mirroredTerminalIds.has(localId)) {
-      hostSessionTabIdByLocalKey.set(
-        hostSessionTabMappingKey({ ...args, tabId: localId }),
-        surface.parentTabId
-      )
+      setHostSessionTabIdMapping({ ...args, tabId: localId }, surface.parentTabId)
     }
   }
   for (const entry of args.browserTabs) {
-    hostSessionTabIdByLocalKey.set(
-      hostSessionTabMappingKey({ ...args, tabId: entry.unifiedTab.id }),
-      entry.hostTabId
-    )
+    setHostSessionTabIdMapping({ ...args, tabId: entry.unifiedTab.id }, entry.hostTabId)
   }
   for (const entry of args.editorTabs) {
-    hostSessionTabIdByLocalKey.set(
-      hostSessionTabMappingKey({ ...args, tabId: entry.unifiedTab.id }),
-      entry.hostTabId
-    )
+    setHostSessionTabIdMapping({ ...args, tabId: entry.unifiedTab.id }, entry.hostTabId)
   }
 }
 
+function retainClientPlacedMirroredTabs(args: {
+  groups: readonly TabGroup[]
+  mirroredUnifiedIds: ReadonlySet<string>
+  validUnifiedTabIds: ReadonlySet<string>
+  clientGroupIdByLocalTabId: ReadonlyMap<string, string>
+  nextActiveUnifiedTabId: string | null
+}): TabGroup[] {
+  return args.groups.map((group) => {
+    const retainedTabOrder = group.tabOrder.filter(
+      (tabId) =>
+        args.validUnifiedTabIds.has(tabId) &&
+        (!args.mirroredUnifiedIds.has(tabId) ||
+          args.clientGroupIdByLocalTabId.get(tabId) === group.id)
+    )
+    const placedTabIds = [...args.clientGroupIdByLocalTabId]
+      .filter(
+        ([tabId, groupId]) =>
+          groupId === group.id &&
+          args.validUnifiedTabIds.has(tabId) &&
+          !retainedTabOrder.includes(tabId)
+      )
+      .map(([tabId]) => tabId)
+    const tabOrder = [...retainedTabOrder, ...placedTabIds]
+    const activeTabId =
+      args.nextActiveUnifiedTabId && tabOrder.includes(args.nextActiveUnifiedTabId)
+        ? args.nextActiveUnifiedTabId
+        : group.activeTabId && tabOrder.includes(group.activeTabId)
+          ? group.activeTabId
+          : (tabOrder[0] ?? null)
+    return {
+      ...group,
+      tabOrder,
+      activeTabId,
+      recentTabIds: activeTabId
+        ? pushRecentTabId(sanitizeRecentTabIds(group.recentTabIds, tabOrder), activeTabId)
+        : []
+    }
+  })
+}
+
 function buildMirroredHostGroups({
   currentGroups,
   hostGroups,
@@ -1325,7 +1817,8 @@ function buildMirroredHostGroups({
   now,
   validUnifiedTabIds,
   environmentId,
-  worktreeId
+  worktreeId,
+  clientGroupIdByLocalTabId
 }: {
   currentGroups: readonly TabGroup[]
   hostGroups: readonly RuntimeMobileSessionTabGroup[]
@@ -1336,16 +1829,14 @@ function buildMirroredHostGroups({
   validUnifiedTabIds: ReadonlySet<string>
   environmentId: string
   worktreeId: string
+  clientGroupIdByLocalTabId: ReadonlyMap<string, string>
 }): TabGroup[] | null {
-  const strippedGroups = currentGroups.map((group) => {
-    const tabOrder = group.tabOrder.filter(
-      (tabId) => validUnifiedTabIds.has(tabId) && !mirroredUnifiedIds.has(tabId)
-    )
-    return {
-      ...group,
-      tabOrder,
-      recentTabIds: sanitizeRecentTabIds(group.recentTabIds, tabOrder)
-    }
+  const strippedGroups = retainClientPlacedMirroredTabs({
+    groups: currentGroups,
+    mirroredUnifiedIds,
+    validUnifiedTabIds,
+    clientGroupIdByLocalTabId,
+    nextActiveUnifiedTabId
   })
   const groupsById = new Map(strippedGroups.map((group) => [group.id, group]))
   const orderedGroups: TabGroup[] = []
@@ -1355,7 +1846,12 @@ function buildMirroredHostGroups({
     const existing = groupsById.get(hostGroup.id)
     const localHostOrder = hostGroup.tabOrder
       .map((tabId) => hostToLocalTabId.get(tabId))
-      .filter((tabId): tabId is string => tabId !== undefined && validUnifiedTabIds.has(tabId))
+      .filter(
+        (tabId): tabId is string =>
+          tabId !== undefined &&
+          validUnifiedTabIds.has(tabId) &&
+          !clientGroupIdByLocalTabId.has(tabId)
+      )
     const hostTabOrder = [
       ...(existing?.tabOrder.filter((tabId) => !localHostOrder.includes(tabId)) ?? []),
       ...localHostOrder
@@ -1397,7 +1893,11 @@ function buildMirroredHostGroups({
   }
 
   for (const group of strippedGroups) {
-    if (!seen.has(group.id) && group.tabOrder.length > 0) {
+    if (
+      !seen.has(group.id) &&
+      (group.tabOrder.length > 0 ||
+        isWebSessionBrowserPlacementGroupReserved({ environmentId, worktreeId, groupId: group.id }))
+    ) {
       orderedGroups.push(group)
     }
   }
@@ -1500,20 +2000,47 @@ function pushRecentTabId(recent: string[] | undefined, tabId: string): string[]
   return [...base.filter((id) => id !== tabId), tabId]
 }
 
+function writableWebSessionTabsRecord<K extends WebSessionTabsBatchRecordKey>(
+  state: WebSessionTabsSyncState,
+  recordKey: K,
+  batchContext?: WebSessionTabsBatchContext
+): NonNullable<WebSessionTabsSyncState[K]> {
+  const record = (state[recordKey] ?? {}) as NonNullable<WebSessionTabsSyncState[K]>
+  if (!batchContext) {
+    return { ...record } as NonNullable<WebSessionTabsSyncState[K]>
+  }
+  // Why: one batch owns its record copies, so later snapshots can update them without recopying every workspace.
+  if (batchContext.changedRecords.has(recordKey)) {
+    return record
+  }
+  const next = { ...record } as NonNullable<WebSessionTabsSyncState[K]>
+  const mutableState = state as unknown as Record<
+    WebSessionTabsBatchRecordKey,
+    Record<string, unknown>
+  >
+  mutableState[recordKey] = next as Record<string, unknown>
+  batchContext.changedRecords.add(recordKey)
+  return next
+}
+
 function withWorktreeEntry<T>(
-  record: Record<string, T>,
+  state: WebSessionTabsSyncState,
+  recordKey: WebSessionTabsBatchRecordKey,
   key: string,
   value: T | null,
-  equal: (a: T | undefined, b: T | null) => boolean
+  equal: (a: T | undefined, b: T | null) => boolean,
+  batchContext?: WebSessionTabsBatchContext,
+  deleteNull = true
 ): Record<string, T> {
+  const record = (state[recordKey] ?? {}) as Record<string, T>
   if (equal(record[key], value)) {
     return record
   }
-  const next = { ...record }
-  if (value === null) {
+  const next = writableWebSessionTabsRecord(state, recordKey, batchContext) as Record<string, T>
+  if (value === null && deleteNull) {
     delete next[key]
   } else {
-    next[key] = value
+    next[key] = value as T
   }
   return next
 }
@@ -1669,6 +2196,63 @@ function sameOpenFiles(a: readonly OpenFile[], b: readonly OpenFile[]): boolean
   return a.every((file, index) => openFileEqual(file, b[index]!))
 }
 
+/** This worktree's open files — the only scope a snapshot reconciles, so a batch can
+ *  answer from here instead of walking every open file in the app. */
+function webSessionOpenFilesForWorktree(
+  state: WebSessionTabsSyncState,
+  worktreeId: string,
+  batchContext?: WebSessionTabsBatchContext
+): readonly OpenFile[] {
+  if (!batchContext) {
+    return state.openFiles.filter((file) => file.worktreeId === worktreeId)
+  }
+  let index = batchContext.openFilesIndex
+  if (!index || index.source !== state.openFiles) {
+    const byWorktree = new Map<string, OpenFile[]>()
+    for (const file of state.openFiles) {
+      const bucket = byWorktree.get(file.worktreeId) ?? []
+      bucket.push(file)
+      byWorktree.set(file.worktreeId, bucket)
+    }
+    index = { source: state.openFiles, byWorktree }
+    batchContext.openFilesIndex = index
+  }
+  return index.byWorktree.get(worktreeId) ?? []
+}
+
+/** Retargets the index at the array a snapshot just produced, re-bucketing only the
+ *  worktree that changed. Rebuilding it wholesale would cost the entire array again on
+ *  every snapshot, which is the cost this index exists to avoid. */
+function advanceWebSessionOpenFilesIndex(
+  batchContext: WebSessionTabsBatchContext | undefined,
+  nextOpenFiles: readonly OpenFile[],
+  worktreeId: string
+): void {
+  const index = batchContext?.openFilesIndex
+  if (!index || index.source === nextOpenFiles) {
+    return
+  }
+  const bucket: OpenFile[] = []
+  for (const file of nextOpenFiles) {
+    if (file.worktreeId === worktreeId) {
+      bucket.push(file)
+    }
+  }
+  index.byWorktree.set(worktreeId, bucket)
+  index.source = nextOpenFiles
+}
+
+/** Mirrors `openFiles.find()` first-wins lookup, which duplicate ids make observable. */
+function firstOpenFileByIdForWorktree(files: readonly OpenFile[]): Map<string, OpenFile> {
+  const byId = new Map<string, OpenFile>()
+  for (const file of files) {
+    if (!byId.has(file.id)) {
+      byId.set(file.id, file)
+    }
+  }
+  return byId
+}
+
 function tabEqual(a: Tab, b: Tab): boolean {
   return (
     a.id === b.id &&
@@ -1727,47 +2311,12 @@ function toVisibleTabType(tab: Tab): WebSessionTabsSyncState['activeTabType'] {
   return 'editor'
 }
 
-function findCurrentVisibleUnifiedTabId(args: {
-  state: WebSessionTabsSyncState
-  worktreeId: string
-  nextUnifiedTabs: readonly Tab[] | null
-}): string | null {
-  const { state, worktreeId, nextUnifiedTabs } = args
-  if (!nextUnifiedTabs) {
-    return null
-  }
-  const currentVisibleType =
-    state.activeTabTypeByWorktree[worktreeId] ??
-    (state.activeWorktreeId === worktreeId ? state.activeTabType : null)
-  if (currentVisibleType === 'terminal') {
-    const terminalTabId = state.activeTabIdByWorktree[worktreeId]
-    return terminalTabId && nextUnifiedTabs.some((tab) => tab.id === terminalTabId)
-      ? terminalTabId
-      : null
-  }
-  if (currentVisibleType === 'browser') {
-    const browserWorkspaceId = state.activeBrowserTabIdByWorktree[worktreeId]
-    return (
-      nextUnifiedTabs.find(
-        (tab) => tab.contentType === 'browser' && tab.entityId === browserWorkspaceId
-      )?.id ?? null
-    )
-  }
-  if (currentVisibleType === 'editor') {
-    const fileId = state.activeFileIdByWorktree[worktreeId]
-    return (
-      nextUnifiedTabs.find((tab) => tab.contentType === 'editor' && tab.entityId === fileId)?.id ??
-      null
-    )
-  }
-  return null
-}
-
-export function applyWebSessionTabsSnapshot(
+function applyWebSessionTabsSnapshotWithContext(
   state: WebSessionTabsSyncState,
   rawSnapshot: RuntimeMobileSessionTabsResult,
   environmentId: string,
-  now = Date.now()
+  now = Date.now(),
+  batchContext?: WebSessionTabsBatchContext
 ): WebSessionTabsSyncState | Partial<WebSessionTabsSyncState> {
   const worktreeId = rawSnapshot.worktree
   if (worktreeId === FLOATING_TERMINAL_WORKTREE_ID) {
@@ -1801,7 +2350,7 @@ export function applyWebSessionTabsSnapshot(
   // Why: only a caller-recorded create intent may focus its arriving tab; unsolicited server-active must not steal focus (#5435).
   const focusIntent = peekWebSessionFocusIntent({ environmentId }, worktreeId)
   const focusIntentHostTabId = focusIntent?.hostTabId ?? null
-  const callerFocusIntentTab =
+  const matchingFocusIntentTab =
     focusIntentHostTabId === null
       ? null
       : focusIntent?.leafId
@@ -1817,13 +2366,21 @@ export function applyWebSessionTabsSnapshot(
               (tab.type === 'terminal' && tab.parentTabId === focusIntentHostTabId) ||
               (tab.type === 'browser' && tab.browserPageId === focusIntentHostTabId)
           ) ?? null)
+  const expectedCurrentLocalTabId = focusIntent?.expectedCurrentLocalTabId
+  const currentVisibleLocalTabId = resolveWebSessionVisibleTabId(state, worktreeId)
+  const callerFocusIntentTab =
+    matchingFocusIntentTab &&
+    (expectedCurrentLocalTabId === undefined ||
+      expectedCurrentLocalTabId === currentVisibleLocalTabId)
+      ? matchingFocusIntentTab
+      : null
   const followIntentTab =
     snapshot.navigationIntent === 'follow'
       ? (snapshot.tabs.find((tab) => tab.id === snapshot.activeTabId) ?? null)
       : null
   const navigationIntentTab = callerFocusIntentTab ?? followIntentTab
   const honorSnapshotActiveFocus = navigationIntentTab !== null
-  if (callerFocusIntentTab) {
+  if (matchingFocusIntentTab) {
     clearWebSessionFocusIntent({ environmentId }, worktreeId)
   }
   const currentTerminalTabs = state.tabsByWorktree[worktreeId] ?? []
@@ -1892,6 +2449,9 @@ export function applyWebSessionTabsSnapshot(
   const removedTerminalIds = new Set(
     currentTerminalTabs.filter((tab) => !retainedTerminalIds.has(tab.id)).map((tab) => tab.id)
   )
+  const removedTerminalResourceIds = [...removedTerminalIds].filter(
+    (tabId) => !mirroredTerminalIds.has(tabId)
+  )
   for (const provisionalTabId of exactProvisionalHandoffs) {
     clearWebAgentSessionHandoff({ environmentId, worktreeId, provisionalTabId })
   }
@@ -1940,10 +2500,12 @@ export function applyWebSessionTabsSnapshot(
       ? [...retainedBrowserTabs, ...mirroredBrowserTabs.map((entry) => entry.workspace)]
       : null
   const readyEditorTabs = snapshot.tabs.filter(isReadyEditorTab)
+  const worktreeOpenFiles = webSessionOpenFilesForWorktree(state, worktreeId, batchContext)
   const mirroredEditorTabs = buildMirroredEditorTabs(
     snapshot,
     environmentId,
     state,
+    firstOpenFileByIdForWorktree(worktreeOpenFiles),
     hostGroupIdByTabId,
     targetGroupId,
     mirroredTerminalTabEntries.length + mirroredBrowserTabs.length,
@@ -1952,10 +2514,9 @@ export function applyWebSessionTabsSnapshot(
   const mirroredEditorFileIds = new Set(mirroredEditorTabs.map((entry) => entry.file.id))
   const mirroredEditorHostTabIds = new Set(mirroredEditorTabs.map((entry) => entry.hostTabId))
   const removedEditorFileIds = new Set(
-    state.openFiles
+    worktreeOpenFiles
       .filter(
         (file) =>
-          file.worktreeId === worktreeId &&
           file.runtimeEnvironmentId === environmentId &&
           (file.mode === 'edit' || file.mode === 'markdown-preview') &&
           // Why: only cull host-mirrored tabs; locally opened files have no host counterpart, so their omission isn't a close signal.
@@ -1964,7 +2525,25 @@ export function applyWebSessionTabsSnapshot(
       )
       .map((file) => file.id)
   )
+  const isReplacedOpenFile = (file: OpenFile): boolean =>
+    file.runtimeEnvironmentId === environmentId &&
+    (removedEditorFileIds.has(file.id) || mirroredEditorFileIds.has(file.id))
+  const replacedOpenFileCount = worktreeOpenFiles.filter(isReplacedOpenFile).length
+  // Why: both consumers below ask only about this worktree, so the surviving ids answer
+  // them in worktree scope instead of walking every open file in the app.
+  const nextWorktreeOpenFileIds = new Set<string>(
+    worktreeOpenFiles.filter((file) => !isReplacedOpenFile(file)).map((file) => file.id)
+  )
+  for (const fileId of mirroredEditorFileIds) {
+    nextWorktreeOpenFileIds.add(fileId)
+  }
+  const mirroredOpenFiles = mirroredEditorTabs.map((entry) => entry.file)
   const nextOpenFiles = (() => {
+    // Why: with nothing to drop or mirror, rebuilding reproduces the array exactly, so
+    // skip the global rebuild the equality check below would have thrown away anyway.
+    if (replacedOpenFileCount === 0 && mirroredOpenFiles.length === 0) {
+      return state.openFiles
+    }
     const retained = state.openFiles.filter(
       (file) =>
         !(
@@ -1973,9 +2552,10 @@ export function applyWebSessionTabsSnapshot(
           (removedEditorFileIds.has(file.id) || mirroredEditorFileIds.has(file.id))
         )
     )
-    const next = [...retained, ...mirroredEditorTabs.map((entry) => entry.file)]
+    const next = [...retained, ...mirroredOpenFiles]
     return sameOpenFiles(state.openFiles, next) ? state.openFiles : next
   })()
+  advanceWebSessionOpenFilesIndex(batchContext, nextOpenFiles, worktreeId)
   const currentUnifiedTabs = state.unifiedTabsByWorktree[worktreeId] ?? []
   const retainedUnifiedTabs = currentUnifiedTabs.filter((tab) => {
     if (tab.contentType === 'browser') {
@@ -2103,13 +2683,10 @@ export function applyWebSessionTabsSnapshot(
       ? (activeMirroredBrowserWorkspaceId ?? mirroredBrowserTabs[0]?.workspace.id)
       : mirroredBrowserTabs[0]?.workspace.id) ??
     null
+  const activeEditorFileIdForWorktree = state.activeFileIdByWorktree[worktreeId]
   const currentActiveEditorStillExists =
-    state.activeFileIdByWorktree[worktreeId] &&
-    nextOpenFiles.some(
-      (file) =>
-        file.worktreeId === worktreeId && file.id === state.activeFileIdByWorktree[worktreeId]
-    )
-      ? state.activeFileIdByWorktree[worktreeId]
+    activeEditorFileIdForWorktree && nextWorktreeOpenFileIds.has(activeEditorFileIdForWorktree)
+      ? activeEditorFileIdForWorktree
       : null
   const intentEditorFileId = honorSnapshotActiveFocus
     ? (intentMirroredEditor?.file.id ?? null)
@@ -2121,11 +2698,11 @@ export function applyWebSessionTabsSnapshot(
       ? (activeMirroredEditorFileId ?? mirroredEditorTabs[0]?.file.id)
       : mirroredEditorTabs[0]?.file.id) ??
     null
-  const currentVisibleUnifiedTabId = findCurrentVisibleUnifiedTabId({
+  const currentVisibleUnifiedTabId = resolveWebSessionVisibleTabId(
     state,
     worktreeId,
-    nextUnifiedTabs
-  })
+    nextUnifiedTabs ?? []
+  )
   // Why: a client-initiated activation also drives the visible unified tab, overriding the sticky current-visible tab.
   const intentUnifiedTabId = honorSnapshotActiveFocus
     ? navigationIntentTab?.type === 'browser'
@@ -2167,6 +2744,11 @@ export function applyWebSessionTabsSnapshot(
   })
 
   const currentGroups = state.groupsByWorktree[worktreeId] ?? []
+  const clientGroupIdByLocalTabId = new Map(
+    mirroredBrowserTabs.flatMap((entry) =>
+      entry.clientGroupId ? [[entry.unifiedTab.id, entry.clientGroupId]] : []
+    )
+  )
   const nextGroups = (() => {
     if (!nextUnifiedTabs || nextUnifiedTabs.length === 0) {
       return null
@@ -2181,21 +2763,17 @@ export function applyWebSessionTabsSnapshot(
         now,
         validUnifiedTabIds,
         environmentId,
-        worktreeId
+        worktreeId,
+        clientGroupIdByLocalTabId
       })
     }
-    const strippedGroups = currentGroups.map((group) => ({
-      ...group,
-      tabOrder: group.tabOrder.filter(
-        (tabId) => validUnifiedTabIds.has(tabId) && !mirroredUnifiedIds.has(tabId)
-      ),
-      recentTabIds: sanitizeRecentTabIds(
-        group.recentTabIds,
-        group.tabOrder.filter(
-          (tabId) => validUnifiedTabIds.has(tabId) && !mirroredUnifiedIds.has(tabId)
-        )
-      )
-    }))
+    const strippedGroups = retainClientPlacedMirroredTabs({
+      groups: currentGroups,
+      mirroredUnifiedIds,
+      validUnifiedTabIds,
+      clientGroupIdByLocalTabId,
+      nextActiveUnifiedTabId
+    })
     const target = strippedGroups.find((group) => group.id === targetGroupId) ?? {
       id: targetGroupId,
       worktreeId,
@@ -2205,7 +2783,9 @@ export function applyWebSessionTabsSnapshot(
     }
     const targetOrder = [
       ...target.tabOrder.filter((tabId) => validUnifiedTabIds.has(tabId)),
-      ...mirroredUnifiedTabs.map((tab) => tab.id)
+      ...mirroredUnifiedTabs
+        .filter((tab) => !clientGroupIdByLocalTabId.has(tab.id))
+        .map((tab) => tab.id)
     ]
     const targetActiveTabId =
       nextActiveUnifiedTabId && targetOrder.includes(nextActiveUnifiedTabId)
@@ -2225,7 +2805,16 @@ export function applyWebSessionTabsSnapshot(
     const merged = strippedGroups.some((group) => group.id === targetGroupId)
       ? strippedGroups.map((group) => (group.id === targetGroupId ? updatedTarget : group))
       : [...strippedGroups, updatedTarget]
-    return merged.filter((group) => group.id === targetGroupId || group.tabOrder.length > 0)
+    return merged.filter(
+      (group) =>
+        group.id === targetGroupId ||
+        group.tabOrder.length > 0 ||
+        isWebSessionBrowserPlacementGroupReserved({
+          environmentId,
+          worktreeId,
+          groupId: group.id
+        })
+    )
   })()
 
   const nextTabBarOrder = (() => {
@@ -2259,28 +2848,42 @@ export function applyWebSessionTabsSnapshot(
   })()
 
   let nextPtyIdsByTabId = state.ptyIdsByTabId
-  for (const removedId of removedTerminalIds) {
+  for (const removedId of removedTerminalResourceIds) {
     if (nextPtyIdsByTabId[removedId]) {
       nextPtyIdsByTabId =
-        nextPtyIdsByTabId === state.ptyIdsByTabId ? { ...state.ptyIdsByTabId } : nextPtyIdsByTabId
+        nextPtyIdsByTabId === state.ptyIdsByTabId
+          ? writableWebSessionTabsRecord(state, 'ptyIdsByTabId', batchContext)
+          : nextPtyIdsByTabId
       delete nextPtyIdsByTabId[removedId]
     }
   }
   for (const { tab, ptyIds } of mirroredTerminalTabs) {
+    if (ptyIds.length === 0) {
+      if (nextPtyIdsByTabId[tab.id]) {
+        nextPtyIdsByTabId =
+          nextPtyIdsByTabId === state.ptyIdsByTabId
+            ? writableWebSessionTabsRecord(state, 'ptyIdsByTabId', batchContext)
+            : nextPtyIdsByTabId
+        delete nextPtyIdsByTabId[tab.id]
+      }
+      continue
+    }
     const current = nextPtyIdsByTabId[tab.id] ?? []
     if (!sameStringArray(current, ptyIds)) {
       nextPtyIdsByTabId =
-        nextPtyIdsByTabId === state.ptyIdsByTabId ? { ...state.ptyIdsByTabId } : nextPtyIdsByTabId
+        nextPtyIdsByTabId === state.ptyIdsByTabId
+          ? writableWebSessionTabsRecord(state, 'ptyIdsByTabId', batchContext)
+          : nextPtyIdsByTabId
       nextPtyIdsByTabId[tab.id] = ptyIds
     }
   }
 
   let nextTerminalLayoutsByTabId = state.terminalLayoutsByTabId
-  for (const removedId of removedTerminalIds) {
+  for (const removedId of removedTerminalResourceIds) {
     if (nextTerminalLayoutsByTabId[removedId]) {
       nextTerminalLayoutsByTabId =
         nextTerminalLayoutsByTabId === state.terminalLayoutsByTabId
-          ? { ...state.terminalLayoutsByTabId }
+          ? writableWebSessionTabsRecord(state, 'terminalLayoutsByTabId', batchContext)
           : nextTerminalLayoutsByTabId
       delete nextTerminalLayoutsByTabId[removedId]
     }
@@ -2289,7 +2892,7 @@ export function applyWebSessionTabsSnapshot(
     if (!terminalLayoutEqual(nextTerminalLayoutsByTabId[tab.id], layout)) {
       nextTerminalLayoutsByTabId =
         nextTerminalLayoutsByTabId === state.terminalLayoutsByTabId
-          ? { ...state.terminalLayoutsByTabId }
+          ? writableWebSessionTabsRecord(state, 'terminalLayoutsByTabId', batchContext)
           : nextTerminalLayoutsByTabId
       nextTerminalLayoutsByTabId[tab.id] = layout
     }
@@ -2300,7 +2903,7 @@ export function applyWebSessionTabsSnapshot(
     if (nextUnreadTerminalTabs[removedId]) {
       nextUnreadTerminalTabs =
         nextUnreadTerminalTabs === state.unreadTerminalTabs
-          ? { ...state.unreadTerminalTabs }
+          ? writableWebSessionTabsRecord(state, 'unreadTerminalTabs', batchContext)
           : nextUnreadTerminalTabs
       delete nextUnreadTerminalTabs[removedId]
     }
@@ -2314,14 +2917,14 @@ export function applyWebSessionTabsSnapshot(
     if (nextPendingStartupByTabId[removedId]) {
       nextPendingStartupByTabId =
         nextPendingStartupByTabId === pendingStartupByTabId
-          ? { ...pendingStartupByTabId }
+          ? writableWebSessionTabsRecord(state, 'pendingStartupByTabId', batchContext)
           : nextPendingStartupByTabId
       delete nextPendingStartupByTabId[removedId]
     }
     if (nextAutomaticAgentResumeClaimsByTabId[removedId]) {
       nextAutomaticAgentResumeClaimsByTabId =
         nextAutomaticAgentResumeClaimsByTabId === automaticAgentResumeClaimsByTabId
-          ? { ...automaticAgentResumeClaimsByTabId }
+          ? writableWebSessionTabsRecord(state, 'automaticAgentResumeClaimsByTabId', batchContext)
           : nextAutomaticAgentResumeClaimsByTabId
       delete nextAutomaticAgentResumeClaimsByTabId[removedId]
     }
@@ -2330,29 +2933,52 @@ export function applyWebSessionTabsSnapshot(
   let nextBrowserPagesByWorkspace = state.browserPagesByWorkspace
   let nextRemoteBrowserPageHandlesByPageId = state.remoteBrowserPageHandlesByPageId
   let nextBrowserCertificateFailuresByPageId = state.browserCertificateFailuresByPageId
-  for (const removedWorkspaceId of removedBrowserWorkspaceIds) {
-    const pages = nextBrowserPagesByWorkspace[removedWorkspaceId] ?? []
-    if (nextBrowserPagesByWorkspace[removedWorkspaceId]) {
-      nextBrowserPagesByWorkspace =
-        nextBrowserPagesByWorkspace === state.browserPagesByWorkspace
-          ? { ...state.browserPagesByWorkspace }
-          : nextBrowserPagesByWorkspace
-      delete nextBrowserPagesByWorkspace[removedWorkspaceId]
-    }
-    for (const page of pages) {
-      if (nextBrowserCertificateFailuresByPageId[page.id]) {
-        nextBrowserCertificateFailuresByPageId =
-          nextBrowserCertificateFailuresByPageId === state.browserCertificateFailuresByPageId
-            ? { ...state.browserCertificateFailuresByPageId }
-            : nextBrowserCertificateFailuresByPageId
-        delete nextBrowserCertificateFailuresByPageId[page.id]
+  if (removedBrowserWorkspaceIds.size > 0) {
+    const nextBrowserWorkspaceIds = new Set(nextBrowserTabs?.map((tab) => tab.id) ?? [])
+    const nextBrowserPageIds = new Set(mirroredBrowserTabs.map((entry) => entry.page.id))
+    for (const workspace of retainedBrowserTabs) {
+      for (const page of state.browserPagesByWorkspace[workspace.id] ?? []) {
+        nextBrowserPageIds.add(page.id)
       }
-      if (nextRemoteBrowserPageHandlesByPageId[page.id]) {
-        nextRemoteBrowserPageHandlesByPageId =
-          nextRemoteBrowserPageHandlesByPageId === state.remoteBrowserPageHandlesByPageId
-            ? { ...state.remoteBrowserPageHandlesByPageId }
-            : nextRemoteBrowserPageHandlesByPageId
-        delete nextRemoteBrowserPageHandlesByPageId[page.id]
+    }
+    for (const removedWorkspaceId of removedBrowserWorkspaceIds) {
+      const pages = nextBrowserPagesByWorkspace[removedWorkspaceId] ?? []
+      if (
+        !nextBrowserWorkspaceIds.has(removedWorkspaceId) &&
+        nextBrowserPagesByWorkspace[removedWorkspaceId]
+      ) {
+        nextBrowserPagesByWorkspace =
+          nextBrowserPagesByWorkspace === state.browserPagesByWorkspace
+            ? writableWebSessionTabsRecord(state, 'browserPagesByWorkspace', batchContext)
+            : nextBrowserPagesByWorkspace
+        delete nextBrowserPagesByWorkspace[removedWorkspaceId]
+      }
+      for (const page of pages) {
+        if (nextBrowserPageIds.has(page.id)) {
+          continue
+        }
+        if (nextBrowserCertificateFailuresByPageId[page.id]) {
+          nextBrowserCertificateFailuresByPageId =
+            nextBrowserCertificateFailuresByPageId === state.browserCertificateFailuresByPageId
+              ? writableWebSessionTabsRecord(
+                  state,
+                  'browserCertificateFailuresByPageId',
+                  batchContext
+                )
+              : nextBrowserCertificateFailuresByPageId
+          delete nextBrowserCertificateFailuresByPageId[page.id]
+        }
+        if (nextRemoteBrowserPageHandlesByPageId[page.id]) {
+          nextRemoteBrowserPageHandlesByPageId =
+            nextRemoteBrowserPageHandlesByPageId === state.remoteBrowserPageHandlesByPageId
+              ? writableWebSessionTabsRecord(
+                  state,
+                  'remoteBrowserPageHandlesByPageId',
+                  batchContext
+                )
+              : nextRemoteBrowserPageHandlesByPageId
+          delete nextRemoteBrowserPageHandlesByPageId[page.id]
+        }
       }
     }
   }
@@ -2361,7 +2987,7 @@ export function applyWebSessionTabsSnapshot(
     if (!sameBrowserPages(current, [page])) {
       nextBrowserPagesByWorkspace =
         nextBrowserPagesByWorkspace === state.browserPagesByWorkspace
-          ? { ...state.browserPagesByWorkspace }
+          ? writableWebSessionTabsRecord(state, 'browserPagesByWorkspace', batchContext)
           : nextBrowserPagesByWorkspace
       nextBrowserPagesByWorkspace[page.workspaceId] = [page]
     }
@@ -2372,7 +2998,7 @@ export function applyWebSessionTabsSnapshot(
     ) {
       nextRemoteBrowserPageHandlesByPageId =
         nextRemoteBrowserPageHandlesByPageId === state.remoteBrowserPageHandlesByPageId
-          ? { ...state.remoteBrowserPageHandlesByPageId }
+          ? writableWebSessionTabsRecord(state, 'remoteBrowserPageHandlesByPageId', batchContext)
           : nextRemoteBrowserPageHandlesByPageId
       nextRemoteBrowserPageHandlesByPageId[page.id] = {
         environmentId,
@@ -2387,7 +3013,7 @@ export function applyWebSessionTabsSnapshot(
     ) {
       nextBrowserCertificateFailuresByPageId =
         nextBrowserCertificateFailuresByPageId === state.browserCertificateFailuresByPageId
-          ? { ...state.browserCertificateFailuresByPageId }
+          ? writableWebSessionTabsRecord(state, 'browserCertificateFailuresByPageId', batchContext)
           : nextBrowserCertificateFailuresByPageId
       if (certificateFailure) {
         nextBrowserCertificateFailuresByPageId[page.id] = certificateFailure
@@ -2398,28 +3024,36 @@ export function applyWebSessionTabsSnapshot(
   }
 
   const nextTabsByWorktree = withWorktreeEntry(
-    state.tabsByWorktree,
+    state,
+    'tabsByWorktree',
     worktreeId,
     nextTerminalTabs,
-    sameTerminalTabs
+    sameTerminalTabs,
+    batchContext
   )
   const nextBrowserTabsByWorktree = withWorktreeEntry(
-    state.browserTabsByWorktree,
+    state,
+    'browserTabsByWorktree',
     worktreeId,
     nextBrowserTabs,
-    sameBrowserTabs
+    sameBrowserTabs,
+    batchContext
   )
   const nextUnifiedTabsByWorktree = withWorktreeEntry(
-    state.unifiedTabsByWorktree,
+    state,
+    'unifiedTabsByWorktree',
     worktreeId,
     nextUnifiedTabs,
-    sameUnifiedTabs
+    sameUnifiedTabs,
+    batchContext
   )
   const nextGroupsByWorktree = withWorktreeEntry(
-    state.groupsByWorktree,
+    state,
+    'groupsByWorktree',
     worktreeId,
     nextGroups,
-    sameGroups
+    sameGroups,
+    batchContext
   )
   const nextActiveGroupId =
     // Why: status/title snapshots carry the host's last active tab; a client that already switched panes keeps its local group focus.
@@ -2429,7 +3063,14 @@ export function applyWebSessionTabsSnapshot(
     null
   const nextActiveGroupIdByWorktree =
     nextGroups && state.activeGroupIdByWorktree[worktreeId] !== nextActiveGroupId
-      ? { ...state.activeGroupIdByWorktree, [worktreeId]: nextActiveGroupId ?? targetGroupId }
+      ? withWorktreeEntry(
+          state,
+          'activeGroupIdByWorktree',
+          worktreeId,
+          nextActiveGroupId ?? targetGroupId,
+          (current, next) => current === next,
+          batchContext
+        )
       : state.activeGroupIdByWorktree
   const nextLayoutByWorktree = (() => {
     if (!nextGroups) {
@@ -2467,28 +3108,58 @@ export function applyWebSessionTabsSnapshot(
     if (tabGroupLayoutEqual(state.layoutByWorktree[worktreeId], fallbackLayout)) {
       return state.layoutByWorktree
     }
-    return {
-      ...state.layoutByWorktree,
-      [worktreeId]: fallbackLayout
-    }
+    return withWorktreeEntry(
+      state,
+      'layoutByWorktree',
+      worktreeId,
+      fallbackLayout,
+      (current, next) => current === next,
+      batchContext
+    )
   })()
   const nextTabBarOrderByWorktree = withWorktreeEntry(
-    state.tabBarOrderByWorktree,
+    state,
+    'tabBarOrderByWorktree',
     worktreeId,
     nextTabBarOrder.length > 0 ? nextTabBarOrder : null,
-    (a, b) => sameStringArray(a ?? [], b ?? [])
+    (a, b) => sameStringArray(a ?? [], b ?? []),
+    batchContext
   )
   const nextActiveTabIdByWorktree =
     (state.activeTabIdByWorktree[worktreeId] ?? null) !== nextActiveTerminalId
-      ? { ...state.activeTabIdByWorktree, [worktreeId]: nextActiveTerminalId }
+      ? withWorktreeEntry(
+          state,
+          'activeTabIdByWorktree',
+          worktreeId,
+          nextActiveTerminalId,
+          (current, next) => (current ?? null) === next,
+          batchContext,
+          false
+        )
       : state.activeTabIdByWorktree
   const nextActiveBrowserTabIdByWorktree =
     (state.activeBrowserTabIdByWorktree[worktreeId] ?? null) !== nextActiveBrowserWorkspaceId
-      ? { ...state.activeBrowserTabIdByWorktree, [worktreeId]: nextActiveBrowserWorkspaceId }
+      ? withWorktreeEntry(
+          state,
+          'activeBrowserTabIdByWorktree',
+          worktreeId,
+          nextActiveBrowserWorkspaceId,
+          (current, next) => (current ?? null) === next,
+          batchContext,
+          false
+        )
       : state.activeBrowserTabIdByWorktree
   const nextActiveFileIdByWorktree =
     (state.activeFileIdByWorktree[worktreeId] ?? null) !== nextActiveEditorFileId
-      ? { ...state.activeFileIdByWorktree, [worktreeId]: nextActiveEditorFileId }
+      ? withWorktreeEntry(
+          state,
+          'activeFileIdByWorktree',
+          worktreeId,
+          nextActiveEditorFileId,
+          (current, next) => (current ?? null) === next,
+          batchContext,
+          false
+        )
       : state.activeFileIdByWorktree
   const isActiveWorktree = state.activeWorktreeId === worktreeId
   const focusIntentVisibleTabType =
@@ -2544,8 +3215,7 @@ export function applyWebSessionTabsSnapshot(
       ? state.activeTabId
       : null
   const currentActiveEditorStillValid =
-    state.activeFileId &&
-    nextOpenFiles.some((file) => file.worktreeId === worktreeId && file.id === state.activeFileId)
+    state.activeFileId && nextWorktreeOpenFileIds.has(state.activeFileId)
       ? state.activeFileId
       : null
   const nextActiveTabId = isActiveWorktree
@@ -2564,14 +3234,22 @@ export function applyWebSessionTabsSnapshot(
   const nextActiveTabType = isActiveWorktree ? nextVisibleTabType : state.activeTabType
   const nextActiveTabTypeByWorktree =
     state.activeTabTypeByWorktree[worktreeId] !== nextVisibleTabType
-      ? { ...state.activeTabTypeByWorktree, [worktreeId]: nextVisibleTabType }
+      ? withWorktreeEntry(
+          state,
+          'activeTabTypeByWorktree',
+          worktreeId,
+          nextVisibleTabType,
+          (current, next) => current === next,
+          batchContext
+        )
       : state.activeTabTypeByWorktree
   const agentStatusPatch = buildMirroredAgentStatusPatch(
     state,
     currentTerminalTabs,
     terminalSurfaceTabs,
     mirroredTerminalTabs,
-    now
+    now,
+    batchContext
   )
 
   const patch: Partial<WebSessionTabsSyncState> = {
@@ -2641,21 +3319,46 @@ export function applyWebSessionTabsSnapshot(
   return Object.keys(patch).length === 0 ? state : patch
 }
 
+export function applyWebSessionTabsSnapshot(
+  state: WebSessionTabsSyncState,
+  rawSnapshot: RuntimeMobileSessionTabsResult,
+  environmentId: string,
+  now = Date.now()
+): WebSessionTabsSyncState | Partial<WebSessionTabsSyncState> {
+  return applyWebSessionTabsSnapshotWithContext(state, rawSnapshot, environmentId, now)
+}
+
 export function applyWebSessionTabsSnapshots(
   state: WebSessionTabsSyncState,
   snapshots: readonly RuntimeMobileSessionTabsResult[],
   environmentId: string,
   now = Date.now()
 ): WebSessionTabsSyncState | Partial<WebSessionTabsSyncState> {
-  let nextState = state
+  const nextState = { ...state }
+  const batchContext: WebSessionTabsBatchContext = {
+    agentPaneKeysByTabId: null,
+    changedRecords: new Set(),
+    openFilesIndex: null
+  }
   let mergedPatch: Partial<WebSessionTabsSyncState> = {}
   for (const snapshot of snapshots) {
-    const patch = applyWebSessionTabsSnapshot(nextState, snapshot, environmentId, now)
+    const patch = applyWebSessionTabsSnapshotWithContext(
+      nextState,
+      snapshot,
+      environmentId,
+      now,
+      batchContext
+    )
     if (patch === nextState) {
       continue
     }
     mergedPatch = { ...mergedPatch, ...patch }
-    nextState = { ...nextState, ...patch }
+    Object.assign(nextState, patch)
+  }
+  const mutableMergedPatch = mergedPatch as Record<string, unknown>
+  const mutableNextState = nextState as unknown as Record<string, unknown>
+  for (const recordKey of batchContext.changedRecords) {
+    mutableMergedPatch[recordKey] = mutableNextState[recordKey]
   }
   return Object.keys(mergedPatch).length === 0 ? state : mergedPatch
 }
@@ -2686,14 +3389,38 @@ export function applyFreshWebSessionTabsSnapshots(
     : applyWebSessionTabsSnapshots(state, freshSnapshots, environmentId, now)
 }
 
+type WebSessionTabsSnapshotOperation = {
+  environmentId: string
+  snapshot: RuntimeMobileSessionTabsResult
+}
+
+function applyWebSessionTabsSnapshotOperations(
+  state: WebSessionTabsSyncState,
+  operations: readonly WebSessionTabsSnapshotOperation[]
+): WebSessionTabsSyncState | Partial<WebSessionTabsSyncState> {
+  let nextState = state
+  let mergedPatch: Partial<WebSessionTabsSyncState> = {}
+  for (const { environmentId, snapshot } of operations) {
+    if (!shouldApplyWebSessionTabsSnapshot(snapshot, environmentId)) {
+      continue
+    }
+    const patch = applyWebSessionTabsSnapshot(nextState, snapshot, environmentId)
+    if (patch === nextState) {
+      continue
+    }
+    mergedPatch = { ...mergedPatch, ...patch }
+    nextState = { ...nextState, ...patch }
+  }
+  return Object.keys(mergedPatch).length === 0 ? state : mergedPatch
+}
+
 export function applyWebSessionTabsStorePatch(
   buildPatch: (state: AppState) => WebSessionTabsSyncState | Partial<WebSessionTabsSyncState>
 ): void {
   let mirroredAgentStatusChanged = false
   useAppStore.setState((state) => {
     const patch = buildPatch(state)
-    mirroredAgentStatusChanged =
-      patch !== state && Object.prototype.hasOwnProperty.call(patch, 'agentStatusByPaneKey')
+    mirroredAgentStatusChanged = patch !== state && Object.hasOwn(patch, 'agentStatusByPaneKey')
     return patch
   })
   // Why: paired-web snapshots bypass setAgentStatus, so arm the stale-boundary timer explicitly like local hook events do.
@@ -2702,7 +3429,109 @@ export function applyWebSessionTabsStorePatch(
   }
 }
 
+function loadInitialWebSessionTabs(
+  environmentId: string,
+  expectedEnvironmentPairingRevision: number | undefined,
+  isCurrent: () => boolean
+): void {
+  void window.api.runtimeEnvironments
+    .call({
+      selector: environmentId,
+      method: 'session.tabs.listAll',
+      params: {},
+      timeoutMs: 15_000,
+      expectedEnvironmentPairingRevision
+    })
+    .then(async (response: RuntimeRpcResponse<unknown>) => {
+      if (
+        !isCurrent() ||
+        getRuntimeEnvironmentRevision(environmentId) !== expectedEnvironmentPairingRevision
+      ) {
+        return
+      }
+      if (response.ok === false) {
+        console.warn('[web-session-tabs-sync] initial listAll failed:', response.error.message)
+        return
+      }
+      const result = response.result
+      if (!isSessionTabsListAllResult(result)) {
+        console.warn('[web-session-tabs-sync] initial listAll returned an invalid payload')
+        return
+      }
+      const receivedFrames = result.snapshots.map((snapshot) =>
+        recordReceivedWebSessionTabsSnapshot(environmentId, snapshot)
+      )
+      const finishRecoveries = result.snapshots.map((snapshot, index) =>
+        beginWebSessionTabsSnapshotRecovery(
+          environmentId,
+          snapshot.worktree,
+          receivedFrames[index]!
+        )
+      )
+      try {
+        const recovered = await Promise.all(
+          result.snapshots.map((snapshot) =>
+            recoverWebSessionTerminalOrphansBeforeApply(
+              useAppStore.getState(),
+              snapshot,
+              environmentId
+            )
+          )
+        )
+        if (
+          !isCurrent() ||
+          getRuntimeEnvironmentRevision(environmentId) !== expectedEnvironmentPairingRevision
+        ) {
+          return
+        }
+        const applicable = recovered.filter(
+          (snapshot, index): snapshot is RuntimeMobileSessionTabsResult =>
+            snapshot !== null &&
+            shouldApplyRecoveredWebSessionTabsSnapshot(
+              environmentId,
+              snapshot,
+              receivedFrames[index]!
+            )
+        )
+        applyWebSessionTabsStorePatch((state) =>
+          applyFreshWebSessionTabsSnapshots(state, applicable, environmentId)
+        )
+      } finally {
+        for (const finishRecovery of finishRecoveries) {
+          finishRecovery()
+        }
+      }
+    })
+    .catch((error) => {
+      if (isCurrent()) {
+        console.warn(
+          '[web-session-tabs-sync] failed to load initial session tabs:',
+          error instanceof Error ? error.message : String(error)
+        )
+      }
+    })
+}
+
 export function useWebSessionTabsSync(): void {
+  const recordVisibilityResumeSnapshotRef = useRef<
+    (environmentId: string, snapshot: RuntimeMobileSessionTabsResult, receivedFrame: number) => void
+  >(() => {})
+  const recordVisibilityResumeSnapshotReceiptRef = useRef<
+    (environmentId: string, snapshot: RuntimeMobileSessionTabsResult, receivedFrame: number) => void
+  >(() => {})
+  const shouldApplyVisibilityResumeSnapshotRef = useRef<
+    (
+      environmentId: string,
+      snapshot: RuntimeMobileSessionTabsResult,
+      receivedFrame: number
+    ) => boolean
+  >(() => true)
+  const visibilityResumeOmissionsByKeyRef = useRef(new Map<string, VisibilityResumeOmission>())
+  const mirroredSessionTabsOwnerRevisionByEnvironmentRef = useRef(
+    new Map<string, number | undefined>()
+  )
+  const activeRuntimeEnvironmentIdRef = useRef<string | null>(null)
+  const activeRuntimeWorktreeKeyRef = useRef<string | null>(null)
   const activeWorktreeId = useAppStore((state) => state.activeWorktreeId)
   const runtimeSessionMirrorEnvironmentKey = useRuntimeSessionMirrorEnvironmentKey()
   const activeWorktreeRuntimeEnvironmentId = useAppStore((state) =>
@@ -2728,6 +3557,27 @@ export function useWebSessionTabsSync(): void {
     return environment ? (environment.pairingRevision ?? environment.createdAt) : undefined
   })
   const workspaceSessionReady = useAppStore((state) => state.workspaceSessionReady)
+  // Why: only resume callbacks read these refs, and resumes fire from visibilitychange or
+  // stale-visibility recovery — outside React — so committing during layout leaves no window
+  // where a resume could read the previous worktree's key.
+  useLayoutEffect(() => {
+    activeRuntimeEnvironmentIdRef.current = activeWorktreeRuntimeEnvironmentId?.trim() || null
+    activeRuntimeWorktreeKeyRef.current =
+      activeWorktreeRuntimeEnvironmentId && activeWorktreeId
+        ? sessionTabsFreshnessKey(activeWorktreeRuntimeEnvironmentId, activeWorktreeId)
+        : null
+  }, [activeWorktreeId, activeWorktreeRuntimeEnvironmentId])
+
+  useEffect(
+    () => () => {
+      for (const environmentId of mirroredSessionTabsOwnerRevisionByEnvironmentRef.current.keys()) {
+        clearWebSessionTabsTrackingForEnvironment(environmentId)
+      }
+      mirroredSessionTabsOwnerRevisionByEnvironmentRef.current.clear()
+      visibilityResumeOmissionsByKeyRef.current.clear()
+    },
+    []
+  )
 
   useEffect(() => {
     const environments = runtimeSessionMirrorEnvironmentKey
@@ -2743,14 +3593,396 @@ export function useWebSessionTabsSync(): void {
           })
           .filter(({ environmentId }) => environmentId.trim())
       : []
+    const mirroredEnvironmentOwnerRevisions = new Map(
+      (workspaceSessionReady ? environments : []).map(
+        ({ environmentId, expectedEnvironmentPairingRevision }) =>
+          [environmentId, expectedEnvironmentPairingRevision] as const
+      )
+    )
+    const previousOwnerRevisions = mirroredSessionTabsOwnerRevisionByEnvironmentRef.current
+    // Why: same-owner tracking must survive effect restarts to reconcile removals missed while hidden.
+    for (const [environmentId, previousRevision] of previousOwnerRevisions) {
+      if (
+        !mirroredEnvironmentOwnerRevisions.has(environmentId) ||
+        mirroredEnvironmentOwnerRevisions.get(environmentId) !== previousRevision
+      ) {
+        clearWebSessionTabsTrackingForEnvironment(environmentId)
+      }
+    }
+    mirroredSessionTabsOwnerRevisionByEnvironmentRef.current = mirroredEnvironmentOwnerRevisions
+    for (const [key, omission] of visibilityResumeOmissionsByKeyRef.current) {
+      const previousRevision = previousOwnerRevisions.get(omission.environmentId)
+      if (
+        !mirroredEnvironmentOwnerRevisions.has(omission.environmentId) ||
+        (previousOwnerRevisions.has(omission.environmentId) &&
+          mirroredEnvironmentOwnerRevisions.get(omission.environmentId) !== previousRevision)
+      ) {
+        visibilityResumeOmissionsByKeyRef.current.delete(key)
+      }
+    }
     // Why: mirror all paired runtimes' sessions, not just the selected worktree, so background worktrees don't look asleep (selectedness isn't liveness).
     // Why: applying the host snapshot before startup hydration writes browser-local session state clobbers it and leaves the sidebar stale.
     if (!workspaceSessionReady || environments.length === 0) {
       return
     }
 
-    let disposed = false
-    const unsubscribes: (() => void)[] = []
+    type VisibilityResumeEnvironment = {
+      trackedWorktrees: readonly TrackedWebSessionTabsWorktree[]
+      inventoryReceived: boolean
+      latestInventoryReceivedFrame: number
+      pendingMissingWorktrees: Set<string>
+    }
+    type VisibilityResumeMissing = {
+      environmentId: string
+      inventoryReceivedFrame: number
+      trackedWorktree: TrackedWebSessionTabsWorktree
+      snapshot: RuntimeMobileSessionTabsRemovedResult
+    }
+    type VisibilityResumeBatch = {
+      visibilityGeneration: number
+      environments: Map<string, VisibilityResumeEnvironment>
+      pendingInventoryCount: number
+      pendingMissingByWorktree: Map<string, Map<string, VisibilityResumeMissing>>
+      deferredRepairWorktrees: Set<string>
+      trackedWorktreeIds: ReadonlySet<string>
+      reapplyableSnapshotsByKey: Map<
+        string,
+        { snapshot: RuntimeMobileSessionTabsResult; receivedFrame: number }
+      >
+    }
+
+    const subscriptionSpecs: WindowVisibilitySubscriptionSpec[] = []
+    const environmentIdBySubscriptionSpec: string[] = []
+    let visibilityResumeBatch: VisibilityResumeBatch | null = null
+    const visibilityResumeOmissionsByKey = visibilityResumeOmissionsByKeyRef.current
+
+    const recordVisibilityResumeSnapshotReceipt = (
+      environmentId: string,
+      snapshot: RuntimeMobileSessionTabsResult,
+      receivedFrame: number
+    ): void => {
+      const omission = visibilityResumeOmissionsByKey.get(
+        sessionTabsFreshnessKey(environmentId, snapshot.worktree)
+      )
+      if (
+        omission &&
+        receivedFrame > omission.inventoryReceivedFrame &&
+        ((snapshot as { removed?: unknown }).removed === true ||
+          advancesSessionTabsFreshness(snapshot, omission.baseline))
+      ) {
+        omission.superseded = true
+        if (visibilityResumeBatch?.pendingMissingByWorktree.has(snapshot.worktree)) {
+          reconcileVisibilityResumeWorktrees([snapshot.worktree])
+        }
+      }
+    }
+
+    const shouldApplyVisibilityResumeSnapshot = (
+      environmentId: string,
+      snapshot: RuntimeMobileSessionTabsResult,
+      receivedFrame: number
+    ): boolean => {
+      const omission = visibilityResumeOmissionsByKey.get(
+        sessionTabsFreshnessKey(environmentId, snapshot.worktree)
+      )
+      if (!omission) {
+        return true
+      }
+      if (receivedFrame < omission.inventoryReceivedFrame) {
+        return false
+      }
+      return (
+        (snapshot as { removed?: unknown }).removed === true ||
+        advancesSessionTabsFreshness(snapshot, omission.baseline)
+      )
+    }
+    recordVisibilityResumeSnapshotReceiptRef.current = recordVisibilityResumeSnapshotReceipt
+    shouldApplyVisibilityResumeSnapshotRef.current = shouldApplyVisibilityResumeSnapshot
+
+    const isVisibilityResumeMissingCurrent = (missing: VisibilityResumeMissing): boolean => {
+      const omission = visibilityResumeOmissionsByKey.get(
+        sessionTabsFreshnessKey(missing.environmentId, missing.snapshot.worktree)
+      )
+      return (
+        omission?.inventoryReceivedFrame === missing.inventoryReceivedFrame && !omission.superseded
+      )
+    }
+
+    const getVisibilityResumeSnapshot = (
+      batch: VisibilityResumeBatch,
+      environmentId: string,
+      worktreeId: string
+    ): RuntimeMobileSessionTabsResult | null => {
+      const key = sessionTabsFreshnessKey(environmentId, worktreeId)
+      const entry = batch.reapplyableSnapshotsByKey.get(key)
+      const freshness = latestSessionTabsSnapshotByWorktree.get(key)
+      if (
+        !entry ||
+        freshness?.publicationEpoch !== entry.snapshot.publicationEpoch ||
+        freshness.snapshotVersion !== entry.snapshot.snapshotVersion ||
+        !shouldApplyRecoveredWebSessionTabsSnapshot(
+          environmentId,
+          entry.snapshot,
+          entry.receivedFrame
+        )
+      ) {
+        return null
+      }
+      return entry.snapshot
+    }
+
+    const finishVisibilityResumeBatchIfIdle = (batch: VisibilityResumeBatch): void => {
+      if (
+        batch.pendingInventoryCount === 0 &&
+        batch.pendingMissingByWorktree.size === 0 &&
+        visibilityResumeBatch === batch
+      ) {
+        visibilityResumeBatch = null
+      }
+    }
+
+    // Why: omission tombstones touch shared terminal ids, so apply them only before replaying every surviving host.
+    function reconcileVisibilityResumeWorktrees(worktreeIds: Iterable<string>): void {
+      const batch = visibilityResumeBatch
+      if (!batch) {
+        return
+      }
+      const operations: WebSessionTabsSnapshotOperation[] = []
+      for (const worktreeId of new Set(worktreeIds)) {
+        const pendingMissing = batch.pendingMissingByWorktree.get(worktreeId)
+        if (!pendingMissing) {
+          batch.deferredRepairWorktrees.delete(worktreeId)
+          continue
+        }
+        for (const [environmentId, missing] of pendingMissing) {
+          if (isVisibilityResumeMissingCurrent(missing)) {
+            continue
+          }
+          pendingMissing.delete(environmentId)
+          batch.environments.get(environmentId)?.pendingMissingWorktrees.delete(worktreeId)
+        }
+        if (pendingMissing.size === 0) {
+          batch.pendingMissingByWorktree.delete(worktreeId)
+          batch.deferredRepairWorktrees.delete(worktreeId)
+          continue
+        }
+        const missingEnvironmentIds = new Set(pendingMissing.keys())
+        const survivingSnapshots: {
+          environmentId: string
+          snapshot: RuntimeMobileSessionTabsResult
+        }[] = []
+        let canRepairSharedState = true
+        for (const environmentId of sessionTabsEnvironmentsByWorktree.get(worktreeId) ?? []) {
+          if (missingEnvironmentIds.has(environmentId)) {
+            continue
+          }
+          const snapshot = getVisibilityResumeSnapshot(batch, environmentId, worktreeId)
+          if (!snapshot) {
+            canRepairSharedState = false
+            break
+          }
+          survivingSnapshots.push({ environmentId, snapshot })
+        }
+        if (!canRepairSharedState) {
+          batch.deferredRepairWorktrees.add(worktreeId)
+          continue
+        }
+        for (const missing of pendingMissing.values()) {
+          operations.push({ environmentId: missing.environmentId, snapshot: missing.snapshot })
+        }
+        for (const { environmentId, snapshot } of survivingSnapshots) {
+          acceptReplayedWebSessionTabsSnapshot(environmentId, worktreeId)
+          operations.push({ environmentId, snapshot })
+        }
+        for (const environmentId of pendingMissing.keys()) {
+          batch.environments.get(environmentId)?.pendingMissingWorktrees.delete(worktreeId)
+        }
+        batch.pendingMissingByWorktree.delete(worktreeId)
+        batch.deferredRepairWorktrees.delete(worktreeId)
+      }
+      if (operations.length > 0) {
+        applyWebSessionTabsStorePatch((state) =>
+          applyWebSessionTabsSnapshotOperations(state, operations)
+        )
+      }
+      finishVisibilityResumeBatchIfIdle(batch)
+    }
+
+    const recordVisibilityResumeSnapshot = (
+      environmentId: string,
+      snapshot: RuntimeMobileSessionTabsResult,
+      receivedFrame: number
+    ): void => {
+      const batch = visibilityResumeBatch
+      if (!batch || !batch.trackedWorktreeIds.has(snapshot.worktree)) {
+        return
+      }
+      const key = sessionTabsFreshnessKey(environmentId, snapshot.worktree)
+      const existingIsCurrent = getVisibilityResumeSnapshot(batch, environmentId, snapshot.worktree)
+      const freshness = latestSessionTabsSnapshotByWorktree.get(key)
+      const repairsCrossHostCollision =
+        (sessionTabsEnvironmentsByWorktree.get(snapshot.worktree)?.size ?? 0) > 1 ||
+        batch.deferredRepairWorktrees.has(snapshot.worktree)
+      if (
+        (snapshot as { removed?: unknown }).removed === true ||
+        snapshot.tabs.length === 0 ||
+        !repairsCrossHostCollision ||
+        freshness?.publicationEpoch !== snapshot.publicationEpoch ||
+        freshness.snapshotVersion !== snapshot.snapshotVersion ||
+        !shouldApplyRecoveredWebSessionTabsSnapshot(environmentId, snapshot, receivedFrame)
+      ) {
+        if (!existingIsCurrent) {
+          batch.reapplyableSnapshotsByKey.delete(key)
+        }
+      } else {
+        batch.reapplyableSnapshotsByKey.set(key, { snapshot, receivedFrame })
+      }
+      if (batch.pendingMissingByWorktree.has(snapshot.worktree)) {
+        reconcileVisibilityResumeWorktrees([snapshot.worktree])
+      }
+    }
+
+    const recordVisibilityResumeInventory = (
+      environmentId: string,
+      visibilityGeneration: number,
+      inventoryReceivedFrame: number,
+      missingWorktrees: readonly VisibilityResumeMissing[]
+    ): void => {
+      if (
+        visibilityGeneration === 0 ||
+        visibilityResumeBatch?.visibilityGeneration !== visibilityGeneration
+      ) {
+        return
+      }
+      const environment = visibilityResumeBatch.environments.get(environmentId)
+      if (!environment || environment.latestInventoryReceivedFrame !== inventoryReceivedFrame) {
+        return
+      }
+      const batch = visibilityResumeBatch
+      const affectedWorktrees = new Set(environment.pendingMissingWorktrees)
+      for (const worktreeId of environment.pendingMissingWorktrees) {
+        const pendingMissing = batch.pendingMissingByWorktree.get(worktreeId)
+        pendingMissing?.delete(environmentId)
+        if (pendingMissing?.size === 0) {
+          batch.pendingMissingByWorktree.delete(worktreeId)
+        }
+      }
+      environment.pendingMissingWorktrees.clear()
+      for (const missing of missingWorktrees) {
+        const worktreeId = missing.snapshot.worktree
+        const pendingMissing = batch.pendingMissingByWorktree.get(worktreeId) ?? new Map()
+        pendingMissing.set(environmentId, missing)
+        batch.pendingMissingByWorktree.set(worktreeId, pendingMissing)
+        environment.pendingMissingWorktrees.add(worktreeId)
+        affectedWorktrees.add(worktreeId)
+      }
+      if (!environment.inventoryReceived) {
+        environment.inventoryReceived = true
+        batch.pendingInventoryCount -= 1
+      }
+      reconcileVisibilityResumeWorktrees(affectedWorktrees)
+    }
+    recordVisibilityResumeSnapshotRef.current = recordVisibilityResumeSnapshot
+
+    const recordVisibilityResumeInventoryReceipt = (
+      environmentId: string,
+      visibilityGeneration: number,
+      inventoryReceivedFrame: number,
+      snapshots: readonly RuntimeMobileSessionTabsResult[]
+    ): VisibilityResumeMissing[] => {
+      for (const snapshot of snapshots) {
+        visibilityResumeOmissionsByKey.delete(
+          sessionTabsFreshnessKey(environmentId, snapshot.worktree)
+        )
+      }
+      if (visibilityResumeBatch?.visibilityGeneration !== visibilityGeneration) {
+        return []
+      }
+      const environment = visibilityResumeBatch.environments.get(environmentId)
+      if (!environment) {
+        return []
+      }
+      environment.latestInventoryReceivedFrame = Math.max(
+        environment.latestInventoryReceivedFrame,
+        inventoryReceivedFrame
+      )
+      if (environment.latestInventoryReceivedFrame !== inventoryReceivedFrame) {
+        return []
+      }
+      const publishedWorktrees = new Set(snapshots.map((snapshot) => snapshot.worktree))
+      return buildMissingWebSessionTabsRemovals(
+        environmentId,
+        environment.trackedWorktrees,
+        publishedWorktrees
+      ).map((missing) => {
+        const key = sessionTabsFreshnessKey(environmentId, missing.snapshot.worktree)
+        visibilityResumeOmissionsByKey.set(key, {
+          baseline: missing.trackedWorktree.freshness,
+          environmentId,
+          inventoryReceivedFrame,
+          superseded: false,
+          visibilityGeneration
+        })
+        recordReceivedWebSessionTabsRemoval(
+          environmentId,
+          missing.snapshot.worktree,
+          inventoryReceivedFrame
+        )
+        return { environmentId, inventoryReceivedFrame, ...missing }
+      })
+    }
+
+    const beginVisibilityResume = ({
+      visibilityGeneration,
+      restartingSpecIndexes
+    }: {
+      visibilityGeneration: number
+      restartingSpecIndexes: readonly number[]
+    }): void => {
+      const activeRuntimeWorktreeKey = activeRuntimeWorktreeKeyRef.current
+      for (const [key, omission] of visibilityResumeOmissionsByKey) {
+        // Why: the active worktree's scoped stream resumes before its host inventory, so its fence outlives exactly one resume - never more.
+        if (
+          key !== activeRuntimeWorktreeKey ||
+          omission.visibilityGeneration < visibilityGeneration - 1
+        ) {
+          visibilityResumeOmissionsByKey.delete(key)
+        }
+      }
+      const resumedEnvironments = new Map<string, VisibilityResumeEnvironment>()
+      const trackedWorktreeIds = new Set<string>()
+      for (const index of restartingSpecIndexes) {
+        const environmentId = environmentIdBySubscriptionSpec[index]
+        if (environmentId) {
+          const trackedWorktrees = getTrackedWebSessionTabsWorktrees(environmentId)
+          if (trackedWorktrees.length === 0) {
+            continue
+          }
+          for (const { worktree } of trackedWorktrees) {
+            trackedWorktreeIds.add(worktree)
+          }
+          resumedEnvironments.set(environmentId, {
+            trackedWorktrees,
+            inventoryReceived: false,
+            latestInventoryReceivedFrame: 0,
+            pendingMissingWorktrees: new Set()
+          })
+        }
+      }
+      visibilityResumeBatch =
+        resumedEnvironments.size > 0
+          ? {
+              visibilityGeneration,
+              environments: resumedEnvironments,
+              pendingInventoryCount: resumedEnvironments.size,
+              pendingMissingByWorktree: new Map(),
+              deferredRepairWorktrees: new Set(),
+              trackedWorktreeIds,
+              reapplyableSnapshotsByKey: new Map()
+            }
+          : null
+    }
+
     // Why: the stream's initial snapshot can land after first render, so a one-shot fetch makes initial parity deterministic.
     for (const { environmentId, expectedEnvironmentPairingRevision } of environments) {
       if (
@@ -2761,170 +3993,241 @@ export function useWebSessionTabsSync(): void {
       ) {
         continue
       }
-      void window.api.runtimeEnvironments
-        .call({
-          selector: environmentId,
-          method: 'session.tabs.listAll',
-          params: {},
-          timeoutMs: 15_000,
-          expectedEnvironmentPairingRevision
-        })
-        .then(async (response: RuntimeRpcResponse<unknown>) => {
-          if (
-            disposed ||
-            getRuntimeEnvironmentRevision(environmentId) !== expectedEnvironmentPairingRevision
-          ) {
-            return
+      let requestedInitialLoad = false
+      environmentIdBySubscriptionSpec.push(environmentId)
+      subscriptionSpecs.push({
+        subscribe: (isCurrent, { visibilityGeneration }) => {
+          const isVisibilityRestart = visibilityGeneration > 0
+          let awaitingVisibilityResumeInventory = isVisibilityRestart
+          if (!requestedInitialLoad) {
+            requestedInitialLoad = true
+            loadInitialWebSessionTabs(environmentId, expectedEnvironmentPairingRevision, isCurrent)
           }
-          if (response.ok === false) {
-            console.warn('[web-session-tabs-sync] initial listAll failed:', response.error.message)
-            return
-          }
-          const result = response.result
-          if (!isSessionTabsListAllResult(result)) {
-            console.warn('[web-session-tabs-sync] initial listAll returned an invalid payload')
-            return
-          }
-          const recovered = await Promise.all(
-            result.snapshots.map((snapshot) =>
-              recoverWebSessionTerminalOrphansBeforeApply(
-                useAppStore.getState(),
-                snapshot,
-                environmentId
-              )
-            )
-          )
-          if (disposed) {
-            return
-          }
-          const applicable = recovered.filter(
-            (snapshot): snapshot is RuntimeMobileSessionTabsResult => snapshot !== null
-          )
-          applyWebSessionTabsStorePatch((state) =>
-            applyFreshWebSessionTabsSnapshots(state, applicable, environmentId)
-          )
-        })
-        .catch((error) => {
-          if (!disposed) {
-            console.warn(
-              '[web-session-tabs-sync] failed to load initial session tabs:',
-              error instanceof Error ? error.message : String(error)
-            )
-          }
-        })
-
-      void window.api.runtimeEnvironments
-        .subscribe(
-          {
-            selector: environmentId,
-            method: 'session.tabs.subscribeAll',
-            params: {},
-            timeoutMs: 15_000,
-            expectedEnvironmentPairingRevision
-          },
-          {
-            onResponse: (response: RuntimeRpcResponse<unknown>) => {
-              if (
-                disposed ||
-                getRuntimeEnvironmentRevision(environmentId) !== expectedEnvironmentPairingRevision
-              ) {
-                return
-              }
-              if (response.ok === false) {
-                console.warn(
-                  '[web-session-tabs-sync] global subscription failed:',
-                  response.error.message
-                )
-                return
-              }
-              const event = response.result as SessionTabsStreamEvent
-              const replayed = isRuntimeSubscriptionReplayResponse(response)
-              if (event.type === 'snapshots') {
-                void Promise.all(
-                  event.snapshots.map((snapshot) =>
-                    recoverWebSessionTerminalOrphansBeforeApply(
-                      useAppStore.getState(),
-                      snapshot,
-                      environmentId
+          return window.api.runtimeEnvironments.subscribe(
+            {
+              selector: environmentId,
+              method: 'session.tabs.subscribeAll',
+              params: {},
+              timeoutMs: 15_000,
+              expectedEnvironmentPairingRevision
+            },
+            {
+              onResponse: (response: RuntimeRpcResponse<unknown>) => {
+                if (
+                  !isCurrent() ||
+                  getRuntimeEnvironmentRevision(environmentId) !==
+                    expectedEnvironmentPairingRevision
+                ) {
+                  return
+                }
+                if (response.ok === false) {
+                  console.warn(
+                    '[web-session-tabs-sync] global subscription failed:',
+                    response.error.message
+                  )
+                  return
+                }
+                const event = response.result as SessionTabsStreamEvent
+                const replayed = isRuntimeSubscriptionReplayResponse(response)
+                if (event.type === 'snapshots') {
+                  const skipUnchangedResumeWork = awaitingVisibilityResumeInventory && !replayed
+                  awaitingVisibilityResumeInventory = false
+                  // Why: an unchanged epoch/version proves the host published nothing while parked, so there is no missed frame to recover or replay.
+                  const unchangedVisibilityResumeSnapshots = event.snapshots.map((snapshot) => {
+                    const key = sessionTabsFreshnessKey(environmentId, snapshot.worktree)
+                    const freshness = latestSessionTabsSnapshotByWorktree.get(key)
+                    return Boolean(
+                      skipUnchangedResumeWork &&
+                      // Why: an armed replay is an outstanding repair request, so that worktree must be rebuilt even when the host looks unchanged.
+                      !replayableSessionTabsSnapshotByWorktree.has(key) &&
+                      freshness?.publicationEpoch === snapshot.publicationEpoch &&
+                      freshness.snapshotVersion === snapshot.snapshotVersion
+                    )
+                  })
+                  const receivedFrames = event.snapshots.map((snapshot) => {
+                    const receivedFrame = recordReceivedWebSessionTabsSnapshot(
+                      environmentId,
+                      snapshot
+                    )
+                    recordVisibilityResumeSnapshotReceipt(environmentId, snapshot, receivedFrame)
+                    return receivedFrame
+                  })
+                  const inventoryReceivedFrame = recordReceivedWebSessionTabsInventory()
+                  const missingWorktrees = recordVisibilityResumeInventoryReceipt(
+                    environmentId,
+                    visibilityGeneration,
+                    inventoryReceivedFrame,
+                    event.snapshots
+                  )
+                  const finishRecoveries = event.snapshots.map((snapshot, index) =>
+                    unchangedVisibilityResumeSnapshots[index]
+                      ? null
+                      : beginWebSessionTabsSnapshotRecovery(
+                          environmentId,
+                          snapshot.worktree,
+                          receivedFrames[index]!
+                        )
+                  )
+                  void Promise.all(
+                    event.snapshots.map((snapshot, index) =>
+                      unchangedVisibilityResumeSnapshots[index]
+                        ? Promise.resolve(snapshot)
+                        : recoverWebSessionTerminalOrphansBeforeApply(
+                            useAppStore.getState(),
+                            snapshot,
+                            environmentId
+                          )
                     )
                   )
+                    .then((recovered) => {
+                      if (isCurrent()) {
+                        const applicable = recovered.flatMap((snapshot, index) =>
+                          snapshot !== null &&
+                          shouldApplyRecoveredWebSessionTabsSnapshot(
+                            environmentId,
+                            snapshot,
+                            receivedFrames[index]!
+                          ) &&
+                          shouldApplyVisibilityResumeSnapshot(
+                            environmentId,
+                            snapshot,
+                            receivedFrames[index]!
+                          )
+                            ? [{ index, snapshot }]
+                            : []
+                        )
+                        if (isVisibilityRestart || replayed) {
+                          for (const { index, snapshot } of applicable) {
+                            if (unchangedVisibilityResumeSnapshots[index]) {
+                              continue
+                            }
+                            acceptReplayedWebSessionTabsSnapshot(environmentId, snapshot.worktree)
+                          }
+                        }
+                        const freshSnapshots = applicable.flatMap(({ index, snapshot }) =>
+                          !unchangedVisibilityResumeSnapshots[index] &&
+                          shouldApplyWebSessionTabsSnapshot(snapshot, environmentId)
+                            ? [snapshot]
+                            : []
+                        )
+                        if (freshSnapshots.length > 0) {
+                          applyWebSessionTabsStorePatch((state) =>
+                            applyWebSessionTabsSnapshots(state, freshSnapshots, environmentId)
+                          )
+                        }
+                        const freshSnapshotSet = new Set(freshSnapshots)
+                        for (const { index, snapshot } of applicable) {
+                          if (unchangedVisibilityResumeSnapshots[index]) {
+                            queueAcceptedWebSessionTerminalSnapshot(snapshot, environmentId)
+                          }
+                          if (
+                            unchangedVisibilityResumeSnapshots[index] ||
+                            freshSnapshotSet.has(snapshot)
+                          ) {
+                            recordVisibilityResumeSnapshot(
+                              environmentId,
+                              snapshot,
+                              receivedFrames[index]!
+                            )
+                          }
+                        }
+                        recordVisibilityResumeInventory(
+                          environmentId,
+                          visibilityGeneration,
+                          inventoryReceivedFrame,
+                          missingWorktrees
+                        )
+                      }
+                    })
+                    .catch((error) => {
+                      if (isCurrent()) {
+                        console.warn('[web-session-tabs-sync] snapshot recovery failed:', error)
+                      }
+                    })
+                    .finally(() => {
+                      for (const finishRecovery of finishRecoveries) {
+                        finishRecovery?.()
+                      }
+                    })
+                  return
+                }
+                if (event.type !== 'snapshot' && event.type !== 'updated') {
+                  return
+                }
+                const receivedFrame = recordReceivedWebSessionTabsSnapshot(environmentId, event)
+                recordVisibilityResumeSnapshotReceipt(environmentId, event, receivedFrame)
+                const finishRecovery = beginWebSessionTabsSnapshotRecovery(
+                  environmentId,
+                  event.worktree,
+                  receivedFrame
+                )
+                void recoverWebSessionTerminalOrphansBeforeApply(
+                  useAppStore.getState(),
+                  event,
+                  environmentId
                 )
                   .then((recovered) => {
-                    if (!disposed) {
-                      const applicable = recovered.filter(
-                        (snapshot): snapshot is RuntimeMobileSessionTabsResult => snapshot !== null
-                      )
+                    if (
+                      isCurrent() &&
+                      recovered &&
+                      shouldApplyRecoveredWebSessionTabsSnapshot(
+                        environmentId,
+                        recovered,
+                        receivedFrame
+                      ) &&
+                      shouldApplyVisibilityResumeSnapshot(environmentId, recovered, receivedFrame)
+                    ) {
                       if (replayed) {
-                        for (const snapshot of applicable) {
-                          acceptReplayedWebSessionTabsSnapshot(environmentId, snapshot.worktree)
-                        }
+                        acceptReplayedWebSessionTabsSnapshot(environmentId, recovered.worktree)
+                      }
+                      if (shouldApplyWebSessionTabsSnapshot(recovered, environmentId)) {
+                        applyWebSessionTabsStorePatch((state) =>
+                          applyWebSessionTabsSnapshot(state, recovered, environmentId)
+                        )
+                        recordVisibilityResumeSnapshot(environmentId, recovered, receivedFrame)
                       }
-                      applyWebSessionTabsStorePatch((state) =>
-                        applyFreshWebSessionTabsSnapshots(state, applicable, environmentId)
-                      )
                     }
                   })
                   .catch((error) => {
-                    if (!disposed) {
+                    if (isCurrent()) {
                       console.warn('[web-session-tabs-sync] snapshot recovery failed:', error)
                     }
                   })
-                return
+                  .finally(finishRecovery)
+              },
+              onError: (error) => {
+                if (isCurrent()) {
+                  console.warn('[web-session-tabs-sync] global subscription error:', error.message)
+                }
               }
-              if (event.type !== 'snapshot' && event.type !== 'updated') {
-                return
-              }
-              void recoverWebSessionTerminalOrphansBeforeApply(
-                useAppStore.getState(),
-                event,
-                environmentId
-              )
-                .then((recovered) => {
-                  if (!disposed && recovered) {
-                    if (replayed) {
-                      acceptReplayedWebSessionTabsSnapshot(environmentId, recovered.worktree)
-                    }
-                    applyWebSessionTabsStorePatch((state) =>
-                      applyFreshWebSessionTabsSnapshot(state, recovered, environmentId)
-                    )
-                  }
-                })
-                .catch((error) => {
-                  if (!disposed) {
-                    console.warn('[web-session-tabs-sync] snapshot recovery failed:', error)
-                  }
-                })
-            },
-            onError: (error) => {
-              console.warn('[web-session-tabs-sync] global subscription error:', error.message)
             }
-          }
-        )
-        .then((handle) => {
-          if (disposed) {
-            handle.unsubscribe()
-            return
-          }
-          unsubscribes.push(handle.unsubscribe)
-        })
-        .catch((error) => {
-          if (!disposed) {
-            console.warn(
-              '[web-session-tabs-sync] failed to subscribe globally:',
-              error instanceof Error ? error.message : String(error)
-            )
-          }
-        })
+          )
+        },
+        onSubscribeError: (error) => {
+          console.warn(
+            '[web-session-tabs-sync] failed to subscribe globally:',
+            error instanceof Error ? error.message : String(error)
+          )
+        },
+        onUnsubscribeError: (error) => {
+          console.warn('[web-session-tabs-sync] failed to unsubscribe globally:', error)
+        }
+      })
     }
+    // Why: pace full-host inventories while the scoped active-worktree mirror resumes immediately.
+    const disposeSubscriptions = installWindowVisibilitySubscriptionParking(subscriptionSpecs, {
+      getVisibilityResumePriority: (index) =>
+        environmentIdBySubscriptionSpec[index] === activeRuntimeEnvironmentIdRef.current ? 0 : 1,
+      visibilityResumeStaggerMs: WEB_SESSION_TABS_VISIBILITY_RESUME_STAGGER_MS,
+      onVisibilityResume: beginVisibilityResume
+    })
 
     return () => {
-      disposed = true
-      for (const unsubscribe of unsubscribes) {
-        unsubscribe()
-      }
-      // Why: environment ids churn as paired runtimes reconnect; don't leak stale tracking for the renderer lifetime.
+      recordVisibilityResumeSnapshotRef.current = () => {}
+      recordVisibilityResumeSnapshotReceiptRef.current = () => {}
+      shouldApplyVisibilityResumeSnapshotRef.current = () => true
+      disposeSubscriptions()
       for (const { environmentId, expectedEnvironmentPairingRevision } of environments) {
-        clearWebSessionTabsTrackingForEnvironment(environmentId)
         const owner = {
           environmentId,
           pairingRevision: expectedEnvironmentPairingRevision
@@ -2951,25 +4254,29 @@ export function useWebSessionTabsSync(): void {
       return
     }
 
-    // Why: activating a worktree can clear its local mirror after the global stream already recorded this host revision.
-    acceptReplayedWebSessionTabsSnapshot(environmentId, activeWorktreeId)
-    let disposed = false
     let requestedInitialTerminal = false
     let requestedRespawnAfterWake = false
-    let unsubscribe: (() => void) | null = null
     const applyActiveSnapshot = async (
       event: RuntimeMobileSessionTabsResult & { type: 'snapshot' | 'updated' },
-      response: RuntimeRpcResponse<unknown>
+      response: RuntimeRpcResponse<unknown>,
+      isCurrent: () => boolean,
+      receivedFrame: number
     ): Promise<void> => {
       const recovered = await recoverWebSessionTerminalOrphansBeforeApply(
         useAppStore.getState(),
         event,
         environmentId
       )
-      if (disposed || !recovered) {
+      if (
+        !isCurrent() ||
+        !recovered ||
+        !shouldApplyRecoveredWebSessionTabsSnapshot(environmentId, recovered, receivedFrame) ||
+        !shouldApplyVisibilityResumeSnapshotRef.current(environmentId, recovered, receivedFrame)
+      ) {
         return
       }
-      if (isRuntimeSubscriptionReplayResponse(response)) {
+      if (event.type === 'snapshot' || isRuntimeSubscriptionReplayResponse(response)) {
+        // Why: the parallel global stream can consume an earlier replay allowance before this authoritative snapshot lands.
         acceptReplayedWebSessionTabsSnapshot(environmentId, recovered.worktree)
       }
       const recoveredEvent: SessionTabsStreamEvent = { ...recovered, type: event.type }
@@ -3000,8 +4307,9 @@ export function useWebSessionTabsSync(): void {
         applyWebSessionTabsStorePatch((state) =>
           applyWebSessionTabsSnapshot(state, recovered, environmentId)
         )
+        recordVisibilityResumeSnapshotRef.current(environmentId, recovered, receivedFrame)
       }
-      if (!disposed && shouldBootstrapInitialTerminal) {
+      if (isCurrent() && shouldBootstrapInitialTerminal) {
         requestedInitialTerminal = true
         await createWebRuntimeSessionTerminal({
           worktreeId: activeWorktreeId,
@@ -3009,7 +4317,7 @@ export function useWebSessionTabsSync(): void {
           activate: true
         })
       } else if (
-        !disposed &&
+        isCurrent() &&
         shouldRespawnAfterWake &&
         beginWebRuntimeWakeTerminalRespawn(activeWorktreeId)
       ) {
@@ -3022,62 +4330,79 @@ export function useWebSessionTabsSync(): void {
         }).finally(() => endWebRuntimeWakeTerminalRespawn(activeWorktreeId))
       }
     }
-    void window.api.runtimeEnvironments
-      .subscribe(
-        {
-          selector: environmentId,
-          method: 'session.tabs.subscribe',
-          params: { worktree: toRuntimeWorktreeSelector(activeWorktreeId) },
-          timeoutMs: 15_000,
-          expectedEnvironmentPairingRevision
-        },
-        {
-          onResponse: (response: RuntimeRpcResponse<unknown>) => {
-            if (
-              disposed ||
-              getRuntimeEnvironmentRevision(environmentId) !== expectedEnvironmentPairingRevision
-            ) {
-              return
-            }
-            if (response.ok === false) {
-              console.warn('[web-session-tabs-sync] subscription failed:', response.error.message)
-              return
-            }
-            const event = response.result as SessionTabsStreamEvent
-            if (event.type !== 'snapshot' && event.type !== 'updated') {
-              return
-            }
-            void applyActiveSnapshot(event, response).catch((error) => {
-              if (!disposed) {
-                console.warn('[web-session-tabs-sync] active snapshot recovery failed:', error)
+    const disposeSubscription = installWindowVisibilitySubscriptionParking([
+      {
+        subscribe: (isCurrent) =>
+          window.api.runtimeEnvironments.subscribe(
+            {
+              selector: environmentId,
+              method: 'session.tabs.subscribe',
+              params: { worktree: toRuntimeWorktreeSelector(activeWorktreeId) },
+              timeoutMs: 15_000,
+              expectedEnvironmentPairingRevision
+            },
+            {
+              onResponse: (response: RuntimeRpcResponse<unknown>) => {
+                if (
+                  !isCurrent() ||
+                  getRuntimeEnvironmentRevision(environmentId) !==
+                    expectedEnvironmentPairingRevision
+                ) {
+                  return
+                }
+                if (response.ok === false) {
+                  console.warn(
+                    '[web-session-tabs-sync] subscription failed:',
+                    response.error.message
+                  )
+                  return
+                }
+                const event = response.result as SessionTabsStreamEvent
+                if (event.type !== 'snapshot' && event.type !== 'updated') {
+                  return
+                }
+                const receivedFrame = recordReceivedWebSessionTabsSnapshot(environmentId, event)
+                recordVisibilityResumeSnapshotReceiptRef.current(
+                  environmentId,
+                  event,
+                  receivedFrame
+                )
+                const finishRecovery = beginWebSessionTabsSnapshotRecovery(
+                  environmentId,
+                  event.worktree,
+                  receivedFrame
+                )
+                void applyActiveSnapshot(event, response, isCurrent, receivedFrame)
+                  .catch((error) => {
+                    if (isCurrent()) {
+                      console.warn(
+                        '[web-session-tabs-sync] active snapshot recovery failed:',
+                        error
+                      )
+                    }
+                  })
+                  .finally(finishRecovery)
+              },
+              onError: (error) => {
+                if (isCurrent()) {
+                  console.warn('[web-session-tabs-sync] subscription error:', error.message)
+                }
               }
-            })
-          },
-          onError: (error) => {
-            console.warn('[web-session-tabs-sync] subscription error:', error.message)
-          }
-        }
-      )
-      .then((handle) => {
-        if (disposed) {
-          handle.unsubscribe()
-          return
-        }
-        unsubscribe = handle.unsubscribe
-      })
-      .catch((error) => {
-        if (!disposed) {
+            }
+          ),
+        onSubscribeError: (error) => {
           console.warn(
             '[web-session-tabs-sync] failed to subscribe:',
             error instanceof Error ? error.message : String(error)
           )
+        },
+        onUnsubscribeError: (error) => {
+          console.warn('[web-session-tabs-sync] failed to unsubscribe:', error)
         }
-      })
+      }
+    ])
 
-    return () => {
-      disposed = true
-      unsubscribe?.()
-    }
+    return disposeSubscription
   }, [
     activeWorktreeId,
     activeWorktreeRuntimeEnvironmentId,
diff --git a/src/renderer/src/runtime/window-visibility-subscription-parking.test.ts b/src/renderer/src/runtime/window-visibility-subscription-parking.test.ts
new file mode 100644
index 00000000000..605b74f0ca4
--- /dev/null
+++ b/src/renderer/src/runtime/window-visibility-subscription-parking.test.ts
@@ -0,0 +1,436 @@
+// @vitest-environment happy-dom
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { resetStaleDocumentVisibilityForTesting } from '@/components/terminal-pane/stale-document-visibility'
+import {
+  installWindowVisibilitySubscriptionParking,
+  WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_BACKOFF_LIMIT,
+  WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS,
+  WINDOW_VISIBILITY_SUBSCRIPTION_RETRY_INITIAL_MS,
+  type WindowVisibilitySubscriptionSpec
+} from './window-visibility-subscription-parking'
+
+type Deferred<T> = {
+  promise: Promise<T>
+  resolve: (value: T) => void
+}
+
+function createDeferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((done) => {
+    resolve = done
+  })
+  return { promise, resolve }
+}
+
+function setDocumentVisibility(state: 'visible' | 'hidden'): void {
+  Object.defineProperty(document, 'visibilityState', {
+    configurable: true,
+    get: () => state
+  })
+  document.dispatchEvent(new Event('visibilitychange'))
+}
+
+async function settle(): Promise<void> {
+  await Promise.resolve()
+  await Promise.resolve()
+}
+
+function resolvedSpec() {
+  const currents: (() => boolean)[] = []
+  const unsubscribes: ReturnType<typeof vi.fn>[] = []
+  const subscribe = vi.fn(async (isCurrent: () => boolean) => {
+    currents.push(isCurrent)
+    const unsubscribe = vi.fn()
+    unsubscribes.push(unsubscribe)
+    return { unsubscribe }
+  })
+  return {
+    currents,
+    spec: { subscribe } satisfies WindowVisibilitySubscriptionSpec,
+    subscribe,
+    unsubscribes
+  }
+}
+
+describe('installWindowVisibilitySubscriptionParking', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    setDocumentVisibility('visible')
+  })
+
+  afterEach(() => {
+    setDocumentVisibility('visible')
+    resetStaleDocumentVisibilityForTesting()
+    vi.useRealTimers()
+    vi.restoreAllMocks()
+  })
+
+  it('parks every subscription after the grace and restarts them on reveal', async () => {
+    const first = resolvedSpec()
+    const second = resolvedSpec()
+    const dispose = installWindowVisibilitySubscriptionParking([first.spec, second.spec])
+    await settle()
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS - 1)
+    expect(first.unsubscribes[0]).not.toHaveBeenCalled()
+    expect(second.unsubscribes[0]).not.toHaveBeenCalled()
+
+    vi.advanceTimersByTime(1)
+    expect(first.unsubscribes[0]).toHaveBeenCalledTimes(1)
+    expect(second.unsubscribes[0]).toHaveBeenCalledTimes(1)
+    expect(first.currents[0]()).toBe(false)
+
+    setDocumentVisibility('visible')
+    await settle()
+    expect(first.subscribe).toHaveBeenCalledTimes(2)
+    expect(second.subscribe).toHaveBeenCalledTimes(2)
+    expect(first.currents[0]()).toBe(false)
+    expect(first.currents[1]()).toBe(true)
+
+    dispose()
+    expect(first.unsubscribes[1]).toHaveBeenCalledTimes(1)
+    expect(second.unsubscribes[1]).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not reconnect during a quick hide and show', async () => {
+    const harness = resolvedSpec()
+    const dispose = installWindowVisibilitySubscriptionParking([harness.spec])
+    await settle()
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS - 1)
+    setDocumentVisibility('visible')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+
+    expect(harness.subscribe).toHaveBeenCalledTimes(1)
+    expect(harness.unsubscribes[0]).not.toHaveBeenCalled()
+    dispose()
+  })
+
+  it('widens the park delay after a quickly undone park and resets it after a long hide', async () => {
+    const harness = resolvedSpec()
+    const dispose = installWindowVisibilitySubscriptionParking([harness.spec])
+    await settle()
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    setDocumentVisibility('visible')
+    await settle()
+    expect(harness.subscribe).toHaveBeenCalledTimes(2)
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    expect(harness.unsubscribes[1]).not.toHaveBeenCalled()
+
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    expect(harness.unsubscribes[1]).toHaveBeenCalledTimes(1)
+
+    const longHideMs =
+      WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS *
+      WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_BACKOFF_LIMIT
+    vi.advanceTimersByTime(longHideMs)
+    setDocumentVisibility('visible')
+    await settle()
+    expect(harness.subscribe).toHaveBeenCalledTimes(3)
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    expect(harness.unsubscribes[2]).toHaveBeenCalledTimes(1)
+    dispose()
+  })
+
+  it('reports each visibility generation before restarting its subscriptions', async () => {
+    const first = resolvedSpec()
+    const second = resolvedSpec()
+    const onVisibilityResume = vi.fn()
+    const dispose = installWindowVisibilitySubscriptionParking([first.spec, second.spec], {
+      onVisibilityResume
+    })
+    await settle()
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    setDocumentVisibility('visible')
+    await settle()
+
+    expect(onVisibilityResume).toHaveBeenCalledWith({
+      visibilityGeneration: 1,
+      restartingSpecIndexes: [0, 1]
+    })
+    dispose()
+  })
+
+  it('paces resume starts in priority order and cancels delayed starts on cleanup', async () => {
+    const first = resolvedSpec()
+    const active = resolvedSpec()
+    const third = resolvedSpec()
+    const dispose = installWindowVisibilitySubscriptionParking(
+      [first.spec, active.spec, third.spec],
+      {
+        getVisibilityResumePriority: (index) => (index === 1 ? 0 : 1),
+        visibilityResumeStaggerMs: 50
+      }
+    )
+    await settle()
+    expect(
+      [first.subscribe, active.subscribe, third.subscribe].map((mock) => mock.mock.calls.length)
+    ).toEqual([1, 1, 1])
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    setDocumentVisibility('visible')
+    await settle()
+    expect(
+      [first.subscribe, active.subscribe, third.subscribe].map((mock) => mock.mock.calls.length)
+    ).toEqual([1, 2, 1])
+    expect(vi.getTimerCount()).toBe(1)
+
+    vi.advanceTimersByTime(50)
+    await settle()
+    expect(
+      [first.subscribe, active.subscribe, third.subscribe].map((mock) => mock.mock.calls.length)
+    ).toEqual([2, 2, 1])
+    expect(vi.getTimerCount()).toBe(1)
+    vi.advanceTimersByTime(50)
+    await settle()
+    expect(
+      [first.subscribe, active.subscribe, third.subscribe].map((mock) => mock.mock.calls.length)
+    ).toEqual([2, 2, 2])
+    expect(vi.getTimerCount()).toBe(0)
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS * 2)
+    setDocumentVisibility('visible')
+    dispose()
+    vi.advanceTimersByTime(100)
+    expect(
+      [first.subscribe, active.subscribe, third.subscribe].map((mock) => mock.mock.calls.length)
+    ).toEqual([2, 3, 2])
+  })
+
+  it('cancels a paced chain when rehidden and restarts one new generation', async () => {
+    const first = resolvedSpec()
+    const active = resolvedSpec()
+    const third = resolvedSpec()
+    const parkDelayMs = 100
+    const dispose = installWindowVisibilitySubscriptionParking(
+      [first.spec, active.spec, third.spec],
+      {
+        getVisibilityResumePriority: (index) => (index === 1 ? 0 : 1),
+        parkDelayMs,
+        visibilityResumeStaggerMs: 1_000
+      }
+    )
+    await settle()
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(parkDelayMs)
+    setDocumentVisibility('visible')
+    await settle()
+    expect(
+      [first.subscribe, active.subscribe, third.subscribe].map((mock) => mock.mock.calls.length)
+    ).toEqual([1, 2, 1])
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(parkDelayMs)
+    vi.advanceTimersByTime(5_000)
+    expect(
+      [first.subscribe, active.subscribe, third.subscribe].map((mock) => mock.mock.calls.length)
+    ).toEqual([1, 2, 1])
+
+    setDocumentVisibility('visible')
+    await settle()
+    vi.advanceTimersByTime(2_000)
+    await settle()
+    expect(
+      [first.subscribe, active.subscribe, third.subscribe].map((mock) => mock.mock.calls.length)
+    ).toEqual([2, 3, 2])
+    dispose()
+  })
+
+  it('continues a paced chain when the priority subscription rejects', async () => {
+    const first = resolvedSpec()
+    const active = resolvedSpec()
+    const third = resolvedSpec()
+    const error = new Error('active start failed')
+    const onSubscribeError = vi.fn()
+    const dispose = installWindowVisibilitySubscriptionParking(
+      [first.spec, { ...active.spec, onSubscribeError }, third.spec],
+      {
+        getVisibilityResumePriority: (index) => (index === 1 ? 0 : 1),
+        visibilityResumeStaggerMs: 50
+      }
+    )
+    await settle()
+    active.subscribe.mockRejectedValueOnce(error)
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    setDocumentVisibility('visible')
+    await settle()
+    expect(onSubscribeError).toHaveBeenCalledWith(error)
+
+    vi.advanceTimersByTime(100)
+    await settle()
+    expect(
+      [first.subscribe, active.subscribe, third.subscribe].map((mock) => mock.mock.calls.length)
+    ).toEqual([2, 2, 2])
+    dispose()
+  })
+
+  it('stays parked when installed hidden and starts on reveal', async () => {
+    setDocumentVisibility('hidden')
+    const harness = resolvedSpec()
+    const onVisibilityResume = vi.fn()
+    const dispose = installWindowVisibilitySubscriptionParking([harness.spec], {
+      onVisibilityResume
+    })
+
+    expect(harness.subscribe).not.toHaveBeenCalled()
+    setDocumentVisibility('visible')
+    await settle()
+    expect(harness.subscribe).toHaveBeenCalledTimes(1)
+    expect(onVisibilityResume).toHaveBeenCalledWith({
+      visibilityGeneration: 1,
+      restartingSpecIndexes: [0]
+    })
+    dispose()
+  })
+
+  it('restarts after input proves an already parked hidden document is stale', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const harness = resolvedSpec()
+    const dispose = installWindowVisibilitySubscriptionParking([harness.spec])
+    await settle()
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    expect(harness.unsubscribes[0]).toHaveBeenCalledTimes(1)
+
+    document.dispatchEvent(new KeyboardEvent('keydown', { key: 'a' }))
+    await settle()
+    expect(document.visibilityState).toBe('hidden')
+    expect(harness.subscribe).toHaveBeenCalledTimes(2)
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS * 2)
+    expect(harness.unsubscribes[1]).toHaveBeenCalledTimes(1)
+    dispose()
+  })
+
+  it('keeps one pending start and replaces it only after stale settlement', async () => {
+    const first = createDeferred<{ unsubscribe: () => void }>()
+    const second = createDeferred<{ unsubscribe: () => void }>()
+    const firstUnsubscribe = vi.fn()
+    const secondUnsubscribe = vi.fn()
+    const currents: (() => boolean)[] = []
+    const subscribe = vi
+      .fn((isCurrent: () => boolean) => {
+        currents.push(isCurrent)
+        return first.promise
+      })
+      .mockImplementationOnce((isCurrent) => {
+        currents.push(isCurrent)
+        return first.promise
+      })
+      .mockImplementationOnce((isCurrent) => {
+        currents.push(isCurrent)
+        return second.promise
+      })
+    const dispose = installWindowVisibilitySubscriptionParking([{ subscribe }])
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    expect(currents[0]()).toBe(false)
+    setDocumentVisibility('visible')
+    expect(subscribe).toHaveBeenCalledTimes(1)
+
+    first.resolve({ unsubscribe: firstUnsubscribe })
+    await settle()
+    expect(firstUnsubscribe).toHaveBeenCalledTimes(1)
+    expect(subscribe).toHaveBeenCalledTimes(2)
+    expect(currents[0]()).toBe(false)
+    expect(currents[1]()).toBe(true)
+
+    second.resolve({ unsubscribe: secondUnsubscribe })
+    await settle()
+    dispose()
+    expect(secondUnsubscribe).toHaveBeenCalledTimes(1)
+  })
+
+  it('retires a pending handle that resolves after permanent cleanup', async () => {
+    const pending = createDeferred<{ unsubscribe: () => void }>()
+    const unsubscribe = vi.fn()
+    const subscribe = vi.fn(() => pending.promise)
+    const dispose = installWindowVisibilitySubscriptionParking([{ subscribe }])
+
+    dispose()
+    pending.resolve({ unsubscribe })
+    await settle()
+
+    expect(unsubscribe).toHaveBeenCalledTimes(1)
+    expect(subscribe).toHaveBeenCalledTimes(1)
+  })
+
+  it('retries a rejected replacement while visible and cancels retries on cleanup', async () => {
+    vi.spyOn(Math, 'random').mockReturnValue(0)
+    const initialUnsubscribe = vi.fn()
+    const replacementError = new Error('temporary reconnect failure')
+    const subscribe = vi
+      .fn<WindowVisibilitySubscriptionSpec['subscribe']>()
+      .mockResolvedValueOnce({ unsubscribe: initialUnsubscribe })
+      .mockRejectedValueOnce(replacementError)
+      .mockResolvedValueOnce({ unsubscribe: vi.fn() })
+      .mockRejectedValueOnce(replacementError)
+    const onSubscribeError = vi.fn()
+    const dispose = installWindowVisibilitySubscriptionParking([{ subscribe, onSubscribeError }])
+    await settle()
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS)
+    setDocumentVisibility('visible')
+    await settle()
+    expect(onSubscribeError).toHaveBeenCalledWith(replacementError)
+    expect(subscribe).toHaveBeenCalledTimes(2)
+
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_RETRY_INITIAL_MS)
+    await settle()
+    expect(subscribe).toHaveBeenCalledTimes(3)
+
+    setDocumentVisibility('hidden')
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS * 2)
+    setDocumentVisibility('visible')
+    await settle()
+    expect(subscribe).toHaveBeenCalledTimes(4)
+    expect(subscribe.mock.calls.map(([, context]) => context.visibilityGeneration)).toEqual([
+      0, 1, 1, 2
+    ])
+    dispose()
+    vi.advanceTimersByTime(WINDOW_VISIBILITY_SUBSCRIPTION_RETRY_INITIAL_MS * 2)
+    expect(subscribe).toHaveBeenCalledTimes(4)
+  })
+
+  it('isolates unsubscribe failures across entries', async () => {
+    const onUnsubscribeError = vi.fn()
+    const secondUnsubscribe = vi.fn()
+    const first: WindowVisibilitySubscriptionSpec = {
+      subscribe: async () => ({
+        unsubscribe: () => {
+          throw new Error('unsubscribe failed')
+        }
+      }),
+      onUnsubscribeError
+    }
+    const second: WindowVisibilitySubscriptionSpec = {
+      subscribe: async () => ({ unsubscribe: secondUnsubscribe })
+    }
+    const dispose = installWindowVisibilitySubscriptionParking([first, second])
+    await settle()
+
+    dispose()
+    expect(onUnsubscribeError).toHaveBeenCalledOnce()
+    expect(secondUnsubscribe).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/renderer/src/runtime/window-visibility-subscription-parking.ts b/src/renderer/src/runtime/window-visibility-subscription-parking.ts
new file mode 100644
index 00000000000..bfb85d95bf1
--- /dev/null
+++ b/src/renderer/src/runtime/window-visibility-subscription-parking.ts
@@ -0,0 +1,288 @@
+import {
+  getWindowParkVisible,
+  subscribeWindowParkVisibility,
+  WINDOW_HIDE_PARK_GRACE_MS
+} from '@/lib/window-park-visibility'
+
+// Why: the same app-switch grace every park site uses; the backoff below is what makes this one adaptive.
+export const WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS = WINDOW_HIDE_PARK_GRACE_MS
+// Why: resuming re-enumerates every host, so repeated short hides must widen the park delay instead of paying that cost each cycle.
+export const WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_BACKOFF_LIMIT = 8
+export const WINDOW_VISIBILITY_SUBSCRIPTION_RETRY_INITIAL_MS = 1_000
+const WINDOW_VISIBILITY_SUBSCRIPTION_RETRY_MAX_MS = 30_000
+const WINDOW_VISIBILITY_SUBSCRIPTION_RETRY_JITTER_MS = 250
+
+export type WindowVisibilitySubscriptionContext = {
+  visibilityGeneration: number
+}
+
+export type WindowVisibilitySubscriptionSpec = {
+  subscribe: (
+    isCurrent: () => boolean,
+    context: WindowVisibilitySubscriptionContext
+  ) => Promise<{ unsubscribe: () => void }>
+  onSubscribeError?: (error: unknown) => void
+  onUnsubscribeError?: (error: unknown) => void
+}
+
+export type WindowVisibilitySubscriptionParkingOptions = {
+  getVisibilityResumePriority?: (specIndex: number) => number
+  parkDelayMs?: number
+  visibilityResumeStaggerMs?: number
+  onVisibilityResume?: (args: {
+    visibilityGeneration: number
+    restartingSpecIndexes: readonly number[]
+  }) => void
+}
+
+type SubscriptionEntry = {
+  desired: boolean
+  generation: number
+  visibilityGeneration: number
+  pending: Promise<void> | null
+  retryAttempt: number
+  retryTimer: ReturnType<typeof setTimeout> | null
+  startTimer: ReturnType<typeof setTimeout> | null
+  unsubscribe: (() => void) | null
+}
+
+export function installWindowVisibilitySubscriptionParking(
+  specs: readonly WindowVisibilitySubscriptionSpec[],
+  options: WindowVisibilitySubscriptionParkingOptions = {}
+): () => void {
+  const parkDelayMs = options.parkDelayMs ?? WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_MS
+  const maxParkDelayMs = parkDelayMs * WINDOW_VISIBILITY_SUBSCRIPTION_PARK_DELAY_BACKOFF_LIMIT
+  let disposed = false
+  let effectiveVisible = getWindowParkVisible()
+  let visibilityGeneration = effectiveVisible ? 0 : 1
+  let parkTimer: ReturnType<typeof setTimeout> | null = null
+  let currentParkDelayMs = parkDelayMs
+  let hiddenSinceMs: number | null = null
+  const entries: SubscriptionEntry[] = specs.map(() => ({
+    desired: false,
+    generation: 0,
+    visibilityGeneration: 0,
+    pending: null,
+    retryAttempt: 0,
+    retryTimer: null,
+    startTimer: null,
+    unsubscribe: null
+  }))
+
+  const clearRetry = (entry: SubscriptionEntry): void => {
+    if (entry.retryTimer !== null) {
+      clearTimeout(entry.retryTimer)
+      entry.retryTimer = null
+    }
+  }
+
+  const clearStart = (entry: SubscriptionEntry): void => {
+    if (entry.startTimer !== null) {
+      clearTimeout(entry.startTimer)
+      entry.startTimer = null
+    }
+  }
+
+  const unsubscribeEntry = (entry: SubscriptionEntry, spec: WindowVisibilitySubscriptionSpec) => {
+    const unsubscribe = entry.unsubscribe
+    entry.unsubscribe = null
+    if (!unsubscribe) {
+      return
+    }
+    try {
+      unsubscribe()
+    } catch (error) {
+      spec.onUnsubscribeError?.(error)
+    }
+  }
+
+  function scheduleRetry(entry: SubscriptionEntry, spec: WindowVisibilitySubscriptionSpec): void {
+    if (disposed || !entry.desired || entry.retryTimer !== null) {
+      return
+    }
+    const exponentialDelay = Math.min(
+      WINDOW_VISIBILITY_SUBSCRIPTION_RETRY_INITIAL_MS * 2 ** Math.min(entry.retryAttempt, 5),
+      WINDOW_VISIBILITY_SUBSCRIPTION_RETRY_MAX_MS
+    )
+    const jitter = Math.floor(Math.random() * WINDOW_VISIBILITY_SUBSCRIPTION_RETRY_JITTER_MS)
+    entry.retryAttempt += 1
+    entry.retryTimer = setTimeout(() => {
+      entry.retryTimer = null
+      startEntry(entry, spec)
+    }, exponentialDelay + jitter)
+  }
+
+  function startEntry(entry: SubscriptionEntry, spec: WindowVisibilitySubscriptionSpec): void {
+    if (
+      disposed ||
+      !entry.desired ||
+      entry.pending ||
+      entry.retryTimer !== null ||
+      entry.startTimer !== null ||
+      entry.unsubscribe
+    ) {
+      return
+    }
+    const generation = entry.generation
+    const isCurrent = (): boolean => !disposed && entry.desired && entry.generation === generation
+    let subscription: Promise<{ unsubscribe: () => void }>
+    try {
+      subscription = spec.subscribe(isCurrent, {
+        visibilityGeneration: entry.visibilityGeneration
+      })
+    } catch (error) {
+      if (isCurrent()) {
+        spec.onSubscribeError?.(error)
+        scheduleRetry(entry, spec)
+      }
+      return
+    }
+    const pending = Promise.resolve(subscription).then(
+      (handle) => {
+        if (entry.pending !== pending) {
+          try {
+            handle.unsubscribe()
+          } catch (error) {
+            spec.onUnsubscribeError?.(error)
+          }
+          return
+        }
+        entry.pending = null
+        if (isCurrent()) {
+          entry.retryAttempt = 0
+          entry.unsubscribe = handle.unsubscribe
+          return
+        }
+        try {
+          handle.unsubscribe()
+        } catch (error) {
+          spec.onUnsubscribeError?.(error)
+        }
+        if (!disposed && entry.desired) {
+          startEntry(entry, spec)
+        }
+      },
+      (error) => {
+        if (entry.pending !== pending) {
+          return
+        }
+        entry.pending = null
+        if (isCurrent()) {
+          spec.onSubscribeError?.(error)
+          scheduleRetry(entry, spec)
+          return
+        }
+        if (!disposed && entry.desired) {
+          startEntry(entry, spec)
+        }
+      }
+    )
+    entry.pending = pending
+  }
+
+  const startAll = (isVisibilityResume: boolean): void => {
+    const restartingSpecIndexes = entries.flatMap((entry, index) => (entry.desired ? [] : [index]))
+    if (isVisibilityResume && restartingSpecIndexes.length > 0) {
+      options.onVisibilityResume?.({ visibilityGeneration, restartingSpecIndexes })
+    }
+    for (const index of restartingSpecIndexes) {
+      const entry = entries[index]
+      entry.visibilityGeneration = visibilityGeneration
+      entry.desired = true
+    }
+    const startOrder = isVisibilityResume
+      ? [...restartingSpecIndexes].sort((left, right) => {
+          const priority = options.getVisibilityResumePriority
+          return (priority?.(left) ?? 0) - (priority?.(right) ?? 0) || left - right
+        })
+      : restartingSpecIndexes
+    const staggerMs = Math.max(0, options.visibilityResumeStaggerMs ?? 0)
+    if (!isVisibilityResume || staggerMs === 0) {
+      for (const index of startOrder) {
+        startEntry(entries[index], specs[index])
+      }
+      return
+    }
+    const startNext = (position: number): void => {
+      const index = startOrder[position]
+      if (index === undefined) {
+        return
+      }
+      const entry = entries[index]
+      entry.startTimer = null
+      if (disposed || !entry.desired) {
+        return
+      }
+      startEntry(entry, specs[index])
+      const nextIndex = startOrder[position + 1]
+      if (nextIndex === undefined) {
+        return
+      }
+      const nextEntry = entries[nextIndex]
+      nextEntry.startTimer = setTimeout(() => startNext(position + 1), staggerMs)
+    }
+    startNext(0)
+  }
+  const stopAll = (): void => {
+    entries.forEach((entry, index) => {
+      entry.desired = false
+      entry.generation += 1
+      entry.retryAttempt = 0
+      clearStart(entry)
+      clearRetry(entry)
+      unsubscribeEntry(entry, specs[index])
+    })
+  }
+  const cancelPark = (): void => {
+    if (parkTimer !== null) {
+      clearTimeout(parkTimer)
+      parkTimer = null
+    }
+  }
+  const reconcileVisibility = (): void => {
+    if (getWindowParkVisible()) {
+      cancelPark()
+      const hiddenMs = hiddenSinceMs === null ? null : Date.now() - hiddenSinceMs
+      hiddenSinceMs = null
+      if (!effectiveVisible) {
+        effectiveVisible = true
+        if (hiddenMs !== null) {
+          // Why: a park that the user undoes quickly costs more than it saves, so back off until one hide outlasts the ceiling.
+          currentParkDelayMs =
+            hiddenMs >= maxParkDelayMs
+              ? parkDelayMs
+              : Math.min(currentParkDelayMs * 2, maxParkDelayMs)
+        }
+        startAll(visibilityGeneration > 0)
+      }
+      return
+    }
+    if (!effectiveVisible || parkTimer !== null) {
+      return
+    }
+    hiddenSinceMs = Date.now()
+    parkTimer = setTimeout(() => {
+      parkTimer = null
+      if (getWindowParkVisible()) {
+        reconcileVisibility()
+        return
+      }
+      effectiveVisible = false
+      visibilityGeneration += 1
+      stopAll()
+    }, currentParkDelayMs)
+  }
+
+  if (effectiveVisible) {
+    startAll(false)
+  }
+  const unsubscribeVisibility = subscribeWindowParkVisibility(reconcileVisibility)
+
+  return () => {
+    disposed = true
+    cancelPark()
+    unsubscribeVisibility()
+    effectiveVisible = false
+    stopAll()
+  }
+}
diff --git a/src/renderer/src/store/index.ts b/src/renderer/src/store/index.ts
index 5687dfc9776..ebc4691da30 100644
--- a/src/renderer/src/store/index.ts
+++ b/src/renderer/src/store/index.ts
@@ -17,9 +17,11 @@ import { createEditorSlice } from './slices/editor'
 import { createStatsSlice } from './slices/stats'
 import { createMemorySlice } from './slices/memory'
 import { createWorkspaceSpaceSlice } from './slices/workspace-space'
-import { createClaudeUsageSlice } from './slices/claude-usage'
-import { createCodexUsageSlice } from './slices/codex-usage'
-import { createOpenCodeUsageSlice } from './slices/opencode-usage'
+import {
+  createClaudeUsageSlice,
+  createCodexUsageSlice,
+  createOpenCodeUsageSlice
+} from './slices/usage-provider-slices'
 import { createBrowserSlice } from './slices/browser'
 import { createRateLimitSlice } from './slices/rate-limits'
 import { createSshSlice } from './slices/ssh'
@@ -44,7 +46,10 @@ import { createRemoteServerUpdatesSlice } from './slices/remote-server-updates'
 import { createTerminalQuickCommandHostsSlice } from './slices/terminal-quick-command-hosts'
 import { e2eConfig } from '@/lib/e2e-config'
 import type { createWebRuntimeSessionTerminal } from '@/runtime/web-runtime-session'
-import { registerHttpLinkStoreAccessor } from '@/lib/http-link-routing'
+import {
+  registerHttpLinkStoreAccessor,
+  registerRuntimeHttpLinkBrowserOpener
+} from '@/lib/http-link-routing'
 import { installStoreListenerCensus } from './store-listener-census'
 import {
   registerRendererMemoryProfileContributor,
@@ -102,6 +107,10 @@ export const useAppStore = create<AppState>()((...a) => {
 })
 
 registerHttpLinkStoreAccessor(() => useAppStore.getState())
+registerRuntimeHttpLinkBrowserOpener(async (request) => {
+  const { openWorkspaceBrowserTab } = await import('@/lib/workspace-browser-tab-open')
+  await openWorkspaceBrowserTab(request)
+})
 
 // Why: names the fattest store slices in renderer_memory_highwater breadcrumbs
 // so OOM crash reports identify what grew without a local repro.
diff --git a/src/renderer/src/store/plugin-language-packs.test.ts b/src/renderer/src/store/plugin-language-packs.test.ts
new file mode 100644
index 00000000000..53a608d89f4
--- /dev/null
+++ b/src/renderer/src/store/plugin-language-packs.test.ts
@@ -0,0 +1,203 @@
+// @vitest-environment happy-dom
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { i18n, setRendererPluginLanguagePacks } from '../i18n/i18n'
+import { pluginLanguageResourceId } from '../../../shared/plugins/plugin-language-pack-artifact'
+import { usePluginLanguagePackStore } from './plugin-language-packs'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  setRendererPluginLanguagePacks([])
+  usePluginLanguagePackStore.setState({ packs: [], loaded: false })
+  vi.unstubAllGlobals()
+})
+
+describe('plugin language pack loading', () => {
+  it('rejects malformed runtime IPC language-pack results at the renderer ingress', async () => {
+    vi.stubGlobal('window', {
+      api: {
+        plugins: {
+          listLanguagePacks: vi.fn().mockResolvedValue({ malformed: true })
+        }
+      }
+    })
+
+    await usePluginLanguagePackStore.getState().fetchPacks()
+
+    const state = usePluginLanguagePackStore.getState()
+    expect(state.loaded).toBe(true)
+    expect(state.packs).toEqual([])
+    expect(() => state.packs.find(() => true)).not.toThrow()
+  })
+
+  it('filters malformed language-pack array members without changing valid order', async () => {
+    const first = {
+      id: 'plugin:first',
+      resourceLanguage: pluginLanguageResourceId('plugin:first'),
+      pluginKey: 'first',
+      locale: 'pt-BR',
+      catalog: { greeting: 'Olá' }
+    }
+    const second = {
+      id: 'plugin:second',
+      resourceLanguage: pluginLanguageResourceId('plugin:second'),
+      pluginKey: 'second',
+      locale: 'de',
+      catalog: {}
+    }
+    vi.stubGlobal('window', {
+      api: {
+        plugins: {
+          listLanguagePacks: vi
+            .fn()
+            .mockResolvedValue([null, first, { ...first, catalog: [] }, second])
+        }
+      }
+    })
+
+    await usePluginLanguagePackStore.getState().fetchPacks()
+
+    expect(usePluginLanguagePackStore.getState().packs).toEqual([first, second])
+  })
+
+  it.each([
+    ['Date', new Date(0)],
+    ['Map', new Map([['greeting', 'Hello']])]
+  ])('rejects a %s language-pack catalog at renderer ingress', async (_name, catalog) => {
+    const id = 'plugin:malformed' as const
+    vi.stubGlobal('window', {
+      api: {
+        plugins: {
+          listLanguagePacks: vi.fn().mockResolvedValue([
+            {
+              id,
+              resourceLanguage: pluginLanguageResourceId(id),
+              pluginKey: 'malformed',
+              locale: 'en',
+              catalog
+            }
+          ])
+        }
+      }
+    })
+
+    await usePluginLanguagePackStore.getState().fetchPacks()
+
+    expect(usePluginLanguagePackStore.getState().packs).toEqual([])
+  })
+
+  it('rejects a structured-cloned cyclic catalog before i18next resource installation', async () => {
+    const id = 'plugin:cyclic' as const
+    const catalog: Record<string, unknown> = { greeting: 'Hello' }
+    catalog.self = catalog
+    const response = structuredClone([
+      {
+        id,
+        resourceLanguage: pluginLanguageResourceId(id),
+        pluginKey: 'cyclic',
+        locale: 'en',
+        catalog
+      }
+    ])
+    vi.stubGlobal('window', {
+      api: { plugins: { listLanguagePacks: vi.fn().mockResolvedValue(response) } }
+    })
+
+    await usePluginLanguagePackStore.getState().fetchPacks()
+    const packs = usePluginLanguagePackStore.getState().packs
+
+    expect(() => setRendererPluginLanguagePacks(packs)).not.toThrow()
+    expect(packs).toEqual([])
+  })
+
+  it('rejects an inconsistent resource language before i18next owns its cleanup', async () => {
+    vi.stubGlobal('window', {
+      api: {
+        plugins: {
+          listLanguagePacks: vi.fn().mockResolvedValue([
+            {
+              id: 'plugin:bad',
+              resourceLanguage: 'plugin.bad',
+              pluginKey: 'bad',
+              locale: 'en',
+              catalog: {}
+            }
+          ])
+        }
+      }
+    })
+
+    await usePluginLanguagePackStore.getState().fetchPacks()
+    setRendererPluginLanguagePacks(usePluginLanguagePackStore.getState().packs)
+    const removeResourceBundle = vi
+      .spyOn(i18n, 'removeResourceBundle')
+      .mockImplementation((language) => {
+        throw new Error(`invalid resource language: ${language}`)
+      })
+
+    expect(() => setRendererPluginLanguagePacks([])).not.toThrow()
+    expect(removeResourceBundle).not.toHaveBeenCalled()
+  })
+
+  it('rejects a missing resource language before i18next resource installation', async () => {
+    vi.stubGlobal('window', {
+      api: {
+        plugins: {
+          listLanguagePacks: vi.fn().mockResolvedValue([
+            {
+              id: 'plugin:missing-language',
+              resourceLanguage: undefined,
+              pluginKey: 'missing-language',
+              locale: 'en',
+              catalog: {}
+            }
+          ])
+        }
+      }
+    })
+
+    await usePluginLanguagePackStore.getState().fetchPacks()
+    const packs = usePluginLanguagePackStore.getState().packs
+
+    expect(() => setRendererPluginLanguagePacks(packs)).not.toThrow()
+    expect(packs).toEqual([])
+  })
+
+  it('keeps the latest request when an older language-pack response finishes last', async () => {
+    const older = {
+      id: 'plugin:older',
+      resourceLanguage: pluginLanguageResourceId('plugin:older'),
+      pluginKey: 'older',
+      locale: 'de',
+      catalog: {}
+    }
+    const latest = {
+      id: 'plugin:latest',
+      resourceLanguage: pluginLanguageResourceId('plugin:latest'),
+      pluginKey: 'latest',
+      locale: 'fr',
+      catalog: {}
+    }
+    let resolveOlder!: (value: unknown[]) => void
+    const olderResponse = new Promise<unknown[]>((resolve) => {
+      resolveOlder = resolve
+    })
+    vi.stubGlobal('window', {
+      api: {
+        plugins: {
+          listLanguagePacks: vi
+            .fn()
+            .mockReturnValueOnce(olderResponse)
+            .mockResolvedValueOnce([latest])
+        }
+      }
+    })
+
+    const olderFetch = usePluginLanguagePackStore.getState().fetchPacks()
+    await usePluginLanguagePackStore.getState().fetchPacks()
+    resolveOlder([older])
+    await olderFetch
+
+    expect(usePluginLanguagePackStore.getState().packs).toEqual([latest])
+  })
+})
diff --git a/src/renderer/src/store/plugin-language-packs.ts b/src/renderer/src/store/plugin-language-packs.ts
index a237f80f6fc..7c37c53c9c8 100644
--- a/src/renderer/src/store/plugin-language-packs.ts
+++ b/src/renderer/src/store/plugin-language-packs.ts
@@ -1,6 +1,9 @@
 import { useEffect } from 'react'
 import { create } from 'zustand'
-import type { PluginLanguagePackRegistration } from '../../../shared/plugins/plugin-language-pack-artifact'
+import {
+  isPluginLanguagePackRegistration,
+  type PluginLanguagePackRegistration
+} from '../../../shared/plugins/plugin-language-pack-artifact'
 
 type PluginLanguagePackState = {
   packs: PluginLanguagePackRegistration[]
@@ -24,7 +27,16 @@ export const usePluginLanguagePackStore = create<PluginLanguagePackState>()((set
       return
     }
     try {
-      const packs = await api.listLanguagePacks()
+      const response = await api.listLanguagePacks()
+      const packs = Array.isArray(response) ? response.filter(isPluginLanguagePackRegistration) : []
+      // Why: a non-array response and a rejected member are different upstream bugs; keep them distinguishable in the log.
+      if (!Array.isArray(response)) {
+        console.warn(`[plugins] Ignoring non-array language-pack list (${typeof response})`)
+      } else if (packs.length !== response.length) {
+        console.warn(
+          `[plugins] Ignoring ${response.length - packs.length} of ${response.length} malformed language packs`
+        )
+      }
       if (generation === requestGeneration) {
         set({ packs, loaded: true })
       }
diff --git a/src/renderer/src/store/running-terminal-close-confirm.ts b/src/renderer/src/store/running-terminal-close-confirm.ts
index 618d30c98c5..88db03a5d38 100644
--- a/src/renderer/src/store/running-terminal-close-confirm.ts
+++ b/src/renderer/src/store/running-terminal-close-confirm.ts
@@ -83,7 +83,7 @@ export const useRunningTerminalCloseConfirmStore = create<RunningTerminalCloseCo
       const queuedIndex = queuedRequests.findIndex(
         (queued) => queued.terminalTabId === request.terminalTabId
       )
-      if (queuedIndex >= 0) {
+      if (queuedIndex !== -1) {
         queuedRequests[queuedIndex] = mergeRequests(queuedRequests[queuedIndex]!, request)
         return
       }
diff --git a/src/renderer/src/store/slices/agent-status-batch.test.ts b/src/renderer/src/store/slices/agent-status-batch.test.ts
new file mode 100644
index 00000000000..5504f4d463e
--- /dev/null
+++ b/src/renderer/src/store/slices/agent-status-batch.test.ts
@@ -0,0 +1,506 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  AGENT_STATUS_STALE_AFTER_MS,
+  type AgentStatusEntry
+} from '../../../../shared/agent-status-types'
+import type { AppState } from '../types'
+import {
+  MAX_LIVE_AGENT_STATUSES,
+  type AgentStatusBatchUpdate,
+  type RetainedAgentEntry
+} from './agent-status'
+import type { GeneratedTabTitleUpdate } from './terminal-tab-title-batch'
+import { createTestStore, makeTab } from './store-test-helpers'
+
+const BASE_TIME = 2_000_000
+const FIRST_PANE = 'tab-1:11111111-1111-4111-8111-111111111111'
+const SECOND_PANE = 'tab-1:22222222-2222-4222-8222-222222222222'
+const PROVIDER_SESSION = {
+  key: 'session_id' as const,
+  id: 'pi-session-1',
+  transcriptPath: '/tmp/pi-session-1.jsonl'
+}
+
+function flushMicrotasks(): Promise<void> {
+  return new Promise((resolve) => queueMicrotask(resolve))
+}
+
+function seedBatchStore() {
+  const store = createTestStore()
+  const tab = makeTab({ id: 'tab-1', worktreeId: 'wt-1', title: 'pi' })
+  const retainedEntry: AgentStatusEntry = {
+    paneKey: FIRST_PANE,
+    state: 'done',
+    prompt: 'old turn',
+    agentType: 'pi',
+    updatedAt: BASE_TIME - 100,
+    stateStartedAt: BASE_TIME - 200,
+    stateHistory: []
+  }
+  const retained: RetainedAgentEntry = {
+    entry: retainedEntry,
+    worktreeId: 'wt-1',
+    tab,
+    agentType: 'pi',
+    startedAt: BASE_TIME - 200
+  }
+  store.setState({
+    tabsByWorktree: { 'wt-1': [tab] },
+    retainedAgentsByPaneKey: { [FIRST_PANE]: retained },
+    retentionSuppressedPaneKeys: { [FIRST_PANE]: true },
+    refreshGitHubForWorktreeIfStale: vi.fn().mockResolvedValue(undefined)
+  } as Partial<AppState>)
+  return store
+}
+
+function makeUpdates(): AgentStatusBatchUpdate[] {
+  return [
+    {
+      paneKey: FIRST_PANE,
+      payload: { state: 'working', prompt: 'first turn', agentType: 'pi' },
+      terminalTitle: 'Pi',
+      timing: { updatedAt: BASE_TIME, stateStartedAt: BASE_TIME },
+      routing: { tabId: 'tab-1', worktreeId: 'wt-1', terminalHandle: 'pty-1' },
+      metadata: { providerSession: PROVIDER_SESSION }
+    },
+    {
+      paneKey: FIRST_PANE,
+      payload: {
+        state: 'waiting',
+        prompt: 'first turn',
+        agentType: 'pi',
+        toolName: 'AskUserQuestion'
+      },
+      timing: { updatedAt: BASE_TIME + 1, stateStartedAt: BASE_TIME + 1 }
+    },
+    {
+      paneKey: FIRST_PANE,
+      payload: {
+        state: 'done',
+        prompt: 'first turn',
+        agentType: 'pi',
+        lastAssistantMessage: 'Finished.'
+      },
+      timing: { updatedAt: BASE_TIME + 2, stateStartedAt: BASE_TIME + 2 }
+    },
+    {
+      paneKey: FIRST_PANE,
+      payload: { state: 'working', prompt: 'second turn', agentType: 'pi' },
+      timing: { updatedAt: BASE_TIME + 3, stateStartedAt: BASE_TIME + 3 }
+    },
+    {
+      paneKey: FIRST_PANE,
+      payload: { state: 'done', prompt: 'late first turn', agentType: 'pi' },
+      timing: { updatedAt: BASE_TIME + 2, stateStartedAt: BASE_TIME + 2 }
+    },
+    {
+      kind: 'providerSession',
+      paneKey: SECOND_PANE,
+      agent: 'pi',
+      providerSession: PROVIDER_SESSION,
+      timing: { updatedAt: BASE_TIME + 4 },
+      routing: { tabId: 'tab-1', worktreeId: 'wt-1' }
+    },
+    {
+      paneKey: SECOND_PANE,
+      payload: { state: 'working', prompt: 'provider turn', agentType: 'pi' },
+      timing: { updatedAt: BASE_TIME + 5, stateStartedAt: BASE_TIME + 5 },
+      routing: { tabId: 'tab-1', worktreeId: 'wt-1' },
+      metadata: { providerSession: PROVIDER_SESSION }
+    }
+  ]
+}
+
+function selectBatchState(state: AppState) {
+  return {
+    agentStatusByPaneKey: state.agentStatusByPaneKey,
+    retainedAgentsByPaneKey: state.retainedAgentsByPaneKey,
+    sleepingAgentSessionsByPaneKey: state.sleepingAgentSessionsByPaneKey,
+    agentLaunchConfigByPaneKey: state.agentLaunchConfigByPaneKey,
+    migrationUnsupportedByPtyId: state.migrationUnsupportedByPtyId,
+    retentionSuppressedPaneKeys: state.retentionSuppressedPaneKeys,
+    agentStatusEpoch: state.agentStatusEpoch,
+    sortEpoch: state.sortEpoch
+  }
+}
+
+describe('setAgentStatuses', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+    vi.useRealTimers()
+  })
+
+  it('matches sequential updates across repeated panes and provider-session records', async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(BASE_TIME + 10)
+    const sequentialStore = seedBatchStore()
+    const batchStore = seedBatchStore()
+    const sequentialTitleGeneration = vi.fn()
+    const batchTitleGeneration = vi.fn()
+    const batchTitleGenerationBulk = vi.fn((updates: readonly GeneratedTabTitleUpdate[]) => {
+      for (const update of updates) {
+        if (update.options) {
+          batchTitleGeneration(update.paneKey, update.prompt, update.options)
+        } else {
+          batchTitleGeneration(update.paneKey, update.prompt)
+        }
+      }
+    })
+    sequentialStore.setState({
+      setGeneratedTabTitleFromAgentPrompt: sequentialTitleGeneration
+    } as Partial<AppState>)
+    batchStore.setState({
+      setGeneratedTabTitlesFromAgentPrompts: batchTitleGenerationBulk
+    } as Partial<AppState>)
+    const updates = makeUpdates()
+
+    for (const update of updates) {
+      if (update.kind === 'providerSession') {
+        sequentialStore
+          .getState()
+          .recordAgentProviderSession(
+            update.paneKey,
+            update.agent,
+            update.providerSession,
+            update.timing,
+            update.routing,
+            update.metadata
+          )
+      } else {
+        sequentialStore
+          .getState()
+          .setAgentStatus(
+            update.paneKey,
+            update.payload,
+            update.terminalTitle,
+            update.timing,
+            update.routing,
+            update.metadata
+          )
+      }
+    }
+    const outcomes = batchStore.getState().setAgentStatuses(updates)
+
+    expect(outcomes).toEqual([true, true, true, true, false, true, true])
+    expect(selectBatchState(batchStore.getState())).toEqual(
+      selectBatchState(sequentialStore.getState())
+    )
+    expect(
+      batchStore.getState().agentStatusByPaneKey[FIRST_PANE].stateHistory.at(-1)
+    ).toMatchObject({ state: 'done' })
+    // The swallowed `done`'s output survives on the entry, not on the history row.
+    expect(
+      batchStore.getState().agentStatusByPaneKey[FIRST_PANE].lastCompletedAssistantMessage
+    ).toBe('Finished.')
+    expect(batchTitleGeneration.mock.calls).toEqual(sequentialTitleGeneration.mock.calls)
+    expect(batchTitleGeneration).toHaveBeenCalledTimes(5)
+    expect(batchTitleGenerationBulk).toHaveBeenCalledOnce()
+    await flushMicrotasks()
+    expect(batchStore.getState().refreshGitHubForWorktreeIfStale).toHaveBeenCalledTimes(1)
+    expect(sequentialStore.getState().refreshGitHubForWorktreeIfStale).toHaveBeenCalledTimes(1)
+
+    vi.advanceTimersByTime(AGENT_STATUS_STALE_AFTER_MS + 1)
+    expect(selectBatchState(batchStore.getState())).toEqual(
+      selectBatchState(sequentialStore.getState())
+    )
+  })
+
+  it('publishes once and reports skipped ordered updates', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(BASE_TIME + 10)
+    const store = seedBatchStore()
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    const outcomes = store.getState().setAgentStatuses(makeUpdates())
+
+    expect(outcomes).toEqual([true, true, true, true, false, true, true])
+    expect(publications).toBe(1)
+    expect(store.getState().setAgentStatuses([])).toEqual([])
+    expect(publications).toBe(1)
+    unsubscribe()
+  })
+
+  it('coalesces 100 generated tab titles into one post-status publication', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(BASE_TIME + 10)
+    const store = createTestStore()
+    const paneCount = 100
+    const tabsByWorktree = Object.fromEntries(
+      Array.from({ length: paneCount }, (_, index) => {
+        const worktreeId = `wt-${index}`
+        return [worktreeId, [makeTab({ id: `tab-${index}`, worktreeId })]]
+      })
+    )
+    store.setState({
+      settings: { ...store.getState().settings, tabAutoGenerateTitle: true },
+      tabsByWorktree
+    } as Partial<AppState>)
+    const updates: AgentStatusBatchUpdate[] = Array.from({ length: paneCount }, (_, index) => ({
+      paneKey: `tab-${index}:11111111-1111-4111-8111-111111111111`,
+      payload: {
+        state: 'working',
+        prompt: `Refactor remote startup module ${index}`,
+        agentType: 'pi'
+      },
+      timing: { updatedAt: BASE_TIME + index, stateStartedAt: BASE_TIME + index },
+      routing: { tabId: `tab-${index}`, worktreeId: `wt-${index}` }
+    }))
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    const outcomes = store.getState().setAgentStatuses(updates)
+
+    unsubscribe()
+    expect(outcomes).toEqual(Array(paneCount).fill(true))
+    expect(publications).toBe(2)
+    expect(store.getState().tabsByWorktree['wt-99']?.[0]?.generatedTitle).toBe(
+      'Refactor remote startup module 99'
+    )
+  })
+
+  it('coalesces batch freshness requests while preserving standalone scheduling', async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(BASE_TIME + 10)
+    const store = seedBatchStore()
+    const queueMicrotaskSpy = vi.spyOn(globalThis, 'queueMicrotask')
+    const workingUpdate = (updatedAt: number, prompt: string): AgentStatusBatchUpdate => ({
+      paneKey: FIRST_PANE,
+      payload: { state: 'working', prompt, agentType: 'pi' },
+      timing: { updatedAt, stateStartedAt: updatedAt },
+      routing: { tabId: 'tab-1', worktreeId: 'wt-1' }
+    })
+
+    const outcomes = store
+      .getState()
+      .setAgentStatuses([
+        workingUpdate(BASE_TIME, 'first'),
+        workingUpdate(BASE_TIME + 1, 'second'),
+        workingUpdate(BASE_TIME + 2, 'third'),
+        workingUpdate(BASE_TIME + 1, 'stale')
+      ])
+
+    expect(outcomes).toEqual([true, true, true, false])
+    expect(queueMicrotaskSpy).toHaveBeenCalledTimes(1)
+
+    queueMicrotaskSpy.mockClear()
+    store
+      .getState()
+      .setAgentStatus(
+        FIRST_PANE,
+        { state: 'working', prompt: 'standalone', agentType: 'pi' },
+        undefined,
+        { updatedAt: BASE_TIME + 3, stateStartedAt: BASE_TIME + 3 },
+        { tabId: 'tab-1', worktreeId: 'wt-1' }
+      )
+    store
+      .getState()
+      .setAgentStatus(
+        FIRST_PANE,
+        { state: 'working', prompt: 'standalone stale', agentType: 'pi' },
+        undefined,
+        { updatedAt: BASE_TIME + 2, stateStartedAt: BASE_TIME + 2 },
+        { tabId: 'tab-1', worktreeId: 'wt-1' }
+      )
+
+    expect(queueMicrotaskSpy).toHaveBeenCalledTimes(2)
+    await flushMicrotasks()
+  })
+
+  it('shares freshness across nested folds but isolates synchronous reentrant transactions', async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(BASE_TIME + 10)
+    const store = seedBatchStore()
+    const queueMicrotaskSpy = vi.spyOn(globalThis, 'queueMicrotask')
+    const update = (paneKey: string, updatedAt: number): AgentStatusBatchUpdate => ({
+      paneKey,
+      payload: { state: 'working', prompt: paneKey, agentType: 'pi' },
+      timing: { updatedAt, stateStartedAt: updatedAt },
+      routing: { tabId: 'tab-1', worktreeId: 'wt-1' }
+    })
+    let publications = 0
+    const unsubscribeNested = store.subscribe(() => {
+      publications += 1
+    })
+
+    const nestedOutcomes = store
+      .getState()
+      .transactAgentStatuses((transaction) => [
+        transaction.apply(update(FIRST_PANE, BASE_TIME)),
+        store
+          .getState()
+          .transactAgentStatuses((nestedTransaction) =>
+            nestedTransaction.apply(update(SECOND_PANE, BASE_TIME + 1))
+          )
+      ])
+
+    expect(nestedOutcomes).toEqual([true, true])
+    expect(publications).toBe(1)
+    expect(queueMicrotaskSpy).toHaveBeenCalledTimes(1)
+    unsubscribeNested()
+
+    queueMicrotaskSpy.mockClear()
+    let reentered = false
+    const unsubscribeReentrant = store.subscribe(() => {
+      publications += 1
+      if (!reentered) {
+        reentered = true
+        store.getState().setAgentStatuses([update(SECOND_PANE, BASE_TIME + 3)])
+      }
+    })
+
+    store.getState().setAgentStatuses([update(FIRST_PANE, BASE_TIME + 2)])
+
+    expect(publications).toBe(3)
+    expect(queueMicrotaskSpy).toHaveBeenCalledTimes(2)
+    expect(store.getState().agentStatusByPaneKey[FIRST_PANE]?.updatedAt).toBe(BASE_TIME + 2)
+    expect(store.getState().agentStatusByPaneKey[SECOND_PANE]?.updatedAt).toBe(BASE_TIME + 3)
+    unsubscribeReentrant()
+    await flushMicrotasks()
+  })
+
+  it('exposes cap evictions to later updates in the same transaction', () => {
+    const store = seedBatchStore()
+    const firstPane = 'orphan-tab:orphan-0'
+    const entries = Object.fromEntries(
+      Array.from({ length: MAX_LIVE_AGENT_STATUSES }, (_, index) => {
+        const paneKey = `orphan-tab:orphan-${index}`
+        return [
+          paneKey,
+          {
+            paneKey,
+            state: 'working',
+            prompt: 'old turn',
+            agentType: 'pi',
+            updatedAt: BASE_TIME,
+            stateStartedAt: BASE_TIME,
+            stateHistory: []
+          } satisfies AgentStatusEntry
+        ]
+      })
+    )
+    store.setState({ agentStatusByPaneKey: entries } as Partial<AppState>)
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    const outcomes = store.getState().transactAgentStatuses((transaction) => {
+      const added = transaction.apply({
+        paneKey: 'orphan-tab:new-pane',
+        payload: { state: 'working', prompt: 'new turn', agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME + 1, stateStartedAt: BASE_TIME + 1 }
+      })
+      expect(transaction.getState().agentStatusByPaneKey[firstPane]).toBeUndefined()
+      const completed = transaction.apply({
+        paneKey: firstPane,
+        payload: { state: 'done', prompt: 'different agent', agentType: 'claude' },
+        timing: { updatedAt: BASE_TIME + 2, stateStartedAt: BASE_TIME + 2 }
+      })
+      return [added, completed]
+    })
+
+    expect(outcomes).toEqual([true, true])
+    expect(store.getState().agentStatusByPaneKey[firstPane]).toMatchObject({
+      agentType: 'claude',
+      state: 'done'
+    })
+    expect(publications).toBe(1)
+    unsubscribe()
+  })
+
+  it('preserves a store write that bypassed the transaction instead of reverting it', () => {
+    const store = seedBatchStore()
+
+    const outcome = store.getState().transactAgentStatuses((transaction) => {
+      const applied = transaction.apply({
+        paneKey: FIRST_PANE,
+        payload: { state: 'working', prompt: 'first turn', agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME, stateStartedAt: BASE_TIME }
+      })
+      // Any slice action reached through get() writes straight to the real store — a
+      // REPLACE commit of the fold's snapshot would silently revert it.
+      store.setState({ worktreesByRepo: { 'repo-late': [] } } as Partial<AppState>)
+      return applied
+    })
+
+    expect(outcome).toBe(true)
+    expect(store.getState().worktreesByRepo).toEqual({ 'repo-late': [] })
+    expect(store.getState().agentStatusByPaneKey[FIRST_PANE]).toMatchObject({ state: 'working' })
+  })
+
+  it('keeps one completed-turn message per entry instead of one per history row', () => {
+    const store = seedBatchStore()
+    const turns: AgentStatusBatchUpdate[] = []
+    for (let turn = 0; turn < 5; turn += 1) {
+      turns.push({
+        paneKey: FIRST_PANE,
+        payload: { state: 'working', prompt: `turn ${turn}`, agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME + turn * 2, stateStartedAt: BASE_TIME + turn * 2 }
+      })
+      turns.push({
+        paneKey: FIRST_PANE,
+        payload: {
+          state: 'done',
+          prompt: `turn ${turn}`,
+          agentType: 'pi',
+          lastAssistantMessage: `output ${turn}`
+        },
+        timing: { updatedAt: BASE_TIME + turn * 2 + 1, stateStartedAt: BASE_TIME + turn * 2 + 1 }
+      })
+    }
+    store.getState().setAgentStatuses(turns)
+
+    const entry = store.getState().agentStatusByPaneKey[FIRST_PANE]
+    expect(entry.stateHistory.length).toBeGreaterThan(1)
+    expect(entry.stateHistory.some((row) => 'lastAssistantMessage' in row)).toBe(false)
+    // Only the newest done that rolled into history is retained, so memory is O(1) per pane.
+    expect(entry.lastCompletedAssistantMessage).toBe('output 3')
+    expect(entry.lastAssistantMessage).toBe('output 4')
+  })
+
+  it('clears the completed-turn message when a done carried no assistant output', () => {
+    const store = seedBatchStore()
+    store.getState().setAgentStatuses([
+      {
+        paneKey: FIRST_PANE,
+        payload: { state: 'working', prompt: 'first turn', agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME, stateStartedAt: BASE_TIME }
+      },
+      {
+        paneKey: FIRST_PANE,
+        payload: {
+          state: 'done',
+          prompt: 'first turn',
+          agentType: 'pi',
+          lastAssistantMessage: 'Finished.'
+        },
+        timing: { updatedAt: BASE_TIME + 1, stateStartedAt: BASE_TIME + 1 }
+      },
+      {
+        paneKey: FIRST_PANE,
+        payload: { state: 'working', prompt: 'second turn', agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME + 2, stateStartedAt: BASE_TIME + 2 }
+      },
+      {
+        paneKey: FIRST_PANE,
+        payload: { state: 'done', prompt: 'second turn', agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME + 3, stateStartedAt: BASE_TIME + 3 }
+      },
+      {
+        paneKey: FIRST_PANE,
+        payload: { state: 'working', prompt: 'third turn', agentType: 'pi' },
+        timing: { updatedAt: BASE_TIME + 4, stateStartedAt: BASE_TIME + 4 }
+      }
+    ])
+
+    // The second turn finished silently; leaking turn one's output would misreport the run.
+    expect(
+      store.getState().agentStatusByPaneKey[FIRST_PANE].lastCompletedAssistantMessage
+    ).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/store/slices/agent-status-freshness-scheduler.test.ts b/src/renderer/src/store/slices/agent-status-freshness-scheduler.test.ts
new file mode 100644
index 00000000000..93d49d79404
--- /dev/null
+++ b/src/renderer/src/store/slices/agent-status-freshness-scheduler.test.ts
@@ -0,0 +1,139 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  AGENT_STATUS_STALE_AFTER_MS,
+  type AgentStatusEntry
+} from '../../../../shared/agent-status-types'
+import { createFreshnessScheduler } from './agent-status-freshness-scheduler'
+
+const NOW = new Date('2026-04-09T12:00:00.000Z').getTime()
+
+function doneEntry(overrides: Partial<AgentStatusEntry> = {}): AgentStatusEntry {
+  return {
+    paneKey: 'tab-1:11111111-1111-4111-8111-111111111111',
+    state: 'done',
+    prompt: '',
+    updatedAt: NOW,
+    stateStartedAt: NOW,
+    stateHistory: [],
+    agentType: 'claude',
+    ...overrides
+  }
+}
+
+function setup(entries: AgentStatusEntry[]) {
+  const bumpEpochs = vi.fn()
+  const scheduler = createFreshnessScheduler({ getEntries: () => entries, bumpEpochs })
+  return { bumpEpochs, scheduler }
+}
+
+describe('freshness scheduler completion deadlines', () => {
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('wakes at the completion deadline even while the hook row stays fresh', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+    // Completion is 25m old; same-state `done` writes have kept updatedAt at now.
+    const completedAt = NOW - 25 * 60_000
+    const { bumpEpochs, scheduler } = setup([
+      doneEntry({ stateStartedAt: completedAt, updatedAt: NOW })
+    ])
+
+    scheduler.schedule()
+    vi.advanceTimersByTime(completedAt + AGENT_STATUS_STALE_AFTER_MS - NOW)
+    expect(bumpEpochs).not.toHaveBeenCalled()
+
+    vi.advanceTimersByTime(1)
+    expect(bumpEpochs).toHaveBeenCalledTimes(1)
+
+    scheduler.dispose()
+  })
+
+  it('keeps the strict-expiry wake armed when rescheduled exactly at the boundary', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+    const { bumpEpochs, scheduler } = setup([
+      doneEntry({
+        stateStartedAt: NOW - AGENT_STATUS_STALE_AFTER_MS,
+        updatedAt: NOW
+      })
+    ])
+
+    scheduler.schedule()
+    vi.advanceTimersByTime(1)
+    expect(bumpEpochs).toHaveBeenCalledTimes(1)
+
+    scheduler.dispose()
+  })
+
+  it('does not lose a completion deadline when an overdue timer is rescheduled after sleep', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+    const completedAt = NOW - 25 * 60_000
+    const entries = [doneEntry({ stateStartedAt: completedAt, updatedAt: NOW })]
+    const { bumpEpochs, scheduler } = setup(entries)
+
+    scheduler.schedule()
+    vi.setSystemTime(completedAt + AGENT_STATUS_STALE_AFTER_MS + 1)
+    entries[0] = doneEntry({ stateStartedAt: completedAt, updatedAt: Date.now() })
+    scheduler.schedule()
+
+    expect(bumpEpochs).toHaveBeenCalledTimes(1)
+    scheduler.schedule()
+    expect(bumpEpochs).toHaveBeenCalledTimes(1)
+    scheduler.dispose()
+  })
+
+  it('does not rearm an expired completion deadline in a zero-delay loop', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+    const completedAt = NOW - 25 * 60_000
+    const { bumpEpochs, scheduler } = setup([
+      doneEntry({ stateStartedAt: completedAt, updatedAt: NOW })
+    ])
+
+    scheduler.schedule()
+    // Past both the completion deadline and the hook-freshness deadline.
+    vi.advanceTimersByTime(AGENT_STATUS_STALE_AFTER_MS + 60_000)
+
+    // One bump for the completion boundary, one for hook freshness — never a spin.
+    expect(bumpEpochs).toHaveBeenCalledTimes(2)
+    expect(vi.getTimerCount()).toBe(0)
+
+    scheduler.dispose()
+  })
+
+  it('ignores completions that cannot demand attention', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+    const completedAt = NOW - 25 * 60_000
+    const { bumpEpochs, scheduler } = setup([
+      doneEntry({ stateStartedAt: completedAt, updatedAt: NOW, interrupted: true })
+    ])
+
+    scheduler.schedule()
+    vi.advanceTimersByTime(completedAt + AGENT_STATUS_STALE_AFTER_MS - NOW + 1)
+    expect(bumpEpochs).not.toHaveBeenCalled()
+
+    // Only the hook-freshness deadline remains.
+    vi.advanceTimersByTime(AGENT_STATUS_STALE_AFTER_MS)
+    expect(bumpEpochs).toHaveBeenCalledTimes(1)
+
+    scheduler.dispose()
+  })
+
+  it('still arms hook freshness for a working entry', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+    const { bumpEpochs, scheduler } = setup([
+      doneEntry({ state: 'working', stateStartedAt: NOW, updatedAt: NOW })
+    ])
+
+    scheduler.schedule()
+    vi.advanceTimersByTime(AGENT_STATUS_STALE_AFTER_MS + 1)
+    expect(bumpEpochs).toHaveBeenCalledTimes(1)
+
+    scheduler.dispose()
+  })
+})
diff --git a/src/renderer/src/store/slices/agent-status-freshness-scheduler.ts b/src/renderer/src/store/slices/agent-status-freshness-scheduler.ts
index 628529dd007..93c3e54fee1 100644
--- a/src/renderer/src/store/slices/agent-status-freshness-scheduler.ts
+++ b/src/renderer/src/store/slices/agent-status-freshness-scheduler.ts
@@ -1,3 +1,4 @@
+import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
 import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
 import { AGENT_STATUS_STALE_AFTER_MS } from '../../../../shared/agent-status-types'
 
@@ -21,6 +22,7 @@ export function createFreshnessScheduler(deps: FreshnessSchedulerDeps): Freshnes
   // `dispose()` in teardown — otherwise a real 30-minute setTimeout leaks
   // into the test process.
   let timer: ReturnType<typeof setTimeout> | null = null
+  let lastCheckedAt: number | null = null
 
   const clear = (): void => {
     if (timer !== null) {
@@ -33,10 +35,12 @@ export function createFreshnessScheduler(deps: FreshnessSchedulerDeps): Freshnes
     clear()
     const entries = deps.getEntries()
     if (entries.length === 0) {
+      lastCheckedAt = null
       return
     }
     const now = Date.now()
     let nextExpiryAt = Number.POSITIVE_INFINITY
+    let crossedCompletionDeadline = false
     // Why: skip entries already past the stale boundary — they each contribute
     // exactly one epoch bump at crossing, and rescheduling on them would spin
     // the timer forever because the bump doesn't clear them from the map
@@ -47,9 +51,29 @@ export function createFreshnessScheduler(deps: FreshnessSchedulerDeps): Freshnes
     // freshness-aware selectors can decay them immediately on that render.
     for (const entry of entries) {
       const expiryAt = entry.updatedAt + AGENT_STATUS_STALE_AFTER_MS
-      if (expiryAt > now) {
+      if (expiryAt >= now) {
         nextExpiryAt = Math.min(nextExpiryAt, expiryAt)
       }
+      // Completion and hook freshness have independent expiry times.
+      const completedAt = agentEntryCompletionAt(entry)
+      if (completedAt !== null) {
+        const completionExpiryAt = completedAt + AGENT_STATUS_STALE_AFTER_MS
+        // Detect a missed completion expiry before a same-state update extends hook freshness.
+        if (
+          lastCheckedAt !== null &&
+          completionExpiryAt >= lastCheckedAt &&
+          completionExpiryAt < now
+        ) {
+          crossedCompletionDeadline = true
+        }
+        if (completionExpiryAt >= now) {
+          nextExpiryAt = Math.min(nextExpiryAt, completionExpiryAt)
+        }
+      }
+    }
+    lastCheckedAt = now
+    if (crossedCompletionDeadline) {
+      deps.bumpEpochs()
     }
     if (!Number.isFinite(nextExpiryAt)) {
       return
@@ -62,6 +86,7 @@ export function createFreshnessScheduler(deps: FreshnessSchedulerDeps): Freshnes
     timer = setTimeout(() => {
       timer = null
       deps.bumpEpochs()
+      lastCheckedAt = Date.now()
       schedule()
     }, delayMs)
   }
diff --git a/src/renderer/src/store/slices/agent-status.test.ts b/src/renderer/src/store/slices/agent-status.test.ts
index 6965ca8bbb2..d937c3af53b 100644
--- a/src/renderer/src/store/slices/agent-status.test.ts
+++ b/src/renderer/src/store/slices/agent-status.test.ts
@@ -805,6 +805,29 @@ describe('agent status tool + assistant fields', () => {
     expect(store.getState().sortEpoch).toBe(firstSortEpoch)
   })
 
+  it('bumps sort epoch when a same-state done update changes completion eligibility', () => {
+    vi.useFakeTimers()
+    const store = createTestStore()
+    store
+      .getState()
+      .setAgentStatus(
+        'tab-1:1',
+        { state: 'done', prompt: 'p1', agentType: 'claude', interrupted: true },
+        'claude',
+        { updatedAt: 1_000, stateStartedAt: 1_000 }
+      )
+    const firstSortEpoch = store.getState().sortEpoch
+
+    store
+      .getState()
+      .setAgentStatus('tab-1:1', { state: 'done', prompt: 'p1', agentType: 'claude' }, 'claude', {
+        updatedAt: 2_000,
+        stateStartedAt: 1_000
+      })
+
+    expect(store.getState().sortEpoch).toBe(firstSortEpoch + 1)
+  })
+
   it('bumps global epochs when a stale same-state entry refreshes', () => {
     vi.useFakeTimers()
     const store = createTestStore()
diff --git a/src/renderer/src/store/slices/agent-status.ts b/src/renderer/src/store/slices/agent-status.ts
index 271ab70829a..0f1ebf66e08 100644
--- a/src/renderer/src/store/slices/agent-status.ts
+++ b/src/renderer/src/store/slices/agent-status.ts
@@ -26,6 +26,7 @@ import {
   shouldSuppressInheritedTerminalStatus
 } from '../../../../shared/agent-status-identity'
 import { isCommandCodeNewTurnWhileWorking } from '../../../../shared/command-code-turn-boundary'
+import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
 import type { TerminalPaneLayoutNode, TerminalTab } from '../../../../shared/types'
 import {
   getRepoExecutionHostId,
@@ -46,6 +47,7 @@ import {
   transferAgentPaneAuthorityAlias
 } from './agent-pane-authority'
 import { createFreshnessScheduler } from './agent-status-freshness-scheduler'
+import type { GeneratedTabTitleUpdate } from './terminal-tab-title-batch'
 
 /** Snapshot of a finished/vanished agent status entry, kept so the dashboard and sidebar hover
  *  keep showing the completion until the user clicks the worktree. `worktreeId` is stamped at
@@ -106,6 +108,65 @@ type AgentLaunchConfigRegistryEntry = {
   identity: AgentLaunchConfigRegistrationMetadata
 }
 
+export type AgentStatusPayload = ParsedAgentStatusPayload & {
+  orchestration?: AgentStatusOrchestrationContext
+  promptInteractionKey?: string
+  restoredUnconfirmed?: boolean
+}
+
+export type AgentStatusTiming = { updatedAt?: number; stateStartedAt?: number }
+
+export type AgentStatusRouting = {
+  tabId?: string
+  worktreeId?: string
+  terminalHandle?: string
+  connectionId?: string | null
+}
+
+export type AgentStatusMetadata = {
+  providerSession?: AgentProviderSessionMetadata
+  launchConfig?: SleepingAgentLaunchConfig
+  launchToken?: string
+}
+
+export type AgentStatusUpdate = {
+  kind?: 'status'
+  paneKey: string
+  payload: AgentStatusPayload
+  terminalTitle?: string
+  timing?: AgentStatusTiming
+  routing?: AgentStatusRouting
+  metadata?: AgentStatusMetadata
+}
+
+export type AgentProviderSessionTiming = { updatedAt?: number }
+
+export type AgentProviderSessionRouting = {
+  tabId?: string
+  worktreeId?: string
+  connectionId?: string | null
+}
+
+export type AgentProviderSessionRecordMetadata = { launchToken?: string }
+
+export type AgentProviderSessionUpdate = {
+  kind: 'providerSession'
+  paneKey: string
+  agent: ResumableTuiAgent
+  providerSession: AgentProviderSessionMetadata
+  timing?: AgentProviderSessionTiming
+  routing?: AgentProviderSessionRouting
+  metadata?: AgentProviderSessionRecordMetadata
+}
+
+export type AgentStatusBatchUpdate = AgentStatusUpdate | AgentProviderSessionUpdate
+
+export type AgentStatusBatchTransaction = {
+  getState: () => AppState
+  apply: (update: AgentStatusBatchUpdate) => boolean
+  afterCommit: (effect: () => void) => void
+}
+
 export type AgentStatusSlice = {
   /** Explicit agent status entries keyed by `${tabId}:${leafId}`; real-time only, not persisted. */
   agentStatusByPaneKey: Record<string, AgentStatusEntry>
@@ -152,34 +213,30 @@ export type AgentStatusSlice = {
   /** Update or insert an agent status entry from a status payload. */
   setAgentStatus: (
     paneKey: string,
-    payload: ParsedAgentStatusPayload & {
-      orchestration?: AgentStatusOrchestrationContext
-      promptInteractionKey?: string
-      restoredUnconfirmed?: boolean
-    },
+    payload: AgentStatusPayload,
     terminalTitle?: string,
-    timing?: { updatedAt?: number; stateStartedAt?: number },
-    routing?: {
-      tabId?: string
-      worktreeId?: string
-      terminalHandle?: string
-      connectionId?: string | null
-    },
-    metadata?: {
-      providerSession?: AgentProviderSessionMetadata
-      launchConfig?: SleepingAgentLaunchConfig
-      launchToken?: string
-    }
+    timing?: AgentStatusTiming,
+    routing?: AgentStatusRouting,
+    metadata?: AgentStatusMetadata
   ) => void
 
+  /** Apply ordered status updates as one status publication (generated titles and tab
+   *  titles still publish after it — three total, not 2N). */
+  setAgentStatuses: (updates: readonly AgentStatusBatchUpdate[]) => boolean[]
+
+  /** Fold caller-derived updates against exact staged state, committing one status publication. */
+  transactAgentStatuses: <Result>(
+    operation: (transaction: AgentStatusBatchTransaction) => Result
+  ) => Result
+
   /** Record resume identity without creating a visible turn-status row. */
   recordAgentProviderSession: (
     paneKey: string,
     agent: ResumableTuiAgent,
     providerSession: AgentProviderSessionMetadata,
-    timing?: { updatedAt?: number },
-    routing?: { tabId?: string; worktreeId?: string; connectionId?: string | null },
-    metadata?: { launchToken?: string }
+    timing?: AgentProviderSessionTiming,
+    routing?: AgentProviderSessionRouting,
+    metadata?: AgentProviderSessionRecordMetadata
   ) => void
 
   registerAgentLaunchConfig: (
@@ -1211,10 +1268,143 @@ function collectWorktreeIdsForConnection(state: AppState, connectionId: string):
   return onConnection
 }
 
+/** Slices that only the fold touched, so the batch commits as a MERGE.
+ *  Why: the fold runs against a snapshot taken at transaction start. Committing that
+ *  snapshot wholesale (zustand REPLACE) would silently revert any write that landed on
+ *  the real store meanwhile — and it can, because a batched action reaching another
+ *  slice's setter through `get()` bypasses the shadowed `set` entirely
+ *  (setRuntimeAgentOrchestrationByPaneKey → setGeneratedTabTitleFromAgentPrompt does this).
+ *  A merge keeps the single publication while confining conflicts to keys this fold wrote. */
+function buildAgentStatusBatchPatch(
+  initialState: AppState,
+  nextState: AppState
+): Partial<AppState> {
+  const patch: Record<string, unknown> = {}
+  for (const key of Object.keys(nextState) as (keyof AppState)[]) {
+    if (!Object.is(nextState[key], initialState[key])) {
+      patch[key as string] = nextState[key]
+    }
+  }
+  return patch as Partial<AppState>
+}
+
 export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusSlice> = (
-  set,
-  get
+  storeSet,
+  storeGet
 ) => {
+  type AgentStatusStateUpdate =
+    | AppState
+    | Partial<AppState>
+    | ((state: AppState) => AppState | Partial<AppState>)
+
+  let batchedAgentStatusState: AppState | null = null
+  let batchedAgentStatusEffects: (() => void)[] | null = null
+  let batchedGeneratedTabTitleUpdates: GeneratedTabTitleUpdate[] | null = null
+  let batchedAgentStatusFreshnessRequested = false
+  const get = (): AppState => batchedAgentStatusState ?? storeGet()
+  // Deliberately narrower than zustand's `set`: no `replace` parameter, so no call site in
+  // this slice can compile into a REPLACE the batch commit is unable to express.
+  const set = (update: AgentStatusStateUpdate): void => {
+    if (batchedAgentStatusState === null) {
+      storeSet(update, false)
+      return
+    }
+    const nextState = typeof update === 'function' ? update(batchedAgentStatusState) : update
+    if (Object.is(nextState, batchedAgentStatusState)) {
+      return
+    }
+    batchedAgentStatusState = Object.assign({}, batchedAgentStatusState, nextState)
+  }
+  const runAfterAgentStatusCommit = (effect: () => void): void => {
+    if (batchedAgentStatusEffects) {
+      batchedAgentStatusEffects.push(effect)
+      return
+    }
+    effect()
+  }
+  const applyGeneratedTabTitleUpdate = (update: GeneratedTabTitleUpdate): void => {
+    if (batchedGeneratedTabTitleUpdates) {
+      batchedGeneratedTabTitleUpdates.push(update)
+      return
+    }
+    if (update.options) {
+      get().setGeneratedTabTitleFromAgentPrompt(update.paneKey, update.prompt, update.options)
+    } else {
+      get().setGeneratedTabTitleFromAgentPrompt(update.paneKey, update.prompt)
+    }
+  }
+  const applyBatchedAgentStatusUpdate = (update: AgentStatusBatchUpdate): boolean => {
+    const stateBeforeUpdate = batchedAgentStatusState
+    if (!stateBeforeUpdate) {
+      return false
+    }
+    if (update.kind === 'providerSession') {
+      get().recordAgentProviderSession(
+        update.paneKey,
+        update.agent,
+        update.providerSession,
+        update.timing,
+        update.routing,
+        update.metadata
+      )
+    } else {
+      get().setAgentStatus(
+        update.paneKey,
+        update.payload,
+        update.terminalTitle,
+        update.timing,
+        update.routing,
+        update.metadata
+      )
+    }
+    return batchedAgentStatusState !== stateBeforeUpdate
+  }
+  const batchTransaction: AgentStatusBatchTransaction = {
+    getState: get,
+    apply: applyBatchedAgentStatusUpdate,
+    afterCommit: runAfterAgentStatusCommit
+  }
+  const transactAgentStatuses = <Result>(
+    operation: (transaction: AgentStatusBatchTransaction) => Result
+  ): Result => {
+    if (batchedAgentStatusState) {
+      return operation(batchTransaction)
+    }
+    const initialState = storeGet()
+    batchedAgentStatusState = initialState
+    batchedAgentStatusEffects = []
+    batchedGeneratedTabTitleUpdates = []
+    try {
+      const result = operation(batchTransaction)
+      const nextState = batchedAgentStatusState
+      const effects = batchedAgentStatusEffects
+      const generatedTabTitleUpdates = batchedGeneratedTabTitleUpdates
+      const freshnessRequested = batchedAgentStatusFreshnessRequested
+      batchedAgentStatusState = null
+      batchedAgentStatusEffects = null
+      batchedGeneratedTabTitleUpdates = null
+      batchedAgentStatusFreshnessRequested = false
+      if (nextState !== initialState) {
+        storeSet(buildAgentStatusBatchPatch(initialState, nextState), false)
+      }
+      if (generatedTabTitleUpdates.length > 0) {
+        storeGet().setGeneratedTabTitlesFromAgentPrompts(generatedTabTitleUpdates)
+      }
+      if (freshnessRequested) {
+        queueMicrotask(() => freshness.schedule())
+      }
+      for (const effect of effects) {
+        effect()
+      }
+      return result
+    } finally {
+      batchedAgentStatusState = null
+      batchedAgentStatusEffects = null
+      batchedGeneratedTabTitleUpdates = null
+      batchedAgentStatusFreshnessRequested = false
+    }
+  }
+
   // Why: scheduler is process-lifetime-scoped (no dispose) because the store is a
   // module-level singleton with no teardown lifecycle anywhere in the codebase.
   const freshness = createFreshnessScheduler({
@@ -1228,6 +1418,13 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
       }))
     }
   })
+  const requestAgentStatusFreshness = (acceptedInBatch: boolean): void => {
+    if (batchedAgentStatusState !== null) {
+      batchedAgentStatusFreshnessRequested ||= acceptedInBatch
+      return
+    }
+    queueMicrotask(() => freshness.schedule())
+  }
 
   const clearSleepingAgentSessionsByPaneKey = (paneKeys: readonly string[]): void => {
     if (paneKeys.length === 0) {
@@ -1706,7 +1903,7 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
         }
       })
       if (removedLiveStatus) {
-        queueMicrotask(() => freshness.schedule())
+        requestAgentStatusFreshness(true)
       }
     },
 
@@ -1745,6 +1942,10 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
         // must push that completion into history, or the finished timestamp and unread badge
         // lose the turn the moment the flag overwrites the live entry.
         let history: AgentStateHistoryEntry[] = existing?.stateHistory ?? []
+        // Why: a batched burst can fold a whole done→working turn into one publication, so a
+        // completion-reactive subscriber never sees `lastAssistantMessage` while state is `done`.
+        // One slot per entry, not one per history row — 20 transcripts per live status OOMs (#9872).
+        let lastCompletedAssistantMessage = existing?.lastCompletedAssistantMessage
         const boundaryLandsOnRealDone =
           existing?.state === 'done' &&
           existing.sessionBoundary !== true &&
@@ -1769,6 +1970,11 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
           if (history.length > AGENT_STATE_HISTORY_MAX) {
             history = history.slice(history.length - AGENT_STATE_HISTORY_MAX)
           }
+          if (existing.state === 'done') {
+            // The push above just moved this completion out of the live entry; a done that
+            // carried no message must clear the slot, or a stale prior turn leaks forward.
+            lastCompletedAssistantMessage = existing.lastAssistantMessage
+          }
         }
 
         const identity = resolveAgentStatusIdentity({
@@ -1933,6 +2139,7 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
           // card; parseAgentStatusPayload clears it on tool/state change.
           interactivePrompt: payload.interactivePrompt,
           lastAssistantMessage: payload.lastAssistantMessage,
+          ...(lastCompletedAssistantMessage ? { lastCompletedAssistantMessage } : {}),
           // Why: reused panes can start non-orchestrated work; only final done rows keep the
           // previous lineage fallback so completed children stay grouped.
           orchestration,
@@ -1982,13 +2189,18 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
           !!existing &&
           existing.state === payload.state &&
           entry.stateStartedAt !== existing.stateStartedAt
+        const sameStateDoneAttentionChanged =
+          existing?.state === 'done' &&
+          entry.state === 'done' &&
+          agentEntryCompletionAt(existing) !== agentEntryCompletionAt(entry)
         const sortRelevantChange =
           !existing ||
           existing.state !== payload.state ||
           !wasFresh ||
           attributionChanged ||
           commandCodeNewTurn ||
-          sameStateStateStartedAtChanged
+          sameStateStateStartedAtChanged ||
+          sameStateDoneAttentionChanged
         const doneRetentionFieldsChanged =
           existing?.state === 'done' &&
           entry.state === 'done' &&
@@ -2157,15 +2369,19 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
             ? getAgentRowGeneratedTitleText(entryForGeneratedTitle)
             : entryForGeneratedTitle.prompt
         if (shouldReplaceGeneratedTitle) {
-          get().setGeneratedTabTitleFromAgentPrompt(paneKey, generatedTitlePrompt, {
-            replaceExistingGeneratedTitle: true
+          applyGeneratedTabTitleUpdate({
+            paneKey,
+            prompt: generatedTitlePrompt,
+            options: {
+              replaceExistingGeneratedTitle: true
+            }
           })
         } else {
-          get().setGeneratedTabTitleFromAgentPrompt(paneKey, generatedTitlePrompt)
+          applyGeneratedTabTitleUpdate({ paneKey, prompt: generatedTitlePrompt })
         }
       }
-      // Why: schedule via queueMicrotask after set so the timer reads the updated map without re-entering the store during set.
-      queueMicrotask(() => freshness.schedule())
+      // Why: batches coalesce accepted updates; standalone calls keep their existing deferred scheduling.
+      requestAgentStatusFreshness(generatedTitleEntry.current !== null)
       if (completionRefreshWorktreeId) {
         const worktreeId = completionRefreshWorktreeId
         // Why: agents can create a PR via `gh pr create`, bypassing Orca's flow and leaving a stale "no PR" cache entry in place.
@@ -2173,6 +2389,13 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
       }
     },
 
+    setAgentStatuses: (updates) =>
+      updates.length === 0
+        ? []
+        : transactAgentStatuses((transaction) => updates.map(transaction.apply)),
+
+    transactAgentStatuses,
+
     setMigrationUnsupportedPty: (entry) => {
       set((s) => {
         const existing = s.migrationUnsupportedByPtyId[entry.ptyId]
diff --git a/src/renderer/src/store/slices/browser.test.ts b/src/renderer/src/store/slices/browser.test.ts
index c760b37a655..5239a5537ab 100644
--- a/src/renderer/src/store/slices/browser.test.ts
+++ b/src/renderer/src/store/slices/browser.test.ts
@@ -1,5 +1,5 @@
 /* eslint-disable max-lines -- Why: browser slice behavior shares one mocked store harness; splitting only the tests would duplicate more setup than it saves. */
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { create } from 'zustand'
 import { createBrowserSlice, isLocalBrowserPageOwner } from './browser'
 import type { AppState } from '../types'
@@ -10,6 +10,7 @@ import {
 import { GRAB_BUDGET, type BrowserPageAnnotation } from '../../../../shared/browser-grab-types'
 import { clearRuntimeCompatibilityCacheForTests } from '../../runtime/runtime-rpc-client'
 import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
+import { getExecutionHostLabel } from '../../../../shared/execution-host'
 
 const createWebRuntimeSessionBrowserTabMock = vi.hoisted(() => vi.fn())
 const runtimeEnvironmentCall = vi.fn()
@@ -66,6 +67,18 @@ function settingsWithRuntime(id: string): AppState['settings'] {
   return { activeRuntimeEnvironmentId: id } as AppState['settings']
 }
 
+function runtimeStatuses(capabilities: string[]): AppState['runtimeStatusByEnvironmentId'] {
+  return new Map([
+    [
+      'env-1',
+      {
+        status: { capabilities },
+        checkedAt: 1
+      }
+    ]
+  ]) as AppState['runtimeStatusByEnvironmentId']
+}
+
 function seedUnifiedBrowserTab(
   store: ReturnType<typeof createTestStore>,
   entityId: string,
@@ -164,6 +177,21 @@ describe('createBrowserSlice annotations', () => {
     expect(store.getState().recordFeatureInteraction).toHaveBeenCalledWith('browser-tab-created')
   })
 
+  it('opens a local sign-in tab with the imported browser profile', async () => {
+    const store = createTestStore()
+
+    await expect(
+      store
+        .getState()
+        .openBrowserProfileTabInActiveWorkspace('https://accounts.google.com/', 'profile-1')
+    ).resolves.toBe(true)
+
+    expect(store.getState().browserTabsByWorktree['wt-1']?.[0]).toMatchObject({
+      url: 'https://accounts.google.com/',
+      sessionProfileId: 'profile-1'
+    })
+  })
+
   it('clears page annotations when the browser page URL changes', () => {
     const store = createTestStore()
     const tab = store.getState().createBrowserTab('wt-1', 'https://example.com')
@@ -533,6 +561,35 @@ describe('createBrowserSlice runtime guard', () => {
     runtimeEnvironmentCall.mockResolvedValue({ id: 'rpc-1', ok: true, result: {} })
   })
 
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('rejects direct client-local materialization in the web client', () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const store = createTestStore()
+
+    expect(() => store.getState().createBrowserTab('wt-1', 'about:blank')).toThrow(
+      'must be created by a capable paired runtime'
+    )
+    expect(store.getState().browserTabsByWorktree['wt-1']).toBeUndefined()
+    expect(store.getState().createUnifiedTab).not.toHaveBeenCalled()
+  })
+
+  it('rejects direct remote materialization without the provider capability', () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const store = createTestStore()
+    store.setState({ runtimeStatusByEnvironmentId: runtimeStatuses([]) })
+
+    expect(() =>
+      store.getState().createBrowserTab('wt-1', 'about:blank', {
+        browserRuntimeEnvironmentId: 'env-1'
+      })
+    ).toThrow('paired runtime does not support browser streaming')
+    expect(store.getState().browserTabsByWorktree['wt-1']).toBeUndefined()
+    expect(store.getState().createUnifiedTab).not.toHaveBeenCalled()
+  })
+
   it('fetches browser profiles from the active runtime environment', async () => {
     const store = createTestStore()
     runtimeEnvironmentCall.mockResolvedValueOnce({
@@ -786,7 +843,10 @@ describe('createBrowserSlice runtime guard', () => {
       })
     })
     const store = createTestStore()
-    store.setState({ browserSessionHostIdOverride: 'runtime:windows-2' })
+    store.setState({
+      browserSessionHostIdOverride: 'runtime:windows-2',
+      runtimeEnvironments: [{ id: 'windows-2', name: 'Windows Server' }] as never
+    })
 
     const importing = store
       .getState()
@@ -805,7 +865,12 @@ describe('createBrowserSlice runtime guard', () => {
       _meta: { runtimeId: 'runtime-windows' }
     })
 
-    await expect(importing).resolves.toMatchObject({ ok: true, profileId: 'windows-profile' })
+    await expect(importing).resolves.toMatchObject({
+      ok: true,
+      profileId: 'windows-profile',
+      executionHostId: 'runtime:windows-2',
+      executionHostLabel: 'Windows Server'
+    })
     expect(store.getState().browserSessionHostIdOverride).toBe('runtime:linux-3')
     expect(store.getState().browserSessionImportState).toBeNull()
     expect(runtimeEnvironmentCall.mock.calls).toHaveLength(callsBeforeCompletion)
@@ -941,6 +1006,7 @@ describe('createBrowserSlice runtime guard', () => {
     store.setState({
       activeWorktreeId: 'wt-remote',
       settings: { activeRuntimeEnvironmentId: null } as AppState['settings'],
+      runtimeStatusByEnvironmentId: runtimeStatuses(['browser.screencast.v1']),
       browserDefaultUrl: 'about:blank',
       repos: [
         {
@@ -991,15 +1057,12 @@ describe('createBrowserSlice runtime guard', () => {
     expect(store.getState().recordFeatureInteraction).toHaveBeenCalledWith('browser-tab-created')
   })
 
-  it('does not create a local fallback tab when remote browser creation fails', async () => {
+  it('uses the desktop client browser when a remote npm host cannot stream', async () => {
     const store = createTestStore()
-    // Why: a remote-owned workspace must stay remote-owned. If the remote host
-    // cannot create the page, we must NOT silently open a local desktop tab —
-    // that produces confusing split ownership (issue #5321 UX requirement).
-    createWebRuntimeSessionBrowserTabMock.mockResolvedValueOnce(false)
     store.setState({
       activeWorktreeId: 'wt-remote',
-      settings: { activeRuntimeEnvironmentId: 'env-1' } as AppState['settings'],
+      settings: settingsWithRuntime('env-1'),
+      runtimeStatusByEnvironmentId: runtimeStatuses([]),
       worktreesByRepo: {
         'repo-1': [
           {
@@ -1014,6 +1077,39 @@ describe('createBrowserSlice runtime guard', () => {
 
     await store.getState().openNewBrowserTabInActiveWorkspace('group-1')
 
+    expect(createWebRuntimeSessionBrowserTabMock).not.toHaveBeenCalled()
+    const tab = store.getState().browserTabsByWorktree['wt-remote']?.[0]
+    const page = tab ? store.getState().browserPagesByWorkspace[tab.id]?.[0] : undefined
+    expect(page?.browserRuntimeEnvironmentId).toBeNull()
+    expect(store.getState().createUnifiedTab).toHaveBeenCalled()
+  })
+
+  it('does not create a local fallback tab when remote browser creation fails', async () => {
+    const store = createTestStore()
+    // Why: a remote-owned workspace must stay remote-owned. If the remote host
+    // cannot create the page, we must NOT silently open a local desktop tab —
+    // that produces confusing split ownership (issue #5321 UX requirement).
+    createWebRuntimeSessionBrowserTabMock.mockResolvedValueOnce(false)
+    store.setState({
+      activeWorktreeId: 'wt-remote',
+      settings: { activeRuntimeEnvironmentId: 'env-1' } as AppState['settings'],
+      runtimeStatusByEnvironmentId: runtimeStatuses(['browser.screencast.v1']),
+      worktreesByRepo: {
+        'repo-1': [
+          {
+            id: 'wt-remote',
+            repoId: 'repo-1',
+            hostId: 'local',
+            runtimeOwnerEnvironmentId: 'env-1'
+          } as never
+        ]
+      }
+    })
+
+    await expect(store.getState().openNewBrowserTabInActiveWorkspace('group-1')).rejects.toThrow(
+      'The paired runtime could not create a managed browser tab.'
+    )
+
     expect(createWebRuntimeSessionBrowserTabMock).toHaveBeenCalledWith({
       worktreeId: 'wt-remote',
       environmentId: 'env-1',
@@ -1028,12 +1124,12 @@ describe('createBrowserSlice runtime guard', () => {
     )
   })
 
-  it('does not create a local fallback tab when remote browser creation throws', async () => {
+  it('opens a remote sign-in tab with the imported browser profile', async () => {
     const store = createTestStore()
-    createWebRuntimeSessionBrowserTabMock.mockRejectedValueOnce(new Error('remote down'))
     store.setState({
       activeWorktreeId: 'wt-remote',
       settings: { activeRuntimeEnvironmentId: 'env-1' } as AppState['settings'],
+      runtimeStatusByEnvironmentId: runtimeStatuses(['browser.screencast.v1']),
       worktreesByRepo: {
         'repo-1': [
           {
@@ -1046,7 +1142,103 @@ describe('createBrowserSlice runtime guard', () => {
       }
     })
 
-    await store.getState().openNewBrowserTabInActiveWorkspace('group-1')
+    await expect(
+      store
+        .getState()
+        .openBrowserProfileTabInActiveWorkspace('https://accounts.google.com/', 'profile-1')
+    ).resolves.toBe(true)
+
+    expect(createWebRuntimeSessionBrowserTabMock).toHaveBeenCalledWith({
+      worktreeId: 'wt-remote',
+      environmentId: 'env-1',
+      url: 'https://accounts.google.com/',
+      profileId: 'profile-1'
+    })
+    expect(store.getState().browserTabsByWorktree['wt-remote']).toBeUndefined()
+  })
+
+  it('opens a local desktop sign-in tab when the remote host cannot stream browsers', async () => {
+    const store = createTestStore()
+    store.setState({
+      activeWorktreeId: 'wt-remote',
+      settings: settingsWithRuntime('env-1'),
+      runtimeStatusByEnvironmentId: runtimeStatuses([]),
+      worktreesByRepo: {
+        'repo-1': [
+          {
+            id: 'wt-remote',
+            repoId: 'repo-1',
+            hostId: 'local',
+            runtimeOwnerEnvironmentId: 'env-1'
+          } as never
+        ]
+      }
+    })
+
+    await expect(
+      store
+        .getState()
+        .openBrowserProfileTabInActiveWorkspace('https://accounts.google.com/', 'profile-1')
+    ).resolves.toBe(true)
+
+    expect(createWebRuntimeSessionBrowserTabMock).not.toHaveBeenCalled()
+    expect(store.getState().browserTabsByWorktree['wt-remote']?.[0]).toMatchObject({
+      url: 'https://accounts.google.com/',
+      sessionProfileId: 'profile-1'
+    })
+  })
+
+  it('rejects a paired-web sign-in tab when the remote host cannot stream browsers', async () => {
+    vi.stubGlobal('__ORCA_WEB_CLIENT__', true)
+    const store = createTestStore()
+    store.setState({
+      activeWorktreeId: 'wt-remote',
+      settings: settingsWithRuntime('env-1'),
+      runtimeStatusByEnvironmentId: runtimeStatuses([]),
+      worktreesByRepo: {
+        'repo-1': [
+          {
+            id: 'wt-remote',
+            repoId: 'repo-1',
+            hostId: 'local',
+            runtimeOwnerEnvironmentId: 'env-1'
+          } as never
+        ]
+      }
+    })
+
+    await expect(
+      store
+        .getState()
+        .openBrowserProfileTabInActiveWorkspace('https://accounts.google.com/', 'profile-1')
+    ).resolves.toBe(false)
+
+    expect(createWebRuntimeSessionBrowserTabMock).not.toHaveBeenCalled()
+    expect(store.getState().browserTabsByWorktree['wt-remote']).toBeUndefined()
+  })
+
+  it('does not create a local fallback tab when remote browser creation throws', async () => {
+    const store = createTestStore()
+    createWebRuntimeSessionBrowserTabMock.mockRejectedValueOnce(new Error('remote down'))
+    store.setState({
+      activeWorktreeId: 'wt-remote',
+      settings: { activeRuntimeEnvironmentId: 'env-1' } as AppState['settings'],
+      runtimeStatusByEnvironmentId: runtimeStatuses(['browser.screencast.v1']),
+      worktreesByRepo: {
+        'repo-1': [
+          {
+            id: 'wt-remote',
+            repoId: 'repo-1',
+            hostId: 'local',
+            runtimeOwnerEnvironmentId: 'env-1'
+          } as never
+        ]
+      }
+    })
+
+    await expect(store.getState().openNewBrowserTabInActiveWorkspace('group-1')).rejects.toThrow(
+      'remote down'
+    )
 
     expect(store.getState().browserTabsByWorktree['wt-remote']).toBeUndefined()
     expect(store.getState().createUnifiedTab).not.toHaveBeenCalled()
@@ -1059,13 +1251,51 @@ describe('createBrowserSlice runtime guard', () => {
     const result = await store.getState().importCookiesToProfile('default')
 
     expect(mockApi.browser.sessionImportCookies).not.toHaveBeenCalled()
-    expect(result.ok).toBe(false)
+    expect(result).toMatchObject({
+      ok: false,
+      executionHostId: 'runtime:env-1',
+      executionHostLabel: 'env-1'
+    })
     expect(store.getState().browserSessionImportState).toMatchObject({
       profileId: 'default',
       status: 'error'
     })
   })
 
+  it('retains the host display label used by browser settings', async () => {
+    const store = createTestStore()
+    store.setState({
+      settings: {
+        ...settingsWithRuntime('env-1')!,
+        hostSettingOverrides: {
+          'runtime:env-1': { displayLabel: 'Production Browser Host' }
+        }
+      },
+      runtimeEnvironments: [{ id: 'env-1', name: 'Remote Mac' }] as never
+    })
+
+    const result = await store.getState().importCookiesToProfile('default')
+
+    expect(result.executionHostLabel).toBe('Production Browser Host')
+  })
+
+  it('retains the local execution host for a successful browser import', async () => {
+    mockApi.browser.sessionImportFromBrowser.mockResolvedValueOnce({
+      ok: true,
+      profileId: 'default',
+      summary: { totalCookies: 2, importedCookies: 2, skippedCookies: 0, domains: [] }
+    })
+    const store = createTestStore()
+
+    const result = await store.getState().importCookiesFromBrowser('default', 'chrome', 'Default')
+
+    expect(result).toMatchObject({
+      ok: true,
+      executionHostId: 'local',
+      executionHostLabel: getExecutionHostLabel('local')
+    })
+  })
+
   it('uses local browser IPC when no runtime environment is active', async () => {
     const store = createTestStore()
     mockApi.browser.sessionListProfiles.mockResolvedValueOnce([
diff --git a/src/renderer/src/store/slices/browser.ts b/src/renderer/src/store/slices/browser.ts
index 78a7a31b358..6f3c739308a 100644
--- a/src/renderer/src/store/slices/browser.ts
+++ b/src/renderer/src/store/slices/browser.ts
@@ -44,12 +44,14 @@ import type {
 import { createBrowserUuid } from '@/lib/browser-uuid'
 import { translate } from '@/i18n/i18n'
 import {
+  getExecutionHostLabel,
   getSettingsFocusedExecutionHostId,
   LOCAL_EXECUTION_HOST_ID,
   parseExecutionHostId,
   toRuntimeExecutionHostId,
   type ExecutionHostId
 } from '../../../../shared/execution-host'
+import { getHostSettingOverride } from '../../../../shared/host-setting-overrides'
 import {
   getExecutionHostIdForWorktree,
   getRuntimeEnvironmentIdForWorktree
@@ -59,6 +61,10 @@ import {
   type WorkspaceSessionHydrationOptions
 } from '@/lib/workspace-session-hydration-keys'
 import { buildValidWorktreeIdsForSessionHydration } from './degraded-repo-worktree-validity'
+import {
+  assertManagedBrowserMaterializationAllowed,
+  getClientCreationActionPolicy
+} from '@/lib/client-creation-action-policy'
 
 type CreateBrowserTabOptions = {
   activate?: boolean
@@ -117,6 +123,19 @@ export type RemoteBrowserPageHandle = {
   remotePageId: string
 }
 
+export type BrowserCookieImportExecutionResult = BrowserCookieImportResult & {
+  executionHostId: ExecutionHostId
+  executionHostLabel: string
+}
+
+function retainCookieImportExecutionHost(
+  result: BrowserCookieImportResult,
+  executionHostId: ExecutionHostId,
+  executionHostLabel: string
+): BrowserCookieImportExecutionResult {
+  return { ...result, executionHostId, executionHostLabel }
+}
+
 export type BrowserSlice = {
   browserTabsByWorktree: Record<string, BrowserWorkspace[]>
   browserPagesByWorkspace: Record<string, BrowserPage[]>
@@ -135,6 +154,7 @@ export type BrowserSlice = {
     options?: CreateBrowserTabOptions
   ) => BrowserWorkspace
   openNewBrowserTabInActiveWorkspace: (groupId: string) => Promise<void>
+  openBrowserProfileTabInActiveWorkspace: (url: string, profileId: string) => Promise<boolean>
   closeBrowserTab: (tabId: string) => void
   shutdownWorktreeBrowsers: (worktreeId: string) => Promise<void>
   reopenClosedBrowserTab: (worktreeId: string) => BrowserWorkspace | null
@@ -200,7 +220,7 @@ export type BrowserSlice = {
     options?: BrowserSessionProfileCreateOptions
   ) => Promise<BrowserSessionProfile | null>
   deleteBrowserSessionProfile: (profileId: string) => Promise<boolean>
-  importCookiesToProfile: (profileId: string) => Promise<BrowserCookieImportResult>
+  importCookiesToProfile: (profileId: string) => Promise<BrowserCookieImportExecutionResult>
   clearBrowserSessionImportState: () => void
   detectedBrowsers: {
     family: string
@@ -214,7 +234,7 @@ export type BrowserSlice = {
     profileId: string,
     browserFamily: string,
     browserProfile?: string
-  ) => Promise<BrowserCookieImportResult>
+  ) => Promise<BrowserCookieImportExecutionResult>
   clearDefaultSessionCookies: () => Promise<boolean>
   browserUrlHistory: BrowserHistoryEntry[]
   addBrowserHistoryEntry: (url: string, title: string) => void
@@ -253,6 +273,23 @@ function getBrowserSettingsHostId(
   return state.browserSessionHostIdOverride ?? getSettingsFocusedExecutionHostId(state.settings)
 }
 
+function getBrowserSettingsHostLabel(state: AppState, hostId: ExecutionHostId): string {
+  const override = getHostSettingOverride(state.settings, hostId, 'displayLabel')
+  if (override) {
+    return override
+  }
+  const parsed = parseExecutionHostId(hostId)
+  if (parsed?.kind === 'runtime') {
+    const name = state.runtimeEnvironments
+      ?.find((environment) => environment.id === parsed.environmentId)
+      ?.name.trim()
+    if (name) {
+      return name
+    }
+  }
+  return getExecutionHostLabel(hostId)
+}
+
 function getBrowserSettingsRuntimeEnvironmentId(
   state: Pick<AppState, 'browserSessionHostIdOverride' | 'settings'>
 ): string | null {
@@ -560,6 +597,7 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
   },
 
   createBrowserTab: (worktreeId, url, options) => {
+    assertManagedBrowserMaterializationAllowed(get(), options?.browserRuntimeEnvironmentId)
     const workspaceId = createBrowserUuid()
     const page = buildBrowserPage(
       workspaceId,
@@ -675,9 +713,16 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
     if (!worktreeId) {
       return
     }
+    const browserAvailability = getClientCreationActionPolicy(state, worktreeId)['managed-browser']
+    if (browserAvailability.state !== 'enabled') {
+      throw new Error(browserAvailability.reason)
+    }
     const defaultUrl = state.browserDefaultUrl ?? 'about:blank'
     const runtimeEnvironmentId = getRuntimeEnvironmentIdForWorktree(state, worktreeId)
-    if (runtimeEnvironmentId) {
+    if (browserAvailability.provider === 'paired-runtime') {
+      if (!runtimeEnvironmentId) {
+        throw new Error('The paired runtime browser provider is unavailable.')
+      }
       const { createWebRuntimeSessionBrowserTab } = await import('@/runtime/web-runtime-session')
       try {
         const created = await createWebRuntimeSessionBrowserTab({
@@ -696,16 +741,57 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
           '[browser] remote browser tab creation failed:',
           error instanceof Error ? error.message : String(error)
         )
+        throw error
       }
-      return
+      throw new Error('The paired runtime could not create a managed browser tab.')
     }
     get().createBrowserTab(worktreeId, defaultUrl, {
       title: translate('auto.store.slices.browser.d175274b6d', 'New Browser Tab'),
       focusAddressBar: true,
+      ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {}),
       targetGroupId: groupId
     })
     get().recordFeatureInteraction('browser-tab-created')
   },
+
+  openBrowserProfileTabInActiveWorkspace: async (url, profileId) => {
+    const state = get()
+    const worktreeId = state.activeWorktreeId
+    if (!worktreeId) {
+      return false
+    }
+    const browserAvailability = getClientCreationActionPolicy(state, worktreeId)['managed-browser']
+    if (browserAvailability.state !== 'enabled') {
+      return false
+    }
+    const runtimeEnvironmentId = getRuntimeEnvironmentIdForWorktree(state, worktreeId)
+    if (browserAvailability.provider === 'paired-runtime') {
+      if (!runtimeEnvironmentId) {
+        return false
+      }
+      const { createWebRuntimeSessionBrowserTab } = await import('@/runtime/web-runtime-session')
+      try {
+        return await createWebRuntimeSessionBrowserTab({
+          worktreeId,
+          environmentId: runtimeEnvironmentId,
+          url,
+          profileId
+        })
+      } catch (error) {
+        console.warn(
+          '[browser] remote profile tab creation failed:',
+          error instanceof Error ? error.message : String(error)
+        )
+        return false
+      }
+    }
+    get().createBrowserTab(worktreeId, url, {
+      activate: true,
+      sessionProfileId: profileId,
+      ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {})
+    })
+    return true
+  },
   closeBrowserTab: (tabId) => {
     let remotePagesToClose: { worktreeId: string; handle: RemoteBrowserPageHandle }[] = []
     set((s) => {
@@ -938,7 +1024,7 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
     if (activePageId) {
       const restoredPages = get().browserPagesByWorkspace[restored.id] ?? []
       const activePageIndex = pages.findIndex((orig) => orig.id === activePageId)
-      const targetPage = activePageIndex >= 0 ? restoredPages[activePageIndex] : null
+      const targetPage = activePageIndex !== -1 ? restoredPages[activePageIndex] : null
       if (targetPage && targetPage.id !== restoredPages[0]?.id) {
         get().setActiveBrowserPage(restored.id, targetPage.id)
       }
@@ -1955,8 +2041,10 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
   },
 
   importCookiesToProfile: async (profileId) => {
-    const hostId = getBrowserSettingsHostId(get())
-    if (getBrowserSettingsRuntimeEnvironmentId(get())) {
+    const initialState = get()
+    const hostId = getBrowserSettingsHostId(initialState)
+    const executionHostLabel = getBrowserSettingsHostLabel(initialState, hostId)
+    if (getBrowserSettingsRuntimeEnvironmentId(initialState)) {
       const reason = translate(
         'auto.store.slices.browser.remoteCookieImportUnavailable',
         'Manual cookie file import is unavailable while a remote runtime is active.'
@@ -1969,7 +2057,11 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
           error: reason
         })
       )
-      return { ok: false as const, reason }
+      return retainCookieImportExecutionHost(
+        { ok: false as const, reason },
+        hostId,
+        executionHostLabel
+      )
     }
     set((state) =>
       browserImportStateForHostUpdate(state, hostId, {
@@ -2008,7 +2100,7 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
           })
         )
       }
-      return result
+      return retainCookieImportExecutionHost(result, hostId, executionHostLabel)
     } catch (err) {
       const reason = String((err as Error)?.message ?? err)
       set((state) =>
@@ -2019,7 +2111,11 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
           error: reason
         })
       )
-      return { ok: false as const, reason }
+      return retainCookieImportExecutionHost(
+        { ok: false as const, reason },
+        hostId,
+        executionHostLabel
+      )
     }
   },
 
@@ -2077,8 +2173,10 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
   },
 
   importCookiesFromBrowser: async (profileId, browserFamily, browserProfile?) => {
-    const hostId = getBrowserSettingsHostId(get())
-    const runtimeEnvironmentId = getBrowserSettingsRuntimeEnvironmentId(get())
+    const initialState = get()
+    const hostId = getBrowserSettingsHostId(initialState)
+    const executionHostLabel = getBrowserSettingsHostLabel(initialState, hostId)
+    const runtimeEnvironmentId = getBrowserSettingsRuntimeEnvironmentId(initialState)
     if (runtimeEnvironmentId) {
       set((state) =>
         browserImportStateForHostUpdate(state, hostId, {
@@ -2119,7 +2217,7 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
             })
           )
         }
-        return result
+        return retainCookieImportExecutionHost(result, hostId, executionHostLabel)
       } catch (err) {
         const reason = String((err as Error)?.message ?? err)
         set((state) =>
@@ -2130,7 +2228,11 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
             error: reason
           })
         )
-        return { ok: false as const, reason }
+        return retainCookieImportExecutionHost(
+          { ok: false as const, reason },
+          hostId,
+          executionHostLabel
+        )
       }
     }
     set((state) =>
@@ -2172,7 +2274,7 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
           })
         )
       }
-      return result
+      return retainCookieImportExecutionHost(result, hostId, executionHostLabel)
     } catch (err) {
       const reason = String((err as Error)?.message ?? err)
       set((state) =>
@@ -2183,7 +2285,11 @@ export const createBrowserSlice: StateCreator<AppState, [], [], BrowserSlice> =
           error: reason
         })
       )
-      return { ok: false as const, reason }
+      return retainCookieImportExecutionHost(
+        { ok: false as const, reason },
+        hostId,
+        executionHostLabel
+      )
     }
   },
 
diff --git a/src/renderer/src/store/slices/claude-usage.ts b/src/renderer/src/store/slices/claude-usage.ts
deleted file mode 100644
index b9e6d0c74fc..00000000000
--- a/src/renderer/src/store/slices/claude-usage.ts
+++ /dev/null
@@ -1,184 +0,0 @@
-import type { StateCreator } from 'zustand'
-import type {
-  ClaudeUsageBreakdownRow,
-  ClaudeUsageDailyPoint,
-  ClaudeUsageRange,
-  ClaudeUsageScanState,
-  ClaudeUsageScope,
-  ClaudeUsageSessionRow,
-  ClaudeUsageSnapshot,
-  ClaudeUsageSummary
-} from '../../../../shared/claude-usage-types'
-import type { AppState } from '../types'
-
-export type ClaudeUsageSlice = {
-  claudeUsageScope: ClaudeUsageScope
-  claudeUsageRange: ClaudeUsageRange
-  claudeUsageScanState: ClaudeUsageScanState | null
-  claudeUsageSummary: ClaudeUsageSummary | null
-  claudeUsageDaily: ClaudeUsageDailyPoint[]
-  claudeUsageModelBreakdown: ClaudeUsageBreakdownRow[]
-  claudeUsageProjectBreakdown: ClaudeUsageBreakdownRow[]
-  claudeUsageRecentSessions: ClaudeUsageSessionRow[]
-  setClaudeUsageEnabled: (enabled: boolean) => Promise<void>
-  setClaudeUsageScope: (scope: ClaudeUsageScope) => Promise<void>
-  setClaudeUsageRange: (range: ClaudeUsageRange) => Promise<void>
-  fetchClaudeUsage: (opts?: { forceRefresh?: boolean }) => Promise<void>
-  enableClaudeUsage: () => Promise<void>
-  refreshClaudeUsage: () => Promise<void>
-}
-
-export const createClaudeUsageSlice: StateCreator<AppState, [], [], ClaudeUsageSlice> = (
-  set,
-  get
-) => ({
-  claudeUsageScope: 'orca',
-  claudeUsageRange: '30d',
-  claudeUsageScanState: null,
-  claudeUsageSummary: null,
-  claudeUsageDaily: [],
-  claudeUsageModelBreakdown: [],
-  claudeUsageProjectBreakdown: [],
-  claudeUsageRecentSessions: [],
-
-  setClaudeUsageEnabled: async (enabled) => {
-    try {
-      const nextScanState = (await window.api.claudeUsage.setEnabled({
-        enabled
-      })) as ClaudeUsageScanState | undefined
-      // Why: the web client (paired runtime) does not bridge the desktop-only
-      // usage IPC; its preload fallback resolves this call to `undefined`. Bail
-      // so the toggle no-ops instead of seeding an empty scan state and then
-      // crashing on the follow-up fetch.
-      if (!nextScanState) {
-        return
-      }
-      set({
-        // Why: every enable should look like a fresh scan cycle in the UI.
-        // Reusing the last completed timestamp makes repeated toggles skip the
-        // loading skeleton and briefly render an empty analytics pane.
-        claudeUsageScanState: enabled
-          ? {
-              ...nextScanState,
-              isScanning: true,
-              lastScanCompletedAt: null,
-              lastScanError: null
-            }
-          : nextScanState,
-        claudeUsageSummary: null,
-        claudeUsageDaily: [],
-        claudeUsageModelBreakdown: [],
-        claudeUsageProjectBreakdown: [],
-        claudeUsageRecentSessions: []
-      })
-      if (enabled) {
-        await get().fetchClaudeUsage({ forceRefresh: true })
-      }
-    } catch (error) {
-      console.error('Failed to update Claude usage setting:', error)
-    }
-  },
-
-  setClaudeUsageScope: async (scope) => {
-    set({ claudeUsageScope: scope })
-    await get().fetchClaudeUsage()
-  },
-
-  setClaudeUsageRange: async (range) => {
-    set({ claudeUsageRange: range })
-    await get().fetchClaudeUsage()
-  },
-
-  fetchClaudeUsage: async (opts) => {
-    try {
-      const scanState = (await window.api.claudeUsage.getScanState()) as
-        | ClaudeUsageScanState
-        | undefined
-      // Why: in the web client the usage IPC is unavailable and the preload
-      // fallback resolves to `undefined`; reading `scanState.enabled` below would
-      // throw `Cannot read properties of undefined (reading 'enabled')`. Treat an
-      // absent scan state as "usage unavailable" and stop.
-      if (!scanState) {
-        return
-      }
-      const currentScanState = get().claudeUsageScanState
-      const shouldPreserveLoadingState =
-        opts?.forceRefresh === true &&
-        currentScanState?.enabled === true &&
-        get().claudeUsageSummary === null
-      set({
-        claudeUsageScanState: shouldPreserveLoadingState
-          ? {
-              ...scanState,
-              isScanning: true,
-              lastScanCompletedAt: null,
-              lastScanError: null
-            }
-          : scanState
-      })
-      if (!scanState.enabled) {
-        return
-      }
-
-      const { claudeUsageScope, claudeUsageRange } = get()
-      const snapshot = (await window.api.claudeUsage.getSnapshot({
-        scope: claudeUsageScope,
-        range: claudeUsageRange,
-        limit: 10
-      })) as ClaudeUsageSnapshot
-      const hasCachedSnapshot =
-        snapshot.scanState.lastScanCompletedAt !== null || snapshot.scanState.hasAnyClaudeData
-
-      if (hasCachedSnapshot) {
-        set({
-          claudeUsageScanState:
-            opts?.forceRefresh === true
-              ? { ...snapshot.scanState, isScanning: true }
-              : snapshot.scanState,
-          claudeUsageSummary: snapshot.summary,
-          claudeUsageDaily: snapshot.daily,
-          claudeUsageModelBreakdown: snapshot.modelBreakdown,
-          claudeUsageProjectBreakdown: snapshot.projectBreakdown,
-          claudeUsageRecentSessions: snapshot.recentSessions
-        })
-      } else {
-        set({
-          claudeUsageScanState: {
-            ...scanState,
-            isScanning: true,
-            lastScanError: null
-          }
-        })
-      }
-
-      await window.api.claudeUsage.refresh({
-        force: opts?.forceRefresh ?? false
-      })
-      const { claudeUsageScope: refreshedScope, claudeUsageRange: refreshedRange } = get()
-      const refreshedSnapshot = (await window.api.claudeUsage.getSnapshot({
-        scope: refreshedScope,
-        range: refreshedRange,
-        limit: 10
-      })) as ClaudeUsageSnapshot
-
-      set({
-        claudeUsageScanState: refreshedSnapshot.scanState,
-        claudeUsageSummary: refreshedSnapshot.summary,
-        claudeUsageDaily: refreshedSnapshot.daily,
-        claudeUsageModelBreakdown: refreshedSnapshot.modelBreakdown,
-        claudeUsageProjectBreakdown: refreshedSnapshot.projectBreakdown,
-        claudeUsageRecentSessions: refreshedSnapshot.recentSessions
-      })
-    } catch (error) {
-      console.error('Failed to fetch Claude usage:', error)
-    }
-  },
-
-  enableClaudeUsage: async () => {
-    await get().setClaudeUsageEnabled(true)
-  },
-
-  refreshClaudeUsage: async () => {
-    await get().fetchClaudeUsage({ forceRefresh: true })
-  }
-})
diff --git a/src/renderer/src/store/slices/cmd-j-create-actions.test.ts b/src/renderer/src/store/slices/cmd-j-create-actions.test.ts
index abf1904cc19..c8bf6abc690 100644
--- a/src/renderer/src/store/slices/cmd-j-create-actions.test.ts
+++ b/src/renderer/src/store/slices/cmd-j-create-actions.test.ts
@@ -3,6 +3,10 @@ import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
 import { folderWorkspaceKey } from '../../../../shared/workspace-scope'
 import type { AppState } from '../types'
 import { createTestStore, makeWorktree, seedStore, TEST_REPO } from './store-test-helpers'
+import {
+  FLOATING_BROWSER_UNAVAILABLE_MESSAGE,
+  MANAGED_BROWSER_UNAVAILABLE_MESSAGE
+} from '@/lib/client-creation-action-policy'
 
 const createWebRuntimeSessionBrowserTabMock = vi.hoisted(() => vi.fn())
 const createWebRuntimeSessionTerminalMock = vi.hoisted(() => vi.fn())
@@ -23,10 +27,19 @@ vi.mock('@/lib/web-client-location', () => ({
 
 const pairedWebFlag = globalThis as { __ORCA_WEB_CLIENT__?: boolean }
 
+function browserCapableRuntimeStatus(
+  environmentId: string
+): AppState['runtimeStatusByEnvironmentId'] {
+  return new Map([
+    [environmentId, { status: { capabilities: ['browser.screencast.v1'] }, checkedAt: 1 }]
+  ]) as AppState['runtimeStatusByEnvironmentId']
+}
+
 function seedActiveWorkspace(store: ReturnType<typeof createTestStore>): void {
   seedStore(store, {
     activeWorktreeId: 'wt-1',
     settings: { activeRuntimeEnvironmentId: 'runtime-1' } as AppState['settings'],
+    runtimeStatusByEnvironmentId: browserCapableRuntimeStatus('runtime-1'),
     worktreesByRepo: {
       [TEST_REPO.id]: [
         makeWorktree({
@@ -55,7 +68,7 @@ describe('Cmd+J lifted creation actions', () => {
     delete pairedWebFlag.__ORCA_WEB_CLIENT__
   })
 
-  it('does not fall back to a local browser tab when paired-web creation fails', async () => {
+  it('rejects without a local browser fallback when paired-web creation fails', async () => {
     // Why: a remote-owned workspace must stay remote-owned. If the remote host
     // cannot create the page, we must NOT silently open a local desktop tab —
     // that produces confusing split ownership (issue #5321). Mirrors the
@@ -64,7 +77,9 @@ describe('Cmd+J lifted creation actions', () => {
     const store = createTestStore()
     seedActiveWorkspace(store)
 
-    await store.getState().openNewBrowserTabInActiveWorkspace('group-1')
+    await expect(store.getState().openNewBrowserTabInActiveWorkspace('group-1')).rejects.toThrow(
+      'The paired runtime could not create a managed browser tab.'
+    )
 
     expect(createWebRuntimeSessionBrowserTabMock).toHaveBeenCalledWith({
       worktreeId: 'wt-1',
@@ -75,7 +90,7 @@ describe('Cmd+J lifted creation actions', () => {
     expect(store.getState().browserTabsByWorktree['wt-1'] ?? []).toEqual([])
   })
 
-  it('routes browser tab creation to the explicit owner runtime when another runtime is focused', async () => {
+  it('routes browser creation to the owner runtime without a local fallback', async () => {
     createWebRuntimeSessionBrowserTabMock.mockResolvedValue(false)
     const store = createTestStore()
     seedActiveWorkspace(store)
@@ -91,10 +106,13 @@ describe('Cmd+J lifted creation actions', () => {
           })
         ]
       },
-      settings: { activeRuntimeEnvironmentId: 'focused-runtime' } as AppState['settings']
+      settings: { activeRuntimeEnvironmentId: 'focused-runtime' } as AppState['settings'],
+      runtimeStatusByEnvironmentId: browserCapableRuntimeStatus('owner-runtime')
     })
 
-    await store.getState().openNewBrowserTabInActiveWorkspace('group-1')
+    await expect(store.getState().openNewBrowserTabInActiveWorkspace('group-1')).rejects.toThrow(
+      'The paired runtime could not create a managed browser tab.'
+    )
 
     expect(createWebRuntimeSessionBrowserTabMock).toHaveBeenCalledWith({
       worktreeId: 'wt-1',
@@ -106,7 +124,7 @@ describe('Cmd+J lifted creation actions', () => {
     expect(store.getState().browserTabsByWorktree['wt-1'] ?? []).toEqual([])
   })
 
-  it('creates a local browser tab for explicitly local workspaces while a runtime is focused', async () => {
+  it('rejects local browser tabs for explicitly local paired-web workspaces', async () => {
     createWebRuntimeSessionBrowserTabMock.mockResolvedValue(false)
     const store = createTestStore()
     seedActiveWorkspace(store)
@@ -118,13 +136,15 @@ describe('Cmd+J lifted creation actions', () => {
       settings: { activeRuntimeEnvironmentId: 'focused-runtime' } as AppState['settings']
     })
 
-    await store.getState().openNewBrowserTabInActiveWorkspace('group-1')
+    await expect(store.getState().openNewBrowserTabInActiveWorkspace('group-1')).rejects.toThrow(
+      MANAGED_BROWSER_UNAVAILABLE_MESSAGE
+    )
 
     expect(createWebRuntimeSessionBrowserTabMock).not.toHaveBeenCalled()
-    expect(store.getState().browserTabsByWorktree['wt-1'] ?? []).toHaveLength(1)
+    expect(store.getState().browserTabsByWorktree['wt-1'] ?? []).toEqual([])
   })
 
-  it('creates local browser and terminal tabs for the synthetic floating workspace while a runtime is focused', async () => {
+  it('rejects floating browsers while preserving floating terminal creation', async () => {
     createWebRuntimeSessionBrowserTabMock.mockResolvedValue(false)
     createWebRuntimeSessionTerminalMock.mockResolvedValue(false)
     const store = createTestStore()
@@ -144,14 +164,14 @@ describe('Cmd+J lifted creation actions', () => {
       activeGroupIdByWorktree: { [FLOATING_TERMINAL_WORKTREE_ID]: 'group-1' }
     })
 
-    await store.getState().openNewBrowserTabInActiveWorkspace('group-1')
+    await expect(store.getState().openNewBrowserTabInActiveWorkspace('group-1')).rejects.toThrow(
+      FLOATING_BROWSER_UNAVAILABLE_MESSAGE
+    )
     await store.getState().openNewTerminalTabInActiveWorkspace('group-1')
 
     expect(createWebRuntimeSessionBrowserTabMock).not.toHaveBeenCalled()
     expect(createWebRuntimeSessionTerminalMock).not.toHaveBeenCalled()
-    expect(
-      store.getState().browserTabsByWorktree[FLOATING_TERMINAL_WORKTREE_ID] ?? []
-    ).toHaveLength(1)
+    expect(store.getState().browserTabsByWorktree[FLOATING_TERMINAL_WORKTREE_ID] ?? []).toEqual([])
     expect(store.getState().tabsByWorktree[FLOATING_TERMINAL_WORKTREE_ID] ?? []).toHaveLength(1)
   })
 
diff --git a/src/renderer/src/store/slices/codex-usage.ts b/src/renderer/src/store/slices/codex-usage.ts
deleted file mode 100644
index fa90bc0eab1..00000000000
--- a/src/renderer/src/store/slices/codex-usage.ts
+++ /dev/null
@@ -1,181 +0,0 @@
-import type { StateCreator } from 'zustand'
-import type {
-  CodexUsageBreakdownRow,
-  CodexUsageDailyPoint,
-  CodexUsageRange,
-  CodexUsageScanState,
-  CodexUsageScope,
-  CodexUsageSessionRow,
-  CodexUsageSnapshot,
-  CodexUsageSummary
-} from '../../../../shared/codex-usage-types'
-import type { AppState } from '../types'
-
-export type CodexUsageSlice = {
-  codexUsageScope: CodexUsageScope
-  codexUsageRange: CodexUsageRange
-  codexUsageScanState: CodexUsageScanState | null
-  codexUsageSummary: CodexUsageSummary | null
-  codexUsageDaily: CodexUsageDailyPoint[]
-  codexUsageModelBreakdown: CodexUsageBreakdownRow[]
-  codexUsageProjectBreakdown: CodexUsageBreakdownRow[]
-  codexUsageRecentSessions: CodexUsageSessionRow[]
-  setCodexUsageEnabled: (enabled: boolean) => Promise<void>
-  setCodexUsageScope: (scope: CodexUsageScope) => Promise<void>
-  setCodexUsageRange: (range: CodexUsageRange) => Promise<void>
-  fetchCodexUsage: (opts?: { forceRefresh?: boolean }) => Promise<void>
-  enableCodexUsage: () => Promise<void>
-  refreshCodexUsage: () => Promise<void>
-}
-
-export const createCodexUsageSlice: StateCreator<AppState, [], [], CodexUsageSlice> = (
-  set,
-  get
-) => ({
-  codexUsageScope: 'orca',
-  codexUsageRange: '30d',
-  codexUsageScanState: null,
-  codexUsageSummary: null,
-  codexUsageDaily: [],
-  codexUsageModelBreakdown: [],
-  codexUsageProjectBreakdown: [],
-  codexUsageRecentSessions: [],
-
-  setCodexUsageEnabled: async (enabled) => {
-    try {
-      const nextScanState = (await window.api.codexUsage.setEnabled({
-        enabled
-      })) as CodexUsageScanState | undefined
-      // Why: the web client (paired runtime) does not bridge the desktop-only
-      // usage IPC; its preload fallback resolves this call to `undefined`. Bail
-      // so the toggle no-ops instead of seeding an empty scan state and then
-      // crashing on the follow-up fetch.
-      if (!nextScanState) {
-        return
-      }
-      set({
-        codexUsageScanState: enabled
-          ? {
-              ...nextScanState,
-              isScanning: true,
-              lastScanCompletedAt: null,
-              lastScanError: null
-            }
-          : nextScanState,
-        codexUsageSummary: null,
-        codexUsageDaily: [],
-        codexUsageModelBreakdown: [],
-        codexUsageProjectBreakdown: [],
-        codexUsageRecentSessions: []
-      })
-      if (enabled) {
-        await get().fetchCodexUsage({ forceRefresh: true })
-      }
-    } catch (error) {
-      console.error('Failed to update Codex usage setting:', error)
-    }
-  },
-
-  setCodexUsageScope: async (scope) => {
-    set({ codexUsageScope: scope })
-    await get().fetchCodexUsage()
-  },
-
-  setCodexUsageRange: async (range) => {
-    set({ codexUsageRange: range })
-    await get().fetchCodexUsage()
-  },
-
-  fetchCodexUsage: async (opts) => {
-    try {
-      const scanState = (await window.api.codexUsage.getScanState()) as
-        | CodexUsageScanState
-        | undefined
-      // Why: in the web client the usage IPC is unavailable and the preload
-      // fallback resolves to `undefined`; reading `scanState.enabled` below would
-      // throw `Cannot read properties of undefined (reading 'enabled')`. Treat an
-      // absent scan state as "usage unavailable" and stop.
-      if (!scanState) {
-        return
-      }
-      const currentScanState = get().codexUsageScanState
-      const shouldPreserveLoadingState =
-        opts?.forceRefresh === true &&
-        currentScanState?.enabled === true &&
-        get().codexUsageSummary === null
-      set({
-        codexUsageScanState: shouldPreserveLoadingState
-          ? {
-              ...scanState,
-              isScanning: true,
-              lastScanCompletedAt: null,
-              lastScanError: null
-            }
-          : scanState
-      })
-      if (!scanState.enabled) {
-        return
-      }
-
-      const { codexUsageScope, codexUsageRange } = get()
-      const snapshot = (await window.api.codexUsage.getSnapshot({
-        scope: codexUsageScope,
-        range: codexUsageRange,
-        limit: 10
-      })) as CodexUsageSnapshot
-      const hasCachedSnapshot =
-        snapshot.scanState.lastScanCompletedAt !== null || snapshot.scanState.hasAnyCodexData
-
-      if (hasCachedSnapshot) {
-        set({
-          codexUsageScanState:
-            opts?.forceRefresh === true
-              ? { ...snapshot.scanState, isScanning: true }
-              : snapshot.scanState,
-          codexUsageSummary: snapshot.summary,
-          codexUsageDaily: snapshot.daily,
-          codexUsageModelBreakdown: snapshot.modelBreakdown,
-          codexUsageProjectBreakdown: snapshot.projectBreakdown,
-          codexUsageRecentSessions: snapshot.recentSessions
-        })
-      } else {
-        set({
-          codexUsageScanState: {
-            ...scanState,
-            isScanning: true,
-            lastScanError: null
-          }
-        })
-      }
-
-      await window.api.codexUsage.refresh({
-        force: opts?.forceRefresh ?? false
-      })
-      const { codexUsageScope: refreshedScope, codexUsageRange: refreshedRange } = get()
-      const refreshedSnapshot = (await window.api.codexUsage.getSnapshot({
-        scope: refreshedScope,
-        range: refreshedRange,
-        limit: 10
-      })) as CodexUsageSnapshot
-
-      set({
-        codexUsageScanState: refreshedSnapshot.scanState,
-        codexUsageSummary: refreshedSnapshot.summary,
-        codexUsageDaily: refreshedSnapshot.daily,
-        codexUsageModelBreakdown: refreshedSnapshot.modelBreakdown,
-        codexUsageProjectBreakdown: refreshedSnapshot.projectBreakdown,
-        codexUsageRecentSessions: refreshedSnapshot.recentSessions
-      })
-    } catch (error) {
-      console.error('Failed to fetch Codex usage:', error)
-    }
-  },
-
-  enableCodexUsage: async () => {
-    await get().setCodexUsageEnabled(true)
-  },
-
-  refreshCodexUsage: async () => {
-    await get().fetchCodexUsage({ forceRefresh: true })
-  }
-})
diff --git a/src/renderer/src/store/slices/detected-agents.test.ts b/src/renderer/src/store/slices/detected-agents.test.ts
index 1755f355072..c4776039e13 100644
--- a/src/renderer/src/store/slices/detected-agents.test.ts
+++ b/src/renderer/src/store/slices/detected-agents.test.ts
@@ -327,6 +327,10 @@ describe('createDetectedAgentsSlice WSL context', () => {
       projects: [
         {
           id: 'repo-1',
+          displayName: 'repo-1',
+          badgeColor: 'blue',
+          createdAt: 1,
+          updatedAt: 1,
           sourceRepoIds: ['repo-1'],
           localWindowsRuntimePreference: { kind: 'windows-host' }
         }
diff --git a/src/renderer/src/store/slices/diffComments.test.ts b/src/renderer/src/store/slices/diffComments.test.ts
index 49c0ae51b65..c6908d4ad6a 100644
--- a/src/renderer/src/store/slices/diffComments.test.ts
+++ b/src/renderer/src/store/slices/diffComments.test.ts
@@ -122,9 +122,11 @@ import { createEditorSlice } from './editor'
 import { createStatsSlice } from './stats'
 import { createMemorySlice } from './memory'
 import { createWorkspaceSpaceSlice } from './workspace-space'
-import { createClaudeUsageSlice } from './claude-usage'
-import { createCodexUsageSlice } from './codex-usage'
-import { createOpenCodeUsageSlice } from './opencode-usage'
+import {
+  createClaudeUsageSlice,
+  createCodexUsageSlice,
+  createOpenCodeUsageSlice
+} from './usage-provider-slices'
 import { createBrowserSlice } from './browser'
 import { createRateLimitSlice } from './rate-limits'
 import { createSshSlice } from './ssh'
diff --git a/src/renderer/src/store/slices/diffComments.ts b/src/renderer/src/store/slices/diffComments.ts
index 1154fd649b5..3af0505b031 100644
--- a/src/renderer/src/store/slices/diffComments.ts
+++ b/src/renderer/src/store/slices/diffComments.ts
@@ -1,12 +1,18 @@
 /* eslint-disable max-lines -- Why: keeps note mutation, rollback, persistence ordering, and sent-state transitions under shared queue/rollback invariants. */
 import type { StateCreator } from 'zustand'
 import type { AppState } from '../types'
-import type { DiffComment, Worktree } from '../../../../shared/types'
+import type { DiffComment, FolderWorkspace, Worktree } from '../../../../shared/types'
 import { findWorktreeById, getRepoIdFromWorktreeId } from './worktree-helpers'
 import { callRuntimeRpc, getActiveRuntimeTarget } from '../../runtime/runtime-rpc-client'
 import { toRuntimeWorktreeSelector } from '../../runtime/runtime-worktree-selector'
 import { createBrowserUuid } from '@/lib/browser-uuid'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import {
+  findFolderWorkspaceOwner,
+  getExecutionHostIdForFolderWorkspace,
+  getRuntimeEnvironmentIdForFolderWorkspace
+} from '@/lib/folder-workspace-runtime-owner'
+import { parseWorkspaceKey } from '../../../../shared/workspace-scope'
 
 export type DiffCommentsSlice = {
   getDiffComments: (worktreeId: string | null | undefined) => DiffComment[]
@@ -89,10 +95,41 @@ function deliverySnapshotMatches(
 const EMPTY_COMMENTS: readonly DiffComment[] = Object.freeze([])
 
 async function persist(
+  state: AppState,
   settings: AppState['settings'],
   worktreeId: string,
-  diffComments: DiffComment[]
+  diffComments: DiffComment[],
+  folderExecutionHostId?: ReturnType<typeof getExecutionHostIdForFolderWorkspace>
 ): Promise<void> {
+  const scope = parseWorkspaceKey(worktreeId)
+  if (scope?.type === 'folder') {
+    const executionHostId =
+      folderExecutionHostId ?? getExecutionHostIdForFolderWorkspace(state, scope.folderWorkspaceId)
+    const runtimeEnvironmentId = getRuntimeEnvironmentIdForFolderWorkspace(
+      state,
+      scope.folderWorkspaceId,
+      executionHostId
+    )
+    const target = getActiveRuntimeTarget({ activeRuntimeEnvironmentId: runtimeEnvironmentId })
+    const updated =
+      target.kind === 'local'
+        ? await window.api.folderWorkspaces.update({
+            folderWorkspaceId: scope.folderWorkspaceId,
+            updates: { diffComments }
+          })
+        : (
+            await callRuntimeRpc<{ folderWorkspace: FolderWorkspace | null }>(
+              target,
+              'folderWorkspace.update',
+              { folderWorkspaceId: scope.folderWorkspaceId, updates: { diffComments } },
+              { timeoutMs: 15_000 }
+            )
+          ).folderWorkspace
+    if (!updated?.diffComments) {
+      throw new Error('Failed to persist folder workspace review notes')
+    }
+    return
+  }
   const target = getActiveRuntimeTarget(settings)
   if (target.kind === 'local') {
     await window.api.worktrees.updateMeta({
@@ -117,26 +154,44 @@ function settingsForWorktreeOwner(state: AppState, worktreeId: string): AppState
 }
 
 // Why: IPC writes aren't ordered, so serialize per worktree to stop an older snapshot from overwriting a newer one on disk.
-const persistQueueByWorktree: Map<string, Promise<void>> = new Map()
+const persistQueueByWorktree = new Map<string, Promise<void>>()
 
 // Why: chain each write onto the prior promise so writes land in call order; both then handlers keep the chain alive past a failure.
 // Why: queued work reads the latest list at dequeue time, and the returned promise settles for THIS write so callers can roll back.
-function enqueuePersist(worktreeId: string, get: () => AppState): Promise<void> {
-  const prior = persistQueueByWorktree.get(worktreeId) ?? Promise.resolve()
+function enqueuePersist(
+  worktreeId: string,
+  get: () => AppState,
+  folderExecutionHostId?: ReturnType<typeof getExecutionHostIdForFolderWorkspace>
+): Promise<void> {
+  const queueKey = folderExecutionHostId ? `${folderExecutionHostId}\0${worktreeId}` : worktreeId
+  const prior = persistQueueByWorktree.get(queueKey) ?? Promise.resolve()
   const run = async (): Promise<void> => {
+    const scope = parseWorkspaceKey(worktreeId)
+    if (scope?.type === 'folder') {
+      const state = get()
+      const folderWorkspace = findFolderWorkspaceOwner(
+        state,
+        scope.folderWorkspaceId,
+        folderExecutionHostId
+      )
+      const latest = (folderWorkspace?.diffComments ?? []).map(normalizeDiffComment)
+      await persist(state, state.settings, worktreeId, latest, folderExecutionHostId)
+      return
+    }
     const repoId = getRepoIdFromWorktreeId(worktreeId)
     const repoList = get().worktreesByRepo[repoId]
     const target = repoList?.find((w) => w.id === worktreeId)
     const latest = (target?.diffComments ?? []).map(normalizeDiffComment)
-    await persist(settingsForWorktreeOwner(get(), worktreeId), worktreeId, latest)
+    const state = get()
+    await persist(state, settingsForWorktreeOwner(state, worktreeId), worktreeId, latest)
   }
   const next = prior.then(run, run)
-  persistQueueByWorktree.set(worktreeId, next)
+  persistQueueByWorktree.set(queueKey, next)
   // Why: clear the queue entry only if still the tail, so later enqueues chain onto the real in-flight promise.
   // Why: then(cleanup, cleanup) not finally, so a rejection is consumed here rather than re-thrown as unhandledRejection.
   const cleanup = (): void => {
-    if (persistQueueByWorktree.get(worktreeId) === next) {
-      persistQueueByWorktree.delete(worktreeId)
+    if (persistQueueByWorktree.get(queueKey) === next) {
+      persistQueueByWorktree.delete(queueKey)
     }
   }
   next.then(cleanup, cleanup)
@@ -148,11 +203,35 @@ function mutateComments(
   set: Parameters<StateCreator<AppState, [], [], DiffCommentsSlice>>[0],
   worktreeId: string,
   mutate: (existing: DiffComment[]) => DiffComment[] | null
-): { previous: DiffComment[] | undefined; next: DiffComment[] } | null {
+): {
+  previous: DiffComment[] | undefined
+  next: DiffComment[]
+  folderExecutionHostId?: ReturnType<typeof getExecutionHostIdForFolderWorkspace>
+} | null {
   const repoId = getRepoIdFromWorktreeId(worktreeId)
   let previous: DiffComment[] | undefined
   let next: DiffComment[] | null = null
+  let folderExecutionHostId: ReturnType<typeof getExecutionHostIdForFolderWorkspace> | undefined
   set((s) => {
+    const scope = parseWorkspaceKey(worktreeId)
+    if (scope?.type === 'folder') {
+      const target = findFolderWorkspaceOwner(s, scope.folderWorkspaceId)
+      if (!target) {
+        return {}
+      }
+      folderExecutionHostId = getExecutionHostIdForFolderWorkspace(s, scope.folderWorkspaceId)
+      previous = target.diffComments
+      const computed = mutate(previous ?? [])
+      if (computed === null) {
+        return {}
+      }
+      next = computed
+      return {
+        folderWorkspaces: s.folderWorkspaces.map((workspace) =>
+          workspace === target ? { ...workspace, diffComments: computed } : workspace
+        )
+      }
+    }
     const repoList = s.worktreesByRepo[repoId]
     if (!repoList) {
       return {}
@@ -175,7 +254,7 @@ function mutateComments(
   if (next === null) {
     return null
   }
-  return { previous, next }
+  return { previous, next, folderExecutionHostId }
 }
 
 // Why: on IPC-write failure, roll back optimistic state so the renderer matches disk (identity-guarded below).
@@ -183,10 +262,23 @@ function rollback(
   set: Parameters<StateCreator<AppState, [], [], DiffCommentsSlice>>[0],
   worktreeId: string,
   previous: DiffComment[] | undefined,
-  expectedCurrent: DiffComment[]
+  expectedCurrent: DiffComment[],
+  folderExecutionHostId?: ReturnType<typeof getExecutionHostIdForFolderWorkspace>
 ): void {
   const repoId = getRepoIdFromWorktreeId(worktreeId)
   set((s) => {
+    const scope = parseWorkspaceKey(worktreeId)
+    if (scope?.type === 'folder') {
+      const target = findFolderWorkspaceOwner(s, scope.folderWorkspaceId, folderExecutionHostId)
+      if (!target || target.diffComments !== expectedCurrent) {
+        return {}
+      }
+      return {
+        folderWorkspaces: s.folderWorkspaces.map((workspace) =>
+          workspace === target ? { ...workspace, diffComments: previous } : workspace
+        )
+      }
+    }
     const repoList = s.worktreesByRepo[repoId]
     if (!repoList) {
       return {}
@@ -216,7 +308,11 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
     if (!worktreeId) {
       return EMPTY_COMMENTS as DiffComment[]
     }
-    const worktree = findWorktreeById(get().worktreesByRepo, worktreeId)
+    const scope = parseWorkspaceKey(worktreeId)
+    const worktree =
+      scope?.type === 'folder'
+        ? findFolderWorkspaceOwner(get(), scope.folderWorkspaceId)
+        : findWorktreeById(get().worktreesByRepo, worktreeId)
     if (!worktree?.diffComments) {
       // Why: cast the frozen sentinel to the mutable return type; runtime freeze makes accidental mutation throw.
       return EMPTY_COMMENTS as DiffComment[]
@@ -236,13 +332,13 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
     }
     try {
       // Why: serialize through the per-worktree queue so concurrent writes can't land on disk out of call order.
-      await enqueuePersist(input.worktreeId, get)
+      await enqueuePersist(input.worktreeId, get, result.folderExecutionHostId)
       get().recordFeatureInteraction?.('review-notes')
       return comment
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
       // Why: rollback's identity guard no-ops if a later mutation already replaced the list, so a newer write can't be lost.
-      rollback(set, input.worktreeId, result.previous, result.next)
+      rollback(set, input.worktreeId, result.previous, result.next, result.folderExecutionHostId)
       return null
     }
   },
@@ -255,10 +351,7 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
     }
 
     // Why: distinguish "comment missing" (false; keep draft, likely edit-while-deleted) from "body unchanged" (true; close editor) before mutating.
-    const repoId = getRepoIdFromWorktreeId(worktreeId)
-    const repoList = get().worktreesByRepo[repoId]
-    const target = repoList?.find((w) => w.id === worktreeId)
-    const existing = target?.diffComments ?? []
+    const existing = get().getDiffComments(worktreeId)
     const existingIdx = existing.findIndex((c) => c.id === commentId)
     if (existingIdx === -1) {
       return false
@@ -285,11 +378,11 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
       return true
     }
     try {
-      await enqueuePersist(worktreeId, get)
+      await enqueuePersist(worktreeId, get, result.folderExecutionHostId)
       return true
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      rollback(set, worktreeId, result.previous, result.next)
+      rollback(set, worktreeId, result.previous, result.next, result.folderExecutionHostId)
       return false
     }
   },
@@ -311,12 +404,12 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
       return true
     }
     try {
-      await enqueuePersist(worktreeId, get)
+      await enqueuePersist(worktreeId, get, result.folderExecutionHostId)
       get().recordFeatureInteraction?.('review-notes')
       return true
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      rollback(set, worktreeId, result.previous, result.next)
+      rollback(set, worktreeId, result.previous, result.next, result.folderExecutionHostId)
       return false
     }
   },
@@ -341,12 +434,12 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
       return true
     }
     try {
-      await enqueuePersist(worktreeId, get)
+      await enqueuePersist(worktreeId, get, result.folderExecutionHostId)
       get().recordFeatureInteraction?.('review-notes')
       return true
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      rollback(set, worktreeId, result.previous, result.next)
+      rollback(set, worktreeId, result.previous, result.next, result.folderExecutionHostId)
       return false
     }
   },
@@ -361,10 +454,10 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
     }
     try {
       // Why: serialize through the per-worktree queue so concurrent writes can't land out of call order.
-      await enqueuePersist(worktreeId, get)
+      await enqueuePersist(worktreeId, get, result.folderExecutionHostId)
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      rollback(set, worktreeId, result.previous, result.next)
+      rollback(set, worktreeId, result.previous, result.next, result.folderExecutionHostId)
     }
   },
 
@@ -376,11 +469,11 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
       return true
     }
     try {
-      await enqueuePersist(worktreeId, get)
+      await enqueuePersist(worktreeId, get, result.folderExecutionHostId)
       return true
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      rollback(set, worktreeId, result.previous, result.next)
+      rollback(set, worktreeId, result.previous, result.next, result.folderExecutionHostId)
       return false
     }
   },
@@ -394,11 +487,11 @@ export const createDiffCommentsSlice: StateCreator<AppState, [], [], DiffComment
       return true
     }
     try {
-      await enqueuePersist(worktreeId, get)
+      await enqueuePersist(worktreeId, get, result.folderExecutionHostId)
       return true
     } catch (err) {
       console.error('Failed to persist diff comments:', err)
-      rollback(set, worktreeId, result.previous, result.next)
+      rollback(set, worktreeId, result.previous, result.next, result.folderExecutionHostId)
       return false
     }
   }
diff --git a/src/renderer/src/store/slices/editor.test.ts b/src/renderer/src/store/slices/editor.test.ts
index 8b87ee976c7..50530c90382 100644
--- a/src/renderer/src/store/slices/editor.test.ts
+++ b/src/renderer/src/store/slices/editor.test.ts
@@ -713,6 +713,136 @@ describe('createEditorSlice openDiff', () => {
     expect(store.getState().openFiles[0]?.fileContentReloadNonce).toBe(2)
   })
 
+  it('reuses a restored local WSL alias without folding the Linux path tail', () => {
+    vi.stubGlobal('navigator', { userAgent: 'Windows' })
+    const store = createEditorStore()
+    const restoredPath = '//wsl.localhost/Ubuntu/home/Alice/repo/file.ts'
+    store.setState({
+      openFiles: [
+        {
+          id: restoredPath,
+          filePath: restoredPath,
+          relativePath: 'file.ts',
+          worktreeId: 'wt-1',
+          runtimeEnvironmentId: null,
+          language: 'typescript',
+          isDirty: false,
+          mode: 'edit'
+        }
+      ]
+    })
+
+    expect(
+      store.getState().openFile(
+        {
+          filePath: '\\\\wsl.localhost\\ubuntu\\home\\Alice\\repo\\file.ts',
+          relativePath: 'file.ts',
+          worktreeId: 'wt-1',
+          runtimeEnvironmentId: null,
+          language: 'typescript',
+          mode: 'edit'
+        },
+        { suppressActiveRuntimeFallback: true }
+      )
+    ).toBe(restoredPath)
+    expect(store.getState().openFiles).toHaveLength(1)
+
+    store.getState().openFile(
+      {
+        filePath: '\\\\wsl.localhost\\Ubuntu\\home\\alice\\repo\\file.ts',
+        relativePath: 'file.ts',
+        worktreeId: 'wt-1',
+        runtimeEnvironmentId: null,
+        language: 'typescript',
+        mode: 'edit'
+      },
+      { suppressActiveRuntimeFallback: true }
+    )
+    expect(store.getState().openFiles).toHaveLength(2)
+    vi.unstubAllGlobals()
+  })
+
+  it('keeps local WSL-looking aliases distinct on POSIX clients', () => {
+    vi.stubGlobal('navigator', { userAgent: 'Linux' })
+    const store = createEditorStore()
+    store.setState({
+      openFiles: [
+        {
+          id: 'forward',
+          filePath: '//wsl.localhost/Ubuntu/repo/file.ts',
+          relativePath: 'file.ts',
+          worktreeId: 'wt-1',
+          runtimeEnvironmentId: null,
+          language: 'typescript',
+          isDirty: false,
+          mode: 'edit'
+        }
+      ]
+    })
+
+    store.getState().openFile(
+      {
+        filePath: '\\\\wsl.localhost\\Ubuntu\\repo\\file.ts',
+        relativePath: 'file.ts',
+        worktreeId: 'wt-1',
+        runtimeEnvironmentId: null,
+        language: 'typescript',
+        mode: 'edit'
+      },
+      { suppressActiveRuntimeFallback: true }
+    )
+
+    expect(store.getState().openFiles).toHaveLength(2)
+    vi.unstubAllGlobals()
+  })
+
+  it('does not reuse WSL aliases for SSH-owned tabs', () => {
+    const store = createEditorStore()
+    store.setState({
+      repos: [{ id: 'repo-1', path: '/repo', connectionId: 'ssh-1' }],
+      worktreesByRepo: {
+        'repo-1': [{ id: 'wt-1', repoId: 'repo-1', path: '/repo', hostId: 'ssh:ssh-1' }]
+      },
+      sshConnectionStates: new Map([
+        [
+          'ssh-1',
+          {
+            targetId: 'ssh-1',
+            status: 'connected',
+            error: null,
+            reconnectAttempt: 0,
+            connectionGeneration: 1
+          }
+        ]
+      ]),
+      openFiles: [
+        {
+          id: 'ssh-forward',
+          filePath: '//wsl.localhost/Ubuntu/repo/file.ts',
+          relativePath: 'file.ts',
+          worktreeId: 'wt-1',
+          runtimeEnvironmentId: null,
+          externalSshTargetId: 'ssh-1',
+          language: 'typescript',
+          isDirty: false,
+          mode: 'edit'
+        }
+      ]
+    } as never)
+
+    store.getState().openFile({
+      filePath: '\\\\wsl.localhost\\Ubuntu\\repo\\file.ts',
+      relativePath: 'file.ts',
+      worktreeId: 'wt-1',
+      runtimeEnvironmentId: null,
+      externalSshTargetId: 'ssh-1',
+      language: 'typescript',
+      mode: 'edit'
+    })
+
+    expect(store.getState().openFiles).toHaveLength(2)
+  })
+
   it('rebinds an existing external tab when it is reopened from a new SSH host', () => {
     const store = createEditorStore()
     const file = {
@@ -3080,18 +3210,24 @@ describe('createEditorSlice conflict status reconciliation', () => {
       url: null,
       checkRunId: 42
     }
+    const githubRepository = { owner: 'upstream', repo: 'project' }
 
     store.getState().openCheckRunDetails('wt-1', 'repo:99', check, {
       details: null,
       loading: false,
-      error: null
+      error: null,
+      githubRepository
     })
 
     await store.getState().reloadOpenCheckRunDetailsTab('wt-1::check-details::check-run:42')
 
     expect(fetchPRCheckDetails).toHaveBeenCalledWith(
       '/repo',
-      expect.objectContaining({ checkRunId: 42, checkName: 'verify' }),
+      expect.objectContaining({
+        checkRunId: 42,
+        checkName: 'verify',
+        prRepo: githubRepository
+      }),
       { repoId: 'repo-1' }
     )
     expect(store.getState().openFiles).toContainEqual(
@@ -3105,6 +3241,43 @@ describe('createEditorSlice conflict status reconciliation', () => {
     )
   })
 
+  it('stops loading when an open check-details tab loses its repository', async () => {
+    const fetchPRCheckDetails = vi.fn()
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const store = createStore<any>()((...args: any[]) => ({
+      activeWorktreeId: 'wt-1',
+      repos: [],
+      worktreesByRepo: {},
+      fetchPRCheckDetails,
+      ...createEditorSlice(...(args as Parameters<typeof createEditorSlice>))
+    })) as unknown as StoreApi<AppState>
+    const check = {
+      name: 'verify',
+      status: 'completed' as const,
+      conclusion: 'failure' as const,
+      url: null,
+      checkRunId: 42
+    }
+
+    store.getState().openCheckRunDetails('wt-1', 'repo:99', check, {
+      details: null,
+      loading: true,
+      error: null
+    })
+    await store.getState().reloadOpenCheckRunDetailsTab('wt-1::check-details::check-run:42')
+
+    expect(fetchPRCheckDetails).not.toHaveBeenCalled()
+    expect(store.getState().openFiles).toContainEqual(
+      expect.objectContaining({
+        id: 'wt-1::check-details::check-run:42',
+        checkRunDetails: expect.objectContaining({
+          loading: false,
+          error: 'Repository details are unavailable for this check.'
+        })
+      })
+    )
+  })
+
   // Regression for #7732: refreshing a GitLab job tab through the GitHub check-runs
   // API returns null and blanks the tab the user just asked to reload.
   it('reloads an open GitLab job tab through the job trace client', async () => {
@@ -3304,6 +3477,112 @@ describe('createEditorSlice conflict status reconciliation', () => {
     )
   })
 
+  it('ignores a stale check-details request after the tab context changes', () => {
+    const store = createEditorTabsStore()
+    const check = {
+      name: 'verify',
+      status: 'completed' as const,
+      conclusion: 'failure' as const,
+      url: null,
+      checkRunId: 42
+    }
+
+    store.getState().openCheckRunDetails('wt-1', 'repo:old', check, {
+      details: null,
+      loading: true,
+      error: null
+    })
+    store.getState().openCheckRunDetails('wt-1', 'repo:new', check, {
+      details: null,
+      loading: true,
+      error: null
+    })
+    store.getState().patchOpenCheckRunDetails('wt-1', 'repo:old', check, {
+      details: null,
+      loading: false,
+      error: 'stale request failed'
+    })
+
+    expect(
+      store.getState().openFiles.find((file) => file.id === 'wt-1::check-details::check-run:42')
+        ?.checkRunDetails
+    ).toEqual(
+      expect.objectContaining({ contextKey: 'repo:new', details: null, loading: true, error: null })
+    )
+  })
+
+  it('ignores an older check-details request in the same context', () => {
+    const store = createEditorTabsStore()
+    const check = {
+      name: 'verify',
+      status: 'completed' as const,
+      conclusion: 'failure' as const,
+      url: null,
+      checkRunId: 42
+    }
+
+    store.getState().openCheckRunDetails('wt-1', 'repo:99', check, {
+      requestId: 1,
+      details: null,
+      loading: true,
+      error: null
+    })
+    store.getState().patchOpenCheckRunDetails('wt-1', 'repo:99', check, {
+      requestId: 2,
+      details: null,
+      loading: true,
+      error: null
+    })
+    store.getState().patchOpenCheckRunDetails('wt-1', 'repo:99', check, {
+      requestId: 1,
+      details: null,
+      loading: false,
+      error: 'stale request failed'
+    })
+
+    expect(
+      store.getState().openFiles.find((file) => file.id === 'wt-1::check-details::check-run:42')
+        ?.checkRunDetails
+    ).toEqual(expect.objectContaining({ requestId: 2, details: null, loading: true, error: null }))
+  })
+
+  it('does not reopen a check-details tab with an older sidebar snapshot', () => {
+    const store = createEditorTabsStore()
+    const check = {
+      name: 'verify',
+      status: 'completed' as const,
+      conclusion: 'failure' as const,
+      url: null,
+      checkRunId: 42
+    }
+
+    store.getState().openCheckRunDetails('wt-1', 'repo:99', check, {
+      requestId: 2,
+      details: null,
+      loading: false,
+      error: 'newer result'
+    })
+    store.getState().openFile({
+      filePath: '/repo/other.ts',
+      relativePath: 'other.ts',
+      worktreeId: 'wt-1',
+      language: 'typescript',
+      mode: 'edit'
+    })
+    store.getState().openCheckRunDetails('wt-1', 'repo:99', check, {
+      requestId: 1,
+      details: null,
+      loading: false,
+      error: 'stale result'
+    })
+
+    expect(store.getState().activeFileId).toBe('wt-1::check-details::check-run:42')
+    expect(
+      store.getState().openFiles.find((file) => file.id === 'wt-1::check-details::check-run:42')
+        ?.checkRunDetails
+    ).toEqual(expect.objectContaining({ requestId: 2, error: 'newer result' }))
+  })
+
   it('opens check full details as a center-pane editor tab', () => {
     const store = createEditorTabsStore()
     const check = {
diff --git a/src/renderer/src/store/slices/editor.ts b/src/renderer/src/store/slices/editor.ts
index 971ab20cba6..4b2efe9516a 100644
--- a/src/renderer/src/store/slices/editor.ts
+++ b/src/renderer/src/store/slices/editor.ts
@@ -10,11 +10,16 @@ import {
 import type { RecentlyClosedTabPosition } from './recently-closed-tabs'
 import { joinPath } from '@/lib/path'
 import { toast } from 'sonner'
-import { isPathInsideOrEqual } from '../../../../shared/cross-platform-path'
+import {
+  areLocalWindowsWslPathAliases,
+  isPathInsideOrEqual
+} from '../../../../shared/cross-platform-path'
 import { resolveMarkdownLinkTarget } from '@/components/editor/markdown-internal-links'
 import {
   buildCheckRunDetailsTabId,
+  createCheckRunDetailsRequestId,
   getCheckRunDetailsTabLabel,
+  isSameGitHubRepository,
   isSameGitLabProjectRef,
   type CheckRunDetailsTabPatch,
   type OpenCheckRunDetailsState
@@ -105,6 +110,7 @@ import {
 import { createBrowserUuid } from '@/lib/browser-uuid'
 import { pruneTabGroupLayoutForGroups } from './tabs-hydration'
 import { sanitizeRecentTabIds } from './tab-group-state'
+import { isLocalWindowsDesktopClient } from '@/lib/desktop-window-chrome'
 
 export type {
   ActiveRightSidebarTab,
@@ -1025,6 +1031,23 @@ function isSameEditorOwner(
   )
 }
 
+function canReuseLocalWslAlias(
+  state: AppState,
+  existing: OpenFile,
+  file: Pick<OpenFile, 'filePath' | 'worktreeId' | 'runtimeEnvironmentId' | 'externalSshTargetId'>,
+  runtimeEnvironmentId: string | null | undefined
+): boolean {
+  return (
+    isLocalWindowsDesktopClient() &&
+    runtimeOwnerKey(runtimeEnvironmentId) === null &&
+    !existing.externalSshTargetId?.trim() &&
+    !file.externalSshTargetId?.trim() &&
+    areLocalWindowsWslPathAliases(existing.filePath, file.filePath) &&
+    getConnectionIdForFileFromState(state, file.worktreeId, file.filePath) === null &&
+    getConnectionIdForFileFromState(state, existing.worktreeId, existing.filePath) === null
+  )
+}
+
 export function buildOwnedEditorFileId(
   filePath: string,
   worktreeId: string,
@@ -1743,9 +1766,9 @@ export const createEditorSlice: StateCreator<AppState, [], [], EditorSlice> = (s
       const reusableOpenFileModes = getReusableOpenFileModes(file.mode)
       const existing = s.openFiles.find(
         (f) =>
-          f.filePath === file.filePath &&
           matchesEditorMode(f, reusableOpenFileModes) &&
-          isSameEditorOwner(f, worktreeId, runtimeEnvironmentId)
+          isSameEditorOwner(f, worktreeId, runtimeEnvironmentId) &&
+          (f.filePath === file.filePath || canReuseLocalWslAlias(s, f, file, runtimeEnvironmentId))
       )
       // Why: a snapshot's reopenId can be a stale shape — the same path is bare in whichever worktree opened it first and namespaced elsewhere — so honoring it while this owner's tab is already open would strand activeFileId and the unified tab on an id no OpenFile has.
       const id = existing
@@ -3802,14 +3825,21 @@ export const createEditorSlice: StateCreator<AppState, [], [], EditorSlice> = (s
     const checkRunDetails: OpenCheckRunDetailsState = {
       contextKey,
       check,
+      requestId: state.requestId,
       details: state.details,
       loading: state.loading,
       error: state.error,
+      githubRepository: state.githubRepository ?? null,
       gitlabProjectRef: state.gitlabProjectRef ?? null
     }
     set((s) => {
       const existing = s.openFiles.find((f) => f.id === id)
       if (existing) {
+        const existingDetails = existing.checkRunDetails
+        const incomingIsStale =
+          existingDetails?.contextKey === contextKey &&
+          existingDetails.requestId !== undefined &&
+          (state.requestId === undefined || state.requestId < existingDetails.requestId)
         return {
           openFiles: s.openFiles.map((f) =>
             f.id === id
@@ -3818,7 +3848,7 @@ export const createEditorSlice: StateCreator<AppState, [], [], EditorSlice> = (s
                   mode: 'check-details' as const,
                   relativePath: label,
                   language: 'plaintext',
-                  checkRunDetails
+                  checkRunDetails: incomingIsStale ? existingDetails : checkRunDetails
                 }
               : f
           ),
@@ -3860,24 +3890,39 @@ export const createEditorSlice: StateCreator<AppState, [], [], EditorSlice> = (s
         return s
       }
       const current = existing.checkRunDetails
+      if (current.contextKey !== contextKey) {
+        return s
+      }
+      if (
+        state.requestId !== undefined &&
+        current.requestId !== undefined &&
+        state.requestId < current.requestId
+      ) {
+        return s
+      }
       // Why: the sidebar resolves the MR's project asynchronously, so an early patch
       // must not blank a ref we already know.
+      const githubRepository = state.githubRepository ?? current.githubRepository ?? null
       const gitlabProjectRef = state.gitlabProjectRef ?? current.gitlabProjectRef ?? null
       const nextCheckRunDetails: OpenCheckRunDetailsState = {
         contextKey,
         check,
+        requestId: state.requestId ?? current.requestId,
         details: state.details,
         loading: state.loading,
         error: state.error,
+        githubRepository,
         gitlabProjectRef
       }
       if (
         current.contextKey === nextCheckRunDetails.contextKey &&
+        current.requestId === nextCheckRunDetails.requestId &&
         current.check.status === nextCheckRunDetails.check.status &&
         current.check.conclusion === nextCheckRunDetails.check.conclusion &&
         current.loading === nextCheckRunDetails.loading &&
         current.error === nextCheckRunDetails.error &&
         current.details === nextCheckRunDetails.details &&
+        isSameGitHubRepository(current.githubRepository ?? null, githubRepository) &&
         isSameGitLabProjectRef(current.gitlabProjectRef ?? null, gitlabProjectRef)
       ) {
         return s
@@ -3897,16 +3942,25 @@ export const createEditorSlice: StateCreator<AppState, [], [], EditorSlice> = (s
     if (!file || file.mode !== 'check-details' || !checkRunDetails) {
       return
     }
+    const { contextKey, check } = checkRunDetails
+    const requestId = createCheckRunDetailsRequestId()
+    const patch = (next: CheckRunDetailsTabPatch): void => {
+      get().patchOpenCheckRunDetails(file.worktreeId, contextKey, check, { ...next, requestId })
+    }
     const worktree = findWorktreeById(state.worktreesByRepo, file.worktreeId)
     const repoId = worktree?.repoId ?? getRepoIdFromWorktreeId(file.worktreeId)
     const repo = state.repos.find((candidate) => candidate.id === repoId)
     if (!repo?.path) {
+      patch({
+        details: checkRunDetails.details,
+        loading: false,
+        error: translate(
+          'auto.store.slices.editor.checkRunDetailsRepoUnavailable',
+          'Repository details are unavailable for this check.'
+        )
+      })
       return
     }
-    const { contextKey, check } = checkRunDetails
-    const patch = (next: CheckRunDetailsTabPatch): void => {
-      get().patchOpenCheckRunDetails(file.worktreeId, contextKey, check, next)
-    }
     patch({ details: checkRunDetails.details, loading: true, error: null })
     try {
       // Why: refreshing a GitLab job tab through the GitHub check-runs API returns
@@ -3927,7 +3981,7 @@ export const createEditorSlice: StateCreator<AppState, [], [], EditorSlice> = (s
               workflowRunId: check.workflowRunId,
               checkName: check.name,
               url: check.url,
-              prRepo: null
+              prRepo: checkRunDetails.githubRepository ?? null
             },
             { repoId: repo.id }
           )
@@ -4109,7 +4163,7 @@ export const createEditorSlice: StateCreator<AppState, [], [], EditorSlice> = (s
   // Why: session-local conflict tracking (Resolved-locally) lives only in the renderer; main returns raw git status, so the renderer owns conflictStatusSource.
   setGitStatus: (worktreeId, status) =>
     set((s) => {
-      const hadStatusEntry = Object.prototype.hasOwnProperty.call(s.gitStatusByWorktree, worktreeId)
+      const hadStatusEntry = Object.hasOwn(s.gitStatusByWorktree, worktreeId)
       const prevEntries = s.gitStatusByWorktree[worktreeId] ?? []
       const prevOperation = s.gitConflictOperationByWorktree[worktreeId] ?? 'unknown'
       const currentTracked = { ...s.trackedConflictPathsByWorktree[worktreeId] }
diff --git a/src/renderer/src/store/slices/folder-workspace-diff-comments.test.ts b/src/renderer/src/store/slices/folder-workspace-diff-comments.test.ts
new file mode 100644
index 00000000000..12efee134c3
--- /dev/null
+++ b/src/renderer/src/store/slices/folder-workspace-diff-comments.test.ts
@@ -0,0 +1,243 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { create } from 'zustand'
+import type { AppState } from '../types'
+import type { FolderWorkspace, ProjectGroup } from '../../../../shared/types'
+import { folderWorkspaceKey } from '../../../../shared/workspace-scope'
+import {
+  createCompatibleRuntimeStatusResponseIfNeeded,
+  type RuntimeEnvironmentCallRequest
+} from '../../runtime/runtime-compatibility-test-fixture'
+import { clearRuntimeCompatibilityCacheForTests } from '../../runtime/runtime-rpc-client'
+import { createDiffCommentsSlice } from './diffComments'
+
+const runtimeEnvironmentCall = vi.fn()
+const runtimeEnvironmentTransportCall = vi.fn()
+const folderWorkspacesUpdate = vi.fn()
+
+globalThis.window = {
+  api: {
+    folderWorkspaces: { update: folderWorkspacesUpdate },
+    runtimeEnvironments: { call: runtimeEnvironmentTransportCall }
+  }
+} as never
+
+function createTestStore() {
+  return create<AppState>()((...args) => {
+    const slice = createDiffCommentsSlice(...args)
+    return {
+      ...slice,
+      settings: null,
+      activeWorktreeId: null,
+      activeWorkspaceExecutionHostId: null,
+      folderWorkspaces: [],
+      projectGroups: [],
+      runtimeEnvironments: [],
+      restoredRuntimeHostIdByWorkspaceSessionKey: {},
+      worktreesByRepo: {}
+    } as unknown as AppState
+  })
+}
+
+function makeFolderWorkspace(overrides: Partial<FolderWorkspace> = {}): FolderWorkspace {
+  return {
+    id: 'folder-1',
+    projectGroupId: 'group-1',
+    folderPath: '/workspace',
+    executionHostId: 'local',
+    diffComments: [],
+    ...overrides
+  } as FolderWorkspace
+}
+
+function seedLocalFolderWorkspace(store: ReturnType<typeof createTestStore>): FolderWorkspace {
+  const folderWorkspace = makeFolderWorkspace()
+  const projectGroup = {
+    id: folderWorkspace.projectGroupId,
+    parentPath: '/workspace',
+    executionHostId: 'local'
+  } as ProjectGroup
+  store.setState({
+    activeWorktreeId: folderWorkspaceKey(folderWorkspace.id),
+    activeWorkspaceExecutionHostId: 'local',
+    projectGroups: [projectGroup],
+    folderWorkspaces: [folderWorkspace]
+  })
+  return folderWorkspace
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  clearRuntimeCompatibilityCacheForTests()
+  runtimeEnvironmentTransportCall.mockImplementation((args: RuntimeEnvironmentCallRequest) => {
+    return createCompatibleRuntimeStatusResponseIfNeeded(args) ?? runtimeEnvironmentCall(args)
+  })
+})
+
+describe('folder workspace diff comments', () => {
+  it('adds and persists a review note', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    folderWorkspacesUpdate.mockImplementation(async ({ updates }) => ({
+      ...folderWorkspace,
+      ...updates
+    }))
+
+    const saved = await store.getState().addDiffComment({
+      worktreeId: folderWorkspaceKey(folderWorkspace.id),
+      filePath: 'README.md',
+      source: 'markdown',
+      lineNumber: 1,
+      body: 'folder note',
+      side: 'modified'
+    })
+
+    expect(saved).toEqual(expect.objectContaining({ body: 'folder note' }))
+    expect(store.getState().getDiffComments(folderWorkspaceKey(folderWorkspace.id))).toEqual([
+      expect.objectContaining({ body: 'folder note' })
+    ])
+    expect(folderWorkspacesUpdate).toHaveBeenCalledWith({
+      folderWorkspaceId: folderWorkspace.id,
+      updates: { diffComments: [expect.objectContaining({ body: 'folder note' })] }
+    })
+  })
+
+  it('preserves a second note while the first write is in flight', async () => {
+    const store = createTestStore()
+    const folderWorkspace = seedLocalFolderWorkspace(store)
+    let releaseFirstWrite: (() => void) | undefined
+    const firstWrite = new Promise<void>((resolve) => {
+      releaseFirstWrite = resolve
+    })
+    folderWorkspacesUpdate.mockImplementation(async ({ updates }) => {
+      if (folderWorkspacesUpdate.mock.calls.length === 1) {
+        await firstWrite
+      }
+      return { ...folderWorkspace, ...updates }
+    })
+
+    const addFirst = store.getState().addDiffComment({
+      worktreeId: folderWorkspaceKey(folderWorkspace.id),
+      filePath: 'README.md',
+      source: 'markdown',
+      lineNumber: 1,
+      body: 'first note',
+      side: 'modified'
+    })
+    await vi.waitFor(() => expect(folderWorkspacesUpdate).toHaveBeenCalledTimes(1))
+    const addSecond = store.getState().addDiffComment({
+      worktreeId: folderWorkspaceKey(folderWorkspace.id),
+      filePath: 'README.md',
+      source: 'markdown',
+      lineNumber: 2,
+      body: 'second note',
+      side: 'modified'
+    })
+    releaseFirstWrite?.()
+
+    await Promise.all([addFirst, addSecond])
+    expect(store.getState().getDiffComments(folderWorkspaceKey(folderWorkspace.id))).toEqual([
+      expect.objectContaining({ body: 'first note' }),
+      expect.objectContaining({ body: 'second note' })
+    ])
+    expect(folderWorkspacesUpdate).toHaveBeenLastCalledWith({
+      folderWorkspaceId: folderWorkspace.id,
+      updates: {
+        diffComments: [
+          expect.objectContaining({ body: 'first note' }),
+          expect.objectContaining({ body: 'second note' })
+        ]
+      }
+    })
+  })
+
+  it('keeps same-id writes scoped to their original hosts', async () => {
+    const store = createTestStore()
+    const workspaceId = 'shared-folder-id'
+    const workspaceKey = folderWorkspaceKey(workspaceId)
+    const localWorkspace = makeFolderWorkspace({
+      id: workspaceId,
+      projectGroupId: 'local-group',
+      folderPath: '/workspace/local'
+    })
+    const runtimeWorkspace = makeFolderWorkspace({
+      id: workspaceId,
+      projectGroupId: 'runtime-group',
+      folderPath: '/workspace/runtime',
+      executionHostId: 'runtime:env-owner'
+    })
+    let resolveLocal!: () => void
+    folderWorkspacesUpdate.mockImplementation(
+      ({ updates }) =>
+        new Promise<FolderWorkspace>((resolve) => {
+          resolveLocal = () => resolve({ ...localWorkspace, ...updates })
+        })
+    )
+    runtimeEnvironmentCall.mockImplementation(async (args: RuntimeEnvironmentCallRequest) => ({
+      id: 'rpc-folder-update',
+      ok: true,
+      result: {
+        folderWorkspace: {
+          ...runtimeWorkspace,
+          ...(
+            args as RuntimeEnvironmentCallRequest & {
+              params: { updates?: Partial<FolderWorkspace> }
+            }
+          ).params.updates
+        }
+      },
+      _meta: { runtimeId: 'remote-runtime' }
+    }))
+    store.setState({
+      activeWorktreeId: workspaceKey,
+      activeWorkspaceExecutionHostId: 'local',
+      folderWorkspaces: [localWorkspace, runtimeWorkspace]
+    })
+
+    const localAdd = store.getState().addDiffComment({
+      worktreeId: workspaceKey,
+      filePath: 'LOCAL.md',
+      source: 'markdown',
+      lineNumber: 1,
+      body: 'local note',
+      side: 'modified'
+    })
+    await vi.waitFor(() => expect(folderWorkspacesUpdate).toHaveBeenCalledOnce())
+
+    store.setState({ activeWorkspaceExecutionHostId: 'runtime:env-owner' })
+    const runtimeAdd = store.getState().addDiffComment({
+      worktreeId: workspaceKey,
+      filePath: 'REMOTE.md',
+      source: 'markdown',
+      lineNumber: 1,
+      body: 'runtime note',
+      side: 'modified'
+    })
+    await vi.waitFor(() =>
+      expect(runtimeEnvironmentCall).toHaveBeenCalledWith(
+        expect.objectContaining({
+          selector: 'env-owner',
+          method: 'folderWorkspace.update',
+          params: expect.objectContaining({
+            updates: {
+              diffComments: [expect.objectContaining({ body: 'runtime note' })]
+            }
+          })
+        })
+      )
+    )
+
+    store.setState({ activeWorkspaceExecutionHostId: 'local' })
+    resolveLocal()
+    await expect(Promise.all([localAdd, runtimeAdd])).resolves.toEqual([
+      expect.objectContaining({ body: 'local note' }),
+      expect.objectContaining({ body: 'runtime note' })
+    ])
+    expect(store.getState().getDiffComments(workspaceKey)).toEqual([
+      expect.objectContaining({ body: 'local note' })
+    ])
+    store.setState({ activeWorkspaceExecutionHostId: 'runtime:env-owner' })
+    expect(store.getState().getDiffComments(workspaceKey)).toEqual([
+      expect.objectContaining({ body: 'runtime note' })
+    ])
+  })
+})
diff --git a/src/renderer/src/store/slices/github-repo-lookup-index.test.ts b/src/renderer/src/store/slices/github-repo-lookup-index.test.ts
new file mode 100644
index 00000000000..41918b28c07
--- /dev/null
+++ b/src/renderer/src/store/slices/github-repo-lookup-index.test.ts
@@ -0,0 +1,66 @@
+import { describe, expect, it } from 'vitest'
+import type { Repo } from '../../../../shared/types'
+import { getGitHubRepoLookupIndex } from './github-repo-lookup-index'
+
+function makeRepo(id: string, path: string): Repo {
+  return { id, path, displayName: id, badgeColor: 'blue', addedAt: 1, kind: 'git' }
+}
+
+describe('getGitHubRepoLookupIndex', () => {
+  it('retains the first duplicate after indexing later rows', () => {
+    const first = makeRepo('duplicate', '/first')
+    const second = makeRepo('duplicate', '/second')
+    const later = makeRepo('later', '/later')
+    const lookup = getGitHubRepoLookupIndex([first, second, later])
+
+    expect(lookup.findById('duplicate')).toBe(first)
+    expect(lookup.findById('later')).toBe(later)
+    expect(lookup.findById('duplicate')).toBe(first)
+  })
+
+  it('matches Array.find ordering for combined ID and path lookups', () => {
+    const pathMatch = makeRepo('other', '/target')
+    const idMatch = makeRepo('target', '/other')
+    const lookup = getGitHubRepoLookupIndex([pathMatch, idMatch])
+
+    expect(lookup.findByIdOrPath('target', '/target')).toBe(pathMatch)
+  })
+
+  it('scans each repo once across repeated misses', () => {
+    let idReads = 0
+    const repos = Array.from({ length: 32 }, (_, index) => {
+      const repo = makeRepo(`repo-${index}`, `/repo-${index}`)
+      return Object.defineProperty(repo, 'id', {
+        configurable: true,
+        enumerable: true,
+        get: () => {
+          idReads += 1
+          return `repo-${index}`
+        }
+      })
+    })
+    const lookup = getGitHubRepoLookupIndex(repos)
+
+    expect(lookup.findById('missing-first')).toBeUndefined()
+    expect(lookup.findById('missing-second')).toBeUndefined()
+    expect(idReads).toBe(repos.length)
+  })
+
+  it('stops after a sparse first-row match', () => {
+    let idReads = 0
+    const repos = Array.from({ length: 32 }, (_, index) => {
+      const repo = makeRepo(`repo-${index}`, `/repo-${index}`)
+      return Object.defineProperty(repo, 'id', {
+        configurable: true,
+        enumerable: true,
+        get: () => {
+          idReads += 1
+          return `repo-${index}`
+        }
+      })
+    })
+
+    expect(getGitHubRepoLookupIndex(repos).findById('repo-0')).toBe(repos[0])
+    expect(idReads).toBe(1)
+  })
+})
diff --git a/src/renderer/src/store/slices/github-repo-lookup-index.ts b/src/renderer/src/store/slices/github-repo-lookup-index.ts
new file mode 100644
index 00000000000..0c21a2fbd50
--- /dev/null
+++ b/src/renderer/src/store/slices/github-repo-lookup-index.ts
@@ -0,0 +1,72 @@
+import type { Repo } from '../../../../shared/types'
+
+type IndexedRepo = {
+  index: number
+  repo: Repo
+}
+
+export type GitHubRepoLookupIndex = {
+  findById: (repoId: string) => Repo | undefined
+  findByPath: (repoPath: string) => Repo | undefined
+  findByIdOrPath: (repoId: string | undefined, repoPath: string) => Repo | undefined
+}
+
+// Why: repo identity/path updates replace this array, while weak ownership avoids retaining superseded snapshots.
+const lookupByRepos = new WeakMap<readonly Repo[], GitHubRepoLookupIndex>()
+const EMPTY_REPOS: readonly Repo[] = []
+
+export function getGitHubRepoLookupIndex(
+  repos: readonly Repo[] | undefined
+): GitHubRepoLookupIndex {
+  const repoRows = repos ?? EMPTY_REPOS
+  const cached = lookupByRepos.get(repoRows)
+  if (cached) {
+    return cached
+  }
+
+  const byId = new Map<string, IndexedRepo>()
+  const byPath = new Map<string, IndexedRepo>()
+  let indexedCount = 0
+
+  const scanUntil = (matches: (repoId: string, repoPath: string) => boolean): Repo | undefined => {
+    while (indexedCount < repoRows.length) {
+      const index = indexedCount
+      const repo = repoRows[index]
+      indexedCount += 1
+      const repoId = repo.id
+      const repoPath = repo.path
+      if (!byId.has(repoId)) {
+        byId.set(repoId, { index, repo })
+      }
+      if (!byPath.has(repoPath)) {
+        byPath.set(repoPath, { index, repo })
+      }
+      if (matches(repoId, repoPath)) {
+        return repo
+      }
+    }
+    return undefined
+  }
+
+  const lookup: GitHubRepoLookupIndex = {
+    findById: (repoId) => byId.get(repoId)?.repo ?? scanUntil((id) => id === repoId),
+    findByPath: (repoPath) =>
+      byPath.get(repoPath)?.repo ?? scanUntil((_id, path) => path === repoPath),
+    findByIdOrPath: (repoId, repoPath) => {
+      if (!repoId) {
+        return lookup.findByPath(repoPath)
+      }
+      const idMatch = byId.get(repoId)
+      const pathMatch = byPath.get(repoPath)
+      if (idMatch || pathMatch) {
+        if (!pathMatch || (idMatch && idMatch.index < pathMatch.index)) {
+          return idMatch?.repo
+        }
+        return pathMatch.repo
+      }
+      return scanUntil((id, path) => id === repoId || path === repoPath)
+    }
+  }
+  lookupByRepos.set(repoRows, lookup)
+  return lookup
+}
diff --git a/src/renderer/src/store/slices/github.test.ts b/src/renderer/src/store/slices/github.test.ts
index cadbc5acb8f..5e5b0d61ccb 100644
--- a/src/renderer/src/store/slices/github.test.ts
+++ b/src/renderer/src/store/slices/github.test.ts
@@ -33,6 +33,7 @@ import { GITHUB_WORK_ITEMS_QUERY_MAX_BYTES } from './github-work-items-query-bou
 
 const runtimeEnvironmentCall = vi.fn()
 const runtimeEnvironmentTransportCall = vi.fn()
+const runtimeEnvironmentSubscribe = vi.fn()
 
 const mockApi = {
   gh: {
@@ -62,7 +63,8 @@ const mockApi = {
     create: vi.fn()
   },
   runtimeEnvironments: {
-    call: runtimeEnvironmentTransportCall
+    call: runtimeEnvironmentTransportCall,
+    subscribe: runtimeEnvironmentSubscribe
   },
   cache: {
     getGitHub: vi.fn().mockResolvedValue(null),
@@ -77,9 +79,30 @@ function resetRemoteRuntimeMocks() {
   clearRuntimeCompatibilityCacheForTests()
   runtimeEnvironmentCall.mockReset()
   runtimeEnvironmentTransportCall.mockReset()
+  runtimeEnvironmentSubscribe.mockReset()
   runtimeEnvironmentTransportCall.mockImplementation((args: RuntimeEnvironmentCallRequest) => {
     return createCompatibleRuntimeStatusResponseIfNeeded(args) ?? runtimeEnvironmentCall(args)
   })
+  runtimeEnvironmentSubscribe.mockImplementation(
+    async (
+      args: RuntimeEnvironmentCallRequest,
+      handlers: {
+        onResponse: (response: unknown) => void
+        onError: (error: { message: string }) => void
+      }
+    ) => {
+      let active = true
+      void Promise.resolve(runtimeEnvironmentCall(args)).then(
+        (response) => active && handlers.onResponse(response),
+        (error) => active && handlers.onError({ message: String(error) })
+      )
+      return {
+        unsubscribe: () => {
+          active = false
+        }
+      }
+    }
+  )
 }
 
 function createTestStore() {
@@ -1444,6 +1467,109 @@ describe('createGitHubSlice.fetchPRCheckDetails', () => {
     expect(mockApi.gh.prCheckDetails).not.toHaveBeenCalled()
   })
 
+  it('bounds the whole runtime check-detail load when compatibility probing stalls', async () => {
+    vi.useFakeTimers()
+    try {
+      runtimeEnvironmentTransportCall.mockImplementation(() => new Promise(() => {}))
+      const store = createTestStore()
+      const repoPath = '/repo'
+      const repoId = 'repo-id'
+
+      store.setState({
+        settings: { activeRuntimeEnvironmentId: 'env-1' } as AppState['settings'],
+        repos: [
+          {
+            id: repoId,
+            path: repoPath,
+            name: 'repo',
+            kind: 'git',
+            executionHostId: 'runtime:env-1'
+          }
+        ]
+      } as unknown as Partial<AppState>)
+
+      const request = store
+        .getState()
+        .fetchPRCheckDetails(repoPath, { checkRunId: 123, checkName: 'build' }, { repoId })
+      const rejection = expect(request).rejects.toThrow('Timed out loading check details.')
+
+      await vi.advanceTimersByTimeAsync(30_000)
+
+      await rejection
+      expect(runtimeEnvironmentCall).not.toHaveBeenCalled()
+      expect(mockApi.gh.prCheckDetails).not.toHaveBeenCalled()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('shares one timeout budget between runtime compatibility and check details', async () => {
+    vi.useFakeTimers()
+    try {
+      runtimeEnvironmentTransportCall.mockImplementation((args: RuntimeEnvironmentCallRequest) => {
+        const compatibility = createCompatibleRuntimeStatusResponseIfNeeded(args)
+        if (compatibility) {
+          return new Promise((resolve) => setTimeout(() => resolve(compatibility), 20_000))
+        }
+        return runtimeEnvironmentCall(args)
+      })
+      runtimeEnvironmentCall.mockImplementation(() => new Promise(() => {}))
+      const store = createTestStore()
+      const repoPath = '/repo'
+      const repoId = 'repo-id'
+      store.setState({
+        settings: { activeRuntimeEnvironmentId: 'env-1' } as AppState['settings'],
+        repos: [
+          {
+            id: repoId,
+            path: repoPath,
+            name: 'repo',
+            kind: 'git',
+            executionHostId: 'runtime:env-1'
+          }
+        ]
+      } as unknown as Partial<AppState>)
+
+      const request = store
+        .getState()
+        .fetchPRCheckDetails(repoPath, { checkRunId: 123, checkName: 'build' }, { repoId })
+      let settled = false
+      void request.then(
+        () => {
+          settled = true
+        },
+        () => {
+          settled = true
+        }
+      )
+      const rejection = expect(request).rejects.toThrow('Timed out loading check details.')
+
+      await vi.advanceTimersByTimeAsync(20_000)
+      expect(runtimeEnvironmentCall).toHaveBeenCalledWith({
+        selector: 'env-1',
+        method: 'github.prCheckDetails',
+        params: {
+          repo: repoId,
+          checkRunId: 123,
+          workflowRunId: undefined,
+          checkName: 'build',
+          url: undefined,
+          prRepo: null
+        },
+        timeoutMs: 30_000
+      })
+
+      await vi.advanceTimersByTimeAsync(9_999)
+      expect(settled).toBe(false)
+      await vi.advanceTimersByTimeAsync(1)
+
+      await rejection
+      expect(settled).toBe(true)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('loads known local repo check details through local IPC when a runtime is focused', async () => {
     const store = createTestStore()
     const repoPath = '/repo'
@@ -5425,6 +5551,447 @@ describe('createGitHubSlice.refreshGitHubForWorktreeIfStale', () => {
 describe('createGitHubSlice.refreshAllGitHub', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    resetRemoteRuntimeMocks()
+  })
+
+  it('publishes no store update when the cache sweep changes nothing', () => {
+    const store = createTestStore()
+    store.setState({
+      repos: [{ id: 'repo-1', path: '/repo', name: 'repo', kind: 'git' }],
+      groupBy: 'repo',
+      worktreeCardProperties: ['comment'],
+      rightSidebarOpen: false,
+      worktreesByRepo: { 'repo-1': [makePRRefreshWorktree()] }
+    } as unknown as Partial<AppState>)
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    store.getState().refreshAllGitHub()
+    unsubscribe()
+
+    expect(publications).toBe(0)
+  })
+
+  it('still clears populated comments when no workspace refresh is needed', () => {
+    const store = createTestStore()
+    store.setState({
+      commentsCache: { cached: { data: [], fetchedAt: 1 } },
+      groupBy: 'repo',
+      worktreeCardProperties: ['comment'],
+      rightSidebarOpen: false
+    } as unknown as Partial<AppState>)
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    store.getState().refreshAllGitHub()
+    unsubscribe()
+
+    expect(store.getState().commentsCache).toEqual({})
+    expect(publications).toBe(1)
+  })
+
+  it('skips repo and worktree identity reads when no GitHub decoration is visible', () => {
+    const store = createTestStore()
+    const repoId = 'repo-idle'
+    let repoIdentityReads = 0
+    let worktreeRepoIdentityReads = 0
+    const repo = { id: repoId, path: '/idle', name: 'idle', kind: 'git' as const }
+    const worktree = makePRRefreshWorktree({
+      id: 'wt-idle',
+      repoId,
+      path: '/idle/worktrees/idle',
+      branch: 'feature/idle'
+    })
+    Object.defineProperty(repo, 'id', {
+      configurable: true,
+      enumerable: true,
+      get: () => {
+        repoIdentityReads += 1
+        return repoId
+      }
+    })
+    Object.defineProperty(worktree, 'repoId', {
+      configurable: true,
+      enumerable: true,
+      get: () => {
+        worktreeRepoIdentityReads += 1
+        return repoId
+      }
+    })
+    store.setState({
+      repos: [repo],
+      groupBy: 'repo',
+      worktreeCardProperties: ['comment'],
+      rightSidebarOpen: false,
+      commentsCache: { cached: { data: [], fetchedAt: 1 } },
+      worktreesByRepo: { [repoId]: [worktree] }
+    } as unknown as Partial<AppState>)
+    repoIdentityReads = 0
+    worktreeRepoIdentityReads = 0
+
+    store.getState().refreshAllGitHub()
+
+    expect(store.getState().commentsCache).toEqual({})
+    expect(repoIdentityReads).toBe(0)
+    expect(worktreeRepoIdentityReads).toBe(0)
+    expect(mockApi.gh.enqueuePRRefresh).not.toHaveBeenCalled()
+    expect(mockApi.gh.issue).not.toHaveBeenCalled()
+  })
+
+  it('bounds stale PR repo identity reads to a constant amount per repo and worktree', () => {
+    const store = createTestStore()
+    const repoCount = 128
+    let repoIdentityReads = 0
+    const repoIds = Array.from({ length: repoCount }, (_, index) => `repo-${index}`)
+    const repos = repoIds.map((repoId) => {
+      const repo = { id: repoId, path: `/${repoId}`, name: repoId, kind: 'git' as const }
+      return Object.defineProperty(repo, 'id', {
+        configurable: true,
+        enumerable: true,
+        get: () => {
+          repoIdentityReads += 1
+          return repoId
+        }
+      })
+    })
+    const worktreesByRepo = Object.fromEntries(
+      repoIds.map((repoId, index) => [
+        repoId,
+        [
+          makePRRefreshWorktree({
+            id: `wt-${index}`,
+            repoId,
+            path: `/${repoId}/worktrees/feature`,
+            branch: `feature/${index}`,
+            lastActivityAt: index
+          })
+        ]
+      ])
+    )
+    store.setState({
+      repos,
+      groupBy: 'repo',
+      worktreeCardProperties: ['pr'],
+      rightSidebarOpen: false,
+      worktreesByRepo
+    } as unknown as Partial<AppState>)
+    repoIdentityReads = 0
+
+    store.getState().refreshAllGitHub()
+
+    expect(repoIdentityReads).toBeLessThanOrEqual(repoCount * 5)
+    expect(mockApi.gh.enqueuePRRefresh).toHaveBeenCalledTimes(5)
+  })
+
+  it('stops repo indexing after a sparse enabled match', () => {
+    const store = createTestStore()
+    const repoCount = 128
+    let repoIdentityReads = 0
+    const repos = Array.from({ length: repoCount }, (_, index) => {
+      const repoId = `repo-${index}`
+      const repo = { id: repoId, path: `/${repoId}`, name: repoId, kind: 'git' as const }
+      return Object.defineProperty(repo, 'id', {
+        configurable: true,
+        enumerable: true,
+        get: () => {
+          repoIdentityReads += 1
+          return repoId
+        }
+      })
+    })
+    store.setState({
+      repos,
+      groupBy: 'repo',
+      worktreeCardProperties: ['pr'],
+      rightSidebarOpen: false,
+      worktreesByRepo: {
+        'repo-0': [
+          makePRRefreshWorktree({
+            id: 'wt-sparse',
+            repoId: 'repo-0',
+            path: '/repo-0/worktrees/feature',
+            branch: 'feature/sparse'
+          })
+        ]
+      }
+    } as unknown as Partial<AppState>)
+    repoIdentityReads = 0
+
+    store.getState().refreshAllGitHub()
+
+    expect(repoIdentityReads).toBeLessThanOrEqual(5)
+    expect(mockApi.gh.enqueuePRRefresh).toHaveBeenCalledOnce()
+  })
+
+  it('does not restart repo indexing for repeated missing IDs', () => {
+    const store = createTestStore()
+    const repoCount = 128
+    let repoIdentityReads = 0
+    const repos = Array.from({ length: repoCount }, (_, index) => {
+      const repoId = `repo-${index}`
+      const repo = { id: repoId, path: `/${repoId}`, name: repoId, kind: 'git' as const }
+      return Object.defineProperty(repo, 'id', {
+        configurable: true,
+        enumerable: true,
+        get: () => {
+          repoIdentityReads += 1
+          return repoId
+        }
+      })
+    })
+    const missingWorktrees = Array.from({ length: repoCount }, (_, index) =>
+      makePRRefreshWorktree({
+        id: `wt-missing-${index}`,
+        repoId: `missing-${index}`,
+        branch: `feature/missing-${index}`
+      })
+    )
+    store.setState({
+      repos,
+      groupBy: 'repo',
+      worktreeCardProperties: ['pr'],
+      rightSidebarOpen: false,
+      worktreesByRepo: { missing: missingWorktrees }
+    } as unknown as Partial<AppState>)
+    repoIdentityReads = 0
+
+    store.getState().refreshAllGitHub()
+
+    expect(repoIdentityReads).toBeLessThanOrEqual(repoCount)
+    expect(mockApi.gh.enqueuePRRefresh).not.toHaveBeenCalled()
+  })
+
+  it('keeps runtime PR dispatch identity reads linear in PR-status grouping', async () => {
+    runtimeEnvironmentCall.mockResolvedValue({
+      id: 'rpc-linear-pr',
+      ok: true,
+      result: makePR({ number: 12 }),
+      _meta: { runtimeId: 'remote-runtime' }
+    })
+    const store = createTestStore()
+    const repoCount = 128
+    let repoIdentityReads = 0
+    let worktreeIdentityReads = 0
+    const repos = Array.from({ length: repoCount }, (_, index) => {
+      const repoId = `runtime-repo-${index}`
+      const repoPath = `/runtime/repo-${index}`
+      const repo = {
+        id: repoId,
+        path: repoPath,
+        name: repoId,
+        kind: 'git' as const,
+        executionHostId: 'runtime:env-1'
+      }
+      Object.defineProperty(repo, 'id', {
+        configurable: true,
+        enumerable: true,
+        get: () => {
+          repoIdentityReads += 1
+          return repoId
+        }
+      })
+      return Object.defineProperty(repo, 'path', {
+        configurable: true,
+        enumerable: true,
+        get: () => {
+          repoIdentityReads += 1
+          return repoPath
+        }
+      })
+    })
+    const worktreesByRepo = Object.fromEntries(
+      repos.map((repo, index) => {
+        const worktreeId = `runtime-wt-${index}`
+        const worktree = makePRRefreshWorktree({
+          id: worktreeId,
+          repoId: repo.id,
+          path: `${repo.path}/worktrees/feature`,
+          branch: `feature/${index}`,
+          linkedPR: 12,
+          lastActivityAt: index
+        })
+        Object.defineProperty(worktree, 'id', {
+          configurable: true,
+          enumerable: true,
+          get: () => {
+            worktreeIdentityReads += 1
+            return worktreeId
+          }
+        })
+        return [repo.id, [worktree]]
+      })
+    )
+    store.setState({
+      settings: { activeRuntimeEnvironmentId: 'env-1' } as AppState['settings'],
+      repos,
+      groupBy: 'pr-status',
+      worktreeCardProperties: ['comment'],
+      worktreesByRepo
+    } as unknown as Partial<AppState>)
+    repoIdentityReads = 0
+    worktreeIdentityReads = 0
+
+    store.getState().refreshAllGitHub()
+
+    await vi.waitFor(() => expect(Object.keys(store.getState().prCache)).toHaveLength(repoCount))
+    expect(runtimeEnvironmentCall).toHaveBeenCalledTimes(repoCount)
+    expect(repoIdentityReads).toBeLessThanOrEqual(repoCount * 20)
+    expect(worktreeIdentityReads).toBeLessThanOrEqual(repoCount * 5)
+  })
+
+  it('keeps runtime issue dispatch repo identity reads linear', async () => {
+    runtimeEnvironmentCall.mockResolvedValue({
+      id: 'rpc-linear-issue',
+      ok: true,
+      result: null,
+      _meta: { runtimeId: 'remote-runtime' }
+    })
+    const store = createTestStore()
+    const repoCount = 128
+    let repoIdentityReads = 0
+    const repos = Array.from({ length: repoCount }, (_, index) => {
+      const repoId = `issue-repo-${index}`
+      const repoPath = `/runtime/issues-${index}`
+      const repo = {
+        id: repoId,
+        path: repoPath,
+        name: repoId,
+        kind: 'git' as const,
+        executionHostId: 'runtime:env-1'
+      }
+      Object.defineProperty(repo, 'id', {
+        configurable: true,
+        enumerable: true,
+        get: () => {
+          repoIdentityReads += 1
+          return repoId
+        }
+      })
+      return Object.defineProperty(repo, 'path', {
+        configurable: true,
+        enumerable: true,
+        get: () => {
+          repoIdentityReads += 1
+          return repoPath
+        }
+      })
+    })
+    const worktreesByRepo = Object.fromEntries(
+      repos.map((repo, index) => [
+        repo.id,
+        [
+          makePRRefreshWorktree({
+            id: `issue-wt-${index}`,
+            repoId: repo.id,
+            path: `${repo.path}/worktrees/feature`,
+            linkedIssue: index + 1
+          })
+        ]
+      ])
+    )
+    store.setState({
+      settings: { activeRuntimeEnvironmentId: 'env-1' } as AppState['settings'],
+      repos,
+      groupBy: 'repo',
+      worktreeCardProperties: ['issue'],
+      worktreesByRepo
+    } as unknown as Partial<AppState>)
+    repoIdentityReads = 0
+
+    store.getState().refreshAllGitHub()
+
+    await vi.waitFor(() => expect(Object.keys(store.getState().issueCache)).toHaveLength(repoCount))
+    expect(runtimeEnvironmentCall).toHaveBeenCalledTimes(repoCount)
+    expect(repoIdentityReads).toBeLessThanOrEqual(repoCount * 15)
+  })
+
+  it('keeps the first repo owner when duplicate IDs span hosts', () => {
+    const store = createTestStore()
+    const repoId = 'duplicate-repo'
+    const firstRepo = {
+      id: repoId,
+      path: '/first',
+      name: 'first',
+      kind: 'git' as const,
+      connectionId: 'first',
+      executionHostId: 'ssh:first'
+    }
+    const secondRepo = {
+      id: repoId,
+      path: '/second',
+      name: 'second',
+      kind: 'git' as const,
+      connectionId: 'second',
+      executionHostId: 'ssh:second'
+    }
+    const laterRepo = {
+      id: 'later-repo',
+      path: '/later',
+      name: 'later',
+      kind: 'git' as const
+    }
+    store.setState({
+      repos: [firstRepo, secondRepo, laterRepo],
+      groupBy: 'repo',
+      worktreeCardProperties: ['pr'],
+      rightSidebarOpen: false,
+      sshConnectionStates: new Map([
+        ['first', { status: 'connected' }],
+        ['second', { status: 'connected' }]
+      ]),
+      worktreesByRepo: {
+        first: [
+          makePRRefreshWorktree({
+            id: 'wt-duplicate-first',
+            repoId,
+            path: '/first/worktrees/feature',
+            branch: 'feature/duplicate-first'
+          })
+        ],
+        middle: [
+          makePRRefreshWorktree({
+            id: 'wt-later',
+            repoId: laterRepo.id,
+            path: '/later/worktrees/feature',
+            branch: 'feature/later'
+          })
+        ],
+        last: [
+          makePRRefreshWorktree({
+            id: 'wt-duplicate-last',
+            repoId,
+            path: '/first/worktrees/last',
+            branch: 'feature/duplicate-last'
+          })
+        ]
+      }
+    } as unknown as Partial<AppState>)
+
+    store.getState().refreshAllGitHub()
+
+    const duplicateCandidates = mockApi.gh.enqueuePRRefresh.mock.calls
+      .map(([call]) => call.candidate)
+      .filter((candidate) => candidate.repoId === repoId)
+    expect(duplicateCandidates).toHaveLength(2)
+    expect(duplicateCandidates).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          repoPath: '/first',
+          connectionId: 'first',
+          executionHostId: 'ssh:first'
+        }),
+        expect.objectContaining({
+          repoPath: '/first',
+          connectionId: 'first',
+          executionHostId: 'ssh:first'
+        })
+      ])
+    )
+    expect(runtimeEnvironmentCall).not.toHaveBeenCalled()
   })
 
   it('refreshes stale PR data when source control is the visible PR surface', () => {
@@ -5967,17 +6534,18 @@ describe('createGitHubSlice.fetchWorkItems source/error envelope', () => {
       _meta: { runtimeId: 'remote-runtime' }
     })
     const store = createTestStore()
+    const repos: AppState['repos'] = [
+      {
+        id: 'runtime-repo-id',
+        path: '/server/repo',
+        displayName: 'repo',
+        badgeColor: 'blue',
+        addedAt: 1
+      }
+    ]
     store.setState({
       settings: { activeRuntimeEnvironmentId: 'env-1' },
-      repos: [
-        {
-          id: 'runtime-repo-id',
-          path: '/server/repo',
-          displayName: 'repo',
-          badgeColor: 'blue',
-          addedAt: 1
-        }
-      ]
+      repos
     } as Partial<AppState>)
 
     await store.getState().fetchWorkItems('caller-repo-id', '/server/repo', 24, 'is:open', {
@@ -6067,17 +6635,18 @@ describe('createGitHubSlice.fetchWorkItems source/error envelope', () => {
       _meta: { runtimeId: 'source-runtime' }
     })
     const store = createTestStore()
+    const repos: AppState['repos'] = [
+      {
+        id: 'local-repo-id',
+        path: '/server/repo',
+        displayName: 'repo',
+        badgeColor: 'blue',
+        addedAt: 1
+      }
+    ]
     store.setState({
       settings: { activeRuntimeEnvironmentId: 'focused-runtime' },
-      repos: [
-        {
-          id: 'local-repo-id',
-          path: '/server/repo',
-          displayName: 'repo',
-          badgeColor: 'blue',
-          addedAt: 1
-        }
-      ]
+      repos
     } as Partial<AppState>)
 
     const sourceContext = {
diff --git a/src/renderer/src/store/slices/github.ts b/src/renderer/src/store/slices/github.ts
index 21b66f2e9bd..7ab87e09731 100644
--- a/src/renderer/src/store/slices/github.ts
+++ b/src/renderer/src/store/slices/github.ts
@@ -76,6 +76,8 @@ import {
 } from '../../../../shared/task-source-context'
 import { normalizeGitHubPRForBranchOutcome } from '../../../../shared/github-pr-for-branch-outcome'
 import { restoreReactionOnSubject, setReactionOnSubject } from '@/lib/pr-comment-reactions'
+import { withGitHubCheckDetailsTimeout } from '@/runtime/github-check-details-timeout'
+import { getGitHubRepoLookupIndex } from './github-repo-lookup-index'
 
 // ─── ProjectV2 cache types ────────────────────────────────────────────
 // Why: separate from CacheEntry<T> — project-view has a single GraphQL source (no issue/PR fallback) and a distinct error union.
@@ -125,7 +127,7 @@ function getRuntimeRepoTarget(
   if (target.kind !== 'environment') {
     return null
   }
-  const repo = state.repos.find((candidate) => candidate.path === repoPath)
+  const repo = getGitHubRepoLookupIndex(state.repos).findByPath(repoPath)
   return repo ? { target, repo } : null
 }
 
@@ -249,9 +251,9 @@ function findRepoForGitHubOwner(
   repoId: string | undefined,
   repoPath: string
 ): Repo | undefined {
-  return (state.repos ?? []).find((candidate) =>
-    repoId ? candidate.id === repoId || candidate.path === repoPath : candidate.path === repoPath
-  )
+  return state.repos
+    ? getGitHubRepoLookupIndex(state.repos).findByIdOrPath(repoId, repoPath)
+    : undefined
 }
 
 function getGitHubFocusedRepoOwnerHostId(
@@ -962,13 +964,7 @@ function getPRChecksCacheTtl(entry: CacheEntry<PRCheckDetail[]> | undefined): nu
 }
 
 function findWorktreeById(state: AppState, worktreeId: string): Worktree | null {
-  for (const worktrees of Object.values(state.worktreesByRepo)) {
-    const worktree = worktrees.find((w) => w.id === worktreeId)
-    if (worktree) {
-      return worktree
-    }
-  }
-  return null
+  return getWorktreeLookupIndex(state).byId.get(worktreeId)?.first ?? null
 }
 
 type WorktreeLookupEntry = {
@@ -981,9 +977,12 @@ type WorktreeLookupIndex = {
   repoHostIdsByRepoId: Map<string, Set<string>>
 }
 
+const EMPTY_WORKTREES_BY_REPO: AppState['worktreesByRepo'] = {}
+const EMPTY_WORKTREE_REPOS: AppState['repos'] = []
+
 function buildWorktreeLookupIndex(state: AppState): WorktreeLookupIndex {
   const byId = new Map<string, WorktreeLookupEntry>()
-  for (const worktrees of Object.values(state.worktreesByRepo)) {
+  for (const worktrees of Object.values(state.worktreesByRepo ?? EMPTY_WORKTREES_BY_REPO)) {
     for (const worktree of worktrees) {
       const worktreeId = worktree.id
       const existing = byId.get(worktreeId)
@@ -1007,11 +1006,29 @@ function buildWorktreeLookupIndex(state: AppState): WorktreeLookupIndex {
   return { byId, repoHostIdsByRepoId }
 }
 
+// Why: worktree/owner updates replace these snapshots, while weak ownership avoids retaining superseded state.
+const worktreeLookupIndexes = new WeakMap<
+  AppState['worktreesByRepo'],
+  { repos: AppState['repos']; index: WorktreeLookupIndex }
+>()
+
+function getWorktreeLookupIndex(state: AppState): WorktreeLookupIndex {
+  const worktreesByRepo = state.worktreesByRepo ?? EMPTY_WORKTREES_BY_REPO
+  const repos = state.repos ?? EMPTY_WORKTREE_REPOS
+  const cached = worktreeLookupIndexes.get(worktreesByRepo)
+  if (cached && cached.repos === repos) {
+    return cached.index
+  }
+  const index = buildWorktreeLookupIndex(state)
+  worktreeLookupIndexes.set(worktreesByRepo, { repos, index })
+  return index
+}
+
 function findUniqueWorktreeById(
   state: AppState,
   worktreeId: string,
   executionHostId?: string,
-  lookupIndex = buildWorktreeLookupIndex(state)
+  lookupIndex = getWorktreeLookupIndex(state)
 ): Worktree | null {
   const match = lookupIndex.byId.get(worktreeId)?.unique ?? null
   // Why: metadata persistence is keyed only by worktree id; an id owned by two hosts is non-unique so destructive clears fail closed.
@@ -1130,9 +1147,10 @@ function shouldApplyBranchMismatchedLinkedPRClear(args: {
 function buildPRRefreshCandidate(
   state: AppState,
   worktree: Worktree,
-  repoPath?: string
+  repoPath?: string,
+  repoOverride?: Repo
 ): GitHubPRRefreshCandidate | null {
-  const repo = state.repos.find((r) => r.id === worktree.repoId)
+  const repo = repoOverride ?? getGitHubRepoLookupIndex(state.repos).findById(worktree.repoId)
   if (!repo) {
     return null
   }
@@ -2989,9 +3007,10 @@ export const createGitHubSlice: StateCreator<AppState, [], [], GitHubSlice> = (s
   },
 
   fetchPRForBranch: async (repoPath, branch, options): Promise<PRInfo | null> => {
-    const repo = get().repos?.find((candidate) =>
-      options?.repoId ? candidate.id === options.repoId : candidate.path === repoPath
-    )
+    const repoLookup = getGitHubRepoLookupIndex(get().repos)
+    const repo = options?.repoId
+      ? repoLookup.findById(options.repoId)
+      : repoLookup.findByPath(repoPath)
     const repoId = options?.repoId ?? repo?.id
     const requestSettings = settingsForGitHubRepoOwner(get().settings, repo)
     const cacheKey = prCacheKey(
@@ -3574,30 +3593,35 @@ export const createGitHubSlice: StateCreator<AppState, [], [], GitHubSlice> = (s
       repoPath,
       options?.sourceContext
     )
-    return requestContext.target.kind === 'environment'
-      ? await callRuntimeRpc<PRCheckRunDetails | null>(
-          { kind: 'environment', environmentId: requestContext.target.environmentId },
-          'github.prCheckDetails',
-          {
-            repo: requestContext.target.runtimeRepoId,
+    const requestTarget = requestContext.target
+    return requestTarget.kind === 'environment'
+      ? await withGitHubCheckDetailsTimeout((signal) =>
+          callRuntimeRpc<PRCheckRunDetails | null>(
+            { kind: 'environment', environmentId: requestTarget.environmentId },
+            'github.prCheckDetails',
+            {
+              repo: requestTarget.runtimeRepoId,
+              checkRunId: args.checkRunId,
+              workflowRunId: args.workflowRunId,
+              checkName: args.checkName,
+              url: args.url,
+              prRepo: args.prRepo ?? null
+            },
+            { timeoutMs: 30_000, signal }
+          )
+        )
+      : await withGitHubCheckDetailsTimeout(() =>
+          window.api.gh.prCheckDetails({
+            repoPath,
+            repoId,
             checkRunId: args.checkRunId,
             workflowRunId: args.workflowRunId,
             checkName: args.checkName,
             url: args.url,
-            prRepo: args.prRepo ?? null
-          },
-          { timeoutMs: 30_000 }
+            prRepo: args.prRepo ?? null,
+            sourceContext: options?.sourceContext
+          })
         )
-      : ((await window.api.gh.prCheckDetails({
-          repoPath,
-          repoId,
-          checkRunId: args.checkRunId,
-          workflowRunId: args.workflowRunId,
-          checkName: args.checkName,
-          url: args.url,
-          prRepo: args.prRepo ?? null,
-          sourceContext: options?.sourceContext
-        })) as PRCheckRunDetails | null)
   },
 
   fetchPRComments: async (repoPath, prNumber, options): Promise<PRComment[]> => {
@@ -4415,22 +4439,33 @@ export const createGitHubSlice: StateCreator<AppState, [], [], GitHubSlice> = (s
 
   refreshAllGitHub: () => {
     // Clear comments cache; evict stale entries to bound long-session growth across repos/branches.
-    set((s) => ({
-      commentsCache: {},
-      prCache: evictStaleEntries(s.prCache),
-      issueCache: evictStaleEntries(s.issueCache),
-      checksCache: evictStaleEntries(s.checksCache),
-      workItemsCache: evictStaleEntries(s.workItemsCache),
-      projectViewCache: evictStaleEntries(s.projectViewCache),
-      prRefreshStates: pruneExpiredPRRefreshStates(s.prRefreshStates)
-    }))
+    set((s) => {
+      const next = {
+        commentsCache: Object.keys(s.commentsCache).length === 0 ? s.commentsCache : {},
+        prCache: evictStaleEntries(s.prCache),
+        issueCache: evictStaleEntries(s.issueCache),
+        checksCache: evictStaleEntries(s.checksCache),
+        workItemsCache: evictStaleEntries(s.workItemsCache),
+        projectViewCache: evictStaleEntries(s.projectViewCache),
+        prRefreshStates: pruneExpiredPRRefreshStates(s.prRefreshStates)
+      }
+      // Why: each eviction helper returns its input untouched when nothing changed, so an
+      // unchanged sweep can return `s` and avoid waking every subscriber on window resume.
+      return next.commentsCache === s.commentsCache &&
+        next.prCache === s.prCache &&
+        next.issueCache === s.issueCache &&
+        next.checksCache === s.checksCache &&
+        next.workItemsCache === s.workItemsCache &&
+        next.projectViewCache === s.projectViewCache &&
+        next.prRefreshStates === s.prRefreshStates
+        ? s
+        : next
+    })
 
     // Why: don't prune prRequestGenerations here — deleting a live generation makes its response look stale.
 
     // Only re-fetch PR/issue entries that are already stale — skip fresh ones
     const state = get()
-    const now = Date.now()
-    const stalePRCandidates: { candidate: GitHubPRRefreshCandidate; score: number }[] = []
     const cardProps = state.worktreeCardProperties ?? []
     const rawCardProps = cardProps as readonly string[]
     const shouldRefreshIssues = shouldRefreshIssueDecorations(state)
@@ -4442,10 +4477,17 @@ export const createGitHubSlice: StateCreator<AppState, [], [], GitHubSlice> = (s
       (state.settings?.experimentalNewWorktreeCardStyle === true
         ? cardProps.includes('status')
         : cardProps.includes('pr') || rawCardProps.includes('ci'))
+    if (!shouldRefreshPRs && !shouldRefreshIssues) {
+      return
+    }
+
+    const now = Date.now()
+    const stalePRCandidates: { candidate: GitHubPRRefreshCandidate; score: number }[] = []
+    const repoLookup = getGitHubRepoLookupIndex(state.repos)
 
     for (const worktrees of Object.values(state.worktreesByRepo)) {
       for (const wt of worktrees) {
-        const repo = state.repos.find((r) => r.id === wt.repoId)
+        const repo = repoLookup.findById(wt.repoId)
         if (!repo) {
           continue
         }
@@ -4463,7 +4505,7 @@ export const createGitHubSlice: StateCreator<AppState, [], [], GitHubSlice> = (s
           )
           const prEntry = state.prCache[prKey]
           if (!prEntry || now - prEntry.fetchedAt >= CACHE_TTL) {
-            const candidate = buildPRRefreshCandidate(state, wt)
+            const candidate = buildPRRefreshCandidate(state, wt, undefined, repo)
             if (candidate) {
               stalePRCandidates.push({
                 candidate,
diff --git a/src/renderer/src/store/slices/hosted-review.test.ts b/src/renderer/src/store/slices/hosted-review.test.ts
index e305010758a..c438c2e8ebc 100644
--- a/src/renderer/src/store/slices/hosted-review.test.ts
+++ b/src/renderer/src/store/slices/hosted-review.test.ts
@@ -27,7 +27,8 @@ const mockApi = {
   hostedReview: {
     forBranch: vi.fn(),
     getCreationEligibility: vi.fn(),
-    create: vi.fn()
+    create: vi.fn(),
+    createStacked: vi.fn()
   }
 }
 
@@ -41,6 +42,7 @@ function makeStore(settings: AppState['settings'] = null) {
       | 'fetchHostedReviewForBranch'
       | 'getHostedReviewCreationEligibility'
       | 'createHostedReview'
+      | 'createStackedHostedReview'
       | 'settings'
       | 'repos'
       | 'prCache'
@@ -80,6 +82,7 @@ describe('hosted review slice', () => {
     mockApi.hostedReview.forBranch.mockReset()
     mockApi.hostedReview.getCreationEligibility.mockReset()
     mockApi.hostedReview.create.mockReset()
+    mockApi.hostedReview.createStacked.mockReset()
     runtimeRpc.callRuntimeRpc.mockReset()
   })
 
@@ -388,6 +391,35 @@ describe('hosted review slice', () => {
     })
   })
 
+  it('routes stacked pull request creation through its dedicated IPC method', async () => {
+    mockApi.hostedReview.createStacked.mockResolvedValueOnce({
+      ok: true,
+      number: 42,
+      url: 'https://github.com/acme/orca/pull/42',
+      stackNumber: 50,
+      parentReview: { number: 41, url: 'https://github.com/acme/orca/pull/41' }
+    })
+    const store = makeStore()
+
+    await store.getState().createStackedHostedReview('/repo', {
+      provider: 'github',
+      base: 'stack/parent',
+      head: 'stack/child',
+      title: 'Child',
+      worktreePath: '/worktrees/child'
+    })
+
+    expect(mockApi.hostedReview.createStacked).toHaveBeenCalledWith(
+      expect.objectContaining({
+        repoPath: '/repo',
+        repoId: 'repo-1',
+        base: 'stack/parent',
+        head: 'stack/child'
+      })
+    )
+    expect(mockApi.hostedReview.create).not.toHaveBeenCalled()
+  })
+
   it('forwards SSH connectionId when checking pull request creation eligibility', async () => {
     mockApi.hostedReview.getCreationEligibility.mockResolvedValueOnce({
       provider: 'github',
@@ -490,6 +522,39 @@ describe('hosted review slice', () => {
     )
   })
 
+  it('uses a distinct runtime method for stacked pull request creation', async () => {
+    runtimeRpc.callRuntimeRpc.mockResolvedValueOnce({
+      ok: true,
+      number: 42,
+      url: 'https://github.com/acme/orca/pull/42',
+      stackNumber: 50,
+      parentReview: { number: 41, url: 'https://github.com/acme/orca/pull/41' }
+    })
+    const store = makeStore({
+      activeRuntimeEnvironmentId: 'env-win'
+    } as AppState['settings'])
+
+    await store.getState().createStackedHostedReview('/repo', {
+      provider: 'github',
+      base: 'stack/parent',
+      head: 'stack/child',
+      title: 'Child',
+      worktreePath: 'C:\\worktrees\\child'
+    })
+
+    expect(runtimeRpc.callRuntimeRpc).toHaveBeenCalledWith(
+      { kind: 'environment', environmentId: 'env-win' },
+      'hostedReview.createStacked',
+      expect.objectContaining({
+        repo: 'repo-1',
+        worktree: 'path:C:\\worktrees\\child',
+        base: 'stack/parent',
+        head: 'stack/child'
+      }),
+      { timeoutMs: 90_000 }
+    )
+  })
+
   it('uses the selected worktree selector for runtime pull request creation eligibility', async () => {
     runtimeRpc.callRuntimeRpc.mockResolvedValueOnce({
       provider: 'github',
diff --git a/src/renderer/src/store/slices/hosted-review.ts b/src/renderer/src/store/slices/hosted-review.ts
index 885425c4b4b..4e64aa48e84 100644
--- a/src/renderer/src/store/slices/hosted-review.ts
+++ b/src/renderer/src/store/slices/hosted-review.ts
@@ -4,6 +4,8 @@ import type { StateCreator } from 'zustand'
 import type {
   CreateHostedReviewInput,
   CreateHostedReviewResult,
+  CreateStackedHostedReviewInput,
+  CreateStackedHostedReviewResult,
   HostedReviewCreationEligibility,
   HostedReviewCreationEligibilityArgs,
   HostedReviewInfo
@@ -39,6 +41,9 @@ type FetchOptions = {
   active?: boolean
 }
 type CreateHostedReviewStoreInput = CreateHostedReviewInput & { repoId?: string | null }
+type CreateStackedHostedReviewStoreInput = CreateStackedHostedReviewInput & {
+  repoId?: string | null
+}
 
 const CACHE_TTL_MS = 60_000
 const HOSTED_REVIEW_CACHE_MAX = 500
@@ -242,6 +247,10 @@ export type HostedReviewSlice = {
     repoPath: string,
     input: CreateHostedReviewStoreInput
   ) => Promise<CreateHostedReviewResult>
+  createStackedHostedReview: (
+    repoPath: string,
+    input: CreateStackedHostedReviewStoreInput
+  ) => Promise<CreateStackedHostedReviewResult>
   fetchHostedReviewForBranch: (
     repoPath: string,
     branch: string,
@@ -339,6 +348,33 @@ export const createHostedReviewSlice: StateCreator<AppState, [], [], HostedRevie
     })
   },
 
+  createStackedHostedReview: async (repoPath, input) => {
+    const settings = get().settings
+    const repo = findHostedReviewRepoByPath(get().repos, repoPath, input.repoId)
+    const ownerSettings = settingsForHostedReviewActionOwner(settings, repo)
+    const target = getActiveRuntimeTarget(ownerSettings)
+    const { repoId: inputRepoId, ...hostedReviewInput } = input
+    if (target.kind === 'environment') {
+      const { worktreePath, ...runtimeInput } = hostedReviewInput
+      return callRuntimeRpc<CreateStackedHostedReviewResult>(
+        target,
+        'hostedReview.createStacked',
+        {
+          repo: repo?.id ?? repoPath,
+          ...(worktreePath ? { worktree: `path:${worktreePath}` } : {}),
+          ...runtimeInput
+        },
+        { timeoutMs: 90_000 }
+      )
+    }
+    return window.api.hostedReview.createStacked({
+      repoPath,
+      repoId: repo?.id ?? inputRepoId ?? undefined,
+      connectionId: repo?.connectionId ?? null,
+      ...hostedReviewInput
+    })
+  },
+
   fetchHostedReviewForBranch: async (
     repoPath,
     branch,
diff --git a/src/renderer/src/store/slices/opencode-usage.ts b/src/renderer/src/store/slices/opencode-usage.ts
deleted file mode 100644
index 87c28e7822d..00000000000
--- a/src/renderer/src/store/slices/opencode-usage.ts
+++ /dev/null
@@ -1,181 +0,0 @@
-import type { StateCreator } from 'zustand'
-import type {
-  OpenCodeUsageBreakdownRow,
-  OpenCodeUsageDailyPoint,
-  OpenCodeUsageRange,
-  OpenCodeUsageScanState,
-  OpenCodeUsageScope,
-  OpenCodeUsageSessionRow,
-  OpenCodeUsageSnapshot,
-  OpenCodeUsageSummary
-} from '../../../../shared/opencode-usage-types'
-import type { AppState } from '../types'
-
-export type OpenCodeUsageSlice = {
-  openCodeUsageScope: OpenCodeUsageScope
-  openCodeUsageRange: OpenCodeUsageRange
-  openCodeUsageScanState: OpenCodeUsageScanState | null
-  openCodeUsageSummary: OpenCodeUsageSummary | null
-  openCodeUsageDaily: OpenCodeUsageDailyPoint[]
-  openCodeUsageModelBreakdown: OpenCodeUsageBreakdownRow[]
-  openCodeUsageProjectBreakdown: OpenCodeUsageBreakdownRow[]
-  openCodeUsageRecentSessions: OpenCodeUsageSessionRow[]
-  setOpenCodeUsageEnabled: (enabled: boolean) => Promise<void>
-  setOpenCodeUsageScope: (scope: OpenCodeUsageScope) => Promise<void>
-  setOpenCodeUsageRange: (range: OpenCodeUsageRange) => Promise<void>
-  fetchOpenCodeUsage: (opts?: { forceRefresh?: boolean }) => Promise<void>
-  enableOpenCodeUsage: () => Promise<void>
-  refreshOpenCodeUsage: () => Promise<void>
-}
-
-export const createOpenCodeUsageSlice: StateCreator<AppState, [], [], OpenCodeUsageSlice> = (
-  set,
-  get
-) => ({
-  openCodeUsageScope: 'orca',
-  openCodeUsageRange: '30d',
-  openCodeUsageScanState: null,
-  openCodeUsageSummary: null,
-  openCodeUsageDaily: [],
-  openCodeUsageModelBreakdown: [],
-  openCodeUsageProjectBreakdown: [],
-  openCodeUsageRecentSessions: [],
-
-  setOpenCodeUsageEnabled: async (enabled) => {
-    try {
-      const nextScanState = (await window.api.openCodeUsage.setEnabled({
-        enabled
-      })) as OpenCodeUsageScanState | undefined
-      // Why: the web client (paired runtime) does not bridge the desktop-only
-      // usage IPC; its preload fallback resolves this call to `undefined`. Bail
-      // so the toggle no-ops instead of seeding an empty scan state and then
-      // crashing on the follow-up fetch.
-      if (!nextScanState) {
-        return
-      }
-      set({
-        openCodeUsageScanState: enabled
-          ? {
-              ...nextScanState,
-              isScanning: true,
-              lastScanCompletedAt: null,
-              lastScanError: null
-            }
-          : nextScanState,
-        openCodeUsageSummary: null,
-        openCodeUsageDaily: [],
-        openCodeUsageModelBreakdown: [],
-        openCodeUsageProjectBreakdown: [],
-        openCodeUsageRecentSessions: []
-      })
-      if (enabled) {
-        await get().fetchOpenCodeUsage({ forceRefresh: true })
-      }
-    } catch (error) {
-      console.error('Failed to update OpenCode usage setting:', error)
-    }
-  },
-
-  setOpenCodeUsageScope: async (scope) => {
-    set({ openCodeUsageScope: scope })
-    await get().fetchOpenCodeUsage()
-  },
-
-  setOpenCodeUsageRange: async (range) => {
-    set({ openCodeUsageRange: range })
-    await get().fetchOpenCodeUsage()
-  },
-
-  fetchOpenCodeUsage: async (opts) => {
-    try {
-      const scanState = (await window.api.openCodeUsage.getScanState()) as
-        | OpenCodeUsageScanState
-        | undefined
-      // Why: in the web client the usage IPC is unavailable and the preload
-      // fallback resolves to `undefined`; reading `scanState.enabled` below would
-      // throw `Cannot read properties of undefined (reading 'enabled')`. Treat an
-      // absent scan state as "usage unavailable" and stop.
-      if (!scanState) {
-        return
-      }
-      const currentScanState = get().openCodeUsageScanState
-      const shouldPreserveLoadingState =
-        opts?.forceRefresh === true &&
-        currentScanState?.enabled === true &&
-        get().openCodeUsageSummary === null
-      set({
-        openCodeUsageScanState: shouldPreserveLoadingState
-          ? {
-              ...scanState,
-              isScanning: true,
-              lastScanCompletedAt: null,
-              lastScanError: null
-            }
-          : scanState
-      })
-      if (!scanState.enabled) {
-        return
-      }
-
-      const { openCodeUsageScope, openCodeUsageRange } = get()
-      const snapshot = (await window.api.openCodeUsage.getSnapshot({
-        scope: openCodeUsageScope,
-        range: openCodeUsageRange,
-        limit: 10
-      })) as OpenCodeUsageSnapshot
-      const hasCachedSnapshot =
-        snapshot.scanState.lastScanCompletedAt !== null || snapshot.scanState.hasAnyOpenCodeData
-
-      if (hasCachedSnapshot) {
-        set({
-          openCodeUsageScanState:
-            opts?.forceRefresh === true
-              ? { ...snapshot.scanState, isScanning: true }
-              : snapshot.scanState,
-          openCodeUsageSummary: snapshot.summary,
-          openCodeUsageDaily: snapshot.daily,
-          openCodeUsageModelBreakdown: snapshot.modelBreakdown,
-          openCodeUsageProjectBreakdown: snapshot.projectBreakdown,
-          openCodeUsageRecentSessions: snapshot.recentSessions
-        })
-      } else {
-        set({
-          openCodeUsageScanState: {
-            ...scanState,
-            isScanning: true,
-            lastScanError: null
-          }
-        })
-      }
-
-      await window.api.openCodeUsage.refresh({
-        force: opts?.forceRefresh ?? false
-      })
-      const { openCodeUsageScope: refreshedScope, openCodeUsageRange: refreshedRange } = get()
-      const refreshedSnapshot = (await window.api.openCodeUsage.getSnapshot({
-        scope: refreshedScope,
-        range: refreshedRange,
-        limit: 10
-      })) as OpenCodeUsageSnapshot
-
-      set({
-        openCodeUsageScanState: refreshedSnapshot.scanState,
-        openCodeUsageSummary: refreshedSnapshot.summary,
-        openCodeUsageDaily: refreshedSnapshot.daily,
-        openCodeUsageModelBreakdown: refreshedSnapshot.modelBreakdown,
-        openCodeUsageProjectBreakdown: refreshedSnapshot.projectBreakdown,
-        openCodeUsageRecentSessions: refreshedSnapshot.recentSessions
-      })
-    } catch (error) {
-      console.error('Failed to fetch OpenCode usage:', error)
-    }
-  },
-
-  enableOpenCodeUsage: async () => {
-    await get().setOpenCodeUsageEnabled(true)
-  },
-
-  refreshOpenCodeUsage: async () => {
-    await get().fetchOpenCodeUsage({ forceRefresh: true })
-  }
-})
diff --git a/src/renderer/src/store/slices/preflight.test.ts b/src/renderer/src/store/slices/preflight.test.ts
index bd93507ff41..18ebaf839cd 100644
--- a/src/renderer/src/store/slices/preflight.test.ts
+++ b/src/renderer/src/store/slices/preflight.test.ts
@@ -265,11 +265,12 @@ describe('createPreflightSlice', () => {
       new Error('Project runtime requires repair before preflight: wsl-distro-required')
     )
     const store = createTestStore()
+    const repos: AppState['repos'] = [makeRepo({ id: 'repo-1', path: 'C:\\repo' })]
     store.setState({
       settings: {
         localWindowsRuntimeDefault: { kind: 'wsl', distro: null }
       },
-      repos: [makeRepo({ id: 'repo-1', path: 'C:\\repo' })],
+      repos,
       worktreesByRepo: {},
       activeRepoId: 'repo-1',
       activeWorktreeId: null
diff --git a/src/renderer/src/store/slices/preflight.ts b/src/renderer/src/store/slices/preflight.ts
index 9b4abd21a11..81bfbf163fa 100644
--- a/src/renderer/src/store/slices/preflight.ts
+++ b/src/renderer/src/store/slices/preflight.ts
@@ -90,10 +90,13 @@ export const createPreflightSlice: StateCreator<AppState, [], [], PreflightSlice
       preflightStatusError: null
     })
 
+    const localPreflightCheck = window.api?.preflight?.check
     const request = (
       runtimeTarget.kind === 'environment'
         ? callRuntimeRpc<PreflightStatus>(runtimeTarget, 'preflight.check', force ? { force } : {})
-        : window.api.preflight.check(preflightArgs)
+        : localPreflightCheck
+          ? localPreflightCheck(preflightArgs)
+          : Promise.reject(new Error('Desktop preflight API is unavailable.'))
     )
       .then((status) => {
         if (requestId !== latestPreflightRequestId) {
diff --git a/src/renderer/src/store/slices/repo-host-identity.ts b/src/renderer/src/store/slices/repo-host-identity.ts
index be1c2255621..f21da2b153a 100644
--- a/src/renderer/src/store/slices/repo-host-identity.ts
+++ b/src/renderer/src/store/slices/repo-host-identity.ts
@@ -29,7 +29,7 @@ export function findRepoForHost<T extends RepoIdentityParts>(
   repos: readonly T[],
   repoId: string,
   options: {
-    hostId?: ExecutionHostId | string | null
+    hostId?: ExecutionHostId | (string & {}) | null
     settings?: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null
   } = {}
 ): T | null {
diff --git a/src/renderer/src/store/slices/repo-identity-reconcile.test.ts b/src/renderer/src/store/slices/repo-identity-reconcile.test.ts
index f8c334ff4a7..dda221e18b0 100644
--- a/src/renderer/src/store/slices/repo-identity-reconcile.test.ts
+++ b/src/renderer/src/store/slices/repo-identity-reconcile.test.ts
@@ -14,6 +14,50 @@ describe('reconcileFetchedRepos', () => {
     expect(reconcileFetchedRepos(previous, next)).toBe(previous)
   })
 
+  it('reconciles repos whose nested records were rebuilt by hydration and IPC', () => {
+    // Why: main's hydrateRepo reconstructs hookSettings on every list and structured-clone
+    // rebuilds the rest, so a reference compare would report every real repo as changed.
+    const nested = (): Partial<Repo> => ({
+      hookSettings: { mode: 'auto', scripts: { setup: 'echo hi', archive: '' } },
+      gitRemoteIdentity: {
+        canonicalKey: 'github.com/o/n',
+        remoteName: 'origin',
+        remoteUrl: 'git@github.com:o/n.git'
+      },
+      importedExternalWorktreePaths: ['/a', '/b']
+    })
+    const previous = [makeRepo('a', nested())]
+    const next = structuredClone([makeRepo('a', nested())]) as Repo[]
+
+    expect(reconcileFetchedRepos(previous, next)).toBe(previous)
+  })
+
+  it('treats a changed nested field as a real change', () => {
+    const previous = [makeRepo('a', { importedExternalWorktreePaths: ['/a'] })]
+    const next = [makeRepo('a', { importedExternalWorktreePaths: ['/b'] })]
+    const result = reconcileFetchedRepos(previous, next)
+
+    expect(result).not.toBe(previous)
+    expect(result[0].importedExternalWorktreePaths).toEqual(['/b'])
+  })
+
+  it('treats a nested field gaining a key as a real change', () => {
+    const previous = [
+      makeRepo('a', { hookSettings: { mode: 'auto', scripts: { setup: '', archive: '' } } })
+    ]
+    const next = [
+      makeRepo('a', {
+        hookSettings: {
+          mode: 'auto',
+          setupRunPolicy: 'run-by-default',
+          scripts: { setup: '', archive: '' }
+        }
+      })
+    ]
+
+    expect(reconcileFetchedRepos(previous, next)).not.toBe(previous)
+  })
+
   it('reuses unchanged repo objects while reflecting a reorder', () => {
     const previous = [makeRepo('a'), makeRepo('b')]
     const next = [makeRepo('b'), makeRepo('a')]
diff --git a/src/renderer/src/store/slices/repo-identity-reconcile.ts b/src/renderer/src/store/slices/repo-identity-reconcile.ts
index 119c4ed3e2a..f382ba21e2a 100644
--- a/src/renderer/src/store/slices/repo-identity-reconcile.ts
+++ b/src/renderer/src/store/slices/repo-identity-reconcile.ts
@@ -8,6 +8,43 @@ import { getRepoHostIdentity } from './repo-host-identity'
 // virtualizer to rebuild + re-measure a tick after the drop — the visible jump.
 // Reusing equal objects (and the whole array when nothing moved) makes the echo
 // a no-op render.
+// Why: `Repo` carries nested records (hookSettings, upstream, gitRemoteIdentity, repoIcon, path
+// arrays). IPC structured-clone rebuilds those every fetch, and main's hydrateRepo always
+// reconstructs hookSettings — so a reference compare reports every repo as changed and no repo
+// ever reconciles. Compare nested plain values structurally; they are small sanitized records.
+function areValuesEqual(a: unknown, b: unknown): boolean {
+  if (a === b) {
+    return true
+  }
+  if (typeof a !== 'object' || typeof b !== 'object' || a === null || b === null) {
+    return false
+  }
+  if (Array.isArray(a) || Array.isArray(b)) {
+    return (
+      Array.isArray(a) &&
+      Array.isArray(b) &&
+      a.length === b.length &&
+      a.every((item, index) => areValuesEqual(item, b[index]))
+    )
+  }
+  // Why: only plain records are safe to walk — anything exotic falls back to reference equality.
+  if (
+    Object.getPrototypeOf(a) !== Object.prototype ||
+    Object.getPrototypeOf(b) !== Object.prototype
+  ) {
+    return false
+  }
+  const aRecord = a as Record<string, unknown>
+  const bRecord = b as Record<string, unknown>
+  const keys = Object.keys(aRecord)
+  if (keys.length !== Object.keys(bRecord).length) {
+    return false
+  }
+  return keys.every(
+    (key) => Object.hasOwn(bRecord, key) && areValuesEqual(aRecord[key], bRecord[key])
+  )
+}
+
 function areReposEqual(a: Repo, b: Repo): boolean {
   if (a === b) {
     return true
@@ -17,17 +54,20 @@ function areReposEqual(a: Repo, b: Repo): boolean {
     return false
   }
   for (const key of keys) {
-    if (!Object.prototype.hasOwnProperty.call(b, key)) {
+    if (!Object.hasOwn(b, key)) {
       return false
     }
-    if (a[key] !== b[key]) {
+    if (!areValuesEqual(a[key], b[key])) {
       return false
     }
   }
   return true
 }
 
-export function reconcileFetchedRepos(previous: readonly Repo[], next: Repo[]): Repo[] {
+export function reconcileFetchedRepos(
+  previous: readonly Repo[],
+  next: readonly Repo[]
+): readonly Repo[] {
   const previousById = new Map(previous.map((repo) => [getRepoHostIdentity(repo), repo]))
   let identical = next.length === previous.length
   const reconciled = next.map((repo, index) => {
@@ -41,5 +81,5 @@ export function reconcileFetchedRepos(previous: readonly Repo[], next: Repo[]):
     identical = false
     return repo
   })
-  return identical ? (previous as Repo[]) : reconciled
+  return identical ? previous : reconciled
 }
diff --git a/src/renderer/src/store/slices/repos-catalog-merge-identity.test.ts b/src/renderer/src/store/slices/repos-catalog-merge-identity.test.ts
new file mode 100644
index 00000000000..69f73e589b5
--- /dev/null
+++ b/src/renderer/src/store/slices/repos-catalog-merge-identity.test.ts
@@ -0,0 +1,280 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { FolderWorkspace, ProjectGroup, Repo } from '../../../../shared/types'
+import type { FolderWorkspacePathStatusCacheEntry } from './repos'
+import { createTestStore } from './store-test-helpers'
+
+const projectGroup: ProjectGroup = {
+  id: 'group-1',
+  name: 'Group 1',
+  parentPath: '/parent',
+  parentGroupId: null,
+  createdFrom: 'manual',
+  tabOrder: 0,
+  isCollapsed: false,
+  color: null,
+  createdAt: 1,
+  updatedAt: 1
+}
+
+const secondProjectGroup: ProjectGroup = {
+  ...projectGroup,
+  id: 'group-2',
+  name: 'Group 2',
+  parentPath: '/parent-2',
+  tabOrder: 1
+}
+
+const folderWorkspace: FolderWorkspace = {
+  id: 'folder-1',
+  projectGroupId: 'group-1',
+  name: 'Folder 1',
+  folderPath: '/parent/folder-1',
+  linkedTask: {
+    provider: 'github',
+    type: 'issue',
+    number: 7,
+    title: 'Issue 7',
+    url: 'https://example.test/7'
+  },
+  comment: '',
+  isArchived: false,
+  isUnread: false,
+  isPinned: false,
+  sortOrder: 0,
+  lastActivityAt: 1,
+  createdAt: 1,
+  updatedAt: 1
+}
+
+const secondFolderWorkspace: FolderWorkspace = {
+  ...folderWorkspace,
+  id: 'folder-2',
+  name: 'Folder 2',
+  folderPath: '/parent/folder-2',
+  linkedTask: null,
+  sortOrder: 1
+}
+
+const repo: Repo = {
+  id: 'repo-1',
+  path: '/repo-1',
+  displayName: 'Repo 1',
+  badgeColor: '#000',
+  addedAt: 1,
+  executionHostId: 'local'
+}
+
+const cachedPathStatuses: Record<string, FolderWorkspacePathStatusCacheEntry> = {
+  'local:folder-workspace:folder-1': {
+    status: { path: '/parent/folder-1', exists: false, reason: 'missing' },
+    checkedAt: Date.now(),
+    requestSnapshot: 'snapshot'
+  }
+}
+
+const projectGroupsList = vi.fn()
+const folderWorkspacesList = vi.fn()
+const reposList = vi.fn()
+const projectsList = vi.fn()
+const listHostSetups = vi.fn()
+
+// Why: catalogs arrive over IPC, so every fetch must hand back freshly allocated objects.
+function clone<T>(value: T): T {
+  return structuredClone(value)
+}
+
+beforeEach(() => {
+  projectGroupsList.mockReset()
+  folderWorkspacesList.mockReset()
+  reposList.mockReset()
+  projectsList.mockReset()
+  listHostSetups.mockReset()
+  projectGroupsList.mockImplementation(async () => [clone(projectGroup)])
+  folderWorkspacesList.mockImplementation(async () => [clone(folderWorkspace)])
+  reposList.mockImplementation(async () => [clone(repo)])
+  projectsList.mockImplementation(async () => [])
+  listHostSetups.mockImplementation(async () => [])
+
+  vi.stubGlobal('window', {
+    api: {
+      projectGroups: { list: projectGroupsList },
+      folderWorkspaces: { list: folderWorkspacesList },
+      repos: { list: reposList },
+      projects: { list: projectsList, listHostSetups }
+    },
+    dispatchEvent: vi.fn()
+  })
+})
+
+describe('catalog merge referential stability', () => {
+  it('keeps the same projectGroups array when a refetch changes nothing', async () => {
+    const store = createTestStore()
+
+    await store.getState().fetchProjectGroups()
+    const first = store.getState().projectGroups
+    expect(first).toEqual([{ ...projectGroup, executionHostId: 'local' }])
+
+    await store.getState().fetchProjectGroups()
+
+    expect(store.getState().projectGroups).toBe(first)
+  })
+
+  it('keeps the same folderWorkspaces array (and entries) when a refetch changes nothing', async () => {
+    const store = createTestStore()
+    store.setState({ projectGroups: [{ ...projectGroup, executionHostId: 'local' }] })
+
+    await store.getState().fetchFolderWorkspaces()
+    const first = store.getState().folderWorkspaces
+    expect(first).toHaveLength(1)
+    const firstEntry = first[0]
+
+    await store.getState().fetchFolderWorkspaces()
+
+    expect(store.getState().folderWorkspaces).toBe(first)
+    expect(store.getState().folderWorkspaces[0]).toBe(firstEntry)
+  })
+
+  it('appends new entries and replaces changed ones while keeping order', async () => {
+    const store = createTestStore()
+
+    await store.getState().fetchProjectGroups()
+    const first = store.getState().projectGroups
+
+    projectGroupsList.mockImplementation(async () => [
+      clone({ ...projectGroup, name: 'Renamed' }),
+      clone(secondProjectGroup)
+    ])
+    await store.getState().fetchProjectGroups()
+
+    const merged = store.getState().projectGroups
+    expect(merged).not.toBe(first)
+    expect(merged).toEqual([
+      { ...projectGroup, name: 'Renamed', executionHostId: 'local' },
+      { ...secondProjectGroup, executionHostId: 'local' }
+    ])
+  })
+
+  it('appends new folder workspaces without disturbing existing order', async () => {
+    const store = createTestStore()
+    store.setState({ projectGroups: [{ ...projectGroup, executionHostId: 'local' }] })
+
+    await store.getState().fetchFolderWorkspaces()
+    const firstEntry = store.getState().folderWorkspaces[0]
+
+    folderWorkspacesList.mockImplementation(async () => [
+      clone(secondFolderWorkspace),
+      clone(folderWorkspace)
+    ])
+    await store.getState().fetchFolderWorkspaces()
+
+    const merged = store.getState().folderWorkspaces
+    expect(merged.map((workspace) => workspace.id)).toEqual(['folder-1', 'folder-2'])
+    // Unchanged entries keep their reference even when the array changes.
+    expect(merged[0]).toBe(firstEntry)
+  })
+
+  it('drops entries that vanish from the fetched catalog', async () => {
+    const store = createTestStore()
+    store.setState({ projectGroups: [{ ...projectGroup, executionHostId: 'local' }] })
+
+    projectGroupsList.mockImplementation(async () => [clone(secondProjectGroup)])
+    await store.getState().fetchProjectGroups()
+
+    expect(store.getState().projectGroups).toEqual([
+      { ...secondProjectGroup, executionHostId: 'local' }
+    ])
+  })
+
+  it('treats a nested linkedTask change as a change', async () => {
+    const store = createTestStore()
+    store.setState({ projectGroups: [{ ...projectGroup, executionHostId: 'local' }] })
+
+    await store.getState().fetchFolderWorkspaces()
+    const first = store.getState().folderWorkspaces
+
+    folderWorkspacesList.mockImplementation(async () => [
+      clone({
+        ...folderWorkspace,
+        linkedTask: { ...folderWorkspace.linkedTask!, title: 'Issue 7 renamed' }
+      })
+    ])
+    await store.getState().fetchFolderWorkspaces()
+
+    expect(store.getState().folderWorkspaces).not.toBe(first)
+    expect(store.getState().folderWorkspaces[0]?.linkedTask?.title).toBe('Issue 7 renamed')
+  })
+})
+
+// The sidebar burst that refills this cache only runs when these arrays change reference, so a
+// no-op fetch must not wipe it — otherwise stale-folder rows silently fail open forever.
+describe('folder path status cache retention across catalog fetches', () => {
+  it('keeps cached path statuses when a project-group refetch changes nothing', async () => {
+    const store = createTestStore()
+    await store.getState().fetchProjectGroups()
+    store.setState({ folderWorkspacePathStatuses: cachedPathStatuses })
+
+    await store.getState().fetchProjectGroups()
+
+    expect(store.getState().folderWorkspacePathStatuses).toBe(cachedPathStatuses)
+  })
+
+  it('clears cached path statuses when the project-group catalog changes', async () => {
+    const store = createTestStore()
+    await store.getState().fetchProjectGroups()
+    store.setState({ folderWorkspacePathStatuses: cachedPathStatuses })
+
+    projectGroupsList.mockImplementation(async () => [
+      clone(projectGroup),
+      clone(secondProjectGroup)
+    ])
+    await store.getState().fetchProjectGroups()
+
+    expect(store.getState().folderWorkspacePathStatuses).toEqual({})
+  })
+
+  it('keeps cached path statuses when a folder-workspace refetch changes nothing', async () => {
+    const store = createTestStore()
+    store.setState({ projectGroups: [{ ...projectGroup, executionHostId: 'local' }] })
+    await store.getState().fetchFolderWorkspaces()
+    store.setState({ folderWorkspacePathStatuses: cachedPathStatuses })
+
+    await store.getState().fetchFolderWorkspaces()
+
+    expect(store.getState().folderWorkspacePathStatuses).toBe(cachedPathStatuses)
+  })
+
+  it('clears cached path statuses when a folder workspace path changes', async () => {
+    const store = createTestStore()
+    store.setState({ projectGroups: [{ ...projectGroup, executionHostId: 'local' }] })
+    await store.getState().fetchFolderWorkspaces()
+    store.setState({ folderWorkspacePathStatuses: cachedPathStatuses })
+
+    folderWorkspacesList.mockImplementation(async () => [
+      clone({ ...folderWorkspace, folderPath: '/parent/folder-1-renamed' })
+    ])
+    await store.getState().fetchFolderWorkspaces()
+
+    expect(store.getState().folderWorkspacePathStatuses).toEqual({})
+  })
+
+  it('keeps cached path statuses when a repo refetch changes nothing', async () => {
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    store.setState({ folderWorkspacePathStatuses: cachedPathStatuses })
+
+    await store.getState().fetchRepos()
+
+    expect(store.getState().folderWorkspacePathStatuses).toBe(cachedPathStatuses)
+  })
+
+  it('clears cached path statuses when the repo catalog changes', async () => {
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    store.setState({ folderWorkspacePathStatuses: cachedPathStatuses })
+
+    reposList.mockImplementation(async () => [clone({ ...repo, path: '/repo-1-moved' })])
+    await store.getState().fetchRepos()
+
+    expect(store.getState().folderWorkspacePathStatuses).toEqual({})
+  })
+})
diff --git a/src/renderer/src/store/slices/repos-paired-runtime-add.test.ts b/src/renderer/src/store/slices/repos-paired-runtime-add.test.ts
new file mode 100644
index 00000000000..4e0f4cae622
--- /dev/null
+++ b/src/renderer/src/store/slices/repos-paired-runtime-add.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createTestStore } from './store-test-helpers'
+import {
+  installReposRuntimeRoutingHarness,
+  remoteRepo,
+  reposAdd,
+  reposPickFolder,
+  runtimeEnvironmentCall
+} from './repos-runtime-routing-fixture'
+
+vi.mock('sonner', () => ({
+  toast: {
+    error: vi.fn(),
+    info: vi.fn(),
+    success: vi.fn(),
+    warning: vi.fn()
+  }
+}))
+
+installReposRuntimeRoutingHarness()
+
+describe('paired runtime repo add routing', () => {
+  it('submits the selected host path to repo.add without native filesystem calls', async () => {
+    runtimeEnvironmentCall.mockResolvedValue({
+      id: 'rpc-paired-add',
+      ok: true,
+      result: { repo: remoteRepo },
+      _meta: { runtimeId: 'runtime-remote' }
+    })
+    const store = createTestStore()
+
+    await store.getState().addRepoPath('/srv/paired-project', 'folder', {
+      runtimeEnvironmentId: 'paired-host'
+    })
+
+    expect(runtimeEnvironmentCall).toHaveBeenCalledWith({
+      selector: 'paired-host',
+      method: 'repo.add',
+      params: { path: '/srv/paired-project', kind: 'folder' },
+      timeoutMs: 15_000
+    })
+    expect(reposAdd).not.toHaveBeenCalled()
+    expect(reposPickFolder).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/store/slices/repos.test.ts b/src/renderer/src/store/slices/repos.test.ts
index 764a5650657..efd5a998375 100644
--- a/src/renderer/src/store/slices/repos.test.ts
+++ b/src/renderer/src/store/slices/repos.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import { createTestStore, makeWorktree } from './store-test-helpers'
 import { workItemsCacheKey } from './github'
-import type { Project, ProjectHostSetup } from '../../../../shared/types'
+import type { Project, ProjectHostSetup, Repo } from '../../../../shared/types'
 import { toast } from 'sonner'
 import {
   installReposRuntimeRoutingHarness,
@@ -52,6 +52,46 @@ describe('repo slice runtime routing', () => {
     expect(runtimeEnvironmentCall).not.toHaveBeenCalled()
   })
 
+  it('keeps the repos array identity across a refetch that changes nothing', async () => {
+    // Why: main rebuilds nested records (hookSettings et al) per list and IPC clones them, so a
+    // production-shaped repo — not a scalar-only fixture — is what proves reconciliation works.
+    const hydrated = (): Repo => ({
+      ...localRepo,
+      kind: 'git',
+      gitUsername: 'octocat',
+      hookSettings: { mode: 'auto', scripts: { setup: 'echo hi', archive: '' } },
+      gitRemoteIdentity: {
+        canonicalKey: 'github.com/octocat/local',
+        remoteName: 'origin',
+        remoteUrl: 'git@github.com:octocat/local.git'
+      },
+      importedExternalWorktreePaths: ['/local/wt']
+    })
+    reposList.mockImplementation(async () => [hydrated()])
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const reposRef = store.getState().repos
+
+    await store.getState().fetchRepos()
+
+    // Why: identity-keyed renderer memos (repo lookup index, selectors) rebuild on a new array.
+    expect(store.getState().repos).toBe(reposRef)
+    expect(store.getState().repos[0]).toBe(reposRef[0])
+  })
+
+  it('replaces the repos array identity when a refetch adds a repo', async () => {
+    reposList.mockResolvedValue([localRepo])
+    const store = createTestStore()
+    await store.getState().fetchRepos()
+    const reposRef = store.getState().repos
+    reposList.mockResolvedValue([localRepo, { ...localRepo, id: 'second', path: '/second' }])
+
+    await store.getState().fetchRepos()
+
+    expect(store.getState().repos).not.toBe(reposRef)
+    expect(store.getState().repos).toHaveLength(2)
+  })
+
   it('fetches repos from the active remote runtime environment', async () => {
     runtimeEnvironmentCall.mockResolvedValue({
       id: 'rpc-1',
diff --git a/src/renderer/src/store/slices/repos.ts b/src/renderer/src/store/slices/repos.ts
index ef7d60c2818..1f29b81f83a 100644
--- a/src/renderer/src/store/slices/repos.ts
+++ b/src/renderer/src/store/slices/repos.ts
@@ -72,6 +72,7 @@ import {
 import { syncRuntimeGitForkDefaultBranch } from '../../runtime/runtime-git-client'
 import { toRuntimeWorktreeSelector } from '../../runtime/runtime-worktree-selector'
 import { buildDismissedOnboardingFolderAgentStartup } from '@/lib/onboarding-folder-agent-startup'
+import { isNativeChatTranscriptLocalReadable } from '@/lib/native-chat-transcript-readability'
 import { markOnboardingProjectAdded } from '@/lib/onboarding-project-checklist'
 import { filterSetupScriptPromptDismissalsToValidRepos } from '@/lib/setup-script-prompt'
 import { notifyInstalledAgentSkillsChanged } from '@/hooks/installed-agent-skill-discovery'
@@ -159,6 +160,7 @@ type FolderWorkspaceUpdates = Partial<
     | 'pendingFirstAgentMessageRename'
     | 'firstAgentMessageRenameError'
     | 'lastActivityAt'
+    | 'diffComments'
   >
 >
 
@@ -858,31 +860,90 @@ function mergeFetchedProjectCompatibilityForHost({
   }
 }
 
+function isPlainCatalogObject(value: unknown): value is Record<string, unknown> {
+  if (typeof value !== 'object' || value === null) {
+    return false
+  }
+  const prototype = Object.getPrototypeOf(value)
+  return prototype === Object.prototype || prototype === null
+}
+
+// Why: catalog fetches rebuild every entry from IPC, so identity alone never matches;
+// structural equality is what lets an unchanged refetch stay a no-op.
+function areCatalogEntriesEqual(a: unknown, b: unknown): boolean {
+  if (a === b) {
+    return true
+  }
+  if (Array.isArray(a) || Array.isArray(b)) {
+    return (
+      Array.isArray(a) &&
+      Array.isArray(b) &&
+      a.length === b.length &&
+      a.every((entry, index) => areCatalogEntriesEqual(entry, b[index]))
+    )
+  }
+  if (!isPlainCatalogObject(a) || !isPlainCatalogObject(b)) {
+    return false
+  }
+  const keys = Object.keys(a)
+  if (keys.length !== Object.keys(b).length) {
+    return false
+  }
+  return keys.every((key) => Object.hasOwn(b, key) && areCatalogEntriesEqual(a[key], b[key]))
+}
+
+// Why: returning `base` unchanged keeps referential-equality selectors quiet, so a
+// `repos:changed` echo doesn't re-force folder path-status fetches for every row.
 function mergeByIdentity<T>(
   base: readonly T[],
   overlay: readonly T[],
   getIdentity: (entry: T) => string
-): T[] {
+): readonly T[] {
   const merged = [...base]
   const indexById = new Map(merged.map((entry, index) => [getIdentity(entry), index]))
+  let changed = false
   for (const entry of overlay) {
     const identity = getIdentity(entry)
     const index = indexById.get(identity)
     if (index === undefined) {
       indexById.set(identity, merged.length)
       merged.push(entry)
-    } else {
-      merged[index] = entry
+      changed = true
+      continue
     }
+    if (areCatalogEntriesEqual(merged[index], entry)) {
+      continue
+    }
+    merged[index] = entry
+    changed = true
   }
-  return merged
+  return changed ? merged : base
+}
+
+// Why: `preserved` keeps `previous`'s order and element refs, so an equal-length no-op
+// merge can hand the original store array straight back.
+function unchangedMergeSource<T>(
+  previous: readonly T[],
+  preserved: readonly T[],
+  merged: readonly T[]
+): readonly T[] {
+  return merged === preserved && preserved.length === previous.length ? previous : merged
+}
+
+// Why: the sidebar effect watching these catalog arrays is the only thing that refills the
+// folder path-status cache, so a no-op refetch must not wipe it — nothing would repopulate it.
+function catalogRowsUnchanged<T>(next: readonly T[], previous: readonly T[]): boolean {
+  return (
+    next === previous ||
+    (next.length === previous.length && next.every((row, index) => row === previous[index]))
+  )
 }
 
 function mergeFetchedReposForHost(
   previous: readonly Repo[],
-  fetched: Repo[],
+  fetched: readonly Repo[],
   hostId: string
-): Repo[] {
+): readonly Repo[] {
   const fetchedWithProjectGroups = applyInheritedProjectGroups(previous, fetched)
   const fetchedIdentities = new Set(fetchedWithProjectGroups.map(getRepoHostIdentity))
   const preserved = previous.filter((repo) => {
@@ -975,7 +1036,7 @@ function mergeFetchedProjectGroupsForHost(
   previous: readonly ProjectGroup[],
   fetched: ProjectGroup[],
   hostId: string
-): ProjectGroup[] {
+): readonly ProjectGroup[] {
   const fetchedIdentities = new Set(fetched.map(getProjectGroupHostIdentity))
   const preserved = previous.filter((group) => {
     const existingHostId = getProjectGroupHostId(group)
@@ -984,7 +1045,11 @@ function mergeFetchedProjectGroupsForHost(
       fetchedIdentities.has(getProjectGroupHostIdentity(group))
     )
   })
-  return mergeByIdentity(preserved, fetched, getProjectGroupHostIdentity)
+  return unchangedMergeSource(
+    previous,
+    preserved,
+    mergeByIdentity(preserved, fetched, getProjectGroupHostIdentity)
+  )
 }
 
 function getFolderWorkspaceHostId(
@@ -1032,7 +1097,7 @@ function mergeFetchedFolderWorkspacesForHost({
   fetched: FolderWorkspace[]
   projectGroups: readonly ProjectGroup[]
   hostId: string
-}): FolderWorkspace[] {
+}): readonly FolderWorkspace[] {
   const fetchedIdentities = new Set(
     fetched.map((workspace) => getFolderWorkspaceHostIdentity(workspace, projectGroups))
   )
@@ -1043,13 +1108,17 @@ function mergeFetchedFolderWorkspacesForHost({
       fetchedIdentities.has(getFolderWorkspaceHostIdentity(workspace, projectGroups))
     )
   })
-  return mergeByIdentity(preserved, fetched, (workspace) =>
-    getFolderWorkspaceHostIdentity(workspace, projectGroups)
+  return unchangedMergeSource(
+    previous,
+    preserved,
+    mergeByIdentity(preserved, fetched, (workspace) =>
+      getFolderWorkspaceHostIdentity(workspace, projectGroups)
+    )
   )
 }
 
 type FetchedRepoCatalog = {
-  repos: Repo[]
+  repos: readonly Repo[]
   projectHostSetupCompatibility: ProjectHostSetupProjection
   hostId: ReturnType<typeof getRuntimeTargetHostId>
 }
@@ -1110,7 +1179,7 @@ function mergeFetchedRepoCatalog(
   catalog: FetchedRepoCatalog,
   currentRepos: readonly Repo[]
 ): {
-  repos: Repo[]
+  repos: readonly Repo[]
   projectHostSetupCompatibility: ProjectHostSetupProjection
   hostId: ReturnType<typeof getRuntimeTargetHostId>
 } {
@@ -1239,7 +1308,7 @@ async function fetchProjectGroupCatalogForTarget(
 function mergeFetchedProjectGroupCatalog(
   catalog: FetchedProjectGroupCatalog,
   currentProjectGroups: readonly ProjectGroup[]
-): { projectGroups: ProjectGroup[]; hostId: ReturnType<typeof getRuntimeTargetHostId> } {
+): { projectGroups: readonly ProjectGroup[]; hostId: ReturnType<typeof getRuntimeTargetHostId> } {
   return {
     projectGroups: mergeFetchedProjectGroupsForHost(
       currentProjectGroups,
@@ -1292,7 +1361,7 @@ function mergeFetchedFolderWorkspaceCatalog(
   currentFolderWorkspaces: readonly FolderWorkspace[],
   projectGroups: readonly ProjectGroup[]
 ): {
-  folderWorkspaces: FolderWorkspace[]
+  folderWorkspaces: readonly FolderWorkspace[]
   hostId: ReturnType<typeof getRuntimeTargetHostId>
 } {
   return {
@@ -1619,11 +1688,11 @@ function getFolderWorkspacePathStatusRequestSnapshotForRead(
 }
 
 export type RepoSlice = {
-  repos: Repo[]
+  repos: readonly Repo[]
   projects: Project[]
   projectHostSetups: ProjectHostSetup[]
-  projectGroups: ProjectGroup[]
-  folderWorkspaces: FolderWorkspace[]
+  projectGroups: readonly ProjectGroup[]
+  folderWorkspaces: readonly FolderWorkspace[]
   folderWorkspacePathStatuses: Record<string, FolderWorkspacePathStatusCacheEntry>
   activeRepoId: string | null
   // Monotonic sequence so overlapping catalog fetches can drop stale same-host results (#7020).
@@ -1932,7 +2001,9 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
           pendingSshRepoReadoptions: reconciliation.pendingReadoptions,
           ...reconcileReadoptedSshWorktreeState(s, s.pendingSshRepoReadoptions),
           ...mergedProjectCompatibility,
-          folderWorkspacePathStatuses: {},
+          ...(catalogRowsUnchanged(prunedRepos, s.repos)
+            ? {}
+            : { folderWorkspacePathStatuses: {} }),
           activeRepoId: s.activeRepoId && validRepoIds.has(s.activeRepoId) ? s.activeRepoId : null,
           filterRepoIds: s.filterRepoIds.filter((projectId) => validRepoIds.has(projectId)),
           setupScriptPromptDismissedRepoIds: filterSetupScriptPromptDismissalsToValidRepos(
@@ -2083,7 +2154,9 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
           pendingSshRepoReadoptions: reconciliation.pendingReadoptions,
           ...reconcileReadoptedSshWorktreeState(s, s.pendingSshRepoReadoptions),
           ...mergedProjectCompatibility,
-          folderWorkspacePathStatuses: {},
+          ...(catalogRowsUnchanged(finalizedRepos, s.repos)
+            ? {}
+            : { folderWorkspacePathStatuses: {} }),
           activeRepoId: s.activeRepoId,
           filterRepoIds: s.filterRepoIds,
           setupScriptPromptDismissedRepoIds: s.setupScriptPromptDismissedRepoIds
@@ -2163,15 +2236,18 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
       if (!isHostCatalogFenceCurrent(get, fence)) {
         return
       }
-      set((current) =>
-        isHostCatalogFenceCurrent(get, fence)
-          ? {
-              projectGroups: mergeFetchedProjectGroupCatalog(catalog, current.projectGroups)
-                .projectGroups,
-              folderWorkspacePathStatuses: {}
-            }
-          : current
-      )
+      set((current) => {
+        if (!isHostCatalogFenceCurrent(get, fence)) {
+          return current
+        }
+        const { projectGroups } = mergeFetchedProjectGroupCatalog(catalog, current.projectGroups)
+        return {
+          projectGroups,
+          ...(catalogRowsUnchanged(projectGroups, current.projectGroups)
+            ? {}
+            : { folderWorkspacePathStatuses: {} })
+        }
+      })
     } catch (err) {
       console.error('Failed to fetch project groups:', err)
     }
@@ -2183,15 +2259,18 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
       if (!isHostCatalogFenceCurrent(get, fence)) {
         return
       }
-      set((s) =>
-        isHostCatalogFenceCurrent(get, fence)
-          ? {
-              projectGroups: mergeFetchedProjectGroupCatalog(catalog, s.projectGroups)
-                .projectGroups,
-              folderWorkspacePathStatuses: {}
-            }
-          : s
-      )
+      set((s) => {
+        if (!isHostCatalogFenceCurrent(get, fence)) {
+          return s
+        }
+        const { projectGroups } = mergeFetchedProjectGroupCatalog(catalog, s.projectGroups)
+        return {
+          projectGroups,
+          ...(catalogRowsUnchanged(projectGroups, s.projectGroups)
+            ? {}
+            : { folderWorkspacePathStatuses: {} })
+        }
+      })
     }
 
     try {
@@ -2249,7 +2328,12 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
           current.folderWorkspaces,
           current.projectGroups
         )
-        return { folderWorkspaces, folderWorkspacePathStatuses: {} }
+        return {
+          folderWorkspaces,
+          ...(catalogRowsUnchanged(folderWorkspaces, current.folderWorkspaces)
+            ? {}
+            : { folderWorkspacePathStatuses: {} })
+        }
       })
     } catch (err) {
       console.error('Failed to fetch folder workspaces:', err)
@@ -2277,13 +2361,16 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
             current.projectGroups
           )
         )
+        const { folderWorkspaces } = mergeFetchedFolderWorkspaceCatalog(
+          catalog,
+          current.folderWorkspaces,
+          current.projectGroups
+        )
         return {
-          folderWorkspaces: mergeFetchedFolderWorkspaceCatalog(
-            catalog,
-            current.folderWorkspaces,
-            current.projectGroups
-          ).folderWorkspaces,
-          folderWorkspacePathStatuses: {}
+          folderWorkspaces,
+          ...(catalogRowsUnchanged(folderWorkspaces, current.folderWorkspaces)
+            ? {}
+            : { folderWorkspacePathStatuses: {} })
         }
       })
     }
@@ -2615,6 +2702,20 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
         })
         return false
       }
+      if (updates.diffComments !== undefined && updated.diffComments === undefined) {
+        // Why: older paired runtimes strip this optional field; reconcile instead of showing an unsaved note.
+        await reconcileFailedFolderWorkspaceUpdate({
+          target,
+          folderWorkspaceId,
+          updateIdentity,
+          ownerHostId,
+          ticket: updateTicket,
+          coordinator: folderWorkspaceUpdates,
+          set,
+          get
+        })
+        return false
+      }
       const latestFields = folderWorkspaceUpdates.latestFields(updateIdentity, updateTicket)
       const catalogChanged = folderWorkspaceUpdates.catalogChanged(updateIdentity, updateTicket)
       if (latestFields.length > 0) {
@@ -3266,7 +3367,8 @@ export const createRepoSlice: StateCreator<AppState, [], [], RepoSlice> = (set,
         const startup = buildDismissedOnboardingFolderAgentStartup(
           get().settings,
           onboarding,
-          hadProjectBeforeAdd
+          hadProjectBeforeAdd,
+          isNativeChatTranscriptLocalReadable(repo.connectionId)
         )
         activateAndRevealWorktree(folderWorktree.id, {
           sidebarRevealBehavior: 'auto',
diff --git a/src/renderer/src/store/slices/runtime-environment-disconnect-toast.ts b/src/renderer/src/store/slices/runtime-environment-disconnect-toast.ts
new file mode 100644
index 00000000000..00ef737ca59
--- /dev/null
+++ b/src/renderer/src/store/slices/runtime-environment-disconnect-toast.ts
@@ -0,0 +1,86 @@
+import { toast } from 'sonner'
+import { translate } from '@/i18n/i18n'
+import type { AppState } from '../types'
+
+const activeRuntimeDisconnectedToasts = new Map<string, symbol>()
+const RUNTIME_DISCONNECTED_TOAST_DURATION_MS = 4_000
+
+function getRuntimeDisconnectedToastId(environmentId: string): string {
+  return `runtime-environment-disconnected:${environmentId}`
+}
+
+export function showRuntimeDisconnectedToast(
+  environmentId: string,
+  getState: () => AppState
+): void {
+  const environment = getState().runtimeEnvironments.find((entry) => entry.id === environmentId)
+  const toastId = getRuntimeDisconnectedToastId(environmentId)
+  const activation = Symbol(toastId)
+  const title = environment?.name
+    ? translate(
+        'auto.store.slices.runtime.status.runtimeHostUnreachableNamed',
+        "Can't reach {{hostName}}",
+        { hostName: environment.name }
+      )
+    : translate(
+        'auto.store.slices.runtime.status.runtimeHostUnreachable',
+        "Can't reach Orca server"
+      )
+  activeRuntimeDisconnectedToasts.set(toastId, activation)
+  const clearActiveToast = (): void => {
+    if (activeRuntimeDisconnectedToasts.get(toastId) === activation) {
+      activeRuntimeDisconnectedToasts.delete(toastId)
+    }
+  }
+  let retrying = false
+  const showToast = (duration = RUNTIME_DISCONNECTED_TOAST_DURATION_MS): void => {
+    toast.warning(title, {
+      id: toastId,
+      description: translate(
+        'auto.store.slices.runtime.status.runtimeHostDisconnectedDescription',
+        'Check that Orca is running on this server and that your network connection is working, then try again.'
+      ),
+      duration,
+      action: {
+        label: translate('auto.store.slices.runtime.status.tryAgain', 'Try again'),
+        onClick: (event) => {
+          // Why: Sonner otherwise deletes the keyed toast after the action callback.
+          event.preventDefault()
+          if (retrying) {
+            return
+          }
+          retrying = true
+          showToast(Number.POSITIVE_INFINITY)
+          void getState()
+            .refreshRuntimeEnvironmentStatus(environmentId)
+            .then((reachable) => {
+              const stillSaved = getState().runtimeEnvironments.some(
+                (entry) => entry.id === environmentId
+              )
+              if (
+                !reachable &&
+                stillSaved &&
+                activeRuntimeDisconnectedToasts.get(toastId) === activation
+              ) {
+                showToast()
+              }
+            })
+            .finally(() => {
+              retrying = false
+            })
+        }
+      },
+      onDismiss: clearActiveToast,
+      onAutoClose: clearActiveToast
+    })
+  }
+  showToast()
+}
+
+export function dismissRuntimeDisconnectedToast(environmentId: string): void {
+  const toastId = getRuntimeDisconnectedToastId(environmentId)
+  if (!activeRuntimeDisconnectedToasts.delete(toastId)) {
+    return
+  }
+  toast.dismiss?.(toastId)
+}
diff --git a/src/renderer/src/store/slices/runtime-environment-status-equality.ts b/src/renderer/src/store/slices/runtime-environment-status-equality.ts
new file mode 100644
index 00000000000..04570e461e3
--- /dev/null
+++ b/src/renderer/src/store/slices/runtime-environment-status-equality.ts
@@ -0,0 +1,12 @@
+import type { RuntimeEnvironmentStatus } from './runtime-status'
+import { persistedUIValuesEqual } from '../../../../shared/persisted-ui-equality'
+
+// Why: `checkedAt` is dropped — no consumer reads it, and a per-probe timestamp
+// would make every entry unequal and defeat the caller's identity guard.
+// Everything else, including fields added later, is compared structurally.
+export function runtimeEnvironmentStatusesEqual(
+  { checkedAt: _leftCheckedAt, ...left }: RuntimeEnvironmentStatus,
+  { checkedAt: _rightCheckedAt, ...right }: RuntimeEnvironmentStatus
+): boolean {
+  return persistedUIValuesEqual(left, right)
+}
diff --git a/src/renderer/src/store/slices/runtime-pane-title-sort-epoch.test.ts b/src/renderer/src/store/slices/runtime-pane-title-sort-epoch.test.ts
index b6c10e014ed..4c917c15a27 100644
--- a/src/renderer/src/store/slices/runtime-pane-title-sort-epoch.test.ts
+++ b/src/renderer/src/store/slices/runtime-pane-title-sort-epoch.test.ts
@@ -226,6 +226,42 @@ describe('runtimePaneTitle → sortEpoch', () => {
     expect(publications).toBe(tabCount * 2)
   })
 
+  it('publishes a bulk tab-title update once across worktrees', () => {
+    const store = createTestStore()
+    const tabCount = 20
+    const worktrees = Array.from({ length: tabCount }, (_, index) =>
+      makeWorktree({ id: `wt-${index}`, repoId: 'repo1', path: `/path/wt-${index}` })
+    )
+    seedStore(store, {
+      worktreesByRepo: { repo1: worktrees },
+      tabsByWorktree: Object.fromEntries(
+        worktrees.map((worktree, index) => [
+          worktree.id,
+          [makeTab({ id: `tab-${index}`, worktreeId: worktree.id })]
+        ])
+      )
+    })
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    store.getState().updateTabTitles(
+      worktrees.map((_, index) => ({
+        tabId: `tab-${index}`,
+        title: `Codex ready ${index}`
+      }))
+    )
+
+    unsubscribe()
+    expect(publications).toBe(1)
+    for (let index = 0; index < tabCount; index += 1) {
+      expect(store.getState().tabsByWorktree[`wt-${index}`]?.[0]?.title).toBe(
+        `Codex ready ${index}`
+      )
+    }
+  })
+
   it('does not enumerate terminal tabs when only the spinner frame changes', () => {
     const store = createTestStore()
     seedStore(store, {
diff --git a/src/renderer/src/store/slices/runtime-status-hydration.ts b/src/renderer/src/store/slices/runtime-status-hydration.ts
new file mode 100644
index 00000000000..b8555a38d41
--- /dev/null
+++ b/src/renderer/src/store/slices/runtime-status-hydration.ts
@@ -0,0 +1,109 @@
+import type { PublicKnownRuntimeEnvironment } from '../../../../shared/runtime-environments'
+
+/** Matches the renderer's other catalog-style cache TTLs (checks, work items, Jira). */
+export const RUNTIME_CATALOG_STALE_MS = 60_000
+
+let lastCatalogListedAt = 0
+
+/** Why: status coverage cannot observe catalog edits made by another client or the
+ * orca CLI, so an old-enough listing must be re-read even when coverage looks complete. */
+export function isRuntimeCatalogListingStale(): boolean {
+  return Date.now() - lastCatalogListedAt > RUNTIME_CATALOG_STALE_MS
+}
+
+/** Why: this timestamp is module-global, so without a reset one test's clock leaks
+ * into every test after it and makes list-count assertions order-dependent. */
+export function resetRuntimeCatalogListingForTests(): void {
+  lastCatalogListedAt = 0
+}
+
+type RuntimeStatusHydrationDependencies = {
+  listEnvironments: () => Promise<PublicKnownRuntimeEnvironment[]>
+  getCurrentEnvironments: () => PublicKnownRuntimeEnvironment[]
+  publishEnvironments: (environments: PublicKnownRuntimeEnvironment[]) => void
+  refreshEnvironmentStatus: (environmentId: string) => Promise<boolean>
+  markCatalogSettled: () => void
+}
+
+function environmentRevisions(
+  environments: PublicKnownRuntimeEnvironment[]
+): ReadonlyMap<string, number> {
+  return new Map(
+    environments.map((environment) => [
+      environment.id,
+      environment.pairingRevision ?? environment.createdAt
+    ])
+  )
+}
+
+function revisionsMatch(
+  environments: PublicKnownRuntimeEnvironment[],
+  expected: ReadonlyMap<string, number>
+): boolean {
+  const current = environmentRevisions(environments)
+  if (current.size !== expected.size) {
+    return false
+  }
+  for (const [environmentId, revision] of current) {
+    if (expected.get(environmentId) !== revision) {
+      return false
+    }
+  }
+  return true
+}
+
+export function createRuntimeStatusHydration({
+  listEnvironments,
+  getCurrentEnvironments,
+  publishEnvironments,
+  refreshEnvironmentStatus,
+  markCatalogSettled
+}: RuntimeStatusHydrationDependencies): () => Promise<void> {
+  let inFlight: Promise<void> | null = null
+  let expectedRevisions: ReadonlyMap<string, number> | null = null
+  let rerunRequested = false
+
+  return () => {
+    if (inFlight) {
+      if (expectedRevisions && !revisionsMatch(getCurrentEnvironments(), expectedRevisions)) {
+        rerunRequested = true
+      }
+      return inFlight
+    }
+    const hydration = (async (): Promise<void> => {
+      // Catalog changes queue a current-catalog pass without duplicating stable overlaps.
+      do {
+        rerunRequested = false
+        const revisionsAtListStart = environmentRevisions(getCurrentEnvironments())
+        expectedRevisions = revisionsAtListStart
+        let environments: PublicKnownRuntimeEnvironment[]
+        try {
+          environments = await listEnvironments()
+        } catch (err) {
+          console.error('Failed to list runtime environments for status hydration:', err)
+          markCatalogSettled()
+          return
+        }
+        lastCatalogListedAt = Date.now()
+        if (!revisionsMatch(getCurrentEnvironments(), revisionsAtListStart)) {
+          rerunRequested = true
+          continue
+        }
+        expectedRevisions = environmentRevisions(environments)
+        publishEnvironments(environments)
+        await Promise.allSettled(
+          environments.map((environment) => refreshEnvironmentStatus(environment.id))
+        )
+      } while (
+        rerunRequested ||
+        (expectedRevisions && !revisionsMatch(getCurrentEnvironments(), expectedRevisions))
+      )
+    })()
+    inFlight = hydration.finally(() => {
+      inFlight = null
+      expectedRevisions = null
+      rerunRequested = false
+    })
+    return inFlight
+  }
+}
diff --git a/src/renderer/src/store/slices/runtime-status-refresh.ts b/src/renderer/src/store/slices/runtime-status-refresh.ts
new file mode 100644
index 00000000000..5609cb4c5a7
--- /dev/null
+++ b/src/renderer/src/store/slices/runtime-status-refresh.ts
@@ -0,0 +1,29 @@
+import type { RuntimeStatus } from '../../../../shared/runtime-types'
+import { unwrapRuntimeRpcResult } from '@/runtime/runtime-rpc-client'
+import { getRuntimeEnvironmentRevision } from '@/runtime/runtime-environment-revision'
+
+export async function refreshRuntimeEnvironmentStatus(
+  environmentId: string,
+  timeoutMs: number,
+  publish: (status: RuntimeStatus | null) => void
+): Promise<boolean> {
+  const expectedEnvironmentRevision = getRuntimeEnvironmentRevision(environmentId)
+  try {
+    const response = await window.api.runtimeEnvironments.getStatus({
+      selector: environmentId,
+      timeoutMs
+    })
+    const status = unwrapRuntimeRpcResult<RuntimeStatus>(response)
+    if (getRuntimeEnvironmentRevision(environmentId) !== expectedEnvironmentRevision) {
+      return false
+    }
+    publish(status)
+    return true
+  } catch {
+    if (getRuntimeEnvironmentRevision(environmentId) !== expectedEnvironmentRevision) {
+      return false
+    }
+    publish(null)
+    return false
+  }
+}
diff --git a/src/renderer/src/store/slices/runtime-status.test.ts b/src/renderer/src/store/slices/runtime-status.test.ts
index 1462d5ea702..afdadb266a9 100644
--- a/src/renderer/src/store/slices/runtime-status.test.ts
+++ b/src/renderer/src/store/slices/runtime-status.test.ts
@@ -15,6 +15,7 @@ import {
   getRuntimeEnvironmentConnectionGeneration
 } from './runtime-status'
 import { getProviderRuntimeContextKey } from '@/lib/provider-runtime-context'
+import { getPairedDeviceIdsByEnvironment } from '@/components/sidebar/workspace-creator-visibility'
 
 vi.mock('sonner', () => ({
   toast: { warning: vi.fn(), dismiss: vi.fn() }
@@ -74,6 +75,16 @@ function stubRuntimeEnvironmentApi({
   return { getStatus, list }
 }
 
+function deferred<T>() {
+  let resolve: (value: T) => void = () => {}
+  let reject: (reason?: unknown) => void = () => {}
+  const promise = new Promise<T>((promiseResolve, promiseReject) => {
+    resolve = promiseResolve
+    reject = promiseReject
+  })
+  return { promise, resolve, reject }
+}
+
 beforeEach(() => {
   clearRuntimeEnvironmentConnectionGenerationsForTests()
   vi.mocked(toast.warning).mockReset()
@@ -173,6 +184,127 @@ describe('runtime-status slice', () => {
     expect(map.get('env-a')).toEqual({ status: null, checkedAt: 5, connectionGeneration: 1 })
   })
 
+  it('retains a learned paired device id after disconnecting a legacy environment', () => {
+    const store = createSliceStore()
+    store.getState().setRuntimeEnvironments([makeEnvironment()])
+    store.getState().setRuntimeEnvironmentStatus('env-a', {
+      status: makeStatus({ pairedDeviceId: 'client-device' }),
+      checkedAt: 1
+    })
+    store.getState().setRuntimeEnvironmentStatus('env-a', { status: null, checkedAt: 2 })
+
+    expect(
+      getPairedDeviceIdsByEnvironment(
+        store.getState().runtimeEnvironments,
+        store.getState().runtimeStatusByEnvironmentId
+      ).get('env-a')
+    ).toBe('client-device')
+  })
+
+  it('still learns a paired device id when the re-probed status is unchanged', () => {
+    const store = createSliceStore()
+    // Why: the status arrives before the catalog, so only the second (identical) probe
+    // can carry the id onto the environment — the map guard must not swallow it.
+    const status = makeStatus({ pairedDeviceId: 'client-device' })
+    store.getState().setRuntimeEnvironmentStatus('env-a', { status, checkedAt: 1 })
+    store.getState().setRuntimeEnvironments([makeEnvironment()])
+    const before = store.getState().runtimeStatusByEnvironmentId
+
+    store.getState().setRuntimeEnvironmentStatus('env-a', { status, checkedAt: 2 })
+
+    expect(store.getState().runtimeEnvironments[0].pairedDeviceId).toBe('client-device')
+    expect(store.getState().runtimeStatusByEnvironmentId).toBe(before)
+  })
+
+  it('keeps the map reference when a re-probe returns an identical status', () => {
+    const store = createSliceStore()
+    store.getState().setRuntimeEnvironmentStatus('env-a', { status: makeStatus(), checkedAt: 1 })
+    const before = store.getState().runtimeStatusByEnvironmentId
+    const entryBefore = before.get('env-a')
+    const generationBefore = getRuntimeEnvironmentConnectionGeneration('env-a')
+
+    store.getState().setRuntimeEnvironmentStatus('env-a', { status: makeStatus(), checkedAt: 2 })
+
+    expect(store.getState().runtimeStatusByEnvironmentId).toBe(before)
+    expect(store.getState().runtimeStatusByEnvironmentId.get('env-a')).toBe(entryBefore)
+    expect(getRuntimeEnvironmentConnectionGeneration('env-a')).toBe(generationBefore)
+  })
+
+  it('keeps the map reference when an unreachable server is re-probed', () => {
+    const store = createSliceStore()
+    store.setState({ runtimeEnvironments: [makeEnvironment()] })
+    store.getState().setRuntimeEnvironmentStatus('env-a', { status: null, checkedAt: 1 })
+    const before = store.getState().runtimeStatusByEnvironmentId
+
+    store.getState().setRuntimeEnvironmentStatus('env-a', { status: null, checkedAt: 2 })
+
+    expect(store.getState().runtimeStatusByEnvironmentId).toBe(before)
+    expect(toast.warning).not.toHaveBeenCalled()
+  })
+
+  it('replaces the map when any status field changes, nested ones included', () => {
+    const store = createSliceStore()
+    store.getState().setRuntimeEnvironmentStatus('env-a', {
+      status: makeStatus({ liveTabCount: 1, capabilities: ['a'] }),
+      checkedAt: 1
+    })
+    const afterFirst = store.getState().runtimeStatusByEnvironmentId
+
+    store.getState().setRuntimeEnvironmentStatus('env-a', {
+      status: makeStatus({ liveTabCount: 2, capabilities: ['a'] }),
+      checkedAt: 2
+    })
+    const afterScalarChange = store.getState().runtimeStatusByEnvironmentId
+    expect(afterScalarChange).not.toBe(afterFirst)
+    expect(afterScalarChange.get('env-a')?.checkedAt).toBe(2)
+
+    store.getState().setRuntimeEnvironmentStatus('env-a', {
+      status: makeStatus({ liveTabCount: 2, capabilities: ['a', 'b'] }),
+      checkedAt: 3
+    })
+    const afterNestedChange = store.getState().runtimeStatusByEnvironmentId
+    expect(afterNestedChange).not.toBe(afterScalarChange)
+    expect(afterNestedChange.get('env-a')?.status?.capabilities).toEqual(['a', 'b'])
+  })
+
+  it('still writes and toasts across null and non-null transitions', () => {
+    const store = createSliceStore()
+    store.setState({ runtimeEnvironments: [makeEnvironment()] })
+    store.getState().setRuntimeEnvironmentStatus('env-a', { status: makeStatus(), checkedAt: 1 })
+    const connected = store.getState().runtimeStatusByEnvironmentId
+    const generationConnected = getRuntimeEnvironmentConnectionGeneration('env-a')
+
+    store.getState().setRuntimeEnvironmentStatus('env-a', { status: null, checkedAt: 2 })
+    const disconnected = store.getState().runtimeStatusByEnvironmentId
+    expect(disconnected).not.toBe(connected)
+    expect(disconnected.get('env-a')?.status).toBeNull()
+    expect(toast.warning).toHaveBeenCalledTimes(1)
+
+    store.getState().setRuntimeEnvironmentStatus('env-a', { status: makeStatus(), checkedAt: 3 })
+    const reconnected = store.getState().runtimeStatusByEnvironmentId
+    expect(reconnected).not.toBe(disconnected)
+    expect(getRuntimeEnvironmentConnectionGeneration('env-a')).toBe(generationConnected + 1)
+    expect(reconnected.get('env-a')?.connectionGeneration).toBe(generationConnected + 1)
+    expect(toast.dismiss).toHaveBeenCalledWith('runtime-environment-disconnected:env-a')
+  })
+
+  it('replaces the map when the same status arrives under a new runtime id', () => {
+    const store = createSliceStore()
+    store.getState().setRuntimeEnvironmentStatus('env-a', {
+      status: makeStatus({ runtimeId: 'runtime-a' }),
+      checkedAt: 1
+    })
+    const before = store.getState().runtimeStatusByEnvironmentId
+
+    store.getState().setRuntimeEnvironmentStatus('env-a', {
+      status: makeStatus({ runtimeId: 'runtime-b' }),
+      checkedAt: 2
+    })
+
+    expect(store.getState().runtimeStatusByEnvironmentId).not.toBe(before)
+    expect(store.getState().runtimeStatusByEnvironmentId.get('env-a')?.connectionGeneration).toBe(2)
+  })
+
   it('does not toast when the first probe finds a saved server offline', () => {
     const store = createSliceStore()
     store.setState({ runtimeEnvironments: [makeEnvironment()] })
@@ -361,6 +493,28 @@ describe('runtime-status slice', () => {
     expect(store.getState().runtimeStatusByEnvironmentId.get('env-a')?.connectionGeneration).toBe(1)
   })
 
+  it.each(['success', 'failure'] as const)(
+    'drops a stale refresh %s after the same environment id is re-paired',
+    async (outcome) => {
+      const probe = deferred<ReturnType<typeof createCompatibleRuntimeStatusResponse>>()
+      const getStatus = vi.fn().mockReturnValue(probe.promise)
+      stubRuntimeEnvironmentApi({ getStatus })
+      const store = createSliceStore()
+      store.getState().setRuntimeEnvironments([makeEnvironment({ pairingRevision: 1 })])
+
+      const refresh = store.getState().refreshRuntimeEnvironmentStatus('env-a')
+      store.getState().setRuntimeEnvironments([makeEnvironment({ pairingRevision: 2 })])
+      if (outcome === 'success') {
+        probe.resolve(createCompatibleRuntimeStatusResponse('runtime-old'))
+      } else {
+        probe.reject(new Error('old connection closed'))
+      }
+
+      await expect(refresh).resolves.toBe(false)
+      expect(store.getState().runtimeStatusByEnvironmentId.has('env-a')).toBe(false)
+    }
+  )
+
   it('advances connection generation after recovery without churning stable status polls', () => {
     const store = createSliceStore()
     store.getState().setRuntimeEnvironmentStatus('env-a', {
@@ -590,20 +744,169 @@ describe('runtime-status slice', () => {
     )
   })
 
+  it('shares one full catalog and status sweep across overlapping hydrations', async () => {
+    const environments = [makeEnvironment(), makeEnvironment({ id: 'env-b', name: 'Build Box' })]
+    const probeA = deferred<ReturnType<typeof createCompatibleRuntimeStatusResponse>>()
+    const probeB = deferred<ReturnType<typeof createCompatibleRuntimeStatusResponse>>()
+    const getStatus = vi.fn(({ selector }: { selector: string }) =>
+      selector === 'env-a' ? probeA.promise : probeB.promise
+    )
+    const list = vi.fn().mockResolvedValue(environments)
+    stubRuntimeEnvironmentApi({ getStatus, list })
+    const store = createSliceStore()
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    const first = store.getState().hydrateRuntimeEnvironmentStatuses()
+    const second = store.getState().hydrateRuntimeEnvironmentStatuses()
+    expect(list).toHaveBeenCalledTimes(1)
+    expect(getStatus).not.toHaveBeenCalled()
+    await vi.waitFor(() => expect(getStatus).toHaveBeenCalledTimes(2))
+    const third = store.getState().hydrateRuntimeEnvironmentStatuses()
+
+    probeA.resolve(createCompatibleRuntimeStatusResponse('runtime-a'))
+    probeB.reject(new Error('offline'))
+    await Promise.all([first, second, third])
+    unsubscribe()
+
+    expect(list).toHaveBeenCalledTimes(1)
+    expect(getStatus).toHaveBeenCalledTimes(2)
+    expect(publications).toBe(3)
+    expect(store.getState().runtimeStatusByEnvironmentId.get('env-a')?.status?.runtimeId).toBe(
+      'runtime-a'
+    )
+    expect(store.getState().runtimeStatusByEnvironmentId.get('env-b')?.status).toBeNull()
+  })
+
+  it('runs a fresh explicit hydration after the shared sweep settles', async () => {
+    const getStatus = vi
+      .fn()
+      .mockResolvedValueOnce(createCompatibleRuntimeStatusResponse('runtime-1'))
+      .mockResolvedValueOnce(createCompatibleRuntimeStatusResponse('runtime-2'))
+    const list = vi.fn().mockResolvedValue([makeEnvironment()])
+    stubRuntimeEnvironmentApi({ getStatus, list })
+    const store = createSliceStore()
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    await store.getState().hydrateRuntimeEnvironmentStatuses()
+    await store.getState().hydrateRuntimeEnvironmentStatuses()
+    unsubscribe()
+
+    expect(list).toHaveBeenCalledTimes(2)
+    expect(getStatus).toHaveBeenCalledTimes(2)
+    expect(publications).toBe(4)
+    expect(store.getState().runtimeStatusByEnvironmentId.get('env-a')?.status?.runtimeId).toBe(
+      'runtime-2'
+    )
+  })
+
+  it('does not share hydration work between stores', async () => {
+    const list = vi.fn().mockResolvedValue([])
+    stubRuntimeEnvironmentApi({ getStatus: vi.fn(), list })
+    const firstStore = createSliceStore()
+    const secondStore = createSliceStore()
+
+    await Promise.all([
+      firstStore.getState().hydrateRuntimeEnvironmentStatuses(),
+      secondStore.getState().hydrateRuntimeEnvironmentStatuses()
+    ])
+
+    expect(list).toHaveBeenCalledTimes(2)
+  })
+
+  it('queues a current-catalog sweep when the catalog changes during listing', async () => {
+    const environmentA = makeEnvironment({ pairingRevision: 1 })
+    const repairedEnvironmentA = makeEnvironment({ pairingRevision: 2 })
+    const firstCatalog = deferred<PublicKnownRuntimeEnvironment[]>()
+    const secondCatalog = deferred<PublicKnownRuntimeEnvironment[]>()
+    const getStatus = vi
+      .fn()
+      .mockResolvedValue(createCompatibleRuntimeStatusResponse('runtime-current'))
+    const list = vi
+      .fn()
+      .mockReturnValueOnce(firstCatalog.promise)
+      .mockReturnValueOnce(secondCatalog.promise)
+    stubRuntimeEnvironmentApi({ getStatus, list })
+    const store = createSliceStore()
+    store.getState().setRuntimeEnvironments([environmentA])
+
+    const hydration = store.getState().hydrateRuntimeEnvironmentStatuses()
+    store.getState().setRuntimeEnvironments([repairedEnvironmentA])
+    firstCatalog.resolve([environmentA])
+    await vi.waitFor(() => expect(list).toHaveBeenCalledTimes(2))
+
+    expect(getStatus).not.toHaveBeenCalled()
+    expect(store.getState().runtimeEnvironments).toEqual([repairedEnvironmentA])
+
+    secondCatalog.resolve([repairedEnvironmentA])
+    await hydration
+
+    expect(list).toHaveBeenCalledTimes(2)
+    expect(getStatus).toHaveBeenCalledTimes(1)
+    expect(store.getState().runtimeStatusByEnvironmentId.has('env-a')).toBe(true)
+  })
+
+  it('queues one current-catalog sweep when a host is removed during probing', async () => {
+    const environmentA = makeEnvironment()
+    const environmentB = makeEnvironment({ id: 'env-b', name: 'Build Box' })
+    const firstProbe = deferred<ReturnType<typeof createCompatibleRuntimeStatusResponse>>()
+    const getStatus = vi
+      .fn()
+      .mockImplementationOnce(() => firstProbe.promise)
+      .mockResolvedValue(createCompatibleRuntimeStatusResponse('runtime-current'))
+    const list = vi
+      .fn()
+      .mockResolvedValueOnce([environmentA, environmentB])
+      .mockResolvedValueOnce([environmentA])
+    stubRuntimeEnvironmentApi({ getStatus, list })
+    const store = createSliceStore()
+
+    const first = store.getState().hydrateRuntimeEnvironmentStatuses()
+    await vi.waitFor(() => expect(getStatus).toHaveBeenCalledTimes(2))
+    store.getState().setRuntimeEnvironments([environmentA])
+    const joined = store.getState().hydrateRuntimeEnvironmentStatuses()
+    firstProbe.resolve(createCompatibleRuntimeStatusResponse('runtime-old'))
+    await Promise.all([first, joined])
+
+    expect(list).toHaveBeenCalledTimes(2)
+    expect(getStatus).toHaveBeenCalledTimes(3)
+    expect(store.getState().runtimeStatusByEnvironmentId.get('env-a')?.status?.runtimeId).toBe(
+      'runtime-current'
+    )
+    expect(store.getState().runtimeStatusByEnvironmentId.has('env-b')).toBe(false)
+  })
+
   // Why: skill discovery waits for the catalog to settle. A rejected read must
   // release that wait without claiming the catalog is hydrated — host routing
   // uses `runtimeEnvironmentCatalogHydrated` to fail closed on an unknown
   // catalog, and an empty stale list must not be mistaken for "no runtimes".
-  it('settles but does not hydrate the catalog when the read fails', async () => {
-    const list = vi.fn().mockRejectedValue(new Error('unreadable environments.json'))
+  it('settles failed catalog reads and allows a later hydration retry', async () => {
+    const list = vi
+      .fn()
+      .mockRejectedValueOnce(new Error('unreadable environments.json'))
+      .mockResolvedValueOnce([])
     stubRuntimeEnvironmentApi({ getStatus: vi.fn(), list })
     const store = createSliceStore()
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => undefined)
 
-    await store.getState().hydrateRuntimeEnvironmentStatuses()
+    try {
+      await store.getState().hydrateRuntimeEnvironmentStatuses()
 
-    expect(store.getState().runtimeEnvironmentCatalogSettled).toBe(true)
-    expect(store.getState().runtimeEnvironmentCatalogHydrated).toBe(false)
-    expect(store.getState().runtimeEnvironments).toEqual([])
+      expect(store.getState().runtimeEnvironmentCatalogSettled).toBe(true)
+      expect(store.getState().runtimeEnvironmentCatalogHydrated).toBe(false)
+      expect(store.getState().runtimeEnvironments).toEqual([])
+
+      await store.getState().hydrateRuntimeEnvironmentStatuses()
+      expect(list).toHaveBeenCalledTimes(2)
+      expect(store.getState().runtimeEnvironmentCatalogHydrated).toBe(true)
+    } finally {
+      consoleError.mockRestore()
+    }
   })
 
   it('both settles and hydrates the catalog on a successful read', async () => {
diff --git a/src/renderer/src/store/slices/runtime-status.ts b/src/renderer/src/store/slices/runtime-status.ts
index f1eab57213c..a5bd778273a 100644
--- a/src/renderer/src/store/slices/runtime-status.ts
+++ b/src/renderer/src/store/slices/runtime-status.ts
@@ -1,16 +1,20 @@
 import type { StateCreator } from 'zustand'
-import { toast } from 'sonner'
 import type { AppState } from '../types'
 import type { PublicKnownRuntimeEnvironment } from '../../../../shared/runtime-environments'
 import type { RuntimeStatus } from '../../../../shared/runtime-types'
+import { runtimeEnvironmentStatusesEqual } from './runtime-environment-status-equality'
 import {
   clearRecentRuntimeCompatibilityFailure,
-  clearRuntimeCompatibilityCache,
-  unwrapRuntimeRpcResult
+  clearRuntimeCompatibilityCache
 } from '@/runtime/runtime-rpc-client'
 import { replaceRuntimeEnvironmentRevisions } from '@/runtime/runtime-environment-revision'
-import { translate } from '@/i18n/i18n'
 import { bumpProviderRuntimeSessionGeneration } from '@/lib/provider-runtime-context'
+import {
+  dismissRuntimeDisconnectedToast,
+  showRuntimeDisconnectedToast
+} from './runtime-environment-disconnect-toast'
+import { createRuntimeStatusHydration } from './runtime-status-hydration'
+import { refreshRuntimeEnvironmentStatus } from './runtime-status-refresh'
 
 /** Live status for one saved runtime environment, as last observed by the
  * renderer. `status === null` records a probe that failed or timed out so the
@@ -18,6 +22,8 @@ import { bumpProviderRuntimeSessionGeneration } from '@/lib/provider-runtime-con
 export type RuntimeEnvironmentStatus = {
   status: RuntimeStatus | null
   appVersion?: string | null
+  /** When the stored status was last *observed to change*; an unchanged re-probe
+   * is dropped rather than rewritten, so this is not a probe-freshness clock. */
   checkedAt: number
   connectionGeneration?: number
 }
@@ -64,85 +70,6 @@ export type RuntimeStatusSlice = {
 }
 
 const connectionGenerationByEnvironment = new Map<string, number>()
-const activeRuntimeDisconnectedToasts = new Map<string, symbol>()
-const RUNTIME_DISCONNECTED_TOAST_DURATION_MS = 4_000
-
-function getRuntimeDisconnectedToastId(environmentId: string): string {
-  return `runtime-environment-disconnected:${environmentId}`
-}
-
-function showRuntimeDisconnectedToast(environmentId: string, getState: () => AppState): void {
-  const environment = getState().runtimeEnvironments.find((entry) => entry.id === environmentId)
-  const toastId = getRuntimeDisconnectedToastId(environmentId)
-  const activation = Symbol(toastId)
-  const title = environment?.name
-    ? translate(
-        'auto.store.slices.runtime.status.runtimeHostUnreachableNamed',
-        "Can't reach {{hostName}}",
-        { hostName: environment.name }
-      )
-    : translate(
-        'auto.store.slices.runtime.status.runtimeHostUnreachable',
-        "Can't reach Orca server"
-      )
-  activeRuntimeDisconnectedToasts.set(toastId, activation)
-  const clearActiveToast = (): void => {
-    if (activeRuntimeDisconnectedToasts.get(toastId) === activation) {
-      activeRuntimeDisconnectedToasts.delete(toastId)
-    }
-  }
-  let retrying = false
-  const showToast = (duration = RUNTIME_DISCONNECTED_TOAST_DURATION_MS): void => {
-    toast.warning(title, {
-      id: toastId,
-      description: translate(
-        'auto.store.slices.runtime.status.runtimeHostDisconnectedDescription',
-        'Check that Orca is running on this server and that your network connection is working, then try again.'
-      ),
-      duration,
-      action: {
-        label: translate('auto.store.slices.runtime.status.tryAgain', 'Try again'),
-        onClick: (event) => {
-          // Why: Sonner otherwise deletes the keyed toast after the action callback.
-          event.preventDefault()
-          if (retrying) {
-            return
-          }
-          retrying = true
-          showToast(Number.POSITIVE_INFINITY)
-          void getState()
-            .refreshRuntimeEnvironmentStatus(environmentId)
-            .then((reachable) => {
-              const stillSaved = getState().runtimeEnvironments.some(
-                (entry) => entry.id === environmentId
-              )
-              if (
-                !reachable &&
-                stillSaved &&
-                activeRuntimeDisconnectedToasts.get(toastId) === activation
-              ) {
-                showToast()
-              }
-            })
-            .finally(() => {
-              retrying = false
-            })
-        }
-      },
-      onDismiss: clearActiveToast,
-      onAutoClose: clearActiveToast
-    })
-  }
-  showToast()
-}
-
-function dismissRuntimeDisconnectedToast(environmentId: string): void {
-  const toastId = getRuntimeDisconnectedToastId(environmentId)
-  if (!activeRuntimeDisconnectedToasts.delete(toastId)) {
-    return
-  }
-  toast.dismiss?.(toastId)
-}
 
 export function getRuntimeEnvironmentConnectionGeneration(environmentId: string): number {
   return connectionGenerationByEnvironment.get(environmentId) ?? 0
@@ -254,6 +181,7 @@ export const createRuntimeStatusSlice: StateCreator<AppState, [], [], RuntimeSta
 
   setRuntimeEnvironmentStatus: (environmentId, status, options) => {
     const previous = get().runtimeStatusByEnvironmentId.get(environmentId)
+    const pairedDeviceId = status.status?.pairedDeviceId?.trim()
     // Why: a non-null status proves the runtime just answered, so drop any stale
     // "offline" compat failure before this online transition fires the
     // reuse-flagged background refetches — a recovered host must re-probe.
@@ -261,7 +189,6 @@ export const createRuntimeStatusSlice: StateCreator<AppState, [], [], RuntimeSta
       clearRecentRuntimeCompatibilityFailure(environmentId, status.status)
     }
     set((s) => {
-      const next = new Map(s.runtimeStatusByEnvironmentId)
       const sessionEnded = status.status === null && previous?.status != null
       const connectionChanged =
         status.status !== null &&
@@ -275,11 +202,33 @@ export const createRuntimeStatusSlice: StateCreator<AppState, [], [], RuntimeSta
       if (activeEnvironmentId === environmentId && (sessionEnded || connectionChanged)) {
         bumpProviderRuntimeSessionGeneration()
       }
-      next.set(environmentId, {
-        ...status,
-        connectionGeneration
-      })
-      return { runtimeStatusByEnvironmentId: next }
+      const nextEntry = { ...status, connectionGeneration }
+      const currentEntry = s.runtimeStatusByEnvironmentId.get(environmentId)
+      // Why: an unchanged re-probe must not invalidate every Map subscriber. Real
+      // transitions change `status` or advance `connectionGeneration`, so they still write.
+      const statusUnchanged = Boolean(
+        currentEntry && runtimeEnvironmentStatusesEqual(currentEntry, nextEntry)
+      )
+      const environmentIndex = pairedDeviceId
+        ? s.runtimeEnvironments.findIndex((environment) => environment.id === environmentId)
+        : -1
+      const runtimeEnvironments =
+        environmentIndex >= 0 &&
+        s.runtimeEnvironments[environmentIndex].pairedDeviceId !== pairedDeviceId
+          ? s.runtimeEnvironments.map((environment, index) =>
+              index === environmentIndex ? { ...environment, pairedDeviceId } : environment
+            )
+          : s.runtimeEnvironments
+      const environmentsChanged = runtimeEnvironments !== s.runtimeEnvironments
+      if (statusUnchanged && !environmentsChanged) {
+        return s
+      }
+      return {
+        runtimeStatusByEnvironmentId: statusUnchanged
+          ? s.runtimeStatusByEnvironmentId
+          : new Map(s.runtimeStatusByEnvironmentId).set(environmentId, nextEntry),
+        ...(environmentsChanged ? { runtimeEnvironments } : {})
+      }
     })
     if (options?.suppressDisconnectToast) {
       dismissRuntimeDisconnectedToast(environmentId)
@@ -323,43 +272,20 @@ export const createRuntimeStatusSlice: StateCreator<AppState, [], [], RuntimeSta
     })
   },
 
-  refreshRuntimeEnvironmentStatus: async (environmentId, timeoutMs = 10_000) => {
-    try {
-      const response = await window.api.runtimeEnvironments.getStatus({
-        selector: environmentId,
-        timeoutMs
-      })
-      const status = unwrapRuntimeRpcResult<RuntimeStatus>(response)
-      // setRuntimeEnvironmentStatus drops any stale compat failure on a non-null
+  refreshRuntimeEnvironmentStatus: (environmentId, timeoutMs = 10_000) =>
+    refreshRuntimeEnvironmentStatus(environmentId, timeoutMs, (status) => {
+      // Why: setRuntimeEnvironmentStatus drops any stale compat failure on a non-null
       // (reachable) status, so a recovered host's reuse-flagged refetches re-probe.
       get().setRuntimeEnvironmentStatus(environmentId, { status, checkedAt: Date.now() })
-      return true
-    } catch {
-      get().setRuntimeEnvironmentStatus(environmentId, {
-        status: null,
-        checkedAt: Date.now()
-      })
-      return false
-    }
-  },
+    }),
 
-  hydrateRuntimeEnvironmentStatuses: async () => {
-    let environments: PublicKnownRuntimeEnvironment[]
-    try {
-      environments = await window.api.runtimeEnvironments.list()
-    } catch (err) {
-      console.error('Failed to list runtime environments for status hydration:', err)
-      // Why: settled, not hydrated. Skill discovery must stop waiting and fall
-      // back to the local host, but host routing keeps failing closed on an
-      // unknown catalog rather than acting on a stale empty list.
-      set({ runtimeEnvironmentCatalogSettled: true })
-      return
-    }
-    get().setRuntimeEnvironments(environments)
-    // Why: fire-and-forget per env; one unreachable server must not block the
-    // others, and a failure records a null status rather than nothing.
-    await Promise.allSettled(
-      environments.map((environment) => get().refreshRuntimeEnvironmentStatus(environment.id))
-    )
-  }
+  hydrateRuntimeEnvironmentStatuses: createRuntimeStatusHydration({
+    listEnvironments: () => window.api.runtimeEnvironments.list(),
+    getCurrentEnvironments: () => get().runtimeEnvironments,
+    publishEnvironments: (environments) => get().setRuntimeEnvironments(environments),
+    refreshEnvironmentStatus: (environmentId) =>
+      get().refreshRuntimeEnvironmentStatus(environmentId),
+    // Why: failed reads release catalog waiters without claiming routing is safe.
+    markCatalogSettled: () => set({ runtimeEnvironmentCatalogSettled: true })
+  })
 })
diff --git a/src/renderer/src/store/slices/settings.test.ts b/src/renderer/src/store/slices/settings.test.ts
index 612caab0be4..756e6d9baa8 100644
--- a/src/renderer/src/store/slices/settings.test.ts
+++ b/src/renderer/src/store/slices/settings.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 import { createTestStore, makeWorktree } from './store-test-helpers'
 import type { AppState } from '../types'
 import type { WorktreeLineage } from '../../../../shared/types'
+import type { PublicKnownRuntimeEnvironment } from '../../../../shared/runtime-environments'
 import { toast } from 'sonner'
 import {
   MIN_COMPATIBLE_RUNTIME_SERVER_VERSION,
@@ -9,6 +10,10 @@ import {
   RUNTIME_PROTOCOL_VERSION
 } from '../../../../shared/protocol-version'
 import { clearRuntimeCompatibilityCacheForTests } from '../../runtime/runtime-rpc-client'
+import {
+  RUNTIME_CATALOG_STALE_MS,
+  resetRuntimeCatalogListingForTests
+} from './runtime-status-hydration'
 
 vi.mock('sonner', () => ({ toast: { error: vi.fn(), success: vi.fn(), info: vi.fn() } }))
 vi.mock('@/lib/agent-status', async (importOriginal) => {
@@ -37,9 +42,34 @@ const env2Lineage: WorktreeLineage = {
   createdAt: 1
 }
 
+function makeRuntimeEnvironment(id: string): PublicKnownRuntimeEnvironment {
+  const endpointId = `ws-${id}`
+  return {
+    id,
+    name: id,
+    createdAt: 1,
+    updatedAt: 1,
+    lastUsedAt: null,
+    runtimeId: null,
+    endpoints: [{ id: endpointId, kind: 'websocket', label: 'WebSocket', endpoint: 'ws://x' }],
+    preferredEndpointId: endpointId
+  }
+}
+
+function deferred<T>() {
+  let resolve: (value: T) => void = () => {}
+  let reject: (reason?: unknown) => void = () => {}
+  const promise = new Promise<T>((promiseResolve, promiseReject) => {
+    resolve = promiseResolve
+    reject = promiseReject
+  })
+  return { promise, resolve, reject }
+}
+
 beforeEach(() => {
   delete (globalThis as { __ORCA_WEB_CLIENT__?: boolean }).__ORCA_WEB_CLIENT__
   clearRuntimeCompatibilityCacheForTests()
+  resetRuntimeCatalogListingForTests()
   vi.clearAllMocks()
   runtimeEnvironmentGetStatus.mockResolvedValue({
     id: 'status-rpc-1',
@@ -698,4 +728,141 @@ describe('fetchSettings runtime catalog probe', () => {
     expect(store.getState().settings).not.toBeNull()
     expect(store.getState().runtimeEnvironmentCatalogSettled).toBe(true)
   })
+
+  it('coalesces concurrent settings refreshes into one all-host sweep', async () => {
+    const environments = [makeRuntimeEnvironment('env-a'), makeRuntimeEnvironment('env-b')]
+    const catalog = deferred<PublicKnownRuntimeEnvironment[]>()
+    runtimeEnvironmentList.mockReturnValueOnce(catalog.promise)
+    const store = createTestStore()
+
+    await Promise.all(Array.from({ length: 10 }, () => store.getState().fetchSettings()))
+
+    expect(settingsGet).toHaveBeenCalledTimes(10)
+    expect(runtimeEnvironmentList).toHaveBeenCalledTimes(1)
+    expect(runtimeEnvironmentGetStatus).not.toHaveBeenCalled()
+
+    catalog.resolve(environments)
+    await vi.waitFor(() => expect(runtimeEnvironmentGetStatus).toHaveBeenCalledTimes(2))
+    await vi.waitFor(() => expect(store.getState().runtimeStatusByEnvironmentId.size).toBe(2))
+
+    await store.getState().fetchSettings()
+    expect(settingsGet).toHaveBeenCalledTimes(11)
+    expect(runtimeEnvironmentList).toHaveBeenCalledTimes(1)
+    expect(runtimeEnvironmentGetStatus).toHaveBeenCalledTimes(2)
+  })
+
+  it('fills status coverage after another path publishes only part of the catalog', async () => {
+    const environments = [makeRuntimeEnvironment('env-a'), makeRuntimeEnvironment('env-b')]
+    runtimeEnvironmentList.mockResolvedValue(environments)
+    const store = createTestStore()
+    store.getState().setRuntimeEnvironments(environments)
+    store.getState().setRuntimeEnvironmentStatus('env-a', { status: null, checkedAt: 1 })
+
+    await store.getState().fetchSettings()
+    await vi.waitFor(() => expect(runtimeEnvironmentGetStatus).toHaveBeenCalledTimes(2))
+
+    expect(runtimeEnvironmentList).toHaveBeenCalledTimes(1)
+    expect(store.getState().runtimeStatusByEnvironmentId.has('env-b')).toBe(true)
+  })
+
+  it('treats an offline result as checked on later settings refreshes', async () => {
+    const environments = [makeRuntimeEnvironment('env-a'), makeRuntimeEnvironment('env-b')]
+    runtimeEnvironmentList.mockResolvedValue(environments)
+    runtimeEnvironmentGetStatus.mockImplementation(({ selector }: { selector: string }) =>
+      selector === 'env-b'
+        ? Promise.reject(new Error('offline'))
+        : Promise.resolve({
+            id: 'status-rpc-a',
+            ok: true,
+            result: {
+              runtimeId: 'runtime-a',
+              graphStatus: 'ready',
+              runtimeProtocolVersion: RUNTIME_PROTOCOL_VERSION,
+              minCompatibleRuntimeClientVersion: MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION
+            },
+            _meta: { runtimeId: 'runtime-a' }
+          })
+    )
+    const store = createTestStore()
+
+    await store.getState().fetchSettings()
+    await vi.waitFor(() =>
+      expect(store.getState().runtimeStatusByEnvironmentId.get('env-b')?.status).toBeNull()
+    )
+    await store.getState().fetchSettings()
+
+    expect(settingsGet).toHaveBeenCalledTimes(2)
+    expect(runtimeEnvironmentList).toHaveBeenCalledTimes(1)
+    expect(runtimeEnvironmentGetStatus).toHaveBeenCalledTimes(2)
+  })
+
+  it('retries a failed catalog read on the next settings refresh', async () => {
+    const firstCatalog = deferred<PublicKnownRuntimeEnvironment[]>()
+    runtimeEnvironmentList
+      .mockReturnValueOnce(firstCatalog.promise)
+      .mockResolvedValueOnce([makeRuntimeEnvironment('env-a')])
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    const store = createTestStore()
+
+    try {
+      await store.getState().fetchSettings()
+      firstCatalog.reject(new Error('unreadable environments.json'))
+      await vi.waitFor(() => expect(store.getState().runtimeEnvironmentCatalogSettled).toBe(true))
+      expect(store.getState().runtimeEnvironmentCatalogHydrated).toBe(false)
+
+      await store.getState().fetchSettings()
+      await vi.waitFor(() => expect(store.getState().runtimeEnvironmentCatalogHydrated).toBe(true))
+      await vi.waitFor(() => expect(runtimeEnvironmentGetStatus).toHaveBeenCalledTimes(1))
+      await store.getState().fetchSettings()
+
+      expect(settingsGet).toHaveBeenCalledTimes(3)
+      expect(runtimeEnvironmentList).toHaveBeenCalledTimes(2)
+      expect(runtimeEnvironmentGetStatus).toHaveBeenCalledTimes(1)
+    } finally {
+      consoleError.mockRestore()
+    }
+  })
+
+  it('uses an authoritative sweep to remove ghost status entries', async () => {
+    const store = createTestStore()
+    store.getState().setRuntimeEnvironments([])
+    store.getState().setRuntimeEnvironmentStatus('removed-env', { status: null, checkedAt: 1 })
+
+    await store.getState().fetchSettings()
+    await vi.waitFor(() => expect(store.getState().runtimeStatusByEnvironmentId.size).toBe(0))
+
+    expect(runtimeEnvironmentList).toHaveBeenCalledTimes(1)
+  })
+
+  it('picks up an externally added host once the listing goes stale', async () => {
+    runtimeEnvironmentList.mockResolvedValue([makeRuntimeEnvironment('env-a')])
+    const store = createTestStore()
+    const now = vi.spyOn(Date, 'now').mockReturnValue(1_000_000)
+
+    try {
+      await store.getState().fetchSettings()
+      await vi.waitFor(() => expect(store.getState().runtimeStatusByEnvironmentId.size).toBe(1))
+
+      // Another client adds a host; coverage still matches, so only staleness can reveal it.
+      runtimeEnvironmentList.mockResolvedValue([
+        makeRuntimeEnvironment('env-a'),
+        makeRuntimeEnvironment('env-b')
+      ])
+      await store.getState().fetchSettings()
+      expect(runtimeEnvironmentList).toHaveBeenCalledTimes(1)
+      expect(store.getState().runtimeEnvironments.map(({ id }) => id)).toEqual(['env-a'])
+
+      now.mockReturnValue(1_000_000 + RUNTIME_CATALOG_STALE_MS + 1)
+      await store.getState().fetchSettings()
+      await vi.waitFor(() =>
+        expect(store.getState().runtimeEnvironments.map(({ id }) => id)).toEqual(['env-a', 'env-b'])
+      )
+      await vi.waitFor(() =>
+        expect(store.getState().runtimeStatusByEnvironmentId.has('env-b')).toBe(true)
+      )
+      expect(runtimeEnvironmentList).toHaveBeenCalledTimes(2)
+    } finally {
+      now.mockRestore()
+    }
+  })
 })
diff --git a/src/renderer/src/store/slices/settings.ts b/src/renderer/src/store/slices/settings.ts
index 670a2556e10..593d1650e1e 100644
--- a/src/renderer/src/store/slices/settings.ts
+++ b/src/renderer/src/store/slices/settings.ts
@@ -14,6 +14,7 @@ import { normalizeTerminalCustomThemes } from '../../../../shared/terminal-custo
 import { normalizeTaskProviderSettings } from '../../../../shared/task-providers'
 import { normalizeOpenInApplications } from '../../../../shared/open-in-applications'
 import { createSettingsSearchState, type SettingsSearchState } from './settings-search-state'
+import { isRuntimeCatalogListingStale } from './runtime-status-hydration'
 import { normalizeDisabledTuiAgents } from '../../../../shared/tui-agent-selection'
 import {
   normalizeTuiAgentArgsRecord,
@@ -135,6 +136,17 @@ async function persistSettingsUpdates(
   }))
 }
 
+/** Every known host has a recorded status entry, and no entry survives for a host that is gone. */
+function hasCompleteRuntimeStatusCoverage(
+  runtimeEnvironments: AppState['runtimeEnvironments'],
+  runtimeStatusByEnvironmentId: AppState['runtimeStatusByEnvironmentId']
+): boolean {
+  return (
+    new Set(runtimeEnvironments.map(({ id }) => id)).size === runtimeStatusByEnvironmentId.size &&
+    runtimeEnvironments.every(({ id }) => runtimeStatusByEnvironmentId.has(id))
+  )
+}
+
 async function verifyRuntimeEnvironmentReachable(environmentId: string | null): Promise<void> {
   if (!environmentId) {
     return
@@ -161,11 +173,18 @@ export const createSettingsSlice: StateCreator<AppState, [], [], SettingsSlice>
     } catch (err) {
       console.error('Failed to fetch settings:', err)
     }
-    // Why: best-effort boot probe so sidebar host pickers show live runtime
-    // health before the settings pane is ever opened. Fire-and-forget to keep
-    // startup off the network round-trips. Runs even when settings fail to load,
-    // so surfaces waiting on the catalog settling are never stranded pending.
-    void get().hydrateRuntimeEnvironmentStatuses()
+    const { runtimeEnvironmentCatalogHydrated, runtimeEnvironments, runtimeStatusByEnvironmentId } =
+      get()
+    // Why: settings refreshes are frequent, but only incomplete host coverage needs
+    // the all-host boot probe. A recorded null still means the host was checked.
+    if (
+      !runtimeEnvironmentCatalogHydrated ||
+      !hasCompleteRuntimeStatusCoverage(runtimeEnvironments, runtimeStatusByEnvironmentId) ||
+      // Why: coverage is blind to catalog edits from another client or the orca CLI.
+      isRuntimeCatalogListingStale()
+    ) {
+      void get().hydrateRuntimeEnvironmentStatuses()
+    }
   },
 
   updateSettings: async (updates) => {
diff --git a/src/renderer/src/store/slices/ssh-target-cleanup.ts b/src/renderer/src/store/slices/ssh-target-cleanup.ts
index ba2f5211efc..43707fa86d6 100644
--- a/src/renderer/src/store/slices/ssh-target-cleanup.ts
+++ b/src/renderer/src/store/slices/ssh-target-cleanup.ts
@@ -200,10 +200,7 @@ export function buildRemovedSshTargetCleanupPatch(
   const nextTransientClearedConnections = {
     ...state.transientClearedAgentStatusConnectionIds
   }
-  const removedTransientClearBlock = Object.prototype.hasOwnProperty.call(
-    nextTransientClearedConnections,
-    targetId
-  )
+  const removedTransientClearBlock = Object.hasOwn(nextTransientClearedConnections, targetId)
   delete nextTransientClearedConnections[targetId]
   const nextConnectionStates = new Map(state.sshConnectionStates)
   const removedConnectionState = nextConnectionStates.delete(targetId)
@@ -211,18 +208,9 @@ export function buildRemovedSshTargetCleanupPatch(
   const removedLabel = nextLabels.delete(targetId)
   const nextHydrated = new Set(state.remoteWorkspaceHydratedTargetIds)
   const removedHydrated = nextHydrated.delete(targetId)
-  const removedSyncStatus = Object.prototype.hasOwnProperty.call(
-    state.remoteWorkspaceSyncStatusByTargetId,
-    targetId
-  )
-  const removedPortForwards = Object.prototype.hasOwnProperty.call(
-    state.portForwardsByConnection,
-    targetId
-  )
-  const removedDetectedPorts = Object.prototype.hasOwnProperty.call(
-    state.detectedPortsByConnection,
-    targetId
-  )
+  const removedSyncStatus = Object.hasOwn(state.remoteWorkspaceSyncStatusByTargetId, targetId)
+  const removedPortForwards = Object.hasOwn(state.portForwardsByConnection, targetId)
+  const removedDetectedPorts = Object.hasOwn(state.detectedPortsByConnection, targetId)
   const nextSyncStatus = { ...state.remoteWorkspaceSyncStatusByTargetId }
   delete nextSyncStatus[targetId]
   const nextPortForwards = { ...state.portForwardsByConnection }
diff --git a/src/renderer/src/store/slices/store-cascades.test.ts b/src/renderer/src/store/slices/store-cascades.test.ts
index 1380c311579..4eaee9fa68b 100644
--- a/src/renderer/src/store/slices/store-cascades.test.ts
+++ b/src/renderer/src/store/slices/store-cascades.test.ts
@@ -218,7 +218,7 @@ describe('removeWorktree cascade', () => {
 
     expect(result).toEqual({
       ok: true,
-      preservedBranch: { branchName: 'feature/test', head: 'def456' }
+      preservedBranch: { branchName: 'feature/test', head: 'def456', hostId: 'local' }
     })
     expect(toast.warning).toHaveBeenCalledWith('Worktree deleted, branch kept', {
       id: 'preserved-branch:feature/test:def456',
@@ -254,7 +254,7 @@ describe('removeWorktree cascade', () => {
 
     expect(result).toEqual({
       ok: true,
-      preservedBranch: { branchName: 'feature/test', head: 'def456' }
+      preservedBranch: { branchName: 'feature/test', head: 'def456', hostId: 'local' }
     })
     expect(toast.warning).not.toHaveBeenCalled()
   })
@@ -1658,6 +1658,14 @@ describe('setActiveWorktree', () => {
 
       const terminal = store.getState().createTab(wt, undefined, 'cmd.exe')
       expect(terminal.shellOverride).toBe('wsl.exe')
+
+      const hostTerminal = store
+        .getState()
+        .createTab(wt, undefined, 'powershell.exe', { forceHostRuntime: true })
+      expect(hostTerminal).toMatchObject({
+        shellOverride: 'powershell.exe',
+        forceHostRuntime: true
+      })
     } finally {
       Object.defineProperty(globalThis, 'navigator', {
         value: originalNavigator,
diff --git a/src/renderer/src/store/slices/store-session-cascades.test.ts b/src/renderer/src/store/slices/store-session-cascades.test.ts
index 06cfa17bfc8..65474236f67 100644
--- a/src/renderer/src/store/slices/store-session-cascades.test.ts
+++ b/src/renderer/src/store/slices/store-session-cascades.test.ts
@@ -1742,6 +1742,8 @@ describe('reconnectPersistedTerminals', () => {
         hideAutomationGeneratedWorkspaces: false,
         hideCliCreatedWorkspaces: false,
         hideDetachedHeadWorkspaces: false,
+        hideWorkspacesFromOtherDevices: false,
+        pairedDeviceIdsByEnvironment: new Map(),
         repoMap: new Map(s.repos.map((repo) => [repo.id, repo])),
         workspaceHostScope: 'all',
         defaultHostId: LOCAL_EXECUTION_HOST_ID,
@@ -2089,6 +2091,8 @@ describe('reconnectPersistedTerminals', () => {
         hideAutomationGeneratedWorkspaces: false,
         hideCliCreatedWorkspaces: false,
         hideDetachedHeadWorkspaces: false,
+        hideWorkspacesFromOtherDevices: false,
+        pairedDeviceIdsByEnvironment: new Map(),
         repoMap: new Map(s.repos.map((repo) => [repo.id, repo])),
         workspaceHostScope: 'all',
         defaultHostId: LOCAL_EXECUTION_HOST_ID,
diff --git a/src/renderer/src/store/slices/store-test-helpers.ts b/src/renderer/src/store/slices/store-test-helpers.ts
index 6a342f8c5e2..a4117e25260 100644
--- a/src/renderer/src/store/slices/store-test-helpers.ts
+++ b/src/renderer/src/store/slices/store-test-helpers.ts
@@ -25,9 +25,11 @@ import { createEditorSlice } from './editor'
 import { createStatsSlice } from './stats'
 import { createMemorySlice } from './memory'
 import { createWorkspaceSpaceSlice } from './workspace-space'
-import { createClaudeUsageSlice } from './claude-usage'
-import { createCodexUsageSlice } from './codex-usage'
-import { createOpenCodeUsageSlice } from './opencode-usage'
+import {
+  createClaudeUsageSlice,
+  createCodexUsageSlice,
+  createOpenCodeUsageSlice
+} from './usage-provider-slices'
 import { createBrowserSlice } from './browser'
 import { createRateLimitSlice } from './rate-limits'
 import { createSshSlice } from './ssh'
diff --git a/src/renderer/src/store/slices/superseded-ssh-repo-rows.test.ts b/src/renderer/src/store/slices/superseded-ssh-repo-rows.test.ts
index ec18aea767d..7b50312d7a5 100644
--- a/src/renderer/src/store/slices/superseded-ssh-repo-rows.test.ts
+++ b/src/renderer/src/store/slices/superseded-ssh-repo-rows.test.ts
@@ -31,6 +31,12 @@ describe('reconcileReadoptedSshRepoRows', () => {
     expect(result.pendingReadoptions).toEqual([])
   })
 
+  it('returns the input array when nothing is pruned', () => {
+    const repos = [repo({ id: 'shared', path: '/local' })]
+
+    expect(reconcileReadoptedSshRepoRows(repos, []).repos).toBe(repos)
+  })
+
   it('keeps evidence pending when repos:changed has not delivered the new row yet', () => {
     const oldSsh = repo({ id: 'shared', connectionId: 'ssh-old' })
 
diff --git a/src/renderer/src/store/slices/superseded-ssh-repo-rows.ts b/src/renderer/src/store/slices/superseded-ssh-repo-rows.ts
index da87da70291..4b20cfa6edf 100644
--- a/src/renderer/src/store/slices/superseded-ssh-repo-rows.ts
+++ b/src/renderer/src/store/slices/superseded-ssh-repo-rows.ts
@@ -3,7 +3,7 @@ import type { Repo } from '../../../../shared/types'
 import { getRepoExecutionHostId, toSshExecutionHostId } from '../../../../shared/execution-host'
 
 export type SshRepoReconciliation = {
-  repos: Repo[]
+  repos: readonly Repo[]
   pendingReadoptions: SshRepoReadoption[]
 }
 
@@ -53,8 +53,10 @@ export function reconcileReadoptedSshRepoRows(
     }
   }
 
+  // Why: pruning nothing must hand back the input array, or the copy alone would defeat the
+  // referential stability reconcileFetchedRepos just established upstream.
   if (prunedOwners.size === 0) {
-    return { repos: [...repos], pendingReadoptions }
+    return { repos, pendingReadoptions }
   }
   return {
     repos: repos.filter(
diff --git a/src/renderer/src/store/slices/terminal-tab-title-batch.test.ts b/src/renderer/src/store/slices/terminal-tab-title-batch.test.ts
new file mode 100644
index 00000000000..3a7a1b525ae
--- /dev/null
+++ b/src/renderer/src/store/slices/terminal-tab-title-batch.test.ts
@@ -0,0 +1,266 @@
+import { describe, expect, it, vi } from 'vitest'
+import { getDefaultSettings } from '../../../../shared/constants'
+import { makePaneKey } from '../../../../shared/stable-pane-id'
+
+vi.mock('sonner', () => ({ toast: { info: vi.fn(), success: vi.fn(), error: vi.fn() } }))
+vi.mock('@/runtime/sync-runtime-graph', () => ({ scheduleRuntimeGraphSync: vi.fn() }))
+vi.mock('@/components/terminal-pane/pty-transport', () => ({
+  registerEagerPtyBuffer: vi.fn(),
+  ensurePtyDispatcher: vi.fn(),
+  unregisterPtyDataHandlers: vi.fn()
+}))
+vi.mock('@/components/terminal-pane/shutdown-buffer-captures', () => ({
+  shutdownBufferCaptures: vi.fn()
+}))
+
+// @ts-expect-error -- minimal preload API stub for the slice's IPC writes
+globalThis.window = { api: {} }
+
+import {
+  createTestStore,
+  makeTab,
+  makeUnifiedTab,
+  makeWorktree,
+  seedStore
+} from './store-test-helpers'
+import type { GeneratedTabTitleUpdate } from './terminal-tab-title-batch'
+
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+
+function makeScaleState(count: number) {
+  let idReads = 0
+  const worktrees = Array.from({ length: count }, (_, index) =>
+    makeWorktree({ id: `wt-${index}`, repoId: 'repo1' })
+  )
+  const tabsByWorktree = Object.fromEntries(
+    worktrees.map((worktree, index) => {
+      const tab = makeTab({ id: `tab-${index}`, worktreeId: worktree.id })
+      const id = tab.id
+      Object.defineProperty(tab, 'id', {
+        configurable: true,
+        enumerable: true,
+        get() {
+          idReads += 1
+          return id
+        }
+      })
+      return [worktree.id, [tab]]
+    })
+  )
+  const unifiedTabsByWorktree = Object.fromEntries(
+    worktrees.map((worktree, index) => [
+      worktree.id,
+      [makeUnifiedTab({ id: `tab-${index}`, worktreeId: worktree.id, groupId: 'group-1' })]
+    ])
+  )
+  return {
+    getIdReads: () => idReads,
+    resetIdReads: () => {
+      idReads = 0
+    },
+    tabsByWorktree,
+    unifiedTabsByWorktree,
+    worktrees
+  }
+}
+
+describe('terminal tab title batches', () => {
+  it('updates 100 owners with one publication and a linear owner-index pass', () => {
+    const store = createTestStore()
+    const fixture = makeScaleState(101)
+    seedStore(store, {
+      worktreesByRepo: { repo1: fixture.worktrees },
+      tabsByWorktree: fixture.tabsByWorktree,
+      unifiedTabsByWorktree: fixture.unifiedTabsByWorktree
+    })
+    const untouchedTabs = fixture.tabsByWorktree['wt-100']
+    const baselineSortEpoch = store.getState().sortEpoch
+    fixture.resetIdReads()
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+
+    store.getState().updateTabTitles(
+      Array.from({ length: 100 }, (_, index) => ({
+        tabId: `tab-${index}`,
+        title: `Remote agent ${index}`
+      }))
+    )
+
+    unsubscribe()
+    expect(publications).toBe(1)
+    expect(fixture.getIdReads()).toBeLessThanOrEqual(305)
+    expect(store.getState().tabsByWorktree['wt-100']).toBe(untouchedTabs)
+    expect(store.getState().sortEpoch).toBe(baselineSortEpoch + 100)
+    for (let index = 0; index < 100; index += 1) {
+      expect(store.getState().tabsByWorktree[`wt-${index}`]?.[0]?.title).toBe(
+        `Remote agent ${index}`
+      )
+    }
+  })
+
+  it('preserves ordered duplicate updates and last-owner duplicate-id routing', () => {
+    const store = createTestStore()
+    seedStore(store, {
+      tabsByWorktree: {
+        first: [makeTab({ id: 'duplicate-tab', worktreeId: 'first', title: 'First owner' })],
+        second: [makeTab({ id: 'duplicate-tab', worktreeId: 'second', title: 'Second owner' })]
+      }
+    })
+
+    store.getState().updateTabTitles([
+      { tabId: 'duplicate-tab', title: 'Intermediate' },
+      { tabId: 'duplicate-tab', title: 'Final' }
+    ])
+
+    expect(store.getState().tabsByWorktree.first?.[0]?.title).toBe('First owner')
+    expect(store.getState().tabsByWorktree.second?.[0]?.title).toBe('Final')
+  })
+
+  it('updates every same-owner backing duplicate but only the first unified row', () => {
+    const store = createTestStore()
+    seedStore(store, {
+      settings: { ...getDefaultSettings('/tmp'), tabAutoGenerateTitle: true },
+      tabsByWorktree: {
+        owner: [
+          makeTab({ id: 'duplicate-tab', worktreeId: 'owner', title: 'First backing' }),
+          makeTab({ id: 'duplicate-tab', worktreeId: 'owner', title: 'Second backing' })
+        ]
+      },
+      unifiedTabsByWorktree: {
+        owner: [
+          makeUnifiedTab({
+            id: 'duplicate-tab',
+            worktreeId: 'owner',
+            groupId: 'group-1',
+            label: 'First visible'
+          }),
+          makeUnifiedTab({
+            id: 'duplicate-tab',
+            worktreeId: 'owner',
+            groupId: 'group-2',
+            label: 'Second visible'
+          })
+        ]
+      }
+    })
+
+    store.getState().updateTabTitles([{ tabId: 'duplicate-tab', title: 'Final live title' }])
+    store.getState().setGeneratedTabTitlesFromAgentPrompts([
+      {
+        paneKey: makePaneKey('duplicate-tab', LEAF_ID),
+        prompt: 'Generated duplicate title for remote startup'
+      }
+    ])
+
+    expect(store.getState().tabsByWorktree.owner?.map((tab) => tab.title)).toEqual([
+      'Final live title',
+      'Final live title'
+    ])
+    expect(store.getState().tabsByWorktree.owner?.map((tab) => tab.generatedTitle)).toEqual([
+      'Generated duplicate title for remote',
+      'Generated duplicate title for remote'
+    ])
+    expect(store.getState().unifiedTabsByWorktree.owner?.map((tab) => tab.label)).toEqual([
+      'Final live title',
+      'Second visible'
+    ])
+    expect(store.getState().unifiedTabsByWorktree.owner?.map((tab) => tab.generatedLabel)).toEqual([
+      'Generated duplicate title for remote',
+      undefined
+    ])
+  })
+
+  it('matches sequential live and generated title semantics in event order', () => {
+    const sequentialStore = createTestStore()
+    const batchStore = createTestStore()
+    const fixture = {
+      settings: { ...getDefaultSettings('/tmp'), tabAutoGenerateTitle: true },
+      tabsByWorktree: {
+        owner: [makeTab({ id: 'tab-1', worktreeId: 'owner', title: 'Terminal 1' })]
+      },
+      unifiedTabsByWorktree: {
+        owner: [makeUnifiedTab({ id: 'tab-1', worktreeId: 'owner', groupId: 'group-1' })]
+      }
+    }
+    seedStore(sequentialStore, structuredClone(fixture))
+    seedStore(batchStore, structuredClone(fixture))
+    const liveUpdates = [
+      { tabId: 'tab-1', title: 'Codex' },
+      { tabId: 'tab-1', title: '⠋ Codex is thinking' },
+      { tabId: 'tab-1', title: '⠙ Codex is thinking' },
+      { tabId: 'tab-1', title: '' },
+      { tabId: 'tab-1', title: 'Final stable title' }
+    ]
+    const generatedUpdates = [
+      { paneKey: makePaneKey('tab-1', LEAF_ID), prompt: 'First generated title wins here' },
+      { paneKey: makePaneKey('tab-1', LEAF_ID), prompt: 'Ignored later generated title' },
+      {
+        paneKey: makePaneKey('tab-1', LEAF_ID),
+        prompt: 'Forced replacement generated title',
+        options: { replaceExistingGeneratedTitle: true }
+      }
+    ]
+
+    for (const update of liveUpdates) {
+      sequentialStore.getState().updateTabTitle(update.tabId, update.title)
+    }
+    for (const update of generatedUpdates) {
+      sequentialStore
+        .getState()
+        .setGeneratedTabTitleFromAgentPrompt(update.paneKey, update.prompt, update.options)
+    }
+    batchStore.getState().updateTabTitles(liveUpdates)
+    batchStore.getState().setGeneratedTabTitlesFromAgentPrompts(generatedUpdates)
+
+    expect(batchStore.getState().tabsByWorktree).toEqual(sequentialStore.getState().tabsByWorktree)
+    expect(batchStore.getState().unifiedTabsByWorktree).toEqual(
+      sequentialStore.getState().unifiedTabsByWorktree
+    )
+    expect(batchStore.getState().sortEpoch).toBe(sequentialStore.getState().sortEpoch)
+  })
+
+  it('coalesces generated titles while preserving first-write and replacement semantics', () => {
+    const store = createTestStore()
+    const fixture = makeScaleState(100)
+    seedStore(store, {
+      settings: { ...getDefaultSettings('/tmp'), tabAutoGenerateTitle: true },
+      worktreesByRepo: { repo1: fixture.worktrees },
+      tabsByWorktree: fixture.tabsByWorktree,
+      unifiedTabsByWorktree: fixture.unifiedTabsByWorktree
+    })
+    fixture.resetIdReads()
+    let publications = 0
+    const unsubscribe = store.subscribe(() => {
+      publications += 1
+    })
+    const updates: GeneratedTabTitleUpdate[] = Array.from({ length: 100 }, (_, index) => ({
+      paneKey: makePaneKey(`tab-${index}`, LEAF_ID),
+      prompt: `Refactor remote module ${index} for startup performance`
+    }))
+    updates.push(
+      {
+        paneKey: makePaneKey('tab-0', LEAF_ID),
+        prompt: 'This later prompt must not replace the first generated title'
+      },
+      {
+        paneKey: makePaneKey('tab-0', LEAF_ID),
+        prompt: 'Replacement title for a newer dispatch',
+        options: { replaceExistingGeneratedTitle: true }
+      }
+    )
+
+    store.getState().setGeneratedTabTitlesFromAgentPrompts(updates)
+
+    unsubscribe()
+    expect(publications).toBe(1)
+    expect(fixture.getIdReads()).toBeLessThanOrEqual(305)
+    expect(store.getState().tabsByWorktree['wt-0']?.[0]?.generatedTitle).toBe(
+      'Replacement title for a newer dispatch'
+    )
+    expect(store.getState().tabsByWorktree['wt-99']?.[0]?.generatedTitle).toBe(
+      'Refactor remote module 99 for startup'
+    )
+  })
+})
diff --git a/src/renderer/src/store/slices/terminal-tab-title-batch.ts b/src/renderer/src/store/slices/terminal-tab-title-batch.ts
new file mode 100644
index 00000000000..21701f3bd9d
--- /dev/null
+++ b/src/renderer/src/store/slices/terminal-tab-title-batch.ts
@@ -0,0 +1,242 @@
+import { deriveGeneratedTabTitle } from '../../../../shared/agent-tab-title'
+import { isDecorativeAgentTitleFrameChange } from '../../../../shared/agent-decorative-title-signature'
+import { parseLegacyNumericPaneKey, parsePaneKey } from '../../../../shared/stable-pane-id'
+import type { Tab, TerminalTab } from '../../../../shared/types'
+import type { AppState } from '../types'
+
+export type TerminalTabTitleUpdate = { tabId: string; title: string }
+
+export type GeneratedTabTitleUpdate = {
+  paneKey: string
+  prompt: string
+  options?: { replaceExistingGeneratedTitle?: boolean }
+}
+
+type TitleState = Pick<
+  AppState,
+  'activeWorktreeId' | 'settings' | 'sortEpoch' | 'tabsByWorktree' | 'unifiedTabsByWorktree'
+>
+
+type TitlePatch = Partial<Pick<AppState, 'sortEpoch' | 'tabsByWorktree' | 'unifiedTabsByWorktree'>>
+
+type TitleUpdateResult = {
+  patch: TitlePatch | null
+  runtimeGraphChanged: boolean
+}
+
+type OwnerStage = {
+  tabs: TerminalTab[]
+  tabsChanged: boolean
+  tabIndexesById: Map<string, number[]>
+  unifiedTabs: Tab[]
+  unifiedTabsChanged: boolean
+  unifiedIndexByTabId: Map<string, number>
+}
+
+function getFallbackTabTitle(tab: TerminalTab): string {
+  return (
+    tab.customTitle?.trim() ||
+    tab.quickCommandLabel?.trim() ||
+    tab.defaultTitle?.trim() ||
+    tab.title ||
+    'Terminal 1'
+  )
+}
+
+function getTabIdFromPaneKey(paneKey: string): string | null {
+  return parsePaneKey(paneKey)?.tabId ?? parseLegacyNumericPaneKey(paneKey)?.tabId ?? null
+}
+
+function buildOwnerIndex(tabsByWorktree: TitleState['tabsByWorktree']): Map<string, string> {
+  const ownerByTabId = new Map<string, string>()
+  for (const [worktreeId, tabs] of Object.entries(tabsByWorktree)) {
+    for (const tab of tabs) {
+      ownerByTabId.set(tab.id, worktreeId)
+    }
+  }
+  return ownerByTabId
+}
+
+function getOwnerStage(
+  state: TitleState,
+  stages: Map<string, OwnerStage>,
+  worktreeId: string
+): OwnerStage {
+  const existing = stages.get(worktreeId)
+  if (existing) {
+    return existing
+  }
+  const tabs = state.tabsByWorktree[worktreeId] ?? []
+  const unifiedTabs = state.unifiedTabsByWorktree[worktreeId] ?? []
+  const tabIndexesById = new Map<string, number[]>()
+  for (let index = 0; index < tabs.length; index += 1) {
+    const tabId = tabs[index].id
+    const indexes = tabIndexesById.get(tabId)
+    if (indexes) {
+      indexes.push(index)
+    } else {
+      tabIndexesById.set(tabId, [index])
+    }
+  }
+  const unifiedIndexByTabId = new Map<string, number>()
+  for (let index = 0; index < unifiedTabs.length; index += 1) {
+    const tab = unifiedTabs[index]
+    if (tab.contentType === 'terminal' && !unifiedIndexByTabId.has(tab.entityId)) {
+      unifiedIndexByTabId.set(tab.entityId, index)
+    }
+  }
+  const stage: OwnerStage = {
+    tabs,
+    tabsChanged: false,
+    tabIndexesById,
+    unifiedTabs,
+    unifiedTabsChanged: false,
+    unifiedIndexByTabId
+  }
+  stages.set(worktreeId, stage)
+  return stage
+}
+
+function updateStageTabs(
+  stage: OwnerStage,
+  indexes: readonly number[],
+  update: (tab: TerminalTab) => TerminalTab
+): void {
+  if (!stage.tabsChanged) {
+    stage.tabs = [...stage.tabs]
+    stage.tabsChanged = true
+  }
+  for (const index of indexes) {
+    stage.tabs[index] = update(stage.tabs[index])
+  }
+}
+
+function updateStageUnifiedLabel(
+  stage: OwnerStage,
+  tabId: string,
+  key: 'generatedLabel' | 'label',
+  value: string
+): void {
+  const index = stage.unifiedIndexByTabId.get(tabId)
+  if (index === undefined || stage.unifiedTabs[index]?.[key] === value) {
+    return
+  }
+  if (!stage.unifiedTabsChanged) {
+    stage.unifiedTabs = [...stage.unifiedTabs]
+    stage.unifiedTabsChanged = true
+  }
+  stage.unifiedTabs[index] = { ...stage.unifiedTabs[index], [key]: value }
+}
+
+function finishTitleStages(
+  state: TitleState,
+  stages: Map<string, OwnerStage>,
+  sortEpochIncrement = 0
+): TitleUpdateResult {
+  const tabsChanged = [...stages.values()].some((stage) => stage.tabsChanged)
+  const unifiedTabsChanged = [...stages.values()].some((stage) => stage.unifiedTabsChanged)
+  if (!tabsChanged && !unifiedTabsChanged) {
+    return { patch: null, runtimeGraphChanged: false }
+  }
+  const patch: TitlePatch = {}
+  if (tabsChanged) {
+    patch.tabsByWorktree = { ...state.tabsByWorktree }
+  }
+  if (unifiedTabsChanged) {
+    patch.unifiedTabsByWorktree = { ...state.unifiedTabsByWorktree }
+  }
+  for (const [worktreeId, stage] of stages) {
+    if (stage.tabsChanged) {
+      patch.tabsByWorktree![worktreeId] = stage.tabs
+    }
+    if (stage.unifiedTabsChanged) {
+      patch.unifiedTabsByWorktree![worktreeId] = stage.unifiedTabs
+    }
+  }
+  if (sortEpochIncrement > 0) {
+    patch.sortEpoch = state.sortEpoch + sortEpochIncrement
+  }
+  return { patch, runtimeGraphChanged: tabsChanged }
+}
+
+export function applyTerminalTabTitleUpdates(
+  state: TitleState,
+  updates: readonly TerminalTabTitleUpdate[],
+  ownerByTabId = buildOwnerIndex(state.tabsByWorktree)
+): TitleUpdateResult {
+  const stages = new Map<string, OwnerStage>()
+  let sortEpochIncrement = 0
+  for (const { tabId, title } of updates) {
+    const ownerWorktreeId = ownerByTabId.get(tabId)
+    if (!ownerWorktreeId) {
+      continue
+    }
+    const stage = getOwnerStage(state, stages, ownerWorktreeId)
+    const tabIndexes = stage.tabIndexesById.get(tabId)
+    const currentTab = tabIndexes ? stage.tabs[tabIndexes[0]] : undefined
+    if (!currentTab || !tabIndexes) {
+      continue
+    }
+    const nextTitle = title.trim() || getFallbackTabTitle(currentTab)
+    if (isDecorativeAgentTitleFrameChange(currentTab.title, nextTitle)) {
+      updateStageUnifiedLabel(stage, tabId, 'label', currentTab.title)
+      continue
+    }
+    updateStageUnifiedLabel(stage, tabId, 'label', nextTitle)
+    if (currentTab.title === nextTitle) {
+      continue
+    }
+    updateStageTabs(stage, tabIndexes, (tab) => ({
+      ...tab,
+      title: nextTitle,
+      defaultTitle:
+        tab.defaultTitle ??
+        (/^Terminal \d+$/.test(tab.title) ? tab.title : undefined) ??
+        (/^Terminal \d+$/.test(nextTitle) ? nextTitle : undefined)
+    }))
+    if (ownerWorktreeId !== state.activeWorktreeId) {
+      sortEpochIncrement += 1
+    }
+  }
+  return finishTitleStages(state, stages, sortEpochIncrement)
+}
+
+export function applyGeneratedTabTitleUpdates(
+  state: TitleState,
+  updates: readonly GeneratedTabTitleUpdate[],
+  ownerByTabId = buildOwnerIndex(state.tabsByWorktree)
+): TitleUpdateResult {
+  if (state.settings?.tabAutoGenerateTitle !== true) {
+    return { patch: null, runtimeGraphChanged: false }
+  }
+  const stages = new Map<string, OwnerStage>()
+  for (const { paneKey, prompt, options } of updates) {
+    const tabId = getTabIdFromPaneKey(paneKey)
+    const ownerWorktreeId = tabId ? ownerByTabId.get(tabId) : undefined
+    if (!tabId || !ownerWorktreeId || prompt.length === 0) {
+      continue
+    }
+    const stage = getOwnerStage(state, stages, ownerWorktreeId)
+    const tabIndexes = stage.tabIndexesById.get(tabId)
+    const currentTab = tabIndexes ? stage.tabs[tabIndexes[0]] : undefined
+    if (
+      !currentTab ||
+      !tabIndexes ||
+      currentTab.customTitle?.trim() ||
+      currentTab.quickCommandLabel?.trim()
+    ) {
+      continue
+    }
+    const existingGeneratedTitle = currentTab.generatedTitle?.trim()
+    if (existingGeneratedTitle && options?.replaceExistingGeneratedTitle !== true) {
+      continue
+    }
+    const generatedTitle = deriveGeneratedTabTitle(prompt)
+    if (!generatedTitle || existingGeneratedTitle === generatedTitle) {
+      continue
+    }
+    updateStageTabs(stage, tabIndexes, (tab) => ({ ...tab, generatedTitle }))
+    updateStageUnifiedLabel(stage, tabId, 'generatedLabel', generatedTitle)
+  }
+  return finishTitleStages(state, stages)
+}
diff --git a/src/renderer/src/store/slices/terminals.ts b/src/renderer/src/store/slices/terminals.ts
index 3eb70095083..c644b6db241 100644
--- a/src/renderer/src/store/slices/terminals.ts
+++ b/src/renderer/src/store/slices/terminals.ts
@@ -28,7 +28,6 @@ import {
   parseWorkspaceKey,
   worktreeWorkspaceKey
 } from '../../../../shared/workspace-scope'
-import { deriveGeneratedTabTitle } from '../../../../shared/agent-tab-title'
 import { isDecorativeAgentTitleFrameChange } from '../../../../shared/agent-decorative-title-signature'
 import {
   isTerminalLeafId,
@@ -72,6 +71,12 @@ import { isClaudeAgent } from '@/lib/agent-status'
 import { recordTerminalInputActivity } from '@/lib/terminal-input-activity-coalescing'
 import { classifyTitleActivity } from '@/lib/pane-agent-evidence'
 import { buildOrphanTerminalCleanupPatch, getOrphanTerminalIds } from './terminal-orphan-helpers'
+import {
+  applyGeneratedTabTitleUpdates,
+  applyTerminalTabTitleUpdates,
+  type GeneratedTabTitleUpdate,
+  type TerminalTabTitleUpdate
+} from './terminal-tab-title-batch'
 import {
   dedupeTabOrder,
   ensureGroup,
@@ -227,16 +232,6 @@ function consumePendingActivationSpawn(
   return count === 2 ? true : count - 1
 }
 
-function getFallbackTabTitle(tab: TerminalTab, index?: number): string {
-  return (
-    tab.customTitle?.trim() ||
-    tab.quickCommandLabel?.trim() ||
-    tab.defaultTitle?.trim() ||
-    tab.title ||
-    `Terminal ${(index ?? 0) + 1}`
-  )
-}
-
 function getPathDisplayName(path: string, fallback: string): string {
   const normalized = path.trim().replace(/[\\/]+$/g, '')
   const basename = normalized.split(/[\\/]/).findLast(Boolean)?.trim()
@@ -339,36 +334,6 @@ function getTerminalTabOwnerWorktreeId(
   return terminalTabOwnerCache.get(tabId) ?? null
 }
 
-function updateUnifiedTerminalLabel(
-  unifiedTabs: Tab[],
-  terminalTabId: string,
-  label: string
-): Tab[] | null {
-  const unifiedIndex = unifiedTabs.findIndex(
-    (entry) => entry.contentType === 'terminal' && entry.entityId === terminalTabId
-  )
-  if (unifiedIndex === -1 || unifiedTabs[unifiedIndex]?.label === label) {
-    return null
-  }
-  return unifiedTabs.map((entry, index) => (index === unifiedIndex ? { ...entry, label } : entry))
-}
-
-function updateUnifiedTerminalGeneratedLabel(
-  unifiedTabs: Tab[],
-  terminalTabId: string,
-  generatedLabel: string
-): Tab[] | null {
-  const unifiedIndex = unifiedTabs.findIndex(
-    (entry) => entry.contentType === 'terminal' && entry.entityId === terminalTabId
-  )
-  if (unifiedIndex === -1 || unifiedTabs[unifiedIndex]?.generatedLabel === generatedLabel) {
-    return null
-  }
-  return unifiedTabs.map((entry, index) =>
-    index === unifiedIndex ? { ...entry, generatedLabel } : entry
-  )
-}
-
 function getTabIdFromPaneKey(paneKey: string): string | null {
   return parsePaneKey(paneKey)?.tabId ?? parseLegacyNumericPaneKey(paneKey)?.tabId ?? null
 }
@@ -670,6 +635,7 @@ export type TerminalSlice = {
       /** Initial native-chat view mode; agent launches pass 'chat' when openAgentTabsInChatByDefault is on, else omitted for the 'terminal' default. */
       viewMode?: Tab['viewMode']
       startupCwd?: string
+      forceHostRuntime?: boolean
     }
   ) => TerminalTab
   openNewTerminalTabInActiveWorkspace: (groupId: string) => Promise<void>
@@ -689,12 +655,14 @@ export type TerminalSlice = {
   setActiveTab: (tabId: string) => void
   setActiveTabForWorktree: (worktreeId: string, tabId: string) => void
   updateTabTitle: (tabId: string, title: string) => void
+  updateTabTitles: (updates: readonly TerminalTabTitleUpdate[]) => void
   setAiVaultTabTitle: (tabId: string, aiVaultTitle: AiVaultSessionTitle | null) => void
   setGeneratedTabTitleFromAgentPrompt: (
     paneKey: string,
     prompt: string,
     options?: { replaceExistingGeneratedTitle?: boolean }
   ) => void
+  setGeneratedTabTitlesFromAgentPrompts: (updates: readonly GeneratedTabTitleUpdate[]) => void
   clearTabLaunchAgent: (tabId: string) => void
   setRuntimePaneTitle: (tabId: string, paneId: number, title: string) => void
   clearRuntimePaneTitle: (tabId: string, paneId: number) => void
@@ -1379,7 +1347,9 @@ export const createTerminalSlice: StateCreator<AppState, [], [], TerminalSlice>
           : null,
         // Why: new terminals enter the worktree's repo-scoped WSL distro even when the global Windows shell is PowerShell/cmd.exe.
         isWslWorktree,
-        isRemoteWorktree ? undefined : getLocalProjectExecutionRuntimeContext(s, worktreeId)
+        isRemoteWorktree || options?.forceHostRuntime
+          ? undefined
+          : getLocalProjectExecutionRuntimeContext(s, worktreeId)
       )
       tab = {
         id,
@@ -1396,6 +1366,7 @@ export const createTerminalSlice: StateCreator<AppState, [], [], TerminalSlice>
         createdAt: Date.now(),
         ...(createdShellOverride !== undefined ? { shellOverride: createdShellOverride } : {}),
         ...(startupCwd && startupCwd.length > 0 ? { startupCwd } : {}),
+        ...(options?.forceHostRuntime ? { forceHostRuntime: true } : {}),
         ...(options?.launchAgent ? { launchAgent: options.launchAgent } : {}),
         // Why: mark click-caused (not work-caused) spawns so updateTabPtyId skips the activity/sortEpoch bump that would reorder Recent/Smart on click.
         ...(options?.pendingActivationSpawn ? { pendingActivationSpawn: true } : {})
@@ -1998,77 +1969,29 @@ export const createTerminalSlice: StateCreator<AppState, [], [], TerminalSlice>
   },
 
   updateTabTitle: (tabId, title) => {
-    set((s) => {
-      // Why: update only the owner to preserve selector equality for background worktrees.
-      const ownerWorktreeId = getTerminalTabOwnerWorktreeId(s.tabsByWorktree, tabId)
-      if (!ownerWorktreeId) {
-        return s
+    set((state) => {
+      const ownerWorktreeId = getTerminalTabOwnerWorktreeId(state.tabsByWorktree, tabId)
+      const ownerByTabId = ownerWorktreeId
+        ? new Map([[tabId, ownerWorktreeId]])
+        : new Map<string, string>()
+      const result = applyTerminalTabTitleUpdates(state, [{ tabId, title }], ownerByTabId)
+      if (result.runtimeGraphChanged) {
+        scheduleRuntimeGraphSync()
       }
-      const tabs = s.tabsByWorktree[ownerWorktreeId] ?? []
-      const tabIndex = tabs.findIndex((t) => t.id === tabId)
-      const currentTab = tabs[tabIndex]
-      if (!currentTab) {
-        return s
+      return result.patch ?? state
+    })
+  },
+
+  updateTabTitles: (updates) => {
+    if (updates.length === 0) {
+      return
+    }
+    set((state) => {
+      const result = applyTerminalTabTitleUpdates(state, updates)
+      if (result.runtimeGraphChanged) {
+        scheduleRuntimeGraphSync()
       }
-      const nextTitle = title.trim() || getFallbackTabTitle(currentTab)
-      const currentUnifiedTabs = s.unifiedTabsByWorktree[ownerWorktreeId] ?? []
-      if (isDecorativeAgentTitleFrameChange(currentTab.title, nextTitle)) {
-        const unifiedTabsWithCurrentLabel = updateUnifiedTerminalLabel(
-          currentUnifiedTabs,
-          tabId,
-          currentTab.title
-        )
-        return unifiedTabsWithCurrentLabel
-          ? {
-              unifiedTabsByWorktree: {
-                ...s.unifiedTabsByWorktree,
-                [ownerWorktreeId]: unifiedTabsWithCurrentLabel
-              }
-            }
-          : s
-      }
-      const unifiedTabsWithUpdatedLabel = updateUnifiedTerminalLabel(
-        currentUnifiedTabs,
-        tabId,
-        nextTitle
-      )
-      if (currentTab.title === nextTitle) {
-        return unifiedTabsWithUpdatedLabel
-          ? {
-              unifiedTabsByWorktree: {
-                ...s.unifiedTabsByWorktree,
-                [ownerWorktreeId]: unifiedTabsWithUpdatedLabel
-              }
-            }
-          : s
-      }
-      const ownerTabs = tabs.map((tab) =>
-        tab.id === tabId
-          ? {
-              ...tab,
-              // Why: PTYs can briefly emit an empty title as an agent exits; keep the stable fallback instead of a blank tab.
-              title: nextTitle,
-              defaultTitle:
-                tab.defaultTitle ??
-                (/^Terminal \d+$/.test(tab.title) ? tab.title : undefined) ??
-                (/^Terminal \d+$/.test(nextTitle) ? nextTitle : undefined)
-            }
-          : tab
-      )
-      scheduleRuntimeGraphSync()
-      const nextTabsByWorktree = { ...s.tabsByWorktree, [ownerWorktreeId]: ownerTabs }
-      // Why: title changes affect sorting, except active-worktree remount side effects.
-      const isActive = ownerWorktreeId === s.activeWorktreeId
-      const nextState: Partial<AppState> = isActive
-        ? { tabsByWorktree: nextTabsByWorktree }
-        : { tabsByWorktree: nextTabsByWorktree, sortEpoch: s.sortEpoch + 1 }
-      if (unifiedTabsWithUpdatedLabel) {
-        nextState.unifiedTabsByWorktree = {
-          ...s.unifiedTabsByWorktree,
-          [ownerWorktreeId]: unifiedTabsWithUpdatedLabel
-        }
-      }
-      return nextState
+      return result.patch ?? state
     })
   },
 
@@ -2105,18 +2028,16 @@ export const createTerminalSlice: StateCreator<AppState, [], [], TerminalSlice>
 
   setGeneratedTabTitleFromAgentPrompt: (paneKey, prompt, options) => {
     // Why: setAgentStatus is high-frequency; skip derive/set unless the feature is on and this tab still needs a (re)generated title.
-    if (get().settings?.tabAutoGenerateTitle !== true) {
-      return
-    }
+    const state = get()
     const tabId = getTabIdFromPaneKey(paneKey)
-    if (!tabId || prompt.length === 0) {
+    if (!tabId || prompt.length === 0 || state.settings?.tabAutoGenerateTitle !== true) {
       return
     }
-    const ownerWorktreeId = getTerminalTabOwnerWorktreeId(get().tabsByWorktree, tabId)
+    const ownerWorktreeId = getTerminalTabOwnerWorktreeId(state.tabsByWorktree, tabId)
     if (!ownerWorktreeId) {
       return
     }
-    const tabs = get().tabsByWorktree[ownerWorktreeId] ?? []
+    const tabs = state.tabsByWorktree[ownerWorktreeId] ?? []
     const currentTab = tabs.find((tab) => tab.id === tabId)
     if (!currentTab || currentTab.customTitle?.trim() || currentTab.quickCommandLabel?.trim()) {
       return
@@ -2125,57 +2046,29 @@ export const createTerminalSlice: StateCreator<AppState, [], [], TerminalSlice>
     if (existingGeneratedTitle && options?.replaceExistingGeneratedTitle !== true) {
       return
     }
-    const generatedTitle = deriveGeneratedTabTitle(prompt)
-    if (!generatedTitle || existingGeneratedTitle === generatedTitle) {
+    set((latestState) => {
+      const result = applyGeneratedTabTitleUpdates(
+        latestState,
+        [{ paneKey, prompt, options }],
+        new Map([[tabId, ownerWorktreeId]])
+      )
+      if (result.runtimeGraphChanged) {
+        scheduleRuntimeGraphSync()
+      }
+      return result.patch ?? latestState
+    })
+  },
+
+  setGeneratedTabTitlesFromAgentPrompts: (updates) => {
+    if (updates.length === 0) {
       return
     }
-    set((s) => {
-      const ownerTabsForWrite = s.tabsByWorktree[ownerWorktreeId]
-      if (!ownerTabsForWrite) {
-        return s
-      }
-      const tabIndex = ownerTabsForWrite.findIndex((tab) => tab.id === tabId)
-      const tabForWrite = ownerTabsForWrite[tabIndex]
-      // Why: re-check inside set so concurrent renames / setting flips win.
-      if (
-        !tabForWrite ||
-        s.settings?.tabAutoGenerateTitle !== true ||
-        tabForWrite.customTitle?.trim() ||
-        tabForWrite.quickCommandLabel?.trim()
-      ) {
-        return s
-      }
-      const latestGeneratedTitle = tabForWrite.generatedTitle?.trim()
-      if (
-        latestGeneratedTitle &&
-        (latestGeneratedTitle === generatedTitle || options?.replaceExistingGeneratedTitle !== true)
-      ) {
-        return s
-      }
-      const ownerTabs = ownerTabsForWrite.map((tab) =>
-        tab.id === tabId ? { ...tab, generatedTitle } : tab
-      )
-      const currentUnifiedTabs = s.unifiedTabsByWorktree[ownerWorktreeId] ?? []
-      const unifiedTabsWithGeneratedLabel = updateUnifiedTerminalGeneratedLabel(
-        currentUnifiedTabs,
-        tabId,
-        generatedTitle
-      )
-      scheduleRuntimeGraphSync()
-      return {
-        tabsByWorktree: {
-          ...s.tabsByWorktree,
-          [ownerWorktreeId]: ownerTabs
-        },
-        ...(unifiedTabsWithGeneratedLabel
-          ? {
-              unifiedTabsByWorktree: {
-                ...s.unifiedTabsByWorktree,
-                [ownerWorktreeId]: unifiedTabsWithGeneratedLabel
-              }
-            }
-          : {})
+    set((state) => {
+      const result = applyGeneratedTabTitleUpdates(state, updates)
+      if (result.runtimeGraphChanged) {
+        scheduleRuntimeGraphSync()
       }
+      return result.patch ?? state
     })
   },
 
diff --git a/src/renderer/src/store/slices/ui.ts b/src/renderer/src/store/slices/ui.ts
index e1b9c89e6ab..1bfa1d68d77 100644
--- a/src/renderer/src/store/slices/ui.ts
+++ b/src/renderer/src/store/slices/ui.ts
@@ -792,6 +792,7 @@ export type UISlice = {
     | 'create-worktree'
     | 'edit-meta'
     | 'delete-worktree'
+    | 'preserved-branch-review'
     | 'forget-ssh-workspace'
     | 'confirm-add-project-from-folder'
     | 'confirm-non-git-folder'
@@ -896,6 +897,8 @@ export type UISlice = {
   setHideCliCreatedWorkspaces: (v: boolean) => void
   hideDetachedHeadWorkspaces: boolean
   setHideDetachedHeadWorkspaces: (v: boolean) => void
+  hideWorkspacesFromOtherDevices: boolean
+  setHideWorkspacesFromOtherDevices: (v: boolean) => void
   alwaysShowDefaultBranchWorkspace: boolean
   setAlwaysShowDefaultBranchWorkspace: (v: boolean) => void
   showDotfilesByWorktree: Record<string, boolean>
@@ -2089,6 +2092,8 @@ export const createUISlice: StateCreator<AppState, [], [], UISlice> = (set, get)
   setHideCliCreatedWorkspaces: (v) => set({ hideCliCreatedWorkspaces: v }),
   hideDetachedHeadWorkspaces: false,
   setHideDetachedHeadWorkspaces: (v) => set({ hideDetachedHeadWorkspaces: v }),
+  hideWorkspacesFromOtherDevices: false,
+  setHideWorkspacesFromOtherDevices: (v) => set({ hideWorkspacesFromOtherDevices: v }),
   alwaysShowDefaultBranchWorkspace: true,
   setAlwaysShowDefaultBranchWorkspace: (v) => set({ alwaysShowDefaultBranchWorkspace: v }),
 
@@ -2497,6 +2502,7 @@ export const createUISlice: StateCreator<AppState, [], [], UISlice> = (set, get)
         hideAutomationGeneratedWorkspaces: ui.hideAutomationGeneratedWorkspaces === true,
         hideCliCreatedWorkspaces: ui.hideCliCreatedWorkspaces === true,
         hideDetachedHeadWorkspaces: ui.hideDetachedHeadWorkspaces === true,
+        hideWorkspacesFromOtherDevices: ui.hideWorkspacesFromOtherDevices === true,
         // Why !== false: profiles written before #8873 have no key, and they are
         // precisely the ones showing the bug, so absence must mean "exempt".
         alwaysShowDefaultBranchWorkspace: ui.alwaysShowDefaultBranchWorkspace !== false,
diff --git a/src/renderer/src/store/slices/usage-provider-slices.ts b/src/renderer/src/store/slices/usage-provider-slices.ts
new file mode 100644
index 00000000000..16855b08a48
--- /dev/null
+++ b/src/renderer/src/store/slices/usage-provider-slices.ts
@@ -0,0 +1,299 @@
+import type { StateCreator } from 'zustand'
+import type {
+  ClaudeUsageRange,
+  ClaudeUsageScope,
+  ClaudeUsageSnapshot
+} from '../../../../shared/claude-usage-types'
+import type {
+  CodexUsageRange,
+  CodexUsageScope,
+  CodexUsageSnapshot
+} from '../../../../shared/codex-usage-types'
+import type {
+  OpenCodeUsageRange,
+  OpenCodeUsageScope,
+  OpenCodeUsageSnapshot
+} from '../../../../shared/opencode-usage-types'
+import type { AppState } from '../types'
+
+type UsageSnapshot = {
+  scanState: {
+    enabled: boolean
+    isScanning: boolean
+    lastScanCompletedAt: number | null
+    lastScanError: string | null
+  }
+  summary: object
+  daily: object[]
+  modelBreakdown: object[]
+  projectBreakdown: object[]
+  recentSessions: object[]
+}
+
+type UsageShape<Scope extends string, Range extends string, Snapshot extends UsageSnapshot> = {
+  scope: Scope
+  range: Range
+  snapshot: Snapshot
+}
+
+type UsageData<T extends UsageShape<string, string, UsageSnapshot>> = {
+  scope: T['scope']
+  range: T['range']
+  scanState: T['snapshot']['scanState'] | null
+  summary: T['snapshot']['summary'] | null
+  daily: T['snapshot']['daily']
+  modelBreakdown: T['snapshot']['modelBreakdown']
+  projectBreakdown: T['snapshot']['projectBreakdown']
+  recentSessions: T['snapshot']['recentSessions']
+}
+
+type UsageApi<T extends UsageShape<string, string, UsageSnapshot>> = {
+  getScanState: () => Promise<T['snapshot']['scanState']>
+  setEnabled: (args: { enabled: boolean }) => Promise<T['snapshot']['scanState']>
+  refresh: (args?: { force?: boolean }) => Promise<T['snapshot']['scanState']>
+  getSnapshot: (args: {
+    scope: T['scope']
+    range: T['range']
+    limit?: number
+  }) => Promise<T['snapshot']>
+}
+
+type ProviderUsageSlice<
+  Prefix extends string,
+  Name extends string,
+  T extends UsageShape<string, string, UsageSnapshot>
+> = {
+  [K in keyof UsageData<T> as `${Prefix}Usage${Capitalize<K & string>}`]: UsageData<T>[K]
+} & Record<`set${Name}UsageEnabled`, (enabled: boolean) => Promise<void>> &
+  Record<`set${Name}UsageScope`, (scope: T['scope']) => Promise<void>> &
+  Record<`set${Name}UsageRange`, (range: T['range']) => Promise<void>> &
+  Record<`fetch${Name}Usage`, (opts?: { forceRefresh?: boolean }) => Promise<void>> &
+  Record<`enable${Name}Usage`, () => Promise<void>> &
+  Record<`refresh${Name}Usage`, () => Promise<void>>
+
+type UsageProviderConfig<
+  Prefix extends string,
+  Name extends string,
+  T extends UsageShape<string, string, UsageSnapshot>
+> = {
+  prefix: Prefix
+  name: Name
+  initialScope: T['scope']
+  initialRange: T['range']
+  getApi: () => UsageApi<T>
+  hasCachedData: (scanState: T['snapshot']['scanState']) => boolean
+}
+
+const usageDataFields = [
+  'scope',
+  'range',
+  'scanState',
+  'summary',
+  'daily',
+  'modelBreakdown',
+  'projectBreakdown',
+  'recentSessions'
+] as const satisfies readonly (keyof UsageData<UsageShape<string, string, UsageSnapshot>>)[]
+
+function usageDataKey(prefix: string, field: string): string {
+  return `${prefix}Usage${field[0].toUpperCase()}${field.slice(1)}`
+}
+
+function readUsageData<T extends UsageShape<string, string, UsageSnapshot>>(
+  state: AppState,
+  prefix: string
+): UsageData<T> {
+  const values = state as unknown as Record<string, unknown>
+  return Object.fromEntries(
+    usageDataFields.map((field) => [field, values[usageDataKey(prefix, field)]])
+  ) as UsageData<T>
+}
+
+function createUsagePatch<T extends UsageShape<string, string, UsageSnapshot>>(
+  prefix: string,
+  patch: Partial<UsageData<T>>
+): Partial<AppState> {
+  return Object.fromEntries(
+    usageDataFields
+      .filter((field) => field in patch)
+      .map((field) => [usageDataKey(prefix, field), patch[field]])
+  ) as Partial<AppState>
+}
+
+function createUsageProviderSlice<
+  Prefix extends string,
+  Name extends string,
+  T extends UsageShape<string, string, UsageSnapshot>
+>(
+  config: UsageProviderConfig<Prefix, Name, T>
+): StateCreator<AppState, [], [], ProviderUsageSlice<Prefix, Name, T>> {
+  return (set, get) => {
+    const update = (patch: Partial<UsageData<T>>): void =>
+      set(createUsagePatch(config.prefix, patch))
+    const read = (): UsageData<T> => readUsageData<T>(get(), config.prefix)
+
+    const fetchUsage = async (opts?: { forceRefresh?: boolean }): Promise<void> => {
+      try {
+        const api = config.getApi()
+        const scanState = (await api.getScanState()) as T['snapshot']['scanState'] | undefined
+        // Desktop-only usage APIs resolve undefined in paired web clients.
+        if (!scanState) {
+          return
+        }
+
+        const current = read()
+        const preserveLoading =
+          opts?.forceRefresh === true &&
+          current.scanState?.enabled === true &&
+          current.summary === null
+        update({
+          scanState: preserveLoading
+            ? {
+                ...scanState,
+                isScanning: true,
+                lastScanCompletedAt: null,
+                lastScanError: null
+              }
+            : scanState
+        })
+        if (!scanState.enabled) {
+          return
+        }
+
+        const selection = read()
+        const snapshot = await api.getSnapshot({
+          scope: selection.scope,
+          range: selection.range,
+          limit: 10
+        })
+        if (
+          snapshot.scanState.lastScanCompletedAt !== null ||
+          config.hasCachedData(snapshot.scanState)
+        ) {
+          update({
+            ...snapshot,
+            scanState:
+              opts?.forceRefresh === true
+                ? { ...snapshot.scanState, isScanning: true }
+                : snapshot.scanState
+          })
+        } else {
+          update({ scanState: { ...scanState, isScanning: true, lastScanError: null } })
+        }
+
+        await api.refresh({ force: opts?.forceRefresh ?? false })
+        const refreshedSelection = read()
+        update(
+          await api.getSnapshot({
+            scope: refreshedSelection.scope,
+            range: refreshedSelection.range,
+            limit: 10
+          })
+        )
+      } catch (error) {
+        console.error(`Failed to fetch ${config.name} usage:`, error)
+      }
+    }
+
+    const setEnabled = async (enabled: boolean): Promise<void> => {
+      try {
+        const nextScanState = (await config.getApi().setEnabled({ enabled })) as
+          | T['snapshot']['scanState']
+          | undefined
+        if (!nextScanState) {
+          return
+        }
+        update({
+          scanState: enabled
+            ? {
+                ...nextScanState,
+                isScanning: true,
+                lastScanCompletedAt: null,
+                lastScanError: null
+              }
+            : nextScanState,
+          summary: null,
+          daily: [],
+          modelBreakdown: [],
+          projectBreakdown: [],
+          recentSessions: []
+        })
+        if (enabled) {
+          await fetchUsage({ forceRefresh: true })
+        }
+      } catch (error) {
+        console.error(`Failed to update ${config.name} usage setting:`, error)
+      }
+    }
+
+    const initialData: UsageData<T> = {
+      scope: config.initialScope,
+      range: config.initialRange,
+      scanState: null,
+      summary: null,
+      daily: [],
+      modelBreakdown: [],
+      projectBreakdown: [],
+      recentSessions: []
+    }
+
+    return {
+      ...createUsagePatch(config.prefix, initialData),
+      [`set${config.name}UsageEnabled`]: setEnabled,
+      [`set${config.name}UsageScope`]: async (scope: T['scope']) => {
+        update({ scope })
+        await fetchUsage()
+      },
+      [`set${config.name}UsageRange`]: async (range: T['range']) => {
+        update({ range })
+        await fetchUsage()
+      },
+      [`fetch${config.name}Usage`]: fetchUsage,
+      [`enable${config.name}Usage`]: () => setEnabled(true),
+      [`refresh${config.name}Usage`]: () => fetchUsage({ forceRefresh: true })
+    } as ProviderUsageSlice<Prefix, Name, T>
+  }
+}
+
+type ClaudeUsageShape = UsageShape<ClaudeUsageScope, ClaudeUsageRange, ClaudeUsageSnapshot>
+type CodexUsageShape = UsageShape<CodexUsageScope, CodexUsageRange, CodexUsageSnapshot>
+type OpenCodeUsageShape = UsageShape<OpenCodeUsageScope, OpenCodeUsageRange, OpenCodeUsageSnapshot>
+
+export type ClaudeUsageSlice = ProviderUsageSlice<'claude', 'Claude', ClaudeUsageShape>
+export type CodexUsageSlice = ProviderUsageSlice<'codex', 'Codex', CodexUsageShape>
+export type OpenCodeUsageSlice = ProviderUsageSlice<'openCode', 'OpenCode', OpenCodeUsageShape>
+
+export const createClaudeUsageSlice = createUsageProviderSlice<
+  'claude',
+  'Claude',
+  ClaudeUsageShape
+>({
+  prefix: 'claude',
+  name: 'Claude',
+  initialScope: 'orca',
+  initialRange: '30d',
+  getApi: () => window.api.claudeUsage,
+  hasCachedData: (state) => state.hasAnyClaudeData
+})
+
+export const createCodexUsageSlice = createUsageProviderSlice<'codex', 'Codex', CodexUsageShape>({
+  prefix: 'codex',
+  name: 'Codex',
+  initialScope: 'orca',
+  initialRange: '30d',
+  getApi: () => window.api.codexUsage,
+  hasCachedData: (state) => state.hasAnyCodexData
+})
+
+export const createOpenCodeUsageSlice = createUsageProviderSlice<
+  'openCode',
+  'OpenCode',
+  OpenCodeUsageShape
+>({
+  prefix: 'openCode',
+  name: 'OpenCode',
+  initialScope: 'orca',
+  initialRange: '30d',
+  getApi: () => window.api.openCodeUsage,
+  hasCachedData: (state) => state.hasAnyOpenCodeData
+})
diff --git a/src/renderer/src/store/slices/usage-snapshot-refresh.benchmark.test.ts b/src/renderer/src/store/slices/usage-snapshot-refresh.benchmark.test.ts
index 1e4c7638cd1..7e2bea1f2ed 100644
--- a/src/renderer/src/store/slices/usage-snapshot-refresh.benchmark.test.ts
+++ b/src/renderer/src/store/slices/usage-snapshot-refresh.benchmark.test.ts
@@ -7,7 +7,7 @@ import type {
   CodexUsageSnapshot,
   CodexUsageSummary
 } from '../../../../shared/codex-usage-types'
-import { createCodexUsageSlice } from './codex-usage'
+import { createCodexUsageSlice } from './usage-provider-slices'
 
 type Deferred<T> = {
   promise: Promise<T>
diff --git a/src/renderer/src/store/slices/usage-web-client-fallback.test.ts b/src/renderer/src/store/slices/usage-web-client-fallback.test.ts
index 6dd6f6470c7..4b282d15b47 100644
--- a/src/renderer/src/store/slices/usage-web-client-fallback.test.ts
+++ b/src/renderer/src/store/slices/usage-web-client-fallback.test.ts
@@ -1,22 +1,15 @@
 import { create } from 'zustand'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { AppState } from '../types'
-import { createClaudeUsageSlice } from './claude-usage'
-import { createCodexUsageSlice } from './codex-usage'
-import { createOpenCodeUsageSlice } from './opencode-usage'
+import {
+  createClaudeUsageSlice,
+  createCodexUsageSlice,
+  createOpenCodeUsageSlice
+} from './usage-provider-slices'
 
-// Regression: in the web client (paired `orca serve` runtime) the desktop-only
-// usage IPC is not bridged, so the preload fallback proxy resolves every
-// `window.api.<provider>Usage.*` call to `undefined`. Before the guards, the
-// slices read `scanState.enabled` off that `undefined` and threw
-// `TypeError: Cannot read properties of undefined (reading 'enabled')` when a
-// user opened Settings -> Stats & Usage and pressed "enable" for an agent.
-//
-// These tests stub the web-client fallback (every call -> undefined) and assert
-// the slices degrade to a no-op instead of throwing.
+// Paired web clients resolve unbridged desktop usage calls to undefined.
 
 function stubWebClientFallback(): void {
-  // Mirrors web-preload-api's createFallbackProxy: any method resolves to undefined.
   const undefinedAsync = vi.fn(() => Promise.resolve(undefined))
   const provider = {
     getScanState: undefinedAsync,
diff --git a/src/renderer/src/store/slices/workspace-cleanup-removal-preflight.test.ts b/src/renderer/src/store/slices/workspace-cleanup-removal-preflight.test.ts
index cae7d7c8fce..d47b0f9ff8a 100644
--- a/src/renderer/src/store/slices/workspace-cleanup-removal-preflight.test.ts
+++ b/src/renderer/src/store/slices/workspace-cleanup-removal-preflight.test.ts
@@ -89,6 +89,38 @@ describe('workspace cleanup removal and protection', () => {
     expect(store.getState().workspaceCleanupScan?.candidates).toEqual([])
   })
 
+  it('returns preserved branches for the cleanup batch summary', async () => {
+    const candidate = makeCandidate()
+    installWorkspaceCleanupApi(
+      vi.fn(async () => ({ scannedAt: NOW, candidates: [candidate], errors: [] }))
+    )
+    const removeWorktree = vi.fn().mockResolvedValue({
+      ok: true,
+      preservedBranch: { branchName: 'feature/cleanup', head: 'saved-head' }
+    })
+    const store = createCleanupTestStore(removeWorktree)
+    store.setState({
+      workspaceCleanupScan: { scannedAt: NOW, candidates: [candidate], errors: [] }
+    } as Partial<AppState>)
+
+    await expect(
+      store.getState().removeWorkspaceCleanupCandidates([candidate.worktreeId])
+    ).resolves.toEqual({
+      removedIds: [candidate.worktreeId],
+      failures: [],
+      preservedBranches: [
+        {
+          worktreeId: candidate.worktreeId,
+          branchName: 'feature/cleanup',
+          expectedHead: 'saved-head'
+        }
+      ]
+    })
+    expect(removeWorktree).toHaveBeenCalledWith(candidate.worktreeId, false, {
+      suppressPreservedBranchToast: true
+    })
+  })
+
   it('demotes an active suggested workspace when it was not viewed from cleanup', async () => {
     const [candidate] = await enrichWorkspaceCleanupCandidates(
       [makeCandidate()],
diff --git a/src/renderer/src/store/slices/workspace-cleanup.ts b/src/renderer/src/store/slices/workspace-cleanup.ts
index bffe5fb93d4..c9ee2805594 100644
--- a/src/renderer/src/store/slices/workspace-cleanup.ts
+++ b/src/renderer/src/store/slices/workspace-cleanup.ts
@@ -24,6 +24,7 @@ import {
 import { mapWithConcurrency } from '../../../../shared/map-with-concurrency'
 import { classifyTitleActivity, isExplicitAgentStatusFresh } from '@/lib/pane-agent-evidence'
 import { translate } from '@/i18n/i18n'
+import type { PreservedBranchCleanup } from '@/lib/preserved-branch-cleanup'
 
 export type WorkspaceCleanupFailure = {
   worktreeId: string
@@ -34,6 +35,7 @@ export type WorkspaceCleanupFailure = {
 export type WorkspaceCleanupRemoveResult = {
   removedIds: string[]
   failures: WorkspaceCleanupFailure[]
+  preservedBranches?: PreservedBranchCleanup[]
 }
 
 export type WorkspaceCleanupRemoveOptions = {
@@ -300,6 +302,7 @@ export const createWorkspaceCleanupSlice: StateCreator<AppState, [], [], Workspa
   removeWorkspaceCleanupCandidates: async (worktreeIds, options) => {
     const removedIds: string[] = []
     const failures: WorkspaceCleanupFailure[] = []
+    const preservedBranches: PreservedBranchCleanup[] = []
     const approvedCandidatesByWorktreeId = new Map(
       (options?.approvedCandidates ?? []).map((candidate) => [candidate.worktreeId, candidate])
     )
@@ -336,6 +339,13 @@ export const createWorkspaceCleanupSlice: StateCreator<AppState, [], [], Workspa
       )
       if (result.ok) {
         removedIds.push(candidate.worktreeId)
+        if (result.preservedBranch) {
+          preservedBranches.push({
+            worktreeId: candidate.worktreeId,
+            branchName: result.preservedBranch.branchName,
+            expectedHead: result.preservedBranch.head
+          })
+        }
       } else {
         failures.push({
           worktreeId: candidate.worktreeId,
@@ -361,7 +371,11 @@ export const createWorkspaceCleanupSlice: StateCreator<AppState, [], [], Workspa
       }))
     }
 
-    return { removedIds, failures }
+    return {
+      removedIds,
+      failures,
+      ...(preservedBranches.length > 0 ? { preservedBranches } : {})
+    }
   }
 })
 
diff --git a/src/renderer/src/store/slices/worktree-catalog-reconciliation.test.ts b/src/renderer/src/store/slices/worktree-catalog-reconciliation.test.ts
new file mode 100644
index 00000000000..469ecaabb4d
--- /dev/null
+++ b/src/renderer/src/store/slices/worktree-catalog-reconciliation.test.ts
@@ -0,0 +1,74 @@
+import { describe, expect, it } from 'vitest'
+import { catalogRowsEqual, reuseEqualCatalogRows } from './worktree-catalog-reconciliation'
+
+describe('reuseEqualCatalogRows', () => {
+  it('does not traverse a catalog already reconciled by identity', () => {
+    const current = [
+      {
+        get id(): string {
+          throw new Error('catalog row was traversed')
+        }
+      }
+    ]
+
+    expect(catalogRowsEqual(current, current)).toBe(true)
+  })
+
+  it('reuses rows with equivalent nested catalog data', () => {
+    const current = [
+      { id: 'a', nested: { labels: ['one', 'two'] }, optional: undefined },
+      { id: 'b', nested: { labels: ['three'] } }
+    ]
+    const incoming = [
+      { id: 'a', nested: { labels: ['one', 'two'] } },
+      { id: 'b', nested: { labels: ['three'] } }
+    ]
+
+    const reconciled = reuseEqualCatalogRows(current, incoming)
+
+    expect(reconciled).toBe(current)
+    expect(catalogRowsEqual(current, incoming)).toBe(true)
+  })
+
+  it('reuses unaffected rows while publishing nested changes', () => {
+    const current = [
+      { id: 'a', nested: { value: 1 } },
+      { id: 'b', nested: { value: 2 } }
+    ]
+    const incoming = [
+      { id: 'a', nested: { value: 3 } },
+      { id: 'b', nested: { value: 2 } }
+    ]
+
+    const reconciled = reuseEqualCatalogRows(current, incoming)
+
+    expect(reconciled).not.toBe(current)
+    expect(reconciled[0]).toBe(incoming[0])
+    expect(reconciled[1]).toBe(current[1])
+  })
+
+  it('does not hide host ownership changes', () => {
+    const current = [{ id: 'a', runtimeOwnerEnvironmentId: 'env-a' }]
+    const incoming = [{ id: 'a', runtimeOwnerEnvironmentId: 'env-b' }]
+
+    expect(reuseEqualCatalogRows(current, incoming)[0]).toBe(incoming[0])
+  })
+
+  it('reuses same-ID rows from different hosts independently', () => {
+    const current = [
+      { id: 'repo::/same/path', hostId: 'ssh:a' },
+      { id: 'repo::/same/path', hostId: 'ssh:b' }
+    ]
+    const equivalent = structuredClone(current)
+
+    expect(reuseEqualCatalogRows(current, equivalent)).toBe(current)
+
+    const incoming = structuredClone(current.toReversed())
+    const reconciled = reuseEqualCatalogRows(current, incoming)
+
+    expect(reconciled).not.toBe(current)
+    expect(reconciled.map((row) => row.hostId)).toEqual(['ssh:b', 'ssh:a'])
+    expect(reconciled[0]).toBe(current[1])
+    expect(reconciled[1]).toBe(current[0])
+  })
+})
diff --git a/src/renderer/src/store/slices/worktree-catalog-reconciliation.ts b/src/renderer/src/store/slices/worktree-catalog-reconciliation.ts
new file mode 100644
index 00000000000..5442df285f8
--- /dev/null
+++ b/src/renderer/src/store/slices/worktree-catalog-reconciliation.ts
@@ -0,0 +1,70 @@
+type CatalogRow = { id: string }
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  if (typeof value !== 'object' || value === null) {
+    return false
+  }
+  const prototype = Object.getPrototypeOf(value)
+  return prototype === Object.prototype || prototype === null
+}
+
+function catalogValuesEqual(left: unknown, right: unknown): boolean {
+  if (Object.is(left, right)) {
+    return true
+  }
+  if (Array.isArray(left) || Array.isArray(right)) {
+    if (!Array.isArray(left) || !Array.isArray(right) || left.length !== right.length) {
+      return false
+    }
+    return left.every((value, index) => catalogValuesEqual(value, right[index]))
+  }
+  if (!isPlainRecord(left) || !isPlainRecord(right)) {
+    return false
+  }
+  const keys = new Set([...Object.keys(left), ...Object.keys(right)])
+  for (const key of keys) {
+    if (!catalogValuesEqual(left[key], right[key])) {
+      return false
+    }
+  }
+  return true
+}
+
+export function reuseEqualCatalogRows<T extends CatalogRow>(
+  current: readonly T[] | undefined,
+  incoming: readonly T[]
+): T[] {
+  if (!current) {
+    return [...incoming]
+  }
+  const currentById = new Map<string, T[]>()
+  for (const row of current) {
+    const candidates = currentById.get(row.id)
+    if (candidates) {
+      candidates.push(row)
+    } else {
+      currentById.set(row.id, [row])
+    }
+  }
+  const reconciled = incoming.map((row) => {
+    const candidates = currentById.get(row.id)
+    const previousIndex = candidates?.findIndex((candidate) => catalogValuesEqual(candidate, row))
+    return previousIndex !== undefined && previousIndex >= 0
+      ? candidates!.splice(previousIndex, 1)[0]
+      : row
+  })
+  return current.length === reconciled.length &&
+    current.every((row, index) => row === reconciled[index])
+    ? (current as T[])
+    : reconciled
+}
+
+export function catalogRowsEqual<T extends CatalogRow>(
+  current: readonly T[] | undefined,
+  incoming: readonly T[]
+): boolean {
+  if (current === incoming) {
+    return true
+  }
+  return reuseEqualCatalogRows(current, incoming) === current
+}
diff --git a/src/renderer/src/store/slices/worktree-helpers.ts b/src/renderer/src/store/slices/worktree-helpers.ts
index 499a4865cfe..9675be9a693 100644
--- a/src/renderer/src/store/slices/worktree-helpers.ts
+++ b/src/renderer/src/store/slices/worktree-helpers.ts
@@ -47,10 +47,19 @@ export type WorktreeDeleteState = {
   lockReason?: string | null
 }
 
+type RendererRemoveWorktreeResult = Omit<RemoveWorktreeResult, 'preservedBranch'> & {
+  preservedBranch?: NonNullable<RemoveWorktreeResult['preservedBranch']> & {
+    hostId?: ExecutionHostId
+    runtimeEnvironmentId?: string
+  }
+}
+
 export type WorktreeFetchOptions = {
   requireAuthoritative?: boolean
   executionHostId?: ExecutionHostId
   forceLocalOwner?: boolean
+  /** Skip automatic remote lineage when the caller owns a final host-wide refresh. */
+  suppressRemoteLineageRefresh?: boolean
 }
 
 export type DirectSshWorktreeFetchOptions = WorktreeFetchOptions & {
@@ -236,13 +245,18 @@ export type WorktreeSlice = {
       // PTY stopped; `force` alone is set by the ordinary delete confirmation.
       allowUnverifiedPtyStop?: boolean
     }
-  ) => Promise<({ ok: true } & RemoveWorktreeResult) | { ok: false; error: string }>
+  ) => Promise<({ ok: true } & RendererRemoveWorktreeResult) | { ok: false; error: string }>
   markWorktreesDeleting: (worktreeIds: readonly string[]) => void
   markWorktreesQueuedForDeletion: (worktreeIds: readonly string[]) => void
   forceDeletePreservedBranch: (
     worktreeId: string,
     branchName: string,
-    expectedHead: string
+    expectedHead: string,
+    options?: {
+      suppressToast?: boolean
+      hostId?: ExecutionHostId
+      runtimeEnvironmentId?: string
+    }
   ) => Promise<({ ok: true } & ForceDeleteWorktreeBranchResult) | { ok: false; error: string }>
   clearWorktreeDeleteState: (worktreeId: string) => void
   /** Never rejects — most callers fire-and-forget. Callers that own a surface
@@ -379,9 +393,7 @@ export function withoutErasedRequiredWorktreeFields(
   updates: Partial<WorktreeMeta>
 ): Partial<WorktreeMeta> {
   const erased = Object.keys(ERASURE_PROTECTED_KEYS).filter(
-    (key) =>
-      updates[key as keyof WorktreeMeta] === undefined &&
-      Object.prototype.hasOwnProperty.call(updates, key)
+    (key) => updates[key as keyof WorktreeMeta] === undefined && Object.hasOwn(updates, key)
   )
   if (erased.length === 0) {
     return updates
diff --git a/src/renderer/src/store/slices/worktree-nav-history.ts b/src/renderer/src/store/slices/worktree-nav-history.ts
index 5a72d3d0530..1582e649017 100644
--- a/src/renderer/src/store/slices/worktree-nav-history.ts
+++ b/src/renderer/src/store/slices/worktree-nav-history.ts
@@ -43,7 +43,7 @@ export type WorktreeNavHistoryTaskDetailEntry =
 export type WorktreeNavHistoryViewEntry =
   | WorktreeNavHistorySimpleViewEntry
   | WorktreeNavHistoryTaskDetailEntry
-export type WorktreeNavHistoryEntry = string | WorktreeNavHistoryViewEntry
+export type WorktreeNavHistoryEntry = (string & {}) | WorktreeNavHistoryViewEntry
 
 export type WorktreeNavHistorySlice = {
   // Linear history, oldest -> newest.
diff --git a/src/renderer/src/store/slices/worktrees.test.ts b/src/renderer/src/store/slices/worktrees.test.ts
index 6709169daca..5ebe9a06116 100644
--- a/src/renderer/src/store/slices/worktrees.test.ts
+++ b/src/renderer/src/store/slices/worktrees.test.ts
@@ -487,6 +487,92 @@ describe('fetchWorktrees', () => {
     expect(result).toBe(true)
   })
 
+  it('retains catalog and row references for a cloned unchanged runtime payload', async () => {
+    const store = createTestStore()
+    const first = makeWorktree({
+      id: 'repo1::/path/first',
+      repoId: 'repo1',
+      path: '/path/first',
+      createdAt: 123,
+      sparsePresetId: 'preset-1',
+      pushTarget: {
+        remoteName: 'origin',
+        branchName: 'feature',
+        remoteCreated: true
+      },
+      cliProvenance: {
+        kind: 'created-by-cli',
+        createdAt: 123,
+        callerTerminalHandle: 'term-1',
+        startupAgent: 'codex'
+      }
+    })
+    const second = makeWorktree({
+      id: 'repo1::/path/second',
+      repoId: 'repo1',
+      path: '/path/second'
+    })
+    const detected = makeDetectedResult('repo1', [first, second])
+    store.setState({
+      worktreesByRepo: { repo1: [first, second] },
+      detectedWorktreesByRepo: { repo1: detected },
+      sortEpoch: 7
+    } as Partial<AppState>)
+    mockApi.worktrees.listDetected.mockResolvedValueOnce(
+      structuredClone(makeDetectedResult('repo1', [first, second]))
+    )
+    const before = store.getState()
+    const subscriber = vi.fn()
+    const unsubscribe = store.subscribe(subscriber)
+
+    await store.getState().fetchWorktrees('repo1')
+    unsubscribe()
+
+    const after = store.getState()
+    expect(after.worktreesByRepo).toBe(before.worktreesByRepo)
+    expect(after.worktreesByRepo.repo1).toBe(before.worktreesByRepo.repo1)
+    expect(after.detectedWorktreesByRepo).toBe(before.detectedWorktreesByRepo)
+    expect(after.detectedWorktreesByRepo.repo1).toBe(before.detectedWorktreesByRepo.repo1)
+    expect(after.sortEpoch).toBe(7)
+    expect(subscriber).not.toHaveBeenCalled()
+  })
+
+  it('reuses unaffected catalog rows while publishing a previously untracked field change', async () => {
+    const store = createTestStore()
+    const changed = makeWorktree({
+      id: 'repo1::/path/changed',
+      repoId: 'repo1',
+      path: '/path/changed',
+      pushTarget: { remoteName: 'origin', branchName: 'feature', remoteCreated: false }
+    })
+    const stable = makeWorktree({
+      id: 'repo1::/path/stable',
+      repoId: 'repo1',
+      path: '/path/stable'
+    })
+    const detected = makeDetectedResult('repo1', [changed, stable])
+    store.setState({
+      worktreesByRepo: { repo1: [changed, stable] },
+      detectedWorktreesByRepo: { repo1: detected },
+      sortEpoch: 7
+    } as Partial<AppState>)
+    mockApi.worktrees.listDetected.mockResolvedValueOnce(
+      makeDetectedResult('repo1', [
+        { ...changed, pushTarget: { ...changed.pushTarget!, remoteCreated: true } },
+        { ...stable }
+      ])
+    )
+
+    await store.getState().fetchWorktrees('repo1')
+
+    const after = store.getState()
+    expect(after.worktreesByRepo.repo1[0]).not.toBe(changed)
+    expect(after.worktreesByRepo.repo1[0].pushTarget?.remoteCreated).toBe(true)
+    expect(after.worktreesByRepo.repo1[1]).toBe(stable)
+    expect(after.detectedWorktreesByRepo.repo1.worktrees[1]).toBe(detected.worktrees[1])
+    expect(after.sortEpoch).toBe(8)
+  })
+
   it('updates the repo entry and bumps sortEpoch when git reports a branch change', async () => {
     const store = createTestStore()
     const existing = makeWorktree({
@@ -3101,6 +3187,65 @@ describe('fetchWorktrees', () => {
     expect(store.getState().sortEpoch).toBe(7)
   })
 
+  it('defers remote lineage when a caller owns the final host refresh', async () => {
+    const store = createTestStore()
+    const worktree = makeWorktree({
+      id: 'repo1::/remote/wt1',
+      repoId: 'repo1',
+      path: '/remote/wt1',
+      branch: 'refs/heads/remote'
+    })
+    const lineage = makeLineage({ worktreeId: worktree.id })
+    const workspaceLineage = makeWorkspaceLineage({
+      childWorkspaceKey: worktreeWorkspaceKey(worktree.id)
+    })
+    store.setState({
+      settings: { activeRuntimeEnvironmentId: 'env-1' } as never,
+      worktreesByRepo: {}
+    } as Partial<AppState>)
+    runtimeEnvironmentCall.mockImplementation(({ method }: RuntimeEnvironmentCallRequest) => {
+      const result =
+        method === 'worktree.lineageList'
+          ? {
+              lineage: { [lineage.worktreeId]: lineage },
+              workspaceLineage: { [workspaceLineage.childWorkspaceKey]: workspaceLineage }
+            }
+          : makeDetectedResult('repo1', [worktree])
+      return Promise.resolve({
+        id: 'rpc-1',
+        ok: true,
+        result,
+        _meta: { runtimeId: 'runtime-remote' }
+      })
+    })
+
+    await store.getState().fetchWorktrees('repo1', {
+      executionHostId: 'runtime:env-1',
+      suppressRemoteLineageRefresh: true
+    })
+
+    expect(store.getState().worktreesByRepo.repo1).toEqual([
+      expect.objectContaining({ id: worktree.id, hostId: 'runtime:env-1' })
+    ])
+    expect(
+      runtimeEnvironmentCall.mock.calls.filter(
+        ([request]) => request.method === 'worktree.lineageList'
+      )
+    ).toHaveLength(0)
+
+    await store.getState().fetchWorktreeLineage({ executionHostId: 'runtime:env-1' })
+
+    expect(
+      runtimeEnvironmentCall.mock.calls.filter(
+        ([request]) => request.method === 'worktree.lineageList'
+      )
+    ).toHaveLength(1)
+    expect(store.getState().worktreeLineageById).toEqual({ [lineage.worktreeId]: lineage })
+    expect(store.getState().workspaceLineageByChildKey).toEqual({
+      [workspaceLineage.childWorkspaceKey]: workspaceLineage
+    })
+  })
+
   it('keeps a successful remote worktree refresh when lineage refresh fails', async () => {
     const store = createTestStore()
     const refreshed = makeWorktree({
@@ -6097,11 +6242,13 @@ describe('worktree remote runtime mutations', () => {
       method: 'worktree.rm',
       params: {
         worktree: `id:${wt.id}`,
+        hostId: 'runtime:env-1',
         force: undefined,
         allowUnverifiedPtyStop: false,
         runHooks: true
       },
-      timeoutMs: 60_000
+      timeoutMs: 60_000,
+      expectedEnvironmentPairingRevision: undefined
     })
     expect(mockApi.worktrees.remove).not.toHaveBeenCalled()
     expect(store.getState().shutdownWorktreeTerminals).toHaveBeenCalledWith(wt.id, {
@@ -6120,12 +6267,21 @@ describe('worktree remote runtime mutations', () => {
       hostId: 'ssh:hub-private-target',
       runtimeOwnerEnvironmentId: 'owner-hub'
     })
-    runtimeEnvironmentCall.mockResolvedValue({
-      id: 'rpc-rm-nested',
-      ok: true,
-      result: { removed: true },
-      _meta: { runtimeId: 'runtime-owner-hub' }
-    })
+    runtimeEnvironmentCall
+      .mockResolvedValueOnce({
+        id: 'rpc-rm-nested',
+        ok: true,
+        result: {
+          preservedBranch: { branchName: 'feature/nested', head: 'saved-head' }
+        },
+        _meta: { runtimeId: 'runtime-owner-hub' }
+      })
+      .mockResolvedValueOnce({
+        id: 'rpc-force-delete-branch',
+        ok: true,
+        result: { deleted: true },
+        _meta: { runtimeId: 'runtime-owner-hub' }
+      })
     store.setState({
       settings: { activeRuntimeEnvironmentId: 'different-hub' } as never,
       worktreesByRepo: { 'repo-ssh': [wt] }
@@ -6133,12 +6289,21 @@ describe('worktree remote runtime mutations', () => {
 
     const result = await store.getState().removeWorktree(wt.id)
 
-    expect(result).toEqual({ ok: true })
-    expect(runtimeEnvironmentCall).toHaveBeenCalledWith({
+    expect(result).toEqual({
+      ok: true,
+      preservedBranch: {
+        branchName: 'feature/nested',
+        head: 'saved-head',
+        hostId: 'ssh:hub-private-target',
+        runtimeEnvironmentId: 'owner-hub'
+      }
+    })
+    expect(runtimeEnvironmentCall).toHaveBeenNthCalledWith(1, {
       selector: 'owner-hub',
       method: 'worktree.rm',
       params: {
         worktree: `id:${wt.id}`,
+        hostId: 'ssh:hub-private-target',
         force: undefined,
         allowUnverifiedPtyStop: false,
         runHooks: true
@@ -6146,6 +6311,96 @@ describe('worktree remote runtime mutations', () => {
       timeoutMs: 60_000
     })
     expect(mockApi.worktrees.remove).not.toHaveBeenCalled()
+    expect(store.getState().worktreesByRepo['repo-ssh']).toEqual([])
+
+    const forceResult = await store
+      .getState()
+      .forceDeletePreservedBranch(wt.id, 'feature/nested', 'saved-head')
+
+    expect(forceResult).toEqual({ ok: true, deleted: true })
+    expect(runtimeEnvironmentCall).toHaveBeenNthCalledWith(2, {
+      selector: 'owner-hub',
+      method: 'worktree.forceDeleteBranch',
+      params: {
+        worktree: `id:${wt.id}`,
+        branchName: 'feature/nested',
+        expectedHead: 'saved-head',
+        hostId: 'ssh:hub-private-target'
+      },
+      timeoutMs: 15_000
+    })
+  })
+
+  it('retains separate preserved-branch cleanup routes for sequential same-id hosts', async () => {
+    const store = createTestStore()
+    const worktreeId = 'repo-shared::/same/path'
+    const localWorktree = makeWorktree({
+      id: worktreeId,
+      repoId: 'repo-shared',
+      path: '/same/path',
+      hostId: 'local'
+    })
+    const remoteWorktree = makeWorktree({
+      id: worktreeId,
+      repoId: 'repo-shared',
+      path: '/same/path',
+      hostId: 'ssh:shared-target',
+      runtimeOwnerEnvironmentId: 'shared-hub'
+    })
+    mockApi.worktrees.remove.mockResolvedValueOnce({
+      preservedBranch: { branchName: 'feature/local', head: 'local-head' }
+    })
+    runtimeEnvironmentCall.mockImplementation(({ method }: RuntimeEnvironmentCallRequest) =>
+      Promise.resolve({
+        id: `rpc-${method}`,
+        ok: true,
+        result:
+          method === 'repo.hooksCheck'
+            ? { hasHooks: false, hooks: null, mayNeedUpdate: false }
+            : method === 'worktree.rm'
+              ? {
+                  preservedBranch: { branchName: 'feature/remote', head: 'remote-head' }
+                }
+              : { deleted: true },
+        _meta: { runtimeId: 'runtime-shared-hub' }
+      })
+    )
+    store.setState({
+      worktreesByRepo: { 'repo-shared': [localWorktree] }
+    } as Partial<AppState>)
+
+    await store.getState().removeWorktree(worktreeId)
+    store.setState({
+      worktreesByRepo: { 'repo-shared': [remoteWorktree] }
+    } as Partial<AppState>)
+    await store.getState().removeWorktree(worktreeId)
+
+    await store
+      .getState()
+      .forceDeletePreservedBranch(worktreeId, 'feature/local', 'local-head', { hostId: 'local' })
+    await store.getState().forceDeletePreservedBranch(worktreeId, 'feature/remote', 'remote-head', {
+      hostId: 'ssh:shared-target',
+      runtimeEnvironmentId: 'shared-hub'
+    })
+
+    expect(mockApi.worktrees.forceDeletePreservedBranch).toHaveBeenCalledWith({
+      worktreeId,
+      branchName: 'feature/local',
+      expectedHead: 'local-head',
+      hostId: 'local'
+    })
+    expect(runtimeEnvironmentCall).toHaveBeenCalledWith(
+      expect.objectContaining({
+        selector: 'shared-hub',
+        method: 'worktree.forceDeleteBranch',
+        params: {
+          worktree: `id:${worktreeId}`,
+          branchName: 'feature/remote',
+          expectedHead: 'remote-head',
+          hostId: 'ssh:shared-target'
+        }
+      })
+    )
   })
 
   it('fails HUB-owned SSH removal closed when the exact id has two HUB owners', async () => {
@@ -6439,6 +6694,22 @@ describe('worktree remote runtime mutations', () => {
     expect(mockApi.worktrees.forceDeletePreservedBranch).not.toHaveBeenCalled()
   })
 
+  it('suppresses per-branch feedback for an aggregate delete', async () => {
+    const store = createTestStore()
+    const wt = makeWorktree({ id: 'repo1::/path/wt1', repoId: 'repo1', path: '/path/wt1' })
+    store.setState({ worktreesByRepo: { repo1: [wt] } } as Partial<AppState>)
+    vi.mocked(toast.success).mockClear()
+    vi.mocked(toast.error).mockClear()
+
+    const result = await store
+      .getState()
+      .forceDeletePreservedBranch(wt.id, 'feature/test', 'abc123', { suppressToast: true })
+
+    expect(result).toEqual({ ok: true, deleted: true })
+    expect(toast.success).not.toHaveBeenCalled()
+    expect(toast.error).not.toHaveBeenCalled()
+  })
+
   it('fails preserved branch deletion closed for two HUB owners', async () => {
     const store = createTestStore()
     const worktreeId = 'repo-ssh::/srv/same-wt'
diff --git a/src/renderer/src/store/slices/worktrees.ts b/src/renderer/src/store/slices/worktrees.ts
index 51613ebdb8a..94a3a692360 100644
--- a/src/renderer/src/store/slices/worktrees.ts
+++ b/src/renderer/src/store/slices/worktrees.ts
@@ -14,6 +14,7 @@ import type {
   WorktreeLineage,
   WorkspaceLineage,
   ProjectHostSetup,
+  Repo,
   WorktreeMeta
 } from '../../../../shared/types'
 import type { RuntimeWorktreeListResult } from '../../../../shared/runtime-types'
@@ -28,8 +29,6 @@ import {
 } from './worktree-helpers'
 import { projectWorktreeTabModelReconciliation } from './tabs'
 import { splitWorktreeIdForFilesystem } from '../../../../shared/worktree-id'
-import { areWorkspaceLinkedItemsEqual } from '../../../../shared/workspace-linked-item'
-import { areTaskSourceContextsEqual } from '../../../../shared/task-source-context'
 import {
   remapClosedTerminalTabSnapshotCwds,
   type ClosedTerminalTabSnapshot
@@ -120,6 +119,10 @@ import {
   type DetectedWorktreeRefreshLease
 } from './detected-worktree-refresh-leases'
 import { getTerminalActivationSpawnSuppression } from './terminal-activation-spawn-suppression'
+import {
+  preservedBranchCleanupKey,
+  type PreservedBranchCleanup
+} from '../../../../shared/preserved-branch-cleanup'
 import type {
   HostQualifiedDetectedWorktreeResult,
   HostQualifiedKnownWorktreeResult,
@@ -129,6 +132,7 @@ import type {
 } from '../../../../shared/detected-worktree-provider-contract'
 import type { DirectSshAuthority } from '../../../../shared/ssh-types'
 import { findIndexedWorktreeOwnerForHost } from '@/lib/worktree-runtime-owner-index'
+import { catalogRowsEqual, reuseEqualCatalogRows } from './worktree-catalog-reconciliation'
 export type { WorktreeSlice, WorktreeDeleteState } from './worktree-helpers'
 
 // Why: old runtime servers only have `worktree.list`; preserve the large-list UI hydration parity used before `worktree.detectedList` existed.
@@ -143,6 +147,10 @@ const FOLDER_WORKSPACE_ACTIVITY_PERSIST_INTERVAL_MS = 1_000
 export const WORKTREE_REFRESH_CONCURRENCY = 8
 const pendingActivationTerminalPrepCancels = new Map<string, () => void>()
 const detachedHeadAutoDerivedDisplayNames = new Map<string, string>()
+const preservedBranchRuntimeTargetByCleanupKey = new Map<
+  string,
+  { cleanup: PreservedBranchCleanup; target: ReturnType<typeof getActiveRuntimeTarget> }
+>()
 const folderWorkspaceWorktreeCache = new WeakMap<FolderWorkspace, Worktree>()
 const hostedReviewPushTargetLookupsInFlight = new Set<string>()
 const runtimeDetectedWorktreeRefreshesInFlight = new Map<
@@ -312,107 +320,8 @@ function showLocalBaseRefRefreshToast(
   )
 }
 
-function arraysShallowEqual(a: string[] | undefined, b: string[] | undefined): boolean {
-  if (a === b) {
-    return true
-  }
-  if (!a || !b || a.length !== b.length) {
-    return !a?.length && !b?.length
-  }
-  return a.every((v, i) => v === b[i])
-}
-
-function areLineageRecordsEqual(
-  a: WorktreeLineage | null | undefined,
-  b: WorktreeLineage | null | undefined
-): boolean {
-  if (!a || !b) {
-    return !a && !b
-  }
-  return (
-    a.worktreeId === b.worktreeId &&
-    a.worktreeInstanceId === b.worktreeInstanceId &&
-    a.parentWorktreeId === b.parentWorktreeId &&
-    a.parentWorktreeInstanceId === b.parentWorktreeInstanceId &&
-    a.origin === b.origin &&
-    a.capture.source === b.capture.source &&
-    a.capture.confidence === b.capture.confidence &&
-    a.orchestrationRunId === b.orchestrationRunId &&
-    a.taskId === b.taskId &&
-    a.coordinatorHandle === b.coordinatorHandle &&
-    a.createdByTerminalHandle === b.createdByTerminalHandle &&
-    a.createdAt === b.createdAt
-  )
-}
-
 function areWorktreesEqual(current: Worktree[] | undefined, next: Worktree[]): boolean {
-  if (!current || current.length !== next.length) {
-    return false
-  }
-
-  return current.every((worktree, index) => {
-    const candidate = next[index]
-    return (
-      worktree.id === candidate.id &&
-      worktree.instanceId === candidate.instanceId &&
-      worktree.repoId === candidate.repoId &&
-      worktree.projectId === candidate.projectId &&
-      worktree.hostId === candidate.hostId &&
-      worktree.projectHostSetupId === candidate.projectHostSetupId &&
-      worktree.path === candidate.path &&
-      worktree.head === candidate.head &&
-      worktree.branch === candidate.branch &&
-      worktree.isBare === candidate.isBare &&
-      worktree.isMainWorktree === candidate.isMainWorktree &&
-      worktree.isSparse === candidate.isSparse &&
-      worktree.displayName === candidate.displayName &&
-      worktree.comment === candidate.comment &&
-      worktree.linkedIssue === candidate.linkedIssue &&
-      worktree.linkedPR === candidate.linkedPR &&
-      worktree.linkedLinearIssue === candidate.linkedLinearIssue &&
-      (worktree.linkedLinearIssueWorkspaceId ?? null) ===
-        (candidate.linkedLinearIssueWorkspaceId ?? null) &&
-      (worktree.linkedLinearIssueOrganizationUrlKey ?? null) ===
-        (candidate.linkedLinearIssueOrganizationUrlKey ?? null) &&
-      worktree.linkedGitLabMR === candidate.linkedGitLabMR &&
-      worktree.linkedGitLabIssue === candidate.linkedGitLabIssue &&
-      worktree.linkedBitbucketPR === candidate.linkedBitbucketPR &&
-      worktree.linkedAzureDevOpsPR === candidate.linkedAzureDevOpsPR &&
-      worktree.linkedGiteaPR === candidate.linkedGiteaPR &&
-      areWorkspaceLinkedItemsEqual(worktree.linkedWorkItem, candidate.linkedWorkItem) &&
-      areTaskSourceContextsEqual(
-        worktree.linkedTaskSourceContext,
-        candidate.linkedTaskSourceContext
-      ) &&
-      worktree.isArchived === candidate.isArchived &&
-      worktree.isUnread === candidate.isUnread &&
-      worktree.isPinned === candidate.isPinned &&
-      worktree.sortOrder === candidate.sortOrder &&
-      worktree.manualOrder === candidate.manualOrder &&
-      worktree.lastActivityAt === candidate.lastActivityAt &&
-      worktree.workspaceStatus === candidate.workspaceStatus &&
-      worktree.createdWithAgent === candidate.createdWithAgent &&
-      worktree.pendingFirstAgentMessageRename === candidate.pendingFirstAgentMessageRename &&
-      worktree.firstAgentMessageRenameError === candidate.firstAgentMessageRenameError &&
-      worktree.baseRef === candidate.baseRef &&
-      worktree.pushTarget?.remoteName === candidate.pushTarget?.remoteName &&
-      worktree.pushTarget?.branchName === candidate.pushTarget?.branchName &&
-      worktree.pushTarget?.remoteUrl === candidate.pushTarget?.remoteUrl &&
-      worktree.sparseBaseRef === candidate.sparseBaseRef &&
-      arraysShallowEqual(worktree.sparseDirectories, candidate.sparseDirectories) &&
-      arraysShallowEqual(worktree.priorWorktreeIds, candidate.priorWorktreeIds) &&
-      (worktree as WorktreeWithLineage).parentWorktreeId ===
-        (candidate as WorktreeWithLineage).parentWorktreeId &&
-      arraysShallowEqual(
-        (worktree as WorktreeWithLineage).childWorktreeIds,
-        (candidate as WorktreeWithLineage).childWorktreeIds
-      ) &&
-      areLineageRecordsEqual(
-        (worktree as WorktreeWithLineage).lineage,
-        (candidate as WorktreeWithLineage).lineage
-      )
-    )
-  })
+  return catalogRowsEqual(current, next)
 }
 
 function areDetectedWorktreeResultsEqual(
@@ -424,15 +333,7 @@ function areDetectedWorktreeResultsEqual(
     current.repoId === next.repoId &&
     current.authoritative === next.authoritative &&
     current.source === next.source &&
-    areWorktreesEqual(current.worktrees, next.worktrees) &&
-    current.worktrees.every((worktree, index) => {
-      const candidate = next.worktrees[index]
-      return (
-        worktree.ownership === candidate.ownership &&
-        worktree.selectedCheckout === candidate.selectedCheckout &&
-        worktree.visible === candidate.visible
-      )
-    })
+    catalogRowsEqual(current.worktrees, next.worktrees)
   )
 }
 
@@ -649,7 +550,7 @@ function worktreeMatchesHost(
 }
 
 function mergeWorktreesForHost<
-  T extends { hostId?: ExecutionHostId; runtimeOwnerEnvironmentId?: string }
+  T extends { id: string; hostId?: ExecutionHostId; runtimeOwnerEnvironmentId?: string }
 >(
   current: readonly T[] | undefined,
   refreshed: readonly T[],
@@ -658,13 +559,17 @@ function mergeWorktreesForHost<
 ): T[] {
   // Why: host-scoped refreshes replace that host in place so alternating local/runtime refreshes don't churn sibling row order or sortEpoch.
   const existing = current ?? []
+  const reconciled = reuseEqualCatalogRows(
+    existing.filter((worktree) => worktreeMatchesHost(worktree, hostId, options)),
+    refreshed
+  )
   const next: T[] = []
   let inserted = false
 
   for (const worktree of existing) {
     if (worktreeMatchesHost(worktree, hostId, options)) {
       if (!inserted) {
-        next.push(...refreshed)
+        next.push(...reconciled)
         inserted = true
       }
       continue
@@ -672,7 +577,12 @@ function mergeWorktreesForHost<
     next.push(worktree)
   }
 
-  return inserted ? next : [...next, ...refreshed]
+  if (!inserted) {
+    next.push(...reconciled)
+  }
+  return existing.length === next.length && existing.every((row, index) => row === next[index])
+    ? (existing as T[])
+    : next
 }
 
 function mergeDetectedWorktreesForHost(
@@ -686,9 +596,19 @@ function mergeDetectedWorktreesForHost(
     refreshed.worktrees,
     current?.worktrees
   ).map((worktree) => withRepoHostOwnership(worktree, hostId, setup))
+  const worktrees = mergeWorktreesForHost(current?.worktrees, refreshedForHost, hostId, options)
+  if (
+    current &&
+    current.repoId === refreshed.repoId &&
+    current.authoritative === refreshed.authoritative &&
+    current.source === refreshed.source &&
+    current.worktrees === worktrees
+  ) {
+    return current
+  }
   return {
     ...refreshed,
-    worktrees: mergeWorktreesForHost(current?.worktrees, refreshedForHost, hostId, options)
+    worktrees
   }
 }
 
@@ -941,6 +861,7 @@ function getFolderWorkspaceMetaUpdates(
     | 'createdWithAgent'
     | 'pendingFirstAgentMessageRename'
     | 'firstAgentMessageRenameError'
+    | 'diffComments'
   >
 > {
   const next: Partial<
@@ -958,6 +879,7 @@ function getFolderWorkspaceMetaUpdates(
       | 'createdWithAgent'
       | 'pendingFirstAgentMessageRename'
       | 'firstAgentMessageRenameError'
+      | 'diffComments'
     >
   > = {}
   if (updates.displayName !== undefined) {
@@ -999,6 +921,9 @@ function getFolderWorkspaceMetaUpdates(
   if (updates.firstAgentMessageRenameError !== undefined) {
     next.firstAgentMessageRenameError = updates.firstAgentMessageRenameError
   }
+  if (updates.diffComments !== undefined) {
+    next.diffComments = updates.diffComments
+  }
   return next
 }
 
@@ -1474,8 +1399,7 @@ async function listWorktreeLineageForRuntime(
     workspaceLineage?: Record<string, WorkspaceLineage>
   }
   const normalizeLineageResponse = (value: Record<string, WorktreeLineage> | LineageListResponse) =>
-    Object.prototype.hasOwnProperty.call(value, 'lineage') ||
-    Object.prototype.hasOwnProperty.call(value, 'workspaceLineage')
+    Object.hasOwn(value, 'lineage') || Object.hasOwn(value, 'workspaceLineage')
       ? {
           worktreeLineageById: (value as LineageListResponse).lineage ?? {},
           workspaceLineageByChildKey: (value as LineageListResponse).workspaceLineage ?? {}
@@ -2224,15 +2148,11 @@ function getHostedReviewLinkForMetaRefresh(
   existingWorktree: Worktree | undefined,
   key: HostedReviewLinkKey
 ): number | null {
-  return Object.prototype.hasOwnProperty.call(updates, key)
-    ? (updates[key] ?? null)
-    : (existingWorktree?.[key] ?? null)
+  return Object.hasOwn(updates, key) ? (updates[key] ?? null) : (existingWorktree?.[key] ?? null)
 }
 
 function hasExplicitPushTargetClear(updates: Partial<WorktreeMeta>): boolean {
-  return (
-    Object.prototype.hasOwnProperty.call(updates, 'pushTarget') && updates.pushTarget === undefined
-  )
+  return Object.hasOwn(updates, 'pushTarget') && updates.pushTarget === undefined
 }
 
 type RuntimeWorktreeMetaUpdates = Omit<Partial<WorktreeMeta>, 'pushTarget'> & {
@@ -3528,7 +3448,8 @@ export const createWorktreeSlice: StateCreator<AppState, [], [], WorktreeSlice>
           : false
       }
       // Direct SSH lineage requires its own qualified authority result.
-      if (!directSshAuthority) {
+      // Bulk runtime callers apply one final host-wide snapshot after all repo merges.
+      if (!directSshAuthority && !options?.suppressRemoteLineageRefresh) {
         await refreshRemoteWorktreeLineageBestEffort(settings, set)
       }
       return directCallerAuthority ? refresh.providerResult! : refresh.result.authoritative
@@ -4335,6 +4256,7 @@ export const createWorktreeSlice: StateCreator<AppState, [], [], WorktreeSlice>
                 'worktree.rm',
                 {
                   worktree: toRuntimeWorktreeSelector(worktreeId),
+                  ...(hostId ? { hostId } : {}),
                   force,
                   allowUnverifiedPtyStop: options?.allowUnverifiedPtyStop === true,
                   runHooks: !skipArchive
@@ -4682,13 +4604,46 @@ export const createWorktreeSlice: StateCreator<AppState, [], [], WorktreeSlice>
       // Why: Source Control may be unmounted during deletion, so it can't be the only stale-draft cleanup path.
       clearSessionCommitDraftForWorktree(worktreeId)
       const preservedBranch = removalResult?.preservedBranch
+      const cleanup = preservedBranch
+        ? {
+            worktreeId,
+            branchName: preservedBranch.branchName,
+            expectedHead: preservedBranch.head,
+            ...(hostId ? { hostId } : {}),
+            ...(removalRoute?.runtimeEnvironmentId
+              ? { runtimeEnvironmentId: removalRoute.runtimeEnvironmentId }
+              : {})
+          }
+        : null
+      if (preservedBranch) {
+        preservedBranchRuntimeTargetByCleanupKey.set(preservedBranchCleanupKey(cleanup!), {
+          cleanup: cleanup!,
+          target
+        })
+      }
       if (preservedBranch && options?.suppressPreservedBranchToast !== true) {
         showPreservedBranchToast(removalResult, worktreeBeforeRemoval, (branch, expectedHead) => {
-          void get().forceDeletePreservedBranch(worktreeId, branch, expectedHead)
+          void get().forceDeletePreservedBranch(worktreeId, branch, expectedHead, {
+            ...(hostId ? { hostId } : {}),
+            ...(removalRoute?.runtimeEnvironmentId
+              ? { runtimeEnvironmentId: removalRoute.runtimeEnvironmentId }
+              : {})
+          })
         })
       }
       pruneHostedReviewLinkMutationGenerations([worktreeId])
-      return preservedBranch ? { ok: true as const, preservedBranch } : { ok: true as const }
+      return preservedBranch && cleanup
+        ? {
+            ok: true as const,
+            preservedBranch: {
+              ...preservedBranch,
+              ...(cleanup.hostId ? { hostId: cleanup.hostId } : {}),
+              ...(cleanup.runtimeEnvironmentId
+                ? { runtimeEnvironmentId: cleanup.runtimeEnvironmentId }
+                : {})
+            }
+          }
+        : { ok: true as const }
     } catch (err) {
       // Why: git refusing a non-force delete for dirty/untracked files is a handled user decision, not an app error.
       console.warn('Failed to remove worktree:', err)
@@ -4765,32 +4720,81 @@ export const createWorktreeSlice: StateCreator<AppState, [], [], WorktreeSlice>
     })
   },
 
-  forceDeletePreservedBranch: async (worktreeId, branchName, expectedHead) => {
+  forceDeletePreservedBranch: async (worktreeId, branchName, expectedHead, options) => {
     try {
-      const target = getActiveRuntimeTarget(settingsForWorktreeOwner(get(), worktreeId))
+      const requestedCleanup: PreservedBranchCleanup = {
+        worktreeId,
+        branchName,
+        expectedHead,
+        ...(options?.hostId ? { hostId: options.hostId } : {}),
+        ...(options?.runtimeEnvironmentId
+          ? { runtimeEnvironmentId: options.runtimeEnvironmentId }
+          : {})
+      }
+      const requestedCleanupKey = preservedBranchCleanupKey(requestedCleanup)
+      const exactRetainedTarget = preservedBranchRuntimeTargetByCleanupKey.get(requestedCleanupKey)
+      const matchingRetainedTargets = exactRetainedTarget
+        ? [exactRetainedTarget]
+        : [...preservedBranchRuntimeTargetByCleanupKey.values()].filter(
+            ({ cleanup }) =>
+              cleanup.worktreeId === worktreeId &&
+              cleanup.branchName === branchName &&
+              cleanup.expectedHead === expectedHead
+          )
+      const retainedTarget =
+        exactRetainedTarget ??
+        (options?.hostId || options?.runtimeEnvironmentId || matchingRetainedTargets.length !== 1
+          ? undefined
+          : matchingRetainedTargets[0])
+      if ((options?.hostId || options?.runtimeEnvironmentId) && !retainedTarget) {
+        throw new Error(`No preserved branch cleanup is pending for "${branchName}".`)
+      }
+      const cleanupHostId = options?.hostId ?? retainedTarget?.cleanup.hostId
+      // Why: the removed row no longer records its nested HUB owner, so retain the deletion-time route.
+      const target =
+        retainedTarget?.target ??
+        getActiveRuntimeTarget(settingsForWorktreeOwner(get(), worktreeId))
       const result = await (target.kind === 'local'
         ? window.api.worktrees.forceDeletePreservedBranch({
             worktreeId,
             branchName,
-            expectedHead
+            expectedHead,
+            ...(cleanupHostId ? { hostId: cleanupHostId } : {})
           })
         : callRuntimeRpc<ForceDeleteWorktreeBranchResult>(
             target,
             'worktree.forceDeleteBranch',
-            { worktree: toRuntimeWorktreeSelector(worktreeId), branchName, expectedHead },
+            {
+              worktree: toRuntimeWorktreeSelector(worktreeId),
+              branchName,
+              expectedHead,
+              ...(cleanupHostId ? { hostId: cleanupHostId } : {})
+            },
             { timeoutMs: 15_000 }
           ))
-      toast.success(translate('auto.store.slices.worktrees.19db0085fb', 'Local branch deleted'), {
-        description: translate('auto.store.slices.worktrees.5a58e03a26', 'Deleted "{{value0}}".', {
-          value0: branchName
+      if (options?.suppressToast !== true) {
+        toast.success(translate('auto.store.slices.worktrees.19db0085fb', 'Local branch deleted'), {
+          description: translate(
+            'auto.store.slices.worktrees.5a58e03a26',
+            'Deleted "{{value0}}".',
+            { value0: branchName }
+          )
         })
-      })
+      }
+      preservedBranchRuntimeTargetByCleanupKey.delete(
+        retainedTarget ? preservedBranchCleanupKey(retainedTarget.cleanup) : requestedCleanupKey
+      )
       return { ok: true as const, ...result }
     } catch (err) {
       const error = err instanceof Error ? err.message : String(err)
-      toast.error(translate('auto.store.slices.worktrees.0216895fb5', 'Failed to delete branch'), {
-        description: error
-      })
+      if (options?.suppressToast !== true) {
+        toast.error(
+          translate('auto.store.slices.worktrees.0216895fb5', 'Failed to delete branch'),
+          {
+            description: error
+          }
+        )
+      }
       return { ok: false as const, error }
     }
   },
@@ -5553,7 +5557,7 @@ export const createWorktreeSlice: StateCreator<AppState, [], [], WorktreeSlice>
     set((s) => {
       for (const [worktreeId, tabs] of Object.entries(s.tabsByWorktree)) {
         const index = tabs.findIndex((tab) => tab.id === tabId)
-        if (index < 0) {
+        if (index === -1) {
           continue
         }
         const tab = tabs[index]
@@ -6063,7 +6067,7 @@ export const createWorktreeSlice: StateCreator<AppState, [], [], WorktreeSlice>
       const repoIdsWithRemovedOwners = new Set<string>()
       const survivingRepoIds = new Set<string>()
       const repoIdsWithSurvivingOwners = new Set<string>()
-      const survivingRepos: AppState['repos'] = []
+      const survivingRepos: Repo[] = []
       for (const repo of s.repos) {
         if (isRemovedRuntimeHostId(getRepoExecutionHostId(repo), removed)) {
           repoIdsWithRemovedOwners.add(repo.id)
diff --git a/src/renderer/src/store/types.ts b/src/renderer/src/store/types.ts
index f42325c0b21..bed37f06851 100644
--- a/src/renderer/src/store/types.ts
+++ b/src/renderer/src/store/types.ts
@@ -15,9 +15,11 @@ import type { EditorSlice } from './slices/editor'
 import type { StatsSlice } from './slices/stats'
 import type { MemorySlice } from './slices/memory'
 import type { WorkspaceSpaceSlice } from './slices/workspace-space'
-import type { ClaudeUsageSlice } from './slices/claude-usage'
-import type { CodexUsageSlice } from './slices/codex-usage'
-import type { OpenCodeUsageSlice } from './slices/opencode-usage'
+import type {
+  ClaudeUsageSlice,
+  CodexUsageSlice,
+  OpenCodeUsageSlice
+} from './slices/usage-provider-slices'
 import type { BrowserSlice } from './slices/browser'
 import type { RateLimitSlice } from './slices/rate-limits'
 import type { SshSlice } from './slices/ssh'
diff --git a/src/renderer/src/store/worktree-diff-comments-selector.test.ts b/src/renderer/src/store/worktree-diff-comments-selector.test.ts
index 0f6ceb5d99e..db45edec6b3 100644
--- a/src/renderer/src/store/worktree-diff-comments-selector.test.ts
+++ b/src/renderer/src/store/worktree-diff-comments-selector.test.ts
@@ -1,11 +1,12 @@
 import { describe, expect, it } from 'vitest'
-import type { DiffComment, Worktree } from '../../../shared/types'
+import type { DiffComment, FolderWorkspace, Worktree } from '../../../shared/types'
 import type { AppState } from './types'
 import {
   selectWorktreeDiffComments,
   selectWorktreeDiffCommentsOrEmpty
 } from './worktree-diff-comments-selector'
 import { getIndexedWorktreeById } from './worktree-repo-index'
+import { folderWorkspaceKey } from '../../../shared/workspace-scope'
 
 function makeComment(id: string): DiffComment {
   return {
@@ -84,4 +85,25 @@ describe('selectWorktreeDiffComments', () => {
       selectWorktreeDiffCommentsOrEmpty({ worktreesByRepo: next }, undefined)
     )
   })
+
+  it('reads review notes from a folder workspace', () => {
+    const comments = [makeComment('folder-comment')]
+    const folderWorkspace = {
+      id: 'folder-1',
+      executionHostId: 'local',
+      diffComments: comments
+    } as FolderWorkspace
+
+    expect(
+      selectWorktreeDiffComments(
+        {
+          worktreesByRepo: {},
+          activeWorktreeId: folderWorkspaceKey(folderWorkspace.id),
+          activeWorkspaceExecutionHostId: 'local',
+          folderWorkspaces: [folderWorkspace]
+        },
+        folderWorkspaceKey(folderWorkspace.id)
+      )
+    ).toBe(comments)
+  })
 })
diff --git a/src/renderer/src/store/worktree-diff-comments-selector.ts b/src/renderer/src/store/worktree-diff-comments-selector.ts
index c91ef64bc06..31e6edfa9ee 100644
--- a/src/renderer/src/store/worktree-diff-comments-selector.ts
+++ b/src/renderer/src/store/worktree-diff-comments-selector.ts
@@ -1,23 +1,43 @@
 import type { DiffComment } from '../../../shared/types'
 import type { AppState } from './types'
 import { getIndexedWorktreeById } from './worktree-repo-index'
+import { findFolderWorkspaceOwner } from '@/lib/folder-workspace-runtime-owner'
+import { parseWorkspaceKey } from '../../../shared/workspace-scope'
 
 const EMPTY_DIFF_COMMENTS = Object.freeze([]) as unknown as DiffComment[]
 
+type DiffCommentSelectorState = Pick<AppState, 'worktreesByRepo'> &
+  Partial<
+    Pick<
+      AppState,
+      | 'activeWorkspaceExecutionHostId'
+      | 'activeWorktreeId'
+      | 'folderWorkspaces'
+      | 'projectGroups'
+      | 'restoredRuntimeHostIdByWorkspaceSessionKey'
+      | 'runtimeEnvironments'
+      | 'settings'
+    >
+  >
+
 export function selectWorktreeDiffComments(
-  state: Pick<AppState, 'worktreesByRepo'>,
+  state: DiffCommentSelectorState,
   worktreeId: string | null | undefined
 ): DiffComment[] | undefined {
   if (!worktreeId) {
     return undefined
   }
+  const scope = parseWorkspaceKey(worktreeId)
+  if (scope?.type === 'folder') {
+    return findFolderWorkspaceOwner(state, scope.folderWorkspaceId)?.diffComments
+  }
   // Why: mounted Monaco and diff surfaces rerun this selector on every store
   // write, so share the immutable-snapshot index instead of rescanning all worktrees.
   return getIndexedWorktreeById(state.worktreesByRepo, worktreeId)?.diffComments
 }
 
 export function selectWorktreeDiffCommentsOrEmpty(
-  state: Pick<AppState, 'worktreesByRepo'>,
+  state: Parameters<typeof selectWorktreeDiffComments>[0],
   worktreeId: string | null | undefined
 ): DiffComment[] {
   return selectWorktreeDiffComments(state, worktreeId) ?? EMPTY_DIFF_COMMENTS
diff --git a/src/renderer/src/web/web-clipboard-copy-fallback.test.ts b/src/renderer/src/web/web-clipboard-copy-fallback.test.ts
index e6242c11ae4..28e9f1dc4dd 100644
--- a/src/renderer/src/web/web-clipboard-copy-fallback.test.ts
+++ b/src/renderer/src/web/web-clipboard-copy-fallback.test.ts
@@ -44,7 +44,7 @@ function createFakeDocument(options?: FakeDocOptions) {
     removeEventListener: vi.fn((type: string, listener: (event: unknown) => void) => {
       if (type === 'copy') {
         const index = listeners.indexOf(listener)
-        if (index >= 0) {
+        if (index !== -1) {
           listeners.splice(index, 1)
         }
       }
diff --git a/src/renderer/src/web/web-pairing.test.ts b/src/renderer/src/web/web-pairing.test.ts
index 6840527d227..42721c3c821 100644
--- a/src/renderer/src/web/web-pairing.test.ts
+++ b/src/renderer/src/web/web-pairing.test.ts
@@ -32,6 +32,15 @@ describe('web pairing input', () => {
     })
   })
 
+  it('preserves optional paired device identity', () => {
+    expect(
+      parseWebPairingInput(`orca://pair?code=${encodeOffer({ pairedDeviceId: 'paired-device-a' })}`)
+    ).toEqual({
+      ...offer,
+      pairedDeviceId: 'paired-device-a'
+    })
+  })
+
   it.each([
     ['wss://proxy.example:443/orca/runtime', 'wss://proxy.example:443/orca/runtime'],
     ['https://proxy.example/orca/runtime', 'wss://proxy.example/orca/runtime'],
diff --git a/src/renderer/src/web/web-pairing.ts b/src/renderer/src/web/web-pairing.ts
index f29465cc803..fc58bf9ea08 100644
--- a/src/renderer/src/web/web-pairing.ts
+++ b/src/renderer/src/web/web-pairing.ts
@@ -7,6 +7,7 @@ export type WebPairingOffer = {
   endpoint: string
   deviceToken: string
   publicKeyB64: string
+  pairedDeviceId?: string
   scope?: DeviceScope
 }
 
@@ -99,11 +100,16 @@ function decodePairingPayload(base64url: string): WebPairingOffer | null {
     return null
   }
   const scope = parseWebPairingScope(parsed.scope)
+  const pairedDeviceId =
+    typeof parsed.pairedDeviceId === 'string' && parsed.pairedDeviceId.length > 0
+      ? parsed.pairedDeviceId
+      : null
   return {
     v: PAIRING_OFFER_VERSION,
     endpoint: normalizeWebSocketEndpoint(parsed.endpoint),
     deviceToken: parsed.deviceToken,
     publicKeyB64: parsed.publicKeyB64,
+    ...(pairedDeviceId ? { pairedDeviceId } : {}),
     ...(scope ? { scope } : {})
   }
 }
diff --git a/src/renderer/src/web/web-preload-api.test.ts b/src/renderer/src/web/web-preload-api.test.ts
index cc508040e49..9fcec640925 100644
--- a/src/renderer/src/web/web-preload-api.test.ts
+++ b/src/renderer/src/web/web-preload-api.test.ts
@@ -281,6 +281,22 @@ describe('web runtime environment identity', () => {
     await expect(globals.window.api.runtimeEnvironments.list()).resolves.toEqual([])
   })
 
+  it('stores paired device identity from a web access link', async () => {
+    const globals = installBrowserGlobals('Linux')
+    const { installWebPreloadApi } = await import('./web-preload-api')
+    installWebPreloadApi()
+
+    const paired = await globals.window.api.runtimeEnvironments.addFromPairingCode({
+      name: 'Shared server',
+      pairingCode: encodePairingCode({ pairedDeviceId: 'paired-device-a' })
+    })
+
+    expect(paired.environment.pairedDeviceId).toBe('paired-device-a')
+    expect(
+      JSON.parse(globals.storage.getItem('orca.web.runtimeEnvironment.v1') ?? '{}')
+    ).toMatchObject({ pairedDeviceId: 'paired-device-a' })
+  })
+
   it('persists an explicit Active Server choice across unrelated web settings writes', async () => {
     const globals = installBrowserGlobals('Linux')
     const { installWebPreloadApi } = await import('./web-preload-api')
@@ -363,6 +379,21 @@ describe('web runtime environment identity', () => {
     ).rejects.toThrow('Unknown Orca runtime environment: web-server-old')
   })
 
+  it('ignores malformed persisted paired device identity', async () => {
+    const globals = installBrowserGlobals('Linux')
+    writeStoredRuntimeEnvironment(globals.storage)
+    const stored = JSON.parse(
+      globals.storage.getItem('orca.web.runtimeEnvironment.v1') ?? '{}'
+    ) as Record<string, unknown>
+    stored.pairedDeviceId = { invalid: true }
+    globals.storage.setItem('orca.web.runtimeEnvironment.v1', JSON.stringify(stored))
+    const { installWebPreloadApi } = await import('./web-preload-api')
+    installWebPreloadApi()
+
+    const [environment] = await globals.window.api.runtimeEnvironments.list()
+    expect(environment).not.toHaveProperty('pairedDeviceId')
+  })
+
   it('keeps pairing while manual disconnect fences passive reconnects', async () => {
     const calls: string[] = []
     const close = vi.fn()
@@ -378,7 +409,7 @@ describe('web runtime environment identity', () => {
           return Promise.resolve({
             id: method,
             ok: true,
-            result: { runtimeId: 'runtime-1' },
+            result: { runtimeId: 'runtime-1', pairedDeviceId: 'paired-device-a' },
             _meta: { runtimeId: 'runtime-1' }
           })
         }
@@ -431,6 +462,9 @@ describe('web runtime environment identity', () => {
     ).resolves.toMatchObject({ ok: true })
     expect(clientCount).toBe(2)
     expect(calls).toEqual(['status.get', 'status.get'])
+    expect(
+      JSON.parse(globals.storage.getItem('orca.web.runtimeEnvironment.v1') ?? '{}')
+    ).toMatchObject({ pairedDeviceId: 'paired-device-a' })
   })
 
   it('fences a web runtime response that completes after manual disconnect', async () => {
@@ -901,6 +935,26 @@ describe('web settings preload API', () => {
     expect(settings.terminalCursorStyleDefaultedToBlock).toBe(true)
   })
 
+  it('normalizes terminal cursor style before web settings writes return or persist', async () => {
+    const { api, storage } = await installApi('Linux')
+
+    const invalid = await api.settings.set({ terminalCursorStyle: 'beam' as never })
+    const invalidStored = JSON.parse(storage.getItem('orca.web.settings.v1') ?? '{}') as {
+      terminalCursorStyle?: string
+      terminalCursorStyleDefaultedToBlock?: boolean
+    }
+    expect(invalid.terminalCursorStyle).toBe('block')
+    expect(invalid.terminalCursorStyleDefaultedToBlock).toBe(true)
+    expect(invalidStored.terminalCursorStyle).toBe('block')
+    expect(invalidStored.terminalCursorStyleDefaultedToBlock).toBe(true)
+
+    const valid = await api.settings.set({ terminalCursorStyle: 'bar' })
+    expect(valid.terminalCursorStyle).toBe('bar')
+    expect(JSON.parse(storage.getItem('orca.web.settings.v1') ?? '{}').terminalCursorStyle).toBe(
+      'bar'
+    )
+  })
+
   it('migrates OSC 52 clipboard writes on for stored web settings once', async () => {
     // Why: the web store is a second, independent settings store — the constants-level
     // default flip only reaches profiles that never persisted the old `false` (#10567).
@@ -2360,6 +2414,49 @@ describe('web UI preload API', () => {
     })
   })
 
+  it('keeps the workspace origin filter browser-local across host UI responses', async () => {
+    const runtimeCalls: { method: string; params: unknown }[] = []
+    vi.doMock('./web-runtime-client', () => ({
+      WebRuntimeClient: class {
+        call(method: string, params?: unknown): Promise<RuntimeRpcResponse<unknown>> {
+          runtimeCalls.push({ method, params })
+          return Promise.resolve({
+            id: method,
+            ok: true,
+            result: {
+              ui: {
+                hideWorkspacesFromOtherDevices: false,
+                featureInteractions: {
+                  tasks: { firstInteractedAt: 100, interactionCount: 1 }
+                }
+              }
+            },
+            _meta: { runtimeId: 'runtime-1' }
+          })
+        }
+
+        close(): void {}
+      }
+    }))
+
+    const globals = installBrowserGlobals('Linux')
+    writeStoredRuntimeEnvironment(globals.storage)
+    const { installWebPreloadApi } = await import('./web-preload-api')
+    installWebPreloadApi()
+
+    await globals.window.api.ui.set({ hideWorkspacesFromOtherDevices: true })
+    expect(runtimeCalls[0]).toEqual({ method: 'ui.set', params: {} })
+    await expect(globals.window.api.ui.get()).resolves.toMatchObject({
+      hideWorkspacesFromOtherDevices: true
+    })
+    await expect(globals.window.api.ui.recordFeatureInteraction('tasks')).resolves.toMatchObject({
+      hideWorkspacesFromOtherDevices: true
+    })
+    expect(JSON.parse(globals.storage.getItem('orca.web.ui.v1') ?? '{}')).toMatchObject({
+      hideWorkspacesFromOtherDevices: true
+    })
+  })
+
   it('union-merges local contextual tour seen ids when ui.get returns stale host state', async () => {
     vi.doMock('./web-runtime-client', () => ({
       WebRuntimeClient: class {
diff --git a/src/renderer/src/web/web-preload-api.ts b/src/renderer/src/web/web-preload-api.ts
index 77f9a40dfdb..2baa23a7b28 100644
--- a/src/renderer/src/web/web-preload-api.ts
+++ b/src/renderer/src/web/web-preload-api.ts
@@ -603,6 +603,8 @@ function createWebPreloadApi(): Partial<PreloadApi> {
       get: () => ({
         platform: getBrowserPlatform(),
         osRelease: '',
+        arch: '',
+        shell: '',
         displayServer: null
       })
     },
@@ -705,6 +707,15 @@ function createWebPreloadApi(): Partial<PreloadApi> {
         if ('autoRenameBranchFromWorkDefaultedOn' in sanitizedUpdates) {
           sanitizedUpdates.autoRenameBranchFromWorkDefaultedOn = true
         }
+        if ('terminalCursorStyle' in sanitizedUpdates) {
+          Object.assign(
+            sanitizedUpdates,
+            normalizeTerminalCursorStyleDefault(
+              { terminalCursorStyle: sanitizedUpdates.terminalCursorStyle },
+              { preserveExplicitValue: true }
+            )
+          )
+        }
         const next = mergeSettings(getStoredSettings(), sanitizedUpdates, {
           preserveAutoRenameBranchFromWorkUpdate: 'autoRenameBranchFromWork' in sanitizedUpdates
         })
@@ -1070,7 +1081,7 @@ function removeConflictingWebOverrides(
     const conflictingOverrides = new Set<KeybindingActionId>()
     for (const conflict of conflicts) {
       for (const actionId of conflict.actionIds) {
-        if (Object.prototype.hasOwnProperty.call(next, actionId)) {
+        if (Object.hasOwn(next, actionId)) {
           conflictingOverrides.add(actionId)
         }
       }
@@ -1483,12 +1494,15 @@ function createRuntimeEnvironmentsApi(): NonNullable<Partial<PreloadApi>['runtim
         client?.close()
       }
       const usesSshTunnel = parsed.value.endpointKind === 'loopback' && allowLoopback === true
-      const nextEnvironment = createStoredWebRuntimeEnvironment({
-        name,
-        offer: parsed.value.pairing,
-        previousEnvironment: activeEnvironment,
-        ...(usesSshTunnel ? { connectionDependency: 'ssh-tunnel' as const } : {})
-      })
+      const nextEnvironment = {
+        ...createStoredWebRuntimeEnvironment({
+          name,
+          offer: parsed.value.pairing,
+          previousEnvironment: activeEnvironment,
+          ...(usesSshTunnel ? { connectionDependency: 'ssh-tunnel' as const } : {})
+        }),
+        ...(runtimeStatus.pairedDeviceId ? { pairedDeviceId: runtimeStatus.pairedDeviceId } : {})
+      }
       // Why: a browser storage failure must leave the currently active host usable.
       try {
         saveStoredWebRuntimeEnvironment(nextEnvironment)
@@ -1831,10 +1845,11 @@ function createWorktreesApi(): NonNullable<Partial<PreloadApi>['worktrees']> {
         targetBranch,
         isCrossRepository
       }),
-    remove: async ({ worktreeId, force, allowUnverifiedPtyStop, skipArchive }) => {
+    remove: async ({ worktreeId, hostId, force, allowUnverifiedPtyStop, skipArchive }) => {
       invalidateRuntimeWorktreeCaches()
       return callRuntimeResult<RemoveWorktreeResult>('worktree.rm', {
         worktree: toRuntimeWorktreeSelector(worktreeId),
+        ...(hostId ? { hostId } : {}),
         force,
         // Why (#11960): the web client renders the same Force Delete affordances, so
         // dropping this field here would leave paired clients permanently wedged.
@@ -1846,16 +1861,16 @@ function createWorktreesApi(): NonNullable<Partial<PreloadApi>['worktrees']> {
     forgetLocal: () => {
       throw new Error('Forgetting a workspace is unavailable in paired web clients.')
     },
-    forceDeletePreservedBranch: ({ worktreeId, branchName, expectedHead }) =>
+    forceDeletePreservedBranch: ({ worktreeId, branchName, expectedHead, hostId }) =>
       callRuntimeResult<ForceDeleteWorktreeBranchResult>('worktree.forceDeleteBranch', {
         worktree: toRuntimeWorktreeSelector(worktreeId),
         branchName,
-        expectedHead
+        expectedHead,
+        ...(hostId ? { hostId } : {})
       }),
     updateMeta: async ({ worktreeId, updates }) => {
       const rpcUpdates =
-        Object.prototype.hasOwnProperty.call(updates, 'pushTarget') &&
-        updates.pushTarget === undefined
+        Object.hasOwn(updates, 'pushTarget') && updates.pushTarget === undefined
           ? { ...updates, pushTarget: null }
           : updates
       const owned = await callRuntimeResultWithOwner<{ worktree: Worktree }>('worktree.set', {
@@ -2642,7 +2657,7 @@ function createWebUiApi(): NonNullable<Partial<PreloadApi>['ui']> {
         )
         const local = readLocalWebUIState()
         const next = {
-          ...mergeWebUIState(local, result.ui),
+          ...mergeHostWebUIState(local, result.ui),
           osc52ClipboardDefaultOnNoticePending: mergeOsc52ClipboardNoticePending(local, result.ui),
           featureInteractions: mergeFeatureInteractionState(
             local.featureInteractions,
@@ -2664,8 +2679,11 @@ function createWebUiApi(): NonNullable<Partial<PreloadApi>['ui']> {
       const next = mergeWebUIState(readLocalWebUIState(), updates)
       writeJson(UI_STORAGE_KEY, next)
       zoomLevel = next.uiZoomLevel
+      const { hideWorkspacesFromOtherDevices: _clientLocalWorkspaceFilter, ...hostUpdates } =
+        updates
+      void _clientLocalWorkspaceFilter
       try {
-        await callRuntimeResult('ui.set', updates, 15_000)
+        await callRuntimeResult('ui.set', hostUpdates, 15_000)
       } catch {
         // Why: unpaired/offline web clients still need local UI persistence.
       }
@@ -2692,7 +2710,7 @@ function createWebUiApi(): NonNullable<Partial<PreloadApi>['ui']> {
         )
         const local = readLocalWebUIState()
         const next = {
-          ...mergeWebUIState(local, result.ui),
+          ...mergeHostWebUIState(local, result.ui),
           osc52ClipboardDefaultOnNoticePending: mergeOsc52ClipboardNoticePending(local, result.ui),
           featureInteractions: mergeFeatureInteractionState(
             local.featureInteractions,
@@ -3692,7 +3710,14 @@ function updateEnvironmentFromResponse(
     return
   }
   const runtimeId = response.ok ? response._meta.runtimeId : (response._meta?.runtimeId ?? null)
-  activeEnvironment = updateStoredEnvironmentRuntimeId(environment, runtimeId)
+  const pairedDeviceId =
+    response.ok &&
+    typeof response.result === 'object' &&
+    response.result !== null &&
+    typeof (response.result as { pairedDeviceId?: unknown }).pairedDeviceId === 'string'
+      ? (response.result as { pairedDeviceId: string }).pairedDeviceId
+      : undefined
+  activeEnvironment = updateStoredEnvironmentRuntimeId(environment, runtimeId, pairedDeviceId)
 }
 
 function getStoredSettings(): GlobalSettings {
@@ -4002,6 +4027,16 @@ function mergeWebUIState(
   }
 }
 
+function mergeHostWebUIState(
+  local: PersistedUIState,
+  incoming: PersistedUIState
+): PersistedUIState {
+  return {
+    ...mergeWebUIState(local, incoming),
+    hideWorkspacesFromOtherDevices: local.hideWorkspacesFromOtherDevices === true
+  }
+}
+
 function mergeFeatureInteractionState(
   current: PersistedUIState['featureInteractions'],
   incoming: PersistedUIState['featureInteractions']
diff --git a/src/renderer/src/web/web-runtime-environment.ts b/src/renderer/src/web/web-runtime-environment.ts
index 4f97c416960..6093a88aed3 100644
--- a/src/renderer/src/web/web-runtime-environment.ts
+++ b/src/renderer/src/web/web-runtime-environment.ts
@@ -37,9 +37,18 @@ export function readStoredWebRuntimeEnvironment(): StoredWebRuntimeEnvironment |
           (environmentId): environmentId is string => typeof environmentId === 'string'
         )
       : []
-    const { compatibleEnvironmentIds: _unvalidatedIds, ...environment } = parsed
+    const pairedDeviceId =
+      typeof parsed.pairedDeviceId === 'string' && parsed.pairedDeviceId.trim().length > 0
+        ? parsed.pairedDeviceId.trim()
+        : null
+    const {
+      compatibleEnvironmentIds: _unvalidatedIds,
+      pairedDeviceId: _unvalidatedDeviceId,
+      ...environment
+    } = parsed
     return {
       ...environment,
+      ...(pairedDeviceId ? { pairedDeviceId } : {}),
       ...(compatibleEnvironmentIds.length > 0 ? { compatibleEnvironmentIds } : {})
     }
   } catch {
@@ -71,6 +80,7 @@ export function createStoredWebRuntimeEnvironment(args: {
     updatedAt: now,
     lastUsedAt: null,
     runtimeId: null,
+    ...(args.offer.pairedDeviceId ? { pairedDeviceId: args.offer.pairedDeviceId } : {}),
     ...(args.connectionDependency ? { connectionDependency: args.connectionDependency } : {}),
     ...(compatibleEnvironmentIds.length > 0 ? { compatibleEnvironmentIds } : {}),
     preferredEndpointId: `ws-${id}`,
@@ -124,17 +134,20 @@ export function getPreferredWebPairingOffer(
     v: 2,
     endpoint: endpoint.endpoint,
     deviceToken: endpoint.deviceToken,
-    publicKeyB64: endpoint.publicKeyB64
+    publicKeyB64: endpoint.publicKeyB64,
+    ...(environment.pairedDeviceId ? { pairedDeviceId: environment.pairedDeviceId } : {})
   }
 }
 
 export function updateStoredEnvironmentRuntimeId(
   environment: StoredWebRuntimeEnvironment,
-  runtimeId: string | null
+  runtimeId: string | null,
+  pairedDeviceId?: string
 ): StoredWebRuntimeEnvironment {
   const next = {
     ...environment,
     runtimeId,
+    ...(pairedDeviceId ? { pairedDeviceId } : {}),
     updatedAt: Date.now(),
     lastUsedAt: Date.now()
   }
diff --git a/src/shared/agent-completion-time.ts b/src/shared/agent-completion-time.ts
new file mode 100644
index 00000000000..4b7ea78c430
--- /dev/null
+++ b/src/shared/agent-completion-time.ts
@@ -0,0 +1,43 @@
+import type { AgentStateHistoryEntry, AgentStatusEntry } from './agent-status-types'
+
+/** The subset of a hook entry a completion time is derived from. */
+export type AgentCompletionSource = Pick<
+  AgentStatusEntry,
+  'state' | 'stateStartedAt' | 'stateHistory' | 'interrupted' | 'sessionBoundary'
+>
+
+function mostRecentCompletedTurnInHistory(
+  history: readonly AgentStateHistoryEntry[] | undefined
+): number | null {
+  let max = 0
+  for (const row of history ?? []) {
+    if (
+      row.state === 'done' &&
+      row.interrupted !== true &&
+      Number.isFinite(row.startedAt) &&
+      row.startedAt > max
+    ) {
+      max = row.startedAt
+    }
+  }
+  return max > 0 ? max : null
+}
+
+/**
+ * When the entry's agent last actually COMPLETED a turn, or null when nothing qualifies.
+ * One clock for both the displayed completion age and Smart Sort's Done eligibility, so a row
+ * can't rank as freshly done while showing an age past the staleness threshold.
+ *
+ * A completion is only:
+ *   - a non-interrupted `done` (its `stateStartedAt` — unmoved by same-state tool/prompt pings); or
+ *   - for a session-boundary `done` (connected idle, not a turn), the real completion it displaced.
+ */
+export function agentEntryCompletionAt(entry: AgentCompletionSource): number | null {
+  if (entry.state !== 'done' || entry.interrupted === true) {
+    return null
+  }
+  if (entry.sessionBoundary === true) {
+    return mostRecentCompletedTurnInHistory(entry.stateHistory)
+  }
+  return Number.isFinite(entry.stateStartedAt) ? entry.stateStartedAt : null
+}
diff --git a/src/shared/agent-decorative-title-signature.ts b/src/shared/agent-decorative-title-signature.ts
index 29f1a65e6a2..317a744d098 100644
--- a/src/shared/agent-decorative-title-signature.ts
+++ b/src/shared/agent-decorative-title-signature.ts
@@ -27,7 +27,10 @@ function normalizeDecorativeAgentTitleText(title: string): string {
   let pendingWhitespace = false
   for (let index = 0; index < title.length; index += 1) {
     const code = title.charCodeAt(index)
-    if (normalized.length === 0 && (isDecorativeTitleWhitespace(code) || isBrailleSpinner(code))) {
+    if (
+      normalized.length === 0 &&
+      (isDecorativeTitleWhitespace(code) || isSpinnerFrameGlyph(code))
+    ) {
       continue
     }
     if (isDecorativeTitleWhitespace(code)) {
@@ -43,8 +46,9 @@ function normalizeDecorativeAgentTitleText(title: string): string {
   return normalized
 }
 
-function isBrailleSpinner(code: number): boolean {
-  return code >= 0x2800 && code <= 0x28ff
+// Why: braille (most agents) plus quarter circles (Claude Code 2.1.228+, #13889).
+function isSpinnerFrameGlyph(code: number): boolean {
+  return (code >= 0x2800 && code <= 0x28ff) || (code >= 0x25d0 && code <= 0x25d3)
 }
 
 function isDecorativeTitleWhitespace(code: number): boolean {
diff --git a/src/shared/agent-detection.test.ts b/src/shared/agent-detection.test.ts
index 53ab82f1fbc..14ee33eb7a8 100644
--- a/src/shared/agent-detection.test.ts
+++ b/src/shared/agent-detection.test.ts
@@ -101,6 +101,55 @@ describe('MiMo title detection', () => {
   )
 })
 
+describe('OpenCode native title detection', () => {
+  // Why: `OC | …` names no agent token, so title-derived display and target surfaces
+  // previously dropped OpenCode panes. Runtime sends corroborate the title separately.
+  it.each(['OC | Implement the Kitty IME preview', 'tmux | OC | Implement the Kitty IME preview'])(
+    'classifies the native session title %j as title-derived idle OpenCode',
+    (title) => {
+      expect(getAgentLabel(title)).toBe('OpenCode')
+      expect(detectAgentStatusFromTitle(title)).toBe('idle')
+    }
+  )
+
+  // Why: a spinner glyph is the one status decoration OpenCode adds to the marker, and
+  // its gate runs before the marker's, so an animating frame still reads working (#8940).
+  it('reads a spinner-decorated native frame as working', () => {
+    const title = 'OC | ⠋ ask claude about this'
+    expect(getAgentLabel(title)).toBe('OpenCode')
+    expect(detectAgentStatusFromTitle(title)).toBe('working')
+  })
+
+  it.each(['OC | ✦ Gemini CLI', 'OC | ✋ review Gemini permission handling'])(
+    'does not let a Gemini glyph in OpenCode session text override identity for %j',
+    (title) => {
+      expect(getAgentLabel(title)).toBe('OpenCode')
+      expect(detectAgentStatusFromTitle(title)).toBe('idle')
+    }
+  )
+
+  // Why: the text after the marker is OpenCode's generated session summary — subject
+  // matter, not status. Routing it through the keyword gates would let an ordinary task
+  // name ("stop the flaky test") park a live pane in working/permission forever, so the
+  // marker asserts presence only. Do not "fix" these into keyword-derived statuses.
+  it.each([
+    'OC | ready to review',
+    'OC | permission prompt keeps reappearing',
+    'OC | waiting on the flaky test',
+    'OC | stop the suite from running'
+  ])('keeps the status word inside the session summary %j inert', (title) => {
+    expect(getAgentLabel(title)).toBe('OpenCode')
+    expect(detectAgentStatusFromTitle(title)).toBe('idle')
+  })
+
+  it.each(['OC |', 'OC|Build', 'oc | lowercase lookalike', 'OCTOPUS | build'])(
+    'does not treat the lookalike title %j as an agent',
+    (title) => {
+      expect(detectAgentStatusFromTitle(title)).toBeNull()
+    }
+  )
+})
+
 describe('Pi-compatible title detection', () => {
   it.each([
     ['\u280b OMP', 'OMP', 'working'],
diff --git a/src/shared/agent-detection.ts b/src/shared/agent-detection.ts
index a2e419c4ff3..c603914b450 100644
--- a/src/shared/agent-detection.ts
+++ b/src/shared/agent-detection.ts
@@ -25,6 +25,7 @@ export {
   clearWorkingIndicators,
   createAgentStatusTracker,
   detectAgentStatusFromTitle,
+  isQuarterCircleSpinnerOnlyAgentTitle,
   normalizeTerminalTitle
 } from './agent-title-status'
 
diff --git a/src/shared/agent-hook-listener.test.ts b/src/shared/agent-hook-listener.test.ts
index a03435d0e1f..298e7a55c79 100644
--- a/src/shared/agent-hook-listener.test.ts
+++ b/src/shared/agent-hook-listener.test.ts
@@ -391,6 +391,90 @@ describe('shared agent-hook-listener', () => {
     expect(next?.payload.interactivePrompt).toBeUndefined()
   })
 
+  it('keeps AskUserQuestion visible through a late parallel sibling completion', () => {
+    const questions = { questions: [{ question: 'Pick', options: ['a', 'b'] }] }
+    const question = normalizeHookPayload(
+      state,
+      'claude',
+      {
+        paneKey: PANE_KEY,
+        payload: {
+          hook_event_name: 'PreToolUse',
+          tool_name: 'AskUserQuestion',
+          tool_use_id: 'tool-question',
+          tool_input: questions
+        }
+      },
+      'production'
+    )
+    normalizeHookPayload(
+      state,
+      'claude',
+      {
+        paneKey: PANE_KEY,
+        payload: {
+          hook_event_name: 'PermissionRequest',
+          tool_name: 'AskUserQuestion',
+          tool_input: questions
+        }
+      },
+      'production'
+    )
+    const siblingCompletion = normalizeHookPayload(
+      state,
+      'claude',
+      {
+        paneKey: PANE_KEY,
+        payload: {
+          hook_event_name: 'PostToolUse',
+          tool_name: 'Bash',
+          tool_use_id: 'tool-sibling',
+          tool_input: { command: 'sleep 5' }
+        }
+      },
+      'production'
+    )
+
+    expect(siblingCompletion?.payload).toMatchObject({
+      state: 'waiting',
+      toolName: 'AskUserQuestion',
+      interactivePrompt: question?.payload.interactivePrompt
+    })
+  })
+
+  it('clears AskUserQuestion when its own PostToolUse arrives', () => {
+    normalizeHookPayload(
+      state,
+      'claude',
+      {
+        paneKey: PANE_KEY,
+        payload: {
+          hook_event_name: 'PreToolUse',
+          tool_name: 'AskUserQuestion',
+          tool_use_id: 'tool-question',
+          tool_input: { questions: [{ question: 'Pick', options: ['a', 'b'] }] }
+        }
+      },
+      'production'
+    )
+    const answered = normalizeHookPayload(
+      state,
+      'claude',
+      {
+        paneKey: PANE_KEY,
+        payload: {
+          hook_event_name: 'PostToolUse',
+          tool_name: 'AskUserQuestion',
+          tool_use_id: 'tool-question'
+        }
+      },
+      'production'
+    )
+
+    expect(answered?.payload.state).toBe('working')
+    expect(answered?.payload.interactivePrompt).toBeUndefined()
+  })
+
   it('does not re-assert the AskUserQuestion prompt on PostToolUse', () => {
     // The question was answered, so PostToolUse must clear the live card instead
     // of re-deriving the `{questions}` prompt from the carried tool input.
@@ -3594,6 +3678,28 @@ describe('shared agent-hook-listener', () => {
       expect(childTool?.payload.toolName).toBe('AskUserQuestion')
     })
 
+    it('keeps a child AskUserQuestion visible through its parallel sibling completion', () => {
+      const question = claudeEvent({
+        hook_event_name: 'PreToolUse',
+        agent_id: 'a1',
+        tool_use_id: 'question-1',
+        tool_name: 'AskUserQuestion',
+        tool_input: { questions: [{ question: 'Pick', options: ['a', 'b'] }] }
+      })
+
+      const siblingCompletion = claudeEvent({
+        hook_event_name: 'PostToolUse',
+        agent_id: 'a1',
+        tool_use_id: 'sibling-1',
+        tool_name: 'Bash',
+        tool_input: { command: 'sleep 5' }
+      })
+
+      expect(siblingCompletion?.payload.state).toBe('waiting')
+      expect(siblingCompletion?.payload.interactivePrompt).toBe(question?.payload.interactivePrompt)
+      expect(siblingCompletion?.payload.toolName).toBe('AskUserQuestion')
+    })
+
     it('preserves the interrupted flag across a gated working window', () => {
       claudeEvent({ hook_event_name: 'UserPromptSubmit', prompt: 'long job' })
       claudeEvent({
diff --git a/src/shared/agent-hook-listener.ts b/src/shared/agent-hook-listener.ts
index c41bcb7354d..d24fa70e087 100644
--- a/src/shared/agent-hook-listener.ts
+++ b/src/shared/agent-hook-listener.ts
@@ -1,6 +1,6 @@
 /* eslint-disable max-lines -- Why: canonical transport-agnostic listener; parser, normalizer, per-CLI extractors, and endpoint writer share invariants that must not drift between Orca's main process and the relay. */
 
-// Why: extracted from src/main/agent-hooks/server.ts so the relay can host the pipeline without Electron (Node builtins only). See docs/design/agent-status-over-ssh.md §3.
+// Why: extracted from src/main/agent-hooks/server.ts so the relay can host the same pipeline without Electron — this file must stay on Node builtins and other shared/ modules, or the relay bundle breaks.
 import type { IncomingMessage } from 'node:http'
 import { createHash, randomUUID } from 'node:crypto'
 import { homedir } from 'node:os'
@@ -150,6 +150,8 @@ export type ClaudeLeadTurnState = {
   interrupted?: true
   /** Subagent that induced the wait; only its next tool activity may clear it, so other children's churn can't dismiss a pending human-input card. */
   waitingAgentId?: string
+  /** Tool call that owns the wait; late completions from parallel sibling tools must not dismiss its card. */
+  waitingToolUseId?: string
   /** Lead state a child-induced wait displaced, restored when the wait clears; can't invent 'working' since the done-gate only downgrades done→working, never back. */
   stateBeforeWait?: Pick<ClaudeLeadTurnState, 'state' | 'interrupted'>
 }
@@ -321,7 +323,8 @@ export type AgentHookEventPayload = {
   launchToken?: string
   tabId?: string
   worktreeId?: string
-  /** SSH connection the event arrived on, or null for local (only ingestRemote stamps it; the HTTP path can't know the mux). See docs/design/agent-status-over-ssh.md §5. */
+  /** SSH connection the event arrived on, or null for local. Only `ingestRemote` can stamp it — the loopback HTTP path has no mux identity — and receivers key off it to drop
+   *  in-flight events from a superseded connection after an SSH reconnect. */
   connectionId: string | null
   /** True when the event carried prompt text directly, not the listener's cached prompt from an earlier event in the pane. */
   hasExplicitPrompt?: boolean
@@ -840,7 +843,7 @@ function readString(record: Record<string, unknown>, key: string): string | unde
 }
 
 function hasOwnField(record: Record<string, unknown>, key: string): boolean {
-  return Object.prototype.hasOwnProperty.call(record, key)
+  return Object.hasOwn(record, key)
 }
 
 function hasAnyOwnField(record: Record<string, unknown>, keys: readonly string[]): boolean {
@@ -2620,7 +2623,7 @@ function normalizeClaudeSubagentLifecycleEvent(
       clearClaudePendingWaitForAgent(state, paneKey, (waitingAgentId) => waitingAgentId === agentId)
     }
   }
-  return buildClaudeChildDrivenStatusPayload(state, eventName, paneKey, hookPayload)
+  return buildClaudeCachedLeadStatusPayload(state, eventName, paneKey, hookPayload)
 }
 
 /** Sync the Claude lead-turn record when the SERVER infers an interrupt outside the hook stream (Ctrl+C with a missed Stop); else a later child lifecycle event resurrects the cancelled pane. */
@@ -2712,8 +2715,8 @@ export function clearClaudeAnsweredQuestionWait(
   return effectiveState === restored.state ? restored : { state: effectiveState }
 }
 
-/** Re-emit the lead's cached state on child activity — gated up to 'working' while a child works — without touching the lead's tool/prompt caches, so a live card or permission wait survives child churn. */
-function buildClaudeChildDrivenStatusPayload(
+/** Re-emit the cached lead state without touching its tool/prompt caches; child churn and parallel completions must not dismiss live cards. */
+function buildClaudeCachedLeadStatusPayload(
   state: HookListenerState,
   eventName: unknown,
   paneKey: string,
@@ -2794,10 +2797,13 @@ function normalizeClaudeEvent(
     return null
   }
 
-  // Why: Claude's auto-allowed AskUserQuestion emits PreToolUse (not PermissionRequest; its Notification hook isn't registered) while blocked on a human answer.
-  // Treat that PreToolUse as waiting so the sidebar shows amber attention, not a spinner that decays to grey. Mirrors normalizeKimiEvent.
-  const isAskUserQuestion =
-    eventName === 'PreToolUse' && isAskUserQuestionTool(readString(hookPayload, 'tool_name'))
+  // Why: Claude normally emits PreToolUse while AskUserQuestion is blocked; newer builds can also report it as PermissionRequest.
+  // Treat the PreToolUse as waiting so the sidebar shows amber attention, not a spinner that decays to grey. Mirrors normalizeKimiEvent.
+  const eventToolName = readString(hookPayload, 'tool_name')
+  const isAskUserQuestionWait =
+    (eventName === 'PreToolUse' || eventName === 'PermissionRequest') &&
+    isAskUserQuestionTool(eventToolName)
+  const isAskUserQuestion = eventName === 'PreToolUse' && isAskUserQuestionWait
   // Why: /compact can take minutes and does not emit Stop. PreCompact marks the pane busy;
   // PostCompact clears it so a finished compact cannot leave a sticky working spinner (#11352).
   const reportedStateName =
@@ -2836,6 +2842,20 @@ function normalizeClaudeEvent(
     state.claudeActiveSessionCronPaneKeys.delete(paneKey)
   }
 
+  const eventToolUseId = readFirstString(hookPayload, ['tool_use_id', 'toolUseId'])
+  const previousTool = state.lastToolByPaneKey.get(paneKey)
+  const isParallelSiblingCompletionDuringQuestion =
+    eventAgentId === undefined &&
+    previousLead?.state === 'waiting' &&
+    isAskUserQuestionTool(previousTool?.toolName) &&
+    (eventName === 'PostToolUse' || eventName === 'PostToolUseFailure') &&
+    previousLead.waitingToolUseId !== undefined &&
+    eventToolUseId !== undefined &&
+    eventToolUseId !== previousLead.waitingToolUseId
+  if (isParallelSiblingCompletionDuringQuestion) {
+    return buildClaudeCachedLeadStatusPayload(state, eventName, paneKey, hookPayload)
+  }
+
   // Why: subagent/teammate events carry `agent_id` (lead's don't); child tool activity keeps its row live but must not become the lead's state or overwrite its tool/prompt caches (a live card would vanish).
   // Two exceptions take the full path below: waiting-inducing events (a child needs human attention on this pane) and the blocked child's own next tool event (approval granted — clear the wait as for the lead).
   const isWaitingInducing = reportedStateName === 'waiting'
@@ -2857,7 +2877,15 @@ function normalizeClaudeEvent(
   if (subagentOriginId) {
     const lead = state.claudeLeadStateByPaneKey.get(paneKey)
     if (lead?.state !== 'waiting' || lead.waitingAgentId !== subagentOriginId) {
-      return buildClaudeChildDrivenStatusPayload(state, eventName, paneKey, hookPayload)
+      return buildClaudeCachedLeadStatusPayload(state, eventName, paneKey, hookPayload)
+    }
+    const isParallelSiblingCompletionDuringChildQuestion =
+      (eventName === 'PostToolUse' || eventName === 'PostToolUseFailure') &&
+      lead.waitingToolUseId !== undefined &&
+      eventToolUseId !== undefined &&
+      eventToolUseId !== lead.waitingToolUseId
+    if (isParallelSiblingCompletionDuringChildQuestion) {
+      return buildClaudeCachedLeadStatusPayload(state, eventName, paneKey, hookPayload)
     }
     // Why: approval granted — update the tool snapshot (drop the pending card) as the lead's own next tool event would.
     // Restore the stashed lead state, not this child's 'working': the lead may already be done, and the done-gate never upgrades working back to done once the roster drains.
@@ -2872,7 +2900,7 @@ function normalizeClaudeEvent(
 
   // Why: lead events never carry agent_id; even a child missed by lifecycle tracking cannot own the lead turn or its background-work evidence.
   if (eventAgentId && !isWaitingInducing) {
-    return buildClaudeChildDrivenStatusPayload(state, eventName, paneKey, hookPayload)
+    return buildClaudeCachedLeadStatusPayload(state, eventName, paneKey, hookPayload)
   }
 
   if (isTurnBoundary && eventAgentId === undefined) {
@@ -2897,10 +2925,12 @@ function normalizeClaudeEvent(
             ...(previousLead.interrupted ? { interrupted: true as const } : {})
           }
       : undefined
+  const waitingToolUseId = eventToolUseId ?? previousLead?.waitingToolUseId
   state.claudeLeadStateByPaneKey.set(paneKey, {
     state: reportedStateName,
     ...(interrupted ? { interrupted } : {}),
     ...(isWaitingInducing && eventAgentId ? { waitingAgentId: eventAgentId } : {}),
+    ...(isAskUserQuestionWait && waitingToolUseId !== undefined ? { waitingToolUseId } : {}),
     ...(stateBeforeWait ? { stateBeforeWait } : {})
   })
 
@@ -4332,7 +4362,6 @@ export function normalizeHookPayload(
       break
   }
 
-  // Why: connectionId is null here; ingestRemote stamps it from mux identity on receive. See docs/design/agent-status-over-ssh.md §5.
   const providerSessionOnly =
     (source === 'pi' || source === 'prime-agent') &&
     eventName === 'session_start' &&
@@ -4350,6 +4379,7 @@ export function normalizeHookPayload(
         launchToken,
         tabId,
         worktreeId,
+        // Why: normalization is transport-agnostic — only ingestRemote knows the mux identity to stamp here.
         connectionId: null,
         hasExplicitPrompt:
           source === 'amp'
diff --git a/src/shared/agent-hook-relay.ts b/src/shared/agent-hook-relay.ts
index f71e384b3be..f14db403804 100644
--- a/src/shared/agent-hook-relay.ts
+++ b/src/shared/agent-hook-relay.ts
@@ -8,7 +8,7 @@
 // the renderer-bound IPC + installer contract; this module is the wire envelope
 // between Orca's main process and the remote relay.
 //
-// Per the design doc:
+// Invariants both ends rely on:
 // - The relay normalizes; Orca routes. The envelope's `payload` field has
 //   already been through `normalizeHookPayload` (which calls
 //   `parseAgentStatusPayload` → `normalizeAgentStatusObject`) on the relay
@@ -194,8 +194,9 @@ export function restoreShedStatusFields(
 }
 
 /** JSON-RPC request method Orca issues after `--connect` reattach to ask the
- *  relay to replay its per-paneKey last-payload cache. See §5 Path 3 of the
- *  design doc for the race that ruled out push-on-`setWrite`. */
+ *  relay to replay its per-paneKey last-payload cache. Pull, not push: a relay
+ *  that pushed on `setWrite` can emit before Orca has wired its `agent.hook`
+ *  handler, and those notifications are dropped silently. */
 export const AGENT_HOOK_REQUEST_REPLAY_METHOD = 'agent_hook.requestReplay' as const
 
 /** JSON-RPC request method Orca issues at session-ready to ship the
diff --git a/src/shared/agent-resume-argv-drop.ts b/src/shared/agent-resume-argv-drop.ts
index ae393d0897e..df8c16aae4f 100644
--- a/src/shared/agent-resume-argv-drop.ts
+++ b/src/shared/agent-resume-argv-drop.ts
@@ -37,6 +37,9 @@ function stripSuffix(command: string, suffix: string): string | null {
  * Remove the resume argv `buildAgentResumeStartupPlan` appended, leaving the plain
  * agent launch. Main uses this when it cannot verify which account owns the session,
  * so the pane starts fresh instead of resuming under whichever account is selected.
+ * Codex-only in practice: claude resume commands may carry the selector before a
+ * `--` terminator (agent-resume-launch-command.ts), which this trailing-suffix
+ * strip would report as `unrecognized`.
  */
 export function dropAgentResumeArgvFromCommand(args: {
   command: string
diff --git a/src/shared/agent-resume-launch-command.test.ts b/src/shared/agent-resume-launch-command.test.ts
new file mode 100644
index 00000000000..5bf4797472b
--- /dev/null
+++ b/src/shared/agent-resume-launch-command.test.ts
@@ -0,0 +1,580 @@
+import { describe, expect, it } from 'vitest'
+import { buildClaudeResumeLaunchCommand } from './agent-resume-launch-command'
+import { buildAgentResumeStartupPlan, buildAgentStartupPlan } from './tui-agent-startup'
+import { tokenizeStartupCommand, type AgentStartupShell } from './tui-agent-startup-shell'
+
+const SESSION_ID = 'claude-session-1'
+const RESUME = ['--resume', SESSION_ID] as const
+const providerSession = { key: 'session_id', id: SESSION_ID } as const
+
+const SHELLS: { platform: NodeJS.Platform; shell: AgentStartupShell }[] = [
+  { platform: 'linux', shell: 'posix' },
+  { platform: 'darwin', shell: 'posix' },
+  { platform: 'win32', shell: 'powershell' },
+  { platform: 'win32', shell: 'cmd' }
+]
+
+/** Independent selector oracle — deliberately NOT the implementation's own
+ * predicate, so a regression that shrinks the stripped set cannot also blind
+ * this assertion. */
+function isSelectorShapedToken(token: string): boolean {
+  return (
+    ['--resume', '--continue', '-r', '-c'].includes(token) ||
+    ['--resume=', '--continue=', '-r=', '-c='].some((prefix) => token.startsWith(prefix))
+  )
+}
+
+/** Tokenizes a launch command and asserts exactly one identity-bearing resume. */
+function expectSingleAuthoritativeResume(command: string, shell: AgentStartupShell): void {
+  const tokenized = tokenizeStartupCommand(command, shell)
+  expect(tokenized.ok).toBe(true)
+  if (!tokenized.ok) {
+    return
+  }
+  const selectors = tokenized.tokens.filter(isSelectorShapedToken)
+  expect(selectors).toEqual(['--resume'])
+  const index = tokenized.tokens.indexOf('--resume')
+  expect(tokenized.tokens[index + 1]).toBe(SESSION_ID)
+}
+
+describe('buildClaudeResumeLaunchCommand', () => {
+  it.each(SHELLS)('appends the authoritative selector to a plain base ($shell)', ({ shell }) => {
+    const command = buildClaudeResumeLaunchCommand('claude', RESUME, shell)
+    expectSingleAuthoritativeResume(command, shell)
+    expect(command.startsWith('claude ')).toBe(true)
+  })
+
+  it.each(SHELLS)('strips a bare persisted --resume picker default ($shell)', ({ shell }) => {
+    const base = shell === 'cmd' ? 'claude "--resume"' : "claude '--resume'"
+    const command = buildClaudeResumeLaunchCommand(base, RESUME, shell)
+    expectSingleAuthoritativeResume(command, shell)
+  })
+
+  it.each([
+    'claude --resume stale-session',
+    'claude --resume=stale-session',
+    'claude -r stale-session',
+    'claude -r=stale-session',
+    'claude --resume= --model sonnet',
+    'claude --continue',
+    'claude -c',
+    'claude --continue=1',
+    'claude -c=1',
+    'claude --resume stale -r older --continue -c'
+  ])('replaces stale selectors in %s', (base) => {
+    const command = buildClaudeResumeLaunchCommand(base, RESUME, 'posix')
+    expectSingleAuthoritativeResume(command, 'posix')
+  })
+
+  it('keeps surviving options when stripping selectors', () => {
+    expect(
+      buildClaudeResumeLaunchCommand('claude --resume stale --model sonnet', RESUME, 'posix')
+    ).toBe(`claude --model sonnet '--resume' '${SESSION_ID}'`)
+  })
+
+  it('never mistakes a dash-leading option value for a selector', () => {
+    expect(buildClaudeResumeLaunchCommand('claude --model -recent', RESUME, 'posix')).toBe(
+      `claude --model -recent '--resume' '${SESSION_ID}'`
+    )
+    expect(
+      buildClaudeResumeLaunchCommand('claude --append-system-prompt -rules-here', RESUME, 'posix')
+    ).toBe(`claude --append-system-prompt -rules-here '--resume' '${SESSION_ID}'`)
+    expect(buildClaudeResumeLaunchCommand('claude --agent -reviewer', RESUME, 'posix')).toBe(
+      `claude --agent -reviewer '--resume' '${SESSION_ID}'`
+    )
+    expect(buildClaudeResumeLaunchCommand('claude --plugin-url -remote.zip', RESUME, 'posix')).toBe(
+      `claude --plugin-url -remote.zip '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('leaves the ambiguous joined -r<id> form alone (degrades to pre-guard behavior)', () => {
+    expect(buildClaudeResumeLaunchCommand('claude -rstale-session', RESUME, 'posix')).toBe(
+      `claude -rstale-session '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('leaves wrapper commands untouched and appends at the end', () => {
+    expect(buildClaudeResumeLaunchCommand('bash -c claude', RESUME, 'posix')).toBe(
+      `bash -c claude '--resume' '${SESSION_ID}'`
+    )
+    expect(buildClaudeResumeLaunchCommand('mise exec -- claude', RESUME, 'posix')).toBe(
+      `mise exec -- claude '--resume' '${SESSION_ID}'`
+    )
+    expect(buildClaudeResumeLaunchCommand('sudo -u dev -- claude', RESUME, 'posix')).toBe(
+      `sudo -u dev -- claude '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('strips selectors that follow claude after a wrapper terminator', () => {
+    expect(
+      buildClaudeResumeLaunchCommand("mise exec -- claude '--resume' stale", RESUME, 'posix')
+    ).toBe(`mise exec -- claude '--resume' '${SESSION_ID}'`)
+  })
+
+  it('fails open for claude outside command position (wrapper without --)', () => {
+    // Why: npx/bunx-style passthrough cannot be told apart from an argument
+    // that merely names claude, so the guard defers to append-only behavior.
+    expect(buildClaudeResumeLaunchCommand("npx claude '--resume'", RESUME, 'posix')).toBe(
+      `npx claude '--resume' '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('never mistakes a claude-suffixed argument for the executable', () => {
+    expect(
+      buildClaudeResumeLaunchCommand(
+        'ssh -i ~/.ssh/claude devbox -- claude --resume OLD',
+        RESUME,
+        'posix'
+      )
+    ).toBe(`ssh -i ~/.ssh/claude devbox -- claude '--resume' '${SESSION_ID}'`)
+    expect(
+      buildClaudeResumeLaunchCommand(
+        'mise exec --cd /Users/me/src/claude -- claude --resume OLD',
+        RESUME,
+        'posix'
+      )
+    ).toBe(`mise exec --cd /Users/me/src/claude -- claude '--resume' '${SESSION_ID}'`)
+    // No claude in command position at all: wrapper flags stay untouched.
+    expect(
+      buildClaudeResumeLaunchCommand(
+        'nix develop /Users/me/src/claude -c claude --resume OLD',
+        RESUME,
+        'posix'
+      )
+    ).toBe(`nix develop /Users/me/src/claude -c claude --resume OLD '--resume' '${SESSION_ID}'`)
+  })
+
+  it.each(['claude "\\--resume" old', 'claude "\\-r" old', 'claude --model "\\--resume"'])(
+    'fails open on a double-quoted backslash the shell keeps literal: %s',
+    (base) => {
+      expect(buildClaudeResumeLaunchCommand(base, RESUME, 'posix')).toBe(
+        `${base} '--resume' '${SESSION_ID}'`
+      )
+    }
+  )
+
+  it('still strips when a double-quoted backslash is shell-consumed', () => {
+    expect(
+      buildClaudeResumeLaunchCommand('claude --model "a\\"b" --resume old', RESUME, 'posix')
+    ).toBe(`claude --model "a\\"b" '--resume' '${SESSION_ID}'`)
+  })
+
+  it.each([
+    'claude "--resu\\\nme" --resume stale',
+    "claude $'-c' --resume stale",
+    "claude $'--resu\\x6de' --resume stale"
+  ])('fails open when an escape hides a selector from the tokenizer: %s', (base) => {
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'posix')).toBe(
+      `${base} '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it.each([
+    'claude --resume old --append-system-prompt "spend under 5$"',
+    'claude --resume old --note x$',
+    'claude --resume old --note "a$"'
+  ])('still strips when a $ is not an expansion opener: %s', (base) => {
+    const command = buildClaudeResumeLaunchCommand(base, RESUME, 'posix')
+    expect(command).not.toContain('--resume old')
+    expectSingleAuthoritativeResume(command, 'posix')
+  })
+
+  it.each(['claude a^" --resume ^"b', 'claude ^"x --resume^" --resume old'])(
+    'fails open when a cmd caret escapes a quote: %s',
+    (base) => {
+      // cmd strips the caret and the child's parser reads a bare quote
+      // delimiter, so the tokenizer's word boundaries stop matching argv.
+      expect(buildClaudeResumeLaunchCommand(base, RESUME, 'cmd')).toBe(
+        `${base} "--resume" "${SESSION_ID}"`
+      )
+    }
+  )
+
+  it.each(['claude --resume (Get-Content id.txt)', 'claude --hook { npm -c run } --resume old'])(
+    'fails open on bare powershell evaluation syntax: %s',
+    (base) => {
+      expect(buildClaudeResumeLaunchCommand(base, RESUME, 'powershell')).toBe(
+        `${base} '--resume' '${SESSION_ID}'`
+      )
+    }
+  )
+
+  it.each([
+    'claude "-`r" foo --model x',
+    'claude "-`u{72}" oldid --resume x',
+    'claude -`r foo --model x',
+    'claude --resum`e stale --model x'
+  ])('fails open on powershell escape sequences, quoted or bare: %s', (base) => {
+    // PowerShell expands these in bare arguments too, so the tokenizer's
+    // token value is not what argv receives.
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'powershell')).toBe(
+      `${base} '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('fails open on a token-leading powershell backtick before whitespace', () => {
+    // PowerShell drops the backtick AND the whitespace, emitting no token,
+    // so the tokenizer's extra token would shift the locator.
+    const base = 'claude --resume ` \t"q"'
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'powershell')).toBe(
+      `${base} '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('fails open on the powershell stop-parsing token', () => {
+    // After a bare --%, PowerShell hands the rest of the line to the child
+    // literally, so an appended quoted selector would arrive as literal bytes.
+    const base = 'claude --% --resume stale --model sonnet'
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'powershell')).toBe(
+      `${base} '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('still strips when --% is quoted or on cmd, where it is an ordinary token', () => {
+    expect(
+      buildClaudeResumeLaunchCommand('claude "--%" --resume stale', RESUME, 'powershell')
+    ).toBe(`claude "--%" '--resume' '${SESSION_ID}'`)
+    expect(buildClaudeResumeLaunchCommand('claude --% --resume stale', RESUME, 'cmd')).toBe(
+      `claude --% "--resume" "${SESSION_ID}"`
+    )
+  })
+
+  it('still strips with parens safely inside quotes on powershell', () => {
+    expect(
+      buildClaudeResumeLaunchCommand(
+        'claude --allowedTools "Bash(git:*)" --resume old',
+        RESUME,
+        'powershell'
+      )
+    ).toBe(`claude --allowedTools "Bash(git:*)" '--resume' '${SESSION_ID}'`)
+  })
+
+  it.each([
+    'claude "--add-dir" "C:\\a\\" "--" "--out" "D:\\x\\"',
+    'claude --add-dir "C:\\repo\\" --resume old'
+  ])('fails open when a cmd backslash run makes a quote literal: %s', (base) => {
+    // An odd run of backslashes makes the quote a literal byte to the child's
+    // CommandLineToArgvW parser, so tokenizer boundaries stop matching argv.
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'cmd')).toBe(
+      `${base} "--resume" "${SESSION_ID}"`
+    )
+  })
+
+  it.each([
+    'claude --add-dir "C:\\Users\\me\\repo" --resume old',
+    'claude --add-dir "C:\\Program Files (x86)\\x" --resume old'
+  ])('still strips for ordinary quoted windows paths: %s', (base) => {
+    const command = buildClaudeResumeLaunchCommand(base, RESUME, 'cmd')
+    expect(command).not.toContain('--resume old')
+    expectSingleAuthoritativeResume(command, 'cmd')
+  })
+
+  it('fails open when a cmd caret escapes a real argument separator', () => {
+    // cmd strips ^ before the child re-splits on the bare space, so the
+    // tokenizer's merged token would drop the user's second argument.
+    const base = 'claude --resume a^ b --model x'
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'cmd')).toBe(
+      `${base} "--resume" "${SESSION_ID}"`
+    )
+  })
+
+  it.each([
+    ['claude --resume old \\', 'posix' as const],
+    ['claude --resume old `', 'powershell' as const],
+    ['claude --resume old ^', 'cmd' as const]
+  ])('fails open on a trailing unpaired escape: %s', (base, shell) => {
+    // A dangling escape would swallow the separator before the appended
+    // selector, so claude would receive no exact --resume at all.
+    const quoted = shell === 'cmd' ? `"--resume" "${SESSION_ID}"` : `'--resume' '${SESSION_ID}'`
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, shell)).toBe(`${base} ${quoted}`)
+  })
+
+  it('fails open on a windows escaped line continuation', () => {
+    const powershellBase = 'claude --resume stale `\n--resume hidden'
+    expect(buildClaudeResumeLaunchCommand(powershellBase, RESUME, 'powershell')).toBe(
+      `${powershellBase} '--resume' '${SESSION_ID}'`
+    )
+    const cmdBase = 'claude --resume stale ^\n--resume hidden'
+    expect(buildClaudeResumeLaunchCommand(cmdBase, RESUME, 'cmd')).toBe(
+      `${cmdBase} "--resume" "${SESSION_ID}"`
+    )
+  })
+
+  it('fails open on a posix line continuation hiding a selector', () => {
+    const base = 'claude --model x \\\n--resume old'
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'posix')).toBe(
+      `${base} '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('fails open on escape characters the windows shells keep literal', () => {
+    // cmd keeps ^ literal inside double quotes; PowerShell keeps ` literal
+    // inside single quotes, so these tokens are not really selectors.
+    expect(buildClaudeResumeLaunchCommand('claude "-^-resume" old', RESUME, 'cmd')).toBe(
+      `claude "-^-resume" old "--resume" "${SESSION_ID}"`
+    )
+    expect(buildClaudeResumeLaunchCommand("claude '-`-resume' old", RESUME, 'powershell')).toBe(
+      `claude '-\`-resume' old '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('fails open on an unclosed expansion opened before claude', () => {
+    const base = '$(x; npx -- claude --resume stale)'
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'posix')).toBe(
+      `${base} '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('fails open when the executable token itself is unmodelable', () => {
+    // cmd has no single-quote syntax, so 'claude' is not the claude executable.
+    expect(buildClaudeResumeLaunchCommand("'claude' --resume old", RESUME, 'cmd')).toBe(
+      `'claude' --resume old "--resume" "${SESSION_ID}"`
+    )
+  })
+
+  it.each(['cmd', 'powershell'] as const)(
+    'fails open on a posix-style assignment prefix under %s',
+    (shell) => {
+      // NAME=value prefixes are posix-only syntax; on Windows shells that
+      // token is a bogus executable, so nothing may be spliced.
+      const base = "FOO='bar' claude --resume old"
+      const quoted = shell === 'cmd' ? `"--resume" "${SESSION_ID}"` : `'--resume' '${SESSION_ID}'`
+      expect(buildClaudeResumeLaunchCommand(base, RESUME, shell)).toBe(`${base} ${quoted}`)
+    }
+  )
+
+  it('preserves an env-assignment or path prefix byte for byte', () => {
+    expect(
+      buildClaudeResumeLaunchCommand('FOO="$HOME/x" ~/bin/claude \'--resume\'', RESUME, 'posix')
+    ).toBe(`FOO="$HOME/x" ~/bin/claude '--resume' '${SESSION_ID}'`)
+  })
+
+  it('recognizes Windows claude executable spellings', () => {
+    expect(buildClaudeResumeLaunchCommand('C:\\tools\\claude.CMD "--resume"', RESUME, 'cmd')).toBe(
+      `C:\\tools\\claude.CMD "--resume" "${SESSION_ID}"`
+    )
+  })
+
+  it("inserts the selector before claude's own -- terminator", () => {
+    expect(
+      buildClaudeResumeLaunchCommand('claude --resume stale -- positional', RESUME, 'posix')
+    ).toBe(`claude '--resume' '${SESSION_ID}' -- positional`)
+  })
+
+  it('fails open when the base cannot be tokenized', () => {
+    expect(buildClaudeResumeLaunchCommand('claude "unterminated', RESUME, 'posix')).toBe(
+      `claude "unterminated '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('fails open when no claude executable token exists', () => {
+    expect(buildClaudeResumeLaunchCommand('my-agent-wrapper --resume', RESUME, 'posix')).toBe(
+      `my-agent-wrapper --resume '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it.each([
+    'claude -c && echo done',
+    'claude --resume stale; echo hi',
+    'claude --resume stale;echo hi',
+    'claude -c | tee /tmp/log',
+    'claude --resume stale 2>/tmp/x.log',
+    'claude --resume stale\n--verbose',
+    'claude --resume stale # note'
+  ])('fails open when the base chains shell syntax after claude: %s', (base) => {
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'posix')).toBe(
+      `${base} '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it.each([
+    'claude --resume old "y"; echo hi',
+    "claude --resume old 'y'; echo hi",
+    'claude --resume old --model "sonnet"&&echo hi',
+    'claude --resume old "y"| tee /tmp/x',
+    'claude --resume old \\"; echo hi'
+  ])('fails open when shell syntax hides behind partial quoting: %s', (base) => {
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'posix')).toBe(
+      `${base} '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('fails open on escape-adjacent operators in windows shells', () => {
+    const powershellBase = 'claude --resume old `x; echo hi'
+    expect(buildClaudeResumeLaunchCommand(powershellBase, RESUME, 'powershell')).toBe(
+      `${powershellBase} '--resume' '${SESSION_ID}'`
+    )
+    const cmdBase = 'claude --resume old ^x& echo hi'
+    expect(buildClaudeResumeLaunchCommand(cmdBase, RESUME, 'cmd')).toBe(
+      `${cmdBase} "--resume" "${SESSION_ID}"`
+    )
+  })
+
+  it.each([
+    'claude --resume $(cat sid.txt)',
+    'claude --resume=$(cat sid.txt)',
+    'claude --resume `cat sid.txt`',
+    'claude --resume ${SID:-a b}'
+  ])('fails open on unquoted multi-token shell expansions: %s', (base) => {
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'posix')).toBe(
+      `${base} '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it.each([
+    'claude --resume "`cat "a b"`"',
+    'claude --model "$(pick "x -c y")"',
+    'claude --model "$(f "x --resume y")"',
+    'claude --resume "$(cat "$HOME/My Sessions/id")"'
+  ])('fails open on expansions nested inside double quotes: %s', (base) => {
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'posix')).toBe(
+      `${base} '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('fails open on a powershell double-quoted subexpression', () => {
+    const base = 'claude --model "$(pick "x -c y")"'
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'powershell')).toBe(
+      `${base} '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('fails open on a powershell subexpression locator', () => {
+    const base = 'claude --resume $(Get-Content sid.txt)'
+    expect(buildClaudeResumeLaunchCommand(base, RESUME, 'powershell')).toBe(
+      `${base} '--resume' '${SESSION_ID}'`
+    )
+  })
+
+  it('never walks the separator backoff into an escaped-space token', () => {
+    expect(
+      buildClaudeResumeLaunchCommand(
+        'claude --append-system-prompt Be\\ nice\\  --resume OLD',
+        RESUME,
+        'posix'
+      )
+    ).toBe(`claude --append-system-prompt Be\\ nice\\  '--resume' '${SESSION_ID}'`)
+  })
+
+  it('fails open when cmd operators hide in single quotes', () => {
+    // cmd.exe has no single-quote syntax, so '&' is a live command separator.
+    expect(buildClaudeResumeLaunchCommand("claude '&' --resume=old-session", RESUME, 'cmd')).toBe(
+      `claude '&' --resume=old-session "--resume" "${SESSION_ID}"`
+    )
+  })
+
+  it('fails open on cmd single-quoted literals that merely look like selectors', () => {
+    // cmd passes the quotes through, so these are junk positionals for
+    // claude, not real selectors or terminators.
+    expect(buildClaudeResumeLaunchCommand("claude '--resume' old", RESUME, 'cmd')).toBe(
+      `claude '--resume' old "--resume" "${SESSION_ID}"`
+    )
+    expect(buildClaudeResumeLaunchCommand("claude '--' --resume old", RESUME, 'cmd')).toBe(
+      `claude '--' --resume old "--resume" "${SESSION_ID}"`
+    )
+  })
+
+  it('still strips next to a caret-escaped literal ampersand on cmd', () => {
+    // ^& is an inactive, literal & in cmd, so the guard may keep working.
+    expect(buildClaudeResumeLaunchCommand('claude --resume old ^&', RESUME, 'cmd')).toBe(
+      `claude ^& "--resume" "${SESSION_ID}"`
+    )
+  })
+
+  it('still strips when operators are safely quoted', () => {
+    expect(
+      buildClaudeResumeLaunchCommand(
+        "claude --append-system-prompt 'use && wisely' --resume stale",
+        RESUME,
+        'posix'
+      )
+    ).toBe(`claude --append-system-prompt 'use && wisely' '--resume' '${SESSION_ID}'`)
+  })
+
+  it('recognizes claude behind the PowerShell call operator', () => {
+    expect(buildClaudeResumeLaunchCommand("& claude '--resume'", RESUME, 'powershell')).toBe(
+      `& claude '--resume' '${SESSION_ID}'`
+    )
+    expect(
+      buildClaudeResumeLaunchCommand(
+        "& 'C:\\Program Files\\claude\\claude.exe' --resume old",
+        RESUME,
+        'powershell'
+      )
+    ).toBe(`& 'C:\\Program Files\\claude\\claude.exe' '--resume' '${SESSION_ID}'`)
+  })
+})
+
+describe('buildAgentResumeStartupPlan claude selector guard', () => {
+  it.each(SHELLS)(
+    'emits one identity-bearing resume for a persisted bare selector ($platform/$shell)',
+    ({ platform, shell }) => {
+      const initial = buildAgentStartupPlan({
+        agent: 'claude',
+        prompt: '',
+        cmdOverrides: {},
+        agentArgs: '--resume',
+        platform,
+        shell,
+        allowEmptyPromptLaunch: true
+      })
+      expect(initial).not.toBeNull()
+      const restored = buildAgentResumeStartupPlan({
+        agent: 'claude',
+        providerSession,
+        cmdOverrides: {},
+        agentArgs: initial?.launchConfig.agentArgs,
+        agentCommand: initial?.launchConfig.agentCommand,
+        platform,
+        shell
+      })
+      expect(restored).not.toBeNull()
+      expectSingleAuthoritativeResume(restored?.launchCommand ?? '', shell)
+    }
+  )
+
+  it('emits one identity-bearing resume when only default args carry a stale id', () => {
+    const restored = buildAgentResumeStartupPlan({
+      agent: 'claude',
+      providerSession,
+      cmdOverrides: {},
+      agentArgs: '--resume stale-session --model sonnet',
+      platform: 'linux'
+    })
+    expect(restored?.launchCommand).toBe(`claude '--model' 'sonnet' '--resume' '${SESSION_ID}'`)
+  })
+
+  it('still launches exotic custom commands that the tokenizer rejects', () => {
+    const restored = buildAgentResumeStartupPlan({
+      agent: 'claude',
+      providerSession,
+      cmdOverrides: {},
+      agentCommand: 'claude --model $(cat ~/.claude-model) "unterminated',
+      platform: 'darwin'
+    })
+    expect(restored).not.toBeNull()
+    expect(restored?.launchCommand.endsWith(`'--resume' '${SESSION_ID}'`)).toBe(true)
+  })
+
+  it('does not change other agents', () => {
+    const restored = buildAgentResumeStartupPlan({
+      agent: 'gemini',
+      providerSession,
+      cmdOverrides: {},
+      agentArgs: '--resume',
+      platform: 'linux'
+    })
+    expect(restored?.launchCommand).toBe(`gemini '--resume' '--resume' '${SESSION_ID}'`)
+  })
+
+  it('persists the original base command unchanged', () => {
+    const restored = buildAgentResumeStartupPlan({
+      agent: 'claude',
+      providerSession,
+      cmdOverrides: {},
+      agentCommand: "claude '--resume'",
+      platform: 'linux'
+    })
+    expect(restored?.launchConfig.agentCommand).toBe("claude '--resume'")
+  })
+})
diff --git a/src/shared/agent-resume-launch-command.ts b/src/shared/agent-resume-launch-command.ts
new file mode 100644
index 00000000000..1093735d266
--- /dev/null
+++ b/src/shared/agent-resume-launch-command.ts
@@ -0,0 +1,168 @@
+import type { ResumableTuiAgent } from './agent-session-resume'
+import {
+  quoteStartupArg,
+  tokenizeStartupCommand,
+  type AgentStartupShell
+} from './tui-agent-startup-shell'
+
+function isClaudeResumeSelector(token: string): boolean {
+  if (token === '--resume' || token.startsWith('--resume=')) {
+    return true
+  }
+  if (token === '--continue' || token.startsWith('--continue=')) {
+    return true
+  }
+  // Why: the joined -r<id> form is deliberately NOT matched — any `-r…` token
+  // is ambiguous with another option's dash-leading value (`--agent -review`),
+  // and no arity table can keep up with the CLI. Only exact selector shapes
+  // are stripped; a persisted joined form degrades to pre-guard behavior.
+  return token === '-r' || token.startsWith('-r=') || token === '-c' || token.startsWith('-c=')
+}
+
+function isClaudeExecutableToken(token: string): boolean {
+  const base = token.split(/[\\/]/).pop() ?? ''
+  return /^claude(\.(exe|cmd|bat|ps1))?$/i.test(base)
+}
+
+/** Accepts a claude token only in command position — index 0, right after a
+ * wrapper's `--`, behind PowerShell's `&` call operator, or preceded solely by
+ * NAME=value assignments — so an argument that merely ends in /claude (an ssh
+ * key, a project dir) can never be mistaken for the executable. */
+function findClaudeExecutableIndex(tokens: readonly string[], shell: AgentStartupShell): number {
+  let commandPosition = true
+  for (let i = 0; i < tokens.length; i += 1) {
+    const token = tokens[i]
+    if (commandPosition) {
+      if (isClaudeExecutableToken(token)) {
+        return i
+      }
+      if (
+        // Why: `NAME=value cmd` is posix-only syntax; on cmd/PowerShell such a
+        // token is just a bogus executable name, not a prefix to skip.
+        (shell === 'posix' && /^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) ||
+        (shell === 'powershell' && token === '&' && i === 0)
+      ) {
+        continue
+      }
+      commandPosition = false
+    }
+    if (token === '--') {
+      commandPosition = true
+    }
+  }
+  return -1
+}
+
+/** Joins the resolved base command with the agent's resume argv. Claude goes
+ * through the selector guard below; other agents keep plain appending. */
+export function buildAgentResumeLaunchCommand(
+  agent: ResumableTuiAgent,
+  baseCommand: string,
+  resumeArgv: readonly string[],
+  shell: AgentStartupShell
+): string {
+  const argv = resumeArgv.slice(1)
+  if (agent === 'claude') {
+    return buildClaudeResumeLaunchCommand(baseCommand, argv, shell)
+  }
+  const resumeArgs = argv.map((arg) => quoteStartupArg(arg, shell)).join(' ')
+  return resumeArgs ? `${baseCommand} ${resumeArgs}` : baseCommand
+}
+
+/** Builds the Claude cold-restore launch command: strips any resume/continue
+ * selector the user's persisted command carries and appends exactly one
+ * authoritative selector, so a stale or bare selector can never compete with
+ * the provider session id (#12982).
+ *
+ * Fails open by design: when the base command cannot be tokenized, or no
+ * claude executable token can be located (wrapper commands like
+ * `bash -c claude`), the base is left byte-for-byte untouched and the
+ * selector is appended, which is the pre-guard behavior. Bytes outside
+ * removed selector tokens are always preserved verbatim — the base is
+ * spliced by source span, never re-quoted. */
+export function buildClaudeResumeLaunchCommand(
+  baseCommand: string,
+  resumeArgs: readonly string[],
+  shell: AgentStartupShell
+): string {
+  const quotedResume = resumeArgs.map((arg) => quoteStartupArg(arg, shell)).join(' ')
+  if (!quotedResume) {
+    return baseCommand
+  }
+  const appended = `${baseCommand} ${quotedResume}`
+  const tokenized = tokenizeStartupCommand(baseCommand, shell)
+  if (!tokenized.ok) {
+    return appended
+  }
+  const { tokens, spans } = tokenized
+  const claudeIndex = findClaudeExecutableIndex(tokens, shell)
+  if (claudeIndex === -1) {
+    return appended
+  }
+  // Why: any token the tokenizer cannot model for this shell — an operator,
+  // comment, expansion, or cmd single-quoted region — means the splice could
+  // cut live syntax or misread a literal as a selector. The whole base must
+  // be modelable, including the executable itself; only PowerShell's leading
+  // call operator is a known-safe divergent token.
+  for (let i = 0; i <= tokens.length; i += 1) {
+    const gapStart = i === 0 ? 0 : spans[i - 1].end
+    const gapEnd = i === tokens.length ? baseCommand.length : spans[i].start
+    if (!/^[ \t]*$/.test(baseCommand.slice(gapStart, gapEnd))) {
+      return appended
+    }
+    if (i === tokens.length) {
+      break
+    }
+    // Why: a bare `--%` makes PowerShell pass the rest of the line to the
+    // child literally, so appended quoting would arrive as literal bytes. A
+    // quoted `--%` can also stop parsing, but only before a parameter token,
+    // where the base is already mangled with or without the guard.
+    if (shell === 'powershell' && baseCommand.slice(spans[i].start, spans[i].end) === '--%') {
+      return appended
+    }
+    if (spans[i].divergesFromShell) {
+      const isCallOperator = shell === 'powershell' && i === 0 && tokens[i] === '&'
+      if (!isCallOperator) {
+        return appended
+      }
+    }
+  }
+  const cuts: { start: number; end: number }[] = []
+  let terminatorStart: number | null = null
+  for (let i = claudeIndex + 1; i < tokens.length; i += 1) {
+    const token = tokens[i]
+    if (token === '--') {
+      // Why: claude is the executable here, so `--` is claude's own
+      // terminator; the selector must stay in option position before it.
+      // Span-splice equivalent of insertBeforeTerminator in
+      // tui-agent-launch-command.ts, which re-quotes and cannot be reused.
+      terminatorStart = spans[i].start
+      break
+    }
+    if (!isClaudeResumeSelector(token)) {
+      continue
+    }
+    // Why: absorb the separator before the selector, but never cross into the
+    // previous token, whose span can end with an escaped-space byte.
+    let start = spans[i].start
+    while (start > spans[i - 1].end && ' \t'.includes(baseCommand[start - 1])) {
+      start -= 1
+    }
+    let end = spans[i].end
+    const next = tokens[i + 1]
+    if ((token === '--resume' || token === '-r') && next !== undefined && !next.startsWith('-')) {
+      // A stale session locator rides along with its selector.
+      end = spans[i + 1].end
+      i += 1
+    }
+    cuts.push({ start, end })
+  }
+  let result = baseCommand
+  if (terminatorStart !== null) {
+    result = `${result.slice(0, terminatorStart)}${quotedResume} ${result.slice(terminatorStart)}`
+  }
+  for (let i = cuts.length - 1; i >= 0; i -= 1) {
+    result = `${result.slice(0, cuts[i].start)}${result.slice(cuts[i].end)}`
+  }
+  return terminatorStart !== null ? result : `${result} ${quotedResume}`
+}
diff --git a/src/shared/agent-session-option-catalog-claude-codex.ts b/src/shared/agent-session-option-catalog-claude-codex.ts
index 3e2f0f57921..4e9396632c7 100644
--- a/src/shared/agent-session-option-catalog-claude-codex.ts
+++ b/src/shared/agent-session-option-catalog-claude-codex.ts
@@ -204,7 +204,7 @@ function codexEffort(includeExtraHigh: boolean): CatalogOption {
       launchArgs: (value) => ['-c', `model_reasoning_effort=${String(value)}`],
       agentArgsOverride: hasCodexEffortOverride,
       removeAgentArgs: removeCodexEffortOverride,
-      midSession: { kind: 'agent-picker', command: '/model' }
+      midSession: { kind: 'agent-picker', command: '/model', delivery: 'type' }
     }
   }
 }
@@ -228,12 +228,9 @@ export const CODEX_SESSION_OPTION_CATALOG: AgentSessionOptionCatalog = {
     launchArgs: (value) => ['-m', String(value)],
     agentArgsOverride: (tokens) => hasFlag(tokens, ['-m', '--model']),
     removeAgentArgs: (tokens) => removeAgentArgOption(tokens, ['-m', '--model']),
-    // Codex accepts a model argument in its live /model command.
-    midSession: {
-      kind: 'command',
-      build: (value) => `/model ${String(value)}`,
-      pickerCommand: '/model'
-    }
+    // Codex classifies multi-character writes as pasted prose; type the bare
+    // command and let its own picker apply the account-supported model.
+    midSession: { kind: 'agent-picker', command: '/model', delivery: 'type' }
   },
   unknownModelOptions: [codexEffort(true)]
 }
diff --git a/src/shared/agent-session-option-catalog-types.ts b/src/shared/agent-session-option-catalog-types.ts
index bb08339e07e..ae2af3b450f 100644
--- a/src/shared/agent-session-option-catalog-types.ts
+++ b/src/shared/agent-session-option-catalog-types.ts
@@ -6,6 +6,7 @@ import type {
 } from './native-chat-session-options'
 
 export type CatalogAgentInteractionDetection = 'claude-model-switch-confirmation'
+export type CatalogCommandDelivery = 'type'
 
 export type CatalogMidSessionApply =
   | {
@@ -15,7 +16,7 @@ export type CatalogMidSessionApply =
       detectAgentInteraction?: CatalogAgentInteractionDetection
     }
   | { kind: 'toggle-command'; command: string }
-  | { kind: 'agent-picker'; command: string }
+  | { kind: 'agent-picker'; command: string; delivery?: CatalogCommandDelivery }
   | { kind: 'unsupported' }
 
 export type CatalogOptionApply = {
diff --git a/src/shared/agent-session-option-catalog.ts b/src/shared/agent-session-option-catalog.ts
index e5e254c45de..b242b6b27c9 100644
--- a/src/shared/agent-session-option-catalog.ts
+++ b/src/shared/agent-session-option-catalog.ts
@@ -20,6 +20,7 @@ import type { SessionOptionValue } from './native-chat-session-options'
 export type {
   AgentSessionOptionCatalog,
   CatalogAgentInteractionDetection,
+  CatalogCommandDelivery,
   CatalogMidSessionApply,
   CatalogModel,
   CatalogOption,
diff --git a/src/shared/agent-status-types.ts b/src/shared/agent-status-types.ts
index 9f08791eec3..80ce1a4f823 100644
--- a/src/shared/agent-status-types.ts
+++ b/src/shared/agent-status-types.ts
@@ -44,7 +44,9 @@ export type AgentType = WellKnownAgentType | (string & {})
 
 /** A snapshot of a previous agent state, used to render activity blocks.
  *  Why: intentionally narrower than AgentStatusEntry — tool/assistant context is
- *  per-turn, not meaningful on a historical snapshot, and would bloat memory. */
+ *  per-turn, not meaningful on a historical snapshot, and would bloat memory.
+ *  Coalesced-turn output lives in AgentStatusEntry.lastCompletedAssistantMessage,
+ *  one copy per pane, so it can't multiply by AGENT_STATE_HISTORY_MAX. */
 export type AgentStateHistoryEntry = {
   state: AgentStatusState
   prompt: string
@@ -124,6 +126,10 @@ export type AgentStatusEntry = {
   interactivePrompt?: string
   /** Most recent assistant message preview, when the hook carried one. */
   lastAssistantMessage?: string
+  /** Output of the newest completed (non-boundary) turn, kept across the next `working`.
+   *  Why: batched publications can fold a whole done→working turn into one notification,
+   *  so `lastAssistantMessage` is already cleared by the time a subscriber observes it. */
+  lastCompletedAssistantMessage?: string
   /** True when this `done` was reached via interrupt, not normal completion
    *  (agent-reported or Orca's guarded fallback). Undefined otherwise. */
   interrupted?: boolean
@@ -226,7 +232,7 @@ export type AgentStatusIpcPayload = ParsedAgentStatusPayload & {
   tabId?: string
   worktreeId?: string
   /** Identifies the SSH connection the event arrived on, or null for local.
-   *  Only the remote-ingest path (`ingestRemote`) can stamp it; the HTTP path always sets null. See docs/design/agent-status-over-ssh.md §5. */
+   *  Only the remote-ingest path (`ingestRemote`) can stamp it from mux identity; the HTTP path has no mux and always sets null. */
   connectionId: string | null
   /** Timestamp (ms) when the hook server received this latest status event. */
   receivedAt: number
diff --git a/src/shared/agent-title-core.ts b/src/shared/agent-title-core.ts
index 83dcc12bf92..c96121b432c 100644
--- a/src/shared/agent-title-core.ts
+++ b/src/shared/agent-title-core.ts
@@ -47,6 +47,11 @@ export const CURSOR_NATIVE_TITLE_LOWER = 'cursor agent'
 // eslint-disable-next-line no-control-regex -- intentional unicode range
 export const BRAILLE_SPINNER_RE = /[\u2800-\u28ff]/g
 
+// Why: Claude Code 2.1.228 swapped its busy title spinner from braille to
+// quarter circles (#13889), which read as "no agent" and looked like an exit.
+// Reserve the whole quarter-circle block so a later frame addition cannot regress this.
+export const QUARTER_CIRCLE_SPINNER_RE = /[\u25d0-\u25d3]/g
+
 export function isGeminiTerminalTitle(title: string): boolean {
   // Why: Gemini OSC glyphs are stronger evidence than any cwd/session text.
   if (
@@ -83,6 +88,25 @@ export function containsBrailleSpinner(title: string): boolean {
   return false
 }
 
+export function containsQuarterCircleSpinner(title: string): boolean {
+  for (const char of title) {
+    const codePoint = char.codePointAt(0)
+    if (codePoint !== undefined && codePoint >= 0x25d0 && codePoint <= 0x25d3) {
+      return true
+    }
+  }
+  return false
+}
+
+/**
+ * Any spinner frame glyph an agent animates its OSC title with. Use this for
+ * generic "something is running" checks; agent-specific frame shapes (Grok,
+ * Pi, synthetic Cursor) stay pinned to their own glyph set.
+ */
+export function containsAgentSpinnerGlyph(title: string): boolean {
+  return containsBrailleSpinner(title) || containsQuarterCircleSpinner(title)
+}
+
 export function containsLegacyAgentName(title: string): boolean {
   return titleHasAnyLegacyAgentName(title)
 }
diff --git a/src/shared/agent-title-decoration.ts b/src/shared/agent-title-decoration.ts
index bc05badf8aa..47a6db679e7 100644
--- a/src/shared/agent-title-decoration.ts
+++ b/src/shared/agent-title-decoration.ts
@@ -1,11 +1,11 @@
 // Leading status decorations that coding agents prepend to their OSC title —
-// Claude's '✳', Gemini's glyphs (✦ ⏲ ◇ ✋), braille spinners, and Claude's
-// '. '/'* ' working/idle prefixes. Once the tab bar shows the provider icon,
-// this leading glyph reads as a redundant second icon, so strip it from the
-// displayed title. Scoped to titles we already know belong to an agent.
+// Claude's '✳', Gemini's glyphs (✦ ⏲ ◇ ✋), braille and quarter-circle spinners,
+// and Claude's '. '/'* ' working/idle prefixes. Once the tab bar shows the
+// provider icon, this leading glyph reads as a redundant second icon, so strip
+// it from the displayed title. Scoped to titles we already know belong to an agent.
 const LEADING_AGENT_TITLE_DECORATION_RE =
   // eslint-disable-next-line no-control-regex -- intentional unicode status-glyph ranges
-  /^(?:[✳✦⏲◇✋⠀-⣿]+|[.*]\s)\s*/
+  /^(?:[✳✦⏲◇✋⠀-⣿◐-◓]+|[.*]\s)\s*/
 
 export function stripLeadingAgentTitleDecorationOrEmpty(title: string): string {
   return title.replace(LEADING_AGENT_TITLE_DECORATION_RE, '').trimStart()
diff --git a/src/shared/agent-title-identity.ts b/src/shared/agent-title-identity.ts
index af86de1667d..cdfc6946777 100644
--- a/src/shared/agent-title-identity.ts
+++ b/src/shared/agent-title-identity.ts
@@ -3,7 +3,7 @@ import {
   CLAUDE_IDLE,
   DROID_AGENT_NAME_RE,
   HERMES_AGENT_NAME_RE,
-  containsBrailleSpinner,
+  containsAgentSpinnerGlyph,
   isClaudeManagementTitle,
   isCursorAgentTitle,
   isGeminiTerminalTitle,
@@ -31,7 +31,7 @@ export function isClaudeAgent(title: string): boolean {
   if (title.startsWith('. ') || title.startsWith('* ')) {
     return true
   }
-  if (containsBrailleSpinner(title)) {
+  if (containsAgentSpinnerGlyph(title)) {
     // Why: named non-Claude agents carry braille spinners too. Gate Cursor by its
     // identity title, not the token, so a Claude title mentioning a cursor stays Claude.
     return !isCursorAgentTitle(title) && !lower.includes('openclaude')
diff --git a/src/shared/agent-title-status.ts b/src/shared/agent-title-status.ts
index 09ffc07a677..5c13bb56e95 100644
--- a/src/shared/agent-title-status.ts
+++ b/src/shared/agent-title-status.ts
@@ -9,12 +9,14 @@ import {
   GEMINI_SILENT_WORKING,
   GEMINI_WORKING,
   HERMES_AGENT_NAME_RE,
+  QUARTER_CIRCLE_SPINNER_RE,
   STRONG_IDLE_KEYWORDS_RE,
   STRONG_WORKING_KEYWORDS_RE,
   STRONG_WORKING_KEYWORDS_RE_GLOBAL,
   containsAgentName,
+  containsAgentSpinnerGlyph,
   containsAny,
-  containsBrailleSpinner,
+  containsQuarterCircleSpinner,
   containsLegacyAgentName,
   isClaudeManagementTitle,
   isGeminiTerminalTitle,
@@ -22,6 +24,7 @@ import {
   isPiTerminalTitle
 } from './agent-title-core'
 import type { AgentStatus } from './agent-title-core'
+import { isOpenCodeNativeTitle } from './opencode-terminal-title'
 import { getPiCompatibleSyntheticAgentStatus } from './pi-compatible-synthetic-title'
 import { isGrokRotatingWorkingTitle } from './terminal-title-agent-type'
 
@@ -34,6 +37,7 @@ export function clearWorkingIndicators(title: string): string {
   cleaned = cleaned.replace(GEMINI_WORKING, '')
   cleaned = cleaned.replace(GEMINI_SILENT_WORKING, '')
   cleaned = cleaned.replace(BRAILLE_SPINNER_RE, '')
+  cleaned = cleaned.replace(QUARTER_CIRCLE_SPINNER_RE, '')
   if (cleaned.startsWith('. ')) {
     cleaned = cleaned.slice(2)
   }
@@ -158,6 +162,10 @@ export function detectAgentStatusFromTitle(title: string): AgentStatus | null {
     return null
   }
 
+  if (isOpenCodeNativeTitle(title)) {
+    return containsAgentSpinnerGlyph(title) ? 'working' : 'idle'
+  }
+
   if (title.includes(GEMINI_PERMISSION)) {
     return 'permission'
   }
@@ -181,10 +189,9 @@ export function detectAgentStatusFromTitle(title: string): AgentStatus | null {
   if (isPiTerminalTitle(title)) {
     return 'idle'
   }
-  if (containsBrailleSpinner(title)) {
+  if (containsAgentSpinnerGlyph(title)) {
     return 'working'
   }
-
   const hasDroidAgentName = DROID_AGENT_NAME_RE.test(title)
   const hasHermesAgentName = HERMES_AGENT_NAME_RE.test(title)
   const hasAgyAgentName = AGY_AGENT_NAME_RE.test(title)
@@ -217,3 +224,15 @@ export function detectAgentStatusFromTitle(title: string): AgentStatus | null {
 
   return 'idle'
 }
+
+/**
+ * True when a quarter-circle spinner frame is the only agent evidence a title carries.
+ * Any TUI animates those glyphs, so they prove activity, not identity — callers that
+ * authorize writes into the pane need independent evidence (STA-4028, regression #13925).
+ */
+export function isQuarterCircleSpinnerOnlyAgentTitle(title: string | null | undefined): boolean {
+  if (!title || !containsQuarterCircleSpinner(title)) {
+    return false
+  }
+  return detectAgentStatusFromTitle(title.replace(QUARTER_CIRCLE_SPINNER_RE, '').trim()) === null
+}
diff --git a/src/shared/agent-tui-command-typing.ts b/src/shared/agent-tui-command-typing.ts
new file mode 100644
index 00000000000..389d7e03141
--- /dev/null
+++ b/src/shared/agent-tui-command-typing.ts
@@ -0,0 +1,43 @@
+import { AGENT_TUI_CLEAR_INPUT_LINE } from './agent-tui-input-clear'
+
+export type AgentTuiCommandWriteOutcome = 'accepted' | 'rejected' | 'unknown'
+
+export const AGENT_TUI_COMMAND_KEY_INTERVAL_MS = 16
+
+function waitForNextKey(signal?: AbortSignal): Promise<boolean> {
+  if (signal?.aborted) {
+    return Promise.resolve(false)
+  }
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => finish(true), AGENT_TUI_COMMAND_KEY_INTERVAL_MS)
+    const finish = (completed: boolean): void => {
+      clearTimeout(timer)
+      signal?.removeEventListener('abort', onAbort)
+      resolve(completed)
+    }
+    const onAbort = (): void => finish(false)
+    signal?.addEventListener('abort', onAbort, { once: true })
+  })
+}
+
+/** Sends one PTY write per key so slash-command TUIs do not classify it as pasted prose. */
+export async function typeAgentTuiCommand(args: {
+  command: string
+  write: (key: string) => Promise<AgentTuiCommandWriteOutcome>
+  signal?: AbortSignal
+}): Promise<AgentTuiCommandWriteOutcome> {
+  const keys = [AGENT_TUI_CLEAR_INPUT_LINE, ...args.command, '\r']
+  for (let index = 0; index < keys.length; index += 1) {
+    if (args.signal?.aborted) {
+      return 'rejected'
+    }
+    const outcome = await args.write(keys[index]!)
+    if (outcome !== 'accepted') {
+      return outcome
+    }
+    if (index < keys.length - 1 && !(await waitForNextKey(args.signal))) {
+      return 'rejected'
+    }
+  }
+  return 'accepted'
+}
diff --git a/src/shared/ai-vault-resume-command.ts b/src/shared/ai-vault-resume-command.ts
index 17dd6ba7c66..13c33b8145e 100644
--- a/src/shared/ai-vault-resume-command.ts
+++ b/src/shared/ai-vault-resume-command.ts
@@ -4,6 +4,7 @@
 import { TUI_AGENT_CONFIG } from './tui-agent-config'
 import {
   commandSeparator,
+  isPosixStartupShell,
   quoteStartupArg,
   type AgentStartupShell
 } from './tui-agent-startup-shell'
@@ -98,7 +99,7 @@ function buildResumeShellCommandForShell(args: {
   shell: Exclude<AgentStartupShell, 'cmd'>
 }): string {
   const { cwd, codexHome, shell } = args
-  if (shell === 'posix') {
+  if (isPosixStartupShell(shell)) {
     // Why: git-bash on a Windows host runs a POSIX shell, so reuse the same
     // inline-env + `cd '<cwd>'` prefix as the non-Windows path.
     const envPrefix = codexHome ? `CODEX_HOME=${quoteStartupArg(codexHome, shell)} ` : ''
diff --git a/src/shared/automation-schedules.ts b/src/shared/automation-schedules.ts
index e41ba3ac028..d8a93499287 100644
--- a/src/shared/automation-schedules.ts
+++ b/src/shared/automation-schedules.ts
@@ -301,7 +301,7 @@ export function parseAutomationRrule(rrule: string): {
   }
   const dayCode = rule.byDay[0]
   const dayOfWeek = DAY_CODES.indexOf(dayCode as (typeof DAY_CODES)[number])
-  if (dayOfWeek < 0) {
+  if (dayOfWeek === -1) {
     throw new Error('Invalid recurrence day.')
   }
   return {
diff --git a/src/shared/bitbucket-credentials.ts b/src/shared/bitbucket-credentials.ts
new file mode 100644
index 00000000000..90ae6223153
--- /dev/null
+++ b/src/shared/bitbucket-credentials.ts
@@ -0,0 +1,28 @@
+export type BitbucketAuthMode = 'token' | 'basic'
+
+// Where the active credential comes from. Drives whether the UI offers
+// Disconnect, which is only meaningful for in-app `stored` credentials.
+export type BitbucketCredentialSource = 'environment' | 'stored' | 'none'
+
+export type BitbucketConnectArgs = {
+  authMode: BitbucketAuthMode
+  accessToken?: string | null
+  email?: string | null
+  apiToken?: string | null
+  baseUrl?: string | null
+}
+
+// Deliberately excludes the secret: it never crosses the IPC boundary back to
+// the renderer.
+export type BitbucketConnectionStatus = {
+  configured: boolean
+  source: BitbucketCredentialSource
+  account: string | null
+  authMode: BitbucketAuthMode | null
+  email: string | null
+  baseUrl: string | null
+}
+
+export type BitbucketConnectResult =
+  | { ok: true; account: string | null }
+  | { ok: false; error: string }
diff --git a/src/shared/browser-page-zoom.ts b/src/shared/browser-page-zoom.ts
index 28997ebab4a..83a23d90752 100644
--- a/src/shared/browser-page-zoom.ts
+++ b/src/shared/browser-page-zoom.ts
@@ -23,7 +23,7 @@ export function normalizeBrowserPageZoomLevel(value: unknown): number {
 export function browserPageZoomLevelToPercent(level: number): number {
   // Why: Electron zoom levels are exponential; show the same percentage users
   // expect from Chromium browser zoom controls.
-  return Math.round(100 * Math.pow(1.2, normalizeBrowserPageZoomLevel(level)))
+  return Math.round(100 * 1.2 ** normalizeBrowserPageZoomLevel(level))
 }
 
 export function nextBrowserPageZoomLevel(
diff --git a/src/shared/browser-url.test.ts b/src/shared/browser-url.test.ts
index 4a246355fea..27437766867 100644
--- a/src/shared/browser-url.test.ts
+++ b/src/shared/browser-url.test.ts
@@ -222,6 +222,21 @@ describe('browser-url helpers', () => {
     expect(buildSearchUrl('hello world', 'kagi')).toBe('https://kagi.com/search?q=hello%20world')
   })
 
+  it('encodes Unicode, reserved characters, and emoji for every search engine', () => {
+    const query = 'snow 雪 &?# 😀'
+    const encoded = 'snow%20%E9%9B%AA%20%26%3F%23%20%F0%9F%98%80'
+    for (const engine of ['google', 'duckduckgo', 'bing', 'kagi'] as const) {
+      expect(buildSearchUrl(query, engine)).toContain(encoded)
+    }
+  })
+
+  it('replaces unmatched surrogates without changing valid pairs', () => {
+    expect(buildSearchUrl('\ud800a\udc00😀', 'google')).toBe(
+      'https://www.google.com/search?q=%EF%BF%BDa%EF%BF%BD%F0%9F%98%80'
+    )
+    expect(buildSearchUrl('\ud800', 'google')).toBe('https://www.google.com/search?q=%EF%BF%BD')
+  })
+
   it('uses a Kagi private session link when configured', () => {
     const sessionLink = 'https://kagi.com/search?token=secret&q=%s#ignored'
     expect(normalizeKagiSessionLink(sessionLink)).toBe('https://kagi.com/search?token=secret')
diff --git a/src/shared/browser-url.ts b/src/shared/browser-url.ts
index 7eb2ca6ebe1..f0583a8b1ab 100644
--- a/src/shared/browser-url.ts
+++ b/src/shared/browser-url.ts
@@ -223,7 +223,7 @@ export function buildSearchUrl(
       return sessionSearchUrl
     }
   }
-  return `${SEARCH_ENGINE_URLS[engine]}${encodeURIComponent(query)}`
+  return `${SEARCH_ENGINE_URLS[engine]}${encodeURIComponent(query.toWellFormed())}`
 }
 
 export function looksLikeSearchQuery(input: string): boolean {
diff --git a/src/shared/check-job-log-tail-slice.ts b/src/shared/check-job-log-tail-slice.ts
index a5a9f483b1f..2c4e0a61e20 100644
--- a/src/shared/check-job-log-tail-slice.ts
+++ b/src/shared/check-job-log-tail-slice.ts
@@ -1,3 +1,5 @@
+import { clampUtf8TextTail, getUtf8ByteLength } from './utf8-byte-limits'
+
 export const PR_CHECK_LOG_TAIL_LINES = 200
 export const PR_CHECK_LOG_TAIL_RECENT_LINES = 100
 export const PR_CHECK_LOG_TAIL_BYTES = 16 * 1024
@@ -10,47 +12,23 @@ export const PR_CHECK_LOG_TAIL_EARLIER_SEPARATOR = '… earlier errors …'
 const ERROR_LINE_PATTERN =
   /(?:##\[error\]|::error::|::error\b|\berror:|FAILED|exit code|ENOENT|EACCES|panic:|AssertionError)/i
 
-// Why: this slicer runs in main (GitHub/GitLab log fetches) and in the renderer
-// (defensive re-slice of traces from older remote runtimes), so no Buffer.
-function utf8ByteLength(text: string): number {
-  let bytes = 0
-  for (const character of text) {
-    const codePoint = character.codePointAt(0) ?? 0
-    bytes += codePoint < 0x80 ? 1 : codePoint < 0x800 ? 2 : codePoint < 0x10000 ? 3 : 4
-  }
-  return bytes
-}
-
 function applyLogTailByteCap(text: string): string {
-  if (utf8ByteLength(text) <= PR_CHECK_LOG_TAIL_BYTES) {
+  if (getUtf8ByteLength(text) <= PR_CHECK_LOG_TAIL_BYTES) {
     return text
   }
-  return sliceTrailingTextByUtf8Bytes(text, PR_CHECK_LOG_TAIL_BYTES)
-}
-
-function sliceTrailingTextByUtf8Bytes(text: string, byteLimit: number): string {
-  let byteLength = 0
-  const characters = Array.from(text)
-  for (let index = characters.length - 1; index >= 0; index -= 1) {
-    const characterByteLength = utf8ByteLength(characters[index] ?? '')
-    if (byteLength + characterByteLength > byteLimit) {
-      return characters.slice(index + 1).join('')
-    }
-    byteLength += characterByteLength
-  }
-  return text
+  return clampUtf8TextTail(text, PR_CHECK_LOG_TAIL_BYTES).text
 }
 
 function joinLogExcerptWithByteCap(prefixLines: string[], recentLines: string[]): string {
   const prefix = prefixLines.join('\n')
-  const prefixByteLength = utf8ByteLength(prefix)
+  const prefixByteLength = getUtf8ByteLength(prefix)
   if (prefixByteLength >= PR_CHECK_LOG_TAIL_BYTES) {
-    return sliceTrailingTextByUtf8Bytes(prefix, PR_CHECK_LOG_TAIL_BYTES)
+    return clampUtf8TextTail(prefix, PR_CHECK_LOG_TAIL_BYTES).text
   }
 
   const separator = prefix.length > 0 && recentLines.length > 0 ? '\n' : ''
-  const recentBudget = PR_CHECK_LOG_TAIL_BYTES - prefixByteLength - utf8ByteLength(separator)
-  const recentTail = sliceTrailingTextByUtf8Bytes(recentLines.join('\n'), recentBudget)
+  const recentBudget = PR_CHECK_LOG_TAIL_BYTES - prefixByteLength - getUtf8ByteLength(separator)
+  const recentTail = clampUtf8TextTail(recentLines.join('\n'), recentBudget).text
   return `${prefix}${separator}${recentTail}`
 }
 
diff --git a/src/shared/client-environment-info.test.ts b/src/shared/client-environment-info.test.ts
new file mode 100644
index 00000000000..8858fe2ada5
--- /dev/null
+++ b/src/shared/client-environment-info.test.ts
@@ -0,0 +1,109 @@
+import { describe, expect, it } from 'vitest'
+import {
+  appendClientEnvironmentFooter,
+  formatClientEnvironmentFooter,
+  formatClientEnvironmentInfo,
+  hasClientEnvironmentFooter,
+  stripClientEnvironmentFooter
+} from './client-environment-info'
+
+const SAMPLE = {
+  appVersion: '1.4.178-rc.2',
+  platform: 'win32',
+  osRelease: '10.0.22631',
+  arch: 'x64',
+  shell: 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'
+} as const
+
+describe('formatClientEnvironmentInfo', () => {
+  it('formats version, OS, and optional shell for copy-paste', () => {
+    expect(formatClientEnvironmentInfo(SAMPLE)).toBe(
+      [
+        'Orca: 1.4.178-rc.2',
+        'OS: win32 10.0.22631 (x64)',
+        'Shell: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'
+      ].join('\n')
+    )
+  })
+
+  it('omits shell when unset and falls back unknown fields', () => {
+    expect(
+      formatClientEnvironmentInfo({
+        appVersion: '',
+        platform: 'darwin',
+        osRelease: '',
+        arch: 'arm64'
+      })
+    ).toBe(['Orca: unknown', 'OS: darwin (arm64)'].join('\n'))
+  })
+
+  it('keeps environment-controlled values on one line', () => {
+    expect(
+      formatClientEnvironmentInfo({
+        appVersion: '1.2.3\nInjected: value',
+        platform: 'linux',
+        osRelease: '6.8\r\nExtra',
+        arch: 'x64',
+        shell: '/bin/zsh\nMore: data'
+      })
+    ).toBe(
+      [
+        'Orca: 1.2.3 Injected: value',
+        'OS: linux 6.8 Extra (x64)',
+        'Shell: /bin/zsh More: data'
+      ].join('\n')
+    )
+  })
+})
+
+describe('environment footer helpers', () => {
+  it('builds a marked footer and detects when one is already present', () => {
+    const footer = formatClientEnvironmentFooter(SAMPLE)
+    expect(footer.startsWith('---\nOrca:')).toBe(true)
+    expect(hasClientEnvironmentFooter(`oops\n\n${footer}`)).toBe(true)
+    expect(hasClientEnvironmentFooter('oops')).toBe(false)
+  })
+
+  it('appends a footer once and leaves existing footers alone', () => {
+    const withFooter = appendClientEnvironmentFooter({
+      message: 'Working directory missing.',
+      info: SAMPLE
+    })
+    expect(withFooter).toContain('Working directory missing.')
+    expect(withFooter).toContain('Orca: 1.4.178-rc.2')
+    expect(appendClientEnvironmentFooter({ message: withFooter, info: SAMPLE })).toBe(withFooter)
+  })
+
+  it('treats footer-only text as empty user feedback', () => {
+    const footer = formatClientEnvironmentFooter(SAMPLE)
+    expect(stripClientEnvironmentFooter(`\n\n${footer}\n`).trim()).toBe('')
+    expect(stripClientEnvironmentFooter(`please fix tabs\n\n${footer}`).trimEnd()).toBe(
+      'please fix tabs'
+    )
+    expect(stripClientEnvironmentFooter(footer).trim()).toBe('')
+  })
+
+  it('counts authored text above or below the footer as user feedback', () => {
+    const footer = formatClientEnvironmentFooter(SAMPLE)
+    expect(hasClientEnvironmentFooter(`\n\n${footer}\ntyped below`)).toBe(true)
+    expect(stripClientEnvironmentFooter(`\n\n${footer}\ntyped below`).trim()).toBe('typed below')
+    expect(stripClientEnvironmentFooter(`actual report\n\n${footer}`).trim()).toBe('actual report')
+    expect(
+      stripClientEnvironmentFooter(`above\n\n${footer}\nbelow`).replace(/\n+/g, ' ').trim()
+    ).toBe('above below')
+  })
+
+  it('still detects an edited footer block', () => {
+    const editedFooter = ['---', 'Orca: locally-built', 'OS: edited by user'].join('\n')
+
+    expect(hasClientEnvironmentFooter(editedFooter)).toBe(true)
+    expect(stripClientEnvironmentFooter(editedFooter).trim()).toBe('')
+  })
+
+  it('treats a report as user text after the footer is deleted', () => {
+    const withoutFooter = 'Tabs hang after waking the laptop.'
+
+    expect(hasClientEnvironmentFooter(withoutFooter)).toBe(false)
+    expect(stripClientEnvironmentFooter(withoutFooter)).toBe(withoutFooter)
+  })
+})
diff --git a/src/shared/client-environment-info.ts b/src/shared/client-environment-info.ts
new file mode 100644
index 00000000000..7198a013e78
--- /dev/null
+++ b/src/shared/client-environment-info.ts
@@ -0,0 +1,62 @@
+/** Copy-pasteable client environment fields for bug reports and feedback. */
+export type ClientEnvironmentInfo = {
+  appVersion: string
+  platform: string
+  osRelease: string
+  arch: string
+  /** Login/default shell path when known (e.g. SHELL / ComSpec / spawn shell). */
+  shell?: string
+}
+
+const FOOTER_MARKER = '---'
+const ORCA_LINE_PREFIX = 'Orca:'
+
+// Why: match the whole prefilled block (optional Shell line included) so strip
+// keeps authored text both above and below — users who click past the footer
+// and type must still be able to send.
+const CLIENT_ENVIRONMENT_FOOTER_BLOCK =
+  /(^|\r?\n)---\r?\nOrca:[^\r\n]*\r?\nOS:[^\r\n]*(?:\r?\nShell:[^\r\n]*)?/
+
+function normalizeEnvironmentValue(value: string): string {
+  return value.trim().replace(/[\r\n]+/g, ' ')
+}
+
+export function formatClientEnvironmentInfo(info: ClientEnvironmentInfo): string {
+  const version = normalizeEnvironmentValue(info.appVersion) || 'unknown'
+  const platform = normalizeEnvironmentValue(info.platform) || 'unknown'
+  const osRelease = normalizeEnvironmentValue(info.osRelease)
+  const arch = normalizeEnvironmentValue(info.arch)
+  const osParts = [platform, osRelease, arch ? `(${arch})` : ''].filter(Boolean)
+  const lines = [`${ORCA_LINE_PREFIX} ${version}`, `OS: ${osParts.join(' ')}`]
+  const shell = info.shell ? normalizeEnvironmentValue(info.shell) : ''
+  if (shell) {
+    lines.push(`Shell: ${shell}`)
+  }
+  return lines.join('\n')
+}
+
+/** Block appended under error/feedback bodies so reporters always paste env details. */
+export function formatClientEnvironmentFooter(info: ClientEnvironmentInfo): string {
+  return `${FOOTER_MARKER}\n${formatClientEnvironmentInfo(info)}`
+}
+
+export function hasClientEnvironmentFooter(text: string): boolean {
+  return CLIENT_ENVIRONMENT_FOOTER_BLOCK.test(text)
+}
+
+/** Drop only the env footer block; keep user text above and below it. */
+export function stripClientEnvironmentFooter(text: string): string {
+  return text.replace(CLIENT_ENVIRONMENT_FOOTER_BLOCK, '$1')
+}
+
+export function appendClientEnvironmentFooter(params: {
+  message: string
+  info: ClientEnvironmentInfo
+}): string {
+  if (hasClientEnvironmentFooter(params.message)) {
+    return params.message
+  }
+  const footer = formatClientEnvironmentFooter(params.info)
+  const base = params.message.trimEnd()
+  return base.length > 0 ? `${base}\n\n${footer}` : footer
+}
diff --git a/src/shared/clipboard-text.ts b/src/shared/clipboard-text.ts
index 18425efe4cd..c5d641e93d6 100644
--- a/src/shared/clipboard-text.ts
+++ b/src/shared/clipboard-text.ts
@@ -1,4 +1,10 @@
 import { yieldToEventLoop } from './event-loop-yield'
+import {
+  getUtf8ByteLengthForCodePoint,
+  measureUtf8ByteLength,
+  readUtf8CodePointAt,
+  type Utf8ByteLengthMeasurement
+} from './utf8-byte-limits'
 
 export const CLIPBOARD_TEXT_READ_MAX_BYTES = 16 * 1024 * 1024
 export const CLIPBOARD_TEXT_WRITE_MAX_BYTES = 16 * 1024 * 1024
@@ -14,28 +20,13 @@ export type WriteClipboardTextOptions = {
   maxBytes?: number
 }
 
-export type ClipboardTextByteLengthMeasurement = {
-  byteLength: number
-  exceededLimit: boolean
-}
+export type ClipboardTextByteLengthMeasurement = Utf8ByteLengthMeasurement
 
 export function measureClipboardTextByteLength(
   text: string,
   options: { stopAfterBytes?: number } = {}
 ): ClipboardTextByteLengthMeasurement {
-  const stopAfterBytes = options.stopAfterBytes
-  let byteLength = 0
-  for (let index = 0; index < text.length; index += 1) {
-    const codePoint = text.codePointAt(index) ?? 0
-    byteLength += getUtf8ByteLengthForCodePoint(codePoint)
-    if (Number.isFinite(stopAfterBytes) && byteLength > (stopAfterBytes ?? 0)) {
-      return { byteLength, exceededLimit: true }
-    }
-    if (codePoint > 0xffff) {
-      index += 1
-    }
-  }
-  return { byteLength, exceededLimit: false }
+  return measureUtf8ByteLength(text, options)
 }
 
 export function getClipboardTextByteLength(text: string): number {
@@ -60,7 +51,7 @@ export async function measureClipboardTextByteLengthWithYield(
   let byteLength = 0
 
   for (let index = 0; index < text.length; index += 1) {
-    const codePoint = text.codePointAt(index) ?? 0
+    const codePoint = readUtf8CodePointAt(text, index)
     byteLength += getUtf8ByteLengthForCodePoint(codePoint)
     if (Number.isFinite(stopAfterBytes) && byteLength > (stopAfterBytes ?? 0)) {
       return { byteLength, exceededLimit: true }
@@ -172,16 +163,3 @@ export function isClipboardTextTooLargeError(error: unknown): boolean {
 export function isClipboardTextWriteTooLargeError(error: unknown): boolean {
   return error instanceof Error && error.message.includes(CLIPBOARD_TEXT_WRITE_TOO_LARGE_ERROR)
 }
-
-function getUtf8ByteLengthForCodePoint(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
diff --git a/src/shared/commit-message-prompt.test.ts b/src/shared/commit-message-prompt.test.ts
index 407b604f76d..ba2a975190f 100644
--- a/src/shared/commit-message-prompt.test.ts
+++ b/src/shared/commit-message-prompt.test.ts
@@ -250,27 +250,67 @@ describe('excerptAgentFailureOutput', () => {
 describe('tokenizeCustomCommandTemplate', () => {
   it('splits on whitespace', () => {
     const r = tokenizeCustomCommandTemplate('claude -p')
-    expect(r).toEqual({ ok: true, tokens: ['claude', '-p'] })
+    expect(r).toEqual({ ok: true, tokens: ['claude', '-p'], spans: expect.any(Array) })
   })
 
   it('groups double-quoted segments with spaces', () => {
     const r = tokenizeCustomCommandTemplate('claude --msg "hello world"')
-    expect(r).toEqual({ ok: true, tokens: ['claude', '--msg', 'hello world'] })
+    expect(r).toEqual({
+      ok: true,
+      tokens: ['claude', '--msg', 'hello world'],
+      spans: expect.any(Array)
+    })
   })
 
   it('groups single-quoted segments verbatim', () => {
     const r = tokenizeCustomCommandTemplate(`agent --json '{"k":"v"}'`)
-    expect(r).toEqual({ ok: true, tokens: ['agent', '--json', '{"k":"v"}'] })
+    expect(r).toEqual({
+      ok: true,
+      tokens: ['agent', '--json', '{"k":"v"}'],
+      spans: expect.any(Array)
+    })
   })
 
   it('honors backslash escapes inside double quotes', () => {
     const r = tokenizeCustomCommandTemplate('claude --msg "she said \\"hi\\""')
-    expect(r).toEqual({ ok: true, tokens: ['claude', '--msg', 'she said "hi"'] })
+    expect(r).toEqual({
+      ok: true,
+      tokens: ['claude', '--msg', 'she said "hi"'],
+      spans: expect.any(Array)
+    })
   })
 
   it('keeps adjacent quoted/unquoted regions in one token (a"b"c → abc)', () => {
     const r = tokenizeCustomCommandTemplate('foo a"b"c')
-    expect(r).toEqual({ ok: true, tokens: ['foo', 'abc'] })
+    expect(r).toEqual({ ok: true, tokens: ['foo', 'abc'], spans: expect.any(Array) })
+  })
+
+  it('always reports one span per token', () => {
+    for (const source of ['claude -p', 'claude --msg "hello world"', 'foo a"b"c', '   \t  ']) {
+      const r = tokenizeCustomCommandTemplate(source)
+      expect(r.ok && r.spans.length).toBe(r.ok && r.tokens.length)
+    }
+  })
+
+  it('reports source spans covering each raw token including quotes', () => {
+    const source = 'claude --msg "hello world"'
+    const r = tokenizeCustomCommandTemplate(source)
+    expect(r).toEqual({
+      ok: true,
+      tokens: ['claude', '--msg', 'hello world'],
+      spans: [
+        { start: 0, end: 6, divergesFromShell: false },
+        { start: 7, end: 12, divergesFromShell: false },
+        { start: 13, end: 26, divergesFromShell: false }
+      ]
+    })
+    if (r.ok) {
+      expect(r.spans.map(({ start, end }) => source.slice(start, end))).toEqual([
+        'claude',
+        '--msg',
+        '"hello world"'
+      ])
+    }
   })
 
   it('returns an error for an unclosed quote', () => {
@@ -283,7 +323,7 @@ describe('tokenizeCustomCommandTemplate', () => {
 
   it('returns an empty token list for whitespace-only input', () => {
     const r = tokenizeCustomCommandTemplate('   \t  ')
-    expect(r).toEqual({ ok: true, tokens: [] })
+    expect(r).toEqual({ ok: true, tokens: [], spans: [] })
   })
 })
 
diff --git a/src/shared/commit-message-prompt.ts b/src/shared/commit-message-prompt.ts
index 4a034d2d53f..82dc830fd59 100644
--- a/src/shared/commit-message-prompt.ts
+++ b/src/shared/commit-message-prompt.ts
@@ -131,8 +131,16 @@ export function truncateDiffForPrompt(
 
 export const CUSTOM_PROMPT_PLACEHOLDER = '{prompt}'
 
+/** Source range of a token: [start, end) offsets into the original string.
+ * `divergesFromShell` marks a token this tokenizer cannot model faithfully for
+ * the target shell: an unquoted operator (`;&|<>`), a word-leading `#`
+ * comment, an expansion opener whose body can span tokens (backtick, `$(`,
+ * `${`, quoted or not), or a cmd single-quoted region (cmd has no
+ * single-quote syntax). Not recoverable from the token value alone. */
+export type CommandTokenSpan = { start: number; end: number; divergesFromShell: boolean }
+
 export type TokenizeCustomCommandResult =
-  | { ok: true; tokens: string[] }
+  | { ok: true; tokens: string[]; spans: CommandTokenSpan[] }
   | { ok: false; error: string }
 
 // Why: deliberately POSIX-shell-style only for *grouping* (single + double
@@ -143,8 +151,11 @@ export type TokenizeCustomCommandResult =
 // surface we don't need.
 export function tokenizeCustomCommandTemplate(template: string): TokenizeCustomCommandResult {
   const tokens: string[] = []
+  const spans: CommandTokenSpan[] = []
   let current = ''
   let inToken = false
+  let tokenStart = 0
+  let divergesFromShell = false
   let quote: '"' | "'" | null = null
   let i = 0
 
@@ -152,10 +163,17 @@ export function tokenizeCustomCommandTemplate(template: string): TokenizeCustomC
     const ch = template[i]
     if (quote) {
       if (ch === '\\' && quote === '"' && i + 1 < template.length) {
+        // Why: inside double quotes the shell only consumes the backslash
+        // before these; elsewhere it stays a literal byte this tokenizer drops.
+        divergesFromShell ||= !'$`"\\'.includes(template[i + 1])
         current += template[i + 1]
         i += 2
         continue
       }
+      // Why: a `"` inside $(…) or `…` re-opens a nested quoting context in the
+      // real shell, so this tokenizer's word boundaries stop matching it.
+      divergesFromShell ||=
+        quote === '"' && (ch === '`' || (ch === '$' && '({'.includes(template[i + 1] ?? '\0')))
       if (ch === quote) {
         quote = null
         i++
@@ -171,13 +189,22 @@ export function tokenizeCustomCommandTemplate(template: string): TokenizeCustomC
 
     if (ch === '"' || ch === "'") {
       quote = ch
+      if (!inToken) {
+        tokenStart = i
+      }
       inToken = true
       i++
       continue
     }
 
     if (ch === '\\' && i + 1 < template.length) {
+      // Why: an unquoted line continuation joins words the shell splits, so a
+      // selector can hide inside the joined token and skip the gap check.
+      divergesFromShell ||= template[i + 1] === '\n'
       current += template[i + 1]
+      if (!inToken) {
+        tokenStart = i
+      }
       inToken = true
       i += 2
       continue
@@ -186,13 +213,25 @@ export function tokenizeCustomCommandTemplate(template: string): TokenizeCustomC
     if (/\s/.test(ch)) {
       if (inToken) {
         tokens.push(current)
+        spans.push({ start: tokenStart, end: i, divergesFromShell })
         current = ''
         inToken = false
+        divergesFromShell = false
       }
       i++
       continue
     }
 
+    if (!inToken) {
+      tokenStart = i
+    }
+    // Why: a trailing unpaired escape swallows whatever a consumer appends
+    // after the base, so the base is not safe to build on.
+    divergesFromShell ||= ch === '\\' && i + 1 >= template.length
+    divergesFromShell ||=
+      ';&|<>`'.includes(ch) ||
+      (ch === '#' && !inToken) ||
+      (ch === '$' && '({\'"'.includes(template[i + 1] ?? '\0'))
     current += ch
     inToken = true
     i++
@@ -203,8 +242,9 @@ export function tokenizeCustomCommandTemplate(template: string): TokenizeCustomC
   }
   if (inToken) {
     tokens.push(current)
+    spans.push({ start: tokenStart, end: template.length, divergesFromShell })
   }
-  return { ok: true, tokens }
+  return { ok: true, tokens, spans }
 }
 
 export type CustomCommandPlan =
diff --git a/src/shared/constants.ts b/src/shared/constants.ts
index d9a17c103f5..8da7cb5b9d1 100644
--- a/src/shared/constants.ts
+++ b/src/shared/constants.ts
@@ -480,6 +480,7 @@ export function getDefaultUIState(): PersistedUIState {
     hideAutomationGeneratedWorkspaces: false,
     hideCliCreatedWorkspaces: false,
     hideDetachedHeadWorkspaces: false,
+    hideWorkspacesFromOtherDevices: false,
     alwaysShowDefaultBranchWorkspace: true,
     showDotfilesByWorktree: {},
     filterRepoIds: [],
diff --git a/src/shared/cross-platform-path.test.ts b/src/shared/cross-platform-path.test.ts
index 398de1913a0..b817459301e 100644
--- a/src/shared/cross-platform-path.test.ts
+++ b/src/shared/cross-platform-path.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import {
+  areLocalWindowsWslPathAliases,
   isCaseInsensitiveRuntimeRoot,
   isPathInsideOrEqual,
   isRuntimePathAbsolute,
@@ -8,6 +9,32 @@ import {
   resolveRuntimePath
 } from './cross-platform-path'
 
+describe('local Windows WSL aliases', () => {
+  it('matches UNC aliases and mounted drives without folding Linux path case', () => {
+    expect(
+      areLocalWindowsWslPathAliases(
+        '//wsl.localhost/Ubuntu/home/Alice/file.ts',
+        '\\\\wsl$\\ubuntu\\home\\Alice\\file.ts'
+      )
+    ).toBe(true)
+    expect(
+      areLocalWindowsWslPathAliases(
+        '//wsl.localhost/Ubuntu/home/Alice/file.ts',
+        '\\\\wsl.localhost\\Ubuntu\\home\\alice\\file.ts'
+      )
+    ).toBe(false)
+    expect(
+      areLocalWindowsWslPathAliases(
+        '//wsl.localhost/Ubuntu/mnt/c/repo/file.ts',
+        'C:\\repo\\file.ts'
+      )
+    ).toBe(true)
+    expect(
+      areLocalWindowsWslPathAliases('//server/share/file.ts', '\\\\server\\share\\file.ts')
+    ).toBe(false)
+  })
+})
+
 describe('isCaseInsensitiveRuntimeRoot', () => {
   it('folds Windows drive and plain UNC roots', () => {
     expect(isCaseInsensitiveRuntimeRoot('C:\\repos\\app')).toBe(true)
diff --git a/src/shared/cross-platform-path.ts b/src/shared/cross-platform-path.ts
index 3ef49e310e0..aad0981c3a1 100644
--- a/src/shared/cross-platform-path.ts
+++ b/src/shared/cross-platform-path.ts
@@ -1,4 +1,4 @@
-import { isWslUncPath } from './wsl-paths'
+import { isWslUncPath, parseWslUncPath, toWindowsWslPath } from './wsl-paths'
 
 const SLASH_CHAR_CODE = '/'.charCodeAt(0)
 
@@ -56,6 +56,33 @@ export function normalizeRuntimePathForComparison(rawValue: string): string {
   return isWindowsPath ? normalized.toLowerCase() : normalized
 }
 
+export function areLocalWindowsWslPathAliases(left: string, right: string): boolean {
+  const leftIdentity = getLocalWindowsWslPathIdentity(left)
+  const rightIdentity = getLocalWindowsWslPathIdentity(right)
+  return (
+    (leftIdentity.isWslUnc || rightIdentity.isWslUnc) &&
+    leftIdentity.aliasComparisonPath === rightIdentity.aliasComparisonPath
+  )
+}
+
+export type LocalWindowsWslPathIdentity = {
+  normalizedPath: string
+  aliasComparisonPath: string
+  isWslUnc: boolean
+}
+
+export function getLocalWindowsWslPathIdentity(value: string): LocalWindowsWslPathIdentity {
+  const wslPath = parseWslUncPath(value)
+  const normalizedPath = normalizeRuntimePathForComparison(value)
+  return {
+    normalizedPath,
+    aliasComparisonPath: wslPath
+      ? normalizeRuntimePathForComparison(toWindowsWslPath(wslPath.linuxPath, wslPath.distro))
+      : normalizedPath,
+    isWslUnc: wslPath !== null
+  }
+}
+
 export function isRuntimePathAbsolute(
   value: string,
   pathFlavor: 'posix' | 'windows' = isWindowsPathFlavor(value) ? 'windows' : 'posix'
diff --git a/src/shared/diff-comment-schema.ts b/src/shared/diff-comment-schema.ts
new file mode 100644
index 00000000000..369dda682c6
--- /dev/null
+++ b/src/shared/diff-comment-schema.ts
@@ -0,0 +1,19 @@
+import { z } from 'zod'
+
+export const DiffCommentSchema = z.object({
+  id: z.string(),
+  worktreeId: z.string(),
+  filePath: z.string(),
+  source: z.enum(['diff', 'markdown']).optional(),
+  selectedText: z.string().optional(),
+  startLine: z.number().int().positive().optional(),
+  lineNumber: z.number().int().positive(),
+  body: z.string(),
+  createdAt: z.number().finite(),
+  updatedAt: z.number().finite().optional(),
+  sentAt: z.number().finite().optional(),
+  scope: z.enum(['unstaged', 'staged', 'branch']).optional(),
+  oldPath: z.string().optional(),
+  diffIdentity: z.string().optional(),
+  side: z.literal('modified')
+})
diff --git a/src/shared/external-worktree-visibility.ts b/src/shared/external-worktree-visibility.ts
index be5d24a524c..3907d133a30 100644
--- a/src/shared/external-worktree-visibility.ts
+++ b/src/shared/external-worktree-visibility.ts
@@ -30,7 +30,7 @@ export function getExternalWorktreeParentPath(worktreePath: string | undefined):
     return `//${parts.slice(0, -1).join('/')}`
   }
   const lastSeparatorIndex = normalized.lastIndexOf('/')
-  if (lastSeparatorIndex < 0) {
+  if (lastSeparatorIndex === -1) {
     return UNKNOWN_EXTERNAL_WORKTREE_PARENT_PATH
   }
   if (lastSeparatorIndex === 0) {
diff --git a/src/shared/fish-binary-requirement.test.ts b/src/shared/fish-binary-requirement.test.ts
new file mode 100644
index 00000000000..e4d57bbf9e4
--- /dev/null
+++ b/src/shared/fish-binary-requirement.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest'
+import {
+  fishRequirementViolation,
+  REQUIRE_FISH_ENV_VAR,
+  resolveFishBinary,
+  type FishBinaryLookup
+} from './fish-binary-requirement'
+
+const FOUND: FishBinaryLookup = { available: true, path: '/usr/bin/fish', majorVersion: 4 }
+const MISSING: FishBinaryLookup = {
+  available: false,
+  path: null,
+  majorVersion: 0,
+  reason: 'no fish binary on PATH'
+}
+
+describe('fishRequirementViolation', () => {
+  it('lets a missing fish skip when the requirement is not set', () => {
+    expect(fishRequirementViolation(MISSING, {})).toBeNull()
+    expect(fishRequirementViolation(MISSING, { [REQUIRE_FISH_ENV_VAR]: '0' })).toBeNull()
+  })
+
+  // The #9993 guard is CI's only end-to-end coverage; a skip there is a silent gap.
+  it('reports a violation naming the reason when CI requires fish and it is absent', () => {
+    const violation = fishRequirementViolation(MISSING, { [REQUIRE_FISH_ENV_VAR]: '1' })
+    expect(violation).toContain(REQUIRE_FISH_ENV_VAR)
+    expect(violation).toContain('no fish binary on PATH')
+  })
+
+  it('reports no violation when fish is present, requirement set or not', () => {
+    expect(fishRequirementViolation(FOUND, { [REQUIRE_FISH_ENV_VAR]: '1' })).toBeNull()
+    expect(fishRequirementViolation(FOUND, {})).toBeNull()
+  })
+})
+
+describe('resolveFishBinary', () => {
+  it('treats an installed fish below the floor as unavailable, with the version in the reason', () => {
+    const lookup = resolveFishBinary(Number.MAX_SAFE_INTEGER)
+    if (lookup.available) {
+      throw new Error('no fish can satisfy an unreachable version floor')
+    }
+    // Only when a fish is actually installed does the reason describe a version.
+    if (lookup.majorVersion > 0) {
+      expect(lookup.reason).toContain(`fish ${Number.MAX_SAFE_INTEGER}+ required`)
+    }
+  })
+
+  it('never reports a path on Windows', () => {
+    if (process.platform !== 'win32') {
+      return
+    }
+    expect(resolveFishBinary().path).toBeNull()
+  })
+})
diff --git a/src/shared/fish-binary-requirement.ts b/src/shared/fish-binary-requirement.ts
new file mode 100644
index 00000000000..9045433956d
--- /dev/null
+++ b/src/shared/fish-binary-requirement.ts
@@ -0,0 +1,65 @@
+import { spawnSync } from 'node:child_process'
+
+/**
+ * Locates the fish binary live shell tests run against, and decides how strict
+ * they are about finding one.
+ *
+ * Why the strictness is configurable: on a developer machine without fish these
+ * suites must skip, but the `shell contracts` CI job is a required check whose
+ * fish lane is the only end-to-end guard for #9993. There, a skip would report
+ * green with nothing exercised, so ORCA_REQUIRE_FISH=1 turns it into a failure.
+ */
+const FISH_CANDIDATES = ['fish', '/opt/homebrew/bin/fish', '/usr/local/bin/fish'] as const
+
+/** Env var CI sets to make a missing or too-old fish fail instead of skip. */
+export const REQUIRE_FISH_ENV_VAR = 'ORCA_REQUIRE_FISH'
+
+export type FishBinaryLookup =
+  | { available: true; path: string; majorVersion: number }
+  | { available: false; path: null; majorVersion: number; reason: string }
+
+export function resolveFishBinary(minMajorVersion = 1): FishBinaryLookup {
+  if (process.platform === 'win32') {
+    return {
+      available: false,
+      path: null,
+      majorVersion: 0,
+      reason: 'fish is not supported on Windows'
+    }
+  }
+
+  for (const path of FISH_CANDIDATES) {
+    const probe = spawnSync(path, ['--version'], { encoding: 'utf8' })
+    if (probe.status !== 0) {
+      continue
+    }
+    const majorVersion = Number(/version (\d+)/.exec(probe.stdout ?? '')?.[1] ?? '0')
+    if (majorVersion < minMajorVersion) {
+      return {
+        available: false,
+        path: null,
+        majorVersion,
+        reason: `fish ${minMajorVersion}+ required, found ${probe.stdout?.trim() || 'an unknown version'} at ${path}`
+      }
+    }
+    return { available: true, path, majorVersion }
+  }
+
+  return { available: false, path: null, majorVersion: 0, reason: 'no fish binary on PATH' }
+}
+
+/**
+ * The message to fail with when CI demanded fish and did not get it, else null.
+ *
+ * Assert this in a test that always runs, so the requirement cannot vanish with
+ * the suite it guards.
+ */
+export function fishRequirementViolation(
+  lookup: FishBinaryLookup,
+  env: NodeJS.ProcessEnv = process.env
+): string | null {
+  if (lookup.available || env[REQUIRE_FISH_ENV_VAR] !== '1') {
+    return null
+  }
+  return `${REQUIRE_FISH_ENV_VAR}=1 but the live fish tests would skip: ${lookup.reason}`
+}
diff --git a/src/shared/folder-workspace-worktree.test.ts b/src/shared/folder-workspace-worktree.test.ts
index 0283208cd8f..270e62eb2ce 100644
--- a/src/shared/folder-workspace-worktree.test.ts
+++ b/src/shared/folder-workspace-worktree.test.ts
@@ -132,6 +132,17 @@ describe('folderWorkspaceToWorktree', () => {
     })
   })
 
+  it('projects runtime ownership from the folder execution host', () => {
+    const worktree = folderWorkspaceToWorktree(
+      makeFolderWorkspace({ executionHostId: 'runtime:shared%20server' })
+    )
+
+    expect(worktree).toMatchObject({
+      hostId: 'runtime:shared%20server',
+      runtimeOwnerEnvironmentId: 'shared server'
+    })
+  })
+
   it('keeps review-style tasks attached only to the folder workspace record', () => {
     const githubPr = folderWorkspaceToWorktree(
       makeFolderWorkspace({
diff --git a/src/shared/folder-workspace-worktree.ts b/src/shared/folder-workspace-worktree.ts
index 0b427f42407..3bc62acb41f 100644
--- a/src/shared/folder-workspace-worktree.ts
+++ b/src/shared/folder-workspace-worktree.ts
@@ -1,12 +1,19 @@
 import type { FolderWorkspace, Worktree } from './types'
 import { folderWorkspaceKey } from './workspace-scope'
-import { toSshExecutionHostId } from './execution-host'
+import { parseExecutionHostId, toSshExecutionHostId } from './execution-host'
+import { normalizeWorkspaceCreatorProvenance } from './workspace-creator-provenance'
 
 export function folderWorkspaceToWorktree(folderWorkspace: FolderWorkspace): Worktree {
   const linkedTask = folderWorkspace.linkedTask
+  const creatorProvenance = normalizeWorkspaceCreatorProvenance(folderWorkspace.creatorProvenance)
+  const hostId =
+    folderWorkspace.executionHostId ??
+    (folderWorkspace.connectionId ? toSshExecutionHostId(folderWorkspace.connectionId) : 'local')
+  const parsedHost = parseExecutionHostId(hostId)
   return {
     id: folderWorkspaceKey(folderWorkspace.id),
     repoId: `folder-workspace:${folderWorkspace.projectGroupId}`,
+    ...(creatorProvenance ? { creatorProvenance } : {}),
     displayName: folderWorkspace.name,
     comment: folderWorkspace.comment,
     linkedIssue:
@@ -33,14 +40,16 @@ export function folderWorkspaceToWorktree(folderWorkspace: FolderWorkspace): Wor
     pendingFirstAgentMessageRename: folderWorkspace.pendingFirstAgentMessageRename,
     firstAgentMessageRenameError: folderWorkspace.firstAgentMessageRenameError,
     workspaceStatus: folderWorkspace.workspaceStatus,
+    diffComments: folderWorkspace.diffComments,
     path: folderWorkspace.folderPath,
     head: '',
     branch: '',
     isBare: false,
     isSparse: false,
     isMainWorktree: false,
-    hostId:
-      folderWorkspace.executionHostId ??
-      (folderWorkspace.connectionId ? toSshExecutionHostId(folderWorkspace.connectionId) : 'local')
+    hostId,
+    ...(parsedHost?.kind === 'runtime'
+      ? { runtimeOwnerEnvironmentId: parsedHost.environmentId }
+      : {})
   }
 }
diff --git a/src/shared/folder-workspaces.ts b/src/shared/folder-workspaces.ts
index 675117dd3eb..8850083d672 100644
--- a/src/shared/folder-workspaces.ts
+++ b/src/shared/folder-workspaces.ts
@@ -3,6 +3,7 @@ import { isTuiAgent } from './tui-agent-config'
 import { normalizeStoredTaskSourceContext } from './task-source-context'
 import { normalizeWorkspaceLinkedItem } from './workspace-linked-item'
 import { isWorkspaceLinkedItemSourceContextMatch } from './workspace-linked-item-source-context'
+import { normalizeWorkspaceCreatorProvenance } from './workspace-creator-provenance'
 
 export function normalizeFolderWorkspaceName(
   name: string | null | undefined,
@@ -53,6 +54,7 @@ export function normalizeFolderWorkspaces(
     const now = Date.now()
     const linkedTask = normalizeWorkspaceLinkedItem(raw.linkedTask)
     const linkedTaskSourceContext = normalizeStoredTaskSourceContext(raw.linkedTaskSourceContext)
+    const creatorProvenance = normalizeWorkspaceCreatorProvenance(raw.creatorProvenance)
     seen.add(raw.id)
     workspaces.push({
       id: raw.id,
@@ -65,6 +67,7 @@ export function normalizeFolderWorkspaces(
           : raw.connectionId === null
             ? null
             : (group?.connectionId ?? null),
+      ...(creatorProvenance ? { creatorProvenance } : {}),
       linkedTask,
       linkedTaskSourceContext: isWorkspaceLinkedItemSourceContextMatch(
         linkedTask,
@@ -100,7 +103,8 @@ export function normalizeFolderWorkspaces(
       createdAt:
         typeof raw.createdAt === 'number' && Number.isFinite(raw.createdAt) ? raw.createdAt : now,
       updatedAt:
-        typeof raw.updatedAt === 'number' && Number.isFinite(raw.updatedAt) ? raw.updatedAt : now
+        typeof raw.updatedAt === 'number' && Number.isFinite(raw.updatedAt) ? raw.updatedAt : now,
+      ...(Array.isArray(raw.diffComments) ? { diffComments: raw.diffComments } : {})
     })
   }
   return workspaces.sort(
diff --git a/src/shared/git-binary-compatibility.test.ts b/src/shared/git-binary-compatibility.test.ts
index 660a2b7aaad..c8fe65d53bb 100644
--- a/src/shared/git-binary-compatibility.test.ts
+++ b/src/shared/git-binary-compatibility.test.ts
@@ -226,4 +226,25 @@ describeBinaryCompatibility('real Git binary compatibility', () => {
     expect(lines[0]).toBe('--end-of-options')
     expect(lines.find((line) => line !== '--end-of-options')).toMatch(/^refs\//)
   })
+
+  // Why pin this: `show --end-of-options <oid>:<path>` is the only Git command on the
+  // pinned SSH branch-diff path, and both blob sides depend on it resolving against the
+  // named commit rather than live HEAD, and on failing (not falling back) for a path
+  // absent at that commit — that failure is what renders additions and deletions.
+  it('reads a blob at a pinned object id', async () => {
+    await writeFile(join(repoPath, 'pinned.txt'), 'pinned\n')
+    await runGit(['add', 'pinned.txt'])
+    await runGit(['commit', '-qm', 'pinned'])
+    const pinnedOid = (await runGit(['rev-parse', 'HEAD'])).stdout.trim()
+
+    await writeFile(join(repoPath, 'pinned.txt'), 'moved on\n')
+    await runGit(['commit', '-qam', 'after pinned'])
+
+    await expect(
+      runGit(['show', '--end-of-options', `${pinnedOid}:pinned.txt`])
+    ).resolves.toMatchObject({ stdout: 'pinned\n' })
+    await expect(
+      runGit(['show', '--end-of-options', `${pinnedOid}:absent.txt`])
+    ).rejects.toBeDefined()
+  })
 })
diff --git a/src/shared/github-check-details-deadline.ts b/src/shared/github-check-details-deadline.ts
new file mode 100644
index 00000000000..2886265fc92
--- /dev/null
+++ b/src/shared/github-check-details-deadline.ts
@@ -0,0 +1,6 @@
+export const GITHUB_CHECK_DETAILS_HOST_TIMEOUT_MS = 25_000
+export const GITHUB_CHECK_DETAILS_TIMEOUT_MESSAGE = 'Timed out loading check details.'
+
+export function isGitHubCheckDetailsTimeout(error: unknown): boolean {
+  return error instanceof Error && error.message.endsWith(GITHUB_CHECK_DETAILS_TIMEOUT_MESSAGE)
+}
diff --git a/src/shared/github-project-group-sort.ts b/src/shared/github-project-group-sort.ts
index fe91c78051e..923b8aacf49 100644
--- a/src/shared/github-project-group-sort.ts
+++ b/src/shared/github-project-group-sort.ts
@@ -29,6 +29,7 @@ const EMPTY_GROUP_KEY = '__empty__'
 // Array.sort's behavior implementation-defined and skips later tie-breaks.
 const UNKNOWN_INDEX_SENTINEL = Number.MAX_SAFE_INTEGER
 
+// Preserve the mobile mirror's fallback for partial ordering metadata.
 function getFieldValueForGrouping(
   row: GitHubProjectRow,
   field: GitHubProjectField
@@ -43,8 +44,9 @@ function getFieldValueForGrouping(
     }
   }
   if (field.kind === 'iteration' && value.kind === 'iteration') {
-    const idx = field.iterations.findIndex((it) => it.id === value.iterationId)
-    const meta = field.iterations.find((it) => it.id === value.iterationId)
+    const iterations = field.iterations ?? []
+    const idx = iterations.findIndex((iteration) => iteration.id === value.iterationId)
+    const meta = iterations.find((iteration) => iteration.id === value.iterationId)
     return {
       key: value.iterationId,
       label: value.title || meta?.title || 'Iteration',
@@ -55,7 +57,7 @@ function getFieldValueForGrouping(
     }
   }
   if (field.kind === 'single-select' && value.kind === 'single-select') {
-    const idx = field.options.findIndex((o) => o.id === value.optionId)
+    const idx = (field.options ?? []).findIndex((option) => option.id === value.optionId)
     return {
       key: value.optionId,
       label: value.name,
@@ -158,8 +160,9 @@ function compareSort(a: GitHubProjectRow, b: GitHubProjectRow, sort: GitHubProje
     aValue.kind === 'single-select' &&
     bValue.kind === 'single-select'
   ) {
-    const aIdx = field.options.findIndex((o) => o.id === aValue.optionId)
-    const bIdx = field.options.findIndex((o) => o.id === bValue.optionId)
+    const options = field.options ?? []
+    const aIdx = options.findIndex((option) => option.id === aValue.optionId)
+    const bIdx = options.findIndex((option) => option.id === bValue.optionId)
     cmp =
       (aIdx === -1 ? UNKNOWN_INDEX_SENTINEL : aIdx) - (bIdx === -1 ? UNKNOWN_INDEX_SENTINEL : bIdx)
   } else if (
@@ -167,8 +170,9 @@ function compareSort(a: GitHubProjectRow, b: GitHubProjectRow, sort: GitHubProje
     aValue.kind === 'iteration' &&
     bValue.kind === 'iteration'
   ) {
-    const aIdx = field.iterations.findIndex((it) => it.id === aValue.iterationId)
-    const bIdx = field.iterations.findIndex((it) => it.id === bValue.iterationId)
+    const iterations = field.iterations ?? []
+    const aIdx = iterations.findIndex((iteration) => iteration.id === aValue.iterationId)
+    const bIdx = iterations.findIndex((iteration) => iteration.id === bValue.iterationId)
     cmp =
       (aIdx === -1 ? UNKNOWN_INDEX_SENTINEL : aIdx) - (bIdx === -1 ? UNKNOWN_INDEX_SENTINEL : bIdx)
   } else if (aValue.kind === 'number' && bValue.kind === 'number') {
diff --git a/src/shared/gitlab-types.ts b/src/shared/gitlab-types.ts
index 703085fb8a2..c9f2a0fffba 100644
--- a/src/shared/gitlab-types.ts
+++ b/src/shared/gitlab-types.ts
@@ -215,7 +215,7 @@ export type GitLabTodo = {
   id: number
   /** Free-form GitLab action name, e.g. 'assigned', 'mentioned', 'build_failed', 'review_requested'. */
   actionName: string
-  targetType: GitLabTodoTargetType | string
+  targetType: GitLabTodoTargetType | (string & {})
   /** iid for MR/Issue targets; absent for Commit/Note targets where the identifier is a SHA or note ID. */
   targetIid: number | null
   targetTitle: string
diff --git a/src/shared/hermes-run-output-limits.test.ts b/src/shared/hermes-run-output-limits.test.ts
deleted file mode 100644
index 1f583a83ca9..00000000000
--- a/src/shared/hermes-run-output-limits.test.ts
+++ /dev/null
@@ -1,165 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { DatabaseSync } from 'node:sqlite'
-import {
-  formatHermesSessionMessagesWithinLimits,
-  HERMES_RUN_PAGE_OUTPUT_OMITTED_ERROR,
-  HERMES_SESSION_RUN_METADATA_MAX_BYTES,
-  HERMES_SESSION_RUN_SELECT_SQL,
-  HERMES_SESSION_TRANSCRIPT_TRUNCATED_ERROR,
-  hydrateHermesRunPageWithinLimits
-} from './hermes-run-output-limits'
-
-describe('HERMES_SESSION_RUN_SELECT_SQL', () => {
-  it('preserves exact-limit text metadata and rejects oversized non-numeric fields in SQL', () => {
-    const database = new DatabaseSync(':memory:')
-    database.exec(`CREATE TABLE sessions (
-      id TEXT PRIMARY KEY,
-      title TEXT,
-      started_at,
-      ended_at,
-      model TEXT,
-      message_count,
-      input_tokens,
-      output_tokens
-    )`)
-    const exactTitle = 't'.repeat(HERMES_SESSION_RUN_METADATA_MAX_BYTES)
-    const exactModel = 'm'.repeat(HERMES_SESSION_RUN_METADATA_MAX_BYTES)
-    database
-      .prepare(
-        `INSERT INTO sessions (
-          id, title, started_at, ended_at, model, message_count, input_tokens, output_tokens
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
-      )
-      .run('run-1', exactTitle, 1, 2, exactModel, 3, 4, 5)
-
-    const exact = database.prepare(HERMES_SESSION_RUN_SELECT_SQL).get('run-1')
-    expect(exact).toEqual({
-      title: exactTitle,
-      started_at: 1,
-      ended_at: 2,
-      model: exactModel,
-      message_count: 3,
-      input_tokens: 4,
-      output_tokens: 5
-    })
-
-    database.exec(`UPDATE sessions SET
-      title = title || 'overflow',
-      model = model || 'overflow',
-      started_at = zeroblob(1048576),
-      ended_at = zeroblob(1048576),
-      message_count = zeroblob(1048576),
-      input_tokens = zeroblob(1048576),
-      output_tokens = zeroblob(1048576)
-    WHERE id = 'run-1'`)
-    const bounded = database.prepare(HERMES_SESSION_RUN_SELECT_SQL).get('run-1')
-
-    expect(Buffer.byteLength(String(bounded?.title))).toBe(HERMES_SESSION_RUN_METADATA_MAX_BYTES)
-    expect(Buffer.byteLength(String(bounded?.model))).toBe(HERMES_SESSION_RUN_METADATA_MAX_BYTES)
-    expect(bounded).toMatchObject({
-      started_at: null,
-      ended_at: null,
-      message_count: null,
-      input_tokens: null,
-      output_tokens: null
-    })
-    database.close()
-  })
-})
-
-describe('formatHermesSessionMessagesWithinLimits', () => {
-  it('preserves transcript formatting below the limits', () => {
-    const result = formatHermesSessionMessagesWithinLimits([
-      {
-        role: 'assistant',
-        tool_name: ' terminal ',
-        reasoning_content: ' because ',
-        content: ' done '
-      },
-      { role: null, content: '   ' }
-    ])
-
-    expect(result).toEqual({
-      content: [
-        '## assistant / terminal',
-        '',
-        '### Reasoning',
-        '',
-        'because',
-        '',
-        'done',
-        '',
-        '---',
-        '',
-        '## message',
-        '',
-        '(empty)'
-      ].join('\n'),
-      truncated: false
-    })
-  })
-
-  it('keeps UTF-8 output within the byte budget and explains truncation', () => {
-    const result = formatHermesSessionMessagesWithinLimits(
-      [{ role: 'assistant', content: '🐋'.repeat(100) }],
-      { maxBytes: 160 }
-    )
-
-    expect(result.truncated).toBe(true)
-    expect(Buffer.byteLength(result.content ?? '')).toBeLessThanOrEqual(160)
-    expect(result.content).toContain(HERMES_SESSION_TRANSCRIPT_TRUNCATED_ERROR)
-    expect(result.content).not.toContain('\ufffd')
-  })
-
-  it('stops pulling rows after the message limit', () => {
-    let rowsPulled = 0
-    function* messages(): Generator<Record<string, unknown>> {
-      for (let index = 0; index < 100; index += 1) {
-        rowsPulled += 1
-        yield { role: 'user', content: `message ${index}` }
-      }
-    }
-
-    const result = formatHermesSessionMessagesWithinLimits(messages(), {
-      maxBytes: 1024,
-      maxMessages: 2
-    })
-
-    expect(rowsPulled).toBe(3)
-    expect(result.truncated).toBe(true)
-    expect(result.content).toContain('message 0')
-    expect(result.content).toContain('message 1')
-    expect(result.content).not.toContain('message 2')
-  })
-})
-
-describe('hydrateHermesRunPageWithinLimits', () => {
-  it('bounds concurrency, preserves order, and omits aggregate overflow', async () => {
-    let active = 0
-    let maxActive = 0
-    const refs = ['first', 'second', 'third', 'fourth']
-
-    const runs = (await hydrateHermesRunPageWithinLimits(
-      refs,
-      async (id) => {
-        active += 1
-        maxActive = Math.max(maxActive, active)
-        await new Promise<void>((resolve) => setTimeout(resolve, 1))
-        active -= 1
-        return { id, output_content: id.slice(0, 3) }
-      },
-      { maxConcurrent: 2, maxRetainedBytes: 5 }
-    )) as { id: string; output_content: string | null; error?: string }[]
-
-    expect(maxActive).toBe(2)
-    expect(runs.map((run) => run.id)).toEqual(refs)
-    expect(runs[0]?.output_content).toBe('fir')
-    expect(runs.slice(1)).toEqual(
-      refs.slice(1).map((id) => ({
-        id,
-        output_content: null,
-        error: HERMES_RUN_PAGE_OUTPUT_OMITTED_ERROR
-      }))
-    )
-  })
-})
diff --git a/src/shared/hermes-run-output-limits.ts b/src/shared/hermes-run-output-limits.ts
deleted file mode 100644
index d456effe8a8..00000000000
--- a/src/shared/hermes-run-output-limits.ts
+++ /dev/null
@@ -1,233 +0,0 @@
-export const HERMES_SESSION_TRANSCRIPT_MAX_BYTES = 8 * 1024 * 1024
-export const HERMES_SESSION_TRANSCRIPT_MAX_MESSAGES = 10_000
-export const HERMES_RUN_PAGE_MAX_RETAINED_BYTES = 32 * 1024 * 1024
-export const HERMES_RUN_HYDRATION_CONCURRENCY = 2
-export const HERMES_SESSION_RUN_METADATA_MAX_BYTES = 16 * 1024
-export const HERMES_RUN_PAGE_OUTPUT_OMITTED_ERROR =
-  'Run output omitted because this history page exceeds the memory limit'
-export const HERMES_SESSION_TRANSCRIPT_TRUNCATED_ERROR =
-  'Session transcript truncated because it exceeds the 8 MiB or 10,000-message history limit'
-
-const HERMES_SESSION_TRANSCRIPT_TRUNCATION_NOTICE = `[${HERMES_SESSION_TRANSCRIPT_TRUNCATED_ERROR}.]`
-const HERMES_SESSION_TRANSCRIPT_SOURCE_TRUNCATED_COLUMN = 'orca_source_truncated'
-
-export const HERMES_SESSION_RUN_SELECT_SQL = `SELECT
-  CASE WHEN typeof(title) = 'text'
-    THEN CAST(substr(CAST(title AS BLOB), 1, ${HERMES_SESSION_RUN_METADATA_MAX_BYTES}) AS TEXT)
-    ELSE NULL END AS title,
-  CASE WHEN typeof(started_at) IN ('integer', 'real') THEN started_at ELSE NULL END AS started_at,
-  CASE WHEN typeof(ended_at) IN ('integer', 'real') THEN ended_at ELSE NULL END AS ended_at,
-  CASE WHEN typeof(model) = 'text'
-    THEN CAST(substr(CAST(model AS BLOB), 1, ${HERMES_SESSION_RUN_METADATA_MAX_BYTES}) AS TEXT)
-    ELSE NULL END AS model,
-  CASE WHEN typeof(message_count) IN ('integer', 'real') THEN message_count ELSE NULL END AS message_count,
-  CASE WHEN typeof(input_tokens) IN ('integer', 'real') THEN input_tokens ELSE NULL END AS input_tokens,
-  CASE WHEN typeof(output_tokens) IN ('integer', 'real') THEN output_tokens ELSE NULL END AS output_tokens
-FROM sessions
-WHERE id = ?`
-
-type HermesRunPageLimits = {
-  maxConcurrent?: number
-  maxRetainedBytes?: number
-}
-
-type HermesSessionTranscriptLimits = {
-  maxBytes?: number
-  maxMessages?: number
-}
-
-export type FormattedHermesSessionMessages = {
-  content: string | null
-  truncated: boolean
-}
-
-export async function hydrateHermesRunPageWithinLimits<T>(
-  refs: readonly T[],
-  hydrate: (ref: T) => Promise<unknown>,
-  limits: HermesRunPageLimits = {}
-): Promise<unknown[]> {
-  const maxConcurrent = clampFiniteLimit(limits.maxConcurrent, 1, HERMES_RUN_HYDRATION_CONCURRENCY)
-  const maxRetainedBytes = clampFiniteLimit(
-    limits.maxRetainedBytes,
-    0,
-    HERMES_RUN_PAGE_MAX_RETAINED_BYTES
-  )
-  const results: unknown[] = []
-  let retainedBytes = 0
-  for (let start = 0; start < refs.length; start += maxConcurrent) {
-    const batch = await Promise.all(refs.slice(start, start + maxConcurrent).map(hydrate))
-    for (const run of batch) {
-      const runBytes = hermesRunOutputByteLength(run)
-      if (retainedBytes + runBytes <= maxRetainedBytes) {
-        results.push(run)
-        retainedBytes += runBytes
-      } else {
-        results.push(omitHermesRunOutput(run))
-      }
-    }
-  }
-  return results
-}
-
-export function formatHermesSessionMessagesWithinLimits(
-  messages: Iterable<Record<string, unknown>>,
-  limits: HermesSessionTranscriptLimits = {}
-): FormattedHermesSessionMessages {
-  const maxBytes = clampFiniteLimit(limits.maxBytes, 0, HERMES_SESSION_TRANSCRIPT_MAX_BYTES)
-  const maxMessages = clampFiniteLimit(
-    limits.maxMessages,
-    0,
-    HERMES_SESSION_TRANSCRIPT_MAX_MESSAGES
-  )
-  const chunks: string[] = []
-  let retainedBytes = 0
-  let messageCount = 0
-  let truncated = false
-
-  transcript: for (const message of messages) {
-    if (messageCount >= maxMessages) {
-      truncated = true
-      break
-    }
-    for (const part of formatHermesSessionMessageParts(message, messageCount > 0)) {
-      const partBytes = Buffer.byteLength(part)
-      if (retainedBytes + partBytes <= maxBytes) {
-        chunks.push(part)
-        retainedBytes += partBytes
-        continue
-      }
-      const prefix = takeUtf8Prefix(part, maxBytes - retainedBytes)
-      if (prefix) {
-        chunks.push(prefix)
-        retainedBytes += Buffer.byteLength(prefix)
-      }
-      truncated = true
-      break transcript
-    }
-    messageCount += 1
-    if (message[HERMES_SESSION_TRANSCRIPT_SOURCE_TRUNCATED_COLUMN] === 1) {
-      truncated = true
-      break
-    }
-  }
-
-  if (truncated) {
-    appendTranscriptTruncationNotice(chunks, retainedBytes, maxBytes)
-  }
-  return { content: chunks.length > 0 ? chunks.join('') : null, truncated }
-}
-
-function clampFiniteLimit(value: number | undefined, minimum: number, maximum: number): number {
-  if (value === undefined || !Number.isFinite(value)) {
-    return maximum
-  }
-  return Math.max(minimum, Math.min(maximum, Math.floor(value)))
-}
-
-function hermesRunOutputByteLength(run: unknown): number {
-  if (!run || typeof run !== 'object' || Array.isArray(run)) {
-    return 0
-  }
-  const content = (run as Record<string, unknown>).output_content
-  return typeof content === 'string' ? Buffer.byteLength(content) : 0
-}
-
-function formatHermesSessionMessageParts(
-  message: Record<string, unknown>,
-  includeSeparator: boolean
-): string[] {
-  const role = typeof message.role === 'string' ? message.role : 'message'
-  const content = typeof message.content === 'string' ? message.content.trim() : ''
-  const toolName = typeof message.tool_name === 'string' ? message.tool_name.trim() : ''
-  const reasoning =
-    typeof message.reasoning_content === 'string'
-      ? message.reasoning_content.trim()
-      : typeof message.reasoning === 'string'
-        ? message.reasoning.trim()
-        : ''
-  const parts = [
-    includeSeparator ? '\n\n---\n\n' : '',
-    `## ${role}${toolName ? ` / ${toolName}` : ''}`
-  ]
-  if (reasoning) {
-    parts.push('\n\n### Reasoning\n\n', reasoning)
-  }
-  parts.push('\n\n', content || '(empty)')
-  return parts
-}
-
-function appendTranscriptTruncationNotice(
-  chunks: string[],
-  retainedBytes: number,
-  maxBytes: number
-): void {
-  const separator = chunks.length > 0 ? '\n\n---\n\n' : ''
-  const notice = `${separator}${HERMES_SESSION_TRANSCRIPT_TRUNCATION_NOTICE}`
-  const boundedNotice = takeUtf8Prefix(notice, maxBytes)
-  const noticeBytes = Buffer.byteLength(boundedNotice)
-  const targetBytes = maxBytes - noticeBytes
-  trimUtf8Chunks(chunks, retainedBytes, targetBytes)
-  if (boundedNotice) {
-    chunks.push(boundedNotice)
-  }
-}
-
-function trimUtf8Chunks(chunks: string[], retainedBytes: number, targetBytes: number): void {
-  let bytes = retainedBytes
-  while (bytes > targetBytes && chunks.length > 0) {
-    const lastIndex = chunks.length - 1
-    const last = chunks[lastIndex]!
-    const lastBytes = Buffer.byteLength(last)
-    const allowedBytes = Math.max(0, lastBytes - (bytes - targetBytes))
-    if (allowedBytes === 0) {
-      chunks.pop()
-      bytes -= lastBytes
-      continue
-    }
-    const prefix = takeUtf8Prefix(last, allowedBytes)
-    chunks[lastIndex] = prefix
-    bytes = bytes - lastBytes + Buffer.byteLength(prefix)
-  }
-}
-
-function takeUtf8Prefix(value: string, maxBytes: number): string {
-  if (maxBytes <= 0) {
-    return ''
-  }
-  if (Buffer.byteLength(value) <= maxBytes) {
-    return value
-  }
-  let low = 0
-  let high = Math.min(value.length, maxBytes)
-  while (low < high) {
-    const middle = Math.ceil((low + high) / 2)
-    if (Buffer.byteLength(value.slice(0, middle)) <= maxBytes) {
-      low = middle
-    } else {
-      high = middle - 1
-    }
-  }
-  if (low > 0 && isHighSurrogate(value.charCodeAt(low - 1))) {
-    low -= 1
-  }
-  return value.slice(0, low)
-}
-
-function isHighSurrogate(code: number): boolean {
-  return code >= 0xd800 && code <= 0xdbff
-}
-
-function omitHermesRunOutput(run: unknown): unknown {
-  if (!run || typeof run !== 'object' || Array.isArray(run)) {
-    return { output_content: null, error: HERMES_RUN_PAGE_OUTPUT_OMITTED_ERROR }
-  }
-  const record = run as Record<string, unknown>
-  const existingError = typeof record.error === 'string' && record.error ? record.error : null
-  return {
-    ...record,
-    output_content: null,
-    error: existingError
-      ? `${existingError}; ${HERMES_RUN_PAGE_OUTPUT_OMITTED_ERROR}`
-      : HERMES_RUN_PAGE_OUTPUT_OMITTED_ERROR
-  }
-}
diff --git a/src/shared/hermes-startup-query.ts b/src/shared/hermes-startup-query.ts
index 60e2705073f..a120305e1ee 100644
--- a/src/shared/hermes-startup-query.ts
+++ b/src/shared/hermes-startup-query.ts
@@ -1,6 +1,7 @@
 import { encodePowerShellCommand } from './powershell-command-encoding'
 import {
   buildShellCommandFromArgv,
+  isPosixStartupShell,
   quoteStartupArg,
   tokenizeStartupCommand,
   type AgentStartupShell
@@ -114,7 +115,7 @@ function normalizeHermesArgv(
     assignmentCount += 1
   }
   if (assignmentCount > 0) {
-    if (shell !== 'posix') {
+    if (!isPosixStartupShell(shell)) {
       return null
     }
     commandPrefix = ['env', ...commandPrefix]
@@ -139,7 +140,7 @@ function normalizeHermesArgv(
 }
 
 function buildQueryCommand(argv: string[], shell: AgentStartupShell): string {
-  if (shell !== 'posix') {
+  if (!isPosixStartupShell(shell)) {
     const invocation = buildShellCommandFromArgv(argv, 'powershell').replace(
       quoteStartupArg(QUERY_ARG_PLACEHOLDER, 'powershell'),
       `"--query=$${POWERSHELL_NATIVE_QUERY_VARIABLE}"`
diff --git a/src/shared/hosted-review-creation-providers.test.ts b/src/shared/hosted-review-creation-providers.test.ts
new file mode 100644
index 00000000000..67e62aad54b
--- /dev/null
+++ b/src/shared/hosted-review-creation-providers.test.ts
@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest'
+import {
+  resolveHostedReviewCreationProvider,
+  supportsHostedReviewCreation
+} from './hosted-review-creation-providers'
+
+describe('hosted review creation providers', () => {
+  // Why: this list is the gate behind the "provider does not support creating a
+  // pull request" blocker. A provider whose forge adapter implements
+  // createReview but is missing here reports unsupported to the user forever.
+  it('accepts every provider Orca can create a review on', () => {
+    for (const provider of ['github', 'gitlab', 'bitbucket', 'azure-devops', 'gitea'] as const) {
+      expect(supportsHostedReviewCreation(provider)).toBe(true)
+      expect(resolveHostedReviewCreationProvider(provider)).toBe(provider)
+    }
+  })
+
+  it('rejects unsupported and missing providers, falling back to GitHub copy', () => {
+    expect(supportsHostedReviewCreation('unsupported')).toBe(false)
+    expect(supportsHostedReviewCreation(null)).toBe(false)
+    expect(supportsHostedReviewCreation(undefined)).toBe(false)
+    expect(resolveHostedReviewCreationProvider('unsupported')).toBe('github')
+  })
+})
diff --git a/src/shared/hosted-review-creation-providers.ts b/src/shared/hosted-review-creation-providers.ts
index b32cfebfbd9..bbe0dc6b912 100644
--- a/src/shared/hosted-review-creation-providers.ts
+++ b/src/shared/hosted-review-creation-providers.ts
@@ -1,6 +1,11 @@
 import type { HostedReviewProvider } from './hosted-review'
 
-export type HostedReviewCreationProvider = 'github' | 'gitlab' | 'azure-devops' | 'gitea'
+export type HostedReviewCreationProvider =
+  | 'github'
+  | 'gitlab'
+  | 'bitbucket'
+  | 'azure-devops'
+  | 'gitea'
 
 export function supportsHostedReviewCreation(
   provider: HostedReviewProvider | null | undefined
@@ -8,6 +13,7 @@ export function supportsHostedReviewCreation(
   return (
     provider === 'github' ||
     provider === 'gitlab' ||
+    provider === 'bitbucket' ||
     provider === 'azure-devops' ||
     provider === 'gitea'
   )
diff --git a/src/shared/hosted-review-github.test.ts b/src/shared/hosted-review-github.test.ts
index 640a87016b5..bbc17fa785b 100644
--- a/src/shared/hosted-review-github.test.ts
+++ b/src/shared/hosted-review-github.test.ts
@@ -1,8 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import {
-  hostedReviewInfoFromGitHubPRInfo,
-  hostedReviewSummaryFromGitHubPRInfo
-} from './hosted-review-github'
+import { hostedReviewInfoFromGitHubPRInfo } from './hosted-review-github'
 import type { PRInfo } from './types'
 
 const pr: PRInfo = {
@@ -16,113 +13,10 @@ const pr: PRInfo = {
   headSha: 'abc123'
 }
 
-describe('hostedReviewSummaryFromGitHubPRInfo', () => {
-  it('maps PRInfo into provider-neutral summary with host identity', () => {
-    const summary = hostedReviewSummaryFromGitHubPRInfo({
-      pr,
-      owner: 'acme',
-      repo: 'orca',
-      host: 'github.acme.internal'
-    })
-
-    expect(summary.identity).toEqual({
-      provider: 'github',
-      host: 'github.acme.internal',
-      owner: 'acme',
-      repo: 'orca',
-      number: 12
-    })
-    expect(summary.checksStatus).toBe('pending')
-    expect(summary.threadSummary).toBeUndefined()
-  })
-
-  it('derives unresolved thread count and failing status from enrichers', () => {
-    const summary = hostedReviewSummaryFromGitHubPRInfo({
-      pr: { ...pr, checksStatus: 'success' },
-      owner: 'acme',
-      repo: 'orca',
-      comments: [
-        {
-          id: 1,
-          author: 'a',
-          authorAvatarUrl: '',
-          body: '',
-          createdAt: '',
-          url: '',
-          threadId: 't1',
-          isResolved: false
-        },
-        {
-          id: 2,
-          author: 'b',
-          authorAvatarUrl: '',
-          body: '',
-          createdAt: '',
-          url: '',
-          threadId: 't1',
-          isResolved: false
-        },
-        {
-          id: 3,
-          author: 'c',
-          authorAvatarUrl: '',
-          body: '',
-          createdAt: '',
-          url: '',
-          threadId: 't2',
-          isResolved: true
-        }
-      ],
-      checks: [{ name: 'ci', status: 'completed', conclusion: 'failure', url: null }]
-    })
-
-    expect(summary.threadSummary).toEqual({ unresolvedCount: 1, dataCompleteness: 'partial' })
-    expect(summary.checksStatus).toBe('failure')
-  })
-
-  it('treats cancelled checks as failed in hosted review summaries', () => {
-    const summary = hostedReviewSummaryFromGitHubPRInfo({
-      pr: { ...pr, checksStatus: 'success' },
-      owner: 'acme',
-      repo: 'orca',
-      checks: [{ name: 'ci', status: 'completed', conclusion: 'cancelled', url: null }]
-    })
-
-    expect(summary.checksStatus).toBe('failure')
-  })
-
-  it('treats action_required checks as failed so auto-merge sees the block', () => {
-    const summary = hostedReviewSummaryFromGitHubPRInfo({
-      pr: { ...pr, checksStatus: 'success' },
-      owner: 'acme',
-      repo: 'orca',
-      checks: [{ name: 'approval', status: 'completed', conclusion: 'action_required', url: null }]
-    })
-
-    expect(summary.checksStatus).toBe('failure')
-  })
-
-  it('distinguishes loaded empty comments from unknown comments', () => {
-    expect(
-      hostedReviewSummaryFromGitHubPRInfo({
-        pr,
-        owner: 'acme',
-        repo: 'orca'
-      }).threadSummary
-    ).toBeUndefined()
-
-    expect(
-      hostedReviewSummaryFromGitHubPRInfo({
-        pr,
-        owner: 'acme',
-        repo: 'orca',
-        comments: []
-      }).threadSummary
-    ).toEqual({ unresolvedCount: 0, dataCompleteness: 'partial' })
-  })
-
+describe('hostedReviewInfoFromGitHubPRInfo', () => {
   it('maps PRInfo into sidebar hosted review metadata', () => {
-    const review = hostedReviewInfoFromGitHubPRInfo(pr)
+    const githubRepository = { owner: 'upstream', repo: 'orca' }
+    const review = hostedReviewInfoFromGitHubPRInfo({ ...pr, prRepo: githubRepository })
 
     expect(review).toMatchObject({
       provider: 'github',
@@ -131,7 +25,8 @@ describe('hostedReviewSummaryFromGitHubPRInfo', () => {
       state: 'open',
       status: 'pending',
       mergeable: 'MERGEABLE',
-      headSha: 'abc123'
+      headSha: 'abc123',
+      githubRepository
     })
   })
 })
diff --git a/src/shared/hosted-review-github.ts b/src/shared/hosted-review-github.ts
index 6fc90a39aaf..3cf76175bda 100644
--- a/src/shared/hosted-review-github.ts
+++ b/src/shared/hosted-review-github.ts
@@ -1,86 +1,5 @@
-import type { PRCheckDetail, PRComment, PRInfo } from './types'
-import type { HostedReviewInfo, HostedReviewQueueSummary } from './hosted-review'
-import { derivePRCheckStatus } from './pr-check-status'
-
-export type HostedReviewFromGitHubPRInfoArgs = {
-  pr: PRInfo
-  owner: string
-  repo: string
-  host?: string
-  authorLogin?: string | null
-  authorIsBot?: boolean
-  requestedReviewerLogins?: string[] | null
-  comments?: PRComment[]
-  checks?: PRCheckDetail[]
-  lastViewedAt?: number
-}
-
-function unresolvedThreadCount(comments?: PRComment[]): number | null {
-  if (comments === undefined) {
-    return null
-  }
-  const unresolved = new Set<string>()
-  for (const comment of comments) {
-    if (!comment.threadId || comment.isResolved !== false) {
-      continue
-    }
-    unresolved.add(comment.threadId)
-  }
-  return unresolved.size
-}
-
-function deriveChecksStatus(
-  prChecksStatus: PRInfo['checksStatus'],
-  checks?: PRCheckDetail[]
-): PRInfo['checksStatus'] {
-  if (!checks) {
-    return prChecksStatus
-  }
-  return derivePRCheckStatus(checks)
-}
-
-export function hostedReviewSummaryFromGitHubPRInfo(
-  args: HostedReviewFromGitHubPRInfoArgs
-): HostedReviewQueueSummary {
-  const unresolvedCount = unresolvedThreadCount(args.comments)
-  return {
-    identity: {
-      provider: 'github',
-      host: args.host ?? 'github.com',
-      owner: args.owner,
-      repo: args.repo,
-      number: args.pr.number
-    },
-    title: args.pr.title,
-    url: args.pr.url,
-    state: args.pr.state,
-    author: args.authorLogin ? { login: args.authorLogin, isBot: args.authorIsBot } : null,
-    updatedAt: args.pr.updatedAt,
-    mergeable: args.pr.mergeable,
-    ...(args.pr.mergeStateStatus !== undefined
-      ? { mergeStateStatus: args.pr.mergeStateStatus }
-      : {}),
-    checksStatus: deriveChecksStatus(args.pr.checksStatus, args.checks),
-    reviewDecision:
-      args.pr.reviewDecision === 'APPROVED'
-        ? 'approved'
-        : args.pr.reviewDecision === 'CHANGES_REQUESTED'
-          ? 'changes_requested'
-          : args.pr.reviewDecision === 'REVIEW_REQUIRED'
-            ? 'review_required'
-            : undefined,
-    threadSummary:
-      unresolvedCount === null
-        ? undefined
-        : {
-            unresolvedCount,
-            dataCompleteness: 'partial'
-          },
-    requestedReviewerLogins: args.requestedReviewerLogins,
-    lastViewedAt: args.lastViewedAt,
-    draft: args.pr.state === 'draft'
-  }
-}
+import type { HostedReviewInfo } from './hosted-review'
+import type { PRInfo } from './types'
 
 export function hostedReviewInfoFromGitHubPRInfo(pr: PRInfo): HostedReviewInfo {
   return {
@@ -98,6 +17,7 @@ export function hostedReviewInfoFromGitHubPRInfo(pr: PRInfo): HostedReviewInfo {
     ...(pr.mergeQueueRequired !== undefined ? { mergeQueueRequired: pr.mergeQueueRequired } : {}),
     ...(pr.mergeStateStatus !== undefined ? { mergeStateStatus: pr.mergeStateStatus } : {}),
     ...(pr.headSha ? { headSha: pr.headSha } : {}),
+    ...(pr.prRepo ? { githubRepository: pr.prRepo } : {}),
     ...(pr.confirmedContainedHeadOid
       ? { confirmedContainedHeadOid: pr.confirmedContainedHeadOid }
       : {}),
diff --git a/src/shared/hosted-review-gitlab.test.ts b/src/shared/hosted-review-gitlab.test.ts
deleted file mode 100644
index b3cc6ad9c59..00000000000
--- a/src/shared/hosted-review-gitlab.test.ts
+++ /dev/null
@@ -1,72 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { hostedReviewSummaryFromGitLabInfo } from './hosted-review-gitlab'
-import type { HostedReviewInfo } from './hosted-review'
-
-const review: HostedReviewInfo & { provider: 'gitlab' } = {
-  provider: 'gitlab',
-  number: 12,
-  title: 'Add queue badges',
-  state: 'open',
-  url: 'https://gitlab.acme.internal/group/subgroup/orca/-/merge_requests/12',
-  status: 'pending',
-  updatedAt: '2026-05-12T00:00:00.000Z',
-  mergeable: 'MERGEABLE'
-}
-
-describe('hostedReviewSummaryFromGitLabInfo', () => {
-  it('maps nested GitLab project URLs into provider-neutral identity', () => {
-    const summary = hostedReviewSummaryFromGitLabInfo({ review })
-
-    expect(summary.identity).toEqual({
-      provider: 'gitlab',
-      host: 'gitlab.acme.internal',
-      owner: 'group/subgroup',
-      repo: 'orca',
-      number: 12
-    })
-    expect(summary.checksStatus).toBe('pending')
-    expect(summary.threadSummary).toBeUndefined()
-  })
-
-  it('derives unresolved thread count and failing status from enrichers', () => {
-    const summary = hostedReviewSummaryFromGitLabInfo({
-      review: { ...review, status: 'success' },
-      comments: [
-        {
-          id: 1,
-          author: 'a',
-          authorAvatarUrl: '',
-          body: '',
-          createdAt: '',
-          url: '',
-          threadId: 't1',
-          isResolved: false
-        },
-        {
-          id: 2,
-          author: 'b',
-          authorAvatarUrl: '',
-          body: '',
-          createdAt: '',
-          url: '',
-          threadId: 't1',
-          isResolved: false
-        },
-        {
-          id: 3,
-          author: 'c',
-          authorAvatarUrl: '',
-          body: '',
-          createdAt: '',
-          url: '',
-          threadId: 't2',
-          isResolved: true
-        }
-      ],
-      checks: [{ name: 'gitlab-ci', status: 'completed', conclusion: 'failure', url: null }]
-    })
-
-    expect(summary.threadSummary).toEqual({ unresolvedCount: 1, dataCompleteness: 'partial' })
-    expect(summary.checksStatus).toBe('failure')
-  })
-})
diff --git a/src/shared/hosted-review-gitlab.ts b/src/shared/hosted-review-gitlab.ts
deleted file mode 100644
index 3253ee9ff16..00000000000
--- a/src/shared/hosted-review-gitlab.ts
+++ /dev/null
@@ -1,109 +0,0 @@
-import type { HostedReviewInfo, HostedReviewQueueSummary } from './hosted-review'
-import type { PRCheckDetail, PRComment } from './types'
-import { derivePRCheckStatus } from './pr-check-status'
-
-export type HostedReviewFromGitLabInfoArgs = {
-  review: HostedReviewInfo & { provider: 'gitlab' }
-  authorLogin?: string | null
-  authorIsBot?: boolean
-  comments?: PRComment[]
-  checks?: PRCheckDetail[]
-  lastViewedAt?: number
-}
-
-type GitLabIdentityParts = {
-  host: string
-  owner: string
-  repo: string
-}
-
-function parseGitLabIdentity(url: string): GitLabIdentityParts {
-  try {
-    const parsed = new URL(url)
-    const segments = parsed.pathname.split('/').filter(Boolean)
-    const markerIndex = segments.indexOf('-')
-    const projectSegments = markerIndex >= 0 ? segments.slice(0, markerIndex) : segments
-    if (projectSegments.length >= 2) {
-      return {
-        host: parsed.host || 'gitlab.com',
-        owner: projectSegments.slice(0, -1).join('/'),
-        repo: projectSegments.at(-1) ?? 'unknown'
-      }
-    }
-    return {
-      host: parsed.host || 'gitlab.com',
-      owner: projectSegments[0] ?? 'unknown',
-      repo: projectSegments[1] ?? 'unknown'
-    }
-  } catch {
-    // Why: queue badges should degrade gracefully for hand-entered/self-hosted URLs.
-    return { host: 'gitlab.com', owner: 'unknown', repo: 'unknown' }
-  }
-}
-
-function unresolvedThreadCount(comments?: PRComment[]): number | null {
-  if (comments === undefined) {
-    return null
-  }
-  const unresolved = new Set<string>()
-  for (const comment of comments) {
-    if (!comment.threadId || comment.isResolved !== false) {
-      continue
-    }
-    unresolved.add(comment.threadId)
-  }
-  return unresolved.size
-}
-
-function deriveChecksStatus(
-  reviewStatus: HostedReviewInfo['status'],
-  checks?: PRCheckDetail[]
-): HostedReviewInfo['status'] {
-  if (!checks) {
-    return reviewStatus
-  }
-  return derivePRCheckStatus(checks)
-}
-
-export function hostedReviewSummaryFromGitLabInfo(
-  args: HostedReviewFromGitLabInfoArgs
-): HostedReviewQueueSummary {
-  const identity = parseGitLabIdentity(args.review.url)
-  const unresolvedCount = unresolvedThreadCount(args.comments)
-  return {
-    identity: {
-      provider: 'gitlab',
-      host: identity.host,
-      owner: identity.owner,
-      repo: identity.repo,
-      number: args.review.number
-    },
-    title: args.review.title,
-    url: args.review.url,
-    state: args.review.state,
-    author: args.authorLogin ? { login: args.authorLogin, isBot: args.authorIsBot } : null,
-    updatedAt: args.review.updatedAt,
-    mergeable: args.review.mergeable,
-    ...(args.review.mergeStateStatus !== undefined
-      ? { mergeStateStatus: args.review.mergeStateStatus }
-      : {}),
-    checksStatus: deriveChecksStatus(args.review.status, args.checks),
-    reviewDecision:
-      args.review.reviewDecision === 'APPROVED'
-        ? 'approved'
-        : args.review.reviewDecision === 'CHANGES_REQUESTED'
-          ? 'changes_requested'
-          : args.review.reviewDecision === 'REVIEW_REQUIRED'
-            ? 'review_required'
-            : undefined,
-    threadSummary:
-      unresolvedCount === null
-        ? undefined
-        : {
-            unresolvedCount,
-            dataCompleteness: 'partial'
-          },
-    lastViewedAt: args.lastViewedAt,
-    draft: args.review.state === 'draft'
-  }
-}
diff --git a/src/shared/hosted-review-queue.test.ts b/src/shared/hosted-review-queue.test.ts
deleted file mode 100644
index fbf90768493..00000000000
--- a/src/shared/hosted-review-queue.test.ts
+++ /dev/null
@@ -1,124 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import type { HostedReviewQueueSummary } from './hosted-review'
-import {
-  classifyHostedReview,
-  hostedReviewIdentityKey,
-  reviewNeedsResponse,
-  reviewReadyToMerge
-} from './hosted-review-queue'
-
-function baseSummary(overrides: Partial<HostedReviewQueueSummary> = {}): HostedReviewQueueSummary {
-  return {
-    identity: { provider: 'github', host: 'github.com', owner: 'acme', repo: 'orca', number: 42 },
-    title: 'Improve checks panel',
-    url: 'https://github.com/acme/orca/pull/42',
-    state: 'open',
-    author: { login: 'teammate' },
-    updatedAt: '2026-05-10T00:00:00.000Z',
-    mergeable: 'MERGEABLE',
-    checksStatus: 'success',
-    threadSummary: { unresolvedCount: 0 },
-    ...overrides
-  }
-}
-
-describe('hostedReviewIdentityKey', () => {
-  it('includes provider and host for enterprise-safe keys', () => {
-    const dotcom = hostedReviewIdentityKey({
-      provider: 'github',
-      host: 'github.com',
-      owner: 'acme',
-      repo: 'orca',
-      number: 7
-    })
-    const ghe = hostedReviewIdentityKey({
-      provider: 'github',
-      host: 'github.acme.internal',
-      owner: 'acme',
-      repo: 'orca',
-      number: 7
-    })
-    expect(dotcom).not.toBe(ghe)
-  })
-})
-
-describe('classifyHostedReview', () => {
-  it('classifies mine/requested/agent/teammate', () => {
-    expect(
-      classifyHostedReview(baseSummary({ author: { login: 'me' } }), {
-        viewer: { login: 'me' }
-      }).state
-    ).toBe('mine')
-
-    expect(
-      classifyHostedReview(baseSummary({ requestedReviewerLogins: ['me'] }), {
-        viewer: { login: 'me' }
-      }).state
-    ).toBe('requested')
-
-    expect(
-      classifyHostedReview(baseSummary({ author: { login: 'orca-ci' } }), {
-        agentAuthorLogins: ['orca-ci']
-      }).state
-    ).toBe('agent')
-
-    expect(classifyHostedReview(baseSummary()).state).toBe('teammate')
-  })
-})
-
-describe('reviewNeedsResponse', () => {
-  it('returns true for unresolved threads, failed checks, conflicts, and newer remote updates', () => {
-    expect(reviewNeedsResponse(baseSummary({ threadSummary: { unresolvedCount: 1 } }))).toBe(true)
-    expect(reviewNeedsResponse(baseSummary({ checksStatus: 'failure' }))).toBe(true)
-    expect(reviewNeedsResponse(baseSummary({ mergeable: 'CONFLICTING' }))).toBe(true)
-    expect(
-      reviewNeedsResponse(
-        baseSummary({
-          updatedAt: '2026-05-11T00:00:00.000Z',
-          lastViewedAt: Date.parse('2026-05-10T00:00:00.000Z')
-        })
-      )
-    ).toBe(true)
-  })
-
-  it('does not mark needs-response from updatedAt alone when lastViewedAt is missing', () => {
-    expect(reviewNeedsResponse(baseSummary({ updatedAt: '2026-05-11T00:00:00.000Z' }))).toBe(false)
-  })
-})
-
-describe('reviewReadyToMerge', () => {
-  it('rejects drafts, conflicts, failed/pending checks, unresolved threads, and unknown mergeability', () => {
-    expect(reviewReadyToMerge(baseSummary({ state: 'draft', draft: true }))).toBe(false)
-    expect(reviewReadyToMerge(baseSummary({ mergeable: 'CONFLICTING' }))).toBe(false)
-    expect(reviewReadyToMerge(baseSummary({ checksStatus: 'failure' }))).toBe(false)
-    expect(reviewReadyToMerge(baseSummary({ checksStatus: 'pending' }))).toBe(false)
-    expect(reviewReadyToMerge(baseSummary({ threadSummary: { unresolvedCount: 2 } }))).toBe(false)
-    expect(reviewReadyToMerge(baseSummary({ threadSummary: undefined }))).toBe(false)
-    expect(reviewReadyToMerge(baseSummary({ mergeable: 'UNKNOWN' }))).toBe(false)
-    expect(reviewReadyToMerge(baseSummary({ reviewDecision: 'review_required' }))).toBe(false)
-    expect(reviewReadyToMerge(baseSummary({ reviewDecision: 'changes_requested' }))).toBe(false)
-    expect(reviewReadyToMerge(baseSummary({ mergeStateStatus: 'BEHIND' }))).toBe(false)
-    expect(reviewReadyToMerge(baseSummary({ mergeStateStatus: 'BLOCKED' }))).toBe(false)
-  })
-
-  it('accepts neutral checks when all other gates pass', () => {
-    expect(reviewReadyToMerge(baseSummary({ checksStatus: 'neutral' }))).toBe(true)
-  })
-
-  it('scopes GitHub merge-state blockers to GitHub summaries', () => {
-    expect(
-      reviewReadyToMerge(
-        baseSummary({
-          identity: {
-            provider: 'gitlab',
-            host: 'gitlab.com',
-            owner: 'acme',
-            repo: 'orca',
-            number: 42
-          },
-          mergeStateStatus: 'BLOCKED'
-        })
-      )
-    ).toBe(true)
-  })
-})
diff --git a/src/shared/hosted-review-queue.ts b/src/shared/hosted-review-queue.ts
deleted file mode 100644
index 037765c341b..00000000000
--- a/src/shared/hosted-review-queue.ts
+++ /dev/null
@@ -1,134 +0,0 @@
-import type {
-  HostedReviewIdentity,
-  HostedReviewQueueClassification,
-  HostedReviewQueueState,
-  HostedReviewQueueSummary,
-  HostedReviewUser
-} from './hosted-review'
-
-export type HostedReviewClassificationOptions = {
-  viewer?: HostedReviewUser | null
-  agentAuthorLogins?: string[]
-}
-
-export function hostedReviewIdentityKey(identity: HostedReviewIdentity): string {
-  return `${identity.provider}::${identity.host.toLowerCase()}::${identity.owner.toLowerCase()}::${identity.repo.toLowerCase()}::${identity.number}`
-}
-
-function hasRequestedReviewerSignal(
-  summary: HostedReviewQueueSummary,
-  viewer?: HostedReviewUser | null
-): boolean {
-  if (!viewer?.login) {
-    return false
-  }
-  const requested = summary.requestedReviewerLogins
-  if (!requested || requested.length === 0) {
-    return false
-  }
-  const viewerLogin = viewer.login.toLowerCase()
-  return requested.some((login) => login.toLowerCase() === viewerLogin)
-}
-
-function isAgentAuthored(
-  summary: HostedReviewQueueSummary,
-  options?: HostedReviewClassificationOptions
-): boolean {
-  if (summary.author?.isBot) {
-    return true
-  }
-  const author = summary.author?.login?.toLowerCase()
-  if (!author) {
-    return false
-  }
-  if (options?.agentAuthorLogins?.some((login) => login.toLowerCase() === author)) {
-    return true
-  }
-  return author.endsWith('[bot]') || author.includes('bot')
-}
-
-function getQueueState(
-  summary: HostedReviewQueueSummary,
-  options?: HostedReviewClassificationOptions
-): HostedReviewQueueState {
-  const viewerLogin = options?.viewer?.login?.toLowerCase() ?? null
-  const authorLogin = summary.author?.login?.toLowerCase() ?? null
-  if (viewerLogin && authorLogin && viewerLogin === authorLogin) {
-    return 'mine'
-  }
-  if (hasRequestedReviewerSignal(summary, options?.viewer)) {
-    return 'requested'
-  }
-  if (isAgentAuthored(summary, options)) {
-    return 'agent'
-  }
-  return 'teammate'
-}
-
-export function reviewNeedsResponse(
-  summary: HostedReviewQueueSummary,
-  viewer?: HostedReviewUser | null
-): boolean {
-  void viewer
-  if (summary.state !== 'open' && summary.state !== 'draft') {
-    return false
-  }
-  if ((summary.threadSummary?.unresolvedCount ?? 0) > 0) {
-    return true
-  }
-  if (summary.checksStatus === 'failure') {
-    return true
-  }
-  if (summary.mergeable === 'CONFLICTING') {
-    return true
-  }
-  if (summary.lastViewedAt === undefined) {
-    return false
-  }
-  const updatedAt = Date.parse(summary.updatedAt)
-  return Number.isFinite(updatedAt) && updatedAt > summary.lastViewedAt
-}
-
-export function reviewReadyToMerge(summary: HostedReviewQueueSummary): boolean {
-  if (summary.state !== 'open') {
-    return false
-  }
-  if (summary.draft) {
-    return false
-  }
-  if (summary.mergeable !== 'MERGEABLE') {
-    return false
-  }
-  if (
-    summary.identity.provider === 'github' &&
-    (summary.mergeStateStatus === 'BEHIND' || summary.mergeStateStatus === 'BLOCKED')
-  ) {
-    return false
-  }
-  if (
-    summary.reviewDecision === 'review_required' ||
-    summary.reviewDecision === 'changes_requested'
-  ) {
-    return false
-  }
-  if (summary.checksStatus !== 'success' && summary.checksStatus !== 'neutral') {
-    return false
-  }
-  if (summary.threadSummary?.unresolvedCount !== 0) {
-    return false
-  }
-  return true
-}
-
-export function classifyHostedReview(
-  summary: HostedReviewQueueSummary,
-  options?: HostedReviewClassificationOptions
-): HostedReviewQueueClassification {
-  const state = getQueueState(summary, options)
-  return {
-    state,
-    requested: hasRequestedReviewerSignal(summary, options?.viewer),
-    needsResponse: reviewNeedsResponse(summary, options?.viewer),
-    readyToMerge: reviewReadyToMerge(summary)
-  }
-}
diff --git a/src/shared/hosted-review.ts b/src/shared/hosted-review.ts
index 90a97d0afb9..c0763cb4184 100644
--- a/src/shared/hosted-review.ts
+++ b/src/shared/hosted-review.ts
@@ -1,4 +1,10 @@
-import type { CheckStatus, PRConflictSummary, PRMergeableState, PRReviewDecision } from './types'
+import type {
+  CheckStatus,
+  GitHubRepositoryIdentity,
+  PRConflictSummary,
+  PRMergeableState,
+  PRReviewDecision
+} from './types'
 
 export type HostedReviewProvider =
   | 'github'
@@ -10,6 +16,12 @@ export type HostedReviewProvider =
 
 export type HostedReviewState = 'open' | 'closed' | 'merged' | 'draft'
 
+// Why: Bitbucket Cloud's API has no draft pull requests, so offering the toggle
+// there would either publish a live PR or fail at submit.
+export function hostedReviewProviderSupportsDraft(provider: HostedReviewProvider): boolean {
+  return provider !== 'bitbucket'
+}
+
 /** A linked review is identified by a positive integer PR/MR number. */
 export function isPositiveHostedReviewNumber(value: unknown): value is number {
   return typeof value === 'number' && Number.isInteger(value) && value > 0
@@ -30,6 +42,8 @@ export type HostedReviewInfo = {
   mergeQueueRequired?: boolean | null
   mergeStateStatus?: string | null
   headSha?: string
+  /** GitHub repository that owns the PR; absent on older runtimes and other providers. */
+  githubRepository?: GitHubRepositoryIdentity
   // Why: mirrors PRInfo.confirmedContainedHeadOid so merged-review staleness
   // checks accept a worktree head confirmed to be part of the merged PR.
   confirmedContainedHeadOid?: string
@@ -80,6 +94,14 @@ export type CreateHostedReviewArgs = CreateHostedReviewInput & {
   connectionId?: string | null
 }
 
+export type CreateStackedHostedReviewInput = CreateHostedReviewInput
+
+export type CreateStackedHostedReviewArgs = CreateStackedHostedReviewInput & {
+  repoPath: string
+  repoId?: string
+  connectionId?: string | null
+}
+
 export type CreateHostedReviewErrorCode =
   | 'auth_required'
   | 'unsupported_provider'
@@ -99,6 +121,21 @@ export type CreateHostedReviewResult =
       existingReview?: HostedReviewSummary
     }
 
+export type CreateStackedHostedReviewResult =
+  | {
+      ok: true
+      number: number
+      url: string
+      stackNumber: number
+      parentReview: HostedReviewSummary
+    }
+  | {
+      ok: false
+      code: CreateHostedReviewErrorCode
+      error: string
+      createdReview?: HostedReviewSummary
+    }
+
 export type HostedReviewCreationBlockedReason =
   | 'dirty'
   | 'detached_head'
@@ -144,6 +181,8 @@ export type HostedReviewCreationEligibility = {
   head?: string | null
   title?: string | null
   body?: string | null
+  /** Present only when the executing host supports GitHub stack creation. */
+  stackedCreationSupported?: boolean
 }
 
 export type HostedReviewCreationEligibilityArgs = {
@@ -165,48 +204,4 @@ export type HostedReviewCreationEligibilityArgs = {
   linkedGiteaPR?: number | null
 }
 
-export type HostedReviewIdentity = {
-  provider: HostedReviewProvider
-  host: string
-  owner: string
-  repo: string
-  number: number
-}
-
-export type HostedReviewUser = {
-  login: string | null
-  isBot?: boolean
-}
-
 export type HostedReviewDecision = 'approved' | 'changes_requested' | 'review_required' | null
-
-export type HostedReviewThreadSummary = {
-  unresolvedCount: number | null
-  dataCompleteness?: 'full' | 'partial'
-}
-
-export type HostedReviewQueueSummary = {
-  identity: HostedReviewIdentity
-  title: string
-  url: string
-  state: HostedReviewState
-  author: HostedReviewUser | null
-  updatedAt: string
-  lastViewedAt?: number
-  mergeable: PRMergeableState
-  mergeStateStatus?: string | null
-  checksStatus: CheckStatus
-  reviewDecision?: HostedReviewDecision
-  threadSummary?: HostedReviewThreadSummary
-  requestedReviewerLogins?: string[] | null
-  draft?: boolean
-}
-
-export type HostedReviewQueueState = 'mine' | 'requested' | 'agent' | 'teammate'
-
-export type HostedReviewQueueClassification = {
-  state: HostedReviewQueueState
-  needsResponse: boolean
-  readyToMerge: boolean
-  requested: boolean
-}
diff --git a/src/shared/integration-credential-errors.ts b/src/shared/integration-credential-errors.ts
index 3a2cc55613d..c997802becc 100644
--- a/src/shared/integration-credential-errors.ts
+++ b/src/shared/integration-credential-errors.ts
@@ -1,4 +1,4 @@
-export type IntegrationCredentialService = 'Linear' | 'Jira'
+export type IntegrationCredentialService = 'Linear' | 'Jira' | 'Bitbucket'
 
 export function credentialDecryptionMessage(service: IntegrationCredentialService): string {
   return `Could not decrypt saved ${service} credential. Approve Keychain access or reconnect ${service}.`
@@ -10,6 +10,7 @@ export function isIntegrationCredentialDecryptionError(error: unknown): boolean
   const message = error instanceof Error ? error.message : String(error)
   return (
     message.includes(credentialDecryptionMessage('Linear')) ||
-    message.includes(credentialDecryptionMessage('Jira'))
+    message.includes(credentialDecryptionMessage('Jira')) ||
+    message.includes(credentialDecryptionMessage('Bitbucket'))
   )
 }
diff --git a/src/shared/jira-types.ts b/src/shared/jira-types.ts
index ad8e84ecbad..6adaa966ead 100644
--- a/src/shared/jira-types.ts
+++ b/src/shared/jira-types.ts
@@ -19,7 +19,7 @@ export type JiraViewer = {
   avatarUrl?: string
 }
 
-export type JiraSiteSelection = string | 'all'
+export type JiraSiteSelection = (string & {}) | 'all'
 
 export type JiraConnectionStatus = {
   connected: boolean
diff --git a/src/shared/linear-agent-access.ts b/src/shared/linear-agent-access.ts
index 2ffa17cb406..69169268767 100644
--- a/src/shared/linear-agent-access.ts
+++ b/src/shared/linear-agent-access.ts
@@ -115,13 +115,13 @@ export type LinearIssueListRequest = {
   filter?: LinearIssueListFilter
   teamInput?: string
   limit?: number
-  workspaceId?: string | 'all'
+  workspaceId?: (string & {}) | 'all'
 }
 
 export type LinearProjectListRequest = {
   query?: string
   limit?: number
-  workspaceId?: string | 'all'
+  workspaceId?: (string & {}) | 'all'
 }
 
 export type LinearStatusSetRequest = LinearWriteTargetRequest & {
diff --git a/src/shared/linear-agent-result-types.ts b/src/shared/linear-agent-result-types.ts
index e986460007b..ae04c842d4d 100644
--- a/src/shared/linear-agent-result-types.ts
+++ b/src/shared/linear-agent-result-types.ts
@@ -144,7 +144,7 @@ export type LinearSearchResult = {
   issues: LinearSearchIssueSummary[]
   meta: {
     query: string
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
     limit: number
     returned: number
     limitReached: boolean
@@ -178,7 +178,7 @@ export type LinearTeamSummary = {
 export type LinearTeamListResult = {
   teams: LinearTeamSummary[]
   meta: {
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
     returned: number
     partial: boolean
     workspaceErrors: {
@@ -211,7 +211,7 @@ export type LinearIssueListResult = {
   issues: LinearSearchIssueSummary[]
   meta: {
     filter: LinearIssueListFilter
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
     team?: LinearTeamSummary
     limit: number
     returned: number
@@ -242,7 +242,7 @@ export type LinearProjectListResult = {
   projects: LinearAgentProjectSummary[]
   meta: {
     query?: string
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
     limit: number
     returned: number
     hasMore: boolean
diff --git a/src/shared/linear-issue-view-resume-state.ts b/src/shared/linear-issue-view-resume-state.ts
index 11fbb967570..82c03f87c2e 100644
--- a/src/shared/linear-issue-view-resume-state.ts
+++ b/src/shared/linear-issue-view-resume-state.ts
@@ -173,9 +173,7 @@ export function selectLinearWorkspaceIssueFilter(
   if (!workspaceId) {
     return emptyLinearIssueAttributeFilter()
   }
-  const filter = Object.prototype.hasOwnProperty.call(filters, workspaceId)
-    ? filters[workspaceId]
-    : undefined
+  const filter = Object.hasOwn(filters, workspaceId) ? filters[workspaceId] : undefined
   return filter ? canonicalizeLinearIssueAttributeFilter(filter) : emptyLinearIssueAttributeFilter()
 }
 
diff --git a/src/shared/linear-links.ts b/src/shared/linear-links.ts
index 0f1db592736..097a0f5e1f9 100644
--- a/src/shared/linear-links.ts
+++ b/src/shared/linear-links.ts
@@ -88,7 +88,7 @@ export function parseLinearIssueInput(input: string): ParsedLinearIssueInput | n
     const parts = parsed.pathname.split('/').filter(Boolean)
     const issueIndex = parts.indexOf('issue')
     const organizationUrlKey = parts[0]
-    const rawIdentifier = issueIndex >= 0 ? parts[issueIndex + 1] : undefined
+    const rawIdentifier = issueIndex !== -1 ? parts[issueIndex + 1] : undefined
     if (!organizationUrlKey || !rawIdentifier) {
       return null
     }
diff --git a/src/shared/linear-mcp-issue-list.ts b/src/shared/linear-mcp-issue-list.ts
index c668c848aef..6955eef16ab 100644
--- a/src/shared/linear-mcp-issue-list.ts
+++ b/src/shared/linear-mcp-issue-list.ts
@@ -19,7 +19,7 @@ export type LinearMcpIssueListRequest = {
   createdAt?: string
   updatedAt?: string
   includeArchived?: boolean
-  workspaceId?: string | 'all'
+  workspaceId?: (string & {}) | 'all'
 }
 
 export type LinearMcpIssueListResult = {
@@ -30,7 +30,7 @@ export type LinearMcpIssueListResult = {
     hasMore: boolean
     nextCursor?: string
     orderBy: 'createdAt' | 'updatedAt'
-    workspaceId?: string | 'all'
+    workspaceId?: (string & {}) | 'all'
     partial: boolean
     workspaceErrors: {
       workspace: LinearWorkspaceCandidate
diff --git a/src/shared/local-build-compatibility-contract.json b/src/shared/local-build-compatibility-contract.json
index d7b46db0959..705d1d92f99 100644
--- a/src/shared/local-build-compatibility-contract.json
+++ b/src/shared/local-build-compatibility-contract.json
@@ -3,9 +3,9 @@
   "appId": "com.stablyai.orca",
   "stateSchemaVersion": 1,
   "readableStateSchemaVersions": [1],
-  "daemonProtocolVersion": 32,
+  "daemonProtocolVersion": 33,
   "attachableDaemonProtocolVersions": [
     1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26,
-    27, 28, 29, 30, 31, 32
+    27, 28, 29, 30, 31, 32, 33
   ]
 }
diff --git a/src/shared/local-build-compatibility-contract.ts b/src/shared/local-build-compatibility-contract.ts
index 07bbacd3d3a..39556be77a9 100644
--- a/src/shared/local-build-compatibility-contract.ts
+++ b/src/shared/local-build-compatibility-contract.ts
@@ -3,9 +3,9 @@ export const LOCAL_BUILD_COMPATIBILITY_CONTRACT = {
   appId: 'com.stablyai.orca',
   stateSchemaVersion: 1,
   readableStateSchemaVersions: [1],
-  daemonProtocolVersion: 32,
+  daemonProtocolVersion: 33,
   attachableDaemonProtocolVersions: [
     1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26,
-    27, 28, 29, 30, 31, 32
+    27, 28, 29, 30, 31, 32, 33
   ]
 } as const
diff --git a/src/shared/manual-repo-order.test.ts b/src/shared/manual-repo-order.test.ts
index 298ba4a10a1..3044a8d5399 100644
--- a/src/shared/manual-repo-order.test.ts
+++ b/src/shared/manual-repo-order.test.ts
@@ -27,6 +27,26 @@ describe('manual repo order', () => {
     expect(applyManualRepoOrder([localBravo, localAlpha], [])).toEqual([localBravo, localAlpha])
   })
 
+  it('returns the input array when no overlay exists', () => {
+    const repos = [localBravo, localAlpha]
+
+    expect(applyManualRepoOrder(repos, [])).toBe(repos)
+  })
+
+  it('returns the input array when the saved order moves nothing', () => {
+    const repos = [localAlpha, remoteCharlie, localBravo, remoteDelta]
+
+    expect(applyManualRepoOrder(repos, getManualRepoOrder(repos))).toBe(repos)
+  })
+
+  it('returns a new array when the saved order actually reorders', () => {
+    const repos = [localBravo, localAlpha]
+    const reordered = applyManualRepoOrder(repos, getManualRepoOrder([localAlpha, localBravo]))
+
+    expect(reordered).not.toBe(repos)
+    expect(reordered).toEqual([localAlpha, localBravo])
+  })
+
   it('restores a host-qualified cross-host interleaving', () => {
     const order = getManualRepoOrder([localAlpha, remoteCharlie, localBravo, remoteDelta])
 
diff --git a/src/shared/manual-repo-order.ts b/src/shared/manual-repo-order.ts
index 1ba8c886cab..9b5bfee39a1 100644
--- a/src/shared/manual-repo-order.ts
+++ b/src/shared/manual-repo-order.ts
@@ -41,13 +41,15 @@ export function getManualRepoOrder(repos: readonly Repo[]): ManualRepoOrderEntry
 export function applyManualRepoOrder(
   repos: readonly Repo[],
   order: readonly ManualRepoOrderEntry[] | null | undefined
-): Repo[] {
+): readonly Repo[] {
   const normalized = normalizeManualRepoOrder(order)
+  // Why: results flow straight back into `repos`, so a reorder that moves nothing must return
+  // the input — a fresh array would invalidate every identity-keyed repo memo downstream.
   if (normalized.length === 0) {
-    return [...repos]
+    return repos
   }
   const rankByKey = new Map(normalized.map((entry, index) => [getEntryKey(entry), index]))
-  return repos
+  const ordered = repos
     .map((repo, index) => ({
       repo,
       index,
@@ -66,4 +68,5 @@ export function applyManualRepoOrder(
       return a.rank - b.rank || a.index - b.index
     })
     .map(({ repo }) => repo)
+  return ordered.every((repo, index) => repo === repos[index]) ? repos : ordered
 }
diff --git a/src/shared/mcp-config.ts b/src/shared/mcp-config.ts
index 0cc0ce60d3b..09fbc6d3865 100644
--- a/src/shared/mcp-config.ts
+++ b/src/shared/mcp-config.ts
@@ -165,7 +165,7 @@ export function inspectMcpConfigContent(
 function collectMcpServerEntries(rawServers: Record<string, unknown>): [string, unknown][] | null {
   const entries: [string, unknown][] = []
   for (const name in rawServers) {
-    if (!Object.prototype.hasOwnProperty.call(rawServers, name)) {
+    if (!Object.hasOwn(rawServers, name)) {
       continue
     }
     if (
diff --git a/src/shared/mcp-server-inspection.ts b/src/shared/mcp-server-inspection.ts
index ab7a79cf40b..a475ff413e8 100644
--- a/src/shared/mcp-server-inspection.ts
+++ b/src/shared/mcp-server-inspection.ts
@@ -66,7 +66,7 @@ function inspectMcpEnv(env: unknown): BoundedEnv {
   const masked: Record<string, string> = {}
   let fields = 0
   for (const key in env) {
-    if (!Object.prototype.hasOwnProperty.call(env, key)) {
+    if (!Object.hasOwn(env, key)) {
       continue
     }
     fields += 1
diff --git a/src/shared/mobile-relay-pairing-offer.test.ts b/src/shared/mobile-relay-pairing-offer.test.ts
index d8b78c5622e..bc49ca2f884 100644
--- a/src/shared/mobile-relay-pairing-offer.test.ts
+++ b/src/shared/mobile-relay-pairing-offer.test.ts
@@ -12,4 +12,14 @@ describe('desktop mobile-relay pairing contract', () => {
       expect(result.success ? result.data : null).toEqual(fixture.expected)
     })
   }
+
+  it('preserves optional paired device identity', () => {
+    const fixture = createMobileRelayPairingFixtures(now)[0]!
+    if (!fixture.expected) {
+      throw new Error('Expected a valid direct pairing fixture')
+    }
+    const payload = { ...fixture.expected, pairedDeviceId: 'paired-device-a' }
+
+    expect(schema.parse(payload)).toMatchObject({ pairedDeviceId: 'paired-device-a' })
+  })
 })
diff --git a/src/shared/mobile-relay-pairing-offer.ts b/src/shared/mobile-relay-pairing-offer.ts
index 11405225974..4f5f2cc3d8c 100644
--- a/src/shared/mobile-relay-pairing-offer.ts
+++ b/src/shared/mobile-relay-pairing-offer.ts
@@ -75,6 +75,7 @@ export function createPairingOfferSchema(now: () => number = () => Date.now()) {
       // Why: the desktop's Curve25519 public key is pinned by the pairing
       // offer, while relayHostId is verified from its decoded bytes later.
       publicKeyB64: z.string().min(1).max(PAIRING_PUBLIC_KEY_MAX_CHARACTERS),
+      pairedDeviceId: z.string().min(1).max(128).optional(),
       scope: PairingScopeSchema.optional(),
       relay: relaySchema.optional()
     })
diff --git a/src/shared/native-chat-image-transcript-markers.ts b/src/shared/native-chat-image-transcript-markers.ts
index a55f0c9c272..34c2e9ae32d 100644
--- a/src/shared/native-chat-image-transcript-markers.ts
+++ b/src/shared/native-chat-image-transcript-markers.ts
@@ -21,7 +21,7 @@ function stripImagePromptMarkersFromFirstText(
   blocks: readonly NativeChatBlock[]
 ): NativeChatBlock[] {
   const textIndex = blocks.findIndex(isTextBlock)
-  if (textIndex < 0) {
+  if (textIndex === -1) {
     return blocks as NativeChatBlock[]
   }
   const block = blocks[textIndex]
diff --git a/src/shared/native-chat-session-option-commands.test.ts b/src/shared/native-chat-session-option-commands.test.ts
index 2583192d34b..77205f6ba5c 100644
--- a/src/shared/native-chat-session-option-commands.test.ts
+++ b/src/shared/native-chat-session-option-commands.test.ts
@@ -68,7 +68,7 @@ describe('buildNativeChatSessionOptionCommand', () => {
     ).toBe('/fast')
   })
 
-  it('builds an absolute command for live Codex model changes', () => {
+  it('does not turn a Codex model pick into pasted slash-command prose', () => {
     expect(
       buildNativeChatSessionOptionCommand({
         optionId: 'model',
@@ -79,7 +79,12 @@ describe('buildNativeChatSessionOptionCommand', () => {
         models: CODEX_SESSION_OPTION_CATALOG.models,
         record: createNativeChatSessionOptionRecord('codex')
       })
-    ).toBe('/model gpt-5.5')
+    ).toBeNull()
+    expect(CODEX_SESSION_OPTION_CATALOG.modelApply.midSession).toEqual({
+      kind: 'agent-picker',
+      command: '/model',
+      delivery: 'type'
+    })
   })
 })
 
diff --git a/src/shared/native-chat-session-option-commands.ts b/src/shared/native-chat-session-option-commands.ts
index 6fb5095be8d..e4efd5efdf9 100644
--- a/src/shared/native-chat-session-option-commands.ts
+++ b/src/shared/native-chat-session-option-commands.ts
@@ -22,7 +22,7 @@ export function parseBuiltSessionOptionCommand(
   const marker = '__orca_session_option_value__'
   const template = build(marker)
   const markerIndex = template.indexOf(marker)
-  if (markerIndex < 0) {
+  if (markerIndex === -1) {
     return null
   }
   const prefix = template.slice(0, markerIndex)
diff --git a/src/shared/native-chat-session-option-snapshot.test.ts b/src/shared/native-chat-session-option-snapshot.test.ts
index c6436f9aad4..961701b7415 100644
--- a/src/shared/native-chat-session-option-snapshot.test.ts
+++ b/src/shared/native-chat-session-option-snapshot.test.ts
@@ -207,7 +207,7 @@ describe('buildNativeChatSessionOptionSnapshot', () => {
     })
   })
 
-  it('exposes Codex model changes as native selectable values', () => {
+  it('routes Codex model changes through its typed TUI picker', () => {
     const snapshot = buildNativeChatSessionOptionSnapshot({
       catalog: CODEX_SESSION_OPTION_CATALOG,
       models: CODEX_SESSION_OPTION_CATALOG.models,
@@ -216,7 +216,7 @@ describe('buildNativeChatSessionOptionSnapshot', () => {
       modelLabel: 'Model'
     })
     expect(snapshot[0]).toMatchObject({ settable: true })
-    expect(snapshot[0]?.action).toBeUndefined()
+    expect(snapshot[0]?.action).toEqual({ type: 'agent-picker' })
     expect(snapshot[0]?.kind).toMatchObject({
       type: 'select',
       choices: expect.arrayContaining([{ value: 'gpt-5.5', label: 'GPT-5.5' }])
diff --git a/src/shared/native-chat-tool-summary.ts b/src/shared/native-chat-tool-summary.ts
index 3f71d997e15..a048e16da0e 100644
--- a/src/shared/native-chat-tool-summary.ts
+++ b/src/shared/native-chat-tool-summary.ts
@@ -283,7 +283,7 @@ function boundedPreviewValue(value: unknown, depth: number, seen: WeakSet<object
   const result: Record<string, unknown> = {}
   let count = 0
   for (const key in value) {
-    if (!Object.prototype.hasOwnProperty.call(value, key)) {
+    if (!Object.hasOwn(value, key)) {
       continue
     }
     if (count >= MAX_PREVIEW_COLLECTION_ITEMS) {
diff --git a/src/shared/native-chat-transcript-retention.test.ts b/src/shared/native-chat-transcript-retention.test.ts
index e62d980bd3f..d1f0a443e00 100644
--- a/src/shared/native-chat-transcript-retention.test.ts
+++ b/src/shared/native-chat-transcript-retention.test.ts
@@ -10,40 +10,27 @@ function message(id: string): NativeChatMessage {
 }
 
 describe('native chat transcript retention', () => {
-  it('holds only the latest settled transcript for the same identity while loading', () => {
+  it('holds only the latest settled transcript for the same identity while unsettled', () => {
     const retention = createNativeChatTranscriptRetention()
     const first = [message('first')]
     const second = [message('second')]
 
     retention.capture('source-a', first)
-    expect(
-      retention.visible({ identity: 'source-a', messages: [], settled: false, loading: true })
-    ).toBe(first)
-    expect(
-      retention.visible({ identity: 'source-b', messages: [], settled: false, loading: true })
-    ).toEqual([])
+    expect(retention.visible({ identity: 'source-a', messages: [], settled: false })).toBe(first)
+    expect(retention.visible({ identity: 'source-b', messages: [], settled: false })).toEqual([])
 
     retention.capture('source-b', second)
-    expect(
-      retention.visible({ identity: 'source-a', messages: [], settled: false, loading: true })
-    ).toEqual([])
-    expect(
-      retention.visible({ identity: 'source-b', messages: [], settled: false, loading: true })
-    ).toBe(second)
+    expect(retention.visible({ identity: 'source-a', messages: [], settled: false })).toEqual([])
+    expect(retention.visible({ identity: 'source-b', messages: [], settled: false })).toBe(second)
   })
 
-  it('never substitutes retained history for a settled or non-loading read', () => {
+  it('never substitutes retained history for a settled read', () => {
     const retention = createNativeChatTranscriptRetention()
     const retained = [message('retained')]
     const fresh = [message('fresh')]
     retention.capture('source', retained)
 
-    expect(
-      retention.visible({ identity: 'source', messages: fresh, settled: true, loading: false })
-    ).toBe(fresh)
-    expect(
-      retention.visible({ identity: 'source', messages: [], settled: false, loading: false })
-    ).toEqual([])
+    expect(retention.visible({ identity: 'source', messages: fresh, settled: true })).toBe(fresh)
   })
 
   it('encodes identity components without delimiter collisions', () => {
diff --git a/src/shared/native-chat-transcript-retention.ts b/src/shared/native-chat-transcript-retention.ts
index a2f891bb763..860bea95778 100644
--- a/src/shared/native-chat-transcript-retention.ts
+++ b/src/shared/native-chat-transcript-retention.ts
@@ -12,7 +12,6 @@ export type NativeChatTranscriptRetention = {
     identity: string
     messages: NativeChatMessage[]
     settled: boolean
-    loading: boolean
   }) => NativeChatMessage[]
 }
 
@@ -24,13 +23,12 @@ export function createNativeChatTranscriptRetention(): NativeChatTranscriptReten
     capture(identity, messages) {
       captured = { identity, messages }
     },
-    visible({ identity, messages, settled, loading }) {
+    visible({ identity, messages, settled }) {
       if (settled) {
         return messages
       }
-      return loading && captured?.identity === identity
-        ? captured.messages
-        : EMPTY_NATIVE_CHAT_TRANSCRIPT
+      // An unsettled read includes a failed one: retained history beats blanking the pane for a transient error.
+      return captured?.identity === identity ? captured.messages : EMPTY_NATIVE_CHAT_TRANSCRIPT
     }
   }
 }
diff --git a/src/shared/opencode-terminal-title.test.ts b/src/shared/opencode-terminal-title.test.ts
index f1cb825e8cd..35bb339f797 100644
--- a/src/shared/opencode-terminal-title.test.ts
+++ b/src/shared/opencode-terminal-title.test.ts
@@ -4,20 +4,30 @@ import { isMeaningfulOpenCodeTerminalTitle, isOpenCodeNativeTitle } from './open
 describe('OpenCode terminal titles', () => {
   it('recognizes native session titles', () => {
     expect(isMeaningfulOpenCodeTerminalTitle('OC | Native Stable Session')).toBe(true)
-    expect(isMeaningfulOpenCodeTerminalTitle('  OC|Session  ')).toBe(true)
+    expect(isMeaningfulOpenCodeTerminalTitle('  OC | Session  ')).toBe(true)
     expect(isOpenCodeNativeTitle('OC | Understand about the plugin')).toBe(true)
     expect(isOpenCodeNativeTitle('tmux | OC | ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('ssh build-host | OC | ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('user@host: ~/code | OC | ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('▣ OC | ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('⠋ OC | ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('ssh build-host | ⠋ OC | ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('OC |   ses_123')).toBe(true)
+    expect(isOpenCodeNativeTitle('OC |\tses_123')).toBe(true)
   })
 
   it('rejects generic, incomplete, embedded, and lookalike titles', () => {
     expect(isMeaningfulOpenCodeTerminalTitle('OpenCode')).toBe(false)
     expect(isMeaningfulOpenCodeTerminalTitle('OpenCode ready')).toBe(false)
     expect(isMeaningfulOpenCodeTerminalTitle('OC |')).toBe(false)
+    // Why: the native marker always spaces its separator; `OC|x` is another tool's
+    // pipe-delimited title, so accepting it would make a non-OpenCode pane a send target.
+    expect(isMeaningfulOpenCodeTerminalTitle('OC|Session')).toBe(false)
+    expect(isMeaningfulOpenCodeTerminalTitle('OC |Session')).toBe(false)
     expect(isMeaningfulOpenCodeTerminalTitle(undefined)).toBe(false)
     // Why: lowercase is not OpenCode's native marker; avoid "oc |" cwd/task noise.
     expect(isOpenCodeNativeTitle('oc | Understand about the plugin')).toBe(false)
     // Why: mid-title OC must not steal another agent's braille/task frame.
     expect(isOpenCodeNativeTitle('⠋ Fix foo | OC | bar')).toBe(false)
-    expect(isOpenCodeNativeTitle('my session | OC | task')).toBe(false)
   })
 })
diff --git a/src/shared/opencode-terminal-title.ts b/src/shared/opencode-terminal-title.ts
index 01d3d3819ae..c45cc9fd49c 100644
--- a/src/shared/opencode-terminal-title.ts
+++ b/src/shared/opencode-terminal-title.ts
@@ -1,12 +1,10 @@
-// Why: OpenCode abbreviates native OSC session titles as `OC | <task>` (no
-// agent-name token). Optional single-token multiplexer prefix covers SSH/tmux
-// frames like `tmux | OC | …`. Case-sensitive `OC` avoids ordinary lowercase
-// "oc" lookalikes; require non-whitespace after the marker so bare `OC |` is not
-// identity. Used for both display-title preservation and tab-agent identity.
-const OPENCODE_NATIVE_TITLE_RE = /^(?:[^|\s]+ \| )?OC\s*\|\s*\S/u
+// Why: wrappers may prepend an SSH/tmux label, and OpenCode may prepend one
+// status glyph. A spinner-led task from another agent must not become a wrapper.
+const OPENCODE_NATIVE_TITLE_RE =
+  /^\s*(?:(?![▣\u2800-\u28ff])[^|]+? \| )?(?:[▣\u2800-\u28ff] )?OC \|[ \t]+\S/u
 
 export function isOpenCodeNativeTitle(title: string | null | undefined): boolean {
-  return OPENCODE_NATIVE_TITLE_RE.test(title?.trim() ?? '')
+  return title ? OPENCODE_NATIVE_TITLE_RE.test(title) : false
 }
 
 export function isMeaningfulOpenCodeTerminalTitle(title: string | null | undefined): boolean {
diff --git a/src/shared/owned-utf16-suffix.ts b/src/shared/owned-utf16-suffix.ts
new file mode 100644
index 00000000000..19d623db60e
--- /dev/null
+++ b/src/shared/owned-utf16-suffix.ts
@@ -0,0 +1,20 @@
+const COPY_BLOCK_CODE_UNITS = 4 * 1024
+
+export function copyUtf16SuffixToOwnedString(value: string, suffixCodeUnits: number): string {
+  const suffixLength = Math.max(0, Math.min(value.length, suffixCodeUnits))
+  const start = value.length - suffixLength
+  const blocks: string[] = []
+  const codeUnits: number[] = []
+  codeUnits.length = Math.min(COPY_BLOCK_CODE_UNITS, suffixLength)
+
+  // Why: slice can retain an arbitrarily large V8 backing string.
+  for (let offset = start; offset < value.length; offset += COPY_BLOCK_CODE_UNITS) {
+    const blockLength = Math.min(COPY_BLOCK_CODE_UNITS, value.length - offset)
+    codeUnits.length = blockLength
+    for (let index = 0; index < blockLength; index += 1) {
+      codeUnits[index] = value.charCodeAt(offset + index)
+    }
+    blocks.push(String.fromCharCode(...codeUnits))
+  }
+  return blocks.join('')
+}
diff --git a/src/shared/persisted-state-file-bounds.test.ts b/src/shared/persisted-state-file-bounds.test.ts
deleted file mode 100644
index e6ee2de1878..00000000000
--- a/src/shared/persisted-state-file-bounds.test.ts
+++ /dev/null
@@ -1,171 +0,0 @@
-import { createHash } from 'node:crypto'
-import {
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  truncateSync,
-  writeFileSync
-} from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { NodeFileReadTooLargeError } from './node-bounded-file-reader'
-import { JsonStringifyByteLimitError } from './node-bounded-json-stringify'
-import {
-  PersistedStateSecretCapacityError,
-  assertPersistedStateSecretWithinLimit,
-  readPersistedStateJsonFileSync,
-  replacePersistedStateJsonWithinLimit,
-  restorePersistedStateBackupSync,
-  stringifyPrettyPersistedStateWithinLimit,
-  stringifyPersistedStateWithinLimit,
-  updatePersistedStateHashWithJsonRange
-} from './persisted-state-file-bounds'
-
-describe('persisted state file bounds', () => {
-  let root = ''
-
-  beforeEach(() => {
-    root = mkdtempSync(join(tmpdir(), 'orca-state-bounds-'))
-  })
-
-  afterEach(() => {
-    rmSync(root, { recursive: true, force: true })
-  })
-
-  it('reads and parses a state file exactly at the byte limit', () => {
-    const path = join(root, 'state.json')
-    const json = `{"value":"${'x'.repeat(20)}"}`
-    writeFileSync(path, json)
-
-    expect(
-      readPersistedStateJsonFileSync<{ value: string }>(path, Buffer.byteLength(json))
-    ).toEqual({
-      byteLength: Buffer.byteLength(json),
-      value: { value: 'x'.repeat(20) }
-    })
-  })
-
-  it('rejects an oversized sparse state file before reading its body', () => {
-    const path = join(root, 'state.json')
-    writeFileSync(path, '')
-    truncateSync(path, 1025)
-
-    expect(() => readPersistedStateJsonFileSync(path, 1024)).toThrow(NodeFileReadTooLargeError)
-  })
-
-  it('rejects structurally amplified state before parsing it', () => {
-    const path = join(root, 'state.json')
-    const json = '{"rows":[{},{}]}'
-    writeFileSync(path, json)
-
-    expect(() =>
-      readPersistedStateJsonFileSync(path, Buffer.byteLength(json), {
-        structuralTokens: 7,
-        nestingDepth: 3
-      })
-    ).toThrow('JSON structure')
-  })
-
-  it('matches native compact JSON exactly at the output boundary', () => {
-    const state = { quote: '"', unicode: '🐋', nested: [1, true, null] }
-    const native = JSON.stringify(state)
-
-    expect(stringifyPersistedStateWithinLimit(state, Buffer.byteLength(native))).toEqual({
-      byteLength: Buffer.byteLength(native),
-      serialized: native
-    })
-    expect(() => stringifyPersistedStateWithinLimit(state, Buffer.byteLength(native) - 1)).toThrow(
-      JsonStringifyByteLimitError
-    )
-  })
-
-  it('matches native pretty JSON and enforces its whitespace-inclusive boundary', () => {
-    const state = { nested: { value: 'x' }, list: [1, 2] }
-    const native = JSON.stringify(state, null, 2)
-
-    expect(stringifyPrettyPersistedStateWithinLimit(state, Buffer.byteLength(native))).toEqual({
-      byteLength: Buffer.byteLength(native),
-      serialized: native
-    })
-    expect(() =>
-      stringifyPrettyPersistedStateWithinLimit(state, Buffer.byteLength(native) - 1)
-    ).toThrow(JsonStringifyByteLimitError)
-  })
-
-  it('bounds secret plaintext before encryption can expand it', () => {
-    assertPersistedStateSecretWithinLimit('🐋', 4)
-
-    expect(() => assertPersistedStateSecretWithinLimit('🐋x', 4)).toThrow(
-      PersistedStateSecretCapacityError
-    )
-  })
-
-  it('checks replacement growth before constructing the next payload', () => {
-    const serialized = '{"value":"slot"}'
-    const exactBytes =
-      Buffer.byteLength(serialized) - Buffer.byteLength('slot') + Buffer.byteLength('expanded')
-
-    expect(
-      replacePersistedStateJsonWithinLimit({
-        serialized,
-        currentBytes: Buffer.byteLength(serialized),
-        search: 'slot',
-        replacement: 'expanded',
-        maxBytes: exactBytes
-      })
-    ).toEqual({ byteLength: exactBytes, serialized: '{"value":"expanded"}' })
-    expect(() =>
-      replacePersistedStateJsonWithinLimit({
-        serialized,
-        currentBytes: Buffer.byteLength(serialized),
-        search: 'slot',
-        replacement: 'expanded',
-        maxBytes: exactBytes - 1
-      })
-    ).toThrow(JsonStringifyByteLimitError)
-  })
-
-  it('hashes bounded string ranges without splitting UTF-16 surrogate pairs', () => {
-    const value = `prefix-${'x'.repeat(8)}🐋-${'y'.repeat(8)}-suffix`
-    const expected = createHash('sha1').update(value).digest('hex')
-    const actual = createHash('sha1')
-
-    updatePersistedStateHashWithJsonRange(actual, value, 0, value.length, 2)
-
-    expect(actual.digest('hex')).toBe(expected)
-  })
-
-  it('atomically restores only a valid in-limit backup', () => {
-    const backupPath = join(root, 'backup.json')
-    const targetPath = join(root, 'profile', 'orca-data.json')
-    writeFileSync(backupPath, '{"repos":[{"id":"recovered"}]}')
-
-    restorePersistedStateBackupSync(backupPath, targetPath, 1024)
-
-    expect(JSON.parse(readFileSync(targetPath, 'utf8'))).toEqual({
-      repos: [{ id: 'recovered' }]
-    })
-    const originalTarget = readFileSync(targetPath)
-    writeFileSync(backupPath, '{{invalid')
-    expect(() => restorePersistedStateBackupSync(backupPath, targetPath, 1024)).toThrow()
-    expect(readFileSync(targetPath)).toEqual(originalTarget)
-    expect(
-      readdirSync(join(root, 'profile')).filter((name) => name.endsWith('.recovery.tmp'))
-    ).toEqual([])
-  })
-
-  it('leaves the target untouched when a backup exceeds the cap', () => {
-    const backupPath = join(root, 'backup.json')
-    const targetPath = join(root, 'orca-data.json')
-    writeFileSync(targetPath, '{"original":true}')
-    writeFileSync(backupPath, '')
-    truncateSync(backupPath, 1025)
-
-    expect(() => restorePersistedStateBackupSync(backupPath, targetPath, 1024)).toThrow(
-      NodeFileReadTooLargeError
-    )
-    expect(readFileSync(targetPath, 'utf8')).toBe('{"original":true}')
-  })
-})
diff --git a/src/shared/persisted-state-file-bounds.ts b/src/shared/persisted-state-file-bounds.ts
deleted file mode 100644
index 8ad92c95435..00000000000
--- a/src/shared/persisted-state-file-bounds.ts
+++ /dev/null
@@ -1,204 +0,0 @@
-import { randomUUID, type Hash } from 'node:crypto'
-import { mkdirSync, renameSync, rmSync, writeFileSync } from 'node:fs'
-import { dirname } from 'node:path'
-import { readNodeFileSyncWithinLimit, type BoundedNodeFileRead } from './node-bounded-file-reader'
-import {
-  JsonStringifyByteLimitError,
-  stringifyJsonWithinByteLimit
-} from './node-bounded-json-stringify'
-import {
-  assertJsonTextStructureWithinLimits,
-  type JsonTextStructureLimits
-} from './json-text-structure-limit'
-
-export const ORCA_PERSISTED_STATE_MAX_BYTES = 64 * 1024 * 1024
-export const ORCA_PERSISTED_STATE_SECRET_MAX_BYTES = 4 * 1024 * 1024
-export const ORCA_PERSISTED_STATE_HASH_CHUNK_CODE_UNITS = 64 * 1024
-export const ORCA_PERSISTED_STATE_JSON_LIMITS: JsonTextStructureLimits = {
-  structuralTokens: 4_000_000,
-  nestingDepth: 256
-}
-
-export type PersistedStateJsonRead<T> = {
-  byteLength: number
-  value: T
-}
-
-export class PersistedStateSecretCapacityError extends Error {
-  constructor(
-    readonly observedBytes: number,
-    readonly maxBytes = ORCA_PERSISTED_STATE_SECRET_MAX_BYTES
-  ) {
-    super(`Persisted state secret exceeds ${maxBytes} bytes`)
-    this.name = 'PersistedStateSecretCapacityError'
-  }
-}
-
-export function readPersistedStateJsonFileSync<T>(
-  filePath: string,
-  maxBytes = ORCA_PERSISTED_STATE_MAX_BYTES,
-  structureLimits: JsonTextStructureLimits = ORCA_PERSISTED_STATE_JSON_LIMITS
-): PersistedStateJsonRead<T> {
-  const { buffer } = readPersistedStateFileBytesSync(filePath, maxBytes)
-  return {
-    byteLength: buffer.byteLength,
-    value: parsePersistedStateJsonBuffer<T>(buffer, structureLimits)
-  }
-}
-
-export function readPersistedStateFileBytesSync(
-  filePath: string,
-  maxBytes = ORCA_PERSISTED_STATE_MAX_BYTES
-): BoundedNodeFileRead {
-  return readNodeFileSyncWithinLimit(filePath, maxBytes)
-}
-
-export function parsePersistedStateJsonBuffer<T>(
-  buffer: Buffer,
-  structureLimits: JsonTextStructureLimits = ORCA_PERSISTED_STATE_JSON_LIMITS
-): T {
-  const serialized = buffer.toString('utf8')
-  assertJsonTextStructureWithinLimits(serialized, structureLimits)
-  return JSON.parse(serialized) as T
-}
-
-export function stringifyPersistedStateWithinLimit(
-  value: unknown,
-  maxBytes = ORCA_PERSISTED_STATE_MAX_BYTES
-): { byteLength: number; serialized: string } {
-  return stringifyJsonWithinByteLimit(value, maxBytes)
-}
-
-export function stringifyPrettyPersistedStateWithinLimit(
-  value: unknown,
-  maxBytes = ORCA_PERSISTED_STATE_MAX_BYTES
-): { byteLength: number; serialized: string } {
-  return stringifyJsonWithinByteLimit(value, maxBytes, 2)
-}
-
-export function assertPersistedStateSecretWithinLimit(
-  value: string,
-  maxBytes = ORCA_PERSISTED_STATE_SECRET_MAX_BYTES
-): void {
-  const observedBytes = Buffer.byteLength(value, 'utf8')
-  if (observedBytes > maxBytes) {
-    throw new PersistedStateSecretCapacityError(observedBytes, maxBytes)
-  }
-}
-
-export function replacedPersistedStateJsonByteLength(options: {
-  currentBytes: number
-  maxBytes?: number
-  replacement: string
-  search: string
-}): number {
-  const maxBytes = options.maxBytes ?? ORCA_PERSISTED_STATE_MAX_BYTES
-  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
-    throw new RangeError('Persisted state JSON byte limit must be a non-negative safe integer')
-  }
-  if (!Number.isSafeInteger(options.currentBytes) || options.currentBytes < 0) {
-    throw new RangeError('Persisted state JSON byte count must be a non-negative safe integer')
-  }
-  if (options.currentBytes > maxBytes) {
-    throw new JsonStringifyByteLimitError(options.currentBytes, maxBytes)
-  }
-  const nextBytes =
-    options.currentBytes -
-    Buffer.byteLength(options.search, 'utf8') +
-    Buffer.byteLength(options.replacement, 'utf8')
-  if (!Number.isSafeInteger(nextBytes) || nextBytes < 0 || nextBytes > maxBytes) {
-    throw new JsonStringifyByteLimitError(nextBytes, maxBytes)
-  }
-  return nextBytes
-}
-
-export function replacePersistedStateJsonWithinLimit(options: {
-  currentBytes: number
-  maxBytes?: number
-  replacement: string
-  search: string
-  serialized: string
-}): { byteLength: number; serialized: string } {
-  const byteLength = replacedPersistedStateJsonByteLength(options)
-  const searchIndex = options.serialized.indexOf(options.search)
-  if (searchIndex === -1) {
-    throw new Error('Persisted state JSON replacement slot is missing')
-  }
-  if (options.serialized.includes(options.search, searchIndex + options.search.length)) {
-    throw new Error('Persisted state JSON replacement slot is ambiguous')
-  }
-  return {
-    byteLength,
-    serialized: options.serialized.replace(options.search, () => options.replacement)
-  }
-}
-
-export function updatePersistedStateHashWithJsonRange(
-  hash: Pick<Hash, 'update'>,
-  value: string,
-  start = 0,
-  end = value.length,
-  chunkCodeUnits = ORCA_PERSISTED_STATE_HASH_CHUNK_CODE_UNITS
-): void {
-  if (
-    !Number.isSafeInteger(start) ||
-    !Number.isSafeInteger(end) ||
-    start < 0 ||
-    end < start ||
-    end > value.length
-  ) {
-    throw new RangeError('Persisted state hash range is invalid')
-  }
-  if (!Number.isSafeInteger(chunkCodeUnits) || chunkCodeUnits <= 0) {
-    throw new RangeError('Persisted state hash chunk size must be a positive safe integer')
-  }
-
-  let offset = start
-  while (offset < end) {
-    let nextOffset = Math.min(end, offset + chunkCodeUnits)
-    if (
-      nextOffset < end &&
-      isHighSurrogate(value.charCodeAt(nextOffset - 1)) &&
-      isLowSurrogate(value.charCodeAt(nextOffset))
-    ) {
-      nextOffset += 1
-    }
-    hash.update(value.slice(offset, nextOffset), 'utf8')
-    offset = nextOffset
-  }
-}
-
-export function restorePersistedStateBackupSync(
-  sourcePath: string,
-  targetPath: string,
-  maxBytes = ORCA_PERSISTED_STATE_MAX_BYTES
-): number {
-  const read = readValidatedPersistedStateBytesSync(sourcePath, maxBytes)
-  mkdirSync(dirname(targetPath), { recursive: true })
-  const temporaryPath = `${targetPath}.${process.pid}.${randomUUID()}.recovery.tmp`
-  try {
-    writeFileSync(temporaryPath, read.buffer)
-    renameSync(temporaryPath, targetPath)
-  } catch (error) {
-    rmSync(temporaryPath, { force: true })
-    throw error
-  }
-  return read.buffer.byteLength
-}
-
-function readValidatedPersistedStateBytesSync(
-  filePath: string,
-  maxBytes: number
-): BoundedNodeFileRead {
-  const read = readPersistedStateFileBytesSync(filePath, maxBytes)
-  parsePersistedStateJsonBuffer(read.buffer)
-  return read
-}
-
-function isHighSurrogate(code: number): boolean {
-  return code >= 0xd800 && code <= 0xdbff
-}
-
-function isLowSurrogate(code: number): boolean {
-  return code >= 0xdc00 && code <= 0xdfff
-}
diff --git a/src/shared/persisted-ui-equality.ts b/src/shared/persisted-ui-equality.ts
index b82320737c9..701359c487d 100644
--- a/src/shared/persisted-ui-equality.ts
+++ b/src/shared/persisted-ui-equality.ts
@@ -36,7 +36,7 @@ export function persistedUIValuesEqual(left: unknown, right: unknown): boolean {
 
   for (const key of leftKeys) {
     if (
-      !Object.prototype.hasOwnProperty.call(rightRecord, key) ||
+      !Object.hasOwn(rightRecord, key) ||
       !persistedUIValuesEqual(leftRecord[key], rightRecord[key])
     ) {
       return false
diff --git a/src/shared/plugins/plugin-language-pack-artifact.test.ts b/src/shared/plugins/plugin-language-pack-artifact.test.ts
index e684bb50095..a313cc33839 100644
--- a/src/shared/plugins/plugin-language-pack-artifact.test.ts
+++ b/src/shared/plugins/plugin-language-pack-artifact.test.ts
@@ -1,7 +1,11 @@
 import { describe, expect, it } from 'vitest'
 import {
+  isPluginLanguagePackRegistration,
   parsePluginLanguagePackArtifact,
   PLUGIN_LANGUAGE_CATALOG_MAX_DEPTH,
+  PLUGIN_LANGUAGE_CATALOG_MAX_ENTRIES,
+  validatePluginLanguagePackCatalog,
+  validatePluginLanguagePackCatalogShape,
   pluginLanguageResourceId
 } from './plugin-language-pack-artifact'
 
@@ -163,4 +167,48 @@ describe('plugin language-pack artifacts', () => {
       error: expect.stringContaining('depth')
     })
   })
+
+  it('accepts the entry limit and rejects one additional entry', () => {
+    const catalog = Object.fromEntries(
+      Array.from({ length: PLUGIN_LANGUAGE_CATALOG_MAX_ENTRIES }, (_, index) => [
+        `key${index}`,
+        'value'
+      ])
+    )
+
+    expect(validatePluginLanguagePackCatalog(catalog)).toMatchObject({
+      ok: true,
+      entries: PLUGIN_LANGUAGE_CATALOG_MAX_ENTRIES
+    })
+    catalog.overflow = 'value'
+    expect(validatePluginLanguagePackCatalog(catalog)).toMatchObject({
+      ok: false,
+      error: expect.stringContaining(`${PLUGIN_LANGUAGE_CATALOG_MAX_ENTRIES} entries`)
+    })
+  })
+
+  it('shape-validates 16 maximum-entry registrations without returning catalog copies', () => {
+    const catalog = Object.fromEntries(
+      Array.from({ length: PLUGIN_LANGUAGE_CATALOG_MAX_ENTRIES }, (_, index) => [
+        `key${index}`,
+        'value'
+      ])
+    )
+    const packs = Array.from({ length: 16 }, (_, index) => {
+      const id = `plugin:maximum-${index}` as const
+      return {
+        id,
+        resourceLanguage: pluginLanguageResourceId(id),
+        pluginKey: `maximum-${index}`,
+        locale: 'en',
+        catalog
+      }
+    })
+
+    expect(validatePluginLanguagePackCatalogShape(catalog)).toEqual({
+      ok: true,
+      entries: PLUGIN_LANGUAGE_CATALOG_MAX_ENTRIES
+    })
+    expect(packs.filter(isPluginLanguagePackRegistration)).toHaveLength(16)
+  })
 })
diff --git a/src/shared/plugins/plugin-language-pack-artifact.ts b/src/shared/plugins/plugin-language-pack-artifact.ts
index 917adeef69e..7bcfacf47d4 100644
--- a/src/shared/plugins/plugin-language-pack-artifact.ts
+++ b/src/shared/plugins/plugin-language-pack-artifact.ts
@@ -23,6 +23,24 @@ export type PluginLanguagePackRegistration = {
   catalog: Record<string, unknown>
 }
 
+export function isPluginLanguagePackRegistration(
+  value: unknown
+): value is PluginLanguagePackRegistration {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    return false
+  }
+  const pack = value as Record<string, unknown>
+  return (
+    typeof pack.id === 'string' &&
+    pack.id.startsWith('plugin:') &&
+    typeof pack.resourceLanguage === 'string' &&
+    pack.resourceLanguage === pluginLanguageResourceId(pack.id as `plugin:${string}`) &&
+    typeof pack.pluginKey === 'string' &&
+    typeof pack.locale === 'string' &&
+    validatePluginLanguagePackCatalogShape(pack.catalog).ok
+  )
+}
+
 export function pluginLanguageResourceId(id: `plugin:${string}`): `plugin${string}` {
   let encoded = ''
   for (let index = 0; index < id.length; index += 1) {
@@ -37,15 +55,28 @@ export type PluginLanguagePackParseResult =
   | { ok: true; catalog: Record<string, unknown>; entries: number }
   | { ok: false; error: string }
 
+export type PluginLanguagePackValidationResult =
+  | { ok: true; entries: number }
+  | { ok: false; error: string }
+
+type PluginLanguagePackWalkResult =
+  | { ok: true; catalog: Record<string, unknown> | null; entries: number }
+  | { ok: false; error: string }
+
 type CatalogFrame = {
   source: Record<string, unknown>
-  target: Record<string, unknown>
+  target: Record<string, unknown> | null
   path: string
   depth: number
 }
 
 function isCatalogObject(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value)
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.getPrototypeOf(value) === Object.prototype
+  )
 }
 
 function protectedTranslation(path: string): boolean {
@@ -59,7 +90,15 @@ function protectedTranslation(path: string): boolean {
 }
 
 function hasUnsafeCatalogKeyCharacter(key: string): boolean {
-  return key.includes('.') || Array.from(key).some((character) => character.charCodeAt(0) <= 31)
+  if (key.includes('.')) {
+    return true
+  }
+  for (let index = 0; index < key.length; index += 1) {
+    if (key.charCodeAt(index) <= 31) {
+      return true
+    }
+  }
+  return false
 }
 
 export function parsePluginLanguagePackArtifact(raw: string): PluginLanguagePackParseResult {
@@ -69,19 +108,43 @@ export function parsePluginLanguagePackArtifact(raw: string): PluginLanguagePack
   } catch {
     return { ok: false, error: 'language pack must contain one JSON object' }
   }
-  if (!isCatalogObject(json)) {
+  return validatePluginLanguagePackCatalog(json)
+}
+
+export function validatePluginLanguagePackCatalog(source: unknown): PluginLanguagePackParseResult {
+  const result = walkPluginLanguagePackCatalog(source, true)
+  if (!result.ok) {
+    return result
+  }
+  return { ok: true, catalog: result.catalog!, entries: result.entries }
+}
+
+export function validatePluginLanguagePackCatalogShape(
+  source: unknown
+): PluginLanguagePackValidationResult {
+  const result = walkPluginLanguagePackCatalog(source, false)
+  return result.ok ? { ok: true, entries: result.entries } : result
+}
+
+function walkPluginLanguagePackCatalog(
+  source: unknown,
+  copyCatalog: boolean
+): PluginLanguagePackWalkResult {
+  if (!isCatalogObject(source)) {
     return { ok: false, error: 'language pack root must be an object' }
   }
 
-  const catalog: Record<string, unknown> = {}
-  const stack: CatalogFrame[] = [{ source: json, target: catalog, path: '', depth: 0 }]
+  const catalog: Record<string, unknown> | null = copyCatalog ? {} : null
+  const stack: CatalogFrame[] = [{ source, target: catalog, path: '', depth: 0 }]
+  const seen = new WeakSet<object>([source])
   let entries = 0
   while (stack.length > 0) {
     const frame = stack.pop()!
     if (frame.depth > PLUGIN_LANGUAGE_CATALOG_MAX_DEPTH) {
       return { ok: false, error: `catalog exceeds depth ${PLUGIN_LANGUAGE_CATALOG_MAX_DEPTH}` }
     }
-    for (const [key, value] of Object.entries(frame.source)) {
+    for (const key of Object.keys(frame.source)) {
+      const value = frame.source[key]
       entries += 1
       if (entries > PLUGIN_LANGUAGE_CATALOG_MAX_ENTRIES) {
         return {
@@ -110,14 +173,22 @@ export function parsePluginLanguagePackArtifact(raw: string): PluginLanguagePack
         if (value.length > 8192) {
           return { ok: false, error: `translation at ${path} exceeds 8192 characters` }
         }
-        frame.target[key] = value
+        if (frame.target) {
+          frame.target[key] = value
+        }
         continue
       }
       if (!isCatalogObject(value)) {
         return { ok: false, error: `translation at ${path} must be a string or object` }
       }
-      const child: Record<string, unknown> = {}
-      frame.target[key] = child
+      if (seen.has(value)) {
+        return { ok: false, error: `catalog contains a repeated or cyclic object at ${path}` }
+      }
+      seen.add(value)
+      const child: Record<string, unknown> | null = frame.target ? {} : null
+      if (frame.target && child) {
+        frame.target[key] = child
+      }
       stack.push({ source: value, target: child, path, depth: frame.depth + 1 })
     }
   }
diff --git a/src/renderer/src/lib/pr-comment-audience.test.ts b/src/shared/pr-comment-audience.test.ts
similarity index 70%
rename from src/renderer/src/lib/pr-comment-audience.test.ts
rename to src/shared/pr-comment-audience.test.ts
index fb48a97e6f9..7499e791b90 100644
--- a/src/renderer/src/lib/pr-comment-audience.test.ts
+++ b/src/shared/pr-comment-audience.test.ts
@@ -1,12 +1,11 @@
 import { describe, expect, it } from 'vitest'
-
+import type { PRComment } from './types'
+import { createBotAuthorOverrideSet } from './pr-bot-author-overrides'
 import {
-  createBotAuthorOverrideSet,
   filterPRCommentsByAudience,
   getPRCommentAudienceCounts,
   isBotPRComment
 } from './pr-comment-audience'
-import type { PRComment } from '../../../shared/types'
 
 function comment(overrides: Partial<PRComment>): PRComment {
   return {
@@ -21,9 +20,17 @@ function comment(overrides: Partial<PRComment>): PRComment {
 }
 
 describe('pr comment audience filtering', () => {
-  it('uses GitHub bot metadata before falling back to login suffixes', () => {
-    expect(isBotPRComment(comment({ author: 'chatgpt-codex-connector', isBot: true }))).toBe(true)
+  it('classifies provider metadata and automation logins', () => {
+    expect(isBotPRComment(comment({ author: 'alice', isBot: true }))).toBe(true)
     expect(isBotPRComment(comment({ author: 'github-actions[bot]' }))).toBe(true)
+    expect(isBotPRComment(comment({ author: 'renovate-bot' }))).toBe(true)
+    expect(isBotPRComment(comment({ author: 'preview-automation' }))).toBe(true)
+    expect(isBotPRComment(comment({ author: 'qodo-ai-reviewer', isBot: false }))).toBe(true)
+    expect(isBotPRComment(comment({ author: 'coderabbitai', isBot: false }))).toBe(true)
+    expect(isBotPRComment(comment({ author: 'sonarcloud' }))).toBe(true)
+    expect(isBotPRComment(comment({ author: 'codium-ai-reviewer' }))).toBe(true)
+    expect(isBotPRComment(comment({ author: 'octocat' }))).toBe(false)
+    expect(isBotPRComment(comment({ author: 'robotics-dev' }))).toBe(false)
     expect(isBotPRComment(comment({ author: 'human-botany' }))).toBe(false)
   })
 
@@ -35,6 +42,7 @@ describe('pr comment audience filtering', () => {
     ]
 
     expect(getPRCommentAudienceCounts(comments)).toEqual({ all: 3, human: 1, bot: 2 })
+    expect(filterPRCommentsByAudience(comments, 'all')).toBe(comments)
     expect(filterPRCommentsByAudience(comments, 'human').map((item) => item.id)).toEqual([1])
     expect(filterPRCommentsByAudience(comments, 'bot').map((item) => item.id)).toEqual([2, 3])
   })
diff --git a/mobile/src/components/pr-sidebar/pr-comment-audience.ts b/src/shared/pr-comment-audience.ts
similarity index 54%
rename from mobile/src/components/pr-sidebar/pr-comment-audience.ts
rename to src/shared/pr-comment-audience.ts
index 71032a74f81..280d0590a7a 100644
--- a/mobile/src/components/pr-sidebar/pr-comment-audience.ts
+++ b/src/shared/pr-comment-audience.ts
@@ -1,35 +1,19 @@
-import type { PRComment } from '../../../../src/shared/types'
-import {
-  createBotAuthorOverrideSet,
-  normalizePRCommentAuthorLogin
-} from '../../../../src/shared/pr-bot-author-overrides'
+import type { PRComment } from './types'
+import { normalizePRCommentAuthorLogin } from './pr-bot-author-overrides'
 
-export { createBotAuthorOverrideSet }
-
-// Audience filtering for the PR comment timeline, ported from the desktop helper
-// (src/renderer/src/lib/pr-comment-audience.ts) minus its i18n wrapper so it stays
-// pure + unit-testable under the node Vitest config. Classification must match the
-// desktop so the same comment reads as human/bot on both surfaces.
 export type PRCommentAudienceFilter = 'all' | 'human' | 'bot'
 
-export const PR_COMMENT_AUDIENCE_FILTERS: { value: PRCommentAudienceFilter; label: string }[] = [
-  { value: 'all', label: 'All' },
-  { value: 'human', label: 'Humans' },
-  { value: 'bot', label: 'Bots' }
-]
-
 const BOT_LOGIN_SUFFIX = '[bot]'
 const AUTOMATION_LOGIN_PATTERNS = [
   /bot$/i,
-  /-bot$/i,
   /\bbot\b/i,
   /automation/i,
   /actions/i,
   /renovate/i,
   /dependabot/i
 ]
-// Some AI/code-review services use regular user accounts, so GitHub metadata can
-// report them as users — keep this list in sync with the desktop helper.
+
+// GitHub can report regular-account review services as users.
 const KNOWN_AUTOMATION_LOGIN_SUBSTRINGS = [
   'chatgpt-codex-connector',
   'codex-connector',
@@ -55,10 +39,7 @@ export function isBotPRComment(
 ): boolean {
   const author = comment.author.trim()
   const normalized = normalizePRCommentAuthorLogin(author)
-  if (botAuthorOverrides?.has(normalized)) {
-    return true
-  }
-  if (comment.isBot === true) {
+  if (botAuthorOverrides?.has(normalized) || comment.isBot === true) {
     return true
   }
   if (normalized.endsWith(BOT_LOGIN_SUFFIX)) {
@@ -71,15 +52,11 @@ export function isBotPRComment(
 }
 
 export function getPRCommentAudienceCounts(
-  comments: PRComment[],
+  comments: readonly PRComment[],
   botAuthorOverrides?: ReadonlySet<string>
 ): Record<PRCommentAudienceFilter, number> {
   const bot = comments.filter((comment) => isBotPRComment(comment, botAuthorOverrides)).length
-  return {
-    all: comments.length,
-    human: comments.length - bot,
-    bot
-  }
+  return { all: comments.length, human: comments.length - bot, bot }
 }
 
 export function filterPRCommentsByAudience(
@@ -95,14 +72,3 @@ export function filterPRCommentsByAudience(
   }
   return comments
 }
-
-export function getPRCommentAudienceEmptyLabel(filter: PRCommentAudienceFilter): string {
-  switch (filter) {
-    case 'bot':
-      return 'No bot comments.'
-    case 'human':
-      return 'No human comments.'
-    case 'all':
-      return 'No comments yet.'
-  }
-}
diff --git a/src/renderer/src/lib/pr-comment-groups.test.ts b/src/shared/pr-comment-groups.test.ts
similarity index 72%
rename from src/renderer/src/lib/pr-comment-groups.test.ts
rename to src/shared/pr-comment-groups.test.ts
index 1bdacc7710a..b2f8de72980 100644
--- a/src/renderer/src/lib/pr-comment-groups.test.ts
+++ b/src/shared/pr-comment-groups.test.ts
@@ -1,12 +1,11 @@
 import { describe, expect, it } from 'vitest'
-
+import type { PRComment } from './types'
 import {
   getPRCommentGroupCount,
   getPRCommentGroupId,
   groupPRComments,
   isResolvedPRCommentGroup
 } from './pr-comment-groups'
-import type { PRComment } from '../../../shared/types'
 
 function comment(overrides: Partial<PRComment>): PRComment {
   return {
@@ -22,14 +21,17 @@ function comment(overrides: Partial<PRComment>): PRComment {
 
 describe('pr comment groups', () => {
   it('groups review thread replies while preserving first-comment order', () => {
-    const groups = groupPRComments([
+    const comments = [
       comment({ id: 1 }),
       comment({ id: 2, threadId: 'thread-a', isResolved: true }),
-      comment({ id: 3, threadId: 'thread-a', isResolved: true }),
+      comment({ id: 3, threadId: 'thread-a' }),
       comment({ id: 4 })
-    ])
+    ]
+    const groups = groupPRComments(comments)
 
     expect(groups.map(getPRCommentGroupId)).toEqual(['comment:1', 'thread:thread-a', 'comment:4'])
+    expect(groups[0]).toEqual({ kind: 'standalone', comment: comments[0] })
+    expect(groups[1]).toMatchObject({ root: { id: 2 }, replies: [{ id: 3 }] })
     expect(getPRCommentGroupCount(groups[1])).toBe(2)
     expect(isResolvedPRCommentGroup(groups[1])).toBe(true)
   })
diff --git a/src/shared/pr-comment-groups.ts b/src/shared/pr-comment-groups.ts
new file mode 100644
index 00000000000..8d43b9e2b77
--- /dev/null
+++ b/src/shared/pr-comment-groups.ts
@@ -0,0 +1,47 @@
+import type { PRComment } from './types'
+
+export type PRCommentGroup =
+  | { kind: 'standalone'; comment: PRComment }
+  | { kind: 'thread'; threadId: string; root: PRComment; replies: PRComment[] }
+
+export function groupPRComments(comments: readonly PRComment[]): PRCommentGroup[] {
+  const groups: PRCommentGroup[] = []
+  const threads = new Map<string, Extract<PRCommentGroup, { kind: 'thread' }>>()
+
+  for (const comment of comments) {
+    if (!comment.threadId) {
+      groups.push({ kind: 'standalone', comment })
+      continue
+    }
+    const existing = threads.get(comment.threadId)
+    if (existing) {
+      existing.replies.push(comment)
+      continue
+    }
+    const group: Extract<PRCommentGroup, { kind: 'thread' }> = {
+      kind: 'thread',
+      threadId: comment.threadId,
+      root: comment,
+      replies: []
+    }
+    threads.set(comment.threadId, group)
+    groups.push(group)
+  }
+  return groups
+}
+
+export function getPRCommentGroupRoot(group: PRCommentGroup): PRComment {
+  return group.kind === 'thread' ? group.root : group.comment
+}
+
+export function getPRCommentGroupCount(group: PRCommentGroup): number {
+  return group.kind === 'thread' ? group.replies.length + 1 : 1
+}
+
+export function isResolvedPRCommentGroup(group: PRCommentGroup): boolean {
+  return getPRCommentGroupRoot(group).isResolved === true
+}
+
+export function getPRCommentGroupId(group: PRCommentGroup): string {
+  return group.kind === 'thread' ? `thread:${group.threadId}` : `comment:${group.comment.id}`
+}
diff --git a/src/renderer/src/lib/pr-comment-time.test.ts b/src/shared/pr-comment-time.test.ts
similarity index 100%
rename from src/renderer/src/lib/pr-comment-time.test.ts
rename to src/shared/pr-comment-time.test.ts
diff --git a/src/renderer/src/lib/pr-comment-time.ts b/src/shared/pr-comment-time.ts
similarity index 81%
rename from src/renderer/src/lib/pr-comment-time.ts
rename to src/shared/pr-comment-time.ts
index d5935df2c6d..32f8ec2bc09 100644
--- a/src/renderer/src/lib/pr-comment-time.ts
+++ b/src/shared/pr-comment-time.ts
@@ -1,5 +1,3 @@
-// Relative timestamp for PR comments (ISO string in, "Xm/Xh/Xd" out). Pure and
-// unit-testable; nowMs is passed in so tests stay deterministic.
 export function formatPrCommentRelativeTime(iso: string, nowMs: number): string {
   const ts = Date.parse(iso)
   if (Number.isNaN(ts)) {
diff --git a/src/shared/preserved-branch-cleanup.ts b/src/shared/preserved-branch-cleanup.ts
new file mode 100644
index 00000000000..6199ce52d5e
--- /dev/null
+++ b/src/shared/preserved-branch-cleanup.ts
@@ -0,0 +1,23 @@
+import type { ExecutionHostId } from './execution-host'
+
+export type PreservedBranchCleanup = {
+  worktreeId: string
+  branchName: string
+  expectedHead?: string
+  hostId?: ExecutionHostId
+  runtimeEnvironmentId?: string
+}
+
+export function preservedBranchCleanupScopeKey(
+  cleanup: Pick<PreservedBranchCleanup, 'worktreeId' | 'hostId' | 'runtimeEnvironmentId'>
+): string {
+  return [cleanup.hostId ?? '', cleanup.runtimeEnvironmentId ?? '', cleanup.worktreeId].join('\0')
+}
+
+export function preservedBranchCleanupKey(cleanup: PreservedBranchCleanup): string {
+  return [
+    preservedBranchCleanupScopeKey(cleanup),
+    cleanup.branchName,
+    cleanup.expectedHead ?? ''
+  ].join('\0')
+}
diff --git a/src/shared/protocol-version.ts b/src/shared/protocol-version.ts
index f1818b901c3..eb61be79c97 100644
--- a/src/shared/protocol-version.ts
+++ b/src/shared/protocol-version.ts
@@ -32,9 +32,12 @@ export const REMOTE_RUNTIME_SHARED_CONTROL_CAPABILITY = 'remote-runtime.shared-c
 export const ORCHESTRATION_FEDERATION_RUNTIME_CAPABILITY = 'orchestration.federation.v1' as const
 export const ORCHESTRATION_FEDERATION_CONTROL_MAIL_RUNTIME_CAPABILITY =
   'orchestration.federation-control-mail.v1' as const
+export const ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_RUNTIME_CAPABILITY =
+  'orchestration.federation-lifecycle-settlement.v1' as const
 export const ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY =
   'orchestration.worker-launch-preferences.v1' as const
 export const ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION = 2 as const
+export const ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_PROTOCOL_VERSION = 3 as const
 export const ORCHESTRATION_CONTRACT_VERSION = 1 as const
 export const ORCHESTRATION_CONTRACT_RUNTIME_CAPABILITY = 'orchestration.contract.v1' as const
 export const FOLDER_WORKSPACE_PATH_STATUS_RUNTIME_CAPABILITY =
@@ -51,6 +54,7 @@ export const AI_VAULT_SESSION_TITLES_RUNTIME_CAPABILITY = 'aiVault.session-title
 // offscreen backend). Advertised only when that backend is actually available, so
 // clients never fall back to a local desktop browser tab for a remote-owned page.
 export const BROWSER_HEADLESS_RUNTIME_CAPABILITY = 'browser.headless.v1' as const
+export const BROWSER_SCREENCAST_RUNTIME_CAPABILITY = 'browser.screencast.v1' as const
 export const BROWSER_CERTIFICATE_TRUST_RUNTIME_CAPABILITY = 'browser.certificate-trust.v1' as const
 // Why: hosts without this strip terminal.send's inputKind (zod object drops
 // unknown keys), so a mobile xterm query reply would land as ordinary
@@ -91,9 +95,10 @@ export const RUNTIME_CAPABILITIES = [
   REMOTE_RUNTIME_SHARED_CONTROL_CAPABILITY,
   ORCHESTRATION_FEDERATION_RUNTIME_CAPABILITY,
   ORCHESTRATION_FEDERATION_CONTROL_MAIL_RUNTIME_CAPABILITY,
+  ORCHESTRATION_FEDERATION_LIFECYCLE_SETTLEMENT_RUNTIME_CAPABILITY,
   ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY,
   ORCHESTRATION_CONTRACT_RUNTIME_CAPABILITY,
-  'browser.screencast.v1',
+  BROWSER_SCREENCAST_RUNTIME_CAPABILITY,
   'terminal.binary-stream.v1',
   'terminal.multiplex.v1',
   'workspace-ports.v1',
diff --git a/src/shared/pty-slave-line-discipline-echo.test.ts b/src/shared/pty-slave-line-discipline-echo.test.ts
index 4f6c3994a85..c5538f2328c 100644
--- a/src/shared/pty-slave-line-discipline-echo.test.ts
+++ b/src/shared/pty-slave-line-discipline-echo.test.ts
@@ -3,7 +3,11 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 const execFileMock = vi.hoisted(() => vi.fn())
 vi.mock('node:child_process', () => ({ execFile: execFileMock }))
 
-import { createPtySlaveEchoProbe, readPtySlavePath } from './pty-slave-line-discipline-echo'
+import {
+  createPtySlaveEchoProbe,
+  createPtySlaveLineEditorProbe,
+  readPtySlavePath
+} from './pty-slave-line-discipline-echo'
 
 /** Replies to the next stty call with the given output, or an error when `output` is null. */
 function answerStty(output: string | null): void {
@@ -14,6 +18,7 @@ function answerStty(output: string | null): void {
 
 const COOKED = 'speed 38400 baud;\nlflags: icanon isig iexten echo echoe echok echoctl\n'
 const RAW = 'speed 38400 baud;\nlflags: -icanon -isig -iexten -echo -echoe -echok -echoctl\n'
+const LINE_EDITOR = `${RAW}cchars: lnext = <undef>; min = 1; time = 0;\n`
 
 beforeEach(() => {
   execFileMock.mockReset()
@@ -132,3 +137,21 @@ describe('createPtySlaveEchoProbe', () => {
     expect(execFileMock.mock.calls[1]?.[1]).toEqual(['-a', '-F', '/dev/pts/3'])
   })
 })
+
+describe('createPtySlaveLineEditorProbe', () => {
+  it('requires raw quiet mode with the line editor disabling literal-next', async () => {
+    const probe = createPtySlaveLineEditorProbe('/dev/ttys048', 'darwin')
+    answerStty(LINE_EDITOR)
+    await expect(probe?.()).resolves.toBe('line-editor')
+    answerStty(`${RAW}cchars: lnext = ^V; min = 1; time = 0;\n`)
+    await expect(probe?.()).resolves.toBe('other')
+    answerStty(COOKED)
+    await expect(probe?.()).resolves.toBe('other')
+  })
+
+  it('fails closed when the terminal state is incomplete', async () => {
+    const probe = createPtySlaveLineEditorProbe('/dev/ttys048', 'darwin')
+    answerStty('lflags: -echo\ncchars: lnext = <undef>;\n')
+    await expect(probe?.()).resolves.toBe('unknown')
+  })
+})
diff --git a/src/shared/pty-slave-line-discipline-echo.ts b/src/shared/pty-slave-line-discipline-echo.ts
index 3f515066450..1eb6bfde3c9 100644
--- a/src/shared/pty-slave-line-discipline-echo.ts
+++ b/src/shared/pty-slave-line-discipline-echo.ts
@@ -10,10 +10,16 @@ export type PtySlaveLineDisciplineEcho = 'echoing' | 'quiet' | 'unknown'
 
 export type PtySlaveEchoProbe = () => Promise<PtySlaveLineDisciplineEcho>
 
+export type PtySlaveLineEditorState = 'line-editor' | 'other' | 'unknown'
+
+export type PtySlaveLineEditorProbe = () => Promise<PtySlaveLineEditorState>
+
 const STTY_TIMEOUT_MS = 2_000
 // `stty -a` prints the lflags as a space-separated list where a disabled flag is
 // prefixed with `-`, so `echo` and `-echo` are the two tokens that matter.
 const ECHO_FLAG = /(?:^|\s)(-?)echo(?:\s|$)/
+const ICANON_FLAG = /(?:^|\s)(-?)icanon(?:\s|$)/
+const LNEXT_UNDEFINED = /(?:^|[;\s])lnext\s*=\s*<undef>(?:;|\s|$)/
 
 function sttyArgs(ptsName: string, platform: NodeJS.Platform): readonly string[] {
   // BSD/macOS take `-f`; Linux (GNU coreutils) takes `-F`.
@@ -30,7 +36,18 @@ function parseEchoFlag(sttyOutput: string): PtySlaveLineDisciplineEcho {
   return match[1] === '-' ? 'quiet' : 'echoing'
 }
 
-type SttyProbeResult = { state: PtySlaveLineDisciplineEcho; permanent: boolean }
+function parseLineEditorState(sttyOutput: string): PtySlaveLineEditorState {
+  const echo = ECHO_FLAG.exec(sttyOutput)
+  const icanon = ICANON_FLAG.exec(sttyOutput)
+  if (!echo || !icanon) {
+    return 'unknown'
+  }
+  return echo[1] === '-' && icanon[1] === '-' && LNEXT_UNDEFINED.test(sttyOutput)
+    ? 'line-editor'
+    : 'other'
+}
+
+type SttyProbeResult = { stdout: string | null; permanent: boolean }
 
 /**
  * A spawn that never ran (`stty` absent) or a device that answered non-zero (reaped,
@@ -54,8 +71,8 @@ function runStty(ptsName: string, platform: NodeJS.Platform): Promise<SttyProbeR
       (error, stdout) => {
         resolve(
           error
-            ? { state: 'unknown', permanent: isPermanentSttyFailure(error) }
-            : { state: parseEchoFlag(stdout), permanent: false }
+            ? { stdout: null, permanent: isPermanentSttyFailure(error) }
+            : { stdout, permanent: false }
         )
       }
     )
@@ -83,6 +100,21 @@ export function createPtySlaveEchoProbe(
   ptsName: string | undefined,
   platform: NodeJS.Platform = process.platform
 ): PtySlaveEchoProbe | undefined {
+  return createSttyProbe(ptsName, platform, parseEchoFlag)
+}
+
+export function createPtySlaveLineEditorProbe(
+  ptsName: string | undefined,
+  platform: NodeJS.Platform = process.platform
+): PtySlaveLineEditorProbe | undefined {
+  return createSttyProbe(ptsName, platform, parseLineEditorState)
+}
+
+function createSttyProbe<T extends string>(
+  ptsName: string | undefined,
+  platform: NodeJS.Platform,
+  parse: (output: string) => T | 'unknown'
+): (() => Promise<T | 'unknown'>) | undefined {
   if (platform === 'win32' || !ptsName) {
     return undefined
   }
@@ -101,6 +133,6 @@ export function createPtySlaveEchoProbe(
     })
     const result = await inFlight
     unavailable = result.permanent
-    return result.state
+    return result.stdout === null ? 'unknown' : parse(result.stdout)
   }
 }
diff --git a/src/shared/remote-runtime-client.ts b/src/shared/remote-runtime-client.ts
index f147ed4e7bb..c53565dc8a2 100644
--- a/src/shared/remote-runtime-client.ts
+++ b/src/shared/remote-runtime-client.ts
@@ -144,16 +144,12 @@ async function sendRemoteRuntimeRequestOnSocket<TResult>(
   })
   const pendingRequest = {
     preparedRequest: prepareRemoteRuntimeRequest(new Map(), () =>
-      serializeRemoteRuntimePayload({
-        id: requestId,
+      serializeRemoteRuntimeRpcRequest({
+        requestId,
         deviceToken: pairing.deviceToken,
         method,
         params,
-        orchestrationCapability: envelope?.orchestrationCapability,
-        orchestrationContractVersion: envelope?.orchestrationContractVersion,
-        orchestrationRequestId: envelope?.orchestrationRequestId,
-        compatibilityInvocationId: envelope?.compatibilityInvocationId,
-        orchestrationCompatibilityEvidence: envelope?.orchestrationCompatibilityEvidence
+        envelope
       })
     )
   }
diff --git a/src/shared/remote-runtime-memory-limits.ts b/src/shared/remote-runtime-memory-limits.ts
index 8152f58ef66..a41409ffdfe 100644
--- a/src/shared/remote-runtime-memory-limits.ts
+++ b/src/shared/remote-runtime-memory-limits.ts
@@ -3,6 +3,7 @@ import {
   stringifyJsonWithinByteLimit
 } from './node-bounded-json-stringify'
 import { RemoteRuntimeClientError } from './remote-runtime-client-error'
+import type { RuntimeOrchestrationEnvelope } from './runtime-rpc-envelope'
 
 export const REMOTE_RUNTIME_MAX_OUTBOUND_JSON_BYTES = 4 * 1024 * 1024
 export const REMOTE_RUNTIME_MAX_WEBSOCKET_FRAME_BYTES = 8 * 1024 * 1024 + 64
@@ -63,12 +64,18 @@ export function serializeRemoteRuntimeRpcRequest(args: {
   deviceToken: string
   method: string
   params: unknown
+  envelope?: RuntimeOrchestrationEnvelope
 }): string {
   return serializeRemoteRuntimePayload({
     id: args.requestId,
     deviceToken: args.deviceToken,
     method: args.method,
-    params: args.params
+    params: args.params,
+    orchestrationCapability: args.envelope?.orchestrationCapability,
+    orchestrationContractVersion: args.envelope?.orchestrationContractVersion,
+    orchestrationRequestId: args.envelope?.orchestrationRequestId,
+    compatibilityInvocationId: args.envelope?.compatibilityInvocationId,
+    orchestrationCompatibilityEvidence: args.envelope?.orchestrationCompatibilityEvidence
   })
 }
 
diff --git a/src/shared/remote-runtime-shared-control-connection.test.ts b/src/shared/remote-runtime-shared-control-connection.test.ts
index 66a57a92e52..f85b1d8fa6b 100644
--- a/src/shared/remote-runtime-shared-control-connection.test.ts
+++ b/src/shared/remote-runtime-shared-control-connection.test.ts
@@ -78,6 +78,37 @@ describe('RemoteRuntimeSharedControlConnection', () => {
     connection.close()
   })
 
+  it('preserves orchestration authority fields on shared-control requests', async () => {
+    const server = await createServer()
+    const connection = new RemoteRuntimeSharedControlConnection(server.pairing)
+    const envelope = {
+      orchestrationCapability: 'capability',
+      orchestrationContractVersion: 1,
+      orchestrationRequestId: 'request-1',
+      compatibilityInvocationId: 'compatibility-1',
+      orchestrationCompatibilityEvidence: {
+        terminalHandle: 'term-1',
+        paneKey: 'pane-1',
+        launchToken: 'launch-1'
+      },
+      id: 'forged-id',
+      deviceToken: 'forged-token',
+      method: 'orchestration.federationAck',
+      params: { dispatchId: 'forged-dispatch' }
+    }
+
+    await connection.request('orchestration.federationPull', {}, 1000, envelope)
+
+    expect(server.requests).toContainEqual({
+      ...envelope,
+      id: expect.any(String),
+      deviceToken: 'device-token',
+      method: 'orchestration.federationPull',
+      params: {}
+    })
+    connection.close()
+  })
+
   it('does not expose a binary sender on the shared control protocol surface', () => {
     expect('sendSharedControlEncryptedBinary' in sharedControlProtocol).toBe(false)
   })
diff --git a/src/shared/remote-runtime-shared-control-connection.ts b/src/shared/remote-runtime-shared-control-connection.ts
index 524b6697931..4fb40525245 100644
--- a/src/shared/remote-runtime-shared-control-connection.ts
+++ b/src/shared/remote-runtime-shared-control-connection.ts
@@ -1,6 +1,5 @@
 import WebSocket from 'ws'
 import type { PairingOffer } from './pairing'
-import type { RuntimeRpcResponse } from './runtime-rpc-envelope'
 import type { RemoteRuntimeClientError } from './remote-runtime-client-error'
 import { remoteRuntimeUnavailableError } from './remote-runtime-request-frames'
 import { openSharedControlSocket } from './remote-runtime-shared-control-open'
@@ -66,14 +65,16 @@ export class RemoteRuntimeSharedControlConnection {
   request<TResult>(
     method: string,
     params: unknown,
-    timeoutMs: number
-  ): Promise<RuntimeRpcResponse<TResult>> {
-    return requestSharedControl({
+    timeoutMs: number,
+    envelope?: Parameters<typeof requestSharedControl>[0]['envelope']
+  ): ReturnType<typeof requestSharedControl<TResult>> {
+    return requestSharedControl<TResult>({
       pendingRequests: this.pendingRequests,
       deviceToken: this.pairing.deviceToken,
       method,
       params,
       timeoutMs,
+      envelope,
       ensureReady: () => this.ensureReadyWithTimeout(timeoutMs),
       send: (requestId) => this.sendRequest(requestId),
       retireRequestId: (requestId) => this.retiredRequestIds.retire(requestId)
diff --git a/src/shared/remote-runtime-shared-control-ready.ts b/src/shared/remote-runtime-shared-control-ready.ts
index 23461245d0d..9d0a92c500c 100644
--- a/src/shared/remote-runtime-shared-control-ready.ts
+++ b/src/shared/remote-runtime-shared-control-ready.ts
@@ -37,7 +37,7 @@ export function waitForSharedControlReadyWithTimeout(args: {
       }
       settled = true
       const index = args.readyWaiters.indexOf(waiter)
-      if (index >= 0) {
+      if (index !== -1) {
         args.readyWaiters.splice(index, 1)
       }
       reject(remoteRuntimeUnavailableError())
@@ -65,7 +65,7 @@ export function waitForSharedControlReadyWithTimeout(args: {
       args.open()
     } catch (error) {
       const index = args.readyWaiters.indexOf(waiter)
-      if (index >= 0) {
+      if (index !== -1) {
         args.readyWaiters.splice(index, 1)
       }
       waiter.reject(error instanceof Error ? error : remoteRuntimeUnavailableError(String(error)))
diff --git a/src/shared/remote-runtime-shared-control-requests.ts b/src/shared/remote-runtime-shared-control-requests.ts
index 8379e53da91..5c55c3d11b6 100644
--- a/src/shared/remote-runtime-shared-control-requests.ts
+++ b/src/shared/remote-runtime-shared-control-requests.ts
@@ -6,7 +6,7 @@ import {
   type RemoteRuntimePreparedRequest
 } from './remote-runtime-prepared-request-admission'
 import { remoteRuntimeTimeoutError } from './remote-runtime-request-frames'
-import type { RuntimeRpcResponse } from './runtime-rpc-envelope'
+import type { RuntimeOrchestrationEnvelope, RuntimeRpcResponse } from './runtime-rpc-envelope'
 import { toRemoteRuntimeClientError } from './remote-runtime-shared-control-protocol'
 import { rejectSharedControlPendingRequest } from './remote-runtime-shared-control-state'
 import type { SharedControlPendingRequest } from './remote-runtime-shared-control-types'
@@ -19,6 +19,7 @@ export function requestSharedControl<TResult>(args: {
   method: string
   params: unknown
   timeoutMs: number
+  envelope?: RuntimeOrchestrationEnvelope
   ensureReady: () => Promise<void>
   send: (requestId: string) => void
   retireRequestId?: (requestId: string) => void
@@ -35,7 +36,8 @@ export function requestSharedControl<TResult>(args: {
         requestId,
         deviceToken: args.deviceToken,
         method: args.method,
-        params: args.params
+        params: args.params,
+        envelope: args.envelope
       })
     )
   } catch (error) {
diff --git a/src/shared/repro-13889-claude-quarter-circle-busy-title.test.ts b/src/shared/repro-13889-claude-quarter-circle-busy-title.test.ts
new file mode 100644
index 00000000000..6156489a567
--- /dev/null
+++ b/src/shared/repro-13889-claude-quarter-circle-busy-title.test.ts
@@ -0,0 +1,99 @@
+import { describe, expect, it } from 'vitest'
+
+import {
+  clearWorkingIndicators,
+  createAgentStatusTracker,
+  detectAgentStatusFromTitle,
+  getAgentLabel,
+  isClaudeAgent
+} from './agent-detection'
+import { isDecorativeAgentTitleFrameChange } from './agent-decorative-title-signature'
+import { stripLeadingAgentTitleDecoration } from './agent-title-decoration'
+import { resolveExplicitTerminalTitleAgentType } from './terminal-title-agent-type'
+
+// Titles captured from real `claude` binaries running the same one-line prompt.
+// 2.1.228 swapped the busy spinner from braille to quarter circles, which read as
+// "no agent" and made the tracker report a confirmed exit mid-turn (#13889).
+const BUSY_2_1_227 = ['⠂ Claude Code', '⠐ Claude Code', '⠂ Say hi in one word'] as const
+const BUSY_2_1_228 = ['◐ Claude Code', '◑ Claude Code', '◑ Say hi in one word'] as const
+
+const CAPTURED_2_1_228_TURN = [
+  '✳ Claude Code',
+  '◐ Claude Code',
+  '◑ Claude Code',
+  '◑ Say hi in one word',
+  '◐ Say hi in one word',
+  '✳ Say hi in one word'
+] as const
+
+function trackTurn(titles: readonly string[]): string[] {
+  const events: string[] = []
+  const tracker = createAgentStatusTracker(
+    () => events.push('idle'),
+    () => events.push('working'),
+    () => events.push('exited')
+  )
+  for (const title of titles) {
+    tracker.handleTitle(title)
+  }
+  return events
+}
+
+describe('Claude Code quarter-circle busy titles (#13889)', () => {
+  it('reports working for every quarter-circle spinner frame', () => {
+    for (const title of ['◐ Claude Code', '◑ Claude Code', '◒ Claude Code', '◓ Claude Code']) {
+      expect(detectAgentStatusFromTitle(title)).toBe('working')
+    }
+  })
+
+  it('reports working when the busy title carries task text instead of the agent name', () => {
+    // Why: the summary-bearing frame has no "claude" token, so it previously fell
+    // through to null — the value the tracker reads as an exit.
+    expect(detectAgentStatusFromTitle('◐ Say hi in one word')).toBe('working')
+  })
+
+  it('keeps Claude identity while busy', () => {
+    for (const title of BUSY_2_1_228) {
+      expect(isClaudeAgent(title)).toBe(true)
+      expect(getAgentLabel(title)).toBe('Claude Code')
+    }
+  })
+
+  it('matches 2.1.227 status and identity frame for frame', () => {
+    BUSY_2_1_228.forEach((title, index) => {
+      const braille = BUSY_2_1_227[index]
+      expect(detectAgentStatusFromTitle(title)).toBe(detectAgentStatusFromTitle(braille))
+      expect(getAgentLabel(title)).toBe(getAgentLabel(braille))
+      expect(resolveExplicitTerminalTitleAgentType(title)).toBe(
+        resolveExplicitTerminalTitleAgentType(braille)
+      )
+    })
+  })
+
+  it('never confirms an agent exit across a real 2.1.228 turn', () => {
+    const events = trackTurn(CAPTURED_2_1_228_TURN)
+    expect(events).not.toContain('exited')
+    expect(events).toEqual(['working', 'idle'])
+  })
+
+  it('tracks the 2.1.228 turn exactly like the 2.1.227 turn', () => {
+    const brailleTurn = CAPTURED_2_1_228_TURN.map((title) =>
+      title.replace('◐', '⠂').replace('◑', '⠐')
+    )
+    expect(trackTurn(CAPTURED_2_1_228_TURN)).toEqual(trackTurn(brailleTurn))
+  })
+
+  it('strips the spinner from stale exit titles and displayed labels', () => {
+    expect(clearWorkingIndicators('◐ Say hi in one word')).toBe('Say hi in one word')
+    expect(stripLeadingAgentTitleDecoration('◐ Claude Code')).toBe('Claude Code')
+  })
+
+  it('treats a spinner tick as decoration, not a title change', () => {
+    expect(isDecorativeAgentTitleFrameChange('◐ Say hi', '◑ Say hi')).toBe(true)
+  })
+
+  it('does not claim Gemini’s ◇ idle glyph, which neighbors the spinner block', () => {
+    expect(detectAgentStatusFromTitle('◇ Gemini CLI')).toBe('idle')
+    expect(getAgentLabel('◇ Gemini CLI')).toBe('Gemini CLI')
+  })
+})
diff --git a/src/shared/ripgrep-process-availability.test.ts b/src/shared/ripgrep-process-availability.test.ts
new file mode 100644
index 00000000000..033df296666
--- /dev/null
+++ b/src/shared/ripgrep-process-availability.test.ts
@@ -0,0 +1,90 @@
+import { spawn, type ChildProcess } from 'node:child_process'
+import { EventEmitter } from 'node:events'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import {
+  absorbPendingRipgrepSpawnError,
+  isRipgrepUnavailableExit,
+  isRipgrepSpawnCwdUsable,
+  killSpawnedRipgrepProcess
+} from './ripgrep-process-availability'
+
+function createChild(pid: number | undefined): ChildProcess {
+  const child = new EventEmitter() as ChildProcess
+  Object.defineProperty(child, 'pid', { value: pid })
+  return child
+}
+
+describe('ripgrep process availability', () => {
+  it('recognizes native pre-spawn failures before either event wins the race', () => {
+    expect(isRipgrepUnavailableExit(createChild(undefined), null, null)).toBe(true)
+    expect(isRipgrepUnavailableExit(createChild(undefined), -2, null)).toBe(true)
+  })
+
+  it('keeps all post-spawn and signal exits on their existing paths', () => {
+    for (const code of [0, 1, 2, 127]) {
+      expect(isRipgrepUnavailableExit(createChild(1), code, null)).toBe(false)
+    }
+    expect(isRipgrepUnavailableExit(createChild(1), null, 'SIGTERM')).toBe(false)
+  })
+
+  it('tags only unsupported native launcher exits after spawn', () => {
+    for (const code of [0, 1, 2]) {
+      expect(
+        isRipgrepUnavailableExit(createChild(1), code, null, {
+          classifyNativeLauncherExit: true
+        })
+      ).toBe(false)
+    }
+    for (const code of [3, 126, 127, 9009]) {
+      expect(
+        isRipgrepUnavailableExit(createChild(1), code, null, {
+          classifyNativeLauncherExit: true
+        })
+      ).toBe(true)
+    }
+  })
+
+  it('does not signal a real failed-spawn handle', async () => {
+    const child = spawn('orca-definitely-missing-rg-admission-test', [])
+    const error = new Promise<void>((resolve) => child.once('error', () => resolve()))
+    const close = new Promise<void>((resolve) => child.once('close', () => resolve()))
+
+    expect(killSpawnedRipgrepProcess(child)).toBe(false)
+    await Promise.all([error, close])
+  })
+
+  it('distinguishes a usable root from a missing spawn cwd', async () => {
+    await expect(isRipgrepSpawnCwdUsable(process.cwd())).resolves.toBe(true)
+    await expect(
+      isRipgrepSpawnCwdUsable(join(process.cwd(), 'orca-definitely-missing-rg-cwd'))
+    ).resolves.toBe(false)
+  })
+
+  it('absorbs a queued spawn error when cleanup wins the race', () => {
+    const child = createChild(undefined)
+    absorbPendingRipgrepSpawnError(child, {
+      errorObserved: false,
+      unavailableExitObserved: false
+    })
+
+    expect(() => child.emit('error', new Error('spawn rg ENOENT'))).not.toThrow()
+    expect(child.listenerCount('error')).toBe(0)
+  })
+
+  it('does not retain a sink for started or already-observed processes', () => {
+    const started = createChild(1)
+    absorbPendingRipgrepSpawnError(started, {
+      errorObserved: false,
+      unavailableExitObserved: false
+    })
+    const observed = createChild(undefined)
+    absorbPendingRipgrepSpawnError(observed, {
+      errorObserved: true,
+      unavailableExitObserved: true
+    })
+
+    expect(started.listenerCount('error')).toBe(0)
+    expect(observed.listenerCount('error')).toBe(0)
+  })
+})
diff --git a/src/shared/ripgrep-process-availability.ts b/src/shared/ripgrep-process-availability.ts
new file mode 100644
index 00000000000..0b5ef026c0e
--- /dev/null
+++ b/src/shared/ripgrep-process-availability.ts
@@ -0,0 +1,124 @@
+import { constants } from 'node:fs'
+import { access, stat } from 'node:fs/promises'
+import { spawn, type ChildProcess } from 'node:child_process'
+
+const RIPGREP_CWD_CHECK_TIMEOUT_MS = 1000
+const RIPGREP_FAILURE_PROBE_TIMEOUT_MS = 5000
+
+export class RipgrepUnavailableError extends Error {
+  constructor() {
+    super('ripgrep is unavailable')
+    this.name = 'RipgrepUnavailableError'
+  }
+}
+
+function ignoreRipgrepSpawnError(): void {}
+
+export function killSpawnedRipgrepProcess(child: ChildProcess): boolean {
+  // Why: killing a failed-spawn handle can signal the relay's own process group.
+  if (Object.hasOwn(child, 'pid') && child.pid === undefined) {
+    return false
+  }
+  return child.kill()
+}
+
+export function absorbPendingRipgrepSpawnError(
+  child: ChildProcess,
+  state: { errorObserved: boolean; unavailableExitObserved: boolean }
+): void {
+  if (
+    state.errorObserved ||
+    (!state.unavailableExitObserved && !(Object.hasOwn(child, 'pid') && child.pid === undefined))
+  ) {
+    return
+  }
+  // Why: concurrent-pass cleanup can win before Node delivers the queued spawn error.
+  child.once('error', ignoreRipgrepSpawnError)
+}
+
+export async function isRipgrepSpawnCwdUsable(cwd: string): Promise<boolean> {
+  let timeout: ReturnType<typeof setTimeout> | null = null
+  const timedOut = new Promise<boolean>((resolve) => {
+    timeout = setTimeout(() => resolve(false), RIPGREP_CWD_CHECK_TIMEOUT_MS)
+    timeout.unref?.()
+  })
+  const checked = Promise.all([stat(cwd), access(cwd, constants.X_OK)]).then(
+    ([entry]) => entry.isDirectory(),
+    () => false
+  )
+  try {
+    return await Promise.race([checked, timedOut])
+  } finally {
+    if (timeout) {
+      clearTimeout(timeout)
+    }
+  }
+}
+
+function checkRipgrepAvailableWithoutCwd(): Promise<boolean> {
+  return new Promise((resolve) => {
+    let child: ChildProcess
+    try {
+      child = spawn('rg', ['--version'], { stdio: 'ignore' })
+    } catch {
+      resolve(false)
+      return
+    }
+    let settled = false
+    let errorObserved = false
+    let unavailableExitObserved = false
+    let timeout: ReturnType<typeof setTimeout> | null = null
+    const settle = (available: boolean, kill = false): void => {
+      if (settled) {
+        return
+      }
+      settled = true
+      if (timeout) {
+        clearTimeout(timeout)
+      }
+      child.off('error', onError)
+      child.off('close', onClose)
+      if (kill) {
+        child.once('error', ignoreRipgrepSpawnError)
+        killSpawnedRipgrepProcess(child)
+      } else {
+        absorbPendingRipgrepSpawnError(child, { errorObserved, unavailableExitObserved })
+      }
+      resolve(available)
+    }
+    const onError = (): void => {
+      errorObserved = true
+      settle(false)
+    }
+    const onClose = (code: number | null): void => {
+      unavailableExitObserved = code !== null && code < 0
+      settle(code === 0)
+    }
+    child.once('error', onError)
+    child.once('close', onClose)
+    timeout = setTimeout(() => settle(false, true), RIPGREP_FAILURE_PROBE_TIMEOUT_MS)
+    timeout.unref?.()
+  })
+}
+
+export async function isRipgrepUnavailableAfterLaunchFailure(cwd: string): Promise<boolean> {
+  if (await isRipgrepSpawnCwdUsable(cwd)) {
+    return true
+  }
+  return !(await checkRipgrepAvailableWithoutCwd())
+}
+
+export function isRipgrepUnavailableExit(
+  child: ChildProcess,
+  code: number | null,
+  signal: NodeJS.Signals | null,
+  options: { classifyNativeLauncherExit?: boolean } = {}
+): boolean {
+  if (signal) {
+    return false
+  }
+  if ((Object.hasOwn(child, 'pid') && child.pid === undefined) || (code !== null && code < 0)) {
+    return true
+  }
+  return Boolean(options.classifyNativeLauncherExit && code !== null && code > 2)
+}
diff --git a/src/shared/runtime-environment-store.test.ts b/src/shared/runtime-environment-store.test.ts
index 3e34f5846b2..dbf0a6a50b6 100644
--- a/src/shared/runtime-environment-store.test.ts
+++ b/src/shared/runtime-environment-store.test.ts
@@ -13,12 +13,13 @@ import {
   updateEnvironmentFromPairingCode
 } from './runtime-environment-store'
 
-function pairingCode(endpoint = 'ws://127.0.0.1:6768'): string {
+function pairingCode(endpoint = 'ws://127.0.0.1:6768', pairedDeviceId?: string): string {
   return encodePairingOffer({
     v: 2,
     endpoint,
     deviceToken: 'device-token',
-    publicKeyB64: Buffer.from(new Uint8Array(32).fill(1)).toString('base64')
+    publicKeyB64: Buffer.from(new Uint8Array(32).fill(1)).toString('base64'),
+    ...(pairedDeviceId ? { pairedDeviceId } : {})
   })
 }
 
@@ -151,6 +152,31 @@ describe('runtime environment store', () => {
     })
   })
 
+  it('persists paired device identity from pairing and status backfill', () => {
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-runtime-env-store-'))
+    tempDirs.push(userDataPath)
+    const paired = addEnvironmentFromPairingCode(userDataPath, {
+      name: 'paired box',
+      pairingCode: pairingCode('ws://127.0.0.1:6768', 'device-from-offer'),
+      now: 1_000
+    })
+    const legacy = addEnvironmentFromPairingCode(userDataPath, {
+      name: 'legacy box',
+      pairingCode: pairingCode('ws://192.0.2.10:6768'),
+      now: 1_000
+    })
+
+    expect(paired.pairedDeviceId).toBe('device-from-offer')
+    markEnvironmentUsed(userDataPath, legacy.id, {
+      pairedDeviceId: 'device-from-status',
+      now: 2_000
+    })
+    expect(listEnvironments(userDataPath).find((entry) => entry.id === legacy.id)).toMatchObject({
+      pairedDeviceId: 'device-from-status',
+      lastUsedAt: 2_000
+    })
+  })
+
   it('rejects an oversized sparse environment store before parsing it', () => {
     const userDataPath = mkdtempSync(join(tmpdir(), 'orca-runtime-env-store-bound-'))
     tempDirs.push(userDataPath)
diff --git a/src/shared/runtime-environment-store.ts b/src/shared/runtime-environment-store.ts
index 85f90f8bef6..e784dc80281 100644
--- a/src/shared/runtime-environment-store.ts
+++ b/src/shared/runtime-environment-store.ts
@@ -176,17 +176,19 @@ const LAST_USED_PERSIST_INTERVAL_MS = 60_000
 export function markEnvironmentUsed(
   userDataPath: string,
   selector: string,
-  args: { runtimeId?: string | null; now?: number } = {}
+  args: { runtimeId?: string | null; pairedDeviceId?: string; now?: number } = {}
 ): void {
   const store = readEnvironmentStore(userDataPath)
   const environment = resolveEnvironmentFromStore(store, selector)
   const now = args.now ?? Date.now()
   const runtimeIdChanged = args.runtimeId != null && args.runtimeId !== environment.runtimeId
+  const pairedDeviceIdChanged =
+    args.pairedDeviceId != null && args.pairedDeviceId !== environment.pairedDeviceId
   const lastUsedIsFresh =
     environment.lastUsedAt != null &&
     now >= environment.lastUsedAt &&
     now - environment.lastUsedAt < LAST_USED_PERSIST_INTERVAL_MS
-  if (!runtimeIdChanged && lastUsedIsFresh) {
+  if (!runtimeIdChanged && !pairedDeviceIdChanged && lastUsedIsFresh) {
     return
   }
   const next = store.environments.map((entry) =>
@@ -194,6 +196,7 @@ export function markEnvironmentUsed(
       ? {
           ...entry,
           runtimeId: args.runtimeId ?? entry.runtimeId,
+          ...(args.pairedDeviceId ? { pairedDeviceId: args.pairedDeviceId } : {}),
           lastUsedAt: now,
           updatedAt: now
         }
diff --git a/src/shared/runtime-environments.ts b/src/shared/runtime-environments.ts
index f1cfd64085b..b3411eb3f70 100644
--- a/src/shared/runtime-environments.ts
+++ b/src/shared/runtime-environments.ts
@@ -26,6 +26,7 @@ export const KnownRuntimeEnvironmentSchema = z.object({
   createdAt: z.number().finite(),
   updatedAt: z.number().finite(),
   pairingRevision: z.number().finite().optional(),
+  pairedDeviceId: z.string().min(1).optional(),
   lastUsedAt: z.number().finite().nullable(),
   runtimeId: z.string().min(1).nullable(),
   source: RuntimeEnvironmentSourceSchema.optional(),
@@ -74,6 +75,7 @@ export function createEnvironmentFromPairingOffer(args: {
     createdAt: args.now,
     updatedAt: args.now,
     pairingRevision: args.now,
+    ...(args.offer.pairedDeviceId ? { pairedDeviceId: args.offer.pairedDeviceId } : {}),
     lastUsedAt: null,
     runtimeId: args.runtimeId ?? null,
     ...(args.source ? { source: args.source } : {}),
@@ -115,6 +117,7 @@ export function getPreferredPairingOffer(environment: KnownRuntimeEnvironment):
     v: PAIRING_OFFER_VERSION,
     endpoint: endpoint.endpoint,
     deviceToken: endpoint.deviceToken,
-    publicKeyB64: endpoint.publicKeyB64
+    publicKeyB64: endpoint.publicKeyB64,
+    ...(environment.pairedDeviceId ? { pairedDeviceId: environment.pairedDeviceId } : {})
   }
 }
diff --git a/src/shared/runtime-types.ts b/src/shared/runtime-types.ts
index 6e012e60b42..af02b02e484 100644
--- a/src/shared/runtime-types.ts
+++ b/src/shared/runtime-types.ts
@@ -67,6 +67,8 @@ export type RuntimeBrowserDriverState = RuntimeTerminalDriverState
 
 export type RuntimeStatus = {
   runtimeId: string
+  /** Authenticated requester identity. Missing for in-process callers and older hosts. */
+  pairedDeviceId?: string
   rendererGraphEpoch: number
   graphStatus: RuntimeGraphStatus
   authoritativeWindowId: number | null
@@ -774,6 +776,7 @@ export type RuntimeWorktreePsSummary = {
   manualOrder?: number
   lastActivityAt?: number
   createdAt?: number
+  creatorProvenance?: Worktree['creatorProvenance']
   linkedIssue: number | null
   linkedPR: { number: number; state: string } | null
   linkedLinearIssue: string | null
diff --git a/src/shared/secure-file.ts b/src/shared/secure-file.ts
index 36231de6835..e3c38c70e09 100644
--- a/src/shared/secure-file.ts
+++ b/src/shared/secure-file.ts
@@ -1,8 +1,11 @@
 import { randomBytes } from 'node:crypto'
 import {
   chmodSync,
+  closeSync,
   existsSync,
+  fsyncSync,
   mkdirSync,
+  openSync,
   renameSync,
   rmSync,
   statSync,
@@ -40,6 +43,8 @@ const DEFAULT_HARDENING_CACHE_BOUNDS: SecurePathHardeningCacheBounds = {
   maxTotalKeyBytes: SECURE_PATH_HARDENING_CACHE_KEYS_MAX_BYTES
 }
 
+const UNSUPPORTED_DIRECTORY_FSYNC_CODES = new Set(['EINVAL', 'ENOTSUP', 'EOPNOTSUPP'])
+
 // Why: PowerShell hardening (~1-1.5s) stalls the main thread, so cache idempotent re-hardens per process.
 let hardenedPathsThisProcess = new SecurePathHardeningCache<HardenedPathCacheEntry>(
   DEFAULT_HARDENING_CACHE_BOUNDS
@@ -87,7 +92,15 @@ export function writeSecureJsonFile(targetPath: string, value: unknown): void {
   writeSecureFile(targetPath, JSON.stringify(value, null, 2))
 }
 
-export function writeSecureFile(targetPath: string, contents: string): void {
+export function writeDurableSecureJsonFile(targetPath: string, value: unknown): void {
+  writeSecureFile(targetPath, JSON.stringify(value, null, 2), { durable: true })
+}
+
+export function writeSecureFile(
+  targetPath: string,
+  contents: string,
+  options: { durable?: boolean } = {}
+): void {
   const dir = dirname(targetPath)
   if (!existsSync(dir)) {
     mkdirSync(dir, { recursive: true, mode: 0o700 })
@@ -101,6 +114,9 @@ export function writeSecureFile(targetPath: string, contents: string): void {
       encoding: 'utf-8',
       mode: 0o600
     })
+    if (options.durable) {
+      fsyncFileSync(tmpFile)
+    }
     // Why: writeFileSync mode is a no-op on Windows, so restrict the credential's ACL synchronously before the rename publishes it under inherited ACLs.
     applySecurePathRestriction(tmpFile, false, process.platform, true)
     renameSync(tmpFile, targetPath)
@@ -108,12 +124,41 @@ export function writeSecureFile(targetPath: string, contents: string): void {
     if (applySecurePathRestriction(targetPath, false, process.platform, true)) {
       rememberHardenedPath(targetPath, false)
     }
+    if (options.durable) {
+      bestEffortFsyncDirectorySync(dir)
+    }
   } catch (error) {
     rmSync(tmpFile, { force: true })
     throw error
   }
 }
 
+export function fsyncFileSync(path: string): void {
+  const descriptor = openSync(path, 'r')
+  try {
+    fsyncSync(descriptor)
+  } finally {
+    closeSync(descriptor)
+  }
+}
+
+export function bestEffortFsyncDirectorySync(directory: string): void {
+  if (process.platform === 'win32') {
+    return
+  }
+  try {
+    fsyncFileSync(directory)
+  } catch (error) {
+    if (
+      error instanceof Error &&
+      UNSUPPORTED_DIRECTORY_FSYNC_CODES.has((error as NodeJS.ErrnoException).code ?? '')
+    ) {
+      return
+    }
+    throw error
+  }
+}
+
 export function hardenExistingSecureFile(targetPath: string): void {
   const dir = dirname(targetPath)
   if (existsSync(dir)) {
diff --git a/src/shared/setup-agent-sequencing.test.ts b/src/shared/setup-agent-sequencing.test.ts
index 5bff3422f95..3d51b5b7476 100644
--- a/src/shared/setup-agent-sequencing.test.ts
+++ b/src/shared/setup-agent-sequencing.test.ts
@@ -20,6 +20,7 @@ import {
 } from './setup-agent-startup-policy'
 
 const TEMP_DIRS: string[] = []
+const WINDOWS_PROCESS_TEST_TIMEOUT_MS = 30_000
 
 afterEach(() => {
   for (const dir of TEMP_DIRS.splice(0)) {
@@ -330,7 +331,8 @@ describe('createSequencedSetupAgentCommands', () => {
       expect(startupExit.code).toBe(0)
       expect(startupExit.stderr).toContain('Waiting for setup to finish before starting agent...')
       expect(readFileSync(logPath, 'utf8')).toBe('setup-done\r\nagent-start\r\n')
-    }
+    },
+    WINDOWS_PROCESS_TEST_TIMEOUT_MS
   )
 
   it.skipIf(process.platform === 'win32')(
diff --git a/src/shared/setup-agent-sequencing.windows.test.ts b/src/shared/setup-agent-sequencing.windows.test.ts
index b964eb241a7..10b1e76d908 100644
--- a/src/shared/setup-agent-sequencing.windows.test.ts
+++ b/src/shared/setup-agent-sequencing.windows.test.ts
@@ -11,6 +11,7 @@ import {
 } from './setup-agent-sequencing'
 
 const TEMP_DIRS: string[] = []
+const WINDOWS_PROCESS_TEST_TIMEOUT_MS = 30_000
 
 afterEach(() => {
   for (const dir of TEMP_DIRS.splice(0)) {
@@ -20,61 +21,69 @@ afterEach(() => {
 
 describe.skipIf(process.platform !== 'win32')('Windows setup-agent sequencing', () => {
   it.each([
-    'path with spaces',
-    'ampersand&parentheses(test)',
-    'caret^percent%bang!',
-    "apostrophe's directory",
-    'Unicode-한글-abc'
-  ])('preserves the native runner path in %s', async (directoryName) => {
-    const tempDir = makeTempDir(directoryName)
-    const runnerScriptPath = join(tempDir, 'setup runner.cmd')
-    const startupScriptPath = join(tempDir, 'agent startup.ps1')
-    const logPath = join(dirname(tempDir), 'sequence.log')
-    const prompt = 'spaces & pipe | caret ^ percent % bang ! "quotes" Unicode 한글 trailing\\'
+    ['path with spaces', false],
+    ['ampersand&parentheses(test)', false],
+    ['caret^percent%bang!', false],
+    ["apostrophe's directory", false],
+    ['Unicode-한글-abc', false],
+    ['forward-slash Git path', true]
+  ] as const)(
+    'preserves the native runner path in %s',
+    async (directoryName, useForwardSlashes) => {
+      const tempDir = makeTempDir(directoryName)
+      const nativeRunnerScriptPath = join(tempDir, 'setup runner.cmd')
+      const runnerScriptPath = useForwardSlashes
+        ? nativeRunnerScriptPath.replaceAll('\\', '/')
+        : nativeRunnerScriptPath
+      const startupScriptPath = join(tempDir, 'agent startup.ps1')
+      const logPath = join(dirname(tempDir), 'sequence.log')
+      const prompt = 'spaces & pipe | caret ^ percent % bang ! "quotes" Unicode 한글 trailing\\'
 
-    writeFileSync(
-      runnerScriptPath,
-      ['@echo off', `>> "${logPath}" echo setup-done`, 'exit /b 0'].join('\r\n'),
-      'utf8'
-    )
-    writeFileSync(
-      startupScriptPath,
-      [
-        'param([string]$Value)',
-        '$utf8 = [System.Text.UTF8Encoding]::new($false)',
-        `[System.IO.File]::AppendAllText('${quotePowerShell(logPath)}', $Value + [Environment]::NewLine, $utf8)`
-      ].join('\r\n'),
-      'utf8'
-    )
-
-    const commands = createSequencedSetupAgentCommands({
-      runnerScriptPath,
-      startupCommand: `& '${quotePowerShell(startupScriptPath)}' '${quotePowerShell(prompt)}'`,
-      platform: 'windows',
-      nonce: 'windows-sequence',
-      waitTimeoutSeconds: 2
-    })
-
-    const setupExit = await waitForExit(
-      spawnWindowsCommand(dirname(tempDir), 'run setup.cmd', commands.setupCommand)
-    )
-    expect(setupExit.code).toBe(0)
-    expect(readFileSync(`${runnerScriptPath}.windows-sequence.done`, 'utf8')).toBe(
-      'windows-sequence:0\r\n'
-    )
-
-    const startupExit = await waitForExit(
-      spawnWindowsCommand(
-        dirname(tempDir),
-        'run startup.cmd',
-        commands.startupCommand,
-        commands.startupEnv
+      writeFileSync(
+        runnerScriptPath,
+        ['@echo off', `>> "${logPath}" echo setup-done`, 'exit /b 0'].join('\r\n'),
+        'utf8'
       )
-    )
-    expect(startupExit.code).toBe(0)
-    expect(startupExit.stderr).toContain('Waiting for setup to finish before starting agent...')
-    expect(readFileSync(logPath, 'utf8')).toBe(`setup-done\r\n${prompt}\r\n`)
-  })
+      writeFileSync(
+        startupScriptPath,
+        [
+          'param([string]$Value)',
+          '$utf8 = [System.Text.UTF8Encoding]::new($false)',
+          `[System.IO.File]::AppendAllText('${quotePowerShell(logPath)}', $Value + [Environment]::NewLine, $utf8)`
+        ].join('\r\n'),
+        'utf8'
+      )
+
+      const commands = createSequencedSetupAgentCommands({
+        runnerScriptPath,
+        startupCommand: `& '${quotePowerShell(startupScriptPath)}' '${quotePowerShell(prompt)}'`,
+        platform: 'windows',
+        nonce: 'windows-sequence',
+        waitTimeoutSeconds: 2
+      })
+
+      const setupExit = await waitForExit(
+        spawnWindowsCommand(dirname(tempDir), 'run setup.cmd', commands.setupCommand)
+      )
+      expect(setupExit.code).toBe(0)
+      expect(readFileSync(`${runnerScriptPath}.windows-sequence.done`, 'utf8')).toBe(
+        'windows-sequence:0\r\n'
+      )
+
+      const startupExit = await waitForExit(
+        spawnWindowsCommand(
+          dirname(tempDir),
+          'run startup.cmd',
+          commands.startupCommand,
+          commands.startupEnv
+        )
+      )
+      expect(startupExit.code).toBe(0)
+      expect(startupExit.stderr).toContain('Waiting for setup to finish before starting agent...')
+      expect(readFileSync(logPath, 'utf8')).toBe(`setup-done\r\n${prompt}\r\n`)
+    },
+    WINDOWS_PROCESS_TEST_TIMEOUT_MS
+  )
 
   it('keeps the startup command out of generated cmd.exe source', () => {
     const startupCommand = 'agent --prompt "& | ^ % ! 한글 trailing\\"'
@@ -90,46 +99,50 @@ describe.skipIf(process.platform !== 'win32')('Windows setup-agent sequencing',
     expect(commands.startupEnv?.[SETUP_AGENT_SEQUENCE_STARTUP_COMMAND_ENV]).toBe(startupCommand)
   })
 
-  it('propagates setup failure without launching the agent', async () => {
-    const tempDir = makeTempDir('failure path & metacharacters!')
-    const runnerScriptPath = join(tempDir, 'setup runner.cmd')
-    const startupScriptPath = join(tempDir, 'agent startup.cmd')
-    const startupLogPath = join(dirname(tempDir), 'agent-started.log')
+  it(
+    'propagates setup failure without launching the agent',
+    async () => {
+      const tempDir = makeTempDir('failure path & metacharacters!')
+      const runnerScriptPath = join(tempDir, 'setup runner.cmd')
+      const startupScriptPath = join(tempDir, 'agent startup.cmd')
+      const startupLogPath = join(dirname(tempDir), 'agent-started.log')
 
-    writeFileSync(runnerScriptPath, '@echo off\r\nexit /b 37\r\n', 'utf8')
-    writeFileSync(
-      startupScriptPath,
-      `@echo off\r\necho started>"${startupLogPath}"\r\nexit /b 0\r\n`,
-      'utf8'
-    )
-    const commands = createSequencedSetupAgentCommands({
-      runnerScriptPath,
-      startupCommand: `cmd.exe /d /c "${startupScriptPath}"`,
-      platform: 'windows',
-      nonce: 'failed-windows-sequence',
-      waitTimeoutSeconds: 2
-    })
-
-    const setupExit = await waitForExit(
-      spawnWindowsCommand(dirname(tempDir), 'run failed setup.cmd', commands.setupCommand)
-    )
-    expect(setupExit.code).toBe(37)
-    expect(readFileSync(`${runnerScriptPath}.failed-windows-sequence.done`, 'utf8')).toBe(
-      'failed-windows-sequence:37\r\n'
-    )
-
-    const startupExit = await waitForExit(
-      spawnWindowsCommand(
-        dirname(tempDir),
-        'run blocked startup.cmd',
-        commands.startupCommand,
-        commands.startupEnv
+      writeFileSync(runnerScriptPath, '@echo off\r\nexit /b 37\r\n', 'utf8')
+      writeFileSync(
+        startupScriptPath,
+        `@echo off\r\necho started>"${startupLogPath}"\r\nexit /b 0\r\n`,
+        'utf8'
       )
-    )
-    expect(startupExit.code).toBe(37)
-    expect(startupExit.stderr).toContain('Setup failed; skipping agent startup.')
-    expect(existsSync(startupLogPath)).toBe(false)
-  })
+      const commands = createSequencedSetupAgentCommands({
+        runnerScriptPath,
+        startupCommand: `cmd.exe /d /c "${startupScriptPath}"`,
+        platform: 'windows',
+        nonce: 'failed-windows-sequence',
+        waitTimeoutSeconds: 2
+      })
+
+      const setupExit = await waitForExit(
+        spawnWindowsCommand(dirname(tempDir), 'run failed setup.cmd', commands.setupCommand)
+      )
+      expect(setupExit.code).toBe(37)
+      expect(readFileSync(`${runnerScriptPath}.failed-windows-sequence.done`, 'utf8')).toBe(
+        'failed-windows-sequence:37\r\n'
+      )
+
+      const startupExit = await waitForExit(
+        spawnWindowsCommand(
+          dirname(tempDir),
+          'run blocked startup.cmd',
+          commands.startupCommand,
+          commands.startupEnv
+        )
+      )
+      expect(startupExit.code).toBe(37)
+      expect(startupExit.stderr).toContain('Setup failed; skipping agent startup.')
+      expect(existsSync(startupLogPath)).toBe(false)
+    },
+    WINDOWS_PROCESS_TEST_TIMEOUT_MS
+  )
 })
 
 function makeTempDir(directoryName: string): string {
diff --git a/src/shared/setup-script-import-codex-environment.ts b/src/shared/setup-script-import-codex-environment.ts
index 77a8e48296d..d684d197497 100644
--- a/src/shared/setup-script-import-codex-environment.ts
+++ b/src/shared/setup-script-import-codex-environment.ts
@@ -136,7 +136,7 @@ function parseTomlMultilineString(
       remainder = lines[index]
     }
     const closeIndex = remainder.indexOf(delimiter)
-    if (closeIndex >= 0) {
+    if (closeIndex !== -1) {
       if (!oversized && !append(remainder.slice(0, closeIndex))) {
         oversized = true
       }
diff --git a/src/shared/setup-script-imports.ts b/src/shared/setup-script-imports.ts
index 5aa698d13d1..5c37b99dab0 100644
--- a/src/shared/setup-script-imports.ts
+++ b/src/shared/setup-script-imports.ts
@@ -186,7 +186,7 @@ function resolveSupersetScriptValue(
   }
 
   for (const field in localRecord) {
-    if (!Object.prototype.hasOwnProperty.call(localRecord, field)) {
+    if (!Object.hasOwn(localRecord, field)) {
       continue
     }
     if (field !== 'before' && field !== 'after') {
@@ -283,7 +283,7 @@ function collectUnsupportedCmuxCommandFields(
   const supportedFields = new Set(['name', 'title', 'description', 'keywords', 'command'])
   const unsupportedFields: string[] = []
   for (const field in command) {
-    if (!Object.prototype.hasOwnProperty.call(command, field)) {
+    if (!Object.hasOwn(command, field)) {
       continue
     }
     if (!supportedFields.has(field)) {
diff --git a/src/shared/shell-process-readiness.test.ts b/src/shared/shell-process-readiness.test.ts
new file mode 100644
index 00000000000..9c3abad9783
--- /dev/null
+++ b/src/shared/shell-process-readiness.test.ts
@@ -0,0 +1,73 @@
+import { mkdir, mkdtemp, rm, symlink } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { parseDarwinExecutablePath, resolveShellExecutablePath } from './shell-process-readiness'
+
+describe('shell process readiness', () => {
+  it('extracts the primary text image from macOS lsof output', () => {
+    expect(parseDarwinExecutablePath('p42\nftxt\nn/bin/zsh\nftxt\nn/usr/lib/zsh/zle.so\n')).toBe(
+      '/bin/zsh'
+    )
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'resolves bare shell commands through the spawn PATH',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-shell-path-'))
+      const link = join(root, 'shell-name')
+      await symlink(process.execPath, link)
+      try {
+        await expect(resolveShellExecutablePath('shell-name', dirname(root), root)).resolves.toBe(
+          await resolveShellExecutablePath(process.execPath, dirname(root), root)
+        )
+      } finally {
+        await rm(root, { recursive: true, force: true })
+      }
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'uses the POSIX exec default when PATH is unset',
+    async () => {
+      await expect(resolveShellExecutablePath('sh', process.cwd(), undefined)).resolves.toBe(
+        await resolveShellExecutablePath('/bin/sh', process.cwd(), '')
+      )
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'resolves relative shell paths against the PTY cwd',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-relative-shell-'))
+      const bin = join(root, 'bin')
+      await symlink(dirname(process.execPath), bin)
+      try {
+        await expect(
+          resolveShellExecutablePath(`./bin/${basename(process.execPath)}`, root, '')
+        ).resolves.toBe(await resolveShellExecutablePath(process.execPath, root, ''))
+      } finally {
+        await rm(root, { recursive: true, force: true })
+      }
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'skips searchable directories that shadow a later PATH executable',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-shadowed-shell-'))
+      const first = join(root, 'first')
+      const second = join(root, 'second')
+      await mkdir(join(first, 'shell-name'), { recursive: true })
+      await mkdir(second)
+      await symlink(process.execPath, join(second, 'shell-name'))
+      try {
+        await expect(
+          resolveShellExecutablePath('shell-name', root, `${first}:${second}`)
+        ).resolves.toBe(await resolveShellExecutablePath(process.execPath, root, ''))
+      } finally {
+        await rm(root, { recursive: true, force: true })
+      }
+    }
+  )
+})
diff --git a/src/shared/shell-process-readiness.ts b/src/shared/shell-process-readiness.ts
new file mode 100644
index 00000000000..2a631dcd82e
--- /dev/null
+++ b/src/shared/shell-process-readiness.ts
@@ -0,0 +1,80 @@
+import { execFile as execFileCallback } from 'node:child_process'
+import { constants } from 'node:fs'
+import { access, readlink, realpath, stat } from 'node:fs/promises'
+import { delimiter, isAbsolute, resolve } from 'node:path'
+import { promisify } from 'node:util'
+
+const execFile = promisify(execFileCallback)
+const PROCESS_READINESS_TIMEOUT_MS = 3000
+const DEFAULT_POSIX_EXEC_PATH = '/usr/bin:/bin'
+
+export type ShellProcessReadiness = {
+  executablePath: string
+  foreground: boolean
+}
+
+export function parseDarwinExecutablePath(stdout: string): string | null {
+  const lines = stdout.split(/\r?\n/)
+  const textIndex = lines.indexOf('ftxt')
+  const pathLine = textIndex === -1 ? undefined : lines[textIndex + 1]
+  return pathLine?.startsWith('n') ? pathLine.slice(1) : null
+}
+
+async function readExecutablePath(pid: number): Promise<string | null> {
+  if (process.platform === 'linux') {
+    return readlink(`/proc/${pid}/exe`)
+  }
+  if (process.platform !== 'darwin') {
+    return null
+  }
+  const { stdout } = await execFile(
+    '/usr/sbin/lsof',
+    ['-a', '-p', String(pid), '-d', 'txt', '-Fn'],
+    {
+      encoding: 'utf8',
+      timeout: PROCESS_READINESS_TIMEOUT_MS
+    }
+  )
+  return parseDarwinExecutablePath(stdout)
+}
+
+export async function readShellProcessReadiness(
+  pid: number
+): Promise<ShellProcessReadiness | null> {
+  const [executablePath, { stdout }] = await Promise.all([
+    readExecutablePath(pid),
+    execFile('ps', ['-p', String(pid), '-o', 'stat='], {
+      encoding: 'utf8',
+      timeout: PROCESS_READINESS_TIMEOUT_MS
+    })
+  ])
+  const status = stdout.trim()
+  return status && executablePath
+    ? { executablePath: await realpath(executablePath), foreground: status.includes('+') }
+    : null
+}
+
+export async function resolveShellExecutablePath(
+  shellPath: string,
+  cwd: string,
+  pathEnv: string | undefined
+): Promise<string | null> {
+  const candidates = shellPath.includes('/')
+    ? [isAbsolute(shellPath) ? shellPath : resolve(cwd, shellPath)]
+    : (
+        pathEnv ??
+        (process.platform === 'win32' ? (process.env.PATH ?? '') : DEFAULT_POSIX_EXEC_PATH)
+      )
+        .split(delimiter)
+        .map((entry) => resolve(isAbsolute(entry) ? entry : resolve(cwd, entry), shellPath))
+  for (const candidate of candidates) {
+    try {
+      await access(candidate, constants.X_OK)
+      const canonicalPath = await realpath(candidate)
+      if ((await stat(canonicalPath)).isFile()) {
+        return canonicalPath
+      }
+    } catch {}
+  }
+  return null
+}
diff --git a/src/shared/source-control-ai-actions.ts b/src/shared/source-control-ai-actions.ts
index 8b1a8acb636..19dc70aa652 100644
--- a/src/shared/source-control-ai-actions.ts
+++ b/src/shared/source-control-ai-actions.ts
@@ -195,7 +195,7 @@ export function renderSourceControlActionCommandTemplate(
       // Why: placeholder names may start with letters or underscores.
       // Why: only own keys are real variables; inherited Object.prototype names
       // (e.g. `constructor`) must stay visible instead of rendering their value.
-      if (!Object.prototype.hasOwnProperty.call(variables, name)) {
+      if (!Object.hasOwn(variables, name)) {
         return match
       }
       const value = variables[name]
diff --git a/src/shared/source-control-ai.ts b/src/shared/source-control-ai.ts
index 2ca3541916a..7445ee5b874 100644
--- a/src/shared/source-control-ai.ts
+++ b/src/shared/source-control-ai.ts
@@ -194,7 +194,7 @@ function normalizeOperationRecord<T>(
   }
   const normalized: Partial<Record<SourceControlAiOperation, T>> = {}
   for (const operation of SOURCE_CONTROL_AI_OPERATIONS) {
-    if (!Object.prototype.hasOwnProperty.call(value, operation)) {
+    if (!Object.hasOwn(value, operation)) {
       continue
     }
     const normalizedValue = normalizeValue(value[operation])
@@ -214,7 +214,7 @@ function normalizeActionRecord<T>(
   }
   const normalized: Partial<Record<SourceControlActionId, T>> = {}
   for (const actionId of SOURCE_CONTROL_ACTION_IDS) {
-    if (!Object.prototype.hasOwnProperty.call(value, actionId)) {
+    if (!Object.hasOwn(value, actionId)) {
       continue
     }
     const normalizedValue = normalizeValue(value[actionId])
@@ -388,7 +388,7 @@ function legacyPromptFromCommandTemplate(
 function hasActionAgentRecipe(recipe: {
   agentId?: TuiAgent | CustomAgentId | null
 }): recipe is { agentId: TuiAgent | CustomAgentId | null } {
-  return Object.prototype.hasOwnProperty.call(recipe, 'agentId')
+  return Object.hasOwn(recipe, 'agentId')
 }
 
 function legacyCommitMessageCoreChanges(
@@ -541,7 +541,7 @@ function mergeLegacyModelSelectionDelta<T>(
   let changed = false
   const keys = new Set([...Object.keys(legacy ?? {}), ...Object.keys(projected ?? {})])
   for (const key of keys) {
-    const legacyHasKey = Object.prototype.hasOwnProperty.call(legacy ?? {}, key)
+    const legacyHasKey = Object.hasOwn(legacy ?? {}, key)
     const legacyValue = legacy?.[key]
     if (JSON.stringify(projected?.[key]) === JSON.stringify(legacyValue)) {
       continue
@@ -994,7 +994,7 @@ function hasOwnInstruction(
   instructions: Partial<Record<SourceControlAiOperation, string | null>> | null | undefined,
   operation: SourceControlAiOperation
 ): boolean {
-  return Object.prototype.hasOwnProperty.call(instructions ?? {}, operation)
+  return Object.hasOwn(instructions ?? {}, operation)
 }
 
 function readRepoInstructionOverride(
diff --git a/src/shared/source-control-primary-action-decision-types.ts b/src/shared/source-control-primary-action-decision-types.ts
index 1769dbe0958..c1e2147b315 100644
--- a/src/shared/source-control-primary-action-decision-types.ts
+++ b/src/shared/source-control-primary-action-decision-types.ts
@@ -60,6 +60,21 @@ export type SourceControlPrimaryActionDecision = {
   requiresForceWithLease?: boolean
 }
 
+export type SourceControlCommitAreaPrimaryActionDecision = Omit<
+  SourceControlPrimaryActionDecision,
+  'kind' | 'labelIntent' | 'titleIntent'
+> & {
+  kind: Exclude<SourceControlPrimaryActionKind, 'create_pr_intent' | 'create_pr'>
+  labelIntent: Exclude<
+    SourceControlPrimaryActionDecision['labelIntent'],
+    'create_pr_intent' | 'create_pr'
+  >
+  titleIntent: Exclude<
+    SourceControlPrimaryActionTitleIntent,
+    'prepare_review' | 'create_review' | 'checking_review_creation'
+  >
+}
+
 export type SourceControlPrimaryActionDecisionInputs = {
   stagedCount: number
   hasUnstagedChanges: boolean
diff --git a/src/shared/source-control-primary-action-decision.test.ts b/src/shared/source-control-primary-action-decision.test.ts
index 6f153d74bbe..892d27cbffb 100644
--- a/src/shared/source-control-primary-action-decision.test.ts
+++ b/src/shared/source-control-primary-action-decision.test.ts
@@ -159,25 +159,30 @@ describe('source-control primary action decision', () => {
     expect(resolveSourceControlCommitAreaPrimaryActionDecision(input).kind).toBe('commit')
   })
 
+  it('keeps in-flight review intents out of commit-area decisions', () => {
+    const input = inputs({ isPrIntentInFlight: true })
+    expect(resolveSourceControlPrimaryActionDecision(input).kind).toBe('create_pr_intent')
+    expect(resolveSourceControlCommitAreaPrimaryActionDecision(input).kind).toBe('commit')
+  })
+
   it('returns disabled create review while hosted-review creation eligibility is loading', () => {
-    const result = resolveSourceControlPrimaryActionDecision(
-      inputs({
-        upstreamStatus: { hasUpstream: true, ahead: 0, behind: 0 },
-        hostedReviewCreation: {
-          provider: 'gitlab',
-          review: null,
-          canCreate: false,
-          blockedReason: null,
-          nextAction: null,
-          reviewLookupOutcome: 'not_found'
-        },
-        isHostedReviewCreationLoading: true
-      })
-    )
-    expect(result).toMatchObject({
+    const input = inputs({
+      upstreamStatus: { hasUpstream: true, ahead: 0, behind: 0 },
+      hostedReviewCreation: {
+        provider: 'gitlab',
+        review: null,
+        canCreate: false,
+        blockedReason: null,
+        nextAction: null,
+        reviewLookupOutcome: 'not_found'
+      },
+      isHostedReviewCreationLoading: true
+    })
+    expect(resolveSourceControlPrimaryActionDecision(input)).toMatchObject({
       kind: 'create_pr',
       titleIntent: 'checking_review_creation',
       disabled: true
     })
+    expect(resolveSourceControlCommitAreaPrimaryActionDecision(input).kind).toBe('commit')
   })
 })
diff --git a/src/shared/source-control-primary-action-decision.ts b/src/shared/source-control-primary-action-decision.ts
index acdaf27cbf8..3a06c6f9133 100644
--- a/src/shared/source-control-primary-action-decision.ts
+++ b/src/shared/source-control-primary-action-decision.ts
@@ -3,6 +3,7 @@ import { supportsHostedReviewCreation } from './hosted-review-creation-providers
 import { resolveCreateReviewIntentEligibility } from './source-control-create-review-intent'
 import { resolveSourceControlPrimaryActionDuringRemoteOp } from './source-control-primary-action-in-flight'
 import type {
+  SourceControlCommitAreaPrimaryActionDecision,
   SourceControlPrimaryActionDecision,
   SourceControlPrimaryActionDecisionInputs
 } from './source-control-primary-action-decision-types'
@@ -11,6 +12,7 @@ import { resolveUnpublishedSourceControlPrimaryAction } from './source-control-p
 export type {
   SourceControlPrimaryActionKind,
   SourceControlRemoteOpKind,
+  SourceControlCommitAreaPrimaryActionDecision,
   SourceControlPrimaryActionDecision,
   SourceControlPrimaryActionDecisionInputs
 } from './source-control-primary-action-decision-types'
@@ -221,14 +223,14 @@ function shouldOfferCreateReviewLoadingAction(
 
 export function resolveSourceControlCommitAreaPrimaryActionDecision(
   inputs: SourceControlPrimaryActionDecisionInputs
-): SourceControlPrimaryActionDecision {
+): SourceControlCommitAreaPrimaryActionDecision {
   // Why: review creation is additive chrome. Commit/mobile bottom areas keep
   // the local/remote action they would have without review eligibility.
   return resolveSourceControlPrimaryActionDecision({
     ...inputs,
     hostedReviewCreation: null,
     isPrIntentInFlight: false
-  })
+  }) as SourceControlCommitAreaPrimaryActionDecision
 }
 
 function resolveCreatePrIntentDecision(
diff --git a/src/shared/startup-command-submission.test.ts b/src/shared/startup-command-submission.test.ts
index 1006e63aa05..e25ee4c4105 100644
--- a/src/shared/startup-command-submission.test.ts
+++ b/src/shared/startup-command-submission.test.ts
@@ -1,5 +1,8 @@
 import { describe, expect, it } from 'vitest'
-import { buildStartupCommandSubmission } from './startup-command-submission'
+import {
+  buildStartupCommandSubmission,
+  isBracketedPasteSafeShell
+} from './startup-command-submission'
 
 describe('buildStartupCommandSubmission', () => {
   it('appends the submit byte to a single-line command unchanged', () => {
@@ -44,3 +47,22 @@ describe('buildStartupCommandSubmission', () => {
     ).toBe(`${command}\n`)
   })
 })
+
+describe('isBracketedPasteSafeShell', () => {
+  it('always trusts bash and zsh', () => {
+    for (const shellName of ['bash', 'zsh', 'BASH']) {
+      expect(isBracketedPasteSafeShell({ shellName, waitsForShellReady: false })).toBe(true)
+    }
+  })
+
+  it('trusts fish only behind the shell-ready barrier', () => {
+    expect(isBracketedPasteSafeShell({ shellName: 'fish', waitsForShellReady: true })).toBe(true)
+    expect(isBracketedPasteSafeShell({ shellName: 'fish', waitsForShellReady: false })).toBe(false)
+  })
+
+  it('rejects shells with no known bracketed-paste line editor', () => {
+    for (const shellName of ['sh', 'dash', 'nu', 'powershell.exe', '']) {
+      expect(isBracketedPasteSafeShell({ shellName, waitsForShellReady: true })).toBe(false)
+    }
+  })
+})
diff --git a/src/shared/startup-command-submission.ts b/src/shared/startup-command-submission.ts
index 7d97f59a271..33d84cd82b2 100644
--- a/src/shared/startup-command-submission.ts
+++ b/src/shared/startup-command-submission.ts
@@ -23,11 +23,33 @@ export type StartupCommandSubmissionOptions = {
    *  byte on `command` is preserved as-is. */
   submit: string
   /** Whether the target line editor has bracketed-paste mode active (Orca's
-   *  wrapped bash/zsh). Only wrap multiline payloads when true — a shell without
-   *  bracketed paste would echo the ESC[200~ markers as literal garbage. */
+   *  wrapped bash/zsh/fish). Only wrap multiline payloads when true — a shell
+   *  without bracketed paste would echo the ESC[200~ markers as literal garbage. */
   bracketedPasteSafe: boolean
 }
 
+/**
+ * Whether a spawned POSIX shell will read a bracketed-paste payload as one
+ * multiline command.
+ *
+ * Why fish needs the ready barrier: bash readline and zsh zle interpret the
+ * ESC[200~ wrapper out of their buffered input, but fish consumes bytes during
+ * its startup terminal-query handshake, so a payload written before its reader
+ * is up lands as literal `200~` text and the command never runs (verified
+ * against fish 4.7). Waiting for the shell-ready barrier is what makes fish
+ * paste-safe, and it is what the daemon and relay backends already require.
+ */
+export function isBracketedPasteSafeShell(args: {
+  shellName: string
+  waitsForShellReady: boolean
+}): boolean {
+  const name = args.shellName.toLowerCase()
+  if (name === 'bash' || name === 'zsh') {
+    return true
+  }
+  return name === 'fish' && args.waitsForShellReady
+}
+
 export function buildStartupCommandSubmission(
   command: string,
   { submit, bracketedPasteSafe }: StartupCommandSubmissionOptions
diff --git a/src/shared/terminal-cursor-style-settings.ts b/src/shared/terminal-cursor-style-settings.ts
index 0de07a08e31..ec271a7b972 100644
--- a/src/shared/terminal-cursor-style-settings.ts
+++ b/src/shared/terminal-cursor-style-settings.ts
@@ -5,6 +5,10 @@ type TerminalCursorStyleSettings = Pick<
   'terminalCursorStyle' | 'terminalCursorStyleDefaultedToBlock'
 >
 
+function isTerminalCursorStyle(value: unknown): value is GlobalSettings['terminalCursorStyle'] {
+  return value === 'bar' || value === 'block' || value === 'underline'
+}
+
 export function normalizeTerminalCursorStyleDefault(
   settings: Partial<TerminalCursorStyleSettings> | undefined,
   options: { preserveExplicitValue?: boolean } = {}
@@ -15,7 +19,10 @@ export function normalizeTerminalCursorStyleDefault(
   return {
     // Why: prior builds persisted the old bar default into profiles; migrate
     // those inherited values once while preserving later explicit choices.
-    terminalCursorStyle: defaultedToBlock ? (settings?.terminalCursorStyle ?? 'block') : 'block',
+    terminalCursorStyle:
+      defaultedToBlock && isTerminalCursorStyle(settings?.terminalCursorStyle)
+        ? settings.terminalCursorStyle
+        : 'block',
     terminalCursorStyleDefaultedToBlock: true
   }
 }
diff --git a/src/shared/terminal-file-link-conformance.ts b/src/shared/terminal-file-link-conformance.ts
index ec2ea0b9c64..d74af87eab2 100644
--- a/src/shared/terminal-file-link-conformance.ts
+++ b/src/shared/terminal-file-link-conformance.ts
@@ -13,7 +13,7 @@ export type TerminalFileLinkTapConformanceCase = {
 
 export function columnForTerminalFileLinkTap(testCase: TerminalFileLinkTapConformanceCase): number {
   const column = testCase.lineText.indexOf(testCase.tapText)
-  if (column < 0) {
+  if (column === -1) {
     throw new Error(`Tap text "${testCase.tapText}" not found in "${testCase.lineText}"`)
   }
   return column
diff --git a/src/shared/terminal-input.ts b/src/shared/terminal-input.ts
index 52f0ee8960f..bdaa410d04b 100644
--- a/src/shared/terminal-input.ts
+++ b/src/shared/terminal-input.ts
@@ -3,6 +3,7 @@ import {
   isClipboardTextByteLengthOverLimitWithYield,
   measureClipboardTextByteLength
 } from './clipboard-text'
+import { getUtf8ChunkEndIndex } from './utf8-byte-limits'
 
 export const TERMINAL_INPUT_CHUNK_MAX_BYTES = 16 * 1024
 export const TERMINAL_INPUT_MAX_BYTES = 16 * 1024 * 1024
@@ -13,19 +14,6 @@ export function getTerminalInputByteLength(text: string): number {
   return measureClipboardTextByteLength(text).byteLength
 }
 
-function getUtf8ByteLengthForCodePoint(codePoint: number): number {
-  if (codePoint <= 0x7f) {
-    return 1
-  }
-  if (codePoint <= 0x7ff) {
-    return 2
-  }
-  if (codePoint <= 0xffff) {
-    return 3
-  }
-  return 4
-}
-
 export function assertTerminalInputWithinLimit(
   text: string,
   maxBytes = TERMINAL_INPUT_MAX_BYTES
@@ -87,23 +75,10 @@ export function* iterateTerminalInputChunks(
     return
   }
 
-  let currentStart = 0
-  let currentBytes = 0
-  let index = 0
-  while (index < text.length) {
-    const codePoint = text.codePointAt(index) ?? 0
-    const codeUnitLength = codePoint > 0xffff ? 2 : 1
-    const nextIndex = index + codeUnitLength
-    const characterBytes = getUtf8ByteLengthForCodePoint(codePoint)
-    if (currentBytes > 0 && currentBytes + characterBytes > normalizedMax) {
-      yield text.slice(currentStart, index)
-      currentStart = index
-      currentBytes = 0
-    }
-    currentBytes += characterBytes
-    index = nextIndex
-  }
-  if (currentStart < text.length) {
-    yield text.slice(currentStart)
+  let startIndex = 0
+  while (startIndex < text.length) {
+    const endIndex = getUtf8ChunkEndIndex(text, startIndex, normalizedMax)
+    yield text.slice(startIndex, endIndex)
+    startIndex = endIndex
   }
 }
diff --git a/src/shared/terminal-kitty-keyboard-flags.ts b/src/shared/terminal-kitty-keyboard-flags.ts
new file mode 100644
index 00000000000..c8c7fb735ed
--- /dev/null
+++ b/src/shared/terminal-kitty-keyboard-flags.ts
@@ -0,0 +1,13 @@
+/**
+ * Boundary validation for the optional `kittyKeyboardFlags` snapshot field
+ * shared by Electron IPC, remote JSON decoding, and tracker restore.
+ *
+ * Absent means the snapshot owner could not PROVE the state — an old remote
+ * host, an unsequenced renderer serializer, or a source with no mode metadata.
+ * That is not the same fact as a proven inactive protocol, so an unparseable
+ * value returns `undefined` rather than clamping or coercing to `0`; laundering
+ * it into known zero would make Preview commit raw text against a bit-3 TUI.
+ */
+export function parseTerminalKittyKeyboardFlags(value: unknown): number | undefined {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined
+}
diff --git a/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts b/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
index 9ad2cb4d77a..57bd58abe21 100644
--- a/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
+++ b/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
@@ -147,4 +147,151 @@ describe('TerminalKittyKeyboardModeTracker', () => {
     ranAndExited.scanReplay('\x1b[>1uoutput\x1b[<u')
     expect(ranAndExited.flags).toBe(0)
   })
+
+  // `flags` is the conservative input fallback and `snapshotFlags` is
+  // the provable fact. Collapsing them lets a snapshot that carried no kitty
+  // metadata be republished downstream as "the host proved kitty is inactive",
+  // which is exactly how a Preview on a bit-3 TUI ends up sending legacy text.
+  describe('snapshot provenance', () => {
+    it("separates a fresh PTY's known zero from a snapshot's unproven zero", () => {
+      const fresh = new TerminalKittyKeyboardModeTracker()
+      expect(fresh.flags).toBe(0)
+      expect(fresh.snapshotFlags).toBe(0)
+
+      fresh.resetForSnapshot()
+      expect(fresh.flags).toBe(0)
+      expect(fresh.snapshotFlags).toBeUndefined()
+    })
+
+    it('restores known 0 and known 8 onto the active screen', () => {
+      const inactive = new TerminalKittyKeyboardModeTracker()
+      inactive.resetForSnapshot()
+      inactive.restoreSnapshotFlags(0)
+      expect(inactive.snapshotFlags).toBe(0)
+
+      const negotiated = new TerminalKittyKeyboardModeTracker()
+      negotiated.resetForSnapshot()
+      negotiated.restoreSnapshotFlags(8)
+      expect(negotiated.flags).toBe(8)
+      expect(negotiated.snapshotFlags).toBe(8)
+    })
+
+    it('ignores values that are not non-negative safe integers', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.resetForSnapshot()
+      for (const invalid of [-1, 1.5, Number.NaN, Number.MAX_SAFE_INTEGER + 2]) {
+        tracker.restoreSnapshotFlags(invalid)
+        expect(tracker.snapshotFlags).toBeUndefined()
+      }
+    })
+
+    it('re-proves state on an absolute set but not on a relative update', () => {
+      const relative = new TerminalKittyKeyboardModeTracker()
+      relative.resetForSnapshot()
+      relative.scan('\x1b[=8;2u')
+      expect(relative.flags).toBe(8)
+      // An OR against an unproven baseline cannot prove the result.
+      expect(relative.snapshotFlags).toBeUndefined()
+
+      const absolute = new TerminalKittyKeyboardModeTracker()
+      absolute.resetForSnapshot()
+      absolute.scan('\x1b[=8;1u')
+      expect(absolute.snapshotFlags).toBe(8)
+    })
+
+    it('degrades to unknown on a pop that reaches past omitted push history', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.resetForSnapshot()
+      tracker.restoreSnapshotFlags(8)
+      tracker.scan('\x1b[<u')
+      // The frame under the restored one was never captured, so zero is a guess.
+      expect(tracker.flags).toBe(0)
+      expect(tracker.snapshotFlags).toBeUndefined()
+    })
+
+    it('keeps a live push/pop pair proven when its baseline was proven', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.resetForSnapshot()
+      tracker.restoreSnapshotFlags(0)
+      tracker.scan('\x1b[>8u')
+      expect(tracker.snapshotFlags).toBe(8)
+      tracker.scan('\x1b[<u')
+      expect(tracker.snapshotFlags).toBe(0)
+    })
+
+    it('degrades to unknown on a pop that empties the stack over a nonzero frame', () => {
+      // The app's own emulator still holds pre-snapshot frames, so ITS pop
+      // restores the pushed 8 while the mirror's exhausted stack forces 0 —
+      // the forced zero must not be published as proven.
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.resetForSnapshot()
+      tracker.restoreSnapshotFlags(8)
+      tracker.scan('\x1b[>2u\x1b[<u')
+      expect(tracker.flags).toBe(0)
+      expect(tracker.snapshotFlags).toBeUndefined()
+    })
+
+    it('moves the known bit with the numeric slot across screen switches', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.resetForSnapshot()
+      tracker.restoreSnapshotFlags(8)
+      // The alternate screen's saved slot was never captured.
+      tracker.scan('\x1b[?1049h')
+      expect(tracker.snapshotFlags).toBeUndefined()
+      tracker.scan('\x1b[?1049l')
+      expect(tracker.snapshotFlags).toBe(8)
+    })
+
+    it('re-proves everything on RIS and DECSTR', () => {
+      const ris = new TerminalKittyKeyboardModeTracker()
+      ris.resetForSnapshot()
+      ris.scan('\x1bc')
+      expect(ris.snapshotFlags).toBe(0)
+
+      const softReset = new TerminalKittyKeyboardModeTracker()
+      softReset.resetForSnapshot()
+      softReset.restoreSnapshotFlags(8)
+      softReset.scan('\x1b[!p')
+      expect(softReset.snapshotFlags).toBe(0)
+    })
+  })
+
+  // A constructor-fresh tracker reports known-zero, which is only true for a
+  // PTY it watches from spawn. Grounding lets snapshot appliers refuse to
+  // preserve or carry that default for a pre-existing PTY.
+  describe('baseline grounding', () => {
+    it('starts ungrounded and grounds on an explicit fresh-PTY reset', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      expect(tracker.hasProvenBaseline).toBe(false)
+      tracker.reset()
+      expect(tracker.hasProvenBaseline).toBe(true)
+    })
+
+    it('is not grounded by plain output, only by absolute kitty evidence', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.scan('plain output\x1b[31mcolored\x1b[0m')
+      expect(tracker.hasProvenBaseline).toBe(false)
+      tracker.scan('\x1b[>8u')
+      expect(tracker.hasProvenBaseline).toBe(true)
+    })
+
+    it('grounds on a proven snapshot restore but not on the snapshot reset', () => {
+      const tracker = new TerminalKittyKeyboardModeTracker()
+      tracker.reset()
+      tracker.resetForSnapshot()
+      expect(tracker.hasProvenBaseline).toBe(false)
+      tracker.restoreSnapshotFlags(8)
+      expect(tracker.hasProvenBaseline).toBe(true)
+    })
+
+    it('grounds on RIS and DECSTR arriving in the stream', () => {
+      const ris = new TerminalKittyKeyboardModeTracker()
+      ris.scan('\x1bc')
+      expect(ris.hasProvenBaseline).toBe(true)
+
+      const softReset = new TerminalKittyKeyboardModeTracker()
+      softReset.scan('\x1b[!p')
+      expect(softReset.hasProvenBaseline).toBe(true)
+    })
+  })
 })
diff --git a/src/shared/terminal-kitty-keyboard-mode-tracker.ts b/src/shared/terminal-kitty-keyboard-mode-tracker.ts
index 2b501a2c9ff..cae87067973 100644
--- a/src/shared/terminal-kitty-keyboard-mode-tracker.ts
+++ b/src/shared/terminal-kitty-keyboard-mode-tracker.ts
@@ -1,3 +1,5 @@
+import { parseTerminalKittyKeyboardFlags } from './terminal-kitty-keyboard-flags'
+
 // Why: PTY/SSH chunks can split an escape sequence before its final byte.
 // Keep parser state far beyond normal sequence lengths while bounding memory.
 const KITTY_SCAN_TAIL_LIMIT = 4096
@@ -6,6 +8,9 @@ const KITTY_SCAN_TAIL_LIMIT = 4096
 // mirrored stacks unboundedly while the renderer's own stacks stay at 16.
 const KITTY_STACK_LIMIT = 16
 
+/** A pushed flags slot plus whether the value it will restore was ever proven. */
+type KittyStackFrame = { flags: number; known: boolean }
+
 /**
  * Mirrors the kitty keyboard protocol flag state (CSI > u push, CSI < u pop,
  * CSI = u set) by scanning the raw PTY output stream, replicating xterm's
@@ -27,16 +32,50 @@ export class TerminalKittyKeyboardModeTracker {
   private currentFlags = 0
   private mainFlags = 0
   private altFlags = 0
-  private mainStack: number[] = []
-  private altStack: number[] = []
+  private currentKnown = true
+  private mainKnown = true
+  private altKnown = true
+  private mainStack: KittyStackFrame[] = []
+  private altStack: KittyStackFrame[] = []
+  /** False once a snapshot replaced state whose push history was never observed. */
+  private mainStackComplete = true
+  private altStackComplete = true
   private alternateScreenActive = false
   private alternateScreenSwitchObserved = false
+  // Why: a constructor-fresh tracker reports known-inactive, which is correct
+  // for a PTY it watches from spawn but was never proven for a pre-existing
+  // one. Grounding flips on evidence only: an explicit fresh-PTY reset, a
+  // proven snapshot restore, or scanned bytes that state flags absolutely.
+  private baselineProven = false
 
-  /** Current effective kitty keyboard flags (0 = protocol inactive). */
+  /**
+   * Current effective kitty keyboard flags. `0` doubles as the conservative
+   * input fallback while the state is unknown — read `snapshotFlags` instead
+   * when the caller must distinguish "proven inactive" from "unproven".
+   */
   get flags(): number {
     return this.currentFlags
   }
 
+  /**
+   * Active screen's proven flags, absent when unknown: after snapshots without
+   * Kitty metadata, or transitions needing uncarried push history. Serializers
+   * publish this, never `flags` — silence must not become a proven zero.
+   */
+  get snapshotFlags(): number | undefined {
+    return this.currentKnown ? this.currentFlags : undefined
+  }
+
+  /**
+   * True once this tracker's knownness is grounded in evidence for the PTY it
+   * mirrors. Consumers use it to refuse to preserve (or carry) a constructor
+   * default across a snapshot that proves nothing — the fresh known-zero must
+   * not be laundered into a host-proven inactive protocol.
+   */
+  get hasProvenBaseline(): boolean {
+    return this.baselineProven
+  }
+
   get isAlternateScreen(): boolean {
     return this.alternateScreenActive
   }
@@ -45,17 +84,57 @@ export class TerminalKittyKeyboardModeTracker {
     return this.alternateScreenSwitchObserved
   }
 
+  /** Full reset to a fresh PTY: known-inactive on both screens. */
   reset(): void {
+    this.baselineProven = true
     this.scanTail = ''
     this.currentFlags = 0
     this.mainFlags = 0
     this.altFlags = 0
+    this.currentKnown = true
+    this.mainKnown = true
+    this.altKnown = true
     this.mainStack = []
     this.altStack = []
+    this.mainStackComplete = true
+    this.altStackComplete = true
     this.alternateScreenActive = false
     this.alternateScreenSwitchObserved = false
   }
 
+  /**
+   * Start applying a replacement or historical snapshot. Production snapshot
+   * ANSI deliberately omits kitty pushes, so scanning it can never recover a
+   * negotiation that predates the capture: keep `0` as the input fallback but
+   * mark both screens and their stacks unproven until `restoreSnapshotFlags`
+   * or explicit application output proves them again.
+   */
+  resetForSnapshot(): void {
+    this.reset()
+    this.baselineProven = false
+    this.currentKnown = false
+    this.mainKnown = false
+    this.altKnown = false
+    this.mainStackComplete = false
+    this.altStackComplete = false
+  }
+
+  /**
+   * Adopt the effective flags the snapshot owner proved at the snapshot's own
+   * sequence boundary. Only the ACTIVE screen becomes known — the inactive
+   * screen's slot and both push stacks stay unproven because current snapshot
+   * authorities expose neither.
+   */
+  restoreSnapshotFlags(flags: number): void {
+    const parsed = parseTerminalKittyKeyboardFlags(flags)
+    if (parsed === undefined) {
+      return
+    }
+    this.currentFlags = parsed
+    this.currentKnown = true
+    this.baselineProven = true
+  }
+
   scan(data: string): void {
     this.scanInternal(data, false)
   }
@@ -106,11 +185,17 @@ export class TerminalKittyKeyboardModeTracker {
     // Why: xterm's DECSTR (CSI ! p) wipes kitty flags and stacks for both
     // screens via coreService.reset but does not switch buffers — mirror that
     // so a soft-resetting TUI stops receiving kitty-encoded Option chords.
+    this.baselineProven = true
     this.currentFlags = 0
     this.mainFlags = 0
     this.altFlags = 0
+    this.currentKnown = true
+    this.mainKnown = true
+    this.altKnown = true
     this.mainStack = []
     this.altStack = []
+    this.mainStackComplete = true
+    this.altStackComplete = true
   }
 
   private applyScreenSwitch(params: string, enabled: boolean): void {
@@ -123,13 +208,19 @@ export class TerminalKittyKeyboardModeTracker {
       // Why: xterm swaps the current flags with the inactive screen's slot on
       // every 47/1047/1049 transition, without an already-active guard —
       // mirror it exactly so this state matches what the renderer encodes.
+      // Why the known bit rides the numeric slot: a screen whose flags were
+      // never proven must not become proven just by being swapped in.
       if (enabled) {
         this.mainFlags = this.currentFlags
+        this.mainKnown = this.currentKnown
         this.currentFlags = this.altFlags
+        this.currentKnown = this.altKnown
         this.alternateScreenActive = true
       } else {
         this.altFlags = this.currentFlags
+        this.altKnown = this.currentKnown
         this.currentFlags = this.mainFlags
+        this.currentKnown = this.mainKnown
         this.alternateScreenActive = false
       }
     }
@@ -143,26 +234,54 @@ export class TerminalKittyKeyboardModeTracker {
         if (stack.length >= KITTY_STACK_LIMIT) {
           stack.shift()
         }
-        stack.push(this.currentFlags)
+        stack.push({ flags: this.currentFlags, known: this.currentKnown })
       }
+      // A push states the new effective flags absolutely, so they are proven
+      // even when the value it displaced was not.
       this.currentFlags = parsed[0] || 0
+      this.currentKnown = true
+      this.baselineProven = true
       return
     }
     if (prefix === '<') {
       const count = Math.max(1, parsed[0] || 1)
-      for (let i = 0; i < count && stack.length > 0; i++) {
-        this.currentFlags = stack.pop() as number
+      let lastPopped: KittyStackFrame | null = null
+      for (let i = 0; i < count; i++) {
+        const frame = stack.pop()
+        if (!frame) {
+          lastPopped = null
+          break
+        }
+        lastPopped = frame
+        this.currentFlags = frame.flags
+        this.currentKnown = frame.known
       }
       if (stack.length === 0) {
+        // Why: xterm zeroes an exhausted stack even over a just-popped value.
+        // With complete history that matches the app's emulator exactly, but a
+        // mirror whose stack omits pre-snapshot pushes empties EARLIER than
+        // the app's — its forced zero is only proven when the popped frame
+        // itself proves 0 (the app restores that same value whatever sits
+        // below it); landing at empty on any other frame, or past it, proves
+        // nothing about the older history.
         this.currentFlags = 0
+        const stackComplete = this.alternateScreenActive
+          ? this.altStackComplete
+          : this.mainStackComplete
+        this.currentKnown =
+          stackComplete || (lastPopped !== null && lastPopped.known && lastPopped.flags === 0)
       }
       return
     }
     const flags = parsed[0] || 0
     const mode = parsed.length > 1 && parsed[1] ? parsed[1] : 1
     if (mode === 1) {
+      // An absolute set re-proves the active screen regardless of its baseline.
       this.currentFlags = flags
+      this.currentKnown = true
+      this.baselineProven = true
     } else if (mode === 2) {
+      // Relative updates only preserve knowledge; they cannot create it.
       this.currentFlags |= flags
     } else if (mode === 3) {
       this.currentFlags &= ~flags
diff --git a/src/shared/terminal-mode-2031-final-state.test.ts b/src/shared/terminal-mode-2031-final-state.test.ts
index b8e04d9f1c0..7e2f8b0cce3 100644
--- a/src/shared/terminal-mode-2031-final-state.test.ts
+++ b/src/shared/terminal-mode-2031-final-state.test.ts
@@ -4,13 +4,19 @@
 // subscription the shell has already dropped, and the reply lands as literal
 // text at the prompt or in a child's stdin (#9993).
 import { describe, expect, it } from 'vitest'
-import { scanMode2031Sequences } from './terminal-color-scheme-protocol'
+import {
+  INITIAL_MODE_2031_REPLY_SCAN_STATE,
+  scanMode2031ReplyDecision,
+  scanMode2031Sequences,
+  type Mode2031ReplyDecision
+} from './terminal-color-scheme-protocol'
 import {
   createTerminalTitleTracker,
   type TerminalTitleTrackerCallbacks
 } from './terminal-output-side-effects'
 
 const ESC = '\x1b'
+const BEL = '\x07'
 
 // A fish prompt cycle: subscribe, paint the prompt, hand the tty to the child.
 const FISH_PROMPT_HANDOFF = `${ESC}[?2031h${ESC}[0m~/orca ${ESC}[32m❯${ESC}[0m ${ESC}[?2031l`
@@ -131,3 +137,73 @@ describe('DECSET 2031 replies follow the chunk-final state (#9993)', () => {
     expect(recorded.subscribes).toBe(1)
   })
 })
+
+/**
+ * Real chunk boundaries captured from fish 4.7.1 over node-pty
+ * (tests/tools/fish-mode2031-repro/capture-fish-mode2031-trace.mjs). One prompt-accept:
+ * arm 2031 while painting the prompt, echo the typed line, withdraw 2031, exec the command.
+ * Measured gap between chunks 1 and 4 in that trace: 0.57ms — shorter than a renderer IPC hop.
+ */
+const FISH_PROMPT_ACCEPT_CHUNKS: readonly string[] = [
+  // 1. Prompt setup: capability probes plus the 2031 arm. Ends SUBSCRIBED.
+  `${ESC}]0;~/orca${BEL}${ESC}[m${ESC}]11;?${ESC}\\${ESC}[6n${ESC}[0c${ESC}[?2004h${ESC}[?2031h${ESC}[>4;1m${ESC}=`,
+  // 2. The prompt itself.
+  `${ESC}]133;A;click_events=1${BEL}~/orca ❯ ${ESC}]133;B${BEL}${ESC}[K\r${ESC}[9C`,
+  // 3. Echo of the typed command.
+  `npx${ESC}[12C -y${ESC}[15C`,
+  // 4. Accept: fish withdraws 2031 before handing the tty over. Ends UNSUBSCRIBED.
+  `${ESC}[?2004l${ESC}[?2031l${ESC}[>4;0m${ESC}>\r${ESC}[15C`,
+  // 5. The command is now running and owns the tty — any reply from chunk 1 lands HERE.
+  `${ESC}[m${ESC}]133;C;cmdline_url=npx${BEL}`
+]
+
+function trackerRecordingBothFacts(): {
+  facts: string[]
+  tracker: ReturnType<typeof createTerminalTitleTracker>
+} {
+  const facts: string[] = []
+  return {
+    facts,
+    tracker: createTerminalTitleTracker({
+      onMode2031Subscribe: () => facts.push('2031-subscribe'),
+      onMode2031Unsubscribe: () => facts.push('2031-unsubscribe')
+    })
+  }
+}
+
+describe('a fish prompt-accept burst is tracked, never answered (#9993)', () => {
+  it('yields registry transitions only — subscribe then unsubscribe, two chunks apart', () => {
+    let state = INITIAL_MODE_2031_REPLY_SCAN_STATE
+    const decisions: Mode2031ReplyDecision[] = FISH_PROMPT_ACCEPT_CHUNKS.map((chunk) => {
+      const result = scanMode2031ReplyDecision(state, chunk)
+      state = result.state
+      return result.decision
+    })
+
+    expect(decisions).toEqual(['subscribed', null, null, 'unsubscribed', null])
+    // The subscription is already retired one chunk before the command starts, so a reply
+    // queued on the 'subscribed' decision cannot reach fish — only the child that replaced it.
+    expect(decisions.indexOf('unsubscribed')).toBeLessThan(FISH_PROMPT_ACCEPT_CHUNKS.length - 1)
+  })
+
+  it('still emits both side-effect facts so the subscription registry stays truthful', () => {
+    const recorded = trackerRecordingBothFacts()
+
+    for (const chunk of FISH_PROMPT_ACCEPT_CHUNKS) {
+      recorded.tracker.handleChunk(chunk)
+    }
+
+    // Facts survive the fix: maybePushMode2031Flip needs them to know who is listening.
+    expect(recorded.facts).toEqual(['2031-subscribe', '2031-unsubscribe'])
+  })
+
+  it('contains no color-scheme query, so silence is the whole correct answer', () => {
+    const burst = FISH_PROMPT_ACCEPT_CHUNKS.join('')
+
+    // Verified over a full real session: fish never sends the protocol's query (`CSI ?996n`).
+    // It only ever subscribes, so there is nothing here that a `CSI ?997;Nn` could be a reply to.
+    expect(burst).toContain(`${ESC}[?2031h`)
+    expect(burst).not.toContain('996')
+    expect(burst).not.toContain('997')
+  })
+})
diff --git a/src/shared/terminal-output-side-effects.ts b/src/shared/terminal-output-side-effects.ts
index 31f7df27edf..d8b39e954e1 100644
--- a/src/shared/terminal-output-side-effects.ts
+++ b/src/shared/terminal-output-side-effects.ts
@@ -67,7 +67,7 @@ export type TerminalTitleTrackerCallbacks = {
   onPrLink?: (link: TerminalGitHubPRLink) => void
   /**
    * Fired per chunk containing a DECSET 2031 subscribe (chunk-boundary-safe): lets
-   * hidden-delivery-gated renderer views answer the color-scheme query without byte access.
+   * hidden-delivery-gated renderer views track the subscription without byte access.
    */
   onMode2031Subscribe?: () => void
   /**
diff --git a/src/shared/terminal-preview.ts b/src/shared/terminal-preview.ts
index 41bd7e638d5..0ca380fe8e9 100644
--- a/src/shared/terminal-preview.ts
+++ b/src/shared/terminal-preview.ts
@@ -5,12 +5,27 @@ export type TerminalPreviewSnapshot = {
   seq?: number
   scrollbackAnsi?: string
   pendingEscapeTailAnsi?: string
+  /** Effective kitty keyboard flags the snapshot owner proved at this same
+   *  `seq` boundary. Absent means unknown — Preview then keeps its tracker
+   *  unproven and commits raw text rather than guessing zero. */
+  kittyKeyboardFlags?: number
+}
+
+/**
+ * How the renderer must apply one buffered chunk. `live` is a proven
+ * post-snapshot suffix, so kitty pushes advance the stack; `replay` is
+ * redelivery that may repeat the application's one-time push, so it applies
+ * idempotently (see TerminalKittyKeyboardModeTracker.scanReplay).
+ */
+export type TerminalPreviewReplayChunk = {
+  data: string
+  mode: 'live' | 'replay'
 }
 
 export type TerminalPreviewConnectResult = {
   snapshot: TerminalPreviewSnapshot | null
   /** Live bytes captured while the snapshot was being serialized. */
-  replay: string[]
+  replay: TerminalPreviewReplayChunk[]
   /** Snapshot acquisition overflowed twice; refresh without blanking the existing view. */
   resyncRequired?: boolean
 }
diff --git a/src/shared/terminal-query-reply.ts b/src/shared/terminal-query-reply.ts
index 8e25905447a..e83f0dbcc94 100644
--- a/src/shared/terminal-query-reply.ts
+++ b/src/shared/terminal-query-reply.ts
@@ -92,8 +92,9 @@ function cookedEchoSafeReplyEnd(data: string, start: number): number {
 }
 
 /**
- * If `data` is entirely one or more consecutive cooked-echo-risk replies
- * (e.g. repeated `?997;1n` coalesced by the input write queue), return each reply.
+ * If `data` is entirely one or more consecutive cooked-echo-risk replies, return each
+ * reply. Repeats still arrive coalesced from a rapid theme flip or an older client that
+ * answers 2031 subscribes (this host stopped — #9993), so peel them individually.
  * Mixed payloads (reply + keystroke) return null so hosts fall through to raw write.
  */
 export function extractOnlyCookedEchoSafeQueryReplies(data: string): string[] | null {
diff --git a/src/shared/terminal-reply-query-scan.test.ts b/src/shared/terminal-reply-query-scan.test.ts
index 2a94eaad63d..a29ab3c98da 100644
--- a/src/shared/terminal-reply-query-scan.test.ts
+++ b/src/shared/terminal-reply-query-scan.test.ts
@@ -3,6 +3,24 @@ import {
   EMPTY_TERMINAL_REPLY_QUERY_SCAN_STATE,
   scanTerminalReplyQuerySequences
 } from './terminal-reply-query-scan'
+import {
+  INITIAL_MODE_2031_REPLY_SCAN_STATE,
+  scanMode2031ReplyDecision
+} from './terminal-color-scheme-protocol'
+
+/** Exactly what terminal.ts's subscribe path concatenates into the replay push. */
+function replayDataFor(chunks: readonly string[]): string {
+  let state = EMPTY_TERMINAL_REPLY_QUERY_SCAN_STATE
+  let seq = 0
+  let replay = ''
+  for (const chunk of chunks) {
+    const scan = scanTerminalReplyQuerySequences(chunk, seq, state)
+    state = scan.state
+    seq += chunk.length
+    replay += scan.queries.map((query) => query.data).join('')
+  }
+  return replay
+}
 
 describe('terminal reply query scan', () => {
   it('records reply-eliciting queries with their output high-water sequence', () => {
@@ -39,3 +57,56 @@ describe('terminal reply query scan', () => {
     expect(second.queries).toEqual([])
   })
 })
+
+// A late-attaching remote/mobile client is handed these sequences because the scrollback
+// snapshot it also receives carries no control bytes. Carrying the 2031 arm without its
+// withdraw made the client register a subscription the TUI had already retired, and the
+// remote renderer then pushed CSI ?997;Nn into the shell on the next theme flip (#9993).
+describe('replayed DECSET 2031 state matches the TUI final state (#9993)', () => {
+  it('carries the withdraw alongside the arm', () => {
+    const result = scanTerminalReplyQuerySequences(
+      '\x1b[?2031h\x1b[6nprompt$ \x1b[?2031l',
+      0,
+      EMPTY_TERMINAL_REPLY_QUERY_SCAN_STATE
+    )
+
+    expect(result.queries).toEqual([
+      { data: '\x1b[?2031h', startSeq: 0, endSeq: 8 },
+      { data: '\x1b[6n', startSeq: 8, endSeq: 12 },
+      { data: '\x1b[?2031l', startSeq: 20, endSeq: 28 }
+    ])
+  })
+
+  it('leaves a fish prompt-accept replay UNSUBSCRIBED, as fish actually is', () => {
+    // fish arms 2031 while painting the prompt and withdraws it before exec'ing the command.
+    const replay = replayDataFor([
+      '\x1b[?2004h\x1b[?2031h',
+      '~/orca ❯ ',
+      '\x1b[?2004l\x1b[?2031l',
+      'npx running now'
+    ])
+
+    expect(replay).toBe('\x1b[?2031h\x1b[?2031l')
+    expect(scanMode2031ReplyDecision(INITIAL_MODE_2031_REPLY_SCAN_STATE, replay).decision).toBe(
+      'unsubscribed'
+    )
+  })
+
+  it('leaves a still-armed TUI SUBSCRIBED so it keeps receiving theme flips', () => {
+    const replay = replayDataFor(['\x1b[?2031h', 'a TUI that stays subscribed'])
+
+    expect(replay).toBe('\x1b[?2031h')
+    expect(scanMode2031ReplyDecision(INITIAL_MODE_2031_REPLY_SCAN_STATE, replay).decision).toBe(
+      'subscribed'
+    )
+  })
+
+  it('resolves a rearm after a withdraw to the last toggle, in byte order', () => {
+    const replay = replayDataFor(['\x1b[?2031h', 'x\x1b[?2031l', 'y\x1b[?2031h'])
+
+    expect(replay).toBe('\x1b[?2031h\x1b[?2031l\x1b[?2031h')
+    expect(scanMode2031ReplyDecision(INITIAL_MODE_2031_REPLY_SCAN_STATE, replay).decision).toBe(
+      'subscribed'
+    )
+  })
+})
diff --git a/src/shared/terminal-reply-query-scan.ts b/src/shared/terminal-reply-query-scan.ts
index 434d37041d7..1a0d14741d2 100644
--- a/src/shared/terminal-reply-query-scan.ts
+++ b/src/shared/terminal-reply-query-scan.ts
@@ -24,7 +24,18 @@ export const EMPTY_TERMINAL_REPLY_QUERY_SCAN_STATE: TerminalReplyQueryScanState
   pendingStartSeq: null
 }
 
-function isReplyElicitingCsi(sequence: string): boolean {
+/**
+ * Sequences worth replaying to a late-attaching view, because a scrollback snapshot
+ * carries only rendered cells and drops the control bytes that produced them.
+ *
+ * Most entries are reply-eliciting queries the attaching emulator must answer once.
+ * The DECSET/DECRST 2031 pair is different: since #9993 nothing answers the subscribe,
+ * but a remote renderer derives its color-scheme subscription registry from these very
+ * bytes (pty-connection observeLiveMode2031Chunk), so both toggles must be carried —
+ * an arm without its withdraw would leave the client subscribed for a TUI that already
+ * retired the subscription, and fish rearms/withdraws on every prompt.
+ */
+function isReplayableCsi(sequence: string): boolean {
   if (DEVICE_ATTRIBUTES_QUERY_RE.test(sequence)) {
     return true
   }
@@ -41,7 +52,10 @@ function isReplyElicitingCsi(sequence: string): boolean {
     sequence === '\x1b[16t' ||
     sequence === '\x1b[18t' ||
     sequence === '\x1b[?u' ||
-    sequence === '\x1b[?2031h'
+    sequence === '\x1b[?2031h' ||
+    // Why paired with the arm above, exact-form only: replaying a combined DECRST such as
+    // `CSI ?2004;2031l` would also toggle unrelated modes in the attaching emulator.
+    sequence === '\x1b[?2031l'
   )
 }
 
@@ -81,7 +95,7 @@ export function scanTerminalReplyQuerySequences(
     if (input.startsWith(`${ESC}[`, candidateIndex)) {
       endIndex = findCsiFinalByteIndex(input, candidateIndex + 2)
       if (endIndex !== -1) {
-        matches = isReplyElicitingCsi(input.slice(candidateIndex, endIndex + 1))
+        matches = isReplayableCsi(input.slice(candidateIndex, endIndex + 1))
       }
     } else if (input.startsWith(`${ESC}]`, candidateIndex)) {
       const osc = parseTerminalOscColorQuery(input, candidateIndex)
diff --git a/src/shared/terminal-serialize-absolute-cursor.ts b/src/shared/terminal-serialize-absolute-cursor.ts
index 18902b27426..ee2ac371296 100644
--- a/src/shared/terminal-serialize-absolute-cursor.ts
+++ b/src/shared/terminal-serialize-absolute-cursor.ts
@@ -19,7 +19,7 @@ type BufferSerializer<TOpts> = {
 }
 
 /** VT100 DECSC saved-cursor register (0-based, viewport-relative row). */
-export type SavedCursorRegister = { x: number; y: number }
+export type SavedCursorRegister = { x: number; y: number; originMode: boolean }
 
 // xterm keeps the DECSC register on each Buffer (savedY is absolute:
 // ybase-included). It is not exposed through the public API, so snapshot
@@ -27,7 +27,17 @@ export type SavedCursorRegister = { x: number; y: number }
 // buffer, so an alt-screen TUI yields the alternate screen's own register,
 // matching the one a post-restore DECRC would consult.
 type TerminalWithSavedCursorCore = SerializeCursorTerminal & {
-  _core?: { buffer?: { savedX?: number; savedY?: number; ybase?: number } }
+  modes?: { originMode?: boolean }
+  _core?: {
+    buffer?: {
+      savedX?: number
+      savedY?: number
+      savedOriginMode?: boolean
+      ybase?: number
+      scrollTop?: number
+      scrollBottom?: number
+    }
+  }
 }
 
 /** Reads the source terminal's active-buffer DECSC register, or null when it
@@ -48,13 +58,14 @@ export function readSavedCursorRegister(
   // cols (DECSC during wrap-pending); CUP cannot re-create pending, so clamp.
   const y = Math.min(Math.max(core.savedY - core.ybase, 0), terminal.rows - 1)
   const x = Math.min(Math.max(core.savedX, 0), terminal.cols - 1)
-  if (x === 0 && y === 0) {
+  const originMode = core.savedOriginMode === true
+  if (x === 0 && y === 0 && !originMode) {
     // Home is xterm's never-saved default: a fresh restore terminal already
     // sends DECRC to home, and skipping the injection avoids overwriting the
     // fresh terminal's default saved SGR/charset when nothing was ever saved.
     return null
   }
-  return { x, y }
+  return { x, y, originMode }
 }
 
 export function serializeWithAbsoluteCursor<TOpts>(
@@ -70,15 +81,30 @@ export function serializeWithAbsoluteCursor<TOpts>(
   if (serialized.length === 0) {
     return serialized
   }
+  return `${serialized}${buildAbsoluteCursorRestoreSequence(terminal, savedCursor)}`
+}
+
+/** Cursor state appended after serialized modes; safe to replay without the frame body. */
+export function buildAbsoluteCursorRestoreSequence(
+  terminal: SerializeCursorTerminal,
+  savedCursor?: SavedCursorRegister | null,
+  options: { restoreModesWithoutCursor?: boolean } = {}
+): string {
   const { cursorX, cursorY } = terminal.buffer.active
+  const terminalWithCore = terminal as TerminalWithSavedCursorCore
+  const buffer = terminalWithCore._core?.buffer
+  const scrollTop = buffer?.scrollTop ?? 0
+  const scrollBottom = buffer?.scrollBottom ?? terminal.rows - 1
+  const originMode = terminalWithCore.modes?.originMode === true
+  const cupCursorY = cursorY - (originMode ? scrollTop : 0)
   // Why skip wrap-pending sources (cursorX == cols): plain replay already
   // reproduces that state exactly, while CUP would clamp to the last column
   // and clear the pending-wrap flag, changing how the next byte renders.
   // The remaining bounds checks are defensive: never emit a clamping CUP.
-  // The saved-cursor injection is skipped with it — it moves the cursor, so
-  // it may only ride along when the absolute CUP restores the position after.
-  if (cursorX < 0 || cursorX >= terminal.cols || cursorY < 0 || cursorY >= terminal.rows) {
-    return serialized
+  const canRestoreCurrentCursor =
+    cursorX >= 0 && cursorX < terminal.cols && cupCursorY >= 0 && cupCursorY < terminal.rows
+  if (!canRestoreCurrentCursor && options.restoreModesWithoutCursor !== true) {
+    return ''
   }
   // Why the DECSC injection: the serialized screen cannot carry the VT100
   // saved-cursor register, so a hidden DECSC followed by a post-reveal DECRC
@@ -87,9 +113,21 @@ export function serializeWithAbsoluteCursor<TOpts>(
   // the source's saved position, then CUP back to the real cursor. Saved SGR/
   // charset are not carried — the synthetic ESC 7 saves the serializer's
   // final pen, a deliberate position-only fidelity trade.
-  const savedRestore = savedCursor ? `\x1b[${savedCursor.y + 1};${savedCursor.x + 1}H\x1b7` : ''
-  // cursorY is viewport-relative (0 at the buffer's base row), which is the
-  // same coordinate space CUP addresses after replay; scrollback length
-  // differences between source and destination do not shift it.
-  return `${serialized}${savedRestore}\x1b[${cursorY + 1};${cursorX + 1}H`
+  // Install the saved register against a full region so its absolute row is
+  // representable even when it predates the current DECSTBM/DECOM state.
+  const savedRestore = savedCursor
+    ? `\x1b[r\x1b[?6${savedCursor.originMode ? 'h' : 'l'}\x1b[${savedCursor.y + 1};${savedCursor.x + 1}H\x1b7`
+    : ''
+  const mustRestoreModes = savedCursor != null || options.restoreModesWithoutCursor === true
+  const scrollRegionRestore =
+    mustRestoreModes && (scrollTop !== 0 || scrollBottom !== terminal.rows - 1)
+      ? `\x1b[${scrollTop + 1};${scrollBottom + 1}r`
+      : ''
+  const originModeRestore = mustRestoreModes ? `\x1b[?6${originMode ? 'h' : 'l'}` : ''
+  // CUP rows become margin-relative under DECOM; ordinary snapshots keep the
+  // zero offset because scrollback length does not shift viewport coordinates.
+  const currentCursorRestore = canRestoreCurrentCursor
+    ? `\x1b[${cupCursorY + 1};${cursorX + 1}H`
+    : ''
+  return `${savedRestore}${scrollRegionRestore}${originModeRestore}${currentCursorRestore}`
 }
diff --git a/src/shared/terminal-side-effect-facts.ts b/src/shared/terminal-side-effect-facts.ts
index d9c4ce6e46a..47c416aff5d 100644
--- a/src/shared/terminal-side-effect-facts.ts
+++ b/src/shared/terminal-side-effect-facts.ts
@@ -30,9 +30,8 @@ export type TerminalSideEffectFact =
   | { kind: 'command-code-working'; prompt: string }
   | { kind: 'command-code-done'; prompt: string }
   /** DECSET 2031 color-scheme subscribe observed in the byte stream. Emitted
-   *  so hidden-delivery-gated views (whose bytes never arrive) can still send
-   *  the theme reply — the reply stays renderer-side because query authority
-   *  belongs to the view (model/view contract invariant 6). */
+   *  so hidden-delivery-gated views (whose bytes never arrive) can still record
+   *  the subscription and push later theme flips; subscribing is never answered. */
   | { kind: '2031-subscribe' }
   /** DECSET 2031 withdrawal observed in the byte stream. Gated views never see
    *  these bytes, so without this fact their subscription registry goes stale
diff --git a/src/shared/terminal-title-agent-type.test.ts b/src/shared/terminal-title-agent-type.test.ts
index d20d03b5b6d..ed7203f5af3 100644
--- a/src/shared/terminal-title-agent-type.test.ts
+++ b/src/shared/terminal-title-agent-type.test.ts
@@ -64,7 +64,7 @@ describe('resolveExplicitTerminalTitleAgentType', () => {
     expect(getSharedAgentLabel('OC | Compare Codex and Claude')).toBe('OpenCode')
     expect(getSharedAgentLabel('OC | ✦ Gemini CLI')).toBe('OpenCode')
     expect(resolveExplicitTerminalTitleAgentType('tmux | OC | ses_123')).toBe('opencode')
-    expect(resolveExplicitTerminalTitleAgentType('OC|compact-session')).toBe('opencode')
+    expect(resolveExplicitTerminalTitleAgentType('OC|compact-session')).toBeNull()
     expect(resolveExplicitTerminalTitleAgentType('oc | Understand about the plugin')).toBeNull()
   })
 
diff --git a/src/shared/terminal-title-agent-type.ts b/src/shared/terminal-title-agent-type.ts
index 7e38a227f34..0952d96e63f 100644
--- a/src/shared/terminal-title-agent-type.ts
+++ b/src/shared/terminal-title-agent-type.ts
@@ -4,7 +4,7 @@ import {
   HERMES_AGENT_NAME_RE,
   titleHasAgentName
 } from './agent-name-token-match'
-import { isCursorAgentTitle } from './agent-title-core'
+import { containsAgentSpinnerGlyph, isCursorAgentTitle } from './agent-title-core'
 import { stripLeadingAgentTitleDecorationOrEmpty } from './agent-title-decoration'
 import { isOpenCodeNativeTitle } from './opencode-terminal-title'
 import { getWrapperTitleSegments } from './terminal-title-wrapper-segments'
@@ -96,7 +96,7 @@ export function isClaudeAgent(title: string): boolean {
   if (title.startsWith('. ') || title.startsWith('* ')) {
     return true
   }
-  if (containsBrailleSpinner(title)) {
+  if (containsAgentSpinnerGlyph(title)) {
     // Why: named non-Claude agents carry braille spinners too. Gate Cursor by its
     // identity title, not the token, so a Claude title mentioning a cursor stays Claude.
     return !isCursorAgentTitle(title) && !lower.includes('openclaude')
@@ -231,7 +231,7 @@ const TITLE_LABEL_TO_AGENT: Partial<Record<string, TuiAgent>> = {
 
 function hasGenericClaudeStatusPrefix(title: string): boolean {
   return (
-    containsBrailleSpinner(title) ||
+    containsAgentSpinnerGlyph(title) ||
     title.startsWith('✳ ') ||
     title === '✳' ||
     title.startsWith('. ') ||
diff --git a/src/shared/text-search.ts b/src/shared/text-search.ts
index d3d9b40226a..780164372cb 100644
--- a/src/shared/text-search.ts
+++ b/src/shared/text-search.ts
@@ -393,7 +393,7 @@ export function ingestGitGrepLine(
   const secondNullIdx = rest.indexOf('\0')
   let lineNumberText: string
   let lineContent: string
-  if (secondNullIdx >= 0) {
+  if (secondNullIdx !== -1) {
     lineNumberText = rest.substring(0, secondNullIdx)
     lineContent = rest.substring(secondNullIdx + 1).replace(/\n$/, '')
   } else {
diff --git a/src/shared/tui-agent-config.ts b/src/shared/tui-agent-config.ts
index 06d490342ba..3437e44e560 100644
--- a/src/shared/tui-agent-config.ts
+++ b/src/shared/tui-agent-config.ts
@@ -331,7 +331,7 @@ export const TUI_AGENT_CONFIG: Record<TuiAgent, TuiAgentConfig> = {
 }
 
 export function isTuiAgent(value: unknown): value is TuiAgent {
-  return typeof value === 'string' && Object.prototype.hasOwnProperty.call(TUI_AGENT_CONFIG, value)
+  return typeof value === 'string' && Object.hasOwn(TUI_AGENT_CONFIG, value)
 }
 
 export function getTuiAgentDetectCommands(config: TuiAgentConfig): string[] {
diff --git a/src/shared/tui-agent-launch-command.ts b/src/shared/tui-agent-launch-command.ts
index 3ce20571f4e..c45ac67bd19 100644
--- a/src/shared/tui-agent-launch-command.ts
+++ b/src/shared/tui-agent-launch-command.ts
@@ -43,7 +43,7 @@ export function resolveAgentLaunchCommand(args: {
   }
   const trailingTokens = args.agentArgs?.trim()
     ? tokenizeStartupCommand(args.agentArgs.trim(), args.shell)
-    : { ok: true as const, tokens: [] }
+    : { ok: true as const, tokens: [], spans: [] }
   if (!trailingTokens.ok) {
     return { ok: false, error: `CLI arguments are invalid: ${trailingTokens.error}` }
   }
diff --git a/src/shared/tui-agent-launch-defaults.ts b/src/shared/tui-agent-launch-defaults.ts
index 94ca6e103a1..f0f5d3e8bd1 100644
--- a/src/shared/tui-agent-launch-defaults.ts
+++ b/src/shared/tui-agent-launch-defaults.ts
@@ -85,7 +85,7 @@ export function resolveTuiAgentLaunchArgs(
 ): string {
   if (
     configuredArgs &&
-    Object.prototype.hasOwnProperty.call(configuredArgs, agent) &&
+    Object.hasOwn(configuredArgs, agent) &&
     typeof configuredArgs[agent] === 'string'
   ) {
     return configuredArgs[agent] ?? ''
@@ -97,7 +97,7 @@ export function resolveTuiAgentLaunchEnv(
   agent: TuiAgent,
   configuredEnv: Partial<Record<TuiAgent, Record<string, string>>> | null | undefined
 ): Record<string, string> {
-  if (configuredEnv && Object.prototype.hasOwnProperty.call(configuredEnv, agent)) {
+  if (configuredEnv && Object.hasOwn(configuredEnv, agent)) {
     return { ...configuredEnv[agent] }
   }
   return getTuiAgentDefaultEnv(agent)
diff --git a/src/shared/tui-agent-startup-shell.test.ts b/src/shared/tui-agent-startup-shell.test.ts
new file mode 100644
index 00000000000..2d155063462
--- /dev/null
+++ b/src/shared/tui-agent-startup-shell.test.ts
@@ -0,0 +1,114 @@
+import { describe, expect, it } from 'vitest'
+import {
+  buildShellCommandFromArgv,
+  clearEnvCommand,
+  commandSeparator,
+  isPosixStartupShell,
+  quoteStartupArg,
+  resolveLoginShellStartupDialect,
+  tokenizeStartupCommand
+} from './tui-agent-startup-shell'
+import { buildAgentDraftLaunchPlan } from './tui-agent-startup'
+
+function expectSpansCoverTokens(source: string, shell: 'powershell' | 'cmd'): string[] {
+  const result = tokenizeStartupCommand(source, shell)
+  expect(result.ok).toBe(true)
+  if (!result.ok) {
+    return []
+  }
+  expect(result.spans).toHaveLength(result.tokens.length)
+  let previousEnd = 0
+  for (const [index, { start, end }] of result.spans.entries()) {
+    expect(start).toBeGreaterThanOrEqual(previousEnd)
+    expect(end).toBeGreaterThan(start)
+    // Every raw span must re-tokenize to exactly its own token.
+    const slice = tokenizeStartupCommand(source.slice(start, end), shell)
+    expect(slice.ok && slice.tokens).toEqual([result.tokens[index]])
+    previousEnd = end
+  }
+  return result.spans.map(({ start, end }) => source.slice(start, end))
+}
+
+describe('tokenizeStartupCommand spans (windows shells)', () => {
+  it('covers plain and quoted tokens on powershell', () => {
+    const source = "claude --msg 'hello world'"
+    const result = tokenizeStartupCommand(source, 'powershell')
+    expect(result).toEqual({
+      ok: true,
+      tokens: ['claude', '--msg', 'hello world'],
+      spans: [
+        { start: 0, end: 6, divergesFromShell: false },
+        { start: 7, end: 12, divergesFromShell: false },
+        { start: 13, end: 26, divergesFromShell: false }
+      ]
+    })
+  })
+
+  it('starts a span at a token-leading escape character', () => {
+    expect(expectSpansCoverTokens('claude ^&literal next', 'cmd')).toEqual([
+      'claude',
+      '^&literal',
+      'next'
+    ])
+    expect(expectSpansCoverTokens('claude `x tail', 'powershell')).toEqual(['claude', '`x', 'tail'])
+  })
+
+  it('spans a powershell doubled-quote token as one raw range', () => {
+    expect(expectSpansCoverTokens("claude 'a''b' end", 'powershell')).toEqual([
+      'claude',
+      "'a''b'",
+      'end'
+    ])
+  })
+
+  it('spans a token opened by a quote at end of input', () => {
+    expect(expectSpansCoverTokens('claude ""', 'cmd')).toEqual(['claude', '""'])
+  })
+})
+
+describe('fish startup shell dialect', () => {
+  it('clears variables with fish syntax instead of the sh `unset` fish rejects', () => {
+    expect(clearEnvCommand('CODEX_HOME', 'fish')).toBe('set -e CODEX_HOME')
+    expect(clearEnvCommand('CODEX_HOME', 'posix')).toBe('unset CODEX_HOME')
+    expect(clearEnvCommand('CODEX_HOME', 'cmd')).toBe('set "CODEX_HOME="')
+    expect(clearEnvCommand('CODEX_HOME', 'powershell')).toBe(
+      'Remove-Item Env:CODEX_HOME -ErrorAction SilentlyContinue'
+    )
+  })
+
+  it('shares POSIX quoting, tokenizing and chaining', () => {
+    expect(quoteStartupArg("it's", 'fish')).toBe(quoteStartupArg("it's", 'posix'))
+    expect(buildShellCommandFromArgv(['codex', 'resume', 'a b'], 'fish')).toBe(
+      buildShellCommandFromArgv(['codex', 'resume', 'a b'], 'posix')
+    )
+    expect(tokenizeStartupCommand('codex --arg "a b"', 'fish')).toEqual(
+      tokenizeStartupCommand('codex --arg "a b"', 'posix')
+    )
+    expect(commandSeparator('fish')).toBe('; ')
+    expect(isPosixStartupShell('fish')).toBe(true)
+  })
+
+  it('maps login shell paths to their dialect', () => {
+    expect(resolveLoginShellStartupDialect('/opt/homebrew/bin/fish')).toBe('fish')
+    expect(resolveLoginShellStartupDialect('/usr/local/bin/FISH')).toBe('fish')
+    expect(resolveLoginShellStartupDialect('/bin/zsh')).toBe('posix')
+    expect(resolveLoginShellStartupDialect('/bin/bash')).toBe('posix')
+    expect(resolveLoginShellStartupDialect('')).toBe('posix')
+    expect(resolveLoginShellStartupDialect(undefined)).toBe('posix')
+  })
+
+  // Contract-only: no POSIX caller threads a shell into buildAgentDraftLaunchPlan yet
+  // (`selectedRepoStartupShell` is Windows-only), so fish users still get `unset` here.
+  it('clears an agent draft prefill variable with fish syntax', () => {
+    const plan = buildAgentDraftLaunchPlan({
+      agent: 'pi',
+      draft: 'hello',
+      cmdOverrides: {},
+      platform: 'darwin',
+      shell: 'fish'
+    })
+
+    expect(plan?.launchCommand).toBe('pi; set -e ORCA_PI_PREFILL')
+    expect(plan?.env?.ORCA_PI_PREFILL).toBe('hello')
+  })
+})
diff --git a/src/shared/tui-agent-startup-shell.ts b/src/shared/tui-agent-startup-shell.ts
index 8bdb5465845..ef23b837e0b 100644
--- a/src/shared/tui-agent-startup-shell.ts
+++ b/src/shared/tui-agent-startup-shell.ts
@@ -1,28 +1,95 @@
-import { tokenizeCustomCommandTemplate } from './commit-message-prompt'
+import { tokenizeCustomCommandTemplate, type CommandTokenSpan } from './commit-message-prompt'
 
-export type AgentStartupShell = 'posix' | 'powershell' | 'cmd'
+// Why: fish shares POSIX word splitting, quoting and `;` chaining, so it is a
+// separate dialect only where its grammar actually diverges (env clearing).
+export type AgentStartupShell = 'posix' | 'fish' | 'powershell' | 'cmd'
 
-export type StartupCommandTokens = { ok: true; tokens: string[] } | { ok: false; error: string }
+type WindowsStartupShell = Extract<AgentStartupShell, 'powershell' | 'cmd'>
+
+/** True for shells parsed with POSIX quoting/word rules (sh family + fish). */
+export function isPosixStartupShell(shell: AgentStartupShell): boolean {
+  return shell === 'posix' || shell === 'fish'
+}
+
+function isWindowsStartupShell(shell: AgentStartupShell): shell is WindowsStartupShell {
+  return shell === 'powershell' || shell === 'cmd'
+}
+
+/** Maps a POSIX login-shell path (`$SHELL`) to the dialect that parses queued commands. */
+export function resolveLoginShellStartupDialect(
+  loginShell: string | null | undefined
+): AgentStartupShell {
+  const basename = loginShell?.trim().replaceAll('\\', '/').split('/').pop()?.toLowerCase() ?? ''
+  return basename === 'fish' ? 'fish' : 'posix'
+}
+
+export type StartupCommandTokens =
+  | { ok: true; tokens: string[]; spans: CommandTokenSpan[] }
+  | { ok: false; error: string }
+
+/** True when an odd run of backslashes precedes this quote, which makes it a
+ * literal byte to the child's CommandLineToArgvW parser rather than a
+ * delimiter — so cmd's word boundaries stop matching this tokenizer's. */
+function hasOddBackslashRun(value: string, quoteIndex: number): boolean {
+  let backslashes = 0
+  while (value[quoteIndex - 1 - backslashes] === '\\') {
+    backslashes += 1
+  }
+  return backslashes % 2 === 1
+}
 
 function tokenizeWindowsStartupCommand(
   value: string,
-  shell: Exclude<AgentStartupShell, 'posix'>
+  shell: WindowsStartupShell
 ): StartupCommandTokens {
   const tokens: string[] = []
+  const spans: CommandTokenSpan[] = []
   let token = ''
+  let tokenStart = 0
+  let divergesFromShell = false
   let quote: "'" | '"' | null = null
   let tokenStarted = false
   for (let index = 0; index < value.length; index += 1) {
     const char = value[index]
     const escape = shell === 'cmd' ? '^' : '`'
     if (char === escape && index + 1 < value.length) {
+      // Why: cmd strips `^` and hands the bare byte to the child's parser,
+      // which re-splits on whitespace and reopens a quote, and keeps the caret
+      // literal inside double quotes — either way the token stops matching
+      // argv. PowerShell folds the backtick into the token except for LF line
+      // continuations, verbatim single quotes, escape sequences, and a
+      // token-leading backtick before whitespace, which it drops entirely.
+      // A bare CR is treated as unmodelable rather than folded: pwsh 7 keeps
+      // it in the token, Windows PowerShell 5.1 is unverified, and failing
+      // open there costs nothing.
+      divergesFromShell ||=
+        (shell === 'cmd' ? /[\s"]/.test(value[index + 1]) : /[\n\r]/.test(value[index + 1])) ||
+        (shell === 'cmd' && quote === '"') ||
+        (shell === 'powershell' && quote === "'") ||
+        // A token-leading backtick before whitespace is dropped with the
+        // whitespace, emitting no token at all rather than the one built here.
+        (shell === 'powershell' && !tokenStarted && /\s/.test(value[index + 1])) ||
+        // PowerShell expands these escape sequences in quoted AND bare
+        // arguments, so the token value this branch builds is not argv's.
+        (shell === 'powershell' && '0abefnrtuv'.includes(value[index + 1]))
       token += value[index + 1]
+      if (!tokenStarted) {
+        tokenStart = index
+      }
       tokenStarted = true
       index += 1
       continue
     }
     if (quote) {
+      // Why: see the posix tokenizer — a `"` inside $(…) re-opens a nested
+      // quoting context that this tokenizer does not model.
+      divergesFromShell ||=
+        shell === 'powershell' &&
+        quote === '"' &&
+        char === '$' &&
+        (value[index + 1] === '(' || value[index + 1] === '{')
       if (char === quote) {
+        divergesFromShell ||= shell === 'cmd' && char === '"' && hasOddBackslashRun(value, index)
         if (shell === 'powershell' && quote === "'" && value[index + 1] === "'") {
           token += "'"
           index += 1
@@ -36,15 +103,39 @@ function tokenizeWindowsStartupCommand(
       continue
     }
     if (char === "'" || char === '"') {
+      divergesFromShell ||= shell === 'cmd' && char === '"' && hasOddBackslashRun(value, index)
       quote = char
+      // Why: cmd.exe has no single-quote syntax, so this tokenizer's grouping
+      // of a single-quoted region diverges from what cmd actually parses;
+      // flag the token so consumers treat it as unmodelable.
+      divergesFromShell ||= shell === 'cmd' && char === "'"
+      if (!tokenStarted) {
+        tokenStart = index
+      }
       tokenStarted = true
     } else if (/\s/.test(char)) {
       if (tokenStarted) {
         tokens.push(token)
+        spans.push({ start: tokenStart, end: index, divergesFromShell })
         token = ''
         tokenStarted = false
+        divergesFromShell = false
       }
     } else {
+      if (!tokenStarted) {
+        tokenStart = index
+      }
+      // Why: see the posix tokenizer — a trailing unpaired escape would
+      // swallow the separator before anything appended to the base.
+      divergesFromShell ||= char === escape && index + 1 >= value.length
+      divergesFromShell ||=
+        ';&|<>'.includes(char) ||
+        (shell === 'powershell' &&
+          // Why: bare (…) is evaluated and {…} is a script block in argument
+          // position, so both are live syntax the span splice cannot model.
+          ('(){}'.includes(char) ||
+            (char === '#' && !tokenStarted) ||
+            (char === '$' && (value[index + 1] === '(' || value[index + 1] === '{'))))
       token += char
       tokenStarted = true
     }
@@ -54,17 +145,18 @@ function tokenizeWindowsStartupCommand(
   }
   if (tokenStarted) {
     tokens.push(token)
+    spans.push({ start: tokenStart, end: value.length, divergesFromShell })
   }
-  return { ok: true, tokens }
+  return { ok: true, tokens, spans }
 }
 
 export function tokenizeStartupCommand(
   value: string,
   shell: AgentStartupShell
 ): StartupCommandTokens {
-  return shell === 'posix'
-    ? tokenizeCustomCommandTemplate(value)
-    : tokenizeWindowsStartupCommand(value, shell)
+  return isWindowsStartupShell(shell)
+    ? tokenizeWindowsStartupCommand(value, shell)
+    : tokenizeCustomCommandTemplate(value)
 }
 
 export function resolveStartupShell(
@@ -102,6 +194,11 @@ export function clearEnvCommand(name: string, shell: AgentStartupShell): string
   if (shell === 'cmd') {
     return `set "${name}="`
   }
+  // Why: fish has no `unset`; the sh spelling errors out and silently leaves
+  // the variable exported (e.g. an account-routed CODEX_HOME survives).
+  if (shell === 'fish') {
+    return `set -e ${name}`
+  }
   return `unset ${name}`
 }
 
diff --git a/src/shared/tui-agent-startup.ts b/src/shared/tui-agent-startup.ts
index 27d4b40ac8d..4cef246ccdb 100644
--- a/src/shared/tui-agent-startup.ts
+++ b/src/shared/tui-agent-startup.ts
@@ -20,6 +20,7 @@ import { inlineAgentDraftFitsPlatform } from './agent-draft-platform-limit'
 import type { TuiAgent } from './types'
 import type { SessionOptionValue } from './native-chat-session-options'
 import { resolveAgentLaunchCommand } from './tui-agent-launch-command'
+import { buildAgentResumeLaunchCommand } from './agent-resume-launch-command'
 
 export type AgentStartupPlan = {
   agent: TuiAgent
@@ -222,14 +223,9 @@ export function buildAgentResumeStartupPlan(args: {
     ...args,
     agentCommand: baseCommand.command
   })
-  const resumeArgs = argv
-    .slice(1)
-    .map((arg) => quoteStartupArg(arg, shell))
-    .join(' ')
-  const launchCommand = resumeArgs ? `${baseCommand.command} ${resumeArgs}` : baseCommand.command
   return {
     agent: args.agent,
-    launchCommand,
+    launchCommand: buildAgentResumeLaunchCommand(args.agent, baseCommand.command, argv, shell),
     expectedProcess: config.expectedProcess,
     followupPrompt: null,
     launchConfig,
diff --git a/src/shared/types.ts b/src/shared/types.ts
index cd874d94037..5fcd3938133 100644
--- a/src/shared/types.ts
+++ b/src/shared/types.ts
@@ -339,6 +339,8 @@ export type FolderWorkspace = {
   connectionId?: string | null
   /** Renderer-owned host stamp for host-qualified folder catalogs. */
   executionHostId?: ExecutionHostId | null
+  /** Authenticated client that created this workspace. Missing means unknown legacy origin. */
+  creatorProvenance?: WorkspaceCreatorProvenance
   linkedTask: WorkspaceLinkedItem | null
   linkedTaskSourceContext?: TaskSourceContext | null
   comment: string
@@ -355,6 +357,7 @@ export type FolderWorkspace = {
   lastActivityAt: number
   createdAt: number
   updatedAt: number
+  diffComments?: DiffComment[]
 }
 
 export type WorkspaceLinkedItem = {
@@ -493,6 +496,8 @@ export type Worktree = {
   hostId?: ExecutionHostId
   /** Renderer projection of the paired runtime that transports operations to `hostId`. */
   runtimeOwnerEnvironmentId?: string
+  /** Authenticated client that created this workspace. Missing means unknown legacy origin. */
+  creatorProvenance?: WorkspaceCreatorProvenance
   /** Host-specific setup used to create/run this workspace. */
   projectHostSetupId?: string
   displayName: string
@@ -571,6 +576,10 @@ export type CliWorkspaceProvenance = {
   startupAgent?: TuiAgent
 }
 
+export type WorkspaceCreatorProvenance =
+  | { kind: 'host' }
+  | { kind: 'paired-device'; deviceId: string }
+
 export type AutomationWorkspaceProvenance = {
   kind: 'created-by-automation'
   automationId: string
@@ -623,6 +632,8 @@ export type WorktreeMeta = {
   hostId?: ExecutionHostId
   /** See Worktree.projectHostSetupId. Persisted for project-first workspace ownership. */
   projectHostSetupId?: string
+  /** See Worktree.creatorProvenance. */
+  creatorProvenance?: WorkspaceCreatorProvenance
   displayName: string
   comment: string
   linkedIssue: number | null
@@ -903,6 +914,8 @@ export type TerminalTab = {
    *  PTY and tab icon stay stable even if the default shell setting changes
    *  later. Older persisted tabs may omit this field. */
   shellOverride?: string
+  /** Keeps an ephemeral host fallback out of the active project's runtime. */
+  forceHostRuntime?: boolean
   /** Why: explorer-created terminals can start below the workspace root while
    *  still belonging to that workspace for tab/session ownership. */
   startupCwd?: string
@@ -1067,6 +1080,7 @@ export type BrowserCookieImportSummary = {
   totalCookies: number
   importedCookies: number
   skippedCookies: number
+  googleCookiesSkipped?: number
   domains: string[]
   warning?: {
     code: 'restart-fallback-unavailable'
@@ -1245,6 +1259,30 @@ export type GitHubPRMergeMethodSettings = {
   allowedMethods: Record<GitHubPRMergeMethod, boolean>
 }
 
+export type GitHubPRStackEntry = {
+  position: number
+  number: number
+  title: string
+  url: string
+  updatedAt?: string
+  state: PRState
+  checksStatus: CheckStatus
+  mergeable: PRMergeableState
+  reviewDecision?: PRReviewDecision | null
+  mergeStateStatus?: string | null
+  headRefName?: string
+  headSha?: string
+}
+
+export type GitHubPRStack = {
+  number: number
+  position: number
+  size: number
+  baseRefName: string
+  baseSha?: string
+  entries?: GitHubPRStackEntry[]
+}
+
 export type PRInfo = {
   number: number
   title: string
@@ -1259,6 +1297,8 @@ export type PRInfo = {
   mergeQueueRequired?: boolean | null
   mergeMethodSettings?: GitHubPRMergeMethodSettings
   mergeStateStatus?: string | null
+  /** GitHub-registered stack metadata. Absent for ordinary dependent PR chains. */
+  stack?: GitHubPRStack
   // Why: check-runs are keyed by the PR head commit, not the mutable branch name.
   // Keeping the head SHA in cached PR metadata lets the checks panel poll the
   // correct commit without re-querying GitHub or guessing from local branch refs.
@@ -1459,8 +1499,8 @@ export type PRCheckJob = {
 
 export type PRCheckRunDetails = {
   name: string
-  status: PRCheckDetail['status'] | string | null
-  conclusion: PRCheckDetail['conclusion'] | string | null
+  status: PRCheckDetail['status'] | (string & {}) | null
+  conclusion: PRCheckDetail['conclusion'] | (string & {}) | null
   url: string | null
   detailsUrl: string | null
   startedAt: string | null
@@ -1711,7 +1751,7 @@ export type LinearWorkspace = LinearViewer & {
   credentialRevision?: number
 }
 
-export type LinearWorkspaceSelection = string | 'all'
+export type LinearWorkspaceSelection = (string & {}) | 'all'
 export type LinearWorkspaceSelector = LinearWorkspaceSelection | undefined
 export type LinearConcreteWorkspaceId = string
 
@@ -3429,6 +3469,8 @@ export type PersistedUIState = {
   hideCliCreatedWorkspaces?: boolean
   /** Hide workspaces sitting on a detached HEAD; folder workspaces (no head at all) are unaffected. */
   hideDetachedHeadWorkspaces?: boolean
+  /** Hide workspaces with known provenance from another paired device or the host UI. */
+  hideWorkspacesFromOtherDevices?: boolean
   /** Keep each project's main workspace out of the "Hide sleeping" sweep. Absent means on (#8873). */
   alwaysShowDefaultBranchWorkspace?: boolean
   /** Per-worktree Explorer dotfile visibility. Missing entries inherit the default: show. */
diff --git a/src/shared/utf8-byte-limits.test.ts b/src/shared/utf8-byte-limits.test.ts
new file mode 100644
index 00000000000..9556a5c39bc
--- /dev/null
+++ b/src/shared/utf8-byte-limits.test.ts
@@ -0,0 +1,131 @@
+import { describe, expect, it } from 'vitest'
+import {
+  clampUtf8TextPrefix,
+  getUtf8ChunkEndIndex,
+  isUtf8ByteLengthWithinLimit,
+  measureUtf8ByteLength,
+  readUtf8CodePointAt
+} from './utf8-byte-limits'
+
+// Once V8 optimizes the calling function, `String.prototype.codePointAt` on a sliced string
+// pairs a trailing high surrogate with the code unit that follows the SLICE inside its parent
+// (reproduced on Node 24 and 26). A prefix slice cut mid-pair then reads a code point the
+// string does not contain, so a scan reports one byte too many — but only after tier-up, which
+// is why it surfaced as an intermittent CI failure rather than a deterministic one.
+// Build a rope, cut it mid-pair, and hammer the scan so the optimizing tier is under test.
+const SLICE_BOUNDARY_PARENT_UNITS = [
+  0x72, 0x2e6, 0x7b, 0x54, 0xda9b, 0x568, 0x52, 0x26, 0x46, 0xc15b, 0x7, 0x768, 0xd9f6, 0xdcde
+]
+// V8 only creates a sliced string (rather than copying) at 13 code units or more.
+const SLICE_BOUNDARY_UNITS = 13
+const TIER_UP_ITERATIONS = 200_000
+
+function buildSliceEndingInLoneHighSurrogate(): string {
+  let text = ''
+  for (const unit of SLICE_BOUNDARY_PARENT_UNITS) {
+    text += String.fromCharCode(unit)
+  }
+  return text.slice(0, SLICE_BOUNDARY_UNITS)
+}
+
+describe('scanning a prefix slice whose parent continues past the slice', () => {
+  const sliced = buildSliceEndingInLoneHighSurrogate()
+
+  it('is a sliced string that ends in a lone high surrogate', () => {
+    expect(sliced.length).toBe(SLICE_BOUNDARY_UNITS)
+    expect(sliced.charCodeAt(SLICE_BOUNDARY_UNITS - 1)).toBe(0xd9f6)
+    expect(Buffer.byteLength(sliced, 'utf8')).toBe(22)
+  })
+
+  it('reads the trailing lone surrogate without pairing past the end in every JIT tier', () => {
+    const observed = new Set<number>()
+    for (let iteration = 0; iteration < TIER_UP_ITERATIONS; iteration += 1) {
+      observed.add(readUtf8CodePointAt(sliced, SLICE_BOUNDARY_UNITS - 1))
+    }
+    expect([...observed]).toEqual([0xd9f6])
+  })
+
+  it('measures the same byte length as the encoder in every JIT tier', () => {
+    const expected = Buffer.byteLength(sliced, 'utf8')
+    const observed = new Set<number>()
+    for (let iteration = 0; iteration < TIER_UP_ITERATIONS; iteration += 1) {
+      observed.add(measureUtf8ByteLength(sliced).byteLength)
+    }
+    expect([...observed]).toEqual([expected])
+  })
+
+  it('does not report an exceeded limit at the true byte length in every JIT tier', () => {
+    const limit = Buffer.byteLength(sliced, 'utf8')
+    const observed = new Set<boolean>()
+    for (let iteration = 0; iteration < TIER_UP_ITERATIONS; iteration += 1) {
+      observed.add(measureUtf8ByteLength(sliced, { stopAfterBytes: limit }).exceededLimit)
+    }
+    expect([...observed]).toEqual([false])
+  })
+
+  it('keeps the whole slice when clamping to its true byte length in every JIT tier', () => {
+    const limit = Buffer.byteLength(sliced, 'utf8')
+    const observed = new Set<number>()
+    for (let iteration = 0; iteration < TIER_UP_ITERATIONS; iteration += 1) {
+      observed.add(clampUtf8TextPrefix(sliced, limit).length)
+    }
+    expect([...observed]).toEqual([SLICE_BOUNDARY_UNITS])
+  })
+})
+
+describe('getUtf8ChunkEndIndex', () => {
+  it.each([
+    { name: 'ASCII', text: 'abcdef', maxBytes: 3, endIndex: 3 },
+    { name: 'multibyte characters', text: 'aé中z', maxBytes: 6, endIndex: 3 }
+  ])('respects the byte budget for $name', ({ text, maxBytes, endIndex }) => {
+    expect(getUtf8ChunkEndIndex(text, 0, maxBytes)).toBe(endIndex)
+  })
+
+  it('never splits valid surrogate pairs', () => {
+    expect(getUtf8ChunkEndIndex('a😀b', 0, 4)).toBe(1)
+    expect(getUtf8ChunkEndIndex('a😀b', 1, 4)).toBe(3)
+  })
+
+  it.each(['\ud800a', '\udc00a'])('counts a lone surrogate as three bytes', (text) => {
+    expect(getUtf8ChunkEndIndex(text, 0, 3)).toBe(1)
+  })
+
+  it('starts measuring at the requested offset', () => {
+    expect(getUtf8ChunkEndIndex('skipé中tail', 4, 5)).toBe(6)
+  })
+
+  it('returns the starting index when no text remains', () => {
+    expect(getUtf8ChunkEndIndex('', 0, 1)).toBe(0)
+    expect(getUtf8ChunkEndIndex('abc', 3, 1)).toBe(3)
+  })
+
+  it.each([0, -1])('consumes one code point when the %s-byte budget is exceeded', (maxBytes) => {
+    expect(getUtf8ChunkEndIndex('😀a', 0, maxBytes)).toBe(2)
+  })
+
+  it('preserves raw non-finite budget comparisons', () => {
+    expect(getUtf8ChunkEndIndex('abc', 0, Number.NaN)).toBe(3)
+    expect(getUtf8ChunkEndIndex('abc', 0, Number.POSITIVE_INFINITY)).toBe(3)
+    expect(getUtf8ChunkEndIndex('abc', 0, Number.NEGATIVE_INFINITY)).toBe(1)
+  })
+})
+
+describe('isUtf8ByteLengthWithinLimit', () => {
+  it.each([
+    { name: 'ASCII at a finite limit', text: 'abc', maxBytes: 3, expected: true },
+    { name: 'ASCII over a finite limit', text: 'abcd', maxBytes: 3, expected: false },
+    { name: 'multibyte text at its limit', text: 'é中', maxBytes: 5, expected: true },
+    { name: 'multibyte text over its limit', text: 'é中', maxBytes: 4, expected: false },
+    { name: 'empty text with a negative limit', text: '', maxBytes: -1, expected: true },
+    {
+      name: 'nonempty text with negative infinity',
+      text: 'a',
+      maxBytes: -Infinity,
+      expected: false
+    },
+    { name: 'text with a NaN limit', text: '😀', maxBytes: Number.NaN, expected: true },
+    { name: 'text with positive infinity', text: '😀', maxBytes: Infinity, expected: true }
+  ])('$name', ({ text, maxBytes, expected }) => {
+    expect(isUtf8ByteLengthWithinLimit(text, maxBytes)).toBe(expected)
+  })
+})
diff --git a/src/shared/utf8-byte-limits.ts b/src/shared/utf8-byte-limits.ts
index c49be3fff44..df8f99f68ad 100644
--- a/src/shared/utf8-byte-limits.ts
+++ b/src/shared/utf8-byte-limits.ts
@@ -8,6 +8,26 @@ export type Utf8TextTail = {
   bytes: number
 }
 
+/**
+ * Bounds-safe replacement for `String.prototype.codePointAt`.
+ *
+ * Why: once V8 optimizes the calling function, `codePointAt` on a sliced string pairs a
+ * trailing high surrogate with the code unit that follows the SLICE inside its parent, so a
+ * prefix slice cut mid-pair reports a code point the string does not contain (and one byte
+ * too many). `charCodeAt` stays bounds-correct in every tier, so pair the units explicitly.
+ */
+export function readUtf8CodePointAt(text: string, index: number): number {
+  const leadUnit = text.charCodeAt(index)
+  if (leadUnit < 0xd800 || leadUnit > 0xdbff || index + 1 >= text.length) {
+    return leadUnit
+  }
+  const trailUnit = text.charCodeAt(index + 1)
+  if (trailUnit < 0xdc00 || trailUnit > 0xdfff) {
+    return leadUnit
+  }
+  return (leadUnit - 0xd800) * 0x400 + (trailUnit - 0xdc00) + 0x10000
+}
+
 export function measureUtf8ByteLength(
   text: string,
   options: { stopAfterBytes?: number } = {}
@@ -15,7 +35,7 @@ export function measureUtf8ByteLength(
   const stopAfterBytes = options.stopAfterBytes
   let byteLength = 0
   for (let index = 0; index < text.length; index += 1) {
-    const codePoint = text.codePointAt(index) ?? 0
+    const codePoint = readUtf8CodePointAt(text, index)
     byteLength += getUtf8ByteLengthForCodePoint(codePoint)
     if (Number.isFinite(stopAfterBytes) && byteLength > (stopAfterBytes ?? 0)) {
       return { byteLength, exceededLimit: true }
@@ -31,6 +51,16 @@ export function getUtf8ByteLength(text: string): number {
   return measureUtf8ByteLength(text).byteLength
 }
 
+export function isUtf8ByteLengthWithinLimit(text: string, maxBytes: number): boolean {
+  if (text.length === 0) {
+    return true
+  }
+  if (text.length > maxBytes) {
+    return false
+  }
+  return !measureUtf8ByteLength(text, { stopAfterBytes: maxBytes }).exceededLimit
+}
+
 export function clampUtf8TextTail(text: string, maxBytes: number): Utf8TextTail {
   if (!text || maxBytes <= 0) {
     return { text: '', bytes: 0 }
@@ -59,7 +89,7 @@ export function clampUtf8TextPrefix(text: string, maxBytes: number): string {
   let bytes = 0
   let end = 0
   while (end < text.length) {
-    const codePoint = text.codePointAt(end) ?? 0
+    const codePoint = readUtf8CodePointAt(text, end)
     const codePointBytes = getUtf8ByteLengthForCodePoint(codePoint)
     if (bytes + codePointBytes > maxBytes) {
       break
@@ -70,6 +100,21 @@ export function clampUtf8TextPrefix(text: string, maxBytes: number): string {
   return end === text.length ? text : text.slice(0, end)
 }
 
+export function getUtf8ChunkEndIndex(text: string, startIndex: number, maxBytes: number): number {
+  let bytes = 0
+  let endIndex = startIndex
+  while (endIndex < text.length) {
+    const codePoint = readUtf8CodePointAt(text, endIndex)
+    const codePointBytes = getUtf8ByteLengthForCodePoint(codePoint)
+    if (bytes > 0 && bytes + codePointBytes > maxBytes) {
+      break
+    }
+    bytes += codePointBytes
+    endIndex += codePoint > 0xffff ? 2 : 1
+  }
+  return endIndex
+}
+
 export function getUtf8ByteLengthForCodePoint(codePoint: number): number {
   if (codePoint <= 0x7f) {
     return 1
@@ -98,6 +143,6 @@ function getPreviousUtf8CodePoint(
   }
   return {
     start,
-    bytes: getUtf8ByteLengthForCodePoint(text.codePointAt(start) ?? codeUnit)
+    bytes: getUtf8ByteLengthForCodePoint(readUtf8CodePointAt(text, start))
   }
 }
diff --git a/src/shared/workspace-creator-provenance.ts b/src/shared/workspace-creator-provenance.ts
new file mode 100644
index 00000000000..541cf3f2a5e
--- /dev/null
+++ b/src/shared/workspace-creator-provenance.ts
@@ -0,0 +1,21 @@
+import type { WorkspaceCreatorProvenance } from './types'
+
+export function normalizeWorkspaceCreatorProvenance(
+  value: unknown
+): WorkspaceCreatorProvenance | undefined {
+  if (!value || typeof value !== 'object') {
+    return undefined
+  }
+  const candidate = value as { kind?: unknown; deviceId?: unknown }
+  if (candidate.kind === 'host') {
+    return { kind: 'host' }
+  }
+  if (
+    candidate.kind === 'paired-device' &&
+    typeof candidate.deviceId === 'string' &&
+    candidate.deviceId.trim().length > 0
+  ) {
+    return { kind: 'paired-device', deviceId: candidate.deviceId }
+  }
+  return undefined
+}
diff --git a/src/shared/workspace-session-schema.sleeping-agent.test.ts b/src/shared/workspace-session-schema.sleeping-agent.test.ts
index 9f58d453969..16f499ac7d5 100644
--- a/src/shared/workspace-session-schema.sleeping-agent.test.ts
+++ b/src/shared/workspace-session-schema.sleeping-agent.test.ts
@@ -219,12 +219,9 @@ describe('parseWorkspaceSession sleeping agents', () => {
 
     expect(result.ok).toBe(true)
     if (result.ok) {
-      expect(
-        Object.prototype.hasOwnProperty.call(
-          result.value.sleepingAgentSessionsByPaneKey ?? {},
-          '__proto__'
-        )
-      ).toBe(false)
+      expect(Object.hasOwn(result.value.sleepingAgentSessionsByPaneKey ?? {}, '__proto__')).toBe(
+        false
+      )
       const record = result.value.sleepingAgentSessionsByPaneKey?.['tab1:pane-1']
       expect(record?.agent).toBe('codex')
       expect(record?.launchConfig).toBeUndefined()
diff --git a/src/shared/worktree-sort-order-update.test.ts b/src/shared/worktree-sort-order-update.test.ts
new file mode 100644
index 00000000000..4c53ddff56d
--- /dev/null
+++ b/src/shared/worktree-sort-order-update.test.ts
@@ -0,0 +1,44 @@
+import { describe, expect, it, vi } from 'vitest'
+import { planWorktreeSortOrderUpdates } from './worktree-sort-order-update'
+
+describe('planWorktreeSortOrderUpdates', () => {
+  it('skips an order that is already represented by descending ranks', () => {
+    const getMeta = vi.fn((id: string) => ({
+      sortOrder: id === 'a' ? 300 : id === 'b' ? 200 : 100
+    }))
+
+    expect(planWorktreeSortOrderUpdates(['a', 'b', 'c'], getMeta, 1_000)).toEqual([])
+  })
+
+  it('re-ranks changed order and ignores stale worktree IDs', () => {
+    const getMeta = vi.fn((id: string) => {
+      if (id === 'stale') {
+        return undefined
+      }
+      return { sortOrder: id === 'a' ? 100 : 200 }
+    })
+
+    expect(planWorktreeSortOrderUpdates(['a', 'stale', 'b'], getMeta, 5_000)).toEqual([
+      { worktreeId: 'a', sortOrder: 5_000 },
+      { worktreeId: 'b', sortOrder: 4_000 }
+    ])
+  })
+
+  it('ranks a duplicate worktree ID only once', () => {
+    const getMeta = vi.fn((id: string) => ({ sortOrder: id === 'a' ? 100 : 200 }))
+
+    expect(planWorktreeSortOrderUpdates(['a', 'a', 'b'], getMeta, 5_000)).toEqual([
+      { worktreeId: 'a', sortOrder: 5_000 },
+      { worktreeId: 'b', sortOrder: 4_000 }
+    ])
+    expect(getMeta).toHaveBeenCalledTimes(2)
+  })
+
+  it('initializes missing ranks without manufacturing metadata', () => {
+    const getMeta = vi.fn((id: string) => (id === 'known' ? {} : undefined))
+
+    expect(planWorktreeSortOrderUpdates(['known', 'missing'], getMeta, 9_000)).toEqual([
+      { worktreeId: 'known', sortOrder: 9_000 }
+    ])
+  })
+})
diff --git a/src/shared/worktree-sort-order-update.ts b/src/shared/worktree-sort-order-update.ts
new file mode 100644
index 00000000000..07dc88214c4
--- /dev/null
+++ b/src/shared/worktree-sort-order-update.ts
@@ -0,0 +1,32 @@
+export type WorktreeSortOrderUpdate = {
+  worktreeId: string
+  sortOrder: number
+}
+
+type WorktreeSortOrderMeta = {
+  sortOrder?: number
+}
+
+export function planWorktreeSortOrderUpdates(
+  orderedIds: readonly string[],
+  getMeta: (worktreeId: string) => WorktreeSortOrderMeta | undefined,
+  now: number
+): WorktreeSortOrderUpdate[] {
+  const uniqueIds = [...new Set(orderedIds)]
+  const existing = uniqueIds.flatMap((worktreeId) => {
+    const meta = getMeta(worktreeId)
+    return meta ? [{ worktreeId, sortOrder: meta.sortOrder }] : []
+  })
+  const alreadyOrdered = existing.every(
+    (entry, index) =>
+      Number.isFinite(entry.sortOrder) &&
+      (index === 0 || existing[index - 1].sortOrder! > entry.sortOrder!)
+  )
+  if (alreadyOrdered) {
+    return []
+  }
+  return existing.map((entry, index) => ({
+    worktreeId: entry.worktreeId,
+    sortOrder: now - index * 1000
+  }))
+}
diff --git a/tests/e2e/ai-vault-typing-bench-corpus.ts b/tests/e2e/ai-vault-typing-bench-corpus.ts
new file mode 100644
index 00000000000..9f8f22713f4
--- /dev/null
+++ b/tests/e2e/ai-vault-typing-bench-corpus.ts
@@ -0,0 +1,84 @@
+import { mkdirSync, utimesSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+
+export type SeededVaultBatch = {
+  newestTitle: string
+  totalBytes: number
+}
+
+function jsonLine(value: unknown): string {
+  return JSON.stringify(value)
+}
+
+export function seedVaultTranscriptBatch(args: {
+  homePath: string
+  cwd: string
+  batch: number
+  sessionCount: number
+  payloadBytes: number
+}): SeededVaultBatch {
+  const sessionsDir = path.join(args.homePath, '.codex', 'sessions', '2026', '08', '09')
+  mkdirSync(sessionsDir, { recursive: true })
+  const padding = 'x'.repeat(args.payloadBytes)
+  const baseTimeMs = Date.now() + args.batch * 10_000
+  let totalBytes = 0
+  let newestTitle = ''
+
+  for (let index = 0; index < args.sessionCount; index += 1) {
+    const sessionId = `vault-bench-${args.batch}-${index}`
+    const title = `Vault benchmark batch ${args.batch} session ${index}`
+    const timestamp = new Date(baseTimeMs + index).toISOString()
+    const content = `${[
+      jsonLine({
+        timestamp,
+        type: 'session_meta',
+        payload: { id: sessionId, cwd: args.cwd }
+      }),
+      jsonLine({
+        timestamp,
+        type: 'response_item',
+        payload: {
+          type: 'message',
+          role: 'user',
+          content: [{ type: 'text', text: title }]
+        }
+      }),
+      jsonLine({
+        timestamp,
+        type: 'response_item',
+        payload: {
+          type: 'message',
+          role: 'assistant',
+          content: [{ type: 'output_text', text: padding }]
+        }
+      })
+    ].join('\n')}\n`
+    const filePath = path.join(sessionsDir, `rollout-${sessionId}.jsonl`)
+    writeFileSync(filePath, content)
+    const mtime = new Date(baseTimeMs + index)
+    utimesSync(filePath, mtime, mtime)
+    totalBytes += Buffer.byteLength(content)
+    newestTitle = title
+  }
+
+  return { newestTitle, totalBytes }
+}
+
+export function typingEchoScript(readyMarker: string): string {
+  return `
+process.stdin.setEncoding('utf8')
+if (process.stdin.isTTY) process.stdin.setRawMode(true)
+process.stdin.resume()
+let input = ''
+const interrupt = String.fromCharCode(3)
+process.stdout.write('\\x1b[2J\\x1b[H${readyMarker}\\n')
+process.stdin.on('data', (chunk) => {
+  if (chunk.includes(interrupt)) process.exit(0)
+  for (const char of chunk) {
+    if (char === '\\r' || char === '\\n') continue
+    input += char
+  }
+  process.stdout.write('\\r\\x1b[2K' + input)
+})
+`
+}
diff --git a/tests/e2e/ai-vault-typing-bench-renderer-probe.ts b/tests/e2e/ai-vault-typing-bench-renderer-probe.ts
new file mode 100644
index 00000000000..c233aaaae50
--- /dev/null
+++ b/tests/e2e/ai-vault-typing-bench-renderer-probe.ts
@@ -0,0 +1,119 @@
+import { expect, type Page } from '@stablyai/playwright-test'
+
+export type RendererJank = {
+  longTaskCount: number
+  maxLongTaskMs: number
+  totalLongTaskMs: number
+  maxTimerDriftMs: number
+  maxFrameGapMs: number
+}
+
+export async function startRendererJankProbe(page: Page): Promise<void> {
+  await page.evaluate(() => {
+    const durations: number[] = []
+    let maxTimerDriftMs = 0
+    let maxFrameGapMs = 0
+    let lastTimer = performance.now()
+    let lastFrame = performance.now()
+    let stopped = false
+    const observer = new PerformanceObserver((list) => {
+      durations.push(...list.getEntries().map((entry) => entry.duration))
+    })
+    observer.observe({ type: 'longtask' })
+    const timer = window.setInterval(() => {
+      const now = performance.now()
+      maxTimerDriftMs = Math.max(maxTimerDriftMs, now - lastTimer - 16)
+      lastTimer = now
+    }, 16)
+    const frame = (now: number): void => {
+      maxFrameGapMs = Math.max(maxFrameGapMs, now - lastFrame)
+      lastFrame = now
+      if (!stopped) {
+        requestAnimationFrame(frame)
+      }
+    }
+    requestAnimationFrame(frame)
+    const target = window as Window & { __vaultBenchJank?: { stop: () => RendererJank } }
+    target.__vaultBenchJank = {
+      stop: () => {
+        stopped = true
+        window.clearInterval(timer)
+        durations.push(...observer.takeRecords().map((entry) => entry.duration))
+        observer.disconnect()
+        return {
+          longTaskCount: durations.length,
+          maxLongTaskMs: Math.max(0, ...durations),
+          totalLongTaskMs: durations.reduce((sum, value) => sum + value, 0),
+          maxTimerDriftMs,
+          maxFrameGapMs
+        }
+      }
+    }
+  })
+}
+
+export async function stopRendererJankProbe(page: Page): Promise<RendererJank> {
+  return page.evaluate(() => {
+    const target = window as Window & { __vaultBenchJank?: { stop: () => RendererJank } }
+    if (!target.__vaultBenchJank) {
+      throw new Error('Renderer jank probe was not installed')
+    }
+    const result = target.__vaultBenchJank.stop()
+    delete target.__vaultBenchJank
+    return result
+  })
+}
+
+export async function triggerVaultRefresh(page: Page): Promise<void> {
+  const refreshButton = page.getByRole('button', { name: 'Refresh Session History' })
+  await page.evaluate(() => {
+    const button = document.querySelector<HTMLButtonElement>(
+      'button[aria-label="Refresh Session History"]'
+    )
+    if (!button) {
+      throw new Error('Vault refresh button unavailable')
+    }
+    const target = window as Window & {
+      __vaultBenchRefresh?: { startedAt: number; durationMs: number | null }
+    }
+    const refresh = { startedAt: performance.now(), durationMs: null }
+    target.__vaultBenchRefresh = refresh
+    let sawBusy = false
+    const observer = new MutationObserver(() => {
+      sawBusy ||= button.getAttribute('aria-busy') === 'true'
+      if (sawBusy && button.getAttribute('aria-busy') !== 'true') {
+        refresh.durationMs = performance.now() - refresh.startedAt
+        observer.disconnect()
+      }
+    })
+    observer.observe(button, { attributes: true, attributeFilter: ['aria-busy'] })
+    button.click()
+  })
+  await expect(refreshButton).toHaveAttribute('aria-busy', 'true', { timeout: 5_000 })
+}
+
+export async function readVaultRefreshDuration(page: Page): Promise<number> {
+  await expect
+    .poll(
+      () =>
+        page.evaluate(() => {
+          const target = window as Window & {
+            __vaultBenchRefresh?: { durationMs: number | null }
+          }
+          return target.__vaultBenchRefresh?.durationMs ?? null
+        }),
+      { timeout: 120_000 }
+    )
+    .not.toBeNull()
+  return page.evaluate(() => {
+    const target = window as Window & {
+      __vaultBenchRefresh?: { durationMs: number | null }
+    }
+    const durationMs = target.__vaultBenchRefresh?.durationMs
+    delete target.__vaultBenchRefresh
+    if (durationMs === null || durationMs === undefined) {
+      throw new Error('Vault refresh completion was not observed')
+    }
+    return durationMs
+  })
+}
diff --git a/tests/e2e/artificial-opencode-hidden-pressure-scenario.ts b/tests/e2e/artificial-opencode-hidden-pressure-scenario.ts
index ca19daf7395..f65bbeea84a 100644
--- a/tests/e2e/artificial-opencode-hidden-pressure-scenario.ts
+++ b/tests/e2e/artificial-opencode-hidden-pressure-scenario.ts
@@ -54,10 +54,8 @@ type HiddenPressureDeps<TMeasurement, TDebug, TScheduler, TMainPressure, TAckGat
   writeInteractivePromptScript: (scriptPath: string, runId: string) => void
 }
 
-// Why: the renderer hidden-skip counters are gone with the skip grammar —
-// withheld hidden output is observed via main's delivery-drop counters only.
 type HiddenPressureDebug = {
-  hiddenRendererMode2031ReplyCount: number
+  hiddenRendererSkipCount: number
 }
 
 type HiddenPressureMeasurement = {
diff --git a/tests/e2e/artificial-opencode-revisit-pressure-scenario.ts b/tests/e2e/artificial-opencode-revisit-pressure-scenario.ts
index 48643b8d8de..c4300fe7cb5 100644
--- a/tests/e2e/artificial-opencode-revisit-pressure-scenario.ts
+++ b/tests/e2e/artificial-opencode-revisit-pressure-scenario.ts
@@ -27,9 +27,7 @@ type RevisitPressureMeasurement = {
   maxTimerDriftMs: number
 }
 
-// Why: the renderer hidden-skip counters were deleted with the skip grammar;
-// only the mode-2031 fact-reply counter still exists renderer-side.
-type RevisitPressureDebug = { hiddenRendererMode2031ReplyCount: number }
+type RevisitPressureDebug = { hiddenRendererSkipCount: number }
 
 type RevisitPressureSchedulerSnapshot = {
   peakQueuedChars: number
diff --git a/tests/e2e/artificial-opencode-terminal-load.spec.ts b/tests/e2e/artificial-opencode-terminal-load.spec.ts
index 3e857d3258f..0a3e1570769 100644
--- a/tests/e2e/artificial-opencode-terminal-load.spec.ts
+++ b/tests/e2e/artificial-opencode-terminal-load.spec.ts
@@ -56,11 +56,8 @@ type SyntheticOpenCodeWindow = Window & {
   }
 }
 
-// Why: the renderer hidden-skip grammar is deleted — hidden bytes are dropped
-// in main (gate) or ride the background queue. Only the mode-2031 fact-reply
-// counter still has a renderer-side producer.
 type TerminalPtyOutputDebugSnapshot = {
-  hiddenRendererMode2031ReplyCount: number
+  hiddenRendererSkipCount: number
 }
 
 type TerminalOutputSchedulerDebugSnapshot = {
@@ -373,7 +370,7 @@ function annotateTypingMeasurement(
   mainPressure: MainPtyPressureDebugSnapshot | null = null,
   ackGate: TerminalPtyAckGateSnapshot | null = null
 ): void {
-  const mode2031Summary = debug ? ` mode2031Replies=${debug.hiddenRendererMode2031ReplyCount}` : ''
+  const hiddenSkipSummary = debug ? ` hiddenRendererSkips=${debug.hiddenRendererSkipCount}` : ''
   const schedulerSummary = scheduler
     ? ` deferredForegroundEnqueue=${scheduler.deferredForegroundEnqueueCount} deferredForegroundWrite=${scheduler.deferredForegroundWriteCount} scheduledDrains=${scheduler.scheduledDrainCount} rendererQueuedTerminals=${scheduler.queuedTerminalCount} rendererQueuedChars=${scheduler.queuedChars} rendererPeakQueuedTerminals=${scheduler.peakQueuedTerminalCount} rendererPeakQueuedChars=${scheduler.peakQueuedChars} rendererPeakQueuedCharsByTerminal=${scheduler.peakQueuedCharsByTerminal} rendererDroppedBacklogs=${scheduler.droppedBacklogCount}`
     : ''
@@ -391,7 +388,7 @@ function annotateTypingMeasurement(
       1
     )}ms maxTimerDrift=${measurement.maxTimerDriftMs.toFixed(1)}ms samples=${measurement.latencies
       .map((value) => value.toFixed(1))
-      .join(',')}${mode2031Summary}${schedulerSummary}${mainPressureSummary}${ackGateSummary}`
+      .join(',')}${hiddenSkipSummary}${schedulerSummary}${mainPressureSummary}${ackGateSummary}`
   })
 }
 
diff --git a/tests/e2e/browser-fedcm-fallback.spec.ts b/tests/e2e/browser-fedcm-fallback.spec.ts
new file mode 100644
index 00000000000..c782bfed5a6
--- /dev/null
+++ b/tests/e2e/browser-fedcm-fallback.spec.ts
@@ -0,0 +1,139 @@
+import { createServer, type Server } from 'node:http'
+import type { AddressInfo } from 'node:net'
+import { test, expect } from './helpers/orca-app'
+import { ensureTerminalVisible, getActiveWorktreeId } from './helpers/store'
+
+async function closeServer(server: Server): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    server.close((error) => (error ? reject(error) : resolve()))
+  })
+}
+
+async function startFedCmFallbackServer(): Promise<{
+  url: string
+  close: () => Promise<void>
+}> {
+  const server = createServer((request, response) => {
+    const origin = `http://127.0.0.1:${(server.address() as AddressInfo).port}`
+    const pathname = new URL(request.url ?? '/', origin).pathname
+    response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
+    if (pathname === '/popup') {
+      response.end(
+        '<!doctype html><html><head><title>Popup fallback</title></head><body>Popup fallback<script>window.opener?.postMessage("popup-opener-live", window.location.origin)</script></body></html>'
+      )
+      return
+    }
+    response.end(`
+      <!doctype html>
+      <html>
+        <head><title>FedCM fallback oracle</title></head>
+        <body>
+          <output id="capabilities"></output>
+          <button id="sign-in">Sign in</button>
+          <output id="path">pending</output>
+          <script>
+            const hasIdentityCredential = 'IdentityCredential' in window
+            const hasIdentityProvider = 'IdentityProvider' in window
+            window.popupMessages = []
+            window.addEventListener('message', (event) => {
+              window.popupMessages.push(event.data)
+            })
+            document.querySelector('#capabilities').textContent = JSON.stringify({
+              hasIdentityCredential,
+              hasIdentityProvider
+            })
+            document.querySelector('#sign-in').addEventListener('click', () => {
+              if (hasIdentityCredential && hasIdentityProvider) {
+                document.querySelector('#path').textContent = 'fedcm-selected'
+                return
+              }
+              const popup = window.open('/popup', 'google-auth', 'width=480,height=640')
+              document.querySelector('#path').textContent = popup ? 'popup-live' : 'popup-blocked'
+            })
+          </script>
+        </body>
+      </html>
+    `)
+  })
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+  const port = (server.address() as AddressInfo).port
+  return { url: `http://127.0.0.1:${port}/`, close: () => closeServer(server) }
+}
+
+test('embedded browser omits unusable FedCM and reaches the popup fallback', async ({
+  electronApp,
+  orcaPage
+}) => {
+  const server = await startFedCmFallbackServer()
+  try {
+    await ensureTerminalVisible(orcaPage)
+    const worktreeId = await getActiveWorktreeId(orcaPage)
+    expect(worktreeId).not.toBeNull()
+    const browserTabId = await orcaPage.evaluate(
+      ({ targetWorktreeId, url }) => {
+        const tab = window.__store!.getState().createBrowserTab(targetWorktreeId!, url, {
+          title: 'FedCM fallback oracle',
+          activate: true
+        })
+        return tab.id
+      },
+      { targetWorktreeId: worktreeId, url: server.url }
+    )
+    const readGuest = async <T>(expression: string): Promise<T> =>
+      orcaPage.evaluate(
+        async ({ targetBrowserTabId, script }) => {
+          const slot = document.querySelector(
+            `[data-browser-overlay-tab-id="${targetBrowserTabId}"]`
+          )
+          const webview = slot?.querySelector('webview') as Electron.WebviewTag | null
+          if (!webview) {
+            throw new Error(`Missing webview for browser tab ${targetBrowserTabId}`)
+          }
+          return (await webview.executeJavaScript(script)) as T
+        },
+        { targetBrowserTabId: browserTabId, script: expression }
+      )
+
+    await expect
+      .poll(() => readGuest<string>('document.title'), { timeout: 10_000 })
+      .toBe('FedCM fallback oracle')
+    const capabilities = await readGuest<{
+      hasIdentityCredential: boolean
+      hasIdentityProvider: boolean
+    }>('JSON.parse(document.querySelector("#capabilities").textContent)')
+    expect.soft(capabilities).toEqual({
+      hasIdentityCredential: false,
+      hasIdentityProvider: false
+    })
+
+    await readGuest<void>('document.querySelector("#sign-in").click()')
+    const path = await readGuest<string>('document.querySelector("#path").textContent')
+    expect.soft(path).toBe('popup-live')
+    await expect
+      .poll(() =>
+        electronApp.evaluate(async ({ webContents }) => {
+          const popup = webContents.getAllWebContents().find((contents) => {
+            return contents.getURL().endsWith('/popup')
+          })
+          if (!popup) {
+            return null
+          }
+          return {
+            openerLive: await popup.executeJavaScript('Boolean(window.opener)'),
+            title: await popup.executeJavaScript('document.title'),
+            url: popup.getURL()
+          }
+        })
+      )
+      .toEqual({
+        openerLive: true,
+        title: 'Popup fallback',
+        url: `${server.url}popup`
+      })
+    await expect
+      .poll(() => readGuest<string[]>('window.popupMessages'))
+      .toEqual(['popup-opener-live'])
+  } finally {
+    await server.close()
+  }
+})
diff --git a/tests/e2e/browser-local-https-certificate-trust.spec.ts b/tests/e2e/browser-local-https-certificate-trust.spec.ts
index c82ec75f959..39e9cd782f2 100644
--- a/tests/e2e/browser-local-https-certificate-trust.spec.ts
+++ b/tests/e2e/browser-local-https-certificate-trust.spec.ts
@@ -1,4 +1,4 @@
-import type { Page } from '@stablyai/playwright-test'
+import type { Locator, Page } from '@stablyai/playwright-test'
 
 import { expect, test } from './helpers/orca-app'
 import {
@@ -64,6 +64,12 @@ function browserSlot(page: Page, pageId: string) {
   return page.locator(`[data-browser-overlay-tab-id="${pageId}"]`)
 }
 
+// Why: the toolbar reload button is also named "Retry" once a load fails, so match the
+// overlay's button by its visible label — the toolbar one is icon-only.
+function failureOverlayRetryButton(slot: Locator): Locator {
+  return slot.getByRole('button', { name: 'Retry' }).filter({ hasText: 'Retry' })
+}
+
 async function readBrowserHeading(page: Page, browserTabId: string): Promise<string | null> {
   return page.evaluate(async (targetBrowserTabId) => {
     const slot = [...document.querySelectorAll('[data-browser-overlay-tab-id]')].find(
@@ -144,7 +150,7 @@ test.describe('local HTTPS certificate trust', () => {
       // The certificate-failure branch keeps its safe recovery actions and the
       // certificate-specific hint, but never the local-server connectivity hint.
       await expect(firstSlot.getByRole('button', { name: 'Copy Address' })).toBeVisible()
-      await expect(firstSlot.getByRole('button', { name: 'Retry' })).toBeVisible()
+      await expect(failureOverlayRetryButton(firstSlot)).toBeVisible()
       await expect(firstSlot.getByText(/use a trusted local certificate/i)).toBeVisible()
       await expect(firstSlot.getByText(/make sure the server is running/i)).toHaveCount(0)
       await firstSlot.getByRole('button', { name: 'Proceed Anyway (Unsafe)' }).click()
diff --git a/tests/e2e/chinese-ime-chat-input-repro.spec.ts b/tests/e2e/chinese-ime-chat-input-repro.spec.ts
index 8c57b8e6a9f..9c72e8cdd4d 100644
--- a/tests/e2e/chinese-ime-chat-input-repro.spec.ts
+++ b/tests/e2e/chinese-ime-chat-input-repro.spec.ts
@@ -305,7 +305,7 @@ async function readPromptState(page: Page): Promise<TerminalPromptState | null>
     .filter((value): value is string => value !== null)
   const promptIndex = content.lastIndexOf(PROMPT)
   const liveLine =
-    promptIndex >= 0 ? (content.slice(promptIndex + PROMPT.length).split(/\r?\n/)[0] ?? '') : ''
+    promptIndex !== -1 ? (content.slice(promptIndex + PROMPT.length).split(/\r?\n/)[0] ?? '') : ''
   return {
     model: liveLine.trimEnd(),
     cursor: Array.from(liveLine.trimEnd()).length,
diff --git a/tests/e2e/codex-composer-echo-latency-probe.ts b/tests/e2e/codex-composer-echo-latency-probe.ts
index 9fc9cabf2c7..c49d98d3708 100644
--- a/tests/e2e/codex-composer-echo-latency-probe.ts
+++ b/tests/e2e/codex-composer-echo-latency-probe.ts
@@ -112,7 +112,7 @@ export async function installCodexEchoLatencyProbe(page: Page, target: string):
     const observeRender = (): void => {
       renderEvents += 1
       const paintedAt = performance.now()
-      for (const entry of awaitingRender.splice(0, awaitingRender.length)) {
+      for (const entry of awaitingRender.splice(0)) {
         entry.sample.keyToRenderMs = paintedAt - entry.startedAt
       }
     }
diff --git a/tests/e2e/completed-worker-retirement-resume.spec.ts b/tests/e2e/completed-worker-retirement-resume.spec.ts
new file mode 100644
index 00000000000..5540c4d6896
--- /dev/null
+++ b/tests/e2e/completed-worker-retirement-resume.spec.ts
@@ -0,0 +1,521 @@
+import { test as base, expect } from './helpers/orca-app'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  waitForActivePaneHookDescriptor,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager
+} from './helpers/terminal'
+import {
+  cleanupCompletedWorkerFixture,
+  clearCompletedWorkerLedger,
+  completedWorkerLaunchEnv,
+  listRuntimeTerminals,
+  readCompletedWorkerDispatchCapability,
+  readCompletedWorkerLedger,
+  readPersistedWorkerRecoveryRecord,
+  runBuiltOrcaCli,
+  seedCurrentCodexTranscript,
+  terminalIdentity
+} from './helpers/completed-worker-retirement-fixture'
+import { RuntimeClient } from '../../src/cli/runtime-client'
+import type { RuntimeTerminalRead, RuntimeTerminalSummary } from '../../src/shared/runtime-types'
+import { splitWorktreeIdForFilesystem } from '../../src/shared/worktree-id'
+
+const PROVIDER_SESSION_ID = '019feb51-2269-71c2-89c6-faa8dc65c8dc'
+
+const test = base.extend({
+  launchEnv: [completedWorkerLaunchEnv, { option: true }]
+})
+
+test.describe.configure({ mode: 'serial' })
+
+test.afterAll(() => {
+  cleanupCompletedWorkerFixture()
+})
+
+for (const closeMode of ['terminal-close-cli', 'worker-release'] as const) {
+  test(`completed background worker ${closeMode} retires resume authority before first activation`, async ({
+    orcaPage,
+    electronApp
+  }) => {
+    test.setTimeout(180_000)
+    clearCompletedWorkerLedger()
+    await waitForSessionReady(orcaPage)
+    const coordinatorWorktreeId = await waitForActiveWorktree(orcaPage)
+    await ensureTerminalVisible(orcaPage)
+    await waitForActiveTerminalManager(orcaPage)
+    await waitForActivePanePtyId(orcaPage)
+    await orcaPage.evaluate(async () => {
+      await window.__store?.getState().updateSettings({
+        disabledTuiAgents: [],
+        terminalHiddenViewParking: false
+      })
+    })
+
+    const userDataDir = await electronApp.evaluate(({ app }) => app.getPath('userData'))
+    const isolatedHome = await electronApp.evaluate(({ app }) => app.getPath('home'))
+    const client = new RuntimeClient(userDataDir, 30_000, null, null)
+    const coordinatorPane = await waitForActivePaneHookDescriptor(orcaPage)
+    const coordinatorResolved = await client.call<{ terminal: { handle: string } }>(
+      'terminal.resolvePane',
+      { paneKey: coordinatorPane.paneKey }
+    )
+    const coordinatorHandle = coordinatorResolved.result.terminal.handle
+    const coordinator = (await listRuntimeTerminals(client)).find(
+      (terminal) => terminal.handle === coordinatorHandle
+    )
+    if (!coordinator) {
+      throw new Error('Coordinator terminal was not runtime-visible')
+    }
+    const coordinatorBefore = terminalIdentity(coordinator)
+
+    let targetWorktreeId: string | null = null
+    await expect
+      .poll(
+        async () => {
+          const listed = await client.call<{ worktrees: { id: string }[] }>('worktree.list', {})
+          const rendererWorktreeIds = await orcaPage.evaluate(() =>
+            Object.values(window.__store?.getState().worktreesByRepo ?? {})
+              .flat()
+              .map((worktree) => worktree.id)
+          )
+          targetWorktreeId =
+            listed.result.worktrees.find(
+              (worktree) =>
+                worktree.id !== coordinatorWorktreeId && rendererWorktreeIds.includes(worktree.id)
+            )?.id ?? null
+          return targetWorktreeId
+        },
+        { timeout: 60_000, message: 'runtime never registered the secondary worktree' }
+      )
+      .not.toBeNull()
+    if (!targetWorktreeId) {
+      throw new Error('The seeded repository did not expose its secondary worktree')
+    }
+    const targetWorktreePath = splitWorktreeIdForFilesystem(targetWorktreeId)?.worktreePath
+    if (!targetWorktreePath) {
+      throw new Error('The secondary worktree did not expose a filesystem path')
+    }
+
+    expect(
+      await orcaPage.evaluate(
+        (worktreeId) => window.__store?.getState().everActivatedWorktreeIds.has(worktreeId),
+        targetWorktreeId
+      )
+    ).toBe(false)
+
+    const run = await client.call<{ run: { id: string } }>('orchestration.runCreate', {
+      objective: 'Retire one completed background worker',
+      from: coordinatorHandle
+    })
+    const task = await client.call<{ task: { id: string } }>('orchestration.taskCreate', {
+      spec: 'Report completion, then exit normally',
+      run: run.result.run.id,
+      callerTerminalHandle: coordinatorHandle
+    })
+    const started = await client.call<{
+      dispatchId: string
+      state: string
+      effects: { kind: string; role?: string; id?: string }[]
+    }>('orchestration.workerStart', {
+      task: task.result.task.id,
+      from: coordinatorHandle,
+      worktree: `id:${String(targetWorktreeId)}`,
+      agent: 'codex',
+      timeoutMs: 30_000
+    })
+    expect(started.result.state).toBe('ready')
+    const workerHandle = started.result.effects.find(
+      (effect) => effect.kind === 'terminal' && effect.role === 'agent'
+    )?.id
+    if (!workerHandle) {
+      throw new Error('worker-start did not return its agent terminal')
+    }
+
+    let worker: RuntimeTerminalSummary | undefined
+    await expect
+      .poll(
+        async () => {
+          worker = (await listRuntimeTerminals(client)).find(
+            (terminal) => terminal.handle === workerHandle
+          )
+          return worker?.ptyId ?? null
+        },
+        { timeout: 30_000, message: 'background worker never published its PTY identity' }
+      )
+      .not.toBeNull()
+    if (!worker?.ptyId || !worker.incarnationId) {
+      throw new Error('Background worker did not publish exact PTY identity')
+    }
+    const workerBefore = terminalIdentity(worker)
+    const workerPaneKey = `${worker.tabId}:${worker.leafId}`
+    expect(worker.worktreeId).toBe(targetWorktreeId)
+    await orcaPage.evaluate(
+      ({ tabId, worktreeId }) => {
+        window.dispatchEvent(
+          new CustomEvent('orca-background-mount-terminal-worktree', {
+            detail: { worktreeId, tabIds: [tabId] }
+          })
+        )
+      },
+      { tabId: worker.tabId, worktreeId: targetWorktreeId }
+    )
+    await expect
+      .poll(() =>
+        orcaPage.evaluate((tabId) => Boolean(window.__paneManagers?.get(tabId)), workerBefore.tabId)
+      )
+      .toBe(true)
+    expect(
+      await orcaPage.evaluate(
+        (worktreeId) => window.__store?.getState().everActivatedWorktreeIds.has(worktreeId),
+        targetWorktreeId
+      )
+    ).toBe(false)
+    await expect
+      .poll(() => readCompletedWorkerLedger().filter((event) => event.event === 'spawn'))
+      .toHaveLength(1)
+    let dispatchCapability: string | null = null
+    await expect
+      .poll(() => {
+        dispatchCapability = readCompletedWorkerDispatchCapability()
+        return dispatchCapability
+      })
+      .not.toBeNull()
+    if (!dispatchCapability) {
+      throw new Error('Background worker did not receive its dispatch capability')
+    }
+
+    const transcriptPath = seedCurrentCodexTranscript(
+      isolatedHome,
+      PROVIDER_SESSION_ID,
+      targetWorktreePath
+    )
+
+    await orcaPage.evaluate(
+      ({ paneKey, providerSessionId, tabId, terminalHandle, transcriptPath, worktreeId }) => {
+        const state = window.__store?.getState()
+        if (!state) {
+          throw new Error('Renderer store unavailable')
+        }
+        const providerSession = {
+          key: 'session_id' as const,
+          id: providerSessionId,
+          transcriptPath
+        }
+        const metadata = { tabId, worktreeId, terminalHandle }
+        const recovery = {
+          providerSession,
+          launchConfig: {
+            agentCommand: 'codex',
+            agentArgs: '--dangerously-bypass-approvals-and-sandbox',
+            agentEnv: {}
+          }
+        }
+        state.setAgentStatus(
+          paneKey,
+          { state: 'working', prompt: 'Report completion, then exit normally', agentType: 'codex' },
+          'Completed background worker',
+          undefined,
+          metadata,
+          recovery
+        )
+        state.setAgentStatus(
+          paneKey,
+          { state: 'done', prompt: 'Report completion, then exit normally', agentType: 'codex' },
+          'Completed background worker',
+          undefined,
+          metadata,
+          recovery
+        )
+      },
+      {
+        paneKey: workerPaneKey,
+        providerSessionId: PROVIDER_SESSION_ID,
+        tabId: worker.tabId,
+        terminalHandle: workerHandle,
+        transcriptPath,
+        worktreeId: targetWorktreeId
+      }
+    )
+
+    const expectedRecovery = {
+      origin: 'live',
+      state: 'working',
+      providerSessionId: PROVIDER_SESSION_ID
+    }
+    await expect
+      .poll(() =>
+        orcaPage.evaluate((paneKey) => {
+          const record = window.__store?.getState().sleepingAgentSessionsByPaneKey[paneKey]
+          return record
+            ? {
+                origin: record.origin,
+                state: record.state,
+                providerSessionId: record.providerSession.id
+              }
+            : null
+        }, workerPaneKey)
+      )
+      .toEqual(expectedRecovery)
+    await expect
+      .poll(
+        () => {
+          const record = readPersistedWorkerRecoveryRecord(userDataDir, workerPaneKey)
+          return record
+            ? {
+                origin: record.origin,
+                state: record.state,
+                providerSessionId: record.providerSession?.id
+              }
+            : null
+        },
+        { timeout: 30_000 }
+      )
+      .toEqual(expectedRecovery)
+
+    const completed = await client.call<{ message: { type: string } }>(
+      'orchestration.send',
+      {
+        from: workerHandle,
+        subject: 'Completed',
+        body: 'The fixture completed. It found no work. Nothing remains.',
+        type: 'worker_done',
+        payload: JSON.stringify({
+          taskId: task.result.task.id,
+          dispatchId: started.result.dispatchId,
+          outcome: 'succeeded'
+        })
+      },
+      { orchestrationCapability: dispatchCapability }
+    )
+    expect(completed.result.message.type).toBe('worker_done')
+    await expect
+      .poll(
+        async () => {
+          const dispatch = await client.call<{ dispatch: { status: string } | null }>(
+            'orchestration.dispatchShow',
+            { task: task.result.task.id }
+          )
+          const tasks = await client.call<{ tasks: { id: string; status: string }[] }>(
+            'orchestration.taskList',
+            { run: run.result.run.id }
+          )
+          return {
+            dispatch: dispatch.result.dispatch?.status ?? null,
+            task:
+              tasks.result.tasks.find((candidate) => candidate.id === task.result.task.id)
+                ?.status ?? null
+          }
+        },
+        { timeout: 30_000, message: 'worker completion never settled its task and dispatch' }
+      )
+      .toEqual({ dispatch: 'completed', task: 'completed' })
+
+    await client.call('terminal.send', {
+      terminal: workerHandle,
+      text: 'ORCA_E2E_EXIT_AFTER_DONE',
+      enter: true
+    })
+    await expect
+      .poll(() => readCompletedWorkerLedger().filter((event) => event.event === 'normal-exit'))
+      .toHaveLength(1)
+    expect(
+      await orcaPage.evaluate(
+        ({ paneKey, tabId, worktreeId }) => {
+          const state = window.__store?.getState()
+          return {
+            tabPresent: Boolean(state?.tabsByWorktree[worktreeId]?.some((tab) => tab.id === tabId)),
+            recoveryPresent: Boolean(state?.sleepingAgentSessionsByPaneKey[paneKey])
+          }
+        },
+        { paneKey: workerPaneKey, tabId: workerBefore.tabId, worktreeId: targetWorktreeId }
+      )
+    ).toEqual({ tabPresent: true, recoveryPresent: true })
+
+    await orcaPage.evaluate(
+      ({ paneKey, tabId, worktreeId }) => {
+        const store = window.__store
+        if (!store) {
+          throw new Error('Renderer store unavailable')
+        }
+        type Transition = { tabPresent: boolean; recoveryPresent: boolean }
+        const e2eWindow = window as typeof window & {
+          __orcaRetiredWorkerTransitions?: Transition[]
+          __orcaRetiredWorkerUnsubscribe?: () => void
+        }
+        const transitions: Transition[] = [
+          {
+            tabPresent: Boolean(
+              store.getState().tabsByWorktree[worktreeId]?.some((tab) => tab.id === tabId)
+            ),
+            recoveryPresent: Boolean(store.getState().sleepingAgentSessionsByPaneKey[paneKey])
+          }
+        ]
+        e2eWindow.__orcaRetiredWorkerTransitions = transitions
+        e2eWindow.__orcaRetiredWorkerUnsubscribe = store.subscribe((state) => {
+          const next = {
+            tabPresent: Boolean(state.tabsByWorktree[worktreeId]?.some((tab) => tab.id === tabId)),
+            recoveryPresent: Boolean(state.sleepingAgentSessionsByPaneKey[paneKey])
+          }
+          const previous = transitions.at(-1)
+          if (
+            !previous ||
+            previous.tabPresent !== next.tabPresent ||
+            previous.recoveryPresent !== next.recoveryPresent
+          ) {
+            transitions.push(next)
+          }
+        })
+      },
+      { paneKey: workerPaneKey, tabId: workerBefore.tabId, worktreeId: targetWorktreeId }
+    )
+
+    if (closeMode === 'terminal-close-cli') {
+      const closed = runBuiltOrcaCli(['terminal', 'close', '--terminal', workerHandle, '--json'], {
+        userDataDir,
+        cwd: process.cwd()
+      })
+      expect(closed).toMatchObject({
+        ok: true,
+        result: {
+          close: {
+            handle: workerHandle,
+            tabId: workerBefore.tabId,
+            ptyKilled: true
+          }
+        }
+      })
+    } else {
+      const release = await client.call<{
+        dispatchId: string
+        state: string
+        processAction: string
+      }>('orchestration.workerRelease', { dispatch: started.result.dispatchId })
+      expect(release.result).toMatchObject({
+        dispatchId: started.result.dispatchId,
+        state: 'released',
+        processAction: 'closed_agent_terminal'
+      })
+    }
+    await expect
+      .poll(() =>
+        orcaPage.evaluate(() => {
+          type Transition = { tabPresent: boolean; recoveryPresent: boolean }
+          return (window as typeof window & { __orcaRetiredWorkerTransitions?: Transition[] })
+            .__orcaRetiredWorkerTransitions
+        })
+      )
+      .toEqual(
+        expect.arrayContaining([
+          { tabPresent: true, recoveryPresent: true },
+          { tabPresent: false, recoveryPresent: false }
+        ])
+      )
+    await orcaPage.evaluate(() => {
+      const e2eWindow = window as typeof window & { __orcaRetiredWorkerUnsubscribe?: () => void }
+      e2eWindow.__orcaRetiredWorkerUnsubscribe?.()
+      delete e2eWindow.__orcaRetiredWorkerUnsubscribe
+    })
+    await expect
+      .poll(() =>
+        orcaPage.evaluate(
+          (paneKey) => window.__store?.getState().sleepingAgentSessionsByPaneKey[paneKey] ?? null,
+          workerPaneKey
+        )
+      )
+      .toBeNull()
+
+    await orcaPage.evaluate(() => window.dispatchEvent(new Event('beforeunload')))
+    await expect
+      .poll(() =>
+        orcaPage.evaluate(async (paneKey) => {
+          const session = await window.api.session.get()
+          return session.sleepingAgentSessionsByPaneKey?.[paneKey] ?? null
+        }, workerPaneKey)
+      )
+      .toBeNull()
+    await orcaPage.evaluate(() => window.api.session.flush())
+    expect(readPersistedWorkerRecoveryRecord(userDataDir, workerPaneKey)).toBeNull()
+
+    await orcaPage.reload()
+    await waitForSessionReady(orcaPage)
+
+    const beforeActivation = await orcaPage.evaluate((worktreeId) => {
+      const state = window.__store?.getState()
+      return {
+        everActivated: state?.everActivatedWorktreeIds.has(worktreeId) ?? false,
+        tabCount: state?.tabsByWorktree[worktreeId]?.length ?? 0,
+        pendingStartupCount: Object.keys(state?.pendingStartupByTabId ?? {}).length
+      }
+    }, targetWorktreeId)
+    expect(beforeActivation).toEqual({ everActivated: false, tabCount: 0, pendingStartupCount: 0 })
+
+    const targetCard = orcaPage
+      .locator(`[data-worktree-id="${String(targetWorktreeId)}"]`)
+      .first()
+      .locator('[data-worktree-card-surface]')
+    await targetCard.evaluate((element: HTMLElement) => element.click())
+    await expect
+      .poll(() => orcaPage.evaluate(() => window.__store?.getState().activeWorktreeId))
+      .toBe(targetWorktreeId)
+    await waitForActiveTerminalManager(orcaPage)
+    await waitForActivePanePtyId(orcaPage)
+    const activatedPane = await waitForActivePaneHookDescriptor(orcaPage)
+    expect(activatedPane.worktreeId).toBe(targetWorktreeId)
+    const activatedResolved = await client.call<{ terminal: { handle: string } }>(
+      'terminal.resolvePane',
+      { paneKey: activatedPane.paneKey }
+    )
+    await expect
+      .poll(
+        async () => {
+          const read = await client.call<{ terminal: RuntimeTerminalRead }>('terminal.read', {
+            terminal: activatedResolved.result.terminal.handle,
+            limit: 50
+          })
+          return read.result.terminal.tail.join('\n')
+        },
+        { timeout: 30_000, message: 'activated fallback terminal never produced output' }
+      )
+      .not.toBe('')
+
+    const spawnEvents = readCompletedWorkerLedger().filter((event) => event.event === 'spawn')
+    expect(spawnEvents).toHaveLength(1)
+    expect(
+      spawnEvents.filter(
+        (event) => event.args?.includes('resume') && event.args?.includes(PROVIDER_SESSION_ID)
+      )
+    ).toEqual([])
+    await expect(orcaPage.locator('.session-restored-banner')).toHaveCount(0)
+
+    const afterActivation = await orcaPage.evaluate(
+      ({ originalTabId, worktreeId }) => {
+        const state = window.__store?.getState()
+        const tabs = state?.tabsByWorktree[worktreeId] ?? []
+        return {
+          everActivated: state?.everActivatedWorktreeIds.has(worktreeId) ?? false,
+          originalTabPresent: tabs.some((tab) => tab.id === originalTabId),
+          replacementTabCount: tabs.filter((tab) => tab.id !== originalTabId).length,
+          pendingResumeSessionIds: Object.values(state?.pendingStartupByTabId ?? {}).flatMap(
+            (startup) => (startup.resumeProviderSession ? [startup.resumeProviderSession.id] : [])
+          ),
+          resumeClaimCount: Object.keys(state?.automaticAgentResumeClaimsByTabId ?? {}).length
+        }
+      },
+      { originalTabId: workerBefore.tabId, worktreeId: targetWorktreeId }
+    )
+    expect(afterActivation).toEqual({
+      everActivated: true,
+      originalTabPresent: false,
+      replacementTabCount: 1,
+      pendingResumeSessionIds: [],
+      resumeClaimCount: 0
+    })
+
+    const coordinatorAfter = (await listRuntimeTerminals(client)).find(
+      (terminal) => terminal.handle === coordinatorHandle
+    )
+    expect(coordinatorAfter ? terminalIdentity(coordinatorAfter) : null).toEqual(coordinatorBefore)
+    expect(coordinatorAfter?.worktreeId).toBe(coordinatorWorktreeId)
+  })
+}
diff --git a/tests/e2e/completed-worker-retirement-resume.unit.test.ts b/tests/e2e/completed-worker-retirement-resume.unit.test.ts
new file mode 100644
index 00000000000..03292dfb0e6
--- /dev/null
+++ b/tests/e2e/completed-worker-retirement-resume.unit.test.ts
@@ -0,0 +1,610 @@
+import path from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { SleepingAgentSessionRecord } from '../../src/shared/agent-session-resume'
+import { makePaneKey } from '../../src/shared/stable-pane-id'
+import { tokenizeStartupCommand } from '../../src/shared/tui-agent-startup-shell'
+import { parseWorkspaceSession } from '../../src/shared/workspace-session-schema'
+import type { TerminalTab, Worktree } from '../../src/shared/types'
+import { OrchestrationDb } from '../../src/main/runtime/orchestration/db'
+import { OrcaRuntimeService } from '../../src/main/runtime/orca-runtime'
+import type { RpcContext } from '../../src/main/runtime/rpc/core'
+import { ORCHESTRATION_METHODS } from '../../src/main/runtime/rpc/methods/orchestration'
+import { closeTerminalTab } from '@/components/terminal/terminal-tab-actions'
+import { seedStartupSessionRestoredBanner } from '@/components/terminal-pane/session-restored-banner-pane-state'
+import {
+  resolveLegacyWorkerTerminalRecoveryAction,
+  rollbackLegacyWorkerTerminalSurfaceInStore
+} from '@/hooks/legacy-worker-terminal-recovery-event'
+import { useAppStore, type AppState } from '@/store'
+import { buildWorkspaceSessionPayload } from '@/lib/workspace-session'
+import { activateAndRevealWorktree } from '@/lib/worktree-activation'
+import { resumeSleepingAgentSessionsForWorktree } from '@/lib/resume-sleeping-agent-session'
+
+const PROVIDER_SESSION_ID = '019feb51-2269-71c2-89c6-faa8dc65c8dc'
+const ORIGINAL_TAB_ID = '1c897bc8-973b-47b4-9449-ac5fc6b726c3'
+const ORIGINAL_LEAF_ID = '0526f763-6729-49af-adf8-85ddbcf2b4e7'
+const ORIGINAL_PANE_KEY = makePaneKey(ORIGINAL_TAB_ID, ORIGINAL_LEAF_ID)
+const ORIGINAL_PTY_ID = 'pty-background-worker'
+const REPO_ID = '32a0226d-9f33-42e8-8b7b-24867dea06d4'
+const WORKTREE_PATH = path.join(path.sep, 'workspace', 'factory-pr-4626-git-crypt')
+const WORKTREE_ID = `${REPO_ID}::${WORKTREE_PATH}`
+const CANARY_WORKTREE_PATH = path.join(path.sep, 'workspace', 'canary')
+const CANARY_WORKTREE_ID = `${REPO_ID}::${CANARY_WORKTREE_PATH}`
+const CANARY_TAB_ID = 'canary-tab'
+const CANARY_LEAF_ID = '22222222-2222-4222-8222-222222222222'
+const CANARY_PTY_ID = 'pty-unrelated-canary'
+const HELPER_TAB_ID = 'worker-child-terminal'
+const HELPER_LEAF_ID = '33333333-3333-4333-8333-333333333333'
+const HELPER_PANE_KEY = makePaneKey(HELPER_TAB_ID, HELPER_LEAF_ID)
+const TERMINAL_HANDLE = 'terminal-background-worker'
+const initialAppStoreState = useAppStore.getState()
+
+function makeWorktree(id: string, workspacePath: string): Worktree {
+  return {
+    id,
+    repoId: REPO_ID,
+    path: workspacePath,
+    head: 'abc123',
+    branch: 'refs/heads/review',
+    isBare: false,
+    isMainWorktree: false,
+    displayName: path.basename(workspacePath),
+    comment: '',
+    linkedIssue: null,
+    linkedPR: null,
+    linkedLinearIssue: null,
+    linkedGitLabMR: null,
+    linkedGitLabIssue: null,
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 0,
+    hostId: 'local'
+  }
+}
+
+function makeTab(id: string, worktreeId: string, ptyId: string, title: string): TerminalTab {
+  return {
+    id,
+    ptyId,
+    worktreeId,
+    title,
+    customTitle: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 1
+  }
+}
+
+function makeLayout(leafId: string, ptyId: string) {
+  return {
+    root: { type: 'leaf' as const, leafId },
+    activeLeafId: leafId,
+    expandedLeafId: null,
+    ptyIdsByLeafId: { [leafId]: ptyId }
+  }
+}
+
+function seedWorkspace(options: { helper?: boolean } = {}): void {
+  useAppStore.setState(initialAppStoreState, true)
+  const target = makeWorktree(WORKTREE_ID, WORKTREE_PATH)
+  const canary = makeWorktree(CANARY_WORKTREE_ID, CANARY_WORKTREE_PATH)
+  const original = makeTab(
+    ORIGINAL_TAB_ID,
+    WORKTREE_ID,
+    ORIGINAL_PTY_ID,
+    'PR 4626 unified correction r3'
+  )
+  const unrelated = makeTab(CANARY_TAB_ID, CANARY_WORKTREE_ID, CANARY_PTY_ID, 'Unrelated')
+  const helper = makeTab(HELPER_TAB_ID, WORKTREE_ID, 'pty-worker-child', 'Worker child')
+  useAppStore.setState({
+    repos: [
+      {
+        id: REPO_ID,
+        path: path.join(path.sep, 'workspace'),
+        displayName: 'repo',
+        badgeColor: '#000000',
+        addedAt: 0,
+        executionHostId: 'local'
+      }
+    ],
+    worktreesByRepo: { [REPO_ID]: [target, canary] },
+    activeRepoId: REPO_ID,
+    activeWorktreeId: CANARY_WORKTREE_ID,
+    activeTabId: CANARY_TAB_ID,
+    activeTabType: 'terminal',
+    activeView: 'terminal',
+    tabsByWorktree: {
+      [WORKTREE_ID]: options.helper ? [original, helper] : [original],
+      [CANARY_WORKTREE_ID]: [unrelated]
+    },
+    ptyIdsByTabId: {
+      [ORIGINAL_TAB_ID]: [ORIGINAL_PTY_ID],
+      [CANARY_TAB_ID]: [CANARY_PTY_ID],
+      ...(options.helper ? { [HELPER_TAB_ID]: ['pty-worker-child'] } : {})
+    },
+    terminalLayoutsByTabId: {
+      [ORIGINAL_TAB_ID]: makeLayout(ORIGINAL_LEAF_ID, ORIGINAL_PTY_ID),
+      [CANARY_TAB_ID]: makeLayout(CANARY_LEAF_ID, CANARY_PTY_ID),
+      ...(options.helper ? { [HELPER_TAB_ID]: makeLayout(HELPER_LEAF_ID, 'pty-worker-child') } : {})
+    },
+    activeTabIdByWorktree: {
+      [WORKTREE_ID]: ORIGINAL_TAB_ID,
+      [CANARY_WORKTREE_ID]: CANARY_TAB_ID
+    },
+    activeTabTypeByWorktree: {
+      [WORKTREE_ID]: 'terminal',
+      [CANARY_WORKTREE_ID]: 'terminal'
+    },
+    tabBarOrderByWorktree: {
+      [WORKTREE_ID]: options.helper ? [ORIGINAL_TAB_ID, HELPER_TAB_ID] : [ORIGINAL_TAB_ID],
+      [CANARY_WORKTREE_ID]: [CANARY_TAB_ID]
+    },
+    unifiedTabsByWorktree: {},
+    groupsByWorktree: {},
+    layoutByWorktree: {},
+    activeGroupIdByWorktree: {},
+    openFiles: [],
+    browserTabsByWorktree: {},
+    browserPagesByWorkspace: {},
+    activeFileIdByWorktree: {},
+    activeBrowserTabIdByWorktree: {},
+    pendingStartupByTabId: {},
+    automaticAgentResumeClaimsByTabId: {},
+    agentStatusByPaneKey: {},
+    sleepingAgentSessionsByPaneKey: {},
+    everActivatedWorktreeIds: new Set([CANARY_WORKTREE_ID]),
+    settings: {
+      ...initialAppStoreState.settings,
+      agentCmdOverrides: {},
+      agentDefaultArgs: { codex: '--dangerously-bypass-approvals-and-sandbox' },
+      setupScriptLaunchMode: 'new-tab'
+    },
+    markWorktreeVisited: vi.fn(),
+    recordWorktreeVisit: vi.fn(),
+    refreshGitHubForWorktreeIfStale: vi.fn(),
+    revealWorktreeInSidebar: vi.fn()
+  } as Partial<AppState>)
+}
+
+function recordWorkingWorker() {
+  const providerSession = { key: 'session_id' as const, id: PROVIDER_SESSION_ID }
+  useAppStore
+    .getState()
+    .setAgentStatus(
+      ORIGINAL_PANE_KEY,
+      { state: 'working', prompt: 'review PR 4626', agentType: 'codex' },
+      'PR 4626 unified correction r3',
+      { updatedAt: 1_786_361_478_130, stateStartedAt: 1_786_361_478_130 },
+      { tabId: ORIGINAL_TAB_ID, worktreeId: WORKTREE_ID, terminalHandle: TERMINAL_HANDLE },
+      { providerSession }
+    )
+  return providerSession
+}
+
+function completeRecordedWorker(
+  providerSession: ReturnType<typeof recordWorkingWorker>
+): SleepingAgentSessionRecord {
+  useAppStore
+    .getState()
+    .setAgentStatus(
+      ORIGINAL_PANE_KEY,
+      { state: 'done', prompt: 'review PR 4626', agentType: 'codex' },
+      'PR 4626 unified correction r3',
+      { updatedAt: 1_786_361_625_666, stateStartedAt: 1_786_361_625_666 },
+      { tabId: ORIGINAL_TAB_ID, worktreeId: WORKTREE_ID, terminalHandle: TERMINAL_HANDLE },
+      { providerSession }
+    )
+  expect(useAppStore.getState().agentStatusByPaneKey[ORIGINAL_PANE_KEY]).toMatchObject({
+    state: 'done',
+    providerSession
+  })
+  const record = useAppStore.getState().sleepingAgentSessionsByPaneKey[ORIGINAL_PANE_KEY]
+  expect(record).toMatchObject({
+    paneKey: ORIGINAL_PANE_KEY,
+    tabId: ORIGINAL_TAB_ID,
+    worktreeId: WORKTREE_ID,
+    agent: 'codex',
+    providerSession,
+    state: 'working',
+    origin: 'live'
+  })
+  return record!
+}
+
+function recordCompletedWorker(): SleepingAgentSessionRecord {
+  return completeRecordedWorker(recordWorkingWorker())
+}
+
+function expectCanaryUnchanged(): void {
+  const state = useAppStore.getState()
+  expect(state.tabsByWorktree[CANARY_WORKTREE_ID]).toEqual([
+    expect.objectContaining({ id: CANARY_TAB_ID, ptyId: CANARY_PTY_ID })
+  ])
+  expect(state.terminalLayoutsByTabId[CANARY_TAB_ID]).toEqual(
+    makeLayout(CANARY_LEAF_ID, CANARY_PTY_ID)
+  )
+}
+
+function orchestrationMethod(name: string) {
+  const method = ORCHESTRATION_METHODS.find((candidate) => candidate.name === name)
+  if (!method) {
+    throw new Error(`Missing orchestration method: ${name}`)
+  }
+  return method
+}
+
+async function releaseCompletedWorker(terminalState: 'running' | 'exited'): Promise<void> {
+  const db = new OrchestrationDb(':memory:')
+  const runtime = new OrcaRuntimeService()
+  runtime.setOrchestrationDb(db)
+  const coordinatorPaneKey = 'coordinator-tab:aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
+  const run = db.createRun({
+    objective: 'Completed worker retirement reproduction',
+    coordinatorHandle: 'terminal-coordinator',
+    coordinatorPaneKey
+  })
+  const ctx: RpcContext = { runtime }
+  const call = async (name: string, params: Record<string, unknown>) => {
+    const method = orchestrationMethod(name)
+    const parsed = method.params ? method.params.parse(params) : undefined
+    return method.handler(parsed, ctx)
+  }
+
+  vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) =>
+    handle === 'terminal-coordinator' ? coordinatorPaneKey : ORIGINAL_PANE_KEY
+  )
+  vi.spyOn(runtime, 'getTerminalProcessIncarnation').mockImplementation((handle) =>
+    handle === TERMINAL_HANDLE ? 'runtime:test:worker:1' : null
+  )
+  vi.spyOn(runtime, 'getOrchestrationDispatchAuthority').mockImplementation((handle) =>
+    handle === TERMINAL_HANDLE
+      ? ({
+          terminalHandle: TERMINAL_HANDLE,
+          paneKey: ORIGINAL_PANE_KEY,
+          processIncarnation: 'runtime:test:worker:1',
+          hostScope: { kind: 'local', hostId: 'local' }
+        } as never)
+      : null
+  )
+  vi.spyOn(runtime, 'validateOrchestrationAgentLauncher').mockImplementation(() => {})
+  vi.spyOn(runtime, 'showManagedWorktree').mockResolvedValue({ id: WORKTREE_ID } as never)
+  vi.spyOn(runtime, 'createTerminal').mockResolvedValue({
+    handle: TERMINAL_HANDLE,
+    worktreeId: WORKTREE_ID,
+    title: 'PR 4626 unified correction r3'
+  })
+  vi.spyOn(runtime, 'waitForTerminal').mockResolvedValue({
+    handle: TERMINAL_HANDLE,
+    condition: 'tui-idle',
+    satisfied: true,
+    status: 'running',
+    exitCode: null
+  })
+  vi.spyOn(runtime, 'getTerminalOrchestrationCliCommand').mockReturnValue('orca')
+  vi.spyOn(runtime, 'sendTerminalAgentPrompt').mockResolvedValue({
+    handle: TERMINAL_HANDLE,
+    accepted: true,
+    bytesWritten: 1
+  })
+  vi.spyOn(runtime, 'isTerminalRunningAgent').mockResolvedValue(true)
+  vi.spyOn(runtime, 'getExactWorkerProviderSession').mockReturnValue(null)
+  vi.spyOn(runtime, 'showTerminal').mockResolvedValue({
+    handle: TERMINAL_HANDLE,
+    worktreeId: WORKTREE_ID,
+    ...(terminalState === 'exited' ? { connected: false } : { status: 'running' })
+  } as never)
+  vi.spyOn(runtime, 'readTerminal').mockResolvedValue({
+    handle: TERMINAL_HANDLE,
+    status: terminalState,
+    tail: terminalState === 'exited' ? [] : ['completed worker output'],
+    truncated: false,
+    nextCursor: terminalState === 'exited' ? null : '1'
+  })
+  const closeTerminal = vi.spyOn(runtime, 'closeTerminal').mockImplementation(async () => {
+    closeTerminalTab(ORIGINAL_TAB_ID, {
+      force: true,
+      skipRunningProcessConfirm: true,
+      localPtyTeardownOwnedExternally: true
+    })
+    return { handle: TERMINAL_HANDLE, tabId: ORIGINAL_TAB_ID, ptyKilled: true }
+  })
+  vi.spyOn(runtime, 'notifyMessageArrived').mockImplementation(() => {})
+
+  try {
+    const task = db.createTask({ spec: 'release completed worker', runId: run.id })
+    const started = (await call('orchestration.workerStart', {
+      task: task.id,
+      from: 'terminal-coordinator',
+      agent: 'codex'
+    })) as { dispatchId: string; state: string }
+    expect(started.state).toBe('ready')
+    expect(db.getWorkerDispatch(started.dispatchId)?.state).toBe('ready')
+    expect(
+      db.settleWorkerReport({
+        taskId: task.id,
+        dispatchId: started.dispatchId,
+        outcome: 'succeeded',
+        result: 'worker completed'
+      }).action
+    ).toBe('settled')
+    expect(db.getWorkerDispatch(started.dispatchId)?.state).toBe('succeeded')
+
+    await expect(
+      call('orchestration.workerRelease', { dispatch: started.dispatchId })
+    ).resolves.toMatchObject({
+      dispatchId: started.dispatchId,
+      state: 'released',
+      processAction: terminalState === 'exited' ? 'closed_exited_terminal' : 'closed_agent_terminal'
+    })
+    expect(db.getWorkerDispatch(started.dispatchId)?.state).toBe('succeeded')
+    expect(db.getWorkerTerminalResourceByOwner(started.dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released',
+      pane_key: ORIGINAL_PANE_KEY,
+      terminal_handle: TERMINAL_HANDLE
+    })
+    expect(closeTerminal).toHaveBeenCalledOnce()
+  } finally {
+    db.close()
+  }
+}
+
+function persistAndParseCurrentSession() {
+  const payload = buildWorkspaceSessionPayload(useAppStore.getState())
+  const parsed = parseWorkspaceSession(JSON.parse(JSON.stringify(payload)))
+  expect(parsed.ok).toBe(true)
+  if (!parsed.ok) {
+    throw new Error(parsed.error)
+  }
+  return parsed.value
+}
+
+async function hydrateSession(
+  session: ReturnType<typeof persistAndParseCurrentSession>
+): Promise<void> {
+  seedWorkspace()
+  useAppStore.getState().hydrateWorkspaceSession(session)
+  useAppStore.getState().hydrateTabsSession(session)
+  await useAppStore.getState().reconnectPersistedTerminals()
+}
+
+beforeEach(() => {
+  vi.spyOn(console, 'debug').mockImplementation(() => {})
+  vi.stubGlobal('window', {
+    api: {
+      pty: { kill: vi.fn().mockResolvedValue(undefined) },
+      runtime: { call: vi.fn().mockResolvedValue({ ok: true, result: {} }) },
+      runtimeEnvironments: { call: vi.fn().mockResolvedValue({ ok: true, result: {} }) }
+    }
+  })
+  seedWorkspace()
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.unstubAllGlobals()
+  useAppStore.setState(initialAppStoreState, true)
+})
+
+describe('completed background-worker retirement resume matrix', () => {
+  it('does not cold-resume an explicitly completed and retired worker on first activation', async () => {
+    // Case 1: task completion alone keeps the still-owned provider session recoverable in place.
+    const ownedRecord = recordCompletedWorker()
+    expect(resumeSleepingAgentSessionsForWorktree(WORKTREE_ID)).toBe(0)
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE_ID]).toHaveLength(1)
+    expect(useAppStore.getState().sleepingAgentSessionsByPaneKey[ORIGINAL_PANE_KEY]).toBe(
+      ownedRecord
+    )
+
+    // Case 2: the renderer boundary used by an explicit Orca close retires the exact authority.
+    seedWorkspace()
+    recordCompletedWorker()
+    closeTerminalTab(ORIGINAL_TAB_ID, {
+      force: true,
+      skipRunningProcessConfirm: true,
+      localPtyTeardownOwnedExternally: true
+    })
+    expect(useAppStore.getState().sleepingAgentSessionsByPaneKey[ORIGINAL_PANE_KEY]).toBeUndefined()
+    expectCanaryUnchanged()
+
+    // Case 3: both running and PTY-exit-first release retire exact resume authority.
+    seedWorkspace()
+    recordCompletedWorker()
+    await releaseCompletedWorker('running')
+    expect(useAppStore.getState().sleepingAgentSessionsByPaneKey[ORIGINAL_PANE_KEY]).toBeUndefined()
+    expectCanaryUnchanged()
+
+    seedWorkspace()
+    recordCompletedWorker()
+    useAppStore.getState().removeAgentStatus(ORIGINAL_PANE_KEY)
+    useAppStore.getState().closeTab(ORIGINAL_TAB_ID, { reason: 'pty-exit' })
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE_ID]).toEqual([])
+    expect(useAppStore.getState().terminalLayoutsByTabId[ORIGINAL_TAB_ID]).toBeUndefined()
+    expect(useAppStore.getState().ptyIdsByTabId[ORIGINAL_TAB_ID]).toBeUndefined()
+    expect(useAppStore.getState().sleepingAgentSessionsByPaneKey[ORIGINAL_PANE_KEY]).toMatchObject({
+      origin: 'live',
+      state: 'working',
+      providerSession: { key: 'session_id', id: PROVIDER_SESSION_ID }
+    })
+    await releaseCompletedWorker('exited')
+    expect(useAppStore.getState().sleepingAgentSessionsByPaneKey[ORIGINAL_PANE_KEY]).toBeUndefined()
+
+    const retiredRestart = persistAndParseCurrentSession()
+    expect(retiredRestart.tabsByWorktree[WORKTREE_ID]).toEqual([])
+    expect(retiredRestart.sleepingAgentSessionsByPaneKey?.[ORIGINAL_PANE_KEY]).toBeUndefined()
+
+    // Case 4: legacy rollback preserves a fenced record; exited resolution clears it.
+    seedWorkspace()
+    const legacyRecord = recordCompletedWorker()
+    useAppStore.setState({
+      sleepingAgentSessionsByPaneKey: {
+        [ORIGINAL_PANE_KEY]: {
+          ...legacyRecord,
+          automaticResumeBlockedBy: 'legacy-orchestration-worker'
+        }
+      }
+    })
+    const legacyAction = resolveLegacyWorkerTerminalRecoveryAction({
+      paneKey: ORIGINAL_PANE_KEY,
+      resolution: 'rolled_back',
+      ptyId: ORIGINAL_PTY_ID
+    })
+    expect(legacyAction.kind).toBe('rollback-surface')
+    if (legacyAction.kind === 'rollback-surface') {
+      expect(
+        rollbackLegacyWorkerTerminalSurfaceInStore(useAppStore.getState(), legacyAction.detail)
+      ).toBe('removed')
+    }
+    expect(resumeSleepingAgentSessionsForWorktree(WORKTREE_ID)).toBe(0)
+    expect(
+      useAppStore.getState().sleepingAgentSessionsByPaneKey[ORIGINAL_PANE_KEY]
+        ?.automaticResumeBlockedBy
+    ).toBe('legacy-orchestration-worker')
+    const exitedAction = resolveLegacyWorkerTerminalRecoveryAction({
+      paneKey: ORIGINAL_PANE_KEY,
+      resolution: 'exited'
+    })
+    expect(exitedAction).toEqual({ kind: 'clear-sleeping', paneKey: ORIGINAL_PANE_KEY })
+    useAppStore.getState().clearSleepingAgentSession(ORIGINAL_PANE_KEY)
+
+    // Case 5: coordinator manual close is the same safe exact-tab retirement boundary.
+    seedWorkspace()
+    recordCompletedWorker()
+    closeTerminalTab(ORIGINAL_TAB_ID, {
+      force: true,
+      skipRunningProcessConfirm: true,
+      localPtyTeardownOwnedExternally: true
+    })
+    expect(useAppStore.getState().sleepingAgentSessionsByPaneKey[ORIGINAL_PANE_KEY]).toBeUndefined()
+    expectCanaryUnchanged()
+
+    // Case 6: normal Codex exit leaves the shell pane; helper close retires only the helper.
+    seedWorkspace({ helper: true })
+    recordCompletedWorker()
+    useAppStore.setState({
+      sleepingAgentSessionsByPaneKey: {
+        ...useAppStore.getState().sleepingAgentSessionsByPaneKey,
+        [HELPER_PANE_KEY]: {
+          paneKey: HELPER_PANE_KEY,
+          tabId: HELPER_TAB_ID,
+          worktreeId: WORKTREE_ID,
+          agent: 'codex',
+          providerSession: { key: 'session_id', id: 'unrelated-helper-session' },
+          prompt: 'helper',
+          state: 'working',
+          capturedAt: 1,
+          updatedAt: 1,
+          origin: 'live'
+        }
+      }
+    })
+    useAppStore.getState().removeAgentStatus(ORIGINAL_PANE_KEY)
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE_ID]?.[0]).toMatchObject({
+      id: ORIGINAL_TAB_ID,
+      ptyId: ORIGINAL_PTY_ID
+    })
+    expect(useAppStore.getState().terminalLayoutsByTabId[ORIGINAL_TAB_ID]).toEqual(
+      makeLayout(ORIGINAL_LEAF_ID, ORIGINAL_PTY_ID)
+    )
+    closeTerminalTab(HELPER_TAB_ID, {
+      force: true,
+      skipRunningProcessConfirm: true,
+      localPtyTeardownOwnedExternally: true
+    })
+    expect(useAppStore.getState().sleepingAgentSessionsByPaneKey[HELPER_PANE_KEY]).toBeUndefined()
+    expect(useAppStore.getState().sleepingAgentSessionsByPaneKey[ORIGINAL_PANE_KEY]).toBeDefined()
+    expect(resumeSleepingAgentSessionsForWorktree(WORKTREE_ID)).toBe(0)
+    expectCanaryUnchanged()
+
+    // Case 7: restart preserves owned panes, while post-retirement restart keeps authority absent.
+    seedWorkspace()
+    const workingProviderSession = recordWorkingWorker()
+    const beforeCompletion = persistAndParseCurrentSession()
+    expect(beforeCompletion.tabsByWorktree[WORKTREE_ID]?.[0]).toMatchObject({
+      id: ORIGINAL_TAB_ID,
+      ptyId: ORIGINAL_PTY_ID
+    })
+    expect(beforeCompletion.sleepingAgentSessionsByPaneKey?.[ORIGINAL_PANE_KEY]).toMatchObject({
+      state: 'working',
+      origin: 'live',
+      providerSession: workingProviderSession
+    })
+    await hydrateSession(beforeCompletion)
+    activateAndRevealWorktree(WORKTREE_ID, { notifyHostRuntime: false })
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE_ID]?.[0]?.id).toBe(ORIGINAL_TAB_ID)
+    expect(Object.keys(useAppStore.getState().pendingStartupByTabId)).toEqual([])
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE_ID]?.[0]?.ptyId).toBe(ORIGINAL_PTY_ID)
+    expect(useAppStore.getState().ptyIdsByTabId[ORIGINAL_TAB_ID]).toEqual([ORIGINAL_PTY_ID])
+    completeRecordedWorker(recordWorkingWorker())
+    const afterCompletion = persistAndParseCurrentSession()
+    expect(afterCompletion.tabsByWorktree[WORKTREE_ID]?.[0]).toMatchObject({
+      id: ORIGINAL_TAB_ID,
+      ptyId: ORIGINAL_PTY_ID
+    })
+    expect(afterCompletion.terminalLayoutsByTabId[ORIGINAL_TAB_ID]?.ptyIdsByLeafId).toEqual({
+      [ORIGINAL_LEAF_ID]: ORIGINAL_PTY_ID
+    })
+    expect(afterCompletion.sleepingAgentSessionsByPaneKey?.[ORIGINAL_PANE_KEY]).toBeDefined()
+    await hydrateSession(afterCompletion)
+    activateAndRevealWorktree(WORKTREE_ID, { notifyHostRuntime: false })
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE_ID]?.[0]?.id).toBe(ORIGINAL_TAB_ID)
+    expect(Object.keys(useAppStore.getState().pendingStartupByTabId)).toEqual([])
+    expect(useAppStore.getState().tabsByWorktree[CANARY_WORKTREE_ID]?.[0]?.id).toBe(CANARY_TAB_ID)
+
+    activateAndRevealWorktree(CANARY_WORKTREE_ID, { notifyHostRuntime: false })
+    useAppStore.getState().removeAgentStatus(ORIGINAL_PANE_KEY)
+    useAppStore.getState().closeTab(ORIGINAL_TAB_ID, { reason: 'pty-exit' })
+    await releaseCompletedWorker('exited')
+    const restartAfterRetirement = persistAndParseCurrentSession()
+    await hydrateSession(restartAfterRetirement)
+
+    // Case 8: first activation of the never-visited target cannot resurrect retired authority.
+    const beforeActivation = useAppStore.getState()
+    expect(beforeActivation.everActivatedWorktreeIds.has(WORKTREE_ID)).toBe(false)
+    expect(beforeActivation.agentStatusByPaneKey[ORIGINAL_PANE_KEY]).toBeUndefined()
+    expect(beforeActivation.sleepingAgentSessionsByPaneKey[ORIGINAL_PANE_KEY]).toBeUndefined()
+    expect(Object.keys(beforeActivation.pendingStartupByTabId)).toEqual([])
+    const tabCountBeforeActivation = beforeActivation.tabsByWorktree[WORKTREE_ID]?.length ?? 0
+    activateAndRevealWorktree(WORKTREE_ID, { notifyHostRuntime: false })
+    const activated = useAppStore.getState()
+    const replacementTabs = (activated.tabsByWorktree[WORKTREE_ID] ?? []).filter(
+      (tab) => tab.id !== ORIGINAL_TAB_ID
+    )
+    // The provider-ownership gate separately proves this request becomes one transport spawn.
+    const coldSpawnRequests = replacementTabs.flatMap((tab) => {
+      const startup = activated.pendingStartupByTabId[tab.id]
+      if (!startup?.resumeProviderSession) {
+        return []
+      }
+      const tokens = tokenizeStartupCommand(startup.command, 'posix')
+      expect(tokens.ok).toBe(true)
+      const showSessionRestoredBanner = vi.fn()
+      seedStartupSessionRestoredBanner(startup, 1, showSessionRestoredBanner)
+      return [
+        {
+          providerSession: startup.resumeProviderSession,
+          command: startup.command,
+          argv: tokens.ok ? tokens.tokens : [],
+          restoredBannerCount: showSessionRestoredBanner.mock.calls.length
+        }
+      ]
+    })
+
+    expect(tabCountBeforeActivation).toBe(0)
+    expect(replacementTabs).toHaveLength(1)
+    expect(activated.tabsByWorktree[WORKTREE_ID]?.some((tab) => tab.id === ORIGINAL_TAB_ID)).toBe(
+      false
+    )
+    expect(activated.terminalLayoutsByTabId[ORIGINAL_TAB_ID]).toBeUndefined()
+    expect(activated.ptyIdsByTabId[ORIGINAL_TAB_ID]).toBeUndefined()
+    expect(coldSpawnRequests).toEqual([])
+    expectCanaryUnchanged()
+    expect(Object.keys(activated.pendingStartupByTabId)).toHaveLength(0)
+    expect(Object.keys(activated.automaticAgentResumeClaimsByTabId)).toHaveLength(0)
+
+    // Required invariant: explicit completion plus retirement must revoke provider-resume authority.
+    expect(coldSpawnRequests).toEqual([])
+  })
+})
diff --git a/tests/e2e/fixtures/daemon-generation-legacy-close-client.ts b/tests/e2e/fixtures/daemon-generation-legacy-close-client.ts
index b9bbb621597..730ebbeffc9 100644
--- a/tests/e2e/fixtures/daemon-generation-legacy-close-client.ts
+++ b/tests/e2e/fixtures/daemon-generation-legacy-close-client.ts
@@ -62,7 +62,7 @@ const OBSERVER = {
 
 function readConfig(): FixtureConfig {
   const configIndex = process.argv.indexOf('--config')
-  const configPath = configIndex >= 0 ? process.argv[configIndex + 1] : undefined
+  const configPath = configIndex !== -1 ? process.argv[configIndex + 1] : undefined
   if (!configPath) {
     throw new Error('Legacy close client requires --config <path>')
   }
diff --git a/tests/e2e/fixtures/daemon-generation-reconnect-client.ts b/tests/e2e/fixtures/daemon-generation-reconnect-client.ts
index 28c0a6686a7..6bd163cc474 100644
--- a/tests/e2e/fixtures/daemon-generation-reconnect-client.ts
+++ b/tests/e2e/fixtures/daemon-generation-reconnect-client.ts
@@ -41,7 +41,7 @@ const MAX_OUTPUT_CHARS = 32_768
 
 function readConfig(): ClientConfig {
   const configIndex = process.argv.indexOf('--config')
-  const configPath = configIndex >= 0 ? process.argv[configIndex + 1] : undefined
+  const configPath = configIndex !== -1 ? process.argv[configIndex + 1] : undefined
   if (!configPath) {
     throw new Error('Reconnect client requires --config <path>')
   }
diff --git a/tests/e2e/fixtures/terminal-link-mouse-owner-fixture.cjs b/tests/e2e/fixtures/terminal-link-mouse-owner-fixture.cjs
new file mode 100644
index 00000000000..afb3bd9d0b8
--- /dev/null
+++ b/tests/e2e/fixtures/terminal-link-mouse-owner-fixture.cjs
@@ -0,0 +1,49 @@
+const fs = require('node:fs')
+
+const ESC = '\x1b'
+const LINK = 'https://example.com/sta-3888'
+const OSC_LINK_TEXT = 'STA_3888_OSC_LINK'
+const SGR_MOUSE_REPORT_PATTERN = new RegExp(String.raw`\x1b\[<\d+;\d+;\d+[Mm]`, 'g')
+const logPath = process.argv[2]
+const linkMode = process.argv[3] ?? 'http'
+let pending = ''
+
+if (!logPath) {
+  throw new Error('Expected a mouse-report log path')
+}
+
+function cleanup() {
+  process.stdout.write(`${ESC}[?1000l${ESC}[?1006l${ESC}[?25h${ESC}[?1049l`)
+  process.exit(0)
+}
+
+process.stdin.setEncoding('utf8')
+if (process.stdin.isTTY) {
+  process.stdin.setRawMode(true)
+}
+process.stdin.resume()
+
+const renderedLink =
+  linkMode === 'osc' ? `${ESC}]8;;${LINK}\x07${OSC_LINK_TEXT}${ESC}]8;;\x07` : LINK
+process.stdout.write(
+  `${ESC}[?1049h${ESC}[?1000h${ESC}[?1006h${ESC}[?25l${ESC}[2J${ESC}[H` +
+    `LINK_MOUSE_READY ${renderedLink}\r\nPress q to exit`
+)
+
+process.stdin.on('data', (chunk) => {
+  if (chunk.includes('\x03') || chunk.includes('q')) {
+    cleanup()
+  }
+
+  pending += String(chunk)
+  const reports = pending.match(SGR_MOUSE_REPORT_PATTERN) ?? []
+  if (reports.length > 0) {
+    const encodedReports = reports.map((report) => Buffer.from(report).toString('hex')).join('\n')
+    fs.appendFileSync(logPath, `${encodedReports}\n`)
+    pending = pending.slice(pending.lastIndexOf(reports.at(-1)) + reports.at(-1).length)
+  } else {
+    pending = pending.slice(-64)
+  }
+})
+
+process.on('SIGINT', cleanup)
diff --git a/tests/e2e/fixtures/visible-tui-scroll-fixture.cjs b/tests/e2e/fixtures/visible-tui-scroll-fixture.cjs
index 3702ad21a9f..63b7683916a 100644
--- a/tests/e2e/fixtures/visible-tui-scroll-fixture.cjs
+++ b/tests/e2e/fixtures/visible-tui-scroll-fixture.cjs
@@ -12,7 +12,7 @@ const MOUSE_REPORT_PATTERN = new RegExp(`${ESC}\\[<(64|65);\\d+;\\d+M`, 'g')
 //                  at 120 reports/s) instead of minimal rows.
 const args = process.argv.slice(2)
 const logIndex = args.indexOf('--log')
-const LOG_PATH = logIndex >= 0 ? args[logIndex + 1] : null
+const LOG_PATH = logIndex !== -1 ? args[logIndex + 1] : null
 const HEAVY_FRAMES = args.includes('--heavy')
 
 let offset = 0
diff --git a/tests/e2e/floating-tab-rename.spec.ts b/tests/e2e/floating-tab-rename.spec.ts
index 7f9dca4b7b9..94efe4650ee 100644
--- a/tests/e2e/floating-tab-rename.spec.ts
+++ b/tests/e2e/floating-tab-rename.spec.ts
@@ -80,7 +80,15 @@ async function openFloatingPanel(page: Page): Promise<void> {
     PANEL_SELECTOR,
     { timeout: 30_000 }
   )
-  await page.evaluate(() => window.dispatchEvent(new Event('orca-toggle-floating-terminal')))
+  // Why: the panel's open flag is persisted (floating-terminal-panel-view-state), so
+  // after a restart it reopens on its own and a blind toggle would close it again.
+  const alreadyOpen = await page.evaluate(
+    (selector) => Boolean(document.querySelector(selector)),
+    OPEN_PANEL_SELECTOR
+  )
+  if (!alreadyOpen) {
+    await page.evaluate(() => window.dispatchEvent(new Event('orca-toggle-floating-terminal')))
+  }
   await expect(page.locator(OPEN_PANEL_SELECTOR)).toBeVisible()
 }
 
diff --git a/tests/e2e/git-history-tooltip-wrap.spec.ts b/tests/e2e/git-history-tooltip-wrap.spec.ts
new file mode 100644
index 00000000000..6a8c4f5895b
--- /dev/null
+++ b/tests/e2e/git-history-tooltip-wrap.spec.ts
@@ -0,0 +1,144 @@
+import { execFileSync } from 'node:child_process'
+import { rmSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { expect, test } from './helpers/orca-app'
+import { waitForSessionReady } from './helpers/store'
+import { openSourceControlForWorktree } from './helpers/worktree-registration'
+
+const subject = 'brew-install: source shared brew context before resolving prefixes'
+const reportedLine = 'Sources bin/lib/brew-context.sh, mirroring the brew-install update:'
+const conventionalLine = 'Keep this conventional commit-message body line intact through column 72'
+const unbrokenLine = `https://example.com/${'commit-message-segment-'.repeat(8)}`
+const commitMessage = `${subject}
+
+${reportedLine}
+${conventionalLine}
+${unbrokenLine}
+the resolved prefix list now feeds both the cask audit and the formula
+path checks, so a missing context aborts before any network call runs.
+
+Verified by running the full tap audit locally with both prefixes set.`
+
+function createCommitWorktree(repoPath: string): { branchName: string; worktreePath: string } {
+  const suffix = `${Date.now()}-${Math.random().toString(16).slice(2)}`
+  const branchName = `e2e-tooltip-wrap-${suffix}`
+  const worktreePath = path.join(os.tmpdir(), branchName)
+  execFileSync('git', ['worktree', 'add', worktreePath, '-b', branchName], {
+    cwd: repoPath,
+    stdio: 'pipe'
+  })
+  return { branchName, worktreePath }
+}
+
+async function cleanupCommitWorktree(
+  repoPath: string,
+  worktreePath: string,
+  branchName: string
+): Promise<void> {
+  try {
+    execFileSync('git', ['worktree', 'remove', '--force', worktreePath], {
+      cwd: repoPath,
+      stdio: 'pipe'
+    })
+  } catch {
+    rmSync(worktreePath, { recursive: true, force: true })
+    execFileSync('git', ['worktree', 'prune'], { cwd: repoPath, stdio: 'pipe' })
+  }
+  execFileSync('git', ['branch', '-D', branchName], { cwd: repoPath, stdio: 'pipe' })
+}
+
+test('keeps conventional commit-message lines intact in the history tooltip', async ({
+  orcaPage,
+  testRepoPath,
+  registerPostElectronShutdownCleanup
+}) => {
+  const fixture = createCommitWorktree(testRepoPath)
+  registerPostElectronShutdownCleanup(() =>
+    cleanupCommitWorktree(testRepoPath, fixture.worktreePath, fixture.branchName)
+  )
+  execFileSync('git', ['commit', '--allow-empty', '--file', '-'], {
+    cwd: fixture.worktreePath,
+    input: commitMessage,
+    stdio: ['pipe', 'pipe', 'pipe']
+  })
+
+  await orcaPage.setViewportSize({ width: 1440, height: 900 })
+  await waitForSessionReady(orcaPage)
+  await openSourceControlForWorktree(orcaPage, testRepoPath, fixture.worktreePath)
+
+  const commitsToggle = orcaPage.getByRole('button', { name: /Commits/ })
+  await expect(commitsToggle).toBeVisible()
+  await commitsToggle.click()
+
+  const row = orcaPage.getByTestId('git-history-row').filter({ hasText: subject })
+  await expect(row).toBeVisible({ timeout: 10_000 })
+  const trigger = row.locator('[data-slot="tooltip-trigger"]').filter({ hasText: subject })
+  await trigger.hover({ position: { x: 20, y: 10 } })
+  await trigger.hover({ position: { x: 40, y: 10 } })
+
+  const tooltip = orcaPage
+    .locator('[data-slot="tooltip-content"]')
+    .filter({ hasText: reportedLine })
+  await expect(tooltip).toBeVisible()
+  await expect(tooltip).toContainText(commitMessage)
+  await orcaPage.evaluate(async () => {
+    await document.fonts.ready
+  })
+
+  const layout = await tooltip.evaluate(
+    (element, targetLines) => {
+      const walker = document.createTreeWalker(element, NodeFilter.SHOW_TEXT)
+      let textNode: Text | null = null
+      while (walker.nextNode()) {
+        const candidate = walker.currentNode as Text
+        if (targetLines.every((line) => candidate.data.includes(line))) {
+          textNode = candidate
+          break
+        }
+      }
+      if (!textNode) {
+        throw new Error('Commit message text node was not found in the tooltip')
+      }
+
+      const visualLineCounts = targetLines.map((targetLine) => {
+        const start = textNode.data.indexOf(targetLine)
+        const range = document.createRange()
+        range.setStart(textNode, start)
+        range.setEnd(textNode, start + targetLine.length)
+        const rectTops = Array.from(range.getClientRects())
+          .filter((rect) => rect.width > 0.5)
+          .map((rect) => rect.top)
+        const visualLineTops = rectTops.reduce<number[]>((tops, top) => {
+          if (!tops.some((existing) => Math.abs(existing - top) < 2)) {
+            tops.push(top)
+          }
+          return tops
+        }, [])
+        return visualLineTops.length
+      })
+
+      const style = getComputedStyle(element)
+      const tooltipRect = element.getBoundingClientRect()
+      return {
+        visualLineCounts,
+        tooltipLeft: tooltipRect.left,
+        tooltipRight: tooltipRect.right,
+        tooltipWidth: tooltipRect.width,
+        viewportWidth: window.innerWidth,
+        overflowContained: element.scrollWidth <= element.clientWidth,
+        textWrap: style.textWrap,
+        whiteSpace: style.whiteSpace
+      }
+    },
+    [reportedLine, conventionalLine]
+  )
+
+  expect(layout.whiteSpace).toBe('pre-wrap')
+  expect(layout.tooltipWidth).toBeGreaterThan(0)
+  expect(layout.tooltipLeft).toBeGreaterThanOrEqual(0)
+  expect(layout.tooltipRight).toBeLessThanOrEqual(layout.viewportWidth)
+  expect(layout.visualLineCounts).toEqual([1, 1])
+  expect(layout.overflowContained).toBe(true)
+  expect(layout.textWrap).toBe('wrap')
+})
diff --git a/tests/e2e/github-created-issue-start-prefill.spec.ts b/tests/e2e/github-created-issue-start-prefill.spec.ts
index c3e6d40820a..50d08acc0dd 100644
--- a/tests/e2e/github-created-issue-start-prefill.spec.ts
+++ b/tests/e2e/github-created-issue-start-prefill.spec.ts
@@ -119,11 +119,17 @@ function configureGitHubRemote(repoPath: string): void {
   })
 }
 
-test('starting a just-created GitHub issue launches Claude with its URL prefilled', async ({
-  orcaPage,
-  testRepoPath
-}) => {
+// Why: the remote must exist before Electron launches. `repos.add` probes the
+// remote once, and a settled "no remote" both makes the repo ineligible for the
+// tasks page (disabling "New GitHub issue") and suppresses re-probes for five
+// minutes — so adding origin inside the test body can never recover.
+test.beforeAll(({ testRepoPath }) => {
   configureGitHubRemote(testRepoPath)
+})
+
+test('starting a just-created GitHub issue launches Claude with its URL prefilled', async ({
+  orcaPage
+}) => {
   await waitForSessionReady(orcaPage)
   await waitForActiveWorktree(orcaPage)
 
@@ -167,6 +173,17 @@ test('starting a just-created GitHub issue launches Claude with its URL prefille
 
   await orcaPage.getByRole('button', { name: 'Start workspace from issue' }).click()
 
+  // Why: starting a GitHub issue now routes through the quick-create composer,
+  // which carries the linked issue URL into the agent launch command on submit.
+  const composer = orcaPage.getByRole('dialog', { name: /Create (workspace|worktree)/i })
+  await expect(composer).toBeVisible({ timeout: 15_000 })
+  const createWorkspaceButton = composer.getByRole('button', {
+    name: /Create (workspace|worktree)/i
+  })
+  await expect(createWorkspaceButton).toBeEnabled({ timeout: 15_000 })
+  await createWorkspaceButton.click()
+  await expect(composer).toBeHidden({ timeout: 20_000 })
+
   let terminalText = ''
   await expect
     .poll(
diff --git a/tests/e2e/golden-core-flows.spec.ts b/tests/e2e/golden-core-flows.spec.ts
index c510ce7a68f..96863251081 100644
--- a/tests/e2e/golden-core-flows.spec.ts
+++ b/tests/e2e/golden-core-flows.spec.ts
@@ -16,7 +16,6 @@ import {
 
 const tempRoots: string[] = []
 const SORTABLE_TAB = '[data-testid="sortable-tab"]'
-const REPO_STEP_HEADING = /Point Orca at some code/i
 const TASK_SOURCES_HEADING = /Set up GitHub tasks|Connect your task sources/i
 const WINDOWS_TERMINAL_HEADING = /Set Windows terminal defaults/i
 const ONBOARDING_ADVANCE_LABEL = /^Continue\b|^Add your first project\b/
@@ -161,7 +160,7 @@ async function continueThroughOptionalSetupToNotifications(page: Page): Promise<
   await expect(page.getByRole('heading', { name: /Set up notifications/i })).toBeVisible()
 }
 
-async function continueFromNotificationsToRepo(page: Page): Promise<void> {
+async function continueFromNotificationsToAddProject(page: Page): Promise<void> {
   await continueOnboarding(page)
   const taskSourcesVisible = await page
     .getByRole('heading', { name: TASK_SOURCES_HEADING })
@@ -179,22 +178,9 @@ async function continueFromNotificationsToRepo(page: Page): Promise<void> {
   if (windowsTerminalVisible) {
     await continueOnboarding(page)
   }
-  const repoHeading = page.getByRole('heading', { name: REPO_STEP_HEADING })
-  const addProjectDialog = page.getByRole('dialog', { name: /Add a project/i })
-  await expect
-    .poll(
-      async () => {
-        if (await repoHeading.isVisible().catch(() => false)) {
-          return 'repo-step'
-        }
-        if (await addProjectDialog.isVisible().catch(() => false)) {
-          return 'add-project-dialog'
-        }
-        return 'waiting'
-      },
-      { timeout: 15_000 }
-    )
-    .not.toBe('waiting')
+  await expect(page.getByRole('dialog', { name: /Add a project/i })).toBeVisible({
+    timeout: 15_000
+  })
 }
 
 async function waitForRepoLoaded(page: Page, repoPath: string): Promise<void> {
@@ -457,16 +443,13 @@ test.describe('New-user golden core flow', () => {
     await continueThroughOptionalSetupToNotifications(orcaPage)
     await expect(orcaPage.getByRole('button', { name: /Send Test Notification/i })).toBeVisible()
     await chooseNotificationSound(orcaPage)
-    await continueFromNotificationsToRepo(orcaPage)
+    await continueFromNotificationsToAddProject(orcaPage)
 
     const repoPath = await createGitRepo('orca-e2e-golden-new-', 'golden-new-project')
     await chooseFolderInNativeDialog(electronApp, repoPath)
     await orcaPage
       .getByRole('button', { name: /Browse for a folder|Open a folder|Browse folder/i })
       .click()
-    await expect(orcaPage.getByRole('heading', { name: REPO_STEP_HEADING })).toHaveCount(0, {
-      timeout: 30_000
-    })
     await waitForRepoLoaded(orcaPage, repoPath)
     await expectProjectVisible(orcaPage, repoPath)
     await waitForActiveWorktree(orcaPage)
diff --git a/tests/e2e/helpers/completed-worker-retirement-fixture.ts b/tests/e2e/helpers/completed-worker-retirement-fixture.ts
new file mode 100644
index 00000000000..564f52e2f5f
--- /dev/null
+++ b/tests/e2e/helpers/completed-worker-retirement-fixture.ts
@@ -0,0 +1,194 @@
+import { execFileSync } from 'node:child_process'
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import type { RuntimeClient } from '../../../src/cli/runtime-client'
+import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../../src/shared/orca-profiles'
+import type {
+  RuntimeTerminalListResult,
+  RuntimeTerminalSummary
+} from '../../../src/shared/runtime-types'
+
+const fakeCliDir = mkdtempSync(path.join(os.tmpdir(), 'orca-e2e-retired-worker-'))
+const lifecycleLedgerPath = path.join(fakeCliDir, 'codex-lifecycle.jsonl')
+const fakeCodexSource = `
+const { appendFileSync } = require('node:fs')
+const ledger = process.env.ORCA_E2E_CODEX_LIFECYCLE_LEDGER
+const append = (event) => appendFileSync(ledger, JSON.stringify({ pid: process.pid, ...event }) + '\\n')
+const args = process.argv.slice(2)
+if (args.includes('app-server')) {
+  process.stderr.write("error: unrecognized subcommand 'app-server'\\n")
+  process.exit(2)
+}
+append({ event: 'spawn', args })
+process.stdout.write('\\u001b]0;Codex Ready\\u0007OpenAI Codex\\nmodel: e2e\\ndirectory: e2e\\n')
+process.stdin.on('data', (chunk) => {
+  const input = chunk.toString()
+  append({ event: 'input', input })
+  if (input.includes('ORCA_E2E_EXIT_AFTER_DONE')) {
+    append({ event: 'normal-exit' })
+    process.exit(0)
+  }
+  if (input.includes('\\r')) process.stdout.write('ACK\\n')
+})
+process.stdin.resume()
+setInterval(() => {}, 60_000)
+`
+
+if (process.platform === 'win32') {
+  writeFileSync(path.join(fakeCliDir, 'fake-codex.js'), fakeCodexSource)
+  writeFileSync(
+    path.join(fakeCliDir, 'codex.cmd'),
+    '@echo off\r\nnode "%~dp0\\fake-codex.js" %*\r\n'
+  )
+} else {
+  const executable = path.join(fakeCliDir, 'codex')
+  writeFileSync(executable, `#!/usr/bin/env node\n${fakeCodexSource}`)
+  chmodSync(executable, 0o755)
+}
+
+export const completedWorkerLaunchEnv = {
+  PATH: `${fakeCliDir}${path.delimiter}${process.env.PATH ?? ''}`,
+  ORCA_E2E_CODEX_LIFECYCLE_LEDGER: lifecycleLedgerPath
+}
+
+export type LifecycleEvent = {
+  pid: number
+  event: 'spawn' | 'input' | 'normal-exit'
+  args?: string[]
+  input?: string
+}
+
+export type TerminalIdentity = Pick<
+  RuntimeTerminalSummary,
+  'handle' | 'incarnationId' | 'leafId' | 'ptyId' | 'tabId' | 'worktreeId'
+>
+
+export function clearCompletedWorkerLedger(): void {
+  rmSync(lifecycleLedgerPath, { force: true })
+}
+
+export function cleanupCompletedWorkerFixture(): void {
+  rmSync(fakeCliDir, { recursive: true, force: true })
+}
+
+export function readCompletedWorkerLedger(): LifecycleEvent[] {
+  if (!existsSync(lifecycleLedgerPath)) {
+    return []
+  }
+  const contents = readFileSync(lifecycleLedgerPath, 'utf8')
+  const lastCompleteLine = contents.lastIndexOf('\n')
+  if (lastCompleteLine === -1) {
+    return []
+  }
+  return contents
+    .slice(0, lastCompleteLine)
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map((line) => JSON.parse(line) as LifecycleEvent)
+}
+
+export function readCompletedWorkerDispatchCapability(): string | null {
+  const input = readCompletedWorkerLedger()
+    .filter((event) => event.event === 'input')
+    .map((event) => event.input ?? '')
+    .join('')
+  return input.match(/--dispatch-capability\s+(\S+)/)?.[1] ?? null
+}
+
+export function runBuiltOrcaCli(
+  args: string[],
+  options: { userDataDir: string; cwd: string }
+): unknown {
+  const {
+    ORCA_ENVIRONMENT: _environment,
+    ORCA_PAIRING_CODE: _pairingCode,
+    ORCA_USER_DATA_PATH: _userDataPath,
+    ...cleanEnv
+  } = process.env
+  void _environment
+  void _pairingCode
+  void _userDataPath
+  const output = execFileSync(
+    process.execPath,
+    [path.join(process.cwd(), 'out', 'cli', 'index.js'), ...args],
+    {
+      cwd: options.cwd,
+      env: { ...cleanEnv, ORCA_USER_DATA_PATH: options.userDataDir },
+      encoding: 'utf8',
+      timeout: 30_000
+    }
+  )
+  return JSON.parse(output) as unknown
+}
+
+export function seedCurrentCodexTranscript(
+  isolatedHome: string,
+  providerSessionId: string,
+  cwd: string
+): string {
+  const now = new Date()
+  const transcriptDir = path.join(
+    isolatedHome,
+    '.codex',
+    'sessions',
+    String(now.getUTCFullYear()),
+    String(now.getUTCMonth() + 1).padStart(2, '0'),
+    String(now.getUTCDate()).padStart(2, '0')
+  )
+  mkdirSync(transcriptDir, { recursive: true })
+  const transcriptPath = path.join(transcriptDir, `rollout-${providerSessionId}.jsonl`)
+  writeFileSync(
+    transcriptPath,
+    `${JSON.stringify({
+      timestamp: now.toISOString(),
+      type: 'session_meta',
+      payload: { id: providerSessionId, cwd }
+    })}\n`
+  )
+  return transcriptPath
+}
+
+export function terminalIdentity(terminal: RuntimeTerminalSummary): TerminalIdentity {
+  const { handle, incarnationId, leafId, ptyId, tabId, worktreeId } = terminal
+  return { handle, incarnationId, leafId, ptyId, tabId, worktreeId }
+}
+
+export async function listRuntimeTerminals(
+  client: RuntimeClient
+): Promise<RuntimeTerminalSummary[]> {
+  return (await client.call<RuntimeTerminalListResult>('terminal.list')).result.terminals
+}
+
+export function readPersistedWorkerRecoveryRecord(userDataDir: string, paneKey: string) {
+  const dataPath = path.join(
+    userDataDir,
+    'profiles',
+    DEFAULT_LOCAL_ORCA_PROFILE_ID,
+    'orca-data.json'
+  )
+  if (!existsSync(dataPath)) {
+    return null
+  }
+  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as {
+    workspaceSession?: {
+      sleepingAgentSessionsByPaneKey?: Record<
+        string,
+        {
+          origin?: unknown
+          state?: unknown
+          providerSession?: { id?: unknown }
+        }
+      >
+    }
+  }
+  return data.workspaceSession?.sleepingAgentSessionsByPaneKey?.[paneKey] ?? null
+}
diff --git a/tests/e2e/helpers/paired-terminal-parking-fixture.ts b/tests/e2e/helpers/paired-terminal-parking-fixture.ts
index c49917cb24f..f7632869d3e 100644
--- a/tests/e2e/helpers/paired-terminal-parking-fixture.ts
+++ b/tests/e2e/helpers/paired-terminal-parking-fixture.ts
@@ -4,6 +4,9 @@ import path from 'node:path'
 
 const FILL_ROWS = 6_000
 const FLOOD_ROWS = 4_000
+const TITLE_FRAME_INTERVAL_MS = 70
+const TITLE_FRAME_COUNT = 30
+const TITLE_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏']
 
 function shellQuote(value: string): string {
   return `'${value.replaceAll("'", `'\\''`)}'`
@@ -31,6 +34,29 @@ export function createPairedTerminalParkingFixture(): {
       "process.stdin.setEncoding('utf8')",
       "process.stdin.on('data', (data) => {",
       '  for (const command of data.split(/\\r\\n|\\r|\\n/).filter(Boolean)) {',
+      "    if (command.startsWith('TITLE_START:')) {",
+      "      const token = command.slice('TITLE_START:'.length)",
+      "      process.stdout.write('\\u001b]0;⠋ Cursor Agent\\u0007')",
+      '      process.stdout.write(`TITLE_STARTED:${token}\\r\\n`)',
+      '      continue',
+      '    }',
+      "    if (command.startsWith('TITLE_ANIMATE:')) {",
+      "      const token = command.slice('TITLE_ANIMATE:'.length)",
+      `      const frames = ${JSON.stringify(TITLE_FRAMES)}`,
+      '      let frameIndex = 0',
+      '      const emitFrame = () => {',
+      `        if (frameIndex < ${TITLE_FRAME_COUNT}) {`,
+      '          process.stdout.write(`\\u001b]0;${frames[frameIndex % frames.length]} Cursor Agent\\u0007`)',
+      '          frameIndex += 1',
+      `          setTimeout(emitFrame, ${TITLE_FRAME_INTERVAL_MS})`,
+      '          return',
+      '        }',
+      "        process.stdout.write('\\u001b]0;Cursor ready\\u0007')",
+      '        process.stdout.write(`TITLE_DONE:${token}\\r\\n`)',
+      '      }',
+      `      setTimeout(emitFrame, ${TITLE_FRAME_INTERVAL_MS})`,
+      '      continue',
+      '    }',
       "    if (command.startsWith('FLOOD:')) {",
       "      const token = command.slice('FLOOD:'.length)",
       `      for (let row = 0; row < ${FLOOD_ROWS}; row += 1) process.stdout.write(\`flood-${'${token}'}-${'${row}'}-${'x'.repeat(80)}\\r\\n\`)`,
diff --git a/tests/e2e/helpers/paired-terminal-parking-oracle.ts b/tests/e2e/helpers/paired-terminal-parking-oracle.ts
index 070c73cceb1..c1a385b2162 100644
--- a/tests/e2e/helpers/paired-terminal-parking-oracle.ts
+++ b/tests/e2e/helpers/paired-terminal-parking-oracle.ts
@@ -12,6 +12,7 @@ import {
 import { expect } from './orca-app'
 import { verifyHiddenPairedTerminalOutputSuppression } from './paired-terminal-hidden-output-oracle'
 import { createPairedTerminalParkingFixture } from './paired-terminal-parking-fixture'
+import { verifyPairedTerminalTitleFanout } from './paired-terminal-title-fanout-oracle'
 import { getTerminalContent, waitForActivePanePtyId } from './terminal'
 
 const TARGET_WORKTREE_COUNT = 6
@@ -135,6 +136,7 @@ export async function runPairedTerminalParkingOracle(
     await expectHostTerminalsUnmounted(options.hostPage, seed.fallbackWorktreeId, remoteTabs)
 
     const hiddenFloodTokens = await verifyHiddenPairedTerminalOutputSuppression(page, remoteTabs)
+    await verifyPairedTerminalTitleFanout(page, remoteTabs)
     const baseline = await readPairedRetentionSample(
       page,
       remoteTabs.map((tab) => tab.tabId)
diff --git a/tests/e2e/helpers/paired-terminal-title-fanout-oracle.ts b/tests/e2e/helpers/paired-terminal-title-fanout-oracle.ts
new file mode 100644
index 00000000000..24b686997b7
--- /dev/null
+++ b/tests/e2e/helpers/paired-terminal-title-fanout-oracle.ts
@@ -0,0 +1,310 @@
+import type { Page } from '@stablyai/playwright-test'
+import type { RuntimeTerminalRead } from '../../../src/shared/runtime-types'
+import { TERMINAL_PAIRED_PARKING_RUNTIME_CAPABILITY } from '../../../src/shared/protocol-version'
+import { expect } from './orca-app'
+
+const INITIAL_TITLE = '⠋ Cursor Agent'
+const FINAL_TITLE = 'Cursor ready'
+
+type TitleTarget = {
+  tabId: string
+  terminal: string
+  worktreeId: string
+}
+
+type TitleTransportEvent = {
+  decodedEnvelopeBytes: number
+  snapshotVersion: number
+  title: string
+  worktreeId: string
+}
+
+type TitleStoreChange = {
+  title: string
+  worktreeId: string
+}
+
+type TitleProbeSample = {
+  storeChanges: TitleStoreChange[]
+  transportEvents: TitleTransportEvent[]
+}
+
+type BrowserTitleProbe = TitleProbeSample & {
+  lastTitles: Record<string, string | null>
+  responseCount: number
+  subscription: null | { unsubscribe: () => void }
+  unsubscribeStore: null | (() => void)
+}
+
+async function callRuntime<TResult>(page: Page, method: string, params: unknown): Promise<TResult> {
+  return page.evaluate(
+    async ({ method, params }) => {
+      const response = await window.api.runtime.call({ method, params })
+      if (!response.ok) {
+        throw new Error(`${response.error.code}: ${response.error.message}`)
+      }
+      return response.result
+    },
+    { method, params }
+  ) as Promise<TResult>
+}
+
+export async function verifyPairedTerminalTitleFanout(
+  page: Page,
+  targets: TitleTarget[]
+): Promise<void> {
+  const tokens = targets.map((_, index) => `TITLE_FANOUT_${index}_${Date.now()}`)
+  await installTitleProbe(page, targets)
+  try {
+    await expect.poll(() => readProbeResponseCount(page), { timeout: 30_000 }).toBeGreaterThan(0)
+    await resetTitleProbe(page, targets)
+
+    await Promise.all(
+      targets.map((target, index) =>
+        sendFixtureCommand(page, target, `TITLE_START:${tokens[index]}`)
+      )
+    )
+    await expectTitles(page, targets, INITIAL_TITLE)
+    await expect
+      .poll(async () => (await readTitleProbe(page)).transportEvents.length, { timeout: 30_000 })
+      .toBeGreaterThanOrEqual(targets.length)
+
+    await Promise.all(
+      targets.map((target, index) =>
+        sendFixtureCommand(page, target, `TITLE_ANIMATE:${tokens[index]}`)
+      )
+    )
+    await expectFixtureCompletion(page, targets, tokens)
+    await expectTitles(page, targets, FINAL_TITLE)
+    await expect
+      .poll(async () => (await readTitleProbe(page)).transportEvents.length, { timeout: 30_000 })
+      .toBeGreaterThanOrEqual(targets.length * 2)
+
+    const sample = await readTitleProbe(page)
+    expectTitleFanoutSample(sample, targets)
+  } finally {
+    await disposeTitleProbe(page)
+  }
+}
+
+async function installTitleProbe(page: Page, targets: TitleTarget[]): Promise<void> {
+  await page.evaluate(
+    async ({ targets, capability }) => {
+      const store = window.__store
+      if (!store) {
+        throw new Error('Renderer store is unavailable')
+      }
+      const environmentId = Array.from(
+        store.getState().runtimeStatusByEnvironmentId.entries()
+      ).find(([, entry]) => entry.status?.capabilities?.includes(capability))?.[0]
+      if (!environmentId) {
+        throw new Error('Paired runtime environment is unavailable')
+      }
+      const titleFor = (
+        state: ReturnType<typeof store.getState>,
+        target: (typeof targets)[number]
+      ) =>
+        state.tabsByWorktree[target.worktreeId]?.find((tab) => tab.id === target.tabId)?.title ??
+        null
+      const probe = {
+        responseCount: 0,
+        storeChanges: [] as TitleStoreChange[],
+        transportEvents: [] as TitleTransportEvent[],
+        lastTitles: Object.fromEntries(
+          targets.map((target) => [target.worktreeId, titleFor(store.getState(), target)])
+        ),
+        subscription: null as null | { unsubscribe: () => void },
+        unsubscribeStore: null as null | (() => void)
+      }
+      probe.unsubscribeStore = store.subscribe((state) => {
+        for (const target of targets) {
+          const title = titleFor(state, target)
+          if (title === null || title === probe.lastTitles[target.worktreeId]) {
+            continue
+          }
+          probe.lastTitles[target.worktreeId] = title
+          probe.storeChanges.push({ worktreeId: target.worktreeId, title })
+        }
+      })
+      probe.subscription = await window.api.runtimeEnvironments.subscribe(
+        { selector: environmentId, method: 'session.tabs.subscribeAll', params: {} },
+        {
+          onResponse: (response) => {
+            probe.responseCount += 1
+            if (!response.ok) {
+              return
+            }
+            const result = response.result as {
+              type?: string
+              worktree?: string
+              snapshotVersion?: number
+              tabs?: { type?: string; title?: string }[]
+              snapshots?: {
+                worktree?: string
+                snapshotVersion?: number
+                tabs?: { type?: string; title?: string }[]
+              }[]
+            }
+            const snapshots = result.type === 'snapshots' ? (result.snapshots ?? []) : [result]
+            const decodedEnvelopeBytes = new TextEncoder().encode(
+              JSON.stringify(response)
+            ).byteLength
+            for (const snapshot of snapshots) {
+              if (!targets.some((target) => target.worktreeId === snapshot.worktree)) {
+                continue
+              }
+              const title = snapshot.tabs?.find((tab) => tab.type === 'terminal')?.title
+              if (
+                typeof snapshot.worktree === 'string' &&
+                typeof snapshot.snapshotVersion === 'number' &&
+                typeof title === 'string'
+              ) {
+                probe.transportEvents.push({
+                  worktreeId: snapshot.worktree,
+                  snapshotVersion: snapshot.snapshotVersion,
+                  title,
+                  decodedEnvelopeBytes
+                })
+              }
+            }
+          }
+        }
+      )
+      Object.assign(globalThis, { __pairedTitleFanoutProbe: probe })
+    },
+    { targets, capability: TERMINAL_PAIRED_PARKING_RUNTIME_CAPABILITY }
+  )
+}
+
+async function resetTitleProbe(page: Page, targets: TitleTarget[]): Promise<void> {
+  await page.evaluate((targets) => {
+    const probe = (
+      globalThis as typeof globalThis & { __pairedTitleFanoutProbe?: BrowserTitleProbe }
+    ).__pairedTitleFanoutProbe
+    if (!probe) {
+      throw new Error('Paired title fanout probe is unavailable')
+    }
+    probe.transportEvents.length = 0
+    probe.storeChanges.length = 0
+    const state = window.__store?.getState()
+    for (const target of targets) {
+      probe.lastTitles[target.worktreeId] =
+        state?.tabsByWorktree[target.worktreeId]?.find((tab) => tab.id === target.tabId)?.title ??
+        null
+    }
+  }, targets)
+}
+
+async function readProbeResponseCount(page: Page): Promise<number> {
+  return page.evaluate(() => {
+    const probe = (
+      globalThis as typeof globalThis & { __pairedTitleFanoutProbe?: BrowserTitleProbe }
+    ).__pairedTitleFanoutProbe
+    if (!probe) {
+      throw new Error('Paired title fanout probe is unavailable')
+    }
+    return probe.responseCount
+  })
+}
+
+async function readTitleProbe(page: Page): Promise<TitleProbeSample> {
+  return page.evaluate(() => {
+    const probe = (
+      globalThis as typeof globalThis & { __pairedTitleFanoutProbe?: BrowserTitleProbe }
+    ).__pairedTitleFanoutProbe
+    if (!probe) {
+      throw new Error('Paired title fanout probe is unavailable')
+    }
+    return {
+      storeChanges: [...probe.storeChanges],
+      transportEvents: [...probe.transportEvents]
+    }
+  })
+}
+
+async function disposeTitleProbe(page: Page): Promise<void> {
+  await page
+    .evaluate(() => {
+      const probe = (
+        globalThis as typeof globalThis & { __pairedTitleFanoutProbe?: BrowserTitleProbe }
+      ).__pairedTitleFanoutProbe
+      if (!probe) {
+        return
+      }
+      probe.subscription?.unsubscribe()
+      probe.unsubscribeStore?.()
+      delete (globalThis as typeof globalThis & { __pairedTitleFanoutProbe?: unknown })
+        .__pairedTitleFanoutProbe
+    })
+    .catch(() => undefined)
+}
+
+async function sendFixtureCommand(page: Page, target: TitleTarget, text: string): Promise<void> {
+  await callRuntime(page, 'terminal.send', {
+    terminal: target.terminal,
+    text,
+    enter: true,
+    client: { id: 'paired-title-fanout-e2e', type: 'desktop' }
+  })
+}
+
+async function expectFixtureCompletion(
+  page: Page,
+  targets: TitleTarget[],
+  tokens: string[]
+): Promise<void> {
+  await expect
+    .poll(
+      async () =>
+        Promise.all(
+          targets.map(async (target, index) => {
+            const result = await callRuntime<{ terminal: RuntimeTerminalRead }>(
+              page,
+              'terminal.read',
+              { terminal: target.terminal, limit: 1_000 }
+            )
+            return result.terminal.tail.join('\n').includes(`TITLE_DONE:${tokens[index]}`)
+          })
+        ),
+      { timeout: 30_000 }
+    )
+    .toEqual(Array(targets.length).fill(true))
+}
+
+async function expectTitles(page: Page, targets: TitleTarget[], expected: string): Promise<void> {
+  await expect
+    .poll(
+      () =>
+        page.evaluate(
+          ({ targets, expected }) =>
+            targets.map(
+              (target) =>
+                window.__store
+                  ?.getState()
+                  .tabsByWorktree[target.worktreeId]?.find((tab) => tab.id === target.tabId)
+                  ?.title === expected
+            ),
+          { targets, expected }
+        ),
+      { timeout: 30_000 }
+    )
+    .toEqual(Array(targets.length).fill(true))
+}
+
+function expectTitleFanoutSample(sample: TitleProbeSample, targets: TitleTarget[]): void {
+  expect(sample.transportEvents).toHaveLength(targets.length * 2)
+  expect(sample.storeChanges).toHaveLength(targets.length * 2)
+  for (const target of targets) {
+    const transport = sample.transportEvents.filter(
+      (event) => event.worktreeId === target.worktreeId
+    )
+    expect(transport.map((event) => event.title)).toEqual([INITIAL_TITLE, FINAL_TITLE])
+    expect(transport[1]?.snapshotVersion).toBeGreaterThan(transport[0]?.snapshotVersion ?? 0)
+    expect(transport.every((event) => event.decodedEnvelopeBytes > 0)).toBe(true)
+    expect(
+      sample.storeChanges
+        .filter((change) => change.worktreeId === target.worktreeId)
+        .map((change) => change.title)
+    ).toEqual([INITIAL_TITLE, FINAL_TITLE])
+  }
+}
diff --git a/tests/e2e/helpers/source-control-ai-generation.ts b/tests/e2e/helpers/source-control-ai-generation.ts
index 149f6a019d3..f6be16d7342 100644
--- a/tests/e2e/helpers/source-control-ai-generation.ts
+++ b/tests/e2e/helpers/source-control-ai-generation.ts
@@ -42,12 +42,16 @@ export async function openChecks(page: Page, worktreeId: string): Promise<void>
       { timeout: 5_000 }
     )
     .toBe(true)
-  const checksButton = page.getByRole('button', { name: 'Checks', exact: true })
+  // Why: the activity-bar label carries an optional shortcut and a failure suffix ("Checks — Error"),
+  // so an exact 'Checks' name silently stops matching once the active branch has failing checks.
+  const checksButton = page.getByRole('button', { name: /^Checks(\s|$)/ })
   await expect
     .poll(
       async () => {
         if ((await page.evaluate(() => window.__store?.getState().rightSidebarTab)) !== 'checks') {
-          await checksButton.click()
+          // Why: the label flips as the checks status arrives; bound the click so the poll retries
+          // instead of hanging on a locator that stopped matching mid-action.
+          await checksButton.click({ timeout: 2_000 }).catch(() => undefined)
         }
         await page.waitForTimeout(250)
         return page.evaluate(() => window.__store?.getState().rightSidebarTab)
diff --git a/tests/e2e/korean-ime-terminal-shift-enter-commit.spec.ts b/tests/e2e/korean-ime-terminal-shift-enter-commit.spec.ts
index 208e79a8928..1ddfd56adb4 100644
--- a/tests/e2e/korean-ime-terminal-shift-enter-commit.spec.ts
+++ b/tests/e2e/korean-ime-terminal-shift-enter-commit.spec.ts
@@ -339,7 +339,7 @@ async function dispatchPlainEnter(session: CDPSession): Promise<void> {
 async function readPromptLine(page: Page): Promise<string> {
   const content = stripTerminalControls(await getTerminalContent(page, 20_000))
   const promptIndex = content.lastIndexOf(PROMPT)
-  if (promptIndex < 0) {
+  if (promptIndex === -1) {
     return ''
   }
   return (content.slice(promptIndex + PROMPT.length).split(/\r?\n/)[0] ?? '').trimEnd()
diff --git a/tests/e2e/multi-client-navigation-isolation.spec.ts b/tests/e2e/multi-client-navigation-isolation.spec.ts
index 399ae5d963f..2c1018a75fa 100644
--- a/tests/e2e/multi-client-navigation-isolation.spec.ts
+++ b/tests/e2e/multi-client-navigation-isolation.spec.ts
@@ -1,5 +1,7 @@
 import { execFileSync } from 'node:child_process'
 import { randomUUID } from 'node:crypto'
+import { mkdtempSync, rmSync } from 'node:fs'
+import os from 'node:os'
 import path from 'node:path'
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
@@ -176,3 +178,98 @@ test('keeps two paired browser clients and the host on independent worktrees', a
     await clientA?.close()
   }
 })
+
+test('shows only provider-backed creation actions in paired web', async ({
+  electronApp,
+  orcaPage
+}, testInfo) => {
+  const visibleWorktreeId = await orcaPage.evaluate(
+    () => window.__store?.getState().activeWorktreeId
+  )
+  if (!visibleWorktreeId) {
+    throw new Error('Host worktree was not active before paired web validation')
+  }
+
+  const offer = await createPairingOffer(orcaPage)
+  const client = await openPairedClient(electronApp, offer, visibleWorktreeId)
+  try {
+    await selectWorktree(client, visibleWorktreeId)
+    await expect
+      .poll(() =>
+        client.evaluate(() => {
+          const state = window.__store?.getState()
+          const worktree = state
+            ?.allWorktrees()
+            .find((candidate) => candidate.id === state.activeWorktreeId)
+          const environmentId = worktree?.runtimeOwnerEnvironmentId
+          return environmentId
+            ? state.runtimeStatusByEnvironmentId
+                .get(environmentId)
+                ?.status.capabilities?.includes('browser.screencast.v1') === true
+            : false
+        })
+      )
+      .toBe(true)
+
+    await client.getByRole('button', { name: 'New tab' }).first().click()
+    await expect(client.getByRole('menuitem', { name: /New Terminal/i })).toBeVisible()
+    await expect(client.getByRole('menuitem', { name: /New Browser Tab/i })).toBeVisible()
+    await expect(client.getByRole('menuitem', { name: /New Markdown/i })).toBeVisible()
+    await expect(client.getByRole('menuitem', { name: /Mobile Emulator/i })).toHaveCount(0)
+
+    const screenshotPath = testInfo.outputPath('paired-web-provider-backed-create-menu.png')
+    await client.screenshot({ path: screenshotPath })
+    await testInfo.attach('paired-web-provider-backed-create-menu', {
+      path: screenshotPath,
+      contentType: 'image/png'
+    })
+  } finally {
+    await client.close()
+  }
+})
+
+test('routes Add Project folder browsing through the paired host', async ({
+  electronApp,
+  orcaPage,
+  registerPostElectronShutdownCleanup
+}) => {
+  const hostFolder = mkdtempSync(path.join(os.tmpdir(), 'orca-paired-web-folder-'))
+  const folderName = path.basename(hostFolder)
+  registerPostElectronShutdownCleanup(async () => {
+    rmSync(hostFolder, { recursive: true, force: true })
+  })
+  const visibleWorktreeId = await orcaPage.evaluate(
+    () => window.__store?.getState().activeWorktreeId
+  )
+  if (!visibleWorktreeId) {
+    throw new Error('Host worktree was not active before paired web validation')
+  }
+
+  const offer = await createPairingOffer(orcaPage)
+  const client = await openPairedClient(electronApp, offer, visibleWorktreeId)
+  try {
+    await client
+      .getByRole('button', { name: /Add Project/i })
+      .first()
+      .click()
+    const addDialog = client.getByRole('dialog', { name: /Add a project/i })
+    await expect(addDialog).toBeVisible()
+    await expect(addDialog).not.toContainText('Local Mac')
+
+    await addDialog.getByRole('button', { name: /Browse folder/i }).click()
+    const browser = client.getByRole('dialog', { name: /Browse host filesystem/i })
+    await expect(browser).toBeVisible()
+    await expect(browser.getByRole('button', { name: /Select folder/i })).toBeVisible()
+    await browser.getByRole('button', { name: /^Cancel$/i }).click()
+
+    const manualPathDialog = client.getByRole('dialog', { name: /Open host project/i })
+    await manualPathDialog.locator('#server-project-path').fill(hostFolder)
+    await manualPathDialog.getByRole('button', { name: /Open as Folder/i }).click()
+    await expect(manualPathDialog).toBeHidden({ timeout: 30_000 })
+    await expect(
+      client.locator('[data-worktree-sidebar]').getByText(folderName, { exact: true }).first()
+    ).toBeVisible({ timeout: 30_000 })
+  } finally {
+    await client.close()
+  }
+})
diff --git a/tests/e2e/orca-profiles.spec.ts b/tests/e2e/orca-profiles.spec.ts
deleted file mode 100644
index 4d8bef3aec6..00000000000
--- a/tests/e2e/orca-profiles.spec.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-import { test, expect } from './helpers/orca-app'
-
-// Why: the multi-profile switcher UI is downscoped behind ORCA_MULTI_PROFILE_UI;
-// these specs exercise that full UI, so opt the whole file into the flag.
-test.use({ launchEnv: { ORCA_MULTI_PROFILE_UI: '1' } })
-
-test('opens the profile switcher and profile dialogs', async ({ orcaPage }) => {
-  const switcher = orcaPage.getByRole('button', { name: /^Switch profile$/ })
-  await expect(switcher).toBeVisible()
-
-  await switcher.click()
-  await expect(orcaPage.getByText('Personal', { exact: true }).first()).toBeVisible()
-  const manageProfiles = orcaPage.getByRole('menuitem', { name: /Manage profiles/i })
-  await expect(manageProfiles).toBeVisible()
-  await expect(orcaPage.getByRole('menuitem', { name: /New local profile/i })).toBeVisible()
-
-  await manageProfiles.click()
-  const managementDialog = orcaPage.getByRole('dialog', { name: /Manage profiles/i })
-  await expect(managementDialog).toBeVisible()
-  await expect(managementDialog.getByText(/projects/i).first()).toBeVisible()
-
-  await orcaPage.keyboard.press('Escape')
-  await expect(managementDialog).toBeHidden()
-
-  await switcher.click()
-  await orcaPage.getByRole('menuitem', { name: /New local profile/i }).click()
-  const createDialog = orcaPage.getByRole('dialog', { name: /New local profile/i })
-  await expect(createDialog).toBeVisible()
-  await expect(createDialog.getByPlaceholder(/Profile name/i)).toBeVisible()
-  await expect(createDialog.getByRole('button', { name: /Create and Switch/i })).toBeVisible()
-})
-
-test('places the profile switcher in sidebar footer and full-page titlebar', async ({
-  orcaPage
-}) => {
-  const switcher = orcaPage.getByRole('button', { name: /^Switch profile$/ })
-  const settingsButton = orcaPage.getByRole('button', { name: /^Settings$/ })
-  await expect(switcher).toBeVisible()
-  await expect(settingsButton).toBeVisible()
-
-  const sidebarSwitchBox = await switcher.boundingBox()
-  const settingsBox = await settingsButton.boundingBox()
-  const viewport = await orcaPage.evaluate(() => ({
-    width: window.innerWidth,
-    height: window.innerHeight
-  }))
-  expect(sidebarSwitchBox).not.toBeNull()
-  expect(settingsBox).not.toBeNull()
-
-  expect(sidebarSwitchBox!.x + sidebarSwitchBox!.width).toBeLessThanOrEqual(settingsBox!.x + 2)
-  expect(Math.abs(sidebarSwitchBox!.y - settingsBox!.y)).toBeLessThanOrEqual(2)
-  expect(sidebarSwitchBox!.y).toBeGreaterThan(viewport.height - 64)
-
-  await settingsButton.click()
-  await expect
-    .poll(() => orcaPage.evaluate(() => window.__store?.getState().activeView))
-    .toBe('settings')
-
-  const titlebarSwitchBox = await switcher.boundingBox()
-  expect(titlebarSwitchBox).not.toBeNull()
-  expect(titlebarSwitchBox!.x).toBeGreaterThan(viewport.width - 260)
-  expect(titlebarSwitchBox!.y).toBeLessThan(48)
-})
-
-test.describe('default single-profile mode', () => {
-  // Why: no flag — the default build shows no account trigger on a local-only
-  // (cloud-unconfigured) install.
-  test.use({ launchEnv: {} })
-
-  test('hides the account trigger when cloud is unconfigured', async ({ orcaPage }) => {
-    await expect(orcaPage.getByRole('button', { name: /^Switch profile$/ })).toHaveCount(0)
-    await expect(orcaPage.getByRole('button', { name: /^Account$/ })).toHaveCount(0)
-  })
-})
diff --git a/tests/e2e/orchestration-worker-settlement-release-cli.spec.ts b/tests/e2e/orchestration-worker-settlement-release-cli.spec.ts
new file mode 100644
index 00000000000..33ea97e13b0
--- /dev/null
+++ b/tests/e2e/orchestration-worker-settlement-release-cli.spec.ts
@@ -0,0 +1,290 @@
+import { spawnSync } from 'node:child_process'
+import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { test as base, expect } from './helpers/orca-app'
+import { waitForActivePaneHookDescriptor, waitForActivePanePtyId } from './helpers/terminal'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import { RuntimeClient } from '../../src/cli/runtime-client'
+import Database from '../../src/main/sqlite/sync-database'
+import type { RuntimeTerminalListResult, RuntimeTerminalRead } from '../../src/shared/runtime-types'
+
+const fakeCliDir = mkdtempSync(path.join(os.tmpdir(), 'orca-e2e-settlement-release-'))
+const cliLedgerPath = path.join(fakeCliDir, 'cli.jsonl')
+const cliEntry = path.join(process.cwd(), 'out', 'cli', 'index.js')
+const fakeCodexSource = `
+const { appendFileSync } = require('node:fs')
+const { spawnSync } = require('node:child_process')
+let capability = null
+let acknowledged = false
+process.stdout.write('\\u001b]0;Codex Ready\\u0007OpenAI Codex\\nmodel: e2e\\ndirectory: e2e\\n')
+process.stdin.on('data', (chunk) => {
+  const input = chunk.toString()
+  capability ||= input.match(/--dispatch-capability (dcap_[A-Za-z0-9_-]+)/)?.[1] || null
+  if (!acknowledged && input.includes('\\r')) {
+    acknowledged = true
+    process.stdout.write('ACK\\n')
+  }
+  const encoded = input.match(/ORCA_E2E_WORKER_DONE:([A-Za-z0-9+/=]+)/)?.[1]
+  if (!encoded || !capability) return
+  const request = JSON.parse(Buffer.from(encoded, 'base64').toString('utf8'))
+  const args = [
+    'orchestration', 'send',
+    '--from', request.mismatch ? 'term_foreign' : process.env.ORCA_TERMINAL_HANDLE,
+    '--dispatch-capability', capability,
+    '--to', request.coordinator,
+    '--type', 'worker_done',
+    '--subject', request.mismatch ? 'wrong sender' : 'completed',
+    '--body', 'Compiled CLI E2E worker completion.',
+    '--task-id', request.taskId,
+    '--dispatch-id', request.dispatchId,
+    '--outcome', 'succeeded',
+    '--json'
+  ]
+  const result = spawnSync(process.execPath, [process.env.ORCA_E2E_CLI_ENTRY, ...args], {
+    env: process.env,
+    encoding: 'utf8'
+  })
+  appendFileSync(
+    process.env.ORCA_E2E_CLI_LEDGER,
+    JSON.stringify({ mismatch: request.mismatch, args, status: result.status, stdout: result.stdout, stderr: result.stderr }) + '\\n'
+  )
+})
+process.stdin.resume()
+setInterval(() => {}, 60_000)
+`
+
+if (process.platform === 'win32') {
+  writeFileSync(path.join(fakeCliDir, 'fake-codex.js'), fakeCodexSource)
+  writeFileSync(
+    path.join(fakeCliDir, 'codex.cmd'),
+    '@echo off\r\nnode "%~dp0\\fake-codex.js" %*\r\n'
+  )
+} else {
+  const executable = path.join(fakeCliDir, 'codex')
+  writeFileSync(executable, `#!/usr/bin/env node\n${fakeCodexSource}`)
+  chmodSync(executable, 0o755)
+}
+
+const test = base.extend({
+  launchEnv: [
+    {
+      PATH: `${fakeCliDir}${path.delimiter}${process.env.PATH ?? ''}`,
+      ORCA_E2E_CLI_ENTRY: cliEntry,
+      ORCA_E2E_CLI_LEDGER: cliLedgerPath
+    },
+    { option: true }
+  ]
+})
+
+type CliLedgerEntry = {
+  mismatch: boolean
+  status: number
+  stdout: string
+  stderr: string
+}
+
+function readCliLedger(): CliLedgerEntry[] {
+  if (!existsSync(cliLedgerPath)) {
+    return []
+  }
+  return readFileSync(cliLedgerPath, 'utf8')
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map((line) => JSON.parse(line) as CliLedgerEntry)
+}
+
+function invokeCompiledCli(userDataDir: string, args: string[]) {
+  return spawnSync(process.execPath, [cliEntry, ...args], {
+    env: { ...process.env, ORCA_USER_DATA_PATH: userDataDir, ORCA_DEV_CLI_INVOCATION: '1' },
+    encoding: 'utf8'
+  })
+}
+
+function encodeWorkerDone(input: {
+  coordinator: string
+  taskId: string
+  dispatchId: string
+  mismatch: boolean
+}): string {
+  return Buffer.from(JSON.stringify(input)).toString('base64')
+}
+
+test.afterAll(() => {
+  rmSync(fakeCliDir, { recursive: true, force: true })
+})
+
+test('compiled CLI rejects false completion then reconciles the dead retained worker', async ({
+  orcaPage,
+  electronApp
+}) => {
+  test.setTimeout(180_000)
+  rmSync(cliLedgerPath, { force: true })
+  await waitForSessionReady(orcaPage)
+  const worktreeId = await waitForActiveWorktree(orcaPage)
+  await ensureTerminalVisible(orcaPage)
+  await waitForActivePanePtyId(orcaPage)
+  const coordinatorPane = await waitForActivePaneHookDescriptor(orcaPage)
+  const userDataDir = await electronApp.evaluate(({ app }) => app.getPath('userData'))
+  const client = new RuntimeClient(userDataDir, 30_000, null, null)
+  const coordinator = await client.call<{ terminal: { handle: string } }>('terminal.resolvePane', {
+    paneKey: coordinatorPane.paneKey
+  })
+  const run = await client.call<{ run: { id: string } }>('orchestration.runCreate', {
+    objective: 'Compiled CLI settlement and release E2E',
+    from: coordinator.result.terminal.handle
+  })
+  const task = await client.call<{ task: { id: string } }>('orchestration.taskCreate', {
+    spec: 'Respond ACK and await the completion marker.',
+    run: run.result.run.id,
+    callerTerminalHandle: coordinator.result.terminal.handle
+  })
+  const coordinatorTerminal = await client.call<{ terminal: { worktreeId: string } }>(
+    'terminal.show',
+    { terminal: coordinator.result.terminal.handle }
+  )
+  await expect
+    .poll(async () => {
+      const listed = await client.call<{ worktrees: { id: string }[] }>('worktree.list', {})
+      return listed.result.worktrees.some(
+        (worktree) => worktree.id === coordinatorTerminal.result.terminal.worktreeId
+      )
+    })
+    .toBe(true)
+  const started = await client.call<{ effects: { kind: string; role?: string; id?: string }[] }>(
+    'orchestration.workerStart',
+    {
+      task: task.result.task.id,
+      from: coordinator.result.terminal.handle,
+      agent: 'codex',
+      timeoutMs: 15_000
+    }
+  )
+  const workerHandle = started.result.effects.find(
+    (effect) => effect.kind === 'terminal' && effect.role === 'agent'
+  )?.id
+  expect(workerHandle).toBeTruthy()
+
+  let worker = (
+    await client.call<RuntimeTerminalListResult>('terminal.list')
+  ).result.terminals.find((terminal) => terminal.handle === workerHandle)
+  await expect
+    .poll(async () => {
+      const listed = await client.call<RuntimeTerminalListResult>('terminal.list')
+      worker = listed.result.terminals.find((terminal) => terminal.handle === workerHandle)
+      if (!worker) {
+        return ''
+      }
+      const read = await client.call<{ terminal: RuntimeTerminalRead }>('terminal.read', {
+        terminal: worker.handle,
+        limit: 200
+      })
+      return read.result.terminal.tail.join('\n')
+    })
+    .toContain('ACK')
+  const dispatch = await client.call<{ dispatch: { id: string; status: string } | null }>(
+    'orchestration.dispatchShow',
+    { task: task.result.task.id }
+  )
+  expect(dispatch.result.dispatch?.status).toBe('dispatched')
+
+  const baseMarker = {
+    coordinator: coordinator.result.terminal.handle,
+    taskId: task.result.task.id,
+    dispatchId: dispatch.result.dispatch!.id
+  }
+  await client.call('terminal.send', {
+    terminal: workerHandle,
+    text: `ORCA_E2E_WORKER_DONE:${encodeWorkerDone({ ...baseMarker, mismatch: true })}`,
+    enter: true
+  })
+  await expect.poll(() => readCliLedger()).toHaveLength(1)
+  const rejected = readCliLedger()[0]!
+  expect.soft(rejected.status).not.toBe(0)
+  expect.soft(JSON.parse(rejected.stdout)).toMatchObject({
+    ok: false,
+    error: { code: 'dispatch_capability_invalid' }
+  })
+  const stillDispatched = await client.call<{ dispatch: { status: string } | null }>(
+    'orchestration.dispatchShow',
+    { task: task.result.task.id }
+  )
+  expect(stillDispatched.result.dispatch?.status).toBe('dispatched')
+
+  await client.call('terminal.send', {
+    terminal: workerHandle,
+    text: `ORCA_E2E_WORKER_DONE:${encodeWorkerDone({ ...baseMarker, mismatch: false })}`,
+    enter: true
+  })
+  await expect.poll(() => readCliLedger()).toHaveLength(2)
+  const completed = readCliLedger()[1]!
+  expect(completed.status).toBe(0)
+  expect.soft(JSON.parse(completed.stdout)).toMatchObject({
+    ok: true,
+    result: { lifecycle: { action: 'completed' } }
+  })
+  await expect
+    .poll(async () => {
+      const current = await client.call<{ dispatch: { status: string } | null }>(
+        'orchestration.dispatchShow',
+        { task: task.result.task.id }
+      )
+      return current.result.dispatch?.status
+    })
+    .toBe('completed')
+
+  await client.call('terminal.close', { terminal: workerHandle })
+  await expect
+    .poll(async () => {
+      const listed = await client.call<RuntimeTerminalListResult>('terminal.list')
+      return listed.result.terminals.some((terminal) => terminal.handle === workerHandle)
+    })
+    .toBe(false)
+  const db = new Database(path.join(userDataDir, 'orchestration.db'))
+  try {
+    db.prepare(
+      `UPDATE worker_terminal_resources
+       SET ownership_state = 'external', release_state = 'retained',
+           retained_reason = 'external_terminal'
+       WHERE owner_dispatch_id = ?`
+    ).run(dispatch.result.dispatch!.id)
+  } finally {
+    db.close()
+  }
+
+  const released = invokeCompiledCli(userDataDir, [
+    'orchestration',
+    'worker-release',
+    '--dispatch',
+    dispatch.result.dispatch!.id,
+    '--json'
+  ])
+  expect(released.status).toBe(0)
+  expect.soft(JSON.parse(released.stdout)).toMatchObject({
+    ok: true,
+    result: { state: 'released', processAction: 'none' }
+  })
+  const verified = new Database(path.join(userDataDir, 'orchestration.db'))
+  try {
+    expect
+      .soft(
+        verified
+          .prepare(
+            `SELECT ownership_state, release_state
+           FROM worker_terminal_resources WHERE owner_dispatch_id = ?`
+          )
+          .get(dispatch.result.dispatch!.id)
+      )
+      .toEqual({ ownership_state: 'released', release_state: 'released' })
+  } finally {
+    verified.close()
+  }
+  const coordinatorStillLive = await client.call<RuntimeTerminalListResult>('terminal.list', {
+    worktree: `id:${worktreeId}`
+  })
+  expect(
+    coordinatorStillLive.result.terminals.some(
+      (terminal) => terminal.handle === coordinator.result.terminal.handle
+    )
+  ).toBe(true)
+})
diff --git a/tests/e2e/paired-remote-html-browser-focus.spec.ts b/tests/e2e/paired-remote-html-browser-focus.spec.ts
new file mode 100644
index 00000000000..5a70fa10465
--- /dev/null
+++ b/tests/e2e/paired-remote-html-browser-focus.spec.ts
@@ -0,0 +1,460 @@
+import { writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { expect, test } from './helpers/orca-app'
+import { openFileExplorer } from './helpers/file-explorer'
+import {
+  createRuntimeDesktopPairingOffer,
+  launchPairedElectronClient,
+  type PairedElectronClient
+} from './helpers/paired-electron-client'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+
+const FIXTURE_NAME = 'paired-html-focus.html'
+
+test('keeps remote HTML preview placement and focuses it only after a click', async ({
+  orcaPage,
+  testRepoPath
+}, testInfo) => {
+  test.setTimeout(240_000)
+  writeFileSync(
+    path.join(testRepoPath, FIXTURE_NAME),
+    '<!doctype html><html><body><h1>paired html focus</h1></body></html>\n'
+  )
+  await waitForSessionReady(orcaPage)
+  await waitForActiveWorktree(orcaPage)
+  await ensureTerminalVisible(orcaPage)
+
+  const offer = await createRuntimeDesktopPairingOffer(orcaPage)
+  let client: PairedElectronClient | null = null
+  try {
+    client = await launchPairedElectronClient(offer, testInfo, 'Remote HTML focus')
+    const page = client.page
+    const worktreeId = await expect
+      .poll(
+        () =>
+          page.evaluate((repoPath) => {
+            const state = window.__store?.getState()
+            return state
+              ? (state.allWorktrees().find((worktree) => worktree.path === repoPath)?.id ?? null)
+              : null
+          }, testRepoPath),
+        { timeout: 60_000, message: 'paired client never received the host worktree' }
+      )
+      .not.toBeNull()
+      .then(() =>
+        page.evaluate((repoPath) => {
+          const state = window.__store?.getState()
+          return state?.allWorktrees().find((worktree) => worktree.path === repoPath)?.id ?? null
+        }, testRepoPath)
+      )
+    if (!worktreeId) {
+      throw new Error('paired client worktree disappeared after discovery')
+    }
+    await page.evaluate(
+      ({ environmentId, worktreeId }) => {
+        window.__store?.getState().setActiveWorktree(worktreeId, `runtime:${environmentId}`)
+      },
+      { environmentId: client.environmentId, worktreeId }
+    )
+    await openFileExplorer(page)
+    const fixtureRow = page.locator('[data-file-explorer-row]').filter({ hasText: FIXTURE_NAME })
+    await expect(fixtureRow).toBeVisible({ timeout: 30_000 })
+    await fixtureRow.click()
+    const openPreviewToSide = page.getByRole('button', { name: 'Open Preview to the Side' })
+    await expect(openPreviewToSide).toBeVisible({ timeout: 30_000 })
+    const sourceEditor = await page.evaluate((targetWorktreeId) => {
+      const state = window.__store?.getState()
+      const groupId = state?.activeGroupIdByWorktree[targetWorktreeId]
+      const group = (state?.groupsByWorktree[targetWorktreeId] ?? []).find(
+        (candidate) => candidate.id === groupId
+      )
+      const tab = (state?.unifiedTabsByWorktree[targetWorktreeId] ?? []).find(
+        (candidate) => candidate.id === group?.activeTabId && candidate.contentType === 'editor'
+      )
+      return groupId && tab ? { groupId, tabId: tab.id } : null
+    }, worktreeId)
+    if (!sourceEditor) {
+      throw new Error('paired client editor had no source identity before side preview')
+    }
+    const sourceGroupId = sourceEditor.groupId
+    const browserBaseline = await page.evaluate(
+      async ({ environmentId, worktreeId }) => {
+        const state = window.__store?.getState()
+        const response = await window.api.runtimeEnvironments.call({
+          selector: environmentId,
+          method: 'session.tabs.list',
+          params: { worktree: `id:${worktreeId}` },
+          timeoutMs: 15_000
+        })
+        return {
+          clientUnified: (state?.unifiedTabsByWorktree[worktreeId] ?? []).filter(
+            (tab) => tab.contentType === 'browser'
+          ).length,
+          clientWorkspaces: (state?.browserTabsByWorktree[worktreeId] ?? []).length,
+          host: response.ok
+            ? response.result.tabs.filter((tab) => tab.type === 'browser').length
+            : -1
+        }
+      },
+      { environmentId: client.environmentId, worktreeId }
+    )
+    await openPreviewToSide.click()
+
+    await expect
+      .poll(
+        () =>
+          page.evaluate(
+            async ({ environmentId, fixtureName, worktreeId }) => {
+              const state = window.__store?.getState()
+              if (!state) {
+                return null
+              }
+              const browser = (state.browserTabsByWorktree[worktreeId] ?? []).find((tab) =>
+                tab.url.endsWith(`/${fixtureName}`)
+              )
+              const browserPage = browser
+                ? (state.browserPagesByWorkspace[browser.id] ?? [])[0]
+                : null
+              const handle = browserPage
+                ? state.remoteBrowserPageHandlesByPageId[browserPage.id]
+                : null
+              const response = await window.api.runtimeEnvironments.call({
+                selector: environmentId,
+                method: 'session.tabs.list',
+                params: { worktree: `id:${worktreeId}` },
+                timeoutMs: 15_000
+              })
+              const hostHasHtml =
+                response.ok &&
+                response.result.tabs.some(
+                  (tab) => tab.type === 'browser' && tab.url.endsWith(`/${fixtureName}`)
+                )
+              return {
+                browserRuntimeEnvironmentId: browserPage?.browserRuntimeEnvironmentId ?? null,
+                handleEnvironmentId: handle?.environmentId ?? null,
+                handleRemotePageId: handle?.remotePageId ?? null,
+                hostHasHtml
+              }
+            },
+            { environmentId: client!.environmentId, fixtureName: FIXTURE_NAME, worktreeId }
+          ),
+        { timeout: 60_000, message: 'remote HTML browser ownership never converged' }
+      )
+      .toMatchObject({
+        browserRuntimeEnvironmentId: client.environmentId,
+        handleEnvironmentId: client.environmentId,
+        hostHasHtml: true
+      })
+    const htmlTabInventory = await page.evaluate(
+      async ({ environmentId, fixtureName, worktreeId }) => {
+        const state = window.__store?.getState()
+        const response = await window.api.runtimeEnvironments.call({
+          selector: environmentId,
+          method: 'session.tabs.list',
+          params: { worktree: `id:${worktreeId}` },
+          timeoutMs: 15_000
+        })
+        const clientWorkspaceIds = (state?.browserTabsByWorktree[worktreeId] ?? [])
+          .filter((tab) => tab.url.endsWith(`/${fixtureName}`))
+          .map((tab) => tab.id)
+        return {
+          clientWorkspaceIds,
+          clientUnifiedTabs: (state?.unifiedTabsByWorktree[worktreeId] ?? [])
+            .filter(
+              (tab) => tab.contentType === 'browser' && clientWorkspaceIds.includes(tab.entityId)
+            )
+            .map((tab) => ({ groupId: tab.groupId, id: tab.id })),
+          hostTabIds: response.ok
+            ? response.result.tabs
+                .filter((tab) => tab.type === 'browser' && tab.url.endsWith(`/${fixtureName}`))
+                .map((tab) => tab.id)
+            : [],
+          hostTabGroups: response.ok ? (response.result.tabGroups ?? []) : [],
+          totalClientUnified: (state?.unifiedTabsByWorktree[worktreeId] ?? []).filter(
+            (tab) => tab.contentType === 'browser'
+          ).length,
+          totalClientWorkspaces: (state?.browserTabsByWorktree[worktreeId] ?? []).length,
+          totalHost: response.ok
+            ? response.result.tabs.filter((tab) => tab.type === 'browser').length
+            : -1
+        }
+      },
+      { environmentId: client.environmentId, fixtureName: FIXTURE_NAME, worktreeId }
+    )
+    expect(htmlTabInventory.clientWorkspaceIds).toHaveLength(1)
+    expect(htmlTabInventory.clientUnifiedTabs).toHaveLength(1)
+    expect(htmlTabInventory.hostTabIds).toHaveLength(1)
+    expect(htmlTabInventory.totalClientUnified).toBe(browserBaseline.clientUnified + 1)
+    expect(htmlTabInventory.totalClientWorkspaces).toBe(browserBaseline.clientWorkspaces + 1)
+    expect(htmlTabInventory.totalHost).toBe(browserBaseline.host + 1)
+    expect(htmlTabInventory.clientUnifiedTabs[0]?.groupId).not.toBe(sourceGroupId)
+    expect(
+      htmlTabInventory.hostTabGroups.some(
+        (group) => group.id === htmlTabInventory.clientUnifiedTabs[0]?.groupId
+      )
+    ).toBe(false)
+    const hostBrowserGroupId = htmlTabInventory.hostTabGroups.find((group) =>
+      group.tabOrder.includes(htmlTabInventory.hostTabIds[0]!)
+    )?.id
+    expect(hostBrowserGroupId).toBeTruthy()
+    await expect(page.locator(`[data-tab-group-body-id="${sourceGroupId}"]`)).toBeVisible()
+    await expect(
+      page.locator(`[data-tab-group-body-id="${htmlTabInventory.clientUnifiedTabs[0]!.groupId}"]`)
+    ).toBeVisible()
+    await expect(page.getByTestId('remote-browser-frame')).toBeVisible({ timeout: 60_000 })
+
+    const previewFocus = await page.evaluate(
+      ({ sourceGroupId, sourceTabId, worktreeId: targetWorktreeId }) => {
+        const state = window.__store?.getState()
+        const activeGroup = (state?.groupsByWorktree[targetWorktreeId] ?? []).find(
+          (group) => group.id === state?.activeGroupIdByWorktree[targetWorktreeId]
+        )
+        return {
+          activeGroupId: activeGroup?.id ?? null,
+          activeTabId: activeGroup?.activeTabId ?? null,
+          activeTabType: state?.activeTabTypeByWorktree[targetWorktreeId] ?? null,
+          sourceGroupId,
+          sourceTabId
+        }
+      },
+      { sourceGroupId, sourceTabId: sourceEditor.tabId, worktreeId }
+    )
+    expect(previewFocus).toEqual({
+      activeGroupId: sourceGroupId,
+      activeTabId: sourceEditor.tabId,
+      activeTabType: 'editor',
+      sourceGroupId,
+      sourceTabId: sourceEditor.tabId
+    })
+
+    const tabIds = await page.evaluate(
+      ({ fixtureName, worktreeId: targetWorktreeId }) => {
+        const state = window.__store?.getState()
+        if (!state) {
+          return null
+        }
+        const terminalId = state.tabsByWorktree[targetWorktreeId]?.[0]?.id ?? null
+        const browserId = (state.browserTabsByWorktree[targetWorktreeId] ?? []).find((tab) =>
+          tab.url.endsWith(`/${fixtureName}`)
+        )?.id
+        return terminalId && browserId ? { browserId, terminalId } : null
+      },
+      { fixtureName: FIXTURE_NAME, worktreeId }
+    )
+    if (!tabIds) {
+      throw new Error('paired client did not retain both terminal and HTML browser tabs')
+    }
+    await page.locator(`[data-tab-id="${tabIds.terminalId}"]`).click()
+    await expect
+      .poll(
+        () =>
+          page.evaluate((targetWorktreeId) => {
+            const state = window.__store?.getState()
+            return state?.activeTabTypeByWorktree[targetWorktreeId] ?? null
+          }, worktreeId),
+        { message: 'terminal tab never became active before the browser click' }
+      )
+      .toBe('terminal')
+    await expect
+      .poll(
+        () =>
+          page.evaluate(
+            async ({ environmentId, worktreeId }) => {
+              const response = await window.api.runtimeEnvironments.call({
+                selector: environmentId,
+                method: 'session.tabs.list',
+                params: { worktree: `id:${worktreeId}` },
+                timeoutMs: 15_000
+              })
+              if (!response.ok) {
+                return false
+              }
+              return (
+                response.result.tabs.find((tab) => tab.id === response.result.activeTabId)?.type ===
+                'terminal'
+              )
+            },
+            { environmentId: client.environmentId, worktreeId }
+          ),
+        { timeout: 30_000, message: 'host never accepted terminal activation' }
+      )
+      .toBe(true)
+    const hostBrowserTab = await page.evaluate(
+      async ({ environmentId, fixtureName, worktreeId }) => {
+        const response = await window.api.runtimeEnvironments.call({
+          selector: environmentId,
+          method: 'session.tabs.list',
+          params: { worktree: `id:${worktreeId}` },
+          timeoutMs: 15_000
+        })
+        const tab = response.ok
+          ? response.result.tabs.find(
+              (candidate) =>
+                candidate.type === 'browser' && candidate.url.endsWith(`/${fixtureName}`)
+            )
+          : null
+        return tab?.type === 'browser' ? { browserPageId: tab.browserPageId, id: tab.id } : null
+      },
+      { environmentId: client.environmentId, fixtureName: FIXTURE_NAME, worktreeId }
+    )
+    if (!hostBrowserTab?.browserPageId) {
+      throw new Error('host HTML browser tab disappeared before activation')
+    }
+    const clientRemotePageId = await page.evaluate(
+      ({ fixtureName, worktreeId }) => {
+        const state = window.__store?.getState()
+        const workspace = (state?.browserTabsByWorktree[worktreeId] ?? []).find((tab) =>
+          tab.url.endsWith(`/${fixtureName}`)
+        )
+        const browserPage = workspace
+          ? (state?.browserPagesByWorkspace[workspace.id] ?? [])[0]
+          : null
+        return browserPage
+          ? (state?.remoteBrowserPageHandlesByPageId[browserPage.id]?.remotePageId ?? null)
+          : null
+      },
+      { fixtureName: FIXTURE_NAME, worktreeId }
+    )
+    expect(clientRemotePageId).toBe(hostBrowserTab.browserPageId)
+    const content = await page.evaluate(
+      async ({ browserPageId, environmentId, worktreeId }) =>
+        window.api.runtimeEnvironments.call({
+          selector: environmentId,
+          method: 'browser.eval',
+          params: {
+            worktree: `id:${worktreeId}`,
+            page: browserPageId,
+            expression: 'document.querySelector("h1")?.textContent'
+          },
+          timeoutMs: 15_000
+        }),
+      {
+        browserPageId: hostBrowserTab.browserPageId,
+        environmentId: client.environmentId,
+        worktreeId
+      }
+    )
+    expect(content).toMatchObject({ ok: true, result: { result: 'paired html focus' } })
+    await expect
+      .poll(
+        () =>
+          page.evaluate(
+            ({ browserTabId, environmentId }) => {
+              const state = window.__store?.getState()
+              return (state?.browserPagesByWorkspace[browserTabId] ?? []).some((browserPage) => {
+                const handle = state?.remoteBrowserPageHandlesByPageId[browserPage.id]
+                return (
+                  handle?.environmentId === environmentId ||
+                  browserPage.browserRuntimeEnvironmentId === environmentId
+                )
+              })
+            },
+            { browserTabId: tabIds.browserId, environmentId: client.environmentId }
+          ),
+        { timeout: 30_000, message: 'client lost remote browser ownership before activation' }
+      )
+      .toBe(true)
+    await page.locator(`[data-tab-id="${tabIds.browserId}"]`).click()
+
+    await expect
+      .poll(
+        () =>
+          page.evaluate(
+            async ({ environmentId, fixtureName, worktreeId }) => {
+              const state = window.__store?.getState()
+              if (!state) {
+                return null
+              }
+              const response = await window.api.runtimeEnvironments.call({
+                selector: environmentId,
+                method: 'session.tabs.list',
+                params: { worktree: `id:${worktreeId}` },
+                timeoutMs: 15_000
+              })
+              const activeGroup = (state.groupsByWorktree[worktreeId] ?? []).find(
+                (group) => group.id === state.activeGroupIdByWorktree[worktreeId]
+              )
+              const activeUnified = (state.unifiedTabsByWorktree[worktreeId] ?? []).find(
+                (tab) => tab.id === activeGroup?.activeTabId
+              )
+              const hostActive = response.ok
+                ? response.result.tabs.find((tab) => tab.id === response.result.activeTabId)
+                : null
+              return {
+                activeGroupType: activeUnified?.contentType ?? null,
+                activeTabType: state.activeTabTypeByWorktree[worktreeId] ?? null,
+                hostActiveHtml:
+                  hostActive?.type === 'browser' && hostActive.url.endsWith(`/${fixtureName}`)
+              }
+            },
+            { environmentId: client!.environmentId, fixtureName: FIXTURE_NAME, worktreeId }
+          ),
+        { timeout: 30_000, message: 'browser click did not remain authoritative' }
+      )
+      .toEqual({ activeGroupType: 'browser', activeTabType: 'browser', hostActiveHtml: true })
+    await expect(page.getByTestId('remote-browser-frame')).toBeVisible()
+
+    const browserTab = page.locator(`[data-tab-id="${tabIds.browserId}"]`)
+    await browserTab.click({ button: 'right' })
+    await page.getByRole('menuitem', { name: 'Close', exact: true }).click()
+    await expect
+      .poll(
+        () =>
+          page.evaluate(
+            async ({
+              environmentId,
+              hostTabId,
+              sourceGroupId,
+              unifiedTabId,
+              workspaceId,
+              worktreeId
+            }) => {
+              const state = window.__store?.getState()
+              const response = await window.api.runtimeEnvironments.call({
+                selector: environmentId,
+                method: 'session.tabs.list',
+                params: { worktree: `id:${worktreeId}` },
+                timeoutMs: 15_000
+              })
+              return {
+                clientUnifiedPresent: (state?.unifiedTabsByWorktree[worktreeId] ?? []).some(
+                  (tab) => tab.id === unifiedTabId
+                ),
+                clientWorkspacePresent: (state?.browserTabsByWorktree[worktreeId] ?? []).some(
+                  (tab) => tab.id === workspaceId
+                ),
+                hostTabPresent: response.ok
+                  ? response.result.tabs.some((tab) => tab.id === hostTabId)
+                  : true,
+                sourceGroupPresent: (state?.groupsByWorktree[worktreeId] ?? []).some(
+                  (group) => group.id === sourceGroupId
+                )
+              }
+            },
+            {
+              environmentId: client!.environmentId,
+              hostTabId: hostBrowserTab.id,
+              sourceGroupId,
+              unifiedTabId: htmlTabInventory.clientUnifiedTabs[0]!.id,
+              workspaceId: htmlTabInventory.clientWorkspaceIds[0]!,
+              worktreeId
+            }
+          ),
+        { timeout: 30_000, message: 'remote HTML browser close did not converge cleanly' }
+      )
+      .toEqual({
+        clientUnifiedPresent: false,
+        clientWorkspacePresent: false,
+        hostTabPresent: false,
+        sourceGroupPresent: true
+      })
+    await expect(browserTab).toHaveCount(0)
+    await expect(page.locator(`[data-tab-id="${tabIds.terminalId}"]`)).toBeVisible()
+    await expect(page.locator(`[data-tab-id="${sourceEditor.tabId}"]`)).toBeVisible()
+    await expect(
+      page.locator(`[data-tab-group-body-id="${sourceGroupId}"] .monaco-editor`)
+    ).toBeVisible()
+  } finally {
+    await client?.dispose()
+  }
+})
diff --git a/tests/e2e/paired-remote-terminal-browser-link.spec.ts b/tests/e2e/paired-remote-terminal-browser-link.spec.ts
new file mode 100644
index 00000000000..44d0d3484f1
--- /dev/null
+++ b/tests/e2e/paired-remote-terminal-browser-link.spec.ts
@@ -0,0 +1,368 @@
+import { createServer, type Server } from 'node:http'
+import type { AddressInfo } from 'node:net'
+import type { Page } from '@stablyai/playwright-test'
+import { expect, test } from './helpers/orca-app'
+import {
+  createRuntimeDesktopPairingOffer,
+  launchPairedElectronClient,
+  type PairedElectronClient
+} from './helpers/paired-electron-client'
+import {
+  readPanelNavigationObserver,
+  startPanelNavigationObserver,
+  stopPanelNavigationObserver
+} from './helpers/plugin-panel-navigation-observer'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  execInTerminal,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForTerminalOutput
+} from './helpers/terminal'
+
+const PAGE_MARKER = 'remote terminal browser owner'
+const TERMINAL_MARKER = 'remote-terminal-still-live-after-browser-close'
+
+async function readTabInventory(
+  page: Page,
+  environmentId: string,
+  worktreeId: string
+): Promise<{
+  clientBrowserWorkspaces: number
+  clientBrowserTabs: number
+  clientTerminalTabs: number
+  hostBrowserTabs: number
+  hostTerminalTabs: number
+}> {
+  return page.evaluate(
+    async ({ environmentId, worktreeId }) => {
+      const state = window.__store?.getState()
+      const response = await window.api.runtimeEnvironments.call({
+        selector: environmentId,
+        method: 'session.tabs.list',
+        params: { worktree: `id:${worktreeId}` },
+        timeoutMs: 15_000
+      })
+      return {
+        clientBrowserWorkspaces: (state?.browserTabsByWorktree[worktreeId] ?? []).length,
+        clientBrowserTabs: (state?.unifiedTabsByWorktree[worktreeId] ?? []).filter(
+          (tab) => tab.contentType === 'browser'
+        ).length,
+        clientTerminalTabs: (state?.tabsByWorktree[worktreeId] ?? []).length,
+        hostBrowserTabs: response.ok
+          ? response.result.tabs.filter((tab) => tab.type === 'browser').length
+          : -1,
+        hostTerminalTabs: response.ok
+          ? response.result.tabs.filter((tab) => tab.type === 'terminal').length
+          : -1
+      }
+    },
+    { environmentId, worktreeId }
+  )
+}
+
+async function startPageServer(): Promise<{ server: Server; url: string }> {
+  const server = createServer((_request, response) => {
+    response.writeHead(200, { 'content-type': 'text/html; charset=utf-8' })
+    response.end(`<!doctype html><html><body><h1>${PAGE_MARKER}</h1></body></html>`)
+  })
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', () => {
+      server.off('error', reject)
+      resolve()
+    })
+  })
+  const address = server.address() as AddressInfo
+  return { server, url: `http://127.0.0.1:${address.port}/remote-terminal` }
+}
+
+async function closePageServer(server: Server): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    server.close((error) => (error ? reject(error) : resolve()))
+  })
+}
+
+async function findTerminalLinkTarget(page: Page, link: string): Promise<{ x: number; y: number }> {
+  return page.evaluate((targetLink) => {
+    const state = window.__store?.getState()
+    const worktreeId = state?.activeWorktreeId
+    const tabId = worktreeId ? state?.activeTabIdByWorktree?.[worktreeId] : null
+    const manager = tabId ? window.__paneManagers?.get(tabId) : null
+    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
+    const screen = pane?.terminal.element?.querySelector<HTMLElement>('.xterm-screen') ?? null
+    if (!pane || !screen) {
+      throw new Error('paired terminal screen unavailable')
+    }
+    const buffer = pane.terminal.buffer.active
+    for (let row = 0; row < pane.terminal.rows; row += 1) {
+      const text = buffer.getLine(buffer.viewportY + row)?.translateToString(false) ?? ''
+      const column = text.indexOf(targetLink)
+      if (column === -1) {
+        continue
+      }
+      const cell = pane.terminal.dimensions?.css.cell
+      if (!cell?.width || !cell.height) {
+        throw new Error('paired terminal cell dimensions unavailable')
+      }
+      const rect = screen.getBoundingClientRect()
+      return {
+        x: rect.left + (column + targetLink.length / 2) * cell.width,
+        y: rect.top + (row + 0.5) * cell.height
+      }
+    }
+    throw new Error('paired terminal link unavailable')
+  }, link)
+}
+
+function remoteTerminalHandle(ptyId: string): string {
+  const separator = ptyId.indexOf('@@')
+  if (!ptyId.startsWith('remote:') || separator === -1) {
+    throw new Error(`Expected runtime-owned PTY id, received ${ptyId}`)
+  }
+  return decodeURIComponent(ptyId.slice(separator + 2))
+}
+
+test('opens a paired-runtime terminal link on its owning host', async ({
+  orcaPage,
+  testRepoPath
+}, testInfo) => {
+  test.setTimeout(240_000)
+  const fixture = await startPageServer()
+  let client: PairedElectronClient | null = null
+  let observerActive = false
+  try {
+    await waitForSessionReady(orcaPage)
+    await waitForActiveWorktree(orcaPage)
+    await ensureTerminalVisible(orcaPage)
+    await waitForActiveTerminalManager(orcaPage)
+    const hostPtyId = await waitForActivePanePtyId(orcaPage)
+    await execInTerminal(orcaPage, hostPtyId, `printf '%s\\n' ${JSON.stringify(fixture.url)}`)
+    await waitForTerminalOutput(orcaPage, fixture.url)
+
+    const offer = await createRuntimeDesktopPairingOffer(orcaPage)
+    client = await launchPairedElectronClient(offer, testInfo, 'Remote terminal browser link')
+    const page = client.page
+    const worktreeId = await expect
+      .poll(
+        () =>
+          page.evaluate((repoPath) => {
+            const state = window.__store?.getState()
+            return state?.allWorktrees().find((worktree) => worktree.path === repoPath)?.id ?? null
+          }, testRepoPath),
+        { timeout: 60_000, message: 'paired client never received the host worktree' }
+      )
+      .not.toBeNull()
+      .then(() =>
+        page.evaluate((repoPath) => {
+          const state = window.__store?.getState()
+          return state?.allWorktrees().find((worktree) => worktree.path === repoPath)?.id ?? null
+        }, testRepoPath)
+      )
+    if (!worktreeId) {
+      throw new Error('paired client worktree disappeared after discovery')
+    }
+    await page.evaluate(
+      async ({ environmentId, worktreeId }) => {
+        const state = window.__store?.getState()
+        state?.setActiveWorktree(worktreeId, `runtime:${environmentId}`)
+        await state?.updateSettings({
+          openLinksInApp: true,
+          terminalLinkActionPopoverEnabled: true
+        })
+      },
+      { environmentId: client.environmentId, worktreeId }
+    )
+    await ensureTerminalVisible(page, 30_000)
+    await waitForActiveTerminalManager(page, 30_000)
+    await waitForTerminalOutput(page, fixture.url, 30_000)
+    const clientPtyId = await waitForActivePanePtyId(page, 30_000)
+    expect(clientPtyId.startsWith(`remote:${client.environmentId}@@`)).toBe(true)
+
+    const baseline = await readTabInventory(page, client.environmentId, worktreeId)
+    await startPanelNavigationObserver(client.app, page.url())
+    observerActive = true
+
+    const target = await findTerminalLinkTarget(page, fixture.url)
+    await page.mouse.move(target.x, target.y)
+    await expect(page.locator('.xterm-hover')).toHaveCount(1)
+    await page.mouse.click(target.x, target.y)
+    const actionPopover = page.locator('[data-terminal-link-action-popover]')
+    await expect(actionPopover).toBeVisible()
+    await expect(actionPopover.locator('[data-terminal-link-destination]')).toHaveText(fixture.url)
+    await expect(
+      actionPopover.getByRole('button').filter({ hasText: 'System Browser' })
+    ).toBeVisible()
+    const orcaBrowserAction = actionPopover.getByRole('button').filter({ hasText: 'Orca Browser' })
+    await expect(orcaBrowserAction).toBeVisible()
+    await orcaBrowserAction.click()
+
+    const identity = await expect
+      .poll(
+        () =>
+          page.evaluate(
+            async ({ environmentId, url, worktreeId }) => {
+              const state = window.__store?.getState()
+              const workspace = (state?.browserTabsByWorktree[worktreeId] ?? []).find(
+                (tab) => tab.url === url
+              )
+              const browserPage = workspace
+                ? (state?.browserPagesByWorkspace[workspace.id] ?? [])[0]
+                : null
+              const handle = browserPage
+                ? state?.remoteBrowserPageHandlesByPageId[browserPage.id]
+                : null
+              const response = await window.api.runtimeEnvironments.call({
+                selector: environmentId,
+                method: 'session.tabs.list',
+                params: { worktree: `id:${worktreeId}` },
+                timeoutMs: 15_000
+              })
+              const hostTab = response.ok
+                ? response.result.tabs.find((tab) => tab.type === 'browser' && tab.url === url)
+                : null
+              return workspace && browserPage && handle && hostTab?.type === 'browser'
+                ? {
+                    clientPageId: browserPage.id,
+                    clientRuntimeId: browserPage.browserRuntimeEnvironmentId,
+                    clientWorkspaceId: workspace.id,
+                    hostPageId: hostTab.browserPageId,
+                    hostTabId: hostTab.id,
+                    remoteEnvironmentId: handle.environmentId,
+                    remotePageId: handle.remotePageId
+                  }
+                : null
+            },
+            { environmentId: client!.environmentId, url: fixture.url, worktreeId }
+          ),
+        { timeout: 60_000, message: 'terminal link never became one host-owned browser tab' }
+      )
+      .not.toBeNull()
+      .then(() =>
+        page.evaluate(
+          async ({ environmentId, url, worktreeId }) => {
+            const state = window.__store!.getState()
+            const workspace = state.browserTabsByWorktree[worktreeId]!.find(
+              (tab) => tab.url === url
+            )!
+            const browserPage = state.browserPagesByWorkspace[workspace.id]![0]!
+            const handle = state.remoteBrowserPageHandlesByPageId[browserPage.id]!
+            const response = await window.api.runtimeEnvironments.call({
+              selector: environmentId,
+              method: 'session.tabs.list',
+              params: { worktree: `id:${worktreeId}` },
+              timeoutMs: 15_000
+            })
+            if (!response.ok) {
+              throw new Error('host tab inventory unavailable')
+            }
+            const hostTab = response.result.tabs.find(
+              (tab) => tab.type === 'browser' && tab.url === url
+            )!
+            return {
+              clientPageId: browserPage.id,
+              clientRuntimeId: browserPage.browserRuntimeEnvironmentId,
+              clientWorkspaceId: workspace.id,
+              hostPageId: hostTab.type === 'browser' ? hostTab.browserPageId : null,
+              hostTabId: hostTab.id,
+              remoteEnvironmentId: handle.environmentId,
+              remotePageId: handle.remotePageId
+            }
+          },
+          { environmentId: client!.environmentId, url: fixture.url, worktreeId }
+        )
+      )
+
+    expect(identity.clientRuntimeId).toBe(client.environmentId)
+    expect(identity.remoteEnvironmentId).toBe(client.environmentId)
+    expect(identity.remotePageId).toBe(identity.hostPageId)
+    const finalInventory = await readTabInventory(page, client.environmentId, worktreeId)
+    expect(finalInventory).toEqual({
+      clientBrowserWorkspaces: baseline.clientBrowserWorkspaces + 1,
+      clientBrowserTabs: baseline.clientBrowserTabs + 1,
+      clientTerminalTabs: baseline.clientTerminalTabs,
+      hostBrowserTabs: baseline.hostBrowserTabs + 1,
+      hostTerminalTabs: baseline.hostTerminalTabs
+    })
+    expect((await readPanelNavigationObserver(client.app)).externalUrls).toEqual([])
+
+    const content = await page.evaluate(
+      async ({ browserPageId, environmentId, worktreeId }) =>
+        window.api.runtimeEnvironments.call({
+          selector: environmentId,
+          method: 'browser.eval',
+          params: {
+            worktree: `id:${worktreeId}`,
+            page: browserPageId,
+            expression: 'document.querySelector("h1")?.textContent'
+          },
+          timeoutMs: 15_000
+        }),
+      {
+        browserPageId: identity.hostPageId!,
+        environmentId: client.environmentId,
+        worktreeId
+      }
+    )
+    expect(content).toMatchObject({ ok: true, result: { result: PAGE_MARKER } })
+
+    const browserTab = page.locator(`[data-tab-id="${identity.clientWorkspaceId}"]`)
+    await browserTab.click()
+    await expect
+      .poll(() =>
+        page.evaluate((worktreeId) => {
+          const state = window.__store?.getState()
+          return {
+            browserWorkspaceId: state?.activeBrowserTabIdByWorktree[worktreeId] ?? null,
+            tabType: state?.activeTabTypeByWorktree[worktreeId] ?? null
+          }
+        }, worktreeId)
+      )
+      .toEqual({ browserWorkspaceId: identity.clientWorkspaceId, tabType: 'browser' })
+    await expect(
+      page.locator(`[data-browser-overlay-tab-id="${identity.clientWorkspaceId}"]`)
+    ).toHaveCSS('opacity', '1')
+
+    await browserTab.hover()
+    await browserTab.locator('button').click()
+    await expect
+      .poll(() => readTabInventory(page, client!.environmentId, worktreeId), {
+        timeout: 30_000,
+        message: 'host and client browser inventories did not return to baseline'
+      })
+      .toEqual(baseline)
+
+    await ensureTerminalVisible(page, 30_000)
+    await waitForActiveTerminalManager(page, 30_000)
+    expect(await waitForActivePanePtyId(page, 30_000)).toBe(clientPtyId)
+    const send = await page.evaluate(
+      async ({ environmentId, terminal, text }) =>
+        window.api.runtimeEnvironments.call({
+          selector: environmentId,
+          method: 'terminal.send',
+          params: {
+            terminal,
+            text,
+            enter: true,
+            client: { id: 'remote-browser-close-e2e', type: 'desktop' }
+          },
+          timeoutMs: 15_000
+        }),
+      {
+        environmentId: client.environmentId,
+        terminal: remoteTerminalHandle(clientPtyId),
+        text: `printf '%s\\n' ${JSON.stringify(TERMINAL_MARKER)}`
+      }
+    )
+    expect(send).toMatchObject({ ok: true, result: { send: { accepted: true } } })
+    await waitForTerminalOutput(page, TERMINAL_MARKER, 30_000)
+    expect(await readTabInventory(page, client.environmentId, worktreeId)).toEqual(baseline)
+    expect((await readPanelNavigationObserver(client.app)).externalUrls).toEqual([])
+  } finally {
+    if (observerActive && client) {
+      await stopPanelNavigationObserver(client.app).catch(() => undefined)
+    }
+    await client?.dispose()
+    await closePageServer(fixture.server)
+  }
+})
diff --git a/tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts b/tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts
index 9a358c65b54..fae82b45d44 100644
--- a/tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts
+++ b/tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts
@@ -42,9 +42,6 @@ vi.mock('@/store', () => ({
 }))
 
 vi.mock('@/runtime/sync-runtime-graph', () => ({ scheduleRuntimeGraphSync: vi.fn() }))
-vi.mock('@/components/terminal-pane/terminal-webgl-atlas-recovery', () => ({
-  scheduleTerminalWebglAtlasRecovery: vi.fn()
-}))
 vi.mock('sonner', () => ({ toast: { info: vi.fn() } }))
 vi.mock('@/lib/codex-stale-pane-sweep', () => ({ notifyCodexPaneBoundForStaleSweep: vi.fn() }))
 vi.mock('@/runtime/web-runtime-session', () => ({
diff --git a/tests/e2e/pty-input-write-queue-ssh.spec.ts b/tests/e2e/pty-input-write-queue-ssh.spec.ts
new file mode 100644
index 00000000000..353f7fd22b0
--- /dev/null
+++ b/tests/e2e/pty-input-write-queue-ssh.spec.ts
@@ -0,0 +1,66 @@
+import { test } from './helpers/orca-app'
+import { connectDockerSshRelayTarget } from './helpers/docker-ssh-relay-connection'
+import {
+  cleanupDockerSshRelayTarget,
+  startDockerSshRelayTarget,
+  type DockerSshRelayTarget
+} from './helpers/docker-ssh-relay-target'
+import {
+  execInTerminal,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForTerminalOutput
+} from './helpers/terminal'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+
+const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
+
+function shellQuote(value: string): string {
+  return `'${value.replaceAll("'", "'\\''")}'`
+}
+
+function remoteOscQueryScript(runId: string): string {
+  return [
+    "process.stdin.setEncoding('utf8')",
+    'if (process.stdin.isTTY) process.stdin.setRawMode(true)',
+    'process.stdin.resume()',
+    "let received = ''",
+    `process.stdout.write('REMOTE_OSC_READY_${runId}\\n')`,
+    "process.stdin.on('data', (chunk) => {",
+    '  received += chunk',
+    "  if (received.includes('\\x1b]10;rgb:')) {",
+    `    process.stdout.write('REMOTE_OSC_REPLY_${runId}\\n')`,
+    '    process.exit(0)',
+    '  }',
+    '})',
+    "setTimeout(() => process.stdout.write('\\x1b]10;?\\x1b\\\\'), 100)"
+  ].join(';')
+}
+
+test.describe('PTY input write queue over SSH', () => {
+  test.skip(!RUN_DOCKER_SSH, 'Set ORCA_E2E_SSH_DOCKER=1 to run Docker-backed SSH E2E.')
+  test.skip(process.platform === 'win32', 'Docker SSH E2E uses POSIX ssh tooling.')
+
+  test('returns an xterm OSC query reply through the live SSH PTY', async ({
+    orcaPage
+  }, testInfo) => {
+    test.slow()
+    let target: DockerSshRelayTarget | null = null
+    try {
+      target = startDockerSshRelayTarget(testInfo)
+      await waitForSessionReady(orcaPage)
+      await waitForActiveWorktree(orcaPage)
+      await connectDockerSshRelayTarget(orcaPage, target)
+      await ensureTerminalVisible(orcaPage, 45_000)
+      await waitForActiveTerminalManager(orcaPage, 60_000)
+      const ptyId = await waitForActivePanePtyId(orcaPage, 60_000)
+      const runId = String(Date.now())
+
+      await execInTerminal(orcaPage, ptyId, `node -e ${shellQuote(remoteOscQueryScript(runId))}`)
+      await waitForTerminalOutput(orcaPage, `REMOTE_OSC_READY_${runId}`, 30_000, 80_000)
+      await waitForTerminalOutput(orcaPage, `REMOTE_OSC_REPLY_${runId}`, 30_000, 80_000)
+    } finally {
+      cleanupDockerSshRelayTarget(target)
+    }
+  })
+})
diff --git a/tests/e2e/remote-agent-session-focus-authority.spec.ts b/tests/e2e/remote-agent-session-focus-authority.spec.ts
index 2b007fddd98..4fb4c3e7ae8 100644
--- a/tests/e2e/remote-agent-session-focus-authority.spec.ts
+++ b/tests/e2e/remote-agent-session-focus-authority.spec.ts
@@ -140,7 +140,7 @@ async function readRenderedTabOrder(page: Page): Promise<string[]> {
 
 function expectImmediatelyAfter(order: string[], predecessor: string, created: string): void {
   const predecessorIndex = order.indexOf(predecessor)
-  if (predecessorIndex < 0) {
+  if (predecessorIndex === -1) {
     throw new Error(
       `placement predecessor ${predecessor} missing before ${created}: ${JSON.stringify(order)}`
     )
diff --git a/tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts b/tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts
new file mode 100644
index 00000000000..48dd86e318d
--- /dev/null
+++ b/tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts
@@ -0,0 +1,772 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  RuntimeMobileSessionTabsResult,
+  RuntimeMobileSessionTabsSnapshot
+} from '../../src/shared/runtime-types'
+import { detectAgentStatusFromTitle } from '../../src/shared/agent-detection'
+import { AGENT_STATUS_STALE_AFTER_MS } from '../../src/shared/agent-status-types'
+import { isExplicitAgentStatusFresh } from '../../src/renderer/src/lib/agent-status'
+import { OrcaRuntimeService } from '../../src/main/runtime/orca-runtime'
+import {
+  SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS,
+  SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS
+} from '../../src/main/runtime/mobile-session-tabs-agent-status-heartbeat'
+import {
+  applyFreshWebSessionTabsSnapshot,
+  resetWebSessionTabsSnapshotFreshnessForTests,
+  type WebSessionTabsSyncState
+} from '../../src/renderer/src/runtime/web-session-tabs-sync'
+
+vi.mock('../../src/renderer/src/store', () => ({
+  useAppStore: {
+    setState: vi.fn()
+  }
+}))
+
+const ENVIRONMENT_ID = 'paired-runtime'
+const WORKTREE_COUNT = 24
+const DECORATIVE_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏']
+
+type RuntimeInternals = {
+  mobileSessionTabsByWorktree: Map<string, RuntimeMobileSessionTabsSnapshot>
+  ptysById: Map<string, { launchAgent: 'grok-build' | 'pi' | null }>
+  ptyDelayedForegroundSnapshotTitleObservations: Map<string, number>
+  resetTrackedTerminalStateForProviderGeneration: (ptyId: string) => void
+}
+
+type FanoutCounters = {
+  hostPublications: number
+  serializedBytes: number
+  rendererApplyCalls: number
+  rendererStoreMutations: number
+  rawTerminalChunks: number
+}
+
+type FanoutEvidence = {
+  publishedByWorktree: Map<string, RuntimeMobileSessionTabsResult[]>
+  rawChunksByPty: Map<string, string[]>
+}
+
+function makeViewerState(): WebSessionTabsSyncState {
+  return {
+    activeBrowserTabId: null,
+    activeBrowserTabIdByWorktree: {},
+    activeFileId: null,
+    activeFileIdByWorktree: {},
+    activeGroupIdByWorktree: {},
+    activeTabId: null,
+    activeTabIdByWorktree: {},
+    activeTabType: 'terminal',
+    activeTabTypeByWorktree: {},
+    activeWorktreeId: 'workspace-0',
+    agentStatusByPaneKey: {},
+    agentStatusEpoch: 0,
+    browserCertificateFailuresByPageId: {},
+    browserPagesByWorkspace: {},
+    browserTabsByWorktree: {},
+    groupsByWorktree: {},
+    layoutByWorktree: {},
+    openFiles: [],
+    ptyIdsByTabId: {},
+    remoteBrowserPageHandlesByPageId: {},
+    tabBarOrderByWorktree: {},
+    tabsByWorktree: {},
+    terminalLayoutsByTabId: {},
+    unifiedTabsByWorktree: {},
+    unreadTerminalTabs: {},
+    sortEpoch: 0
+  }
+}
+
+function seedWorktree(runtime: OrcaRuntimeService, index: number): string {
+  const worktreeId = `workspace-${index}`
+  const ptyId = `pty-${index}`
+  const tabId = `host-tab-${index}`
+  const leafId = `00000000-0000-4000-8000-${index.toString().padStart(12, '0')}`
+  runtime.registerPty(ptyId, worktreeId)
+  ;(runtime as unknown as RuntimeInternals).mobileSessionTabsByWorktree.set(worktreeId, {
+    worktree: worktreeId,
+    publicationEpoch: 'epoch-1',
+    snapshotVersion: 1,
+    activeGroupId: `group-${index}`,
+    activeTabId: `${tabId}::${leafId}`,
+    activeTabType: 'terminal',
+    tabs: [
+      {
+        type: 'terminal',
+        id: `${tabId}::${leafId}`,
+        parentTabId: tabId,
+        leafId,
+        ptyId,
+        title: 'Cursor Agent',
+        parentLayout: {
+          root: { type: 'leaf', leafId },
+          activeLeafId: leafId,
+          expandedLeafId: null,
+          ptyIdsByLeafId: { [leafId]: ptyId }
+        },
+        isActive: true
+      }
+    ]
+  })
+  return ptyId
+}
+
+function resetCounters(counters: FanoutCounters): void {
+  counters.hostPublications = 0
+  counters.serializedBytes = 0
+  counters.rendererApplyCalls = 0
+  counters.rendererStoreMutations = 0
+  counters.rawTerminalChunks = 0
+}
+
+function resetEvidence(evidence: FanoutEvidence): void {
+  evidence.publishedByWorktree.clear()
+  evidence.rawChunksByPty.clear()
+}
+
+function recordByKey<T>(map: Map<string, T[]>, key: string, value: T): void {
+  const entries = map.get(key) ?? []
+  entries.push(value)
+  map.set(key, entries)
+}
+
+describe('real PTY decorative session-tabs fanout', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    resetWebSessionTabsSnapshotFreshnessForTests()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('bounds host publication and renderer application across remote worktrees', () => {
+    const runtime = new OrcaRuntimeService()
+    const ptyIds = Array.from({ length: WORKTREE_COUNT }, (_, index) =>
+      seedWorktree(runtime, index)
+    )
+    const counters: FanoutCounters = {
+      hostPublications: 0,
+      serializedBytes: 0,
+      rendererApplyCalls: 0,
+      rendererStoreMutations: 0,
+      rawTerminalChunks: 0
+    }
+    const evidence: FanoutEvidence = {
+      publishedByWorktree: new Map(),
+      rawChunksByPty: new Map()
+    }
+    let viewerState = makeViewerState()
+    const dataUnsubscribes = ptyIds.map((ptyId) =>
+      runtime.subscribeToTerminalData(ptyId, (data) => {
+        counters.rawTerminalChunks += 1
+        recordByKey(evidence.rawChunksByPty, ptyId, data)
+      })
+    )
+    const unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => {
+      counters.hostPublications += 1
+      counters.serializedBytes += Buffer.byteLength(JSON.stringify(snapshot))
+      recordByKey(evidence.publishedByWorktree, snapshot.worktree, structuredClone(snapshot))
+      counters.rendererApplyCalls += 1
+      const patch = applyFreshWebSessionTabsSnapshot(
+        viewerState,
+        snapshot,
+        ENVIRONMENT_ID,
+        Date.now()
+      )
+      if (patch !== viewerState) {
+        counters.rendererStoreMutations += 1
+        viewerState = { ...viewerState, ...patch }
+      }
+    })
+
+    for (const ptyId of ptyIds) {
+      runtime.onPtyData(ptyId, '\x1b]0;⠋ Cursor Agent\x07', Date.now())
+    }
+    vi.advanceTimersByTime(50)
+    expect(counters.hostPublications).toBe(WORKTREE_COUNT)
+    expect(counters.rendererStoreMutations).toBe(WORKTREE_COUNT)
+    resetCounters(counters)
+    resetEvidence(evidence)
+
+    for (let cycle = 0; cycle < 4; cycle += 1) {
+      for (const frame of DECORATIVE_FRAMES) {
+        for (const ptyId of ptyIds) {
+          runtime.onPtyData(ptyId, `\x1b]0;${frame} Cursor Agent\x07`, Date.now())
+        }
+        vi.advanceTimersByTime(30)
+      }
+    }
+    vi.advanceTimersByTime(50)
+
+    expect(counters).toEqual({
+      hostPublications: 0,
+      serializedBytes: 0,
+      rendererApplyCalls: 0,
+      rendererStoreMutations: 0,
+      rawTerminalChunks: WORKTREE_COUNT * DECORATIVE_FRAMES.length * 4
+    })
+    for (const ptyId of ptyIds) {
+      expect(evidence.rawChunksByPty.get(ptyId)).toEqual(
+        Array.from({ length: 4 }, () =>
+          DECORATIVE_FRAMES.map((frame) => `\x1b]0;${frame} Cursor Agent\x07`)
+        ).flat()
+      )
+    }
+    expect(evidence.publishedByWorktree.size).toBe(0)
+
+    resetCounters(counters)
+    resetEvidence(evidence)
+    for (let cycle = 0; cycle < 4; cycle += 1) {
+      for (const frame of DECORATIVE_FRAMES) {
+        for (const ptyId of ptyIds) {
+          runtime.onPtyData(ptyId, '\x1b]0;Cursor Agent\x07', Date.now())
+          runtime.onPtyData(ptyId, `\x1b]0;${frame} Cursor Agent\x07`, Date.now())
+        }
+        vi.advanceTimersByTime(30)
+      }
+    }
+    vi.advanceTimersByTime(50)
+    expect(counters).toEqual({
+      hostPublications: 0,
+      serializedBytes: 0,
+      rendererApplyCalls: 0,
+      rendererStoreMutations: 0,
+      rawTerminalChunks: WORKTREE_COUNT * DECORATIVE_FRAMES.length * 8
+    })
+    for (const ptyId of ptyIds) {
+      expect(evidence.rawChunksByPty.get(ptyId)).toEqual(
+        Array.from({ length: 4 }, () =>
+          DECORATIVE_FRAMES.flatMap((frame) => [
+            '\x1b]0;Cursor Agent\x07',
+            `\x1b]0;${frame} Cursor Agent\x07`
+          ])
+        ).flat()
+      )
+    }
+    expect(evidence.publishedByWorktree.size).toBe(0)
+
+    resetCounters(counters)
+    resetEvidence(evidence)
+    for (const ptyId of ptyIds) {
+      runtime.onPtyData(ptyId, '\x1b]0;Cursor ready\x07', Date.now())
+    }
+    vi.advanceTimersByTime(50)
+    expect(counters.hostPublications).toBe(WORKTREE_COUNT)
+    expect(counters.rendererApplyCalls).toBe(WORKTREE_COUNT)
+    expect(counters.rendererStoreMutations).toBe(WORKTREE_COUNT)
+    expect(counters.serializedBytes).toBeGreaterThan(0)
+    for (let index = 0; index < WORKTREE_COUNT; index += 1) {
+      const worktreeId = `workspace-${index}`
+      const snapshots = evidence.publishedByWorktree.get(worktreeId)
+      expect(snapshots).toHaveLength(1)
+      const terminal = snapshots?.[0]?.tabs[0]
+      expect(terminal).toMatchObject({
+        type: 'terminal',
+        parentTabId: `host-tab-${index}`,
+        leafId: `00000000-0000-4000-8000-${index.toString().padStart(12, '0')}`,
+        ptyId: `pty-${index}`,
+        title: 'Cursor ready'
+      })
+      expect(terminal?.type === 'terminal' ? terminal.agentStatus?.state : undefined).toBe('done')
+      expect(viewerState.tabsByWorktree[worktreeId]).toEqual([
+        expect.objectContaining({ title: 'Cursor ready', worktreeId })
+      ])
+      expect(
+        detectAgentStatusFromTitle(viewerState.tabsByWorktree[worktreeId]?.[0]?.title ?? '')
+      ).toBe('idle')
+      expect(evidence.rawChunksByPty.get(`pty-${index}`)).toEqual(['\x1b]0;Cursor ready\x07'])
+    }
+
+    resetCounters(counters)
+    resetEvidence(evidence)
+    for (const ptyId of ptyIds) {
+      runtime.onPtyData(ptyId, 'visible output\r\n', Date.now())
+    }
+    vi.advanceTimersByTime(50)
+    expect(counters).toEqual({
+      hostPublications: 0,
+      serializedBytes: 0,
+      rendererApplyCalls: 0,
+      rendererStoreMutations: 0,
+      rawTerminalChunks: WORKTREE_COUNT
+    })
+    for (const ptyId of ptyIds) {
+      expect(evidence.rawChunksByPty.get(ptyId)).toEqual(['visible output\r\n'])
+    }
+    expect(evidence.publishedByWorktree.size).toBe(0)
+
+    unsubscribe()
+    for (const dispose of dataUnsubscribes) {
+      dispose()
+    }
+  })
+
+  it.each([
+    ['build ⠁', 'build ⠂'],
+    ['Codex working task ⠁', 'Codex working task ⠂']
+  ])('publishes meaningful real-title changes from %j to %j', (firstTitle, secondTitle) => {
+    const runtime = new OrcaRuntimeService()
+    seedWorktree(runtime, 0)
+    const published: RuntimeMobileSessionTabsResult[] = []
+    const unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => published.push(snapshot))
+
+    runtime.onPtyData('pty-0', `\x1b]0;${firstTitle}\x07`, Date.now())
+    vi.advanceTimersByTime(50)
+    published.length = 0
+    runtime.onPtyData('pty-0', `\x1b]0;${secondTitle}\x07`, Date.now())
+    vi.advanceTimersByTime(50)
+
+    expect(published).toHaveLength(1)
+    expect(published[0]?.tabs[0]).toMatchObject({ title: secondTitle, ptyId: 'pty-0' })
+    unsubscribe()
+  })
+
+  it('globally caps decorative freshness while every working status stays fresh', () => {
+    const runtime = new OrcaRuntimeService()
+    const firstWorkingTitleAt = Date.now()
+    const ptyIds = Array.from({ length: WORKTREE_COUNT }, (_, index) =>
+      seedWorktree(runtime, index)
+    )
+    const publications: {
+      worktreeId: string
+      at: number
+      updatedAt: number
+      stateStartedAt: number
+    }[] = []
+    let viewerState = makeViewerState()
+    const unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => {
+      const terminal = snapshot.tabs[0]
+      if (terminal?.type !== 'terminal') {
+        return
+      }
+      publications.push({
+        worktreeId: snapshot.worktree,
+        at: Date.now(),
+        updatedAt: terminal.agentStatus?.updatedAt ?? 0,
+        stateStartedAt: terminal.agentStatus?.stateStartedAt ?? 0
+      })
+      const patch = applyFreshWebSessionTabsSnapshot(
+        viewerState,
+        snapshot,
+        ENVIRONMENT_ID,
+        Date.now()
+      )
+      viewerState = { ...viewerState, ...patch }
+    })
+
+    for (const ptyId of ptyIds) {
+      runtime.onPtyData(ptyId, '\x1b]0;⠋ Cursor Agent\x07', Date.now())
+    }
+    vi.advanceTimersByTime(50)
+    const initialStateStartedAtByWorktree = new Map(
+      publications.map(({ worktreeId, stateStartedAt }) => [worktreeId, stateStartedAt])
+    )
+    publications.length = 0
+
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS - 51)
+    for (const ptyId of ptyIds) {
+      runtime.onPtyData(ptyId, '\x1b]0;⠙ Cursor Agent\x07', Date.now())
+    }
+    vi.advanceTimersByTime(50)
+    expect(publications).toEqual([])
+
+    vi.advanceTimersByTime(1)
+    const heartbeatStartedAt = Date.now()
+    for (const ptyId of ptyIds) {
+      runtime.onPtyData(ptyId, '\x1b]0;⠹ Cursor Agent\x07', Date.now())
+    }
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS * WORKTREE_COUNT + 50)
+
+    expect(publications.map(({ worktreeId }) => worktreeId).sort()).toEqual(
+      Array.from({ length: WORKTREE_COUNT }, (_, index) => `workspace-${index}`).sort()
+    )
+    for (let index = 1; index < publications.length; index += 1) {
+      expect(publications[index]!.at - publications[index - 1]!.at).toBeGreaterThanOrEqual(
+        SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS
+      )
+    }
+    for (const publication of publications) {
+      expect(publication.updatedAt).toBeGreaterThanOrEqual(heartbeatStartedAt)
+      expect(Date.now() - publication.updatedAt).toBeLessThan(AGENT_STATUS_STALE_AFTER_MS)
+      expect(publication.stateStartedAt).toBe(
+        initialStateStartedAtByWorktree.get(publication.worktreeId)
+      )
+    }
+    publications.length = 0
+
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS)
+    for (const ptyId of ptyIds) {
+      runtime.onPtyData(ptyId, '\x1b]0;⠸ Cursor Agent\x07', Date.now())
+    }
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_SPACING_MS * WORKTREE_COUNT + 50)
+    expect(publications).toHaveLength(WORKTREE_COUNT)
+    expect(Date.now() - firstWorkingTitleAt).toBeGreaterThan(AGENT_STATUS_STALE_AFTER_MS)
+    const viewerAgentStatuses = Object.values(viewerState.agentStatusByPaneKey)
+    expect(viewerAgentStatuses).toHaveLength(WORKTREE_COUNT)
+    expect(
+      viewerAgentStatuses.every(
+        (entry) =>
+          entry.state === 'working' &&
+          isExplicitAgentStatusFresh(entry, Date.now(), AGENT_STATUS_STALE_AFTER_MS)
+      )
+    ).toBe(true)
+
+    publications.length = 0
+    const completionAt = Date.now()
+    for (const ptyId of ptyIds) {
+      runtime.onPtyData(ptyId, '\x1b]0;Cursor ready\x07', Date.now())
+    }
+    vi.advanceTimersByTime(50)
+    expect(publications).toHaveLength(WORKTREE_COUNT)
+    expect(publications.every(({ updatedAt }) => updatedAt === completionAt)).toBe(true)
+    unsubscribe()
+  })
+
+  it.each([
+    {
+      agent: 'pi' as const,
+      firstTitle: '⠋ π - project',
+      heartbeatTitles: ['⠋ π - project', '⠙ π - project'],
+      expectedTitle: '⠋ Pi'
+    },
+    {
+      agent: 'grok-build' as const,
+      firstTitle: '⠋ - Waiting for response… - grok',
+      heartbeatTitles: ['⠴ - Thinking - grok', '⠦ - Sleep 2s then echo hello… - grok'],
+      expectedTitle: '⠋ Grok'
+    }
+  ])('renews exact and normalized $agent frames beyond the viewer stale boundary', (testCase) => {
+    const runtime = new OrcaRuntimeService()
+    const firstWorkingTitleAt = Date.now()
+    const ptyId = seedWorktree(runtime, 0)
+    const internals = runtime as unknown as RuntimeInternals
+    internals.ptysById.get(ptyId)!.launchAgent = testCase.agent
+    const seededTab = internals.mobileSessionTabsByWorktree.get('workspace-0')?.tabs[0]
+    if (seededTab?.type !== 'terminal') {
+      throw new Error('expected seeded terminal')
+    }
+    seededTab.agentStatus = {
+      state: 'working',
+      prompt: 'task',
+      updatedAt: firstWorkingTitleAt,
+      stateStartedAt: firstWorkingTitleAt,
+      agentType: testCase.agent,
+      paneKey: seededTab.id,
+      stateHistory: []
+    }
+    const publications: RuntimeMobileSessionTabsResult[] = []
+    let viewerState = makeViewerState()
+    const unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => {
+      publications.push(structuredClone(snapshot))
+      const patch = applyFreshWebSessionTabsSnapshot(
+        viewerState,
+        snapshot,
+        ENVIRONMENT_ID,
+        Date.now()
+      )
+      viewerState = { ...viewerState, ...patch }
+    })
+
+    runtime.onPtyData(ptyId, `\x1b]0;${testCase.firstTitle}\x07`, Date.now())
+    vi.advanceTimersByTime(50)
+    expect(publications).toHaveLength(1)
+    const initialTerminal = publications[0]?.tabs[0]
+    const initialAgentStatus =
+      initialTerminal?.type === 'terminal' ? initialTerminal.agentStatus : undefined
+    expect(initialAgentStatus?.state).toBe('working')
+    publications.length = 0
+
+    for (const title of testCase.heartbeatTitles) {
+      vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS)
+      runtime.onPtyData(ptyId, `\x1b]0;${title}\x07`, Date.now())
+      vi.advanceTimersByTime(50)
+    }
+
+    expect(publications).toHaveLength(2)
+    expect(
+      publications.every((snapshot) => {
+        const terminal = snapshot.tabs[0]
+        return terminal?.type === 'terminal' && terminal.title === testCase.expectedTitle
+      })
+    ).toBe(true)
+    const finalTerminal = publications.at(-1)?.tabs[0]
+    const finalAgentStatus =
+      finalTerminal?.type === 'terminal' ? finalTerminal.agentStatus : undefined
+    expect(finalAgentStatus?.updatedAt).toBeGreaterThan(initialAgentStatus!.updatedAt)
+    expect(finalAgentStatus?.stateStartedAt).toBe(initialAgentStatus?.stateStartedAt)
+    expect(finalAgentStatus?.prompt).toBe('')
+    expect(finalAgentStatus?.agentType).toBe(initialAgentStatus?.agentType)
+    const acknowledgedAt = initialAgentStatus!.updatedAt + 1
+    expect(acknowledgedAt).toBeGreaterThanOrEqual(finalAgentStatus!.stateStartedAt)
+    expect(Date.now() - firstWorkingTitleAt).toBeGreaterThan(AGENT_STATUS_STALE_AFTER_MS)
+    const viewerAgentStatus = Object.values(viewerState.agentStatusByPaneKey)[0]
+    expect(viewerAgentStatus?.state).toBe('working')
+    expect(
+      isExplicitAgentStatusFresh(viewerAgentStatus!, Date.now(), AGENT_STATUS_STALE_AFTER_MS)
+    ).toBe(true)
+
+    publications.length = 0
+    vi.advanceTimersByTime(1)
+    runtime.onPtyData(ptyId, '\x1b]0;bash\x07', Date.now())
+    vi.advanceTimersByTime(50)
+    expect(publications).toHaveLength(1)
+    const completedTerminal = publications[0]?.tabs[0]
+    const completedStatus =
+      completedTerminal?.type === 'terminal' ? completedTerminal.agentStatus : undefined
+    expect(completedStatus).toMatchObject({ state: 'done', prompt: '' })
+    expect(completedStatus?.stateStartedAt).toBeGreaterThan(finalAgentStatus!.stateStartedAt)
+    unsubscribe()
+  })
+
+  it('does not publish a stored working row over a later permission title', () => {
+    const runtime = new OrcaRuntimeService()
+    const ptyId = seedWorktree(runtime, 0)
+    const internals = runtime as unknown as RuntimeInternals
+    const seededTab = internals.mobileSessionTabsByWorktree.get('workspace-0')?.tabs[0]
+    if (seededTab?.type !== 'terminal') {
+      throw new Error('expected seeded terminal')
+    }
+    seededTab.agentStatus = {
+      state: 'working',
+      prompt: 'previous task',
+      updatedAt: Date.now(),
+      stateStartedAt: Date.now(),
+      agentType: 'cursor',
+      paneKey: seededTab.id,
+      stateHistory: []
+    }
+    const publications: RuntimeMobileSessionTabsResult[] = []
+    const unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => {
+      publications.push(structuredClone(snapshot))
+    })
+
+    runtime.onPtyData(ptyId, '\x1b]0;⠋ Cursor Agent\x07', Date.now())
+    vi.advanceTimersByTime(50)
+    publications.length = 0
+    vi.advanceTimersByTime(1)
+    const permissionAt = Date.now()
+    runtime.onPtyData(ptyId, '\x1b]0;Cursor Agent waiting\x07', permissionAt)
+    vi.advanceTimersByTime(50)
+
+    const terminal = publications.at(-1)?.tabs[0]
+    const status = terminal?.type === 'terminal' ? terminal.agentStatus : undefined
+    expect(status).toMatchObject({
+      state: 'blocked',
+      prompt: '',
+      updatedAt: permissionAt,
+      stateStartedAt: permissionAt
+    })
+    unsubscribe()
+  })
+
+  it('does not publish a prior done row over a newer working title', () => {
+    const runtime = new OrcaRuntimeService()
+    const ptyId = seedWorktree(runtime, 0)
+    const internals = runtime as unknown as RuntimeInternals
+    const seededTab = internals.mobileSessionTabsByWorktree.get('workspace-0')?.tabs[0]
+    if (seededTab?.type !== 'terminal') {
+      throw new Error('expected seeded terminal')
+    }
+    seededTab.agentStatus = {
+      state: 'working',
+      prompt: 'first task',
+      updatedAt: Date.now(),
+      stateStartedAt: Date.now(),
+      agentType: 'cursor',
+      paneKey: seededTab.id,
+      stateHistory: []
+    }
+    const publications: RuntimeMobileSessionTabsResult[] = []
+    const unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => {
+      publications.push(structuredClone(snapshot))
+    })
+
+    runtime.onPtyData(ptyId, '\x1b]0;⠋ Cursor Agent\x07', Date.now())
+    vi.advanceTimersByTime(50)
+    vi.advanceTimersByTime(1)
+    runtime.onPtyData(ptyId, '\x1b]0;bash\x07', Date.now())
+    vi.advanceTimersByTime(50)
+    vi.advanceTimersByTime(1)
+    const doneAt = Date.now()
+    seededTab.agentStatus = {
+      state: 'done',
+      prompt: 'first task',
+      updatedAt: doneAt,
+      stateStartedAt: doneAt,
+      agentType: 'cursor',
+      paneKey: seededTab.id,
+      stateHistory: []
+    }
+    publications.length = 0
+
+    vi.advanceTimersByTime(1)
+    const nextWorkingAt = Date.now()
+    runtime.onPtyData(ptyId, '\x1b]0;⠙ Cursor Agent\x07', nextWorkingAt)
+    vi.advanceTimersByTime(50)
+
+    const terminal = publications.at(-1)?.tabs[0]
+    const status = terminal?.type === 'terminal' ? terminal.agentStatus : undefined
+    expect(status).toMatchObject({
+      state: 'working',
+      prompt: '',
+      updatedAt: nextWorkingAt,
+      stateStartedAt: nextWorkingAt
+    })
+    unsubscribe()
+  })
+
+  it('holds decorative heartbeats behind unresolved foreground ownership', async () => {
+    let resolveForegroundProcess: (agent: string | null) => void = () => undefined
+    const foregroundProcess = new Promise<string | null>((resolve) => {
+      resolveForegroundProcess = resolve
+    })
+    const getForegroundProcess = vi.fn(() => foregroundProcess)
+    const runtime = new OrcaRuntimeService()
+    runtime.setPtyController({
+      spawn: vi.fn().mockResolvedValue({ id: 'pty-0' }),
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess
+    })
+    const ptyId = seedWorktree(runtime, 0)
+    const publications: RuntimeMobileSessionTabsResult[] = []
+    const unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => {
+      publications.push(structuredClone(snapshot))
+    })
+
+    runtime.onPtyData(ptyId, '\x1b]0;⠋ Pi\x07', Date.now())
+    runtime.onPtyData(ptyId, '\x1b]0;⠙ Pi\x07', Date.now())
+    await vi.advanceTimersByTimeAsync(50)
+    expect(getForegroundProcess).toHaveBeenCalledTimes(1)
+    expect(publications).toHaveLength(0)
+
+    resolveForegroundProcess('pi')
+    await vi.advanceTimersByTimeAsync(50)
+    expect(publications).toHaveLength(1)
+    expect(publications[0]?.tabs[0]).toMatchObject({
+      type: 'terminal',
+      title: '⠋ Pi',
+      agentStatus: { state: 'working' }
+    })
+
+    runtime.onPtyData(ptyId, '\x1b]0;⠹ Pi\x07', Date.now())
+    await vi.advanceTimersByTimeAsync(50)
+    expect(publications).toHaveLength(1)
+
+    await vi.advanceTimersByTimeAsync(SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS)
+    runtime.onPtyData(ptyId, '\x1b]0;⠸ Pi\x07', Date.now())
+    await vi.advanceTimersByTimeAsync(50)
+    expect(publications).toHaveLength(2)
+    unsubscribe()
+  })
+
+  it('clears delayed ownership markers when tracked terminal state resets', async () => {
+    let resolveForegroundProcess: (agent: string | null) => void = () => undefined
+    const foregroundProcess = new Promise<string | null>((resolve) => {
+      resolveForegroundProcess = resolve
+    })
+    const runtime = new OrcaRuntimeService()
+    runtime.setPtyController({
+      spawn: vi.fn().mockResolvedValue({ id: 'pty-0' }),
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: () => foregroundProcess
+    })
+    const ptyId = seedWorktree(runtime, 0)
+    const internals = runtime as unknown as RuntimeInternals
+
+    runtime.onPtyData(ptyId, '\x1b]0;⠋ Pi\x07', Date.now())
+    await vi.advanceTimersByTimeAsync(0)
+    expect(internals.ptyDelayedForegroundSnapshotTitleObservations.has(ptyId)).toBe(true)
+
+    internals.resetTrackedTerminalStateForProviderGeneration(ptyId)
+    expect(internals.ptyDelayedForegroundSnapshotTitleObservations.has(ptyId)).toBe(false)
+    resolveForegroundProcess(null)
+    await vi.advanceTimersByTimeAsync(0)
+  })
+
+  it('renews retained hook status without resetting its state start', () => {
+    const runtime = new OrcaRuntimeService()
+    const ptyId = seedWorktree(runtime, 0)
+    const internals = runtime as unknown as RuntimeInternals
+    const seededTab = internals.mobileSessionTabsByWorktree.get('workspace-0')?.tabs[0]
+    if (seededTab?.type !== 'terminal') {
+      throw new Error('expected seeded terminal')
+    }
+    runtime.registerPty(ptyId, 'workspace-0', null, {
+      tabId: seededTab.parentTabId,
+      leafId: seededTab.leafId
+    })
+    const publications: RuntimeMobileSessionTabsResult[] = []
+    let viewerState = makeViewerState()
+    const unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => {
+      publications.push(structuredClone(snapshot))
+      const patch = applyFreshWebSessionTabsSnapshot(
+        viewerState,
+        snapshot,
+        ENVIRONMENT_ID,
+        Date.now()
+      )
+      viewerState = { ...viewerState, ...patch }
+    })
+
+    runtime.onPtyData(
+      ptyId,
+      '\x1b]9999;{"state":"working","prompt":"retained work","agentType":"codex"}\x07',
+      Date.now()
+    )
+    vi.advanceTimersByTime(50)
+    expect(publications).toHaveLength(1)
+    const initialTerminal = publications[0]?.tabs[0]
+    const initialStatus =
+      initialTerminal?.type === 'terminal' ? initialTerminal.agentStatus : undefined
+    expect(initialStatus).toMatchObject({ state: 'working', prompt: 'retained work' })
+    publications.length = 0
+
+    vi.advanceTimersByTime(10)
+    runtime.onPtyData(ptyId, '\x1b]0;⠋ Codex working\x07', Date.now())
+    vi.advanceTimersByTime(50)
+    expect(publications).toHaveLength(1)
+    const titledTerminal = publications[0]?.tabs[0]
+    const titledStatus =
+      titledTerminal?.type === 'terminal' ? titledTerminal.agentStatus : undefined
+    expect(titledStatus).toMatchObject({ state: 'working', prompt: 'retained work' })
+    expect(titledStatus?.stateStartedAt).toBe(initialStatus?.stateStartedAt)
+    publications.length = 0
+
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS)
+    runtime.onPtyData(ptyId, '\x1b]0;⠙ Codex working\x07', Date.now())
+    vi.advanceTimersByTime(50)
+
+    expect(publications).toHaveLength(1)
+    const refreshedTerminal = publications[0]?.tabs[0]
+    const refreshedStatus =
+      refreshedTerminal?.type === 'terminal' ? refreshedTerminal.agentStatus : undefined
+    expect(refreshedStatus).toMatchObject({ state: 'working', prompt: 'retained work' })
+    expect(refreshedStatus?.updatedAt).toBeGreaterThan(initialStatus!.updatedAt)
+    expect(refreshedStatus?.stateStartedAt).toBe(initialStatus?.stateStartedAt)
+    expect(initialStatus!.updatedAt + 1).toBeGreaterThanOrEqual(refreshedStatus!.stateStartedAt)
+
+    publications.length = 0
+    vi.advanceTimersByTime(SESSION_TABS_AGENT_STATUS_HEARTBEAT_INTERVAL_MS)
+    runtime.onPtyData(ptyId, '\x1b]0;⠹ Codex working\x07', Date.now())
+    vi.advanceTimersByTime(50)
+
+    expect(publications).toHaveLength(1)
+    const expiredHookTerminal = publications[0]?.tabs[0]
+    const titleOnlyStatus =
+      expiredHookTerminal?.type === 'terminal' ? expiredHookTerminal.agentStatus : undefined
+    expect(titleOnlyStatus).toMatchObject({ state: 'working', prompt: '' })
+    expect(titleOnlyStatus?.updatedAt).toBeGreaterThan(refreshedStatus!.updatedAt)
+    expect(titleOnlyStatus?.stateStartedAt).toBe(initialStatus?.stateStartedAt)
+    expect(Date.now() - initialStatus!.updatedAt).toBeGreaterThan(AGENT_STATUS_STALE_AFTER_MS)
+    const viewerStatus = Object.values(viewerState.agentStatusByPaneKey)[0]
+    expect(viewerStatus?.prompt).toBe('')
+    expect(isExplicitAgentStatusFresh(viewerStatus!, Date.now(), AGENT_STATUS_STALE_AFTER_MS)).toBe(
+      true
+    )
+    unsubscribe()
+  })
+})
diff --git a/tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts b/tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts
new file mode 100644
index 00000000000..2c60fe19082
--- /dev/null
+++ b/tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts
@@ -0,0 +1,305 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from '../../src/main/runtime/orca-runtime'
+import type {
+  RuntimeMobileSessionTabsResult,
+  RuntimeMobileSessionTabsSnapshot
+} from '../../src/shared/runtime-types'
+
+const PTY_ID = 'pty-0'
+const WORKTREE_ID = 'workspace-0'
+const TAB_ID = 'host-tab-0'
+const LEAF_ID = '00000000-0000-4000-8000-000000000000'
+
+type TerminalTab = Extract<RuntimeMobileSessionTabsSnapshot['tabs'][number], { type: 'terminal' }>
+
+type RuntimeInternals = {
+  mobileSessionTabsByWorktree: Map<string, RuntimeMobileSessionTabsSnapshot>
+  ptysById: Map<string, { lastAgentStatusRichInvalidatedAtEpochMs: number | null }>
+  resetTrackedTerminalStateForProviderGeneration: (ptyId: string) => void
+}
+
+type Harness = {
+  internals: RuntimeInternals
+  publications: RuntimeMobileSessionTabsResult[]
+  runtime: OrcaRuntimeService
+  tab: TerminalTab
+  unsubscribe: () => void
+}
+
+function createHarness(): Harness {
+  const runtime = new OrcaRuntimeService()
+  runtime.registerPty(PTY_ID, WORKTREE_ID)
+  const tab: TerminalTab = {
+    type: 'terminal',
+    id: `${TAB_ID}::${LEAF_ID}`,
+    parentTabId: TAB_ID,
+    leafId: LEAF_ID,
+    ptyId: PTY_ID,
+    title: 'Cursor Agent',
+    parentLayout: {
+      root: { type: 'leaf', leafId: LEAF_ID },
+      activeLeafId: LEAF_ID,
+      expandedLeafId: null,
+      ptyIdsByLeafId: { [LEAF_ID]: PTY_ID }
+    },
+    isActive: true
+  }
+  const internals = runtime as unknown as RuntimeInternals
+  internals.mobileSessionTabsByWorktree.set(WORKTREE_ID, {
+    worktree: WORKTREE_ID,
+    publicationEpoch: 'epoch-1',
+    snapshotVersion: 1,
+    activeGroupId: 'group-0',
+    activeTabId: tab.id,
+    activeTabType: 'terminal',
+    tabs: [tab]
+  })
+  const publications: RuntimeMobileSessionTabsResult[] = []
+  const unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => {
+    publications.push(structuredClone(snapshot))
+  })
+  return { internals, publications, runtime, tab, unsubscribe }
+}
+
+function setRichStatus(
+  tab: TerminalTab,
+  args: { agentType?: 'claude' | 'cursor'; prompt: string; at: number }
+): void {
+  tab.agentStatus = {
+    state: 'working',
+    prompt: args.prompt,
+    updatedAt: args.at,
+    stateStartedAt: args.at,
+    agentType: args.agentType ?? 'cursor',
+    paneKey: tab.id,
+    stateHistory: []
+  }
+}
+
+function emitTitle(harness: Harness, title: string, at = Date.now()): void {
+  harness.runtime.onPtyData(PTY_ID, `\x1b]0;${title}\x07`, at)
+  vi.advanceTimersByTime(50)
+}
+
+function latestStatus(harness: Harness) {
+  const terminal = harness.publications.at(-1)?.tabs[0]
+  return terminal?.type === 'terminal' ? terminal.agentStatus : undefined
+}
+
+describe('session-tabs rich-status boundaries', () => {
+  beforeEach(() => vi.useFakeTimers())
+  afterEach(() => vi.useRealTimers())
+
+  it('does not renew a previous task across a done-to-working title boundary', () => {
+    const harness = createHarness()
+    const firstWorkingAt = Date.now()
+    setRichStatus(harness.tab, { prompt: 'previous task', at: firstWorkingAt })
+    emitTitle(harness, '⠋ Cursor Agent', firstWorkingAt)
+    vi.advanceTimersByTime(1)
+    emitTitle(harness, 'bash')
+    harness.publications.length = 0
+
+    vi.advanceTimersByTime(1)
+    const nextWorkingAt = Date.now()
+    emitTitle(harness, '⠙ Cursor Agent', nextWorkingAt)
+    expect(latestStatus(harness)).toMatchObject({
+      state: 'working',
+      prompt: '',
+      updatedAt: nextWorkingAt,
+      stateStartedAt: nextWorkingAt
+    })
+    harness.unsubscribe()
+  })
+
+  it('preserves the same task across a neutral title', () => {
+    const harness = createHarness()
+    const workingAt = Date.now()
+    setRichStatus(harness.tab, { prompt: 'current task', at: workingAt })
+    emitTitle(harness, '⠋ Cursor Agent', workingAt)
+
+    harness.publications.length = 0
+    vi.advanceTimersByTime(1)
+    emitTitle(harness, 'Terminal')
+    expect(latestStatus(harness)).toMatchObject({
+      state: 'working',
+      prompt: 'current task',
+      updatedAt: workingAt,
+      stateStartedAt: workingAt
+    })
+
+    harness.publications.length = 0
+    vi.advanceTimersByTime(1)
+    const resumedWorkingAt = Date.now()
+    emitTitle(harness, '⠙ Cursor Agent', resumedWorkingAt)
+    expect(latestStatus(harness)).toMatchObject({
+      state: 'working',
+      prompt: 'current task',
+      updatedAt: resumedWorkingAt,
+      stateStartedAt: workingAt
+    })
+    harness.unsubscribe()
+  })
+
+  it('does not resurrect a task after neutral then shell titles', () => {
+    const harness = createHarness()
+    setRichStatus(harness.tab, { prompt: 'completed task', at: Date.now() })
+    emitTitle(harness, '⠋ Cursor Agent')
+    vi.advanceTimersByTime(1)
+    emitTitle(harness, 'Terminal')
+    vi.advanceTimersByTime(1)
+    emitTitle(harness, 'bash')
+    harness.publications.length = 0
+
+    vi.advanceTimersByTime(1)
+    const nextWorkingAt = Date.now()
+    emitTitle(harness, '⠙ Cursor Agent', nextWorkingAt)
+    expect(latestStatus(harness)).toMatchObject({
+      state: 'working',
+      prompt: '',
+      updatedAt: nextWorkingAt,
+      stateStartedAt: nextWorkingAt
+    })
+    harness.unsubscribe()
+  })
+
+  it('does not carry a stale question into the next title interval', () => {
+    const harness = createHarness()
+    const firstWorkingAt = Date.now()
+    harness.tab.agentStatus = {
+      state: 'waiting',
+      prompt: 'previous question',
+      interactivePrompt: '{"question":"previous question"}',
+      updatedAt: firstWorkingAt,
+      stateStartedAt: firstWorkingAt,
+      agentType: 'cursor',
+      paneKey: harness.tab.id,
+      stateHistory: []
+    }
+    emitTitle(harness, 'Cursor Agent needs confirmation', firstWorkingAt)
+    vi.advanceTimersByTime(1)
+    emitTitle(harness, 'bash')
+    harness.publications.length = 0
+
+    vi.advanceTimersByTime(1)
+    emitTitle(harness, '⠋ Cursor Agent')
+    expect(latestStatus(harness)).toMatchObject({ state: 'working', prompt: '' })
+    expect(latestStatus(harness)).not.toHaveProperty('interactivePrompt')
+    harness.unsubscribe()
+  })
+
+  it('keeps a renderer question visible under a shell title until the next agent interval', () => {
+    const harness = createHarness()
+    const questionAt = Date.now()
+    harness.tab.agentStatus = {
+      state: 'waiting',
+      prompt: 'current question',
+      interactivePrompt: '{"question":"current question"}',
+      updatedAt: questionAt,
+      stateStartedAt: questionAt,
+      agentType: 'cursor',
+      paneKey: harness.tab.id,
+      stateHistory: []
+    }
+
+    emitTitle(harness, 'bash')
+    expect(latestStatus(harness)).toMatchObject({
+      state: 'waiting',
+      interactivePrompt: '{"question":"current question"}'
+    })
+
+    harness.publications.length = 0
+    vi.advanceTimersByTime(1)
+    emitTitle(harness, '⠋ Cursor Agent')
+    expect(latestStatus(harness)).toMatchObject({ state: 'working', prompt: '' })
+    expect(latestStatus(harness)).not.toHaveProperty('interactivePrompt')
+    harness.unsubscribe()
+  })
+
+  it('keeps a retained OSC question visible under a shell title until the next agent interval', () => {
+    const harness = createHarness()
+    harness.runtime.registerPty(PTY_ID, WORKTREE_ID, null, {
+      tabId: harness.tab.parentTabId,
+      leafId: harness.tab.leafId
+    })
+    harness.runtime.onPtyData(
+      PTY_ID,
+      '\x1b]9999;{"state":"waiting","prompt":"current question","interactivePrompt":"question-payload","agentType":"cursor"}\x07',
+      Date.now()
+    )
+
+    emitTitle(harness, 'bash')
+    expect(latestStatus(harness)).toMatchObject({
+      state: 'waiting',
+      interactivePrompt: 'question-payload'
+    })
+
+    harness.publications.length = 0
+    vi.advanceTimersByTime(1)
+    emitTitle(harness, '⠋ Cursor Agent')
+    expect(latestStatus(harness)).toMatchObject({ state: 'working', prompt: '' })
+    expect(latestStatus(harness)).not.toHaveProperty('interactivePrompt')
+    harness.unsubscribe()
+  })
+
+  it('does not resurrect retained status after an identity-only owner change', () => {
+    const harness = createHarness()
+    harness.runtime.registerPty(PTY_ID, WORKTREE_ID, null, {
+      tabId: harness.tab.parentTabId,
+      leafId: harness.tab.leafId
+    })
+    harness.runtime.onPtyData(
+      PTY_ID,
+      '\x1b]9999;{"state":"working","prompt":"retained task","agentType":"codex"}\x07',
+      Date.now()
+    )
+    vi.advanceTimersByTime(50)
+    emitTitle(harness, '⠋ Codex working')
+    harness.publications.length = 0
+
+    vi.advanceTimersByTime(1)
+    emitTitle(harness, 'Cursor Agent')
+    expect(latestStatus(harness)).toMatchObject({ state: 'done', prompt: '' })
+    harness.unsubscribe()
+  })
+
+  it('does not renew rich status from a replaced provider generation', () => {
+    const harness = createHarness()
+    const firstWorkingAt = Date.now()
+    setRichStatus(harness.tab, { prompt: 'previous provider task', at: firstWorkingAt })
+    emitTitle(harness, '⠋ Cursor Agent', firstWorkingAt)
+    harness.tab.agentStatus!.updatedAt = Date.now()
+    harness.internals.resetTrackedTerminalStateForProviderGeneration(PTY_ID)
+    harness.publications.length = 0
+
+    vi.advanceTimersByTime(1)
+    const replacementWorkingAt = Date.now()
+    emitTitle(harness, '⠙ Cursor Agent', replacementWorkingAt)
+    expect(latestStatus(harness)).toMatchObject({
+      state: 'working',
+      prompt: '',
+      updatedAt: replacementWorkingAt,
+      stateStartedAt: replacementWorkingAt
+    })
+    harness.unsubscribe()
+  })
+
+  it('keeps invalidation across an identity-only owner change', () => {
+    const harness = createHarness()
+    setRichStatus(harness.tab, {
+      prompt: 'previous owner task',
+      at: Date.now(),
+      agentType: 'claude'
+    })
+    emitTitle(harness, '⠋ Claude working')
+    harness.publications.length = 0
+
+    vi.advanceTimersByTime(1)
+    const identityChangeAt = Date.now()
+    emitTitle(harness, 'Cursor Agent', identityChangeAt)
+    expect(harness.internals.ptysById.get(PTY_ID)?.lastAgentStatusRichInvalidatedAtEpochMs).toBe(
+      identityChangeAt
+    )
+    expect(latestStatus(harness)).toBeUndefined()
+    harness.unsubscribe()
+  })
+})
diff --git a/tests/e2e/ssh-config-host-import.spec.ts b/tests/e2e/ssh-config-host-import.spec.ts
index 959d180ddde..4fba64f6adf 100644
--- a/tests/e2e/ssh-config-host-import.spec.ts
+++ b/tests/e2e/ssh-config-host-import.spec.ts
@@ -148,7 +148,7 @@ test.describe('SSH config host import (bulk + settings re-adopt)', () => {
     await expect(
       configHostRow(reopened, hosts.bravo).getByText('In Orca', { exact: true })
     ).toBeVisible()
-    await expect(reopened.getByRole('button', { name: 'All hosts already in Orca' })).toBeDisabled()
+    await expect(reopened.getByRole('button', { name: 'No new hosts to add' })).toBeDisabled()
   })
 
   // ── P7 ─────────────────────────────────────────────────────────────
@@ -164,13 +164,17 @@ test.describe('SSH config host import (bulk + settings re-adopt)', () => {
     )
 
     const picker = await openSshConfigHostPicker(orcaPage)
-    // Suppressed aliases are omitted from the picker entirely.
-    await expect(configHostRow(picker, hosts.alpha)).toHaveCount(0)
+    // Suppressed aliases stay listed (re-pickable) but never count as new.
+    const alphaRow = configHostRow(picker, hosts.alpha)
+    await expect(alphaRow).toBeVisible()
+    await expect(alphaRow).toBeEnabled()
+    await expect(alphaRow.getByText('Removed from Orca', { exact: true })).toBeVisible()
+    await expect(alphaRow.getByText('In Orca', { exact: true })).toHaveCount(0)
     await expect(configHostRow(picker, hosts.bravo)).toBeVisible()
     await expect(
       configHostRow(picker, hosts.bravo).getByText('In Orca', { exact: true })
     ).toBeVisible()
-    await expect(picker.getByRole('button', { name: 'All hosts already in Orca' })).toBeDisabled()
+    await expect(picker.getByRole('button', { name: 'No new hosts to add' })).toBeDisabled()
     await expect(picker.getByRole('button', { name: /Add all \d+ to Orca/ })).toHaveCount(0)
 
     await returnToAppShell(orcaPage)
diff --git a/tests/e2e/ssh-docker-relay-perf.spec.ts b/tests/e2e/ssh-docker-relay-perf.spec.ts
index 775f7cc5f62..fe39cfef709 100644
--- a/tests/e2e/ssh-docker-relay-perf.spec.ts
+++ b/tests/e2e/ssh-docker-relay-perf.spec.ts
@@ -50,6 +50,11 @@ function shellQuote(value: string): string {
   return `'${value.replaceAll("'", "'\\''")}'`
 }
 
+function encodedRemoteNodeCommand(script: string): string {
+  const encoded = Buffer.from(script, 'utf8').toString('base64')
+  return `node -e ${shellQuote(`eval(Buffer.from('${encoded}', 'base64').toString('utf8'))`)}`
+}
+
 function remoteTypingLoadScript(runId: string): string {
   return [
     "process.stdin.setEncoding('utf8')",
@@ -368,7 +373,9 @@ test.describe('Docker SSH relay perf', () => {
       await waitForActiveTerminalManager(orcaPage, 60_000)
       const beforePtyId = await waitForActivePanePtyId(orcaPage, 60_000)
       const beforeMarker = `SSH_RECONNECT_BEFORE_${Date.now()}`
-      await execInTerminal(orcaPage, beforePtyId, `printf ${shellQuote(beforeMarker)}`)
+      const beforeCommand = encodedRemoteNodeCommand(`process.stdout.write('${beforeMarker}\\n')`)
+      expect(beforeCommand).not.toContain(beforeMarker)
+      await execInTerminal(orcaPage, beforePtyId, beforeCommand)
       await waitForTerminalOutput(orcaPage, beforeMarker, 20_000, 60_000)
       const recoveryStartedMarker = `SSH_RECONNECT_RECOVERY_STARTED_${Date.now()}`
       const recoveryMarker = `SSH_RECONNECT_RECOVERY_${Date.now()}`
@@ -382,7 +389,10 @@ test.describe('Docker SSH relay perf', () => {
         `if (frame === 256) { clearInterval(timer); process.stdout.write('${recoveryMarker}\\n') }`,
         '}, 10)'
       ].join(';')
-      await execInTerminal(orcaPage, beforePtyId, `node -e ${shellQuote(recoveryScript)}`)
+      const recoveryCommand = encodedRemoteNodeCommand(recoveryScript)
+      expect(recoveryCommand).not.toContain(recoveryStartedMarker)
+      expect(recoveryCommand).not.toContain(recoveryMarker)
+      await execInTerminal(orcaPage, beforePtyId, recoveryCommand)
       await waitForTerminalOutput(orcaPage, recoveryStartedMarker, 30_000, 80_000)
 
       await reconnectDockerSshRelayTarget(orcaPage, remote.targetId)
@@ -392,11 +402,16 @@ test.describe('Docker SSH relay perf', () => {
       await waitForTerminalOutput(orcaPage, recoveryMarker, 30_000, 80_000)
       const afterMarker = `SSH_RECONNECT_AFTER_${Date.now()}`
       const remoteProofPath = `/tmp/${afterMarker}`
-      await execInTerminal(
-        orcaPage,
-        afterPtyId,
-        `printf ${shellQuote(afterMarker)} | tee ${shellQuote(remoteProofPath)}`
+      const afterCommand = encodedRemoteNodeCommand(
+        [
+          "const fs = require('node:fs')",
+          `const marker = '${afterMarker}'`,
+          `fs.writeFileSync('${remoteProofPath}', marker)`,
+          "process.stdout.write(marker + '\\n')"
+        ].join(';')
       )
+      expect(afterCommand).not.toContain(afterMarker)
+      await execInTerminal(orcaPage, afterPtyId, afterCommand)
       await waitForTerminalOutput(orcaPage, afterMarker, 20_000, 60_000)
       expect(execDockerSshRelayTargetCommand(target, `cat ${shellQuote(remoteProofPath)}`)).toBe(
         afterMarker
diff --git a/tests/e2e/tab-create-entry-file-paths.spec.ts b/tests/e2e/tab-create-entry-file-paths.spec.ts
index bde87a1f4ae..5f18b8bd0e1 100644
--- a/tests/e2e/tab-create-entry-file-paths.spec.ts
+++ b/tests/e2e/tab-create-entry-file-paths.spec.ts
@@ -19,9 +19,9 @@ test('new-tab file results prioritize the filename and reveal the full path on h
   await ensureTerminalVisible(orcaPage)
 
   await orcaPage.getByRole('button', { name: 'New tab' }).click({ force: true })
-  const input = orcaPage.getByRole('combobox', {
-    name: 'Open any file, URL, agent, ...'
-  })
+  // Not the placeholder/aria-label: that copy is translated and already drifted
+  // once. aria-controls points at the results listbox id, which is structural.
+  const input = orcaPage.locator('input[role="combobox"][aria-controls="tab-create-entry-results"]')
   await input.fill('secondaryNav')
 
   const row = orcaPage.locator('[role="option"]').filter({ hasText: 'Open file' }).first()
diff --git a/tests/e2e/tab-rename.spec.ts b/tests/e2e/tab-rename.spec.ts
index a7063f9af21..6e7f0a7fdc1 100644
--- a/tests/e2e/tab-rename.spec.ts
+++ b/tests/e2e/tab-rename.spec.ts
@@ -308,6 +308,56 @@ test.describe('Tab Rename (Inline)', () => {
     await expect(renameInput).toBeHidden()
   })
 
+  test('terminal title updates do not resize neighboring tabs', async ({ orcaPage }) => {
+    const worktreeId = (await getActiveWorktreeId(orcaPage))!
+    const tabIds = await orcaPage.evaluate((targetWorktreeId) => {
+      const state = window.__store!.getState()
+      const existing = state.tabsByWorktree[targetWorktreeId] ?? []
+      for (let index = existing.length; index < 3; index += 1) {
+        state.createTab(targetWorktreeId, undefined, undefined, { activate: false })
+      }
+      const ids = (window.__store!.getState().tabsByWorktree[targetWorktreeId] ?? [])
+        .slice(0, 3)
+        .map((tab) => tab.id)
+      ids.forEach((id, index) => state.setTabCustomTitle(id, `Tab ${index + 1}`))
+      return ids
+    }, worktreeId)
+
+    const tabs = tabIds.map((id) =>
+      orcaPage.locator(`[data-testid="sortable-tab"][data-tab-id="${id}"]`)
+    )
+    await expect(tabs[2]!).toBeVisible()
+    const before = await Promise.all(
+      tabs.map((tab) => tab.evaluate((element) => element.getBoundingClientRect().width))
+    )
+    // Why: at the 88px shrink floor widths are stable for the wrong reason, and being above it is
+    // also what proves the definite tab width applied — so this fails first on a regression.
+    expect(
+      Math.min(...before),
+      'tabs must be above the 88px shrink floor for the stability check to mean anything'
+    ).toBeGreaterThan(88)
+
+    await orcaPage.evaluate(
+      ({ tabId }) => {
+        window
+          .__store!.getState()
+          .setTabCustomTitle(
+            tabId,
+            'Continuously changing generated terminal title that must remain constrained'
+          )
+      },
+      { tabId: tabIds[0] }
+    )
+    await expect(tabs[0]!).toContainText('Continuously changing generated terminal title')
+    const after = await Promise.all(
+      tabs.map((tab) => tab.evaluate((element) => element.getBoundingClientRect().width))
+    )
+
+    after.forEach((width, index) => expect(Math.abs(width - before[index]!)).toBeLessThanOrEqual(1))
+    await tabs[2]!.click()
+    await expect(tabs[2]!).toHaveAttribute('data-active', 'true')
+  })
+
   test('rename input stays at a usable width when many tabs are open', async ({ orcaPage }) => {
     const worktreeId = (await getActiveWorktreeId(orcaPage))!
     const targetTabId = await getActiveTabId(orcaPage)
diff --git a/tests/e2e/terminal-ai-vault-typing-latency.spec.ts b/tests/e2e/terminal-ai-vault-typing-latency.spec.ts
new file mode 100644
index 00000000000..4fd46be33b6
--- /dev/null
+++ b/tests/e2e/terminal-ai-vault-typing-latency.spec.ts
@@ -0,0 +1,230 @@
+import type { Page, TestInfo } from '@stablyai/playwright-test'
+import { randomUUID } from 'node:crypto'
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { test, expect } from './helpers/orca-app'
+import {
+  focusActiveTerminalInput,
+  sendToTerminal,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForTerminalOutput
+} from './helpers/terminal'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  collectCodexEchoLatencyReport,
+  installCodexEchoLatencyProbe,
+  summarizeLatencies,
+  type CodexEchoProbeReport,
+  type LatencyDistribution
+} from './codex-composer-echo-latency-probe'
+import { seedVaultTranscriptBatch, typingEchoScript } from './ai-vault-typing-bench-corpus'
+import {
+  readVaultRefreshDuration,
+  startRendererJankProbe,
+  stopRendererJankProbe,
+  triggerVaultRefresh,
+  type RendererJank
+} from './ai-vault-typing-bench-renderer-probe'
+
+const BENCH_ENABLED = process.env.ORCA_AI_VAULT_TYPING_BENCH === '1'
+const RESULTS_DIR = path.resolve(__dirname, '..', 'tools', 'benchmarks', 'results')
+
+function readPositiveInt(name: string, fallback: number): number {
+  const value = Number(process.env[name])
+  return Number.isInteger(value) && value > 0 ? value : fallback
+}
+
+const ITERATIONS = readPositiveInt('ORCA_AI_VAULT_BENCH_ITERATIONS', 3)
+const SESSION_COUNT = readPositiveInt('ORCA_AI_VAULT_BENCH_SESSIONS', 300)
+const PAYLOAD_KIB = readPositiveInt('ORCA_AI_VAULT_BENCH_PAYLOAD_KIB', 128)
+const KEY_COUNT = readPositiveInt('ORCA_AI_VAULT_BENCH_KEYS', 100)
+const KEY_CADENCE_MS = readPositiveInt('ORCA_AI_VAULT_BENCH_CADENCE_MS', 30)
+const BENCH_LABEL = process.env.ORCA_AI_VAULT_BENCH_LABEL ?? 'dev'
+const TYPING_ALPHABET = 'abcdefghijklmnopqrstuvwxyz'
+
+type ArmResult = {
+  iteration: number
+  scenario: 'control' | 'vault-refresh'
+  order: number
+  refreshDurationMs: number | null
+  echo: CodexEchoProbeReport
+  parse: LatencyDistribution
+  render: LatencyDistribution
+  missingEchoCount: number
+  rendererJank: RendererJank
+}
+
+async function openAiVaultSidebar(page: Page): Promise<void> {
+  await page.evaluate(() => {
+    const store = window.__store
+    if (!store) {
+      throw new Error('Store unavailable')
+    }
+    store.getState().setRightSidebarOpen(true)
+    store.getState().setRightSidebarTab('vault')
+  })
+  const refresh = page.getByRole('button', { name: 'Refresh Session History' })
+  await expect(refresh).toBeVisible()
+  await expect(refresh).toBeEnabled({ timeout: 30_000 })
+}
+
+async function typeAtCadence(page: Page, target: string): Promise<void> {
+  for (const char of target) {
+    const startedAt = performance.now()
+    await page.keyboard.type(char)
+    const remaining = KEY_CADENCE_MS - (performance.now() - startedAt)
+    if (remaining > 0) {
+      await page.waitForTimeout(remaining)
+    }
+  }
+}
+
+async function runArm(args: {
+  page: Page
+  ptyId: string
+  scriptPath: string
+  iteration: number
+  scenario: ArmResult['scenario']
+  order: number
+}): Promise<ArmResult> {
+  const readyMarker = `VAULT_TYPING_READY_${randomUUID()}`
+  writeFileSync(args.scriptPath, typingEchoScript(readyMarker))
+  await sendToTerminal(args.page, args.ptyId, `node ${JSON.stringify(args.scriptPath)}\r`)
+  await waitForTerminalOutput(args.page, readyMarker, 15_000)
+  const target = TYPING_ALPHABET.repeat(Math.ceil(KEY_COUNT / TYPING_ALPHABET.length)).slice(
+    0,
+    KEY_COUNT
+  )
+  await installCodexEchoLatencyProbe(args.page, target)
+  await startRendererJankProbe(args.page)
+  if (args.scenario === 'vault-refresh') {
+    await triggerVaultRefresh(args.page)
+  }
+  await focusActiveTerminalInput(args.page)
+  await typeAtCadence(args.page, target)
+  if (args.scenario === 'vault-refresh') {
+    await expect(args.page.getByRole('button', { name: 'Refresh Session History' })).toBeEnabled({
+      timeout: 120_000
+    })
+  }
+  const refreshDurationMs =
+    args.scenario === 'vault-refresh' ? await readVaultRefreshDuration(args.page) : null
+  await args.page.waitForTimeout(100)
+  const echo = await collectCodexEchoLatencyReport(args.page)
+  const rendererJank = await stopRendererJankProbe(args.page)
+  await sendToTerminal(args.page, args.ptyId, '\x03').catch(() => undefined)
+  const parse = summarizeLatencies(echo.samples.map((sample) => sample.keyToParseMs))
+  const render = summarizeLatencies(
+    echo.samples.flatMap((sample) => (sample.keyToRenderMs === null ? [] : [sample.keyToRenderMs]))
+  )
+  return {
+    iteration: args.iteration,
+    scenario: args.scenario,
+    order: args.order,
+    refreshDurationMs,
+    echo,
+    parse,
+    render,
+    missingEchoCount: KEY_COUNT - echo.samples.length,
+    rendererJank
+  }
+}
+
+function aggregate(arms: ArmResult[], scenario: ArmResult['scenario']): object {
+  const selected = arms.filter((arm) => arm.scenario === scenario)
+  return {
+    parse: summarizeLatencies(
+      selected.flatMap((arm) => arm.echo.samples.map((s) => s.keyToParseMs))
+    ),
+    render: summarizeLatencies(
+      selected.flatMap((arm) => arm.echo.samples.flatMap((s) => s.keyToRenderMs ?? []))
+    ),
+    maxTimerDriftMs: Math.max(...selected.map((arm) => arm.rendererJank.maxTimerDriftMs)),
+    maxFrameGapMs: Math.max(...selected.map((arm) => arm.rendererJank.maxFrameGapMs)),
+    maxLongTaskMs: Math.max(...selected.map((arm) => arm.rendererJank.maxLongTaskMs)),
+    refresh: summarizeLatencies(selected.flatMap((arm) => arm.refreshDurationMs ?? [])),
+    missingEchoCount: selected.reduce((sum, arm) => sum + arm.missingEchoCount, 0)
+  }
+}
+
+function writeReport(testInfo: TestInfo, arms: ArmResult[], seededBytes: number): string {
+  const report = {
+    benchmark: 'terminal-ai-vault-typing-latency',
+    label: BENCH_LABEL,
+    timestamp: new Date().toISOString(),
+    config: {
+      iterations: ITERATIONS,
+      sessionCount: SESSION_COUNT,
+      payloadKib: PAYLOAD_KIB,
+      keyCount: KEY_COUNT,
+      keyCadenceMs: KEY_CADENCE_MS
+    },
+    seededBytes,
+    aggregate: {
+      control: aggregate(arms, 'control'),
+      vaultRefresh: aggregate(arms, 'vault-refresh')
+    },
+    arms
+  }
+  mkdirSync(RESULTS_DIR, { recursive: true })
+  const stamp = report.timestamp.replace(/[:.]/g, '-')
+  const outPath = path.join(RESULTS_DIR, `ai-vault-typing-${BENCH_LABEL}-${stamp}.json`)
+  writeFileSync(outPath, JSON.stringify(report, null, 2))
+  testInfo.annotations.push({ type: 'ai-vault-typing-bench', description: outPath })
+  console.log(`[ai-vault-typing] report ${outPath}`)
+  console.log(`[ai-vault-typing] ${JSON.stringify(report.aggregate)}`)
+  return outPath
+}
+
+test.describe('Terminal typing during AI Vault refresh bench', () => {
+  test.setTimeout(10 * 60 * 1000)
+
+  test('alternates control typing and forced Vault refresh typing', async ({
+    electronApp,
+    orcaPage,
+    testRepoPath
+  }, testInfo) => {
+    test.skip(!BENCH_ENABLED, 'Bench-only: run via pnpm bench:ai-vault-typing')
+    await waitForSessionReady(orcaPage)
+    await waitForActiveWorktree(orcaPage)
+    await ensureTerminalVisible(orcaPage)
+    await waitForActiveTerminalManager(orcaPage, 30_000)
+    await openAiVaultSidebar(orcaPage)
+    const ptyId = await waitForActivePanePtyId(orcaPage)
+    const homePath = await electronApp.evaluate(({ app }) => app.getPath('home'))
+    const scriptPath = path.join(testRepoPath, `.orca-vault-typing-${randomUUID()}.mjs`)
+    const arms: ArmResult[] = []
+    let seededBytes = 0
+
+    try {
+      for (let iteration = 0; iteration < ITERATIONS; iteration += 1) {
+        const batch = seedVaultTranscriptBatch({
+          homePath,
+          cwd: testRepoPath,
+          batch: iteration,
+          sessionCount: SESSION_COUNT,
+          payloadBytes: PAYLOAD_KIB * 1024
+        })
+        seededBytes += batch.totalBytes
+        const scenarios: ArmResult['scenario'][] =
+          iteration % 2 === 0 ? ['control', 'vault-refresh'] : ['vault-refresh', 'control']
+        for (const [order, scenario] of scenarios.entries()) {
+          arms.push(await runArm({ page: orcaPage, ptyId, scriptPath, iteration, scenario, order }))
+          if (scenario === 'vault-refresh') {
+            await expect(
+              orcaPage.getByText(batch.newestTitle, { exact: true }).first()
+            ).toBeVisible({
+              timeout: 30_000
+            })
+          }
+        }
+      }
+      writeReport(testInfo, arms, seededBytes)
+      expect(arms.every((arm) => arm.missingEchoCount === 0)).toBe(true)
+    } finally {
+      await sendToTerminal(orcaPage, ptyId, '\x03').catch(() => undefined)
+      rmSync(scriptPath, { force: true })
+    }
+  })
+})
diff --git a/tests/e2e/terminal-hidden-tui-visual-restore.spec.ts b/tests/e2e/terminal-hidden-tui-visual-restore.spec.ts
index 96476cb0cd2..a78f4e81fa1 100644
--- a/tests/e2e/terminal-hidden-tui-visual-restore.spec.ts
+++ b/tests/e2e/terminal-hidden-tui-visual-restore.spec.ts
@@ -28,7 +28,7 @@ type HiddenTuiWindow = Window & {
   __terminalPtyOutputDebug?: {
     reset: () => void
     snapshot: () => {
-      hiddenRendererMode2031ReplyCount: number
+      hiddenRendererSkipCount: number
     }
   }
 }
diff --git a/tests/e2e/terminal-ime-cdp-composition.ts b/tests/e2e/terminal-ime-cdp-composition.ts
new file mode 100644
index 00000000000..e035db8bef0
--- /dev/null
+++ b/tests/e2e/terminal-ime-cdp-composition.ts
@@ -0,0 +1,89 @@
+import type { CDPSession } from '@stablyai/playwright-test'
+
+/**
+ * Dispatches the key shapes an input source or a system text substitution produces, through CDP.
+ *
+ * Driving these from the browser protocol rather than a native input source is what removes the
+ * accessibility grant and the system input source that would otherwise force a `@headful`,
+ * macOS-only gate, so the specs they feed run in the normal headless project on CI.
+ */
+export type ImeKeyIdentity = {
+  key: string
+  code: string
+  keyCode: number
+}
+
+/**
+ * A printable keydown whose `key` the input source has already rewritten to the glyph it will
+ * commit — the shape a CJK source produces for punctuation and full-width digits, which arrive
+ * with no composition session at all.
+ */
+export async function dispatchImeRewrittenPrintableKey(
+  session: CDPSession,
+  identity: ImeKeyIdentity
+): Promise<void> {
+  await session.send('Input.dispatchKeyEvent', {
+    type: 'keyDown',
+    key: identity.key,
+    code: identity.code,
+    windowsVirtualKeyCode: identity.keyCode,
+    nativeVirtualKeyCode: identity.keyCode,
+    text: identity.key,
+    unmodifiedText: identity.key
+  })
+  await session.send('Input.dispatchKeyEvent', {
+    type: 'keyUp',
+    key: identity.key,
+    code: identity.code,
+    windowsVirtualKeyCode: identity.keyCode,
+    nativeVirtualKeyCode: identity.keyCode
+  })
+}
+
+/**
+ * A printable keydown that still carries the **physical layout key**, followed by the substituted
+ * glyph arriving through the text system.
+ *
+ * This is the macOS shape for full-width punctuation and digits, and for a
+ * `DefaultKeyBinding.dict` remap: the substitution happens inside `insertText:`, not on the
+ * keydown, so the keydown Chromium delivers is the plain layout character and the substituted one
+ * only ever appears in the `input` event. Anything that produces terminal bytes from the keydown
+ * emits the layout form and destroys the real one.
+ */
+export async function dispatchImeSubstitutedTextKey(
+  session: CDPSession,
+  identity: ImeKeyIdentity,
+  committedText: string
+): Promise<void> {
+  // rawKeyDown carries no `text`, so Chromium generates no character of its own and the only
+  // committed text is the one the text system supplies below.
+  await session.send('Input.dispatchKeyEvent', {
+    type: 'rawKeyDown',
+    key: identity.key,
+    code: identity.code,
+    windowsVirtualKeyCode: identity.keyCode,
+    nativeVirtualKeyCode: identity.keyCode,
+    text: '',
+    unmodifiedText: ''
+  })
+  await session.send('Input.insertText', { text: committedText })
+  await session.send('Input.dispatchKeyEvent', {
+    type: 'keyUp',
+    key: identity.key,
+    code: identity.code,
+    windowsVirtualKeyCode: identity.keyCode,
+    nativeVirtualKeyCode: identity.keyCode
+  })
+}
+
+export async function dispatchPlainEnter(session: CDPSession): Promise<void> {
+  for (const type of ['rawKeyDown', 'keyUp'] as const) {
+    await session.send('Input.dispatchKeyEvent', {
+      type,
+      key: 'Enter',
+      code: 'Enter',
+      windowsVirtualKeyCode: 13,
+      nativeVirtualKeyCode: 13
+    })
+  }
+}
diff --git a/tests/e2e/terminal-ime-pane-arena.ts b/tests/e2e/terminal-ime-pane-arena.ts
new file mode 100644
index 00000000000..4462814d06a
--- /dev/null
+++ b/tests/e2e/terminal-ime-pane-arena.ts
@@ -0,0 +1,50 @@
+import type { CDPSession, Page, TestInfo } from '@stablyai/playwright-test'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  focusActiveTerminalInput,
+  sendToTerminal,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager
+} from './helpers/terminal'
+import {
+  attachTerminalImeBoundaryEvidence,
+  disposeTerminalImeBoundaryProbe,
+  installTerminalImeBoundaryProbe
+} from './terminal-ime-boundary-probe'
+
+/** A focused terminal pane with a CDP session and the boundary probe already attached. */
+export type TerminalImePaneArena = {
+  page: Page
+  session: CDPSession
+  ptyId: string
+}
+
+export async function openTerminalImePaneArena(page: Page): Promise<TerminalImePaneArena> {
+  await waitForSessionReady(page)
+  await waitForActiveWorktree(page)
+  await ensureTerminalVisible(page)
+  await waitForActiveTerminalManager(page, 30_000)
+  const ptyId = await waitForActivePanePtyId(page)
+  const session = await page.context().newCDPSession(page)
+  await focusActiveTerminalInput(page)
+  await installTerminalImeBoundaryProbe(page)
+  return { page, session, ptyId }
+}
+
+/**
+ * `interrupt` sends Ctrl+C only when the test did not reach its end, so a spec that failed
+ * mid-composition cannot leave a byte reader holding the pane for the next test in the worker.
+ */
+export async function closeTerminalImePaneArena(
+  arena: TerminalImePaneArena,
+  testInfo: TestInfo,
+  evidenceName: string,
+  interrupt: boolean
+): Promise<void> {
+  await attachTerminalImeBoundaryEvidence(arena.page, testInfo, evidenceName).catch(() => undefined)
+  await disposeTerminalImeBoundaryProbe(arena.page).catch(() => undefined)
+  await arena.session.detach().catch(() => undefined)
+  if (interrupt) {
+    await sendToTerminal(arena.page, arena.ptyId, '\x03').catch(() => undefined)
+  }
+}
diff --git a/tests/e2e/terminal-ime-platform-policy.ts b/tests/e2e/terminal-ime-platform-policy.ts
new file mode 100644
index 00000000000..04adb66f0ea
--- /dev/null
+++ b/tests/e2e/terminal-ime-platform-policy.ts
@@ -0,0 +1,51 @@
+import type { Page } from '@stablyai/playwright-test'
+
+/**
+ * Pins the renderer's IME ownership policy to one platform, from any runner.
+ *
+ * Every platform-dependent IME decision in the terminal reads `navigator.userAgent` and nothing
+ * else — the forwarder that owns printable keydowns installs only when the UA reports macOS, the
+ * candidate-key guards only when it reports desktop Linux, and the standalone `keyCode 229`
+ * keydown reaches xterm on macOS and Linux but not on Windows. Overriding the UA is therefore the
+ * whole platform decision, which is what lets the Windows and Linux shapes run headless on the
+ * Linux CI shards instead of needing three runners.
+ *
+ * What it does NOT simulate is the input framework itself. That comes from the recorded traces
+ * replayed against the pinned policy, because the frameworks disagree on ordering in ways no
+ * hand-authored sequence would have predicted.
+ */
+export type ImePlatformPolicy = 'mac' | 'windows' | 'linux'
+
+const USER_AGENT_BY_POLICY: Record<ImePlatformPolicy, string> = {
+  mac: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/146 Safari/537.36',
+  windows: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/146 Safari/537.36',
+  // X11 rather than Wayland in the UA string: Chromium reports the same token for both, so the
+  // Wayland traces run under this policy too.
+  linux: 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/146 Safari/537.36'
+}
+
+export async function applyImePlatformPolicy(page: Page, policy: ImePlatformPolicy): Promise<void> {
+  await page.addInitScript((userAgent) => {
+    Object.defineProperty(navigator, 'userAgent', {
+      get: () => userAgent,
+      configurable: true
+    })
+  }, USER_AGENT_BY_POLICY[policy])
+  await page.reload({ waitUntil: 'domcontentloaded' })
+  await page.waitForFunction(() => Boolean(window.__store), null, { timeout: 30_000 })
+}
+
+/** Fails loudly if the override did not take, so a policy-scoped spec cannot pass on the wrong one. */
+export async function expectImePlatformPolicy(
+  page: Page,
+  policy: ImePlatformPolicy
+): Promise<void> {
+  const observed = await page.evaluate(() => ({
+    mac: navigator.userAgent.includes('Mac'),
+    windows: navigator.userAgent.includes('Windows'),
+    linux: navigator.userAgent.includes('Linux') && !/Android|CrOS/.test(navigator.userAgent)
+  }))
+  if (!observed[policy] || (policy !== 'mac' && observed.mac)) {
+    throw new Error(`IME platform policy '${policy}' did not take: ${JSON.stringify(observed)}`)
+  }
+}
diff --git a/tests/e2e/terminal-link-click-ownership.spec.ts b/tests/e2e/terminal-link-click-ownership.spec.ts
new file mode 100644
index 00000000000..50b570b0a6d
--- /dev/null
+++ b/tests/e2e/terminal-link-click-ownership.spec.ts
@@ -0,0 +1,161 @@
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import type { Page, TestInfo } from '@playwright/test'
+import { test, expect } from './helpers/orca-app'
+import {
+  execInTerminal,
+  sendToTerminal,
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForPaneCount,
+  waitForTerminalOutput
+} from './helpers/terminal'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+
+const FIXTURE_PATH = path.join(
+  process.cwd(),
+  'tests/e2e/fixtures/terminal-link-mouse-owner-fixture.cjs'
+)
+const LINK = 'https://example.com/sta-3888'
+const OSC_LINK_TEXT = 'STA_3888_OSC_LINK'
+
+type LinkTarget = { x: number; y: number; mouseTrackingMode: string }
+type LinkMode = 'http' | 'osc'
+
+async function startMouseAwareLinkFixture(
+  orcaPage: Page,
+  testInfo: TestInfo,
+  linkMode: LinkMode = 'http'
+): Promise<{ mouseLogPath: string; ptyId: string; target: LinkTarget }> {
+  await waitForSessionReady(orcaPage)
+  await waitForActiveWorktree(orcaPage)
+  await ensureTerminalVisible(orcaPage)
+  await waitForActiveTerminalManager(orcaPage)
+  await waitForPaneCount(orcaPage, 1)
+
+  const ptyId = await waitForActivePanePtyId(orcaPage)
+  const mouseLogPath = testInfo.outputPath('child-mouse-reports.log')
+  await execInTerminal(
+    orcaPage,
+    ptyId,
+    `node ${JSON.stringify(FIXTURE_PATH)} ${JSON.stringify(mouseLogPath)} ${linkMode}`
+  )
+  const renderedLinkText = linkMode === 'osc' ? OSC_LINK_TEXT : LINK
+  await waitForTerminalOutput(orcaPage, 'LINK_MOUSE_READY')
+
+  const target = await orcaPage.evaluate((linkText) => {
+    const state = window.__store?.getState()
+    const worktreeId = state?.activeWorktreeId
+    const tabId = worktreeId ? state?.activeTabIdByWorktree?.[worktreeId] : null
+    const manager = tabId ? window.__paneManagers?.get(tabId) : null
+    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
+    const screen = pane?.terminal.element?.querySelector<HTMLElement>('.xterm-screen') ?? null
+    if (!pane || !screen) {
+      throw new Error('Active terminal screen unavailable')
+    }
+
+    const buffer = pane.terminal.buffer.active
+    for (let viewportRow = 0; viewportRow < pane.terminal.rows; viewportRow += 1) {
+      const text = buffer.getLine(buffer.viewportY + viewportRow)?.translateToString(false)
+      const column = text?.indexOf(linkText) ?? -1
+      if (column < 0) {
+        continue
+      }
+      const rect = screen.getBoundingClientRect()
+      const cell = pane.terminal.dimensions?.css.cell
+      if (!cell?.width || !cell.height) {
+        throw new Error('Active terminal cell dimensions unavailable')
+      }
+      return {
+        x: rect.left + (column + linkText.length / 2) * cell.width,
+        y: rect.top + (viewportRow + 0.5) * cell.height,
+        mouseTrackingMode: pane.terminal.modes.mouseTrackingMode
+      }
+    }
+    throw new Error('Rendered fixture link unavailable')
+  }, renderedLinkText)
+
+  expect(target.mouseTrackingMode).not.toBe('none')
+  return { mouseLogPath, ptyId, target }
+}
+
+function childMouseReportCount(mouseLogPath: string): number {
+  if (!existsSync(mouseLogPath)) {
+    return 0
+  }
+  return readFileSync(mouseLogPath, 'utf8').trim().split(/\s+/).filter(Boolean).length
+}
+
+async function expectChildMouseReports(mouseLogPath: string): Promise<void> {
+  await expect
+    .poll(() => childMouseReportCount(mouseLogPath), { timeout: 5_000 })
+    .toBeGreaterThan(0)
+}
+
+async function expectOrcaOwnedMouseOutcome(mouseLogPath: string): Promise<void> {
+  await new Promise<void>((resolve) => setTimeout(resolve, 1_000))
+  expect(childMouseReportCount(mouseLogPath)).toBe(0)
+}
+
+test.describe('terminal link click ownership', () => {
+  test('an Orca-owned plain link click emits no child PTY mouse frames', async ({
+    orcaPage
+  }, testInfo) => {
+    const { mouseLogPath, ptyId, target } = await startMouseAwareLinkFixture(orcaPage, testInfo)
+    await orcaPage.mouse.click(target.x, target.y)
+
+    await expect(orcaPage.locator('[data-terminal-link-action-popover]')).toBeVisible()
+    await expect(orcaPage.locator('[data-terminal-link-destination]')).toHaveText(LINK)
+
+    await expectOrcaOwnedMouseOutcome(mouseLogPath)
+
+    await sendToTerminal(orcaPage, ptyId, 'q')
+  })
+
+  test('an Orca-owned OSC link click emits no child PTY mouse frames', async ({
+    orcaPage
+  }, testInfo) => {
+    const { mouseLogPath, ptyId, target } = await startMouseAwareLinkFixture(
+      orcaPage,
+      testInfo,
+      'osc'
+    )
+    await orcaPage.mouse.move(target.x, target.y)
+    await expect(orcaPage.locator('.xterm-hover')).toHaveCount(1)
+    await orcaPage.mouse.click(target.x, target.y)
+
+    await expect(orcaPage.locator('[data-terminal-link-action-popover]')).toBeVisible()
+    await expect(orcaPage.locator('[data-terminal-link-destination]')).toHaveText(LINK)
+    await expectOrcaOwnedMouseOutcome(mouseLogPath)
+
+    await sendToTerminal(orcaPage, ptyId, 'q')
+  })
+
+  test('a plain click stays child-owned when link actions are disabled', async ({
+    orcaPage
+  }, testInfo) => {
+    const { mouseLogPath, ptyId, target } = await startMouseAwareLinkFixture(orcaPage, testInfo)
+    await orcaPage.evaluate(async () => {
+      await window.__store?.getState().updateSettings({ terminalLinkActionPopoverEnabled: false })
+    })
+
+    await orcaPage.mouse.click(target.x, target.y)
+
+    await expect(orcaPage.locator('[data-terminal-link-action-popover]')).toHaveCount(0)
+    await expectChildMouseReports(mouseLogPath)
+    await sendToTerminal(orcaPage, ptyId, 'q')
+  })
+
+  test('a drag across a link stays child-owned', async ({ orcaPage }, testInfo) => {
+    const { mouseLogPath, ptyId, target } = await startMouseAwareLinkFixture(orcaPage, testInfo)
+
+    await orcaPage.mouse.move(target.x, target.y)
+    await orcaPage.mouse.down()
+    await orcaPage.mouse.move(target.x + 12, target.y + 12, { steps: 3 })
+    await orcaPage.mouse.up()
+
+    await expect(orcaPage.locator('[data-terminal-link-action-popover]')).toHaveCount(0)
+    await expectChildMouseReports(mouseLogPath)
+    await sendToTerminal(orcaPage, ptyId, 'q')
+  })
+})
diff --git a/tests/e2e/terminal-link-hover-after-worktree-return.spec.ts b/tests/e2e/terminal-link-hover-after-worktree-return.spec.ts
index 70912388cba..ee5ebe81079 100644
--- a/tests/e2e/terminal-link-hover-after-worktree-return.spec.ts
+++ b/tests/e2e/terminal-link-hover-after-worktree-return.spec.ts
@@ -56,7 +56,7 @@ async function locateHoverProbe(page: Page, needle: string): Promise<HoverProbe>
         continue
       }
       const idx = line.translateToString(true).indexOf(needle)
-      if (idx >= 0) {
+      if (idx !== -1) {
         hit = { row, col: idx }
         break
       }
diff --git a/tests/e2e/terminal-paste-ownership.spec.ts b/tests/e2e/terminal-paste-ownership.spec.ts
index 5df66cbce04..56c65a139aa 100644
--- a/tests/e2e/terminal-paste-ownership.spec.ts
+++ b/tests/e2e/terminal-paste-ownership.spec.ts
@@ -114,7 +114,7 @@ async function rightClickActiveTerminalSurface(page: Page): Promise<void> {
 
 async function installClipboardReadTerminalBlurRepro(app: ElectronApplication): Promise<void> {
   await app.evaluate(({ BrowserWindow, ipcMain }) => {
-    type ClipboardReadHandler = (event: unknown, ...args: unknown[]) => Promise<unknown> | unknown
+    type ClipboardReadHandler = (event: unknown, ...args: unknown[]) => unknown
     const global = globalThis as unknown as {
       __orcaOriginalClipboardReadTextHandler?: ClipboardReadHandler
     }
@@ -152,7 +152,7 @@ async function installClipboardReadTerminalBlurRepro(app: ElectronApplication):
 
 async function restoreClipboardReadTerminalBlurRepro(app: ElectronApplication): Promise<void> {
   await app.evaluate(({ ipcMain }) => {
-    type ClipboardReadHandler = (event: unknown, ...args: unknown[]) => Promise<unknown> | unknown
+    type ClipboardReadHandler = (event: unknown, ...args: unknown[]) => unknown
     const global = globalThis as unknown as {
       __orcaOriginalClipboardReadTextHandler?: ClipboardReadHandler
     }
diff --git a/tests/e2e/terminal-tab-switch-visual-restore.spec.ts b/tests/e2e/terminal-tab-switch-visual-restore.spec.ts
index 4f0d2a5df11..938dc852179 100644
--- a/tests/e2e/terminal-tab-switch-visual-restore.spec.ts
+++ b/tests/e2e/terminal-tab-switch-visual-restore.spec.ts
@@ -60,7 +60,6 @@ type SchedulerDebugWindow = Window & {
 type HiddenOutputDebugSnapshot = {
   hiddenRendererSkipCount: number
   hiddenRendererSkippedChars: number
-  hiddenRendererMode2031ReplyCount: number
 }
 
 type HiddenOutputRecoveryWindow = Window & {
diff --git a/tests/e2e/worktree-jump-palette-filter.spec.ts b/tests/e2e/worktree-jump-palette-filter.spec.ts
index 02a7e08f8ac..90b2c7b5137 100644
--- a/tests/e2e/worktree-jump-palette-filter.spec.ts
+++ b/tests/e2e/worktree-jump-palette-filter.spec.ts
@@ -6,6 +6,7 @@ const LOCAL_PROJECT = 'E2E Palette Local Project'
 const REMOTE_PROJECT = 'E2E Palette Remote Project'
 const REMOTE_WORKSPACE = 'E2E Palette Remote Workspace'
 const REMOTE_HOST = 'E2E Palette Builder'
+const SEARCH_PLACEHOLDER = 'Search chats, terminals, worktrees, settings, and actions...'
 
 type PaletteFilterFixture = { localWorktreeId: string; remoteWorktreeId: string }
 
@@ -107,7 +108,7 @@ async function openPalette(page: Page): Promise<void> {
 }
 
 async function searchFixtureWorkspaces(page: Page, fixture: PaletteFilterFixture): Promise<void> {
-  const input = palette(page).getByPlaceholder('Search worktrees, settings, tabs, and actions...')
+  const input = palette(page).getByPlaceholder(SEARCH_PLACEHOLDER)
   await input.fill('E2E Palette')
   await expect(worktreeRow(page, fixture.localWorktreeId)).toBeVisible()
   await expect(worktreeRow(page, fixture.remoteWorktreeId)).toBeVisible()
@@ -115,7 +116,7 @@ async function searchFixtureWorkspaces(page: Page, fixture: PaletteFilterFixture
 
 async function selectRemoteHost(page: Page, useKeyboard = false): Promise<void> {
   if (useKeyboard) {
-    const input = palette(page).getByPlaceholder('Search worktrees, settings, tabs, and actions...')
+    const input = palette(page).getByPlaceholder(SEARCH_PLACEHOLDER)
     await input.press('Tab')
     await expect(filterTrigger(page)).toBeFocused()
     await filterTrigger(page).click()
@@ -152,9 +153,7 @@ test.describe('Worktree jump-palette filters', () => {
     await expect(worktreeRow(orcaPage, fixture.localWorktreeId)).toHaveCount(0)
 
     // P2: host and project fields intersect, with the filter-specific empty state.
-    await palette(orcaPage)
-      .getByPlaceholder('Search worktrees, settings, tabs, and actions...')
-      .fill('')
+    await palette(orcaPage).getByPlaceholder(SEARCH_PLACEHOLDER).fill('')
     await filterTrigger(orcaPage).click()
     await palette(orcaPage).getByText('Projects', { exact: true }).click()
     const projects = palette(orcaPage).getByRole('listbox', { name: 'Projects' })
diff --git a/tests/tools/benchmarks/mutation-receipt-capacity-bench.mjs b/tests/tools/benchmarks/mutation-receipt-capacity-bench.mjs
new file mode 100644
index 00000000000..dfdcfe6cf13
--- /dev/null
+++ b/tests/tools/benchmarks/mutation-receipt-capacity-bench.mjs
@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+import { DatabaseSync } from 'node:sqlite'
+import { mkdtempSync, rmSync, statSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { performance } from 'node:perf_hooks'
+
+const ROW_LIMIT = 10_000
+const PRUNE_BATCH_SIZE = 64
+
+function parseArgs(argv) {
+  const options = { iterations: 32, payloadBytes: 9_500 }
+  for (let index = 2; index < argv.length; index += 1) {
+    const value = argv[index + 1]
+    if (argv[index] === '--iterations') {
+      options.iterations = Number(value)
+    } else if (argv[index] === '--payload-bytes') {
+      options.payloadBytes = Number(value)
+    } else {
+      throw new Error(`Unknown argument: ${argv[index]}`)
+    }
+    index += 1
+  }
+  if (!Number.isSafeInteger(options.iterations) || options.iterations < 1) {
+    throw new Error('--iterations must be a positive integer')
+  }
+  if (!Number.isSafeInteger(options.payloadBytes) || options.payloadBytes < 0) {
+    throw new Error('--payload-bytes must be a non-negative integer')
+  }
+  return options
+}
+
+function createFixture(path, payloadBytes, optimized) {
+  const db = new DatabaseSync(path)
+  db.exec(`
+    PRAGMA journal_mode = WAL;
+    PRAGMA synchronous = NORMAL;
+    CREATE TABLE mutation_receipts (
+      caller_fingerprint TEXT NOT NULL,
+      request_id TEXT NOT NULL,
+      method TEXT NOT NULL,
+      payload_hash TEXT NOT NULL,
+      state TEXT NOT NULL,
+      receipt BLOB,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      PRIMARY KEY (caller_fingerprint, request_id)
+    );
+    WITH RECURSIVE receipt_numbers(value) AS (
+      VALUES (1)
+      UNION ALL
+      SELECT value + 1 FROM receipt_numbers WHERE value < ${ROW_LIMIT}
+    )
+    INSERT INTO mutation_receipts (
+      caller_fingerprint, request_id, method, payload_hash, state, receipt
+    )
+    SELECT 'caller', printf('request_%05d', value), 'orchestration.send',
+           printf('hash_%05d', value), 'completed', zeroblob(${payloadBytes})
+    FROM receipt_numbers;
+  `)
+  if (optimized) {
+    db.exec(`
+      CREATE INDEX idx_mutation_receipts_completed_updated
+        ON mutation_receipts(updated_at) WHERE state = 'completed';
+      CREATE TABLE mutation_receipt_ledger (
+        singleton INTEGER PRIMARY KEY,
+        receipt_count INTEGER NOT NULL
+      );
+      INSERT INTO mutation_receipt_ledger VALUES (1, ${ROW_LIMIT});
+      CREATE TRIGGER mutation_receipts_count_insert AFTER INSERT ON mutation_receipts
+      BEGIN
+        UPDATE mutation_receipt_ledger SET receipt_count = receipt_count + 1;
+      END;
+      CREATE TRIGGER mutation_receipts_count_delete AFTER DELETE ON mutation_receipts
+      BEGIN
+        UPDATE mutation_receipt_ledger SET receipt_count = receipt_count - 1;
+      END;
+    `)
+  }
+  db.exec('PRAGMA wal_checkpoint(TRUNCATE)')
+  return db
+}
+
+function runLegacyMutation(db, iteration) {
+  db.exec('BEGIN IMMEDIATE')
+  db.prepare(
+    `DELETE FROM mutation_receipts
+     WHERE state = 'completed' AND updated_at < datetime('now', '-30 days')`
+  ).run()
+  const { count } = db.prepare('SELECT COUNT(*) AS count FROM mutation_receipts').get()
+  const completedToRemove = count - ROW_LIMIT + 1
+  if (completedToRemove > 0) {
+    db.prepare(
+      `DELETE FROM mutation_receipts WHERE rowid IN (
+         SELECT rowid FROM mutation_receipts WHERE state = 'completed'
+         ORDER BY updated_at, rowid LIMIT ?
+       )`
+    ).run(completedToRemove)
+  }
+  db.prepare('SELECT COUNT(*) AS count FROM mutation_receipts').get()
+  insertReceipt(db, iteration)
+  db.exec('COMMIT')
+}
+
+function runOptimizedMutation(db, iteration) {
+  db.exec('BEGIN IMMEDIATE')
+  db.prepare(
+    `DELETE FROM mutation_receipts
+     WHERE state = 'completed' AND updated_at < datetime('now', '-30 days')`
+  ).run()
+  const { receipt_count: count } = db
+    .prepare('SELECT receipt_count FROM mutation_receipt_ledger WHERE singleton = 1')
+    .get()
+  if (count >= ROW_LIMIT) {
+    db.prepare(
+      `DELETE FROM mutation_receipts WHERE rowid IN (
+         SELECT rowid FROM mutation_receipts WHERE state = 'completed'
+         ORDER BY updated_at, rowid LIMIT ?
+       )`
+    ).run(count - ROW_LIMIT + PRUNE_BATCH_SIZE)
+  }
+  db.prepare('SELECT receipt_count FROM mutation_receipt_ledger WHERE singleton = 1').get()
+  insertReceipt(db, iteration)
+  db.exec('COMMIT')
+}
+
+function insertReceipt(db, iteration) {
+  db.prepare(
+    `INSERT INTO mutation_receipts (
+       caller_fingerprint, request_id, method, payload_hash, state
+     ) VALUES ('benchmark', ?, 'orchestration.send', ?, 'pending')`
+  ).run(`new_${iteration}`, `new_hash_${iteration}`)
+}
+
+function percentile(sorted, fraction) {
+  return sorted[Math.min(sorted.length - 1, Math.ceil(sorted.length * fraction) - 1)]
+}
+
+function measure(db, iterations, mutation) {
+  const samplesMs = []
+  for (let index = 0; index < iterations; index += 1) {
+    const startedAt = performance.now()
+    mutation(db, index)
+    samplesMs.push(performance.now() - startedAt)
+  }
+  const sorted = samplesMs.toSorted((left, right) => left - right)
+  return {
+    firstMs: samplesMs[0],
+    medianMs: percentile(sorted, 0.5),
+    p95Ms: percentile(sorted, 0.95),
+    maxMs: sorted.at(-1),
+    totalMs: samplesMs.reduce((sum, value) => sum + value, 0)
+  }
+}
+
+const options = parseArgs(process.argv)
+const fixtureDir = mkdtempSync(join(tmpdir(), 'orca-mutation-receipt-bench-'))
+try {
+  const legacyPath = join(fixtureDir, 'legacy.db')
+  const optimizedPath = join(fixtureDir, 'optimized.db')
+  const legacyDb = createFixture(legacyPath, options.payloadBytes, false)
+  const optimizedDb = createFixture(optimizedPath, options.payloadBytes, true)
+  const databaseBytes = statSync(legacyPath).size
+  const legacy = measure(legacyDb, options.iterations, runLegacyMutation)
+  const optimized = measure(optimizedDb, options.iterations, runOptimizedMutation)
+  legacyDb.close()
+  optimizedDb.close()
+
+  process.stdout.write(
+    `${JSON.stringify(
+      {
+        rows: ROW_LIMIT,
+        payloadBytes: options.payloadBytes,
+        databaseBytes,
+        iterations: options.iterations,
+        legacy,
+        optimized,
+        medianSpeedup: legacy.medianMs / optimized.medianMs,
+        totalSpeedup: legacy.totalMs / optimized.totalMs
+      },
+      null,
+      2
+    )}\n`
+  )
+} finally {
+  rmSync(fixtureDir, { recursive: true, force: true })
+}
diff --git a/tests/tools/fish-mode2031-repro/capture-fish-mode2031-trace.mjs b/tests/tools/fish-mode2031-repro/capture-fish-mode2031-trace.mjs
new file mode 100644
index 00000000000..1b2cbcae38c
--- /dev/null
+++ b/tests/tools/fish-mode2031-repro/capture-fish-mode2031-trace.mjs
@@ -0,0 +1,398 @@
+#!/usr/bin/env node
+/**
+ * Ground-truth repro harness for issue #9993: color-scheme (CSI ?997;1n) replies
+ * leaking into a child process' stdin under fish.
+ *
+ * Simulates Orca's terminal pipeline around a REAL fish shell:
+ *   node-pty  ->  scanMode2031ReplyDecision() (the real scanner from
+ *                 src/shared/terminal-color-scheme-protocol.ts)
+ *             ->  reply `CSI ?997;1n` written back to the PTY, optionally after
+ *                 a delay that models the renderer IPC round-trip.
+ *
+ * Requires Node >= 22.18 (native TypeScript type stripping) so the real .ts
+ * scanner can be imported without a build step.
+ *
+ * Usage:
+ *   node tests/tools/fish-mode2031-repro/capture-fish-mode2031-trace.mjs [options]
+ *
+ *   --delay=<ms>        reply delay; 0 = synchronous in-process (default 0)
+ *   --shell=<path>      fish binary (default /opt/homebrew/bin/fish)
+ *   --user-config       use the caller's real fish config (Tide etc.) instead of
+ *                       an isolated minimal config
+ *   --prompt-cmd        add an external command substitution to fish_prompt, so
+ *                       the prompt itself forces extra tty handoffs
+ *   --no-probes         do NOT answer DA1/DA2/CPR/XTVERSION/OSC 10/11 (fish then
+ *                       stalls 10s on its DA1 wait)
+ *   --accept-delay=<ms> gap between typing the command and pressing Enter (300)
+ *   --paste             send command + Enter in a single write (paste-like)
+ *   --no-reply          never answer 2031 (control run)
+ *   --json              append a machine-readable summary
+ */
+
+import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { createRequire } from 'node:module'
+
+const require = createRequire(import.meta.url)
+const REPO_ROOT = path.resolve(import.meta.dirname, '../../..')
+
+const pty = require(path.join(REPO_ROOT, 'node_modules/node-pty'))
+const { INITIAL_MODE_2031_REPLY_SCAN_STATE, mode2031SequenceFor, scanMode2031ReplyDecision } =
+  await import(path.join(REPO_ROOT, 'src/shared/terminal-color-scheme-protocol.ts'))
+
+// ---------------------------------------------------------------- args
+
+const argv = process.argv.slice(2)
+const flag = (name) => argv.includes(`--${name}`)
+const opt = (name, fallback) => {
+  const hit = argv.find((a) => a.startsWith(`--${name}=`))
+  return hit === undefined ? fallback : hit.slice(name.length + 3)
+}
+
+const REPLY_DELAY_MS = Number(opt('delay', '0'))
+const SHELL = opt('shell', '/opt/homebrew/bin/fish')
+const USE_USER_CONFIG = flag('user-config')
+const ANSWER_PROBES = !flag('no-probes')
+const REPLY_ENABLED = !flag('no-reply')
+const EMIT_JSON = flag('json')
+const ACCEPT_DELAY_MS = Number(opt('accept-delay', '300'))
+const PASTE = flag('paste')
+const PROMPT_CMD = flag('prompt-cmd')
+const TYPEAHEAD = flag('typeahead')
+const TYPEAHEAD_AT_MS = Number(opt('typeahead-at', '150'))
+const SETTLE_MS = Number(opt('settle', '400'))
+
+const PROMPT_MARK = 'HARNESS> '
+const CHILD_CMD = `python3 -c 'import sys; d=sys.stdin.readline(); print("GOT:", repr(d))'`
+
+// ---------------------------------------------------------------- tracing
+
+const t0 = process.hrtime.bigint()
+const ms = () => Number(process.hrtime.bigint() - t0) / 1e6
+const stamp = () => ms().toFixed(3).padStart(10, ' ')
+
+const trace = []
+function log(dir, label, detail) {
+  const line = `[${stamp()}ms] ${dir.padEnd(12)} ${label}${detail ? ` ${detail}` : ''}`
+  trace.push(line)
+  console.log(line)
+}
+
+function esc(s) {
+  let out = ''
+  for (const ch of s) {
+    const c = ch.codePointAt(0)
+    if (ch === '\x1b') {
+      out += '\\e'
+    } else if (ch === '\n') {
+      out += '\\n'
+    } else if (ch === '\r') {
+      out += '\\r'
+    } else if (ch === '\t') {
+      out += '\\t'
+    } else if (c < 0x20 || c === 0x7f) {
+      out += `\\x${c.toString(16).padStart(2, '0')}`
+    } else if (c === 0x9b) {
+      out += '\\x9b'
+    } else {
+      out += ch
+    }
+  }
+  return out
+}
+
+const CHUNK_PRINT_CAP = 1200
+function escCapped(s) {
+  const e = esc(s)
+  return e.length > CHUNK_PRINT_CAP
+    ? `${e.slice(0, CHUNK_PRINT_CAP)}…<+${e.length - CHUNK_PRINT_CAP} esc-chars>`
+    : e
+}
+
+// ---------------------------------------------------------------- fish config
+
+let configHome = null
+const env = { ...process.env, TERM: 'xterm-256color', COLORTERM: 'truecolor', LANG: 'en_US.UTF-8' }
+delete env.FISH_HISTORY
+if (!USE_USER_CONFIG) {
+  configHome = mkdtempSync(path.join(tmpdir(), 'fish-2031-'))
+  mkdirSync(path.join(configHome, 'fish'), { recursive: true })
+  // Plain prompt: no Tide, no async prompt machinery. fish core still toggles
+  // DEC 2031 in tty_handoff.rs regardless of the prompt.
+  const promptBody = PROMPT_CMD
+    ? `set -l __x (/bin/echo -n ok); printf '${PROMPT_MARK}'`
+    : `printf '${PROMPT_MARK}'`
+  writeFileSync(
+    path.join(configHome, 'fish/config.fish'),
+    [
+      'set -g fish_greeting ""',
+      `function fish_prompt; ${promptBody}; end`,
+      'function fish_right_prompt; end',
+      ''
+    ].join('\n')
+  )
+  env.XDG_CONFIG_HOME = configHome
+  env.XDG_DATA_HOME = path.join(configHome, 'data')
+}
+
+// ---------------------------------------------------------------- pty
+
+log(
+  'HARNESS',
+  'config',
+  JSON.stringify({
+    shell: SHELL,
+    replyDelayMs: REPLY_DELAY_MS,
+    acceptDelayMs: ACCEPT_DELAY_MS,
+    paste: PASTE,
+    promptCmd: PROMPT_CMD,
+    replyEnabled: REPLY_ENABLED,
+    userConfig: USE_USER_CONFIG,
+    answerProbes: ANSWER_PROBES,
+    xdgConfigHome: configHome
+  })
+)
+
+const term = pty.spawn(SHELL, ['-l', '-i'], {
+  name: 'xterm-256color',
+  cols: 120,
+  rows: 30,
+  cwd: REPO_ROOT,
+  env
+})
+
+let scanState = INITIAL_MODE_2031_REPLY_SCAN_STATE
+let all = ''
+let replyCount = 0
+const replyEvents = []
+const decisionEvents = []
+let phase = 'boot'
+let chunkSeq = 0
+let lastDecision = null
+let staleReplyCount = 0
+
+function ptyWrite(bytes, label) {
+  log('HARNESS->PTY', label, `"${esc(bytes)}"`)
+  term.write(bytes)
+}
+
+function sendMode2031Reply(reason) {
+  replyCount += 1
+  // Stale = the scanner has already seen fish's `CSI ?2031l` (tty handed to a child)
+  // by the time this reply actually reaches the PTY. That reply lands in the child's stdin.
+  const stale = lastDecision === 'unsubscribed'
+  if (stale) {
+    staleReplyCount += 1
+  }
+  replyEvents.push({ at: ms(), phase, reason, delayMs: REPLY_DELAY_MS, stale })
+  ptyWrite(
+    mode2031SequenceFor('dark'),
+    `reply#${replyCount} CSI ?997;1n (${reason}, phase=${phase}${stale ? ', STALE: fish already sent ?2031l' : ''})`
+  )
+}
+
+// Modest emulation of the other terminal replies fish may probe for.
+function answerProbes(data) {
+  if (!ANSWER_PROBES) {
+    return
+  }
+  // oxlint-disable no-control-regex -- terminal escape sequences require control chars
+  if (/\x1b\[(?:0)?c/.test(data)) {
+    ptyWrite('\x1b[?62;4;6;22c', 'probe reply DA1')
+  }
+  if (/\x1b\[>(?:0)?c/.test(data)) {
+    ptyWrite('\x1b[>1;95;0c', 'probe reply DA2')
+  }
+  if (/\x1b\[(?:6n)/.test(data)) {
+    ptyWrite('\x1b[1;1R', 'probe reply CPR')
+  }
+  if (/\x1b\[>q/.test(data)) {
+    ptyWrite('\x1bP>|orca-harness(1)\x1b\\', 'probe reply XTVERSION')
+  }
+  if (/\x1b\]10;\?/.test(data)) {
+    ptyWrite('\x1b]10;rgb:ffff/ffff/ffff\x1b\\', 'probe reply OSC 10')
+  }
+  if (/\x1b\]11;\?/.test(data)) {
+    ptyWrite('\x1b]11;rgb:1e1e/1e1e/1e1e\x1b\\', 'probe reply OSC 11')
+  }
+  // oxlint-enable no-control-regex
+}
+
+term.onData((data) => {
+  const seq = ++chunkSeq
+  all += data
+  // oxlint-disable-next-line no-control-regex -- terminal escape sequences require control chars
+  const mode2031ToggleRe = /\x1b\[\?([0-9;]+)([hl])/g
+  const toggles = [...data.matchAll(mode2031ToggleRe)]
+    .filter((m) => m[1].split(';').some((p) => Number(p) === 2031))
+    .map((m) => `?2031${m[2]}`)
+  log(
+    'PTY->SCANNER',
+    `chunk#${seq} len=${data.length}${toggles.length ? ` toggles=[${toggles.join(',')}]` : ''}`,
+    `"${escCapped(data)}"`
+  )
+
+  const before = scanState
+  const result = scanMode2031ReplyDecision(scanState, data)
+  scanState = result.state
+  if (result.decision || before.pendingSubscribe !== scanState.pendingSubscribe || scanState.tail) {
+    log(
+      'SCANNER',
+      `chunk#${seq} decision=${result.decision ?? 'null'}`,
+      `state={tail:"${esc(scanState.tail)}",pendingSubscribe:${scanState.pendingSubscribe}}`
+    )
+  }
+  if (result.decision) {
+    lastDecision = result.decision
+    decisionEvents.push({ at: ms(), seq, decision: result.decision, phase })
+  }
+
+  if (REPLY_ENABLED && result.decision === 'subscribed') {
+    if (REPLY_DELAY_MS <= 0) {
+      sendMode2031Reply(`chunk#${seq} sync`)
+    } else {
+      setTimeout(() => sendMode2031Reply(`chunk#${seq} +${REPLY_DELAY_MS}ms`), REPLY_DELAY_MS)
+    }
+  }
+  answerProbes(data)
+})
+
+let exitInfo = null
+term.onExit((e) => {
+  exitInfo = e
+  log('PTY', 'exit', JSON.stringify(e))
+})
+
+// ---------------------------------------------------------------- driving
+
+const sleep = (n) => new Promise((r) => setTimeout(r, n))
+async function waitFor(pred, timeoutMs, what) {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() < deadline) {
+    if (pred()) {
+      return true
+    }
+    await sleep(10)
+  }
+  log('HARNESS', 'TIMEOUT', `waiting for ${what}`)
+  return false
+}
+
+const countPrompts = () => all.split(PROMPT_MARK).length - 1
+
+try {
+  phase = 'boot'
+  await waitFor(() => all.includes(PROMPT_MARK), 15000, 'first prompt')
+  await sleep(SETTLE_MS)
+
+  let promptsBeforeAccept
+  let repliesBeforeAccept
+  let decisionsBeforeAccept
+  let outLenBeforeAccept
+
+  if (TYPEAHEAD) {
+    // Most realistic leak window: queue the command while an external command
+    // still owns the tty. fish redraws the prompt (`CSI ?2031h`) and consumes the
+    // buffered line in the same breath, so the handoff to the child happens
+    // sub-millisecond after the subscribe.
+    phase = 'pre-command'
+    log('HARNESS', 'MARK', '--- running `sleep 0.4` so the next line is typed ahead ---')
+    ptyWrite('sleep 0.4\r', 'pre-command')
+    await sleep(TYPEAHEAD_AT_MS)
+
+    promptsBeforeAccept = countPrompts()
+    repliesBeforeAccept = replyCount
+    decisionsBeforeAccept = decisionEvents.length
+    outLenBeforeAccept = all.length
+
+    phase = 'prompt-accept'
+    log('HARNESS', 'MARK', '--- type-ahead: command + Enter while sleep still owns the tty ---')
+    ptyWrite(`${CHILD_CMD}\r`, 'typeahead command + Enter')
+  } else if (PASTE) {
+    promptsBeforeAccept = countPrompts()
+    repliesBeforeAccept = replyCount
+    decisionsBeforeAccept = decisionEvents.length
+    outLenBeforeAccept = all.length
+    phase = 'prompt-accept'
+    log('HARNESS', 'MARK', '--- pasting command + Enter in one write (prompt-accept) ---')
+    ptyWrite(`${CHILD_CMD}\r`, 'paste command + Enter')
+  } else {
+    phase = 'type-command'
+    log('HARNESS', 'MARK', '--- typing child command (no Enter yet) ---')
+    ptyWrite(CHILD_CMD, 'type command')
+    await sleep(ACCEPT_DELAY_MS)
+
+    promptsBeforeAccept = countPrompts()
+    repliesBeforeAccept = replyCount
+    decisionsBeforeAccept = decisionEvents.length
+    outLenBeforeAccept = all.length
+
+    phase = 'prompt-accept'
+    log('HARNESS', 'MARK', '--- pressing Enter (prompt-accept -> tty handoff to child) ---')
+    ptyWrite('\r', 'Enter')
+  }
+  await sleep(1200)
+
+  const repliesDuringAccept = replyCount - repliesBeforeAccept
+  const decisionsDuringAccept = decisionEvents.length - decisionsBeforeAccept
+
+  phase = 'child-stdin'
+  log('HARNESS', 'MARK', '--- typing hello + Enter into the child ---')
+  ptyWrite('hello\r', 'child stdin')
+  await sleep(1500)
+
+  phase = 'teardown'
+  // python's repr renders ESC as the 4 literal chars \x1b, so match on the printed form.
+  const gotLine = (all.slice(outLenBeforeAccept).match(/GOT: '[^\r\n]*/) ?? [])[0] ?? null
+  log('HARNESS', 'RESULT GOT-line', gotLine === null ? '<none captured>' : `"${esc(gotLine)}"`)
+  const leaked = gotLine !== null && /\\x1b|\\033|\\u001b/.test(gotLine)
+  const leaked997 = gotLine !== null && gotLine.includes('997;1n')
+  log('HARNESS', 'RESULT leaked-escape-bytes-into-stdin', String(leaked))
+  log('HARNESS', 'RESULT leaked-CSI-997-1n-into-stdin', String(leaked997))
+  log(
+    'HARNESS',
+    'RESULT replies',
+    JSON.stringify({
+      total: replyCount,
+      duringPromptAccept: repliesDuringAccept,
+      decisionsDuringPromptAccept: decisionsDuringAccept,
+      staleReplies: staleReplyCount,
+      promptsBeforeAccept
+    })
+  )
+
+  ptyWrite('exit\r', 'exit')
+  await waitFor(() => exitInfo !== null, 3000, 'shell exit')
+  try {
+    term.kill()
+  } catch {}
+
+  if (EMIT_JSON) {
+    console.log(
+      `\n__JSON__${JSON.stringify({
+        delayMs: REPLY_DELAY_MS,
+        mode: TYPEAHEAD ? 'typeahead' : PASTE ? 'paste' : 'typed',
+        acceptDelayMs: ACCEPT_DELAY_MS,
+        promptCmd: PROMPT_CMD,
+        replyEnabled: REPLY_ENABLED,
+        userConfig: USE_USER_CONFIG,
+        answerProbes: ANSWER_PROBES,
+        gotLine,
+        leaked,
+        leaked997,
+        totalReplies: replyCount,
+        staleReplies: staleReplyCount,
+        repliesDuringPromptAccept: repliesDuringAccept,
+        decisions: decisionEvents,
+        replies: replyEvents
+      })}`
+    )
+  }
+} finally {
+  if (configHome) {
+    rmSync(configHome, { recursive: true, force: true })
+  }
+}
+
+process.exit(0)
diff --git a/tests/tools/google-signin-ua-probe.cjs b/tests/tools/google-signin-ua-probe.cjs
index 4fe50a2c122..7adf06bb7a0 100644
--- a/tests/tools/google-signin-ua-probe.cjs
+++ b/tests/tools/google-signin-ua-probe.cjs
@@ -9,13 +9,27 @@ const MODES = new Set([
   'electron-auth',
   'electron-fixed',
   'firefox-auth',
-  'firefox-fixed'
+  'firefox-fixed',
+  // Replicates the SHIPPED app exactly (setupClientHintsOverride +
+  // applyGoogleAuthUserAgent): Firefox UA is written to the WebContents on auth
+  // navs and to the request header only for auth-host URLs; every other request
+  // keeps whatever UA the WebContents carries. Logs incoming vs outgoing
+  // identity for ALL requests to expose cross-host mismatches during the flow.
+  'app-current',
+  // Same, but with the STA-3811 fix: the header layer strips client hints on any
+  // request already carrying the Firefox auth UA, regardless of destination host.
+  'app-fixed'
 ])
 const mode = process.argv.find((arg) => arg.startsWith('--mode='))?.slice('--mode='.length)
 if (!mode || !MODES.has(mode)) {
   throw new Error(`Expected --mode=${[...MODES].join('|')}`)
 }
 
+const headless = process.argv.includes('--headless')
+const exitAfterMs = Number(
+  process.argv.find((arg) => arg.startsWith('--exit-after-ms='))?.slice('--exit-after-ms='.length)
+)
+
 const profileRoot = mkdtempSync(join(tmpdir(), `orca-google-signin-${mode}-`))
 const partition = `persist:google-signin-${mode}`
 app.setPath('userData', profileRoot)
@@ -58,6 +72,30 @@ function safeUrl(rawUrl) {
   }
 }
 
+function hostOf(rawUrl) {
+  try {
+    return new URL(rawUrl).hostname.toLowerCase()
+  } catch {
+    return '<invalid>'
+  }
+}
+
+// A Firefox UA paired with any sec-ch-ua header is the cross-host tell we hunt:
+// real Firefox emits no client hints, so the two surfaces contradict each other.
+function detectUaHintMismatch(headers) {
+  const ua = headers['user-agent'] || ''
+  const isFirefox = /Firefox\/\d/.test(ua) && !/Chrome\//.test(ua)
+  const hasHints = Object.keys(headers).some((key) => key.startsWith('sec-ch-ua'))
+  if (isFirefox && hasHints) {
+    return 'firefox-ua-with-chrome-hints'
+  }
+  const isChrome = /Chrome\/\d/.test(ua)
+  if (isChrome && !hasHints) {
+    return 'chrome-ua-without-hints'
+  }
+  return null
+}
+
 function setHeader(headers, name, value) {
   const existing = Object.keys(headers).find((key) => key.toLowerCase() === name.toLowerCase())
   headers[existing ?? name] = value
@@ -126,8 +164,47 @@ app.whenReady().then(async () => {
   identities.cleaned = cleanElectronUserAgent(identities.native)
   browserSession.setUserAgent(identityForUrl('about:blank', identities))
 
+  const isAppMode = mode === 'app-current' || mode === 'app-fixed'
+
   browserSession.webRequest.onBeforeSendHeaders({ urls: ['https://*/*'] }, (details, callback) => {
     const headers = details.requestHeaders
+    const incoming = relevantHeaders(headers)
+
+    if (isAppMode) {
+      // Mirror setupClientHintsOverride: only auth-host URLs get the Firefox UA
+      // header + hint strip; every other request keeps its incoming UA (which is
+      // the WebContents UA — Firefox while the auth document is on screen).
+      if (isGoogleAuthUrl(details.url)) {
+        setHeader(headers, 'user-agent', identities.firefox)
+        removeClientHints(headers)
+      } else {
+        const currentUa = incoming['user-agent']
+        // STA-3811 fix: a request already carrying the Firefox auth UA came from
+        // the auth document; real Firefox sends no client hints, so strip them
+        // instead of rewriting to Chrome — keeping UA and hints one story.
+        if (mode === 'app-fixed' && currentUa === identities.firefox) {
+          removeClientHints(headers)
+        } else {
+          // Real setupClientHintsOverride builds Chrome hints once from the
+          // session's cleaned UA (a closure), never from the per-request UA.
+          applyChromeClientHints(headers, identities.cleaned)
+        }
+      }
+      const outgoing = relevantHeaders(headers)
+      const uaMismatch = detectUaHintMismatch(outgoing)
+      log('request', {
+        url: safeUrl(details.url),
+        host: hostOf(details.url),
+        resourceType: details.resourceType,
+        isAuthHost: isGoogleAuthUrl(details.url),
+        incoming,
+        outgoing,
+        uaHintMismatch: uaMismatch
+      })
+      callback({ requestHeaders: headers })
+      return
+    }
+
     const identity = identityForUrl(details.url, identities)
     setHeader(headers, 'user-agent', identity)
     if (identity === identities.firefox) {
@@ -144,8 +221,15 @@ app.whenReady().then(async () => {
     callback({ requestHeaders: headers })
   })
 
+  if (Number.isFinite(exitAfterMs) && exitAfterMs > 0) {
+    setTimeout(() => {
+      log('exit', { reason: 'timeout', exitAfterMs })
+      app.quit()
+    }, exitAfterMs)
+  }
+
   const window = new BrowserWindow({
-    show: true,
+    show: !headless,
     title: `Google sign-in UA probe: ${mode}`,
     width: 980,
     height: 840,
@@ -161,6 +245,24 @@ app.whenReady().then(async () => {
     if (!isMainFrame) {
       return
     }
+    if (isAppMode) {
+      // Mirror applyGoogleAuthUserAgent: Firefox UA on auth navs, restore the
+      // cleaned session UA otherwise. This WebContents UA is what leaks onto
+      // cross-host subresource requests while the auth document is on screen.
+      const current = window.webContents.getUserAgent()
+      if (isGoogleAuthUrl(url)) {
+        if (current !== identities.firefox) {
+          window.webContents.setUserAgent(identities.firefox)
+        }
+      } else if (current === identities.firefox) {
+        window.webContents.setUserAgent(identities.cleaned)
+      }
+      log('main-frame-navigation', {
+        url: safeUrl(url),
+        appliedUserAgent: window.webContents.getUserAgent()
+      })
+      return
+    }
     const identity = identityForUrl(url, identities)
     if (window.webContents.getUserAgent() !== identity) {
       window.webContents.setUserAgent(identity)
diff --git a/tests/tools/win-crash-survival-e2e/cli-args.mjs b/tests/tools/win-crash-survival-e2e/cli-args.mjs
index 2a289d7893e..e3533342e4d 100644
--- a/tests/tools/win-crash-survival-e2e/cli-args.mjs
+++ b/tests/tools/win-crash-survival-e2e/cli-args.mjs
@@ -119,7 +119,7 @@ function validateArgShape(argv) {
 
 function takeValue(argv, flag) {
   const idx = argv.indexOf(flag)
-  if (idx < 0) {
+  if (idx === -1) {
     return undefined
   }
   const value = argv[idx + 1]
diff --git a/tests/tools/win-update-e2e/cli-args.mjs b/tests/tools/win-update-e2e/cli-args.mjs
index 510bac5a899..d6310e8d159 100644
--- a/tests/tools/win-update-e2e/cli-args.mjs
+++ b/tests/tools/win-update-e2e/cli-args.mjs
@@ -190,7 +190,7 @@ function validate(opts, installDirFlagPresent) {
 
 function takeValue(argv, flag) {
   const idx = argv.indexOf(flag)
-  if (idx < 0) {
+  if (idx === -1) {
     return undefined
   }
   const value = argv[idx + 1]
diff --git a/tests/tools/win-update-e2e/daemon-processes.mjs b/tests/tools/win-update-e2e/daemon-processes.mjs
index f7d43cc9b44..d292c0f24b8 100644
--- a/tests/tools/win-update-e2e/daemon-processes.mjs
+++ b/tests/tools/win-update-e2e/daemon-processes.mjs
@@ -148,7 +148,7 @@ function normalizeArray(raw) {
 
 function parseUserDataArg(argv) {
   const idx = argv.indexOf('--user-data')
-  return idx >= 0 && argv[idx + 1] ? argv[idx + 1] : defaultUserDataDir()
+  return idx !== -1 && argv[idx + 1] ? argv[idx + 1] : defaultUserDataDir()
 }
 
 function runStandalone(argv) {
@@ -161,7 +161,7 @@ function runStandalone(argv) {
   console.log(JSON.stringify(pidFiles, null, 2))
 
   const scopeIdx = argv.indexOf('--scope')
-  const scope = scopeIdx >= 0 && argv[scopeIdx + 1] ? argv[scopeIdx + 1] : ''
+  const scope = scopeIdx !== -1 && argv[scopeIdx + 1] ? argv[scopeIdx + 1] : ''
   const processes = findDaemonProcesses(scope)
   console.log(
     `[daemon-processes] live daemon processes${scope ? ` scoped to "${scope}"` : ''} (${processes.length}):`